Warning: Permanently added '10.128.10.1' (ED25519) to the list of known hosts. 2026/10/15 04:13:55 parsed 1 programs 2026/10/15 04:13:55 serving rpc on tcp://37335 Setting up swapspace version 1, size = 127995904 bytes [ 33.370548][ T30] kauditd_printk_skb: 31 callbacks suppressed [ 33.370562][ T30] audit: type=1400 audit(1792037636.543:105): avc: denied { unlink } for pid=409 comm="syz-executor" name="swap-file" dev="sda1" ino=2027 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 33.404717][ T409] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 34.047990][ T30] audit: type=1401 audit(1792037637.213:106): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 34.223223][ T447] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.230292][ T447] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.237549][ T447] device bridge_slave_0 entered promiscuous mode [ 34.244314][ T447] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.251372][ T447] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.258622][ T447] device bridge_slave_1 entered promiscuous mode [ 34.290730][ T447] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.297753][ T447] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.305019][ T447] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.312141][ T447] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.329720][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 34.337230][ T318] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.344686][ T318] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.354044][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 34.362229][ T318] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.369244][ T318] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.377625][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 34.385876][ T318] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.392911][ T318] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.405695][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 34.419030][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 34.429177][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 34.439847][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 34.447952][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 34.455422][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 34.463694][ T447] device veth0_vlan entered promiscuous mode [ 34.474482][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 34.483761][ T447] device veth1_macvtap entered promiscuous mode [ 34.492656][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 34.502243][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/10/15 04:13:58 executed programs: 0 [ 34.880729][ T475] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.887765][ T475] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.895702][ T475] device bridge_slave_0 entered promiscuous mode [ 34.905819][ T475] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.912897][ T475] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.920394][ T475] device bridge_slave_1 entered promiscuous mode [ 34.966890][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 34.974368][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 34.986675][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 34.994949][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 35.003173][ T318] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.010215][ T318] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.017701][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 35.029624][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 35.037970][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 35.046075][ T318] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.053108][ T318] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.065391][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 35.078805][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 35.091329][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 35.108190][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 35.116225][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 35.123723][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 35.132070][ T475] device veth0_vlan entered promiscuous mode [ 35.141926][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 35.151571][ T475] device veth1_macvtap entered promiscuous mode [ 35.162443][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 35.177900][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 35.203471][ T30] audit: type=1400 audit(1792037638.373:107): avc: denied { create } for pid=480 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 35.223405][ T30] audit: type=1400 audit(1792037638.373:108): avc: denied { write } for pid=480 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 35.243908][ T481] ================================================================== [ 35.245700][ T30] audit: type=1400 audit(1792037638.373:109): avc: denied { nlmsg_write } for pid=480 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 35.251991][ T481] BUG: KASAN: use-after-free in __ipv6_addr_type+0x272/0x2f0 [ 35.252024][ T481] Read of size 4 at addr ffff88812f6c6448 by task syz.2.17/481 [ 35.252038][ T481] [ 35.252048][ T481] CPU: 0 PID: 481 Comm: syz.2.17 Not tainted syzkaller #0 [ 35.252063][ T481] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 35.252075][ T481] Call Trace: [ 35.309758][ T481] [ 35.312675][ T481] __dump_stack+0x21/0x30 [ 35.316985][ T481] dump_stack_lvl+0x110/0x170 [ 35.321641][ T481] ? show_regs_print_info+0x20/0x20 [ 35.326817][ T481] ? load_image+0x3f0/0x3f0 [ 35.331297][ T481] ? __xfrm_route_forward+0x37e/0x540 [ 35.336654][ T481] print_address_description+0x7f/0x2c0 [ 35.342176][ T481] ? __ipv6_addr_type+0x272/0x2f0 [ 35.347185][ T481] kasan_report+0x10f/0x150 [ 35.351668][ T481] ? __ipv6_addr_type+0x272/0x2f0 [ 35.356670][ T481] __asan_report_load4_noabort+0x14/0x20 [ 35.362280][ T481] __ipv6_addr_type+0x272/0x2f0 [ 35.367111][ T481] ip6_forward+0xdb2/0x1ba0 [ 35.371595][ T481] ? dst_output+0x80/0x80 [ 35.375901][ T481] ? sk_setup_caps+0x400/0x400 [ 35.380646][ T481] ? ip6table_mangle_table_init+0x60/0x60 [ 35.386359][ T481] ip6_rcv_finish+0x18f/0x360 [ 35.391014][ T481] ipv6_rcv+0xed/0x230 [ 35.395060][ T481] ? ip6_rcv_finish+0x360/0x360 [ 35.399893][ T481] ? refcount_add+0x80/0x80 [ 35.404372][ T481] ? __alloc_skb+0x459/0x730 [ 35.409290][ T481] ? ip6_rcv_finish+0x360/0x360 [ 35.414117][ T481] __netif_receive_skb+0xc8/0x280 [ 35.419119][ T481] netif_receive_skb+0x98/0x3e0 [ 35.423951][ T481] ? netif_receive_skb_core+0x100/0x100 [ 35.429476][ T481] ? copy_page_from_iter+0x2b1/0x680 [ 35.434741][ T481] tun_rx_batched+0x600/0x750 [ 35.439401][ T481] ? local_bh_enable+0x30/0x30 [ 35.444145][ T481] tun_get_user+0x2809/0x33e0 [ 35.448806][ T481] ? tun_do_read+0x1d70/0x1d70 [ 35.453548][ T481] ? futex_exit_release+0x1e0/0x1e0 [ 35.458727][ T481] ? netdev_run_todo+0x8e0/0x950 [ 35.463640][ T481] ? dev_ifsioc+0x130/0xd50 [ 35.468121][ T481] ? dev_ioctl+0xd00/0xd00 [ 35.472514][ T481] ? netdev_refcnt_read+0x60/0x60 [ 35.477519][ T481] ? mutex_lock+0x9b/0x1c0 [ 35.481919][ T481] ? wait_for_completion_killable_timeout+0x10/0x10 [ 35.488495][ T481] ? avc_policy_seqno+0x1b/0x70 [ 35.493324][ T481] ? selinux_file_permission+0x2aa/0x510 [ 35.498954][ T481] tun_chr_write_iter+0x1ed/0x2f0 [ 35.503961][ T481] vfs_write+0x831/0xfd0 [ 35.508184][ T481] ? file_end_write+0x1b0/0x1b0 [ 35.513021][ T481] ? __fget_files+0x2e1/0x340 [ 35.517675][ T481] ? __fdget_pos+0x1f7/0x380 [ 35.522253][ T481] ? ksys_write+0x70/0x260 [ 35.526651][ T481] ksys_write+0x14a/0x260 [ 35.531051][ T481] ? __ia32_sys_read+0x90/0x90 [ 35.535793][ T481] ? __kasan_check_write+0x14/0x20 [ 35.540884][ T481] ? switch_fpu_return+0x15d/0x2c0 [ 35.545999][ T481] __x64_sys_write+0x7b/0x90 [ 35.550661][ T481] x64_sys_call+0x8ef/0x9a0 [ 35.555144][ T481] do_syscall_64+0x4c/0xa0 [ 35.559539][ T481] ? clear_bhb_loop+0x50/0xa0 [ 35.564199][ T481] ? clear_bhb_loop+0x50/0xa0 [ 35.568867][ T481] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 35.574739][ T481] RIP: 0033:0x7f5e4514c159 [ 35.579139][ T481] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.598725][ T481] RSP: 002b:00007f5e44fad028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 35.607139][ T481] RAX: ffffffffffffffda RBX: 00007f5e453d3fa0 RCX: 00007f5e4514c159 [ 35.615109][ T481] RDX: 000000000000ffdd RSI: 0000200000000000 RDI: 0000000000000005 [ 35.623080][ T481] RBP: 00007f5e451e306b R08: 0000000000000000 R09: 0000000000000000 [ 35.631041][ T481] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 35.638999][ T481] R13: 00007f5e453d4038 R14: 00007f5e453d3fa0 R15: 00007fffe30a4ad8 [ 35.646960][ T481] [ 35.649963][ T481] [ 35.652267][ T481] Allocated by task 481: [ 35.656491][ T481] __kasan_kmalloc+0xd4/0x100 [ 35.661152][ T481] __kmalloc_track_caller+0x13c/0x2c0 [ 35.666504][ T481] __alloc_skb+0x210/0x730 [ 35.670901][ T481] alloc_skb_with_frags+0xa8/0x620 [ 35.675993][ T481] sock_alloc_send_pskb+0x87f/0x9a0 [ 35.681178][ T481] tun_get_user+0xaab/0x33e0 [ 35.685752][ T481] tun_chr_write_iter+0x1ed/0x2f0 [ 35.690755][ T481] vfs_write+0x831/0xfd0 [ 35.695013][ T481] ksys_write+0x14a/0x260 [ 35.699321][ T481] __x64_sys_write+0x7b/0x90 [ 35.703891][ T481] x64_sys_call+0x8ef/0x9a0 [ 35.708374][ T481] do_syscall_64+0x4c/0xa0 [ 35.712796][ T481] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 35.718670][ T481] [ 35.720974][ T481] Freed by task 481: [ 35.724845][ T481] kasan_set_track+0x4a/0x70 [ 35.729421][ T481] kasan_set_free_info+0x23/0x40 [ 35.734337][ T481] ____kasan_slab_free+0x125/0x160 [ 35.739428][ T481] __kasan_slab_free+0x11/0x20 [ 35.744174][ T481] slab_free_freelist_hook+0xc2/0x190 [ 35.749534][ T481] kfree+0xc4/0x270 [ 35.753322][ T481] pskb_expand_head+0x394/0x1280 [ 35.758241][ T481] __pskb_pull_tail+0xba/0x1570 [ 35.763072][ T481] __xfrm_decode_session+0x5b0/0x1de0 [ 35.768426][ T481] __xfrm_route_forward+0x115/0x540 [ 35.773603][ T481] ip6_forward+0xca5/0x1ba0 [ 35.778094][ T481] ip6_rcv_finish+0x18f/0x360 [ 35.782748][ T481] ipv6_rcv+0xed/0x230 [ 35.786803][ T481] __netif_receive_skb+0xc8/0x280 [ 35.791806][ T481] netif_receive_skb+0x98/0x3e0 [ 35.796655][ T481] tun_rx_batched+0x600/0x750 [ 35.801339][ T481] tun_get_user+0x2809/0x33e0 [ 35.806000][ T481] tun_chr_write_iter+0x1ed/0x2f0 [ 35.811005][ T481] vfs_write+0x831/0xfd0 [ 35.815226][ T481] ksys_write+0x14a/0x260 [ 35.819540][ T481] __x64_sys_write+0x7b/0x90 [ 35.824116][ T481] x64_sys_call+0x8ef/0x9a0 [ 35.828598][ T481] do_syscall_64+0x4c/0xa0 [ 35.832992][ T481] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 35.838864][ T481] [ 35.841166][ T481] The buggy address belongs to the object at ffff88812f6c6400 [ 35.841166][ T481] which belongs to the cache kmalloc-512 of size 512 [ 35.855214][ T481] The buggy address is located 72 bytes inside of [ 35.855214][ T481] 512-byte region [ffff88812f6c6400, ffff88812f6c6600) [ 35.868381][ T481] The buggy address belongs to the page: [ 35.873997][ T481] page:ffffea0004bdb100 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12f6c4 [ 35.884215][ T481] head:ffffea0004bdb100 order:2 compound_mapcount:0 compound_pincount:0 [ 35.892514][ T481] flags: 0x4000000000010200(slab|head|zone=1) [ 