[ 71.144166][ T43] audit: type=1400 audit(1788525461.365:211): avc: denied { transition } for pid=5965 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 71.146532][ T43] audit: type=1400 audit(1788525461.365:212): avc: denied { noatsecure } for pid=5965 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 71.146592][ T43] audit: type=1400 audit(1788525461.365:213): avc: denied { rlimitinh } for pid=5965 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 71.146623][ T43] audit: type=1400 audit(1788525461.365:214): avc: denied { siginh } for pid=5965 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 71.779589][ T1442] ieee802154 phy0 wpan0: encryption failed: -22
[ 71.779691][ T1442] ieee802154 phy1 wpan1: encryption failed: -22
[ 75.192638][ T43] audit: type=1400 audit(1788525465.415:215): avc: denied { write } for pid=5971 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 75.265260][ T43] audit: type=1400 audit(1788525465.485:216): avc: denied { write } for pid=5974 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 75.513253][ T43] audit: type=1400 audit(1788525465.735:217): avc: denied { write } for pid=5977 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 75.567276][ T43] audit: type=1400 audit(1788525465.785:218): avc: denied { write } for pid=5980 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 75.867921][ T43] audit: type=1400 audit(1788525466.095:219): avc: denied { write } for pid=5983 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 75.921099][ T43] audit: type=1400 audit(1788525466.145:220): avc: denied { write } for pid=5986 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 76.916246][ T1042] cfg80211: failed to load regulatory.db
Warning: Permanently added '[localhost]:49305' (ED25519) to the list of known hosts.
[ 77.339392][ T43] audit: type=1400 audit(1788525467.565:221): avc: denied { mounton } for pid=5997 comm="syz-executor411" path="/dev" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=dir permissive=1
[ 77.339473][ T43] audit: type=1400 audit(1788525467.565:222): avc: denied { mount } for pid=5997 comm="syz-executor411" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1
[ 77.342755][ T43] audit: type=1400 audit(1788525467.565:223): avc: denied { mounton } for pid=5997 comm="syz-executor411" path="/sys/kernel/config" dev="configfs" ino=1067 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 77.342787][ T43] audit: type=1400 audit(1788525467.565:224): avc: denied { mount } for pid=5997 comm="syz-executor411" name="/" dev="configfs" ino=1067 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1
[ 77.342817][ T43] audit: type=1400 audit(1788525467.565:225): avc: denied { mount } for pid=5997 comm="syz-executor411" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1
[ 77.342847][ T43] audit: type=1400 audit(1788525467.565:226): avc: denied { search } for pid=5997 comm="syz-executor411" name="/" dev="configfs" ino=1067 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 77.342879][ T43] audit: type=1400 audit(1788525467.565:227): avc: denied { search } for pid=5997 comm="syz-executor411" name="usb_gadget" dev="configfs" ino=2447 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 77.343383][ T43] audit: type=1400 audit(1788525467.565:228): avc: denied { write search } for pid=5997 comm="syz-executor411" name="usb_gadget" dev="configfs" ino=2447 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 77.343562][ T43] audit: type=1400 audit(1788525467.565:229): avc: denied { add_name } for pid=5997 comm="syz-executor411" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 77.343812][ T43] audit: type=1400 audit(1788525467.565:230): avc: denied { create } for pid=5997 comm="syz-executor411" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1
