[ 171.021796][ T28] audit: type=1400 audit(170.940:91): avc: denied { read write } for pid=3099 comm="scp" name="null" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 171.024006][ T28] audit: type=1400 audit(170.940:92): avc: denied { open } for pid=3099 comm="scp" path="/dev/null" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 Warning: Permanently added '[localhost]:18735' (ED25519) to the list of known hosts. [ 222.984039][ T28] audit: type=1400 audit(222.900:93): avc: denied { execute } for pid=3111 comm="sh" name="syz-execprog" dev="vda" ino=805 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 222.987726][ T28] audit: type=1400 audit(222.900:94): avc: denied { execute_no_trans } for pid=3111 comm="sh" path="/syz-execprog" dev="vda" ino=805 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 238.262764][ T28] audit: type=1400 audit(238.180:95): avc: denied { write } for pid=3117 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=15 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 238.476299][ T28] audit: type=1400 audit(238.390:96): avc: denied { write } for pid=3120 comm="rm" name="hook-state" dev="tmpfs" ino=15 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 1970/01/01 00:04:20 parsed 1 programs [ 260.715505][ T28] audit: type=1400 audit(260.630:97): avc: denied { node_bind } for pid=3111 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 1970/01/01 00:04:20 serving rpc on tcp://44837 [ 264.222893][ T28] audit: type=1400 audit(264.140:98): avc: denied { mounton } for pid=3125 comm="syz-executor" path="/syzcgroup/unified" dev="vda" ino=808 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 264.226451][ T28] audit: type=1400 audit(264.140:99): avc: denied { mount } for pid=3125 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 264.243906][ T3125] cgroup: Unknown subsys name 'net' [ 264.252434][ T28] audit: type=1400 audit(264.170:100): avc: denied { unmount } for pid=3125 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 264.425893][ T3125] cgroup: Unknown subsys name 'cpuset' [ 264.432776][ T3125] cgroup: Unknown subsys name 'hugetlb' [ 264.433753][ T3125] cgroup: Unknown subsys name 'rlimit' [ 264.598398][ T28] audit: type=1400 audit(264.510:101): avc: denied { setattr } for pid=3125 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 264.602469][ T28] audit: type=1400 audit(264.520:102): avc: denied { create } for pid=3125 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 264.604618][ T28] audit: type=1400 audit(264.520:103): avc: denied { write } for pid=3125 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 264.605574][ T28] audit: type=1400 audit(264.520:104): avc: denied { module_request } for pid=3125 comm="syz-executor" kmod="net-pf-16-proto-16-family-nl802154" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 264.659306][ T28] audit: type=1400 audit(264.570:105): avc: denied { read } for pid=3125 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 264.663972][ T28] audit: type=1400 audit(264.580:106): avc: denied { mounton } for pid=3125 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 264.790466][ T3128] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 272.117064][ T3125] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 282.990024][ T28] kauditd_printk_skb: 5 callbacks suppressed [ 