Warning: Permanently added '10.128.1.6' (ED25519) to the list of known hosts.
2026/06/07 17:47:56 parsed 1 programs
[ 41.817331][ T29] kauditd_printk_skb: 1 callbacks suppressed
[ 41.817350][ T29] audit: type=1400 audit(1780854476.045:77): avc: denied { node_bind } for pid=2975 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1
[ 41.844612][ T29] audit: type=1400 audit(1780854476.045:78): avc: denied { module_request } for pid=2975 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1
[ 43.736673][ T29] audit: type=1400 audit(1780854477.965:79): avc: denied { mounton } for pid=2986 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 43.760514][ T29] audit: type=1400 audit(1780854477.985:80): avc: denied { mount } for pid=2986 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 43.764170][ T2986] cgroup: Unknown subsys name 'net'
[ 43.789954][ T29] audit: type=1400 audit(1780854478.015:81): avc: denied { unmount } for pid=2986 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 43.905964][ T2986] cgroup: Unknown subsys name 'cpuset'
[ 43.914175][ T2986] cgroup: Unknown subsys name 'rlimit'
[ 44.056734][ T29] audit: type=1400 audit(1780854478.285:82): avc: denied { setattr } for pid=2986 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 44.080145][ T29] audit: type=1400 audit(1780854478.285:83): avc: denied { create } for pid=2986 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 44.101054][ T29] audit: type=1400 audit(1780854478.285:84): avc: denied { write } for pid=2986 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 44.121786][ T29] audit: type=1400 audit(1780854478.285:85): avc: denied { read } for pid=2986 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 44.142451][ T29] audit: type=1400 audit(1780854478.315:86): avc: denied { sys_module } for pid=2986 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1
[ 44.201083][ T2991] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped).
Setting up swapspace version 1, size = 127995904 bytes
[ 44.291072][ T2986] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 46.092133][ T2998] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 46.932220][ T29] kauditd_printk_skb: 30 callbacks suppressed
[ 46.932240][ T29] audit: type=1400 audit(1780854481.155:117): avc: denied { create } for pid=3037 comm="syz-executor" name="tun" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=chr_file permissive=1
[ 46.996603][ T29] audit: type=1400 audit(1780854481.185:118): avc: denied { setattr } for pid=3037 comm="syz-executor" name="tun" dev="devtmpfs" ino=534 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=chr_file permissive=1
[ 47.078479][ T29] audit: type=1400 audit(1780854481.185:119): avc: denied { read write } for pid=3037 comm="syz-executor" name="tun" dev="devtmpfs" ino=534 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=chr_file permissive=1
[ 47.165174][ T29] audit: type=1400 audit(1780854481.195:120): avc: denied { open } for pid=3037 comm="syz-executor" path="/dev/net/tun" dev="devtmpfs" ino=534 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=chr_file permissive=1
[ 47.338132][ T29] audit: type=1401 audit(1780854481.565:121): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768"
2026/06/07 17:48:12 executed programs: 0
[ 58.229403][ T3052] syz-executor (3052) used greatest stack depth: 22920 bytes left
2026/06/07 17:48:56 executed programs: 10
[ 102.614496][ T29] audit: type=1400 audit(1780854536.835:122): avc: denied { read write } for pid=5745 comm="syz.0.17" name="raw-gadget" dev="devtmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 102.677918][ T29] audit: type=1400 audit(1780854536.835:123): avc: denied { open } for pid=5745 comm="syz.0.17" path="/dev/raw-gadget" dev="devtmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 102.718173][ T29] audit: type=1400 audit(1780854536.835:124): avc: denied { ioctl } for pid=5745 comm="syz.0.17" path="/dev/raw-gadget" dev="devtmpfs" ino=236 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 102.874179][ T3008] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[ 103.047497][ T3008] usb 1-1: Using ep0 maxpacket: 32
[ 103.057213][ T3008] usb 1-1: config 0 has an invalid interface number: 132 but max is 0
[ 103.068600][ T3008] usb 1-1: config 0 has no interface number 0
[ 103.086998][ T3008] usb 1-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0
[ 103.117133][ T3008] usb 1-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5
[ 103.133739][ T3008] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 103.144732][ T779] usb 8-1: new high-speed USB device number 2 using dummy_hcd
[ 103.151225][ T3008] usb 1-1: Product: syz
[ 103.170411][ T3008] usb 1-1: Manufacturer: syz
[ 103.183559][ T3008] usb 1-1: SerialNumber: syz
[ 103.203646][ T3008] usb 1-1: config 0 descriptor??
