Warning: Permanently added '[localhost]:58492' (ED25519) to the list of known hosts.
2026/01/11 05:09:24 parsed 1 programs
syzkaller login: [ 87.901258][ T5322] cgroup: Unknown subsys name 'net'
[ 87.973399][ T5322] cgroup: Unknown subsys name 'cpuset'
[ 87.978728][ T5322] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 89.727154][ T5322] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 95.225922][ T5340] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 97.001433][ T10] cfg80211: failed to load regulatory.db
[ 99.670707][ T5385] chnl_net:caif_netlink_parms(): no params data found
[ 99.836400][ T5385] bridge0: port 1(bridge_slave_0) entered blocking state
[ 99.849577][ T5385] bridge0: port 1(bridge_slave_0) entered disabled state
[ 99.853209][ T5385] bridge_slave_0: entered allmulticast mode
[ 99.861279][ T5385] bridge_slave_0: entered promiscuous mode
[ 99.872137][ T5385] bridge0: port 2(bridge_slave_1) entered blocking state
[ 99.875310][ T5385] bridge0: port 2(bridge_slave_1) entered disabled state
[ 99.878549][ T5385] bridge_slave_1: entered allmulticast mode
[ 99.891513][ T5385] bridge_slave_1: entered promiscuous mode
[ 99.942671][ T5385] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 99.962532][ T5385] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 100.007664][ T5385] team0: Port device team_slave_0 added
[ 100.021758][ T5385] team0: Port device team_slave_1 added
[ 100.056671][ T5385] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 100.060407][ T5385] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 100.072737][ T5385] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 100.080346][ T5385] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 100.083361][ T5385] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 100.094688][ T5385] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 100.130326][ T5385] hsr_slave_0: entered promiscuous mode
[ 100.133589][ T5385] hsr_slave_1: entered promiscuous mode
[ 100.278551][ T5385] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 100.288714][ T5385] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 100.296094][ T5385] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 100.304180][ T5385] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 100.387306][ T5385] 8021q: adding VLAN 0 to HW filter on device bond0
[ 100.403642][ T5385] 8021q: adding VLAN 0 to HW filter on device team0
[ 100.412448][ T43] bridge0: port 1(bridge_slave_0) entered blocking state
[ 100.415677][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 100.426263][ T13] bridge0: port 2(bridge_slave_1) entered blocking state
[ 100.429587][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 100.604651][ T5385] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 100.638834][ T5385] veth0_vlan: entered promiscuous mode
[ 100.646887][ T5385] veth1_vlan: entered promiscuous mode
[ 100.675369][ T5385] veth0_macvtap: entered promiscuous mode
[ 100.682758][ T5385] veth1_macvtap: entered promiscuous mode
[ 100.696487][ T5385] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 100.710082][ T5385] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 100.720164][ T4584] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 100.733569][ T4584] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 100.737366][ T4584] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 100.749931][ T4584] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 100.917814][ T43] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 100.987049][ T43] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 101.031525][ T43] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 101.181153][ T43] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 102.013745][ T4680] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 102.017712][ T4680] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 102.021601][ T4680] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 102.029577][ T4680] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 102.032817][ T4680] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 102.540264][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 102.543632][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 102.601201][ T4584] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 102.604755][ T4584] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
2026/01/11 05:09:41 executed programs: 0
[ 103.301357][ T46] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 103.305333][ T46] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 103.308832][ T46] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 103.314405][ T46] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 103.317898][ T46] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 103.562987][ T43] bridge_slave_1: left allmulticast mode
[ 103.565693][ T43] bridge_slave_1: left promiscuous mode
[ 103.568881][ T43] bridge0: port 2(bridge_slave_1) entered disabled state
