Warning: Permanently added '10.128.0.141' (ED25519) to the list of known hosts. 2026/07/09 15:46:39 parsed 1 programs 2026/07/09 15:46:39 serving rpc on tcp://39031 [ 25.026979][ T28] audit: type=1400 audit(1783611999.034:64): avc: denied { node_bind } for pid=295 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 25.048309][ T28] audit: type=1400 audit(1783611999.034:65): avc: denied { module_request } for pid=295 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 26.098864][ T28] audit: type=1400 audit(1783612000.104:66): avc: denied { mounton } for pid=301 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 26.103460][ T301] cgroup: Unknown subsys name 'net' [ 26.121632][ T28] audit: type=1400 audit(1783612000.104:67): avc: denied { mount } for pid=301 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.148826][ T28] audit: type=1400 audit(1783612000.144:68): avc: denied { unmount } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.149169][ T301] cgroup: Unknown subsys name 'devices' [ 26.263937][ T301] cgroup: Unknown subsys name 'hugetlb' [ 26.269557][ T301] cgroup: Unknown subsys name 'rlimit' [ 26.410818][ T28] audit: type=1400 audit(1783612000.414:69): avc: denied { setattr } for pid=301 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 26.434005][ T28] audit: type=1400 audit(1783612000.424:70): avc: denied { create } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.454500][ T28] audit: type=1400 audit(1783612000.424:71): avc: denied { write } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.474790][ T28] audit: type=1400 audit(1783612000.424:72): avc: denied { read } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.493545][ T306] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 26.495551][ T28] audit: type=1400 audit(1783612000.424:73): avc: denied { mounton } for pid=301 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 26.577694][ T301] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 27.272180][ T308] request_module fs-gadgetfs succeeded, but still no fs? [ 27.597175][ T335] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.604321][ T335] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.605470][ T331] syz-executor (331) used greatest stack depth: 21664 bytes left [ 27.612745][ T335] device bridge_slave_0 entered promiscuous mode [ 27.625883][ T335] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.632934][ T335] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.640273][ T335] device bridge_slave_1 entered promiscuous mode [ 27.683341][ T335] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.690378][ T335] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.697680][ T335] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.704718][ T335] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.726306][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.733909][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.741102][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.749718][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.758126][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.765195][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.773962][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.782182][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.789216][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.801797][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.810923][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.824662][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.836433][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.844609][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.852370][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.860326][ T335] device veth0_vlan entered promiscuous mode [ 27.870869][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.880794][ T335] device veth1_macvtap entered promiscuous mode [ 27.889971][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.899922][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/07/09 15:46:42 executed programs: 0 [ 28.470617][ T372] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.477685][ T372] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.485881][ T372] device bridge_slave_0 entered promiscuous mode [ 28.492765][ T372] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.499793][ T372] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.507643][ T372] device