[ 72.150318][ T43] audit: type=1400 audit(1790839052.519:211): avc: denied { transition } for pid=5972 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 72.152014][ T43] audit: type=1400 audit(1790839052.519:212): avc: denied { noatsecure } for pid=5972 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 72.152061][ T43] audit: type=1400 audit(1790839052.519:213): avc: denied { rlimitinh } for pid=5972 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 72.152093][ T43] audit: type=1400 audit(1790839052.519:214): avc: denied { siginh } for pid=5972 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 76.452065][ T43] audit: type=1400 audit(1790839056.829:215): avc: denied { write } for pid=5979 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 76.502870][ T43] audit: type=1400 audit(1790839056.879:216): avc: denied { write } for pid=5982 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 76.533776][ T1042] cfg80211: failed to load regulatory.db
[ 76.626459][ T43] audit: type=1400 audit(1790839056.999:217): avc: denied { write } for pid=5986 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 76.691654][ T43] audit: type=1400 audit(1790839057.059:218): avc: denied { write } for pid=5989 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
Warning: Permanently added '[localhost]:50262' (ED25519) to the list of known hosts.
[ 77.421339][ T43] audit: type=1400 audit(1790839057.789:219): avc: denied { mount } for pid=5999 comm="syz-executor227" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1
[ 77.424251][ T43] audit: type=1400 audit(1790839057.799:220): avc: denied { mounton } for pid=5999 comm="syz-executor227" path="/sys/kernel/config" dev="configfs" ino=2078 scontext=root:sysadm_r:sysadm_t tcontext=system_u:obje
** replaying previous printk message **
[ 77.424251][ T43] audit: type=1400 audit(1790839057.799:220): avc: denied { mounton } for pid=5999 comm="syz-executor227" path="/sys/kernel/config" dev="configfs" ino=2078 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 77.424309][ T43] audit: type=1400 audit(1790839057.799:221): avc: denied { mount } for pid=5999 comm="syz-executor227" name="/" dev="configfs" ino=2078 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1
[ 77.427607][ T43] audit: type=1400 audit(1790839057.799:222): avc: denied { search } for pid=5999 comm="syz-executor227" name="/" dev="configfs" ino=2078 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 77.427644][ T43] audit: type=1400 audit(1790839057.799:223): avc: denied { search } for pid=5999 comm="syz-executor227" name="usb_gadget" dev="configfs" ino=4456 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 77.428064][ T43] audit: type=1400 audit(1790839057.799:224): avc: denied { write search } for pid=5999 comm="syz-executor227" name="usb_gadget" dev="configfs" ino=4456 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 77.428284][ T43] audit: type=1400 audit(1790839057.799:225): avc: denied { add_name } for pid=5999 comm="syz-executor227" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 77.428598][ T43] audit: type=1400 audit(1790839057.799:226): avc: denied { create } for pid=5999 comm="syz-executor227" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1
[ 77.429551][ T43] audit: type=1400 audit(1790839057.799:227): avc: denied { search } for pid=5999 comm="syz-executor227" name="/" dev="configfs" ino=2078 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 77.429710][ T43] audit: type=1400 audit(1790839057.799:228): avc: denied { search } for pid=5999 comm="syz-executor227" name="usb_gadget" dev="configfs" ino=4456 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 77.438123][ T5999] FAULT_INJECTION: forcing a failure.
