syzkaller syzkaller login: [ 7.470265][ T103] udevd (103) used greatest stack depth: 22912 bytes left [ 11.997968][ T30] kauditd_printk_skb: 48 callbacks suppressed [ 11.997982][ T30] audit: type=1400 audit(1778958863.742:59): avc: denied { transition } for pid=223 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.002419][ T30] audit: type=1400 audit(1778958863.742:60): avc: denied { noatsecure } for pid=223 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.005328][ T30] audit: type=1400 audit(1778958863.742:61): avc: denied { write } for pid=223 comm="sh" path="pipe:[13908]" dev="pipefs" ino=13908 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 12.008626][ T30] audit: type=1400 audit(1778958863.742:62): avc: denied { rlimitinh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.011592][ T30] audit: type=1400 audit(1778958863.742:63): avc: denied { siginh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.533179][ T230] sshd-session (230) used greatest stack depth: 22752 bytes left Warning: Permanently added '10.128.0.68' (ED25519) to the list of known hosts. 2026/05/16 19:14:32 parsed 1 programs [ 21.124646][ T30] audit: type=1400 audit(1778958872.872:64): avc: denied { node_bind } for pid=293 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 21.145429][ T30] audit: type=1400 audit(1778958872.872:65): avc: denied { module_request } for pid=293 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 21.737927][ T30] audit: type=1400 audit(1778958873.482:66): avc: denied { mounton } for pid=299 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.739026][ T299] cgroup: Unknown subsys name 'net' [ 21.760606][ T30] audit: type=1400 audit(1778958873.482:67): avc: denied { mount } for pid=299 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.787835][ T30] audit: type=1400 audit(1778958873.512:68): avc: denied { unmount } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.787971][ T299] cgroup: Unknown subsys name 'devices' [ 21.961010][ T299] cgroup: Unknown subsys name 'hugetlb' [ 21.966606][ T299] cgroup: Unknown subsys name 'rlimit' [ 22.107415][ T30] audit: type=1400 audit(1778958873.852:69): avc: denied { setattr } for pid=299 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.130640][ T30] audit: type=1400 audit(1778958873.852:70): avc: denied { create } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 22.135992][ T303] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.151174][ T30] audit: type=1400 audit(1778958873.852:71): avc: denied { write } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 22.179838][ T30] audit: type=1400 audit(1778958873.852:72): avc: denied { read } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 22.200037][ T30] audit: type=1400 audit(1778958873.852:73): avc: denied { mounton } for pid=299 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.227755][ T299] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.610097][ T305] request_module fs-gadgetfs succeeded, but still no fs? [ 23.187660][ T355] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.194736][ T355] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.202102][ T355] device bridge_slave_0 entered promiscuous mode [ 23.208824][ T355] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.215882][ T355] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.223706][ T355] device bridge_slave_1 entered promiscuous mode [ 23.256364][ T355] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.263434][ T355] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.270724][ T355] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.277750][ T355] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.294051][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.301683][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.308785][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.317351][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.325585][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.332617][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.340904][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.349079][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.356114][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.367239][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.376388][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.389096][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.400621][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.408620][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.416310][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.424286][ T355] device veth0_vlan entered promiscuous mode [ 23.433857][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.442802][ T355] device veth1_macvtap entered promiscuous mode [ 23.451770][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.461753][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.492066][ T355] syz-executor (355) used greatest stack depth: 20576 bytes left 2026/05/16 19:14:35 executed programs: 0 [ 23.697794][ T367] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.704891][ T367] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.712307][ T367] device