[ 71.909087][ T42] kauditd_printk_skb: 10 callbacks suppressed
[ 71.909106][ T42] audit: type=1400 audit(1787917284.205:209): avc: denied { transition } for pid=5970 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 71.921912][ T42] audit: type=1400 audit(1787917284.215:210): avc: denied { noatsecure } for pid=5970 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 71.930795][ T42] audit: type=1400 audit(1787917284.215:211): avc: denied { rlimitinh } for pid=5970 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 71.939095][ T42] audit: type=1400 audit(1787917284.215:212): avc: denied { siginh } for pid=5970 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 74.693077][ T42] audit: type=1400 audit(1787917286.995:213): avc: denied { write } for pid=5973 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 74.743720][ T42] audit: type=1400 audit(1787917287.045:214): avc: denied { write } for pid=5976 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 75.571738][ T42] audit: type=1400 audit(1787917287.875:215): avc: denied { write } for pid=5979 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 75.621645][ T42] audit: type=1400 audit(1787917287.925:216): avc: denied { write } for pid=5982 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 75.721605][ T42] audit: type=1400 audit(1787917288.025:217): avc: denied { write } for pid=5985 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 75.768738][ T42] audit: type=1400 audit(1787917288.075:218): avc: denied { write } for pid=5988 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 77.552749][ T42] kauditd_printk_skb: 6 callbacks suppressed
[ 77.552765][ T42] audit: type=1400 audit(1787917289.855:225): avc: denied { write } for pid=6013 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 77.613588][ T42] audit: type=1400 audit(1787917289.915:226): avc: denied { write } for pid=6016 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 78.152492][ T42] audit: type=1400 audit(1787917290.455:227): avc: denied { write } for pid=6019 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 78.214424][ T42] audit: type=1400 audit(1787917290.515:228): avc: denied { write } for pid=6022 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
Warning: Permanently added '[localhost]:32985' (ED25519) to the list of known hosts.
[ 78.971617][ T42] audit: type=1400 audit(1787917291.275:229): avc: denied { read write } for pid=6032 comm="syz-executor356" name="userio" dev="devtmpfs" ino=936 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 78.981827][ T42] audit: type=1400 audit(1787917291.285:230): avc: denied { open } for pid=6032 comm="syz-executor356" path="/dev/userio" dev="devtmpfs" ino=936 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 78.992527][ T42] audit: type=1400 audit(1787917291.285:231): avc: denied { read write } for pid=6032 comm="syz-executor356" name="event0" dev="devtmpfs" ino=940 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1
[ 79.001712][ T42] audit: type=1400 audit(1787917291.285:232): avc: denied { open } for pid=6032 comm="syz-executor356" path="/dev/input/event0" dev="devtmpfs" ino=940 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1
[ 79.011393][ T42] audit: type=1400 audit(1787917291.285:233): avc: denied { ioctl } for pid=6032 comm="syz-executor356" path="/dev/input/event0" dev="devtmpfs" ino=940 ioctlcmd=0x4506 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1
