Warning: Permanently added '10.128.0.225' (ED25519) to the list of known hosts. 2026/07/20 04:37:41 parsed 1 programs 2026/07/20 04:37:41 serving rpc on tcp://43377 [ 26.787264][ T28] audit: type=1400 audit(1784522261.571:64): avc: denied { node_bind } for pid=295 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 26.808298][ T28] audit: type=1400 audit(1784522261.571:65): avc: denied { module_request } for pid=295 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 27.557089][ T28] audit: type=1400 audit(1784522262.341:66): avc: denied { mounton } for pid=301 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 27.558128][ T301] cgroup: Unknown subsys name 'net' [ 27.580498][ T28] audit: type=1400 audit(1784522262.341:67): avc: denied { mount } for pid=301 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 27.607741][ T28] audit: type=1400 audit(1784522262.371:68): avc: denied { unmount } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 27.607897][ T301] cgroup: Unknown subsys name 'devices' [ 27.722986][ T301] cgroup: Unknown subsys name 'hugetlb' [ 27.728704][ T301] cgroup: Unknown subsys name 'rlimit' [ 27.865853][ T28] audit: type=1400 audit(1784522262.651:69): avc: denied { setattr } for pid=301 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 27.889077][ T28] audit: type=1400 audit(1784522262.651:70): avc: denied { create } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 27.900278][ T305] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 27.909662][ T28] audit: type=1400 audit(1784522262.651:71): avc: denied { write } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 27.938559][ T28] audit: type=1400 audit(1784522262.651:72): avc: denied { read } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 27.958929][ T28] audit: type=1400 audit(1784522262.651:73): avc: denied { mounton } for pid=301 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 28.005012][ T301] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 28.713882][ T310] request_module fs-gadgetfs succeeded, but still no fs? [ 28.875359][ T320] syz-executor (320) used greatest stack depth: 22176 bytes left [ 29.096731][ T342] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.104098][ T342] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.111674][ T342] device bridge_slave_0 entered promiscuous mode [ 29.119258][ T342] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.126338][ T342] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.133874][ T342] device bridge_slave_1 entered promiscuous mode [ 29.172195][ T342] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.179232][ T342] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.186513][ T342] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.193542][ T342] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.210077][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.217582][ T316] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.224994][ T316] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.234465][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.242615][ T316] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.249615][ T316] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.259368][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.267692][ T316] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.274743][ T316] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.285837][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.294937][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.307343][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 29.317899][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 29.326078][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 29.333604][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 29.341738][ T342] device veth0_vlan entered promiscuous mode [ 29.350910][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 29.359949][ T342] device veth1_macvtap entered promiscuous mode [ 29.368821][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 29.378637][ T316] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/07/20 04:37:44 executed programs: 0 [ 29.800857][ T372] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.807955][ T372] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.815887][ T372] device bridge_slave_0 entered promiscuous mode [ 29.828473][ T372] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.835582][ T372] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.842986][ T372] device bridge_slave_1 