Warning: Permanently added '10.128.0.170' (ED25519) to the list of known hosts.
2026/07/30 06:35:44 parsed 1 programs
2026/07/30 06:35:44 serving rpc on tcp://44391
[ 31.331832][ T36] audit: type=1400 audit(1785393344.640:64): avc: denied { node_bind } for pid=302 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1
[ 32.836446][ T36] audit: type=1400 audit(1785393346.140:65): avc: denied { mounton } for pid=308 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 32.839761][ T308] cgroup: Unknown subsys name 'net'
[ 32.859563][ T36] audit: type=1400 audit(1785393346.140:66): avc: denied { mount } for pid=308 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 32.886563][ T36] audit: type=1400 audit(1785393346.180:67): avc: denied { unmount } for pid=308 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 32.887005][ T308] cgroup: Unknown subsys name 'devices'
[ 33.013031][ T308] cgroup: Unknown subsys name 'hugetlb'
[ 33.018647][ T308] cgroup: Unknown subsys name 'rlimit'
[ 33.142178][ T36] audit: type=1400 audit(1785393346.450:68): avc: denied { setattr } for pid=308 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 33.165360][ T36] audit: type=1400 audit(1785393346.450:69): avc: denied { create } for pid=308 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 33.185750][ T36] audit: type=1400 audit(1785393346.450:70): avc: denied { write } for pid=308 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 33.206161][ T36] audit: type=1400 audit(1785393346.450:71): avc: denied { read } for pid=308 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
Setting up swapspace version 1, size = 127995904 bytes
[ 33.226471][ T36] audit: type=1400 audit(1785393346.450:72): avc: denied { sys_module } for pid=308 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1
[ 33.232082][ T312] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped).
[ 33.247861][ T36] audit: type=1400 audit(1785393346.450:73): avc: denied { mounton } for pid=308 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1
[ 33.281189][ T308] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 34.304881][ T319] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 34.817043][ T343] bridge0: port 1(bridge_slave_0) entered blocking state
[ 34.842032][ T343] bridge0: port 1(bridge_slave_0) entered disabled state
[ 34.849149][ T343] bridge_slave_0: entered allmulticast mode
[ 34.886885][ T343] bridge_slave_0: entered promiscuous mode
[ 34.934017][ T343] bridge0: port 2(bridge_slave_1) entered blocking state
[ 34.941146][ T343] bridge0: port 2(bridge_slave_1) entered disabled state
[ 34.948237][ T343] bridge_slave_1: entered allmulticast mode
[ 34.954739][ T343] bridge_slave_1: entered promiscuous mode
[ 35.106765][ T343] bridge0: port 2(bridge_slave_1) entered blocking state
[ 35.113871][ T343] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 35.121193][ T343] bridge0: port 1(bridge_slave_0) entered blocking state
[ 35.128238][ T343] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 35.161339][ T46] bridge0: port 1(bridge_slave_0) entered disabled state
[ 35.169105][ T46] bridge0: port 2(bridge_slave_1) entered disabled state
[ 35.183927][ T337] bridge0: port 1(bridge_slave_0) entered blocking state
[ 35.191001][ T337] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 35.215243][ T46] bridge0: port 2(bridge_slave_1) entered blocking state
[ 35.222333][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 35.257402][ T343] veth0_vlan: entered promiscuous mode
[ 35.270598][ T343] veth1_macvtap: entered promiscuous mode
2026/07/30 06:35:48 executed programs: 0
[ 35.478267][ T383] bridge0: port 1(bridge_slave_0) entered blocking state
[ 35.485561][ T383] bridge0: port 1(bridge_slave_0) entered disabled state
[ 35.492960][ T383] bridge_slave_0: entered allmulticast mode
[ 35.499191][ T383] bridge_slave_0: entered promiscuous mode
[ 35.506518][ T383] bridge0: port 2(bridge_slave_1) entered blocking state
[ 35.513764][ T383] bridge0: port 2(bridge_slave_1) entered disabled state
[ 35.520858][ T383] bridge_slave_1: entered allmulticast mode
[ 35.527071][ T383] bridge_slave_1: entered promiscuous mode
