Warning: Permanently added '10.128.0.17' (ED25519) to the list of known hosts. 2026/06/04 08:19:34 parsed 1 programs [ 33.228190][ T28] audit: type=1400 audit(1780561174.891:64): avc: denied { node_bind } for pid=295 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 33.249028][ T28] audit: type=1400 audit(1780561174.901:65): avc: denied { module_request } for pid=295 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 34.360729][ T28] audit: type=1400 audit(1780561176.031:66): avc: denied { mounton } for pid=301 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 34.365499][ T301] cgroup: Unknown subsys name 'net' [ 34.388751][ T28] audit: type=1400 audit(1780561176.031:67): avc: denied { mount } for pid=301 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 34.411124][ T301] cgroup: Unknown subsys name 'devices' [ 34.411324][ T28] audit: type=1400 audit(1780561176.061:68): avc: denied { unmount } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 34.581347][ T301] cgroup: Unknown subsys name 'hugetlb' [ 34.587032][ T301] cgroup: Unknown subsys name 'rlimit' [ 34.701609][ T28] audit: type=1400 audit(1780561176.371:69): avc: denied { setattr } for pid=301 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 34.724927][ T28] audit: type=1400 audit(1780561176.371:70): avc: denied { create } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 34.745501][ T28] audit: type=1400 audit(1780561176.371:71): avc: denied { write } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 34.765913][ T28] audit: type=1400 audit(1780561176.371:72): avc: denied { read } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 34.773857][ T305] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 34.786864][ T28] audit: type=1400 audit(1780561176.371:73): avc: denied { mounton } for pid=301 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 34.827521][ T301] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 35.519937][ T309] request_module fs-gadgetfs succeeded, but still no fs? [ 35.813749][ T327] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.821359][ T327] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.828872][ T327] device bridge_slave_0 entered promiscuous mode [ 35.835930][ T327] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.843094][ T327] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.850960][ T327] device bridge_slave_1 entered promiscuous mode [ 35.899706][ T327] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.906761][ T327] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.914092][ T327] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.921159][ T327] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.942393][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.949913][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.957369][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 35.965151][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 35.974333][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 35.982592][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.989690][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.001635][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 36.009884][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.016915][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.027700][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 36.042690][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 36.053847][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 36.065413][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 36.073571][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 36.081450][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 36.089852][ T327] device veth0_vlan entered promiscuous mode [ 36.100691][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 36.110413][ T327] device veth1_macvtap entered promiscuous mode [ 36.119910][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 36.130847][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 36.167700][ T327] syz-executor (327) used greatest stack depth: 20704 bytes left 2026/06/04 08:19:38 executed programs: 0 [ 36.922155][ T371] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.929385][ T371] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.936801][ T371] device bridge_slave_0 entered promiscuous mode [ 36.944037][ T371] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.951171][ T371] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.958657][ T371] device bridge_slave_1 entered promiscuous mode [ 37.005241][ T371] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.012354][ T371] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.019698][ T371] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.026745][ T371] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.047199][ T367] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 37.054882][ T367] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.062409][ T367] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.078765][ T367] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 37.087397][ T367] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.094467][ T367] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.103921][ T367] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 37.112217][ T367] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.119278][ T367] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.138828][ T367] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 37.149286][ T367] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 37.163966][ T367] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 37.182500][ T367] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 37.191007][ T367] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 37.198449][ T367] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 37.207017][ T371] device veth0_vlan entered promiscuous mode [ 37.224762][ T367] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 37.234618][ T371] device veth1_macvtap entered promiscuous mode [ 37.244618][ T367] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 37.258982][ T367] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 37.297865][ C0] ================================================================== [ 37.305965][ C0] BUG: KASAN: slab-out-of-bounds in __bpf_get_stackid+0x6fa/0x960 [ 37.313796][ C0] Write of size 32 at addr ffff88810e4b0660 by task syz.2.19/378 [ 37.321507][ C0] [ 37.323838][ C0] CPU: 0 PID: 378 Comm: syz.2.19 Not tainted syzkaller #0 [ 37.330962][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 37.341040][ C0] Call Trace: [ 37.344318][ C0] [ 37.347246][ C0] __dump_stack+0x21/0x24 [ 37.351581][ C0] dump_stack_lvl+0x110/0x170 [ 37.356282][ C0] ? __cfi_dump_stack_lvl+0x8/0x8 [ 37.361331][ C0] ? event_sched_in+0xbc1/0xe00 [ 37.366207][ C0] ? __bpf_get_stackid+0x6fa/0x960 [ 37.371318][ C0] print_address_description+0x71/0x200 [ 37.377039][ C0] print_report+0x4a/0x60 [ 37.381456][ C0] kasan_report+0x122/0x150 [ 37.385967][ C0] ? __bpf_get_stackid+0x6fa/0x960 [ 37.391102][ C0] kasan_check_range+0x249/0x2a0 [ 37.396058][ C0] ? __bpf_get_stackid+0x6fa/0x960 [ 37.401169][ C0] memcpy+0x44/0x70 [ 37.404993][ C0] __bpf_get_stackid+0x6fa/0x960 [ 37.409927][ C0] bpf_get_stackid_pe+0x350/0x400 [ 37.414984][ C0] bpf_prog_f4539ffa51f05f93+0x24/0x37 [ 37.420454][ C0] bpf_overflow_handler+0x3d0/0x5e0 [ 37.425762][ C0] ? __cfi_bpf_overflow_handler+0x10/0x10 [ 37.431597][ C0] ? kvm_sched_clock_read+0x18/0x40 [ 37.436838][ C0] ? __this_cpu_preempt_check+0x13/0x20 [ 37.442394][ C0] ? __perf_event_account_interrupt+0x1a4/0x2c0 [ 37.448646][ C0] __perf_event_overflow+0x437/0x620 [ 37.453966][ C0] perf_swevent_hrtimer+0x400/0x5b0 [ 37.459179][ C0] ? should_fail+0xb/0x10 [ 37.463596][ C0] ? get_futex_key+0x641/0xb10 [ 37.468381][ C0] ? __cfi_perf_swevent_hrtimer+0x10/0x10 [ 37.474131][ C0] ? timerqueue_add+0x20e/0x230 [ 37.479090][ C0] ? timerqueue_del+0xd3/0x120 [ 37.483899][ C0] ? __cfi_perf_swevent_hrtimer+0x10/0x10 [ 37.489656][ C0] __hrtimer_run_queues+0x3bb/0x8e0 [ 37.494906][ C0] ? hrtimer_interrupt+0x8c0/0x8c0 [ 37.500040][ C0] ? ktime_get_update_offsets_now+0x30c/0x320 [ 37.506129][ C0] hrtimer_interrupt+0x3c7/0x8c0 [ 37.511091][ C0] __sysvec_apic_timer_interrupt+0x11e/0x440 [ 37.517093][ C0] sysvec_apic_timer_interrupt+0x53/0xc0 [ 37.522749][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 37.528753][ C0] RIP: 0033:0x7f7dae865715 [ 