entered promiscuous mode [ 29.892914][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 29.900266][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.912086][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 29.920371][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.928780][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.935838][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.943689][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 29.957452][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 29.965803][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.974010][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.981027][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.992965][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 30.003891][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 30.018095][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 30.030801][ T372] device veth0_vlan entered promiscuous mode [ 30.038251][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 30.046307][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 30.053843][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 30.066137][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 30.075087][ T372] device veth1_macvtap entered promiscuous mode [ 30.083755][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 30.093354][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 30.116447][ T377] loop2: detected capacity change from 0 to 1024 [ 30.134781][ T377] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 30.151183][ T377] ================================================================== [ 30.159270][ T377] BUG: KASAN: use-after-free in xattr_find_entry+0x2f5/0x300 [ 30.166640][ T377] Read of size 4 at addr ffff88811442e004 by task syz.2.17/377 [ 30.174162][ T377] [ 30.176474][ T377] CPU: 1 PID: 377 Comm: syz.2.17 Not tainted syzkaller #0 [ 30.183555][ T377] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 30.193605][ T377] Call Trace: [ 30.196864][ T377] [ 30.199777][ T377] __dump_stack+0x21/0x24 [ 30.204090][ T377] dump_stack_lvl+0x110/0x170 [ 30.208746][ T377] ? __cfi_dump_stack_lvl+0x8/0x8 [ 30.213751][ T377] ? __ext4_get_inode_loc+0x5a2/0xd60 [ 30.219102][ T377] ? xattr_find_entry+0x2f5/0x300 [ 30.224108][ T377] print_address_description+0x71/0x200 [ 30.229640][ T377] print_report+0x4a/0x60 [ 30.233945][ T377] kasan_report+0x122/0x150 [ 30.238426][ T377] ? xattr_find_entry+0x2f5/0x300 [ 30.243431][ T377] __asan_report_load4_noabort+0x14/0x20 [ 30.249042][ T377] xattr_find_entry+0x2f5/0x300 [ 30.253871][ T377] ext4_xattr_ibody_get+0x245/0x4d0 [ 30.259064][ T377] ? __cfi_ext4_xattr_ibody_get+0x10/0x10 [ 30.264760][ T377] ? down_read+0xa6/0xf0 [ 30.268979][ T377] ? __cfi_down_read+0x10/0x10 [ 30.273720][ T377] ext4_xattr_get+0x122/0x650 [ 30.278391][ T377] ? get_cached_acl+0x2a0/0x2f0 [ 30.283222][ T377] ? __kasan_check_write+0x14/0x20 [ 30.288312][ T377] ext4_get_acl+0x85/0x6c0 [ 30.292711][ T377] ? _raw_spin_lock+0x94/0xf0 [ 30.297365][ T377] get_acl+0x16f/0x280 [ 30.301414][ T377] posix_acl_chmod+0xe9/0x260 [ 30.306081][ T377] ext4_setattr+0xd4e/0x1c80 [ 30.310657][ T377] ? current_time+0x19b/0x2c0 [ 30.315317][ T377] ? __cfi_current_time+0x10/0x10 [ 30.320331][ T377] ? __cfi_ext4_setattr+0x10/0x10 [ 30.325344][ T377] notify_change+0xd33/0x1030 [ 30.330015][ T377] chmod_common+0x21a/0x3c0 [ 30.334504][ T377] ? __cfi_chmod_common+0x10/0x10 [ 30.339517][ T377] ? user_path_at_empty+0x162/0x1c0 [ 30.344700][ T377] do_fchmodat+0xd4/0x1a0 [ 30.349025][ T377] ? __cfi_mem_cgroup_handle_over_high+0x10/0x10 [ 30.355336][ T377] ? do_faccessat+0x9b0/0x9b0 [ 30.360003][ T377] ? fput+0x15b/0x1a0 [ 30.363971][ T377] ? debug_smp_processor_id+0x17/0x20 [ 30.369344][ T377] __x64_sys_chmod+0x60/0x70 [ 30.373929][ T377] x64_sys_call+0x760/0x9a0 [ 30.378434][ T377] do_syscall_64+0x4c/0xa0 [ 30.382853][ T377] ? clear_bhb_loop+0x30/0x80 [ 30.387516][ T377] ? clear_bhb_loop+0x30/0x80 [ 30.392171][ T377] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 30.398053][ T377] RIP: 0033:0x7fc8db79de99 [ 30.402463][ T377] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 30.422051][ T377] RSP: 002b:00007fff2dbeb6e8 EFLAGS: 00000246 ORIG_RAX: 000000000000005a [ 30.430459][ T377] RAX: ffffffffffffffda RBX: 00007fc8dba25fa0 RCX: 00007fc8db79de99 [ 30.438416][ T377] RDX: 0000000000000000 RSI: 000000000000023f RDI: 0000200000000180 [ 30.446367][ T377] RBP: 00007fc8db833eaf R08: 0000000000000000 R09: 0000000000000000 [ 30.454317][ T377] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 30.462268][ T377] R13: 00007fc8dba25fac R14: 00007fc8dba25fa0 R15: 00007fc8dba25fa0 [ 30.470228][ T377] [ 30.473228][ T377] [ 30.475536][ T377] Allocated by task 37: [ 30.479674][ T377] kasan_set_track+0x4b/0x70 [ 30.484251][ T377] kasan_save_alloc_info+0x1f/0x30 [ 30.489351][ T377] __kasan_slab_alloc+0x72/0x80 [ 30.494181][ T377] slab_post_alloc_hook+0x4f/0x2d0 [ 30.499278][ T377] kmem_cache_alloc_node+0x179/0x330 [ 30.504543][ T377] __alloc_skb+0xe8/0x4a0 [ 30.508851][ T377] ndisc_send_rs+0x31d/0x870 [ 30.513419][ T377] addrconf_dad_completed+0x958/0xe80 [ 30.518768][ T377] addrconf_dad_work+0xc1b/0x14a0 [ 30.523770][ T377] process_one_work+0x717/0xc30 [ 30.528599][ T377] worker_thread+0xa4d/0x11d0 [ 30.533263][ T377] kthread+0x281/0x320 [ 30.537316][ T377] ret_from_fork+0x1f/0x30 [ 30.541715][ T377] [ 30.544019][ T377] Freed by task 37: [ 30.547802][ T377] kasan_set_track+0x4b/0x70 [ 30.552373][ T377] kasan_save_free_info+0x2b/0x40 [ 30.557374][ T377] ____kasan_slab_free+0x132/0x180 [ 30.562467][ T377] __kasan_slab_free+0x11/0x20 [ 30.567212][ T377] slab_free_freelist_hook+0xc2/0x190 [ 30.572563][ T377] kmem_cache_free+0x12d/0x300 [ 30.577309][ T377] kfree_skbmem+0x10c/0x180 [ 30.581790][ T377] kfree_skb_reason+0xdc/0x230 [ 30.586532][ T377] neigh_connected_output+0x484/0x500 [ 30.591888][ T377] ip6_finish_output2+0x1619/0x18b0 [ 30.597071][ T377] ip6_finish_output+0x60b/0xbe0 [ 30.601991][ T377] ip6_output+0x1fa/0x410 [ 30.606304][ T377] ndisc_send_skb+0x7c8/0xcd0 [ 30.610959][ T377] ndisc_send_rs+0x66a/0x870 [ 30.615527][ T377] addrconf_dad_completed+0x958/0xe80 [ 30.620879][ T377] addrconf_dad_work+0xc1b/0x14a0 [ 30.625909][ T377] process_one_work+0x717/0xc30 [ 30.630740][ T377] worker_thread+0xa4d/0x11d0 [ 30.635394][ T377] kthread+0x281/0x320 [ 30.639442][ T377] ret_from_fork+0x1f/0x30 [ 30.643840][ T377] [ 30.646146][ T377] The buggy address belongs to the object at ffff88811442e000 [ 30.646146][ T377] which belongs to the cache skbuff_head_cache of size 256 [ 30.660696][ T377] The buggy address is located 4 bytes inside of [ 30.660696][ T377] 256-byte region [ffff88811442e000, ffff88811442e100) [ 30.673776][ T377] [ 30.676084][ T377] The buggy address belongs to the physical page: [ 30.682479][ T377] page:ffffea0004510b80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11442e [ 30.692700][ T377] flags: 0x4000000000000200(slab|zone=1) [ 30.698328][ T377] raw: 4000000000000200 ffffea00044e0980 dead000000000002 ffff888108858780 [ 30.706892][ T377] raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 [ 30.715448][ T377] page dumped because: kasan: bad access detected [ 30.721836][ T377] page_owner tracks the page as allocated [ 30.727534][ T377] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 114, tgid 114 (udevadm), ts 4238244043, free_ts 0 [ 30.744275][ T377] post_alloc_hook+0x1f5/0x210 [ 30.749041][ T377] prep_new_page+0x1c/0x110 [ 30.753529][ T377] get_page_from_freelist+0x2ca9/0x2d20 [ 30.759062][ T377] __alloc_pages+0x1fa/0x610 [ 30.763638][ T377] alloc_slab_page+0x6e/0xf0 [ 30.768209][ T377] new_slab+0x98/0x3e0 [ 30.772287][ T377] ___slab_alloc+0x70f/0xb70 [ 30.776860][ T377] __slab_alloc+0x5e/0xa0 [ 30.781174][ T377] kmem_cache_alloc_node+0x1ba/0x330 [ 30.786441][ T377] __alloc_skb+0xe8/0x4a0 [ 30.790753][ T377] alloc_uevent_skb+0x85/0x240 [ 30.795496][ T377] kobject_uevent_net_broadcast+0x343/0x5b0 [ 30.801374][ T377] kobject_uevent_env+0x541/0x720 [ 30.806381][ T377] kobject_synth_uevent+0x457/0x940 [ 30.811563][ T377] uevent_store+0x25/0x70 [ 30.815876][ T377] dev_attr_store+0x6c/0x90 [ 30.820363][ T377] page_owner free stack trace missing [ 30.825719][ T377] [ 30.828022][ T377] Memory state around the buggy address: [ 30.833631][ T377] ffff88811442df00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 30.841670][ T377] ffff88811442df80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 30.849706][ T377] >ffff88811442e000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.857746][ T377] ^ [ 30.861977][ T377] ffff88811442e080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.870025][ T377] ffff88811442e100: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 30.878064][ T377] ================================================================== [ 30.892280][ T377] Disabling lock debugging due to kernel taint [ 30.898544][ T377] EXT4-fs error (device loop2): xattr_find_entry:297: inode #12: comm syz.2.17: corrupted xattr entries [ 30.920688][ T372] EXT4-fs (loop2): unmounting filesystem.