[ 72.411336][ T42] kauditd_printk_skb: 10 callbacks suppressed
[ 72.411355][ T42] audit: type=1400 audit(1787946097.727:209): avc: denied { transition } for pid=5972 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 72.423442][ T42] audit: type=1400 audit(1787946097.727:210): avc: denied { noatsecure } for pid=5972 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 72.432831][ T42] audit: type=1400 audit(1787946097.727:211): avc: denied { rlimitinh } for pid=5972 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 72.443443][ T42] audit: type=1400 audit(1787946097.727:212): avc: denied { siginh } for pid=5972 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 76.636428][ T42] audit: type=1400 audit(1787946101.947:213): avc: denied { write } for pid=5976 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 76.690750][ T42] audit: type=1400 audit(1787946102.007:214): avc: denied { write } for pid=5979 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 77.202687][ T42] audit: type=1400 audit(1787946102.517:215): avc: denied { write } for pid=5986 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 77.269213][ T42] audit: type=1400 audit(1787946102.577:216): avc: denied { write } for pid=5989 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 77.364575][ T42] audit: type=1400 audit(1787946102.677:217): avc: denied { write } for pid=5992 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 77.434967][ T42] audit: type=1400 audit(1787946102.747:218): avc: denied { write } for pid=5995 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 77.548667][ T42] audit: type=1400 audit(1787946102.857:219): avc: denied { write } for pid=5998 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 77.606841][ T42] audit: type=1400 audit(1787946102.917:220): avc: denied { write } for pid=6001 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 77.700044][ T42] audit: type=1400 audit(1787946103.017:221): avc: denied { write } for pid=6005 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 77.755439][ T42] audit: type=1400 audit(1787946103.067:222): avc: denied { write } for pid=6010 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 77.848711][ T42] audit: type=1400 audit(1787946103.157:223): avc: denied { write } for pid=6014 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 77.898156][ T42] audit: type=1400 audit(1787946103.207:224): avc: denied { write } for pid=6017 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 77.986143][ T42] audit: type=1400 audit(1787946103.297:225): avc: denied { write } for pid=6020 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 78.035349][ T42] audit: type=1400 audit(1787946103.347:226): avc: denied { write } for pid=6024 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
Warning: Permanently added '[localhost]:41206' (ED25519) to the list of known hosts.
[ 78.125939][ T42] audit: type=1400 audit(1787946103.437:227): avc: denied { write } for pid=6029 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 78.360036][ T849] ==================================================================
[ 78.362902][ T849] BUG: KASAN: slab-use-after-free in vidtv_bridge_on_new_pkts_avail+0x126/0x140
[ 78.365719][ T849] Read of size 8 at addr ffff88802ddc0118 by task kworker/0:2/849
[ 78.370571][ T849]
[ 78.371449][ T849] CPU: 0 UID: 0 PID: 849 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full)
[ 78.371465][ T849] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 78.371473][ T849] Workqueue: events vidtv_mux_tick
