Warning: Permanently added '10.128.0.194' (ED25519) to the list of known hosts.
2026/01/18 19:37:03 parsed 1 programs
[ 59.548350][ T29] audit: type=1400 audit(1768765023.332:62): avc: denied { node_bind } for pid=2968 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1
[ 59.569253][ T29] audit: type=1400 audit(1768765023.332:63): avc: denied { module_request } for pid=2968 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1
[ 62.459173][ T29] audit: type=1400 audit(1768765026.242:64): avc: denied { mounton } for pid=2978 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 62.483250][ T29] audit: type=1400 audit(1768765026.262:65): avc: denied { mount } for pid=2978 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 62.492512][ T2978] cgroup: Unknown subsys name 'net'
[ 62.512576][ T29] audit: type=1400 audit(1768765026.292:66): avc: denied { unmount } for pid=2978 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 62.679302][ T2978] cgroup: Unknown subsys name 'cpuset'
[ 62.687923][ T2978] cgroup: Unknown subsys name 'rlimit'
[ 62.857337][ T29] audit: type=1400 audit(1768765026.642:67): avc: denied { setattr } for pid=2978 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 62.880770][ T29] audit: type=1400 audit(1768765026.642:68): avc: denied { create } for pid=2978 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 62.901378][ T29] audit: type=1400 audit(1768765026.642:69): avc: denied { write } for pid=2978 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 62.921880][ T29] audit: type=1400 audit(1768765026.642:70): avc: denied { read } for pid=2978 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 62.950235][ T29] audit: type=1400 audit(1768765026.732:71): avc: denied { sys_module } for pid=2978 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1
Setting up swapspace version 1, size = 127995904 bytes
[ 63.077474][ T2982] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped).
[ 63.141958][ T2978] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 64.806180][ T29] kauditd_printk_skb: 8 callbacks suppressed
[ 64.806204][ T29] audit: type=1400 audit(1768765028.572:80): avc: denied { execmem } for pid=2983 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 64.886788][ T29] audit: type=1400 audit(1768765028.622:81): avc: denied { read } for pid=2983 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 64.908091][ T29] audit: type=1400 audit(1768765028.622:82): avc: denied { open } for pid=2983 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 64.932161][ T29] audit: type=1400 audit(1768765028.622:83): avc: denied { mounton } for pid=2983 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1
[ 65.078029][ T29] audit: type=1400 audit(1768765028.742:84): avc: denied { create } for pid=2987 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1
[ 65.097918][ T29] audit: type=1400 audit(1768765028.742:85): avc: denied { sys_admin } for pid=2987 comm="syz-executor" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1
[ 65.119099][ T29] audit: type=1400 audit(1768765028.772:86): avc: denied { mounton } for pid=2983 comm="syz-executor" path="/dev/binderfs" dev="devtmpfs" ino=531 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1
[ 65.141885][ T29] audit: type=1400 audit(1768765028.802:87): avc: denied { mounton } for pid=2990 comm="syz-executor" path="/root/syzkaller.3r57vB/syz-tmp" dev="sda1" ino=2042 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1
[ 65.166318][ T29] audit: type=1400 audit(1768765028.802:88): avc: denied { mount } for pid=2990 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1
[ 65.188343][ T29] audit: type=1400 audit(1768765028.802:89): avc: denied { mounton } for pid=2990 comm="syz-executor" path="/root/syzkaller.3r57vB/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1
[ 65.367837][ T2990] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
2026/01/18 19:37:24 executed programs: 0
[ 81.224153][ T3025] syz-executor (3025) used greatest stack depth: 23304 bytes left
2026/01/18 19:38:14 executed programs: 10
[ 130.440419][ T29] kauditd_printk_skb: 11 callbacks suppressed
[ 130.440466][ T29] audit: type=1400 audit(1768765094.222:101): avc: denied { read write } for pid=5726 comm="syz.6.17" name="raw-gadget" dev="devtmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 130.470606][ T29] audit: type=1400 audit(1768765094.222:102): avc: denied { open } for pid=5726 comm="syz.6.17" path="/dev/raw-gadget" dev="devtmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 130.565159][ T29] audit: type=1400 audit(1768765094.272:103): avc: denied { ioctl } for pid=5726 comm="syz.6.17" path="/dev/raw-gadget" dev="devtmpfs" ino=236 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 130.757015][ T23] usb 7-1: new high-speed USB device number 2 using dummy_hcd
[ 130.936771][ T23] usb 7-1: Using ep0 maxpacket: 32
[ 130.950954][ T23] usb 7-1: config 0 has an invalid interface number: 89 but max is 0
[ 130.959677][ T23] usb 7-1: config 0 has no interface number 0
[ 130.989642][ T23] usb 7-1: config 0 interface 89 has no altsetting 0
[ 131.018726][ T23] usb 7-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e
[ 131.028328][ T23] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 131.036366][ T23] usb 7-1: Product: syz
[ 131.041444][ T23] usb 7-1: Manufacturer: syz
[ 131.046087][ T23] usb 7-1: SerialNumber: syz
[ 131.100119][ T23] usb 7-1: config 0 descriptor??