[ 103.224725][ T3008] em28xx 1-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132)
[ 103.243758][ T3008] em28xx 1-1:0.132: Video interface 132 found:
[ 103.334803][ T779] usb 8-1: Using ep0 maxpacket: 32
[ 103.346705][ T779] usb 8-1: config 0 has an invalid interface number: 132 but max is 0
[ 103.364826][ T779] usb 8-1: config 0 has no interface number 0
[ 103.378561][ T779] usb 8-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0
[ 103.383960][ T11] usb 7-1: new high-speed USB device number 2 using dummy_hcd
[ 103.407525][ T779] usb 8-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5
[ 103.417038][ T779] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 103.434490][ T779] usb 8-1: Product: syz
[ 103.443745][ T779] usb 8-1: Manufacturer: syz
[ 103.448418][ T779] usb 8-1: SerialNumber: syz
[ 103.458240][ T779] usb 8-1: config 0 descriptor??
[ 103.475506][ T3008] em28xx 1-1:0.132: unknown em28xx chip ID (0)
[ 103.475890][ T779] em28xx 8-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132)
[ 103.492430][ T779] em28xx 8-1:0.132: Video interface 132 found:
[ 103.553231][ T3008] em28xx 1-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5)
[ 103.565274][ T3008] em28xx 1-1:0.132: board has no eeprom
[ 103.583439][ T11] usb 7-1: Using ep0 maxpacket: 32
[ 103.590041][ T11] usb 7-1: config 0 has an invalid interface number: 132 but max is 0
[ 103.598310][ T11] usb 7-1: config 0 has no interface number 0
[ 103.604471][ T11] usb 7-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0
[ 103.616601][ T11] usb 7-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5
[ 103.625744][ T3008] em28xx 1-1:0.132: Identified as Leadtek Winfast USB II (card=7)
[ 103.633608][ T11] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 103.641640][ T3008] em28xx 1-1:0.132: analog set to bulk mode.
[ 103.647728][ T11] usb 7-1: Product: syz
[ 103.651914][ T11] usb 7-1: Manufacturer: syz
[ 103.653443][ T23] usb 6-1: new high-speed USB device number 2 using dummy_hcd
[ 103.656569][ T11] usb 7-1: SerialNumber: syz
[ 103.670749][ T5770] em28xx 1-1:0.132: Registering V4L2 extension
[ 103.683663][ T3008] usb 1-1: USB disconnect, device number 2
[ 103.692882][ T3008] em28xx 1-1:0.132: Disconnecting em28xx
[ 103.702517][ T11] usb 7-1: config 0 descriptor??
[ 103.718956][ T11] em28xx 7-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132)
[ 103.728833][ T11] em28xx 7-1:0.132: Video interface 132 found:
[ 103.737291][ T779] em28xx 8-1:0.132: unknown em28xx chip ID (0)
[ 103.796069][ T5770] em28xx 1-1:0.132: Config register raw data: 0xffffffed
[ 103.803243][ T5770] em28xx 1-1:0.132: AC97 chip type couldn't be determined
[ 103.810413][ T5770] em28xx 1-1:0.132: No AC97 audio processor
[ 103.818248][ T779] em28xx 8-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5)
[ 103.820781][ T5770] usb 1-1: Decoder not found
[ 103.827430][ T5779] usb 4-1: new high-speed USB device number 2 using dummy_hcd
[ 103.831690][ T5770] em28xx 1-1:0.132: failed to create media graph
[ 103.839916][ T23] usb 6-1: Using ep0 maxpacket: 32
[ 103.850294][ T5770] em28xx 1-1:0.132: V4L2 device video0 deregistered
[ 103.851272][ T779] em28xx 8-1:0.132: board has no eeprom
[ 103.863484][ T5770] em28xx 1-1:0.132: Remote control support is not available for this card.
