[ 66.793402][ T43] kauditd_printk_skb: 10 callbacks suppressed
[ 66.793415][ T43] audit: type=1400 audit(1790134287.257:209): avc: denied { transition } for pid=5976 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 66.794455][ T43] audit: type=1400 audit(1790134287.257:210): avc: denied { noatsecure } for pid=5976 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 66.794499][ T43] audit: type=1400 audit(1790134287.257:211): avc: denied { rlimitinh } for pid=5976 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 66.794533][ T43] audit: type=1400 audit(1790134287.257:212): avc: denied { siginh } for pid=5976 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 70.181755][ T43] audit: type=1400 audit(1790134290.647:213): avc: denied { write } for pid=5979 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 70.231539][ T43] audit: type=1400 audit(1790134290.697:214): avc: denied { write } for pid=5982 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 70.678600][ T43] audit: type=1400 audit(1790134291.147:215): avc: denied { write } for pid=5985 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 70.750393][ T43] audit: type=1400 audit(1790134291.217:216): avc: denied { write } for pid=5988 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 70.859114][ T43] audit: type=1400 audit(1790134291.327:217): avc: denied { write } for pid=5991 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 70.918111][ T43] audit: type=1400 audit(1790134291.387:218): avc: denied { write } for pid=5996 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 71.386943][ T1439] ieee802154 phy0 wpan0: encryption failed: -22
[ 71.387006][ T1439] ieee802154 phy1 wpan1: encryption failed: -22
Warning: Permanently added '[localhost]:23027' (ED25519) to the list of known hosts.
[ 71.886973][ T43] kauditd_printk_skb: 6 callbacks suppressed
[ 71.886985][ T43] audit: type=1400 audit(1790134292.357:225): avc: denied { write } for pid=6024 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 71.942990][ T43] audit: type=1400 audit(1790134292.407:226): avc: denied { write } for pid=6029 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 71.981010][ T43] audit: type=1400 audit(1790134292.447:227): avc: denied { read write } for pid=6030 comm="syz-executor157" name="raw-gadget" dev="devtmpfs" ino=848 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 71.981566][ T43] audit: type=1400 audit(1790134292.447:228): avc: denied { open } for pid=6030 comm="syz-executor157" path="/dev/raw-gadget" dev="devtmpfs" ino=848 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 71.982204][ T43] audit: type=1400 audit(1790134292.447:229): avc: denied { ioctl } for pid=6030 comm="syz-executor157" path="/dev/raw-gadget" dev="devtmpfs" ino=848 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 72.059463][ T43] audit: type=1400 audit(1790134292.527:230): avc: denied { write } for pid=6035 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 72.113137][ T43] audit: type=1400 audit(1790134292.577:231): avc: denied { write } for pid=6038 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 72.244456][ T5905] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 72.396249][ T5905] usb 5-1: New USB device found, idVendor=0bda, idProduct=0129, bcdDevice= 1.00
[ 72.397440][ T5905] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 73.049280][ T5905] ==================================================================
[ 73.049289][ T5905] BUG: KASAN: slab-use-after-free in rtsx_usb_ms_handle_req+0x173b/0x1a00
[ 73.049310][ T5905] Write of size 4 at addr ffff88802dba2074 by task kworker/2:4/5905
[ 73.049319][ T5905]
[ 73.049325][ T5905] CPU: 2 UID: 0 PID: 5905 Comm: kworker/2:4 Not tainted syzkaller #0 PREEMPT(full)
[ 73.049337][ T5905] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 73.049344][ T5905] Workqueue: events rtsx_usb_ms_handle_req
[ 73.049361][ T5905] Call Trace:
[ 73.049365][ T5905]
[ 73.049369][ T5905] dump_stack_lvl+0x100/0x190
[ 73.049386][ T5905] print_report+0x13d/0x4b0