[ 131.119293][ T23] em28xx 7-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89)
[ 131.129508][ T23] em28xx 7-1:0.89: Video interface 89 found: bulk
[ 131.377245][ T23] em28xx 7-1:0.89: unknown em28xx chip ID (0)
[ 131.461049][ T23] em28xx 7-1:0.89: reading from i2c device at 0xa0 failed (error=-5)
[ 131.469481][ T23] em28xx 7-1:0.89: board has no eeprom
[ 131.558282][ T23] em28xx 7-1:0.89: Identified as Terratec Grabby (card=67)
[ 131.565618][ T23] em28xx 7-1:0.89: analog set to bulk mode.
[ 131.572262][ T5766] em28xx 7-1:0.89: Registering V4L2 extension
[ 131.590569][ T23] usb 7-1: USB disconnect, device number 2
[ 131.607356][ T23] em28xx 7-1:0.89: Disconnecting em28xx
[ 131.616777][ T38] usb 2-1: new high-speed USB device number 2 using dummy_hcd
[ 131.665380][ T5766] em28xx 7-1:0.89: Config register raw data: 0xffffffed
[ 131.673538][ T5766] em28xx 7-1:0.89: AC97 chip type couldn't be determined
[ 131.680716][ T5766] em28xx 7-1:0.89: No AC97 audio processor
[ 131.698666][ T5766] usb 7-1: Decoder not found
[ 131.703321][ T5766] em28xx 7-1:0.89: failed to create media graph
[ 131.710756][ T2546] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 131.721368][ T5766] em28xx 7-1:0.89: V4L2 device video0 deregistered
[ 131.731526][ T5766] em28xx 7-1:0.89: Registering snapshot button...
[ 131.748600][ T5766] input: em28xx snapshot button as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.89/input/input5
[ 131.761873][ T5766] em28xx 7-1:0.89: Remote control support is not available for this card.
[ 131.770802][ T5770] usb 8-1: new high-speed USB device number 2 using dummy_hcd
[ 131.779275][ T23] em28xx 7-1:0.89: Closing input extension
[ 131.785578][ T23] em28xx 7-1:0.89: Deregistering snapshot button
[ 131.800914][ T23] em28xx 7-1:0.89: Freeing device
[ 131.806781][ T38] usb 2-1: Using ep0 maxpacket: 32
[ 131.813734][ T38] usb 2-1: config 0 has an invalid interface number: 89 but max is 0
[ 131.821908][ T38] usb 2-1: config 0 has no interface number 0
[ 131.829605][ T38] usb 2-1: config 0 interface 89 has no altsetting 0
[ 131.842877][ T38] usb 2-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e
[ 131.852017][ T38] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 131.860178][ T38] usb 2-1: Product: syz
[ 131.864392][ T38] usb 2-1: Manufacturer: syz
[ 131.866962][ T9] usb 4-1: new high-speed USB device number 2 using dummy_hcd
[ 131.869063][ T38] usb 2-1: SerialNumber: syz
[ 131.903219][ T38] usb 2-1: config 0 descriptor??
[ 131.928858][ T2546] usb 5-1: Using ep0 maxpacket: 32
[ 131.941652][ T38] em28xx 2-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89)
[ 131.951290][ T38] em28xx 2-1:0.89: Video interface 89 found: bulk
[ 131.959416][ T2546] usb 5-1: config 0 has an invalid interface number: 89 but max is 0
[ 131.967671][ T2546] usb 5-1: config 0 has no interface number 0
[ 131.977647][ T2546] usb 5-1: config 0 interface 89 has no altsetting 0
[ 131.987064][ T5770] usb 8-1: Using ep0 maxpacket: 32
[ 131.994415][ T5770] usb 8-1: config 0 has an invalid interface number: 89 but max is 0
[ 132.002710][ T5770] usb 8-1: config 0 has no interface number 0
[ 132.011471][ T5770] usb 8-1: config 0 interface 89 has no altsetting 0
[ 132.021177][ T5770] usb 8-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e
[ 132.030389][ T5770] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 132.037677][ T9] usb 4-1: Using ep0 maxpacket: 32
[ 132.038560][ T5770] usb 8-1: Product: syz
[ 132.047891][ T5770] usb 8-1: Manufacturer: syz
[ 132.052559][ T5770] usb 8-1: SerialNumber: syz
[ 132.057926][ T2546] usb 5-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e
[ 132.059082][ T9] usb 4-1: config 0 has an invalid interface number: 89 but max is 0
[ 132.067058][ T2546] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 132.075203][ T9] usb 4-1: config 0 has no interface number 0
[ 132.083214][ T2546] usb 5-1: Product: syz
[ 132.083238][ T2546] usb 5-1: Manufacturer: syz
[ 132.098873][ T2546] usb 5-1: SerialNumber: syz
[ 132.109356][ T5770] usb 8-1: config 0 descriptor??