[ 79.090940][ T29] input: AT Raw Set 2 keyboard as /devices/serio2/input/input5
[ 79.151455][ T42] audit: type=1400 audit(1787917291.455:234): avc: denied { ioctl } for pid=6032 comm="syz-executor356" path="/dev/input/event4" dev="devtmpfs" ino=2837 ioctlcmd=0x4506 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 79.307921][ T850] ==================================================================
[ 79.311993][ T850] BUG: KASAN: slab-use-after-free in atkbd_set_repeat_rate.isra.0+0x44a/0x4e0
[ 79.315761][ T850] Read of size 4 at addr ffff888036712164 by task kworker/1:2/850
[ 79.320962][ T850]
[ 79.322130][ T850] CPU: 1 UID: 0 PID: 850 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT(full)
[ 79.322158][ T850] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 79.322172][ T850] Workqueue: events atkbd_event_work
[ 79.322206][ T850] Call Trace:
[ 79.322215][ T850]
[ 79.322223][ T850] dump_stack_lvl+0x100/0x190
[ 79.322253][ T850] print_report+0x13d/0x4b0
[ 79.322283][ T850] ? __virt_addr_valid+0x239/0x430
[ 79.322312][ T850] ? atkbd_set_repeat_rate.isra.0+0x44a/0x4e0
[ 79.322343][ T850] kasan_report+0xdf/0x1c0
[ 79.322375][ T850] ? atkbd_set_repeat_rate.isra.0+0x44a/0x4e0
[ 79.322410][ T850] atkbd_set_repeat_rate.isra.0+0x44a/0x4e0
[ 79.322443][ T850] ? __pfx_atkbd_set_repeat_rate.isra.0+0x10/0x10
[ 79.322475][ T850] ? ps2_command+0xde/0x130
[ 79.322499][ T850] atkbd_event_work+0x12c/0x160
[ 79.322529][ T850] process_one_work+0xac7/0x1b10
[ 79.322558][ T850] ? __pfx_process_one_work+0x10/0x10
[ 79.322587][ T850] ? __pfx_atkbd_event_work+0x10/0x10
[ 79.322616][ T850] worker_thread+0x5ef/0xe50
[ 79.322643][ T850] ? __pfx_worker_thread+0x10/0x10
[ 79.322669][ T850] ? kthread+0x13a/0x450
[ 79.322691][ T850] ? __pfx_worker_thread+0x10/0x10
[ 79.322715][ T850] kthread+0x373/0x450
[ 79.322737][ T850] ? __pfx_kthread+0x10/0x10
[ 79.322761][ T850] ret_from_fork+0x730/0xd60
[ 79.322792][ T850] ? __pfx_ret_from_fork+0x10/0x10
[ 79.322822][ T850] ? __switch_to+0x800/0x10f0
[ 79.322846][ T850] ? __pfx_kthread+0x10/0x10
[ 79.322897][ T850] ret_from_fork_asm+0x1a/0x30
[ 79.322924][ T850]
[ 79.322931][ T850]
[ 79.383023][ T850] Allocated by task 29:
[ 79.384317][ T850] kasan_save_stack+0x30/0x50
[ 79.385837][ T850] kasan_save_track+0x14/0x30
[ 79.387569][ T850] __kasan_kmalloc+0xaa/0xb0
[ 79.389193][ T850] __kmalloc_cache_noprof+0x2e7/0x6b0
[ 79.391005][ T850] input_allocate_device+0x44/0x350
[ 79.392698][ T850] atkbd_connect+0x9e/0x9c0
[ 79.394449][ T850] serio_driver_probe+0x77/0xa0
[ 79.396319][ T850] really_probe+0x241/0xa60
[ 79.398131][ T850] __driver_probe_device+0x210/0x460
[ 79.400133][ T850] driver_probe_device+0x4a/0x140
[ 79.401806][ T850] __device_attach_driver+0x1df/0x320
[ 79.403559][ T850] bus_for_each_drv+0x159/0x1e0
[ 79.405480][ T850] __device_attach+0x1e4/0x4d0
[ 79.407503][ T850] device_initial_probe+0xaf/0xd0
[ 79.409540][ T850] bus_probe_device+0x64/0x160
[ 79.411560][ T850] device_add+0x121d/0x1970
[ 79.413385][ T850] serio_handle_event+0x593/0x970
[ 79.415578][ T850] process_one_work+0xac7/0x1b10
[ 79.417804][ T850] worker_thread+0x5ef/0xe50
[ 79.420008][ T850] kthread+0x373/0x450
[ 79.421984][ T850] ret_from_fork+0x730/0xd60
