[ 73.100634][ T42] kauditd_printk_skb: 10 callbacks suppressed
[ 73.100650][ T42] audit: type=1400 audit(1787748255.559:209): avc: denied { transition } for pid=5969 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 73.112608][ T42] audit: type=1400 audit(1787748255.559:210): avc: denied { noatsecure } for pid=5969 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 73.120712][ T42] audit: type=1400 audit(1787748255.559:211): avc: denied { rlimitinh } for pid=5969 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 73.128515][ T42] audit: type=1400 audit(1787748255.559:212): avc: denied { siginh } for pid=5969 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 75.957294][ T42] audit: type=1400 audit(1787748258.419:213): avc: denied { write } for pid=5972 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 76.009331][ T42] audit: type=1400 audit(1787748258.469:214): avc: denied { write } for pid=5975 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 76.581678][ T42] audit: type=1400 audit(1787748259.049:215): avc: denied { write } for pid=5978 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 76.631042][ T42] audit: type=1400 audit(1787748259.089:216): avc: denied { write } for pid=5981 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 76.912551][ T42] audit: type=1400 audit(1787748259.379:217): avc: denied { write } for pid=5984 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 76.984515][ T42] audit: type=1400 audit(1787748259.449:218): avc: denied { write } for pid=5987 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 78.121361][ T42] kauditd_printk_skb: 4 callbacks suppressed
[ 78.121379][ T42] audit: type=1400 audit(1787748260.579:223): avc: denied { write } for pid=6006 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 78.179670][ T42] audit: type=1400 audit(1787748260.639:224): avc: denied { write } for pid=6009 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 78.751795][ T42] audit: type=1400 audit(1787748261.219:225): avc: denied { write } for pid=6012 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 78.794669][ T42] audit: type=1400 audit(1787748261.259:226): avc: denied { write } for pid=6015 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
Warning: Permanently added '[localhost]:43114' (ED25519) to the list of known hosts.
[ 79.727929][ T42] audit: type=1400 audit(1787748262.189:227): avc: denied { search } for pid=6025 comm="syz-executor233" name="/" dev="configfs" ino=1062 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 79.735314][ T42] audit: type=1400 audit(1787748262.189:228): avc: denied { search } for pid=6025 comm="syz-executor233" name="usb_gadget" dev="configfs" ino=2355 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 79.737430][ T6025] audit: audit_backlog=65 > audit_backlog_limit=64
[ 79.742418][ T42] audit: type=1400 audit(1787748262.189:229): avc: denied { write search } for pid=6025 comm="syz-executor233" name="usb_gadget" dev="configfs" ino=2355 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 79.745132][ T6025] audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=64
[ 79.753178][ T42] audit: type=1400 audit(1787748262.189:230): avc: denied { add_name } for pid=6025 comm="syz-executor233" name="g_midi2_6025" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 79.806925][ T6025] ==================================================================