[ 35.594918][ T384] bridge0: port 1(bridge_slave_0) entered blocking state
[ 35.601999][ T384] bridge0: port 1(bridge_slave_0) entered disabled state
[ 35.609053][ T384] bridge_slave_0: entered allmulticast mode
[ 35.615401][ T384] bridge_slave_0: entered promiscuous mode
[ 35.630306][ T384] bridge0: port 2(bridge_slave_1) entered blocking state
[ 35.638069][ T384] bridge0: port 2(bridge_slave_1) entered disabled state
[ 35.645298][ T384] bridge_slave_1: entered allmulticast mode
[ 35.651622][ T384] bridge_slave_1: entered promiscuous mode
[ 35.659152][ T386] bridge0: port 1(bridge_slave_0) entered blocking state
[ 35.666236][ T386] bridge0: port 1(bridge_slave_0) entered disabled state
[ 35.673375][ T386] bridge_slave_0: entered allmulticast mode
[ 35.679564][ T386] bridge_slave_0: entered promiscuous mode
[ 35.703789][ T386] bridge0: port 2(bridge_slave_1) entered blocking state
[ 35.711014][ T386] bridge0: port 2(bridge_slave_1) entered disabled state
[ 35.718256][ T386] bridge_slave_1: entered allmulticast mode
[ 35.724641][ T386] bridge_slave_1: entered promiscuous mode
[ 35.734242][ T46] bridge_slave_1: left allmulticast mode
[ 35.739911][ T46] bridge_slave_1: left promiscuous mode
[ 35.745717][ T46] bridge0: port 2(bridge_slave_1) entered disabled state
[ 35.753968][ T46] bridge_slave_0: left allmulticast mode
[ 35.759608][ T46] bridge_slave_0: left promiscuous mode
[ 35.765343][ T46] bridge0: port 1(bridge_slave_0) entered disabled state
[ 35.852584][ T381] bridge0: port 1(bridge_slave_0) entered blocking state
[ 35.859749][ T381] bridge0: port 1(bridge_slave_0) entered disabled state
[ 35.866894][ T381] bridge_slave_0: entered allmulticast mode
[ 35.873364][ T381] bridge_slave_0: entered promiscuous mode
[ 35.892059][ T381] bridge0: port 2(bridge_slave_1) entered blocking state
[ 35.899152][ T381] bridge0: port 2(bridge_slave_1) entered disabled state
[ 35.906345][ T381] bridge_slave_1: entered allmulticast mode
[ 35.912751][ T381] bridge_slave_1: entered promiscuous mode
[ 35.935577][ T46] veth1_macvtap: left promiscuous mode
[ 35.941160][ T46] veth0_vlan: left promiscuous mode
[ 36.004359][ T383] bridge0: port 2(bridge_slave_1) entered blocking state
[ 36.011475][ T383] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 36.018752][ T383] bridge0: port 1(bridge_slave_0) entered blocking state
[ 36.025817][ T383] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 36.121573][ T338] bridge0: port 1(bridge_slave_0) entered disabled state
[ 36.129017][ T338] bridge0: port 2(bridge_slave_1) entered disabled state
[ 36.144006][ T337] bridge0: port 1(bridge_slave_0) entered blocking state
[ 36.151179][ T337] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 36.173925][ T338] bridge0: port 2(bridge_slave_1) entered blocking state
[ 36.181004][ T338] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 36.223098][ T338] bridge0: port 1(bridge_slave_0) entered blocking state
[ 36.230222][ T338] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 36.238318][ T338] bridge0: port 2(bridge_slave_1) entered blocking state
[ 36.245384][ T338] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 36.263875][ T337] bridge0: port 1(bridge_slave_0) entered blocking state
[ 36.270956][ T337] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 36.284984][ T337] bridge0: port 2(bridge_slave_1) entered blocking state
[ 36.292043][ T337] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 36.301372][ T338] bridge0: port 1(bridge_slave_0) entered blocking state
[ 36.308478][ T338] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 36.320701][ T338] bridge0: port 2(bridge_slave_1) entered blocking state
[ 36.327785][ T338] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 36.363094][ T383] veth0_vlan: entered promiscuous mode
[ 36.383096][ T381] veth0_vlan: entered promiscuous mode
[ 36.393036][ T386] veth0_vlan: entered promiscuous mode
[ 36.407519][ T384] veth0_vlan: entered promiscuous mode
[ 36.420704][ T381] veth1_macvtap: entered promiscuous mode
[ 36.428163][ T386] veth1_macvtap: entered promiscuous mode
[ 36.449677][ T383] veth1_macvtap: entered promiscuous mode