bridge_slave_1 entered promiscuous mode [ 28.554031][ T372] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.561073][ T372] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.568382][ T372] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.575474][ T372] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.600685][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.608425][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.615686][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.624826][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 28.633844][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 28.642070][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.649081][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.661547][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 28.669890][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 28.678095][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.685118][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.696227][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 28.704704][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 28.717286][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 28.725360][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 28.738061][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 28.746498][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 28.760765][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 28.768734][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 28.778046][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 28.785981][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 28.793484][ T372] device veth0_vlan entered promiscuous mode [ 28.800351][ T43] device bridge_slave_1 left promiscuous mode [ 28.806562][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.814122][ T43] device bridge_slave_0 left promiscuous mode [ 28.820214][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.828180][ T43] device veth1_macvtap left promiscuous mode [ 28.834273][ T43] device veth0_vlan left promiscuous mode [ 28.909446][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 28.917807][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 28.926750][ T372] device veth1_macvtap entered promiscuous mode [ 28.935782][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 28.943438][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 28.951574][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.966477][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 28.974875][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 29.001061][ T377] loop2: detected capacity change from 0 to 4096 [ 29.012953][ T377] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 29.032992][ T377] EXT4-fs error (device loop2): xattr_find_entry:297: inode #15: comm syz.2.17: corrupted xattr entries [ 29.045334][ T377] ================================================================== [ 29.053426][ T377] BUG: KASAN: use-after-free in ext4_get_inode_usage+0x371/0x520 [ 29.061192][ T377] Read of size 4 at addr ffff88812ad68000 by task syz.2.17/377 [ 29.068738][ T377] [ 29.071065][ T377] CPU: 0 PID: 377 Comm: syz.2.17 Not tainted syzkaller #0 [ 29.078180][ T377] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 29.088230][ T377] Call Trace: [ 29.091598][ T377] [ 29.094532][ T377] __dump_stack+0x21/0x24 [ 29.098876][ T377] dump_stack_lvl+0x110/0x170 [ 29.103557][ T377] ? __cfi_dump_stack_lvl+0x8/0x8 [ 29.108584][ T377] ? ext4_get_inode_usage+0x371/0x520 [ 29.113959][ T377] print_address_description+0x71/0x200 [ 29.119511][ T377] print_report+0x4a/0x60 [ 29.123844][ T377] kasan_report+0x122/0x150 [ 29.128353][ T377] ? ext4_get_inode_usage+0x371/0x520 [ 29.133730][ T377] __asan_report_load4_noabort+0x14/0x20 [ 29.139365][ T377] ext4_get_inode_usage+0x371/0x520 [ 29.144571][ T377] ? qtree_write_dquot+0x45b/0x5f0 [ 29.149679][ T377] ? __cfi_ext4_get_inode_usage+0x10/0x10 [ 29.155404][ T377] ? kfree+0x6f/0xf0 [ 29.159295][ T377] __dquot_transfer+0x1a0/0x2370 [ 29.164266][ T377] ? __cfi_qtree_write_dquot+0x10/0x10 [ 29.169716][ T377] ? __kasan_check_write+0x14/0x20 [ 29.174824][ T377] ? mutex_unlock+0x8f/0x230 [ 29.179413][ T377] ? __cfi_mutex_unlock+0x10/0x10 [ 29.184435][ T377] ? __cfi___dquot_transfer+0x10/0x10 [ 29.189800][ T377] ? dquot_acquire+0x27c/0x590 [ 29.194553][ T377] ? __ext4_journal_stop+0x36/0x1a0 [ 29.199741][ T377] ? ext4_acquire_dquot+0x378/0x4a0 [ 