Warning: Permanently added '10.128.1.59' (ED25519) to the list of known hosts. 2026/01/20 13:07:56 parsed 1 programs [ 35.819364][ T30] audit: type=1400 audit(1768914476.486:64): avc: denied { node_bind } for pid=281 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 35.840753][ T30] audit: type=1400 audit(1768914476.486:65): avc: denied { module_request } for pid=281 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 36.461894][ T30] audit: type=1400 audit(1768914477.126:66): avc: denied { mounton } for pid=290 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 36.463051][ T290] cgroup: Unknown subsys name 'net' [ 36.484931][ T30] audit: type=1400 audit(1768914477.126:67): avc: denied { mount } for pid=290 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 36.512971][ T30] audit: type=1400 audit(1768914477.156:68): avc: denied { unmount } for pid=290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 36.513109][ T290] cgroup: Unknown subsys name 'devices' [ 36.684653][ T290] cgroup: Unknown subsys name 'hugetlb' [ 36.690286][ T290] cgroup: Unknown subsys name 'rlimit' [ 36.837880][ T30] audit: type=1400 audit(1768914477.506:69): avc: denied { setattr } for pid=290 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 36.861590][ T30] audit: type=1400 audit(1768914477.506:70): avc: denied { create } for pid=290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 36.882470][ T30] audit: type=1400 audit(1768914477.506:71): avc: denied { write } for pid=290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 36.888751][ T292] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 36.903204][ T30] audit: type=1400 audit(1768914477.506:72): avc: denied { read } for pid=290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 36.932355][ T30] audit: type=1400 audit(1768914477.506:73): avc: denied { mounton } for pid=290 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 36.939616][ T290] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 37.397163][ T296] request_module fs-gadgetfs succeeded, but still no fs? [ 37.812203][ T329] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.819384][ T329] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.827189][ T329] device bridge_slave_0 entered promiscuous mode [ 37.834878][ T329] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.841932][ T329] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.850065][ T329] device bridge_slave_1 entered promiscuous mode [ 37.887088][ T329] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.894172][ T329] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.901860][ T329] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.908982][ T329] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.929346][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.936595][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.944237][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 37.951837][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 37.960515][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 37.969058][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.976100][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.985042][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 37.993446][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.000464][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.012654][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 38.021626][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 38.034757][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 38.045329][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 38.053599][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 38.061256][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 38.069417][ T329] device veth0_vlan entered promiscuous mode [ 38.078896][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 38.087863][ T329] device veth1_macvtap entered promiscuous mode [ 38.096550][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 38.106471][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 38.133262][ T329] syz-executor (329) used greatest stack depth: 21184 bytes left 2026/01/20 13:07:59 executed programs: 0 [ 38.516087][ T362] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.523641][ T362] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.531152][ T362] device bridge_slave_0 entered promiscuous mode [ 38.542822][ T362] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.549853][ T362] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.557312][ T362] device bridge_slave_1 entered promiscuous mode [ 38.596222][ T362] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.603274][ T362] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.610514][ T362] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.617704][ T362] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.634699][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 38.642401][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.651025][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.659729][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 38.668135][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.675386][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.693928][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 38.702190][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.709363][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.718366][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 38.727072][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 38.742123][ T362] device veth0_vlan entered promiscuous mode [ 38.749232][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 38.757773][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 38.766233][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 38.773665][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 38.785391][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 38.794707][ T362] device veth1_macvtap entered promiscuous mode [ 38.803948][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 38.815680][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 38.824152][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 38.846137][ T373] loop2: detected capacity change from 0 to 512 [ 38.854981][ T373] EXT4-fs (loop2): Ignoring removed mblk_io_submit option [ 38.862302][ T373] EXT4-fs (loop2): mounting ext3 file system using the ext4 subsystem [ 38.871138][ T373] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a003c11c, mo2=0002] [ 38.879946][ T373] System zones: 1-12 [ 38.885054][ T373] EXT4-fs error (device loop2): ext4_xattr_ibody_find:2229: inode #15: comm syz.2.17: corrupted in-inode xattr [ 38.897081][ T373] EXT4-fs error (device loop2): ext4_orphan_get:1406: comm syz.2.17: couldn't read orphan inode 15 (err -117) [ 38.909111][ T373] EXT4-fs (loop2): mounted filesystem without journal. Opts: jqfmt=vfsold,grpid,debug,noload,noauto_da_alloc,commit=0x0000000000000005,init_itable=0x0000000000000009,debug,usrjquota=,nolazytime,mblk_io_submit,,errors=continue. Quota mode: none. [ 38.934938][ T373] EXT4-fs warning (device loop2): dx_probe:833: inode #2: comm syz.2.17: Unrecognised inode hash code 4 [ 38.946133][ T373] EXT4-fs warning (device loop2): dx_probe:966: inode #2: comm syz.2.17: Corrupt directory, running e2fsck is recommended [ 38.958964][ T373] ================================================================== [ 38.967308][ T373] BUG: KASAN: use-after-free in __ext4_check_dir_entry+0x7c2/0x970 [ 38.975716][ T373] Read of size 2 at addr ffff88812aa2e003 by task syz.2.17/373 [ 38.983325][ T373] [ 38.985645][ T373] CPU: 1 PID: 373 Comm: syz.2.17 Not tainted syzkaller #0 [ 38.992840][ T373] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 39.003069][ T373] Call Trace: [ 39.006504][ T373] [ 39.009567][ T373] __dump_stack+0x21/0x30 [ 39.013890][ T373] dump_stack_lvl+0x110/0x170 [ 39.018646][ T373] ? show_regs_print_info+0x20/0x20 [ 39.023917][ T373] ? load_image+0x3e0/0x3e0 [ 39.028840][ T373] print_address_description+0x7f/0x2c0 [ 39.034544][ T373] ? __ext4_check_dir_entry+0x7c2/0x970 [ 39.040245][ T373] kasan_report+0xf1/0x140 [ 39.044752][ T373] ? __ext4_check_dir_entry+0x7c2/0x970 [ 39.050415][ T373] __asan_report_load2_noabort+0x14/0x20 [ 39.056298][ T373] __ext4_check_dir_entry+0x7c2/0x970 [ 39.061650][ T373] ext4_readdir+0x123c/0x3b20 [ 39.066305][ T373] ? ext4_dir_llseek+0x4a0/0x4a0 [ 39.071309][ T373] ? __kasan_slab_free+0x11/0x20 [ 39.076392][ T373] ? slab_free_freelist_hook+0xc2/0x190 [ 