[ 36.467975][ T384] veth1_macvtap: entered promiscuous mode
[ 36.509259][ T36] kauditd_printk_skb: 31 callbacks suppressed
[ 36.509278][ T36] audit: type=1400 audit(1785393349.810:105): avc: denied { mount } for pid=399 comm="syz.0.17" name="/" dev="configfs" ino=907 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1
[ 36.562713][ T36] audit: type=1400 audit(1785393349.810:106): avc: denied { search } for pid=399 comm="syz.0.17" name="/" dev="configfs" ino=907 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 36.640329][ T36] audit: type=1400 audit(1785393349.810:107): avc: denied { write } for pid=399 comm="syz.0.17" name="usb_gadget" dev="configfs" ino=908 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 36.671404][ T36] audit: type=1400 audit(1785393349.810:108): avc: denied { add_name } for pid=399 comm="syz.0.17" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 36.717913][ T36] audit: type=1400 audit(1785393349.810:109): avc: denied { create } for pid=399 comm="syz.0.17" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1
[ 36.786400][ T36] audit: type=1400 audit(1785393349.810:110): avc: denied { create } for pid=399 comm="syz.0.17" name="uac2.usb0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=lnk_file permissive=1
[ 36.810366][ T36] audit: type=1400 audit(1785393349.810:111): avc: denied { remove_name } for pid=399 comm="syz.0.17" name="uac2.usb0" dev="configfs" ino=5125 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 36.911435][ T36] audit: type=1400 audit(1785393349.810:112): avc: denied { unlink } for pid=399 comm="syz.0.17" name="uac2.usb0" dev="configfs" ino=5125 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=lnk_file permissive=1
[ 36.960115][ T36] audit: type=1400 audit(1785393349.810:113): avc: denied { rmdir } for pid=399 comm="syz.0.17" name="uac2.usb0" dev="configfs" ino=5124 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 37.004581][ T36] audit: type=1400 audit(1785393349.810:114): avc: denied { unmount } for pid=381 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1
2026/07/30 06:35:53 executed programs: 586
2026/07/30 06:35:58 executed programs: 1506
[ 47.878555][ T4470] ==================================================================
[ 47.886675][ T4470] BUG: KASAN: slab-use-after-free in config_item_get+0x2b/0xa0
[ 47.894251][ T4470] Write of size 4 at addr ffff8881164d101c by task syz.0.2050/4470
[ 47.902170][ T4470]
[ 47.904521][ T4470] CPU: 0 UID: 0 PID: 4470 Comm: syz.0.2050 Not tainted syzkaller #0 0b31bef96cff8e44f9e14c4f768eb06c85e3b290
[ 47.904543][ T4470] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 47.904561][ T4470] Call Trace:
[ 47.904568][ T4470]
[ 47.904575][ T4470] __dump_stack+0x21/0x30
[ 47.904602][ T4470] dump_stack_lvl+0x140/0x1c0
[ 47.904625][ T4470] ? __cfi_dump_stack_lvl+0x10/0x10
[ 47.904649][ T4470] ? __cfi__printk+0x10/0x10
[ 47.904671][ T4470] print_address_description+0x71/0x210
[ 47.904695][ T4470] print_report+0x4a/0x70
[ 47.904718][ T4470] kasan_report+0x162/0x1a0
[ 47.904740][ T4470] ? config_item_get+0x2b/0xa0
[ 47.904764][ T4470] ? __kasan_check_write+0x18/0x20
[ 47.904781][ T4470] ? config_item_get+0x2b/0xa0
[ 47.904805][ T4470] kasan_check_range+0x25a/0x2b0
[ 47.904827][ T4470] __kasan_check_write+0x18/0x20
[ 47.904843][ T4470] config_item_get+0x2b/0xa0
[ 47.904867][ T4470] configfs_symlink+0x455/0x1050
[ 47.904892][ T4470] ? generic_permission+0x1ec/0x590
[ 47.904911][ T4470] ? __cfi_configfs_symlink+0x10/0x10
[ 47.904935][ T4470] ? selinux_inode_symlink+0x26/0x30
[ 47.904959][ T4470] ? bpf_lsm_inode_symlink+0xd/0x20
[ 47.904980][ T4470] ? security_inode_symlink+0x7e/0x170
[ 47.905003][ T4470] vfs_symlink+0x3f7/0x620
[ 47.905028][ T4470] do_symlinkat+0x1ba/0x400
[ 47.905052][ T4470] ? __cfi_do_symlinkat+0x10/0x10
[ 47.905076][ T4470] ? __kasan_check_write+0x18/0x20
[ 47.905093][ T4470] ? getname_flags+0x203/0x6b0
[ 47.905111][ T4470] ? __kasan_check_write+0x18/0x20
[ 47.905128][ T4470] __x64_sys_symlinkat+0x99/0xb0
[ 47.905152][ T4470] x64_sys_call+0x1f79/0x2ee0
[ 47.905167][ T4470] do_syscall_64+0x57/0xf0
[ 47.905187][ T4470] ? clear_bhb_loop+0x50/0xa0
