[ 71.396528][ T42] kauditd_printk_skb: 10 callbacks suppressed
[ 71.396547][ T42] audit: type=1400 audit(1787823036.183:211): avc: denied { transition } for pid=5972 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 71.407260][ T42] audit: type=1400 audit(1787823036.183:212): avc: denied { noatsecure } for pid=5972 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 71.415493][ T42] audit: type=1400 audit(1787823036.183:213): avc: denied { rlimitinh } for pid=5972 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 71.424158][ T42] audit: type=1400 audit(1787823036.183:214): avc: denied { siginh } for pid=5972 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 71.595886][ T1436] ieee802154 phy0 wpan0: encryption failed: -22
[ 71.598846][ T1436] ieee802154 phy1 wpan1: encryption failed: -22
[ 75.447142][ T42] audit: type=1400 audit(1787823040.233:215): avc: denied { write } for pid=5980 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 75.497937][ T42] audit: type=1400 audit(1787823040.283:216): avc: denied { write } for pid=5983 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 75.733629][ T42] audit: type=1400 audit(1787823040.523:217): avc: denied { write } for pid=5986 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 75.807610][ T42] audit: type=1400 audit(1787823040.593:218): avc: denied { write } for pid=5989 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 75.900399][ T42] audit: type=1400 audit(1787823040.683:219): avc: denied { write } for pid=5992 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 75.949350][ T42] audit: type=1400 audit(1787823040.733:220): avc: denied { write } for pid=5995 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 76.495921][ T42] kauditd_printk_skb: 2 callbacks suppressed
[ 76.495944][ T42] audit: type=1400 audit(1787823041.283:223): avc: denied { write } for pid=6004 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 76.557676][ T42] audit: type=1400 audit(1787823041.343:224): avc: denied { write } for pid=6007 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 76.673691][ T42] audit: type=1400 audit(1787823041.463:225): avc: denied { write } for pid=6010 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 76.752472][ T42] audit: type=1400 audit(1787823041.543:226): avc: denied { write } for pid=6013 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 76.846999][ T42] audit: type=1400 audit(1787823041.633:227): avc: denied { write } for pid=6016 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 76.910630][ T42] audit: type=1400 audit(1787823041.693:228): avc: denied { write } for pid=6019 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 77.603358][ T42] audit: type=1400 audit(1787823042.393:229): avc: denied { write } for pid=6026 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 77.673956][ T42] audit: type=1400 audit(1787823042.463:230): avc: denied { write } for pid=6029 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
Warning: Permanently added '[localhost]:14991' (ED25519) to the list of known hosts.
[ 77.883178][ T42] audit: type=1400 audit(1787823042.673:231): avc: denied { read write } for pid=6035 comm="syz-executor399" name="demux0" dev="devtmpfs" ino=951 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1
[ 77.891337][ T42] audit: type=1400 audit(1787823042.673:232): avc: denied { open } for pid=6035 comm="syz-executor399" path="/dev/dvb/adapter0/demux0" dev="devtmpfs" ino=951 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1
[ 77.923415][ T5832] ==================================================================
[ 77.926310][ T5832] BUG: KASAN: slab-use-after-free in vidtv_bridge_on_new_pkts_avail+0x126/0x140
