Warning: Permanently added '10.128.0.164' (ED25519) to the list of known hosts. 2026/06/15 21:05:32 parsed 1 programs [ 31.413135][ T24] audit: type=1400 audit(1781557532.110:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 31.440956][ T24] audit: type=1400 audit(1781557532.110:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 31.465052][ T24] audit: type=1400 audit(1781557532.110:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 32.126174][ T24] audit: type=1400 audit(1781557532.820:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 32.127146][ T293] cgroup: Unknown subsys name 'net' [ 32.151423][ T24] audit: type=1400 audit(1781557532.820:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 32.180265][ T24] audit: type=1400 audit(1781557532.850:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 32.180423][ T293] cgroup: Unknown subsys name 'devices' [ 32.291720][ T293] cgroup: Unknown subsys name 'hugetlb' [ 32.298452][ T293] cgroup: Unknown subsys name 'rlimit' [ 32.410624][ T24] audit: type=1400 audit(1781557533.110:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 32.425517][ T297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 32.450333][ T24] audit: type=1400 audit(1781557533.110:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 32.499045][ T24] audit: type=1400 audit(1781557533.110:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 32.499077][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 32.530077][ T24] audit: type=1400 audit(1781557533.110:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 33.003416][ T300] request_module fs-gadgetfs succeeded, but still no fs? [ 33.017949][ T300] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 33.673676][ T351] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.681571][ T351] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.689186][ T351] device bridge_slave_0 entered promiscuous mode [ 33.696599][ T351] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.705313][ T351] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.713860][ T351] device bridge_slave_1 entered promiscuous mode [ 33.750058][ T351] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.759015][ T351] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.767643][ T351] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.776124][ T351] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.795910][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 33.804700][ T310] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.812940][ T310] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.822519][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 33.830941][ T310] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.838074][ T310] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.851583][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 33.859961][ T310] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.867021][ T310] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.878590][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 33.892242][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 33.905027][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 33.916235][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 33.924994][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 33.933919][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 33.947895][ T351] device veth0_vlan entered promiscuous mode [ 33.957468][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 33.967904][ T351] device veth1_macvtap entered promiscuous mode [ 33.978451][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 33.993055][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/06/15 21:05:34 executed programs: 0 [ 34.193082][ T365] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.201677][ T365] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.210651][ T365] device bridge_slave_0 entered promiscuous mode [ 34.219453][ T365] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.227235][ T365] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.236234][ T365] device bridge_slave_1 entered promiscuous mode [ 34.282871][ T365] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.290842][ T365] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.300616][ T365] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.310961][ T365] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.336959][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 34.347259][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.355226][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.366966][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 34.376631][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.386661][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.396346][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 34.406181][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.415073][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.429557][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 34.443348][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 34.460741][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 34.475569][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 34.484754][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 34.494015][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 34.505111][ T365] device veth0_vlan entered promiscuous mode [ 34.515071][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 34.524367][ T365] device veth1_macvtap entered promiscuous mode [ 34.533923][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 34.543784][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 34.565616][ T397] ================================================================== [ 34.574821][ T397] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0x875/0x3330 [ 34.585826][ T397] Read of size 8 at addr ffff888110ce97c0 by task syz.2.17/397 [ 34.593775][ T397] [ 34.596876][ T397] CPU: 0 PID: 397 Comm: syz.2.17 Not tainted syzkaller #0 [ 34.604395][ T397] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 34.615372][ T397] Call Trace: [ 34.619541][ T397] __dump_stack+0x21/0x24 [ 34.624355][ T397] dump_stack_lvl+0x1a7/0x208 [ 34.629026][ T397] ? show_regs_print_info+0x18/0x18 [ 34.634650][ T397] ? thaw_kernel_threads+0x220/0x220 [ 34.641039][ T397] print_address_description+0x7f/0x2c0 [ 34.648327][ T397] ? tc_setup_flow_action+0x875/0x3330 [ 34.654942][ T397] kasan_report+0x100/0x140 [ 34.660337][ T397] ? _raw_spin_lock_irq+0xf0/0xf0 [ 34.667040][ T397] ? tc_setup_flow_action+0x875/0x3330 [ 34.676332][ T397] __asan_report_load8_noabort+0x14/0x20 [ 34.684555][ T397] tc_setup_flow_action+0x875/0x3330 [ 34.692462][ T397] ? __kmalloc+0x19f/0x330 [ 34.699288][ T397] ? tcf_exts_num_actions+0x28b/0x2b0 [ 34.705913][ T397] mall_replace_hw_filter+0x2db/0x8c0 [ 34.714700][ T397] ? pcpu_block_update_hint_alloc+0x8b7/0xc50 [ 34.725759][ T397] ? mall_set_parms+0x450/0x450 [ 34.731969][ T397] ? tcf_exts_destroy+0xb0/0xb0 [ 34.741705][ T397] ? pcpu_alloc+0xf8d/0x16c0 [ 34.746834][ T397] ? mall_set_parms+0x1a0/0x450 [ 34.752520][ T397] mall_change+0x546/0x770 [ 34.758079][ T397] ? __kasan_check_write+0x14/0x20 [ 34.764788][ T397] ? mall_get+0xa0/0xa0 [ 34.769864][ T397] ? tcf_chain_tp_insert_unique+0x946/0xa70 [ 34.777020][ T397] tc_new_tfilter+0x1487/0x1ab0 [ 34.782152][ T397] ? mall_get+0xa0/0xa0 [ 34.787402][ T397] ? tcf_gate_entry_destructor+0x20/0x20 [ 34.793738][ T397] ? security_capable+0x87/0xb0 [ 34.799053][ T397] ? ns_capable+0x8c/0xf0 [ 34.805666][ T397] ? netlink_net_capable+0x125/0x160 [ 34.813633][ T397] ? tcf_gate_entry_destructor+0x20/0x20 [ 34.820214][ T397] rtnetlink_rcv_msg+0x811/0xca0 [ 34.825547][ T397] ? unwind_get_return_address+0x4d/0x90 [ 34.834470][ T397] ? rtnetlink_bind+0x80/0x80 [ 34.839448][ T397] ? stack_trace_save+0xa6/0xf0 [ 34.845406][ T397] ? stack_trace_snprint+0xe0/0xe0 [ 34.851709][ T397] ? do_syscall_64+0x31/0x40 [ 34.856978][ T397] ? avc_has_perm+0x168/0x3d0 [ 34.862770][ T397] ? memcpy+0x56/0x70 [ 34.867519][ T397] ? avc_has_perm+0x27f/0x3d0 [ 34.873779][ T397] ? __kasan_slab_alloc+0xc9/0xe0 [ 34.879873][ T397] ? avc_has_perm_noaudit+0x260/0x260 [ 34.885841][ T397] ? entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 34.893451][ T397] ? selinux_nlmsg_lookup+0x398/0x430 [ 34.900291][ T397] netlink_rcv_skb+0x1e9/0x430 [ 34.906853][ T397] ? rtnetlink_bind+0x80/0x80 [ 34.912309][ T397] ? netlink_ack+0xb30/0xb30 [ 34.918061][ T397] ? __netlink_lookup+0x387/0x3b0 [ 34.924264][ T397] rtnetlink_rcv+0x1c/0x20 [ 34.929535][ T397] netlink_unicast+0x86c/0xa30 [ 34.936829][ T397] netlink_sendmsg+0x949/0xb70 [ 34.942640][ T397] ? netlink_getsockopt+0x530/0x530 [ 34.951962][ T397] ? pagevec_add_and_need_flush+0x19d/0x2f0 [ 34.962844][ T397] ? security_socket_sendmsg+0x82/0xa0 [ 34.971301][ T397] ? netlink_getsockopt+0x530/0x530 [ 34.981095][ T397] ____sys_sendmsg+0x5be/0x8f0 [ 34.988968][ T397] ? __sys_sendmsg_sock+0x40/0x40 [ 34.998001][ T397] ? import_iovec+0x7c/0xb0 [ 35.004950][ T397] ___sys_sendmsg+0x236/0x2e0 [ 35.010169][ T397] ? __sys_sendmsg+0x280/0x280 [ 35.016048][ T397] ? __kasan_check_read+0x11/0x20 [ 35.022485][ T397] ? __fdget+0x15b/0x230 [ 35.028632][ T397] __x64_sys_sendmsg+0x201/0x2d0 [ 35.035683][ T397] ? __kasan_check_write+0x14/0x20 [ 35.042456][ T397] ? ___sys_sendmsg+0x2e0/0x2e0 [ 35.048380][ T397] ? debug_smp_processor_id+0x17/0x20 [ 35.055129][ T397] ? fpregs_assert_state_consistent+0xb1/0xe0 [ 35.063291][ T397] ? exit_to_user_mode_prepare+0x2f/0xa0 [ 35.071566][ T397] do_syscall_64+0x31/0x40 [ 35.078251][ T397] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 35.087207][ T397] RIP: 0033:0x7fbbe0c1fe59 [ 35.092350][ T397] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.119940][ T397] RSP: 002b:00007fffaf894ad8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 35.132554][ T397] RAX: ffffffffffffffda RBX: 00007fbbe0e98fa0 RCX: 00007fbbe0c1fe59 [ 35.144580][ T397] RDX: 0000000020000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 35.161121][ T397] RBP: 00007fbbe0cb5d6f R08: 0000000000000000 R09: 0000000000000000 [ 35.177276][ T397] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 35.191654][ T397] R13: 00007fbbe0e98fac R14: 00007fbbe0e98fa0 R15: 00007fbbe0e98fa0 [ 35.204930][ T397] [ 35.208024][ T397] Allocated by task 397: [ 35.215093][ T397] __kasan_kmalloc+0xd4/0x100 [ 35.224543][ T397] __kmalloc+0x19f/0x330 [ 35.233969][ T397] tcf_idr_create+0x5f/0x790 [ 35.243930][ T397] tcf_idr_create_from_flags+0x61/0x70 [ 35.252850][ T397] tcf_gact_init+0x2e6/0x560 [ 35.262632][ T397] tcf_action_init_1+0x443/0x6d0 [ 35.271798][ T397] tcf_action_init+0x227/0x780 [ 35.279497][ T397] tcf_exts_validate+0x23c/0x540 [ 35.289584][ T397] mall_set_parms+0x4a/0x450 [ 35.298186][ T397] mall_change+0x47a/0x770 [ 35.304018][ T397] tc_new_tfilter+0x1487/0x1ab0 [ 35.312886][ T397] rtnetlink_rcv_msg+0x811/0xca0 [ 35.319482][ T397] netlink_rcv_skb+0x1e9/0x430 [ 35.326088][ T397] rtnetlink_rcv+0x1c/0x20 [ 35.332650][ T397] netlink_unicast+0x86c/0xa30 [ 35.341538][ T397] netlink_sendmsg+0x949/0xb70 [ 35.348166][ T397] ____sys_sendmsg+0x5be/0x8f0 [ 35.357067][ T397] ___sys_sendmsg+0x236/0x2e0 [ 35.364328][ T397] __x64_sys_sendmsg+0x201/0x2d0 [ 