Warning: Permanently added '10.128.1.139' (ED25519) to the list of known hosts.
2026/04/03 09:49:16 parsed 1 programs
[ 58.894635][ T30] audit: type=1400 audit(1775209756.445:62): avc: denied { node_bind } for pid=5801 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1
[ 60.867106][ T30] audit: type=1400 audit(1775209758.415:63): avc: denied { mounton } for pid=5808 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 60.890540][ T30] audit: type=1400 audit(1775209758.435:64): avc: denied { mount } for pid=5808 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 60.893162][ T5808] cgroup: Unknown subsys name 'net'
[ 60.919523][ T30] audit: type=1400 audit(1775209758.465:65): avc: denied { unmount } for pid=5808 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 61.083738][ T5808] cgroup: Unknown subsys name 'cpuset'
[ 61.091521][ T5808] cgroup: Unknown subsys name 'rlimit'
[ 61.204363][ T30] audit: type=1400 audit(1775209758.755:66): avc: denied { setattr } for pid=5808 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=819 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 61.238070][ T30] audit: type=1400 audit(1775209758.755:67): avc: denied { create } for pid=5808 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 61.272430][ T30] audit: type=1400 audit(1775209758.755:68): avc: denied { write } for pid=5808 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 61.296881][ T30] audit: type=1400 audit(1775209758.755:69): avc: denied { read } for pid=5808 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 61.304393][ T5811] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped).
[ 61.317220][ T30] audit: type=1400 audit(1775209758.765:70): avc: denied { mounton } for pid=5808 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1
Setting up swapspace version 1, size = 127995904 bytes
[ 61.350643][ T30] audit: type=1400 audit(1775209758.765:71): avc: denied { mount } for pid=5808 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1
[ 62.261593][ T5808] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 63.923803][ T30] kauditd_printk_skb: 4 callbacks suppressed
[ 63.923819][ T30] audit: type=1400 audit(1775209761.475:76): avc: denied { execmem } for pid=5817 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 63.979617][ T30] audit: type=1400 audit(1775209761.475:77): avc: denied { read } for pid=5818 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 64.009750][ T30] audit: type=1400 audit(1775209761.475:78): avc: denied { open } for pid=5818 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 64.033464][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 64.041302][ T30] audit: type=1400 audit(1775209761.485:79): avc: denied { mounton } for pid=5818 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1
[ 64.041714][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 64.086445][ T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 64.094357][ T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 64.105377][ T30] audit: type=1400 audit(1775209761.655:80): avc: denied { mounton } for pid=5818 comm="syz-executor" path="/root/syzkaller.Wl5Io5/syz-tmp" dev="sda1" ino=2030 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1
[ 64.130260][ T30] audit: type=1400 audit(1775209761.655:81): avc: denied { mount } for pid=5818 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1
[ 64.158605][ T30] audit: type=1400 audit(1775209761.655:82): avc: denied { mounton } for pid=5818 comm="syz-executor" path="/root/syzkaller.Wl5Io5/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1
[ 64.160977][ T5818] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 64.184139][ T30] audit: type=1400 audit(1775209761.655:83): avc: denied { mount } for pid=5818 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1