[ 79.809611][ T6025] BUG: KASAN: stack-out-of-bounds in append_midi1_out_jack.isra.0+0x38c/0x470
[ 79.812437][ T6025] Write of size 1 at addr ffffc90003067880 by task syz-executor233/6025
[ 79.816323][ T6025]
[ 79.817681][ T6025] CPU: 3 UID: 0 PID: 6025 Comm: syz-executor233 Not tainted syzkaller #0 PREEMPT(full)
[ 79.817701][ T6025] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 79.817711][ T6025] Call Trace:
[ 79.817717][ T6025]
[ 79.817722][ T6025] dump_stack_lvl+0x100/0x190
[ 79.817748][ T6025] print_report+0x13d/0x4b0
[ 79.817771][ T6025] ? _raw_spin_lock_irqsave+0x52/0x60
[ 79.817796][ T6025] ? append_midi1_out_jack.isra.0+0x38c/0x470
[ 79.817813][ T6025] kasan_report+0xdf/0x1c0
[ 79.817838][ T6025] ? append_midi1_out_jack.isra.0+0x38c/0x470
[ 79.817856][ T6025] append_midi1_out_jack.isra.0+0x38c/0x470
[ 79.817874][ T6025] f_midi2_create_usb_configs+0x748/0xdf0
[ 79.817896][ T6025] f_midi2_bind+0x1d12/0x2770
[ 79.817917][ T6025] ? __pfx_f_midi2_bind+0x10/0x10
[ 79.817944][ T6025] ? usb_gstrings_attach+0xd4/0x920
[ 79.817969][ T6025] ? __pfx_f_midi2_bind+0x10/0x10
[ 79.817987][ T6025] usb_add_function+0x219/0x890
[ 79.818013][ T6025] configfs_composite_bind+0xd83/0x1960
[ 79.818038][ T6025] gadget_bind_driver+0x28c/0xbf0
[ 79.818052][ T6025] ? __pfx_dummy_udc_set_speed+0x10/0x10
[ 79.818074][ T6025] ? __pfx_gadget_bind_driver+0x10/0x10
[ 79.818089][ T6025] really_probe+0x241/0xa60
[ 79.818107][ T6025] __driver_probe_device+0x210/0x460
[ 79.818122][ T6025] ? _raw_spin_unlock_irqrestore+0x52/0x80
[ 79.818147][ T6025] driver_probe_device+0x4a/0x140
[ 79.818163][ T6025] __driver_attach+0x21f/0x5b0
[ 79.818179][ T6025] ? __pfx___driver_attach+0x10/0x10
[ 79.818194][ T6025] bus_for_each_dev+0x13e/0x1d0
[ 79.818216][ T6025] ? __pfx_bus_for_each_dev+0x10/0x10
[ 79.818237][ T6025] ? bus_add_driver+0x2b5/0x5b0
[ 79.818262][ T6025] bus_add_driver+0x305/0x5b0
[ 79.818285][ T6025] driver_register+0x1e2/0x360
[ 79.818303][ T6025] usb_gadget_register_driver_owner+0x132/0x210
[ 79.818329][ T6025] gadget_dev_desc_UDC_store+0x1b0/0x2e0
[ 79.818349][ T6025] configfs_write_iter+0x302/0x4e0
[ 79.818367][ T6025] vfs_write+0x6af/0x1050
[ 79.818387][ T6025] ? __pfx_configfs_write_iter+0x10/0x10
[ 79.818405][ T6025] ? __pfx_vfs_write+0x10/0x10
[ 79.818424][ T6025] ? __pfx_do_sys_openat2+0x10/0x10
[ 79.818443][ T6025] ksys_write+0x12a/0x250
[ 79.818461][ T6025] ? __pfx_ksys_write+0x10/0x10
[ 79.818482][ T6025] do_syscall_64+0x123/0x790
[ 79.818500][ T6025] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 79.818516][ T6025] RIP: 0033:0x7f84b9f19bf7
[ 79.818529][ T6025] Code: 48 89 fa 4c 89 df e8 98 1d 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 79.818545][ T6025] RSP: 002b:00007fffbbaac100 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[ 79.818561][ T6025] RAX: ffffffffffffffda RBX: 0000555593d6d400 RCX: 00007f84b9f19bf7
[ 79.818571][ T6025] RDX: 000000000000000b RSI: 00007fffbbaac270 RDI: 0000000000000003
[ 79.818580][ T6025] RBP: 00007fffbbaac270 R08: 0000000000000000 R09: 0000000000000000
[ 79.818589][ T6025] R10: 0000000000000000 R11: 0000000000000202 R12: 00007fffbbaac370
[ 79.818599][ T6025] R13: 00007fffbbaac170 R14: 00007f84b9f521d8 R15: 00007fffbbaac270
[ 79.818614][ T6025]
[ 79.818619][ T6025]
[ 79.923543][ T6025] The buggy address belongs to stack of task syz-executor233/6025
