Warning: Permanently added '10.128.1.6' (ED25519) to the list of known hosts.
2026/09/20 08:32:10 parsed 1 programs
2026/09/20 08:32:10 serving rpc on tcp://34251
[ 43.087665][ T29] kauditd_printk_skb: 1 callbacks suppressed
[ 43.087716][ T29] audit: type=1400 audit(1789893130.622:77): avc: denied { node_bind } for pid=2981 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1
[ 43.092028][ T29] audit: type=1400 audit(1789893130.622:78): avc: denied { module_request } for pid=2981 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1
[ 45.051034][ T29] audit: type=1400 audit(1789893132.582:79): avc: denied { mounton } for pid=2992 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 45.075053][ T29] audit: type=1400 audit(1789893132.612:80): avc: denied { mount } for pid=2992 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 45.078359][ T2992] cgroup: Unknown subsys name 'net'
[ 45.080602][ T29] audit: type=1400 audit(1789893132.612:81): avc: denied { unmount } for pid=2992 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 45.233607][ T2992] cgroup: Unknown subsys name 'cpuset'
[ 45.240681][ T2992] cgroup: Unknown subsys name 'rlimit'
[ 45.383950][ T29] audit: type=1400 audit(1789893132.922:82): avc: denied { setattr } for pid=2992 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 45.385476][ T29] audit: type=1400 audit(1789893132.922:83): avc: denied { create } for pid=2992 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 45.385531][ T29] audit: type=1400 audit(1789893132.922:84): avc: denied { write } for pid=2992 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 45.385860][ T29] audit: type=1400 audit(1789893132.922:85): avc: denied { read } for pid=2992 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
Setting up swapspace version 1, size = 127995904 bytes
[ 45.421589][ T29] audit: type=1400 audit(1789893132.952:86): avc: denied { sys_module } for pid=2992 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1
[ 45.518477][ T2998] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped).
[ 45.569678][ T2992] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 47.513456][ T3005] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 48.300340][ T29] kauditd_printk_skb: 25 callbacks suppressed
[ 48.300380][ T29] audit: type=1400 audit(1789893135.832:112): avc: denied { create } for pid=3043 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1
[ 48.306634][ T29] audit: type=1400 audit(1789893135.832:113): avc: denied { sys_admin } for pid=3043 comm="syz-executor" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1
[ 48.358014][ T3010] syz-executor (3010) used greatest stack depth: 22888 bytes left
[ 48.523862][ T29] audit: type=1400 audit(1789893136.062:114): avc: denied { sys_chroot } for pid=3048 comm="syz-executor" capability=18 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1
[ 48.587778][ T29] audit: type=1401 audit(1789893136.122:115): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768"
[ 48.626397][ T29] audit: type=1400 audit(1789893136.162:116): avc: denied { create } for pid=3051 comm="syz-executor" name="tun" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=chr_file permissive=1
[ 48.637131][ T29] audit: type=1400 audit(1789893136.162:117): avc: denied { setattr } for pid=3051 comm="syz-executor" name="tun" dev="devtmpfs" ino=534 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=chr_file permissive=1
[ 48.638094][ T29] audit: type=1400 audit(1789893136.162:118): avc: denied { read write } for pid=3051 comm="syz-executor" name="tun" dev="devtmpfs" ino=534 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=chr_file permissive=1
[ 48.638148][ T29] audit: type=1400 audit(1789893136.162:119): avc: denied { open } for pid=3051 comm="syz-executor" path="/dev/net/tun" dev="devtmpfs" ino=534 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=chr_file permissive=1
2026/09/20 08:32:26 executed programs: 0
