[ 53.671446][ C0] sched: DL replenish lagged too much [ 179.709913][ T31] audit: type=1400 audit(179.630:56): avc: denied { read write } for pid=3109 comm="sftp-server" name="null" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 179.713307][ T31] audit: type=1400 audit(179.630:57): avc: denied { open } for pid=3109 comm="sftp-server" path="/dev/null" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 Warning: Permanently added '[localhost]:63634' (ED25519) to the list of known hosts. [ 225.728416][ T31] audit: type=1400 audit(225.650:58): avc: denied { execute } for pid=3121 comm="sh" name="syz-execprog" dev="vda" ino=805 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 225.807099][ T31] audit: type=1400 audit(225.730:59): avc: denied { execute_no_trans } for pid=3121 comm="sh" path="/syz-execprog" dev="vda" ino=805 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 1970/01/01 00:03:53 ignoring optional flag "sandboxArg"="0" 1970/01/01 00:04:23 parsed 1 programs [ 263.854354][ T31] audit: type=1400 audit(263.780:60): avc: denied { node_bind } for pid=3121 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 266.798641][ T31] audit: type=1400 audit(266.720:61): avc: denied { mounton } for pid=3129 comm="syz-executor" path="/syzcgroup/unified" dev="vda" ino=808 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 266.802100][ T31] audit: type=1400 audit(266.730:62): avc: denied { mount } for pid=3129 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 266.817914][ T3129] cgroup: Unknown subsys name 'net' [ 266.827389][ T31] audit: type=1400 audit(266.750:63): avc: denied { unmount } for pid=3129 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 267.016497][ T3129] cgroup: Unknown subsys name 'cpuset' [ 267.025660][ T3129] cgroup: Unknown subsys name 'hugetlb' [ 267.027365][ T3129] cgroup: Unknown subsys name 'rlimit' [ 267.298849][ T31] audit: type=1400 audit(267.220:64): avc: denied { setattr } for pid=3129 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=692 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 267.304742][ T31] audit: type=1400 audit(267.230:65): avc: denied { create } for pid=3129 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 267.311466][ T31] audit: type=1400 audit(267.230:66): avc: denied { write } for pid=3129 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 267.314510][ T31] audit: type=1400 audit(267.240:67): avc: denied { module_request } for pid=3129 comm="syz-executor" kmod="net-pf-16-proto-16-family-nl802154" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 267.391727][ T31] audit: type=1400 audit(267.310:68): avc: denied { read } for pid=3129 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 267.396811][ T31] audit: type=1400 audit(267.320:69): avc: denied { mounton } for pid=3129 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 267.594849][ T3132] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 275.953149][ T3129] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 285.281624][ T31] kauditd_printk_skb: 6 callbacks suppressed [ 285.281984][ T31] audit: type=1400 audit(285.200:76): avc: denied { execmem } for pid=3133 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 285.527720][ T31] audit: type=1400 audit(285.450:77): avc: denied { read } for pid=3136 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 285.528216][ T31] audit: type=1400 audit(285.450:78): avc: denied { open } for pid=3136 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 285.539815][ T31] audit: type=1400 audit(285.460:79): avc: denied { mounton } for pid=3136 comm="syz-executor" path="/" dev="vda" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 285.652162][ T31] audit: type=1400 audit(285.580:80): avc: denied { mount } for pid=3136 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 285.657824][ T31] audit: type=1400 audit(285.580:81): avc: denied { mounton } for pid=3136 comm="syz-executor" path="/syzkaller.E47LA3/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 285.668233][ T31] audit: type=1400 audit(285.590:82): avc: