[ 71.503865][ T42] kauditd_printk_skb: 10 callbacks suppressed
[ 71.503887][ T42] audit: type=1400 audit(1787762893.143:209): avc: denied { transition } for pid=5967 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 71.515401][ T42] audit: type=1400 audit(1787762893.143:210): avc: denied { noatsecure } for pid=5967 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 71.523349][ T42] audit: type=1400 audit(1787762893.143:211): avc: denied { rlimitinh } for pid=5967 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 71.530894][ T42] audit: type=1400 audit(1787762893.143:212): avc: denied { siginh } for pid=5967 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 73.916517][ T42] audit: type=1400 audit(1787762895.553:213): avc: denied { write } for pid=5972 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 73.974344][ T42] audit: type=1400 audit(1787762895.613:214): avc: denied { write } for pid=5975 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 74.649320][ T42] audit: type=1400 audit(1787762896.293:215): avc: denied { write } for pid=5978 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 74.695475][ T42] audit: type=1400 audit(1787762896.333:216): avc: denied { write } for pid=5981 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 74.812741][ T42] audit: type=1400 audit(1787762896.453:217): avc: denied { write } for pid=5984 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 74.868268][ T42] audit: type=1400 audit(1787762896.513:218): avc: denied { write } for pid=5987 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 76.950886][ T42] kauditd_printk_skb: 4 callbacks suppressed
[ 76.950897][ T42] audit: type=1400 audit(1787762898.593:223): avc: denied { write } for pid=6006 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 76.993023][ T42] audit: type=1400 audit(1787762898.633:224): avc: denied { write } for pid=6009 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 77.362116][ T42] audit: type=1400 audit(1787762899.003:225): avc: denied { write } for pid=6017 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
Warning: Permanently added '[localhost]:60246' (ED25519) to the list of known hosts.
[ 77.422232][ T42] audit: type=1400 audit(1787762899.063:226): avc: denied { write } for pid=6021 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 77.473791][ T42] audit: type=1400 audit(1787762899.113:227): avc: denied { mounton } for pid=6023 comm="syz-executor311" path="/sys/kernel/config" dev="configfs" ino=3078 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 77.483718][ T42] audit: type=1400 audit(1787762899.113:228): avc: denied { mount } for pid=6023 comm="syz-executor311" name="/" dev="configfs" ino=3078 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1
[ 77.493821][ T42] audit: type=1400 audit(1787762899.113:229): avc: denied { search } for pid=6023 comm="syz-executor311" name="/" dev="configfs" ino=3078 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 77.497846][ T6023] audit: audit_backlog=65 > audit_backlog_limit=64
[ 77.503160][ T42] audit: type=1400 audit(1787762899.113:230): avc: denied { search } for pid=6023 comm="syz-executor311" name="usb_gadget" dev="configfs" ino=2244 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 77.503198][ T42] audit: type=1400 audit(1787762899.113:231): avc: denied { write search } for pid=6023 comm="syz-executor311" name="usb_gadget" dev="configfs" ino=2244 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 77.766590][ T5776] usb 7-1: new high-speed USB device number 2 using dummy_hcd
[ 77.926868][ T5776] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0104, bcdDevice= 7.02
[ 77.931961][ T5776] usb 7-1: Dual-Role OTG device on HNP port