39.081915][ T373] ? avc_policy_seqno+0x1b/0x70 [ 39.086769][ T373] ? down_read_killable+0xc1/0x110 [ 39.092104][ T373] ? down_read_interruptible+0x110/0x110 [ 39.098119][ T373] ? fsnotify_perm+0x269/0x5b0 [ 39.102955][ T373] ? security_file_permission+0x83/0xa0 [ 39.108500][ T373] iterate_dir+0x260/0x600 [ 39.112908][ T373] ? ext4_dir_llseek+0x4a0/0x4a0 [ 39.117842][ T373] __se_sys_getdents64+0xf2/0x250 [ 39.123139][ T373] ? __x64_sys_getdents64+0x90/0x90 [ 39.128334][ T373] ? mutex_unlock+0x8f/0x230 [ 39.132906][ T373] ? filldir+0x690/0x690 [ 39.137426][ T373] ? debug_smp_processor_id+0x17/0x20 [ 39.142778][ T373] __x64_sys_getdents64+0x7b/0x90 [ 39.147892][ T373] x64_sys_call+0x592/0x9a0 [ 39.152464][ T373] do_syscall_64+0x4c/0xa0 [ 39.156965][ T373] ? clear_bhb_loop+0x50/0xa0 [ 39.162179][ T373] ? clear_bhb_loop+0x50/0xa0 [ 39.166834][ T373] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 39.172714][ T373] RIP: 0033:0x7faeeecb1cb9 [ 39.177132][ T373] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 39.196822][ T373] RSP: 002b:00007ffd56366458 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9 [ 39.205219][ T373] RAX: ffffffffffffffda RBX: 00007faeeef2cfa0 RCX: 00007faeeecb1cb9 [ 39.213172][ T373] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006 [ 39.221300][ T373] RBP: 00007faeeed1fbf7 R08: 0000000000000000 R09: 0000000000000000 [ 39.229256][ T373] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 39.237400][ T373] R13: 00007faeeef2cfac R14: 00007faeeef2cfa0 R15: 00007faeeef2cfa0 [ 39.245548][ T373] [ 39.248640][ T373] [ 39.251091][ T373] The buggy address belongs to the page: [ 39.256801][ T373] page:ffffea0004aa8b80 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x12aa2e [ 39.267284][ T373] flags: 0x4000000000000000(zone=1) [ 39.272699][ T373] raw: 4000000000000000 ffffea0004aa8c88 ffff8881f713c580 0000000000000000 [ 39.281374][ T373] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 39.290215][ T373] page dumped because: kasan: bad access detected [ 39.296610][ T373] page_owner tracks the page as freed [ 39.302141][ T373] page last allocated via order 0, migratetype Movable, gfp_mask 0x100dca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO), pid 373, ts 38844346912, free_ts 38845962166 [ 39.317840][ T373] post_alloc_hook+0x192/0x1b0 [ 39.322729][ T373] prep_new_page+0x1c/0x110 [ 39.327418][ T373] get_page_from_freelist+0x2d3a/0x2dc0 [ 39.332972][ T373] __alloc_pages+0x1a2/0x460 [ 39.337541][ T373] handle_pte_fault+0xebf/0x2710 [ 39.342603][ T373] do_handle_mm_fault+0x1af9/0x1de0 [ 39.347882][ T373] do_user_addr_fault+0x828/0x1250 [ 39.353109][ T373] exc_page_fault+0x51/0xb0 [ 39.357815][ T373] asm_exc_page_fault+0x27/0x30 [ 39.363050][ T373] page last free stack trace: [ 39.367800][ T373] free_unref_page_prepare+0x542/0x550 [ 39.373456][ T373] free_unref_page_list+0x13a/0x9d0 [ 39.378747][ T373] release_pages+0x1006/0x1060 [ 39.383504][ T373] free_pages_and_swap_cache+0x86/0xa0 [ 39.389040][ T373] tlb_finish_mmu+0x17e/0x310 [ 39.393808][ T373] unmap_region+0x344/0x3b0 [ 39.398438][ T373] __do_munmap+0xa24/0x1020 [ 39.403035][ T373] __vm_munmap+0x163/0x2b0 [ 39.407628][ T373] __x64_sys_munmap+0x6b/0x80 [ 39.412523][ T373] x64_sys_call+0xc9/0x9a0 [ 39.416924][ T373] do_syscall_64+0x4c/0xa0 [ 39.421319][ T373] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 39.427401][ T373] [ 39.429713][ T373] Memory state around the buggy address: [ 39.435413][ T373] ffff88812aa2df00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 39.443456][ T373] ffff88812aa2df80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 39.451670][ T373] >ffff88812aa2e000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 39.459857][ T373] ^ [ 39.464089][ T373] ffff88812aa2e080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 39.472304][ T373] ffff88812aa2e100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 39.480615][ T373] ================================================================== [ 39.489089][ T373] Disabling lock debugging due to kernel taint [ 39.499116][ T373] EXT4-fs error (device loop2): ext4_readdir:263: inode #2: block 255: comm syz.2.17: path (unknown): bad entry in directory: directory entry overrun - offset=1023, inode=8514816, rec_len=6656, size=1024 fake=0