Warning: Permanently added '10.128.1.44' (ED25519) to the list of known hosts.
2026/10/22 16:01:06 parsed 1 programs
[ 97.806691][ T29] kauditd_printk_skb: 1 callbacks suppressed
[ 97.807348][ T29] audit: type=1400 audit(1792684866.034:77): avc: denied { node_bind } for pid=2993 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1
[ 97.817719][ T29] audit: type=1400 audit(1792684866.044:78): avc: denied { module_request } for pid=2993 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1
2026/10/22 16:01:06 serving rpc on tcp://40775
[ 100.741673][ T29] audit: type=1400 audit(1792684868.974:79): avc: denied { mounton } for pid=3003 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 100.743270][ T29] audit: type=1400 audit(1792684868.974:80): avc: denied { mount } for pid=3003 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 100.745718][ T3003] cgroup: Unknown subsys name 'net'
[ 100.751187][ T29] audit: type=1400 audit(1792684868.984:81): avc: denied { unmount } for pid=3003 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 100.939476][ T3003] cgroup: Unknown subsys name 'cpuset'
[ 100.942618][ T3003] cgroup: Unknown subsys name 'rlimit'
[ 101.087811][ T29] audit: type=1400 audit(1792684869.324:82): avc: denied { setattr } for pid=3003 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 101.088567][ T29] audit: type=1400 audit(1792684869.324:83): avc: denied { create } for pid=3003 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 101.088973][ T29] audit: type=1400 audit(1792684869.324:84): avc: denied { write } for pid=3003 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 101.089424][ T29] audit: type=1400 audit(1792684869.324:85): avc: denied { read } for pid=3003 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 101.183179][ T29] audit: type=1400 audit(1792684869.414:86): avc: denied { sys_module } for pid=3003 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1
Setting up swapspace version 1, size = 127995904 bytes
[ 101.344215][ T3007] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped).
[ 101.400419][ T3003] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 103.026581][ T29] kauditd_printk_skb: 8 callbacks suppressed
[ 103.026608][ T29] audit: type=1400 audit(1792684871.254:95): avc: denied { execmem } for pid=3009 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 103.079564][ T29] audit: type=1400 audit(1792684871.314:96): avc: denied { create } for pid=3014 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1
[ 103.079638][ T29] audit: type=1400 audit(1792684871.314:97): avc: denied { read } for pid=3015 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 103.079701][ T29] audit: type=1400 audit(1792684871.314:98): avc: denied { open } for pid=3015 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 103.082242][ T29] audit: type=1400 audit(1792684871.314:99): avc: denied { mounton } for pid=3015 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1
[ 103.358436][ T29] audit: type=1400 audit(1792684871.584:100): avc: denied { create } for pid=3016 comm="syz-executor" name="tun" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=chr_file permissive=1
[ 103.359859][ T29] audit: type=1400 audit(1792684871.594:101): avc: denied { setattr } for pid=3016 comm="syz-executor" name="tun" dev="devtmpfs" ino=532 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=chr_file permissive=1
[ 103.359923][ T29] audit: type=1400 audit(1792684871.594:102): avc: denied { read write } for pid=3016 comm="syz-executor" name="tun" dev="devtmpfs" ino=532 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=chr_file permissive=1