282.990275][ T28] audit: type=1400 audit(282.900:112): avc: denied { execmem } for pid=3129 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 283.486903][ T28] audit: type=1400 audit(283.400:113): avc: denied { read } for pid=3131 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 283.488856][ T28] audit: type=1400 audit(283.400:114): avc: denied { open } for pid=3131 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 283.500716][ T28] audit: type=1400 audit(283.420:115): avc: denied { mounton } for pid=3131 comm="syz-executor" path="/" dev="vda" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 283.634353][ T28] audit: type=1400 audit(283.550:116): avc: denied { mount } for pid=3131 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 283.644441][ T28] audit: type=1400 audit(283.560:117): avc: denied { mounton } for pid=3131 comm="syz-executor" path="/syzkaller.SrnEaC/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 283.654029][ T28] audit: type=1400 audit(283.570:118): avc: denied { mount } for pid=3131 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 283.668953][ T28] audit: type=1400 audit(283.580:119): avc: denied { mounton } for pid=3131 comm="syz-executor" path="/syzkaller.SrnEaC/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 283.677010][ T28] audit: type=1400 audit(283.590:120): avc: denied { mounton } for pid=3131 comm="syz-executor" path="/syzkaller.SrnEaC/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=1683 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 283.701879][ T28] audit: type=1400 audit(283.620:121): avc: denied { unmount } for pid=3131 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 283.807354][ T3131] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 290.256253][ T3277] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 290.264200][ T3277] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 291.057547][ T3277] hsr_slave_0: entered promiscuous mode [ 291.063255][ T3277] hsr_slave_1: entered promiscuous mode [ 291.368269][ T3277] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 291.376486][ T3277] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 291.380709][ T3277] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 291.386036][ T3277] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 291.388535][ T3277] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 291.394064][ T3277] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 291.396546][ T3277] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 291.402270][ T3277] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 292.102116][ T3277] 8021q: adding VLAN 0 to HW filter on device bond0 [ 294.561640][ T3277] veth0_vlan: entered promiscuous mode [ 294.587270][ T3277] veth1_vlan: entered promiscuous mode [ 294.652956][ T3277] veth0_macvtap: entered promiscuous mode [ 294.669725][ T3277] veth1_macvtap: entered promiscuous mode [ 294.845071][ T1981] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 294.855750][ T2039] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 294.856193][ T2039] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 294.856570][ T2039] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 295.095935][ T56] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 295.141711][ T56] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 