Warning: Permanently added '10.128.1.99' (ED25519) to the list of known hosts. 2026/06/30 13:17:15 parsed 1 programs 2026/06/30 13:17:15 serving rpc on tcp://43661 [ 25.197668][ T28] audit: type=1400 audit(1782825435.313:64): avc: denied { node_bind } for pid=295 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 25.219144][ T28] audit: type=1400 audit(1782825435.313:65): avc: denied { module_request } for pid=295 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 26.332181][ T28] audit: type=1400 audit(1782825436.443:66): avc: denied { mounton } for pid=301 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 26.335554][ T301] cgroup: Unknown subsys name 'net' [ 26.354953][ T28] audit: type=1400 audit(1782825436.443:67): avc: denied { mount } for pid=301 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.382284][ T28] audit: type=1400 audit(1782825436.473:68): avc: denied { unmount } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.382667][ T301] cgroup: Unknown subsys name 'devices' [ 26.525130][ T301] cgroup: Unknown subsys name 'hugetlb' [ 26.530762][ T301] cgroup: Unknown subsys name 'rlimit' [ 26.643574][ T28] audit: type=1400 audit(1782825436.763:69): avc: denied { setattr } for pid=301 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 26.666787][ T28] audit: type=1400 audit(1782825436.763:70): avc: denied { create } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.687280][ T28] audit: type=1400 audit(1782825436.763:71): avc: denied { write } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.707611][ T28] audit: type=1400 audit(1782825436.763:72): avc: denied { read } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 26.727963][ T28] audit: type=1400 audit(1782825436.763:73): avc: denied { mounton } for pid=301 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 26.729296][ T306] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 26.801295][ T301] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 27.497752][ T310] request_module fs-gadgetfs succeeded, but still no fs? [ 27.735751][ T324] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.742819][ T324] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.750344][ T324] device bridge_slave_0 entered promiscuous mode [ 27.757322][ T324] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.764407][ T324] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.771805][ T324] device bridge_slave_1 entered promiscuous mode [ 27.818663][ T324] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.825737][ T324] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.833057][ T324] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.840092][ T324] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.860972][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.868464][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.876125][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 27.883844][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.893928][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.902113][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.909193][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.918043][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.926303][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.933346][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.946682][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.955992][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.970222][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.982315][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.990577][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.998336][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 28.008155][ T324] device veth0_vlan entered promiscuous mode [ 28.018762][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 28.027878][ T324] device veth1_macvtap entered promiscuous mode [ 28.037537][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.047590][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 28.085626][ T324] syz-executor (324) used greatest stack depth: 21696 bytes left [ 28.745985][ T43] device bridge_slave_1 left promiscuous mode [ 28.752157][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.760065][ T43] device bridge_slave_0 left promiscuous