Warning: Permanently added '10.128.1.55' (ED25519) to the list of known hosts. 2026/05/15 03:05:22 parsed 1 programs [ 20.430912][ T24] audit: type=1400 audit(1778814322.559:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 20.451868][ T24] audit: type=1400 audit(1778814322.559:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 20.471492][ T24] audit: type=1400 audit(1778814322.559:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 21.031121][ T24] audit: type=1400 audit(1778814323.159:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.032108][ T293] cgroup: Unknown subsys name 'net' [ 21.053760][ T24] audit: type=1400 audit(1778814323.159:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.081176][ T24] audit: type=1400 audit(1778814323.179:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.081343][ T293] cgroup: Unknown subsys name 'devices' [ 21.221260][ T293] cgroup: Unknown subsys name 'hugetlb' [ 21.226836][ T293] cgroup: Unknown subsys name 'rlimit' [ 21.338209][ T24] audit: type=1400 audit(1778814323.459:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.361354][ T24] audit: type=1400 audit(1778814323.459:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 21.381743][ T24] audit: type=1400 audit(1778814323.459:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 21.387300][ T298] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 21.402230][ T24] audit: type=1400 audit(1778814323.459:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 21.460303][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.903578][ T302] request_module fs-gadgetfs succeeded, but still no fs? [ 21.912761][ T302] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 22.067115][ T323] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.074204][ T323] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.081600][ T323] device bridge_slave_0 entered promiscuous mode [ 22.088302][ T323] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.095393][ T323] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.102742][ T323] device bridge_slave_1 entered promiscuous mode [ 22.133692][ T323] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.140723][ T323] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.147935][ T323] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.154952][ T323] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.169891][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.177107][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.184328][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 22.192415][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.201654][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.209754][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.216784][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.225156][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.233325][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.240347][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.251711][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.262889][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.273089][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.283500][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.291792][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.299136][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.307220][ T323] device veth0_vlan entered promiscuous mode [ 22.318101][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.327342][ T323] device veth1_macvtap entered promiscuous mode [ 22.335817][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.345243][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/05/15 03:05:24 executed programs: 0 [ 22.880122][ T366] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.887195][ T366] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.894588][ T366] device bridge_slave_0 entered promiscuous mode [ 22.901432][ T366] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.908440][ T366] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.915776][ T366] device bridge_slave_1 