[ 139.676536][ T1340] ieee802154 phy0 wpan0: encryption failed: -22 [ 139.676623][ T1340] ieee802154 phy1 wpan1: encryption failed: -22 Warning: Permanently added '10.128.10.39' (ED25519) to the list of known hosts. [*] Starting reproducer... [+] Using driver dummy_udc and device dummy_udc.0 [+] Device dummy_udc.0 found. [ 140.079936][ T5938] Need at least one configuration in g1. [ 140.089054][ T5938] udc dummy_udc.0: failed to start g1: -22 [ 140.089104][ T5938] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 140.096182][ T5937] Need at least one configuration in g0. [ 140.096320][ T5937] udc dummy_udc.0: failed to start g0: -22 [ 140.096341][ T5937] configfs-gadget.g0 gadget.0: probe with driver configfs-gadget.g0 failed with error -22 [ 140.098552][ T5940] Need at least one configuration in g3. [ 140.098687][ T5940] udc dummy_udc.0: failed to start g3: -22 [ 140.098708][ T5940] configfs-gadget.g3 gadget.0: probe with driver configfs-gadget.g3 failed with error -22 [ 140.100467][ T5939] Need at least one configuration in g2. [ 140.100602][ T5939] udc dummy_udc.0: failed to start g2: -22 [ 140.100623][ T5939] configfs-gadget.g2 gadget.0: probe with driver configfs-gadget.g2 failed with error -22 [ 140.205188][ T5940] UDC core: g3: couldn't find an available UDC or it's busy [ 140.206027][ T5939] UDC core: g2: couldn't find an available UDC or it's busy [ 140.208859][ T5937] UDC core: g0: couldn't find an available UDC or it's busy [ 140.209807][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 140.306088][ T5939] UDC core: g2: couldn't find an available UDC or it's busy [ 140.329579][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 140.330188][ T5940] UDC core: g3: couldn't find an available UDC or it's busy [ 140.330727][ T5937] UDC core: g0: couldn't find an available UDC or it's busy [ 140.352777][ T5939] UDC core: g2: couldn't find an available UDC or it's busy [ 140.387914][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 140.388013][ T5937] UDC core: g0: couldn't find an available UDC or it's busy [ 140.388637][ T5939] UDC core: g2: couldn't find an available UDC or it's busy [ 140.390487][ T5940] UDC core: g3: couldn't find an available UDC or it's busy [ 140.414536][ T5937] UDC core: g0: couldn't find an available UDC or it's busy [ 140.421739][ T5939] UDC core: g2: couldn't find an available UDC or it's busy [ 140.430016][ T5940] UDC core: g3: couldn't find an available UDC or it's busy [ 140.430434][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 140.488863][ T5937] UDC core: g0: couldn't find an available UDC or it's busy [ 140.491111][ T5940] UDC core: g3: couldn't find an available UDC or it's busy [ 140.491581][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 140.491738][ T5939] UDC core: g2: couldn't find an available UDC or it's busy [ 140.512354][ T5937] UDC core: g0: couldn't find an available UDC or it's busy [ 140.514067][ T5940] UDC core: g3: couldn't find an available UDC or it's busy [ 140.514268][ T5939] UDC core: g2: couldn't find an available UDC or it's busy [ 140.514670][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 140.579327][ T5937] UDC core: g0: couldn't find an available UDC or it's busy [ 140.582883][ T5940] UDC core: g3: couldn't find an available UDC or it's busy [ 140.583521][ T5939] UDC core: g2: couldn't find an available UDC or it's busy [ 140.600017][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 140.610664][ T5937] UDC