[ 79.424042][ T850] ret_from_fork_asm+0x1a/0x30
[ 79.426120][ T850]
[ 79.427227][ T850] Freed by task 6032:
[ 79.428953][ T850] kasan_save_stack+0x30/0x50
[ 79.431013][ T850] kasan_save_track+0x14/0x30
[ 79.433048][ T850] kasan_save_free_info+0x3b/0x70
[ 79.435211][ T850] __kasan_slab_free+0x5f/0x80
[ 79.437598][ T850] kfree+0x22b/0x6c0
[ 79.439701][ T850] input_dev_release+0xab/0xd0
[ 79.441940][ T850] device_release+0xd2/0x270
[ 79.443905][ T850] kobject_put+0x1f7/0x640
[ 79.445864][ T850] put_device+0x1f/0x30
[ 79.447749][ T850] input_unregister_device+0xd8/0x110
[ 79.450003][ T850] atkbd_disconnect+0xcb/0x150
[ 79.452056][ T850] serio_driver_remove+0x7b/0xa0
[ 79.454121][ T850] device_remove+0xcb/0x180
[ 79.456185][ T850] device_release_driver_internal+0x44e/0x620
[ 79.459214][ T850] serio_unregister_port+0x23/0x40
[ 79.461671][ T850] userio_char_release+0x91/0xe0
[ 79.463970][ T850] __fput+0x3ff/0xb50
[ 79.465788][ T850] fput_close_sync+0x118/0x250
[ 79.467852][ T850] __x64_sys_close+0x8b/0x120
[ 79.469832][ T850] do_syscall_64+0x123/0x790
[ 79.471870][ T850] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 79.474476][ T850]
[ 79.475786][ T850] The buggy address belongs to the object at ffff888036712000
[ 79.475786][ T850] which belongs to the cache kmalloc-4k of size 4096
[ 79.482223][ T850] The buggy address is located 356 bytes inside of
[ 79.482223][ T850] freed 4096-byte region [ffff888036712000, ffff888036713000)
[ 79.488112][ T850]
[ 79.489133][ T850] The buggy address belongs to the physical page:
[ 79.491801][ T850] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x36710
[ 79.495350][ T850] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 79.498945][ T850] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 79.502758][ T850] page_type: f5(slab)
[ 79.504809][ T850] raw: 00fff00000000040 ffff88801c043040 dead000000000100 dead000000000122
[ 79.508710][ T850] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
[ 79.512158][ T850] head: 00fff00000000040 ffff88801c043040 dead000000000100 dead000000000122
[ 79.515149][ T850] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
[ 79.517763][ T850] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 79.520940][ T850] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 79.525063][ T850] page dumped because: kasan: bad access detected
[ 79.528183][ T850] page_owner tracks the page as allocated
[ 79.531156][ T850] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5138, tgid 5138 (udevd), ts 23156728902
[ 79.538608][ T850] post_alloc_hook+0xfd/0x120
[ 79.540687][ T850] get_page_from_freelist+0x110d/0x35b0
[ 79.542982][ T850] __alloc_frozen_pages_noprof+0x2eb/0x3300
[ 79.545472][ T850] new_slab+0xa5/0x640
[ 79.547278][ T850] refill_objects+0xe3/0x410
[ 79.549459][ T850] __pcs_replace_empty_main+0x372/0x680
[ 79.552117][ T850] __kmalloc_noprof+0x66b/0x820
[ 79.554527][ T850] tomoyo_realpath_from_path+0xb6/0x690
[ 79.557244][ T850] tomoyo_check_open_permission+0x2af/0x3c0
[ 79.559845][ T850] tomoyo_file_open+0x6b/0x90
[ 79.562042][ T850] security_file_open+0xb5/0x1e0
[ 79.564037][ T850] do_dentry_open+0x588/0x14d0
[ 79.566102][ T850] vfs_open+0x82/0x3f0
[ 79.567698][ T850] path_openat+0x19fa/0x2440
[ 79.569209][ T850] do_file_open+0x20e/0x430
[ 79.570686][ T850] do_sys_openat2+0x10f/0x1e0