[ 77.438123][ T5999] name failslab, interval 1, probability 5, space 0, times -1
[ 77.438151][ T5999] CPU: 3 UID: 0 PID: 5999 Comm: syz-executor227 Not tainted syzkaller #0 PREEMPT(full)
[ 77.438169][ T5999] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 77.438179][ T5999] Call Trace:
[ 77.438185][ T5999]
[ 77.438191][ T5999] dump_stack_lvl+0x100/0x190
[ 77.438220][ T5999] should_fail_ex.cold+0x5/0xa
[ 77.438243][ T5999] should_failslab+0xc2/0x120
[ 77.438266][ T5999] kmem_cache_alloc_noprof+0x92/0x6a0
[ 77.438285][ T5999] ? __pfx___might_resched+0x10/0x10
[ 77.438302][ T5999] ? configfs_new_dirent+0x312/0x570
[ 77.438319][ T5999] ? configfs_new_dirent+0x52/0x570
[ 77.438341][ T5999] configfs_new_dirent+0x52/0x570
[ 77.438357][ T5999] ? __pfx_down_write_nested+0x10/0x10
[ 77.438382][ T5999] configfs_make_dirent+0x36/0x1a0
[ 77.438403][ T5999] configfs_create_file+0xfe/0x180
[ 77.438422][ T5999] configfs_attach_item.part.0+0x147/0x4f0
[ 77.438444][ T5999] configfs_mkdir+0xb9a/0xd40
[ 77.438470][ T5999] ? __pfx_configfs_mkdir+0x10/0x10
[ 77.438501][ T5999] vfs_mkdir+0x364/0x850
[ 77.438522][ T5999] filename_mkdirat+0x48b/0x5e0
[ 77.438548][ T5999] ? __pfx_filename_mkdirat+0x10/0x10
[ 77.438570][ T5999] ? strncpy_from_user+0x19d/0x2d0
[ 77.438594][ T5999] ? do_getname+0x191/0x390
[ 77.438612][ T5999] __x64_sys_mkdir+0x6b/0x90
[ 77.438636][ T5999] do_syscall_64+0x123/0x790
[ 77.438655][ T5999] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.438672][ T5999] RIP: 0033:0x7f778c194d07
[ 77.438686][ T5999] Code: 77 01 c3 48 c7 c2 d8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 53 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 d8 ff ff ff f7 d8 64 89 02 b8
[ 77.438700][ T5999] RSP: 002b:00007ffddb96a878 EFLAGS: 00000202 ORIG_RAX: 0000000000000053
[ 77.438718][ T5999] RAX: ffffffffffffffda RBX: 0000000000002710 RCX: 00007f778c194d07
[ 77.438729][ T5999] RDX: 0000000000000000 RSI: 00000000000001ff RDI: 00007f778c1f0488
[ 77.438739][ T5999] RBP: 00007f778c1f0488 R08: 0000000000000000 R09: 0000000000000000
[ 77.438749][ T5999] R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffddb96a9a8
[ 77.438759][ T5999] R13: 0000000000000002 R14: 00007f778c218cc0 R15: 0000000000000002
[ 77.438781][ T5999]
[ 77.439340][ T5999] ==================================================================
[ 77.439350][ T5999] BUG: KASAN: slab-use-after-free in __list_del_entry_valid_or_report+0x18a/0x1d0
[ 77.439375][ T5999] Read of size 8 at addr ffff88802274e158 by task syz-executor227/5999
[ 77.439388][ T5999]
[ 77.439395][ T5999] CPU: 3 UID: 0 PID: 5999 Comm: syz-executor227 Not tainted syzkaller #0 PREEMPT(full)
[ 77.439413][ T5999] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 77.439423][ T5999] Call Trace:
[ 77.439427][ T5999]
[ 77.439433][ T5999] dump_stack_lvl+0x100/0x190
[ 77.439456][ T5999] print_report+0x13d/0x4b0
[ 77.439478][ T5999] ? __virt_addr_valid+0x239/0x430
[ 77.439497][ T5999] ? __list_del_entry_valid_or_report+0x18a/0x1d0
[ 77.439516][ T5999] kasan_report+0xdf/0x1c0
[ 77.439539][ T5999] ? __list_del_entry_valid_or_report+0x18a/0x1d0
[ 77.439561][ T5999] ? __pfx_uvcg_extension_drop+0x10/0x10
[ 77.439583][ T5999] __list_del_entry_valid_or_report+0x18a/0x1d0
[ 77.439605][ T5999] ? __pfx_uvcg_extension_drop+0x10/0x10
[ 77.439626][ T5999] uvcg_extension_drop+0x88/0x290
[ 77.439648][ T5999] ? __pfx_uvcg_extension_drop+0x10/0x10
[ 77.439669][ T5999] client_drop_item+0xa6/0x100
[ 77.439685][ T5999] configfs_mkdir+0x70b/0xd40
[ 77.439725][ T5999] ? __pfx_configfs_mkdir+0x10/0x10
[ 77.439750][ T5999] vfs_mkdir+0x364/0x850
[ 77.439767][ T5999] filename_mkdirat+0x48b/0x5e0
[ 77.439790][ T5999] ? __pfx_filename_mkdirat+0x10/0x10
[ 77.439811][ T5999] ? strncpy_from_user+0x19d/0x2d0
[ 77.439832][ T5999] ? do_getname+0x191/0x390
