Warning: Permanently added '10.128.1.93' (ED25519) to the list of known hosts. 2026/05/21 22:12:52 parsed 1 programs [ 21.144561][ T28] audit: type=1400 audit(1779401572.038:64): avc: denied { node_bind } for pid=295 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 21.147501][ T28] audit: type=1400 audit(1779401572.038:65): avc: denied { module_request } for pid=295 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 21.840456][ T28] audit: type=1400 audit(1779401572.738:66): avc: denied { mounton } for pid=301 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.841521][ T301] cgroup: Unknown subsys name 'net' [ 21.863311][ T28] audit: type=1400 audit(1779401572.738:67): avc: denied { mount } for pid=301 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.890606][ T28] audit: type=1400 audit(1779401572.768:68): avc: denied { unmount } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.890728][ T301] cgroup: Unknown subsys name 'devices' [ 22.000567][ T301] cgroup: Unknown subsys name 'hugetlb' [ 22.006207][ T301] cgroup: Unknown subsys name 'rlimit' [ 22.144104][ T28] audit: type=1400 audit(1779401573.038:69): avc: denied { setattr } for pid=301 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.167313][ T28] audit: type=1400 audit(1779401573.038:70): avc: denied { create } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 22.185152][ T305] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.187895][ T28] audit: type=1400 audit(1779401573.038:71): avc: denied { write } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 22.216479][ T28] audit: type=1400 audit(1779401573.038:72): avc: denied { read } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 22.227554][ T301] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.236764][ T28] audit: type=1400 audit(1779401573.038:73): avc: denied { mounton } for pid=301 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.888551][ T309] request_module fs-gadgetfs succeeded, but still no fs? [ 23.502724][ T356] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.509832][ T356] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.517134][ T356] device bridge_slave_0 entered promiscuous mode [ 23.524421][ T356] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.531520][ T356] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.539499][ T356] device bridge_slave_1 entered promiscuous mode [ 23.574978][ T356] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.582045][ T356] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.589344][ T356] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.596354][ T356] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.613947][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.621924][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.629432][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.638120][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.646540][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.653580][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.662297][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.670565][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.677587][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.689094][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.698113][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.711537][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.722238][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.730410][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.737779][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.745937][ T356] device veth0_vlan entered promiscuous mode [ 23.755450][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.764750][ T356] device veth1_macvtap entered promiscuous mode [ 23.774097][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.784107][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.817075][ T356] syz-executor (356) used greatest stack depth: 21528 bytes left 2026/05/21 22:12:54 executed programs: 0 [ 24.053046][ T371] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.060245][ T371] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.067538][ T371] device bridge_slave_0 entered promiscuous mode [ 24.079851][ T371] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.086915][ T371] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.094362][ T371] device bridge_slave_1 entered promiscuous mode [ 24.138655][ T371] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.145726][ T371] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.152997][ T371] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.160025][ T371] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.177314][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.184896][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.192212][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.201028][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.209761][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.216795][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.229868][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.238086][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.245125][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.256564][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.269829][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.282513][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.293114][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.301353][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.308729][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.320594][ T371] device veth0_vlan entered promiscuous mode [ 24.330437][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.339682][ T371] device veth1_macvtap entered promiscuous mode [ 24.348411][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.358252][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.491652][ C1] ================================================================== [ 24.499735][ C1] BUG: KASAN: slab-out-of-bounds in __bpf_get_stackid+0x6fa/0x960 [ 24.507531][ C1] Write of size 48 at addr ffff88810df75960 by task syz.2.23/381 [ 24.515223][ C1] [ 24.517534][ C1] CPU: 1 PID: 381 Comm: syz.2.23 Not tainted syzkaller #0 [ 24.524616][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 24.534744][ C1] Call Trace: [ 24.538003][ C1] [ 24.540914][ C1] __dump_stack+0x21/0x24 [ 24.545223][ C1] dump_stack_lvl+0x110/0x170 [ 24.549884][ C1] ? __cfi_dump_stack_lvl+0x8/0x8 [ 24.554916][ C1] ? __bpf_get_stackid+0x6fa/0x960 [ 24.560022][ C1] print_address_description+0x71/0x200 [ 24.565548][ C1] print_report+0x4a/0x60 [ 24.569856][ C1] kasan_report+0x122/0x150 [ 24.574366][ C1] ? __bpf_get_stackid+0x6fa/0x960 [ 24.579472][ C1] kasan_check_range+0x249/0x2a0 [ 24.584390][ C1] ? __bpf_get_stackid+0x6fa/0x960 [ 24.589480][ C1] memcpy+0x44/0x70 [ 24.593292][ C1] __bpf_get_stackid+0x6fa/0x960 [ 24.598206][ C1] bpf_get_stackid_pe+0x350/0x400 [ 24.603209][ C1] bpf_prog_644fb7c94e15512a+0x2b/0x40 [ 24.608662][ C1] bpf_overflow_handler+0x3d0/0x5e0 [ 24.613835][ C1] ? __cfi_bpf_overflow_handler+0x10/0x10 [ 24.619532][ C1] ? kvm_sched_clock_read+0x18/0x40 [ 24.624708][ C1] ? __this_cpu_preempt_check+0x13/0x20 [ 24.630256][ C1] ? __perf_event_account_interrupt+0x1a4/0x2c0 [ 24.636491][ C1] __perf_event_overflow+0x437/0x620 [ 24.641760][ C1] perf_swevent_hrtimer+0x400/0x5b0 [ 24.646937][ C1] ? should_fail+0xb/0x10 [ 24.651246][ C1] ? get_futex_key+0x641/0xb10 [ 24.655994][ C1] ? __cfi_perf_swevent_hrtimer+0x10/0x10 [ 24.661698][ C1] ? __cfi_futex_wake+0x10/0x10 [ 24.666528][ C1] ? perf_ioctl+0x140e/0x1e70 [ 24.671184][ C1] ? timerqueue_del+0xd3/0x120 [ 24.675925][ C1] ? __cfi_perf_swevent_hrtimer+0x10/0x10 [ 24.681620][ C1] __hrtimer_run_queues+0x3bb/0x8e0 [ 24.686800][ C1] ? hrtimer_interrupt+0x8c0/0x8c0 [ 24.691891][ C1] ? ktime_get_update_offsets_now+0x30c/0x320 [ 24.697937][ C1] hrtimer_interrupt+0x3c7/0x8c0 [ 24.702864][ C1] __sysvec_apic_timer_interrupt+0x11e/0x440 [ 24.708854][ C1] sysvec_apic_timer_interrupt+0x53/0xc0 [ 24.714479][ C1] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 24.720440][ C1] RIP: 0033:0x7f493525a952 [ 24.724831][ C1] Code: ff ff 66 0f 1f 44 00 00 48 8d 3d 10 85 1d 00 31 c0 e8 02 75 ff ff 48 8d 3d a5 86 1d 00 31 c0 e8 f4 74 ff ff 0f 1f 40 00 41 57 <41> 56 41 55 41 54 55 53 48 83 ec 18 48 8b 47 40 48 8b 57 48 48 39 [ 24.744412][ C1] RSP: 002b:00007ffc38fef3b0 EFLAGS: 00000202 [ 24.750470][ C1] RAX: 0000000000000044 RBX: 0000000000000000 RCX: 0000000000000000 [ 24.758423][ C1] RDX: 0000000000000003 RSI: 0000000000000001 RDI: 00007f4936145720 [ 24.766375][ C1] RBP: 00007f4936145720 R08: 0000000000000000 R09: 00007f4935616038 [ 24.774411][ C1] R10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000000 [ 24.782356][ C1] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000003 [ 24.790304][ C1] [ 24.793300][ C1] [ 24.795595][ C1] Allocated by task 381: [ 24.799816][ C1] kasan_set_track+0x4b/0x70 [ 24.804389][ C1] kasan_save_alloc_info+0x25/0x30 [ 24.809477][ C1] __kasan_kmalloc+0x95/0xb0 [ 24.814046][ C1] __kmalloc_node+0xb2/0x1e0 [ 24.818611][ C1] bpf_map_area_alloc+0x4b/0xe0 [ 24.823435][ C1] prealloc_elems_and_freelist+0x8a/0x1e0 [ 24.829131][ C1] stack_map_alloc+0x3a7/0x530 [ 24.833868][ C1] map_create+0x49c/0xd80 [ 24.838199][ C1] __sys_bpf+0x34e/0x850 [ 24.842418][ C1] __x64_sys_bpf+0x7c/0x90 [ 24.846805][ C1] x64_sys_call+0x488/0x9a0 [ 24.851286][ C1] do_syscall_64+0x4c/0xa0 [ 24.855683][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 24.861555][ C1] [ 24.863855][ C1] The buggy address belongs to the object at ffff88810df75900 [ 24.863855][ C1] which belongs to the cache kmalloc-128 of size 128 [ 24.877901][ C1] The buggy address is located 96 bytes inside of [ 24.877901][ C1] 128-byte region [ffff88810df75900, ffff88810df75980) [ 24.891081][ C1] [ 24.893387][ C1] The buggy address belongs to the physical page: [ 24.899769][ C1] page:ffffea000437dd40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10df75 [ 24.909992][ C1] flags: 0x4000000000000200(slab|zone=1) [ 24.915615][ C1] raw: 4000000000000200 ffffea000437e040 dead000000000002 ffff888100042a80 [ 24.924174][ C1] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 24.932731][ C1] page dumped because: kasan: bad access detected [ 24.939137][ C1] page_owner tracks the page as allocated [ 24.944835][ C1] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 2227822390, free_ts 0 [ 24.961388][ C1] post_alloc_hook+0x1f5/0x210 [ 24.966140][ C1] prep_new_page+0x1c/0x110 [ 24.970642][ C1] get_page_from_freelist+0x2d12/0x2d80 [ 24.976164][ C1] __alloc_pages+0x1fa/0x610 [ 24.980729][ C1] alloc_slab_page+0x6e/0xf0 [ 24.985326][ C1] new_slab+0x98/0x3d0 [ 24.989367][ C1] ___slab_alloc+0x6bd/0xb20 [ 24.993934][ C1] __slab_alloc+0x5e/0xa0 [ 24.998260][ C1] __kmem_cache_alloc_node+0x203/0x2c0 [ 25.003702][ C1] kmalloc_trace+0x29/0xb0 [ 25.008104][ C1] call_usermodehelper_setup+0x8e/0x210 [ 25.013633][ C1] kobject_uevent_env+0x66c/0x730 [ 25.018634][ C1] kobject_uevent+0x1d/0x30 [ 25.023117][ C1] device_add+0xa5c/0xef0 [ 25.027420][ C1] usb_set_configuration+0x19c2/0x1f10 [ 25.032856][ C1] usb_generic_driver_probe+0x91/0x150 [ 25.038292][ C1] page_owner free stack trace missing [ 25.043674][ C1] [ 25.045990][ C1] Memory state around the buggy address: [ 25.051606][ C1] ffff88810df75800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.059645][ C1] ffff88810df75880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.067684][ C1] >ffff88810df75900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 25.075717][ C1] ^ [ 25.083664][ C1] ffff88810df75980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.091721][ C1] ffff88810df75a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.099757][ C1] ================================================================== [ 25.107802][ C1] Disabling lock debugging due to kernel taint [ 25.448890][ C0] hrtimer: interrupt took 27659 ns [ 25.740256][ T8] device bridge_slave_1 left promiscuous mode [ 25.746379][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.754260][ T8] device bridge_slave_0 left promiscuous mode [ 25.762179][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.773758][ T8] device veth1_macvtap left promiscuous mode [ 25.779880][ T8] device veth0_vlan left promiscuous mode 2026/05/21 22:12:59 executed programs: 240 [ 29.049653][ T28] kauditd_printk_skb: 47 callbacks suppressed [ 29.049665][ T28] audit: type=1400 audit(1779401579.948:121): avc: denied { write } for pid=295 comm="syz-execprog" path="pipe:[15035]" dev="pipefs" ino=15035 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 2026/05/21 22:13:04 executed programs: 541