Warning: Permanently added '10.128.0.191' (ED25519) to the list of known hosts. 2026/08/15 07:42:06 parsed 1 programs 2026/08/15 07:42:06 serving rpc on tcp://38651 [ 23.778059][ T28] audit: type=1400 audit(1786779726.360:64): avc: denied { node_bind } for pid=295 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 23.799583][ T28] audit: type=1400 audit(1786779726.360:65): avc: denied { module_request } for pid=295 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 24.597891][ T28] audit: type=1400 audit(1786779727.180:66): avc: denied { mounton } for pid=301 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 24.598851][ T301] cgroup: Unknown subsys name 'net' [ 24.620589][ T28] audit: type=1400 audit(1786779727.180:67): avc: denied { mount } for pid=301 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.648029][ T28] audit: type=1400 audit(1786779727.210:68): avc: denied { unmount } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.648202][ T301] cgroup: Unknown subsys name 'devices' [ 24.756845][ T301] cgroup: Unknown subsys name 'hugetlb' [ 24.762543][ T301] cgroup: Unknown subsys name 'rlimit' [ 24.899884][ T28] audit: type=1400 audit(1786779727.480:69): avc: denied { setattr } for pid=301 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 24.923081][ T28] audit: type=1400 audit(1786779727.480:70): avc: denied { create } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 24.943446][ T28] audit: type=1400 audit(1786779727.480:71): avc: denied { write } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 24.963719][ T28] audit: type=1400 audit(1786779727.480:72): avc: denied { read } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 24.984061][ T28] audit: type=1400 audit(1786779727.480:73): avc: denied { mounton } for pid=301 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 24.993565][ T305] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 25.026938][ T301] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 25.746514][ T310] request_module fs-gadgetfs succeeded, but still no fs? [ 26.201001][ T336] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.208184][ T336] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.216198][ T336] device bridge_slave_0 entered promiscuous mode [ 26.223686][ T336] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.230829][ T336] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.238222][ T336] device bridge_slave_1 entered promiscuous mode [ 26.276738][ T336] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.283779][ T336] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.291265][ T336] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.298310][ T336] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.316926][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.324539][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.332093][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.340873][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.349278][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.356340][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.372202][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.380367][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.387412][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.394734][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.403920][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.417170][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.428021][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.436338][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.443746][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.452009][ T336] device veth0_vlan entered promiscuous mode [ 26.462606][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.471652][ T336] device veth1_macvtap entered promiscuous mode [ 26.481220][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.491346][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.520735][ T336] syz-executor (336) used greatest stack depth: 22048 bytes left 2026/08/15 07:42:09 executed programs: 0 [ 26.935193][ T371] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.942321][ T371] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.949833][ T371] device bridge_slave_0 entered promiscuous mode [ 26.957079][ T371] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.964207][ T371] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.971675][ T371] device bridge_slave_1 entered promiscuous mode [ 27.028686][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 27.036352][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.045464][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 