Warning: Permanently added '10.128.1.181' (ED25519) to the list of known hosts.
2026/07/07 14:15:44 parsed 1 programs
2026/07/07 14:15:44 serving rpc on tcp://35365
[ 88.498569][ T29] audit: type=1400 audit(1783433746.914:122): avc: denied { unlink } for pid=4012 comm="syz-executor" name="swap-file" dev="sda1" ino=2027 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t"
Setting up swapspace version 1, size = 127995904 bytes
[ 88.633956][ T4012] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 102.099054][ T29] audit: type=1401 audit(1783433760.514:123): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768"
2026/07/07 14:16:01 executed programs: 0
2026/07/07 14:16:11 executed programs: 2
[ 113.017175][ T29] audit: type=1400 audit(1783433771.434:124): avc: denied { read write } for pid=4994 comm="syz.3.17" name="raw-gadget" dev="devtmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 113.041211][ T29] audit: type=1400 audit(1783433771.434:125): avc: denied { open } for pid=4994 comm="syz.3.17" path="/dev/raw-gadget" dev="devtmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 113.079668][ T29] audit: type=1400 audit(1783433771.434:126): avc: denied { ioctl } for pid=4994 comm="syz.3.17" path="/dev/raw-gadget" dev="devtmpfs" ino=236 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 113.264769][ T711] usb 4-1: new high-speed USB device number 2 using dummy_hcd
[ 113.428407][ T711] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[ 113.437680][ T711] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 113.446265][ T711] usb 4-1: Product: syz
[ 113.450425][ T711] usb 4-1: Manufacturer: syz
[ 113.455410][ T711] usb 4-1: SerialNumber: syz
[ 113.468881][ T711] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[ 113.547502][ T29] audit: type=1400 audit(1783433771.964:127): avc: denied { firmware_load } for pid=4055 comm="kworker/1:3" path="/lib/firmware/ath9k_htc/htc_9271-1.4.0.fw" dev="sda1" ino=313 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1
[ 113.557609][ T4055] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[ 113.773144][ T711] usb 4-1: USB disconnect, device number 2
[ 114.654459][ T4055] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive
[ 114.662004][ T4055] ath9k_htc: Failed to initialize the device
[ 114.669748][ T711] usb 4-1: ath9k_htc: USB layer deinitialized
[ 114.965234][ T711] usb 4-1: new high-speed USB device number 3 using dummy_hcd
[ 115.128154][ T711] usb 4-1: New USB device found, idVendor=0cf3, idProduct=1002, bcdDevice= 1.08
[ 115.137739][ T711] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 115.146314][ T711] usb 4-1: Product: syz
[ 115.150587][ T711] usb 4-1: Manufacturer: syz
[ 115.155238][ T711] usb 4-1: SerialNumber: syz
[ 115.295230][ T711] usb 4-1: reset high-speed USB device number 3 using dummy_hcd
[ 115.984496][ T711] usb 4-1: device descriptor read/64, error -71
[ 116.272043][ T23] usb 4-1: driver API: 1.9.9 2016-02-15 [1-1]
[ 116.278679][ T23] usb 4-1: firmware API: 1.9.6 2012-07-07
[ 116.489763][ C1] ==================================================================
[ 116.498050][ C1] BUG: KASAN: slab-out-of-bounds in carl9170_tx_process_status+0x21f/0x230
