[ 67.170549][ T43] kauditd_printk_skb: 10 callbacks suppressed
[ 67.170563][ T43] audit: type=1400 audit(1789143228.939:210): avc: denied { transition } for pid=5975 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 67.170667][ T43] audit: type=1400 audit(1789143228.939:211): avc: denied { noatsecure } for pid=5975 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 67.171377][ T43] audit: type=1400 audit(1789143228.939:212): avc: denied { rlimitinh } for pid=5975 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 67.171518][ T43] audit: type=1400 audit(1789143228.939:213): avc: denied { siginh } for pid=5975 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 69.941233][ T43] audit: type=1400 audit(1789143231.699:214): avc: denied { write } for pid=5979 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 69.992536][ T43] audit: type=1400 audit(1789143231.749:215): avc: denied { write } for pid=5982 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 70.230688][ T43] audit: type=1400 audit(1789143231.999:216): avc: denied { write } for pid=5985 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 70.289306][ T43] audit: type=1400 audit(1789143232.059:217): avc: denied { write } for pid=5988 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 70.975314][ T43] audit: type=1400 audit(1789143232.739:218): avc: denied { write } for pid=5995 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 71.045149][ T43] audit: type=1400 audit(1789143232.809:219): avc: denied { write } for pid=5998 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 71.260296][ T1438] ieee802154 phy0 wpan0: encryption failed: -22
[ 71.260359][ T1438] ieee802154 phy1 wpan1: encryption failed: -22
[ 72.203947][ T43] kauditd_printk_skb: 2 callbacks suppressed
[ 72.203963][ T43] audit: type=1400 audit(1789143233.969:222): avc: denied { write } for pid=6007 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 72.250781][ T43] audit: type=1400 audit(1789143234.019:223): avc: denied { write } for pid=6010 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 72.400729][ T43] audit: type=1400 audit(1789143234.169:224): avc: denied { write } for pid=6013 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 72.466607][ T43] audit: type=1400 audit(1789143234.229:225): avc: denied { write } for pid=6016 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 73.157489][ T43] audit: type=1400 audit(1789143234.929:226): avc: denied { write } for pid=6020 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 73.200258][ T43] audit: type=1400 audit(1789143234.969:227): avc: denied { write } for pid=6024 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 73.277649][ T43] audit: type=1400 audit(1789143235.049:228): avc: denied { write } for pid=6029 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 73.356281][ T43] audit: type=1400 audit(1789143235.119:229): avc: denied { write } for pid=6032 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
Warning: Permanently added '[localhost]:28731' (ED25519) to the list of known hosts.
[+] open /dev/raw-gadget successful.
[+] USB_RAW_IOCTL_INIT successful.
[+] USB_RAW_IOCTL_RUN successful.
[+] pthread_create successful.
[ 73.579793][ T43] audit: type=1400 audit(1789143235.349:230): avc: denied { read write } for pid=6038 comm="syz-executor112" name="raw-gadget" dev="devtmpfs" ino=848 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 73.581560][ T43] audit: type=1400 audit(1789143235.349:231): avc: denied { open } for pid=6038 comm="syz-executor112" path="/dev/raw-gadget" dev="devtmpfs" ino=848 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 73.816864][ T5082] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 73.968295][ T5082] usb 5-1: New USB device found, idVendor=045e, idProduct=0775, bcdDevice= 1.00
[ 73.969982][ T5082] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 74.987226][ T5082] input: Samsung SUR40 as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/input/input5
[ 74.994664][ T5124] sur40 5-1:1.0: error in usb_bulk_read
[ 74.999685][ T5124] sur40 5-1:1.0: error in usb_bulk_read
[+] Found new device: /dev/v4l-touch24
[+] Successfully opened /dev/v4l-touch24
[+] close raw-gadget successful.
[ 75.044096][ T5082] usb 5-1: USB disconnect, device number 2
[+] Device node /dev/v4l-touch24 removed, disconnect is processing...
[ 76.369336][ T851] cfg80211: failed to load regulatory.db
[ 77.111231][ T6038] ==================================================================
[+] sleep(2) successful. (remaining: 0)
[+] Closing target device /dev/v4l-touch24 to trigger UAF...