[ 132.123426][ T9] usb 4-1: config 0 interface 89 has no altsetting 0
[ 132.125361][ T5770] em28xx 8-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89)
[ 132.134946][ T9] usb 4-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e
[ 132.139813][ T5770] em28xx 8-1:0.89: Video interface 89 found: bulk
[ 132.155408][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 132.163906][ T9] usb 4-1: Product: syz
[ 132.169063][ T9] usb 4-1: Manufacturer: syz
[ 132.173718][ T9] usb 4-1: SerialNumber: syz
[ 132.174219][ T2546] usb 5-1: config 0 descriptor??
[ 132.193807][ T2546] em28xx 5-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89)
[ 132.204119][ T2546] em28xx 5-1:0.89: Video interface 89 found: bulk
[ 132.225318][ T9] usb 4-1: config 0 descriptor??
[ 132.236001][ T9] em28xx 4-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89)
[ 132.246223][ T9] em28xx 4-1:0.89: Video interface 89 found: bulk
[ 132.247910][ T23] usb 7-1: new high-speed USB device number 3 using dummy_hcd
[ 132.261517][ T38] em28xx 2-1:0.89: unknown em28xx chip ID (0)
[ 132.329471][ T38] em28xx 2-1:0.89: reading from i2c device at 0xa0 failed (error=-5)
[ 132.338286][ T38] em28xx 2-1:0.89: board has no eeprom
[ 132.387445][ T5770] em28xx 8-1:0.89: unknown em28xx chip ID (0)
[ 132.398577][ T38] em28xx 2-1:0.89: Identified as Terratec Grabby (card=67)
[ 132.405888][ T38] em28xx 2-1:0.89: analog set to bulk mode.
[ 132.411906][ T5766] em28xx 2-1:0.89: Registering V4L2 extension
[ 132.418251][ T23] usb 7-1: Using ep0 maxpacket: 32
[ 132.425213][ T23] usb 7-1: config 0 has an invalid interface number: 89 but max is 0
[ 132.433513][ T23] usb 7-1: config 0 has no interface number 0
[ 132.445174][ T38] usb 2-1: USB disconnect, device number 2
[ 132.454699][ T2546] em28xx 5-1:0.89: unknown em28xx chip ID (0)
[ 132.462785][ T5770] em28xx 8-1:0.89: reading from i2c device at 0xa0 failed (error=-5)
[ 132.471024][ T5770] em28xx 8-1:0.89: board has no eeprom
[ 132.476949][ T23] usb 7-1: config 0 interface 89 has no altsetting 0
[ 132.485479][ T38] em28xx 2-1:0.89: Disconnecting em28xx
[ 132.495158][ T23] usb 7-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e
[ 132.503065][ T9] em28xx 4-1:0.89: unknown em28xx chip ID (0)
[ 132.504428][ T23] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 132.518410][ T23] usb 7-1: Product: syz
[ 132.522616][ T23] usb 7-1: Manufacturer: syz
[ 132.527321][ T23] usb 7-1: SerialNumber: syz
[ 132.546916][ T5770] em28xx 8-1:0.89: Identified as Terratec Grabby (card=67)
[ 132.554283][ T5770] em28xx 8-1:0.89: analog set to bulk mode.
[ 132.562554][ T2546] em28xx 5-1:0.89: reading from i2c device at 0xa0 failed (error=-5)
[ 132.570725][ T2546] em28xx 5-1:0.89: board has no eeprom
[ 132.576872][ T5766] em28xx 2-1:0.89: Config register raw data: 0xffffffed
[ 132.584105][ T9] em28xx 4-1:0.89: reading from i2c device at 0xa0 failed (error=-5)
[ 132.584124][ T5766] em28xx 2-1:0.89: AC97 chip type couldn't be determined
[ 132.596525][ T9] em28xx 4-1:0.89: board has no eeprom
[ 132.600157][ T5766] em28xx 2-1:0.89: No AC97 audio processor
[ 132.618097][ T23] usb 7-1: config 0 descriptor??