[ 78.371493][ T849] Call Trace:
[ 78.371499][ T849]
[ 78.371504][ T849] dump_stack_lvl+0x100/0x190
[ 78.371522][ T849] print_report+0x13d/0x4b0
[ 78.371540][ T849] ? __virt_addr_valid+0x239/0x430
[ 78.371558][ T849] ? vidtv_bridge_on_new_pkts_avail+0x126/0x140
[ 78.371571][ T849] kasan_report+0xdf/0x1c0
[ 78.371590][ T849] ? vidtv_bridge_on_new_pkts_avail+0x126/0x140
[ 78.371604][ T849] ? __pfx_vidtv_bridge_on_new_pkts_avail+0x10/0x10
[ 78.371617][ T849] vidtv_bridge_on_new_pkts_avail+0x126/0x140
[ 78.371630][ T849] ? __pfx_vidtv_bridge_on_new_pkts_avail+0x10/0x10
[ 78.371643][ T849] ? __asan_memset+0x23/0x50
[ 78.371658][ T849] vidtv_mux_tick+0xb95/0x1460
[ 78.371680][ T849] ? check_prev_add+0x354/0xe60
[ 78.371697][ T849] ? __pfx_vidtv_mux_tick+0x10/0x10
[ 78.371714][ T849] ? __lock_acquire+0xe15/0x1ec0
[ 78.371734][ T849] ? process_one_work+0x906/0x1b10
[ 78.371750][ T849] ? process_one_work+0x906/0x1b10
[ 78.371767][ T849] process_one_work+0xac7/0x1b10
[ 78.371784][ T849] ? irqentry_exit+0x24d/0xa10
[ 78.371802][ T849] ? __pfx_process_one_work+0x10/0x10
[ 78.371819][ T849] ? __pfx_vidtv_mux_tick+0x10/0x10
[ 78.371836][ T849] worker_thread+0x5ef/0xe50
[ 78.371853][ T849] ? __pfx_worker_thread+0x10/0x10
[ 78.371869][ T849] ? kthread+0x13a/0x450
[ 78.371882][ T849] ? __pfx_worker_thread+0x10/0x10
[ 78.371896][ T849] kthread+0x373/0x450
[ 78.371909][ T849] ? __pfx_kthread+0x10/0x10
[ 78.371922][ T849] ret_from_fork+0x730/0xd60
[ 78.371940][ T849] ? __pfx_ret_from_fork+0x10/0x10
[ 78.371957][ T849] ? __switch_to+0x800/0x10f0
[ 78.371971][ T849] ? __pfx_kthread+0x10/0x10
[ 78.371984][ T849] ret_from_fork_asm+0x1a/0x30
[ 78.371998][ T849]
[ 78.372002][ T849]
[ 78.438388][ T849] Allocated by task 1:
[ 78.439756][ T849] kasan_save_stack+0x30/0x50
[ 78.441192][ T849] kasan_save_track+0x14/0x30
[ 78.442779][ T849] __kasan_kmalloc+0xaa/0xb0
[ 78.444300][ T849] __kmalloc_cache_noprof+0x2e7/0x6b0
[ 78.446024][ T849] vidtv_demod_i2c_probe+0x6e/0x8a0
[ 78.447843][ T849] i2c_device_probe+0x658/0xd10
[ 78.450163][ T849] really_probe+0x241/0xa60
[ 78.452312][ T849] __driver_probe_device+0x210/0x460
[ 78.454961][ T849] driver_probe_device+0x4a/0x140
[ 78.456897][ T849] __device_attach_driver+0x1df/0x320
[ 78.459137][ T849] bus_for_each_drv+0x159/0x1e0
[ 78.461026][ T849] __device_attach+0x1e4/0x4d0
[ 78.462825][ T849] device_initial_probe+0xaf/0xd0
[ 78.464666][ T849] bus_probe_device+0x64/0x160
[ 78.466350][ T849] device_add+0x121d/0x1970
[ 78.468039][ T849] i2c_new_client_device+0x660/0xd30
[ 78.470137][ T849] dvb_module_probe+0x165/0x310
[ 78.472053][ T849] vidtv_bridge_probe+0x370/0xa30
[ 78.473866][ T849] platform_probe+0x106/0x1d0
[ 78.475438][ T849] really_probe+0x241/0xa60
[ 78.476972][ T849] __driver_probe_device+0x210/0x460
[ 78.478991][ T849] driver_probe_device+0x4a/0x140
[ 78.481209][ T849] __driver_attach+0x21f/0x5b0
[ 78.483139][ T849] bus_for_each_dev+0x13e/0x1d0
[ 78.485256][ T849] bus_add_driver+0x305/0x5b0
[ 78.487173][ T849] driver_register+0x1e2/0x360
[ 78.489196][ T849] vidtv_bridge_init+0x52/0x80
[ 78.490834][ T849] do_one_initcall+0x11c/0x6f0
[ 78.492358][ T849] kernel_init_freeable+0x6ea/0x7b0
[ 78.494000][ T849] kernel_init+0x21/0x1e0
[ 78.495342][ T849] ret_from_fork+0x730/0xd60
[ 78.496789][ T849] ret_from_fork_asm+0x1a/0x30
[ 78.498401][ T849]
[ 78.499157][ T849] Freed by task 6033:
[ 78.500402][ T849] kasan_save_stack+0x30/0x50
[ 78.501979][ T849] kasan_save_track+0x14/0x30
