Warning: Permanently added '10.128.0.193' (ED25519) to the list of known hosts. 2026/07/27 05:07:11 parsed 1 programs 2026/07/27 05:07:11 serving rpc on tcp://38691 [ 340.070233][ T36] audit: type=1400 audit(1785128831.240:64): avc: denied { node_bind } for pid=302 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 341.635722][ T36] audit: type=1400 audit(1785128832.800:65): avc: denied { mounton } for pid=308 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 341.640337][ T308] cgroup: Unknown subsys name 'net' [ 341.658496][ T36] audit: type=1400 audit(1785128832.800:66): avc: denied { mount } for pid=308 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 341.685901][ T36] audit: type=1400 audit(1785128832.830:67): avc: denied { unmount } for pid=308 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 341.686597][ T308] cgroup: Unknown subsys name 'devices' [ 341.811305][ T308] cgroup: Unknown subsys name 'hugetlb' [ 341.816954][ T308] cgroup: Unknown subsys name 'rlimit' [ 341.920927][ T36] audit: type=1400 audit(1785128833.090:68): avc: denied { setattr } for pid=308 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 341.944160][ T36] audit: type=1400 audit(1785128833.090:69): avc: denied { create } for pid=308 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 341.964727][ T36] audit: type=1400 audit(1785128833.090:70): avc: denied { write } for pid=308 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 341.981720][ T312] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 341.985891][ T36] audit: type=1400 audit(1785128833.090:71): avc: denied { read } for pid=308 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 342.013851][ T36] audit: type=1400 audit(1785128833.090:72): avc: denied { sys_module } for pid=308 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 342.034846][ T36] audit: type=1400 audit(1785128833.090:73): avc: denied { mounton } for pid=308 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 342.091871][ T308] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 343.091265][ T318] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 343.843255][ T361] bridge0: port 1(bridge_slave_0) entered blocking state [ 343.855296][ T361] bridge0: port 1(bridge_slave_0) entered disabled state [ 343.862778][ T361] bridge_slave_0: entered allmulticast mode [ 343.869670][ T361] bridge_slave_0: entered promiscuous mode [ 343.876785][ T361] bridge0: port 2(bridge_slave_1) entered blocking state [ 343.883909][ T361] bridge0: port 2(bridge_slave_1) entered disabled state [ 343.891040][ T361] bridge_slave_1: entered allmulticast mode [ 343.897512][ T361] bridge_slave_1: entered promiscuous mode [ 343.980729][ T361] bridge0: port 2(bridge_slave_1) entered blocking state [ 343.987830][ T361] bridge0: port 2(bridge_slave_1) entered forwarding state [ 343.995278][ T361] bridge0: port 1(bridge_slave_0) entered blocking state [ 344.002367][ T361] bridge0: port 1(bridge_slave_0) entered forwarding state [ 344.050725][ T340] bridge0: port 1(bridge_slave_0) entered disabled state [ 344.058094][ T340] bridge0: port 2(bridge_slave_1) entered disabled state [ 344.075646][ T333] bridge0: port 1(bridge_slave_0) entered blocking state [ 344.082768][ T333] bridge0: port 1(bridge_slave_0) entered forwarding state [ 344.093900][ T333] bridge0: port 2(bridge_slave_1) entered blocking state [ 344.101033][ T333] bridge0: port 2(bridge_slave_1) entered forwarding state [ 344.135376][ T361] veth0_vlan: entered promiscuous mode [ 344.149419][ T361] veth1_macvtap: entered promiscuous mode 2026/07/27 05:07:15 executed programs: 0 [ 344.394363][ T385] bridge0: port 1(bridge_slave_0) entered blocking state [ 344.401524][ T385] bridge0: port 1(bridge_slave_0) entered disabled state [ 344.408778][ T385] bridge_slave_0: entered allmulticast mode [ 344.415087][ T385] bridge_slave_0: entered promiscuous mode [ 344.422867][ T385] bridge0: port 2(bridge_slave_1) entered blocking state [ 344.430003][ T385] bridge0: port 2(bridge_slave_1) entered disabled state [ 344.437108][ T385] bridge_slave_1: entered allmulticast mode [ 344.443604][ T385] bridge_slave_1: entered promiscuous mode [ 344.474646][ T340] bridge_slave_1: left allmulticast mode [ 344.480418][ T340] bridge_slave_1: left promiscuous mode [ 344.486066][ T340] bridge0: port 2(bridge_slave_1) entered disabled state [ 344.493979][ T340] bridge_slave_0: left allmulticast mode [ 344.499755][ T340] bridge_slave_0: left promiscuous mode [ 344.505512][ T340] bridge0: port 1(bridge_slave_0) entered disabled state [ 344.592352][ T381] bridge0: port 1(bridge_slave_0) entered blocking state [ 344.599488][ T381] bridge0: port 1(bridge_slave_0) entered disabled state [ 344.606579][ T381] bridge_slave_0: entered allmulticast mode [ 344.613332][ T381] bridge_slave_0: entered promiscuous mode [ 344.623013][ T381] bridge0: port 2(bridge_slave_1) entered blocking state [ 344.630220][ T381] bridge0: port 2(bridge_slave_1) entered disabled state [ 344.637337][ T381] bridge_slave_1: entered allmulticast mode [ 344.643751][ T381] bridge_slave_1: entered promiscuous mode [ 344.652624][ T383] bridge0: port 1(bridge_slave_0) entered blocking state [ 344.659767][ T383] bridge0: port 1(bridge_slave_0) entered disabled state [ 344.666866][ T383] bridge_slave_0: entered allmulticast mode [ 344.673261][ T383] bridge_slave_0: entered promiscuous mode [ 344.680817][ T340] veth1_macvtap: left promiscuous mode [ 344.686341][ T340] veth0_vlan: left promiscuous mode [ 344.736489][ T383] bridge0: port 2(bridge_slave_1) entered blocking state [ 344.743636][ T383] bridge0: port 2(bridge_slave_1) entered disabled state [ 344.750821][ T383] bridge_slave_1: entered allmulticast mode [ 344.757234][ T383] bridge_slave_1: entered promiscuous mode [ 344.819097][ T384] bridge0: port 1(bridge_slave_0) entered blocking state [ 344.826196][ T384] bridge0: port 1(bridge_slave_0) entered disabled state [ 344.833353][ T384] bridge_slave_0: entered allmulticast mode [ 344.839713][ T384] bridge_slave_0: entered promiscuous mode [ 344.846261][ T384] bridge0: port 2(bridge_slave_1) entered blocking state [ 344.853454][ T384] bridge0: port 2(bridge_slave_1) entered disabled state [ 344.860634][ T384] bridge_slave_1: entered allmulticast mode [ 344.867221][ T384] bridge_slave_1: entered promiscuous mode [ 345.025247][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 345.032377][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 345.055681][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 345.062787][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 345.071352][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 345.078443][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 345.086260][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 345.093332][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 345.101346][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 345.108420][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 345.118843][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 345.125945][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 345.167903][ T383] veth0_vlan: entered promiscuous mode [ 345.187272][ T381] veth0_vlan: entered promiscuous mode [ 345.204086][ T340] bridge0: port 1(bridge_slave_0) entered blocking state [ 345.211232][ T340] bridge0: port 1(bridge_slave_0) entered forwarding state [ 345.219228][ T340] bridge0: port 2(bridge_slave_1) entered blocking state [ 345.226296][ T340] bridge0: port 2(bridge_slave_1) entered forwarding state [ 345.241119][ T385] veth0_vlan: entered promiscuous mode [ 345.249180][ T383] veth1_macvtap: entered promiscuous mode [ 345.264837][ T381] veth1_macvtap: entered promiscuous mode [ 345.282905][ T385] veth1_macvtap: entered promiscuous mode [ 345.332763][ T36] kauditd_printk_skb: 31 callbacks suppressed [ 345.332782][ T36] audit: type=1400 audit(1785128836.500:105): avc: denied { read write } for pid=400 comm="syz.1.18" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 345.344921][ T384] veth0_vlan: entered promiscuous mode [ 345.376853][ T36] audit: type=1400 audit(1785128836.530:106): avc: denied { open } for pid=400 comm="syz.1.18" path="/dev/raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 345.404664][ T384] veth1_macvtap: entered promiscuous mode [ 345.415436][ T36] audit: type=1400 audit(1785128836.530:107): avc: denied { ioctl } for pid=400 comm="syz.1.18" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 345.608977][ T9] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 345.658775][ T66] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 345.668754][ T46] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 345.699091][ T376] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 345.760284][ T9] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 345.774501][ T9] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 345.783989][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 345.792369][ T9] usb 2-1: SerialNumber: syz [ 345.820011][ T66] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 345.833220][ T46] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 345.847378][ T66] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 345.856603][ T46] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 345.866056][ T66] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 345.874295][ T46] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 345.882407][ T66] usb 4-1: SerialNumber: syz [ 345.887476][ T376] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 345.900812][ T46] usb 6-1: SerialNumber: syz [ 345.908318][ T376] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 345.918532][ T376] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 345.926650][ T376] usb 1-1: SerialNumber: syz [ 346.401697][ T36] audit: type=1400 audit(1785128837.570:108): avc: denied { mount } for pid=400 comm="syz.1.18" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 346.413904][ T9] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -71 [ 346.426678][ T376] cdc_ether 1-1:1.0: probe with driver cdc_ether failed with error -71 [ 346.440904][ T9] usb 2-1: USB disconnect, device number 2 [ 346.457838][ T376] usb 1-1: USB disconnect, device number 2 [ 346.511673][ T66] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -71 [ 346.521217][ T46] cdc_ether 6-1:1.0: probe with driver cdc_ether failed with error -71 [ 346.531076][ T66] usb 4-1: USB disconnect, device number 2 [ 346.537957][ T46] usb 6-1: USB disconnect, device number 2 [ 346.544073][ T407] ================================================================== [ 346.552246][ T407] BUG: KASAN: slab-use-after-free in string+0x20f/0x2b0 [ 346.559279][ T407] Read of size 1 at addr ffff888105ff3b80 by task syz.0.17/407 [ 346.566882][ T407] [ 346.569350][ T407] CPU: 0 UID: 0 PID: 407 Comm: syz.0.17 Not tainted syzkaller #0 a4a563d0c71b2f3eba821a1af94cbf4bdc8174ca [ 346.569412][ T407] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 346.569458][ T407] Call Trace: [ 346.569467][ T407] [ 346.569476][ T407] __dump_stack+0x21/0x30 [ 346.569513][ T407] dump_stack_lvl+0x140/0x1c0 [ 346.569545][ T407] ? __cfi_dump_stack_lvl+0x10/0x10 [ 346.569579][ T407] print_address_description+0x71/0x210 [ 346.569613][ T407] print_report+0x4a/0x70 [ 346.569643][ T407] kasan_report+0x162/0x1a0 [ 346.569672][ T407] ? string+0x20f/0x2b0 [ 346.569695][ T407] ? string+0x20f/0x2b0 [ 346.569715][ T407] __asan_report_load1_noabort+0x18/0x20 [ 346.569737][ T407] string+0x20f/0x2b0 [ 346.569760][ T407] vsnprintf+0xe65/0x1ad0 [ 346.569784][ T407] snprintf+0xe9/0x140 [ 346.569806][ T407] ? __kernel_text_address+0x11/0x40 [ 346.569837][ T407] ? __cfi_snprintf+0x10/0x10 [ 346.569860][ T407] ? dev_vprintk_emit+0x179/0x400 [ 346.569887][ T407] dev_vprintk_emit+0x313/0x400 [ 346.569913][ T407] ? __cfi_dev_vprintk_emit+0x10/0x10 [ 346.569940][ T407] ? __switch_to+0xc6b/0x1320 [ 346.569973][ T407] ? avc_has_extended_perms+0x7fb/0xe60 [ 346.570002][ T407] dev_printk_emit+0xef/0x150 [ 346.570029][ T407] ? __cfi_dev_printk_emit+0x10/0x10 [ 346.570057][ T407] __dev_printk+0x17f/0x1b0 [ 346.570079][ T407] _dev_err+0x11f/0x180 [ 346.570105][ T407] ? __cfi__dev_err+0x10/0x10 [ 346.570130][ T407] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 346.570157][ T407] ? __cfi__raw_spin_lock_irqsave+0x10/0x10 [ 346.570185][ T407] ? dummy_set_halt+0xe6/0x1c0 [ 346.570220][ T407] raw_ioctl+0x2929/0x37a0 [ 346.570255][ T407] ? __cfi_raw_ioctl+0x10/0x10 [ 346.570286][ T407] ? selinux_file_ioctl+0x732/0x1480 [ 346.570319][ T407] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 346.570340][ T407] ? hrtimer_nanosleep+0x265/0x340 [ 346.570376][ T407] ? do_futex+0x37d/0x510 [ 346.570406][ T407] ? __cfi_hrtimer_wakeup+0x10/0x10 [ 346.570427][ T407] ? __cfi_do_futex+0x10/0x10 [ 346.570463][ T407] ? get_timespec64+0x11a/0x1b0 [ 346.570502][ T407] ? __se_sys_futex+0x13c/0x320 [ 346.570533][ T407] ? common_nsleep+0x93/0xb0 [ 346.570564][ T407] ? bpf_lsm_file_ioctl+0xd/0x20 [ 346.570593][ T407] ? security_file_ioctl+0x3e/0x110 [ 