[ 59.544107][ T3058] syz-executor (3058) used greatest stack depth: 22248 bytes left
2026/09/20 08:33:12 executed programs: 10
[ 105.480844][ T29] audit: type=1400 audit(1789893193.012:120): avc: denied { read write } for pid=5765 comm="syz.1.18" name="raw-gadget" dev="devtmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 105.481041][ T29] audit: type=1400 audit(1789893193.012:121): avc: denied { open } for pid=5765 comm="syz.1.18" path="/dev/raw-gadget" dev="devtmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 105.532209][ T29] audit: type=1400 audit(1789893193.072:122): avc: denied { ioctl } for pid=5765 comm="syz.1.18" path="/dev/raw-gadget" dev="devtmpfs" ino=236 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 105.802086][ T42] usb 2-1: new high-speed USB device number 2 using dummy_hcd
[ 105.941788][ T11] usb 3-1: new high-speed USB device number 2 using dummy_hcd
[ 105.963826][ T42] usb 2-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 105.979072][ T42] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 105.979162][ T42] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 105.979224][ T42] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 106.092058][ T201] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[ 106.102319][ T11] usb 3-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 106.103452][ T11] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 106.103503][ T11] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 106.103547][ T11] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 106.252185][ T201] usb 1-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 106.253387][ T201] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 106.253437][ T201] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 106.253508][ T201] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 106.293024][ T5791] usb 7-1: new high-speed USB device number 2 using dummy_hcd
[ 106.341706][ T2995] usb 8-1: new high-speed USB device number 2 using dummy_hcd
[ 106.442168][ T5791] usb 7-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 106.443204][ T5791] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 106.443253][ T5791] usb 7-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 106.443297][ T5791] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 106.512193][ T2995] usb 8-1: New USB device found: idVendor=0bda, idProduct=0129, bcdDevice=1.00
[ 106.513245][ T2995] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[ 106.513293][ T2995] usb 8-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[ 106.513338][ T2995] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[
** replaying previous printk message **
[ 108.374766][ T2995] ==================================================================
[ 108.374786][ T2995] BUG: KASAN: slab-use-after-free in rtsx_usb_ms_handle_req+0x17ff/0x1a00
[ 108.374838][ T2995] Read of size 1 at addr ffff8881140d9071 by task kworker/0:2/2995
[ 108.374859][ T2995]
[ 108.374880][ T2995] CPU: 0 UID: 0 PID: 2995 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(lazy)
[ 108.374906][ T2995] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 108.374919][ T2995] Workqueue: events rtsx_usb_ms_handle_req
[ 108.374941][ T2995] Call Trace:
[ 108.374947][ T2995]
[ 108.374953][ T2995] dump_stack_lvl+0x100/0x190
[ 108.374977][ T2995] print_report+0x13d/0x4b0
[ 108.374998][ T2995] ? __virt_addr_valid+0x239/0x430
[ 108.375020][ T2995] ? rtsx_usb_ms_handle_req+0x17ff/0x1a00
[ 108.375034][ T2995] kasan_report+0xdf/0x1c0
[ 108.375050][ T2995] ? rtsx_usb_ms_handle_req+0x17ff/0x1a00
[ 108.375067][ T2995] rtsx_usb_ms_handle_req+0x17ff/0x1a00
[ 108.375085][ T2995] ? __pfx_rtsx_usb_ms_handle_req+0x10/0x10
[ 108.375099][ T2995] ? process_one_work+0xa2c/0x1b10
[ 108.375121][ T2995] ? process_one_work+0x906/0x1b10
[ 108.375141][ T2995] ? process_one_work+0x906/0x1b10
[ 108.375162][ T2995] process_one_work+0xac7/0x1b10
[ 108.375185][ T2995] ? __pfx_process_one_work+0x10/0x10