[ 77.454414][ T6005] printk: legacy console [ttyGS0] disabled
[ 77.457821][ T6004] ==================================================================
[ 77.457849][ T6004] BUG: KASAN: slab-use-after-free in tty_init_dev.part.0+0x44f/0x470
[ 77.457877][ T6004] Write of size 8 at addr ffff888039c5f128 by task syz-executor411/6004
[ 77.457891][ T6004]
[ 77.457899][ T6004] CPU: 2 UID: 0 PID: 6004 Comm: syz-executor411 Not tainted syzkaller #0 PREEMPT(full)
[ 77.457918][ T6004] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 77.457929][ T6004] Call Trace:
[ 77.457935][ T6004]
[ 77.457942][ T6004] dump_stack_lvl+0x100/0x190
[ 77.457966][ T6004] print_report+0x13d/0x4b0
[ 77.457992][ T6004] ? __virt_addr_valid+0x239/0x430
[ 77.458010][ T6004] ? tty_init_dev.part.0+0x44f/0x470
[ 77.458028][ T6004] kasan_report+0xdf/0x1c0
[ 77.458049][ T6004] ? tty_init_dev.part.0+0x44f/0x470
[ 77.458070][ T6004] tty_init_dev.part.0+0x44f/0x470
[ 77.458088][ T6004] tty_open+0x953/0xe20
[ 77.458107][ T6004] ? __pfx_tty_open+0x10/0x10
[ 77.458123][ T6004] ? chrdev_open+0x10b/0x6a0
[ 77.458142][ T6004] ? chrdev_open+0x10b/0x6a0
[ 77.458161][ T6004] ? __pfx_tty_open+0x10/0x10
[ 77.458178][ T6004] chrdev_open+0x234/0x6a0
[ 77.458197][ T6004] ? __pfx_chrdev_open+0x10/0x10
[ 77.458216][ T6004] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80
[ 77.458243][ T6004] do_dentry_open+0x6ab/0x14d0
[ 77.458261][ T6004] ? __pfx_chrdev_open+0x10/0x10
[ 77.458283][ T6004] vfs_open+0x82/0x3f0
[ 77.458305][ T6004] path_openat+0x19fa/0x2440
[ 77.458327][ T6004] ? __pfx_path_openat+0x10/0x10
[ 77.458346][ T6004] do_file_open+0x20e/0x430
[ 77.458362][ T6004] ? __pfx_do_file_open+0x10/0x10
[ 77.458381][ T6004] ? _raw_spin_unlock+0x28/0x50
[ 77.458394][ T6004] ? alloc_fd+0x471/0x7a0
[ 77.458410][ T6004] do_sys_openat2+0x10f/0x1e0
[ 77.458427][ T6004] ? __pfx_do_sys_openat2+0x10/0x10
[ 77.458444][ T6004] ? __fput+0x692/0xb50
[ 77.458461][ T6004] __x64_sys_openat+0x12d/0x210
[ 77.458478][ T6004] ? __pfx___x64_sys_openat+0x10/0x10
[ 77.458501][ T6004] do_syscall_64+0x123/0x790
[ 77.458518][ T6004] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.458534][ T6004] RIP: 0033:0x7fd79f471dde
[ 77.458548][ T6004] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 77.458563][ T6004] RSP: 002b:00007fd79f41c158 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 77.458581][ T6004] RAX: ffffffffffffffda RBX: 00007fd79f41c6c0 RCX: 00007fd79f471dde
[ 77.458593][ T6004] RDX: 0000000000000102 RSI: 00007fd79f4c11a3 RDI: ffffffffffffff9c
[ 77.458603][ T6004] RBP: 0000000000000021 R08: 0000000000000000 R09: 0000000000000000
[ 77.458614][ T6004] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
[ 77.458624][ T6004] R13: 0000000000000010 R14: 00007ffe14e7e850 R15: 00007ffe14e7e938
[ 77.458641][ T6004]
[ 77.458647][ T6004]
[ 77.458651][ T6004] Allocated by task 5997:
[ 77.458659][ T6004] kasan_save_stack+0x30/0x50
[ 77.458676][ T6004] kasan_save_track+0x14/0x30
[ 77.458691][ T6004] __kasan_kmalloc+0xaa/0xb0
[ 77.458706][ T6004] __kmalloc_cache_noprof+0x2f8/0x6d0
[ 77.458729][ T6004] gserial_alloc_line_no_console+0xac/0x710
[ 77.458753][ T6004] gserial_alloc_line+0x16/0xa0
[ 77.458774][ T6004] gser_alloc_inst+0x86/0x100
[ 77.458806][ T6004] try_get_usb_function_instance+0x136/0x1f0
[ 77.458828][ T6004] usb_get_function_instance+0x16/0x70
[ 77.458850][ T6004] function_make+0x18c/0x3f0
[ 77.458867][ T6004] configfs_mkdir+0x525/0xd40
[ 77.458882][ T6004] vfs_mkdir+0x364/0x850
[ 77.458904][ T6004] filename_mkdirat+0x48b/0x5e0
[ 77.458922][ T6004] __x64_sys_mkdir+0x6b/0x90
[ 77.458941][ T6004] do_syscall_64+0x123/0x790
[ 77.458957][ T6004] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.458973][ T6004]