[ 103.359978][ T29] audit: type=1400 audit(1792684871.594:103): avc: denied { open } for pid=3016 comm="syz-executor" path="/dev/net/tun" dev="devtmpfs" ino=532 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=chr_file permissive=1
[ 103.365872][ T29] audit: type=1400 audit(1792684871.594:104): avc: denied { mounton } for pid=3015 comm="syz-executor" path="/root/syzkaller.ogWXLS/syz-tmp" dev="sda1" ino=2044 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1
[ 103.982502][ T3020] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
2026/10/22 16:01:28 executed programs: 0
[ 120.547986][ T3031] syz-executor (3031) used greatest stack depth: 21928 bytes left
[ 121.624151][ T29] kauditd_printk_skb: 16 callbacks suppressed
[ 121.624178][ T29] audit: type=1400 audit(1792684889.854:121): avc: denied { create } for pid=3558 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1
2026/10/22 16:02:22 executed programs: 10
[ 174.695466][ T29] audit: type=1400 audit(1792684942.924:122): avc: denied { read write } for pid=5787 comm="syz.6.18" name="raw-gadget" dev="devtmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 174.699313][ T29] audit: type=1400 audit(1792684942.934:123): avc: denied { open } for pid=5787 comm="syz.6.18" path="/dev/raw-gadget" dev="devtmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 174.710530][ T29] audit: type=1400 audit(1792684942.934:124): avc: denied { ioctl } for pid=5787 comm="syz.6.18" path="/dev/raw-gadget" dev="devtmpfs" ino=236 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 174.997337][ T9] usb 7-1: new high-speed USB device number 2 using dummy_hcd
[ 175.149180][ T9] usb 7-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 175.158006][ T9] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 175.182263][ T9] usb 7-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 175.182330][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 175.756922][ T11] usb 6-1: new high-speed USB device number 2 using dummy_hcd
[ 175.876804][ T40] usb 8-1: new high-speed USB device number 2 using dummy_hcd
[ 175.876804][ T5821] usb 3-1: new high-speed USB device number 2 using dummy_hcd
[ 175.917288][ T11] usb 6-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 175.918200][ T11] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 175.918240][ T11] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 175.918280][ T11] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 176.026815][ T5827] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 176.028375][ T5821] usb 3-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 176.029694][ T5821] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 176.029745][ T5821] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 176.029812][ T5821] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 176.085835][ T40] usb 8-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 176.097110][ T40] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 176.097238][ T40] usb 8-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 176.097299][ T40] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 176.180931][ T5827] usb 5-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 176.184360][ T5827] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 176.184451][ T5827] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 176.184571][ T5827] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 177.667761][ T24] ==================================================================
[ 177.667780][ T24] BUG: KASAN: slab-use-after-free in rtsx_usb_ms_handle_req+0x17cb/0x1a00
[ 177.667825][ T24] Read of size 1 at addr ffff888105ace071 by task kworker/1:0/24
[ 177.667844][ T24]
[ 177.667869][ T24] CPU: 1 UID: 0 PID: 24 Comm: kworker/1:0 Not tainted syzkaller #0 PREEMPT(lazy)
[ 177.667895][ T24] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