denied { mount } for pid=3136 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 285.679613][ T31] audit: type=1400 audit(285.600:83): avc: denied { mounton } for pid=3136 comm="syz-executor" path="/syzkaller.E47LA3/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 285.685416][ T31] audit: type=1400 audit(285.610:84): avc: denied { mounton } for pid=3136 comm="syz-executor" path="/syzkaller.E47LA3/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=866 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 285.702925][ T31] audit: type=1400 audit(285.630:85): avc: denied { unmount } for pid=3136 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 285.799695][ T3136] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 292.773555][ T3264] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 292.777220][ T3264] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 293.582265][ T3264] hsr_slave_0: entered promiscuous mode [ 293.585241][ T3264] hsr_slave_1: entered promiscuous mode [ 293.937941][ T3264] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 293.951085][ T3264] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 293.958573][ T3264] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 293.965580][ T3264] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 294.592295][ T3264] 8021q: adding VLAN 0 to HW filter on device bond0 [ 296.832785][ T3264] veth0_vlan: entered promiscuous mode [ 296.846969][ T3264] veth1_vlan: entered promiscuous mode [ 296.898269][ T3264] veth0_macvtap: entered promiscuous mode [ 296.907541][ T3264] veth1_macvtap: entered promiscuous mode [ 296.968739][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 296.972885][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 296.978797][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 296.982077][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 297.275120][ T3160] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 297.608144][ T31] kauditd_printk_skb: 11 callbacks suppressed [ 297.608518][ T31] audit: type=1400 audit(297.530:97): avc: denied { create } for pid=3634 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 297.614735][ T3160] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 297.616785][ T31] audit: type=1400 audit(297.540:98): avc: denied { sys_admin } for pid=3634 comm="syz-executor" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 297.696936][ T3160] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 297.773905][ T31] audit: type=1400 audit(297.700:99): avc: denied { sys_chroot } for pid=3635 comm="syz-executor" capability=18 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 297.786615][ T3160] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 298.135523][ T3160] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 298.144575][ T3160] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 298.158483][ T3160] bond0 (unregistering): Released all slaves [ 298.235277][ T3160] hsr_slave_0: left promiscuous mode [ 298.238610][ T3160] hsr_slave_1: left promiscuous mode [ 298.259680][ T3160] veth1_macvtap: left promiscuous mode [ 298.263882][ T3160] veth0_macvtap: left promiscuous mode [ 298.264413][ T3160] veth1_vlan: left promiscuous mode [ 298.264950][ T3160] veth0_vlan: left promiscuous mode 1970/01/01 00:05:03 executed programs: 0 [ 304.932493][ T3776] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 304.938850][ T3776] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 305.729839][ T3776] hsr_slave_0: entered promiscuous mode [ 305.733813][ T3776] hsr_slave_1: entered promiscuous mode [ 306.064885][ T3776] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 306.075941][ T3776] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 306.085366][ T3776] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 306.094816][ T3776] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 306.718095][ T3776] 8021q: adding VLAN 0 to HW filter on device bond0 [ 308.948108][ T3776] veth0_vlan: entered promiscuous mode [ 308.966153][ T3776] veth1_vlan: entered