[ 77.111244][ T6038] BUG: KASAN: slab-use-after-free in v4l2_release+0x30d/0x390
[ 77.111263][ T6038] Read of size 8 at addr ffff88803547c658 by task syz-executor112/6038
[ 77.111271][ T6038]
[ 77.111277][ T6038] CPU: 1 UID: 0 PID: 6038 Comm: syz-executor112 Not tainted syzkaller #0 PREEMPT(full)
[ 77.111290][ T6038] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 77.111296][ T6038] Call Trace:
[ 77.111301][ T6038]
[ 77.111306][ T6038] dump_stack_lvl+0x100/0x190
[ 77.111328][ T6038] print_report+0x13d/0x4b0
[ 77.111344][ T6038] ? __virt_addr_valid+0x239/0x430
[ 77.111357][ T6038] ? v4l2_release+0x30d/0x390
[ 77.111370][ T6038] kasan_report+0xdf/0x1c0
[ 77.111384][ T6038] ? v4l2_release+0x30d/0x390
[ 77.111403][ T6038] ? __pfx_v4l2_release+0x10/0x10
[ 77.111422][ T6038] v4l2_release+0x30d/0x390
[ 77.111442][ T6038] ? __pfx_v4l2_release+0x10/0x10
[ 77.111464][ T6038] __fput+0x3ff/0xb50
[ 77.111488][ T6038] fput_close_sync+0x118/0x250
[ 77.111513][ T6038] ? __pfx_fput_close_sync+0x10/0x10
[ 77.111536][ T6038] __x64_sys_close+0x8b/0x120
[ 77.111554][ T6038] do_syscall_64+0x123/0x790
[ 77.111570][ T6038] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.111581][ T6038] RIP: 0033:0x7fbd276a535e
[ 77.111593][ T6038] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 77.111607][ T6038] RSP: 002b:00007ffce11b8c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
[ 77.111624][ T6038] RAX: ffffffffffffffda RBX: 00005555754b9400 RCX: 00007fbd276a535e
[ 77.111635][ T6038] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
[ 77.111644][ T6038] RBP: 0000000000000031 R08: 0000000000000000 R09: 0000000000000000
[ 77.111654][ T6038] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004
[ 77.111662][ T6038] R13: 00007fbd276f005b R14: 0000000000000025 R15: 0000000000000003
[ 77.111672][ T6038]
[ 77.111676][ T6038]
[ 77.111683][ T6038] Allocated by task 5082:
[ 77.111691][ T6038] kasan_save_stack+0x30/0x50
[ 77.111708][ T6038] kasan_save_track+0x14/0x30
[ 77.111723][ T6038] __kasan_kmalloc+0xaa/0xb0
[ 77.111737][ T6038] __kmalloc_cache_noprof+0x2f8/0x6d0
[ 77.111759][ T6038] sur40_probe+0x1a8/0x1580
[ 77.111775][ T6038] usb_probe_interface+0x386/0x9b0
[ 77.111792][ T6038] really_probe+0x241/0xa60
[ 77.111807][ T6038] __driver_probe_device+0x210/0x460
[ 77.111822][ T6038] driver_probe_device+0x4a/0x140
[ 77.111838][ T6038] __device_attach_driver+0x1df/0x320
[ 77.111853][ T6038] bus_for_each_drv+0x159/0x1e0
[ 77.111874][ T6038] __device_attach+0x1e4/0x4d0
[ 77.111886][ T6038] device_initial_probe+0xaf/0xd0
[ 77.111901][ T6038] bus_probe_device+0x64/0x160
[ 77.111915][ T6038] device_add+0x121d/0x1970
[ 77.111932][ T6038] usb_set_configuration+0xd97/0x1c60
[ 77.111950][ T6038] usb_generic_driver_probe+0xa1/0xe0
[ 77.111966][ T6038] usb_probe_device+0xef/0x400
[ 77.111981][ T6038] really_probe+0x241/0xa60
[ 77.111995][ T6038] __driver_probe_device+0x210/0x460
[ 77.112009][ T6038] driver_probe_device+0x4a/0x140
[ 77.112025][ T6038] __device_attach_driver+0x1df/0x320
[ 77.112040][ T6038] bus_for_each_drv+0x159/0x1e0
[ 77.112061][ T6038] __device_attach+0x1e4/0x4d0
[ 77.112074][ T6038] device_initial_probe+0xaf/0xd0
[ 77.112087][ T6038] bus_probe_device+0x64/0x160
[ 77.112100][ T6038] device_add+0x121d/0x1970
[ 77.112117][ T6038] usb_new_device.part.0+0xcc2/0x1686
[ 77.112139][ T6038] hub_event.cold+0x1e3/0xe90
[ 77.112183][ T6038] process_one_work+0xac7/0x1b10