[ 116.507393][ C1] Read of size 1 at addr ffff8881087e9b41 by task swapper/1/0
[ 116.514855][ C1]
[ 116.517314][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(lazy)
[ 116.517336][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
[ 116.517353][ C1] Call Trace:
[ 116.517365][ C1]
[ 116.517374][ C1] dump_stack_lvl+0x100/0x190
[ 116.517404][ C1] print_report+0x13d/0x4b0
[ 116.517427][ C1] ? __virt_addr_valid+0x239/0x430
[ 116.517448][ C1] ? carl9170_tx_process_status+0x21f/0x230
[ 116.517477][ C1] kasan_report+0xdf/0x1c0
[ 116.517497][ C1] ? carl9170_tx_process_status+0x21f/0x230
[ 116.517521][ C1] carl9170_tx_process_status+0x21f/0x230
[ 116.517545][ C1] carl9170_handle_command_response+0x3c8/0xc50
[ 116.517569][ C1] carl9170_usb_rx_irq_complete+0xfc/0x1b0
[ 116.517586][ C1] __usb_hcd_giveback_urb+0x38d/0x610
[ 116.517610][ C1] usb_hcd_giveback_urb+0x3ca/0x4a0
[ 116.517631][ C1] dummy_timer+0xda1/0x36c0
[ 116.517659][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80
[ 116.517680][ C1] ? __pfx_dummy_timer+0x10/0x10
[ 116.517700][ C1] ? rcu_is_watching+0x12/0xc0
[ 116.517733][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80
[ 116.517754][ C1] ? __pfx_dummy_timer+0x10/0x10
[ 116.517774][ C1] __hrtimer_run_queues+0x462/0x9c0
[ 116.517800][ C1] hrtimer_run_softirq+0x17d/0x2c0
[ 116.517823][ C1] handle_softirqs+0x1dd/0x990
[ 116.517848][ C1] ? __pfx_handle_softirqs+0x10/0x10
[ 116.517871][ C1] ? _raw_spin_unlock+0x28/0x50
[ 116.517885][ C1] ? __hrtimer_rearm_deferred+0x9b/0x720
[ 116.517910][ C1] __irq_exit_rcu+0x160/0x210
[ 116.517932][ C1] irq_exit_rcu+0x9/0x30
[ 116.517954][ C1] sysvec_apic_timer_interrupt+0x8f/0xb0
[ 116.517974][ C1]
[ 116.517979][ C1]
[ 116.517985][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 116.518004][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20
[ 116.518024][ C1] Code: 90 ac 01 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 03 8f 0b 00 fb f4 3c f6 02 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
[ 116.518045][ C1] RSP: 0018:ffffc9000013fe10 EFLAGS: 00000246
[ 116.518058][ C1] RAX: 0000000000073eaf RBX: ffff8881022d9e00 RCX: ffffffff877af8e5
[ 116.518069][ C1] RDX: 0000000000000000 RSI: ffffffff890edf5a RDI: ffffffff87b15200
[ 116.518079][ C1] RBP: ffffed102045b3c0 R08: 0000000000000001 R09: ffffed103eae670d
[ 116.518089][ C1] R10: ffff8881f573386b R11: 0000000000000000 R12: 0000000000000000
[ 116.518099][ C1] R13: 0000000000000000 R14: 1ffff92000027fc6 R15: dffffc0000000000
[ 116.518111][ C1] ? ct_kernel_exit+0x125/0x180
[ 116.518133][ C1] default_idle+0x9/0x10
[ 116.518153][ C1] default_idle_call+0x6c/0xb0
[ 116.518174][ C1] do_idle+0x3a7/0x5b0
[ 116.518191][ C1] ? __pfx_do_idle+0x10/0x10
[ 116.518207][ C1] ? trace_sched_exit_tp+0x2f/0x160
[ 116.518238][ C1] cpu_startup_entry+0x4f/0x60
[ 116.518255][ C1] start_secondary+0x21d/0x2d0
[ 116.518279][ C1] ? __pfx_start_secondary+0x10/0x10
[ 116.518303][ C1] common_startup_64+0x13e/0x158
[ 116.518322][ C1]
[ 116.518328][ C1]
[ 116.817224][ C1] Allocated by task 23:
[ 116.821470][ C1] kasan_save_stack+0x30/0x50
[ 116.826181][ C1] kasan_save_track+0x14/0x30
[ 116.830859][ C1] __kasan_kmalloc+0x8f/0xa0