[ 47.905210][ T4470] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 47.905243][ T4470] RIP: 0033:0x7fcbf559df99
[ 47.905257][ T4470] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 47.905271][ T4470] RSP: 002b:00007fcbf64fb028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a
[ 47.905291][ T4470] RAX: ffffffffffffffda RBX: 00007fcbf5825fa0 RCX: 00007fcbf559df99
[ 47.905303][ T4470] RDX: 0000200000000340 RSI: ffffffffffffff9c RDI: 0000200000000300
[ 47.905315][ T4470] RBP: 00007fcbf5634ec4 R08: 0000000000000000 R09: 0000000000000000
[ 47.905325][ T4470] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 47.905334][ T4470] R13: 00007fcbf5826038 R14: 00007fcbf5825fa0 R15: 00007ffc978cf208
[ 47.905353][ T4470]
[ 47.905359][ T4470]
[ 48.158155][ T4470] Allocated by task 4470:
[ 48.162506][ T4470] kasan_save_track+0x3e/0x80
[ 48.167196][ T4470] kasan_save_alloc_info+0x3a/0x50
[ 48.172317][ T4470] __kasan_kmalloc+0x96/0xb0
[ 48.176937][ T4470] __kmalloc_cache_noprof+0x23c/0x470
[ 48.182324][ T4470] afunc_alloc_inst+0x5e/0x810
[ 48.187103][ T4470] usb_get_function_instance+0xf7/0x320
[ 48.192655][ T4470] function_make+0x125/0x370
[ 48.197260][ T4470] configfs_mkdir+0x523/0xb70
[ 48.201945][ T4470] vfs_mkdir+0x58e/0x810
[ 48.206206][ T4470] do_mkdirat+0x240/0x530
[ 48.210578][ T4470] __x64_sys_mkdirat+0x8b/0xa0
[ 48.215346][ T4470] x64_sys_call+0x2ba8/0x2ee0
[ 48.220097][ T4470] do_syscall_64+0x57/0xf0
[ 48.224605][ T4470] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 48.230516][ T4470]
[ 48.232865][ T4470] Freed by task 4469:
[ 48.236849][ T4470] kasan_save_track+0x3e/0x80
[ 48.241567][ T4470] kasan_save_free_info+0x44/0x50
[ 48.246608][ T4470] __kasan_slab_free+0x5f/0x80
[ 48.251380][ T4470] kfree+0x158/0x440
[ 48.255286][ T4470] afunc_free_inst+0x19/0x30
[ 48.259907][ T4470] usb_put_function_instance+0xa2/0xc0
[ 48.265387][ T4470] f_uac2_attr_release+0x19/0x30
[ 48.270335][ T4470] config_item_put+0x178/0x240
[ 48.275110][ T4470] configfs_rmdir+0x8e8/0x9b0
[ 48.279804][ T4470] vfs_rmdir+0x3de/0x560
[ 48.284060][ T4470] do_rmdir+0x29a/0x590
[ 48.288231][ T4470] __x64_sys_unlinkat+0xc9/0xf0
[ 48.293092][ T4470] x64_sys_call+0x2974/0x2ee0
[ 48.297776][ T4470] do_syscall_64+0x57/0xf0
[ 48.302205][ T4470] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 48.308106][ T4470]
[ 48.310443][ T4470] The buggy address belongs to the object at ffff8881164d1000
[ 48.310443][ T4470] which belongs to the cache kmalloc-2k of size 2048
[ 48.324497][ T4470] The buggy address is located 28 bytes inside of
[ 48.324497][ T4470] freed 2048-byte region [ffff8881164d1000, ffff8881164d1800)
[ 48.338299][ T4470]
[ 48.340622][ T4470] The buggy address belongs to the physical page:
[ 48.347034][ T4470] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1164d0
[ 48.355880][ T4470] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 48.364391][ T4470] anon flags: 0x4000000000000040(head|zone=1)
[ 48.370483][ T4470] page_type: f5(slab)
[ 48.374471][ T4470] raw: 4000000000000040 ffff888100042000 0000000000000000 dead000000000001
[ 48.383070][ T4470] raw: 0000000000000000 0000000080080008 00000001f5000000 0000000000000000
[ 48.391662][ T4470] head: 4000000000000040 ffff888100042000 0000000000000000 dead000000000001
[ 48.400340][ T4470] head: 0000000000000000 0000000080080008 00000001f5000000 0000000000000000
[ 48.409007][ T4470] head: 4000000000000003 ffffea0004593401 ffffffffffffffff 0000000000000000
[ 48.417672][ T4470] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
[ 48.426335][ T4470] page dumped because: kasan: bad access detected
[ 48.432766][ T4470] page_owner tracks the page as allocated
[ 48.438488][ T4470] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 386, tgid 386 (syz-executor), ts 35890084779, free_ts 35856036977
[ 48.461063][ T4470] post_alloc_hook+0x37d/0x3b0
[ 48.465854][ T4470] prep_new_page+0x2d/0x180
[ 48.470370][ T4470] get_page_from_freelist+0x4aea/0x4ba0
[ 48.475926][ T4470] __alloc_pages_noprof+0x35a/0x7e0
[ 48.481139][ T4470] alloc_slab_page+0x6b/0x1e0
[ 48.485830][ T4470] allocate_slab+0x69/0x430
[ 48.490341][ T4470] ___slab_alloc+0x591/0x8c0