[ 103.591760][ T43] bridge_slave_0: left allmulticast mode
[ 103.594314][ T43] bridge_slave_0: left promiscuous mode
[ 103.596723][ T43] bridge0: port 1(bridge_slave_0) entered disabled state
[ 103.961548][ T43] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 103.967600][ T43] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 103.972588][ T43] bond0 (unregistering): Released all slaves
[ 104.089540][ T43] hsr_slave_0: left promiscuous mode
[ 104.094055][ T43] hsr_slave_1: left promiscuous mode
[ 104.100237][ T43] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 104.103352][ T43] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 104.118677][ T43] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 104.130026][ T43] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 104.155340][ T43] veth1_macvtap: left promiscuous mode
[ 104.158055][ T43] veth0_macvtap: left promiscuous mode
[ 104.170702][ T43] veth1_vlan: left promiscuous mode
[ 104.174012][ T43] veth0_vlan: left promiscuous mode
[ 104.641459][ T43] team0 (unregistering): Port device team_slave_1 removed
[ 104.671194][ T43] team0 (unregistering): Port device team_slave_0 removed
[ 104.936091][ T5437] chnl_net:caif_netlink_parms(): no params data found
[ 105.161940][ T5437] bridge0: port 1(bridge_slave_0) entered blocking state
[ 105.165226][ T5437] bridge0: port 1(bridge_slave_0) entered disabled state
[ 105.168992][ T5437] bridge_slave_0: entered allmulticast mode
[ 105.204580][ T5437] bridge_slave_0: entered promiscuous mode
[ 105.209726][ T5437] bridge0: port 2(bridge_slave_1) entered blocking state
[ 105.213492][ T5437] bridge0: port 2(bridge_slave_1) entered disabled state
[ 105.216753][ T5437] bridge_slave_1: entered allmulticast mode
[ 105.231377][ T5437] bridge_slave_1: entered promiscuous mode
[ 105.296497][ T5437] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 105.318499][ T5437] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 105.370897][ T46] Bluetooth: hci0: command tx timeout
[ 105.565536][ T5437] team0: Port device team_slave_0 added
[ 105.574764][ T5437] team0: Port device team_slave_1 added
[ 105.649562][ T5437] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 105.655227][ T5437] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 105.700131][ T5437] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 105.787258][ T5437] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 105.809311][ T5437] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 105.853815][ T5437] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 106.004674][ T5437] hsr_slave_0: entered promiscuous mode
[ 106.008272][ T5437] hsr_slave_1: entered promiscuous mode
[ 106.701050][ T5437] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 106.711872][ T5437] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 106.726857][ T5437] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 106.742809][ T5437] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 106.883680][ T5437] 8021q: adding VLAN 0 to HW filter on device bond0
[ 106.907550][ T5437] 8021q: adding VLAN 0 to HW filter on device team0
[ 106.938562][ T43] bridge0: port 1(bridge_slave_0) entered blocking state
[ 106.941915][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 106.976376][ T2670] bridge0: port 2(bridge_slave_1) entered blocking state
[ 106.979539][ T2670] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 107.344446][ T5437] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 107.421855][ T5437] veth0_vlan: entered promiscuous mode
[ 107.439872][ T5437] veth1_vlan: entered promiscuous mode
[ 107.451986][ T46] Bluetooth: hci0: command tx timeout
[ 107.502785][ T5437] veth0_macvtap: entered promiscuous mode
[ 107.520062][ T5437] veth1_macvtap: entered promiscuous mode
[ 107.550237][ T5437] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 107.571056][ T5437] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 107.607858][ T2670] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 107.631461][ T2670] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 107.635062][ T2670] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 107.638708][ T2670] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 107.728990][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 107.747560][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 107.793836][ T2670] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 107.797264][ T2670] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 108.329472][ T9] usb 5-1: new full-speed USB device number 2 using dummy_hcd
[ 108.494597][ T9] usb 5-1: config 0 interface 0 has no altsetting 0
[ 108.501363][ T9] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b
[ 108.505478][ T9] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2
[ 108.509001][ T9] usb 5-1: Product: syz
[ 108.511456][ T9] usb 5-1: Manufacturer: syz
[ 108.513529][ T9] usb 5-1: SerialNumber: syz
[ 108.525294][ T9] usb 5-1: config 0 descriptor??