[ 132.636774][ T23] em28xx 7-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89)
[ 132.646348][ T23] em28xx 7-1:0.89: Video interface 89 found: bulk
[ 132.653662][ T5770] usb 8-1: USB disconnect, device number 2
[ 132.664917][ T5766] usb 2-1: Decoder not found
[ 132.669778][ T5766] em28xx 2-1:0.89: failed to create media graph
[ 132.676755][ T2546] em28xx 5-1:0.89: Identified as Terratec Grabby (card=67)
[ 132.684046][ T2546] em28xx 5-1:0.89: analog set to bulk mode.
[ 132.691596][ T5770] em28xx 8-1:0.89: Disconnecting em28xx
[ 132.697774][ T5766] em28xx 2-1:0.89: V4L2 device video0 deregistered
[ 132.706026][ T9] em28xx 4-1:0.89: Identified as Terratec Grabby (card=67)
[ 132.713502][ T5766] em28xx 2-1:0.89: Registering snapshot button...
[ 132.718148][ T5766] input: em28xx snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.89/input/input6
[ 132.723058][ T9] em28xx 4-1:0.89: analog set to bulk mode.
[ 132.758846][ T2546] usb 5-1: USB disconnect, device number 2
[ 132.778345][ T9] usb 4-1: USB disconnect, device number 2
[ 132.781364][ T5766] em28xx 2-1:0.89: Remote control support is not available for this card.
[ 132.793448][ T5774] em28xx 8-1:0.89: Registering V4L2 extension
[ 132.808630][ T2546] em28xx 5-1:0.89: Disconnecting em28xx
[ 132.814328][ T9] em28xx 4-1:0.89: Disconnecting em28xx
[ 132.888136][ T23] em28xx 7-1:0.89: unknown em28xx chip ID (0)
[ 132.903593][ T5774] em28xx 8-1:0.89: Config register raw data: 0xffffffed
[ 132.910939][ T5774] em28xx 8-1:0.89: AC97 chip type couldn't be determined
[ 132.918084][ T5774] em28xx 8-1:0.89: No AC97 audio processor
[ 132.934937][ T5774] usb 8-1: Decoder not found
[ 132.940085][ T5774] em28xx 8-1:0.89: failed to create media graph
[ 132.975364][ T23] em28xx 7-1:0.89: reading from i2c device at 0xa0 failed (error=-5)
[ 132.984322][ T23] em28xx 7-1:0.89: board has no eeprom
[ 133.000283][ T5774] em28xx 8-1:0.89: V4L2 device video0 deregistered
[ 133.012349][ T5774] em28xx 8-1:0.89: Registering snapshot button...
[ 133.021433][ T5774] input: em28xx snapshot button as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.89/input/input7
[ 133.034493][ T5774] em28xx 8-1:0.89: Remote control support is not available for this card.
[ 133.043678][ T5772] em28xx 5-1:0.89: Registering V4L2 extension
[ 133.066820][ T23] em28xx 7-1:0.89: Identified as Terratec Grabby (card=67)
[ 133.074148][ T23] em28xx 7-1:0.89: analog set to bulk mode.
[ 133.102064][ T5772] em28xx 5-1:0.89: Config register raw data: 0xffffffed
[ 133.109121][ T5772] em28xx 5-1:0.89: AC97 chip type couldn't be determined
[ 133.116165][ T5772] em28xx 5-1:0.89: No AC97 audio processor
[ 133.123562][ T23] usb 7-1: USB disconnect, device number 3
[ 133.131008][ T23] em28xx 7-1:0.89: Disconnecting em28xx
[ 133.141436][ T5772] usb 5-1: Decoder not found
[ 133.146094][ T5772] em28xx 5-1:0.89: failed to create media graph
[ 133.153164][ T5772] em28xx 5-1:0.89: V4L2 device video0 deregistered
[ 133.162285][ T5772] em28xx 5-1:0.89: Registering snapshot button...
[ 133.172059][ T5772] input: em28xx snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.89/input/input8
[ 133.187286][ T5772] em28xx 5-1:0.89: Remote control support is not available for this card.
[ 133.195876][ T1124] em28xx 4-1:0.89: Registering V4L2 extension
[ 133.230103][ T1124] em28xx 4-1:0.89: Config register raw data: 0xffffffed
[ 133.237148][ T1124] em28xx 4-1:0.89: AC97 chip type couldn't be determined
[ 133.244212][ T1124] em28xx 4-1:0.89: No AC97 audio processor
[ 133.253887][ T1124] usb 4-1: Decoder not found
[ 133.258598][ T1124] em28xx 4-1:0.89: failed to create media graph
[ 133.264975][ T1124] em28xx 4-1:0.89: V4L2 device video0 deregistered
[ 133.276191][ T1124] em28xx 4-1:0.89: Registering snapshot button...