bridge_slave_0 entered promiscuous mode [ 23.719127][ T367] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.726507][ T367] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.733837][ T367] device bridge_slave_1 entered promiscuous mode [ 23.775838][ T367] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.782888][ T367] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.790146][ T367] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.797158][ T367] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.819351][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.826953][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.834427][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.848885][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.857124][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.864158][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.880769][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.888978][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.897226][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.904261][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.912391][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.920337][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.937746][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.945623][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.953775][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.961672][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.969595][ T367] device veth0_vlan entered promiscuous mode [ 23.978126][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.986425][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.999962][ T367] device veth1_macvtap entered promiscuous mode [ 24.008034][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.015749][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.024077][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.033152][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.041621][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.170124][ T371] loop2: detected capacity change from 0 to 40427 [ 24.203831][ T371] ================================================================================ [ 24.213418][ T371] UBSAN: shift-out-of-bounds in fs/f2fs/super.c:934:5 [ 24.220407][ T371] shift exponent 71 is too large for 32-bit type 'int' [ 24.227258][ T371] CPU: 1 PID: 371 Comm: syz.2.17 Not tainted syzkaller #0 [ 24.234356][ T371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 24.244399][ T371] Call Trace: [ 24.247657][ T371] [ 24.250569][ T371] __dump_stack+0x21/0x30 [ 24.254890][ T371] dump_stack_lvl+0x110/0x170 [ 24.259546][ T371] ? show_regs_print_info+0x20/0x20 [ 24.264738][ T371] ? slab_free_freelist_hook+0xc2/0x190 [ 24.270264][ T371] dump_stack+0x15/0x20 [ 24.274396][ T371] ubsan_epilogue+0xe/0x40 [ 24.278785][ T371] __ubsan_handle_shift_out_of_bounds+0x37c/0x400 [ 24.285192][ T371] ? match_int+0x142/0x1a0 [ 24.289586][ T371] ? __kmalloc_track_caller+0x13c/0x2c0 [ 24.295109][ T371] parse_options+0x4834/0x4860 [ 24.299851][ T371] ? default_options+0xc30/0xc30 [ 24.304762][ T371] ? kstrdup+0x51/0x70 [ 24.308810][ T371] ? memcpy+0x56/0x70 [ 24.312768][ T371] f2fs_fill_super+0x1feb/0x6dc0 [ 24.317680][ T371] ? kill_f2fs_super+0x3b0/0x3b0 [ 24.322594][ T371] ? vscnprintf+0x80/0x80 [ 24.326898][ T371] ? mutex_unlock+0x8f/0x230 [ 24.331462][ T371] ? set_blocksize+0x1eb/0x370 [ 24.336199][ T371] ? sb_set_blocksize+0xaa/0xf0 [ 24.341024][ T371] ? kill_f2fs_super+0x3b0/0x3b0 [ 24.345934][ T371] mount_bdev+0x2ae/0x3e0 [ 24.350243][ T371] ? kill_f2fs_super+0x3b0/0x3b0 [ 24.355241][ T371] f2fs_mount+0x34/0x40 [ 24.359368][ T371] legacy_get_tree+0xed/0x190 [ 24.364017][ T371] ? trace_raw_output_f2fs__rw_end+0x110/0x110 [ 24.370144][ T371] vfs_get_tree+0x89/0x260 [ 24.374546][ T371] do_new_mount+0x25a/0xa20 [ 24.379024][ T371] path_mount+0x659/0xff0 [ 24.383324][ T371] ? user_path_at_empty+0x161/0x1c0 [ 24.388495][ T371] __se_sys_mount+0x320/0x390 [ 24.393144][ T371] ? __x64_sys_mount+0xd0/0xd0 [ 24.397890][ T371] __x64_sys_mount+0xbf/0xd0 [ 24.402458][ T371] x64_sys_call+0x6bf/0x9a0 [ 24.406937][ T371] do_syscall_64+0x4c/0xa0 [ 24.411327][ T371] ? clear_bhb_loop+0x50/0xa0 [ 24.415973][ T371] ? clear_bhb_loop+0x50/0xa0 [ 24.420621][ T371] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 24.426488][ T371] RIP: 0033:0x7f48306b20ca [ 24.430877][ T371] Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 24.450465][ T371] RSP: 002b:00007ffc1a44c6a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 24.458866][ T371] RAX: ffffffffffffffda RBX: 00007ffc1a44c730 RCX: 00007f48306b20ca [ 24.466817][ T371] RDX: 0000200000000000 RSI: 0000200000000040 RDI: 00007ffc1a44c6f0 [ 24.474765][ T371] RBP: 0000200000000000 R08: 00007ffc1a44c730 R09: 0000000000000008 [ 24.482712][ T371] R10: 0000000000000008 R11: 0000000000000246 R12: 0000200000000040 [ 24.490661][ T371] R13: 00007ffc1a44c6f0 R14: 0000000000005527 R15: 0000200000000080 [ 24.498608][ T371] [ 24.504853][ T371] ================================================================================ [ 24.514394][ T371] F2FS-fs (loop2): Not support 128, larger than 256