[ 108.536531][ T9] usb 5-1: selecting invalid altsetting 0
[ 108.738420][ T5506] ==================================================================
[ 108.741933][ T5506] BUG: KASAN: slab-out-of-bounds in copy_to_urb+0x261/0x460
[ 108.745298][ T5506] Write of size 264 at addr ffff88804337e800 by task syz.0.17/5506
[ 108.749191][ T5506]
[ 108.750186][ T5506] CPU: 0 UID: 0 PID: 5506 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 108.750201][ T5506] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 108.750208][ T5506] Call Trace:
[ 108.750216][ T5506]
[ 108.750221][ T5506] dump_stack_lvl+0xe8/0x150
[ 108.750238][ T5506] print_report+0xca/0x240
[ 108.750250][ T5506] ? copy_to_urb+0x261/0x460
[ 108.750259][ T5506] kasan_report+0x118/0x150
[ 108.750334][ T5506] ? copy_to_urb+0x261/0x460
[ 108.750344][ T5506] kasan_check_range+0x2b0/0x2c0
[ 108.750352][ T5506] ? copy_to_urb+0x261/0x460
[ 108.750358][ T5506] __asan_memcpy+0x40/0x70
[ 108.750367][ T5506] copy_to_urb+0x261/0x460
[ 108.750375][ T5506] prepare_playback_urb+0x953/0x13d0
[ 108.750385][ T5506] ? __pfx_prepare_playback_urb+0x10/0x10
[ 108.750391][ T5506] ? unwind_next_frame+0xa5/0x23d0
[ 108.750401][ T5506] ? rcu_is_watching+0x15/0xb0
[ 108.750412][ T5506] ? __kasan_check_byte+0x12/0x40
[ 108.750421][ T5506] ? is_bpf_text_address+0x26/0x2b0
[ 108.750436][ T5506] ? __pfx_prepare_playback_urb+0x10/0x10
[ 108.750445][ T5506] prepare_outbound_urb+0x377/0xc50
[ 108.750458][ T5506] ? check_noncircular+0xda/0x150
[ 108.750469][ T5506] ? _copy_from_iter+0xb2c/0x1630
[ 108.750483][ T5506] ? __asan_memcpy+0x40/0x70
[ 108.750495][ T5506] ? __pfx_prepare_outbound_urb+0x10/0x10
[ 108.750505][ T5506] ? _copy_from_iter+0x11eb/0x1630
[ 108.750518][ T5506] ? snd_usb_endpoint_start_quirk+0x1f7/0x320
[ 108.750533][ T5506] snd_usb_endpoint_start+0x4db/0x1530
[ 108.750548][ T5506] ? __pfx_snd_usb_endpoint_start+0x10/0x10
[ 108.750560][ T5506] start_endpoints+0xa1/0x280
[ 108.750569][ T5506] ? snd_usb_substream_playback_trigger+0x3ce/0x830
[ 108.750585][ T5506] snd_usb_substream_playback_trigger+0x3e0/0x830
[ 108.750601][ T5506] snd_pcm_do_start+0xb7/0x180
[ 108.750614][ T5506] snd_pcm_action+0xe7/0x240
[ 108.750623][ T5506] __snd_pcm_lib_xfer+0x1762/0x1d00
[ 108.750638][ T5506] ? __pfx_interleaved_copy+0x10/0x10
[ 108.750650][ T5506] ? __pfx_default_write_copy+0x10/0x10
[ 108.750664][ T5506] ? __pfx___snd_pcm_lib_xfer+0x10/0x10
[ 108.750679][ T5506] snd_pcm_oss_write3+0x1bc/0x350
[ 108.750692][ T5506] snd_pcm_plug_write_transfer+0x2cb/0x4c0
[ 108.750708][ T5506] ? __pfx_snd_pcm_plug_write_transfer+0x10/0x10
[ 108.750722][ T5506] ? snd_pcm_plug_client_channels_buf+0x490/0x640
[ 108.750737][ T5506] snd_pcm_oss_write+0xa2b/0xf20
[ 108.750753][ T5506] ? __pfx_snd_pcm_oss_write+0x10/0x10
[ 108.750763][ T5506] ? bpf_lsm_file_permission+0x9/0x20
[ 108.750775][ T5506] ? security_file_permission+0x75/0x290
[ 108.750784][ T5506] ? rw_verify_area+0x255/0x4d0
[ 108.750793][ T5506] ? __pfx_snd_pcm_oss_write+0x10/0x10
[ 108.750800][ T5506] vfs_write+0x27e/0xb30
[ 108.750813][ T5506] ? __pfx_vfs_write+0x10/0x10
[ 108.750824][ T5506] ? __pfx_do_futex+0x10/0x10
[ 108.750835][ T5506] ? kmem_cache_free+0x197/0x620
[ 108.750848][ T5506] ? do_sys_openat2+0x15a/0x200
[ 108.750861][ T5506] ksys_write+0x145/0x250
[ 108.750880][ T5506] ? __pfx_ksys_write+0x10/0x10
[ 108.750895][ T5506] do_syscall_64+0xec/0xf80
[ 108.750943][ T5506] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 108.750953][ T5506] ? clear_bhb_loop+0x60/0xb0
[ 108.750965][ T5506] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 108.750975][ T5506] RIP: 0033:0x7f8ffad8f7c9