[ 73.049402][ T5905] ? __virt_addr_valid+0x239/0x430
[ 73.049414][ T5905] ? rtsx_usb_ms_handle_req+0x173b/0x1a00
[ 73.049429][ T5905] kasan_report+0xdf/0x1c0
[ 73.049448][ T5905] ? rtsx_usb_ms_handle_req+0x173b/0x1a00
[ 73.049465][ T5905] rtsx_usb_ms_handle_req+0x173b/0x1a00
[ 73.049483][ T5905] ? __pfx_rtsx_usb_ms_handle_req+0x10/0x10
[ 73.049499][ T5905] ? process_one_work+0xa2c/0x1b10
[ 73.049516][ T5905] ? process_one_work+0x906/0x1b10
[ 73.049532][ T5905] ? process_one_work+0x906/0x1b10
[ 73.049549][ T5905] process_one_work+0xac7/0x1b10
[ 73.049568][ T5905] ? __pfx_process_one_work+0x10/0x10
[ 73.049585][ T5905] ? lock_acquire+0x1d1/0x380
[ 73.049597][ T5905] ? __pfx_rtsx_usb_ms_handle_req+0x10/0x10
[ 73.049614][ T5905] worker_thread+0x5ef/0xe50
[ 73.049632][ T5905] ? __pfx_worker_thread+0x10/0x10
[ 73.049648][ T5905] ? kthread+0x13a/0x450
[ 73.049663][ T5905] ? __pfx_worker_thread+0x10/0x10
[ 73.049679][ T5905] kthread+0x373/0x450
[ 73.049694][ T5905] ? __pfx_kthread+0x10/0x10
[ 73.049709][ T5905] ret_from_fork+0x730/0xd60
[ 73.049722][ T5905] ? __pfx_ret_from_fork+0x10/0x10
[ 73.049734][ T5905] ? __switch_to+0x800/0x10f0
[ 73.049749][ T5905] ? __pfx_kthread+0x10/0x10
[ 73.049764][ T5905] ret_from_fork_asm+0x1a/0x30
[ 73.049778][ T5905]
[ 73.049782][ T5905]
[ 73.049784][ T5905] Allocated by task 38:
[ 73.049789][ T5905] kasan_save_stack+0x30/0x50
[ 73.049802][ T5905] kasan_save_track+0x14/0x30
[ 73.049813][ T5905] __kasan_kmalloc+0xaa/0xb0
[ 73.049823][ T5905] __kmalloc_cache_noprof+0x2f8/0x6d0
[ 73.049839][ T5905] memstick_check+0x2c1/0x10d0
[ 73.049852][ T5905] process_one_work+0xac7/0x1b10
[ 73.049867][ T5905] worker_thread+0x5ef/0xe50
[ 73.049882][ T5905] kthread+0x373/0x450
[ 73.049896][ T5905] ret_from_fork+0x730/0xd60
[ 73.049906][ T5905] ret_from_fork_asm+0x1a/0x30
[ 73.049916][ T5905]
[ 73.049918][ T5905] Freed by task 38:
[ 73.049923][ T5905] kasan_save_stack+0x30/0x50
[ 73.049934][ T5905] kasan_save_track+0x14/0x30
[ 73.049944][ T5905] kasan_save_free_info+0x3b/0x70
[ 73.049960][ T5905] __kasan_slab_free+0x5f/0x80
[ 73.049972][ T5905] kfree+0x22b/0x6d0
[ 73.049986][ T5905] memstick_check+0x72b/0x10d0
[ 73.049999][ T5905] process_one_work+0xac7/0x1b10
[ 73.050014][ T5905] worker_thread+0x5ef/0xe50
[ 73.050029][ T5905] kthread+0x373/0x450
[ 73.050043][ T5905] ret_from_fork+0x730/0xd60
[ 73.050053][ T5905] ret_from_fork_asm+0x1a/0x30
[ 73.050063][ T5905]
[ 73.050065][ T5905] The buggy address belongs to the object at ffff88802dba2000
[ 73.050065][ T5905] which belongs to the cache kmalloc-2k of size 2048
[ 73.050073][ T5905] The buggy address is located 116 bytes inside of
[ 73.050073][ T5905] freed 2048-byte region [ffff88802dba2000, ffff88802dba2800)
[ 73.050083][ T5905]
[ 73.050085][ T5905] The buggy address belongs to the physical page:
[ 73.050090][ T5905] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802dba5000 pfn:0x2dba0
[ 73.050099][ T5905] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 73.050107][ T5905] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff)
[ 73.050117][ T5905] page_type: f5(slab)
[ 73.050126][ T5905] raw: 00fff00000000240 ffff88801c042f00 ffffea0000dda410 ffffea000074f410
[ 73.050135][ T5905] raw: ffff88802dba5000 0000000000080006 00000000f5000000 0000000000000000
[ 73.050144][ T5905] head: 00fff00000000240 ffff88801c042f00 ffffea0000dda410 ffffea000074f410
[ 73.050152][ T5905] head: ffff88802dba5000 0000000000080006 00000000f5000000 0000000000000000
[ 73.050161][ T5905] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 73.050169][ T5905] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 73.050174][ T5905] page dumped because: kasan: bad access detected
[ 73.050179][ T5905] page_owner tracks the page as allocated
[ 73.050183][ T5905] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5751, tgid 5751 (syz-executor), ts 52051381762
[ 73.050199][ T5905] post_alloc_hook+0xfd/0x120
[ 73.050213][ T5905] get_page_from_freelist+0x110d/0x35d0
