Warning: Permanently added '10.128.0.103' (ED25519) to the list of known hosts. 2026/11/08 06:48:37 parsed 1 programs 2026/11/08 06:48:37 serving rpc on tcp://46307 [ 42.410651][ T29] kauditd_printk_skb: 1 callbacks suppressed [ 42.410672][ T29] audit: type=1400 audit(1794120517.377:77): avc: denied { node_bind } for pid=2976 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 42.412622][ T29] audit: type=1400 audit(1794120517.387:78): avc: denied { module_request } for pid=2976 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 44.074461][ T29] audit: type=1400 audit(1794120519.047:79): avc: denied { mounton } for pid=2987 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 44.075750][ T29] audit: type=1400 audit(1794120519.047:80): avc: denied { mount } for pid=2987 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 44.077682][ T2987] cgroup: Unknown subsys name 'net' [ 44.079105][ T29] audit: type=1400 audit(1794120519.047:81): avc: denied { unmount } for pid=2987 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 44.223701][ T2987] cgroup: Unknown subsys name 'cpuset' [ 44.231686][ T2987] cgroup: Unknown subsys name 'rlimit' [ 44.373382][ T29] audit: type=1400 audit(1794120519.347:82): avc: denied { setattr } for pid=2987 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 44.373996][ T29] audit: type=1400 audit(1794120519.347:83): avc: denied { create } for pid=2987 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 44.374270][ T29] audit: type=1400 audit(1794120519.347:84): avc: denied { write } for pid=2987 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 44.374586][ T29] audit: type=1400 audit(1794120519.347:85): avc: denied { read } for pid=2987 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 44.425433][ T29] audit: type=1400 audit(1794120519.357:86): avc: denied { sys_module } for pid=2987 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 44.516357][ T2991] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 44.547208][ T2987] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 46.037746][ T2994] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 56.822452][ T3038] syz-executor (3038) used greatest stack depth: 22664 bytes left [ 56.840429][ T29] kauditd_printk_skb: 35 callbacks suppressed [ 56.840456][ T29] audit: type=1400 audit(1794120531.807:122): avc: denied { create } for pid=3492 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 2026/11/08 06:48:53 executed programs: 0 [ 58.594050][ T29] audit: type=1400 audit(1794120533.567:123): avc: denied { create } for pid=3532 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 2026/11/08 06:49:03 executed programs: 2 [ 68.381367][ T29] audit: type=1400 audit(1794120543.347:124): avc: denied { read write } for pid=3983 comm="syz.3.17" name="raw-gadget" dev="devtmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 68.381436][ T29] audit: type=1400 audit(1794120543.347:125): avc: denied { open } for pid=3983 comm="syz.3.17" path="/dev/raw-gadget" dev="devtmpfs" ino=236 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 68.381483][ T29] audit: type=1400 audit(1794120543.347:126): avc: denied { ioctl } for pid=3983 comm="syz.3.17" path="/dev/raw-gadget" dev="devtmpfs" ino=236 ioctlcmd=0x41015500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 68.621633][ T915] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 68.772870][ T915] usb 4-1: New USB device found: idVendor=18d1, idProduct=1eaf, bcdDevice=0.00 [ 68.774107][ T915] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 68.774125][ T915] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 68.775965][ T915] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 68.775980][ T915] usb 4-1: Product: syz [ 68.775990][ T915] usb 4-1: Manufacturer: syz [ 68.775999][ T915] usb 4-1: SerialNumber: syz [ 69.794236][ T86] greybus 1-svc: unexpected request 0x7f received (state 0) [ 69.794392][ T86] ================================================================== [ 69.794403][ T86] BUG: KASAN: slab-out-of-bounds in gb_operation_work+0x8be/0x990 [ 69.794457][ T86] Read of size 2 at addr ffff88810cef5fc2 by task kworker/u8:5/86 [ 69.794476][ T86] [ 69.794495][ T86] CPU: 1 UID: 0 PID: 86 Comm: kworker/u8:5 Not tainted syzkaller #0 PREEMPT(lazy) [ 69.794518][ T86] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 69.794537][ T86] Workqueue: greybus1:0 gb_operation_work [ 69.794570][ T86] Call Trace: [ 69.794578][ T86] [ 69.794586][ T86] dump_stack_lvl+0x100/0x190 [ 69.794606][ T86] print_report+0x13d/0x4b0 [ 69.794638][ T86] ? __virt_addr_valid+0x239/0x430 [ 69.794655][ T86] ? gb_operation_work+0x8be/0x990 [ 69.794673][ T86] kasan_report+0xdf/0x1c0 [ 69.794688][ T86] ? gb_operation_work+0x8be/0x990 [ 69.794708][ T86] gb_operation_work+0x8be/0x990 [ 69.794728][ T86] process_one_work+0xac7/0x1b10 [ 69.794750][ T86] ? __pfx_process_one_work+0x10/0x10 [ 69.794768][ T86] ? lock_acquire+0x1d1/0x380 [ 69.794782][ T86] ? __pfx_gb_operation_work+0x10/0x10 [ 69.794802][ T86] worker_thread+0x5ef/0xe50 [ 69.794822][ T86] ? kthread+0x13a/0x450 [ 69.794837][ T86] ? __pfx_worker_thread+0x10/0x10 [ 69.794854][ T86] kthread+0x373/0x450 [ 69.794869][ T86] ? __pfx_kthread+0x10/0x10 [ 69.794885][ T86] ret_from_fork+0x69f/0xc90 [ 69.794902][ T86] ? __pfx_ret_from_fork+0x10/0x10 [ 69.794917][ T86] ? __switch_to+0x7f6/0x10d0 [ 69.794929][ T86] ? __switch_to_asm+0x39/0x70 [ 69.794946][ T86] ? __pfx_kthread+0x10/0x10 [ 69.794962][ T86] ret_from_fork_asm+0x1a/0x30 [ 69.794983][ T86] [ 69.794987][ T86] [ 69.794990][ T86] Allocated by task 915: [ 69.794999][ T86] kasan_save_stack+0x30/0x50 [ 69.795017][ T86] kasan_save_track+0x14/0x30 [ 69.795035][ T86] __kasan_kmalloc+0x8f/0xa0 [ 69.795052][ T86] __kmalloc_noprof+0x315/0x7e0 [ 69.795065][ T86] gb_operation_message_alloc+0x9b/0x2c0 [ 69.795081][ T86] gb_operation_create_common+0x9f/0x710 [ 69.795099][ T86] gb_connection_recv+0x1dc/0x1050 [ 69.795116][ T86] greybus_data_rcvd+0x244/0x600 [ 69.795129][ T86] cport_in_callback+0x1fb/0x280 [ 69.795147][ T86] __usb_hcd_giveback_urb+0x38e/0x610 [ 69.795163][ T86] usb_hcd_giveback_urb+0x3ca/0x4a0 [ 69.795177][ T86] dummy_timer+0xdb5/0x3840 [ 69.795193][ T86] __hrtimer_run_queues+0x448/0x9a0 [ 69.795209][ T86] hrtimer_run_softirq+0x1ca/0x360 [ 69.795224][ T86] handle_softirqs+0x209/0xa00 [ 69.795241][ T86] __irq_exit_rcu+0x17a/0x220 [ 69.795258][ T86] irq_exit_rcu+0x9/0x30 [ 69.795275][ T86] sysvec_apic_timer_interrupt+0x8f/0xb0 [ 69.795288][ T86] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 69.795302][ T86] [ 69.795304][ T86] The buggy address belongs to the object at ffff88810cef5fc0 [ 69.795304][ T86] which belongs to the cache kmalloc-8 of size 8 [ 69.795314][ T86] The buggy address is located 2 bytes inside of [ 69.795314][ T86] allocated 3-byte region [ffff88810cef5fc0, ffff88810cef5fc3) [ 69.795326][ T86] [ 69.795328][ T86] The buggy address belongs to the physical page: [ 69.795335][ T86] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88810cef5340 pfn:0x10cef5 [ 69.795349][ T86] flags: 0x200000000000200(workingset|node=0|zone=2) [ 69.795368][ T86] page_type: f5(slab) [ 