Warning: Permanently added '10.128.1.108' (ED25519) to the list of known hosts. 2026/07/20 06:00:44 parsed 1 programs 2026/07/20 06:00:44 serving rpc on tcp://44931 [ 20.325001][ T28] audit: type=1400 audit(1784527244.017:64): avc: denied { node_bind } for pid=295 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 20.327936][ T28] audit: type=1400 audit(1784527244.017:65): avc: denied { module_request } for pid=295 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 21.077811][ T28] audit: type=1400 audit(1784527244.767:66): avc: denied { mounton } for pid=302 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.078900][ T302] cgroup: Unknown subsys name 'net' [ 21.100523][ T28] audit: type=1400 audit(1784527244.767:67): avc: denied { mount } for pid=302 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.127789][ T28] audit: type=1400 audit(1784527244.797:68): avc: denied { unmount } for pid=302 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.127948][ T302] cgroup: Unknown subsys name 'devices' [ 21.273754][ T302] cgroup: Unknown subsys name 'hugetlb' [ 21.279397][ T302] cgroup: Unknown subsys name 'rlimit' [ 21.387628][ T28] audit: type=1400 audit(1784527245.077:69): avc: denied { setattr } for pid=302 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.410817][ T28] audit: type=1400 audit(1784527245.077:70): avc: denied { create } for pid=302 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 21.431227][ T28] audit: type=1400 audit(1784527245.077:71): avc: denied { write } for pid=302 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 21.443825][ T305] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 21.451526][ T28] audit: type=1400 audit(1784527245.077:72): avc: denied { read } for pid=302 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 21.480219][ T28] audit: type=1400 audit(1784527245.077:73): avc: denied { mounton } for pid=302 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 21.506409][ T302] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.148313][ T308] request_module fs-gadgetfs succeeded, but still no fs? [ 22.284499][ T318] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.291583][ T318] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.299177][ T318] device bridge_slave_0 entered promiscuous mode [ 22.306441][ T318] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.313500][ T318] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.320774][ T318] device bridge_slave_1 entered promiscuous mode [ 22.357903][ T318] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.365006][ T318] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.372384][ T318] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.379410][ T318] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.397020][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.404516][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.412148][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 22.419653][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.429566][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.437897][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.444960][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.453549][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.462040][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.469070][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.481266][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.490801][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.504200][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.515878][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.523919][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.531365][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.539698][ T318] device veth0_vlan entered promiscuous mode [ 22.550593][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.559596][ T318] device veth1_macvtap entered promiscuous mode [ 22.569165][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.578825][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.606309][ T318] syz-executor (318) used greatest stack depth: 21664 bytes left 2026/07/20 06:00:46 executed programs: 0 [ 23.299286][ T370] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.306587][ T370] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.314145][ T370] device bridge_slave_0 entered promiscuous mode [ 23.324008][ T370] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.331037][ T370] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.338900][ T370] device bridge_slave_1 entered promiscuous mode [ 23.387991][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.395546][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.404367][ T43] device bridge_slave_1 left promiscuous mode [ 23.410585][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.418173][ T43] device bridge_slave_0 left promiscuous mode [ 23.424518][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.432588][ T43] device veth1_macvtap left promiscuous mode [ 23.438599][ T43] device veth0_vlan left promiscuous mode [ 23.506961][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.515319][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.523706][ T317] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.530736][ T317] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.538511][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 23.549102][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.557614][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.565788][ T317] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.572840][ T317] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.583404][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.592664][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.606638][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.617422][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.625626][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.633316][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.641302][ T370] device veth0_vlan entered promiscuous mode [ 23.651369][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.660418][ T370] device veth1_macvtap entered promiscuous mode [ 23.670113][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.682660][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.706807][ T374] loop2: detected capacity change from 0 to 1024 [ 23.728073][ T374] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 23.746627][ T374] ================================================================== [ 23.754723][ T374] BUG: KASAN: use-after-free in xattr_find_entry+0x2f5/0x300 [ 23.762365][ T374] Read of size 4 at addr ffff888114d48004 by task syz.2.17/374 [ 23.769891][ T374] [ 23.772233][ T374] CPU: 0 PID: 374 Comm: syz.2.17 Not tainted syzkaller #0 [ 23.779322][ T374] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 23.789378][ T374] Call Trace: [ 23.792652][ T374] [ 23.795599][ T374] __dump_stack+0x21/0x24 [ 23.799911][ T374] dump_stack_lvl+0x110/0x170 [ 23.804574][ T374] ? __cfi_dump_stack_lvl+0x8/0x8 [ 23.809589][ T374] ? __ext4_get_inode_loc+0x5a2/0xd60 [ 23.814978][ T374] ? xattr_find_entry+0x2f5/0x300 [ 23.820002][ T374] print_address_description+0x71/0x200 [ 23.825531][ T374] print_report+0x4a/0x60 [ 23.829870][ T374] kasan_report+0x122/0x150 [ 23.834370][ T374] ? xattr_find_entry+0x2f5/0x300 [ 23.839506][ T374] __asan_report_load4_noabort+0x14/0x20 [ 23.845132][ T374] xattr_find_entry+0x2f5/0x300 [ 23.849976][ T374] ext4_xattr_ibody_get+0x245/0x4d0 [ 23.855192][ T374] ? __cfi_ext4_xattr_ibody_get+0x10/0x10 [ 23.861073][ T374] ? down_read+0xa6/0xf0 [ 23.865304][ T374] ? __cfi_down_read+0x10/0x10 [ 23.870071][ T374] ext4_xattr_get+0x122/0x650 [ 23.874733][ T374] ? get_cached_acl+0x2a0/0x2f0 [ 23.879569][ T374] ? __kasan_check_write+0x14/0x20 [ 23.884681][ T374] ext4_get_acl+0x85/0x6c0 [ 23.889082][ T374] ? _raw_spin_lock+0x94/0xf0 [ 23.893750][ T374] get_acl+0x16f/0x280 [ 23.897831][ T374] posix_acl_chmod+0xe9/0x260 [ 23.902545][ T374] ext4_setattr+0xd4e/0x1c80 [ 23.907125][ T374] ? current_time+0x19b/0x2c0 [ 23.911790][ T374] ? __cfi_current_time+0x10/0x10 [ 23.916808][ T374] ? __cfi_ext4_setattr+0x10/0x10 [ 23.921824][ T374] notify_change+0xd33/0x1030 [ 23.926497][ T374] chmod_common+0x21a/0x3c0 [ 23.930982][ T374] ? __cfi_chmod_common+0x10/0x10 [ 23.935990][ T374] ? user_path_at_empty+0x162/0x1c0 [ 23.941173][ T374] do_fchmodat+0xd4/0x1a0 [ 23.945488][ T374] ? __cfi_mem_cgroup_handle_over_high+0x10/0x10 [ 23.951838][ T374] ? do_faccessat+0x9b0/0x9b0 [ 23.956513][ T374] ? fput+0x15b/0x1a0 [ 23.960479][ T374] ? debug_smp_processor_id+0x17/0x20 [ 23.965858][ T374] __x64_sys_chmod+0x60/0x70 [ 23.970437][ T374] x64_sys_call+0x760/0x9a0 [ 23.974922][ T374] do_syscall_64+0x4c/0xa0 [ 23.979319][ T374] ? clear_bhb_loop+0x30/0x80 [ 23.983989][ T374] ? clear_bhb_loop+0x30/0x80 [ 23.988654][ T374] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 23.994534][ T374] RIP: 0033:0x7f737019de99 [ 23.998945][ T374] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 24.018708][ T374] RSP: 002b:00007ffe43762a08 EFLAGS: 00000246 ORIG_RAX: 000000000000005a [ 24.027118][ T374] RAX: ffffffffffffffda RBX: 00007f7370425fa0 RCX: 00007f737019de99 [ 24.035326][ T374] RDX: 0000000000000000 RSI: 000000000000023f RDI: 0000200000000180 [ 24.043282][ T374] RBP: 00007f7370233eaf R08: 0000000000000000 R09: 0000000000000000 [ 