[ 79.925938][ T6025] and is located at offset 440 in frame:
[ 79.927721][ T6025] f_midi2_bind+0x0/0x2770
[ 79.929135][ T6025]
[ 79.929889][ T6025] This frame has 6 objects:
[ 79.931398][ T6025] [32, 36) 'sw'
[ 79.931407][ T6025] [48, 56) 'card'
[ 79.932713][ T6025] [80, 88) 'ump'
[ 79.934005][ T6025] [112, 128) 'string_fn'
[ 79.935270][ T6025] [144, 160) 'strings'
[ 79.936750][ T6025] [176, 440) 'config'
[ 79.938052][ T6025]
[ 79.940099][ T6025] The buggy address belongs to a 8-page vmalloc region starting at 0xffffc90003060000 allocated at kernel_clone+0x176/0x9d0
[ 79.944148][ T6025] The buggy address belongs to the physical page:
[ 79.946118][ T6025] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x54bb7
[ 79.948800][ T6025] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 79.951194][ T6025] raw: 00fff00000000000 0000000000000000 ffffea000152edc8 0000000000000000
[ 79.954059][ T6025] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[ 79.956895][ T6025] page dumped because: kasan: bad access detected
[ 79.959353][ T6025] page_owner tracks the page as allocated
[ 79.961669][ T6025] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 5434, tgid 5434 (dhcpcd), ts 75918903758
[ 79.967875][ T6025] post_alloc_hook+0xfd/0x120
[ 79.969326][ T6025] get_page_from_freelist+0x110d/0x35b0
[ 79.971262][ T6025] __alloc_frozen_pages_noprof+0x2eb/0x3300
[ 79.973293][ T6025] alloc_pages_mpol+0x201/0x550
[ 79.974904][ T6025] alloc_pages_noprof+0x1a/0x160
[ 79.976502][ T6025] __vmalloc_node_range_noprof+0xdcc/0x1460
[ 79.978227][ T6025] __vmalloc_node_noprof+0xad/0xf0
[ 79.979739][ T6025] copy_process+0x803/0x8370
[ 79.981137][ T6025] kernel_clone+0x176/0x9d0
[ 79.982569][ T6025] __do_sys_clone3+0x214/0x290
[ 79.983991][ T6025] do_syscall_64+0x123/0x790
[ 79.985437][ T6025] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 79.987272][ T6025] page last free pid 5433 tgid 5433 ts 75917589560 stack trace:
[ 79.989593][ T6025] __free_frozen_pages+0x79f/0x10f0
[ 79.991214][ T6025] skb_free_head+0xb9/0x160
[ 79.992653][ T6025] skb_release_data+0x6c5/0x8e0
[ 79.994278][ T6025] consume_skb+0xc4/0x110
[ 79.995925][ T6025] netlink_recvmsg+0x5b9/0xa90
[ 79.997768][ T6025] sock_recvmsg+0x1d5/0x220
[ 79.999474][ T6025] ____sys_recvmsg+0x21e/0x670
[ 80.001006][ T6025] ___sys_recvmsg+0x16a/0x1a0
[ 80.002483][ T6025] __x64_sys_recvmsg+0x19a/0x260
[ 80.004024][ T6025] do_syscall_64+0x123/0x790
[ 80.005469][ T6025] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 80.007524][ T6025]
[ 80.008276][ T6025] Memory state around the buggy address:
[ 80.010045][ T6025] ffffc90003067780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 80.012486][ T6025] ffffc90003067800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 80.014953][ T6025] >ffffc90003067880: f3 f3 f3 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00
[ 80.017621][ T6025] ^
[ 80.019091][ T6025] ffffc90003067900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 80.021613][ T6025] ffffc90003067980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 80.024049][ T6025] ==================================================================
[ 80.026647][ T6025] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 80.028792][ T6025] CPU: 3 UID: 0 PID: 6025 Comm: syz-executor233 Not tainted syzkaller #0 PREEMPT(full)