[ 103.866361][ T23] usb 6-1: config 0 has an invalid interface number: 132 but max is 0
[ 103.872851][ T3008] em28xx 1-1:0.132: Closing input extension
[ 103.881171][ T23] usb 6-1: config 0 has no interface number 0
[ 103.893171][ T23] usb 6-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0
[ 103.897157][ T3008] em28xx 1-1:0.132: Freeing device
[ 103.905766][ T23] usb 6-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5
[ 103.930403][ T779] em28xx 8-1:0.132: Identified as Leadtek Winfast USB II (card=7)
[ 103.943536][ T23] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 103.951771][ T779] em28xx 8-1:0.132: analog set to bulk mode.
[ 103.961307][ T23] usb 6-1: Product: syz
[ 103.966739][ T5784] em28xx 8-1:0.132: Registering V4L2 extension
[ 103.976006][ T11] em28xx 7-1:0.132: unknown em28xx chip ID (0)
[ 103.976488][ T23] usb 6-1: Manufacturer: syz
[ 103.990649][ T23] usb 6-1: SerialNumber: syz
[ 104.005690][ T779] usb 8-1: USB disconnect, device number 2
[ 104.023890][ T5779] usb 4-1: Using ep0 maxpacket: 32
[ 104.035667][ T779] em28xx 8-1:0.132: Disconnecting em28xx
[ 104.042606][ T23] usb 6-1: config 0 descriptor??
[ 104.047928][ T5779] usb 4-1: config 0 has an invalid interface number: 132 but max is 0
[ 104.056529][ T5779] usb 4-1: config 0 has no interface number 0
[ 104.064204][ T5779] usb 4-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0
[ 104.064988][ T11] em28xx 7-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5)
[ 104.079142][ T23] em28xx 6-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132)
[ 104.095320][ T23] em28xx 6-1:0.132: Video interface 132 found:
[ 104.108419][ T5779] usb 4-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5
[ 104.125133][ T5779] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 104.125353][ T11] em28xx 7-1:0.132: board has no eeprom
[ 104.143560][ T5779] usb 4-1: Product: syz
[ 104.149057][ T5779] usb 4-1: Manufacturer: syz
[ 104.164882][ T5779] usb 4-1: SerialNumber: syz
[ 104.182263][ T5779] usb 4-1: config 0 descriptor??
[ 104.204228][ T11] em28xx 7-1:0.132: Identified as Leadtek Winfast USB II (card=7)
[ 104.214445][ T11] em28xx 7-1:0.132: analog set to bulk mode.
[ 104.214602][ T5784] em28xx 8-1:0.132: Config register raw data: 0xffffffed
[ 104.236778][ T5779] em28xx 4-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132)
[ 104.254119][ T3008] usb 1-1: new high-speed USB device number 3 using dummy_hcd
[ 104.261867][ T5779] em28xx 4-1:0.132: Video interface 132 found:
[ 104.263208][ T11] usb 7-1: USB disconnect, device number 2
[ 104.271195][ T5784] em28xx 8-1:0.132: AC97 chip type couldn't be determined
[ 104.284063][ T5784] em28xx 8-1:0.132: No AC97 audio processor
[ 104.293298][ T5784] usb 8-1: Decoder not found
[ 104.304384][ T5784] em28xx 8-1:0.132: failed to create media graph
[ 104.308203][ T11] em28xx 7-1:0.132: Disconnecting em28xx
[ 104.312579][ T5784] em28xx 8-1:0.132: V4L2 device video0 deregistered
[ 104.325228][ T5784] em28xx 8-1:0.132: Remote control support is not available for this card.