[ 64.220676][ T30] audit: type=1400 audit(1775209761.655:84): avc: denied { mounton } for pid=5818 comm="syz-executor" path="/root/syzkaller.Wl5Io5/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1
[ 64.248699][ T30] audit: type=1400 audit(1775209761.665:85): avc: denied { mounton } for pid=5818 comm="syz-executor" path="/root/syzkaller.Wl5Io5/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=5172 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1
[ 64.959045][ T5842] chnl_net:caif_netlink_parms(): no params data found
[ 65.008716][ T5842] bridge0: port 1(bridge_slave_0) entered blocking state
[ 65.016407][ T5842] bridge0: port 1(bridge_slave_0) entered disabled state
[ 65.023574][ T5842] bridge_slave_0: entered allmulticast mode
[ 65.030235][ T5842] bridge_slave_0: entered promiscuous mode
[ 65.039967][ T5842] bridge0: port 2(bridge_slave_1) entered blocking state
[ 65.047752][ T5842] bridge0: port 2(bridge_slave_1) entered disabled state
[ 65.055019][ T5842] bridge_slave_1: entered allmulticast mode
[ 65.062373][ T5842] bridge_slave_1: entered promiscuous mode
[ 65.086971][ T5842] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 65.098451][ T5842] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 65.127508][ T5842] team0: Port device team_slave_0 added
[ 65.134504][ T5842] team0: Port device team_slave_1 added
[ 65.152024][ T5842] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 65.159001][ T5842] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 65.184918][ T5842] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 65.196914][ T5842] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 65.203878][ T5842] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 65.229744][ T5842] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 65.259116][ T5842] hsr_slave_0: entered promiscuous mode
[ 65.265279][ T5842] hsr_slave_1: entered promiscuous mode
[ 65.360662][ T5842] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 65.371477][ T5842] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 65.380468][ T5842] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 65.390186][ T5842] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 65.449562][ T5842] 8021q: adding VLAN 0 to HW filter on device bond0
[ 65.469945][ T5842] 8021q: adding VLAN 0 to HW filter on device team0
[ 65.482138][ T3511] bridge0: port 1(bridge_slave_0) entered blocking state
[ 65.489288][ T3511] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 65.503028][ T3511] bridge0: port 2(bridge_slave_1) entered blocking state
[ 65.510094][ T3511] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 65.624663][ T5842] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 65.655146][ T5842] veth0_vlan: entered promiscuous mode
[ 65.664817][ T5842] veth1_vlan: entered promiscuous mode
[ 65.683874][ T5842] veth0_macvtap: entered promiscuous mode
[ 65.692028][ T5842] veth1_macvtap: entered promiscuous mode
[ 65.706420][ T5842] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 65.717561][ T5842] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 65.740320][ T77] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 65.749754][ T77] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 65.759809][ T77] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 65.768970][ T77] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 65.804725][ T1296] ieee802154 phy0 wpan0: encryption failed: -22
[ 65.811184][ T1296] ieee802154 phy1 wpan1: encryption failed: -22