[ 108.750987][ T5506] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 108.750996][ T5506] RSP: 002b:00007ffe0de78008 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 108.751009][ T5506] RAX: ffffffffffffffda RBX: 00007f8ffafe5fa0 RCX: 00007f8ffad8f7c9
[ 108.751016][ T5506] RDX: 00000000000005ce RSI: 0000200000000600 RDI: 0000000000000004
[ 108.751023][ T5506] RBP: 00007f8ffae13f91 R08: 0000000000000000 R09: 0000000000000000
[ 108.751028][ T5506] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 108.751034][ T5506] R13: 00007f8ffafe5fa0 R14: 00007f8ffafe5fa0 R15: 0000000000000003
[ 108.751045][ T5506]
[ 108.751049][ T5506]
[ 108.915293][ T5506] Allocated by task 5506:
[ 108.917157][ T5506] kasan_save_track+0x3e/0x80
[ 108.919098][ T5506] __kasan_kmalloc+0x93/0xb0
[ 108.921128][ T5506] __kmalloc_noprof+0x41d/0x800
[ 108.923187][ T5506] snd_usb_endpoint_set_params+0x1741/0x2f10
[ 108.925703][ T5506] snd_usb_hw_params+0xb12/0x12e0
[ 108.927875][ T5506] snd_pcm_hw_params+0x89d/0x1d30
[ 108.930020][ T5506] snd_pcm_oss_change_params_locked+0x21cd/0x3f70
[ 108.932707][ T5506] snd_pcm_oss_make_ready_locked+0x7d/0x300
[ 108.935176][ T5506] snd_pcm_oss_write+0x281/0xf20
[ 108.937282][ T5506] vfs_write+0x27e/0xb30
[ 108.939062][ T5506] ksys_write+0x145/0x250
[ 108.941033][ T5506] do_syscall_64+0xec/0xf80
[ 108.943076][ T5506] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 108.945535][ T5506]
[ 108.946510][ T5506] The buggy address belongs to the object at ffff88804337e800
[ 108.946510][ T5506] which belongs to the cache kmalloc-256 of size 256
[ 108.952194][ T5506] The buggy address is located 0 bytes inside of
[ 108.952194][ T5506] allocated 240-byte region [ffff88804337e800, ffff88804337e8f0)
[ 108.957820][ T5506]
[ 108.958810][ T5506] The buggy address belongs to the physical page:
[ 108.961447][ T5506] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4337e
[ 108.965125][ T5506] ksm flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 108.968272][ T5506] page_type: f5(slab)
[ 108.969992][ T5506] raw: 04fff00000000000 ffff88801a441b40 ffffea000158d7c0 dead000000000003
[ 108.973827][ T5506] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 108.977623][ T5506] page dumped because: kasan: bad access detected
[ 108.980521][ T5506] page_owner tracks the page as allocated
[ 108.982966][ T5506] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5368, tgid 5368 (syz-executor), ts 97563098162, free_ts 97561893679
[ 108.991172][ T5506] post_alloc_hook+0x234/0x290
[ 108.993294][ T5506] get_page_from_freelist+0x24e0/0x2580
[ 108.995567][ T5506] __alloc_frozen_pages_noprof+0x181/0x370
[ 108.998234][ T5506] alloc_pages_mpol+0x232/0x4a0
[ 109.000446][ T5506] allocate_slab+0x86/0x3b0
[ 109.002542][ T5506] ___slab_alloc+0xe53/0x1820
[ 109.004603][ T5506] __slab_alloc+0x65/0x100
[ 109.006557][ T5506] __kmalloc_cache_noprof+0x41e/0x700
[ 109.008842][ T5506] tunnel_key_init_net+0x65/0x190
[ 109.011095][ T5506] ops_init+0x35c/0x5c0
[ 109.012886][ T5506] setup_net+0x110/0x330
[ 109.014889][ T5506] copy_net_ns+0x3e3/0x570
[ 109.016978][ T5506] create_new_namespaces+0x3e7/0x6a0
[ 109.019326][ T5506] unshare_nsproxy_namespaces+0x11c/0x170
[ 109.021886][ T5506] ksys_unshare+0x4c8/0x8c0
[ 109.023725][ T5506] __x64_sys_unshare+0x38/0x50
[ 109.025812][ T5506] page last free pid 4584 tgid 4584 stack trace:
[ 109.028580][ T5506] __free_frozen_pages+0xbc8/0xd30
[ 109.030814][ T5506] vfree+0x25a/0x400
[ 109.032441][ T5506] __ebt_unregister_table+0x531/0x600