[ 104.334301][ T5770] em28xx 7-1:0.132: Registering V4L2 extension
[ 104.343914][ T23] em28xx 6-1:0.132: unknown em28xx chip ID (0)
[ 104.416441][ T23] em28xx 6-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5)
[ 104.428494][ T23] em28xx 6-1:0.132: board has no eeprom
[ 104.435692][ T3008] usb 1-1: Using ep0 maxpacket: 32
[ 104.441077][ T5770] em28xx 7-1:0.132: Config register raw data: 0xffffffed
[ 104.451637][ T3008] usb 1-1: config 0 has an invalid interface number: 132 but max is 0
[ 104.459939][ T5770] em28xx 7-1:0.132: AC97 chip type couldn't be determined
[ 104.465707][ T5779] em28xx 4-1:0.132: unknown em28xx chip ID (0)
[ 104.468537][ T3008] usb 1-1: config 0 has no interface number 0
[ 104.479594][ T5770] em28xx 7-1:0.132: No AC97 audio processor
[ 104.488968][ T3008] usb 1-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0
[ 104.499540][ T5770] usb 7-1: Decoder not found
[ 104.503432][ T23] em28xx 6-1:0.132: Identified as Leadtek Winfast USB II (card=7)
[ 104.504301][ T5770] em28xx 7-1:0.132: failed to create media graph
[ 104.512105][ T23] em28xx 6-1:0.132: analog set to bulk mode.
[ 104.518597][ T5770] em28xx 7-1:0.132: V4L2 device video0 deregistered
[ 104.523168][ T5770] em28xx 7-1:0.132: Remote control support is not available for this card.
[ 104.532856][ T23] usb 6-1: USB disconnect, device number 2
[ 104.541188][ T11] em28xx 7-1:0.132: Closing input extension
[ 104.553844][ T779] em28xx 8-1:0.132: Closing input extension
[ 104.556621][ T3008] usb 1-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5
[ 104.559981][ T5779] em28xx 4-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5)
[ 104.571748][ T3008] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 104.578827][ T5784] em28xx 6-1:0.132: Registering V4L2 extension
[ 104.591326][ T11] em28xx 7-1:0.132: Freeing device
[ 104.596580][ T779] em28xx 8-1:0.132: Freeing device
[ 104.605801][ T5779] em28xx 4-1:0.132: board has no eeprom
[ 104.606902][ T3008] usb 1-1: Product: syz
[ 104.611712][ T23] em28xx 6-1:0.132: Disconnecting em28xx
[ 104.616047][ T3008] usb 1-1: Manufacturer: syz
[ 104.627332][ T3008] usb 1-1: SerialNumber: syz
[ 104.675913][ T5779] em28xx 4-1:0.132: Identified as Leadtek Winfast USB II (card=7)
[ 104.684150][ T5779] em28xx 4-1:0.132: analog set to bulk mode.
[ 104.687365][ T3008] usb 1-1: config 0 descriptor??
[ 104.716293][ T5779] usb 4-1: USB disconnect, device number 2
[ 104.726903][ T3008] em28xx 1-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132)
[ 104.740935][ T5779] em28xx 4-1:0.132: Disconnecting em28xx
[ 104.748377][ T3008] em28xx 1-1:0.132: Video interface 132 found:
[ 104.838403][ T5784] em28xx 6-1:0.132: Config register raw data: 0xffffffed
[ 104.861264][ T5784] em28xx 6-1:0.132: AC97 chip type couldn't be determined
[ 104.869066][ T5784] em28xx 6-1:0.132: No AC97 audio processor
[ 104.880840][ T5784] usb 6-1: Decoder not found
[ 104.887010][ T5784] em28xx 6-1:0.132: failed to create media graph
[ 104.893659][ T5784] em28xx 6-1:0.132: V4L2 device video0 deregistered
[ 104.902421][ T5784] em28xx 6-1:0.132: Remote control support is not available for this card.