mode [ 28.766325][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.774821][ T43] device veth1_macvtap left promiscuous mode [ 28.780887][ T43] device veth0_vlan left promiscuous mode 2026/06/30 13:17:18 executed programs: 0 [ 28.902336][ T371] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.909673][ T371] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.917232][ T371] device bridge_slave_0 entered promiscuous mode [ 28.924183][ T371] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.931300][ T371] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.938780][ T371] device bridge_slave_1 entered promiscuous mode [ 28.986148][ T371] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.993231][ T371] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.000474][ T371] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.007540][ T371] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.027591][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.035452][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.042698][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.052069][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.060435][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.067528][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.076643][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.085160][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.092212][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.106221][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.121207][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.131921][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 29.144864][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 29.152910][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 29.160610][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 29.168794][ T371] device veth0_vlan entered promiscuous mode [ 29.179104][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 29.188647][ T371] device veth1_macvtap entered promiscuous mode [ 29.199055][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 29.209187][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 29.242988][ C0] hrtimer: interrupt took 48242 ns [ 29.450188][ C0] ================================================================== [ 29.458706][ C0] BUG: KASAN: slab-out-of-bounds in __bpf_get_stackid+0x6fa/0x960 [ 29.466524][ C0] Write of size 32 at addr ffff88810e4f1260 by task syz.2.31/390 [ 29.474235][ C0] [ 29.476562][ C0] CPU: 0 PID: 390 Comm: syz.2.31 Not tainted syzkaller #0 [ 29.484281][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 29.494360][ C0] Call Trace: [ 29.497645][ C0] [ 29.500571][ C0] __dump_stack+0x21/0x24 [ 29.504904][ C0] dump_stack_lvl+0x110/0x170 [ 29.509666][ C0] ? __cfi_dump_stack_lvl+0x8/0x8 [ 29.514691][ C0] ? __bpf_get_stackid+0x6fa/0x960 [ 29.519819][ C0] print_address_description+0x71/0x200 [ 29.525362][ C0] print_report+0x4a/0x60 [ 29.529690][ C0] kasan_report+0x122/0x150 [ 29.534193][ C0] ? __bpf_get_stackid+0x6fa/0x960 [ 29.539304][ C0] kasan_check_range+0x249/0x2a0 [ 29.544240][ C0] ? __bpf_get_stackid+0x6fa/0x960 [ 29.549364][ C0] memcpy+0x44/0x70 [ 29.553196][ C0] __bpf_get_stackid+0x6fa/0x960 [ 29.558152][ C0] bpf_get_stackid_pe+0x350/0x400 [ 29.563182][ C0] bpf_prog_605fe31a3ae4ea37+0x2b/0x45 [ 29.568669][ C0] bpf_overflow_handler+0x3c7/0x5e0 [ 29.573871][ C0] ? memcpy+0x56/0x70 [ 29.577855][ C0] ? __cfi_bpf_overflow_handler+0x10/0x10 [ 29.583571][ C0] ? kvm_sched_clock_read+0x18/0x40 [ 29.588775][ C0] ? __this_cpu_preempt_check+0x13/0x20 [ 29.594338][ C0] ? __perf_event_account_interrupt+0x1a4/0x2c0 [ 29.600577][ C0] __perf_event_overflow+0x458/0x640 [ 29.605864][ C0] perf_swevent_hrtimer+0x4b4/0x540 [ 29.611064][ C0] ? irqentry_exit+0x37/0x40 [ 29.615671][ C0] ? sysvec_apic_timer_interrupt+0x64/0xc0 [ 29.621483][ C0] ? __cfi_perf_swevent_hrtimer+0x10/0x10 [ 29.627221][ C0] ? sysvec_apic_timer_interrupt+0x64/0xc0 [ 29.633045][ C0] ? timerqueue_del+0xd3/0x120 [ 29.637835][ C0] ? __cfi_perf_swevent_hrtimer+0x10/0x10 [ 29.643566][ C0] __hrtimer_run_queues+0x398/0x890 [ 29.648796][ C0] ? hrtimer_interrupt+0x8c0/0x8c0 [ 29.653915][ C0] ? ktime_get_update_offsets_now+0x30c/0x320 [ 29.659995][ C0] hrtimer_interrupt+0x3ad/0x8c0 [ 29.664942][ C0] __sysvec_apic_timer_interrupt+0x11e/0x440 [ 29.670933][ C0] sysvec_apic_timer_interrupt+0x53/0xc0 [ 29.676566][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 29.682548][ C0] RIP: 0033:0x7fbb364555f1 [ 29.686975][ C0] Code: 4c 24 18 48 8b 00 48 89 01 eb 91 48 8b 54 24 08 48 8d 35 bd d6 1d 00 48 8d 3d c0 d6 1d 00 31 c0 e8 14 ce ff ff 0f 1f 40 00 53 <48> 8b 1d a8 27 3c 00 45 31 d2 31 c9 48 8b 17 45 31 db 4c 8d 83 00 [ 29.706574][ C0] RSP: 002b:00007ffc1d0daa60 EFLAGS: 00000246 [ 29.712645][ C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fbb3659ce59 [ 29.720625][ C0] RDX: ffffffffffffffff RSI: 0000000000000081 RDI: 00007fbb36815fb0 [ 29.728600][ C0] RBP: 00007fbb36815fb0 R08: 0019512559d91bac R09: 0000000000000000 [ 29.736588][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fbb36815fa0 [ 29.744551][ C0] R13: 0000200000000000 R14: 00007ffc1d0daa78 R15: 00007fbb36815fa0 [ 29.752519][ C0] [ 29.755631][ C0] [ 29.757958][ C0] Allocated by task 390: [ 29.762203][ C0] kasan_set_track+0x4b/0x70 [ 29.766794][ C0] kasan_save_alloc_info+0x1f/0x30 [ 29.771917][ C0] __kasan_kmalloc+0x95/0xb0 [ 29.776510][ C0] __kmalloc_node+0xb2/0x1e0 [ 29.781094][ C0] bpf_map_area_alloc+0x4b/0xe0 [ 29.785944][ C0] prealloc_elems_and_freelist+0x8a/0x1e0 [ 29.791682][ C0] stack_map_alloc+0x398/0x520 [ 29.796447][ C0] map_create+0x467/0xcf0 [ 29.800771][ C0] __sys_bpf+0x34e/0x850 [ 29.805008][ C0] __x64_sys_bpf+0x7c/0x90 [ 29.809419][ C0] x64_sys_call+0x488/0x9a0 [ 29.813921][ C0] do_syscall_64+0x4c/0xa0 [ 29.818337][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 29.824230][ C0] [ 29.826546][ C0] The buggy address belongs to the object at ffff88810e4f1200 [ 29.826546][ C0] which belongs to the cache kmalloc-128 of size 128 [ 29.840591][ C0] The buggy address is located 96 bytes inside of [ 29.840591][ C0] 128-byte region [ffff88810e4f1200, ffff88810e4f1280) [ 29.853782][ C0] [ 29.856109][ C0] The buggy address belongs to the physical page: [ 29.862524][ C0] page:ffffea0004393c40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10e4f1 [ 29.872759][ C0] flags: 0x4000000000000200(slab|zone=1) [ 29.878433][ C0] raw: 4000000000000200 ffffea0004393e40 dead000000000003 ffff888100042a80 [ 29.887012][ C0] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 29.895632][ C0] page dumped because: kasan: bad access detected [ 29.902047][ C0] page_owner tracks the page as allocated [ 29.907758][ C0] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 3685217580, free_ts 0 [ 29.924370][ C0] post_alloc_hook+0x1f5/0x210 [ 29.929151][ C0] prep_new_page+0x1c/0x110 [ 29.933657][ C0] get_page_from_freelist+0x2ca9/0x2d20 [ 29.939205][ C0] __alloc_pages+0x1fa/0x610 [ 29.943804][ C0] alloc_slab_page+0x6e/0xf0 [ 29.948414][ C0] new_slab+0x98/0x3e0 [ 29.952477][ C0] ___slab_alloc+0x70f/0xb70 [ 29.957082][ C0] __slab_alloc+0x5e/0xa0 [ 29.961414][ C0] __kmem_cache_alloc_node+0x204/0x2d0 [ 29.966870][ C0] kmalloc_trace+0x29/0xb0 [ 29.971286][ C0] call_usermodehelper_setup+0x8e/0x210 [ 29.976837][ C0] kobject_uevent_env+0x650/0x720 [ 29.981868][ C0] kobject_uevent+0x1d/0x30 [ 29.986360][ C0] device_add+0xa1a/0xec0 [ 29.990682][ C0] usb_add_gadget+0x3dc/0x620 [ 29.995355][ C0] usb_add_gadget_udc+0x11a/0x150 [ 30.000383][ C0] page_owner free stack trace missing [ 30.005759][ C0] [ 30.008078][ C0] Memory state around the buggy address: [ 30.013786][ C0] ffff88810e4f1100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.021847][ C0] ffff88810e4f1180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.029910][ C0] >ffff88810e4f1200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 30.037985][ C0] ^ [ 30.045977][ C0] ffff88810e4f1280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.054032][ C0] ffff88810e4f1300: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc [ 30.062079][ C0] ================================================================== [ 30.070148][ C0] Disabling lock debugging due to kernel taint 2026/06/30 13:17:24 executed programs: 242 [ 33.893896][ T28] kauditd_printk_skb: 47 callbacks suppressed [ 33.893924][ T28] audit: type=1400 audit(1782825444.013:121): avc: denied { write } for pid=295 comm="syz-execprog" path="pipe:[14642]" dev="pipefs" ino=14642 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 2026/06/30 13:17:29 executed programs: 542