Warning: Permanently added '10.128.0.228' (ED25519) to the list of known hosts. 2025/09/07 01:25:43 parsed 1 programs [ 27.767074][ T24] audit: type=1400 audit(1757208343.440:64): avc: denied { node_bind } for pid=275 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 27.789774][ T24] audit: type=1400 audit(1757208343.440:65): avc: denied { create } for pid=275 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 27.811580][ T24] audit: type=1400 audit(1757208343.440:66): avc: denied { module_request } for pid=275 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 28.482593][ T24] audit: type=1400 audit(1757208344.160:67): avc: denied { mounton } for pid=282 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 28.483531][ T282] cgroup: Unknown subsys name 'net' [ 28.506950][ T24] audit: type=1400 audit(1757208344.160:68): avc: denied { mount } for pid=282 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 28.536984][ T24] audit: type=1400 audit(1757208344.200:69): avc: denied { unmount } for pid=282 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 28.537207][ T282] cgroup: Unknown subsys name 'devices' [ 28.711749][ T282] cgroup: Unknown subsys name 'hugetlb' [ 28.717543][ T282] cgroup: Unknown subsys name 'rlimit' [ 28.909428][ T24] audit: type=1400 audit(1757208344.580:70): avc: denied { setattr } for pid=282 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 28.934871][ T24] audit: type=1400 audit(1757208344.580:71): avc: denied { create } for pid=282 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 28.940581][ T286] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 28.959096][ T24] audit: type=1400 audit(1757208344.580:72): avc: denied { write } for pid=282 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 28.990419][ T24] audit: type=1400 audit(1757208344.590:73): avc: denied { read } for pid=282 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 29.015727][ T282] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 29.459268][ T290] request_module fs-gadgetfs succeeded, but still no fs? [ 29.470673][ T290] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 29.671022][ T312] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.678763][ T312] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.686999][ T312] device bridge_slave_0 entered promiscuous mode [ 29.694292][ T312] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.701805][ T312] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.709336][ T312] device bridge_slave_1 entered promiscuous mode [ 29.740848][ T312] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.748337][ T312] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.756414][ T312] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.764058][ T312] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.780897][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.788591][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.796718][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.806967][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.815521][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.822659][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.831526][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.840300][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.847329][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.860506][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.870278][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.885109][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 29.896829][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 29.905262][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 29.913489][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 29.922113][ T312] device veth0_vlan entered promiscuous mode [ 29.933162][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 29.942351][ T312] device veth1_macvtap entered promiscuous mode [ 29.952125][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 29.962988][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2025/09/07 01:25:46 executed programs: 0 [ 30.534137][ T353] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.541689][ T353] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.549803][ T353] device bridge_slave_0 entered promiscuous mode [ 30.556928][ T353] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.564371][ T353] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.572101][ T353] device bridge_slave_1 entered promiscuous mode [ 30.606093][ T353] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.613771][ T353] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.621806][ T353] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.629203][ T353] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.650612][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 30.658986][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.667715][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.677009][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 30.685994][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 30.694660][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.702317][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.715767][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 30.724393][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 30.732835][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.740153][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.754338][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 30.763065][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 30.772028][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 30.781020][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 30.796699][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 30.805452][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 30.816333][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 30.824943][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 30.834859][ T7] device bridge_slave_1 left promiscuous mode [ 30.841508][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.849386][ T7] device bridge_slave_0 left promiscuous mode [ 30.856757][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.865289][ T7] device veth1_macvtap left promiscuous mode [ 30.872043][ T7] device veth0_vlan left promiscuous mode [ 30.944033][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 30.951501][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 30.959389][ T353] device veth0_vlan entered promiscuous mode [ 30.971123][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 30.979762][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 30.988856][ T353] device veth1_macvtap entered promiscuous mode [ 30.999147][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 31.008062][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 31.017303][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 31.026780][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 31.035750][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 31.107293][ T357] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 31.120663][ T357] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 31.132963][ T357] EXT4-fs warning (device loop2): ext4_expand_extra_isize_ea:2815: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 31.146607][ T357] EXT4-fs (loop2): 1 truncate cleaned up [ 31.152687][ T357] EXT4-fs (loop2): mounted filesystem without journal. Opts: init_itable=0x0000000000000000,jqfmt=vfsold,debug_want_extra_isize=0x000000000000006a,user_xattr,errors=remount-ro,quota, [ 31.176447][ T357] ================================================================== [ 31.185215][ T357] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x1339/0x36c0 [ 31.193485][ T357] Read of size 18446744073709551540 at addr ffff88810f140870 by task syz.2.17/357 [ 31.203840][ T357] [ 31.206236][ T357] CPU: 1 PID: 357 Comm: syz.2.17 Not tainted syzkaller #0 [ 31.213762][ T357] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2025 [ 31.223991][ T357] Call Trace: [ 31.227795][ T357] __dump_stack+0x21/0x24 [ 31.232955][ T357] dump_stack_lvl+0x169/0x1d8 [ 31.238058][ T357] ? show_regs_print_info+0x18/0x18 [ 31.243241][ T357] ? thaw_kernel_threads+0x220/0x220 [ 31.248778][ T357] print_address_description+0x7f/0x2c0 [ 31.254576][ T357] ? ext4_xattr_set_entry+0x1339/0x36c0 [ 31.260277][ T357] kasan_report+0xe2/0x130 [ 31.264954][ T357] ? ext4_xattr_set_entry+0x1339/0x36c0 [ 31.270921][ T357] ? ext4_xattr_set_entry+0x1339/0x36c0 [ 31.276804][ T357] kasan_check_range+0x280/0x290 [ 31.281909][ T357] memmove+0x2d/0x70 [ 31.285889][ T357] ext4_xattr_set_entry+0x1339/0x36c0 [ 31.291453][ T357] ? fscrypt_drop_inode+0xad/0x110 [ 31.296547][ T357] ? ext4_xattr_ibody_set+0x360/0x360 [ 31.302653][ T357] ? slab_post_alloc_hook+0x7d/0x2f0 [ 31.307921][ T357] ? ext4_xattr_block_set+0x847/0x2a50 [ 31.313462][ T357] ? ext4_xattr_block_set+0x847/0x2a50 [ 31.319093][ T357] ? __kmalloc_track_caller+0x181/0x320 [ 31.325003][ T357] ? memcpy+0x56/0x70 [ 31.329071][ T357] ext4_xattr_block_set+0x92f/0x2a50 [ 31.334954][ T357] ? __kasan_check_read+0x11/0x20 [ 31.339968][ T357] ? __ext4_xattr_check_block+0x265/0x8e0 [ 31.345687][ T357] ? ext4_xattr_block_find+0x4f0/0x4f0 [ 31.351759][ T357] ? __kasan_check_write+0x14/0x20 [ 31.357311][ T357] ext4_xattr_set_handle+0xba5/0x12a0 [ 31.363344][ T357] ? ext4_xattr_set_entry+0x36c0/0x36c0 [ 31.369156][ T357] ? __kasan_check_read+0x11/0x20 [ 31.374340][ T357] ? __ext4_journal_start_sb+0x2e2/0x490 [ 31.380613][ T357] ext4_xattr_set+0x1ec/0x320 [ 31.385550][ T357] ? ext4_xattr_set_credits+0x290/0x290 [ 31.391733][ T357] ext4_xattr_trusted_set+0x3b/0x50 [ 31.397296][ T357] ? ext4_xattr_trusted_get+0x40/0x40 [ 31.403007][ T357] __vfs_setxattr+0x42a/0x480 [ 31.408202][ T357] __vfs_setxattr_noperm+0x11e/0x4e0 [ 31.413689][ T357] __vfs_setxattr_locked+0x203/0x220 [ 31.419143][ T357] vfs_setxattr+0x8d/0x1c0 [ 31.423716][ T357] setxattr+0x1a9/0x370 [ 31.428029][ T357] ? path_setxattr+0x210/0x210 [ 31.432864][ T357] ? __mnt_want_write+0x1e6/0x260 [ 31.438236][ T357] ? mnt_want_write+0x19d/0x270 [ 31.443412][ T357] path_setxattr+0x110/0x210 [ 31.448452][ T357] ? simple_xattr_list_add+0x120/0x120 [ 31.453908][ T357] __x64_sys_lsetxattr+0xc2/0xe0 [ 31.459272][ T357] do_syscall_64+0x31/0x40 [ 31.464115][ T357] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 31.470433][ T357] RIP: 0033:0x7f83f3e95be9 [ 31.475281][ T357] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 31.495986][ T357] RSP: 002b:00007fff078e8f28 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd [ 31.504476][ T357] RAX: ffffffffffffffda RBX: 00007f83f40ccfa0 RCX: 00007f83f3e95be9 [ 31.512845][ T357] RDX: 0000200000000040 RSI: 0000200000000300 RDI: 0000200000000100 [ 31.521288][ T357] RBP: 00007f83f3f18e19 R08: 0000000000000000 R09: 0000000000000000 [ 31.529251][ T357] R10: 000000000000fe37 R11: 0000000000000246 R12: 0000000000000000 [ 31.537310][ T357] R13: 00007f83f40ccfa0 R14: 00007f83f40ccfa0 R15: 0000000000000005 [ 31.546089][ T357] [ 31.548489][ T357] Allocated by task 0: [ 31.552710][ T357] (stack is not available) [ 31.557318][ T357] [ 31.559728][ T357] The buggy address belongs to the object at ffff88810f140800 [ 31.559728][ T357] which belongs to the cache kmalloc-1k of size 1024 [ 31.574756][ T357] The buggy address is located 112 bytes inside of [ 31.574756][ T357] 1024-byte region [ffff88810f140800, ffff88810f140c00) [ 31.588647][ T357] The buggy address belongs to the page: [ 31.594363][ T357] page:ffffea00043c5000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10f140 [ 31.605044][ T357] head:ffffea00043c5000 order:3 compound_mapcount:0 compound_pincount:0 [ 31.613625][ T357] flags: 0x4000000000010200(slab|head) [ 31.619173][ T357] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100042f00 [ 31.627920][ T357] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 31.636576][ T357] page dumped because: kasan: bad access detected [ 31.643303][ T357] page_owner tracks the page as allocated [ 31.649294][ T357] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 96, ts 5476347323, free_ts 0 [ 31.668520][ T357] prep_new_page+0x179/0x180 [ 31.673842][ T357] get_page_from_freelist+0x2235/0x23d0 [ 31.679606][ T357] __alloc_pages_nodemask+0x268/0x5f0 [ 31.685059][ T357] new_slab+0x84/0x3f0 [ 31.689208][ T357] ___slab_alloc+0x2a6/0x450 [ 31.694107][ T357] __slab_alloc+0x63/0xa0 [ 31.698709][ T357] __kmalloc_track_caller+0x1ef/0x320 [ 31.704452][ T357] __alloc_skb+0xdc/0x520 [ 31.709044][ T357] alloc_uevent_skb+0x85/0x240 [ 31.714240][ T357] kobject_uevent_net_broadcast+0x335/0x5a0 [ 31.720131][ T357] kobject_uevent_env+0x52e/0x700 [ 31.725401][ T357] kobject_synth_uevent+0x520/0xaf0 [ 31.730582][ T357] uevent_store+0x4b/0x70 [ 31.734910][ T357] drv_attr_store+0x79/0xa0 [ 31.739414][ T357] sysfs_kf_write+0x129/0x150 [ 31.744273][ T357] kernfs_fop_write_iter+0x2c5/0x400 [ 31.750185][ T357] page_owner free stack trace missing [ 31.756328][ T357] [ 31.759081][ T357] Memory state around the buggy address: [ 31.765185][ T357] ffff88810f140700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.773684][ T357] ffff88810f140780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.782525][ T357] >ffff88810f140800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 31.791390][ T357] ^ [ 31.800130][ T357] ffff88810f140880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 31.808952][ T357] ffff88810f140900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 31.817089][ T357] ================================================================== [ 31.825858][ T357] Disabling lock debugging due to kernel taint