[ 64.834391][ T43] kauditd_printk_skb: 10 callbacks suppressed
[ 64.834412][ T43] audit: type=1400 audit(1788980977.931:209): avc: denied { transition } for pid=5971 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 64.834494][ T43] audit: type=1400 audit(1788980977.931:210): avc: denied { noatsecure } for pid=5971 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 64.835187][ T43] audit: type=1400 audit(1788980977.931:211): avc: denied { rlimitinh } for pid=5971 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 64.835342][ T43] audit: type=1400 audit(1788980977.931:212): avc: denied { siginh } for pid=5971 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 68.661005][ T43] audit: type=1400 audit(1788980981.761:213): avc: denied { write } for pid=5979 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 68.714525][ T43] audit: type=1400 audit(1788980981.811:214): avc: denied { write } for pid=5982 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 69.305414][ T43] audit: type=1400 audit(1788980982.401:215): avc: denied { write } for pid=5985 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 69.362565][ T43] audit: type=1400 audit(1788980982.461:216): avc: denied { write } for pid=5988 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 69.451615][ T43] audit: type=1400 audit(1788980982.551:217): avc: denied { write } for pid=5991 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 69.518222][ T43] audit: type=1400 audit(1788980982.611:218): avc: denied { write } for pid=5994 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 69.904979][ T43] audit: type=1400 audit(1788980983.001:219): avc: denied { write } for pid=6001 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 69.949581][ T43] audit: type=1400 audit(1788980983.051:220): avc: denied { write } for pid=6004 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 70.066085][ T43] audit: type=1400 audit(1788980983.161:221): avc: denied { write } for pid=6007 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 70.121472][ T43] audit: type=1400 audit(1788980983.221:222): avc: denied { write } for pid=6011 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
Warning: Permanently added '[localhost]:26811' (ED25519) to the list of known hosts.
[ 70.239800][ T43] audit: type=1400 audit(1788980983.341:223): avc: denied { mounton } for pid=6016 comm="syz-executor101" path="/sys/kernel/config" dev="configfs" ino=3075 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 70.240021][ T43] audit: type=1400 audit(1788980983.341:224): avc: denied { mount } for pid=6016 comm="syz-executor101" name="/" dev="configfs" ino=3075 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1
[ 70.241276][ T43] audit: type=1400 audit(1788980983.341:225): avc: denied { search } for pid=6016 comm="syz-executor101" name="/" dev="configfs" ino=3075 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 70.241338][ T43] audit: type=1400 audit(1788980983.341:226): avc: denied { search } for pid=6016 comm="syz-executor101" name="usb_gadget" dev="configfs" ino=5301 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 70.241939][ T43] audit: type=1400 audit(1788980983.341:227): avc: denied { write search } for pid=6016 comm="syz-executor101" name="usb_gadget" dev="configfs" ino=5301 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 70.242085][ T43] audit: type=1400 audit(1788980983.341:228): avc: denied { add_name } for pid=6016 comm="syz-executor101" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 70.509399][ T2426] usb 7-1: new high-speed USB device number 2 using dummy_hcd
[ 70.659583][ T2426] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0104, bcdDevice= 7.03
[ 70.664193][ T2426] usb 7-1: Dual-Role OTG device on HNP port