[ 177.667915][ T24] Workqueue: events rtsx_usb_ms_handle_req
[ 177.667954][ T24] Call Trace:
[ 177.667962][ T24]
[ 177.667973][ T24] dump_stack_lvl+0x100/0x190
[ 177.668033][ T24] print_report+0x13d/0x4b0
[ 177.668069][ T24] ? __virt_addr_valid+0x239/0x430
[ 177.668093][ T24] ? rtsx_usb_ms_handle_req+0x17cb/0x1a00
[ 177.668123][ T24] kasan_report+0xdf/0x1c0
[ 177.668151][ T24] ? rtsx_usb_ms_handle_req+0x17cb/0x1a00
[ 177.668185][ T24] rtsx_usb_ms_handle_req+0x17cb/0x1a00
[ 177.668224][ T24] ? __pfx_rtsx_usb_ms_handle_req+0x10/0x10
[ 177.668256][ T24] ? lock_acquire+0x5e/0x380
[ 177.668281][ T24] ? process_one_work+0x906/0x1b10
[ 177.668303][ T24] ? process_one_work+0x906/0x1b10
[ 177.668326][ T24] process_one_work+0xac7/0x1b10
[ 177.668353][ T24] ? __pfx_process_one_work+0x10/0x10
[ 177.668376][ T24] ? lock_acquire+0x1d1/0x380
[ 177.668431][ T24] ? __pfx_rtsx_usb_ms_handle_req+0x10/0x10
[ 177.668477][ T24] worker_thread+0x5ef/0xe50
[ 177.668516][ T24] ? kthread+0x13a/0x450
[ 177.668559][ T24] ? __pfx_worker_thread+0x10/0x10
[ 177.668580][ T24] kthread+0x373/0x450
[ 177.668614][ T24] ? __pfx_kthread+0x10/0x10
[ 177.668648][ T24] ret_from_fork+0x69f/0xc90
[ 177.668673][ T24] ? __pfx_ret_from_fork+0x10/0x10
[ 177.668704][ T24] ? __switch_to+0x7f6/0x10e0
[ 177.668753][ T24] ? __switch_to_asm+0x39/0x70
[ 177.668792][ T24] ? __pfx_kthread+0x10/0x10
[ 177.668839][ T24] ret_from_fork_asm+0x1a/0x30
[ 177.668873][ T24]
[ 177.668881][ T24]
[ 177.668886][ T24] Allocated by task 37:
[ 177.668902][ T24] kasan_save_stack+0x30/0x50
[ 177.668925][ T24] kasan_save_track+0x14/0x30
[ 177.668948][ T24] __kasan_kmalloc+0x8f/0xa0
[ 177.668969][ T24] __kmalloc_cache_noprof+0x2d8/0x680
[ 177.668995][ T24] memstick_check+0x2c1/0x10d0
[ 177.669021][ T24] process_one_work+0xac7/0x1b10
[ 177.669040][ T24] worker_thread+0x5ef/0xe50
[ 177.669058][ T24] kthread+0x373/0x450
[ 177.669089][ T24] ret_from_fork+0x69f/0xc90
[ 177.669109][ T24] ret_from_fork_asm+0x1a/0x30
[ 177.669134][ T24]
[ 177.669139][ T24] Freed by task 37:
[ 177.669148][ T24] kasan_save_stack+0x30/0x50
[ 177.669171][ T24] kasan_save_track+0x14/0x30
[ 177.669193][ T24] kasan_save_free_info+0x3b/0x70
[ 177.669227][ T24] __kasan_slab_free+0x43/0x70
[ 177.669251][ T24] kfree+0x20c/0x650
[ 177.669273][ T24] memstick_check+0x72b/0x10d0
[ 177.669300][ T24] process_one_work+0xac7/0x1b10
[ 177.669318][ T24] worker_thread+0x5ef/0xe50
[ 177.669337][ T24] kthread+0x373/0x450
[ 177.669368][ T24] ret_from_fork+0x69f/0xc90
[ 177.669388][ T24] ret_from_fork_asm+0x1a/0x30
[ 177.669413][ T24]
[ 177.669418][ T24] The buggy address belongs to the object at ffff888105ace000
[ 177.669418][ T24] which belongs to the cache kmalloc-2k of size 2048
[ 177.669435][ T24] The buggy address is located 113 bytes inside of
[ 177.669435][ T24] freed 2048-byte region [ffff888105ace000, ffff888105ace800)
[ 177.669458][ T24]
[ 177.669463][ T24] The buggy address belongs to the physical page:
[ 177.669473][ T24] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105ac8
[ 177.669509][ T24] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 177.669534][ T24] flags: 0x200000000000040(head|node=0|zone=2)
[ 177.669574][ T24] page_type: f5(slab)
[ 177.669594][ T24] raw: 0200000000000040 ffff888100042000 dead000000000100 dead000000000122
[ 177.669618][ T24] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 177.669640][ T24] head: 0200000000000040 ffff888100042000 dead000000000100 dead000000000122
[ 177.669660][ T24] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 177.669681][ T24] head: 0200000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 177.669706][ T24] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008
[ 177.669719][ T24] page dumped because: kasan: bad access detected