[ 48.494937][ T4470] __kmalloc_node_track_caller_noprof+0x2e3/0x4f0
[ 48.501363][ T4470] kmemdup_noprof+0x31/0x80
[ 48.505888][ T4470] neigh_sysctl_register+0xcc/0xb20
[ 48.511102][ T4470] addrconf_sysctl_register+0xb9/0x1c0
[ 48.516575][ T4470] ipv6_add_dev+0xc0a/0x1410
[ 48.521163][ T4470] addrconf_notify+0x56e/0xeb0
[ 48.525938][ T4470] notifier_call_chain+0x106/0x2b0
[ 48.531063][ T4470] raw_notifier_call_chain+0x31/0x40
[ 48.536365][ T4470] call_netdevice_notifiers+0x11d/0x1a0
[ 48.541921][ T4470] page last free pid 384 tgid 384 stack trace:
[ 48.548077][ T4470] free_unref_page+0xbb8/0xf70
[ 48.552853][ T4470] __free_pages+0x6b/0x3b0
[ 48.557282][ T4470] __free_slab+0xb2/0x110
[ 48.561616][ T4470] free_slab+0x18/0xe0
[ 48.565702][ T4470] __put_partials+0x115/0x150
[ 48.570389][ T4470] put_cpu_partial+0x91/0xc0
[ 48.574986][ T4470] __slab_free+0x1cf/0x2a0
[ 48.579419][ T4470] ___cache_free+0xc9/0xe0
[ 48.583839][ T4470] qlist_free_all+0xb5/0x130
[ 48.588436][ T4470] kasan_quarantine_reduce+0x14f/0x180
[ 48.593928][ T4470] __kasan_slab_alloc+0x28/0x90
[ 48.598799][ T4470] kmem_cache_alloc_node_noprof+0x1ca/0x420
[ 48.604692][ T4470] __alloc_skb+0x10c/0x360
[ 48.609140][ T4470] netlink_ack+0x155/0xa50
[ 48.613558][ T4470] netlink_rcv_skb+0x2cb/0x4e0
[ 48.618330][ T4470] rtnetlink_rcv+0x20/0x30
[ 48.622754][ T4470]
[ 48.625090][ T4470] Memory state around the buggy address:
[ 48.630732][ T4470] ffff8881164d0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 48.638816][ T4470] ffff8881164d0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 48.646878][ T4470] >ffff8881164d1000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 48.654932][ T4470] ^
[ 48.659783][ T4470] ffff8881164d1080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 48.667845][ T4470] ffff8881164d1100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 48.675911][ T4470] ==================================================================
[ 48.684179][ T4470] Disabling lock debugging due to kernel taint
[ 48.690346][ T4470] ------------[ cut here ]------------
[ 48.695821][ T4470] refcount_t: addition on 0; use-after-free.
[ 48.701949][ T4470] WARNING: CPU: 0 PID: 4470 at lib/refcount.c:25 refcount_warn_saturate+0xfd/0x1c0
[ 48.711281][ T4470] Modules linked in:
[ 48.715191][ T4470] CPU: 0 UID: 0 PID: 4470 Comm: syz.0.2050 Tainted: G B syzkaller #0 0b31bef96cff8e44f9e14c4f768eb06c85e3b290
[ 48.728235][ T4470] Tainted: [B]=BAD_PAGE
[ 48.732397][ T4470] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 48.742473][ T4470] RIP: 0010:refcount_warn_saturate+0xfd/0x1c0
[ 48.748563][ T4470] Code: 00 00 00 e8 c5 a1 d8 fe 5b 41 5e 5d c3 cc cc cc cc cc e8 b6 a1 d8 fe c6 05 b3 74 36 05 01 48 c7 c7 80 ee 51 86 e8 d3 79 55 fe <0f> 0b eb da e8 9a a1 d8 fe c6 05 98 74 36 05 01 48 c7 c7 e0 ee 51
[ 48.768196][ T4470] RSP: 0018:ffffc900041dfc38 EFLAGS: 00010246
[ 48.774315][ T4470] RAX: b1a9dde3e0a77e00 RBX: 0000000000000002 RCX: ffff8881162e4c00
[ 48.782337][ T4470] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
[ 48.790319][ T4470] RBP: ffffc900041dfc48 R08: 0000000000000003 R09: 0000000000000004
[ 48.799008][ T4470] R10: dffffc0000000000 R11: fffffbfff0e9f34c R12: ffff888121ac7d50
[ 48.807383][ T4470] R13: dffffc0000000000 R14: ffff8881164d101c R15: 0000000000000000
[ 48.815397][ T4470] FS: 00007fcbf64fb6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
[ 48.824357][ T4470] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 48.830970][ T4470] CR2: 0000001b34763fff CR3: 000000012d95a000 CR4: 00000000003526b0
[ 48.838959][ T4470] Call Trace:
[ 48.842261][ T4470]
[ 48.845206][ T4470] config_item_get+0x95/0xa0
[ 48.849816][ T4470] configfs_symlink+0x455/0x1050
[ 48.854796][ T4470] ? generic_permission+0x1ec/0x590
[ 48.860008][ T4470] ? __cfi_configfs_symlink+0x10/0x10
[ 48.865412][ T4470] ? selinux_inode_symlink+0x26/0x30
[ 48.870721][ T4470] ? bpf_lsm_inode_symlink+0xd/0x20
[ 48.875981][ T4470] ? security_inode_symlink+0x7e/0x170
[ 48.881473][ T4470] vfs_symlink+0x3f7/0x620
[ 48.885915][ T4470] do_symlinkat+0x1ba/0x400
[ 48.890454][ T4470] ? __cfi_do_symlinkat+0x10/0x10
