Warning: Permanently added '10.128.0.162' (ED25519) to the list of known hosts. 2026/03/20 08:23:36 parsed 1 programs [ 24.628775][ T24] audit: type=1400 audit(1773995016.700:64): avc: denied { node_bind } for pid=275 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 24.649628][ T24] audit: type=1400 audit(1773995016.700:65): avc: denied { create } for pid=275 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 24.669454][ T24] audit: type=1400 audit(1773995016.700:66): avc: denied { module_request } for pid=275 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 25.232187][ T24] audit: type=1400 audit(1773995017.310:67): avc: denied { mounton } for pid=282 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.233402][ T282] cgroup: Unknown subsys name 'net' [ 25.254836][ T24] audit: type=1400 audit(1773995017.310:68): avc: denied { mount } for pid=282 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.282059][ T24] audit: type=1400 audit(1773995017.340:69): avc: denied { unmount } for pid=282 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.282233][ T282] cgroup: Unknown subsys name 'devices' [ 25.510972][ T282] cgroup: Unknown subsys name 'hugetlb' [ 25.516544][ T282] cgroup: Unknown subsys name 'rlimit' [ 25.659185][ T24] audit: type=1400 audit(1773995017.730:70): avc: denied { setattr } for pid=282 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.682334][ T24] audit: type=1400 audit(1773995017.740:71): avc: denied { create } for pid=282 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 25.700627][ T285] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 25.702867][ T24] audit: type=1400 audit(1773995017.740:72): avc: denied { write } for pid=282 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.731413][ T24] audit: type=1400 audit(1773995017.740:73): avc: denied { read } for pid=282 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.779123][ T282] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.157441][ T287] request_module fs-gadgetfs succeeded, but still no fs? [ 26.167691][ T287] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 26.581030][ T326] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.588050][ T326] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.595539][ T326] device bridge_slave_0 entered promiscuous mode [ 26.602943][ T326] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.610026][ T326] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.617236][ T326] device bridge_slave_1 entered promiscuous mode [ 26.647359][ T326] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.654392][ T326] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.661634][ T326] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.668639][ T326] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.684940][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.692463][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.699648][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.708283][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.716796][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.723803][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.732604][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.740724][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.747731][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.762358][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.770265][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.781519][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.792140][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.800338][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.807626][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.815464][ T326] device veth0_vlan entered promiscuous mode [ 26.824172][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.833114][ T326] device veth1_macvtap entered promiscuous mode [ 26.842727][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.851949][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/03/20 08:23:39 executed programs: 0 [ 27.212867][ T351] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.220013][ T351] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.227336][ T351] device bridge_slave_0 entered promiscuous mode [ 27.234318][ T351] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.241495][ T351] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.248708][ T351] device bridge_slave_1 entered promiscuous mode [ 27.292845][ T307] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 27.300423][ T307] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.312086][ T307] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 27.320548][ T307] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.328593][ T307] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.335610][ T307] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.343018][ T307] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 27.351549][ T307] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 27.359805][ T307] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.367865][ T307] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.374884][ T307] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.385622][ T307] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.400093][ T307] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.412177][ T307] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.422459][ T307] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.430550][ T307] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.437838][ T307] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.445993][ T351] device veth0_vlan entered promiscuous mode [ 27.460462][ T307] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.469113][ T351] device veth1_macvtap entered promiscuous mode [ 27.480725][ T307] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.490193][ T307] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.515732][ T351] ------------[ cut here ]------------ [ 27.521399][ T351] WARNING: CPU: 0 PID: 351 at fs/inode.c:304 drop_nlink+0xc5/0x110 [ 27.529273][ T351] Modules linked in: [ 27.533392][ T351] CPU: 1 PID: 351 Comm: syz-executor Not tainted syzkaller #0 [ 27.541384][ T351] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 27.551636][ T351] RIP: 0010:drop_nlink+0xc5/0x110 [ 27.556658][ T351] Code: 1b 48 8d bb b8 04 00 00 be 08 00 00 00 e8 13 f1 f1 ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 db 6e b7 ff <0f> 0b eb 86 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 5e ff ff ff 4c [ 27.576635][ T351] RSP: 0018:ffffc90000c97cd0 EFLAGS: 00010293 [ 27.583029][ T351] RAX: ffffffff81ad4475 RBX: ffff88810fe0e100 RCX: ffff88810f62cf00 [ 27.591039][ T351] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 27.599003][ T351] RBP: ffffc90000c97cf8 R08: 0000000000000003 R09: 0000000000000004 [ 27.607088][ T351] R10: dffffc0000000000 R11: fffff52000192f88 R12: dffffc0000000000 [ 27.615104][ T351] R13: 1ffff11021fc1c29 R14: ffff88810fe0e148 R15: 0000000000000000 [ 27.623128][ T351] FS: 000055555d03e500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 27.632211][ T351] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.638787][ T351] CR2: 000055555d061948 CR3: 0000000129892000 CR4: 00000000003506b0 [ 27.647096][ T351] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 27.655173][ T351] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 27.663238][ T351] Call Trace: [ 27.666516][ T351] shmem_rmdir+0x5b/0x90 [ 27.670868][ T351] vfs_rmdir+0x1b3/0x3e0 [ 27.675107][ T351] incfs_kill_sb+0xfe/0x210 [ 27.679853][ T351] deactivate_locked_super+0xa0/0x100 [ 27.685218][ T351] deactivate_super+0xaf/0xe0 [ 27.690165][ T351] cleanup_mnt+0x45b/0x510 [ 27.694583][ T351] __cleanup_mnt+0x19/0x20 [ 27.698988][ T351] task_work_run+0x127/0x190 [ 27.703743][ T351] exit_to_user_mode_loop+0xcb/0xe0 [ 27.708967][ T351] exit_to_user_mode_prepare+0x76/0xa0 [ 27.714607][ T351] syscall_exit_to_user_mode+0x1d/0x40 [ 27.720356][ T351] do_syscall_64+0x3d/0x40 [ 27.724775][ T351] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 27.730732][ T351] RIP: 0033:0x7f74a37a49d7 [ 27.735140][ T351] Code: a2 c7 05 1c fd 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 27.754760][ T351] RSP: 002b:00007ffc75415678 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 27.763195][ T351] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f74a37a49d7 [ 27.771177][ T351] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc75415730 [ 27.779153][ T351] RBP: 00007ffc75415730 R08: 00007ffc75416730 R09: 00000000ffffffff [ 27.787240][ T351] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc754167c0 [ 27.795229][ T351] R13: 00007f74a3839050 R14: 0000000000006b64 R15: 00007ffc75416800 [ 27.803310][ T351] ---[ end trace 9db752924097b693 ]--- [ 27.808821][ T351] ================================================================== [ 27.816866][ T351] BUG: KASAN: null-ptr-deref in ihold+0x20/0x60 [ 27.823073][ T351] Write of size 4 at addr 0000000000000170 by task syz-executor/351 [ 27.831011][ T351] [ 27.833319][ T351] CPU: 0 PID: 351 Comm: syz-executor Tainted: G W syzkaller #0 [ 27.842125][ T351] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 27.852156][ T351] Call Trace: [ 27.855424][ T351] __dump_stack+0x21/0x24 [ 27.859729][ T351] dump_stack_lvl+0x1a7/0x208 [ 27.864388][ T351] ? thaw_kernel_threads+0x220/0x220 [ 27.869639][ T351] ? show_regs_print_info+0x18/0x18 [ 27.874805][ T351] ? ihold+0x20/0x60 [ 27.878667][ T351] kasan_report+0xd8/0x130 [ 27.883050][ T351] ? ihold+0x20/0x60 [ 27.886911][ T351] kasan_check_range+0x249/0x2a0 [ 27.891817][ T351] __kasan_check_write+0x14/0x20 [ 27.896720][ T351] ihold+0x20/0x60 [ 27.900409][ T351] vfs_rmdir+0x247/0x3e0 [ 27.904616][ T351] incfs_kill_sb+0xfe/0x210 [ 27.909201][ T351] deactivate_locked_super+0xa0/0x100 [ 27.914546][ T351] deactivate_super+0xaf/0xe0 [ 27.919202][ T351] cleanup_mnt+0x45b/0x510 [ 27.923587][ T351] __cleanup_mnt+0x19/0x20 [ 27.927968][ T351] task_work_run+0x127/0x190 [ 27.932527][ T351] exit_to_user_mode_loop+0xcb/0xe0 [ 27.937700][ T351] exit_to_user_mode_prepare+0x76/0xa0 [ 27.943130][ T351] syscall_exit_to_user_mode+0x1d/0x40 [ 27.948561][ T351] do_syscall_64+0x3d/0x40 [ 27.952949][ T351] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 27.958816][ T351] RIP: 0033:0x7f74a37a49d7 [ 27.963204][ T351] Code: a2 c7 05 1c fd 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 27.982781][ T351] RSP: 002b:00007ffc75415678 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 27.991161][ T351] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f74a37a49d7 [ 27.999103][ T351] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc75415730 [ 28.007048][ T351] RBP: 00007ffc75415730 R08: 00007ffc75416730 R09: 00000000ffffffff [ 28.014988][ T351] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc754167c0 [ 28.022928][ T351] R13: 00007f74a3839050 R14: 0000000000006b64 R15: 00007ffc75416800 [ 28.030895][ T351] ================================================================== [ 28.038928][ T351] Disabling lock debugging due to kernel taint [ 28.046730][ T351] BUG: kernel NULL pointer dereference, address: 0000000000000170 [ 28.054613][ T351] #PF: supervisor write access in kernel mode [ 28.060643][ T351] #PF: error_code(0x0002) - not-present page [ 28.066595][ T351] PGD 10fa5b067 P4D 10fa5b067 PUD 0 [ 28.071858][ T351] Oops: 0002 [#1] PREEMPT SMP KASAN [ 28.077024][ T351] CPU: 0 PID: 351 Comm: syz-executor Tainted: G B W syzkaller #0 [ 28.085832][ T351] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 28.095864][ T351] RIP: 0010:ihold+0x26/0x60 [ 28.100336][ T351] Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 f1 66 b7 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 00 e9 f1 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 71 [ 28.119916][ T351] RSP: 0018:ffffc90000c97d10 EFLAGS: 00010246 [ 28.125961][ T351] RAX: ffff88810f62cf00 RBX: 0000000000000000 RCX: 0000000000000286 [ 28.133908][ T351] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff [ 28.142027][ T351] RBP: ffffc90000c97d20 R08: 0000000000000003 R09: 0000000000000004 [ 28.149974][ T351] R10: dffffc0000000000 R11: fffffbfff0dcf648 R12: 1ffff11021a5f7c0 [ 28.157919][ T351] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 [ 28.165862][ T351] FS: 000055555d03e500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 28.174759][ T351] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 28.181328][ T351] CR2: 0000000000000170 CR3: 0000000129892000 CR4: 00000000003506b0 [ 28.189270][ T351] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 28.197220][ T351] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 28.205164][ T351] Call Trace: [ 28.208432][ T351] vfs_rmdir+0x247/0x3e0 [ 28.212646][ T351] incfs_kill_sb+0xfe/0x210 [ 28.217124][ T351] deactivate_locked_super+0xa0/0x100 [ 28.222470][ T351] deactivate_super+0xaf/0xe0 [ 28.227118][ T351] cleanup_mnt+0x45b/0x510 [ 28.231504][ T351] __cleanup_mnt+0x19/0x20 [ 28.235894][ T351] task_work_run+0x127/0x190 [ 28.240458][ T351] exit_to_user_mode_loop+0xcb/0xe0 [ 28.245632][ T351] exit_to_user_mode_prepare+0x76/0xa0 [ 28.251065][ T351] syscall_exit_to_user_mode+0x1d/0x40 [ 28.256501][ T351] do_syscall_64+0x3d/0x40 [ 28.260890][ T351] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.266751][ T351] RIP: 0033:0x7f74a37a49d7 [ 28.271138][ T351] Code: a2 c7 05 1c fd 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 28.290725][ T351] RSP: 002b:00007ffc75415678 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 28.299110][ T351] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f74a37a49d7 [ 28.307054][ T351] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc75415730 [ 28.314998][ T351] RBP: 00007ffc75415730 R08: 00007ffc75416730 R09: 00000000ffffffff [ 28.322941][ T351] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc754167c0 [ 28.330883][ T351] R13: 00007f74a3839050 R14: 0000000000006b64 R15: 00007ffc75416800 [ 28.338824][ T351] Modules linked in: [ 28.342703][ T351] CR2: 0000000000000170 [ 28.346837][ T351] ---[ end trace 9db752924097b694 ]--- [ 28.352269][ T351] RIP: 0010:ihold+0x26/0x60 [ 28.356742][ T351] Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 f1 66 b7 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 00 e9 f1 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 71 [ 28.376316][ T351] RSP: 0018:ffffc90000c97d10 EFLAGS: 00010246 [ 28.382355][ T351] RAX: ffff88810f62cf00 RBX: 0000000000000000 RCX: 0000000000000286 [ 28.390295][ T351] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff [ 28.398236][ T351] RBP: ffffc90000c97d20 R08: 0000000000000003 R09: 0000000000000004 [ 28.406176][ T351] R10: dffffc0000000000 R11: fffffbfff0dcf648 R12: 1ffff11021a5f7c0 [ 28.414115][ T351] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 [ 28.422056][ T351] FS: 000055555d03e500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 28.430952][ T351] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 28.437506][ T351] CR2: 0000000000000170 CR3: 0000000129892000 CR4: 00000000003506b0 [ 28.445536][ T351] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 28.453480][ T351] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 28.461421][ T351] Kernel panic - not syncing: Fatal exception [ 28.467724][ T351] Kernel Offset: disabled [ 28.472023][ T351] Rebooting in 86400 seconds..