[ 78.503465][ T849] kasan_save_free_info+0x3b/0x70
[ 78.505128][ T849] __kasan_slab_free+0x5f/0x80
[ 78.506851][ T849] kfree+0x22b/0x6c0
[ 78.508450][ T849] i2c_device_remove+0x81/0x280
[ 78.510357][ T849] device_remove+0xcb/0x180
[ 78.512105][ T849] device_release_driver_internal+0x44e/0x620
[ 78.514075][ T849] bus_remove_device+0x2bc/0x560
[ 78.515698][ T849] device_del+0x376/0x9b0
[ 78.517073][ T849] device_unregister+0x1d/0xe0
[ 78.518672][ T849] i2c_unregister_device+0xf5/0x270
[ 78.520423][ T849] dvb_module_release+0x69/0x90
[ 78.522012][ T849] vidtv_bridge_remove+0xd8/0x140
[ 78.523588][ T849] platform_remove+0x5f/0x80
[ 78.525094][ T849] device_remove+0xcb/0x180
[ 78.526492][ T849] device_release_driver_internal+0x44e/0x620
[ 78.528433][ T849] unbind_store+0xf8/0x110
[ 78.530086][ T849] drv_attr_store+0x74/0xb0
[ 78.531768][ T849] sysfs_kf_write+0xf2/0x150
[ 78.533636][ T849] kernfs_fop_write_iter+0x3e0/0x5f0
[ 78.535625][ T849] vfs_write+0x6af/0x1050
[ 78.537298][ T849] ksys_write+0x12a/0x250
[ 78.539011][ T849] do_syscall_64+0x123/0x790
[ 78.540508][ T849] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 78.542450][ T849]
[ 78.543213][ T849] The buggy address belongs to the object at ffff88802ddc0000
[ 78.543213][ T849] which belongs to the cache kmalloc-2k of size 2048
[ 78.547435][ T849] The buggy address is located 280 bytes inside of
[ 78.547435][ T849] freed 2048-byte region [ffff88802ddc0000, ffff88802ddc0800)
[ 78.551987][ T849]
[ 78.552759][ T849] The buggy address belongs to the physical page:
[ 78.554752][ T849] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2ddc0
[ 78.558165][ T849] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 78.561433][ T849] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 78.564022][ T849] page_type: f5(slab)
[ 78.565366][ T849] raw: 00fff00000000040 ffff88801c042f00 dead000000000100 dead000000000122
[ 78.568020][ T849] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[ 78.571579][ T849] head: 00fff00000000040 ffff88801c042f00 dead000000000100 dead000000000122
[ 78.574735][ T849] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
[ 78.577692][ T849] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 78.580734][ T849] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 78.583621][ T849] page dumped because: kasan: bad access detected
[ 78.586349][ T849] page_owner tracks the page as allocated
[ 78.589234][ T849] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 14346453177
[ 78.597229][ T849] post_alloc_hook+0xfd/0x120
[ 78.599012][ T849] get_page_from_freelist+0x110d/0x35b0
[ 78.600916][ T849] __alloc_frozen_pages_noprof+0x2eb/0x3300
[ 78.602845][ T849] new_slab+0xa5/0x640
[ 78.604668][ T849] refill_objects+0xe3/0x410
[ 78.606922][ T849] __pcs_replace_empty_main+0x372/0x680
[ 78.609722][ T849] __kmalloc_cache_noprof+0x47b/0x6b0
[ 78.612295][ T849] wakeup_source_device_create+0x46/0x2e0
[ 78.614076][ T849] wakeup_source_sysfs_add+0x1c/0x90
[ 78.615694][ T849] wakeup_source_register+0x154/0x3e0
[ 78.617370][ T849] device_wakeup_enable+0xce/0x2e0
[ 78.619085][ T849] alarmtimer_rtc_add_device+0x1da/0x320
[ 78.621504][ T849] device_add+0x13cc/0x1970
[ 78.623472][ T849] cdev_device_add+0x12b/0x270
[ 78.625571][ T849] __devm_rtc_register_device+0x456/0x8d0
[ 78.627453][ T849] cmos_platform_probe+0xe3b/0x1100
[ 78.629263][ T849] page last free pid 849 tgid 849 ts 14250197565 stack trace:
[ 78.631593][ T849] free_pages_prepare+0x586/0xe00