[ 109.034684][ T5506] ops_undo_list+0x49a/0x990
[ 109.036750][ T5506] cleanup_net+0x4d8/0x7a0
[ 109.038695][ T5506] process_scheduled_works+0xad1/0x1770
[ 109.041123][ T5506] worker_thread+0x8a0/0xda0
[ 109.043220][ T5506] kthread+0x711/0x8a0
[ 109.045072][ T5506] ret_from_fork+0x510/0xa50
[ 109.047383][ T5506] ret_from_fork_asm+0x1a/0x30
[ 109.049477][ T5506]
[ 109.050612][ T5506] Memory state around the buggy address:
[ 109.053098][ T5506] ffff88804337e780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 109.056330][ T5506] ffff88804337e800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 109.059779][ T5506] >ffff88804337e880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc
[ 109.063173][ T5506] ^
[ 109.066576][ T5506] ffff88804337e900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 109.070021][ T5506] ffff88804337e980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 109.073469][ T5506] ==================================================================
[ 109.076989][ T5506] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 109.080008][ T5506] CPU: 0 UID: 0 PID: 5506 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 109.084220][ T5506] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 109.088659][ T5506] Call Trace:
[ 109.090075][ T5506]
[ 109.091318][ T5506] vpanic+0x1e0/0x670
[ 109.092841][ T5506] panic+0xb9/0xc0
[ 109.094158][ T5506] ? __pfx_panic+0x10/0x10
[ 109.095734][ T5506] ? copy_to_urb+0x261/0x460
[ 109.097365][ T5506] ? rcu_is_watching+0x15/0xb0
[ 109.099365][ T5506] ? copy_to_urb+0x261/0x460
[ 109.101436][ T5506] ? copy_to_urb+0x261/0x460
[ 109.103191][ T5506] check_panic_on_warn+0x89/0xb0
[ 109.105114][ T5506] ? copy_to_urb+0x261/0x460
[ 109.106834][ T5506] end_report+0x6f/0x140
[ 109.108395][ T5506] kasan_report+0x129/0x150
[ 109.110119][ T5506] ? copy_to_urb+0x261/0x460
[ 109.111953][ T5506] kasan_check_range+0x2b0/0x2c0
[ 109.113891][ T5506] ? copy_to_urb+0x261/0x460
[ 109.115785][ T5506] __asan_memcpy+0x40/0x70
[ 109.117531][ T5506] copy_to_urb+0x261/0x460
[ 109.119433][ T5506] prepare_playback_urb+0x953/0x13d0
[ 109.121713][ T5506] ? __pfx_prepare_playback_urb+0x10/0x10
[ 109.124281][ T5506] ? unwind_next_frame+0xa5/0x23d0
[ 109.126543][ T5506] ? rcu_is_watching+0x15/0xb0
[ 109.128756][ T5506] ? __kasan_check_byte+0x12/0x40
[ 109.130887][ T5506] ? is_bpf_text_address+0x26/0x2b0
[ 109.133138][ T5506] ? __pfx_prepare_playback_urb+0x10/0x10
[ 109.135418][ T5506] prepare_outbound_urb+0x377/0xc50
[ 109.137816][ T5506] ? check_noncircular+0xda/0x150
[ 109.139904][ T5506] ? _copy_from_iter+0xb2c/0x1630
[ 109.142015][ T5506] ? __asan_memcpy+0x40/0x70
[ 109.143860][ T5506] ? __pfx_prepare_outbound_urb+0x10/0x10
[ 109.146264][ T5506] ? _copy_from_iter+0x11eb/0x1630
[ 109.148485][ T5506] ? snd_usb_endpoint_start_quirk+0x1f7/0x320
[ 109.151023][ T5506] snd_usb_endpoint_start+0x4db/0x1530
[ 109.153532][ T5506] ? __pfx_snd_usb_endpoint_start+0x10/0x10
[ 109.156346][ T5506] start_endpoints+0xa1/0x280
[ 109.158695][ T5506] ? snd_usb_substream_playback_trigger+0x3ce/0x830
[ 109.161750][ T5506] snd_usb_substream_playback_trigger+0x3e0/0x830
[ 109.164473][ T5506] snd_pcm_do_start+0xb7/0x180
[ 109.166637][ T5506] snd_pcm_action+0xe7/0x240
[ 109.168464][ T5506] __snd_pcm_lib_xfer+0x1762/0x1d00
[ 109.170765][ T5506] ? __pfx_interleaved_copy+0x10/0x10
[ 109.173282][ T5506] ? __pfx_default_write_copy+0x10/0x10
[ 109.175704][ T5506] ? __pfx___snd_pcm_lib_xfer+0x10/0x10
[ 109.177964][ T5506] snd_pcm_oss_write3+0x1bc/0x350
[ 109.180098][ T5506] snd_pcm_plug_write_transfer+0x2cb/0x4c0