[ 48.895512][ T4470] ? __kasan_check_write+0x18/0x20
[ 48.900656][ T4470] ? getname_flags+0x203/0x6b0
[ 48.905449][ T4470] ? __kasan_check_write+0x18/0x20
[ 48.910574][ T4470] __x64_sys_symlinkat+0x99/0xb0
[ 48.915548][ T4470] x64_sys_call+0x1f79/0x2ee0
[ 48.920256][ T4470] do_syscall_64+0x57/0xf0
[ 48.924694][ T4470] ? clear_bhb_loop+0x50/0xa0
[ 48.929391][ T4470] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 48.935310][ T4470] RIP: 0033:0x7fcbf559df99
[ 48.939742][ T4470] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 48.959396][ T4470] RSP: 002b:00007fcbf64fb028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a
[ 48.967836][ T4470] RAX: ffffffffffffffda RBX: 00007fcbf5825fa0 RCX: 00007fcbf559df99
[ 48.975833][ T4470] RDX: 0000200000000340 RSI: ffffffffffffff9c RDI: 0000200000000300
[ 48.983855][ T4470] RBP: 00007fcbf5634ec4 R08: 0000000000000000 R09: 0000000000000000
[ 48.991884][ T4470] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 48.999958][ T4470] R13: 00007fcbf5826038 R14: 00007fcbf5825fa0 R15: 00007ffc978cf208
[ 49.007965][ T4470]
[ 49.011051][ T4470] ---[ end trace 0000000000000000 ]---
[ 49.020999][ T4470] ------------[ cut here ]------------
[ 49.026534][ T4470] refcount_t: underflow; use-after-free.
[ 49.032450][ T4470] WARNING: CPU: 0 PID: 4470 at lib/refcount.c:28 refcount_warn_saturate+0x119/0x1c0
[ 49.041908][ T4470] Modules linked in:
[ 49.045863][ T4470] CPU: 0 UID: 0 PID: 4470 Comm: syz.0.2050 Tainted: G B W syzkaller #0 0b31bef96cff8e44f9e14c4f768eb06c85e3b290
[ 49.058954][ T4470] Tainted: [B]=BAD_PAGE, [W]=WARN
[ 49.064017][ T4470] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 49.074134][ T4470] RIP: 0010:refcount_warn_saturate+0x119/0x1c0
[ 49.080341][ T4470] Code: 05 01 48 c7 c7 80 ee 51 86 e8 d3 79 55 fe 0f 0b eb da e8 9a a1 d8 fe c6 05 98 74 36 05 01 48 c7 c7 e0 ee 51 86 e8 b7 79 55 fe <0f> 0b eb be e8 7e a1 d8 fe c6 05 79 74 36 05 01 48 c7 c7 20 ee 51
[ 49.100029][ T4470] RSP: 0018:ffffc900041dfc18 EFLAGS: 00010246
[ 49.106204][ T4470] RAX: b1a9dde3e0a77e00 RBX: 0000000000000003 RCX: ffff8881162e4c00
[ 49.114235][ T4470] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
[ 49.122273][ T4470] RBP: ffffc900041dfc28 R08: 0000000000000003 R09: 0000000000000004
[ 49.130267][ T4470] R10: dffffc0000000000 R11: fffffbfff0e9f34c R12: 00000000ffffffea
[ 49.138313][ T4470] R13: dffffc0000000000 R14: ffff8881164d101c R15: 00000000c0000000
[ 49.146356][ T4470] FS: 00007fcbf64fb6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
[ 49.155381][ T4470] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 49.162021][ T4470] CR2: 0000555571108918 CR3: 000000012d95a000 CR4: 00000000003526b0
[ 49.170027][ T4470] Call Trace:
[ 49.171062][ T36] audit: type=1400 audit(1785393362.350:115): avc: denied { read } for pid=92 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1
[ 49.173418][ T4470]
[ 49.198206][ T4470] config_item_put+0x230/0x240
[ 49.200655][ T36] audit: type=1400 audit(1785393362.350:116): avc: denied { search } for pid=92 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 49.203644][ T4470] configfs_symlink+0x4b5/0x1050
[ 49.229380][ T4470] ? generic_permission+0x1ec/0x590
[ 49.230497][ T36] audit: type=1400 audit(1785393362.350:117): avc: denied { write } for pid=92 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 49.234634][ T4470] ? __cfi_configfs_symlink+0x10/0x10
[ 49.260972][ T36] audit: type=1400 audit(1785393362.350:118): avc: denied { add_name } for pid=92 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[ 49.261251][ T4470] ? selinux_inode_symlink+0x26/0x30
[ 49.284236][ T36] audit: type=1400 audit(1785393362.350:119): avc: denied { create } for pid=92 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 49.287027][ T4470] ? bpf_lsm_inode_symlink+0xd/0x20
[ 49.308160][ T36] audit: type=1400 audit(1785393362.350:120): avc: denied { append open } for pid=92 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 49.312668][ T4470] ? security_inode_symlink+0x7e/0x170
[ 49.312702][ T4470] vfs_symlink+0x3f7/0x620
[ 49.345563][ T4470] do_symlinkat+0x1ba/0x400
[ 49.350150][ T4470] ? __cfi_do_symlinkat+0x10/0x10