[ 104.902454][ T5808] ==================================================================
[ 104.912726][ T28] em28xx 4-1:0.132: Registering V4L2 extension
[ 104.919074][ T5808] BUG: KASAN: slab-use-after-free in v4l2_open+0x351/0x490
[ 104.919127][ T5808] Read of size 4 at addr ffff88812081c858 by task v4l_id/5808
[ 104.939898][ T5808]
[ 104.942257][ T5808] CPU: 0 UID: 0 PID: 5808 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(lazy)
[ 104.942289][ T5808] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[ 104.942311][ T5808] Call Trace:
[ 104.942319][ T5808]
[ 104.942337][ T5808] dump_stack_lvl+0x100/0x190
[ 104.942373][ T5808] print_report+0x13d/0x4b0
[ 104.942407][ T5808] ? __virt_addr_valid+0x239/0x430
[ 104.942438][ T5808] ? v4l2_open+0x351/0x490
[ 104.942466][ T5808] kasan_report+0xdf/0x1d0
[ 104.942501][ T5808] ? v4l2_open+0x351/0x490
[ 104.942533][ T5808] v4l2_open+0x351/0x490
[ 104.942562][ T5808] ? __pfx_v4l2_open+0x10/0x10
[ 104.942592][ T5808] chrdev_open+0x234/0x6a0
[ 104.942620][ T5808] ? __pfx_chrdev_open+0x10/0x10
[ 104.942645][ T5808] ? path_get+0x61/0x80
[ 104.942676][ T5808] do_dentry_open+0x68b/0x14b0
[ 104.942700][ T5808] ? __pfx_chrdev_open+0x10/0x10
[ 104.942729][ T5808] vfs_open+0x82/0x3f0
[ 104.942759][ T5808] path_openat+0x208c/0x31a0
[ 104.942790][ T5808] ? __pfx_path_openat+0x10/0x10
[ 104.942823][ T5808] do_file_open+0x20e/0x430
[ 104.942850][ T5808] ? __pfx_do_file_open+0x10/0x10
[ 104.942888][ T5808] ? alloc_fd+0x476/0x790
[ 104.942962][ T5808] ? do_getname+0x191/0x390
[ 104.942994][ T5808] do_sys_openat2+0x10d/0x1e0
[ 104.943025][ T5808] ? __pfx_do_sys_openat2+0x10/0x10
[ 104.943062][ T5808] __x64_sys_openat+0x12d/0x210
[ 104.943093][ T5808] ? __pfx___x64_sys_openat+0x10/0x10
[ 104.943128][ T5808] ? rcu_is_watching+0x12/0xc0
[ 104.943159][ T5808] do_syscall_64+0x10b/0x7f0
[ 104.943196][ T5808] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 104.943229][ T5808] RIP: 0033:0x7ff1fdb64407
[ 104.943249][ T5808] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 104.943277][ T5808] RSP: 002b:00007ffc13a5bf40 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
[ 104.943302][ T5808] RAX: ffffffffffffffda RBX: 00007ff1fda76880 RCX: 00007ff1fdb64407
[ 104.943319][ T5808] RDX: 0000000000000000 RSI: 00007ffc13a5cf24 RDI: ffffffffffffff9c
[ 104.943342][ T5808] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
[ 104.943354][ T5808] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
[ 104.943366][ T5808] R13: 00007ffc13a5c190 R14: 00007ff1fe2fa000 R15: 000055c8416684d8
[ 104.943388][ T5808]
[ 104.943395][ T5808]
[ 104.943772][ T779] usb 8-1: new high-speed USB device number 3 using dummy_hcd
[ 104.952323][ T5808] Allocated by task 5784:
[ 104.952355][ T5808] kasan_save_stack+0x30/0x50
[ 105.048673][ T28] em28xx 4-1:0.132: Config register raw data: 0xffffffed
[ 105.051174][ T5808] kasan_save_track+0x14/0x30
