rocess permissive=1 [ 14.359779][ T30] audit: type=1400 audit(1782614316.786:63): avc: denied { siginh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.24' (ED25519) to the list of known hosts. 2026/06/28 02:38:46 parsed 1 programs 2026/06/28 02:38:46 serving rpc on tcp://34333 [ 24.395802][ T30] audit: type=1400 audit(1782614326.866:64): avc: denied { node_bind } for pid=293 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 24.416581][ T30] audit: type=1400 audit(1782614326.866:65): avc: denied { module_request } for pid=293 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 25.417852][ T30] audit: type=1400 audit(1782614327.886:66): avc: denied { mounton } for pid=299 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.421419][ T299] cgroup: Unknown subsys name 'net' [ 25.440541][ T30] audit: type=1400 audit(1782614327.896:67): avc: denied { mount } for pid=299 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.467883][ T30] audit: type=1400 audit(1782614327.916:68): avc: denied { unmount } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.468329][ T299] cgroup: Unknown subsys name 'devices' [ 25.610366][ T299] cgroup: Unknown subsys name 'hugetlb' [ 25.615977][ T299] cgroup: Unknown subsys name 'rlimit' [ 25.764302][ T30] audit: type=1400 audit(1782614328.236:69): avc: denied { setattr } for pid=299 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.787738][ T30] audit: type=1400 audit(1782614328.236:70): avc: denied { create } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.808382][ T30] audit: type=1400 audit(1782614328.236:71): avc: denied { write } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.808470][ T303] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 25.829256][ T30] audit: type=1400 audit(1782614328.236:72): avc: denied { read } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 25.857655][ T30] audit: type=1400 audit(1782614328.246:73): avc: denied { mounton } for pid=299 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 25.882378][ T299] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.386653][ T306] request_module fs-gadgetfs succeeded, but still no fs? [ 27.041967][ T353] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.049092][ T353] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.056523][ T353] device bridge_slave_0 entered promiscuous mode [ 27.063553][ T353] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.070694][ T353] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.078047][ T353] device bridge_slave_1 entered promiscuous mode [ 27.120966][ T353] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.128017][ T353] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.135409][ T353] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.142503][ T353] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.161369][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.169181][ T319] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.176766][ T319] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.186990][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.195254][ T319] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.202347][ T319] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.211200][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.219529][ T319] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.226591][ T319] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.238413][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.247851][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.261995][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.277740][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.285917][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.293443][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.301950][ T353] device veth0_vlan