[ 108.375206][ T2995] ? lock_acquire+0x1d1/0x380
[ 108.375222][ T2995] ? __pfx_rtsx_usb_ms_handle_req+0x10/0x10
[ 108.375237][ T2995] worker_thread+0x5ef/0xe50
[ 108.375259][ T2995] ? __pfx_worker_thread+0x10/0x10
[ 108.375280][ T2995] ? kthread+0x13a/0x450
[ 108.375297][ T2995] ? __pfx_worker_thread+0x10/0x10
[ 108.375317][ T2995] kthread+0x373/0x450
[ 108.375335][ T2995] ? __pfx_kthread+0x10/0x10
[ 108.375353][ T2995] ret_from_fork+0x69f/0xc90
[ 108.375367][ T2995] ? __pfx_ret_from_fork+0x10/0x10
[ 108.375386][ T2995] ? __switch_to+0x7f6/0x10e0
[ 108.375406][ T2995] ? __switch_to_asm+0x39/0x70
[ 108.375421][ T2995] ? __pfx_kthread+0x10/0x10
[ 108.375440][ T2995] ret_from_fork_asm+0x1a/0x30
[ 108.375465][ T2995]
[ 108.375470][ T2995]
[ 108.375473][ T2995] Allocated by task 32:
[ 108.375482][ T2995] kasan_save_stack+0x30/0x50
[ 108.375494][ T2995] kasan_save_track+0x14/0x30
[ 108.375505][ T2995] __kasan_kmalloc+0x8f/0xa0
[ 108.375524][ T2995] __kmalloc_cache_noprof+0x2d8/0x680
[ 108.375537][ T2995] memstick_check+0x2c1/0x10d0
[ 108.375548][ T2995] process_one_work+0xac7/0x1b10
[ 108.375567][ T2995] worker_thread+0x5ef/0xe50
[ 108.375585][ T2995] kthread+0x373/0x450
[ 108.375601][ T2995] ret_from_fork+0x69f/0xc90
[ 108.375612][ T2995] ret_from_fork_asm+0x1a/0x30
[ 108.375626][ T2995]
[ 108.375629][ T2995] Freed by task 32:
[ 108.375635][ T2995] kasan_save_stack+0x30/0x50
[ 108.375646][ T2995] kasan_save_track+0x14/0x30
[ 108.375656][ T2995] kasan_save_free_info+0x3b/0x70
[ 108.375672][ T2995] __kasan_slab_free+0x43/0x70
[ 108.375684][ T2995] kfree+0x20c/0x650
[ 108.375695][ T2995] memstick_check+0x72b/0x10d0
[ 108.375706][ T2995] process_one_work+0xac7/0x1b10
[ 108.375724][ T2995] worker_thread+0x5ef/0xe50
[ 108.375742][ T2995] kthread+0x373/0x450
[ 108.375759][ T2995] ret_from_fork+0x69f/0xc90
[ 108.375770][ T2995] ret_from_fork_asm+0x1a/0x30
[ 108.375783][ T2995]
[ 108.375786][ T2995] The buggy address belongs to the object at ffff8881140d9000
[ 108.375786][ T2995] which belongs to the cache kmalloc-2k of size 2048
[ 108.375797][ T2995] The buggy address is located 113 bytes inside of
[ 108.375797][ T2995] freed 2048-byte region [ffff8881140d9000, ffff8881140d9800)
[ 108.375810][ T2995]
[ 108.375813][ T2995] The buggy address belongs to the physical page:
[ 108.375824][ T2995] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8881140db000 pfn:0x1140d8
[ 108.375845][ T2995] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 108.375863][ T2995] flags: 0x200000000000240(workingset|head|node=0|zone=2)
[ 108.375888][ T2995] page_type: f5(slab)
[ 108.375910][ T2995] raw: 0200000000000240 ffff888100042000 ffff888100040948 ffff888100040948
[ 108.375937][ T2995] raw: ffff8881140db000 0000000000080003 00000000f5000000 0000000000000000
[ 108.375961][ T2995] head: 0200000000000240 ffff888100042000 ffff888100040948 ffff888100040948
[ 108.375980][ T2995] head: ffff8881140db000 0000000000080003 00000000f5000000 0000000000000000
[ 108.375992][ T2995] head: 0200000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 108.376004][ T2995] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008
[ 108.376011][ T2995] page dumped because: kasan: bad access detected
[ 108.376018][ T2995] page_owner tracks the page as allocated
[ 108.376022][ T2995] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 2995, tgid 2995 (kworker/0:2), ts 107680734858
[ 108.376044][ T2995] post_alloc_hook+0xfd/0x120
[ 108.376064][ T2995] get_page_from_freelist+0xf4b/0x3440
[ 108.376077][ T2995] __alloc_frozen_pages_noprof+0x2d7/0x2f70
[ 108.376090][ T2995] new_slab+0xa9/0x6e0
[ 108.376101][ T2995] refill_objects+0xe3/0x410
[ 108.376114][ T2995] __pcs_replace_empty_main+0x35e/0x650
[ 108.376126][ T2995] __kmalloc_cache_noprof+0x4a1/0x680
[ 108.376139][ T2995] usb_create_ep_devs+0x4d/0x2b0
[ 108.376152][ T2995] usb_new_device.part.0+0x15e5/0x1686
[ 108.376175][ T2995] hub_event.cold+0x51a/0xe9d
[ 108.376206][ T2995] process_one_work+0xac7/0x1b10