295.200914][ T56] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 295.287600][ T56] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 295.597762][ T56] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 295.616886][ T56] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 295.623841][ T56] bond0 (unregistering): Released all slaves [ 295.714585][ T56] hsr_slave_0: left promiscuous mode [ 295.717776][ T56] hsr_slave_1: left promiscuous mode [ 295.727244][ T56] veth1_macvtap: left promiscuous mode [ 295.727809][ T56] veth0_macvtap: left promiscuous mode [ 295.728451][ T56] veth1_vlan: left promiscuous mode [ 295.728718][ T56] veth0_vlan: left promiscuous mode [ 296.755266][ T28] kauditd_printk_skb: 14 callbacks suppressed [ 296.755632][ T28] audit: type=1400 audit(296.670:136): avc: denied { write } for pid=3664 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=15 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 296.836156][ T28] audit: type=1400 audit(296.750:137): avc: denied { create } for pid=3670 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 297.109305][ T28] audit: type=1400 audit(297.020:138): avc: denied { write } for pid=3674 comm="rm" name="hook-state" dev="tmpfs" ino=15 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 297.303910][ T2962] 8021q: adding VLAN 0 to HW filter on device eth1 [ 297.899940][ T28] audit: type=1400 audit(297.810:139): avc: denied { write } for pid=3701 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=15 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 298.155510][ T28] audit: type=1400 audit(298.070:140): avc: denied { write } for pid=3704 comm="rm" name="hook-state" dev="tmpfs" ino=15 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 298.322407][ T2962] 8021q: adding VLAN 0 to HW filter on device eth2 [ 298.798933][ T28] audit: type=1400 audit(298.710:141): avc: denied { write } for pid=3708 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=15 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 299.018521][ T28] audit: type=1400 audit(298.930:142): avc: denied { write } for pid=3711 comm="rm" name="hook-state" dev="tmpfs" ino=15 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 299.188467][ T2962] 8021q: adding VLAN 0 to HW filter on device eth3 [ 299.678827][ T28] audit: type=1400 audit(299.590:143): avc: denied { write } for pid=3715 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=15 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 299.858513][ T28] audit: type=1400 audit(299.770:144): avc: denied { write } for pid=3718 comm="rm" name="hook-state" dev="tmpfs" ino=15 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 299.945489][ T2962] 8021q: adding VLAN 0 to HW filter on device eth4 1970/01/01 00:05:01 executed programs: 0 [ 303.674212][ T3729] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 303.683431][ T3729] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 304.348020][ T3729] hsr_slave_0: entered promiscuous mode [ 304.350960][ T3729] hsr_slave_1: entered promiscuous mode [ 304.539137][ T3729] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 304.544909][ T3729] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 304.548936][ T3729] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 304.556196][ T3729] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 