entered promiscuous mode [ 22.949743][ T366] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.956789][ T366] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.964057][ T366] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.971083][ T366] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.989930][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.999489][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.007995][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.016822][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.025032][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.032056][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.048000][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.056471][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.063497][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.070995][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.078898][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.089562][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.097843][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.110245][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.118057][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.126130][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.134779][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.142883][ T366] device veth0_vlan entered promiscuous mode [ 23.151485][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.159584][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.168556][ T366] device veth1_macvtap entered promiscuous mode [ 23.176739][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.184496][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.192720][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.201914][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.210122][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.230608][ T387] Zero length message leads to an empty skb [ 23.741968][ T7] device bridge_slave_1 left promiscuous mode [ 23.748096][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.755727][ T7] device bridge_slave_0 left promiscuous mode [ 23.762199][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.769756][ T7] device veth1_macvtap left promiscuous mode [ 23.775878][ C1] ================================================================== [ 23.783959][ C1] BUG: KASAN: stack-out-of-bounds in __xfrm_dst_hash+0x399/0x480 [ 23.791658][ C1] Read of size 4 at addr ffffc90000170b18 by task kworker/u4:0/7 [ 23.799348][ C1] [ 23.801672][ C1] CPU: 1 PID: 7 Comm: kworker/u4:0 Not tainted syzkaller #0 [ 23.808932][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 23.818977][ C1] Workqueue: netns cleanup_net [ 23.823738][ C1] Call Trace: [ 23.827006][ C1] [ 23.829846][ C1] __dump_stack+0x21/0x24 [ 23.834155][ C1] dump_stack_lvl+0x1a7/0x208 [ 23.838807][ C1] ? show_regs_print_info+0x18/0x18 [ 23.843978][ C1] ? thaw_kernel_threads+0x220/0x220 [ 23.849238][ C1] print_address_description+0x7f/0x2c0 [ 23.854762][ C1] ? __xfrm_dst_hash+0x399/0x480 [ 23.859673][ C1] kasan_report+0xe2/0x130 [ 23.864064][ C1] ? __xfrm_dst_hash+0x399/0x480 [ 23.868969][ C1] __asan_report_load4_noabort+0x14/0x20 [ 23.874574][ C1] __xfrm_dst_hash+0x399/0x480 [ 23.879311][ C1] xfrm_state_find+0x28c/0x28b0 [ 23.884133][ C1] ? stack_trace_save+0xf0/0xf0 [ 23.888955][ C1] ? xfrm_sad_getinfo+0x170/0x170 [ 23.894581][ C1] ? stack_trace_save+0xa6/0xf0 [ 23.899403][ C1] ? stack_trace_snprint+0xf0/0xf0 [ 23.904486][ C1] xfrm_resolve_and_create_bundle+0x697/0x29f0 [ 23.910615][ C1] ? xfrm_sk_policy_lookup+0x480/0x480 [ 23.916048][ C1] ? xfrm_selector_match+0xb7e/0x1030 [ 23.921395][ C1] ? __xfrm_policy_check+0x29d0/0x29d0 [ 23.926826][ C1] xfrm_lookup_with_ifid+0x7ea/0x1a80 [ 23.932168][ C1] ? percpu_counter_add_batch+0x13c/0x160 [ 23.937859][ C1] ? rt_set_nexthop+0x5b9/0x780 [ 23.942677][ C1] ? __xfrm_sk_clone_policy+0x680/0x680 [ 23.948191][ C1] ? ip_route_output_key_hash_rcu+0x15af/0x20e0 [ 23.954400][ C1] xfrm_lookup_route+0x3c/0x170 [ 23.959217][ C1] ip_route_output_flow+0x1f8/0x2f0 [ 