37.533209][ C0] Code: e8 60 52 ff ff 48 8b 05 69 00 ee 00 83 05 52 00 ee 00 01 be 08 00 00 00 48 89 ef 48 8d 50 ff 48 89 15 4f 00 ee 00 44 88 78 ff <44> 8b 3d 34 00 ee 00 e8 2f 52 ff ff 48 8b 05 40 00 ee 00 44 89 38 [ 37.552831][ C0] RSP: 002b:00007fff397590b0 EFLAGS: 00000202 [ 37.558933][ C0] RAX: 0000001b33e63fb0 RBX: 0000000000000000 RCX: 0000000000000000 [ 37.566914][ C0] RDX: 0000001b33e63faf RSI: 0000000000000008 RDI: 00007f7daf745720 [ 37.574921][ C0] RBP: 00007f7daf745720 R08: 0000000000000000 R09: 00007f7daec16038 [ 37.583081][ C0] R10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000000 [ 37.591065][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000003 [ 37.599057][ C0] [ 37.602089][ C0] [ 37.604420][ C0] Allocated by task 378: [ 37.608669][ C0] kasan_set_track+0x4b/0x70 [ 37.613284][ C0] kasan_save_alloc_info+0x25/0x30 [ 37.618407][ C0] __kasan_kmalloc+0x95/0xb0 [ 37.623006][ C0] __kmalloc_node+0xb2/0x1e0 [ 37.627608][ C0] bpf_map_area_alloc+0x4b/0xe0 [ 37.632470][ C0] prealloc_elems_and_freelist+0x8a/0x1e0 [ 37.638209][ C0] stack_map_alloc+0x3a7/0x530 [ 37.642982][ C0] map_create+0x49c/0xd80 [ 37.647320][ C0] __sys_bpf+0x34e/0x850 [ 37.651601][ C0] __x64_sys_bpf+0x7c/0x90 [ 37.656031][ C0] x64_sys_call+0x488/0x9a0 [ 37.660548][ C0] do_syscall_64+0x4c/0xa0 [ 37.664985][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 37.670984][ C0] [ 37.673316][ C0] The buggy address belongs to the object at ffff88810e4b0600 [ 37.673316][ C0] which belongs to the cache kmalloc-128 of size 128 [ 37.687385][ C0] The buggy address is located 96 bytes inside of [ 37.687385][ C0] 128-byte region [ffff88810e4b0600, ffff88810e4b0680) [ 37.700582][ C0] [ 37.702939][ C0] The buggy address belongs to the physical page: [ 37.709353][ C0] page:ffffea0004392c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10e4b0 [ 37.719699][ C0] flags: 0x4000000000000200(slab|zone=1) [ 37.725354][ C0] raw: 4000000000000200 dead000000000100 dead000000000122 ffff888100042a80 [ 37.733948][ C0] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 37.742531][ C0] page dumped because: kasan: bad access detected [ 37.748957][ C0] page_owner tracks the page as allocated [ 37.754682][ C0] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 3770545390, free_ts 0 [ 37.771296][ C0] post_alloc_hook+0x1f5/0x210 [ 37.776119][ C0] prep_new_page+0x1c/0x110 [ 37.780639][ C0] get_page_from_freelist+0x2d12/0x2d80 [ 37.786211][ C0] __alloc_pages+0x1fa/0x610 [ 37.790817][ C0] alloc_slab_page+0x6e/0xf0 [ 37.795417][ C0] new_slab+0x98/0x3d0 [ 37.799514][ C0] ___slab_alloc+0x6bd/0xb20 [ 37.804140][ C0] __slab_alloc+0x5e/0xa0 [ 37.808488][ C0] __kmem_cache_alloc_node+0x203/0x2c0 [ 37.813965][ C0] kmalloc_trace+0x29/0xb0 [ 37.818407][ C0] call_usermodehelper_setup+0x8e/0x210 [ 37.823991][ C0] kobject_uevent_env+0x66c/0x730 [ 37.829037][ C0] kobject_uevent+0x1d/0x30 [ 37.833555][ C0] device_add+0xa5c/0xef0 [ 37.837896][ C0] platform_device_add+0x49d/0x6f0 [ 37.843012][ C0] dummy_hcd_init+0xb3b/0x10d0 [ 37.847791][ C0] page_owner free stack trace missing [ 37.853187][ C0] [ 37.855518][ C0] Memory state around the buggy address: [ 37.861158][ C0] ffff88810e4b0500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 37.869225][ C0] ffff88810e4b0580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 37.877292][ C0] >ffff88810e4b0600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 37.885354][ C0] ^ [ 37.893338][ C0] ffff88810e4b0680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 37.901410][ C0] ffff88810e4b0700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 37.909488][ C0] ================================================================== [ 37.917552][ C0] Disabling lock debugging due to kernel taint [ 38.211775][ T43] device bridge_slave_1 left promiscuous mode [ 38.217970][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.225631][ T43] device bridge_slave_0 left promiscuous mode [ 38.231835][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.240808][ T43] device veth1_macvtap left promiscuous mode [ 38.246888][ T43] device veth0_vlan left promiscuous mode [ 38.249724][ C0] hrtimer: interrupt took 32780 ns 2026/06/04 08:19:43 executed programs: 237 2026/06/04 08:19:48 executed programs: 538