[ 65.875387][ T77] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 65.931433][ T77] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 66.005868][ T77] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 66.030335][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 66.039154][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 66.047633][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 66.056681][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 66.066636][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 66.068458][ T77] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
2026/04/03 09:49:25 executed programs: 0
[ 67.581626][ T5131] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 67.589305][ T5131] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 67.597349][ T5131] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 67.605667][ T5131] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 67.613157][ T5131] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 67.712038][ T5916] chnl_net:caif_netlink_parms(): no params data found
[ 67.766294][ T5916] bridge0: port 1(bridge_slave_0) entered blocking state
[ 67.773541][ T5916] bridge0: port 1(bridge_slave_0) entered disabled state
[ 67.780657][ T5916] bridge_slave_0: entered allmulticast mode
[ 67.787548][ T5916] bridge_slave_0: entered promiscuous mode
[ 67.795051][ T5916] bridge0: port 2(bridge_slave_1) entered blocking state
[ 67.802420][ T5916] bridge0: port 2(bridge_slave_1) entered disabled state
[ 67.809601][ T5916] bridge_slave_1: entered allmulticast mode
[ 67.816440][ T5916] bridge_slave_1: entered promiscuous mode
[ 67.839701][ T5916] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 67.850486][ T5916] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 67.872740][ T5916] team0: Port device team_slave_0 added
[ 67.879636][ T5916] team0: Port device team_slave_1 added
[ 67.898915][ T5916] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 67.906054][ T5916] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 67.932330][ T5916] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 67.944265][ T5916] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 67.951359][ T5916] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 67.977575][ T5916] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 68.006965][ T5916] hsr_slave_0: entered promiscuous mode
[ 68.013168][ T5916] hsr_slave_1: entered promiscuous mode
[ 68.019068][ T5916] debugfs: 'hsr0' already exists in 'hsr'
[ 68.024960][ T5916] Cannot create hsr debugfs directory
[ 69.157496][ T77] bridge_slave_1: left allmulticast mode
[ 69.168528][ T77] bridge_slave_1: left promiscuous mode
[ 69.175025][ T77] bridge0: port 2(bridge_slave_1) entered disabled state
[ 69.185843][ T77] bridge_slave_0: left allmulticast mode
[ 69.193681][ T77] bridge_slave_0: left promiscuous mode
[ 69.199421][ T77] bridge0: port 1(bridge_slave_0) entered disabled state
[ 69.349796][ T77] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 69.364466][ T77] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 69.375465][ T77] bond0 (unregistering): Released all slaves
[ 69.498793][ T77] hsr_slave_0: left promiscuous mode
[ 69.505373][ T77] hsr_slave_1: left promiscuous mode
[ 69.511516][ T77] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 69.519131][ T77] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 69.527413][ T77] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 69.535005][ T77] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 69.553722][ T77] veth1_macvtap: left promiscuous mode
[ 69.561174][ T77] veth0_macvtap: left promiscuous mode
[ 69.566732][ T77] veth1_vlan: left promiscuous mode
[ 69.572352][ T77] veth0_vlan: left promiscuous mode
[ 69.641967][ T51] Bluetooth: hci0: command tx timeout
[ 69.777996][ T77] team0 (unregistering): Port device team_slave_1 removed
[ 69.793465][ T77] team0 (unregistering): Port device team_slave_0 removed