core: g0: couldn't find an available UDC or it's busy [ 140.614208][ T5939] UDC core: g2: couldn't find an available UDC or it's busy [ 140.632886][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 140.635979][ T5937] UDC core: g0: couldn't find an available UDC or it's busy [ 140.651840][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 140.652374][ T5940] UDC core: g3: couldn't find an available UDC or it's busy [ 140.652882][ T5939] UDC core: g2: couldn't find an available UDC or it's busy [ 140.662625][ T5937] UDC core: g0: couldn't find an available UDC or it's busy [ 140.668028][ T5940] UDC core: g3: couldn't find an available UDC or it's busy [ 140.668497][ T5939] UDC core: g2: couldn't find an available UDC or it's busy [ 140.669185][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 140.689640][ T5937] UDC core: g0: couldn't find an available UDC or it's busy [ 140.691900][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 140.722397][ T5939] UDC core: g2: couldn't find an available UDC or it's busy [ 140.723043][ T5940] UDC core: g3: couldn't find an available UDC or it's busy [ 140.725902][ T5937] UDC core: g0: couldn't find an available UDC or it's busy [ 140.728021][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 140.732994][ T5939] UDC core: g2: couldn't find an available UDC or it's busy [ 140.744823][ T5937] UDC core: g0: couldn't find an available UDC or it's busy [ 140.745043][ T5940] UDC core: g3: couldn't find an available UDC or it's busy [ 140.745305][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 140.751362][ T5939] UDC core: g2: couldn't find an available UDC or it's busy [ 140.770212][ T5937] UDC core: g0: couldn't find an available UDC or it's busy [ 140.770491][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 140.781826][ T5939] UDC core: g2: couldn't find an available UDC or it's busy [ 140.789527][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 140.791782][ T5937] UDC core: g0: couldn't find an available UDC or it's busy [ 140.795044][ T5940] UDC core: g3: couldn't find an available UDC or it's busy [ 140.801562][ T5939] UDC core: g2: couldn't find an available UDC or it's busy [ 140.827228][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 140.827880][ T5937] UDC core: g0: couldn't find an available UDC or it's busy [ 140.838442][ T5940] UDC core: g3: couldn't find an available UDC or it's busy [ 140.868824][ T5939] UDC core: g2: couldn't find an available UDC or it's busy [ 140.869410][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 140.869922][ T5937] UDC core: g0: couldn't find an available UDC or it's busy [ 140.882575][ T5939] UDC core: g2: couldn't find an available UDC or it's busy [ 140.883393][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 140.929277][ T5940] UDC core: g3: couldn't find an available UDC or it's busy [ 140.929652][ T5937] UDC core: g0: couldn't find an available UDC or it's busy [ 140.958887][ T5936] Need at least one configuration in g1. [ 140.959308][ T5936] udc dummy_udc.0: failed to start g1: -22 [ 140.959332][ T5936] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 140.960135][ T5936] Need at least one configuration in g2. [ 140.961326][ T5936] udc dummy_udc.0: failed to start g2: -22 [ 140.961350][ T5936] configfs-gadget.g2 gadget.0: probe with driver configfs-gadget.g2 failed with error -22 [ 140.983996][ T5936] Need at least one configuration in g3. [ 140.984141][ T5936] udc dummy_udc.0: