Warning: Permanently added '10.128.1.95' (ED25519) to the list of known hosts. 2026/05/24 22:32:00 parsed 1 programs [ 25.470849][ T28] audit: type=1400 audit(1779661920.698:64): avc: denied { node_bind } for pid=295 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 25.491689][ T28] audit: type=1400 audit(1779661920.698:65): avc: denied { module_request } for pid=295 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 26.619452][ T28] audit: type=1400 audit(1779661921.848:66): avc: denied { mounton } for pid=301 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 26.623057][ T301] cgroup: Unknown subsys name 'net' [ 26.642449][ T28] audit: type=1400 audit(1779661921.848:67): avc: denied { mount } for pid=301 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.669764][ T28] audit: type=1400 audit(1779661921.878:68): avc: denied { unmount } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.670298][ T301] cgroup: Unknown subsys name 'devices' [ 26.788177][ T301] cgroup: Unknown subsys name 'hugetlb' [ 26.793840][ T301] cgroup: Unknown subsys name 'rlimit' [ 26.937593][ T28] audit: type=1400 audit(1779661922.168:69): avc: denied { setattr } for pid=301 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 26.960845][ T28] audit: type=1400 audit(1779661922.168:70): avc: denied { create } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.981423][ T28] audit: type=1400 audit(1779661922.168:71): avc: denied { write } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 27.001889][ T28] audit: type=1400 audit(1779661922.168:72): avc: denied { read } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 27.022300][ T28] audit: type=1400 audit(1779661922.168:73): avc: denied { mounton } for pid=301 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 27.030246][ T305] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 27.073171][ T301] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 27.775925][ T308] request_module fs-gadgetfs succeeded, but still no fs? [ 28.353356][ T348] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.360535][ T348] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.368086][ T348] device bridge_slave_0 entered promiscuous mode [ 28.375435][ T348] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.382776][ T348] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.390423][ T348] device bridge_slave_1 entered promiscuous mode [ 28.438478][ T348] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.445571][ T348] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.453066][ T348] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.460141][ T348] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.482402][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.490129][ T325] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.497760][ T325] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.507124][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 28.515490][ T325] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.522577][ T325] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.531589][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 28.540483][ T325] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.547598][ T325] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.560385][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 28.569724][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 28.584334][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 28.595953][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 28.604321][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 28.612208][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 28.620704][ T348] device veth0_vlan entered promiscuous mode [ 28.631403][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 28.640879][ T348] device veth1_macvtap entered promiscuous mode [ 28.651259][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.661934][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 28.699214][ T348] syz-executor (348) used greatest stack depth: 21984 bytes left 2026/05/24 22:32:04 executed programs: 0 [ 29.232686][ T370] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.240334][ T370] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.248148][ T370] device bridge_slave_0 entered promiscuous mode [ 29.255360][ T370] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.262531][ T370] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.270028][ T370] device bridge_slave_1 entered promiscuous mode [ 29.318668][ T370] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.325770][ T370] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.333237][ T370] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.340315][ T370] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.361415][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.369415][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.376986][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.386906][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.395153][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.402239][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.411257][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.419913][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.426991][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.440023][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.449426][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.464194][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 29.476516][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 29.484683][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 29.492620][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 29.506242][ T370] device veth0_vlan entered promiscuous mode [ 29.516944][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 29.526725][ T370] device veth1_macvtap entered promiscuous mode [ 29.536952][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 29.551688][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 29.927432][ T43] device bridge_slave_1 left promiscuous mode [ 29.933591][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.941222][ T43] device bridge_slave_0 left promiscuous mode [ 29.947491][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.955866][ T43] device veth1_macvtap left promiscuous mode [ 29.957577][ C1] hrtimer: interrupt took 29862 ns [ 29.962945][ T43] device veth0_vlan left promiscuous mode [ 30.044532][ C1] ================================================================== [ 30.052663][ C1] BUG: KASAN: slab-out-of-bounds in __bpf_get_stackid+0x6fa/0x960 [ 30.060516][ C1] Write of size 32 at addr ffff88810e3e2b60 by task syz.2.43/401 [ 30.068261][ C1] [ 30.070597][ C1] CPU: 1 PID: 401 Comm: syz.2.43 Not tainted syzkaller #0 [ 30.077735][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 30.087815][ C1] Call Trace: [ 30.091126][ C1] [ 30.094062][ C1] __dump_stack+0x21/0x24 [ 30.098442][ C1] dump_stack_lvl+0x110/0x170 [ 30.103140][ C1] ? __cfi_dump_stack_lvl+0x8/0x8 [ 30.108318][ C1] ? __bpf_get_stackid+0x6fa/0x960 [ 30.113442][ C1] print_address_description+0x71/0x200 [ 30.118994][ C1] print_report+0x4a/0x60 [ 30.123592][ C1] kasan_report+0x122/0x150 [ 30.128106][ C1] ? __bpf_get_stackid+0x6fa/0x960 [ 30.133224][ C1] kasan_check_range+0x249/0x2a0 [ 30.138191][ C1] ? __bpf_get_stackid+0x6fa/0x960 [ 30.143307][ C1] memcpy+0x44/0x70 [ 30.147122][ C1] __bpf_get_stackid+0x6fa/0x960 [ 30.152065][ C1] bpf_get_stackid_pe+0x350/0x400 [ 30.157107][ C1] bpf_prog_644fb7c94e15512a+0x2b/0x40 [ 30.162592][ C1] bpf_overflow_handler+0x3d0/0x5e0 [ 30.167811][ C1] ? __cfi_bpf_overflow_handler+0x10/0x10 [ 30.173539][ C1] ? kvm_sched_clock_read+0x18/0x40 [ 30.178762][ C1] ? __this_cpu_preempt_check+0x13/0x20 [ 30.184354][ C1] ? __perf_event_account_interrupt+0x1a4/0x2c0 [ 30.190637][ C1] __perf_event_overflow+0x437/0x620 [ 30.195962][ C1] perf_swevent_hrtimer+0x400/0x5b0 [ 30.201195][ C1] ? should_fail+0xb/0x10 [ 30.205629][ C1] ? get_futex_key+0x641/0xb10 [ 30.210420][ C1] ? __cfi_perf_swevent_hrtimer+0x10/0x10 [ 30.216174][ C1] ? __cfi_futex_wake+0x10/0x10 [ 30.221053][ C1] ? perf_ioctl+0x140e/0x1e70 [ 30.225758][ C1] ? timerqueue_del+0xd3/0x120 [ 30.230551][ C1] ? __cfi_perf_swevent_hrtimer+0x10/0x10 [ 30.236299][ C1] __hrtimer_run_queues+0x3bb/0x8e0 [ 30.241542][ C1] ? hrtimer_interrupt+0x8c0/0x8c0 [ 30.246681][ C1] ? ktime_get_update_offsets_now+0x30c/0x320 [ 30.252779][ C1] hrtimer_interrupt+0x3c7/0x8c0 [ 30.257744][ C1] __sysvec_apic_timer_interrupt+0x11e/0x440 [ 30.263745][ C1] sysvec_apic_timer_interrupt+0x53/0xc0 [ 30.269406][ C1] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 30.275410][ C1] RIP: 0033:0x7fdcb6a66068 [ 30.279849][ C1] Code: 00 00 83 ca 0a 41 89 d1 eb a8 0f 1f 84 00 00 00 00 00 80 b8 94 00 00 00 00 44 8b 90 90 00 00 00 74 90 eb de 66 0f 1f 44 00 00 <45> 31 d2 48 83 b8 88 00 00 00 ff 41 b9 03 00 00 00 ba 01 00 00 00 [ 30.299477][ C1] RSP: 002b:00007ffcf67b0e88 EFLAGS: 00000246 [ 30.305596][ C1] RAX: 00007fdcb6e15fa0 RBX: 0000000000000000 RCX: 0000000000000000 [ 30.313679][ C1] RDX: 0000000000000005 RSI: 0000000000000001 RDI: 00007fdcb6e15fa0 [ 30.321752][ C1] RBP: 00007fdcb6e15fb0 R08: 0000001b33120000 R09: 