entered promiscuous mode [ 27.316625][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.325953][ T353] device veth1_macvtap entered promiscuous mode [ 27.335061][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.350658][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.387411][ T353] syz-executor (353) used greatest stack depth: 21664 bytes left 2026/06/28 02:38:50 executed programs: 0 [ 27.656731][ T368] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.663825][ T368] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.671317][ T368] device bridge_slave_0 entered promiscuous mode [ 27.678410][ T368] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.685502][ T368] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.692972][ T368] device bridge_slave_1 entered promiscuous mode [ 27.752487][ T368] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.759588][ T368] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.767075][ T368] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.774335][ T368] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.797330][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.805288][ T319] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.813648][ T319] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.823818][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.832065][ T319] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.839121][ T319] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.849073][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.857257][ T319] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.864325][ T319] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.878334][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.887748][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.902994][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 27.911532][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.922993][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 27.931111][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.939263][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.946736][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.955031][ T368] device veth0_vlan entered promiscuous mode [ 27.964831][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 27.973035][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.982331][ T368] device veth1_macvtap entered promiscuous mode [ 27.991321][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 27.999449][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 28.007787][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.023358][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 28.031652][ T319] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 28.054738][ T373] ================================================================== [ 28.062845][ T373] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0x88e/0x3200 [ 28.071022][ T373] Read of size 8 at addr ffff88811dffe1c0 by task syz.2.17/373 [ 28.078579][ T373] [ 28.080925][ T373] CPU: 1 PID: 373 Comm: syz.2.17 Not tainted syzkaller #0 [ 28.088034][ T373] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 28.098094][ T373] Call Trace: [ 28.101392][ T373] [ 28.104340][ T373] __dump_stack+0x21/0x30 [ 28.108668][ T373] dump_stack_lvl+0x110/0x170 [ 28.113344][ T373] ? show_regs_print_info+0x20/0x20 [ 28.118547][ T373] ? load_image+0x3f0/0x3f0 [ 28.123065][ T373] print_address_description+0x7f/0x2c0 [ 28.128613][ T373] ? tc_setup_flow_action+0x88e/0x3200 [ 28.134072][ T373] kasan_report+0x10f/0x150 [ 28.138573][ T373] ? tc_setup_flow_action+0x88e/0x3200 [ 28.144030][ T373] __asan_report_load8_noabort+0x14/0x20 [ 28.149660][ T373] tc_setup_flow_action+0x88e/0x3200 [ 28.154948][ T373] mall_replace_hw_filter+0x2db/0x8d0 [ 28.160336][ T373] ? pcpu_block_update_hint_alloc+0x8bc/0xc50 [ 28.166417][ T373] ? mall_set_parms+0x520/0x520 [ 28.171367][ T373] ? tcf_exts_destroy+0xb0/0xb0 [ 28.176241][ T373] ? pcpu_alloc+0x1118/0x16f0 [ 28.180949][ T373] ? mall_set_parms+0x1e4/0x520 [ 28.185841][ T373] mall_change+0x544/0x760 [ 28.190267][ T373] ? __kasan_check_write+0x14/0x20 [ 28.195396][ T373] ? mall_get+0xa0/0xa0 [ 28.199567][ T373] ? tcf_chain_tp_insert_unique+0x946/0xa70 [ 28.205483][ T373] ? mall_get+0xa0/0xa0 [ 28.209649][ T373] tc_new_tfilter+0x13df/0x1990 [ 28.214526][ T373] ? tcf_gate_entry_destructor+0x20/0x20 [ 28.220179][ T373] ? security_capable+0x87/0xb0 [ 28.225049][ T373] ? ns_capable+0x8c/0xf0 [ 28.229389][ T373] ? netlink_net_capable+0x125/0x160 [ 28.234695][ T373] ? tcf_gate_entry_destructor+0x20/0x20 [ 28.240339][ T373] rtnetlink_rcv_msg+0x83c/0xcb0 [ 28.245297][ T373] ? rtnetlink_bind+0x80/0x80 [ 28.249990][ T373] ? avc_has_perm_noaudit+0x390/0x490 [ 28.255373][ T373] ? memcpy+0x56/0x70 [ 28.259366][ T373] ? avc_has_perm_noaudit+0x30a/0x490 [ 28.264746][ T373] ? arch_stack_walk+0xee/0x140 [ 28.269618][ T373] ? avc_denied+0x1b0/0x1b0 [ 28.274138][ T373] ? stack_trace_save+0xa6/0xf0 [ 28.279002][ T373] ? avc_has_perm+0x163/0x250 [ 28.283689][ T373] ? avc_has_perm_noaudit+0x490/0x490 [ 28.289070][ T373] ? x64_sys_call+0x4b/0x9a0 [ 28.293671][ T373] ? selinux_nlmsg_lookup+0x39d/0x440 [ 28.299055][ T373] netlink_rcv_skb+0x1e9/0x430 [ 28.303833][ T373] ? rtnetlink_bind+0x80/0x80 [ 28.308610][ T373] ? netlink_ack+0xb10/0xb10 [ 28.313211][ T373] ? _copy_from_iter+0x4a4/0x10a0 [ 28.318249][ T373] ? __netlink_lookup+0x387/0x3b0 [ 28.323292][ T373] rtnetlink_rcv+0x1c/0x20 [ 28.327725][ T373] netlink_unicast+0x86c/0xa30 [ 28.332501][ T373] netlink_sendmsg+0x879/0xb80 [ 28.337277][ T373] ? netlink_getsockopt+0x530/0x530 [ 28.342490][ T373] ? security_socket_sendmsg+0x82/0xa0 [ 28.347958][ T373] ? netlink_getsockopt+0x530/0x530 [ 28.353170][ T373] ____sys_sendmsg+0x5be/0x8f0 [ 28.357945][ T373] ? __sys_sendmsg_sock+0x40/0x40 [ 28.362987][ T373] ? import_iovec+0x7c/0xb0 [ 28.367504][ T373] ___sys_sendmsg+0x236/0x2e0 [ 28.372204][ T373] ? __sys_sendmsg+0x280/0x280 [ 28.376982][ T373] ? do_user_addr_fault+0x9e5/0x11c0 [ 28.382287][ T373] ? __kasan_check_read+0x11/0x20 [ 28.387422][ T373] ? __fdget+0x15b/0x230 [ 28.391705][ T373] __x64_sys_sendmsg+0x201/0x2d0 [ 28.396656][ T373] ? ___sys_sendmsg+0x2e0/0x2e0 [ 28.401521][ T373] ? fpregs_assert_state_consistent+0xb1/0xe0 [ 28.407602][ T373] x64_sys_call+0x4b/0x9a0 [ 28.412033][ T373] do_syscall_64+0x4c/0xa0 [ 28.416469][ T373] ? clear_bhb_loop+0x50/0xa0 [ 28.421161][ T373] ? clear_bhb_loop+0x50/0xa0 [ 28.425939][ T373] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 28.431846][ T373] RIP: 0033:0x7efd8e5dde59 [ 28.436284][ T373] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 28.455901][ T373] RSP: 002b:00007fffa5c4f978 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 28.464333][ T373] RAX: ffffffffffffffda RBX: 00007efd8e856fa0 RCX: 00007efd8e5dde59 [ 28.472316][ T373] RDX: 0000000020000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 28.480300][ T373] RBP: 00007efd8e673e6f R08: 0000000000000000 R09: 0000000000000000 [ 28.488283][ T373] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 28.496272][ T373] R13: 00007efd8e856fac R14: 00007efd8e856fa0 R15: 00007efd8e856fa0 [ 28.504264][ T373] [ 28.507293][ T373] [ 28.509642][ T373] Allocated by task 373: [ 28.513892][ T373] __kasan_kmalloc+0xd4/0x100 [ 28.518590][ T373] __kmalloc+0x13d/0x2c0 [ 28.522844][ T373] tcf_idr_create+0x5f/0x790 [ 28.527449][ T373] tcf_idr_create_from_flags+0x61/0x70 [ 28.532921][ T373] tcf_gact_init+0x342/0x570 [ 28.537522][ T373] tcf_action_init_1+0x3fd/0x6b0 [ 28.542468][ T373] tcf_action_init+0x233/0x7a0 [ 28.547246][ T373] tcf_exts_validate+0x24a/0x580 [ 28.552201][ T373] mall_set_parms+0x48/0x520 [ 28.556819][ T373] mall_change+0x478/0x760 [ 28.561242][ T373] tc_new_tfilter+0x13df/0x1990 [ 28.566104][ T373] rtnetlink_rcv_msg+0x83c/0xcb0 [ 28.571054][ T373] netlink_rcv_skb+0x1e9/0x430 [ 28.575833][ T373] rtnetlink_rcv+0x1c/0x20 [ 28.580260][ T373] netlink_unicast+0x86c/0xa30 [ 28.585036][ T373] netlink_sendmsg+0x879/0xb80 [ 28.589821][ T373] ____sys_sendmsg+0x5be/0x8f0 [ 28.594590][ T373] ___sys_sendmsg+0x236/0x2e0 [ 28.599275][ T373] __x64_sys_sendmsg+0x201/0x2d0 [ 28.604232][ T373] x64_sys_call+0x4b/0x9a0 [ 28.608672][ T373] do_syscall_64+0x4c/0xa0 [ 28.613296][ T373] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 28.619214][ T373] [ 28.621644][ T373] The buggy address belongs to the object at ffff88811dffe100 [ 28.621644][ T373] which belongs to the cache kmalloc-192 of size 192 [ 28.635707][ T373] The buggy address is located 0 bytes to the right of [ 28.635707][ T373] 192-byte region [ffff88811dffe100, ffff88811dffe1c0) [ 28.649431][ T373] The buggy address belongs to the page: [ 28.655103][ T373] page:ffffea000477ff80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11dffe [ 28.665356][ T373] flags: 0x4000000000000200(slab|zone=1) [ 28.671020][ T373] raw: 4000000000000200 0000000000000000 dead000000000122 ffff888100042c00 [ 28.679623][ T373] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 28.688216][ T373] page dumped because: kasan: bad access detected [ 28.694728][ T373] page_owner tracks the page as allocated [ 28.700466][ T373] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 373, ts 28054630598, free_ts 26553648121 [ 28.716374][ T373] post_alloc_hook+0x192/0x1b0 [ 28.721158][ T373] prep_new_page+0x1c/0x110 [ 28.725682][ T373] get_page_from_freelist+0x2c3a/0x2cd0 [ 28.731240][ T373] __alloc_pages+0x1a2/0x460 [ 28.735859][ T373] new_slab+0xa0/0x4d0 [ 28.739948][ T373] ___slab_alloc+0x3ac/0x840 [ 28.744557][ T373] __slab_alloc+0x49/0x90 [ 28.748903][ T373] kmem_cache_alloc_trace+0x146/0x270 [ 28.754288][ T373] mall_change+0x276/0x760 [ 28.758718][ T373] tc_new_tfilter+0x13df/0x1990 [ 28.763577][ T373] rtnetlink_rcv_msg+0x83c/0xcb0 [ 28.768532][ T373] netlink_rcv_skb+0x1e9/0x430 [ 28.773311][ T373] rtnetlink_rcv+0x1c/0x20 [ 28.777747][ T373] netlink_unicast+0x86c/0xa30 [ 28.782522][ T373] netlink_sendmsg+0x879/0xb80 [ 28.787303][ T373] ____sys_sendmsg+0x5be/0x8f0 [ 28.792101][ T373] page last free stack trace: [ 28.796918][ T373] free_unref_page_prepare+0x5fa/0x600 [ 28.802405][ T373] free_unref_page+0xae/0x540 [ 28.807098][ T373] __free_pages+0x6c/0x100 [ 28.811531][ T373] free_pages+0x82/0x90 [ 28.815708][ T373] tlb_finish_mmu+0x258/0x310 [ 28.820485][ T373] exit_mmap+0x43b/0x8b0 [ 28.824738][ T373] __mmput+0x92/0x300 [ 28.828734][ T373] mmput+0x50/0x150 [ 28.832555][ T373] do_exit+0xacc/0x29a0 [ 28.836719][ T373] do_group_exit+0x149/0x310 [ 28.841330][ T373] get_signal+0x64f/0x1430 [ 28.845776][ T373] arch_do_signal_or_restart+0xe2/0x1100 [ 28.851423][ T373] exit_to_user_mode_loop+0xa7/0xe0 [ 28.856630][ T373] exit_to_user_mode_prepare+0x87/0xd0 [ 28.862105][ T373] syscall_exit_to_user_mode+0x1a/0x30 [ 28.867576][ T373] do_syscall_64+0x58/0xa0 [ 28.872007][ T373] [ 28.874338][ T373] Memory state around the buggy address: [ 28.879974][ T373] ffff88811dffe080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.888053][ T373] ffff88811dffe100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 28.896154][ T373] >ffff88811dffe180: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 28.904224][ T373] ^ [ 28.910390][ T373] ffff88811dffe200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.918469][ T373] ffff88811dffe280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.926534][ T373] ================================================================== [ 28.934605][ T373] Disabling lock debugging due to kernel taint