[ 109.182745][ T5506] ? __pfx_snd_pcm_plug_write_transfer+0x10/0x10
[ 109.185445][ T5506] ? snd_pcm_plug_client_channels_buf+0x490/0x640
[ 109.188305][ T5506] snd_pcm_oss_write+0xa2b/0xf20
[ 109.190574][ T5506] ? __pfx_snd_pcm_oss_write+0x10/0x10
[ 109.192957][ T5506] ? bpf_lsm_file_permission+0x9/0x20
[ 109.194815][ T5506] ? security_file_permission+0x75/0x290
[ 109.197084][ T5506] ? rw_verify_area+0x255/0x4d0
[ 109.199283][ T5506] ? __pfx_snd_pcm_oss_write+0x10/0x10
[ 109.201517][ T5506] vfs_write+0x27e/0xb30
[ 109.203383][ T5506] ? __pfx_vfs_write+0x10/0x10
[ 109.205487][ T5506] ? __pfx_do_futex+0x10/0x10
[ 109.207409][ T5506] ? kmem_cache_free+0x197/0x620
[ 109.209518][ T5506] ? do_sys_openat2+0x15a/0x200
[ 109.211741][ T5506] ksys_write+0x145/0x250
[ 109.213728][ T5506] ? __pfx_ksys_write+0x10/0x10
[ 109.215978][ T5506] do_syscall_64+0xec/0xf80
[ 109.218003][ T5506] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 109.220698][ T5506] ? clear_bhb_loop+0x60/0xb0
[ 109.222853][ T5506] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 109.225488][ T5506] RIP: 0033:0x7f8ffad8f7c9
[ 109.227461][ T5506] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 109.235752][ T5506] RSP: 002b:00007ffe0de78008 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 109.239502][ T5506] RAX: ffffffffffffffda RBX: 00007f8ffafe5fa0 RCX: 00007f8ffad8f7c9
[ 109.243166][ T5506] RDX: 00000000000005ce RSI: 0000200000000600 RDI: 0000000000000004
[ 109.246674][ T5506] RBP: 00007f8ffae13f91 R08: 0000000000000000 R09: 0000000000000000
[ 109.250457][ T5506] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 109.254046][ T5506] R13: 00007f8ffafe5fa0 R14: 00007f8ffafe5fa0 R15: 0000000000000003
[ 109.257226][ T5506]
[ 109.258890][ T5506] Kernel Offset: disabled
[ 109.260827][ T5506] Rebooting in 86400 seconds..
VM DIAGNOSIS:
05:09:47 Registers:
info registers vcpu 0
CPU#0
RAX=1ffffffff3382a60 RBX=00000000000003fd RCX=0000000000000000 RDX=00000000000003fd
RSI=0000000000000000 RDI=0000000000000020 RBP=ffffffff99c15950 RSP=ffffc90002b46b50
R8 =ffff888033cc8237 R9 =1ffff11006799046 R10=dffffc0000000000 R11=ffffffff851bb690
R12=dffffc0000000000 R13=0000000000000000 R14=ffffffff99c156c0 R15=0000000000000000
RIP=ffffffff851bb707 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000555572de2500 ffffffff 00c00000
GS =0000 ffff88808d414000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=0000561ec0eacbe8 CR3=0000000011be5000 CR4=00352ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=00000000fffff800 Opmask01=0000000000000014 Opmask02=000000000000003f Opmask03=0000000000000000
Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffe0de75f40 0000003000000010
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001a0000000d0 00000000ffffffff
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001a0000000d0 00000000ffffffff
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f8ffae15050
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f8ffae1505d
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f8ffae15057
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f8ffae1506b
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f8ffae150f1
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f8ffae151cf
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2323232323232323 2323232323232323 2323232323232323 2323232323232323
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000336f69 6475000500060006
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000104c4a 4756420c5546470c
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000