35.373273][ T397] do_syscall_64+0x31/0x40 [ 35.382342][ T397] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 35.392378][ T397] [ 35.397365][ T397] The buggy address belongs to the object at ffff888110ce9700 [ 35.397365][ T397] which belongs to the cache kmalloc-192 of size 192 [ 35.423346][ T397] The buggy address is located 0 bytes to the right of [ 35.423346][ T397] 192-byte region [ffff888110ce9700, ffff888110ce97c0) [ 35.446057][ T397] The buggy address belongs to the page: [ 35.458639][ T397] page:ffffea0004433a40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x110ce9 [ 35.474509][ T397] flags: 0x4000000000000200(slab) [ 35.481662][ T397] raw: 4000000000000200 dead000000000100 dead000000000122 ffff888100043380 [ 35.496784][ T397] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 35.511131][ T397] page dumped because: kasan: bad access detected [ 35.521332][ T397] page_owner tracks the page as allocated [ 35.529028][ T397] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 365, ts 34560302914, free_ts 34559572223 [ 35.548686][ T397] prep_new_page+0x176/0x190 [ 35.553513][ T397] get_page_from_freelist+0x225f/0x23f0 [ 35.559545][ T397] __alloc_pages_nodemask+0x29a/0x640 [ 35.565733][ T397] new_slab+0x84/0x3f0 [ 35.569962][ T397] ___slab_alloc+0x2f8/0x4c0 [ 35.574877][ T397] __slab_alloc+0x63/0xa0 [ 35.579516][ T397] kmem_cache_alloc_trace+0x1a8/0x2e0 [ 35.585456][ T397] kernfs_fop_open+0x375/0xbb0 [ 35.591778][ T397] do_dentry_open+0x7a5/0x10a0 [ 35.598335][ T397] vfs_open+0x73/0x80 [ 35.603402][ T397] path_openat+0x26c3/0x3040 [ 35.610533][ T397] do_filp_open+0x1df/0x400 [ 35.617331][ T397] do_sys_openat2+0x19f/0x750 [ 35.623736][ T397] __x64_sys_openat+0x136/0x160 [ 35.630051][ T397] do_syscall_64+0x31/0x40 [ 35.635466][ T397] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 35.645622][ T397] page last free stack trace: [ 35.651476][ T397] free_unref_page_prepare+0x2b7/0x2d0 [ 35.659595][ T397] __free_pages+0x146/0x390 [ 35.664185][ T397] free_pages+0x82/0x90 [ 35.669729][ T397] selinux_genfs_get_sid+0x20b/0x250 [ 35.676946][ T397] inode_doinit_with_dentry+0x879/0xd70 [ 35.683683][ T397] sb_finish_set_opts+0x69b/0x7d0 [ 35.689703][ T397] selinux_set_mnt_opts+0x1482/0x1ac0 [ 35.696230][ T397] security_sb_set_mnt_opts+0x71/0xd0 [ 35.702119][ T397] vfs_get_tree+0x14e/0x260 [ 35.706954][ T397] do_new_mount+0x25a/0xa30 [ 35.711855][ T397] path_mount+0x581/0xca0 [ 35.716373][ T397] __se_sys_mount+0x320/0x390 [ 35.721799][ T397] __x64_sys_mount+0xbf/0xd0 [ 35.727093][ T397] do_syscall_64+0x31/0x40 [ 35.732357][ T397] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 35.739520][ T397] [ 35.741892][ T397] Memory state around the buggy address: [ 35.749195][ T397] ffff888110ce9680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.758806][ T397] ffff888110ce9700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.767609][ T397] >ffff888110ce9780: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 35.776642][ T397] ^ [ 35.783219][ T397] ffff888110ce9800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 35.791742][ T397] ffff888110ce9880: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 35.800577][ T397] ================================================================== [ 35.810272][ T397] Disabling lock debugging due to kernel taint [ 36.220748][ T7] device bridge_slave_1 left promiscuous mode [ 36.231334][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.241728][ T7] device bridge_slave_0 left promiscuous mode [ 36.253518][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.264217][ T7] device veth1_macvtap left promiscuous mode [ 36.273392][ T7] device veth0_vlan left promiscuous mode 2026/06/15 21:05:39 executed programs: 192 2026/06/15 21:05:44 executed programs: 492