[ 77.929235][ T5832] Read of size 8 at addr ffff88802e860118 by task kworker/2:3/5832
[ 77.933877][ T5832]
[ 77.934662][ T5832] CPU: 2 UID: 0 PID: 5832 Comm: kworker/2:3 Not tainted syzkaller #0 PREEMPT(full)
[ 77.934676][ T5832] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 77.934684][ T5832] Workqueue: events vidtv_mux_tick
[ 77.934704][ T5832] Call Trace:
[ 77.934710][ T5832]
[ 77.934715][ T5832] dump_stack_lvl+0x100/0x190
[ 77.934730][ T5832] print_report+0x13d/0x4b0
[ 77.934747][ T5832] ? __virt_addr_valid+0x239/0x430
[ 77.934766][ T5832] ? vidtv_bridge_on_new_pkts_avail+0x126/0x140
[ 77.934782][ T5832] kasan_report+0xdf/0x1c0
[ 77.934807][ T5832] ? vidtv_bridge_on_new_pkts_avail+0x126/0x140
[ 77.934827][ T5832] ? __pfx_vidtv_bridge_on_new_pkts_avail+0x10/0x10
[ 77.934842][ T5832] vidtv_bridge_on_new_pkts_avail+0x126/0x140
[ 77.934857][ T5832] ? __pfx_vidtv_bridge_on_new_pkts_avail+0x10/0x10
[ 77.934872][ T5832] ? __asan_memset+0x23/0x50
[ 77.934889][ T5832] vidtv_mux_tick+0xb95/0x1460
[ 77.934914][ T5832] ? check_prev_add+0x354/0xe60
[ 77.934933][ T5832] ? __pfx_vidtv_mux_tick+0x10/0x10
[ 77.934952][ T5832] ? __lock_acquire+0xe15/0x1ec0
[ 77.934976][ T5832] ? process_one_work+0x906/0x1b10
[ 77.934994][ T5832] ? process_one_work+0x906/0x1b10
[ 77.935012][ T5832] process_one_work+0xac7/0x1b10
[ 77.935032][ T5832] ? irqentry_exit+0x24d/0xa10
[ 77.935047][ T5832] ? __pfx_process_one_work+0x10/0x10
[ 77.935068][ T5832] ? __pfx_vidtv_mux_tick+0x10/0x10
[ 77.935086][ T5832] worker_thread+0x5ef/0xe50
[ 77.935105][ T5832] ? __pfx_worker_thread+0x10/0x10
[ 77.935123][ T5832] ? kthread+0x13a/0x450
[ 77.935139][ T5832] ? __pfx_worker_thread+0x10/0x10
[ 77.935160][ T5832] kthread+0x373/0x450
[ 77.935176][ T5832] ? __pfx_kthread+0x10/0x10
[ 77.935192][ T5832] ret_from_fork+0x730/0xd60
[ 77.935213][ T5832] ? __pfx_ret_from_fork+0x10/0x10
[ 77.935234][ T5832] ? __switch_to+0x800/0x10f0
[ 77.935250][ T5832] ? __pfx_kthread+0x10/0x10
[ 77.935266][ T5832] ret_from_fork_asm+0x1a/0x30
[ 77.935335][ T5832]
[ 77.935344][ T5832]
[ 78.012523][ T5832] Allocated by task 1:
[ 78.013973][ T5832] kasan_save_stack+0x30/0x50
[ 78.015475][ T5832] kasan_save_track+0x14/0x30
[ 78.017035][ T5832] __kasan_kmalloc+0xaa/0xb0
[ 78.018511][ T5832] __kmalloc_cache_noprof+0x2e7/0x6b0
[ 78.020682][ T5832] vidtv_demod_i2c_probe+0x6e/0x8a0
[ 78.022837][ T5832] i2c_device_probe+0x658/0xd10
[ 78.024918][ T5832] really_probe+0x241/0xa60
[ 78.026833][ T5832] __driver_probe_device+0x210/0x460
[ 78.029185][ T5832] driver_probe_device+0x4a/0x140
[ 78.031566][ T5832] __device_attach_driver+0x1df/0x320
[ 78.034035][ T5832] bus_for_each_drv+0x159/0x1e0
[ 78.036215][ T5832] __device_attach+0x1e4/0x4d0
[ 78.038252][ T5832] device_initial_probe+0xaf/0xd0
[ 78.040380][ T5832] bus_probe_device+0x64/0x160
[ 78.042339][ T5832] device_add+0x121d/0x1970
[ 78.044229][ T5832] i2c_new_client_device+0x660/0xd30
[ 78.046167][ T5832] dvb_module_probe+0x165/0x310
[ 78.048049][ T5832] vidtv_bridge_probe+0x370/0xa30
[ 78.050205][ T5832] platform_probe+0x106/0x1d0
[ 78.052003][ T5832] really_probe+0x241/0xa60
[ 78.053766][ T5832] __driver_probe_device+0x210/0x460
[ 78.055838][ T5832] driver_probe_device+0x4a/0x140
[ 78.057863][ T5832] __driver_attach+0x21f/0x5b0
[ 78.059857][ T5832] bus_for_each_dev+0x13e/0x1d0
[ 78.062020][ T5832] bus_add_driver+0x305/0x5b0
[ 78.063920][ T5832] driver_register+0x1e2/0x360
[ 78.065936][ T5832] vidtv_bridge_init+0x52/0x80
[ 78.068131][ T5832] do_one_initcall+0x11c/0x6f0
[ 78.069996][ T5832] kernel_init_freeable+0x6ea/0x7b0
[ 78.072797][ T5832] kernel_init+0x21/0x1e0
[ 78.075347][ T5832] ret_from_fork+0x730/0xd60