[ 116.835556][ C1] __kmalloc_cache_noprof+0x35e/0x670
[ 116.840947][ C1] carl9170_usb_send_rx_irq_urb.constprop.0+0x62/0x340
[ 116.847796][ C1] carl9170_usb_firmware_step2+0x173/0x240
[ 116.853798][ C1] request_firmware_work_func+0x13f/0x440
[ 116.859617][ C1] process_one_work+0xa23/0x1940
[ 116.864632][ C1] worker_thread+0x5ef/0xe50
[ 116.869226][ C1] kthread+0x370/0x450
[ 116.873298][ C1] ret_from_fork+0x69a/0xc80
[ 116.877889][ C1] ret_from_fork_asm+0x1a/0x30
[ 116.882895][ C1]
[ 116.885204][ C1] The buggy address belongs to the object at ffff8881087e9b00
[ 116.885204][ C1] which belongs to the cache kmalloc-64 of size 64
[ 116.899216][ C1] The buggy address is located 1 bytes to the right of
[ 116.899216][ C1] allocated 64-byte region [ffff8881087e9b00, ffff8881087e9b40)
[ 116.913633][ C1]
[ 116.916096][ C1] The buggy address belongs to the physical page:
[ 116.922510][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1087e9
[ 116.931365][ C1] flags: 0x200000000000000(node=0|zone=2)
[ 116.937164][ C1] page_type: f5(slab)
[ 116.941140][ C1] raw: 0200000000000000 ffff8881000418c0 dead000000000100 dead000000000122
[ 116.949842][ C1] raw: 0000000000000000 0000000800200020 00000000f5000000 0000000000000000
[ 116.958539][ C1] page dumped because: kasan: bad access detected
[ 116.965008][ C1] page_owner tracks the page as allocated
[ 116.970730][ C1] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 6669157810, free_ts 0
[ 116.989763][ C1] post_alloc_hook+0xfd/0x120
[ 116.994456][ C1] get_page_from_freelist+0xf25/0x3400
[ 116.999947][ C1] __alloc_frozen_pages_noprof+0x28f/0x2b90
[ 117.005838][ C1] new_slab+0xa2/0x670
[ 117.009907][ C1] refill_objects+0xe3/0x410
[ 117.014511][ C1] __pcs_replace_empty_main+0x376/0x680
[ 117.020096][ C1] __kmalloc_noprof+0x60d/0x7c0
[ 117.024966][ C1] kobject_get_path+0xcf/0x2c0
[ 117.029727][ C1] kobject_uevent_env+0x287/0x18b0
[ 117.034831][ C1] driver_register+0x29c/0x360
[ 117.039601][ C1] ohci_platform_init+0x51/0x70
[ 117.044453][ C1] do_one_initcall+0x11d/0x700
[ 117.049215][ C1] kernel_init_freeable+0x6ea/0x7b0
[ 117.054414][ C1] kernel_init+0x1f/0x1e0
[ 117.058845][ C1] ret_from_fork+0x69a/0xc80
[ 117.063493][ C1] ret_from_fork_asm+0x1a/0x30
[ 117.068271][ C1] page_owner free stack trace missing
[ 117.073812][ C1]
[ 117.076122][ C1] Memory state around the buggy address:
[ 117.081753][ C1] ffff8881087e9a00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[ 117.089810][ C1] ffff8881087e9a80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 117.097870][ C1] >ffff8881087e9b00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[ 117.106132][ C1] ^
[ 117.112298][ C1] ffff8881087e9b80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 117.120366][ C1] ffff8881087e9c00: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
[ 117.128692][ C1] ==================================================================
[ 117.136860][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 117.144051][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(lazy)
[ 117.152985][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
[ 117.163226][ C1] Call Trace:
[ 117.166589][ C1]