promiscuous mode [ 309.025151][ T3776] veth0_macvtap: entered promiscuous mode [ 309.035408][ T3776] veth1_macvtap: entered promiscuous mode [ 309.125422][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 309.125857][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 309.126711][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 309.127170][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 1970/01/01 00:05:09 executed programs: 2 [ 309.916915][ T31] audit: type=1400 audit(309.840:100): avc: denied { read write } for pid=4128 comm="syz.1.17" name="file0" dev="fuse" ino=64 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 309.917266][ T31] audit: type=1400 audit(309.840:101): avc: denied { open } for pid=4128 comm="syz.1.17" path="/0/file0/file0" dev="fuse" ino=64 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 309.931124][ T4131] block device autoloading is deprecated and will be removed. [ 309.934407][ T31] audit: type=1400 audit(309.860:102): avc: denied { ioctl } for pid=4128 comm="syz.1.17" path="/0/file0/file0" dev="fuse" ino=64 ioctlcmd=0x935 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 309.952918][ T31] audit: type=1400 audit(309.880:103): avc: denied { unmount } for pid=3776 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 310.566268][ T3065] ------------[ cut here ]------------ [ 310.566858][ T3065] WARNING: CPU: 0 PID: 3065 at lib/refcount.c:28 refcount_warn_saturate+0x13c/0x174 [ 310.568111][ T3065] refcount_t: underflow; use-after-free. [ 310.568521][ T3065] Modules linked in: [ 310.569804][ T3065] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 310.572809][ T3065] CPU: 0 UID: 0 PID: 3065 Comm: kworker/0:3 Not tainted 6.16.0-syzkaller #0 PREEMPT [ 310.573462][ T3065] Hardware name: ARM-Versatile Express [ 310.573908][ T3065] Workqueue: md_misc mddev_delayed_delete [ 310.574626][ T3065] Call trace: [ 310.575086][ T3065] [<80201a24>] (dump_backtrace) from [<80201b20>] (show_stack+0x18/0x1c) [ 310.575659][ T3065] r7:00000000 r6:8281f77c r5:00000000 r4:82260f18 [ 310.576026][ T3065] [<80201b08>] (show_stack) from [<8021fbf4>] (dump_stack_lvl+0x54/0x7c) [ 310.576458][ T3065] [<8021fba0>] (dump_stack_lvl) from [<8021fc34>] (dump_stack+0x18/0x1c) [ 310.576814][ T3065] r5:00000000 r4:82a77d18 [ 310.577003][ T3065] [<8021fc1c>] (dump_stack) from [<80202624>] (vpanic+0x10c/0x360) [ 310.577368][ T3065] [<80202518>] (vpanic) from [<802028ac>] (trace_suspend_resume+0x0/0xd8) [ 310.577744][ T3065] r7:808bb0e8 [ 310.577885][ T3065] [<80202878>] (panic) from [<802548cc>] (get_taint+0x0/0x1c) [ 310.578183][ T3065] r3:8280c684 r2:00000001 r1:822479f0 r0:8224f3b8 [ 310.578404][ T3065] [<80254858>] (check_panic_on_warn) from [<80254a30>] (__warn+0x80/0x188) [ 310.578681][ T3065] [<802549b0>] (__warn) from [<80254d20>] (warn_slowpath_fmt+0x1e8/0x1f4) [ 310.578954][ T3065] r8:00000009 r7:822b98e4 r6:ec1cde54 r5:848eec00 r4:00000000 [ 310.579189][ T3065] [<80254b3c>] (warn_slowpath_fmt) from [<808bb0e8>] (refcount_warn_saturate+0x13c/0x174) [ 310.579553][ T3065] r10:83811e70 r9:8339f225 r8:848eec00 r7:dddced40 r6:8339f200 r5:84ccfa1c [ 310.579878][ T3065] r4:84ccf850 [ 310.580012][ T3065] [<808bafac>] (refcount_warn_saturate) from [<81a11768>] (kobject_put+0x158/0x1f4) [ 310.580690][ T3065] [<81a11610>] (kobject_put) from [<81169718>] (mddev_delayed_delete+0x14/0x18) [ 310.581182][ T3065] r7:dddced40 r6:8339f200 r5:84ccfa1c r4:84b39d00 [ 310.581414][ T3065] [<81169704>] (mddev_delayed_delete) from [<8027a32c>] (process_one_work+0x1b4/0x4f4) [ 310.581783][ T3065] [<8027a178>] (process_one_work) from [<8027af74>] (worker_thread+0x1fc/0x3d8) [ 310.582126][ T3065] r10:61c88647 r9:848eec00 r8:84b39d2c r7:82804d40 r6:dddced40 r5:dddced60 [ 310.582416][ T3065] r4:84b39d00 [ 310.582546][ T3065] [<8027ad78>] (worker_thread) from [<80281f5c>] (kthread+0x12c/0x280) [ 310.582868][ T3065] r10:00000000 r9:84b39d00 r8:8027ad78 r7:df83de60 r6:84ae1980 r5:848eec00 [ 310.583150][ T3065] r4:00000001 [ 310.583280][ T3065] [<80281e30>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20) [ 