304.558222][ T3729] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 304.565476][ T3729] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 304.570661][ T3729] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 304.576222][ T3729] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 305.147383][ T3729] 8021q: adding VLAN 0 to HW filter on device bond0 [ 307.722165][ T3729] veth0_vlan: entered promiscuous mode [ 307.743907][ T3729] veth1_vlan: entered promiscuous mode [ 307.804279][ T3729] veth0_macvtap: entered promiscuous mode [ 307.816792][ T3729] veth1_macvtap: entered promiscuous mode [ 307.950526][ T2039] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 307.951020][ T2039] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 307.951399][ T2039] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 307.951686][ T2039] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 1970/01/01 00:05:08 executed programs: 2 [ 308.171146][ T4036] syz.2.17 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 308.173299][ T4036] CPU: 0 UID: 0 PID: 4036 Comm: syz.2.17 Not tainted syzkaller #0 PREEMPT [ 308.173535][ T4036] Hardware name: ARM-Versatile Express [ 308.173792][ T4036] Call trace: [ 308.174119][ T4036] [<80201998>] (dump_backtrace) from [<80201a8c>] (show_stack+0x18/0x1c) [ 308.175195][ T4036] r7:60000013 r6:60000013 r5:82333190 r4:00000000 [ 308.175289][ T4036] [<80201a74>] (show_stack) from [<8021e60c>] (dump_stack_lvl+0x5c/0x70) [ 308.175355][ T4036] [<8021e5b0>] (dump_stack_lvl) from [<8021e638>] (dump_stack+0x18/0x1c) [ 308.175422][ T4036] r7:81c1e924 r6:82348368 r5:e0259ab0 r4:e0259ab0 [ 308.175441][ T4036] [<8021e620>] (dump_stack) from [<80205cdc>] (dump_header+0x4c/0x1b0) [ 308.175521][ T4036] [<80205c90>] (dump_header) from [<804a80fc>] (oom_kill_process+0x1b4/0x234) [ 308.175592][ T4036] r7:81c1e924 r6:82348368 r5:e0259ab0 r4:83e0c980 [ 308.175611][ T4036] [<804a7f48>] (oom_kill_process) from [<804a8908>] (out_of_memory+0x114/0x384) [ 308.175675][ T4036] r7:831721c0 r6:82cd23c4 r5:83e0c980 r4:e0259ab0 [ 308.175695][ T4036] [<804a87f4>] (out_of_memory) from [<80570cb0>] (mem_cgroup_out_of_memory+0xa0/0xb8) [ 308.175761][ T4036] r6:00000cc0 r5:831721c0 r4:00000000 [ 308.175778][ T4036] [<80570c10>] (mem_cgroup_out_of_memory) from [<80577cfc>] (try_charge_memcg+0x41c/0x578) [ 308.175843][ T4036] r6:831721c0 r5:00000001 r4:00000001 [ 308.175863][ T4036] [<805778e0>] (try_charge_memcg) from [<80577e98>] (obj_cgroup_charge_pages+0x40/0x1c8) [ 308.175962][ T4036] r10:00000000 r9:00000000 r8:e0259be4 r7:00000cc0 r6:85bb25c0 r5:00000001 [ 308.175997][ T4036] r4:831721c0 [ 308.176018][ T4036] [<80577e58>] (obj_cgroup_charge_pages) from [<80578af4>] (__memcg_slab_post_alloc_hook+0x1e4/0x5dc) [ 308.176093][ T4036] r7:00000180 r6:830c4cc0 r5:85bb25c0 r4:ddeb0830 [ 308.176115][ T4036] [<80578910>] (__memcg_slab_post_alloc_hook) from [<80545ecc>] (kmem_cache_alloc_lru_noprof+0x3c0/0x3e4) [ 308.176193][ T4036] r10:82a0b444 r9:8553c780 r8:828d8320 r7:83e0c980 r6:805c8fe4 r5:00000cc0 [ 308.176214][ T4036] r4:830c4cc0 [ 308.176231][ T4036] [<80545b0c>] (kmem_cache_alloc_lru_noprof) from [<805c8fe4>] (alloc_inode+0xa0/0xd0) [ 308.176305][ T4036] r10:85c7f604 r9:831916b0 r8:8602d528 r7:00008180 r6:81de3a30 r5:8589c400 [ 308.176326][ T4036] r4:8602d528 [ 308.176345][ T4036] [<805c8f44>] (alloc_inode) from [<805c9024>] (new_inode+0x10/0x68) [ 308.176415][ T4036] r7:00008180 r6:8602d500 r5:81de3b24 r4:8602d528 [ 308.176437][ T4036] [<805c9014>] (new_inode) from [<81120318>] (gadgetfs_make_inode+0x30/0xb8) [ 308.176528][ T4036] r9:831916b0 r8:8602d528 r7:00008180 r6:8602d500 r5:81de3b24 r4:8602d528 [ 308.176551][ T4036] [<811202e8>] (gadgetfs_make_inode) from [<811203dc>] (gadgetfs_create_file+0x3c/0x8c) [ 308.176615][ T4036] r7:8319105c r6:8589c400 r5:82454a40 r4:8602d528 [ 308.176633][ T4036] [<811203a0>] (gadgetfs_create_file) from [<81120dd4>] (gadgetfs_bind+0x100/0x330) [ 308.176697][ T4036] r7:8319105c r6:85c7f600 r5:82454a40 r4:8602d500 [ 308.176715][ T4036] [<81120cd4>] (gadgetfs_bind) from [<810be110>] (gadget_bind_driver+0x90/0x2b0) [ 308.176787][ T4036] r10:81de3a9c r9:00000000 r8:00000013 r7:831916f8 r6:82ba109c r5:82ba1078 [ 308.176806][ T4036] r4:842cdc00 [ 308.176822][ T4036] [<810be080>] (gadget_bind_driver) from [<80bd57b4>] (really_probe+0xd8/0x40c) [ 308.176897][ T4036] r9:00000000 r8:00000013 r7:00000000 r6:82ba109c r5:00000000 r4:831916f8 [ 308.176916][ T4036] [<80bd56dc>] (really_probe) from [<80bd5b88>] (__driver_probe_device+0xa0/0x21c) [ 308.176982][ T4036] r8:00000013 r7:831916f8 r6:83191744 r5:82ba109c r4:831916f8 [ 308.177002][ T4036] [<80bd5ae8>] (__driver_probe_device) from [<80bd5de4>] (driver_probe_device+0x3c/0xc0) [ 308.177070][ T4036] r9:00000000 r8:00000013 r7:831916f8 r6:83191744 r5:82d250bc r4:82d250ac [ 308.177090][ T4036] [<80bd5da8>] (driver_probe_device) from [<80bd6060>] (__driver_attach+0xc0/0x1f0) [ 308.177158][ T4036] r9:00000000 r8:85c441b8 r7:00000000 r6:83191744 r5:82ba109c r4:831916f8 [ 308.177176][ T4036] [<80bd5fa0>] (__driver_attach) from [<80bd30d4>] (bus_for_each_dev+0x84/0xd4) [ 308.177239][ T4036] r7:00000000 r6:83805600 r5:80bd5fa0 r4:82ba109c [ 308.177257][ T4036] [<80bd3050>] (bus_for_each_dev) from [<80bd5034>] (driver_attach+0x24/0x28) [ 308.177317][ T4036] r7:83805600 r6:00000000 r5:85c44180 r4:82ba109c [ 308.177335][ T4036] [<80bd5010>] (driver_attach) from [<80bd478c>] (bus_add_driver+0x110/0x230) [ 308.177385][ T4036] [<80bd467c>] (bus_add_driver) from [<80bd70f0>] (driver_register+0x88/0x124) [ 308.177454][ T4036] r8:0000001f r7:00000012 r6:82ba109c r5:00000000 r4:82ba109c [ 308.177508][ T4036] [<80bd7068>] (driver_register) from [<810bb9d8>] (usb_gadget_register_driver_owner+0x54/0xec) [ 308.177579][ T4036] r5:00000000 r4:82ba1078 [ 308.177600][ T4036] [<810bb984>] (usb_gadget_register_driver_owner) from [<81122054>] (dev_config+0x2ec/0x618) [ 308.177675][ T4036] r7:00000012 r6:85bb1e40 r5:00000000 r4:85c7f600 [ 308.177696][ T4036] [<81121d68>] (dev_config) from [<8059ff68>] (vfs_write+0xd4/0x42c) [ 308.177774][ T4036] r10:81de3a9c r9:83e0c980 r8:81121d68 r7:e0259f68 r6:20000400 r5:85a2ef00 [ 308.177797][ T4036] r4:0000001f [ 308.177814][ T4036] [<8059fe94>] (vfs_write) from [<805a0434>] (ksys_write+0x74/0xec) [ 308.177884][ T4036] r10:00000004 r9:83e0c980 r8:8020029c r7:00000000 r6:00000000 r5:85a2ef00 [ 308.177908][ T4036] r4:85a2ef00 [ 308.177929][ T4036] [<805a03c0>] (ksys_write) from [<805a04bc>] (sys_write+0x10/0x14) [ 308.178041][ T4036] r7:00000004 r6:00356310 r5:00000000 r4:00000000 [ 308.178060][ T4036] [<805a04ac>] (sys_write) from [<80200060>] (ret_fast_syscall+0x0/0x1c) [ 308.178204][ T4036] Exception stack(0xe0259fa8 to 0xe0259ff0) [ 308.178384][ T4036] 9fa0: 00000000 00000000 00000003 20000400 0000001f 00000000 [ 308.178442][ T4036] 9fc0: 00000000 00000000 00356310 00000004 003562d8 00000000 003562d8 003562e4 [ 308.178470][ T4036] 9fe0: 7ef7e798 7ef7e788 00018fa0 001309d0 [ 308.202908][ T4036] memory: usage 0kB, limit 0kB, failcnt 19 [ 308.203061][ T4036] memory+swap: usage 0kB, limit 8589934588kB, failcnt 0 [ 308.203156][ T4036] kmem: usage 0kB, limit 8589934588kB, failcnt 0 [ 308.203226][ T4036] Memory cgroup stats for /syz2/test: [ 308.205375][ T4036] cache 0 [ 308.205451][ T4036] rss 0 [ 308.205534][ T4036] shmem 0 [ 308.205558][ T4036] mapped_file 0 [ 308.205594][ T4036] dirty 0 [ 308.205621][ T4036] writeback 0 [ 308.205635][ T4036] workingset_refault_anon 0 [ 308.205648][ T4036] workingset_refault_file 0 [ 308.205662][ T4036] swap 0 [ 308.205676][ T4036] swapcached 0 [ 308.205689][ T4036] pgpgin 0 [ 308.205703][ T4036] pgpgout 0 [ 308.205736][ T4036] pgfault 0 [ 308.205751][ T4036] pgmajfault 0 [ 308.205766][ T4036] inactive_anon 0 [ 308.205803][ T4036] active_anon 0 [ 308.205823][ T4036] inactive_file 0 [ 308.205854][ T4036] active_file 0 [ 308.205873][ T4036] unevictable 0 [ 308.205890][ T4036] hierarchical_memory_limit 0 [ 308.205905][ T4036] hierarchical_memsw_limit 8796093018112 [ 308.205918][ T4036] total_cache 0 [ 308.205932][ T4036] total_rss 0 [ 308.205944][ T4036] total_shmem 0 [ 308.205973][ T4036] total_mapped_file 0 [ 308.206021][ T4036] total_dirty 0 [ 308.206057][ T4036] total_writeback 0 [ 308.206128][ T4036] total_workingset_refault_anon 0 [ 308.206151][ T4036] total_workingset_refault_file 0 [ 308.206168][ T4036] total_swap 0 [ 308.206182][ T4036] total_swapcached 0 [ 308.206197][ T4036] total_pgpgin 0 [ 308.206210][ T4036] total_pgpgout 0 [ 308.206253][ T4036] total_pgfault 0 [ 308.206302][ T4036] total_pgmajfault 0 [ 308.206323][ T4036] total_inactive_anon 0 [ 308.206339][ T4036] total_active_anon 0 [ 308.206379][ T4036] total_inactive_file 0 [ 308.206395][ T4036] total_active_file 0 [ 308.206408][ T4036] total_unevictable 0 [ 308.206425][ T4036] anon_cost 0 [ 308.206437][ T4036] file_cost 0 [ 308.206640][ T4036] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0,oom_memcg=/syz2/test,task_memcg=/syz2/test,task=syz.2.17,pid=4036,uid=0 [ 308.208324][ T4036] Memory cgroup out of memory: Killed process 4036 (syz.2.17) total-vm:35764kB, anon-rss:96kB, file-rss:1288kB, shmem-rss:0kB, UID:0 pgtables:40kB oom_score_adj:1000 [ 308.253854][ T4036] udc dummy_udc.0: failed to start USB Gadget filesystem: -12 [ 308.255422][ T4036] gadgetfs gadget.0: probe with driver gadgetfs failed with error -12 [ 308.294715][ T4036] udc dummy_udc.1: failed to start USB Gadget filesystem: -12 [ 308.295865][ T4036] gadgetfs gadget.1: probe with driver gadgetfs failed with error -12 [ 308.298176][ T4036] UDC core: USB Gadget filesystem: couldn't find an available UDC [ 308.305993][ T4036] ------------[ cut here ]------------ [ 308.306541][ T4036] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x134/0x170, CPU#0: syz.2.17/4036 [ 308.308467][ T4036] refcount_t: underflow; use-after-free. [ 308.308771][ T4036] Modules linked in: [ 308.309570][ T4036] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 