69.795384][ T86] raw: 0200000000000200 ffff888100041500 ffff888100040348 ffffea000484a0d0 [ 69.795407][ T86] raw: ffff88810cef5340 000000000080007e 00000000f5000000 0000000000000000 [ 69.795417][ T86] page dumped because: kasan: bad access detected [ 69.795424][ T86] page_owner tracks the page as allocated [ 69.795428][ T86] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 3916937894 [ 69.795448][ T86] post_alloc_hook+0xfd/0x120 [ 69.795466][ T86] get_page_from_freelist+0xf4b/0x3440 [ 69.795484][ T86] __alloc_frozen_pages_noprof+0x299/0x2d50 [ 69.795503][ T86] new_slab+0xb1/0x6d0 [ 69.795513][ T86] refill_objects+0xe3/0x410 [ 69.795524][ T86] __pcs_replace_empty_main+0x35e/0x650 [ 69.795535][ T86] __kmalloc_noprof+0x617/0x7e0 [ 69.795548][ T86] acpi_ns_internalize_name+0x161/0x2e0 [ 69.795562][ T86] acpi_ns_get_node_unlocked+0x18c/0x500 [ 69.795575][ T86] acpi_ns_get_node+0x6c/0xf0 [ 69.795587][ T86] acpi_ns_evaluate+0xb01/0x1670 [ 69.795604][ T86] acpi_rs_set_srs_method_data+0x314/0x3d0 [ 69.795622][ T86] acpi_set_current_resources+0x129/0x200 [ 69.795639][ T86] acpi_pci_link_set+0x4c7/0xa80 [ 69.795657][ T86] acpi_pci_link_allocate_irq+0x2bd/0xc70 [ 69.795675][ T86] acpi_pci_irq_enable+0x28c/0x6f0 [ 69.795692][ T86] page_owner free stack trace missing [ 69.795697][ T86] [ 69.795699][ T86] Memory state around the buggy address: [ 69.795706][ T86] ffff88810cef5e80: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc [ 69.795714][ T86] ffff88810cef5f00: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc [ 69.795723][ T86] >ffff88810cef5f80: fa fc fc fc 00 fc fc fc 03 fc fc fc fa fc fc fc [ 69.795729][ T86] ^ [ 69.795735][ T86] ffff88810cef6000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 69.795744][ T86] ffff88810cef6080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 69.795750][ T86] ================================================================== [ 69.795784][ T86] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 70.333782][ T86] CPU: 1 UID: 0 PID: 86 Comm: kworker/u8:5 Not tainted syzkaller #0 PREEMPT(lazy) [ 70.343058][ T86] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 70.353283][ T86] Workqueue: greybus1:0 gb_operation_work [ 70.359013][ T86] Call Trace: [ 70.362279][ T86] [ 70.365213][ T86] dump_stack_lvl+0x100/0x190 [ 70.369888][ T86] vpanic+0x2dc/0x6f8 [ 70.373857][ T86] panic+0xd1/0xe0 [ 70.377562][ T86] ? __pfx_panic+0x10/0x10 [ 70.381962][ T86] ? gb_operation_work+0x8be/0x990 [ 70.387062][ T86] ? preempt_schedule+0x57/0xd0 [ 70.391897][ T86] check_panic_on_warn.cold+0x19/0x34 [ 70.397256][ T86] end_report.part.0+0x3a/0x90 [ 70.402011][ T86] kasan_report.cold+0xe/0x18 [ 70.406684][ T86] ? gb_operation_work+0x8be/0x990 [ 70.411788][ T86] gb_operation_work+0x8be/0x990 [ 70.416716][ T86] process_one_work+0xac7/0x1b10 [ 70.421662][ T86] ? __pfx_process_one_work+0x10/0x10 [ 70.427019][ T86] ? lock_acquire+0x1d1/0x380 [ 70.431680][ T86] ? __pfx_gb_operation_work+0x10/0x10 [ 70.437147][ T86] worker_thread+0x5ef/0xe50 [ 70.441730][ T86] ? kthread+0x13a/0x450 [ 70.445960][ T86] ? __pfx_worker_thread+0x10/0x10 [ 70.451056][ T86] kthread+0x373/0x450 [ 70.455111][ T86] ? __pfx_kthread+0x10/0x10 [ 70.459706][ T86] ret_from_fork+0x69f/0xc90 [ 70.464289][ T86] ? __pfx_ret_from_fork+0x10/0x10 [ 70.469387][ T86] ? __switch_to+0x7f6/0x10d0 [ 70.474047][ T86] ? __switch_to_asm+0x39/0x70 [ 70.478795][ T86] ? __pfx_kthread+0x10/0x10 [ 70.483373][ T86] ret_from_fork_asm+0x1a/0x30 [ 70.488134][ T86] [ 70.491390][ T86] Kernel Offset: disabled [ 70.495704][ T86] Rebooting in 86400 seconds..