[ 70.226552][ T5916] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 70.237382][ T5916] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 70.248190][ T5916] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 70.259251][ T5916] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 70.673049][ T5916] 8021q: adding VLAN 0 to HW filter on device bond0
[ 70.698325][ T5916] 8021q: adding VLAN 0 to HW filter on device team0
[ 70.715471][ T13] bridge0: port 1(bridge_slave_0) entered blocking state
[ 70.722593][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 70.743496][ T13] bridge0: port 2(bridge_slave_1) entered blocking state
[ 70.750633][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 70.945618][ T5916] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 70.976342][ T5916] veth0_vlan: entered promiscuous mode
[ 70.985111][ T5916] veth1_vlan: entered promiscuous mode
[ 71.004321][ T5916] veth0_macvtap: entered promiscuous mode
[ 71.015277][ T5916] veth1_macvtap: entered promiscuous mode
[ 71.028649][ T5916] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 71.042497][ T5916] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 71.054252][ T36] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 71.064094][ T36] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 71.073580][ T48] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 71.084186][ T48] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 71.126307][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 71.139280][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 71.159952][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 71.167922][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 71.207065][ T30] kauditd_printk_skb: 19 callbacks suppressed
[ 71.207080][ T30] audit: type=1400 audit(1775209768.755:105): avc: denied { create } for pid=5990 comm="syz.0.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1
[ 71.232727][ T30] audit: type=1400 audit(1775209768.755:106): avc: denied { bind } for pid=5990 comm="syz.0.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1
[ 71.254362][ T30] audit: type=1400 audit(1775209768.755:107): avc: denied { setopt } for pid=5990 comm="syz.0.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1
[ 71.263447][ T5991] ==================================================================
[ 71.281499][ T5991] BUG: KASAN: slab-out-of-bounds in af_alg_pull_tsgl+0x8fb/0xa80
[ 71.289213][ T5991] Read of size 8 at addr ffff888038706b20 by task syz.0.17/5991
[ 71.296818][ T5991]
[ 71.299123][ T5991] CPU: 0 UID: 0 PID: 5991 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 71.299140][ T5991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
[ 71.299148][ T5991] Call Trace:
[ 71.299152][ T5991]
[ 71.299157][ T5991] dump_stack_lvl+0x100/0x190
[ 71.299180][ T5991] print_report+0x156/0x4c9
[ 71.299199][ T5991] ? __virt_addr_valid+0x81/0x620
[ 71.299218][ T5991] ? __phys_addr+0xe8/0x180
[ 71.299237][ T5991] ? af_alg_pull_tsgl+0x8fb/0xa80
[ 71.299255][ T5991] kasan_report+0xdf/0x1e0
[ 71.299269][ T5991] ? af_alg_pull_tsgl+0x8fb/0xa80
[ 71.299289][ T5991] af_alg_pull_tsgl+0x8fb/0xa80
[ 71.299312][ T5991] skcipher_recvmsg+0x512/0x1020
[ 71.299331][ T5991] ? __pfx_skcipher_recvmsg+0x10/0x10
[ 71.299344][ T5991] ? __pfx_skcipher_recvmsg+0x10/0x10
[ 71.299357][ T5991] sock_recvmsg+0x1a4/0x1f0
[ 71.299371][ T5991] ____sys_recvmsg+0x218/0x640
[ 71.299385][ T5991] ? __pfx_____sys_recvmsg+0x10/0x10
[ 71.299400][ T5991] ? __lock_acquire+0x4a5/0x2630
[ 71.299414][ T5991] ___sys_recvmsg+0x16a/0x1a0
[ 71.299428][ T5991] ? __pfx____sys_recvmsg+0x10/0x10
[ 71.299448][ T5991] __sys_recvmsg+0x16d/0x220
[ 71.299466][ T5991] ? __pfx___sys_recvmsg+0x10/0x10
[ 71.299484][ T5991] ? __x64_sys_futex+0x34f/0x4d0
[ 71.299502][ T5991] do_syscall_64+0x106/0xf80
[ 71.299522][ T5991] ? clear_bhb_loop+0x40/0x90