[ 133.284066][ T1124] input: em28xx snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.89/input/input9
[ 133.295950][ T1124] em28xx 4-1:0.89: Remote control support is not available for this card.
[ 133.304611][ T38] em28xx 2-1:0.89: Closing input extension
[ 133.311371][ T38] em28xx 2-1:0.89: Deregistering snapshot button
[ 133.322152][ T5770] em28xx 8-1:0.89: Closing input extension
[ 133.328731][ T5770] em28xx 8-1:0.89: Deregistering snapshot button
[ 133.336472][ T38] em28xx 2-1:0.89: Freeing device
[ 133.380034][ T5774] em28xx 7-1:0.89: Registering V4L2 extension
[ 133.404841][ T5770] em28xx 8-1:0.89: Freeing device
[ 133.465132][ T5774] em28xx 7-1:0.89: Config register raw data: 0xffffffed
[ 133.472243][ T5774] em28xx 7-1:0.89: AC97 chip type couldn't be determined
[ 133.479386][ T5774] em28xx 7-1:0.89: No AC97 audio processor
[ 133.491697][ T5774] usb 7-1: Decoder not found
[ 133.496374][ T5774] em28xx 7-1:0.89: failed to create media graph
[ 133.504857][ T5774] em28xx 7-1:0.89: V4L2 device video0 deregistered
[ 133.512867][ T5774] em28xx 7-1:0.89: Registering snapshot button...
[ 133.513381][ T5794] ==================================================================
[ 133.523602][ T5774] input: em28xx snapshot button as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.89/input/input10
[ 133.527396][ T5794] BUG: KASAN: slab-use-after-free in v4l2_fh_init+0x27d/0x2c0
[ 133.527444][ T5794] Read of size 8 at addr ffff888119a84738 by task v4l_id/5794
[ 133.548896][ T5774] em28xx 7-1:0.89: Remote control support is not available for this card.
[ 133.552881][ T5794]
[ 133.552970][ T5794] CPU: 0 UID: 0 PID: 5794 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(voluntary)
[ 133.553099][ T5794] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 133.553169][ T5794] Call Trace:
[ 133.553198][ T5794]
[ 133.553230][ T5794] dump_stack_lvl+0x100/0x190
[ 133.553325][ T5794] print_report+0x156/0x4c9
[ 133.553428][ T5794] ? __virt_addr_valid+0x81/0x620
[ 133.553551][ T5794] ? __phys_addr+0xe8/0x180
[ 133.553662][ T5794] ? v4l2_fh_init+0x27d/0x2c0
[ 133.553766][ T5794] kasan_report+0xdf/0x1a0
[ 133.553880][ T5794] ? v4l2_fh_init+0x27d/0x2c0
[ 133.554005][ T5794] v4l2_fh_init+0x27d/0x2c0
[ 133.554105][ T5794] v4l2_fh_open+0x64/0xa0
[ 133.554220][ T5794] em28xx_v4l2_open+0x11e/0x570
[ 133.554359][ T5794] v4l2_open+0x1d2/0x490
[ 133.554490][ T5794] ? __pfx_v4l2_open+0x10/0x10
[ 133.554596][ T5794] chrdev_open+0x234/0x6a0
[ 133.554672][ T5794] ? __pfx_chrdev_open+0x10/0x10
[ 133.554756][ T5794] ? path_get+0x61/0x80
[ 133.554853][ T5794] do_dentry_open+0x71a/0x1400
[ 133.554978][ T5794] ? __pfx_chrdev_open+0x10/0x10
[ 133.555058][ T5794] ? inode_permission+0x374/0x630
[ 133.555163][ T5794] vfs_open+0x82/0x3f0
[ 133.555257][ T5794] ? may_open+0x1f3/0x410
[ 133.555351][ T5794] path_openat+0x21dc/0x3120
[ 133.555442][ T5794] ? __pfx_path_openat+0x10/0x10
[ 133.555533][ T5794] do_filp_open+0x1f7/0x420
[ 133.555607][ T5794] ? __pfx_do_filp_open+0x10/0x10