[ 49.355259][ T4470] ? __kasan_check_write+0x18/0x20
[ 49.360404][ T4470] ? getname_flags+0x203/0x6b0
[ 49.363048][ T36] audit: type=1400 audit(1785393362.350:121): avc: denied { getattr } for pid=92 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1
[ 49.365249][ T4470] ? __kasan_check_write+0x18/0x20
[ 49.365279][ T4470] __x64_sys_symlinkat+0x99/0xb0
[ 49.365313][ T4470] x64_sys_call+0x1f79/0x2ee0
[ 49.365335][ T4470] do_syscall_64+0x57/0xf0
[ 49.407085][ T4470] ? clear_bhb_loop+0x50/0xa0
[ 49.411837][ T4470] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 49.417761][ T4470] RIP: 0033:0x7fcbf559df99
[ 49.422224][ T4470] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 49.443664][ T4470] RSP: 002b:00007fcbf64fb028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a
[ 49.452757][ T4470] RAX: ffffffffffffffda RBX: 00007fcbf5825fa0 RCX: 00007fcbf559df99
[ 49.460801][ T4470] RDX: 0000200000000340 RSI: ffffffffffffff9c RDI: 0000200000000300
[ 49.468808][ T4470] RBP: 00007fcbf5634ec4 R08: 0000000000000000 R09: 0000000000000000
[ 49.476938][ T4470] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 49.484959][ T4470] R13: 00007fcbf5826038 R14: 00007fcbf5825fa0 R15: 00007ffc978cf208
[ 49.493016][ T4470]
[ 49.496054][ T4470] ---[ end trace 0000000000000000 ]---
2026/07/30 06:36:03 executed programs: 2217
[ 51.303835][ T12] bridge_slave_1: left allmulticast mode
[ 51.309590][ T12] bridge_slave_1: left promiscuous mode
[ 51.332881][ T12] bridge0: port 2(bridge_slave_1) entered disabled state
[ 51.351767][ T12] bridge_slave_0: left allmulticast mode
[ 51.357456][ T12] bridge_slave_0: left promiscuous mode
[ 51.376641][ T12] bridge0: port 1(bridge_slave_0) entered disabled state
[ 51.466346][ T5188] bridge0: port 1(bridge_slave_0) entered blocking state
[ 51.475774][ T5188] bridge0: port 1(bridge_slave_0) entered disabled state
[ 51.483058][ T5188] bridge_slave_0: entered allmulticast mode
[ 51.489508][ T5188] bridge_slave_0: entered promiscuous mode
[ 51.497122][ T5188] bridge0: port 2(bridge_slave_1) entered blocking state
[ 51.512421][ T5188] bridge0: port 2(bridge_slave_1) entered disabled state
[ 51.520461][ T5188] bridge_slave_1: entered allmulticast mode
[ 51.528781][ T5188] bridge_slave_1: entered promiscuous mode
[ 51.539754][ T12] veth1_macvtap: left promiscuous mode
[ 51.545741][ T12] veth0_vlan: left promiscuous mode
[ 51.728610][ T5188] bridge0: port 2(bridge_slave_1) entered blocking state
[ 51.735727][ T5188] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 51.743071][ T5188] bridge0: port 1(bridge_slave_0) entered blocking state
[ 51.750106][ T5188] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 51.794536][ T338] bridge0: port 1(bridge_slave_0) entered disabled state
[ 51.804247][ T338] bridge0: port 2(bridge_slave_1) entered disabled state
[ 51.816894][ T337] bridge0: port 1(bridge_slave_0) entered blocking state
[ 51.823990][ T337] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 51.838211][ T338] bridge0: port 2(bridge_slave_1) entered blocking state
[ 51.845304][ T338] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 51.890456][ T5188] veth0_vlan: entered promiscuous mode
[ 51.906044][ T5188] veth1_macvtap: entered promiscuous mode
[ 52.006093][ T12] bridge_slave_1: left allmulticast mode
[ 52.018973][ T12] bridge_slave_1: left promiscuous mode
[ 52.024812][ T12] bridge0: port 2(bridge_slave_1) entered disabled state
[ 52.033158][ T12] bridge_slave_0: left allmulticast mode
[ 52.039051][ T12] bridge_slave_0: left promiscuous mode
[ 52.044845][ T12] bridge0: port 1(bridge_slave_0) entered disabled state
[ 52.168961][ T5409] bridge0: port 1(bridge_slave_0) entered blocking state
[ 52.176111][ T5409] bridge0: port 1(bridge_slave_0) entered disabled state
[ 52.183334][ T5409] bridge_slave_0: entered allmulticast mode
[ 52.189727][ T5409] bridge_slave_0: entered promiscuous mode
[ 52.198110][ T5409] bridge0: port 2(bridge_slave_1) entered blocking state
[ 52.206356][ T5409] bridge0: port 2(bridge_slave_1) entered disabled state
[ 52.213645][ T5409] bridge_slave_1: entered allmulticast mode
[ 52.219932][ T5409] bridge_slave_1: entered promiscuous mode