[ 71.299536][ T5991] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 71.299550][ T5991] RIP: 0033:0x7ff9a799c819
[ 71.299561][ T5991] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 71.299574][ T5991] RSP: 002b:00007ff9a8912028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f
[ 71.299587][ T5991] RAX: ffffffffffffffda RBX: 00007ff9a7c15fa0 RCX: 00007ff9a799c819
[ 71.299596][ T5991] RDX: 000000000000001c RSI: 0000200000000480 RDI: 0000000000000004
[ 71.299604][ T5991] RBP: 00007ff9a7a32c91 R08: 0000000000000000 R09: 0000000000000000
[ 71.299612][ T5991] R10: 0000000040002022 R11: 0000000000000246 R12: 0000000000000000
[ 71.299620][ T5991] R13: 00007ff9a7c16038 R14: 00007ff9a7c15fa0 R15: 00007ffdfbd3efa8
[ 71.299633][ T5991]
[ 71.299637][ T5991]
[ 71.514266][ T5991] Allocated by task 5991:
[ 71.518580][ T5991] kasan_save_stack+0x30/0x50
[ 71.523245][ T5991] kasan_save_track+0x14/0x30
[ 71.527907][ T5991] __kasan_kmalloc+0xaa/0xb0
[ 71.532478][ T5991] __kmalloc_noprof+0x301/0x850
[ 71.537311][ T5991] sock_kmalloc+0x111/0x170
[ 71.541792][ T5991] skcipher_recvmsg+0x48b/0x1020
[ 71.546708][ T5991] sock_recvmsg+0x1a4/0x1f0
[ 71.551186][ T5991] ____sys_recvmsg+0x218/0x640
[ 71.555934][ T5991] ___sys_recvmsg+0x16a/0x1a0
[ 71.560588][ T5991] __sys_recvmsg+0x16d/0x220
[ 71.565160][ T5991] do_syscall_64+0x106/0xf80
[ 71.569735][ T5991] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 71.575616][ T5991]
[ 71.577932][ T5991] The buggy address belongs to the object at ffff888038706b00
[ 71.577932][ T5991] which belongs to the cache kmalloc-32 of size 32
[ 71.591787][ T5991] The buggy address is located 0 bytes to the right of
[ 71.591787][ T5991] allocated 32-byte region [ffff888038706b00, ffff888038706b20)
[ 71.606165][ T5991]
[ 71.608468][ T5991] The buggy address belongs to the physical page:
[ 71.614854][ T5991] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888038706f40 pfn:0x38706
[ 71.624890][ T5991] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
[ 71.632931][ T5991] page_type: f5(slab)
[ 71.636887][ T5991] raw: 00fff00000000200 ffff88813fe40780 ffffea0000ddf690 ffffea0000dca890
[ 71.645448][ T5991] raw: ffff888038706f40 000000080040003f 00000000f5000000 0000000000000000
[ 71.654002][ T5991] page dumped because: kasan: bad access detected
[ 71.660386][ T5991] page_owner tracks the page as allocated
[ 71.666076][ T5991] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5652, tgid 5652 (sshd-session), ts 45958766256, free_ts 45957364677
[ 71.685672][ T5991] post_alloc_hook+0x153/0x170
[ 71.690421][ T5991] get_page_from_freelist+0x111d/0x3140
[ 71.695949][ T5991] __alloc_frozen_pages_noprof+0x27c/0x2ba0
[ 71.701837][ T5991] new_slab+0xa6/0x6b0
[ 71.705888][ T5991] refill_objects+0x26b/0x400
[ 71.710556][ T5991] __pcs_replace_empty_main+0x1ab/0x660
[ 71.716082][ T5991] __kmalloc_cache_noprof+0x493/0x6f0
[ 71.721435][ T5991] kmem_cache_free+0x41f/0x6a0
[ 71.726180][ T5991] __fput+0x68a/0xb40
[ 71.730139][ T5991] fput_close_sync+0x118/0x250
[ 71.734894][ T5991] __x64_sys_close+0x8b/0x120
[ 71.739551][ T5991] do_syscall_64+0x106/0xf80
[ 71.744131][ T5991] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 71.749999][ T5991] page last free pid 5652 tgid 5652 stack trace:
[ 71.756295][ T5991] __free_frozen_pages+0x7e1/0x10d0
[ 71.761473][ T5991] inode_doinit_with_dentry+0x99d/0x1320
[ 71.767089][ T5991] selinux_d_instantiate+0x26/0x40
[ 71.772181][ T5991] security_d_instantiate+0x14c/0x1b0
[ 71.777528][ T5991] d_splice_alias_ops+0xd7/0x1320
[ 71.782526][ T5991] proc_sys_lookup+0x319/0x430
[ 71.787265][ T5991] lookup_open.isra.0+0x631/0x11b0
[ 71.792362][ T5991] path_openat+0xa98/0x31a0
[ 71.796844][ T5991] do_file_open+0x20e/0x430
[ 71.801325][ T5991] do_sys_openat2+0x10d/0x1e0
[ 71.805980][ T5991] __x64_sys_openat+0x12d/0x210