failed to start g3: -22 [ 140.984171][ T5936] configfs-gadget.g3 gadget.0: probe with driver configfs-gadget.g3 failed with error -22 [ 140.984665][ T5936] Need at least one configuration in g0. [ 140.996752][ T5936] udc dummy_udc.0: failed to start g0: -22 [ 140.996780][ T5936] configfs-gadget.g0 gadget.0: probe with driver configfs-gadget.g0 failed with error -22 [ 141.001493][ T5938] Need at least one configuration in g1. [ 141.001624][ T5938] udc dummy_udc.0: failed to start g1: -22 [ 141.001644][ T5938] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 141.009412][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 141.021938][ T5939] Need at least one configuration in g2. [ 141.022058][ T5939] udc dummy_udc.0: failed to start g2: -22 [ 141.022079][ T5939] configfs-gadget.g2 gadget.0: probe with driver configfs-gadget.g2 failed with error -22 [ 141.025781][ T5939] UDC core: g2: couldn't find an available UDC or it's busy [ 141.039022][ T5940] Need at least one configuration in g3. [ 141.039951][ T5940] udc dummy_udc.0: failed to start g3: -22 [ 141.039981][ T5940] configfs-gadget.g3 gadget.0: probe with driver configfs-gadget.g3 failed with error -22 [ 141.040436][ T5937] Need at least one configuration in g0. [ 141.040547][ T5937] udc dummy_udc.0: failed to start g0: -22 [ 141.040564][ T5937] configfs-gadget.g0 gadget.0: probe with driver configfs-gadget.g0 failed with error -22 [ 141.041375][ T5937] UDC core: g0: couldn't find an available UDC or it's busy [ 141.047889][ T5938] Need at least one configuration in g1. [ 141.048035][ T5938] udc dummy_udc.0: failed to start g1: -22 [ 141.048054][ T5938] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 141.048870][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 141.056796][ T5940] UDC core: g3: couldn't find an available UDC or it's busy [ 141.080081][ T5939] UDC core: g2: couldn't find an available UDC or it's busy [ 141.080293][ T5937] UDC core: g0: couldn't find an available UDC or it's busy [ 141.080491][ T5940] UDC core: g3: couldn't find an available UDC or it's busy [ 141.080684][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 141.102062][ T5939] UDC core: g2: couldn't find an available UDC or it's busy [ 141.102737][ T5937] UDC core: g0: couldn't find an available UDC or it's busy [ 141.104761][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 141.109280][ T5940] UDC core: g3: couldn't find an available UDC or it's busy [ 141.131729][ T5939] UDC core: g2: couldn't find an available UDC or it's busy [ 141.132547][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 141.139966][ T5940] UDC core: g3: couldn't find an available UDC or it's busy [ 141.140162][ T5937] UDC core: g0: couldn't find an available UDC or it's busy [ 141.162544][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 141.164770][ T5939] UDC core: g2: couldn't find an available UDC or it's busy [ 141.166986][ T5937] UDC core: g0: couldn't find an available UDC or it's busy [ 141.167323][ T5940] UDC core: g3: couldn't find an available UDC or it's busy [ 141.186153][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 141.190824][ T5937] UDC core: g0: couldn't find an available UDC or it's busy [ 141.195131][ T5939] UDC core: g2: couldn't find an available UDC or it's busy [ 141.199203][ T5940] UDC core: g3: couldn't find an available UDC or it's busy [ 141.220921][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 141.221450][ T5937] UDC core: g0: couldn't find an available UDC or it's busy [ 141.221944][ T5939] UDC core: g2: couldn't find an available UDC or it's busy [ 141.225972][ T5940] UDC core: g3: couldn't find an available UDC or it's busy [ 141.244557][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 141.245264][ T5939] UDC core: g2: couldn't find an available UDC or it's busy [ 141.290970][ T5940] UDC core: g3: couldn't find an available UDC or it's busy [ 141.296689][ T5937] UDC core: g0: couldn't find an available UDC or it's busy [ 141.297539][ T5939] UDC core: g2: couldn't find an available UDC or it's busy [ 141.299573][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 141.316188][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 141.330334][ T5939] UDC core: g2: couldn't find an available UDC or it's busy [ 141.331875][ T5937] UDC core: g0: couldn't find an available UDC or it's busy [ 141.346458][ T5940] UDC core: g3: couldn't find an available UDC or it's busy [ 141.369402][ T5936] Need at least one configuration in g3. [ 141.369939][ T5938] UDC core: g1: couldn't find an available UDC or it's busy [ 141.386774][ T5936] udc dummy_udc.0: failed to start g3: -22 [ 141.386803][ T5936] configfs-gadget.g3 gadget.0: probe with driver configfs-gadget.g3 failed with error -22 [ 141.396209][ T5939] UDC core: g2: couldn't find an available UDC or it's busy [ 141.435271][ T5936] ================================================================== [ 141.435291][ T5936] BUG: KASAN: slab-use-after-free in klist_dec_and_del+0x386/0x3d0 [ 141.435332][ T5936] Write of size 8 at addr ffff88803fe920e0 by task syz-executor321/5936 [ 141.435348][ T5936] [ 141.435373][ T5936] CPU: 1 UID: 0 PID: 5936 Comm: syz-executor321 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 141.435397][ T5936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 141.435416][ T5936] Call Trace: [ 141.435424][ T5936] [ 141.435433][ T5936] dump_stack_lvl+0xe8/0x150 [ 141.435461][ T5936] print_address_description+0x55/0x1e0 [ 141.435492][ T5936] ? klist_dec_and_del+0x386/0x3d0 [ 141.435511][ T5936] print_report+0x58/0x70 [ 141.435534][ T5936] kasan_report+0x117/0x150 [ 141.435555][ T5936] ? klist_dec_and_del+0x386/0x3d0 [ 141.435579][ T5936] klist_dec_and_del+0x386/0x3d0 [ 141.435602][ T5936] klist_next+0xc3/0x2f0 [ 141.435625][ T5936] bus_for_each_drv+0x268/0x2f0 [ 141.435648][ T5936] ? __pfx___device_attach_driver+0x10/0x10 [ 141.435664][ T5936] ? __pfx_bus_for_each_drv+0x10/0x10 [ 141.435685][ T5936] ? rt_spin_unlock+0x163/0x200 [ 141.435719][ T5936] __device_attach+0x2c7/0x450 [ 141.435734][ T5936] ? rt_spin_unlock+0x157/0x200 [ 141.435758][ T5936] ? __pfx___device_attach+0x10/0x10 [ 141.435777][ T5936] device_initial_probe+0xa1/0xd0 [ 141.435794][ T5936] bus_probe_device+0x12d/0x220 [ 141.435816][ T5936] device_add+0x7d7/0xb80 [ 141.435842][ T5936] usb_add_gadget+0x47d/0x700 [ 141.435861][ T5936] ? __pfx_usb_udc_nop_release+0x10/0x10 [ 141.435888][ T5936] usb_add_gadget_udc_release+0x1a4/0x1f0 [ 141.435907][ T5936] dummy_udc_probe+0x6e1/0x7e0 [ 141.435933][ T5936] ? __pfx_dummy_udc_probe+0x10/0x10 [ 141.435956][ T5936] platform_probe+0xf9/0x190 [ 141.435981][ T5936] ? __pfx_platform_probe+0x10/0x10 [ 141.436004][ T5936] really_probe+0x254/0xae0 [ 141.436022][ T5936] __driver_probe_device+0x1e8/0x360 [ 141.436040][ T5936] device_driver_attach+0xe0/0x1d0 [ 141.436057][ T5936] bind_store+0x1d3/0x220 [ 141.436082][ T5936] ? __pfx_sysfs_kf_write+0x10/0x10 [ 141.436098][ T5936] kernfs_fop_write_iter+0x3a5/0x540 [ 141.436124][ T5936] vfs_write+0x61e/0xbb0 [ 141.436149][ T5936] ? __pfx_vfs_write+0x10/0x10 [ 141.436171][ T5936] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 141.436189][ T5936] ? lockdep_hardirqs_on+0x7a/0x110 [ 141.436207][ T5936] ? mutex_lock_nested+0x152/0x1d0 [ 141.436229][ T5936] ? fdget_pos+0x252/0x320 [ 141.436250][ T5936] ksys_write+0x156/0x270 [ 141.436272][ T5936] ? __pfx_ksys_write+0x10/0x10 [ 141.436296][ T5936] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 141.436315][ T5936] do_syscall_64+0x174/0x580 [ 141.436333][ T5936] ? trace_irq_disable+0x3b/0x140 [ 141.436350][ T5936] ? clear_bhb_loop+0x70/0xc0 [ 141.436368][ T5936] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 141.436386][ T5936] RIP: 0033:0x7f453d1641de [ 141.436409][ T5936] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08 [ 141.436424][ T5936] RSP: 002b:00007f453d106f98 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 141.436452][ T5936] RAX: ffffffffffffffda RBX: 00007f453d1076c0 RCX: 00007f453d1641de [ 141.436466][ T5936] RDX: 000000000000000b RSI: 00007f453d1ad1b9 RDI: 0000000000000003 [ 141.436477][ T5936] RBP: 0000000000000005 R08: 0000000000000000 R09: 0000000000000000 [ 141.436487][ T5936] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 141.436498][ T5936] R13: 0000000000000010 R14: 00007ffca4345660 R15: 00007ffca4345748 [ 141.436517][ T5936] [ 141.436524][ T5936] [ 141.436528][ T5936] Allocated by task 5940: [ 141.436536][ T5936] kasan_save_track+0x3e/0x80 [ 141.436553][ T5936] __kasan_kmalloc+0x93/0xb0 [ 141.436569][ T5936] __kmalloc_cache_noprof+0x3d2/0x6b0 [ 141.436587][ T5936] bus_add_driver+0x165/0x670 [ 141.436605][ T5936] driver_register+0x23a/0x320 [ 141.436621][ T5936] usb_gadget_register_driver_owner+0xf9/0x270 [ 141.436638][ T5936] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 141.436655][ T5936] configfs_write_iter+0x33a/0x430 [ 141.436673][ T5936] vfs_write+0x61e/0xbb0 [ 141.436691][ T5936] ksys_write+0x156/0x270 [ 141.436716][ T5936] do_syscall_64+0x174/0x580 [ 141.436732][ T5936] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 141.436747][ T5936] [ 141.436751][ T5936] Freed by task 5940: [ 141.436759][ T5936] kasan_save_track+0x3e/0x80 [ 141.436774][ T5936] kasan_save_free_info+0x40/0x50 [ 141.436795][ T5936] __kasan_slab_free+0x5c/0x80 [ 141.436811][ T5936] kfree+0x1c5/0x6c0 [ 141.436824][ T5936] kobject_put+0x222/0x550 [ 141.436843][ T5936] bus_remove_driver+0x248/0x320 [ 141.436862][ T5936] usb_gadget_register_driver_owner+0x223/0x270 [ 141.436878][ T5936] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 141.436894][ T5936] configfs_write_iter+0x33a/0x430 [ 141.436912][ T5936] vfs_write+0x61e/0xbb0 [ 141.436930][ T5936] ksys_write+0x156/0x270 [ 141.436949][ T5936] do_syscall_64+0x174/0x580 [ 141.436965][ T5936] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 141.436981][ T5936] [ 141.436984][ T5936] The buggy address belongs to the object at ffff88803fe92000 [ 141.436984][ T5936] which belongs to the cache kmalloc-512 of size 512 [ 141.436999][ T5936] The buggy address is located 224 bytes inside of [ 141.436999][ T5936] freed 512-byte region [ffff88803fe92000, ffff88803fe92200) [ 141.437017][ T5936] [ 141.437021][ T5936] The buggy address belongs to the physical page: [ 141.437043][ T5936] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3fe90 [ 141.437060][ T5936] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 