Warning: Permanently added '10.128.0.12' (ED25519) to the list of known hosts. 2026/07/01 20:54:54 parsed 1 programs 2026/07/01 20:54:54 serving rpc on tcp://33875 [ 20.184985][ T30] audit: type=1400 audit(1782939294.842:64): avc: denied { node_bind } for pid=293 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 20.205787][ T30] audit: type=1400 audit(1782939294.842:65): avc: denied { module_request } for pid=293 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 20.847740][ T30] audit: type=1400 audit(1782939295.512:66): avc: denied { mounton } for pid=299 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 20.848841][ T299] cgroup: Unknown subsys name 'net' [ 20.870389][ T30] audit: type=1400 audit(1782939295.512:67): avc: denied { mount } for pid=299 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.897667][ T30] audit: type=1400 audit(1782939295.532:68): avc: denied { unmount } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.897764][ T299] cgroup: Unknown subsys name 'devices' [ 21.008801][ T299] cgroup: Unknown subsys name 'hugetlb' [ 21.014390][ T299] cgroup: Unknown subsys name 'rlimit' [ 21.155655][ T30] audit: type=1400 audit(1782939295.812:69): avc: denied { setattr } for pid=299 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.178834][ T30] audit: type=1400 audit(1782939295.812:70): avc: denied { create } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 21.199252][ T30] audit: type=1400 audit(1782939295.812:71): avc: denied { write } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 21.205032][ T304] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 21.219547][ T30] audit: type=1400 audit(1782939295.812:72): avc: denied { read } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 21.248285][ T30] audit: type=1400 audit(1782939295.812:73): avc: denied { mounton } for pid=299 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 21.276301][ T299] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.700964][ T306] request_module fs-gadgetfs succeeded, but still no fs? [ 21.899714][ T315] syz-executor (315) used greatest stack depth: 21984 bytes left [ 21.911861][ T329] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.918920][ T329] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.926216][ T329] device bridge_slave_0 entered promiscuous mode [ 21.933101][ T329] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.940175][ T329] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.947835][ T329] device bridge_slave_1 entered promiscuous mode [ 21.982047][ T329] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.989116][ T329] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.996372][ T329] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.003423][ T329] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.020722][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.028485][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.035700][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.044489][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.052646][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.059670][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.069209][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.077380][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.084417][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.095446][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.104713][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.117800][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.129798][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.137807][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.145159][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.153839][ T329] device veth0_vlan entered promiscuous mode [ 22.162834][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.171692][ T329] device veth1_macvtap entered promiscuous mode [ 22.180730][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.191212][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.226108][ T329] syz-executor (329) used greatest stack depth: 21096 bytes left 2026/07/01 20:54:57 executed programs: 0 [ 22.762368][ T368] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.769455][ T368] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.776823][ T368] device bridge_slave_0 entered promiscuous mode [ 22.783706][ T368] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.790775][ T368] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.798079][ T368] device bridge_slave_1 entered promiscuous mode [ 22.845932][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 22.853406][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.861714][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 22.870091][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.878275][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.885282][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.892688][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 22.903934][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 22.912256][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.920454][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.927492][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.938200][ T45] device bridge_slave_1 left promiscuous mode [ 22.944281][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.951692][ T45] device bridge_slave_0 left promiscuous mode [ 22.957820][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.965448][ T45] device veth1_macvtap left promiscuous mode [ 22.971722][ T45] device veth0_vlan left promiscuous mode [ 23.073472][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.082365][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.094443][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.104837][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.112852][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.120193][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.128966][ T368] device veth0_vlan entered promiscuous mode [ 23.138433][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.147162][ T368] device veth1_macvtap entered promiscuous mode [ 23.155395][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.163886][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.173012][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.181366][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.204555][ T372] loop2: detected capacity change from 0 to 1024 [ 23.237299][ T372] EXT4-fs (loop2): Mount option "noacl" will be removed by 3.5 [ 23.237299][ T372] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 23.237299][ T372] [ 23.255055][ T372] EXT4-fs (loop2): Ignoring removed orlov option [ 23.268776][ T372] EXT4-fs (loop2): mounted filesystem without journal. Opts: block_validity,bsddf,noacl,norecovery,debug_want_extra_isize=0x0000000000000080,orlov,nogrpid,noauto_da_alloc,norecovery,,errors=continue. Quota mode: none. [ 23.300291][ T372] ================================================================== [ 23.308341][ T372] BUG: KASAN: slab-out-of-bounds in ext4_listxattr+0x4a9/0xc60 [ 23.315872][ T372] Read of size 4 at addr ffff8881113b0090 by task syz.2.17/372 [ 23.323387][ T372] [ 23.325692][ T372] CPU: 0 PID: 372 Comm: syz.2.17 Not tainted syzkaller #0 [ 23.332770][ T372] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 23.342804][ T372] Call Trace: [ 23.346056][ T372] [ 23.348964][ T372] __dump_stack+0x21/0x30 [ 23.353267][ T372] dump_stack_lvl+0x110/0x170 [ 23.357912][ T372] ? show_regs_print_info+0x20/0x20 [ 23.363079][ T372] ? load_image+0x3f0/0x3f0 [ 23.367561][ T372] print_address_description+0x7f/0x2c0 [ 23.373082][ T372] ? ext4_listxattr+0x4a9/0xc60 [ 23.377908][ T372] kasan_report+0x10f/0x150 [ 23.382385][ T372] ? ext4_listxattr+0x4a9/0xc60 [ 23.387207][ T372] __asan_report_load4_noabort+0x14/0x20 [ 23.392826][ T372] ext4_listxattr+0x4a9/0xc60 [ 23.397475][ T372] ? kmem_cache_free+0x100/0x320 [ 23.402389][ T372] ? ext4_xattr_get+0x830/0x830 [ 23.407215][ T372] ? security_inode_listxattr+0xc9/0x110 [ 23.412836][ T372] ? ext4_xattr_get+0x830/0x830 [ 23.417665][ T372] listxattr+0x28f/0x300 [ 23.421886][ T372] path_listxattr+0xe1/0x1b0 [ 23.426457][ T372] ? getxattr+0x410/0x410 [ 23.430761][ T372] ? debug_smp_processor_id+0x17/0x20 [ 23.436111][ T372] __x64_sys_llistxattr+0x7d/0x90 [ 23.441115][ T372] x64_sys_call+0x584/0x9a0 [ 23.445596][ T372] do_syscall_64+0x4c/0xa0 [ 23.449991][ T372] ? clear_bhb_loop+0x50/0xa0 [ 23.454651][ T372] ? clear_bhb_loop+0x50/0xa0 [ 23.459318][ T372] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 23.465193][ T372] RIP: 0033:0x7f36a09c6e59 [ 23.469589][ T372] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 23.489177][ T372] RSP: 002b:00007ffdd9f71478 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3 [ 23.497573][ T372] RAX: ffffffffffffffda RBX: 00007f36a0c4efa0 RCX: 00007f36a09c6e59 [ 23.505525][ T372] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000400 [ 23.513475][ T372] RBP: 00007f36a0a5ce6f R08: 0000000000000000 R09: 0000000000000000 [ 23.521433][ T372] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 23.529388][ T372] R13: 00007f36a0c4efac R14: 00007f36a0c4efa0 R15: 00007f36a0c4efa0 [ 23.537341][ T372] [ 23.540339][ T372] [ 23.542641][ T372] Allocated by task 308: [ 23.546856][ T372] __kasan_slab_alloc+0xb7/0xe0 [ 23.551688][ T372] slab_post_alloc_hook+0x4f/0x2b0 [ 23.556778][ T372] kmem_cache_alloc+0xf7/0x260 [ 23.561522][ T372] security_file_alloc+0x33/0x120 [ 23.566524][ T372] __alloc_file+0xb5/0x2a0 [ 23.570915][ T372] alloc_empty_file+0x97/0x180 [ 23.575660][ T372] path_openat+0xf4/0x2f80 [ 23.580051][ T372] do_filp_open+0x1df/0x400 [ 23.584532][ T372] do_sys_openat2+0x15e/0x7f0 [ 23.589187][ T372] __x64_sys_openat+0x136/0x160 [ 23.594015][ T372] x64_sys_call+0x219/0x9a0 [ 23.598496][ T372] do_syscall_64+0x4c/0xa0 [ 23.602891][ T372] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 23.608761][ T372] [ 23.611063][ T372] Freed by task 308: [ 23.614930][ T372] kasan_set_track+0x4a/0x70 [ 23.619499][ T372] kasan_set_free_info+0x23/0x40 [ 23.624415][ T372] ____kasan_slab_free+0x125/0x160 [ 23.629506][ T372] __kasan_slab_free+0x11/0x20 [ 23.634244][ T372] slab_free_freelist_hook+0xc2/0x190 [ 23.639596][ T372] kmem_cache_free+0x100/0x320 [ 23.644337][ T372] security_file_free+0xc7/0xe0 [ 23.649165][ T372] __fput+0x5fd/0x900 [ 23.653127][ T372] ____fput+0x15/0x20 [ 23.657083][ T372] task_work_run+0x127/0x190 [ 23.661650][ T372] exit_to_user_mode_loop+0xd0/0xe0 [ 23.666825][ T372] exit_to_user_mode_prepare+0x87/0xd0 [ 23.672259][ T372] syscall_exit_to_user_mode+0x1a/0x30 [ 23.677700][ T372] do_syscall_64+0x58/0xa0 [ 23.682095][ T372] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 23.687963][ T372] [ 23.690264][ T372] The buggy address belongs to the object at ffff8881113b0080 [ 23.690264][ T372] which belongs to the cache lsm_file_cache of size 16 [ 23.704463][ T372] The buggy address is located 0 bytes to the right of [ 23.704463][ T372] 16-byte region [ffff8881113b0080, ffff8881113b0090) [ 23.717970][ T372] The buggy address belongs to the page: [ 23.723586][ T372] page:ffffea000444ec00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8881113b04a0 pfn:0x1113b0 [ 23.735106][ T372] flags: 0x4000000000000200(slab|zone=1) [ 23.740721][ T372] raw: 4000000000000200 ffffea0004415640 0000000a0000000a ffff888100187c80 [ 23.749283][ T372] raw: ffff8881113b04a0 0000000080800075 00000001ffffffff 0000000000000000 [ 23.757836][ T372] page dumped because: kasan: bad access detected [ 23.764221][ T372] page_owner tracks the page as allocated [ 23.769918][ T372] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 104, ts 3844865768, free_ts 0 [ 23.784909][ T372] post_alloc_hook+0x192/0x1b0 [ 23.789656][ T372] prep_new_page+0x1c/0x110 [ 23.794135][ T372] get_page_from_freelist+0x2c3a/0x2cd0 [ 23.799658][ T372] __alloc_pages+0x1a2/0x460 [ 23.804224][ T372] new_slab+0xa0/0x4d0 [ 23.808275][ T372] ___slab_alloc+0x3ac/0x840 [ 23.812841][ T372] __slab_alloc+0x49/0x90 [ 23.817148][ T372] kmem_cache_alloc+0x138/0x260 [ 23.821976][ T372] security_file_alloc+0x33/0x120 [ 23.826982][ T372] __alloc_file+0xb5/0x2a0 [ 23.831373][ T372] alloc_empty_file+0x97/0x180 [ 23.836123][ T372] path_openat+0xf4/0x2f80 [ 23.840517][ T372] do_filp_open+0x1df/0x400 [ 23.844998][ T372] do_sys_openat2+0x15e/0x7f0 [ 23.849652][ T372] __x64_sys_openat+0x136/0x160 [ 23.854476][ T372] x64_sys_call+0x219/0x9a0 [ 23.858956][ T372] page_owner free stack trace missing [ 23.864315][ T372] [ 23.866615][ T372] Memory state around the buggy address: [ 23.872221][ T372] ffff8881113aff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 23.880259][ T372] ffff8881113b0000: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc [ 23.888294][ T372] >ffff8881113b0080: fa fb fc fc fb fb fc fc fa fb fc fc fb fb fc fc [ 23.896328][ T372] ^ [ 23.900889][ T372] ffff8881113b0100: fa fb fc fc fb fb fc fc fb fb fc fc fa fb fc fc [ 23.908927][ T372] ffff8881113b0180: fb fb fc fc fb fb fc fc fa fb fc fc fa fb fc fc [ 23.916980][ T372] ================================================================== [ 23.925013][ T372] Disabling lock debugging due to kernel taint