[ 76.079942][ T42] audit: type=1400 audit(1784390400.386:209): avc: denied { transition } for pid=5964 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 76.087392][ T42] audit: type=1400 audit(1784390400.386:210): avc: denied { noatsecure } for pid=5964 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 76.095151][ T42] audit: type=1400 audit(1784390400.386:211): avc: denied { rlimitinh } for pid=5964 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 76.101277][ T42] audit: type=1400 audit(1784390400.386:212): avc: denied { siginh } for pid=5964 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 79.931810][ T42] audit: type=1400 audit(1784390404.236:213): avc: denied { write } for pid=5972 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 79.998928][ T42] audit: type=1400 audit(1784390404.306:214): avc: denied { write } for pid=5975 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 80.997686][ T42] audit: type=1400 audit(1784390405.306:215): avc: denied { write } for pid=5978 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 81.042039][ T42] audit: type=1400 audit(1784390405.346:216): avc: denied { write } for pid=5981 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 81.640978][ T42] audit: type=1400 audit(1784390405.946:217): avc: denied { write } for pid=5984 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 81.698576][ T42] audit: type=1400 audit(1784390406.006:218): avc: denied { write } for pid=5987 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '[localhost]:38945' (ED25519) to the list of known hosts. [ 82.215575][ T42] audit: type=1400 audit(1784390406.526:219): avc: denied { write } for pid=5998 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 82.276775][ T42] audit: type=1400 audit(1784390406.586:220): avc: denied { write } for pid=6006 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 82.402389][ T10] cfg80211: failed to load regulatory.db 2026/07/18 16:00:07 parsed 1 programs [ 86.680472][ T42] audit: type=1400 audit(1784390410.986:221): avc: denied { read write } for pid=6014 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 86.688358][ T42] audit: type=1400 audit(1784390410.986:222): avc: denied { open } for pid=6014 comm="syz-executor" path="/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 86.737251][ T42] audit: type=1400 audit(1784390411.046:223): avc: denied { unlink } for pid=6014 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 87.281013][ T42] audit: type=1400 audit(1784390411.586:224): avc: denied { relabelto } for pid=6017 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 88.355670][ T6014] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 90.731045][ T42] audit: type=1400 audit(1784390415.036:225): avc: denied { sys_module } for pid=6026 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 91.142160][ T6026] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.144750][ T6026] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.147578][ T6026] bridge_slave_0: entered allmulticast mode [ 91.152208][ T6026] bridge_slave_0: entered promiscuous mode [ 91.157604][ T6026] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.160795][ T6026] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.163989][ T6026] bridge_slave_1: entered allmulticast mode [ 91.168003][ T6026] bridge_slave_1: entered promiscuous mode [ 91.216773][ T6026] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.223275][ T6026] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.281066][ T6026] team0: Port device team_slave_0 added [ 91.285880][ T6026] team0: Port device team_slave_1 added [ 91.336643][ T6026] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.339595][ T6026] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.349647][ T6026] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.358208][ T6026] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.361099][ T6026] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.371617][ T6026] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.424813][ T6026] hsr_slave_0: entered promiscuous mode [ 91.427566][ T6026] hsr_slave_1: entered promiscuous mode [ 91.602038][ T42] audit: type=1400 audit(1784390415.906:226): avc: denied { write } for pid=6042 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 91.661383][ T42] audit: type=1400 audit(1784390415.966:227): avc: denied { write } for pid=6046 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 91.753402][ T42] audit: type=1400 audit(1784390416.056:228): avc: denied { write } for pid=6048 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 91.812756][ T42] audit: type=1400 audit(1784390416.116:229): avc: denied { write } for pid=6051 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 91.883635][ T42] audit: type=1400 audit(1784390416.186:230): avc: denied { write } for pid=6053 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 91.948922][ T42] audit: type=1400 audit(1784390416.256:231): avc: denied { write } for pid=6056 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 92.019747][ T42] audit: type=1400 audit(1784390416.326:232): avc: denied { write } for pid=6058 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 92.027277][ T6026] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 92.033874][ T6026] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 92.037524][ T6026] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 92.042794][ T6026] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 92.047206][ T6026] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 92.056993][ T6026] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 92.060452][ T6026] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 92.067557][ T6026] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 92.082811][ T42] audit: type=1400 audit(1784390416.386:233): avc: denied { write } for pid=6062 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 92.117767][ T6026] 8021q: adding VLAN 0 to HW filter on device bond0 [ 92.134538][ T6026] 8021q: adding VLAN 0 to HW filter on device team0 [ 92.142193][ T1167] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.145315][ T1167] bridge0: port 1(bridge_slave_0) entered forwarding state [ 92.156277][ T81] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.158944][ T81] bridge0: port 2(bridge_slave_1) entered forwarding state [ 92.168138][ T42] audit: type=1400 audit(1784390416.476:234): avc: denied { write } for pid=6070 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 92.220620][ T42] audit: type=1400 audit(1784390416.526:235): avc: denied { write } for pid=6073 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 92.310294][ T42] audit: type=1400 audit(1784390416.616:236): avc: denied { write } for pid=6079 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 92.373514][ T42] audit: type=1400 audit(1784390416.676:237): avc: denied { write } for pid=6085 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 92.438987][ T6026] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.473272][ T6026] veth0_vlan: entered promiscuous mode [ 92.481897][ T6026] veth1_vlan: entered promiscuous mode [ 92.505636][ T6026] veth0_macvtap: entered promiscuous mode [ 92.510757][ T6026] veth1_macvtap: entered promiscuous mode [ 92.521646][ T6026] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.530418][ T6026] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.539007][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.542766][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.547648][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.552983][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.649016][ T5761] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 92.750333][ T5761] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 92.782782][ T5092] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 92.786559][ T5092] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 92.790633][ T5092] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 92.793613][ T5092] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 92.799494][ T5092] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 92.870875][ T5761] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 