[ 77.458976][ T6004] Freed by task 6005:
[ 77.458983][ T6004] kasan_save_stack+0x30/0x50
[ 77.458999][ T6004] kasan_save_track+0x14/0x30
[ 77.459014][ T6004] kasan_save_free_info+0x3b/0x70
[ 77.459036][ T6004] __kasan_slab_free+0x5f/0x80
[ 77.459052][ T6004] kfree+0x22b/0x6d0
[ 77.459072][ T6004] gserial_free_port+0x146/0x2f0
[ 77.459093][ T6004] gserial_free_line+0xf8/0x1e0
[ 77.459115][ T6004] gser_free_inst+0x3b/0x50
[ 77.459137][ T6004] usb_put_function_instance+0x89/0xc0
[ 77.459159][ T6004] config_item_cleanup+0x146/0x240
[ 77.459175][ T6004] config_item_put+0x93/0xb0
[ 77.459191][ T6004] configfs_rmdir+0x5e3/0x950
[ 77.459205][ T6004] vfs_rmdir+0x328/0x8a0
[ 77.459227][ T6004] filename_rmdir+0x31a/0x5c0
[ 77.459245][ T6004] __x64_sys_rmdir+0x46/0x70
[ 77.459263][ T6004] do_syscall_64+0x123/0x790
[ 77.459279][ T6004] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.459363][ T6004]
[ 77.459369][ T6004] The buggy address belongs to the object at ffff888039c5f000
[ 77.459369][ T6004] which belongs to the cache kmalloc-2k of size 2048
[ 77.459383][ T6004] The buggy address is located 296 bytes inside of
[ 77.459383][ T6004] freed 2048-byte region [ffff888039c5f000, ffff888039c5f800)
[ 77.459399][ T6004]
[ 77.459404][ T6004] The buggy address belongs to the physical page:
[ 77.459413][ T6004] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888039c5b000 pfn:0x39c58
[ 77.459429][ T6004] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 77.459442][ T6004] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff)
[ 77.459458][ T6004] page_type: f5(slab)
[ 77.459473][ T6004] raw: 00fff00000000240 ffff88801c042f00 ffffea00011fe010 ffffea0000d4be10
[ 77.459488][ T6004] raw: ffff888039c5b000 0000000000080007 00000000f5000000 0000000000000000
[ 77.459503][ T6004] head: 00fff00000000240 ffff88801c042f00 ffffea00011fe010 ffffea0000d4be10
[ 77.459517][ T6004] head: ffff888039c5b000 0000000000080007 00000000f5000000 0000000000000000
[ 77.459531][ T6004] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 77.459546][ T6004] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 77.459555][ T6004] page dumped because: kasan: bad access detected
[ 77.459563][ T6004] page_owner tracks the page as allocated
[ 77.459569][ T6004] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5536, tgid 5536 (getty), ts 27613485294
[ 77.459597][ T6004] post_alloc_hook+0xfd/0x120
[ 77.459620][ T6004] get_page_from_freelist+0x110d/0x35d0
[ 77.459689][ T6004] __alloc_frozen_pages_noprof+0x2eb/0x3300
[ 77.459713][ T6004] new_slab+0xa9/0x6e0
[ 77.459735][ T6004] refill_objects+0xe3/0x410
[ 77.459757][ T6004] __pcs_replace_empty_main+0x35e/0x650
[ 77.459779][ T6004] __kmalloc_node_track_caller_noprof+0x6a8/0x870
[ 77.459795][ T6004] kmalloc_reserve+0xe8/0x350
[ 77.459816][ T6004] __alloc_skb+0x185/0x710
[ 77.459838][ T6004] audit_log_start+0x350/0x930
[ 77.459862][ T6004] common_lsm_audit+0xb2/0x2b0
[ 77.459879][ T6004] slow_avc_audit+0x186/0x210
[ 77.459897][ T6004] avc_has_perm+0x1a6/0x1e0
[ 77.459915][ T6004] inode_has_perm+0x166/0x1d0
[ 77.459934][ T6004] __file_has_perm+0x39c/0x460
[ 77.459967][ T6004] selinux_file_fcntl+0x111/0x170
[ 77.459988][ T6004] page last free pid 5536 tgid 5536 ts 27612066419 stack trace:
[ 77.460000][ T6004] __free_frozen_pages+0x79f/0x10f0
[ 77.460020][ T6004] qlist_free_all+0x47/0xf0
[ 77.460034][ T6004] kasan_quarantine_reduce+0x1a0/0x1f0
[ 77.460049][ T6004] __kasan_slab_alloc+0x69/0x90
[ 77.460066][ T6004] __kmalloc_noprof+0x2cc/0x840
[ 77.460080][ T6004] tomoyo_supervisor+0x65d/0x1340
[ 77.460098][ T6004] tomoyo_path_number_perm+0x445/0x580
[ 77.460121][ T6004] tomoyo_path_chown+0x14b/0x1b0
[ 77.460139][ T6004] security_path_chown+0x12a/0x2d0
