Warning: Permanently added '10.128.1.25' (ED25519) to the list of known hosts. 2025/11/18 12:29:28 parsed 1 programs [ 46.422571][ T30] audit: type=1400 audit(1763468969.560:105): avc: denied { unlink } for pid=398 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 46.476860][ T398] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 47.135954][ T424] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.143232][ T424] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.150609][ T424] device bridge_slave_0 entered promiscuous mode [ 47.158337][ T424] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.165444][ T424] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.172924][ T424] device bridge_slave_1 entered promiscuous mode [ 47.213293][ T424] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.220337][ T424] bridge0: port 2(bridge_slave_1) entered forwarding state [ 47.227771][ T424] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.234801][ T424] bridge0: port 1(bridge_slave_0) entered forwarding state [ 47.251400][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.259015][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.267584][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 47.275050][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 47.284817][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 47.293236][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.300265][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 47.308927][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 47.317352][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.324529][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 47.336516][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 47.345851][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 47.358652][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 47.370452][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 47.378827][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 47.386591][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 47.394986][ T424] device veth0_vlan entered promiscuous mode [ 47.406993][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 47.416507][ T424] device veth1_macvtap entered promiscuous mode [ 47.426036][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 47.436064][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 47.767924][ T30] audit: type=1401 audit(1763468970.900:106): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" 2025/11/18 12:29:31 executed programs: 0 [ 48.033710][ T468] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.040747][ T468] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.048258][ T468] device bridge_slave_0 entered promiscuous mode [ 48.055752][ T8] device bridge_slave_1 left promiscuous mode [ 48.061943][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.069482][ T8] device bridge_slave_0 left promiscuous mode [ 48.075713][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.083643][ T8] device veth1_macvtap left promiscuous mode [ 48.089807][ T8] device veth0_vlan left promiscuous mode [ 48.186087][ T468] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.193349][ T468] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.200796][ T468] device bridge_slave_1 entered promiscuous mode [ 48.250838][ T301] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 48.258436][ T301] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 48.267184][ T301] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 48.275830][ T301] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 48.284104][ T301] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.291152][ T301] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.299093][ T301] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 48.307733][ T301] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 48.316132][ T301] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 48.324374][ T301] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.331503][ T301] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.343439][ T301] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 48.352774][ T301] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 48.365793][ T301] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 48.378778][ T468] device veth0_vlan entered promiscuous mode [ 48.385714][ T301] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 48.393866][ T301] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 