[ 177.669729][ T24] page_owner tracks the page as allocated
[ 177.669736][ T24] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 3367678238
[ 177.669771][ T24] post_alloc_hook+0xfd/0x120
[ 177.669800][ T24] get_page_from_freelist+0xf4b/0x3440
[ 177.669825][ T24] __alloc_frozen_pages_noprof+0x2d7/0x2f70
[ 177.669873][ T24] new_slab+0xa9/0x6e0
[ 177.669908][ T24] refill_objects+0xe3/0x410
[ 177.669942][ T24] __pcs_replace_empty_main+0x35e/0x650
[ 177.669968][ T24] __kmalloc_cache_noprof+0x4a1/0x680
[ 177.669993][ T24] acpi_ds_create_walk_state+0x95/0x300
[ 177.670021][ T24] acpi_ps_execute_method+0x2c1/0xe90
[ 177.670051][ T24] acpi_ns_evaluate+0x640/0x1670
[ 177.670081][ T24] acpi_evaluate_object+0x420/0xe00
[ 177.670104][ T24] acpi_evaluate_integer+0xdf/0x220
[ 177.670137][ T24] acpi_bus_get_status+0x1a1/0x430
[ 177.670156][ T24] acpi_add_single_object+0x127/0x1ab0
[ 177.670185][ T24] acpi_bus_check_add+0x2d2/0x920
[ 177.670217][ T24] acpi_ns_walk_namespace+0x4cc/0x760
[ 177.670239][ T24] page_owner free stack trace missing
[ 177.670247][ T24]
[ 177.670251][ T24] Memory state around the buggy address:
[ 177.670262][ T24] ffff888105acdf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 177.670278][ T24] ffff888105acdf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 177.670294][ T24] >ffff888105ace000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 177.670306][ T24] ^
[ 177.670319][ T24] ffff888105ace080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 177.670335][ T24] ffff888105ace100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 177.670347][ T24] ==================================================================
[ 177.670465][ T24] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 178.280825][ T24] CPU: 1 UID: 0 PID: 24 Comm: kworker/1:0 Not tainted syzkaller #0 PREEMPT(lazy)
[ 178.290066][ T24] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
[ 178.300158][ T24] Workqueue: events rtsx_usb_ms_handle_req
[ 178.306051][ T24] Call Trace:
[ 178.309387][ T24]
[ 178.312357][ T24] dump_stack_lvl+0x100/0x190
[ 178.317098][ T24] vpanic+0x553/0x970
[ 178.321131][ T24] ? __pfx_vpanic+0x10/0x10
[ 178.325683][ T24] ? rtsx_usb_ms_handle_req+0x17cb/0x1a00
[ 178.331451][ T24] panic+0xd1/0xe0
[ 178.335222][ T24] ? __pfx_panic+0x10/0x10
[ 178.339685][ T24] ? rtsx_usb_ms_handle_req+0x17cb/0x1a00
[ 178.345456][ T24] ? preempt_schedule_common+0x3c/0xb0
[ 178.351002][ T24] check_panic_on_warn.cold+0x19/0x34
[ 178.356420][ T24] end_report.part.0+0x3a/0x90
[ 178.361239][ T24] kasan_report.cold+0xe/0x18
[ 178.365995][ T24] ? rtsx_usb_ms_handle_req+0x17cb/0x1a00
[ 178.371775][ T24] rtsx_usb_ms_handle_req+0x17cb/0x1a00
[ 178.377386][ T24] ? __pfx_rtsx_usb_ms_handle_req+0x10/0x10
[ 178.383326][ T24] ? lock_acquire+0x5e/0x380
[ 178.388023][ T24] ? process_one_work+0x906/0x1b10
[ 178.393212][ T24] ? process_one_work+0x906/0x1b10
[ 178.398387][ T24] process_one_work+0xac7/0x1b10
[ 178.403370][ T24] ? __pfx_process_one_work+0x10/0x10
[ 178.408779][ T24] ? lock_acquire+0x1d1/0x380
[ 178.413502][ T24] ? __pfx_rtsx_usb_ms_handle_req+0x10/0x10
[ 178.419451][ T24] worker_thread+0x5ef/0xe50
[ 178.424140][ T24] ? kthread+0x13a/0x450
[ 178.428433][ T24] ? __pfx_worker_thread+0x10/0x10
[ 178.433585][ T24] kthread+0x373/0x450
[ 178.437735][ T24] ? __pfx_kthread+0x10/0x10
[ 178.442559][ T24] ret_from_fork+0x69f/0xc90
[ 178.447220][ T24] ? __pfx_ret_from_fork+0x10/0x10
[ 178.452388][ T24] ? __switch_to+0x7f6/0x10e0
[ 178.457115][ T24] ? __switch_to_asm+0x39/0x70
[ 178.461923][ T24] ? __pfx_kthread+0x10/0x10
[ 178.466566][ T24] ret_from_fork_asm+0x1a/0x30
[ 178.471419][ T24]
[ 178.475035][ T24] Kernel Offset: disabled
[ 178.479390][ T24] Rebooting in 86400 seconds..