310.583661][ T3065] Exception stack(0xec1cdfb0 to 0xec1cdff8) [ 310.584035][ T3065] dfa0: 00000000 00000000 00000000 00000000 [ 310.584435][ T3065] dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 310.584783][ T3065] dfe0: 00000000 00000000 00000000 00000000 00000013 00000000 [ 310.585058][ T3065] r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:80281e30 [ 310.585347][ T3065] r4:84b57fc0 [ 310.587565][ T3065] Rebooting in 86400 seconds.. VM DIAGNOSIS: 20:47:31 Registers: info registers vcpu 0 CPU#0 R00=83ff7c40 R01=0000006e R02=eb7fb000 R03=00000000 R04=82abb123 R05=83ff7c40 R06=80a7928c R07=82abb144 R08=82826ee0 R09=00000000 R10=0000037b R11=ec1cdbb4 R12=00000002 R13=ec1cdba8 R14=82959084 R15=80a792e4 PSR=80000093 N--- A S svc32 s00=2e393631 s01=2e343532 d00=2e3435322e393631 s02=01634488 s03=016343f0 d01=016343f001634488 s04=e4000000 s05=e4000000 d02=e4000000e4000000 s06=00000000 s07=00000000 d03=0000000000000000 s08=00000000 s09=c0200400 d04=c020040000000000 s10=00040000 s11=80402000 d05=8040200000040000 s12=08040201 s13=80402010 d06=8040201008040201 s14=00000000 s15=00000000 d07=0000000000000000 s16=00000000 s17=00000000 d08=0000000000000000 s18=00000000 s19=00000000 d09=0000000000000000 s20=00000000 s21=00000000 d10=0000000000000000 s22=00000000 s23=00000000 d11=0000000000000000 s24=00000000 s25=00000000 d12=0000000000000000 s26=00000000 s27=00000000 d13=0000000000000000 s28=00000000 s29=00000000 d14=0000000000000000 s30=00000000 s31=00000000 d15=0000000000000000 s32=00000000 s33=00000000 d16=0000000000000000 s34=00000000 s35=00000000 d17=0000000000000000 s36=00000000 s37=00000000 d18=0000000000000000 s38=00000000 s39=00000000 d19=0000000000000000 s40=00000000 s41=00000000 d20=0000000000000000 s42=00000000 s43=00000000 d21=0000000000000000 s44=00000000 s45=00000000 d22=0000000000000000 s46=00000000 s47=00000000 d23=0000000000000000 s48=00000000 s49=00000000 d24=0000000000000000 s50=00000000 s51=00000000 d25=0000000000000000 s52=00000000 s53=00000000 d26=0000000000000000 s54=00000000 s55=00000000 d27=0000000000000000 s56=00000000 s57=00000000 d28=0000000000000000 s58=00000000 s59=00000000 d29=0000000000000000 s60=00000000 s61=00000000 d30=0000000000000000 s62=00000000 s63=00000000 d31=0000000000000000 FPSCR: 00000000 info registers vcpu 1 CPU#1 R00=83698b08 R01=00000001 R02=00000000 R03=00000002 R04=83230d00 R05=84c206f0 R06=83698a18 R07=83698b08 R08=00000000 R09=84c20704 R10=00000000 R11=dfdb9bf4 R12=dfdb9bb8 R13=dfdb9bf8 R14=81a44c4c R15=81a44c4c PSR=60000013 -ZC- A S svc32 s00=00000000 s01=00000000 d00=0000000000000000 s02=00000000 s03=00000000 d01=0000000000000000 s04=00000000 s05=00000000 d02=0000000000000000 s06=00000000 s07=00000000 d03=0000000000000000 s08=00000000 s09=00000000 d04=0000000000000000 s10=00000000 s11=00000000 d05=0000000000000000 s12=00000000 s13=00000000 d06=0000000000000000 s14=00000000 s15=00000000 d07=0000000000000000 s16=00000000 s17=00000000 d08=0000000000000000 s18=00000000 s19=00000000 d09=0000000000000000 s20=00000000 s21=00000000 d10=0000000000000000 s22=00000000 s23=00000000 d11=0000000000000000 s24=00000000 s25=00000000 d12=0000000000000000 s26=00000000 s27=00000000 d13=0000000000000000 s28=00000000 s29=00000000 d14=0000000000000000 s30=00000000 s31=00000000 d15=0000000000000000 s32=00000000 s33=00000000 d16=0000000000000000 s34=00000000 s35=00000000 d17=0000000000000000 s36=00000000 s37=00000000 d18=0000000000000000 s38=00000000 s39=00000000 d19=0000000000000000 s40=00000000 s41=00000000 d20=0000000000000000 s42=00000000 s43=00000000 d21=0000000000000000 s44=00000000 s45=00000000 d22=0000000000000000 s46=00000000 s47=00000000 d23=0000000000000000 s48=00000000 s49=00000000 d24=0000000000000000 s50=00000000 s51=00000000 d25=0000000000000000 s52=00000000 s53=00000000 d26=0000000000000000 s54=00000000 s55=00000000 d27=0000000000000000 s56=00000000 s57=00000000 d28=0000000000000000 s58=00000000 s59=00000000 d29=0000000000000000 s60=00000000 s61=00000000 d30=0000000000000000 s62=00000000 s63=00000000 d31=0000000000000000 FPSCR: 00000000