[ 79.572218][ T850] page last free pid 5139 tgid 5139 ts 23149284278 stack trace:
[ 79.575400][ T850] __free_frozen_pages+0x79f/0x10f0
[ 79.577645][ T850] qlist_free_all+0x47/0xf0
[ 79.579537][ T850] kasan_quarantine_reduce+0x1a0/0x1f0
[ 79.581704][ T850] __kasan_slab_alloc+0x69/0x90
[ 79.583684][ T850] kmem_cache_alloc_noprof+0x26b/0x6a0
[ 79.585719][ T850] alloc_empty_file+0x5b/0x1c0
[ 79.587233][ T850] path_openat+0xdb/0x2440
[ 79.588622][ T850] do_file_open+0x20e/0x430
[ 79.590019][ T850] do_sys_openat2+0x10f/0x1e0
[ 79.591844][ T850] __x64_sys_openat+0x12d/0x210
[ 79.593486][ T850] do_syscall_64+0x123/0x790
[ 79.595412][ T850] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 79.597836][ T850]
[ 79.598896][ T850] Memory state around the buggy address:
[ 79.601239][ T850] ffff888036712000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.604820][ T850] ffff888036712080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.608465][ T850] >ffff888036712100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.611768][ T850] ^
[ 79.614446][ T850] ffff888036712180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.617925][ T850] ffff888036712200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.620759][ T850] ==================================================================
[ 79.623761][ T850] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 79.626000][ T850] CPU: 1 UID: 0 PID: 850 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT(full)
[ 79.628864][ T850] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 79.632402][ T850] Workqueue: events atkbd_event_work
[ 79.634266][ T850] Call Trace:
[ 79.635400][ T850]
[ 79.636356][ T850] dump_stack_lvl+0x100/0x190
[ 79.637880][ T850] vpanic+0x553/0x970
[ 79.639155][ T850] ? __pfx_vpanic+0x10/0x10
[ 79.640813][ T850] ? mark_held_locks+0x40/0x70
[ 79.642396][ T850] ? atkbd_set_repeat_rate.isra.0+0x44a/0x4e0
[ 79.644494][ T850] panic+0xd1/0xe0
[ 79.645872][ T850] ? __pfx_panic+0x10/0x10
[ 79.647644][ T850] ? atkbd_set_repeat_rate.isra.0+0x44a/0x4e0
[ 79.649834][ T850] ? preempt_schedule_common+0x3c/0xb0
[ 79.652333][ T850] check_panic_on_warn.cold+0x19/0x34
[ 79.654597][ T850] end_report.part.0+0x3a/0x90
[ 79.656768][ T850] kasan_report.cold+0xe/0x18
[ 79.658945][ T850] ? atkbd_set_repeat_rate.isra.0+0x44a/0x4e0
[ 79.661705][ T850] atkbd_set_repeat_rate.isra.0+0x44a/0x4e0
[ 79.664416][ T850] ? __pfx_atkbd_set_repeat_rate.isra.0+0x10/0x10
[ 79.666927][ T850] ? ps2_command+0xde/0x130
[ 79.668361][ T850] atkbd_event_work+0x12c/0x160
[ 79.670064][ T850] process_one_work+0xac7/0x1b10
[ 79.671791][ T850] ? __pfx_process_one_work+0x10/0x10
[ 79.673780][ T850] ? __pfx_atkbd_event_work+0x10/0x10
[ 79.675638][ T850] worker_thread+0x5ef/0xe50
[ 79.677228][ T850] ? __pfx_worker_thread+0x10/0x10
[ 79.679081][ T850] ? kthread+0x13a/0x450
[ 79.680564][ T850] ? __pfx_worker_thread+0x10/0x10
[ 79.682657][ T850] kthread+0x373/0x450
[ 79.684646][ T850] ? __pfx_kthread+0x10/0x10
[ 79.686678][ T850] ret_from_fork+0x730/0xd60
[ 79.688494][ T850] ? __pfx_ret_from_fork+0x10/0x10
[ 79.690285][ T850] ? __switch_to+0x800/0x10f0
[ 79.692002][ T850] ? __pfx_kthread+0x10/0x10
[ 79.693525][ T850] ret_from_fork_asm+0x1a/0x30
[ 79.695101][ T850]
[ 79.696824][ T850] Kernel Offset: disabled
[ 79.698604][ T850] Rebooting in 86400 seconds..