[ 73.050222][ T5905] __alloc_frozen_pages_noprof+0x2eb/0x3300
[ 73.050232][ T5905] new_slab+0xa9/0x6e0
[ 73.050239][ T5905] refill_objects+0xe3/0x410
[ 73.050248][ T5905] __pcs_replace_empty_main+0x35e/0x650
[ 73.050263][ T5905] __kmalloc_noprof+0x67c/0x840
[ 73.050273][ T5905] cache_create_net+0xa2/0x1f0
[ 73.050283][ T5905] unix_gid_cache_create+0x60/0x130
[ 73.050293][ T5905] sunrpc_init_net+0x71/0x1b0
[ 73.050307][ T5905] ops_init+0x1e2/0x5f0
[ 73.050320][ T5905] setup_net+0x118/0x3a0
[ 73.050333][ T5905] copy_net_ns+0x345/0x7a0
[ 73.050347][ T5905] create_new_namespaces+0x3ea/0xac0
[ 73.050358][ T5905] unshare_nsproxy_namespaces+0xf2/0x220
[ 73.050370][ T5905] ksys_unshare+0x4a2/0xa70
[ 73.050381][ T5905] page last free pid 5718 tgid 5718 ts 42990443667 stack trace:
[ 73.050388][ T5905] __free_frozen_pages+0x79f/0x10f0
[ 73.050402][ T5905] qlist_free_all+0x47/0xf0
[ 73.050411][ T5905] kasan_quarantine_reduce+0x1a0/0x1f0
[ 73.050422][ T5905] __kasan_slab_alloc+0x69/0x90
[ 73.050438][ T5905] kmem_cache_alloc_noprof+0x269/0x6a0
[ 73.050448][ T5905] do_getname+0x35/0x390
[ 73.050463][ T5905] do_sys_openat2+0xc7/0x1e0
[ 73.050477][ T5905] __x64_sys_openat+0x12d/0x210
[ 73.050491][ T5905] do_syscall_64+0x123/0x790
[ 73.050505][ T5905] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 73.050515][ T5905]
[ 73.050518][ T5905] Memory state around the buggy address:
[ 73.050522][ T5905] ffff88802dba1f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 73.050529][ T5905] ffff88802dba1f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 73.050536][ T5905] >ffff88802dba2000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 73.050541][ T5905] ^
[ 73.050547][ T5905] ffff88802dba2080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 73.050553][ T5905] ffff88802dba2100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 73.050558][ T5905] ==================================================================
[ 73.050565][ T5905] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 73.277612][ T5905] CPU: 2 UID: 0 PID: 5905 Comm: kworker/2:4 Not tainted syzkaller #0 PREEMPT(full)
[ 73.281460][ T5905] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 73.285474][ T5905] Workqueue: events rtsx_usb_ms_handle_req
[ 73.287809][ T5905] Call Trace:
[ 73.289148][ T5905]
[ 73.290339][ T5905] dump_stack_lvl+0x100/0x190
[ 73.292224][ T5905] vpanic+0x553/0x970
[ 73.293804][ T5905] ? __pfx_vpanic+0x10/0x10
[ 73.295642][ T5905] ? __pfx_vprintk_emit+0x10/0x10
[ 73.297637][ T5905] ? rtsx_usb_ms_handle_req+0x173b/0x1a00
[ 73.299890][ T5905] panic+0xd1/0xe0
[ 73.301391][ T5905] ? __pfx_panic+0x10/0x10
[ 73.303158][ T5905] ? rtsx_usb_ms_handle_req+0x173b/0x1a00
[ 73.305402][ T5905] check_panic_on_warn.cold+0x19/0x34
[ 73.307549][ T5905] end_report.part.0+0x3a/0x90
[ 73.309444][ T5905] kasan_report.cold+0xe/0x18
[ 73.311322][ T5905] ? rtsx_usb_ms_handle_req+0x173b/0x1a00
[ 73.313565][ T5905] rtsx_usb_ms_handle_req+0x173b/0x1a00
[ 73.315766][ T5905] ? __pfx_rtsx_usb_ms_handle_req+0x10/0x10
[ 73.318108][ T5905] ? process_one_work+0xa2c/0x1b10
[ 73.320151][ T5905] ? process_one_work+0x906/0x1b10
[ 73.322174][ T5905] ? process_one_work+0x906/0x1b10
[ 73.324245][ T5905] process_one_work+0xac7/0x1b10
[ 73.326207][ T5905] ? __pfx_process_one_work+0x10/0x10
[ 73.328335][ T5905] ? lock_acquire+0x1d1/0x380
[ 73.330223][ T5905] ? __pfx_rtsx_usb_ms_handle_req+0x10/0x10
[ 73.332564][ T5905] worker_thread+0x5ef/0xe50
[ 73.334402][ T5905] ? __pfx_worker_thread+0x10/0x10
[ 73.336452][ T5905] ? kthread+0x13a/0x450
[ 73.338130][ T5905] ? __pfx_worker_thread+0x10/0x10
[ 73.340064][ T5905] kthread+0x373/0x450
[ 73.341389][ T5905] ? __pfx_kthread+0x10/0x10
[ 73.342797][ T5905] ret_from_fork+0x730/0xd60
[ 73.344456][ T5905] ? __pfx_ret_from_fork+0x10/0x10
[ 73.346379][ T5905] ? __switch_to+0x800/0x10f0
[ 73.348113][ T5905] ? __pfx_kthread+0x10/0x10
[ 73.349614][ T5905] ret_from_fork_asm+0x1a/0x30
[ 73.351100][ T5905]
[ 73.352859][ T5905] Kernel Offset: disabled
[ 73.354515][ T5905] Rebooting in 86400 seconds..