[ 77.460163][ T6004] chown_common+0x3da/0x6e0
[ 77.460181][ T6004] vfs_fchown+0xcd/0x110
[ 77.460198][ T6004] __x64_sys_fchown+0xad/0x130
[ 77.460216][ T6004] do_syscall_64+0x123/0x790
[ 77.460234][ T6004] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.460249][ T6004]
[ 77.460253][ T6004] Memory state around the buggy address:
[ 77.460260][ T6004] ffff888039c5f000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.460271][ T6004] ffff888039c5f080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.460282][ T6004] >ffff888039c5f100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.460291][ T6004] ^
[ 77.460300][ T6004] ffff888039c5f180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.460310][ T6004] ffff888039c5f200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.460319][ T6004] ==================================================================
[ 77.460407][ T6004] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 77.786577][ T6004] CPU: 2 UID: 0 PID: 6004 Comm: syz-executor411 Not tainted syzkaller #0 PREEMPT(full)
[ 77.790697][ T6004] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 77.794688][ T6004] Call Trace:
[ 77.795928][ T6004]
[ 77.797006][ T6004] dump_stack_lvl+0x100/0x190
[ 77.798749][ T6004] vpanic+0x553/0x970
[ 77.800221][ T6004] ? __pfx_vpanic+0x10/0x10
[ 77.801867][ T6004] ? mark_held_locks+0x40/0x70
[ 77.803667][ T6004] ? irqentry_exit+0x24d/0xa10
[ 77.805411][ T6004] ? tty_init_dev.part.0+0x44f/0x470
[ 77.807407][ T6004] panic+0xd1/0xe0
[ 77.808886][ T6004] ? __pfx_panic+0x10/0x10
[ 77.810737][ T6004] check_panic_on_warn.cold+0x19/0x34
[ 77.813034][ T6004] end_report.part.0+0x3a/0x90
[ 77.814981][ T6004] kasan_report.cold+0xe/0x18
[ 77.816917][ T6004] ? tty_init_dev.part.0+0x44f/0x470
[ 77.818954][ T6004] tty_init_dev.part.0+0x44f/0x470
[ 77.820821][ T6004] tty_open+0x953/0xe20
[ 77.822357][ T6004] ? __pfx_tty_open+0x10/0x10
[ 77.824119][ T6004] ? chrdev_open+0x10b/0x6a0
[ 77.825806][ T6004] ? chrdev_open+0x10b/0x6a0
[ 77.827529][ T6004] ? __pfx_tty_open+0x10/0x10
[ 77.829256][ T6004] chrdev_open+0x234/0x6a0
[ 77.831209][ T6004] ? __pfx_chrdev_open+0x10/0x10
[ 77.833499][ T6004] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80
[ 77.836258][ T6004] do_dentry_open+0x6ab/0x14d0
[ 77.838101][ T6004] ? __pfx_chrdev_open+0x10/0x10
[ 77.840049][ T6004] vfs_open+0x82/0x3f0
[ 77.841547][ T6004] path_openat+0x19fa/0x2440
[ 77.843282][ T6004] ? __pfx_path_openat+0x10/0x10
[ 77.845103][ T6004] do_file_open+0x20e/0x430
[ 77.846801][ T6004] ? __pfx_do_file_open+0x10/0x10
[ 77.848665][ T6004] ? _raw_spin_unlock+0x28/0x50
[ 77.850497][ T6004] ? alloc_fd+0x471/0x7a0
[ 77.852211][ T6004] do_sys_openat2+0x10f/0x1e0
[ 77.854238][ T6004] ? __pfx_do_sys_openat2+0x10/0x10
[ 77.856565][ T6004] ? __fput+0x692/0xb50
[ 77.858305][ T6004] __x64_sys_openat+0x12d/0x210
[ 77.860179][ T6004] ? __pfx___x64_sys_openat+0x10/0x10
[ 77.862143][ T6004] do_syscall_64+0x123/0x790
[ 77.863906][ T6004] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.866151][ T6004] RIP: 0033:0x7fd79f471dde
[ 77.867881][ T6004] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 77.875097][ T6004] RSP: 002b:00007fd79f41c158 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 77.878560][ T6004] RAX: ffffffffffffffda RBX: 00007fd79f41c6c0 RCX: 00007fd79f471dde
[ 77.881680][ T6004] RDX: 0000000000000102 RSI: 00007fd79f4c11a3 RDI: ffffffffffffff9c
[ 77.884645][ T6004] RBP: 0000000000000021 R08: 0000000000000000 R09: 0000000000000000
[ 77.887508][ T6004] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
[ 77.890358][ T6004] R13: 0000000000000010 R14: 00007ffe14e7e850 R15: 00007ffe14e7e938
[ 77.893564][ T6004]
[ 77.895500][ T6004] Kernel Offset: disabled
[ 77.897135][ T6004] Rebooting in 86400 seconds..