[ 70.664407][ T2426] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 70.664418][ T2426] usb 7-1: Product: Dummy
[ 70.664426][ T2426] usb 7-1: Manufacturer: Linux
[ 70.664433][ T2426] usb 7-1: SerialNumber: 123456
[ 70.683045][ T2426] cdc_acm 7-1:1.0: ttyACM0: USB ACM device
[ 70.807073][ T6016] usbip-host 7-1: usbip-host: register new device (bus 7 dev 2)
[ 70.808988][ T6016] usbip-host 7-1: stub up
[ 70.925176][ T6032] ==================================================================
[ 70.925186][ T6032] BUG: KASAN: slab-use-after-free in stub_rx_loop+0x2d3b/0x31c0
[ 70.925204][ T6032] Read of size 4 at addr ffff8880579b8d30 by task stub_rx/6032
[ 70.925212][ T6032]
[ 70.925218][ T6032] CPU: 0 UID: 0 PID: 6032 Comm: stub_rx Not tainted syzkaller #0 PREEMPT(full)
[ 70.925230][ T6032] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 70.925236][ T6032] Call Trace:
[ 70.925240][ T6032]
[ 70.925244][ T6032] dump_stack_lvl+0x100/0x190
[ 70.925261][ T6032] print_report+0x13d/0x4b0
[ 70.925276][ T6032] ? __virt_addr_valid+0x239/0x430
[ 70.925287][ T6032] ? stub_rx_loop+0x2d3b/0x31c0
[ 70.925300][ T6032] kasan_report+0xdf/0x1c0
[ 70.925314][ T6032] ? stub_rx_loop+0x2d3b/0x31c0
[ 70.925328][ T6032] stub_rx_loop+0x2d3b/0x31c0
[ 70.925343][ T6032] ? __kthread_parkme+0xbb/0x230
[ 70.925355][ T6032] ? __pfx_stub_rx_loop+0x10/0x10
[ 70.925369][ T6032] ? __kthread_parkme+0x18f/0x230
[ 70.925381][ T6032] ? kthread+0x13a/0x450
[ 70.925395][ T6032] ? __pfx_stub_rx_loop+0x10/0x10
[ 70.925408][ T6032] kthread+0x373/0x450
[ 70.925422][ T6032] ? __pfx_kthread+0x10/0x10
[ 70.925436][ T6032] ret_from_fork+0x730/0xd60
[ 70.925448][ T6032] ? __pfx_ret_from_fork+0x10/0x10
[ 70.925459][ T6032] ? __switch_to+0x800/0x10f0
[ 70.925473][ T6032] ? __pfx_kthread+0x10/0x10
[ 70.925488][ T6032] ret_from_fork_asm+0x1a/0x30
[ 70.925501][ T6032]
[ 70.925505][ T6032]
[ 70.925507][ T6032] Allocated by task 6032:
[ 70.925512][ T6032] kasan_save_stack+0x30/0x50
[ 70.925524][ T6032] kasan_save_track+0x14/0x30
[ 70.925534][ T6032] __kasan_slab_alloc+0x89/0x90
[ 70.925545][ T6032] kmem_cache_alloc_noprof+0x269/0x6a0
[ 70.925555][ T6032] stub_rx_loop+0x638/0x31c0
[ 70.925567][ T6032] kthread+0x373/0x450
[ 70.925580][ T6032] ret_from_fork+0x730/0xd60
[ 70.925589][ T6032] ret_from_fork_asm+0x1a/0x30
[ 70.925599][ T6032]
[ 70.925601][ T6032] Freed by task 6033:
[ 70.925606][ T6032] kasan_save_stack+0x30/0x50
[ 70.925616][ T6032] kasan_save_track+0x14/0x30
[ 70.925626][ T6032] kasan_save_free_info+0x3b/0x70
[ 70.925641][ T6032] __kasan_slab_free+0x5f/0x80
[ 70.925652][ T6032] kmem_cache_free+0x127/0x6c0
[ 70.925666][ T6032] stub_free_priv_and_urb+0x427/0x570
[ 70.925679][ T6032] stub_send_ret_submit+0xecf/0x1810
[ 70.925692][ T6032] stub_tx_loop+0xe2/0x3e0
[ 70.925704][ T6032] kthread+0x373/0x450
[ 70.925716][ T6032] ret_from_fork+0x730/0xd60
[ 70.925726][ T6032] ret_from_fork_asm+0x1a/0x30
[ 70.925736][ T6032]
[ 70.925738][ T6032] The buggy address belongs to the object at ffff8880579b8d00
[ 70.925738][ T6032] which belongs to the cache stub_priv of size 64
[ 70.925746][ T6032] The buggy address is located 48 bytes inside of
[ 70.925746][ T6032] freed 64-byte region [ffff8880579b8d00, ffff8880579b8d40)
[ 70.925755][ T6032]
[ 70.925758][ T6032] The buggy address belongs to the physical page:
[ 70.925762][ T6032] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880579b8e00 pfn:0x579b8
[ 70.925772][ T6032] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
[ 70.925781][ T6032] page_type: f5(slab)
[ 70.925790][ T6032] raw: 00fff00000000200 ffff888029222780 ffff888029d9ca08 ffff888029d9ca08
[ 70.925799][ T6032] raw: ffff8880579b8e00 000000020020001c 00000000f5000000 0000000000000000
[ 70.925804][ T6032] page dumped because: kasan: bad access detected