[ 133.555721][ T5794] ? _raw_spin_unlock+0x28/0x50
[ 133.555868][ T5794] ? alloc_fd+0x42a/0x730
[ 133.555958][ T5794] do_sys_openat2+0x12e/0x220
[ 133.556037][ T5794] ? __pfx_do_sys_openat2+0x10/0x10
[ 133.556128][ T5794] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0
[ 133.556251][ T5794] __x64_sys_openat+0x12d/0x210
[ 133.556391][ T5794] ? __pfx___x64_sys_openat+0x10/0x10
[ 133.556489][ T5794] ? do_user_addr_fault+0x3e3/0x11d0
[ 133.556606][ T5794] do_syscall_64+0xc9/0x570
[ 133.556685][ T5794] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 133.556787][ T5794] RIP: 0033:0x7f45c8bf2407
[ 133.556851][ T5794] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 133.556942][ T5794] RSP: 002b:00007ffe4d5a9150 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
[ 133.557016][ T5794] RAX: ffffffffffffffda RBX: 00007f45c8b04880 RCX: 00007f45c8bf2407
[ 133.557071][ T5794] RDX: 0000000000000000 RSI: 00007ffe4d5a9f25 RDI: ffffffffffffff9c
[ 133.557124][ T5794] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
[ 133.557188][ T5794] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
[ 133.557253][ T5794] R13: 00007ffe4d5a93a0 R14: 00007f45c9388000 R15: 00005641f3c494d8
[ 133.557341][ T5794]
[ 133.557365][ T5794]
[ 133.561606][ T2546] em28xx 5-1:0.89: Closing input extension
[ 133.563722][ T5794] Allocated by task 5774:
[ 133.587914][ T2546] em28xx 5-1:0.89: Deregistering snapshot button
[ 133.589438][ T5794] kasan_save_stack+0x30/0x50
[ 133.666958][ T38] usb 2-1: new high-speed USB device number 3 using dummy_hcd
[ 133.667921][ T5794] kasan_save_track+0x14/0x30
[ 133.747008][ T5770] usb 8-1: new high-speed USB device number 3 using dummy_hcd
[ 133.751899][ T5794] __kasan_kmalloc+0x8f/0xa0
[ 133.816945][ T38] usb 2-1: Using ep0 maxpacket: 32
[ 133.824308][ T5794] em28xx_v4l2_init.cold+0x94/0x3503
[ 133.831804][ T38] usb 2-1: config 0 has an invalid interface number: 89 but max is 0
[ 133.835501][ T5794] em28xx_init_extension+0x13a/0x200
[ 133.840031][ T38] usb 2-1: config 0 has no interface number 0
[ 133.846183][ T5794] request_module_async+0x61/0x80
[ 133.853130][ T38] usb 2-1: config 0 interface 89 has no altsetting 0
[ 133.858345][ T5794] process_one_work+0x9c2/0x1840
[ 133.867968][ T38] usb 2-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e
[ 133.870536][ T5794] worker_thread+0x5da/0xe40
[ 133.875168][ T38] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 133.880280][ T5794] kthread+0x3b3/0x730
[ 133.880317][ T5794] ret_from_fork+0x6c3/0xa20
[ 133.880346][ T5794] ret_from_fork_asm+0x1a/0x30
[ 133.880383][ T5794]
[ 133.880390][ T5794] Freed by task 5774:
[ 133.880404][ T5794] kasan_save_stack+0x30/0x50
[ 133.885709][ T38] usb 2-1: Product: syz
[ 133.893775][ T5794] kasan_save_track+0x14/0x30
[ 133.893813][ T5794] kasan_save_free_info+0x3b/0x70
[ 133.899177][ T38] usb 2-1: Manufacturer: syz
[ 133.905186][ T5794] __kasan_slab_free+0x43/0x70
[ 133.910305][ T38] usb 2-1: SerialNumber: syz
[ 133.916910][ T5794] kfree+0x1ad/0x630
[ 133.937067][ T38] usb 2-1: config 0 descriptor??