35.898568][ T481] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 [ 35.907129][ T481] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 35.915683][ T481] page dumped because: kasan: bad access detected [ 35.922070][ T481] page_owner tracks the page as allocated [ 35.927765][ T481] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 8, ts 35237856543, free_ts 35230580089 [ 35.947969][ T481] post_alloc_hook+0x192/0x1b0 [ 35.952717][ T481] prep_new_page+0x1c/0x110 [ 35.957200][ T481] get_page_from_freelist+0x2c3a/0x2cd0 [ 35.962811][ T481] __alloc_pages+0x1a2/0x460 [ 35.967385][ T481] new_slab+0xa0/0x4d0 [ 35.971430][ T481] ___slab_alloc+0x3ac/0x840 [ 35.975997][ T481] __slab_alloc+0x49/0x90 [ 35.980394][ T481] __kmalloc_track_caller+0x169/0x2c0 [ 35.985749][ T481] __alloc_skb+0x210/0x730 [ 35.990316][ T481] inet_netconf_notify_devconf+0x169/0x220 [ 35.996102][ T481] devinet_exit_net+0x10e/0x220 [ 36.000941][ T481] cleanup_net+0x58e/0xae0 [ 36.005342][ T481] process_one_work+0x6c8/0xbb0 [ 36.010173][ T481] worker_thread+0xaa0/0x1250 [ 36.014833][ T481] kthread+0x3f5/0x4f0 [ 36.018879][ T481] ret_from_fork+0x1f/0x30 [ 36.023301][ T481] page last free stack trace: [ 36.027951][ T481] free_unref_page_prepare+0x5fa/0x600 [ 36.033407][ T481] free_unref_page+0xae/0x540 [ 36.038062][ T481] __free_pages+0x6c/0x100 [ 36.042476][ T481] free_pages+0x82/0x90 [ 36.046613][ T481] __stack_depot_save+0x453/0x480 [ 36.051621][ T481] __kasan_kmalloc+0xe6/0x100 [ 36.056276][ T481] kmem_cache_alloc_trace+0x119/0x270 [ 36.061628][ T481] __ipv6_dev_ac_inc+0x294/0x860 [ 36.066550][ T481] __ipv6_ifa_notify+0x91a/0xe70 [ 36.071470][ T481] addrconf_dad_completed+0x182/0xe20 [ 36.076835][ T481] addrconf_dad_work+0xc4c/0x1510 [ 36.081849][ T481] process_one_work+0x6c8/0xbb0 [ 36.086718][ T481] worker_thread+0xaa0/0x1250 [ 36.091375][ T481] kthread+0x3f5/0x4f0 [ 36.095422][ T481] ret_from_fork+0x1f/0x30 [ 36.099827][ T481] [ 36.102129][ T481] Memory state around the buggy address: [ 36.107762][ T481] ffff88812f6c6300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.115816][ T481] ffff88812f6c6380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.123861][ T481] >ffff88812f6c6400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.131913][ T481] ^ [ 36.138311][ T481] ffff88812f6c6480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.146361][ T481] ffff88812f6c6500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.154398][ T481] ================================================================== [ 36.162436][ T481] Disabling lock debugging due to kernel taint [ 36.183709][ T30] audit: type=1400 audit(1792037639.353:110): avc: denied { read } for pid=83 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 36.206435][ T30] audit: type=1400 audit(1792037639.353:111): avc: denied { search } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 36.227951][ T30] audit: type=1400 audit(1792037639.353:112): avc: denied { write } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 36.249435][ T30] audit: type=1400 audit(1792037639.353:113): avc: denied { add_name } for pid=83 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 36.272056][ T30] audit: type=1400 audit(1792037639.353:114): avc: denied { create } for pid=83 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 36.993366][ T8] device bridge_slave_1 left promiscuous mode [ 36.999502][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.006988][ T8] device bridge_slave_0 left promiscuous mode [ 37.013203][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.021208][ T8] device veth1_macvtap left promiscuous mode [ 37.027197][ T8] device veth0_vlan left promiscuous mode 2026/10/15 04:14:03 executed programs: 39 2026/10/15 04:14:08 executed programs: 91