23.964384][ C1] ? igmpv3_newpack+0x173/0xc80 [ 23.969202][ C1] ? ipv4_sk_update_pmtu+0x14c0/0x14c0 [ 23.974630][ C1] ? make_kuid+0x1db/0x680 [ 23.979018][ C1] ? __put_user_ns+0x60/0x60 [ 23.983581][ C1] ? __kasan_check_write+0x14/0x20 [ 23.988669][ C1] ? __alloc_skb+0x38b/0x520 [ 23.993229][ C1] igmpv3_newpack+0x281/0xc80 [ 23.997876][ C1] ? ip6table_filter_table_init+0xf0/0xf0 [ 24.003567][ C1] ? igmpv3_sendpack+0x190/0x190 [ 24.008489][ C1] ? mld_sendpack+0x77d/0xb40 [ 24.013162][ C1] add_grhead+0x75/0x2e0 [ 24.017390][ C1] add_grec+0x116b/0x1410 [ 24.021690][ C1] ? __kasan_check_write+0x14/0x20 [ 24.026771][ C1] igmp_ifc_timer_expire+0x89e/0xf80 [ 24.032026][ C1] ? __kasan_check_write+0x14/0x20 [ 24.037106][ C1] ? _raw_spin_lock_irq+0x95/0xf0 [ 24.042098][ C1] ? _raw_spin_lock_irqsave+0x130/0x130 [ 24.047612][ C1] ? igmp_gq_timer_expire+0xe0/0xe0 [ 24.052805][ C1] call_timer_fn+0x38/0x290 [ 24.057280][ C1] ? igmp_gq_timer_expire+0xe0/0xe0 [ 24.062451][ C1] __run_timers+0x650/0x9e0 [ 24.066922][ C1] ? calc_index+0x200/0x200 [ 24.071394][ C1] ? sched_clock_cpu+0x1b/0x3d0 [ 24.076216][ C1] run_timer_softirq+0x6a/0xf0 [ 24.080959][ C1] __do_softirq+0x255/0x563 [ 24.085431][ C1] asm_call_irq_on_stack+0xf/0x20 [ 24.090421][ C1] [ 24.093333][ C1] do_softirq_own_stack+0x60/0x80 [ 24.098350][ C1] do_softirq+0xb0/0xf0 [ 24.102478][ C1] ? __local_bh_enable_ip+0x80/0x80 [ 24.107651][ C1] ? _raw_spin_lock+0x94/0xf0 [ 24.112300][ C1] __local_bh_enable_ip+0x70/0x80 [ 24.117298][ C1] _raw_spin_unlock_bh+0x51/0x60 [ 24.122210][ C1] dev_uc_del+0x2d3/0x340 [ 24.126597][ C1] macsec_dev_stop+0x482/0x540 [ 24.131330][ C1] ? macsec_dev_open+0x690/0x690 [ 24.136238][ C1] ? __kasan_check_write+0x14/0x20 [ 24.141325][ C1] ? _raw_spin_lock_bh+0x94/0xf0 [ 24.146234][ C1] ? _raw_spin_lock_irq+0xf0/0xf0 [ 24.151229][ C1] ? __local_bh_enable_ip+0x53/0x80 [ 24.156394][ C1] ? _raw_spin_unlock_bh+0x51/0x60 [ 24.161489][ C1] ? dev_deactivate_many+0xb52/0xb70 [ 24.166740][ C1] ? macsec_dev_open+0x690/0x690 [ 24.171649][ C1] __dev_close_many+0x288/0x360 [ 24.176467][ C1] ? dev_close_many+0x4d0/0x4d0 [ 24.181285][ C1] dev_close_many+0x221/0x4d0 [ 24.185928][ C1] ? __dev_open+0x500/0x500 [ 24.190400][ C1] ? __kasan_slab_free+0x11/0x20 [ 24.195305][ C1] ? __kasan_check_read+0x11/0x20 [ 24.200297][ C1] unregister_netdevice_many+0x45e/0x1a80 [ 24.205985][ C1] ? alloc_netdev_mqs+0xc80/0xc80 [ 24.210982][ C1] ? unregister_netdevice_queue+0x1aa/0x370 [ 24.216847][ C1] ? list_netdevice+0x4c0/0x4c0 [ 24.221667][ C1] ? br_dev_delete+0xfc/0x110 [ 24.226313][ C1] default_device_exit_batch+0x35e/0x3c0 [ 24.231913][ C1] ? default_device_exit+0x390/0x390 [ 24.237168][ C1] ? wait_woken+0x180/0x180 [ 24.241641][ C1] ? rtnl_unlock+0xe/0x10 [ 24.245937][ C1] ? default_device_exit+0x390/0x390 [ 24.251210][ C1] cleanup_net+0x603/0xb80 [ 24.255602][ C1] ? __kasan_check_write+0x14/0x20 [ 24.260683][ C1] ? ops_init+0x4a0/0x4a0 [ 24.264998][ C1] ? read_word_at_a_time+0x12/0x20 [ 24.270103][ C1] ? strscpy+0x9b/0x290 [ 24.274226][ C1] process_one_work+0x6e1/0xba0 [ 24.279045][ C1] worker_thread+0xa6a/0x13c0 [ 24.283696][ C1] kthread+0x346/0x3d0 [ 24.287731][ C1] ? worker_clr_flags+0x190/0x190 [ 24.292722][ C1] ? kthread_blkcg+0xd0/0xd0 [ 24.297281][ C1] ret_from_fork+0x1f/0x30 [ 24.301664][ C1] [ 24.303960][ C1] [ 24.306256][ C1] Memory state around the buggy address: [ 24.311856][ C1] ffffc90000170a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.319888][ C1] ffffc90000170a80: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 [ 24.327918][ C1] >ffffc90000170b00: 00 00 00 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 [ 24.335946][ C1] ^ [ 24.340768][ C1] ffffc90000170b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.348795][ C1] ffffc90000170c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.356828][ C1] ================================================================== [ 24.364858][ C1] Disabling lock debugging due to kernel taint [ 24.372395][ T7] device veth0_vlan left promiscuous mode 2026/05/15 03:05:30 executed programs: 244 2026/05/15 03:05:35 executed programs: 544