Warning: Permanently added '10.128.1.219' (ED25519) to the list of known hosts. 2025/09/03 14:49:24 parsed 1 programs [ 32.802520][ T28] audit: type=1400 audit(1756910964.242:64): avc: denied { node_bind } for pid=282 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 32.823328][ T28] audit: type=1400 audit(1756910964.242:65): avc: denied { module_request } for pid=282 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 33.964639][ T28] audit: type=1400 audit(1756910965.402:66): avc: denied { mounton } for pid=290 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 33.966054][ T290] cgroup: Unknown subsys name 'net' [ 33.987371][ T28] audit: type=1400 audit(1756910965.402:67): avc: denied { mount } for pid=290 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 34.014710][ T28] audit: type=1400 audit(1756910965.432:68): avc: denied { unmount } for pid=290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 34.014929][ T290] cgroup: Unknown subsys name 'devices' [ 34.171854][ T290] cgroup: Unknown subsys name 'hugetlb' [ 34.177474][ T290] cgroup: Unknown subsys name 'rlimit' [ 34.290238][ T28] audit: type=1400 audit(1756910965.732:69): avc: denied { setattr } for pid=290 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 34.313513][ T28] audit: type=1400 audit(1756910965.732:70): avc: denied { create } for pid=290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 34.334061][ T28] audit: type=1400 audit(1756910965.732:71): avc: denied { write } for pid=290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 34.340909][ T293] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 34.354816][ T28] audit: type=1400 audit(1756910965.732:72): avc: denied { read } for pid=290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 34.383650][ T28] audit: type=1400 audit(1756910965.732:73): avc: denied { mounton } for pid=290 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 34.387436][ T290] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 35.086475][ T295] request_module fs-gadgetfs succeeded, but still no fs? [ 35.445029][ T314] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.452206][ T314] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.459846][ T314] device bridge_slave_0 entered promiscuous mode [ 35.467495][ T314] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.474605][ T314] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.482073][ T314] device bridge_slave_1 entered promiscuous mode [ 35.534202][ T314] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.541267][ T314] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.548620][ T314] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.555676][ T314] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.576041][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 35.584035][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.591312][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.601501][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 35.610124][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.617175][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.626966][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 35.635328][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.642550][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.655314][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 35.671199][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 35.681924][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 35.693234][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 35.701803][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 35.709233][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 35.717929][ T314] device veth0_vlan entered promiscuous mode [ 35.729323][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 35.738463][ T314] device veth1_macvtap entered promiscuous mode [ 35.748078][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 35.758160][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 35.793200][ T314] syz-executor (314) used greatest stack depth: 22368 bytes left 2025/09/03 14:49:27 executed programs: 0 [ 36.393690][ T363] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.401401][ T363] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.408876][ T363] device bridge_slave_0 entered promiscuous mode [ 36.415972][ T363] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.423373][ T363] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.430997][ T363] device bridge_slave_1 entered promiscuous mode [ 36.482364][ T363] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.489558][ T363] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.496837][ T363] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.504272][ T363] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.525062][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 36.532928][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.540256][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.549223][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 36.557773][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.564865][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.576044][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 36.584465][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.591545][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.608748][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 36.618675][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 36.633401][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 36.652092][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 36.660360][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 36.667815][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 36.676363][ T363] device veth0_vlan entered promiscuous mode [ 36.693266][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 36.703709][ T363] device veth1_macvtap entered promiscuous mode [ 36.719725][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 36.730814][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 36.758823][ T373] loop2: detected capacity change from 0 to 1024 [ 36.765690][ T373] ======================================================= [ 36.765690][ T373] WARNING: The mand mount option has been deprecated and [ 36.765690][ T373] and is ignored by this kernel. Remove the mand [ 36.765690][ T373] option from the mount to silence this warning. [ 36.765690][ T373] ======================================================= [ 36.802519][ T373] EXT4-fs: Ignoring removed nobh option [ 36.808325][ T373] EXT4-fs: Ignoring removed bh option [ 36.814431][ T373] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 36.841386][ T373] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 36.863380][ T10] ================================================================== [ 36.871486][ T10] BUG: KASAN: use-after-free in ext4_find_extent+0xbeb/0xe20 [ 36.878885][ T10] Read of size 4 at addr ffff88812901c018 by task kworker/u4:1/10 [ 36.886712][ T10] [ 36.889068][ T10] CPU: 1 PID: 10 Comm: kworker/u4:1 Not tainted syzkaller #0 [ 36.896469][ T10] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 36.906544][ T10] Workqueue: writeback wb_workfn (flush-7:2) [ 36.912682][ T10] Call Trace: [ 36.915982][ T10] [ 36.918929][ T10] __dump_stack+0x21/0x24 [ 36.923281][ T10] dump_stack_lvl+0xee/0x150 [ 36.928079][ T10] ? __cfi_dump_stack_lvl+0x8/0x8 [ 36.933137][ T10] ? ext4_find_extent+0xbeb/0xe20 [ 36.938188][ T10] print_address_description+0x71/0x1e0 [ 36.943778][ T10] print_report+0x4a/0x60 [ 36.948153][ T10] kasan_report+0x122/0x150 [ 36.952680][ T10] ? ext4_find_extent+0xbeb/0xe20 [ 36.957767][ T10] __asan_report_load4_noabort+0x14/0x20 [ 36.963543][ T10] ext4_find_extent+0xbeb/0xe20 [ 36.968425][ T10] ? __cfi__raw_spin_lock_irqsave+0x10/0x10 [ 36.974351][ T10] ext4_ext_map_blocks+0x1dc/0x6060 [ 36.979578][ T10] ? _raw_spin_unlock_irqrestore+0x5a/0x80 [ 36.985418][ T10] ? __stack_depot_save+0x445/0x480 [ 36.990636][ T10] ? kasan_set_track+0x60/0x70 [ 36.995422][ T10] ? kasan_set_track+0x4b/0x70 [ 37.000202][ T10] ? kasan_save_alloc_info+0x25/0x30 [ 37.005511][ T10] ? __kasan_slab_alloc+0x72/0x80 [ 37.010555][ T10] ? slab_post_alloc_hook+0x4f/0x2d0 [ 37.015876][ T10] ? kmem_cache_alloc+0x16e/0x330 [ 37.020928][ T10] ? ext4_alloc_io_end_vec+0x2a/0x160 [ 37.026352][ T10] ? ext4_writepages+0xf42/0x3020 [ 37.031585][ T10] ? do_writepages+0x3a9/0x5e0 [ 37.036456][ T10] ? __writeback_single_inode+0xc6/0xad0 [ 37.042266][ T10] ? writeback_sb_inodes+0x9b8/0x1550 [ 37.047676][ T10] ? wb_writeback+0x3f1/0x980 [ 37.052386][ T10] ? wb_workfn+0x350/0xda0 [ 37.056856][ T10] ? process_one_work+0x71f/0xc40 [ 37.061902][ T10] ? wo