[ 77.439847][ T5999] __x64_sys_mkdir+0x6b/0x90
[ 77.439868][ T5999] do_syscall_64+0x123/0x790
[ 77.439885][ T5999] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.439900][ T5999] RIP: 0033:0x7f778c194d07
[ 77.439912][ T5999] Code: 77 01 c3 48 c7 c2 d8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 53 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 d8 ff ff ff f7 d8 64 89 02 b8
[ 77.439926][ T5999] RSP: 002b:00007ffddb96a878 EFLAGS: 00000202 ORIG_RAX: 0000000000000053
[ 77.439942][ T5999] RAX: ffffffffffffffda RBX: 0000000000002710 RCX: 00007f778c194d07
[ 77.439953][ T5999] RDX: 0000000000000000 RSI: 00000000000001ff RDI: 00007f778c1f0488
[ 77.439963][ T5999] RBP: 00007f778c1f0488 R08: 0000000000000000 R09: 0000000000000000
[ 77.439972][ T5999] R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffddb96a9a8
[ 77.439981][ T5999] R13: 0000000000000002 R14: 00007f778c218cc0 R15: 0000000000000002
[ 77.439996][ T5999]
[ 77.440001][ T5999]
[ 77.440005][ T5999] Allocated by task 5999:
[ 77.440012][ T5999] kasan_save_stack+0x30/0x50
[ 77.440030][ T5999] kasan_save_track+0x14/0x30
[ 77.440048][ T5999] __kasan_kmalloc+0xaa/0xb0
[ 77.440065][ T5999] __kmalloc_cache_noprof+0x2f8/0x6d0
[ 77.440085][ T5999] uvcg_extension_make+0x98/0x4e0
[ 77.440105][ T5999] configfs_mkdir+0x7ef/0xd40
[ 77.440121][ T5999] vfs_mkdir+0x364/0x850
[ 77.440134][ T5999] filename_mkdirat+0x48b/0x5e0
[ 77.440154][ T5999] __x64_sys_mkdir+0x6b/0x90
[ 77.440173][ T5999] do_syscall_64+0x123/0x790
[ 77.440186][ T5999] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.440201][ T5999]
[ 77.440204][ T5999] Freed by task 5999:
[ 77.440211][ T5999] kasan_save_stack+0x30/0x50
[ 77.440228][ T5999] kasan_save_track+0x14/0x30
[ 77.440245][ T5999] kasan_save_free_info+0x3b/0x70
[ 77.440258][ T5999] __kasan_slab_free+0x5f/0x80
[ 77.440276][ T5999] kfree+0x22b/0x6d0
[ 77.440287][ T5999] config_item_cleanup+0x146/0x240
[ 77.440305][ T5999] config_item_put+0x93/0xb0
[ 77.440322][ T5999] uvcg_extension_drop+0x80/0x290
[ 77.440341][ T5999] client_drop_item+0xa6/0x100
[ 77.440355][ T5999] configfs_mkdir+0x70b/0xd40
[ 77.440370][ T5999] vfs_mkdir+0x364/0x850
[ 77.440383][ T5999] filename_mkdirat+0x48b/0x5e0
[ 77.440406][ T5999] __x64_sys_mkdir+0x6b/0x90
[ 77.440425][ T5999] do_syscall_64+0x123/0x790
[ 77.440439][ T5999] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.440455][ T5999]
[ 77.440458][ T5999] The buggy address belongs to the object at ffff88802274e100
[ 77.440458][ T5999] which belongs to the cache kmalloc-192 of size 192
[ 77.440471][ T5999] The buggy address is located 88 bytes inside of
[ 77.440471][ T5999] freed 192-byte region [ffff88802274e100, ffff88802274e1c0)
[ 77.440487][ T5999]
[ 77.440491][ T5999] The buggy address belongs to the physical page:
[ 77.440499][ T5999] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2274e
[ 77.440514][ T5999] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 77.440528][ T5999] page_type: f5(slab)
[ 77.440543][ T5999] raw: 00fff00000000000 ffff88801c0423c0 dead000000000100 dead000000000122
[ 77.440558][ T5999] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[ 77.440567][ T5999] page dumped because: kasan: bad access detected
[ 77.440575][ T5999] page_owner tracks the page as allocated
[ 77.440580][ T5999] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 8964019714
[ 77.440605][ T5999] post_alloc_hook+0xfd/0x120
[ 77.440620][ T5999] get_page_from_freelist+0x110d/0x35d0
[ 77.440636][ T5999] __alloc_frozen_pages_noprof+0x2eb/0x3300
[ 77.440654][ T5999] new_slab+0xa9/0x6e0
[ 77.440668][ T5999] refill_objects+0xe3/0x410
[ 77.440683][ T5999] __pcs_replace_empty_main+0x35e/0x650
[ 77.440698][ T5999] __kmalloc_cache_noprof+0x4f4/0x6d0
[ 77.440714][ T5999] __usb_create_hcd+0x7b6/0xac0
[ 77.440731][ T5999] dummy_hcd_probe+0x130/0x2fa
