Warning: Permanently added '10.128.0.164' (ED25519) to the list of known hosts. 2026/05/23 02:38:49 parsed 1 programs [ 24.790933][ T28] audit: type=1400 audit(1779503929.026:64): avc: denied { node_bind } for pid=295 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 24.811639][ T28] audit: type=1400 audit(1779503929.026:65): avc: denied { module_request } for pid=295 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 25.596283][ T28] audit: type=1400 audit(1779503929.836:66): avc: denied { mounton } for pid=304 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.597301][ T304] cgroup: Unknown subsys name 'net' [ 25.618973][ T28] audit: type=1400 audit(1779503929.836:67): avc: denied { mount } for pid=304 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.646247][ T28] audit: type=1400 audit(1779503929.866:68): avc: denied { unmount } for pid=304 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.646392][ T304] cgroup: Unknown subsys name 'devices' [ 25.787049][ T304] cgroup: Unknown subsys name 'hugetlb' [ 25.792649][ T304] cgroup: Unknown subsys name 'rlimit' [ 25.900006][ T28] audit: type=1400 audit(1779503930.136:69): avc: denied { setattr } for pid=304 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.923297][ T28] audit: type=1400 audit(1779503930.136:70): avc: denied { create } for pid=304 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.943746][ T28] audit: type=1400 audit(1779503930.136:71): avc: denied { write } for pid=304 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.953397][ T306] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 25.964266][ T28] audit: type=1400 audit(1779503930.136:72): avc: denied { read } for pid=304 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 25.992927][ T28] audit: type=1400 audit(1779503930.136:73): avc: denied { mounton } for pid=304 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 26.039423][ T304] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.804836][ T308] request_module fs-gadgetfs succeeded, but still no fs? [ 27.144914][ T340] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.152522][ T340] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.159963][ T340] device bridge_slave_0 entered promiscuous mode [ 27.166769][ T340] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.173780][ T340] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.181897][ T340] device bridge_slave_1 entered promiscuous mode [ 27.219147][ T340] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.226196][ T340] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.233430][ T340] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.240464][ T340] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.259803][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.267457][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.274563][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.283721][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.292058][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.299117][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.308778][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.317002][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.324021][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.335789][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.345997][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.359458][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.370171][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.378272][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.385893][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.393910][ T340] device veth0_vlan entered promiscuous mode [ 27.406015][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.415445][ T340] device veth1_macvtap entered promiscuous mode [ 27.424535][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.434283][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/05/23 02:38:52 executed programs: 0 [ 27.963572][ T372] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.971161][ T372] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.978686][ T372] device bridge_slave_0 entered promiscuous mode [ 27.985945][ T372] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.992983][ T372] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.000444][ T372] device bridge_slave_1 entered promiscuous mode [ 28.042031][ T372] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.049099][ T372] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.056394][ T372] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.063420][ T372] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.085882][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.093488][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.101026][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.110019][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 28.118429][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.125486][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.145216][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 28.153667][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 28.162112][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.169202][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.176693][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 28.184718][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 28.193262][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 28.201558][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 28.214947][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 28.223330][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 28.233844][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 28.241986][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 28.250002][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 28.257661][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 28.266070][ T372] device veth0_vlan entered promiscuous mode [ 28.276138][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 28.284328][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 28.292741][ T43] device bridge_slave_1 left promiscuous mode [ 28.299031][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.306562][ T43] device bridge_slave_0 left promiscuous mode [ 28.312653][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.320861][ T43] device veth1_macvtap left promiscuous mode [ 28.326894][ T43] device veth0_vlan left promiscuous mode [ 28.432968][ T372] device veth1_macvtap entered promiscuous mode [ 28.441985][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 28.449717][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 28.457910][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.469216][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 28.477466][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 28.671144][ C0] ================================================================== [ 28.679262][ C0] BUG: KASAN: slab-out-of-bounds in __bpf_get_stackid+0x6fa/0x960 [ 28.687087][ C0] Write of size 32 at addr ffff88810e3ab260 by task syz.2.28/387 [ 28.694815][ C0] [ 28.697127][ C0] CPU: 0 PID: 387 Comm: syz.2.28 Not tainted syzkaller #0 [ 28.704218][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 28.714270][ C0] Call Trace: [ 28.717558][ C0] [ 28.720478][ C0] __dump_stack+0x21/0x24 [ 28.724811][ C0] dump_stack_lvl+0x110/0x170 [ 28.729489][ C0] ? __cfi_dump_stack_lvl+0x8/0x8 [ 28.734511][ C0] ? __bpf_get_stackid+0x6fa/0x960 [ 28.739606][ C0] print_address_description+0x71/0x200 [ 28.745145][ C0] print_report+0x4a/0x60 [ 28.749482][ C0] kasan_report+0x122/0x150 [ 28.753974][ C0] ? __bpf_get_stackid+0x6fa/0x960 [ 28.759068][ C0] kasan_check_range+0x249/0x2a0 [ 28.763991][ C0] ? __bpf_get_stackid+0x6fa/0x960 [ 28.769082][ C0] memcpy+0x44/0x70 [ 28.772880][ C0] __bpf_get_stackid+0x6fa/0x960 [ 28.777825][ C0] bpf_get_stackid_pe+0x350/0x400 [ 28.782836][ C0] bpf_prog_644fb7c94e15512a+0x2b/0x40 [ 28.788292][ C0] bpf_overflow_handler+0x3d0/0x5e0 [ 28.793475][ C0] ? __cfi_bpf_overflow_handler+0x10/0x10 [ 28.799175][ C0] ? kvm_sched_clock_read+0x18/0x40 [ 28.804373][ C0] ? __this_cpu_preempt_check+0x13/0x20 [ 28.809910][ C0] ? __perf_event_account_interrupt+0x1a4/0x2c0 [ 28.816157][ C0] __perf_event_overflow+0x437/0x620 [ 28.821432][ C0] perf_swevent_hrtimer+0x400/0x5b0 [ 28.826614][ C0] ? should_fail+0xb/0x10 [ 28.830929][ C0] ? get_futex_key+0x641/0xb10 [ 28.835676][ C0] ? __cfi_perf_swevent_hrtimer+0x10/0x10 [ 28.841381][ C0] ? timerqueue_add+0x20e/0x230 [ 28.846214][ C0] ? timerqueue_del+0xd3/0x120 [ 28.851047][ C0] ? __cfi_perf_swevent_hrtimer+0x10/0x10 [ 28.856750][ C0] __hrtimer_run_queues+0x3bb/0x8e0 [ 28.861948][ C0] ? hrtimer_interrupt+0x8c0/0x8c0 [ 28.867048][ C0] ? ktime_get_update_offsets_now+0x30c/0x320 [ 28.873135][ C0] hrtimer_interrupt+0x3c7/0x8c0 [ 28.878063][ C0] __sysvec_apic_timer_interrupt+0x11e/0x440 [ 28.884054][ C0] sysvec_apic_timer_interrupt+0x53/0xc0 [ 28.889681][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 28.895654][ C0] RIP: 0033:0x7ffa36e656c7 [ 28.900068][ C0] Code: c0 0f 85 b2 5e fe ff 8b 05 a6 00 ee 00 41 80 79 48 00 c6 05 ca 00 ee 00 01 89 44 24 08 0f 84 f0 02 00 00 45 89 d7 41 83 cf 10 <48> 83 3d b9 00 ee 00 00 75 0b 48 c7 05 ac 00 ee 00 01 00 00 00 48 [ 28.919659][ C0] RSP: 002b:00007ffdd9097550 EFLAGS: 00000206 [ 28.925729][ C0] RAX: 0000000000000044 RBX: 0000000000000000 RCX: 0000000000000000 [ 28.933687][ C0] RDX: 0000000000000003 RSI: 00007ffa37216038 RDI: 0000000000000005 [ 28.941819][ C0] RBP: 00007ffa37215fb0 R08: 0000000000000000 R09: 00007ffa37216038 [ 28.949787][ C0] R10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000000 [ 28.957766][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000003 [ 28.965729][ C0] [ 28.968748][ C0] [ 28.971053][ C0] Allocated by task 387: [ 28.975278][ C0] kasan_set_track+0x4b/0x70 [ 28.979854][ C0] kasan_save_alloc_info+0x25/0x30 [ 28.984943][ C0] __kasan_kmalloc+0x95/0xb0 [ 28.989515][ C0] __kmalloc_node+0xb2/0x1e0 [ 28.994099][ C0] bpf_map_area_alloc+0x4b/0xe0 [ 28.998931][ C0] prealloc_elems_and_freelist+0x8a/0x1e0 [ 29.004645][ C0] stack_map_alloc+0x3a7/0x530 [ 29.009390][ C0] map_create+0x49c/0xd80 [ 29.013699][ C0] __sys_bpf+0x34e/0x850 [ 29.017922][ C0] __x64_sys_bpf+0x7c/0x90 [ 29.022331][ C0] x64_sys_call+0x488/0x9a0 [ 29.026818][ C0] do_syscall_64+0x4c/0xa0 [ 29.031220][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 29.037122][ C0] [ 29.039431][ C0] The buggy address belongs to the object at ffff88810e3ab200 [ 29.039431][ C0] which belongs to the cache kmalloc-128 of size 128 [ 29.053463][ C0] The buggy address is located 96 bytes inside of [ 29.053463][ C0] 128-byte region [ffff88810e3ab200, ffff88810e3ab280) [ 29.066636][ C0] [ 29.068965][ C0] The buggy address belongs to the physical page: [ 29.075355][ C0] page:ffffea000438eac0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10e3ab [ 29.085571][ C0] flags: 0x4000000000000200(slab|zone=1) [ 29.091189][ C0] raw: 4000000000000200 ffffea000438ed00 dead000000000003 ffff888100042a80 [ 29.099757][ C0] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 29.108317][ C0] page dumped because: kasan: bad access detected [ 29.114705][ C0] page_owner tracks the page as allocated [ 29.120405][ C0] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 2805925051, free_ts 0 [ 29.137159][ C0] post_alloc_hook+0x1f5/0x210 [ 29.141922][ C0] prep_new_page+0x1c/0x110 [ 29.146408][ C0] get_page_from_freelist+0x2d12/0x2d80 [ 29.151953][ C0] __alloc_pages+0x1fa/0x610 [ 29.156523][ C0] alloc_slab_page+0x6e/0xf0 [ 29.161092][ C0] new_slab+0x98/0x3d0 [ 29.165145][ C0] ___slab_alloc+0x6bd/0xb20 [ 29.169739][ C0] __slab_alloc+0x5e/0xa0 [ 29.174071][ C0] __kmem_cache_alloc_node+0x203/0x2c0 [ 29.179534][ C0] kmalloc_trace+0x29/0xb0 [ 29.183940][ C0] call_usermodehelper_setup+0x8e/0x210 [ 29.189479][ C0] kobject_uevent_env+0x66c/0x730 [ 29.194498][ C0] kobject_uevent+0x1d/0x30 [ 29.198997][ C0] device_add+0xa5c/0xef0 [ 29.203320][ C0] platform_device_add+0x49d/0x6f0 [ 29.208422][ C0] dummy_hcd_init+0xb3b/0x10d0 [ 29.213177][ C0] page_owner free stack trace missing [ 29.218549][ C0] [ 29.220868][ C0] Memory state around the buggy address: [ 29.226485][ C0] ffff88810e3ab100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.234543][ C0] ffff88810e3ab180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.242619][ C0] >ffff88810e3ab200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 29.250667][ C0] ^ [ 29.258629][ C0] ffff88810e3ab280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.266679][ C0] ffff88810e3ab300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.274725][ C0] ================================================================== [ 29.282773][ C0] Disabling lock debugging due to kernel taint [ 30.455263][ C1] hrtimer: interrupt took 146062 ns 2026/05/23 02:38:57 executed programs: 227 [ 32.945876][ T28] kauditd_printk_skb: 47 callbacks suppressed [ 32.945890][ T28] audit: type=1400 audit(1779503937.186:121): avc: denied { write } for pid=295 comm="syz-execprog" path="pipe:[9100]" dev="pipefs" ino=9100 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 2026/05/23 02:39:02 executed programs: 527