[ 117.169426][ C1] dump_stack_lvl+0x100/0x190
[ 117.174105][ C1] vpanic+0x552/0x970
[ 117.178079][ C1] ? __pfx_vpanic+0x10/0x10
[ 117.182576][ C1] ? __pfx_vprintk_emit+0x10/0x10
[ 117.187598][ C1] ? carl9170_tx_process_status+0x21f/0x230
[ 117.193498][ C1] panic+0xd1/0xe0
[ 117.197241][ C1] ? __pfx_panic+0x10/0x10
[ 117.201673][ C1] ? end_report.part.0+0x23/0x90
[ 117.207140][ C1] ? rcu_is_watching+0x12/0xc0
[ 117.212001][ C1] ? end_report.part.0+0x23/0x90
[ 117.216965][ C1] ? check_panic_on_warn+0x1f/0x90
[ 117.222095][ C1] check_panic_on_warn.cold+0x19/0x34
[ 117.227522][ C1] end_report.part.0+0x3a/0x90
[ 117.232397][ C1] kasan_report.cold+0xe/0x18
[ 117.237348][ C1] ? carl9170_tx_process_status+0x21f/0x230
[ 117.243687][ C1] carl9170_tx_process_status+0x21f/0x230
[ 117.249420][ C1] carl9170_handle_command_response+0x3c8/0xc50
[ 117.255853][ C1] carl9170_usb_rx_irq_complete+0xfc/0x1b0
[ 117.261707][ C1] __usb_hcd_giveback_urb+0x38d/0x610
[ 117.267435][ C1] usb_hcd_giveback_urb+0x3ca/0x4a0
[ 117.272740][ C1] dummy_timer+0xda1/0x36c0
[ 117.277251][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80
[ 117.283055][ C1] ? __pfx_dummy_timer+0x10/0x10
[ 117.288032][ C1] ? rcu_is_watching+0x12/0xc0
[ 117.292918][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80
[ 117.298823][ C1] ? __pfx_dummy_timer+0x10/0x10
[ 117.303792][ C1] __hrtimer_run_queues+0x462/0x9c0
[ 117.308995][ C1] hrtimer_run_softirq+0x17d/0x2c0
[ 117.314218][ C1] handle_softirqs+0x1dd/0x990
[ 117.319025][ C1] ? __pfx_handle_softirqs+0x10/0x10
[ 117.324445][ C1] ? _raw_spin_unlock+0x28/0x50
[ 117.329390][ C1] ? __hrtimer_rearm_deferred+0x9b/0x720
[ 117.335049][ C1] __irq_exit_rcu+0x160/0x210
[ 117.339745][ C1] irq_exit_rcu+0x9/0x30
[ 117.344095][ C1] sysvec_apic_timer_interrupt+0x8f/0xb0
[ 117.349763][ C1]
[ 117.352771][ C1]
[ 117.355707][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 117.361737][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20
[ 117.367396][ C1] Code: 90 ac 01 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 03 8f 0b 00 fb f4 3c f6 02 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
[ 117.387090][ C1] RSP: 0018:ffffc9000013fe10 EFLAGS: 00000246
[ 117.393329][ C1] RAX: 0000000000073eaf RBX: ffff8881022d9e00 RCX: ffffffff877af8e5
[ 117.401300][ C1] RDX: 0000000000000000 RSI: ffffffff890edf5a RDI: ffffffff87b15200
[ 117.409637][ C1] RBP: ffffed102045b3c0 R08: 0000000000000001 R09: ffffed103eae670d
[ 117.417613][ C1] R10: ffff8881f573386b R11: 0000000000000000 R12: 0000000000000000
[ 117.425667][ C1] R13: 0000000000000000 R14: 1ffff92000027fc6 R15: dffffc0000000000
[ 117.433720][ C1] ? ct_kernel_exit+0x125/0x180
[ 117.438751][ C1] default_idle+0x9/0x10
[ 117.443001][ C1] default_idle_call+0x6c/0xb0
[ 117.447771][ C1] do_idle+0x3a7/0x5b0
[ 117.452052][ C1] ? __pfx_do_idle+0x10/0x10
[ 117.456827][ C1] ? trace_sched_exit_tp+0x2f/0x160
[ 117.462051][ C1] cpu_startup_entry+0x4f/0x60
[ 117.466994][ C1] start_secondary+0x21d/0x2d0
[ 117.472044][ C1] ? __pfx_start_secondary+0x10/0x10
[ 117.477501][ C1] common_startup_64+0x13e/0x158
[ 117.482546][ C1]
[ 117.485960][ C1] Kernel Offset: disabled
[ 117.490670][ C1] Rebooting in 86400 seconds..