308.310089][ T4036] CPU: 0 UID: 0 PID: 4036 Comm: syz.2.17 Not tainted syzkaller #0 PREEMPT [ 308.310435][ T4036] Hardware name: ARM-Versatile Express [ 308.310692][ T4036] Call trace: [ 308.310874][ T4036] [<80201998>] (dump_backtrace) from [<80201a8c>] (show_stack+0x18/0x1c) [ 308.311236][ T4036] r7:82a20f78 r6:00000000 r5:82333190 r4:00000001 [ 308.311574][ T4036] [<80201a74>] (show_stack) from [<8021e60c>] (dump_stack_lvl+0x5c/0x70) [ 308.311953][ T4036] [<8021e5b0>] (dump_stack_lvl) from [<8021e638>] (dump_stack+0x18/0x1c) [ 308.312330][ T4036] r7:82a20f78 r6:00000000 r5:83e0c980 r4:82c83d40 [ 308.312590][ T4036] [<8021e620>] (dump_stack) from [<80202590>] (vpanic+0x114/0x320) [ 308.312908][ T4036] [<8020247c>] (vpanic) from [<802027d0>] (trace_suspend_resume+0x0/0x100) [ 308.313276][ T4036] r7:809300ec [ 308.313435][ T4036] [<8020279c>] (panic) from [<80250a80>] (get_taint+0x0/0x1c) [ 308.313828][ T4036] r3:82a0b144 r2:00000001 r1:82318ef4 r0:82320850 [ 308.314401][ T4036] [<80250a08>] (check_panic_on_warn) from [<80250bfc>] (__warn+0x98/0x1a4) [ 308.314865][ T4036] [<80250b64>] (__warn) from [<80250ef0>] (warn_slowpath_fmt+0x1e8/0x1f4) [ 308.315270][ T4036] r8:00000009 r7:8238cee4 r6:e0259da4 r5:83e0c980 r4:00000000 [ 308.315562][ T4036] [<80250d0c>] (warn_slowpath_fmt) from [<809300ec>] (refcount_warn_saturate+0x134/0x170) [ 308.315943][ T4036] r10:8475ea00 r9:00000000 r8:838acb10 r7:8553bc80 r6:835f77f8 r5:00000000 [ 308.316238][ T4036] r4:85c7f600 [ 308.316391][ T4036] [<8092ffb8>] (refcount_warn_saturate) from [<81120650>] (put_dev+0x4c/0x6c) [ 308.316709][ T4036] [<81120604>] (put_dev) from [<81120718>] (dev_release+0x48/0x6c) [ 308.317008][ T4036] [<811206d0>] (dev_release) from [<805a1bcc>] (__fput+0xd8/0x2f4) [ 308.317321][ T4036] r5:040f801b r4:85a2ef00 [ 308.317508][ T4036] [<805a1af4>] (__fput) from [<805a1e7c>] (____fput+0x14/0x18) [ 308.317824][ T4036] r9:00000000 r8:83e0d214 r7:82c846ac r6:83e0c980 r5:83e0d1e0 r4:00000000 [ 308.318106][ T4036] [<805a1e68>] (____fput) from [<8027d7c8>] (task_work_run+0x8c/0xb4) [ 308.318420][ T4036] [<8027d73c>] (task_work_run) from [<80257888>] (do_exit+0x2ac/0xadc) [ 308.318742][ T4036] r9:00000000 r8:e0259e90 r7:83e0d210 r6:850c5d4c r5:83e0c980 r4:850c5c00 [ 308.319022][ T4036] [<802575dc>] (do_exit) from [<8025828c>] (do_group_exit+0x40/0x8c) [ 308.319334][ T4036] r7:00000004 [ 308.319624][ T4036] [<8025824c>] (do_group_exit) from [<80269358>] (get_signal+0xa68/0xa90) [ 308.320117][ T4036] r7:00000004 r4:83e0c980 [ 308.320326][ T4036] [<802688f0>] (get_signal) from [<8022a630>] (do_work_pending+0x124/0x4f0) [ 308.320654][ T4036] r10:00000004 r9:83e0c980 r8:0000001f r7:00000004 r6:8020029c r5:e0259fb0 [ 308.320962][ T4036] r4:83e0c980 [ 308.321178][ T4036] [<8022a50c>] (do_work_pending) from [<80200088>] (slow_work_pending+0xc/0x24) [ 308.321493][ T4036] Exception stack(0xe0259fb0 to 0xe0259ff8) [ 308.321732][ T4036] 9fa0: 0000001f 20000400 0000001f 00000000 [ 308.322048][ T4036] 9fc0: 00000000 00000000 00356310 00000004 003562d8 00000000 003562d8 003562e4 [ 308.322351][ T4036] 9fe0: 7ef7e798 7ef7e788 00018fa0 001309d0 60000010 00000003 [ 308.322620][ T4036] r10:00000004 r9:83e0c980 r8:8020029c r7:00000004 r6:00356310 r5:00000000 [ 308.322893][ T4036] r4:00000000 [ 308.325050][ T4036] Rebooting in 86400 seconds..