[ 77.112207][ T6038] worker_thread+0x5ef/0xe50
[ 77.112228][ T6038] kthread+0x373/0x450
[ 77.112247][ T6038] ret_from_fork+0x730/0xd60
[ 77.112263][ T6038] ret_from_fork_asm+0x1a/0x30
[ 77.112278][ T6038]
[ 77.112281][ T6038] Freed by task 5082:
[ 77.112288][ T6038] kasan_save_stack+0x30/0x50
[ 77.112304][ T6038] kasan_save_track+0x14/0x30
[ 77.112327][ T6038] kasan_save_free_info+0x3b/0x70
[ 77.112345][ T6038] __kasan_slab_free+0x5f/0x80
[ 77.112360][ T6038] kfree+0x22b/0x6d0
[ 77.112379][ T6038] sur40_disconnect+0xb8/0x170
[ 77.112393][ T6038] usb_unbind_interface+0x1dd/0x9e0
[ 77.112413][ T6038] device_remove+0x12a/0x180
[ 77.112427][ T6038] device_release_driver_internal+0x44e/0x620
[ 77.112445][ T6038] bus_remove_device+0x2bc/0x560
[ 77.112455][ T6038] device_del+0x376/0x9b0
[ 77.112467][ T6038] usb_disable_device+0x367/0x810
[ 77.112484][ T6038] usb_disconnect+0x2e2/0x9a0
[ 77.112501][ T6038] hub_event+0x1bb1/0x4420
[ 77.112519][ T6038] process_one_work+0xac7/0x1b10
[ 77.112539][ T6038] worker_thread+0x5ef/0xe50
[ 77.112560][ T6038] kthread+0x373/0x450
[ 77.112581][ T6038] ret_from_fork+0x730/0xd60
[ 77.112597][ T6038] ret_from_fork_asm+0x1a/0x30
[ 77.112613][ T6038]
[ 77.112617][ T6038] The buggy address belongs to the object at ffff88803547c000
[ 77.112617][ T6038] which belongs to the cache kmalloc-4k of size 4096
[ 77.112631][ T6038] The buggy address is located 1624 bytes inside of
[ 77.112631][ T6038] freed 4096-byte region [ffff88803547c000, ffff88803547d000)
[ 77.112646][ T6038]
[ 77.112650][ T6038] The buggy address belongs to the physical page:
[ 77.112658][ T6038] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x35478
[ 77.112673][ T6038] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 77.112685][ T6038] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 77.112697][ T6038] page_type: f5(slab)
[ 77.112707][ T6038] raw: 00fff00000000040 ffff88801c043040 dead000000000100 dead000000000122
[ 77.112720][ T6038] raw: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000
[ 77.112735][ T6038] head: 00fff00000000040 ffff88801c043040 dead000000000100 dead000000000122
[ 77.112749][ T6038] head: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000
[ 77.112763][ T6038] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 77.112776][ T6038] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 77.112785][ T6038] page dumped because: kasan: bad access detected
[ 77.112792][ T6038] page_owner tracks the page as allocated
[ 77.112798][ T6038] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5149, tgid 5149 (udevd), ts 15027584225
[ 77.112821][ T6038] post_alloc_hook+0xfd/0x120
[ 77.112835][ T6038] get_page_from_freelist+0x110d/0x35d0
[ 77.112851][ T6038] __alloc_frozen_pages_noprof+0x2eb/0x3300
[ 77.112867][ T6038] new_slab+0xa9/0x6e0
[ 77.112881][ T6038] refill_objects+0xe3/0x410
[ 77.112896][ T6038] __pcs_replace_empty_main+0x35e/0x650
[ 77.112910][ T6038] __kmalloc_noprof+0x67c/0x840
[ 77.112920][ T6038] tomoyo_realpath_from_path+0xb6/0x690
[ 77.112932][ T6038] tomoyo_check_open_permission+0x2af/0x3c0
[ 77.112949][ T6038] tomoyo_file_open+0x6b/0x90
[ 77.112961][ T6038] security_file_open+0xb5/0x1e0
[ 77.112973][ T6038] do_dentry_open+0x588/0x14d0
[ 77.112983][ T6038] vfs_open+0x82/0x3f0
[ 77.112994][ T6038] path_openat+0x19fa/0x2440
[ 77.113006][ T6038] do_file_open+0x20e/0x430
[ 77.113017][ T6038] do_sys_openat2+0x10f/0x1e0