[ 78.077664][ T5832] ret_from_fork_asm+0x1a/0x30
[ 78.079628][ T5832]
[ 78.080605][ T5832] Freed by task 6035:
[ 78.082265][ T5832] kasan_save_stack+0x30/0x50
[ 78.084212][ T5832] kasan_save_track+0x14/0x30
[ 78.086168][ T5832] kasan_save_free_info+0x3b/0x70
[ 78.088315][ T5832] __kasan_slab_free+0x5f/0x80
[ 78.090457][ T5832] kfree+0x22b/0x6c0
[ 78.092264][ T5832] i2c_device_remove+0x81/0x280
[ 78.094486][ T5832] device_remove+0xcb/0x180
[ 78.096589][ T5832] device_release_driver_internal+0x44e/0x620
[ 78.099199][ T5832] bus_remove_device+0x2bc/0x560
[ 78.101303][ T5832] device_del+0x376/0x9b0
[ 78.103091][ T5832] device_unregister+0x1d/0xe0
[ 78.105272][ T5832] i2c_unregister_device+0xf5/0x270
[ 78.107758][ T5832] dvb_module_release+0x69/0x90
[ 78.110047][ T5832] vidtv_bridge_remove+0xd8/0x140
[ 78.112145][ T5832] platform_remove+0x5f/0x80
[ 78.114048][ T5832] device_remove+0xcb/0x180
[ 78.115523][ T5832] device_release_driver_internal+0x44e/0x620
[ 78.117438][ T5832] unbind_store+0xf8/0x110
[ 78.118868][ T5832] drv_attr_store+0x74/0xb0
[ 78.120628][ T5832] sysfs_kf_write+0xf2/0x150
[ 78.122338][ T5832] kernfs_fop_write_iter+0x3e0/0x5f0
[ 78.124418][ T5832] vfs_write+0x6af/0x1050
[ 78.125917][ T5832] ksys_write+0x12a/0x250
[ 78.127377][ T5832] do_syscall_64+0x123/0x790
[ 78.128880][ T5832] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 78.130685][ T5832]
[ 78.131434][ T5832] The buggy address belongs to the object at ffff88802e860000
[ 78.131434][ T5832] which belongs to the cache kmalloc-2k of size 2048
[ 78.137152][ T5832] The buggy address is located 280 bytes inside of
[ 78.137152][ T5832] freed 2048-byte region [ffff88802e860000, ffff88802e860800)
[ 78.144647][ T5832]
[ 78.145879][ T5832] The buggy address belongs to the physical page:
[ 78.148529][ T5832] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802e864000 pfn:0x2e860
[ 78.152091][ T5832] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 78.155098][ T5832] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff)
[ 78.157787][ T5832] page_type: f5(slab)
[ 78.159041][ T5832] raw: 00fff00000000240 ffff88801c042f00 ffffea000071b010 ffffea0000993a10
[ 78.161828][ T5832] raw: ffff88802e864000 0000000800080007 00000000f5000000 0000000000000000
[ 78.164840][ T5832] head: 00fff00000000240 ffff88801c042f00 ffffea000071b010 ffffea0000993a10
[ 78.167791][ T5832] head: ffff88802e864000 0000000800080007 00000000f5000000 0000000000000000
[ 78.171281][ T5832] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 78.174767][ T5832] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 78.177984][ T5832] page dumped because: kasan: bad access detected
[ 78.179982][ T5832] page_owner tracks the page as allocated
[ 78.182073][ T5832] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 15032077504
[ 78.189300][ T5832] post_alloc_hook+0xfd/0x120
[ 78.190908][ T5832] get_page_from_freelist+0x110d/0x35b0
[ 78.192932][ T5832] __alloc_frozen_pages_noprof+0x2eb/0x3300
[ 78.194844][ T5832] new_slab+0xa5/0x640
[ 78.196309][ T5832] refill_objects+0xe3/0x410
[ 78.197919][ T5832] __pcs_replace_empty_main+0x372/0x680
[ 78.200013][ T5832] __kmalloc_cache_noprof+0x47b/0x6b0
[ 78.201855][ T5832] wakeup_source_device_create+0x46/0x2e0
[ 78.203911][ T5832] wakeup_source_sysfs_add+0x1c/0x90
[ 78.206140][ T5832] wakeup_source_register+0x154/0x3e0
[ 78.208481][ T5832] device_wakeup_enable+0xce/0x2e0
[ 78.211156][ T5832] alarmtimer_rtc_add_device+0x1da/0x320
[ 78.213866][ T5832] device_add+0x13cc/0x1970
[ 78.216039][ T5832] cdev_device_add+0x12b/0x270
[ 78.217907][ T5832] __devm_rtc_register_device+0x456/0x8d0
[ 78.220006][ T5832] cmos_platform_probe+0xe3b/0x1100