[ 105.055557][ T28] em28xx 4-1:0.132: AC97 chip type couldn't be determined
[ 105.059985][ T5808] __kasan_kmalloc+0x8f/0xa0
[ 105.060013][ T5808] em28xx_v4l2_init.cold+0x94/0x3a40
[ 105.065331][ T28] em28xx 4-1:0.132: No AC97 audio processor
[ 105.069846][ T5808] em28xx_init_extension+0x13a/0x200
[ 105.076799][ T28] usb 4-1: Decoder not found
[ 105.080046][ T5808] request_module_async+0x61/0x80
[ 105.085543][ T28] em28xx 4-1:0.132: failed to create media graph
[ 105.089390][ T5808] process_one_work+0xa0e/0x1980
[ 105.095890][ T28] em28xx 4-1:0.132: V4L2 device video1 deregistered
[ 105.099692][ T5808] worker_thread+0x5ef/0xe50
[ 105.099721][ T5808] kthread+0x370/0x450
[ 105.124020][ T28] em28xx 4-1:0.132: Remote control support is not available for this card.
[ 105.127704][ T5808] ret_from_fork+0x69a/0xc80
[ 105.135857][ T23] em28xx 6-1:0.132: Closing input extension
[ 105.143647][ T5808] ret_from_fork_asm+0x1a/0x30
[ 105.143685][ T5808]
[ 105.143691][ T5808] Freed by task 5784:
[ 105.143703][ T5808] kasan_save_stack+0x30/0x50
[ 105.153866][ T5779] em28xx 4-1:0.132: Closing input extension
[ 105.159622][ T5808] kasan_save_track+0x14/0x30
[ 105.159658][ T5808] kasan_save_free_info+0x3b/0x70
[ 105.159679][ T5808] __kasan_slab_free+0x43/0x70
[ 105.159706][ T5808] kfree+0x204/0x650
[ 105.179404][ T5779] em28xx 4-1:0.132: Freeing device
[ 105.180430][ T5808] kref_put.isra.0+0x53/0x75
[ 105.186830][ T23] em28xx 6-1:0.132: Freeing device
[ 105.189415][ T5808] em28xx_v4l2_init.cold+0x280/0x3a40
[ 105.189452][ T5808] em28xx_init_extension+0x13a/0x200
[ 105.189481][ T5808] request_module_async+0x61/0x80
[ 105.189509][ T5808] process_one_work+0xa0e/0x1980
[ 105.189534][ T5808] worker_thread+0x5ef/0xe50
[ 105.189558][ T5808] kthread+0x370/0x450
[ 105.189579][ T5808] ret_from_fork+0x69a/0xc80
[ 105.189612][ T5808] ret_from_fork_asm+0x1a/0x30
[ 105.189644][ T5808]
[ 105.189651][ T5808] The buggy address belongs to the object at ffff88812081c000
[ 105.189651][ T5808] which belongs to the cache kmalloc-8k of size 8192
[ 105.189671][ T5808] The buggy address is located 2136 bytes inside of
[ 105.189671][ T5808] freed 8192-byte region [ffff88812081c000, ffff88812081e000)
[ 105.189697][ T5808]
[ 105.189703][ T5808] The buggy address belongs to the physical page:
[ 105.189714][ T5808] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x120818
[ 105.189752][ T5808] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 105.189771][ T5808] flags: 0x200000000000040(head|node=0|zone=2)
[ 105.189796][ T5808] page_type: f5(slab)
[ 105.189819][ T5808] raw: 0200000000000040 ffff888100042280 dead000000000100 dead000000000122
[ 105.189850][ T5808] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
[ 105.203462][ T779] usb 8-1: Using ep0 maxpacket: 32
[ 105.208617][ T5808] head: 0200000000000040 ffff888100042280 dead000000000100 dead000000000122