[ 77.934476][ T5776] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 77.937617][ T5776] usb 7-1: Product: Dummy
[ 77.939352][ T5776] usb 7-1: Manufacturer: Linux
[ 77.941179][ T5776] usb 7-1: SerialNumber: 123456
[ 77.956645][ T5776] cdc_acm 7-1:1.0: ttyACM0: USB ACM device
[ 78.049627][ T6023] usbip-host 7-1: usbip-host: register new device (bus 7 dev 2)
[ 78.056060][ T6023] usbip-host 7-1: stub up
[ 78.217148][ T6028] ==================================================================
[ 78.220358][ T6028] BUG: KASAN: slab-use-after-free in stub_rx_loop+0x2d3b/0x31c0
[ 78.223348][ T6028] Read of size 4 at addr ffff888034999db0 by task stub_rx/6028
[ 78.227945][ T6028]
[ 78.228919][ T6028] CPU: 0 UID: 0 PID: 6028 Comm: stub_rx Not tainted syzkaller #0 PREEMPT(full)
[ 78.228940][ T6028] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 78.228950][ T6028] Call Trace:
[ 78.228958][ T6028]
[ 78.228965][ T6028] dump_stack_lvl+0x100/0x190
[ 78.228990][ T6028] print_report+0x13d/0x4b0
[ 78.229015][ T6028] ? __virt_addr_valid+0x239/0x430
[ 78.229040][ T6028] ? stub_rx_loop+0x2d3b/0x31c0
[ 78.229061][ T6028] kasan_report+0xdf/0x1c0
[ 78.229086][ T6028] ? stub_rx_loop+0x2d3b/0x31c0
[ 78.229108][ T6028] stub_rx_loop+0x2d3b/0x31c0
[ 78.229132][ T6028] ? __kthread_parkme+0xbb/0x230
[ 78.229149][ T6028] ? __pfx_stub_rx_loop+0x10/0x10
[ 78.229172][ T6028] ? __kthread_parkme+0x18f/0x230
[ 78.229189][ T6028] ? kthread+0x13a/0x450
[ 78.229205][ T6028] ? __pfx_stub_rx_loop+0x10/0x10
[ 78.229223][ T6028] kthread+0x373/0x450
[ 78.229243][ T6028] ? __pfx_kthread+0x10/0x10
[ 78.229262][ T6028] ret_from_fork+0x730/0xd60
[ 78.229288][ T6028] ? __pfx_ret_from_fork+0x10/0x10
[ 78.229312][ T6028] ? __switch_to+0x800/0x10f0
[ 78.229330][ T6028] ? __pfx_kthread+0x10/0x10
[ 78.229349][ T6028] ret_from_fork_asm+0x1a/0x30
[ 78.229374][ T6028]
[ 78.229381][ T6028]
[ 78.276805][ T6028] Allocated by task 6028:
[ 78.278514][ T6028] kasan_save_stack+0x30/0x50
[ 78.280398][ T6028] kasan_save_track+0x14/0x30
[ 78.282294][ T6028] __kasan_slab_alloc+0x89/0x90
[ 78.284229][ T6028] kmem_cache_alloc_noprof+0x26b/0x6a0
[ 78.286406][ T6028] stub_rx_loop+0x638/0x31c0
[ 78.288216][ T6028] kthread+0x373/0x450
[ 78.289770][ T6028] ret_from_fork+0x730/0xd60
[ 78.291552][ T6028] ret_from_fork_asm+0x1a/0x30
[ 78.293395][ T6028]
[ 78.294343][ T6028] Freed by task 6029:
[ 78.295899][ T6028] kasan_save_stack+0x30/0x50
[ 78.297812][ T6028] kasan_save_track+0x14/0x30
[ 78.299677][ T6028] kasan_save_free_info+0x3b/0x70
[ 78.301655][ T6028] __kasan_slab_free+0x5f/0x80
[ 78.303563][ T6028] kmem_cache_free+0x127/0x6b0
[ 78.305471][ T6028] stub_free_priv_and_urb+0x427/0x570
[ 78.307569][ T6028] stub_send_ret_submit+0xecf/0x1810
[ 78.309530][ T6028] stub_tx_loop+0xe2/0x3e0
[ 78.311332][ T6028] kthread+0x373/0x450
[ 78.312933][ T6028] ret_from_fork+0x730/0xd60
[ 78.314738][ T6028] ret_from_fork_asm+0x1a/0x30
[ 78.316681][ T6028]
[ 78.317665][ T6028] The buggy address belongs to the object at ffff888034999d80
[ 78.317665][ T6028] which belongs to the cache stub_priv of size 64
[ 78.322897][ T6028] The buggy address is located 48 bytes inside of
[ 78.322897][ T6028] freed 64-byte region [ffff888034999d80, ffff888034999dc0)
[ 78.328144][ T6028]
[ 78.329131][ T6028] The buggy address belongs to the physical page:
[ 78.331683][ T6028] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888034999e00 pfn:0x34999
[ 78.335662][ T6028] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
[ 78.338847][ T6028] page_type: f5(slab)
[ 78.340386][ T6028] raw: 00fff00000000200 ffff8881016c7540 ffff88802aafa948 ffff88802aafa948