29.204939][ T377] ? dqget+0xba6/0xf20 [ 29.209010][ T377] dquot_transfer+0x620/0x7d0 [ 29.213719][ T377] ? __cfi_dquot_transfer+0x10/0x10 [ 29.218940][ T377] ? down_read+0xa6/0xf0 [ 29.223177][ T377] ? __cfi_down_read+0x10/0x10 [ 29.227935][ T377] ? __kasan_check_read+0x11/0x20 [ 29.232951][ T377] ? __ext4_journal_start_sb+0x2ed/0x4a0 [ 29.238667][ T377] ext4_setattr+0xa01/0x1c80 [ 29.243265][ T377] ? __vfs_getxattr+0x3da/0x410 [ 29.248122][ T377] ? __cfi_ext4_setattr+0x10/0x10 [ 29.253145][ T377] notify_change+0xd33/0x1030 [ 29.257831][ T377] chown_common+0x448/0x5f0 [ 29.262342][ T377] ? __cfi_chown_common+0x10/0x10 [ 29.267391][ T377] ? mnt_want_write+0x220/0x300 [ 29.272259][ T377] do_fchownat+0x147/0x240 [ 29.276671][ T377] ? __cfi_do_fchownat+0x10/0x10 [ 29.281603][ T377] ? do_user_addr_fault+0x9a5/0x1030 [ 29.286889][ T377] ? debug_smp_processor_id+0x17/0x20 [ 29.292274][ T377] __x64_sys_lchown+0x85/0x90 [ 29.296960][ T377] x64_sys_call+0x951/0x9a0 [ 29.301476][ T377] do_syscall_64+0x4c/0xa0 [ 29.305894][ T377] ? clear_bhb_loop+0x30/0x80 [ 29.310574][ T377] ? clear_bhb_loop+0x30/0x80 [ 29.315255][ T377] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 29.321159][ T377] RIP: 0033:0x7fb19b19de59 [ 29.325586][ T377] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 29.345195][ T377] RSP: 002b:00007fff27a53068 EFLAGS: 00000246 ORIG_RAX: 000000000000005e [ 29.353618][ T377] RAX: ffffffffffffffda RBX: 00007fb19b425fa0 RCX: 00007fb19b19de59 [ 29.361589][ T377] RDX: 0000000000000000 RSI: 00000000000000ff RDI: 00002000000004c0 [ 29.369563][ T377] RBP: 00007fb19b233e6f R08: 0000000000000000 R09: 0000000000000000 [ 29.377551][ T377] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 29.385518][ T377] R13: 00007fb19b425fac R14: 00007fb19b425fa0 R15: 00007fb19b425fa0 [ 29.393506][ T377] [ 29.396533][ T377] [ 29.398844][ T377] The buggy address belongs to the physical page: [ 29.405250][ T377] page:ffffea0004ab5a00 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x12ad68 [ 29.415477][ T377] flags: 0x4000000000000000(zone=1) [ 29.420685][ T377] raw: 4000000000000000 ffffea0004aa8c48 ffffea0004ab57c8 0000000000000000 [ 29.429268][ T377] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 29.437854][ T377] page dumped because: kasan: bad access detected [ 29.444262][ T377] page_owner tracks the page as freed [ 29.449634][ T377] page last allocated via order 0, migratetype Movable, gfp_mask 0x8140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO|__GFP_CMA), pid 309, tgid 309 (udevd), ts 29029998733, free_ts 29041665736 [ 29.468485][ T377] post_alloc_hook+0x1f5/0x210 [ 29.473277][ T377] prep_new_page+0x1c/0x110 [ 29.477791][ T377] get_page_from_freelist+0x2ca9/0x2d20 [ 29.483346][ T377] __alloc_pages+0x1fa/0x610 [ 29.487955][ T377] __folio_alloc+0x12/0x40 [ 29.492382][ T377] handle_mm_fault+0x1989/0x26b0 [ 29.497347][ T377] do_user_addr_fault+0x61e/0x1030 [ 29.502477][ T377] exc_page_fault+0x51/0xb0 [ 29.506980][ T377] asm_exc_page_fault+0x27/0x30 [ 29.511847][ T377] page last free stack trace: [ 29.516517][ T377] free_unref_page_prepare+0x80c/0x820 [ 29.521983][ T377] free_unref_page_list+0x117/0x8d0 [ 29.527200][ T377] release_pages+0xc7e/0xce0 [ 29.531792][ T377] free_pages_and_swap_cache+0x86/0xa0 [ 29.537255][ T377] tlb_finish_mmu+0x1b2/0x380 [ 29.541927][ T377] unmap_region+0x2b7/0x320 [ 29.546427][ T377] do_mas_align_munmap+0xbf3/0x1330 [ 29.551631][ T377] do_mas_munmap+0x23d/0x2b0 [ 29.556233][ T377] __vm_munmap+0x1af/0x310 [ 29.560669][ T377] __x64_sys_munmap+0x6b/0x80 [ 29.565362][ T377] x64_sys_call+0x8a/0x9a0 [ 29.569789][ T377] do_syscall_64+0x4c/0xa0 [ 29.574229][ T377] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 29.580133][ T377] [ 29.582464][ T377] Memory state around the buggy address: [ 29.588101][ T377] ffff88812ad67f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 29.596180][ T377] ffff88812ad67f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 29.604337][ T377] >ffff88812ad68000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 29.612412][ T377] ^ [ 29.616505][ T377] ffff88812ad68080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 29.624565][ T377] ffff88812ad68100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 29.632620][ T377] ================================================================== [ 29.641514][ T377] Disabling lock debugging due to kernel taint [ 29.659725][ T372] EXT4-fs (loop2): unmounting filesystem.