141.437074][ T5936] flags: 0x80000000000040(head|node=0|zone=1) [ 141.437092][ T5936] page_type: f5(slab) [ 141.437108][ T5936] raw: 0080000000000040 ffff88813ffb3c80 dead000000000100 dead000000000122 [ 141.437123][ T5936] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 141.437140][ T5936] head: 0080000000000040 ffff88813ffb3c80 dead000000000100 dead000000000122 [ 141.437154][ T5936] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 141.437170][ T5936] head: 0080000000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff [ 141.437185][ T5936] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000004 [ 141.437193][ T5936] page dumped because: kasan: bad access detected [ 141.437205][ T5936] page_owner tracks the page as allocated [ 141.437212][ T5936] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5633, tgid 5633 (syz-executor), ts 102640041714, free_ts 80262861649 [ 141.437243][ T5936] post_alloc_hook+0x1f9/0x250 [ 141.437258][ T5936] get_page_from_freelist+0x262a/0x26a0 [ 141.437277][ T5936] __alloc_frozen_pages_noprof+0x18d/0x380 [ 141.437295][ T5936] allocate_slab+0x79/0x5e0 [ 141.437316][ T5936] refill_objects+0x2d8/0x350 [ 141.437338][ T5936] __pcs_replace_empty_main+0x330/0x690 [ 141.437359][ T5936] __kmalloc_cache_noprof+0x468/0x6b0 [ 141.437375][ T5936] __ipv6_dev_mc_inc+0x447/0xa40 [ 141.437396][ T5936] ipv6_add_dev+0xe83/0x1400 [ 141.437416][ T5936] addrconf_notify+0x771/0x1050 [ 141.437431][ T5936] notifier_call_chain+0x1a5/0x3d0 [ 141.437454][ T5936] register_netdevice+0x18c0/0x1ed0 [ 141.437478][ T5936] __ip_tunnel_create+0x3e8/0x550 [ 141.437499][ T5936] ip_tunnel_init_net+0x2e5/0x820 [ 141.437519][ T5936] ops_init+0x35d/0x5d0 [ 141.437538][ T5936] setup_net+0x118/0x350 [ 141.437556][ T5936] page last free pid 5564 tgid 5564 stack trace: [ 141.437565][ T5936] __free_frozen_pages+0x10e7/0x11c0 [ 141.437581][ T5936] __slab_free+0x252/0x2a0 [ 141.437597][ T5936] qlist_free_all+0x99/0x100 [ 141.437611][ T5936] kasan_quarantine_reduce+0x148/0x160 [ 141.437626][ T5936] __kasan_slab_alloc+0x22/0x80 [ 141.437641][ T5936] __kmalloc_cache_noprof+0x351/0x6b0 [ 141.437658][ T5936] single_open+0x5a/0x240 [ 141.437681][ T5936] do_dentry_open+0x849/0x1420 [ 141.437695][ T5936] vfs_open+0x3b/0x350 [ 141.437714][ T5936] path_openat+0x2e60/0x3850 [ 141.437733][ T5936] do_file_open+0x23e/0x4a0 [ 141.437752][ T5936] do_sys_openat2+0x115/0x200 [ 141.437766][ T5936] __x64_sys_openat+0x138/0x170 [ 141.437782][ T5936] do_syscall_64+0x174/0x580 [ 141.437798][ T5936] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 141.437813][ T5936] [ 141.437817][ T5936] Memory state around the buggy address: [ 141.437825][ T5936] ffff88803fe91f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 141.437837][ T5936] ffff88803fe92000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 141.437848][ T5936] >ffff88803fe92080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 141.437857][ T5936] ^ [ 141.437866][ T5936] ffff88803fe92100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 141.437878][ T5936] ffff88803fe92180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 141.437886][ T5936] ================================================================== [ 141.438086][ T5936] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 141.438100][ T5936] CPU: 1 UID: 0 PID: 5936 Comm: syz-executor321 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 141.438120][ T5936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 141.438130][ T5936] Call Trace: [ 141.438137][ T5936] [ 141.438144][ T5936] vpanic+0x56c/0xa60 [ 141.438163][ T5936] ? __pfx_vpanic+0x10/0x10 [ 141.438179][ T5936] ? __pfx___schedule+0x10/0x10 [ 141.438198][ T5936] panic+0xc5/0xd0 [ 141.438213][ T5936] ? __pfx_panic+0x10/0x10 [ 141.438230][ T5936] ? preempt_schedule_thunk+0x16/0x40 [ 141.438255][ T5936] ? klist_dec_and_del+0x386/0x3d0 [ 141.438276][ T5936] check_panic_on_warn+0x89/0xb0 [ 141.438293][ T5936] ? klist_dec_and_del+0x386/0x3d0 [ 141.438313][ T5936] end_report+0x73/0x170 [ 141.438332][ T5936] ? klist_dec_and_del+0x386/0x3d0 [ 141.438351][ T5936] kasan_report+0x128/0x150 [ 141.438371][ T5936] ? klist_dec_and_del+0x386/0x3d0 [ 141.438395][ T5936] klist_dec_and_del+0x386/0x3d0 [ 141.438417][ T5936] klist_next+0xc3/0x2f0 [ 141.438440][ T5936] bus_for_each_drv+0x268/0x2f0 [ 141.438461][ T5936] ? __pfx___device_attach_driver+0x10/0x10 [ 141.438479][ T5936] ? __pfx_bus_for_each_drv+0x10/0x10 [ 141.438500][ T5936] ? rt_spin_unlock+0x163/0x200 [ 141.438526][ T5936] __device_attach+0x2c7/0x450 [ 141.438541][ T5936] ? rt_spin_unlock+0x157/0x200 [ 141.438564][ T5936] ? __pfx___device_attach+0x10/0x10 [ 141.438583][ T5936] device_initial_probe+0xa1/0xd0 [ 141.438600][ T5936] bus_probe_device+0x12d/0x220 [ 141.438622][ T5936] device_add+0x7d7/0xb80 [ 141.438647][ T5936] usb_add_gadget+0x47d/0x700 [ 141.438664][ T5936] ? __pfx_usb_udc_nop_release+0x10/0x10 [ 141.438690][ T5936] usb_add_gadget_udc_release+0x1a4/0x1f0 [ 141.438715][ T5936] dummy_udc_probe+0x6e1/0x7e0 [ 141.438741][ T5936] ? __pfx_dummy_udc_probe+0x10/0x10 [ 141.438763][ T5936] platform_probe+0xf9/0x190 [ 141.438787][ T5936] ? __pfx_platform_probe+0x10/0x10 [ 141.438809][ T5936] really_probe+0x254/0xae0 [ 141.438828][ T5936] __driver_probe_device+0x1e8/0x360 [ 141.438846][ T5936] device_driver_attach+0xe0/0x1d0 [ 141.438861][ T5936] bind_store+0x1d3/0x220 [ 141.438882][ T5936] ? __pfx_sysfs_kf_write+0x10/0x10 [ 141.438896][ T5936] kernfs_fop_write_iter+0x3a5/0x540 [ 141.438918][ T5936] vfs_write+0x61e/0xbb0 [ 141.438938][ T5936] ? __pfx_vfs_write+0x10/0x10 [ 141.438950][ T5936] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 141.438960][ T5936] ? lockdep_hardirqs_on+0x7a/0x110 [ 141.438970][ T5936] ? mutex_lock_nested+0x152/0x1d0 [ 141.438982][ T5936] ? fdget_pos+0x252/0x320 [ 141.438993][ T5936] ksys_write+0x156/0x270 [ 141.439005][ T5936] ? __pfx_ksys_write+0x10/0x10 [ 141.439018][ T5936] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 141.439028][ T5936] do_syscall_64+0x174/0x580 [ 141.439038][ T5936] ? trace_irq_disable+0x3b/0x140 [ 141.439047][ T5936] ? clear_bhb_loop+0x70/0xc0 [ 141.439058][ T5936] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 141.439066][ T5936] RIP: 0033:0x7f453d1641de [ 141.439076][ T5936] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08 [ 141.439083][ T5936] RSP: 002b:00007f453d106f98 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 141.439094][ T5936] RAX: ffffffffffffffda RBX: 00007f453d1076c0 RCX: 00007f453d1641de [ 141.439101][ T5936] RDX: 000000000000000b RSI: 00007f453d1ad1b9 RDI: 0000000000000003 [ 141.439107][ T5936] RBP: 0000000000000005 R08: 0000000000000000 R09: 0000000000000000 [ 141.439112][ T5936] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 141.439118][ T5936] R13: 0000000000000010 R14: 00007ffca4345660 R15: 00007ffca4345748 [ 141.439128][ T5936] [ 141.439648][ T5936] Kernel Offset: disabled