Warning: Permanently added '10.128.1.89' (ED25519) to the list of known hosts. 2026/07/19 19:59:18 parsed 1 programs 2026/07/19 19:59:18 serving rpc on tcp://41611 [ 24.702817][ T24] audit: type=1400 audit(1784491158.930:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 24.724282][ T24] audit: type=1400 audit(1784491158.940:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 24.743989][ T24] audit: type=1400 audit(1784491158.940:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 25.622499][ T24] audit: type=1400 audit(1784491159.850:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.625460][ T293] cgroup: Unknown subsys name 'net' [ 25.645221][ T24] audit: type=1400 audit(1784491159.860:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.672401][ T24] audit: type=1400 audit(1784491159.880:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.672766][ T293] cgroup: Unknown subsys name 'devices' [ 25.814632][ T293] cgroup: Unknown subsys name 'hugetlb' [ 25.820207][ T293] cgroup: Unknown subsys name 'rlimit' [ 25.996450][ T24] audit: type=1400 audit(1784491160.230:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 26.019617][ T24] audit: type=1400 audit(1784491160.230:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 26.032128][ T298] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 26.040800][ T24] audit: type=1400 audit(1784491160.230:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.069002][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.069183][ T24] audit: type=1400 audit(1784491160.230:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.457743][ T300] request_module fs-gadgetfs succeeded, but still no fs? [ 26.468151][ T300] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 27.077692][ T353] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.084982][ T353] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.092244][ T353] device bridge_slave_0 entered promiscuous mode [ 27.099124][ T353] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.106185][ T353] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.113595][ T353] device bridge_slave_1 entered promiscuous mode [ 27.149299][ T353] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.156339][ T353] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.163620][ T353] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.170639][ T353] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.187294][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.194870][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.202011][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.211246][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.219444][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.226489][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.235198][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.243390][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.250407][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.261593][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.270729][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.283635][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.294540][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.302559][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.310187][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.318240][ T353] device veth0_vlan entered promiscuous mode [ 27.333438][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.342137][ T353] device veth1_macvtap entered promiscuous mode [ 27.351065][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.368066][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/07/19 19:59:21 executed programs: 0 [ 27.580116][ T364] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.587302][ T364] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.594761][ T364] device bridge_slave_0 entered promiscuous mode [ 27.601524][ T364] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.608597][ T364] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.616292][ T364] device bridge_slave_1 entered promiscuous mode [ 27.657098][ T364] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.664130][ T364] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.671341][ T364] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.678391][ T364] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.695512][ T357] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.702619][ T357] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.710273][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 27.717790][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.731715][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.739983][ T357] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.747026][ T357] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.755535][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.763823][ T357] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.770828][ T357] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.788498][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.797665][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.817293][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.828452][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.836586][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.844491][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.852561][ T364] device veth0_vlan entered promiscuous mode [ 27.864248][ T364] device veth1_macvtap entered promiscuous mode [ 27.871307][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.883504][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.892680][ T357] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.920719][ T406] ================================================================== [ 27.928797][ T406] BUG: KASAN: slab-out-of-bounds in xfrm_policy_inexact_list_reinsert+0x62b/0x6e0 [ 27.937971][ T406] Read of size 1 at addr ffff888111860bd8 by task syz.2.17/406 [ 27.945489][ T406] [ 27.947820][ T406] CPU: 1 PID: 406 Comm: syz.2.17 Not tainted syzkaller #0 [ 27.954907][ T406] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 27.964940][ T406] Call Trace: [ 27.968214][ T406] __dump_stack+0x21/0x24 [ 27.972528][ T406] dump_stack_lvl+0x1a7/0x208 [ 27.977187][ T406] ? show_regs_print_info+0x18/0x18 [ 27.982367][ T406] ? thaw_kernel_threads+0x220/0x220 [ 27.987638][ T406] print_address_description+0x7f/0x2c0 [ 27.993186][ T406] ? xfrm_policy_inexact_list_reinsert+0x62b/0x6e0 [ 27.999684][ T406] kasan_report+0x100/0x140 [ 28.004179][ T406] ? xfrm_policy_inexact_list_reinsert+0x62b/0x6e0 [ 28.010671][ T406] __asan_report_load1_noabort+0x14/0x20 [ 28.016297][ T406] xfrm_policy_inexact_list_reinsert+0x62b/0x6e0 [ 28.022611][ T406] xfrm_policy_inexact_insert_node+0x5c0/0xb60 [ 28.028760][ T406] xfrm_policy_inexact_alloc_chain+0x540/0xb40 [ 28.034901][ T406] xfrm_policy_inexact_insert+0x6a/0x1190 [ 28.040609][ T406] ? __kasan_check_write+0x14/0x20 [ 28.045738][ T406] ? _raw_spin_lock_bh+0x94/0xf0 [ 28.050686][ T406] xfrm_policy_insert+0x12c/0x9c0 [ 28.055698][ T406] xfrm_add_policy+0x4e1/0x840 [ 28.060442][ T406] ? xfrm_dump_sa_done+0xc0/0xc0 [ 28.065360][ T406] xfrm_user_rcv_msg+0x54d/0x7e0 [ 28.070276][ T406] ? stack_trace_save+0xa6/0xf0 [ 28.075108][ T406] ? xfrm_netlink_rcv+0x90/0x90 [ 28.079947][ T406] ? selinux_nlmsg_lookup+0x22a/0x430 [ 28.085302][ T406] netlink_rcv_skb+0x1e9/0x430 [ 28.090048][ T406] ? xfrm_netlink_rcv+0x90/0x90 [ 28.094895][ T406] ? netlink_ack+0xb30/0xb30 [ 28.099469][ T406] ? mutex_trylock+0xb0/0xb0 [ 28.104045][ T406] ? __netlink_lookup+0x387/0x3b0 [ 28.109056][ T406] xfrm_netlink_rcv+0x72/0x90 [ 28.113731][ T406] netlink_unicast+0x86c/0xa30 [ 28.118495][ T406] netlink_sendmsg+0x949/0xb70 [ 28.123248][ T406] ? netlink_getsockopt+0x530/0x530 [ 28.128439][ T406] ? alloc_file_pseudo+0x180/0x200 [ 28.133531][ T406] ? security_socket_sendmsg+0x82/0xa0 [ 28.138974][ T406] ? netlink_getsockopt+0x530/0x530 [ 28.144156][ T406] ____sys_sendmsg+0x5be/0x8f0 [ 28.148935][ T406] ? __sys_sendmsg_sock+0x40/0x40 [ 28.153945][ T406] ? import_iovec+0x7c/0xb0 [ 28.158434][ T406] ___sys_sendmsg+0x236/0x2e0 [ 28.163101][ T406] ? __sys_sendmsg+0x280/0x280 [ 28.167871][ T406] ? alloc_file+0x82/0x580 [ 28.172269][ T406] ? __kasan_check_read+0x11/0x20 [ 28.177274][ T406] ? __fdget+0x15b/0x230 [ 28.181498][ T406] __x64_sys_sendmsg+0x201/0x2d0 [ 28.186415][ T406] ? ___sys_sendmsg+0x2e0/0x2e0 [ 28.191242][ T406] ? __fd_install+0x13b/0x270 [ 28.195904][ T406] ? debug_smp_processor_id+0x17/0x20 [ 28.201260][ T406] ? fpregs_assert_state_consistent+0xb1/0xe0 [ 28.207397][ T406] ? exit_to_user_mode_prepare+0x2f/0xa0 [ 28.213011][ T406] do_syscall_64+0x31/0x40 [ 28.217410][ T406] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.223281][ T406] RIP: 0033:0x7f9095869e99 [ 28.227678][ T406] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 28.247266][ T406] RSP: 002b:00007fff0877a968 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 28.255664][ T406] RAX: ffffffffffffffda RBX: 00007f9095af1fa0 RCX: 00007f9095869e99 [ 28.263626][ T406] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 0000000000000008 [ 28.271595][ T406] RBP: 00007f90958ffeaf R08: 0000000000000000 R09: 0000000000000000 [ 28.279552][ T406] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 28.287507][ T406] R13: 00007f9095af1fac R14: 00007f9095af1fa0 R15: 00007f9095af1fa0 [ 28.295457][ T406] [ 28.297767][ T406] Allocated by task 406: [ 28.301990][ T406] __kasan_kmalloc+0xd4/0x100 [ 28.306657][ T406] __kmalloc+0x19f/0x330 [ 28.310877][ T406] sk_prot_alloc+0xb2/0x340 [ 28.315361][ T406] sk_alloc+0x38/0x4e0 [ 28.319412][ T406] pfkey_create+0x12a/0x650 [ 28.323898][ T406] __sock_create+0x38d/0x770 [ 28.328465][ T406] __sys_socket+0xec/0x190 [ 28.332864][ T406] __x64_sys_socket+0x7a/0x90 [ 28.337521][ T406] do_syscall_64+0x31/0x40 [ 28.341912][ T406] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.347793][ T406] [ 28.350128][ T406] The buggy address belongs to the object at ffff888111860800 [ 28.350128][ T406] which belongs to the cache kmalloc-1k of size 1024 [ 28.364159][ T406] The buggy address is located 984 bytes inside of [ 28.364159][ T406] 1024-byte region [ffff888111860800, ffff888111860c00) [ 28.377499][ T406] The buggy address belongs to the page: [ 28.383138][ T406] page:ffffea0004461800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x111860 [ 28.393358][ T406] head:ffffea0004461800 order:3 compound_mapcount:0 compound_pincount:0 [ 28.401666][ T406] flags: 0x4000000000010200(slab|head) [ 28.407108][ T406] raw: 4000000000010200 ffffea00043e3000 0000000200000002 ffff888100042f00 [ 28.415674][ T406] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 28.424233][ T406] page dumped because: kasan: bad access detected [ 28.430620][ T406] page_owner tracks the page as allocated [ 28.436332][ T406] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 94, ts 4731365955, free_ts 0 [ 28.454279][ T406] prep_new_page+0x176/0x190 [ 28.458873][ T406] get_page_from_freelist+0x225f/0x23f0 [ 28.464397][ T406] __alloc_pages_nodemask+0x29a/0x640 [ 28.469749][ T406] new_slab+0x84/0x3f0 [ 28.473809][ T406] ___slab_alloc+0x2f8/0x4c0 [ 28.478399][ T406] __slab_alloc+0x63/0xa0 [ 28.482710][ T406] __kmalloc_track_caller+0x1e4/0x310 [ 28.488061][ T406] __alloc_skb+0xdc/0x520 [ 28.492381][ T406] netlink_sendmsg+0x693/0xb70 [ 28.497124][ T406] ____sys_sendmsg+0x5be/0x8f0 [ 28.501869][ T406] ___sys_sendmsg+0x236/0x2e0 [ 28.506532][ T406] __x64_sys_sendmsg+0x201/0x2d0 [ 28.511448][ T406] do_syscall_64+0x31/0x40 [ 28.515849][ T406] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.521726][ T406] page_owner free stack trace missing [ 28.527070][ T406] [ 28.529385][ T406] Memory state around the buggy address: [ 28.535015][ T406] ffff888111860a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 28.543056][ T406] ffff888111860b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 28.551103][ T406] >ffff888111860b80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 28.559151][ T406] ^ [ 28.566087][ T406] ffff888111860c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.574130][ T406] ffff888111860c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.582173][ T406] ================================================================== [ 28.590214][ T406] Disabling lock debugging due to kernel taint