[ 78.343620][ T6028] raw: ffff888034999e00 000000080020001c 00000000f5000000 0000000000000000
[ 78.346827][ T6028] page dumped because: kasan: bad access detected
[ 78.349302][ T6028] page_owner tracks the page as allocated
[ 78.351474][ T6028] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6028, tgid 6028 (stub_rx), ts 78215496489
[ 78.358472][ T6028] post_alloc_hook+0xfd/0x120
[ 78.360336][ T6028] get_page_from_freelist+0x110d/0x35b0
[ 78.362511][ T6028] __alloc_frozen_pages_noprof+0x2eb/0x3300
[ 78.364788][ T6028] new_slab+0xa5/0x640
[ 78.366409][ T6028] refill_objects+0xe3/0x410
[ 78.368229][ T6028] __pcs_replace_empty_main+0x372/0x680
[ 78.370372][ T6028] kmem_cache_alloc_noprof+0x46e/0x6a0
[ 78.372506][ T6028] stub_rx_loop+0x638/0x31c0
[ 78.374315][ T6028] kthread+0x373/0x450
[ 78.375913][ T6028] ret_from_fork+0x730/0xd60
[ 78.377770][ T6028] ret_from_fork_asm+0x1a/0x30
[ 78.379628][ T6028] page last free pid 15 tgid 15 ts 77527058318 stack trace:
[ 78.382408][ T6028] __free_frozen_pages+0x79f/0x10f0
[ 78.384407][ T6028] tlb_remove_table_rcu+0x2cf/0x380
[ 78.386417][ T6028] rcu_core+0x5a2/0x10e0
[ 78.388089][ T6028] handle_softirqs+0x1e6/0x9d0
[ 78.389955][ T6028] __irq_exit_rcu+0x194/0x210
[ 78.391808][ T6028] irq_exit_rcu+0x9/0x30
[ 78.393549][ T6028] sysvec_apic_timer_interrupt+0xa3/0xc0
[ 78.395854][ T6028] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 78.398320][ T6028]
[ 78.399315][ T6028] Memory state around the buggy address:
[ 78.401584][ T6028] ffff888034999c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.404812][ T6028] ffff888034999d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.408082][ T6028] >ffff888034999d80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 78.411313][ T6028] ^
[ 78.413581][ T6028] ffff888034999e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.416838][ T6028] ffff888034999e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.420068][ T6028] ==================================================================
[ 78.423513][ T6028] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 78.426472][ T6028] CPU: 0 UID: 0 PID: 6028 Comm: stub_rx Not tainted syzkaller #0 PREEMPT(full)
[ 78.430069][ T6028] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 78.434102][ T6028] Call Trace:
[ 78.435509][ T6028]
[ 78.436731][ T6028] dump_stack_lvl+0x100/0x190
[ 78.438665][ T6028] vpanic+0x553/0x970
[ 78.440300][ T6028] ? __pfx_vpanic+0x10/0x10
[ 78.442178][ T6028] ? rcu_is_watching+0x13/0xc0
[ 78.444138][ T6028] ? irqentry_exit+0x24d/0xa10
[ 78.446062][ T6028] ? stub_rx_loop+0x2d3b/0x31c0
[ 78.448115][ T6028] panic+0xd1/0xe0
[ 78.449675][ T6028] ? __pfx_panic+0x10/0x10
[ 78.451515][ T6028] ? stub_rx_loop+0x2d3b/0x31c0
[ 78.453499][ T6028] ? preempt_schedule_common+0x3c/0xb0
[ 78.455726][ T6028] check_panic_on_warn.cold+0x19/0x34
[ 78.457914][ T6028] end_report.part.0+0x3a/0x90
[ 78.459899][ T6028] kasan_report.cold+0xe/0x18
[ 78.461843][ T6028] ? stub_rx_loop+0x2d3b/0x31c0
[ 78.463856][ T6028] stub_rx_loop+0x2d3b/0x31c0
[ 78.465793][ T6028] ? __kthread_parkme+0xbb/0x230
[ 78.467830][ T6028] ? __pfx_stub_rx_loop+0x10/0x10
[ 78.469887][ T6028] ? __kthread_parkme+0x18f/0x230
[ 78.471965][ T6028] ? kthread+0x13a/0x450
[ 78.473707][ T6028] ? __pfx_stub_rx_loop+0x10/0x10
[ 78.475767][ T6028] kthread+0x373/0x450
[ 78.477477][ T6028] ? __pfx_kthread+0x10/0x10
[ 78.479393][ T6028] ret_from_fork+0x730/0xd60
[ 78.481288][ T6028] ? __pfx_ret_from_fork+0x10/0x10
[ 78.483419][ T6028] ? __switch_to+0x800/0x10f0
[ 78.485343][ T6028] ? __pfx_kthread+0x10/0x10
[ 78.487259][ T6028] ret_from_fork_asm+0x1a/0x30
[ 78.489230][ T6028]
[ 78.491220][ T6028] Kernel Offset: disabled
[ 78.492990][ T6028] Rebooting in 86400 seconds..