346.570628][ T407] ? __cfi_raw_ioctl+0x10/0x10 [ 346.570658][ T407] __se_sys_ioctl+0x132/0x1b0 [ 346.570687][ T407] __x64_sys_ioctl+0x7f/0xa0 [ 346.570714][ T407] x64_sys_call+0x1878/0x2ee0 [ 346.570735][ T407] do_syscall_64+0x57/0xf0 [ 346.570761][ T407] ? clear_bhb_loop+0x50/0xa0 [ 346.570792][ T407] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 346.570872][ T407] RIP: 0033:0x7ff4c239db2b [ 346.570893][ T407] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 346.570912][ T407] RSP: 002b:00007fffb93fa610 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 346.570945][ T407] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007ff4c239db2b [ 346.570961][ T407] RDX: 0000000000000000 RSI: 000000000000550c RDI: 0000000000000003 [ 346.570980][ T407] RBP: 00007ff4c2433eaf R08: 0000000000000003 R09: 0000000000000409 [ 346.570995][ T407] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 [ 346.571009][ T407] R13: 0000200000000080 R14: 00007ff4c2625fa0 R15: 00007ff4c2625fa0 [ 346.571029][ T407] [ 346.571038][ T407] [ 346.903305][ T407] Allocated by task 1: [ 346.907373][ T407] kasan_save_track+0x3e/0x80 [ 346.912085][ T407] kasan_save_alloc_info+0x3a/0x50 [ 346.917219][ T407] __kasan_kmalloc+0x96/0xb0 [ 346.921830][ T407] __kmalloc_node_track_caller_noprof+0x24e/0x4f0 [ 346.928289][ T407] kvasprintf+0xf1/0x260 [ 346.932543][ T407] kvasprintf_const+0xf6/0x250 [ 346.937336][ T407] kobject_set_name_vargs+0x65/0x120 [ 346.942634][ T407] dev_set_name+0xe3/0x140 [ 346.947085][ T407] usb_add_gadget+0x3e1/0x6e0 [ 346.951773][ T407] usb_add_gadget_udc+0x11e/0x160 [ 346.956808][ T407] dummy_udc_probe+0x6ea/0x7f0 [ 346.961583][ T407] platform_probe+0x17a/0x200 [ 346.966275][ T407] really_probe+0x2e1/0x8b0 [ 346.970797][ T407] __driver_probe_device+0x193/0x280 [ 346.976100][ T407] driver_probe_device+0x54/0x3f0 [ 346.981136][ T407] __device_attach_driver+0x2f1/0x4b0 [ 346.986521][ T407] bus_for_each_drv+0x264/0x300 [ 346.991409][ T407] __device_attach+0x2c4/0x3c0 [ 346.996186][ T407] device_initial_probe+0x1e/0x30 [ 347.001218][ T407] bus_probe_device+0x18b/0x270 [ 347.006098][ T407] device_add+0x7fd/0xbf0 [ 347.010447][ T407] platform_device_add+0x464/0x6c0 [ 347.015594][ T407] dummy_hcd_init+0xce2/0x1230 [ 347.020395][ T407] do_one_initcall+0x1e8/0x6a0 [ 347.025174][ T407] do_initcall_level+0x174/0x2e5 [ 347.030125][ T407] do_initcalls+0x7e/0x160 [ 347.034549][ T407] do_basic_setup+0x95/0xb0 [ 347.039235][ T407] kernel_init_freeable+0x2b1/0x400 [ 347.044462][ T407] kernel_init+0x21/0x1e0 [ 347.048840][ T407] ret_from_fork+0x67/0xa0 [ 347.053285][ T407] ret_from_fork_asm+0x1a/0x30 [ 347.058054][ T407] [ 347.060383][ T407] Freed by task 400: [ 347.064276][ T407] kasan_save_track+0x3e/0x80 [ 347.068960][ T407] kasan_save_free_info+0x44/0x50 [ 347.074021][ T407] __kasan_slab_free+0x5f/0x80 [ 347.078793][ T407] kfree+0x158/0x440 [ 347.082694][ T407] kfree_const+0x3d/0x50 [ 347.086942][ T407] kobject_put+0x21f/0x2a0 [ 347.091362][ T407] put_device+0x23/0x40 [ 347.095541][ T407] usb_del_gadget_udc+0x25/0x30 [ 347.100412][ T407] dummy_udc_remove+0x5c/0x70 [ 347.105112][ T407] platform_remove+0x7e/0xb0 [ 347.109731][ T407] device_release_driver_internal+0x4ad/0x830 [ 347.115838][ T407] device_driver_detach+0x3f/0x50 [ 347.120919][ T407] unbind_store+0x1ab/0x1f0 [ 347.125431][ T407] drv_attr_store+0x91/0xb0 [ 347.129941][ T407] sysfs_kf_write+0x141/0x160 [ 347.134648][ T407] kernfs_fop_write_iter+0x316/0x510 [ 347.139938][ T407] vfs_write+0x762/0xfd0 [ 347.144186][ T407] ksys_write+0x145/0x260 [ 347.148515][ T407] __x64_sys_write+0x7f/0x90 [ 347.153123][ T407] x64_sys_call+0x271c/0x2ee0 [ 347.157798][ T407] do_syscall_64+0x57/0xf0 [ 347.162225][ T407] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 347.168147][ T407] [ 347.170476][ T407] The buggy address belongs to the object at ffff888105ff3b80 [ 347.170476][ T407] which belongs to the cache kmalloc-16 of size 16 [ 347.184380][ T407] The buggy address is located 0 bytes inside of [ 347.184380][ T407] freed 16-byte region [ffff888105ff3b80, ffff888105ff3b90) [ 347.197959][ T407] [ 347.200334][ T407] The buggy address belongs to the physical page: [ 347.206805][ T407] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105ff3 [ 347.215700][ T407] flags: 0x4000000000000000(zone=1) [ 347.220956][ T407] page_type: f5(slab) [ 347.224941][ T407] raw: 