[ 78.633160][ T849] __free_contig_range_common+0x14f/0x250
[ 78.635042][ T849] free_pages_bulk+0x12a/0x200
[ 78.636645][ T849] vm_area_free_pages+0xad/0x2b0
[ 78.638445][ T849] vfree+0x108/0x730
[ 78.639817][ T849] delayed_vfree_work+0x56/0x80
[ 78.641374][ T849] process_one_work+0xac7/0x1b10
[ 78.642904][ T849] worker_thread+0x5ef/0xe50
[ 78.644359][ T849] kthread+0x373/0x450
[ 78.645633][ T849] ret_from_fork+0x730/0xd60
[ 78.647054][ T849] ret_from_fork_asm+0x1a/0x30
[ 78.648675][ T849]
[ 78.649425][ T849] Memory state around the buggy address:
[ 78.651115][ T849] ffff88802ddc0000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.653564][ T849] ffff88802ddc0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.657576][ T849] >ffff88802ddc0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.661089][ T849] ^
[ 78.663131][ T849] ffff88802ddc0180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.666599][ T849] ffff88802ddc0200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.669491][ T849] ==================================================================
[ 78.673296][ T6030] ------------[ cut here ]------------
[ 78.673991][ T849] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 78.674001][ T849] CPU: 0 UID: 0 PID: 849 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full)
[ 78.674014][ T849] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 78.674021][ T849] Workqueue: events vidtv_mux_tick
[ 78.674040][ T849] Call Trace:
[ 78.674043][ T849]
[ 78.674047][ T849] dump_stack_lvl+0x100/0x190
[ 78.674064][ T849] vpanic+0x553/0x970
[ 78.674074][ T849] ? __pfx_vpanic+0x10/0x10
[ 78.674083][ T849] ? mark_held_locks+0x40/0x70
[ 78.674100][ T849] ? vidtv_bridge_on_new_pkts_avail+0x126/0x140
[ 78.674111][ T849] panic+0xd1/0xe0
[ 78.674120][ T849] ? __pfx_panic+0x10/0x10
[ 78.674130][ T849] ? vidtv_bridge_on_new_pkts_avail+0x126/0x140
[ 78.674141][ T849] ? preempt_schedule_common+0x3c/0xb0
[ 78.674160][ T849] check_panic_on_warn.cold+0x19/0x34
[ 78.674171][ T849] end_report.part.0+0x3a/0x90
[ 78.674186][ T849] kasan_report.cold+0xe/0x18
[ 78.674202][ T849] ? vidtv_bridge_on_new_pkts_avail+0x126/0x140
[ 78.674214][ T849] ? __pfx_vidtv_bridge_on_new_pkts_avail+0x10/0x10
[ 78.674225][ T849] vidtv_bridge_on_new_pkts_avail+0x126/0x140
[ 78.674237][ T849] ? __pfx_vidtv_bridge_on_new_pkts_avail+0x10/0x10
[ 78.674248][ T849] ? __asan_memset+0x23/0x50
[ 78.674261][ T849] vidtv_mux_tick+0xb95/0x1460
[ 78.674279][ T849] ? check_prev_add+0x354/0xe60
[ 78.674293][ T849] ? __pfx_vidtv_mux_tick+0x10/0x10
[ 78.674308][ T849] ? __lock_acquire+0xe15/0x1ec0
[ 78.674325][ T849] ? process_one_work+0x906/0x1b10
[ 78.674339][ T849] ? process_one_work+0x906/0x1b10
[ 78.674353][ T849] process_one_work+0xac7/0x1b10
[ 78.674369][ T849] ? irqentry_exit+0x24d/0xa10
[ 78.674380][ T849] ? __pfx_process_one_work+0x10/0x10
[ 78.674395][ T849] ? __pfx_vidtv_mux_tick+0x10/0x10
[ 78.674410][ T849] worker_thread+0x5ef/0xe50
[ 78.674425][ T849] ? __pfx_worker_thread+0x10/0x10
[ 78.674439][ T849] ? kthread+0x13a/0x450
[ 78.674451][ T849] ? __pfx_worker_thread+0x10/0x10
[ 78.674464][ T849] kthread+0x373/0x450
[ 78.674476][ T849] ? __pfx_kthread+0x10/0x10
[ 78.674488][ T849] ret_from_fork+0x730/0xd60
[ 78.674520][ T849] ? __pfx_ret_from_fork+0x10/0x10
[ 78.674537][ T849] ? __switch_to+0x800/0x10f0
[ 78.674551][ T849] ? __pfx_kthread+0x10/0x10
[ 78.674564][ T849] ret_from_fork_asm+0x1a/0x30
[ 78.674578][ T849]
[ 78.675916][ T849] Kernel Offset: disabled