[ 77.440748][ T5999] platform_probe+0x106/0x1d0
[ 77.440765][ T5999] really_probe+0x241/0xa60
[ 77.440784][ T5999] __driver_probe_device+0x210/0x460
[ 77.440805][ T5999] driver_probe_device+0x4a/0x140
[ 77.440824][ T5999] __device_attach_driver+0x1df/0x320
[ 77.440845][ T5999] bus_for_each_drv+0x159/0x1e0
[ 77.440861][ T5999] __device_attach+0x1e4/0x4d0
[ 77.440881][ T5999] page_owner free stack trace missing
[ 77.440886][ T5999]
[ 77.440890][ T5999] Memory state around the buggy address:
[ 77.440898][ T5999] ffff88802274e000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.440909][ T5999] ffff88802274e080: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 77.440920][ T5999] >ffff88802274e100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.440929][ T5999] ^
[ 77.440938][ T5999] ffff88802274e180: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 77.440949][ T5999] ffff88802274e200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.440958][ T5999] ==================================================================
[ 77.441025][ T5999] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 77.810475][ T5999] CPU: 3 UID: 0 PID: 5999 Comm: syz-executor227 Not tainted syzkaller #0 PREEMPT(full)
[ 77.813460][ T5999] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 77.816623][ T5999] Call Trace:
[ 77.817753][ T5999]
[ 77.818873][ T5999] dump_stack_lvl+0x100/0x190
[ 77.820506][ T5999] vpanic+0x553/0x970
[ 77.821883][ T5999] ? __pfx_vpanic+0x10/0x10
[ 77.823598][ T5999] ? mark_held_locks+0x40/0x70
[ 77.825258][ T5999] ? irqentry_exit+0x24d/0xa10
[ 77.827051][ T5999] ? __list_del_entry_valid_or_report+0x18a/0x1d0
[ 77.829208][ T5999] panic+0xd1/0xe0
[ 77.830513][ T5999] ? __pfx_panic+0x10/0x10
[ 77.831959][ T5999] ? __list_del_entry_valid_or_report+0x18a/0x1d0
[ 77.833958][ T5999] ? preempt_schedule_common+0x3c/0xb0
[ 77.835658][ T5999] check_panic_on_warn.cold+0x19/0x34
[ 77.837407][ T5999] end_report.part.0+0x3a/0x90
[ 77.839019][ T5999] kasan_report.cold+0xe/0x18
[ 77.840605][ T5999] ? __list_del_entry_valid_or_report+0x18a/0x1d0
[ 77.842763][ T5999] ? __pfx_uvcg_extension_drop+0x10/0x10
[ 77.844711][ T5999] __list_del_entry_valid_or_report+0x18a/0x1d0
[ 77.846756][ T5999] ? __pfx_uvcg_extension_drop+0x10/0x10
[ 77.848556][ T5999] uvcg_extension_drop+0x88/0x290
[ 77.850149][ T5999] ? __pfx_uvcg_extension_drop+0x10/0x10
[ 77.851897][ T5999] client_drop_item+0xa6/0x100
[ 77.853478][ T5999] configfs_mkdir+0x70b/0xd40
[ 77.855142][ T5999] ? __pfx_configfs_mkdir+0x10/0x10
[ 77.856954][ T5999] vfs_mkdir+0x364/0x850
[ 77.858537][ T5999] filename_mkdirat+0x48b/0x5e0
[ 77.860635][ T5999] ? __pfx_filename_mkdirat+0x10/0x10
[ 77.862985][ T5999] ? strncpy_from_user+0x19d/0x2d0
[ 77.865357][ T5999] ? do_getname+0x191/0x390
[ 77.867478][ T5999] __x64_sys_mkdir+0x6b/0x90
[ 77.869314][ T5999] do_syscall_64+0x123/0x790
[ 77.871155][ T5999] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.873498][ T5999] RIP: 0033:0x7f778c194d07
[ 77.874930][ T5999] Code: 77 01 c3 48 c7 c2 d8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 53 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 d8 ff ff ff f7 d8 64 89 02 b8
[ 77.880905][ T5999] RSP: 002b:00007ffddb96a878 EFLAGS: 00000202 ORIG_RAX: 0000000000000053
[ 77.883522][ T5999] RAX: ffffffffffffffda RBX: 0000000000002710 RCX: 00007f778c194d07
[ 77.885991][ T5999] RDX: 0000000000000000 RSI: 00000000000001ff RDI: 00007f778c1f0488
[ 77.888599][ T5999] RBP: 00007f778c1f0488 R08: 0000000000000000 R09: 0000000000000000
[ 77.891561][ T5999] R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffddb96a9a8
[ 77.894514][ T5999] R13: 0000000000000002 R14: 00007f778c218cc0 R15: 0000000000000002
[ 77.897227][ T5999]
[ 77.899015][ T5999] Kernel Offset: disabled
[ 77.900418][ T5999] Rebooting in 86400 seconds..