Warning: Permanently added '10.128.1.123' (ED25519) to the list of known hosts. 2025/12/30 04:18:03 parsed 1 programs [ 20.132229][ T24] audit: type=1400 audit(1767068283.229:64): avc: denied { node_bind } for pid=275 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 20.135470][ T24] audit: type=1400 audit(1767068283.229:65): avc: denied { create } for pid=275 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 20.139611][ T24] audit: type=1400 audit(1767068283.229:66): avc: denied { module_request } for pid=275 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 20.729967][ T24] audit: type=1400 audit(1767068283.829:67): avc: denied { mounton } for pid=283 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 20.730929][ T283] cgroup: Unknown subsys name 'net' [ 20.752624][ T24] audit: type=1400 audit(1767068283.829:68): avc: denied { mount } for pid=283 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.779797][ T24] audit: type=1400 audit(1767068283.849:69): avc: denied { unmount } for pid=283 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.779938][ T283] cgroup: Unknown subsys name 'devices' [ 20.890671][ T283] cgroup: Unknown subsys name 'hugetlb' [ 20.896247][ T283] cgroup: Unknown subsys name 'rlimit' [ 21.069048][ T24] audit: type=1400 audit(1767068284.159:70): avc: denied { setattr } for pid=283 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.092249][ T24] audit: type=1400 audit(1767068284.169:71): avc: denied { create } for pid=283 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 21.112887][ T24] audit: type=1400 audit(1767068284.169:72): avc: denied { write } for pid=283 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 21.118253][ T286] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 21.133313][ T24] audit: type=1400 audit(1767068284.169:73): avc: denied { read } for pid=283 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 21.161856][ T283] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.530931][ T288] request_module fs-gadgetfs succeeded, but still no fs? [ 21.541233][ T288] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 22.087555][ T343] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.094623][ T343] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.101981][ T343] device bridge_slave_0 entered promiscuous mode [ 22.108618][ T343] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.115673][ T343] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.123313][ T343] device bridge_slave_1 entered promiscuous mode [ 22.153246][ T343] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.160274][ T343] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.167477][ T343] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.174491][ T343] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.189235][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.196698][ T334] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.204015][ T334] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.212758][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.221003][ T334] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.227998][ T334] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.236451][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.244571][ T334] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.251590][ T334] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.262336][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.271130][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.283979][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.294150][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.302207][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.309735][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.317505][ T343] device veth0_vlan entered promiscuous mode [ 22.326489][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.335462][ T343] device veth1_macvtap entered promiscuous mode [ 22.344017][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.353507][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2025/12/30 04:18:05 executed programs: 0 [ 22.585037][ T353] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.592084][ T353] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.599619][ T353] device bridge_slave_0 entered promiscuous mode [ 22.606355][ T353] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.613573][ T353] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.620914][ T353] device bridge_slave_1 entered promiscuous mode [ 22.653880][ T353] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.660905][ T353] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.668099][ T353] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.675122][ T353] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.697029][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.704494][ T48] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.711708][ T48] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.721557][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.729679][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.736670][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.744078][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.752265][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.759286][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.775217][ T353] device veth0_vlan entered promiscuous mode [ 22.782061][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.790424][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.798234][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.805636][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.813101][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.820983][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.839439][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.848176][ T353] device veth1_macvtap entered promiscuous mode [ 22.861754][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.871294][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.894238][ T357] netlink: 76 bytes leftover after parsing attributes in process `syz.2.17'. [ 22.903792][ T357] ================================================================== [ 22.911861][ T357] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0x842/0x3280 [ 22.919989][ T357] Read of size 8 at addr ffff88810f8fefc0 by task syz.2.17/357 [ 22.927511][ T357] [ 22.929827][ T357] CPU: 0 PID: 357 Comm: syz.2.17 Not tainted syzkaller #0 [ 22.936911][ T357] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 22.946944][ T357] Call Trace: [ 22.950216][ T357] __dump_stack+0x21/0x24 [ 22.954525][ T357] dump_stack_lvl+0x169/0x1d8 [ 22.959179][ T357] ? show_regs_print_info+0x18/0x18 [ 22.964351][ T357] ? thaw_kernel_threads+0x220/0x220 [ 22.969605][ T357] print_address_description+0x7f/0x2c0 [ 22.975123][ T357] ? tc_setup_flow_action+0x842/0x3280 [ 22.980548][ T357] kasan_report+0xe2/0x130 [ 22.984931][ T357] ? flow_action_cookie_create+0x28/0x90 [ 22.990540][ T357] ? tc_setup_flow_action+0x842/0x3280 [ 22.995975][ T357] __asan_report_load8_noabort+0x14/0x20 [ 23.001578][ T357] tc_setup_flow_action+0x842/0x3280 [ 23.006831][ T357] ? __kmalloc+0x1a7/0x330 [ 23.011220][ T357] ? flow_rule_alloc+0x32/0x2c0 [ 23.016041][ T357] mall_replace_hw_filter+0x293/0x810 [ 23.021380][ T357] ? pcpu_block_update_hint_alloc+0x8bc/0xc50 [ 23.027413][ T357] ? mall_set_parms+0x410/0x410 [ 23.032229][ T357] ? tcf_exts_destroy+0xb0/0xb0 [ 23.037046][ T357] ? pcpu_alloc+0xf8a/0x16b0 [ 23.041603][ T357] ? mall_set_parms+0x19d/0x410 [ 23.046428][ T357] mall_change+0x528/0x750 [ 23.050810][ T357] ? __kasan_check_write+0x14/0x20 [ 23.055886][ T357] ? mall_get+0xa0/0xa0 [ 23.060009][ T357] ? tcf_chain_tp_insert_unique+0xac1/0xc10 [ 23.065871][ T357] ? nla_strcmp+0xf4/0x140 [ 23.070259][ T357] tc_new_tfilter+0x13f6/0x1a10 [ 23.075080][ T357] ? mall_get+0xa0/0xa0 [ 23.079203][ T357] ? tcf_gate_entry_destructor+0x20/0x20 [ 23.084801][ T357] ? security_capable+0x87/0xb0 [ 23.089618][ T357] ? ns_capable+0x8c/0xf0 [ 23.093916][ T357] ? netlink_net_capable+0x125/0x160 [ 23.099165][ T357] ? tcf_gate_entry_destructor+0x20/0x20 [ 23.104762][ T357] rtnetlink_rcv_msg+0x800/0xb90 [ 23.109664][ T357] ? rtnetlink_bind+0x80/0x80 [ 23.114306][ T357] ? arch_stack_walk+0xee/0x140 [ 23.119120][ T357] ? stack_trace_save+0x98/0xe0 [ 23.123940][ T357] ? stack_trace_snprint+0xf0/0xf0 [ 23.129016][ T357] ? do_syscall_64+0x31/0x40 [ 23.133578][ T357] ? memcpy+0x56/0x70 [ 23.137529][ T357] ? avc_has_perm+0x234/0x360 [ 23.142170][ T357] ? __kasan_slab_alloc+0xbd/0xf0 [ 23.147159][ T357] ? slab_post_alloc_hook+0x5d/0x2f0 [ 23.152419][ T357] ? ___sys_sendmsg+0x1f0/0x260 [ 23.157237][ T357] ? avc_has_perm_noaudit+0x240/0x240 [ 23.162574][ T357] ? selinux_nlmsg_lookup+0x3fb/0x4a0 [ 23.167911][ T357] netlink_rcv_skb+0x1e0/0x430 [ 23.172648][ T357] ? rtnetlink_bind+0x80/0x80 [ 23.177293][ T357] ? netlink_ack+0xb80/0xb80 [ 23.181847][ T357] ? __netlink_lookup+0x387/0x3b0 [ 23.186838][ T357] rtnetlink_rcv+0x1c/0x20 [ 23.191218][ T357] netlink_unicast+0x876/0xa40 [ 23.195960][ T357] netlink_sendmsg+0x88d/0xb30 [ 23.200698][ T357] ? netlink_getsockopt+0x530/0x530 [ 23.205865][ T357] ? security_socket_sendmsg+0x82/0xa0 [ 23.211290][ T357] ? netlink_getsockopt+0x530/0x530 [ 23.216454][ T357] ____sys_sendmsg+0x5a2/0x8c0 [ 23.221188][ T357] ? __sys_sendmsg_sock+0x40/0x40 [ 23.226266][ T357] ? import_iovec+0x7c/0xb0 [ 23.230740][ T357] ___sys_sendmsg+0x1f0/0x260 [ 23.235396][ T357] ? __sys_sendmsg+0x250/0x250 [ 23.240138][ T357] ? __kasan_check_read+0x11/0x20 [ 23.245130][ T357] ? __fdget+0x15b/0x230 [ 23.249341][ T357] __x64_sys_sendmsg+0x1e2/0x2a0 [ 23.254245][ T357] ? ___sys_sendmsg+0x260/0x260 [ 23.259064][ T357] ? debug_smp_processor_id+0x17/0x20 [ 23.264411][ T357] ? fpregs_assert_state_consistent+0xb1/0xe0 [ 23.270448][ T357] ? exit_to_user_mode_prepare+0x2f/0xa0 [ 23.276050][ T357] do_syscall_64+0x31/0x40 [ 23.280437][ T357] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 23.286306][ T357] RIP: 0033:0x7f3ef4f36749 [ 23.290696][ T357] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 23.310269][ T357] RSP: 002b:00007ffeebda7178 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 23.318650][ T357] RAX: ffffffffffffffda RBX: 00007f3ef518cfa0 RCX: 00007f3ef4f36749 [ 23.326593][ T357] RDX: 0000000020000000 RSI: 0000200000000580 RDI: 0000000000000006 [ 23.334539][ T357] RBP: 00007f3ef4fbaf91 R08: 0000000000000000 R09: 0000000000000000 [ 23.342487][ T357] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 23.350442][ T357] R13: 00007f3ef518cfa0 R14: 00007f3ef518cfa0 R15: 0000000000000003 [ 23.358388][ T357] [ 23.360686][ T357] Allocated by task 357: [ 23.364901][ T357] __kasan_kmalloc+0xda/0x110 [ 23.369545][ T357] __kmalloc+0x1a7/0x330 [ 23.373755][ T357] tcf_idr_create+0x5f/0x790 [ 23.378406][ T357] tcf_idr_create_from_flags+0x61/0x70 [ 23.383830][ T357] tcf_gact_init+0x2b4/0x520 [ 23.388385][ T357] tcf_action_init_1+0x3e1/0x670 [ 23.393291][ T357] tcf_action_init+0x1e6/0x700 [ 23.398024][ T357] tcf_exts_validate+0x215/0x510 [ 23.402926][ T357] mall_set_parms+0x4b/0x410 [ 23.407480][ T357] mall_change+0x45c/0x750 [ 23.411995][ T357] tc_new_tfilter+0x13f6/0x1a10 [ 23.416910][ T357] rtnetlink_rcv_msg+0x800/0xb90 [ 23.421823][ T357] netlink_rcv_skb+0x1e0/0x430 [ 23.426555][ T357] rtnetlink_rcv+0x1c/0x20 [ 23.430936][ T357] netlink_unicast+0x876/0xa40 [ 23.435665][ T357] netlink_sendmsg+0x88d/0xb30 [ 23.440399][ T357] ____sys_sendmsg+0x5a2/0x8c0 [ 23.445128][ T357] ___sys_sendmsg+0x1f0/0x260 [ 23.449771][ T357] __x64_sys_sendmsg+0x1e2/0x2a0 [ 23.454675][ T357] do_syscall_64+0x31/0x40 [ 23.459065][ T357] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 23.464916][ T357] [ 23.467214][ T357] The buggy address belongs to the object at ffff88810f8fef00 [ 23.467214][ T357] which belongs to the cache kmalloc-192 of size 192 [ 23.481236][ T357] The buggy address is located 0 bytes to the right of [ 23.481236][ T357] 192-byte region [ffff88810f8fef00, ffff88810f8fefc0) [ 23.494817][ T357] The buggy address belongs to the page: [ 23.500425][ T357] page:ffffea00043e3f80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10f8fe [ 23.510622][ T357] flags: 0x4000000000000200(slab) [ 23.515615][ T357] raw: 4000000000000200 dead000000000100 dead000000000122 ffff888100043380 [ 23.524163][ T357] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 23.532704][ T357] page dumped because: kasan: bad access detected [ 23.539089][ T357] page_owner tracks the page as allocated [ 23.544774][ T357] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 353, ts 22889965849, free_ts 22889549112 [ 23.560624][ T357] prep_new_page+0x179/0x180 [ 23.565181][ T357] get_page_from_freelist+0x2235/0x23d0 [ 23.570688][ T357] __alloc_pages_nodemask+0x268/0x5f0 [ 23.576026][ T357] new_slab+0x84/0x3f0 [ 23.580059][ T357] ___slab_alloc+0x2a6/0x450 [ 23.584612][ T357] __slab_alloc+0x63/0xa0 [ 23.588908][ T357] kmem_cache_alloc_trace+0x1b3/0x2e0 [ 23.594245][ T357] kernfs_fop_open+0x343/0xb30 [ 23.598972][ T357] do_dentry_open+0x793/0x1090 [ 23.603703][ T357] vfs_open+0x73/0x80 [ 23.607652][ T357] path_openat+0x27ad/0x3160 [ 23.612209][ T357] do_filp_open+0x1b3/0x3e0 [ 23.616676][ T357] do_sys_openat2+0x14c/0x6d0 [ 23.621318][ T357] __x64_sys_openat+0x136/0x160 [ 23.626137][ T357] do_syscall_64+0x31/0x40 [ 23.630532][ T357] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 23.636389][ T357] page last free stack trace: [ 23.641032][ T357] free_unref_page_prepare+0x2b7/0x2d0 [ 23.646540][ T357] __free_pages+0x14b/0x380 [ 23.651007][ T357] free_pages+0x82/0x90 [ 23.655127][ T357] selinux_genfs_get_sid+0x20b/0x250 [ 23.660376][ T357] inode_doinit_with_dentry+0x86d/0xd70 [ 23.665886][ T357] sb_finish_set_opts+0x6a3/0x7d0 [ 23.670878][ T357] selinux_set_mnt_opts+0x156d/0x1bc0 [ 23.676216][ T357] security_sb_set_mnt_opts+0x71/0xd0 [ 23.681551][ T357] vfs_get_tree+0x14e/0x260 [ 23.686017][ T357] do_new_mount+0x25a/0xa20 [ 23.690484][ T357] path_mount+0x572/0xc80 [ 23.694776][ T357] __se_sys_mount+0x318/0x380 [ 23.699416][ T357] __x64_sys_mount+0xbf/0xd0 [ 23.703970][ T357] do_syscall_64+0x31/0x40 [ 23.708353][ T357] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 23.714212][ T357] [ 23.716507][ T357] Memory state around the buggy address: [ 23.722106][ T357] ffff88810f8fee80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 23.730134][ T357] ffff88810f8fef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 23.738159][ T357] >ffff88810f8fef80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 23.746181][ T357] ^ [ 23.752295][ T357] ffff88810f8ff000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 23.760327][ T357] ffff88810f8ff080: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc [ 23.768351][ T357] ================================================================== [ 23.776372][ T357] Disabling lock debugging due to kernel taint