27.053956][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.062686][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.069737][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.077284][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 27.086407][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 27.094723][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.103031][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.110101][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.124472][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.133623][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.147946][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.159276][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.167409][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.174880][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.183086][ T371] device veth0_vlan entered promiscuous mode [ 27.192956][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.202267][ T371] device veth1_macvtap entered promiscuous mode [ 27.211707][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.221742][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.254050][ T376] loop2: detected capacity change from 0 to 1024 [ 27.267132][ T376] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 27.281356][ T376] ================================================================== [ 27.289549][ T376] BUG: KASAN: use-after-free in ext4_read_inline_dir+0x483/0xd90 [ 27.297278][ T376] Read of size 68 at addr ffff88812e7e041e by task syz.2.17/376 [ 27.304898][ T376] [ 27.307231][ T376] CPU: 0 PID: 376 Comm: syz.2.17 Not tainted syzkaller #0 [ 27.314348][ T376] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 27.324473][ T376] Call Trace: [ 27.327755][ T376] [ 27.330683][ T376] __dump_stack+0x21/0x24 [ 27.335106][ T376] dump_stack_lvl+0x110/0x170 [ 27.339788][ T376] ? __cfi_dump_stack_lvl+0x8/0x8 [ 27.344952][ T376] ? ext4_read_inline_dir+0x483/0xd90 [ 27.350328][ T376] print_address_description+0x71/0x200 [ 27.355878][ T376] print_report+0x4a/0x60 [ 27.360209][ T376] kasan_report+0x122/0x150 [ 27.364712][ T376] ? ext4_read_inline_dir+0x483/0xd90 [ 27.370082][ T376] kasan_check_range+0x249/0x2a0 [ 27.375022][ T376] ? ext4_read_inline_dir+0x483/0xd90 [ 27.380391][ T376] memcpy+0x2d/0x70 [ 27.384218][ T376] ext4_read_inline_dir+0x483/0xd90 [ 27.389471][ T376] ? __stack_depot_save+0x44d/0x490 [ 27.394687][ T376] ? __cfi_ext4_read_inline_dir+0x10/0x10 [ 27.400421][ T376] ? kasan_set_track+0x60/0x70 [ 27.405187][ T376] ? kasan_set_track+0x4b/0x70 [ 27.409949][ T376] ? kasan_save_free_info+0x2b/0x40 [ 27.415145][ T376] ext4_readdir+0x3c2/0x3c10 [ 27.419738][ T376] ? __cfi_get_futex_key+0x10/0x10 [ 27.424857][ T376] ? __kasan_check_read+0x11/0x20 [ 27.429889][ T376] ? futex_wake+0x5b7/0x8e0 [ 27.434393][ T376] ? __cfi_ext4_readdir+0x10/0x10 [ 27.439418][ T376] ? __kasan_check_write+0x14/0x20 [ 27.444540][ T376] ? rwsem_read_trylock+0x2af/0x640 [ 27.449766][ T376] ? kmem_cache_free+0x12d/0x300 [ 27.454723][ T376] ? downgrade_write+0x370/0x370 [ 27.459666][ T376] ? __kasan_slab_free+0x11/0x20 [ 27.464611][ T376] ? down_read_killable+0xbc/0x110 [ 27.469731][ T376] ? __cfi_down_read_killable+0x10/0x10 [ 27.475277][ T376] ? security_file_permission+0x94/0xb0 [ 27.480830][ T376] iterate_dir+0x26d/0x610 [ 27.485250][ T376] ? __cfi_ext4_readdir+0x10/0x10 [ 27.490449][ T376] __se_sys_getdents+0xf2/0x250 [ 27.495390][ T376] ? __x64_sys_getdents+0x90/0x90 [ 27.500446][ T376] ? __cfi_filldir+0x10/0x10 [ 27.505037][ T376] ? do_user_addr_fault+0x9a5/0x1030 [ 27.510329][ T376] ? debug_smp_processor_id+0x17/0x20 [ 27.515789][ T376] __x64_sys_getdents+0x7b/0x90 [ 27.520640][ T376] x64_sys_call+0x212/0x9a0 [ 27.525148][ T376] do_syscall_64+0x4c/0xa0 [ 27.529563][ T376] ? clear_bhb_loop+0x30/0x80 [ 27.534240][ T376] ? clear_bhb_loop+0x30/0x80 [ 27.538959][ T376] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 27.544861][ T376] RIP: 0033:0x7f2bb8d9e0d9 [ 27.549366][ T376] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 27.569144][ T376] RSP: 002b:00007ffdfe97ea88 EFLAGS: 00000246 ORIG_RAX: 000000000000004e [ 27.577577][ T376] RAX: ffffffffffffffda RBX: 00007f2bb9025fa0 RCX: 00007f2bb8d9e0d9 [ 27.585546][ T376] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006 [ 27.593514][ T376] RBP: 00007f2bb8e35024 R08: 0000000000000000 R09: 0000000000000000 [ 27.601575][ T376] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 27.609550][ T376] R13: 00007f2bb9025fac R14: 00007f2bb9025fa0 R15: 00007f2bb9025fa0 [ 27.617548][ T376] [ 27.620565][ T376] [ 27.622882][ T376] Allocated by task 371: [ 27.627116][ T376] kasan_set_track+0x4b/0x70 [ 27.631709][ T376] kasan_save_alloc_info+0x1f/0x30 [ 27.636814][ T376] __kasan_slab_alloc+0x72/0x80 [ 27.641757][ T376] slab_post_alloc_hook+0x4f/0x2d0 [ 27.646962][ T376] kmem_cache_alloc_node+0x179/0x330 [ 27.652249][ T376] __alloc_skb+0xe8/0x4a0 [ 27.656575][ T376] wg_packet_send_keepalive+0x62/0x1c0 [ 27.662040][ T376] wg_open+0x214/0x300 [ 27.666107][ T376] __dev_open+0x39c/0x520 [ 27.670439][ T376] __dev_change_flags+0x1f2/0x6b0 [ 27.675497][ T376] dev_change_flags+0x80/0x1a0 [ 27.680263][ T376] do_setlink+0xc02/0x2a10 [ 27.684681][ T376] rtnl_newlink+0x17d7/0x20d0 [ 27.689388][ T376] rtnetlink_rcv_msg+0xb28/0xde0 [ 27.694419][ T376] netlink_rcv_skb+0x200/0x450 [ 27.699177][ T376] rtnetlink_rcv+0x1c/0x20 [ 27.703646][ T376] netlink_unicast+0x8c1/0xa60 [ 27.708436][ T376] netlink_sendmsg+0x8b9/0xbd0 [ 27.713215][ T376] __sys_sendto+0x4ac/0x660 [ 27.717745][ T376] __x64_sys_sendto+0xe5/0x100 [ 27.722515][ T376] x64_sys_call+0x83/0x9a0 [ 27.726946][ T376] do_syscall_64+0x4c/0xa0 [ 27.731366][ T376] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 27.737261][ T376] [ 27.739586][ T376] Freed by task 60: [ 27.743383][ T376] kasan_set_track+0x4b/0x70 [ 27.747974][ T376] kasan_save_free_info+0x2b/0x40 [ 27.752996][ T376] ____kasan_slab_free+0x132/0x180 [ 27.758108][ T376] __kasan_slab_free+0x11/0x20 [ 27.762873][ T376] slab_free_freelist_hook+0xc2/0x190 [ 27.768240][ T376] kmem_cache_free+0x12d/0x300 [ 27.773038][ T376] kfree_skbmem+0x10c/0x180 [ 27.777539][ T376] consume_skb+0xb3/0x1f0 [ 27.781877][ T376] wg_packet_rx_poll+0x10db/0x1b60 [ 27.787028][ T376] __napi_poll+0xcd/0x5d0 [ 27.791387][ T376] net_rx_action+0x4a3/0xa90 [ 27.795987][ T376] handle_softirqs+0x1d7/0x600 [ 27.800753][ T376] __do_softirq+0xb/0xd [ 27.804909][ T376] [ 27.807236][ T376] The buggy address belongs to the object at ffff88812e7e03c0 [ 27.807236][ T376] which belongs to the cache skbuff_head_cache of size 256 [ 27.821899][ T376] The buggy address is located 94 bytes inside of [ 27.821899][ T376] 256-byte region [ffff88812e7e03c0, ffff88812e7e04c0) [ 27.835106][ T376] [ 27.837426][ T376] The buggy address belongs to the physical page: [ 27.843828][ T376] page:ffffea0004b9f800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12e7e0 [ 27.854060][ T376] flags: 0x4000000000000200(slab|zone=1) [ 27.859695][ T376] raw: 4000000000000200 0000000000000000 dead000000000122 ffff8881001f0d80 [ 27.868271][ T376] raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 [ 27.876841][ T376] page dumped because: kasan: bad access detected [ 27.883243][ T376] page_owner tracks the page as allocated [ 27.888946][ T376] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL), pid 371, tgid 371 (syz-executor), ts 27234184970, free_ts 26690529794 [ 27.908480][ T376] post_alloc_hook+0x1f5/0x210 [ 27.913247][ T376] prep_new_page+0x1c/0x110 [ 27.917840][ T376] get_page_from_freelist+0x2ca9/0x2d20 [ 27.923402][ T376] __alloc_pages+0x1fa/0x610 [ 27.927993][ T376] alloc_slab_page+0x6e/0xf0 [ 27.932583][ T376] new_slab+0x98/0x3e0 [ 27.936731][ T376] ___slab_alloc+0x70f/0xb70 [ 27.941323][ T376] __slab_alloc+0x5e/0xa0 [ 27.945654][ T376] kmem_cache_alloc_node+0x1ba/0x330 [ 27.950940][ T376] __alloc_skb+0xe8/0x4a0 [ 27.955292][ T376] __ipv6_ifa_notify+0x200/0xe80 [ 27.960322][ T376] inet6_addr_add+0x644/0x9c0 [ 27.965001][ T376] inet6_rtm_newaddr+0x74a/0xa10 [ 27.969937][ T376] rtnetlink_rcv_msg+0xb28/0xde0 [ 27.974876][ T376] netlink_rcv_skb+0x200/0x450 [ 27.979643][ T376] rtnetlink_rcv+0x1c/0x20 [ 27.984059][ T376] page last free stack trace: [ 27.988810][ T376] free_unref_page_prepare+0x80c/0x820 [ 27.994278][ T376] free_unref_page+0x93/0x530 [ 27.998954][ T376] __free_pages+0x67/0x100 [ 28.003371][ T376] free_pages+0x82/0x90 [ 28.007528][ T376] kasan_depopulate_vmalloc_pte+0x6b/0x90 [ 28.013244][ T376] __apply_to_page_range+0x8db/0xc80 [ 28.018528][ T376] apply_to_existing_page_range+0x38/0x50 [ 28.024248][ T376] kasan_release_vmalloc+0x97/0xb0 [ 28.029396][ T376] __purge_vmap_area_lazy+0xf09/0x1870 [ 28.034877][ T376] drain_vmap_area_work+0x3e/0xd0 [ 28.039920][ T376] process_one_work+0x717/0xc30 [ 28.044778][ T376] worker_thread+0xa4d/0x11d0 [ 28.049457][ T376] kthread+0x281/0x320 [ 28.053528][ T376] ret_from_fork+0x1f/0x30 [ 28.057948][ T376] [ 28.060267][ T376] Memory state around the buggy address: [ 28.065918][ T376] ffff88812e7e0300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.073977][ T376] ffff88812e7e0380: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 28.082032][ T376] >ffff88812e7e0400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.090173][ T376] ^ [ 28.095018][ T376] ffff88812e7e0480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 28.103073][ T376] ffff88812e7e0500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.111145][ T376] ================================================================== [ 28.127451][ T376] Disabling lock debugging due to kernel taint [ 28.144423][ T371] EXT4-fs (loop2): unmounting filesystem.