[ 70.925809][ T6032] page_owner tracks the page as allocated
[ 70.925812][ T6032] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6032, tgid 6032 (stub_rx), ts 70923231925
[ 70.925828][ T6032] post_alloc_hook+0xfd/0x120
[ 70.925842][ T6032] get_page_from_freelist+0x110d/0x35d0
[ 70.925857][ T6032] __alloc_frozen_pages_noprof+0x2eb/0x3300
[ 70.925873][ T6032] new_slab+0xa9/0x6e0
[ 70.925887][ T6032] refill_objects+0xe3/0x410
[ 70.925902][ T6032] __pcs_replace_empty_main+0x35e/0x650
[ 70.925916][ T6032] kmem_cache_alloc_noprof+0x4c4/0x6a0
[ 70.925926][ T6032] stub_rx_loop+0x638/0x31c0
[ 70.925938][ T6032] kthread+0x373/0x450
[ 70.925950][ T6032] ret_from_fork+0x730/0xd60
[ 70.925965][ T6032] ret_from_fork_asm+0x1a/0x30
[ 70.925975][ T6032] page last free pid 6016 tgid 6016 ts 70844418825 stack trace:
[ 70.925981][ T6032] __free_frozen_pages+0x79f/0x10f0
[ 70.925994][ T6032] qlist_free_all+0x47/0xf0
[ 70.926003][ T6032] kasan_quarantine_reduce+0x1a0/0x1f0
[ 70.926013][ T6032] __kasan_slab_alloc+0x69/0x90
[ 70.926025][ T6032] __kmalloc_cache_noprof+0x278/0x6d0
[ 70.926039][ T6032] single_open+0x4d/0x1d0
[ 70.926048][ T6032] do_dentry_open+0x6ab/0x14d0
[ 70.926058][ T6032] vfs_open+0x82/0x3f0
[ 70.926069][ T6032] path_openat+0x19fa/0x2440
[ 70.926081][ T6032] do_file_open+0x20e/0x430
[ 70.926092][ T6032] do_sys_openat2+0x10f/0x1e0
[ 70.926105][ T6032] __x64_sys_openat+0x12d/0x210
[ 70.926118][ T6032] do_syscall_64+0x123/0x790
[ 70.926131][ T6032] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 70.926141][ T6032]
[ 70.926143][ T6032] Memory state around the buggy address:
[ 70.926148][ T6032] ffff8880579b8c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 70.926155][ T6032] ffff8880579b8c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 70.926161][ T6032] >ffff8880579b8d00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 70.926167][ T6032] ^
[ 70.926172][ T6032] ffff8880579b8d80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 70.926178][ T6032] ffff8880579b8e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 70.926184][ T6032] ==================================================================
[ 70.926189][ T6032] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 71.104488][ T6032] CPU: 0 UID: 0 PID: 6032 Comm: stub_rx Not tainted syzkaller #0 PREEMPT(full)
[ 71.107342][ T6032] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 71.110569][ T6032] Call Trace:
[ 71.111645][ T6032]
[ 71.112646][ T6032] dump_stack_lvl+0x100/0x190
[ 71.114173][ T6032] vpanic+0x553/0x970
[ 71.115498][ T6032] ? __pfx_vpanic+0x10/0x10
[ 71.116933][ T6032] ? __pfx_vprintk_emit+0x10/0x10
[ 71.118615][ T6032] ? stub_rx_loop+0x2d3b/0x31c0
[ 71.120193][ T6032] panic+0xd1/0xe0
[ 71.121401][ T6032] ? __pfx_panic+0x10/0x10
[ 71.123173][ T6032] ? end_report.part.0+0x23/0x90
[ 71.124741][ T6032] ? rcu_is_watching+0x13/0xc0
[ 71.126364][ T6032] check_panic_on_warn.cold+0x19/0x34
[ 71.128068][ T6032] end_report.part.0+0x3a/0x90
[ 71.129609][ T6032] kasan_report.cold+0xe/0x18
[ 71.131189][ T6032] ? stub_rx_loop+0x2d3b/0x31c0
[ 71.132776][ T6032] stub_rx_loop+0x2d3b/0x31c0
[ 71.134275][ T6032] ? __kthread_parkme+0xbb/0x230
[ 71.135909][ T6032] ? __pfx_stub_rx_loop+0x10/0x10
[ 71.137481][ T6032] ? __kthread_parkme+0x18f/0x230
[ 71.139024][ T6032] ? kthread+0x13a/0x450
[ 71.140424][ T6032] ? __pfx_stub_rx_loop+0x10/0x10
[ 71.142029][ T6032] kthread+0x373/0x450
[ 71.143317][ T6032] ? __pfx_kthread+0x10/0x10
[ 71.144886][ T6032] ret_from_fork+0x730/0xd60
[ 71.146346][ T6032] ? __pfx_ret_from_fork+0x10/0x10
[ 71.147944][ T6032] ? __switch_to+0x800/0x10f0
[ 71.149443][ T6032] ? __pfx_kthread+0x10/0x10
[ 71.150962][ T6032] ret_from_fork_asm+0x1a/0x30
[ 71.152519][ T6032]
[ 71.154279][ T6032] Kernel Offset: disabled
[ 71.155719][ T6032] Rebooting in 86400 seconds..