92.952742][ T5761] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 94.171972][ T1167] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.175366][ T1167] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.196573][ T81] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.199892][ T81] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 2026/07/18 16:00:19 executed programs: 0 [ 94.712294][ T64] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 94.715288][ T64] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 94.718151][ T64] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 94.723323][ T64] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 94.727032][ T64] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 95.172404][ T6191] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.175302][ T6191] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.178063][ T6191] bridge_slave_0: entered allmulticast mode [ 95.180967][ T6191] bridge_slave_0: entered promiscuous mode [ 95.184513][ T6191] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.186906][ T6191] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.189240][ T6191] bridge_slave_1: entered allmulticast mode [ 95.191887][ T6191] bridge_slave_1: entered promiscuous mode [ 95.238815][ T6191] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 95.244202][ T6191] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 95.293009][ T6191] team0: Port device team_slave_0 added [ 95.298220][ T6191] team0: Port device team_slave_1 added [ 95.341913][ T6191] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 95.344535][ T6191] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.353633][ T6191] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 95.361783][ T6191] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 95.364209][ T6191] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.372969][ T6191] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 95.433349][ T6191] hsr_slave_0: entered promiscuous mode [ 95.436216][ T6191] hsr_slave_1: entered promiscuous mode [ 95.438708][ T6191] debugfs: 'hsr0' already exists in 'hsr' [ 95.440838][ T6191] Cannot create hsr debugfs directory [ 96.092763][ T5761] bridge_slave_1: left allmulticast mode [ 96.094640][ T5761] bridge_slave_1: left promiscuous mode [ 96.096402][ T5761] bridge0: port 2(bridge_slave_1) entered disabled state [ 96.099829][ T5761] bridge_slave_0: left allmulticast mode [ 96.101507][ T5761] bridge_slave_0: left promiscuous mode [ 96.103241][ T5761] bridge0: port 1(bridge_slave_0) entered disabled state [ 96.203654][ T5761] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 96.209497][ T5761] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 96.214298][ T5761] bond0 (unregistering): Released all slaves [ 96.378004][ T5761] hsr_slave_0: left promiscuous mode [ 96.381511][ T5761] hsr_slave_1: left promiscuous mode [ 96.384570][ T5761] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 96.387709][ T5761] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 96.391388][ T5761] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 96.395559][ T5761] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 96.404969][ T5761] veth1_macvtap: left promiscuous mode [ 96.407227][ T5761] veth0_macvtap: left promiscuous mode [ 96.409072][ T5761] veth1_vlan: left promiscuous mode [ 96.411156][ T5761] veth0_vlan: left promiscuous mode [ 96.579379][ T5761] team0 (unregistering): Port device team_slave_1 removed [ 96.590423][ T5761] team0 (unregistering): Port device team_slave_0 removed [ 96.660207][ T5446] 8021q: adding VLAN 0 to HW filter on device eth2 [ 96.794693][ T5092] Bluetooth: hci0: command tx timeout [ 96.828409][ T42] kauditd_printk_skb: 17 callbacks suppressed [ 96.828426][ T42] audit: type=1400 audit(1784390421.136:255): avc: denied { write } for pid=6217 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 96.887892][ T42] audit: type=1400 audit(1784390421.196:256): avc: denied { write } for pid=6220 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 96.968151][ T42] audit: type=1400 audit(1784390421.276:257): avc: denied { write } for pid=6222 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 96.978699][ T6191] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 96.985536][ T6191] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 96.989484][ T6191] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 97.003883][ T6191] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 97.008287][ T6191] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 97.015425][ T6191] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 97.019077][ T6191] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 97.025614][ T6191] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 97.027099][ T42] audit: type=1400 audit(1784390421.336:258): avc: denied { write } for pid=6225 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 97.088974][ T6191] 8021q: adding VLAN 0 to HW filter on device bond0 [ 97.097736][ T6191] 8021q: adding VLAN 0 to HW filter on device team0 [ 97.102720][ T81] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.105289][ T81] bridge0: port 1(bridge_slave_0) entered forwarding state [ 97.111914][ T81] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.114599][ T81] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.707151][ T6191] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 97.737644][ T6191] veth0_vlan: entered promiscuous mode [ 97.753284][ T6191] veth1_vlan: entered promiscuous mode [ 97.785435][ T6191] veth0_macvtap: entered promiscuous mode [ 97.792440][ T6191] veth1_macvtap: entered promiscuous mode [ 97.814723][ T6191] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 97.824268][ T6191] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 97.831320][ T5604] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.837969][ T5604] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.842782][ T5604] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.846774][ T5604] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.902502][ T81] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.905395][ T81] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.923426][ T1167] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.926709][ T1167] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.961896][ T42] audit: type=1400 audit(1784390422.266:259): avc: denied { create } for pid=6245 comm="syz.0.16" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 97.969395][ T42] audit: type=1400 audit(1784390422.266:260): avc: denied { write } for pid=6245 comm="syz.0.16" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 98.013627][ T42] audit: type=1400 audit(1784390422.316:261): avc: denied { read write } for pid=6245 comm="syz.0.16" name="rdma_cm" dev="devtmpfs" ino=1294 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 98.022295][ T42] audit: type=1400 audit(1784390422.326:262): avc: denied { open } for pid=6245 comm="syz.0.16" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1294 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 98.132888][ T6246] infiniband syz1: set active [ 98.134875][ T6246] infiniband syz1: added syz_tun [ 98.145834][ T6246] smbdirect: ib_dev[syz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 98.150613][ T6246] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 98.157280][ T6246] smbdirect: ib_dev[syz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 98.178376][ T6246] RDS/IB: syz1: added [ 98.180210][ T6246] smc: adding ib device syz1 with port count 1 [ 98.182707][ T6246] smc: ib device syz1 port 1 has no pnetid [ 98.344427][ T6252] syz1: rxe_newlink: already configured on syz_tun [ 98.348903][ T5761] ================================================================== [ 98.351978][ T5761] BUG: KASAN: slab-use-after-free in ucma_create_uevent+0xb60/0xbe0 [ 98.354463][ T5761] Read of size 8 at addr ffff888053083c10 by task kworker/u32:3/5761 [ 98.359398][ T5761] [ 98.360389][ T5761] CPU: 2 UID: 0 PID: 5761 Comm: kworker/u32:3 Not tainted syzkaller #0 PREEMPT(full) [ 98.360412][ T5761] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 