[ 133.943507][ T5794] kref_put.isra.0+0x56/0x90
[ 133.947817][ T5770] usb 8-1: Using ep0 maxpacket: 32
[ 133.952199][ T5794] em28xx_v4l2_init.cold+0x280/0x3503
[ 133.962295][ T5770] usb 8-1: config 0 has an invalid interface number: 89 but max is 0
[ 133.963314][ T5794] em28xx_init_extension+0x13a/0x200
[ 133.968193][ T5770] usb 8-1: config 0 has no interface number 0
[ 133.972202][ T5794] request_module_async+0x61/0x80
[ 133.989360][ T38] em28xx 2-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89)
[ 133.991354][ T5794] process_one_work+0x9c2/0x1840
[ 133.995972][ T38] em28xx 2-1:0.89: Video interface 89 found: bulk
[ 133.999864][ T5794] worker_thread+0x5da/0xe40
[ 133.999906][ T5794] kthread+0x3b3/0x730
[ 133.999942][ T5794] ret_from_fork+0x6c3/0xa20
[ 134.005783][ T5770] usb 8-1: config 0 interface 89 has no altsetting 0
[ 134.009496][ T5794] ret_from_fork_asm+0x1a/0x30
[ 134.009539][ T5794]
[ 134.021774][ T5770] usb 8-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e
[ 134.028111][ T5794] The buggy address belongs to the object at ffff888119a84000
[ 134.028111][ T5794] which belongs to the cache kmalloc-8k of size 8192
[ 134.028138][ T5794] The buggy address is located 1848 bytes inside of
[ 134.028138][ T5794] freed 8192-byte region [ffff888119a84000, ffff888119a86000)
[ 134.028170][ T5794]
[ 134.028179][ T5794] The buggy address belongs to the physical page:
[ 134.033540][ T5770] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 134.039557][ T5794] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x119a80
[ 134.039591][ T5794] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 134.044802][ T5770] usb 8-1: Product: syz
[ 134.054200][ T5794] flags: 0x200000000000040(head|node=0|zone=2)
[ 134.054232][ T5794] page_type: f5(slab)
[ 134.054258][ T5794] raw: 0200000000000040 ffff888100042280 dead000000000100 dead000000000122
[ 134.059431][ T5770] usb 8-1: Manufacturer: syz
[ 134.065632][ T5794] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000
[ 134.070348][ T5770] usb 8-1: SerialNumber: syz
[ 134.074312][ T5794] head: 0200000000000040 ffff888100042280 dead000000000100 dead000000000122
[ 134.074352][ T5794] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000
[ 134.101552][ T5770] usb 8-1: config 0 descriptor??
[ 134.101753][ T5794] head: 0200000000000003 ffffea000466a001 00000000ffffffff 00000000ffffffff
[ 134.134674][ T5770] em28xx 8-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89)
[ 134.138993][ T5794] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008
[ 134.139012][ T5794] page dumped because: kasan: bad access detected
[ 134.139038][ T5794] page_owner tracks the page as allocated
[ 134.139048][ T5794] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 2918, tgid 2918 (ssh-keygen), ts 25191400311, free_ts 25061365466
[ 134.147306][ T5770] em28xx 8-1:0.89: Video interface 89 found: bulk
[ 134.155961][ T5794] post_alloc_hook+0x1e1/0x250
[ 134.177634][ T29] audit: type=1400 audit(1768765097.952:104): avc: denied { read } for pid=2840 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1
[ 134.179128][ T5794] get_page_from_freelist+0xd57/0x3b20
[ 134.188187][ T29] audit: type=1400 audit(1768765097.952:105): avc: denied { search } for pid=2840 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 134.192486][ T5794] __alloc_frozen_pages_noprof+0x269/0x2230
[ 134.201399][ T29] audit: type=1400 audit(1768765097.952:106): avc: denied { search } for pid=2840 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 134.205697][ T5794] alloc_pages_mpol+0xe8/0x410
[ 134.214761][ T29] audit: type=1400 audit(1768765097.952:107): avc: denied { add_name } for pid=2840 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 134.223169][ T5794] new_slab+0x2c4/0x440
[ 134.223212][ T5794] ___slab_alloc+0xda3/0x1ca0
[ 134.223258][ T5794] __slab_alloc.isra.0+0x63/0x110
[ 134.230912][ T29] audit: type=1400 audit(1768765097.962:108): avc: denied { create } for pid=2840 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 134.236863][ T5794] __kmalloc_cache_noprof+0x4ee/0x7e0
[ 134.236911][ T5794] audit_log_d_path+0xed/0x210
[ 134.236947][ T5794] audit_log_lsm_data+0xff3/0x1fa0
[ 134.449061][ T5794] common_lsm_audit+0x229/0x2b0
[ 134.453947][ T5794] slow_avc_audit+0x186/0x210
[ 134.458663][ T5794] avc_has_perm+0x1a6/0x1e0
[ 134.463202][ T5794] inode_has_perm+0x166/0x1d0