48.401292][ T301] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 48.414706][ T468] device veth1_macvtap entered promiscuous mode [ 48.422416][ T301] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 48.437350][ T301] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 48.446172][ T301] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 48.471413][ T480] ================================================================== [ 48.479502][ T480] BUG: KASAN: slab-out-of-bounds in xfrm_policy_inexact_list_reinsert+0x620/0x6d0 [ 48.481859][ T30] audit: type=1400 audit(1763468971.600:107): avc: denied { create } for pid=479 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 48.488722][ T480] Read of size 1 at addr ffff888118d36bf8 by task syz.2.17/480 [ 48.508380][ T30] audit: type=1400 audit(1763468971.600:108): avc: denied { setopt } for pid=479 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 48.515489][ T480] [ 48.515507][ T480] CPU: 1 PID: 480 Comm: syz.2.17 Not tainted syzkaller #0 [ 48.515526][ T480] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 48.515545][ T480] Call Trace: [ 48.534943][ T30] audit: type=1400 audit(1763468971.600:109): avc: denied { write } for pid=479 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 48.536849][ T480] [ 48.544047][ T30] audit: type=1400 audit(1763468971.600:110): avc: denied { create } for pid=479 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 48.553954][ T480] __dump_stack+0x21/0x30 [ 48.553982][ T480] dump_stack_lvl+0xee/0x150 [ 48.553997][ T480] ? show_regs_print_info+0x20/0x20 [ 48.554012][ T480] ? load_image+0x3a0/0x3a0 [ 48.554027][ T480] ? unwind_get_return_address+0x4d/0x90 [ 48.557770][ T30] audit: type=1400 audit(1763468971.600:111): avc: denied { write } for pid=479 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 48.576462][ T480] print_address_description+0x7f/0x2c0 [ 48.576490][ T480] ? xfrm_policy_inexact_list_reinsert+0x620/0x6d0 [ 48.576508][ T480] kasan_report+0xf1/0x140 [ 48.576526][ T480] ? xfrm_policy_inexact_list_reinsert+0x620/0x6d0 [ 48.576542][ T480] __asan_report_load1_noabort+0x14/0x20 [ 48.576557][ T480] xfrm_policy_inexact_list_reinsert+0x620/0x6d0 [ 48.579820][ T30] audit: type=1400 audit(1763468971.600:112): avc: denied { nlmsg_write } for pid=479 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 48.599275][ T480] xfrm_policy_inexact_insert_node+0x938/0xb50 [ 48.599303][ T480] ? xfrm_netlink_rcv+0x72/0x90 [ 48.599320][ T480] ? netlink_unicast+0x876/0xa40 [ 48.599337][ T480] ? netlink_sendmsg+0x86a/0xb70 [ 48.720292][ T480] ? ____sys_sendmsg+0x5a2/0x8c0 [ 48.725284][ T480] ? ___sys_sendmsg+0x1f0/0x260 [ 48.730136][ T480] ? x64_sys_call+0x4b/0x9a0 [ 48.734802][ T480] ? entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 48.740861][ T480] xfrm_policy_inexact_alloc_chain+0x53a/0xb30 [ 48.747087][ T480] xfrm_policy_inexact_insert+0x70/0x1130 [ 48.752796][ T480] ? __get_hash_thresh+0x10c/0x420 [ 48.758161][ T480] ? policy_hash_bysel+0x110/0x4f0 [ 48.763436][ T480] xfrm_policy_insert+0x126/0x9a0 [ 48.768441][ T480] ? xfrm_policy_construct+0x54f/0x1f00 [ 48.773965][ T480] xfrm_add_policy+0x4d1/0x830 [ 48.778714][ T480] ? xfrm_dump_sa_done+0xc0/0xc0 [ 48.783724][ T480] xfrm_user_rcv_msg+0x45c/0x6e0 [ 48.788654][ T480] ? xfrm_netlink_rcv+0x90/0x90 [ 48.793579][ T480] ? avc_has_perm_noaudit+0x460/0x460 [ 48.798937][ T480] ? x64_sys_call+0x4b/0x9a0 [ 48.803604][ T480] ? selinux_nlmsg_lookup+0x237/0x4c0 [ 48.808958][ T480] netlink_rcv_skb+0x1e0/0x430 [ 48.813703][ T480] ? xfrm_netlink_rcv+0x90/0x90 [ 48.818535][ T480] ? netlink_ack+0xb60/0xb60 [ 48.823209][ T480] ? wait_for_completion_killable_timeout+0x10/0x10 [ 48.829878][ T480] ? __netlink_lookup+0x387/0x3b0 [ 48.834884][ T480] xfrm_netlink_rcv+0x72/0x90 [ 48.839632][ T480] netlink_unicast+0x876/0xa40 [ 48.844424][ T480] netlink_sendmsg+0x86a/0xb70 [ 48.849172][ T480] ? netlink_getsockopt+0x530/0x530 [ 48.854439][ T480] ? sock_alloc_file+0xba/0x260 [ 48.859272][ T480] ? security_socket_sendmsg+0x82/0xa0 [ 48.864718][ T480] ? netlink_getsockopt+0x530/0x530 [ 48.869954][ T480] ____sys_sendmsg+0x5a2/0x8c0 [ 48.874733][ T480] ? __sys_sendmsg_sock+0x40/0x40 [ 48.879836][ T480] ? import_iovec+0x7c/0xb0 [ 48.884336][ T480] ___sys_sendmsg+0x1f0/0x260 [ 48.889003][ T480] ? __sys_sendmsg+0x250/0x250 [ 48.893776][ T480] ? __fdget+0x1a1/0x230 [ 48.898007][ T480] __x64_sys_sendmsg+0x1e2/0x2a0 [ 48.902932][ T480] ? ___sys_sendmsg+0x260/0x260 [ 