[ 52.234481][ T12] veth1_macvtap: left promiscuous mode
[ 52.240240][ T12] veth0_vlan: left promiscuous mode
[ 52.447674][ T338] bridge0: port 1(bridge_slave_0) entered blocking state
[ 52.454790][ T338] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 52.463573][ T338] bridge0: port 2(bridge_slave_1) entered blocking state
[ 52.470644][ T338] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 52.545867][ T5409] veth0_vlan: entered promiscuous mode
[ 52.567305][ T5409] veth1_macvtap: entered promiscuous mode
[ 52.703022][ T5608] bridge0: port 1(bridge_slave_0) entered blocking state
[ 52.710130][ T5608] bridge0: port 1(bridge_slave_0) entered disabled state
[ 52.732121][ T5608] bridge_slave_0: entered allmulticast mode
[ 52.738690][ T5608] bridge_slave_0: entered promiscuous mode
[ 52.752920][ T338] bridge_slave_1: left allmulticast mode
[ 52.758624][ T338] bridge_slave_1: left promiscuous mode
[ 52.770081][ T338] bridge0: port 2(bridge_slave_1) entered disabled state
[ 52.779106][ T338] bridge_slave_0: left allmulticast mode
[ 52.786513][ T338] bridge_slave_0: left promiscuous mode
[ 52.792616][ T338] bridge0: port 1(bridge_slave_0) entered disabled state
[ 52.879083][ T5608] bridge0: port 2(bridge_slave_1) entered blocking state
[ 52.889004][ T5608] bridge0: port 2(bridge_slave_1) entered disabled state
[ 52.897183][ T5608] bridge_slave_1: entered allmulticast mode
[ 52.915924][ T5608] bridge_slave_1: entered promiscuous mode
[ 52.962064][ T338] veth1_macvtap: left promiscuous mode
[ 52.967646][ T338] veth0_vlan: left promiscuous mode
[ 53.123432][ T5608] bridge0: port 2(bridge_slave_1) entered blocking state
[ 53.130564][ T5608] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 53.137926][ T5608] bridge0: port 1(bridge_slave_0) entered blocking state
[ 53.144998][ T5608] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 53.187391][ T12] bridge0: port 1(bridge_slave_0) entered disabled state
[ 53.208474][ T12] bridge0: port 2(bridge_slave_1) entered disabled state
[ 53.234811][ T46] bridge0: port 1(bridge_slave_0) entered blocking state
[ 53.241927][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 53.265139][ T46] bridge0: port 2(bridge_slave_1) entered blocking state
[ 53.272248][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 53.303312][ T5608] veth0_vlan: entered promiscuous mode
[ 53.318378][ T5608] veth1_macvtap: entered promiscuous mode
[ 53.495427][ T12] bridge_slave_1: left allmulticast mode
[ 53.501245][ T12] bridge_slave_1: left promiscuous mode
[ 53.506919][ T12] bridge0: port 2(bridge_slave_1) entered disabled state
[ 53.514590][ T12] bridge_slave_0: left allmulticast mode
[ 53.520366][ T12] bridge_slave_0: left promiscuous mode
[ 53.527664][ T12] bridge0: port 1(bridge_slave_0) entered disabled state
[ 53.634011][ T5837] bridge0: port 1(bridge_slave_0) entered blocking state
[ 53.650905][ T5837] bridge0: port 1(bridge_slave_0) entered disabled state
[ 53.659574][ T5837] bridge_slave_0: entered allmulticast mode
[ 53.666776][ T5837] bridge_slave_0: entered promiscuous mode
[ 53.678294][ T5837] bridge0: port 2(bridge_slave_1) entered blocking state
[ 53.688103][ T5837] bridge0: port 2(bridge_slave_1) entered disabled state
[ 53.696024][ T5837] bridge_slave_1: entered allmulticast mode
[ 53.702644][ T5837] bridge_slave_1: entered promiscuous mode
[ 53.714097][ T12] veth1_macvtap: left promiscuous mode
[ 53.719609][ T12] veth0_vlan: left promiscuous mode
[ 53.947697][ T5837] bridge0: port 2(bridge_slave_1) entered blocking state
[ 53.954836][ T5837] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 53.962179][ T5837] bridge0: port 1(bridge_slave_0) entered blocking state
[ 53.969282][ T5837] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 54.040408][ T338] bridge0: port 2(bridge_slave_1) entered disabled state
[ 54.052581][ T5811] bridge0: port 2(bridge_slave_1) entered blocking state
[ 54.059676][ T5811] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 54.116714][ T5837] veth0_vlan: entered promiscuous mode
[ 54.132324][ T5837] veth1_macvtap: entered promiscuous mode
2026/07/30 06:36:08 executed programs: 3071