0000000000000007 [ 30.329742][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: 00007fdcb6e15fa0 [ 30.337725][ C1] R13: 0000200000000000 R14: 00007ffcf67b0e98 R15: 00007fdcb6e15fa0 [ 30.345721][ C1] [ 30.348761][ C1] [ 30.351097][ C1] Allocated by task 401: [ 30.355364][ C1] kasan_set_track+0x4b/0x70 [ 30.359978][ C1] kasan_save_alloc_info+0x25/0x30 [ 30.365108][ C1] __kasan_kmalloc+0x95/0xb0 [ 30.369715][ C1] __kmalloc_node+0xb2/0x1e0 [ 30.374318][ C1] bpf_map_area_alloc+0x4b/0xe0 [ 30.379198][ C1] prealloc_elems_and_freelist+0x8a/0x1e0 [ 30.385041][ C1] stack_map_alloc+0x3a7/0x530 [ 30.389821][ C1] map_create+0x49c/0xd80 [ 30.394169][ C1] __sys_bpf+0x34e/0x850 [ 30.398423][ C1] __x64_sys_bpf+0x7c/0x90 [ 30.402847][ C1] x64_sys_call+0x488/0x9a0 [ 30.407369][ C1] do_syscall_64+0x4c/0xa0 [ 30.411815][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 30.417731][ C1] [ 30.420070][ C1] The buggy address belongs to the object at ffff88810e3e2b00 [ 30.420070][ C1] which belongs to the cache kmalloc-128 of size 128 [ 30.434138][ C1] The buggy address is located 96 bytes inside of [ 30.434138][ C1] 128-byte region [ffff88810e3e2b00, ffff88810e3e2b80) [ 30.447428][ C1] [ 30.449772][ C1] The buggy address belongs to the physical page: [ 30.456193][ C1] page:ffffea000438f880 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10e3e2 [ 30.466458][ C1] flags: 0x4000000000000200(slab|zone=1) [ 30.472116][ C1] raw: 4000000000000200 dead000000000100 dead000000000122 ffff888100042a80 [ 30.480712][ C1] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 30.489304][ C1] page dumped because: kasan: bad access detected [ 30.495736][ C1] page_owner tracks the page as allocated [ 30.501458][ C1] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 3822885965, free_ts 0 [ 30.518230][ C1] post_alloc_hook+0x1f5/0x210 [ 30.523020][ C1] prep_new_page+0x1c/0x110 [ 30.527546][ C1] get_page_from_freelist+0x2d12/0x2d80 [ 30.533115][ C1] __alloc_pages+0x1fa/0x610 [ 30.537725][ C1] alloc_slab_page+0x6e/0xf0 [ 30.542333][ C1] new_slab+0x98/0x3d0 [ 30.546412][ C1] ___slab_alloc+0x6bd/0xb20 [ 30.551106][ C1] __slab_alloc+0x5e/0xa0 [ 30.555454][ C1] __kmem_cache_alloc_node+0x203/0x2c0 [ 30.560935][ C1] kmalloc_trace+0x29/0xb0 [ 30.565364][ C1] call_usermodehelper_setup+0x8e/0x210 [ 30.570925][ C1] kobject_uevent_env+0x66c/0x730 [ 30.575977][ C1] kobject_uevent+0x1d/0x30 [ 30.580515][ C1] driver_bound+0x453/0x4a0 [ 30.585032][ C1] really_probe+0x810/0x960 [ 30.589636][ C1] __driver_probe_device+0x198/0x280 [ 30.594940][ C1] page_owner free stack trace missing [ 30.600320][ C1] [ 30.602653][ C1] Memory state around the buggy address: [ 30.608301][ C1] ffff88810e3e2a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.616390][ C1] ffff88810e3e2a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.624468][ C1] >ffff88810e3e2b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 30.632628][ C1] ^ [ 30.640790][ C1] ffff88810e3e2b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.648873][ C1] ffff88810e3e2c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.656942][ C1] ================================================================== [ 30.665013][ C1] Disabling lock debugging due to kernel taint [ 30.681329][ T28] kauditd_printk_skb: 40 callbacks suppressed [ 30.681346][ T28] audit: type=1400 audit(1779661925.908:114): avc: denied { read } for pid=85 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 30.711593][ T28] audit: type=1400 audit(1779661925.908:115): avc: denied { search } for pid=85 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 30.733797][ T28] audit: type=1400 audit(1779661925.908:116): avc: denied { write } for pid=85 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 30.755246][ T28] audit: type=1400 audit(1779661925.908:117): avc: denied { add_name } for pid=85 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 30.776012][ T28] audit: type=1400 audit(1779661925.908:118): avc: denied { create } for pid=85 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 30.796900][ T28] audit: type=1400 audit(1779661925.908:119): avc: denied { append open } for pid=85 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 30.820218][ T28] audit: type=1400 audit(1779661925.908:120): avc: denied { getattr } for pid=85 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 2026/05/24 22:32:09 executed programs: 226 [ 34.207016][ T28] audit: type=1400 audit(1779661929.438:121): avc: denied { write } for pid=295 comm="syz-execprog" path="pipe:[15446]" dev="pipefs" ino=15446 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 2026/05/24 22:32:14 executed programs: 523