[ 80.031639][ T6025] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 80.035191][ T6025] Call Trace:
[ 80.036270][ T6025]
[ 80.037172][ T6025] dump_stack_lvl+0x100/0x190
[ 80.038573][ T6025] vpanic+0x553/0x970
[ 80.039795][ T6025] ? __pfx_vpanic+0x10/0x10
[ 80.041502][ T6025] ? mark_held_locks+0x40/0x70
[ 80.043227][ T6025] ? append_midi1_out_jack.isra.0+0x38c/0x470
[ 80.045148][ T6025] panic+0xd1/0xe0
[ 80.046659][ T6025] ? __pfx_panic+0x10/0x10
[ 80.048597][ T6025] ? append_midi1_out_jack.isra.0+0x38c/0x470
[ 80.051032][ T6025] ? preempt_schedule_common+0x3c/0xb0
[ 80.052977][ T6025] check_panic_on_warn.cold+0x19/0x34
[ 80.054873][ T6025] end_report.part.0+0x3a/0x90
[ 80.056682][ T6025] kasan_report.cold+0xe/0x18
[ 80.058342][ T6025] ? append_midi1_out_jack.isra.0+0x38c/0x470
[ 80.060475][ T6025] append_midi1_out_jack.isra.0+0x38c/0x470
[ 80.062572][ T6025] f_midi2_create_usb_configs+0x748/0xdf0
[ 80.064598][ T6025] f_midi2_bind+0x1d12/0x2770
[ 80.066103][ T6025] ? __pfx_f_midi2_bind+0x10/0x10
[ 80.067662][ T6025] ? usb_gstrings_attach+0xd4/0x920
[ 80.069238][ T6025] ? __pfx_f_midi2_bind+0x10/0x10
[ 80.070781][ T6025] usb_add_function+0x219/0x890
[ 80.072286][ T6025] configfs_composite_bind+0xd83/0x1960
[ 80.074273][ T6025] gadget_bind_driver+0x28c/0xbf0
[ 80.075781][ T6025] ? __pfx_dummy_udc_set_speed+0x10/0x10
[ 80.077519][ T6025] ? __pfx_gadget_bind_driver+0x10/0x10
[ 80.079381][ T6025] really_probe+0x241/0xa60
[ 80.080694][ T6025] __driver_probe_device+0x210/0x460
[ 80.082184][ T6025] ? _raw_spin_unlock_irqrestore+0x52/0x80
[ 80.083909][ T6025] driver_probe_device+0x4a/0x140
[ 80.085425][ T6025] __driver_attach+0x21f/0x5b0
[ 80.086896][ T6025] ? __pfx___driver_attach+0x10/0x10
[ 80.088513][ T6025] bus_for_each_dev+0x13e/0x1d0
[ 80.090022][ T6025] ? __pfx_bus_for_each_dev+0x10/0x10
[ 80.091623][ T6025] ? bus_add_driver+0x2b5/0x5b0
[ 80.093085][ T6025] bus_add_driver+0x305/0x5b0
[ 80.094526][ T6025] driver_register+0x1e2/0x360
[ 80.095971][ T6025] usb_gadget_register_driver_owner+0x132/0x210
[ 80.097826][ T6025] gadget_dev_desc_UDC_store+0x1b0/0x2e0
[ 80.099439][ T6025] configfs_write_iter+0x302/0x4e0
[ 80.100970][ T6025] vfs_write+0x6af/0x1050
[ 80.102487][ T6025] ? __pfx_configfs_write_iter+0x10/0x10
[ 80.104491][ T6025] ? __pfx_vfs_write+0x10/0x10
[ 80.106239][ T6025] ? __pfx_do_sys_openat2+0x10/0x10
[ 80.107750][ T6025] ksys_write+0x12a/0x250
[ 80.109038][ T6025] ? __pfx_ksys_write+0x10/0x10
[ 80.110603][ T6025] do_syscall_64+0x123/0x790
[ 80.112274][ T6025] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 80.114417][ T6025] RIP: 0033:0x7f84b9f19bf7
[ 80.116013][ T6025] Code: 48 89 fa 4c 89 df e8 98 1d 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 80.122777][ T6025] RSP: 002b:00007fffbbaac100 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[ 80.125615][ T6025] RAX: ffffffffffffffda RBX: 0000555593d6d400 RCX: 00007f84b9f19bf7
[ 80.128388][ T6025] RDX: 000000000000000b RSI: 00007fffbbaac270 RDI: 0000000000000003
[ 80.131022][ T6025] RBP: 00007fffbbaac270 R08: 0000000000000000 R09: 0000000000000000
[ 80.133522][ T6025] R10: 0000000000000000 R11: 0000000000000202 R12: 00007fffbbaac370
[ 80.135996][ T6025] R13: 00007fffbbaac170 R14: 00007f84b9f521d8 R15: 00007fffbbaac270
[ 80.138361][ T6025]
[ 80.139997][ T6025] Kernel Offset: disabled
[ 80.141302][ T6025] Rebooting in 86400 seconds..