[ 78.221725][ T5832] page last free pid 24 tgid 24 ts 14981723256 stack trace:
[ 78.224854][ T5832] free_pages_prepare+0x586/0xe00
[ 78.227186][ T5832] __free_contig_range_common+0x14f/0x250
[ 78.229614][ T5832] free_pages_bulk+0x12a/0x200
[ 78.231662][ T5832] vm_area_free_pages+0xad/0x2b0
[ 78.233358][ T5832] vfree+0x108/0x730
[ 78.234923][ T5832] delayed_vfree_work+0x56/0x80
[ 78.236599][ T5832] process_one_work+0xac7/0x1b10
[ 78.238422][ T5832] worker_thread+0x5ef/0xe50
[ 78.240162][ T5832] kthread+0x373/0x450
[ 78.241787][ T5832] ret_from_fork+0x730/0xd60
[ 78.243609][ T5832] ret_from_fork_asm+0x1a/0x30
[ 78.245616][ T5832]
[ 78.246938][ T5832] Memory state around the buggy address:
[ 78.248967][ T5832] ffff88802e860000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.251799][ T5832] ffff88802e860080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.254584][ T5832] >ffff88802e860100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.257462][ T5832] ^
[ 78.259115][ T5832] ffff88802e860180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.262066][ T5832] ffff88802e860200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.264899][ T5832] ==================================================================
[ 78.272755][ T5832] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 78.275214][ T5832] CPU: 2 UID: 0 PID: 5832 Comm: kworker/2:3 Not tainted syzkaller #0 PREEMPT(full)
[ 78.278431][ T5832] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 78.281611][ T5832] Workqueue: events vidtv_mux_tick
[ 78.283205][ T5832] Call Trace:
[ 78.284497][ T5832]
[ 78.285720][ T5832] dump_stack_lvl+0x100/0x190
[ 78.287677][ T5832] vpanic+0x553/0x970
[ 78.289401][ T5832] ? __pfx_vpanic+0x10/0x10
[ 78.291397][ T5832] ? mark_held_locks+0x40/0x70
[ 78.293424][ T5832] ? vidtv_bridge_on_new_pkts_avail+0x126/0x140
[ 78.295478][ T5832] panic+0xd1/0xe0
[ 78.296757][ T5832] ? __pfx_panic+0x10/0x10
[ 78.298173][ T5832] ? vidtv_bridge_on_new_pkts_avail+0x126/0x140
[ 78.300134][ T5832] ? preempt_schedule_common+0x3c/0xb0
[ 78.301810][ T5832] check_panic_on_warn.cold+0x19/0x34
[ 78.303566][ T5832] end_report.part.0+0x3a/0x90
[ 78.305165][ T5832] kasan_report.cold+0xe/0x18
[ 78.306943][ T5832] ? vidtv_bridge_on_new_pkts_avail+0x126/0x140
[ 78.309280][ T5832] ? __pfx_vidtv_bridge_on_new_pkts_avail+0x10/0x10
[ 78.311376][ T5832] vidtv_bridge_on_new_pkts_avail+0x126/0x140
[ 78.313287][ T5832] ? __pfx_vidtv_bridge_on_new_pkts_avail+0x10/0x10
[ 78.315379][ T5832] ? __asan_memset+0x23/0x50
[ 78.316884][ T5832] vidtv_mux_tick+0xb95/0x1460
[ 78.318403][ T5832] ? check_prev_add+0x354/0xe60
[ 78.319965][ T5832] ? __pfx_vidtv_mux_tick+0x10/0x10
[ 78.321555][ T5832] ? __lock_acquire+0xe15/0x1ec0
[ 78.323306][ T5832] ? process_one_work+0x906/0x1b10
[ 78.325116][ T5832] ? process_one_work+0x906/0x1b10
[ 78.326929][ T5832] process_one_work+0xac7/0x1b10
[ 78.328614][ T5832] ? irqentry_exit+0x24d/0xa10
[ 78.330166][ T5832] ? __pfx_process_one_work+0x10/0x10
[ 78.331825][ T5832] ? __pfx_vidtv_mux_tick+0x10/0x10
[ 78.333441][ T5832] worker_thread+0x5ef/0xe50
[ 78.334868][ T5832] ? __pfx_worker_thread+0x10/0x10
[ 78.336727][ T5832] ? kthread+0x13a/0x450
[ 78.338367][ T5832] ? __pfx_worker_thread+0x10/0x10
[ 78.340206][ T5832] kthread+0x373/0x450
[ 78.341578][ T5832] ? __pfx_kthread+0x10/0x10
[ 78.343323][ T5832] ret_from_fork+0x730/0xd60
[ 78.345151][ T5832] ? __pfx_ret_from_fork+0x10/0x10
[ 78.347246][ T5832] ? __switch_to+0x800/0x10f0
[ 78.348850][ T5832] ? __pfx_kthread+0x10/0x10
[ 78.350331][ T5832] ret_from_fork_asm+0x1a/0x30
[ 78.351870][ T5832]
[ 78.353838][ T5832] Kernel Offset: disabled
[ 78.355193][ T5832] Rebooting in 86400 seconds..