[ 105.208640][ T5808] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000
[ 105.223617][ T779] usb 8-1: config 0 has an invalid interface number: 132 but max is 0
[ 105.224373][ T5808] head: 0200000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 105.242447][ T779] usb 8-1: config 0 has no interface number 0
[ 105.245530][ T5808] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008
[ 105.245545][ T5808] page dumped because: kasan: bad access detected
[ 105.245557][ T5808] page_owner tracks the page as allocated
[ 105.245565][ T5808] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 2881, tgid 2881 (iptables-restor), ts 17912138886, free_ts 0
[ 105.269190][ T779] usb 8-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0
[ 105.274284][ T5808] post_alloc_hook+0xfd/0x120
[ 105.274320][ T5808] get_page_from_freelist+0x20a5/0x3850
[ 105.274350][ T5808] __alloc_frozen_pages_noprof+0x273/0x28a0
[ 105.285276][ T779] usb 8-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5
[ 105.289565][ T5808] new_slab+0xa6/0x6b0
[ 105.289600][ T5808] refill_objects+0x277/0x420
[ 105.292023][ T779] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 105.295876][ T5808] __pcs_replace_empty_main+0x375/0x650
[ 105.295910][ T5808] __kmalloc_cache_noprof+0x52c/0x6b0
[ 105.318239][ T779] usb 8-1: Product: syz
[ 105.320862][ T5808] audit_log_d_path+0xed/0x210
[ 105.618551][ T5808] audit_log_lsm_data+0xff3/0x1fa0
[ 105.623678][ T5808] common_lsm_audit+0x229/0x2b0
[ 105.628532][ T5808] slow_avc_audit+0x186/0x210
[ 105.633205][ T5808] avc_has_perm+0x1a6/0x1e0
[ 105.637709][ T5808] inode_has_perm+0x166/0x1d0
[ 105.642389][ T5808] __file_has_perm+0x39c/0x460
[ 105.647155][ T5808] match_file+0xd9/0x150
[ 105.651392][ T5808] iterate_fd+0x11c/0x390
[ 105.655718][ T5808] page_owner free stack trace missing
[ 105.661077][ T5808]
[ 105.663390][ T5808] Memory state around the buggy address:
[ 105.669012][ T5808] ffff88812081c700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 105.677077][ T5808] ffff88812081c780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 105.685142][ T5808] >ffff88812081c800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 105.693197][ T5808] ^
[ 105.700122][ T5808] ffff88812081c880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 105.708175][ T5808] ffff88812081c900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 105.716236][ T5808] ==================================================================
[ 105.724669][ T779] usb 8-1: Manufacturer: syz
[ 105.725056][ T29] audit: type=1400 audit(1780854539.435:125): avc: denied { read } for pid=2836 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1
[ 105.729861][ T779] usb 8-1: SerialNumber: syz
[ 105.751303][ T29] audit: type=1400 audit(1780854539.435:126): avc: denied { search } for pid=2836 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 105.759029][ T779] usb 8-1: config 0 descriptor??