48.907877][ T480] ? __kasan_check_write+0x14/0x20 [ 48.912981][ T480] ? switch_fpu_return+0x15d/0x2c0 [ 48.918108][ T480] x64_sys_call+0x4b/0x9a0 [ 48.922521][ T480] do_syscall_64+0x4c/0xa0 [ 48.926924][ T480] ? clear_bhb_loop+0x50/0xa0 [ 48.931670][ T480] ? clear_bhb_loop+0x50/0xa0 [ 48.936331][ T480] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 48.942211][ T480] RIP: 0033:0x7fc4e29ffbe9 [ 48.946700][ T480] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 48.966418][ T480] RSP: 002b:00007fc4e2870038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 48.974841][ T480] RAX: ffffffffffffffda RBX: 00007fc4e2c26fa0 RCX: 00007fc4e29ffbe9 [ 48.982809][ T480] RDX: 0000000000004000 RSI: 0000200000000580 RDI: 0000000000000005 [ 48.990782][ T480] RBP: 00007fc4e2a82e19 R08: 0000000000000000 R09: 0000000000000000 [ 48.998754][ T480] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 49.006745][ T480] R13: 00007fc4e2c27038 R14: 00007fc4e2c26fa0 R15: 00007ffd47bff158 [ 49.014710][ T480] [ 49.017806][ T480] [ 49.020122][ T480] Allocated by task 480: [ 49.024426][ T480] __kasan_kmalloc+0xda/0x110 [ 49.029188][ T480] __kmalloc+0x13d/0x2c0 [ 49.033409][ T480] sk_prot_alloc+0xed/0x320 [ 49.037898][ T480] sk_alloc+0x38/0x430 [ 49.042054][ T480] pfkey_create+0x12a/0x660 [ 49.046556][ T480] __sock_create+0x38d/0x7a0 [ 49.051141][ T480] __sys_socket+0xec/0x190 [ 49.055555][ T480] __x64_sys_socket+0x7a/0x90 [ 49.060240][ T480] x64_sys_call+0x8c5/0x9a0 [ 49.064848][ T480] do_syscall_64+0x4c/0xa0 [ 49.069255][ T480] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 49.075137][ T480] [ 49.077447][ T480] The buggy address belongs to the object at ffff888118d36800 [ 49.077447][ T480] which belongs to the cache kmalloc-1k of size 1024 [ 49.091479][ T480] The buggy address is located 1016 bytes inside of [ 49.091479][ T480] 1024-byte region [ffff888118d36800, ffff888118d36c00) [ 49.104921][ T480] The buggy address belongs to the page: [ 49.110546][ T480] page:ffffea0004634c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118d30 [ 49.120880][ T480] head:ffffea0004634c00 order:3 compound_mapcount:0 compound_pincount:0 [ 49.129366][ T480] flags: 0x4000000000010200(slab|head|zone=1) [ 49.135445][ T480] raw: 4000000000010200 0000000000000000 0000000100000001 ffff888100043080 [ 49.144130][ T480] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 49.152783][ T480] page dumped because: kasan: bad access detected [ 49.159201][ T480] page_owner tracks the page as allocated [ 49.165092][ T480] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 108, ts 4898043275, free_ts 0 [ 49.183155][ T480] post_alloc_hook+0x192/0x1b0 [ 49.187928][ T480] prep_new_page+0x1c/0x110 [ 49.192514][ T480] get_page_from_freelist+0x2cc5/0x2d50 [ 49.198140][ T480] __alloc_pages+0x18f/0x440 [ 49.202709][ T480] new_slab+0xa1/0x4d0 [ 49.206768][ T480] ___slab_alloc+0x381/0x810 [ 49.211336][ T480] __slab_alloc+0x49/0x90 [ 49.215743][ T480] __kmalloc_track_caller+0x169/0x2c0 [ 49.221114][ T480] __alloc_skb+0x21a/0x740 [ 49.225522][ T480] netlink_sendmsg+0x602/0xb70 [ 49.230274][ T480] ____sys_sendmsg+0x5a2/0x8c0 [ 49.235054][ T480] ___sys_sendmsg+0x1f0/0x260 [ 49.239733][ T480] __x64_sys_sendmsg+0x1e2/0x2a0 [ 49.244691][ T480] x64_sys_call+0x4b/0x9a0 [ 49.249118][ T480] do_syscall_64+0x4c/0xa0 [ 49.253527][ T480] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 49.259418][ T480] page_owner free stack trace missing [ 49.264775][ T480] [ 49.267366][ T480] Memory state around the buggy address: [ 49.273196][ T480] ffff888118d36a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 49.281350][ T480] ffff888118d36b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 49.289398][ T480] >ffff888118d36b80: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 49.297437][ T480] ^ [ 49.305410][ T480] ffff888118d36c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 49.313560][ T480] ffff888118d36c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 49.321601][ T480] ================================================================== [ 49.329635][ T480] Disabling lock debugging due to kernel taint [ 49.344525][ T30] audit: type=1400 audit(1763468972.480:113): avc: denied { read } for pid=83 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 49.367519][ T30] audit: type=1400 audit(1763468972.480:114): avc: denied { search } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 2025/11/18 12:29:36 executed programs: 217 2025/11/18 12:29:41 executed programs: 517