[ 71.810809][ T5991] do_syscall_64+0x106/0xf80
[ 71.815383][ T5991] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 71.821256][ T5991]
[ 71.823560][ T5991] Memory state around the buggy address:
[ 71.829166][ T5991] ffff888038706a00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[ 71.837203][ T5991] ffff888038706a80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[ 71.845241][ T5991] >ffff888038706b00: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc
[ 71.853272][ T5991] ^
[ 71.858368][ T5991] ffff888038706b80: 00 00 00 00 fc fc fc fc fa fb fb fb fc fc fc fc
[ 71.866401][ T5991] ffff888038706c00: 00 00 00 06 fc fc fc fc fa fb fb fb fc fc fc fc
[ 71.874436][ T5991] ==================================================================
[ 71.883859][ T51] Bluetooth: hci0: command tx timeout
[ 71.892238][ T30] audit: type=1400 audit(1775209768.755:108): avc: denied { accept } for pid=5990 comm="syz.0.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1
[ 71.911479][ T30] audit: type=1400 audit(1775209768.755:109): avc: denied { read } for pid=5990 comm="syz.0.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1
[ 71.930675][ T30] audit: type=1400 audit(1775209768.805:110): avc: denied { write } for pid=5990 comm="syz.0.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1
[ 71.935927][ T5991] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 71.935943][ T5991] CPU: 0 UID: 0 PID: 5991 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
[ 71.935961][ T5991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
[ 71.935970][ T5991] Call Trace:
[ 71.935976][ T5991]
[ 71.935982][ T5991] dump_stack_lvl+0x100/0x190
[ 71.936010][ T5991] vpanic+0x552/0x970
[ 71.936024][ T5991] ? __pfx_vpanic+0x10/0x10
[ 71.936040][ T5991] ? af_alg_pull_tsgl+0x8fb/0xa80
[ 71.936062][ T5991] panic+0xd1/0xe0
[ 71.936075][ T5991] ? __pfx_panic+0x10/0x10
[ 71.936089][ T5991] ? af_alg_pull_tsgl+0x8fb/0xa80
[ 71.936109][ T5991] ? preempt_schedule_common+0x42/0xc0
[ 71.936132][ T5991] ? check_panic_on_warn+0x1f/0x90
[ 71.936147][ T5991] check_panic_on_warn.cold+0x19/0x34
[ 71.936163][ T5991] end_report.part.0+0x3a/0x90
[ 71.936183][ T5991] kasan_report.cold+0xe/0x18
[ 71.936203][ T5991] ? af_alg_pull_tsgl+0x8fb/0xa80
[ 71.936226][ T5991] af_alg_pull_tsgl+0x8fb/0xa80
[ 71.936250][ T5991] skcipher_recvmsg+0x512/0x1020
[ 71.936268][ T5991] ? __pfx_skcipher_recvmsg+0x10/0x10
[ 71.936283][ T5991] ? __pfx_skcipher_recvmsg+0x10/0x10
[ 71.936297][ T5991] sock_recvmsg+0x1a4/0x1f0
[ 71.936313][ T5991] ____sys_recvmsg+0x218/0x640
[ 71.936334][ T5991] ? __pfx_____sys_recvmsg+0x10/0x10
[ 71.936351][ T5991] ? __lock_acquire+0x4a5/0x2630
[ 71.936367][ T5991] ___sys_recvmsg+0x16a/0x1a0
[ 71.936383][ T5991] ? __pfx____sys_recvmsg+0x10/0x10
[ 71.936405][ T5991] __sys_recvmsg+0x16d/0x220
[ 71.936425][ T5991] ? __pfx___sys_recvmsg+0x10/0x10
[ 71.936445][ T5991] ? __x64_sys_futex+0x34f/0x4d0
[ 71.936465][ T5991] do_syscall_64+0x106/0xf80
[ 71.936487][ T5991] ? clear_bhb_loop+0x40/0x90
[ 71.936504][ T5991] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 71.936519][ T5991] RIP: 0033:0x7ff9a799c819
[ 71.936531][ T5991] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 71.936544][ T5991] RSP: 002b:00007ff9a8912028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f
[ 71.936560][ T5991] RAX: ffffffffffffffda RBX: 00007ff9a7c15fa0 RCX: 00007ff9a799c819
[ 71.936570][ T5991] RDX: 000000000000001c RSI: 0000200000000480 RDI: 0000000000000004
[ 71.936579][ T5991] RBP: 00007ff9a7a32c91 R08: 0000000000000000 R09: 0000000000000000
[ 71.936588][ T5991] R10: 0000000040002022 R11: 0000000000000246 R12: 0000000000000000
[ 71.936597][ T5991] R13: 00007ff9a7c16038 R14: 00007ff9a7c15fa0 R15: 00007ffdfbd3efa8
[ 71.936611][ T5991]
[ 71.949932][ T5991] Kernel Offset: disabled