4000000000000000 ffff888100041640 ffffea000422d940 dead000000000002 [ 347.233531][ T407] raw: 0000000000000000 0000000000800080 00000001f5000000 0000000000000000 [ 347.242124][ T407] page dumped because: kasan: bad access detected [ 347.248633][ T407] page_owner tracks the page as allocated [ 347.254434][ T407] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c00(GFP_NOIO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 4046773052, free_ts 0 [ 347.273328][ T407] register_dummy_stack+0x99/0x110 [ 347.278458][ T407] init_page_owner+0x36/0x840 [ 347.283152][ T407] page_ext_init+0x3f8/0x44b [ 347.287757][ T407] mm_core_init+0x4b/0x7b [ 347.292100][ T407] page_owner free stack trace missing [ 347.297484][ T407] [ 347.299831][ T407] Memory state around the buggy address: [ 347.305467][ T407] ffff888105ff3a80: 00 01 fc fc 00 01 fc fc 00 01 fc fc fa fb fc fc [ 347.313541][ T407] ffff888105ff3b00: 00 01 fc fc 00 00 fc fc fa fb fc fc fa fb fc fc [ 347.321633][ T407] >ffff888105ff3b80: fa fb fc fc 00 01 fc fc 00 05 fc fc 00 04 fc fc [ 347.329714][ T407] ^ [ 347.333812][ T407] ffff888105ff3c00: 00 00 fc fc 00 01 fc fc 00 01 fc fc 00 00 fc fc [ 347.341888][ T407] ffff888105ff3c80: fa fb fc fc fa fb fc fc 00 00 fc fc fa fb fc fc [ 347.349970][ T407] ================================================================== [ 347.358034][ T407] Disabling lock debugging due to kernel taint [ 347.364187][ T407] gadget €gŪˆ˙˙: fail, usb_ep_set_halt returned -108 [ 347.383473][ T36] audit: type=1400 audit(1785128838.550:109): avc: denied { read } for pid=92 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 347.405379][ T36] audit: type=1400 audit(1785128838.550:110): avc: denied { search } for pid=92 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 347.427083][ T36] audit: type=1400 audit(1785128838.550:111): avc: denied { write } for pid=92 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 347.448490][ T36] audit: type=1400 audit(1785128838.550:112): avc: denied { add_name } for pid=92 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 347.469527][ T36] audit: type=1400 audit(1785128838.550:113): avc: denied { create } for pid=92 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 347.490107][ T36] audit: type=1400 audit(1785128838.550:114): avc: denied { append open } for pid=92 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 347.896956][ T416] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 347.905659][ T416] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 347.928758][ T66] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 348.018764][ T9] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 348.028748][ T46] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 348.079794][ T66] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 348.093558][ T66] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 348.102984][ T66] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 348.111084][ T66] usb 2-1: SerialNumber: syz [ 348.169911][ T9] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 348.181569][ T46] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 348.184820][ T9] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 348.199078][ T46] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 348.205240][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 348.215520][ T46] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 348.222287][ T9] usb 4-1: SerialNumber: syz [ 348.230897][ T46] usb 6-1: SerialNumber: syz [ 348.430005][ T418] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 348.438610][ T418] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 348.720611][ T66] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -71 [ 348.729965][ T66] usb 2-1: USB disconnect, device number 3 [ 348.849708][ T46] cdc_ether 6-1:1.0: probe with driver cdc_ether failed with error -71 [ 348.850074][ T9] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -71 [ 348.866211][ T46] usb 6-1: USB disconnect, device number 3 [ 348.877922][ T9] usb 4-1: USB disconnect, device number 3 [ 348.954847][ T419] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 348.963501][ T419] misc raw-gadget: fail, usb_gadget_register_driver returned -16 2026/07/27 05:07:20 executed programs: 18 [ 349.460023][ T9] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 349.479552][ T423] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 349.488221][ T423] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 349.588806][ T46] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 349.598755][ T66] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 349.609939][ T9] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 349.623732][ T9] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 349.633130][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 349.641219][ T9] usb 2-1: SerialNumber: syz [ 349.739961][ T46] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 349.753937][ T46] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 349.763129][ T46] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 349.771284][ T46] usb 4-1: SerialNumber: syz [ 349.776047][ T66] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 349.790412][ T66] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 349.800148][ T66] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 349.808233][ T66] usb 6-1: SerialNumber: syz [ 350.008017][ T424] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 350.017248][ T424] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 350.249756][ T9] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -71 [ 350.259678][ T9] usb 2-1: USB disconnect, device number 4 [ 350.392675][ T46] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -71 [ 350.401958][ T46] usb 4-1: USB disconnect, device number 4 [ 350.417933][ T66] cdc_ether 6-1:1.0: probe with driver cdc_ether failed with error -71 [ 350.427370][ T66] usb 6-1: USB disconnect, device number 4 [ 350.532991][ T425] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 350.541752][ T425] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 350.988863][ T9] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 351.057166][ T429] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 351.066165][ T429] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 351.138942][ T66] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 351.149935][ T9] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 351.158931][ T46] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 351.165042][ T9] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 351.179609][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 351.187634][ T9] usb 2-1: SerialNumber: syz [ 351.300290][ T66] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 351.314080][ T66] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 351.323272][ T66] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 351.331365][ T66] usb 4-1: SerialNumber: syz [ 351.336944][ T46] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 351.352729][ T46] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 351.361925][ T46] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 351.370018][ T46] usb 6-1: SerialNumber: syz [ 351.584444][ T430] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 351.593103][ T430] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 351.803632][ T9] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -71 [ 351.813751][ T9] usb 2-1: USB disconnect, device number 5 [ 351.954523][ T66] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -71 [ 351.963832][ T66] usb 4-1: USB disconnect, device number 5 [ 351.979131][ T46] cdc_ether 6-1:1.0: probe with driver cdc_ether failed with error -71 [ 351.988311][ T46] usb 6-1: USB disconnect, device number 5 [ 352.109401][ T431] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 352.118003][ T431] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 352.548779][ T417] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 352.633408][ T436] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 352.641971][ T436] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 352.698816][ T9] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 352.707592][ T417] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 352.720666][ T10] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 352.728890][ T417] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 352.737937][ T417] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 352.745989][ T417] usb 2-1: SerialNumber: syz [ 352.849889][ T9] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 352.863819][ T9] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 