Warning: Permanently added '10.128.1.47' (ED25519) to the list of known hosts. 2026/06/21 12:55:03 parsed 1 programs 2026/06/21 12:55:03 serving rpc on tcp://44175 [ 24.510202][ T30] audit: type=1400 audit(1782046503.296:64): avc: denied { node_bind } for pid=293 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 24.531613][ T30] audit: type=1400 audit(1782046503.296:65): avc: denied { module_request } for pid=293 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 25.494402][ T30] audit: type=1400 audit(1782046504.286:66): avc: denied { mounton } for pid=299 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.497830][ T299] cgroup: Unknown subsys name 'net' [ 25.517191][ T30] audit: type=1400 audit(1782046504.286:67): avc: denied { mount } for pid=299 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.544586][ T30] audit: type=1400 audit(1782046504.306:68): avc: denied { unmount } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.544915][ T299] cgroup: Unknown subsys name 'devices' [ 25.686077][ T299] cgroup: Unknown subsys name 'hugetlb' [ 25.691687][ T299] cgroup: Unknown subsys name 'rlimit' [ 25.927466][ T30] audit: type=1400 audit(1782046504.716:69): avc: denied { setattr } for pid=299 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.950662][ T30] audit: type=1400 audit(1782046504.716:70): avc: denied { create } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.971295][ T30] audit: type=1400 audit(1782046504.716:71): avc: denied { write } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.991875][ T30] audit: type=1400 audit(1782046504.716:72): avc: denied { read } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.004067][ T303] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 26.012692][ T30] audit: type=1400 audit(1782046504.716:73): avc: denied { mounton } for pid=299 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 26.072566][ T299] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.557433][ T308] request_module fs-gadgetfs succeeded, but still no fs? [ 26.751869][ T326] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.758972][ T326] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.766470][ T326] device bridge_slave_0 entered promiscuous mode [ 26.774107][ T326] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.781163][ T326] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.788589][ T326] device bridge_slave_1 entered promiscuous mode [ 26.829997][ T326] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.837065][ T326] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.844393][ T326] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.851432][ T326] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.870905][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.878229][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.885803][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 26.893185][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.903327][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.911587][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.918647][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.927309][ T331] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.935642][ T331] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.942724][ T331] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.954597][ T331] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.964747][ T331] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.979629][ T331] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.990482][ T331] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.998634][ T331] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.006200][ T331] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.014513][ T326] device veth0_vlan entered promiscuous mode [ 27.023914][ T331] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.033811][ T326] device veth1_macvtap entered promiscuous mode [ 27.043719][ T331] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.054490][ T331] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/06/21 12:55:06 executed programs: 0 [ 27.687276][ T370] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.694378][ T370] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.701673][ T370] device bridge_slave_0 entered promiscuous mode [ 27.709061][ T45] device bridge_slave_1 left promiscuous mode [ 27.715234][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.722718][ T45] device bridge_slave_0 left promiscuous mode [ 27.728924][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.736883][ T45] device veth1_macvtap left promiscuous mode [ 27.742884][ T45] device veth0_vlan left promiscuous mode [ 27.828505][ T370] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.835581][ T370] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.842926][ T370] device bridge_slave_1 entered promiscuous mode [ 27.896805][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 27.904325][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.913522][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 27.921889][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.930141][ T333] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.937202][ T333] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.944748][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 27.953454][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 27.961837][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.970032][ T333] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.977122][ T333] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.994533][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 28.003763][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 28.017182][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 28.029163][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 28.037717][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 28.045443][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 28.054011][ T370] device veth0_vlan entered promiscuous mode [ 28.066728][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 28.076569][ T370] device veth1_macvtap entered promiscuous mode [ 28.086783][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.098046][ T333] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 28.131012][ T374] ================================================================== [ 28.139124][ T374] BUG: KASAN: slab-out-of-bounds in xfrm_policy_inexact_list_reinsert+0x635/0x6e0 [ 28.148366][ T374] Read of size 1 at addr ffff8881112873f8 by task syz.2.17/374 [ 28.155929][ T374] [ 28.158277][ T374] CPU: 0 PID: 374 Comm: syz.2.17 Not tainted syzkaller #0 [ 28.165383][ T374] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 28.175449][ T374] Call Trace: [ 28.178726][ T374] [ 28.181649][ T374] __dump_stack+0x21/0x30 [ 28.185979][ T374] dump_stack_lvl+0x110/0x170 [ 28.190658][ T374] ? show_regs_print_info+0x20/0x20 [ 28.195854][ T374] ? load_image+0x3f0/0x3f0 [ 28.200357][ T374] ? unwind_get_return_address+0x4d/0x90 [ 28.206012][ T374] ? stack_trace_save+0xf0/0xf0 [ 28.210861][ T374] print_address_description+0x7f/0x2c0 [ 28.216410][ T374] ? xfrm_policy_inexact_list_reinsert+0x635/0x6e0 [ 28.222904][ T374] kasan_report+0x10f/0x150 [ 28.227402][ T374] ? xfrm_policy_inexact_list_reinsert+0x635/0x6e0 [ 28.233897][ T374] __asan_report_load1_noabort+0x14/0x20 [ 28.239524][ T374] xfrm_policy_inexact_list_reinsert+0x635/0x6e0 [ 28.245852][ T374] xfrm_policy_inexact_insert_node+0x954/0xb60 [ 28.252006][ T374] ? xfrm_netlink_rcv+0x72/0x90 [ 28.256853][ T374] ? netlink_unicast+0x86c/0xa30 [ 28.261788][ T374] ? ____sys_sendmsg+0x5be/0x8f0 [ 28.266722][ T374] ? ___sys_sendmsg+0x236/0x2e0 [ 28.271576][ T374] xfrm_policy_inexact_alloc_chain+0x540/0xb40 [ 28.277732][ T374] xfrm_policy_inexact_insert+0x6a/0x1190 [ 28.283481][ T374] ? __kasan_check_write+0x14/0x20 [ 28.288587][ T374] ? _raw_spin_lock_bh+0x94/0xf0 [ 28.293521][ T374] xfrm_policy_insert+0x12c/0x9c0 [ 28.298545][ T374] xfrm_add_policy+0x4e1/0x840 [ 28.303316][ T374] ? xfrm_dump_sa_done+0xc0/0xc0 [ 28.308280][ T374] xfrm_user_rcv_msg+0x559/0x7f0 [ 28.313228][ T374] ? xfrm_netlink_rcv+0x90/0x90 [ 28.318083][ T374] ? avc_has_perm_noaudit+0x490/0x490 [ 28.323451][ T374] ? x64_sys_call+0x4b/0x9a0 [ 28.328041][ T374] ? selinux_nlmsg_lookup+0x233/0x440 [ 28.333438][ T374] netlink_rcv_skb+0x1e9/0x430 [ 28.338197][ T374] ? xfrm_netlink_rcv+0x90/0x90 [ 28.343038][ T374] ? netlink_ack+0xb10/0xb10 [ 28.347624][ T374] ? wait_for_completion_killable_timeout+0x10/0x10 [ 28.354216][ T374] ? __netlink_lookup+0x387/0x3b0 [ 28.359244][ T374] xfrm_netlink_rcv+0x72/0x90 [ 28.363920][ T374] netlink_unicast+0x86c/0xa30 [ 28.368684][ T374] netlink_sendmsg+0x879/0xb80 [ 28.373452][ T374] ? netlink_getsockopt+0x530/0x530 [ 28.378649][ T374] ? alloc_file+0x59/0x580 [ 28.383094][ T374] ? security_socket_sendmsg+0x82/0xa0 [ 28.388553][ T374] ? netlink_getsockopt+0x530/0x530 [ 28.393851][ T374] ____sys_sendmsg+0x5be/0x8f0 [ 28.398627][ T374] ? __sys_sendmsg_sock+0x40/0x40 [ 28.403650][ T374] ? import_iovec+0x7c/0xb0 [ 28.408157][ T374] ___sys_sendmsg+0x236/0x2e0 [ 28.412832][ T374] ? __sys_sendmsg+0x280/0x280 [ 28.417615][ T374] ? percpu_counter_add_batch+0x13c/0x160 [ 28.423338][ T374] ? __kasan_check_read+0x11/0x20 [ 28.428360][ T374] ? __fdget+0x15b/0x230 [ 28.432608][ T374] __x64_sys_sendmsg+0x201/0x2d0 [ 28.437538][ T374] ? ___sys_sendmsg+0x2e0/0x2e0 [ 28.442386][ T374] ? fpregs_assert_state_consistent+0xb1/0xe0 [ 28.448450][ T374] x64_sys_call+0x4b/0x9a0 [ 28.452864][ T374] do_syscall_64+0x4c/0xa0 [ 28.457335][ T374] ? clear_bhb_loop+0x50/0xa0 [ 28.462009][ T374] ? clear_bhb_loop+0x50/0xa0 [ 28.466686][ T374] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 28.472579][ T374] RIP: 0033:0x7f5ecc170e59 [ 28.476984][ T374] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 28.496639][ T374] RSP: 002b:00007ffe0056f3a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 28.505047][ T374] RAX: ffffffffffffffda RBX: 00007f5ecc3e9fa0 RCX: 00007f5ecc170e59 [ 28.513016][ T374] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 0000000000000007 [ 28.520986][ T374] RBP: 00007f5ecc206e6f R08: 0000000000000000 R09: 0000000000000000 [ 28.528975][ T374] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 28.536941][ T374] R13: 00007f5ecc3e9fac R14: 00007f5ecc3e9fa0 R15: 00007f5ecc3e9fa0 [ 28.544931][ T374] [ 28.547960][ T374] [ 28.550276][ T374] Allocated by task 374: [ 28.554524][ T374] __kasan_kmalloc+0xd4/0x100 [ 28.559196][ T374] __kmalloc+0x13d/0x2c0 [ 28.563432][ T374] sk_prot_alloc+0xed/0x320 [ 28.567932][ T374] sk_alloc+0x38/0x430 [ 28.572006][ T374] pfkey_create+0x12a/0x650 [ 28.576531][ T374] __sock_create+0x38d/0x7a0 [ 28.581122][ T374] __sys_socket+0xec/0x190 [ 28.585532][ T374] __x64_sys_socket+0x7a/0x90 [ 28.590205][ T374] x64_sys_call+0x8c5/0x9a0 [ 28.594713][ T374] do_syscall_64+0x4c/0xa0 [ 28.599144][ T374] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 28.605035][ T374] [ 28.607351][ T374] The buggy address belongs to the object at ffff888111287000 [ 28.607351][ T374] which belongs to the cache kmalloc-1k of size 1024 [ 28.621398][ T374] The buggy address is located 1016 bytes inside of [ 28.621398][ T374] 1024-byte region [ffff888111287000, ffff888111287400) [ 28.634842][ T374] The buggy address belongs to the page: [ 28.640462][ T374] page:ffffea000444a000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x111280 [ 28.650700][ T374] head:ffffea000444a000 order:3 compound_mapcount:0 compound_pincount:0 [ 28.659017][ T374] flags: 0x4000000000010200(slab|head|zone=1) [ 28.665083][ T374] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100043080 [ 28.673662][ T374] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 28.682232][ T374] page dumped because: kasan: bad access detected [ 28.688637][ T374] page_owner tracks the page as allocated [ 28.694359][ T374] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 20, ts 28109057853, free_ts 27917907329 [ 28.714079][ T374] post_alloc_hook+0x192/0x1b0 [ 28.718865][ T374] prep_new_page+0x1c/0x110 [ 28.723360][ T374] get_page_from_freelist+0x2c3a/0x2cd0 [ 28.728898][ T374] __alloc_pages+0x1a2/0x460 [ 28.733481][ T374] new_slab+0xa0/0x4d0 [ 28.737548][ T374] ___slab_alloc+0x3ac/0x840 [ 28.742137][ T374] __slab_alloc+0x49/0x90 [ 28.746463][ T374] __kmalloc_track_caller+0x169/0x2c0 [ 28.751835][ T374] __alloc_skb+0x210/0x730 [ 28.756253][ T374] wg_socket_send_buffer_to_peer+0x37/0x170 [ 28.762268][ T374] wg_packet_send_handshake_response+0x1af/0x230 [ 28.768610][ T374] wg_packet_handshake_receive_worker+0x512/0x910 [ 28.775023][ T374] process_one_work+0x6c8/0xbb0 [ 28.779873][ T374] worker_thread+0xaa0/0x1250 [ 28.784549][ T374] kthread+0x3f5/0x4f0 [ 28.788613][ T374] ret_from_fork+0x1f/0x30 [ 28.793025][ T374] page last free stack trace: [ 28.797685][ T374] free_unref_page_prepare+0x542/0x550 [ 28.803140][ T374] free_unref_page+0xae/0x540 [ 28.807827][ T374] __free_pages+0x6c/0x100 [ 28.812235][ T374] __free_slab+0xe5/0x1e0 [ 28.816745][ T374] __unfreeze_partials+0x15a/0x190 [ 28.821864][ T374] put_cpu_partial+0xc6/0x120 [ 28.826545][ T374] __slab_free+0x1d4/0x290 [ 28.830972][ T374] ___cache_free+0x104/0x120 [ 28.835586][ T374] qlink_free+0x4d/0x90 [ 28.839740][ T374] qlist_free_all+0x5f/0xb0 [ 28.844241][ T374] kasan_quarantine_reduce+0x14a/0x170 [ 28.849707][ T374] __kasan_slab_alloc+0x2f/0xe0 [ 28.854556][ T374] slab_post_alloc_hook+0x4f/0x2b0 [ 28.859676][ T374] kmem_cache_alloc+0xf7/0x260 [ 28.864436][ T374] __alloc_skb+0xe4/0x730 [ 28.868758][ T374] netlink_sendmsg+0x611/0xb80 [ 28.873519][ T374] [ 28.875833][ T374] Memory state around the buggy address: [ 28.881454][ T374] ffff888111287280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 28.889510][ T374] ffff888111287300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 28.897566][ T374] >ffff888111287380: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 28.905622][ T374] ^ [ 28.913591][ T374] ffff888111287400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.921649][ T374] ffff888111287480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.929712][ T374] ================================================================== [ 28.937767][ T374] Disabling lock debugging due to kernel taint