[ 77.113030][ T6038] page last free pid 5142 tgid 5142 ts 14824943792 stack trace:
[ 77.113037][ T6038] __free_frozen_pages+0x79f/0x10f0
[ 77.113049][ T6038] qlist_free_all+0x47/0xf0
[ 77.113058][ T6038] kasan_quarantine_reduce+0x1a0/0x1f0
[ 77.113068][ T6038] __kasan_slab_alloc+0x69/0x90
[ 77.113080][ T6038] kmem_cache_alloc_noprof+0x269/0x6a0
[ 77.113089][ T6038] alloc_empty_file+0x5b/0x1c0
[ 77.113102][ T6038] path_openat+0xdb/0x2440
[ 77.113113][ T6038] do_file_open+0x20e/0x430
[ 77.113125][ T6038] do_sys_openat2+0x10f/0x1e0
[ 77.113137][ T6038] __x64_sys_openat+0x12d/0x210
[ 77.113150][ T6038] do_syscall_64+0x123/0x790
[ 77.113163][ T6038] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.113173][ T6038]
[ 77.113175][ T6038] Memory state around the buggy address:
[ 77.113180][ T6038] ffff88803547c500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.113187][ T6038] ffff88803547c580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.113194][ T6038] >ffff88803547c600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.113199][ T6038] ^
[ 77.113204][ T6038] ffff88803547c680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.113211][ T6038] ffff88803547c700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.113216][ T6038] ==================================================================
[ 77.113223][ T6038] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 77.389263][ T6038] CPU: 1 UID: 0 PID: 6038 Comm: syz-executor112 Not tainted syzkaller #0 PREEMPT(full)
[ 77.392237][ T6038] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 77.395515][ T6038] Call Trace:
[ 77.396682][ T6038]
[ 77.397709][ T6038] dump_stack_lvl+0x100/0x190
[ 77.399305][ T6038] vpanic+0x553/0x970
[ 77.400682][ T6038] ? __pfx_vpanic+0x10/0x10
[ 77.402254][ T6038] ? __pfx_vprintk_emit+0x10/0x10
[ 77.403983][ T6038] ? v4l2_release+0x30d/0x390
[ 77.405675][ T6038] panic+0xd1/0xe0
[ 77.406934][ T6038] ? __pfx_panic+0x10/0x10
[ 77.408421][ T6038] ? end_report.part.0+0x23/0x90
[ 77.410015][ T6038] ? rcu_is_watching+0x13/0xc0
[ 77.411525][ T6038] check_panic_on_warn.cold+0x19/0x34
[ 77.413197][ T6038] end_report.part.0+0x3a/0x90
[ 77.414712][ T6038] kasan_report.cold+0xe/0x18
[ 77.416268][ T6038] ? v4l2_release+0x30d/0x390
[ 77.417771][ T6038] ? __pfx_v4l2_release+0x10/0x10
[ 77.419375][ T6038] v4l2_release+0x30d/0x390
[ 77.420840][ T6038] ? __pfx_v4l2_release+0x10/0x10
[ 77.422428][ T6038] __fput+0x3ff/0xb50
[ 77.423718][ T6038] fput_close_sync+0x118/0x250
[ 77.425258][ T6038] ? __pfx_fput_close_sync+0x10/0x10
[ 77.426791][ T6038] __x64_sys_close+0x8b/0x120
[ 77.428128][ T6038] do_syscall_64+0x123/0x790
[ 77.429614][ T6038] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.431481][ T6038] RIP: 0033:0x7fbd276a535e
[ 77.432903][ T6038] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 77.438906][ T6038] RSP: 002b:00007ffce11b8c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
[ 77.442167][ T6038] RAX: ffffffffffffffda RBX: 00005555754b9400 RCX: 00007fbd276a535e
[ 77.445357][ T6038] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
[ 77.448615][ T6038] RBP: 0000000000000031 R08: 0000000000000000 R09: 0000000000000000
[ 77.451856][ T6038] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004
[ 77.455004][ T6038] R13: 00007fbd276f005b R14: 0000000000000025 R15: 0000000000000003
[ 77.458265][ T6038]
[ 77.460437][ T6038] Kernel Offset: disabled
[ 77.462244][ T6038] Rebooting in 86400 seconds..