[ 108.376239][ T2995] worker_thread+0x5ef/0xe50
[ 108.376257][ T2995] kthread+0x373/0x450
[ 108.376274][ T2995] ret_from_fork+0x69f/0xc90
[ 108.376285][ T2995] ret_from_fork_asm+0x1a/0x30
[ 108.376298][ T2995] page last free pid 4953 tgid 4953 ts 88950874824 stack trace:
[ 108.376307][ T2995] __free_frozen_pages+0x714/0xfc0
[ 108.376326][ T2995] qlist_free_all+0x47/0xf0
[ 108.376343][ T2995] kasan_quarantine_reduce+0x1a0/0x1f0
[ 108.376361][ T2995] __kasan_slab_alloc+0x4e/0x70
[ 108.376373][ T2995] kmem_cache_alloc_noprof+0x264/0x650
[ 108.376394][ T2995] vm_area_dup+0x25/0x7e0
[ 108.376406][ T2995] __split_vma+0x19c/0x1db0
[ 108.376424][ T2995] vms_gather_munmap_vmas+0x1d2/0x1670
[ 108.376447][ T2995] __mmap_region+0x4c9/0x3150
[ 108.376468][ T2995] mmap_region+0x3db/0x6d0
[ 108.376490][ T2995] do_mmap+0x12b6/0x1c10
[ 108.376507][ T2995] vm_mmap_pgoff+0x1f0/0x390
[ 108.376525][ T2995] ksys_mmap_pgoff+0x3cb/0x610
[ 108.376541][ T2995] __x64_sys_mmap+0x125/0x190
[ 108.376553][ T2995] do_syscall_64+0x119/0x710
[ 108.376570][ T2995] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 108.376583][ T2995]
[ 108.376586][ T2995] Memory state around the buggy address:
[ 108.376592][ T2995] ffff8881140d8f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 108.376602][ T2995] ffff8881140d8f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 108.376611][ T2995] >ffff8881140d9000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 108.376618][ T2995] ^
[ 108.376625][ T2995] ffff8881140d9080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 108.376634][ T2995] ffff8881140d9100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 108.376642][ T2995] ==================================================================
[ 108.376749][ T2995] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 109.065702][ T2995] CPU: 0 UID: 0 PID: 2995 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(lazy)
[ 109.075067][ T2995] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 109.085122][ T2995] Workqueue: events rtsx_usb_ms_handle_req
[ 109.090940][ T2995] Call Trace:
[ 109.094213][ T2995]
[ 109.097139][ T2995] dump_stack_lvl+0x100/0x190
[ 109.101823][ T2995] vpanic+0x553/0x970
[ 109.105802][ T2995] ? __pfx_vpanic+0x10/0x10
[ 109.110306][ T2995] ? rtsx_usb_ms_handle_req+0x17ff/0x1a00
[ 109.116036][ T2995] panic+0xd1/0xe0
[ 109.119766][ T2995] ? __pfx_panic+0x10/0x10
[ 109.124182][ T2995] ? rtsx_usb_ms_handle_req+0x17ff/0x1a00
[ 109.129899][ T2995] ? preempt_schedule_common+0x3c/0xb0
[ 109.135357][ T2995] check_panic_on_warn.cold+0x19/0x34
[ 109.140729][ T2995] end_report.part.0+0x3a/0x90
[ 109.145497][ T2995] kasan_report.cold+0xe/0x18
[ 109.150176][ T2995] ? rtsx_usb_ms_handle_req+0x17ff/0x1a00
[ 109.155896][ T2995] rtsx_usb_ms_handle_req+0x17ff/0x1a00
[ 109.161448][ T2995] ? __pfx_rtsx_usb_ms_handle_req+0x10/0x10
[ 109.167337][ T2995] ? process_one_work+0xa2c/0x1b10
[ 109.172457][ T2995] ? process_one_work+0x906/0x1b10
[ 109.177570][ T2995] ? process_one_work+0x906/0x1b10
[ 109.182690][ T2995] process_one_work+0xac7/0x1b10
[ 109.187639][ T2995] ? __pfx_process_one_work+0x10/0x10
[ 109.193018][ T2995] ? lock_acquire+0x1d1/0x380
[ 109.197694][ T2995] ? __pfx_rtsx_usb_ms_handle_req+0x10/0x10
[ 109.203586][ T2995] worker_thread+0x5ef/0xe50
[ 109.208184][ T2995] ? __pfx_worker_thread+0x10/0x10
[ 109.213303][ T2995] ? kthread+0x13a/0x450
[ 109.217550][ T2995] ? __pfx_worker_thread+0x10/0x10
[ 109.222666][ T2995] kthread+0x373/0x450
[ 109.226738][ T2995] ? __pfx_kthread+0x10/0x10
[ 109.231330][ T2995] ret_from_fork+0x69f/0xc90
[ 109.235916][ T2995] ? __pfx_ret_from_fork+0x10/0x10
[ 109.241022][ T2995] ? __switch_to+0x7f6/0x10e0
[ 109.245701][ T2995] ? __switch_to_asm+0x39/0x70
[ 109.250465][ T2995] ? __pfx_kthread+0x10/0x10
[ 109.255061][ T2995] ret_from_fork_asm+0x1a/0x30
[ 109.259830][ T2995]
[ 109.263075][ T2995] Kernel Offset: disabled
[ 109.267390][ T2995] Rebooting in 86400 seconds..