98.360457][ T5761] Workqueue: rdma_cm cma_iboe_join_work_handler [ 98.360519][ T5761] Call Trace: [ 98.360527][ T5761] [ 98.360534][ T5761] dump_stack_lvl+0x100/0x190 [ 98.360560][ T5761] print_report+0x13d/0x4b0 [ 98.360585][ T5761] ? __virt_addr_valid+0x239/0x430 [ 98.360608][ T5761] ? ucma_create_uevent+0xb60/0xbe0 [ 98.360630][ T5761] kasan_report+0xdf/0x1c0 [ 98.360651][ T5761] ? ucma_create_uevent+0xb60/0xbe0 [ 98.360677][ T5761] ucma_create_uevent+0xb60/0xbe0 [ 98.360701][ T5761] ucma_event_handler+0x102/0x940 [ 98.360726][ T5761] ? rcu_is_watching+0x12/0xc0 [ 98.360752][ T5761] cma_cm_event_handler+0x99/0x300 [ 98.360775][ T5761] cma_iboe_join_work_handler+0xca/0x180 [ 98.360798][ T5761] process_one_work+0xa23/0x1940 [ 98.360821][ T5761] ? __pfx_process_one_work+0x10/0x10 [ 98.360841][ T5761] ? __pfx_cma_iboe_join_work_handler+0x10/0x10 [ 98.360865][ T5761] worker_thread+0x5ef/0xe50 [ 98.360884][ T5761] ? __pfx_worker_thread+0x10/0x10 [ 98.360902][ T5761] ? kthread+0x13a/0x450 [ 98.360925][ T5761] ? __pfx_worker_thread+0x10/0x10 [ 98.360941][ T5761] kthread+0x370/0x450 [ 98.360966][ T5761] ? __pfx_kthread+0x10/0x10 [ 98.360990][ T5761] ret_from_fork+0x72b/0xd50 [ 98.361013][ T5761] ? __pfx_ret_from_fork+0x10/0x10 [ 98.361034][ T5761] ? __switch_to+0x800/0x10f0 [ 98.361052][ T5761] ? __pfx_kthread+0x10/0x10 [ 98.361077][ T5761] ret_from_fork_asm+0x1a/0x30 [ 98.361106][ T5761] [ 98.361112][ T5761] [ 98.423926][ T5761] Allocated by task 6252: [ 98.425543][ T5761] kasan_save_stack+0x30/0x50 [ 98.427349][ T5761] kasan_save_track+0x14/0x30 [ 98.428903][ T5761] __kasan_kmalloc+0xaa/0xb0 [ 98.430458][ T5761] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 98.432475][ T5761] ucma_process_join+0x232/0xa20 [ 98.434199][ T5761] ucma_join_multicast+0xe9/0x160 [ 98.436048][ T5761] ucma_write+0x1fb/0x330 [ 98.437783][ T5761] vfs_write+0x2aa/0x1050 [ 98.439550][ T5761] ksys_write+0x1f8/0x250 [ 98.441271][ T5761] do_syscall_64+0x115/0x870 [ 98.443144][ T5761] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.445488][ T5761] [ 98.446472][ T5761] Freed by task 6252: [ 98.448116][ T5761] kasan_save_stack+0x30/0x50 [ 98.449895][ T5761] kasan_save_track+0x14/0x30 [ 98.451738][ T5761] kasan_save_free_info+0x3b/0x70 [ 98.453486][ T5761] __kasan_slab_free+0x5f/0x80 [ 98.455405][ T5761] kfree+0x22b/0x6c0 [ 98.456953][ T5761] ucma_process_join+0x39a/0xa20 [ 98.458694][ T5761] ucma_join_multicast+0xe9/0x160 [ 98.460299][ T5761] ucma_write+0x1fb/0x330 [ 98.461964][ T5761] vfs_write+0x2aa/0x1050 [ 98.463681][ T5761] ksys_write+0x1f8/0x250 [ 98.465429][ T5761] do_syscall_64+0x115/0x870 [ 98.467324][ T5761] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.469636][ T5761] [ 98.470617][ T5761] The buggy address belongs to the object at ffff888053083c00 [ 98.470617][ T5761] which belongs to the cache kmalloc-192 of size 192 [ 98.476046][ T5761] The buggy address is located 16 bytes inside of [ 98.476046][ T5761] freed 192-byte region [ffff888053083c00, ffff888053083cc0) [ 98.481259][ T5761] [ 98.482232][ T5761] The buggy address belongs to the physical page: [ 98.484702][ T5761] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x53083 [ 98.487945][ T5761] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 98.490716][ T5761] page_type: f5(slab) [ 98.492310][ T5761] raw: 00fff00000000000 ffff88801bc423c0 dead000000000122 0000000000000000 [ 98.495636][ T5761] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 98.498883][ T5761] page dumped because: kasan: bad access detected [ 98.501220][ T5761] page_owner tracks the page as allocated [ 98.503444][ T5761] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6191, tgid 6191 (syz-executor), ts 97952770545, free_ts 97952313814 [ 98.511480][ T5761] post_alloc_hook+0xfd/0x120 [ 98.513421][ T5761] get_page_from_freelist+0xf48/0x3530 [ 98.515499][ T5761] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 98.517404][ T5761] new_slab+0xa2/0x650 [ 98.518664][ T5761] refill_objects+0xe3/0x410 [ 98.520092][ T5761] __pcs_replace_empty_main+0x376/0x680 [ 98.521820][ T5761] __kmalloc_noprof+0x66d/0x820 [ 98.523350][ T5761] __memcg_list_lru_alloc+0x418/0x680 [ 98.525463][ T5761] memcg_list_lru_alloc+0xd3/0x100 [ 98.527562][ T5761] __memcg_slab_post_alloc_hook+0x28b/0x1160 [ 98.529972][ T5761] kmem_cache_alloc_lru_noprof+0x583/0x6a0 [ 98.532326][ T5761] shmem_alloc_inode+0x25/0x50 [ 98.534142][ T5761] alloc_inode+0x68/0x250 [ 98.535862][ T5761] new_inode+0x22/0x1c0 [ 98.537595][ T5761] shmem_get_inode+0x1e3/0xf70 [ 98.539578][ T5761] shmem_mknod+0x217/0x480 [ 98.541380][ T5761] page last free pid 6191 tgid 6191 stack trace: [ 98.543945][ T5761] __free_frozen_pages+0x79f/0x1090 [ 98.545955][ T5761] __kasan_populate_vmalloc+0x164/0x210 [ 98.547984][ T5761] alloc_vmap_area+0x95d/0x2bb0 [ 98.550076][ T5761] __get_vm_area_node+0x1ca/0x330 [ 98.552563][ T5761] __vmalloc_node_range_noprof+0x228/0x1630 [ 98.555059][ T5761] __vmalloc_node_noprof+0xad/0xf0 [ 98.557089][ T5761] do_ip6t_get_ctl+0x7e0/0xc30 [ 98.558729][ T5761] nf_getsockopt+0x7c/0xe0 [ 98.560275][ T5761] ipv6_getsockopt+0x207/0x2a0 [ 98.562261][ T5761] tcp_getsockopt+0xa1/0x110 [ 98.564178][ T5761] do_sock_getsockopt+0x50a/0x6e0 [ 98.566194][ T5761] __sys_getsockopt+0x148/0x260 [ 98.568096][ T5761] __x64_sys_getsockopt+0xbd/0x160 [ 98.570164][ T5761] do_syscall_64+0x115/0x870 [ 98.572118][ T5761] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.574515][ T5761] [ 98.575547][ T5761] Memory state around the buggy address: [ 98.577854][ T5761] ffff888053083b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 98.581179][ T5761] ffff888053083b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 98.584512][ T5761] >ffff888053083c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 98.587866][ T5761] ^ [ 98.589810][ T5761] ffff888053083c80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 98.593161][ T5761] ffff888053083d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 98.596389][ T5761] ================================================================== [ 98.601556][ T5761] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 98.604616][ T5761] CPU: 2 UID: 0 PID: 5761 Comm: kworker/u32:3 Not tainted syzkaller #0 PREEMPT(full) [ 98.608301][ T5761] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 98.612478][ T5761] Workqueue: rdma_cm cma_iboe_join_work_handler [ 98.615114][ T5761] Call Trace: [ 98.616483][ T5761] [ 98.617532][ T5761] dump_stack_lvl+0x100/0x190 [ 98.619225][ T5761] vpanic+0x552/0x970 [ 98.620636][ T5761] ? __pfx_vpanic+0x10/0x10 [ 98.622443][ T5761] ? mark_held_locks+0x40/0x70 [ 98.624270][ T5761] ? ucma_create_uevent+0xb60/0xbe0 [ 98.626380][ T5761] panic+0xd1/0xe0 [ 98.627891][ T5761] ? __pfx_panic+0x10/0x10 [ 98.629769][ T5761] ? ucma_create_uevent+0xb60/0xbe0 [ 98.631500][ T5761] ? preempt_schedule_common+0x42/0xc0 [ 98.633270][ T5761] ? check_panic_on_warn+0x1f/0x90 [ 98.635329][ T5761] check_panic_on_warn.cold+0x19/0x34 [ 98.637319][ T5761] end_report.part.0+0x3a/0x90 [ 98.639351][ T5761] kasan_report.cold+0xe/0x18 [ 98.641369][ T5761] ? ucma_create_uevent+0xb60/0xbe0 [ 98.643189][ T5761] ucma_create_uevent+0xb60/0xbe0 [ 98.645292][ T5761] ucma_event_handler+0x102/0x940 [ 98.647428][ T5761] ? rcu_is_watching+0x12/0xc0 [ 98.649143][ T5761] cma_cm_event_handler+0x99/0x300 [ 98.651314][ T5761] cma_iboe_join_work_handler+0xca/0x180 [ 98.653668][ T5761] process_one_work+0xa23/0x1940 [ 98.655267][ T5761] ? __pfx_process_one_work+0x10/0x10 [ 98.657487][ T5761] ? __pfx_cma_iboe_join_work_handler+0x10/0x10 [ 98.660099][ T5761] worker_thread+0x5ef/0xe50 [ 98.662054][ T5761] ? __pfx_worker_thread+0x10/0x10 [ 98.664207][ T5761] ? kthread+0x13a/0x450 [ 98.665979][ T5761] ? __pfx_worker_thread+0x10/0x10 [ 98.667823][ T5761] kthread+0x370/0x450 [ 98.669299][ T5761] ? __pfx_kthread+0x10/0x10 [ 98.671298][ T5761] ret_from_fork+0x72b/0xd50 [ 98.673262][ T5761] ? __pfx_ret_from_fork+0x10/0x10 [ 98.675433][ T5761] ? __switch_to+0x800/0x10f0 [ 98.677234][ T5761] ? __pfx_kthread+0x10/0x10 [ 98.679186][ T5761] ret_from_fork_asm+0x1a/0x30 [ 98.681203][ T5761] [ 98.683241][ T5761] Kernel Offset: disabled [ 98.685067][ T5761] Rebooting in 86400 seconds..