[ 134.467921][ T5794] file_has_perm+0x2e2/0x350
[ 134.472547][ T5794] match_file+0xd7/0x150
[ 134.476824][ T5794] page last free pid 2913 tgid 2913 stack trace:
[ 134.483173][ T5794] __free_frozen_pages+0x7d1/0x1010
[ 134.488506][ T5794] __put_partials+0x127/0x160
[ 134.493238][ T5794] qlist_free_all+0x47/0xe0
[ 134.497771][ T5794] kasan_quarantine_reduce+0x1a0/0x1f0
[ 134.503260][ T5794] __kasan_slab_alloc+0x4e/0x70
[ 134.508153][ T5794] kmem_cache_alloc_noprof+0x266/0x760
[ 134.513666][ T5794] getname_flags.part.0+0x4c/0x540
[ 134.518821][ T5794] getname_flags+0x93/0xf0
[ 134.523373][ T5794] vfs_fstatat+0xe1/0xf0
[ 134.527657][ T5794] __do_sys_newfstatat+0x9d/0x120
[ 134.532715][ T5794] do_syscall_64+0xc9/0x570
[ 134.537258][ T5794] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 134.543373][ T5794]
[ 134.545732][ T5794] Memory state around the buggy address:
[ 134.551381][ T5794] ffff888119a84600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 134.559484][ T5794] ffff888119a84680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 134.567568][ T5794] >ffff888119a84700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 134.575661][ T5794] ^
[ 134.581660][ T5794] ffff888119a84780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 134.589746][ T5794] ffff888119a84800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 134.597836][ T5794] ==================================================================
[ 134.606282][ T5794] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 134.613534][ T5794] CPU: 0 UID: 0 PID: 5794 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(voluntary)
[ 134.622947][ T5794] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 134.633141][ T5794] Call Trace:
[ 134.636460][ T5794]
[ 134.639422][ T5794] dump_stack_lvl+0x100/0x190
[ 134.644140][ T5794] vpanic+0x20d/0x630
[ 134.648157][ T5794] panic+0xd1/0xd1
[ 134.651919][ T5794] ? __pfx_panic+0x10/0x10
[ 134.656383][ T5794] ? check_panic_on_warn+0x1f/0x90
[ 134.661545][ T5794] check_panic_on_warn.cold+0x19/0x34
[ 134.666965][ T5794] end_report.part.0+0x3a/0x90
[ 134.671781][ T5794] kasan_report.cold+0xe/0x18
[ 134.676510][ T5794] ? v4l2_fh_init+0x27d/0x2c0
[ 134.681237][ T5794] v4l2_fh_init+0x27d/0x2c0
[ 134.685873][ T5794] v4l2_fh_open+0x64/0xa0
[ 134.690241][ T5794] em28xx_v4l2_open+0x11e/0x570
[ 134.695142][ T5794] v4l2_open+0x1d2/0x490
[ 134.699434][ T5794] ? __pfx_v4l2_open+0x10/0x10
[ 134.704245][ T5794] chrdev_open+0x234/0x6a0
[ 134.708695][ T5794] ? __pfx_chrdev_open+0x10/0x10
[ 134.713663][ T5794] ? path_get+0x61/0x80
[ 134.717871][ T5794] do_dentry_open+0x71a/0x1400
[ 134.722719][ T5794] ? __pfx_chrdev_open+0x10/0x10
[ 134.727691][ T5794] ? inode_permission+0x374/0x630
[ 134.732769][ T5794] vfs_open+0x82/0x3f0
[ 134.736872][ T5794] ? may_open+0x1f3/0x410
[ 134.741328][ T5794] path_openat+0x21dc/0x3120
[ 134.745951][ T5794] ? __pfx_path_openat+0x10/0x10
[ 134.750929][ T5794] do_filp_open+0x1f7/0x420
[ 134.755461][ T5794] ? __pfx_do_filp_open+0x10/0x10
[ 134.760609][ T5794] ? _raw_spin_unlock+0x28/0x50
[ 134.765499][ T5794] ? alloc_fd+0x42a/0x730
[ 134.769866][ T5794] do_sys_openat2+0x12e/0x220
[ 134.774580][ T5794] ? __pfx_do_sys_openat2+0x10/0x10
[ 134.779813][ T5794] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0
[ 134.786271][ T5794] __x64_sys_openat+0x12d/0x210
[ 134.791155][ T5794] ? __pfx___x64_sys_openat+0x10/0x10
[ 134.796576][ T5794] ? do_user_addr_fault+0x3e3/0x11d0
[ 134.801906][ T5794] do_syscall_64+0xc9/0x570
[ 134.806444][ T5794] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 134.812370][ T5794] RIP: 0033:0x7f45c8bf2407
[ 134.816814][ T5794] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 134.836543][ T5794] RSP: 002b:00007ffe4d5a9150 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
[ 134.844998][ T5794] RAX: ffffffffffffffda RBX: 00007f45c8b04880 RCX: 00007f45c8bf2407
[ 134.853276][ T5794] RDX: 0000000000000000 RSI: 00007ffe4d5a9f25 RDI: ffffffffffffff9c
[ 134.861366][ T5794] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
[ 134.869360][ T5794] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
[ 134.877449][ T5794] R13: 00007ffe4d5a93a0 R14: 00007f45c9388000 R15: 00005641f3c494d8
[ 134.885457][ T5794]
[ 134.889066][ T5794] Kernel Offset: disabled
[ 134.893407][ T5794] Rebooting in 86400 seconds..