24.051291][ T374] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 24.059249][ T374] R13: 00007f7370425fac R14: 00007f7370425fa0 R15: 00007f7370425fa0 [ 24.067207][ T374] [ 24.070213][ T374] [ 24.072538][ T374] Allocated by task 117: [ 24.076843][ T374] kasan_set_track+0x4b/0x70 [ 24.081411][ T374] kasan_save_alloc_info+0x1f/0x30 [ 24.086493][ T374] __kasan_slab_alloc+0x72/0x80 [ 24.091326][ T374] slab_post_alloc_hook+0x4f/0x2d0 [ 24.096425][ T374] kmem_cache_alloc+0x166/0x320 [ 24.101267][ T374] skb_clone+0x1e8/0x380 [ 24.105622][ T374] netlink_broadcast+0x698/0x1170 [ 24.110624][ T374] kobject_uevent_net_broadcast+0x3cb/0x5b0 [ 24.116503][ T374] kobject_uevent_env+0x541/0x720 [ 24.121507][ T374] kobject_synth_uevent+0x457/0x940 [ 24.126685][ T374] uevent_store+0x25/0x70 [ 24.131004][ T374] dev_attr_store+0x6c/0x90 [ 24.135488][ T374] sysfs_kf_write+0x137/0x150 [ 24.140144][ T374] kernfs_fop_write_iter+0x307/0x470 [ 24.145407][ T374] vfs_write+0x5ef/0xd00 [ 24.149628][ T374] ksys_write+0x14a/0x260 [ 24.153937][ T374] __x64_sys_write+0x7b/0x90 [ 24.158597][ T374] x64_sys_call+0x27b/0x9a0 [ 24.163108][ T374] do_syscall_64+0x4c/0xa0 [ 24.167505][ T374] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 24.173413][ T374] [ 24.175722][ T374] Freed by task 103: [ 24.179594][ T374] kasan_set_track+0x4b/0x70 [ 24.184166][ T374] kasan_save_free_info+0x2b/0x40 [ 24.189168][ T374] ____kasan_slab_free+0x132/0x180 [ 24.194255][ T374] __kasan_slab_free+0x11/0x20 [ 24.198994][ T374] slab_free_freelist_hook+0xc2/0x190 [ 24.204340][ T374] kmem_cache_free+0x12d/0x300 [ 24.209087][ T374] kfree_skbmem+0x10c/0x180 [ 24.213572][ T374] consume_skb+0xb3/0x1f0 [ 24.217883][ T374] skb_free_datagram+0x15/0x20 [ 24.222633][ T374] netlink_recvmsg+0x5e3/0xe00 [ 24.228352][ T374] ____sys_recvmsg+0x2d6/0x5c0 [ 24.233114][ T374] ___sys_recvmsg+0x210/0x590 [ 24.237788][ T374] __x64_sys_recvmsg+0x20a/0x2e0 [ 24.242711][ T374] x64_sys_call+0x75/0x9a0 [ 24.247134][ T374] do_syscall_64+0x4c/0xa0 [ 24.251530][ T374] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 24.257421][ T374] [ 24.259736][ T374] The buggy address belongs to the object at ffff888114d48000 [ 24.259736][ T374] which belongs to the cache skbuff_head_cache of size 256 [ 24.274288][ T374] The buggy address is located 4 bytes inside of [ 24.274288][ T374] 256-byte region [ffff888114d48000, ffff888114d48100) [ 24.287381][ T374] [ 24.289693][ T374] The buggy address belongs to the physical page: [ 24.296093][ T374] page:ffffea0004535200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x114d48 [ 24.306340][ T374] flags: 0x4000000000000200(slab|zone=1) [ 24.311997][ T374] raw: 4000000000000200 ffffea00045352c0 dead000000000003 ffff888108858a80 [ 24.320659][ T374] raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 [ 24.329220][ T374] page dumped because: kasan: bad access detected [ 24.335641][ T374] page_owner tracks the page as allocated [ 24.341366][ T374] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 117, tgid 117 (udevadm), ts 4169240235, free_ts 0 [ 24.358105][ T374] post_alloc_hook+0x1f5/0x210 [ 24.362865][ T374] prep_new_page+0x1c/0x110 [ 24.367354][ T374] get_page_from_freelist+0x2ca9/0x2d20 [ 24.372878][ T374] __alloc_pages+0x1fa/0x610 [ 24.377458][ T374] alloc_slab_page+0x6e/0xf0 [ 24.382040][ T374] new_slab+0x98/0x3e0 [ 24.386096][ T374] ___slab_alloc+0x70f/0xb70 [ 24.390670][ T374] __slab_alloc+0x5e/0xa0 [ 24.395014][ T374] kmem_cache_alloc+0x1a8/0x320 [ 24.399878][ T374] skb_clone+0x1e8/0x380 [ 24.404101][ T374] netlink_broadcast+0x698/0x1170 [ 24.409106][ T374] kobject_uevent_net_broadcast+0x3cb/0x5b0 [ 24.414986][ T374] kobject_uevent_env+0x541/0x720 [ 24.419998][ T374] kobject_synth_uevent+0x457/0x940 [ 24.425175][ T374] uevent_store+0x25/0x70 [ 24.429484][ T374] dev_attr_store+0x6c/0x90 [ 24.433979][ T374] page_owner free stack trace missing [ 24.439336][ T374] [ 24.441643][ T374] Memory state around the buggy address: [ 24.447274][ T374] ffff888114d47f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.455319][ T374] ffff888114d47f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.463362][ T374] >ffff888114d48000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.471411][ T374] ^ [ 24.475464][ T374] ffff888114d48080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.483508][ T374] ffff888114d48100: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 24.491567][ T374] ================================================================== [ 24.503328][ T374] Disabling lock debugging due to kernel taint [ 24.509532][ T374] EXT4-fs error (device loop2): xattr_find_entry:297: inode #12: comm syz.2.17: corrupted xattr entries [ 24.529035][ T370] EXT4-fs (loop2): unmounting filesystem.