[ 105.777412][ T29] audit: type=1400 audit(1780854539.435:127): avc: denied { write search } for pid=2836 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 105.777470][ T29] audit: type=1400 audit(1780854539.485:128): avc: denied { add_name } for pid=2836 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 105.777539][ T29] audit: type=1400 audit(1780854539.485:129): avc: denied { create } for pid=2836 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 105.777590][ T29] audit: type=1400 audit(1780854539.485:130): avc: denied { append open } for pid=2836 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 105.777665][ T29] audit: type=1400 audit(1780854539.485:131): avc: denied { getattr } for pid=2836 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 105.778755][ T11] usb 7-1: new high-speed USB device number 3 using dummy_hcd
[ 105.809797][ T779] em28xx 8-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132)
[ 105.831555][ T5808] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 105.831577][ T5808] CPU: 0 UID: 0 PID: 5808 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(lazy)
[ 105.831608][ T5808] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
[ 105.831625][ T5808] Call Trace:
[ 105.831633][ T5808]
[ 105.831642][ T5808] dump_stack_lvl+0x100/0x190
[ 105.831676][ T5808] vpanic+0x552/0x970
[ 105.831703][ T5808] ? __pfx_vpanic+0x10/0x10
[ 105.831734][ T5808] ? v4l2_open+0x351/0x490
[ 105.831760][ T5808] panic+0xd1/0xe0
[ 105.831785][ T5808] ? __pfx_panic+0x10/0x10
[ 105.831813][ T5808] ? v4l2_open+0x351/0x490
[ 105.831840][ T5808] ? preempt_schedule_common+0x42/0xc0
[ 105.831870][ T5808] ? check_panic_on_warn+0x1f/0x90
[ 105.831897][ T5808] check_panic_on_warn.cold+0x19/0x34
[ 105.831927][ T5808] end_report.part.0+0x3a/0x90
[ 105.831960][ T5808] kasan_report.cold+0xe/0x18
[ 105.831992][ T5808] ? v4l2_open+0x351/0x490
[ 105.832024][ T5808] v4l2_open+0x351/0x490
[ 105.832053][ T5808] ? __pfx_v4l2_open+0x10/0x10
[ 105.832080][ T5808] chrdev_open+0x234/0x6a0
[ 105.832108][ T5808] ? __pfx_chrdev_open+0x10/0x10
[ 105.832133][ T5808] ? path_get+0x61/0x80
[ 105.832164][ T5808] do_dentry_open+0x68b/0x14b0
[ 105.832187][ T5808] ? __pfx_chrdev_open+0x10/0x10
[ 105.832217][ T5808] vfs_open+0x82/0x3f0
[ 105.832247][ T5808] path_openat+0x208c/0x31a0
[ 105.832284][ T5808] ? __pfx_path_openat+0x10/0x10
[ 105.832317][ T5808] do_file_open+0x20e/0x430
[ 105.832345][ T5808] ? __pfx_do_file_open+0x10/0x10
[ 105.832383][ T5808] ? alloc_fd+0x476/0x790
[ 105.832411][ T5808] ? do_getname+0x191/0x390
[ 105.832444][ T5808] do_sys_openat2+0x10d/0x1e0
[ 105.832473][ T5808] ? __pfx_do_sys_openat2+0x10/0x10
[ 105.832509][ T5808] __x64_sys_openat+0x12d/0x210
[ 105.832540][ T5808] ? __pfx___x64_sys_openat+0x10/0x10
[ 105.832574][ T5808] ? rcu_is_watching+0x12/0xc0
[ 105.832604][ T5808] do_syscall_64+0x10b/0x7f0
[ 105.832639][ T5808] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 105.832665][ T5808] RIP: 0033:0x7ff1fdb64407
[ 105.832684][ T5808] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 105.832707][ T5808] RSP: 002b:00007ffc13a5bf40 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
[ 105.832732][ T5808] RAX: ffffffffffffffda RBX: 00007ff1fda76880 RCX: 00007ff1fdb64407
[ 105.832749][ T5808] RDX: 0000000000000000 RSI: 00007ffc13a5cf24 RDI: ffffffffffffff9c
[ 105.832765][ T5808] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
[ 105.832780][ T5808] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
[ 105.832795][ T5808] R13: 00007ffc13a5c190 R14: 00007ff1fe2fa000 R15: 000055c8416684d8
[ 105.832820][ T5808]
[ 105.846497][ T5808] Kernel Offset: disabled