352.872976][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 352.881094][ T9] usb 4-1: SerialNumber: syz [ 352.886626][ T10] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 352.901629][ T10] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 352.910776][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 352.918866][ T10] usb 6-1: SerialNumber: syz [ 353.159805][ T437] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 353.168409][ T437] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 353.356079][ T417] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -71 [ 353.365423][ T417] usb 2-1: USB disconnect, device number 6 [ 353.503846][ T9] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -71 [ 353.513312][ T9] usb 4-1: USB disconnect, device number 6 [ 353.528819][ T10] cdc_ether 6-1:1.0: probe with driver cdc_ether failed with error -71 [ 353.538040][ T10] usb 6-1: USB disconnect, device number 6 [ 353.684234][ T438] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 353.692943][ T438] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 354.098868][ T46] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 354.208312][ T442] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 354.216919][ T442] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 354.248828][ T66] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 354.257405][ T46] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 354.271261][ T46] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 354.278856][ T10] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 354.280838][ T46] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 354.296463][ T46] usb 2-1: SerialNumber: syz [ 354.399898][ T66] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 354.413917][ T66] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 354.423064][ T66] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 354.431176][ T66] usb 4-1: SerialNumber: syz [ 354.439896][ T10] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 354.453826][ T10] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 354.462987][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 354.471213][ T10] usb 6-1: SerialNumber: syz 2026/07/27 05:07:25 executed programs: 40 [ 354.740105][ T443] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 354.748873][ T443] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 354.905693][ T46] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -71 [ 354.915071][ T46] usb 2-1: USB disconnect, device number 7 [ 355.039416][ T66] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -71 [ 355.048565][ T66] usb 4-1: USB disconnect, device number 7 [ 355.080359][ T10] cdc_ether 6-1:1.0: probe with driver cdc_ether failed with error -71 [ 355.092591][ T10] usb 6-1: USB disconnect, device number 7 [ 355.264832][ T444] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 355.273488][ T444] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 355.648753][ T10] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 355.788733][ T408] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 355.795282][ T448] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 355.804897][ T448] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 355.806118][ T10] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 355.825713][ T9] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 355.834172][ T10] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 355.843290][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 355.851393][ T10] usb 2-1: SerialNumber: syz [ 355.949993][ T408] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 355.963999][ T408] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 355.973213][ T408] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 355.980823][ T9] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 355.981398][ T408] usb 4-1: SerialNumber: syz [ 355.996292][ T9] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 356.008115][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 356.016213][ T9] usb 6-1: SerialNumber: syz [ 356.324324][ T449] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 356.332988][ T449] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 356.460289][ T10] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -71 [ 356.469622][ T10] usb 2-1: USB disconnect, device number 8