Warning: Permanently added '10.128.1.160' (ED25519) to the list of known hosts. 2026/02/26 20:54:38 parsed 1 programs Setting up swapspace version 1, size = 127995904 bytes [ 52.280015][ T36] audit: type=1400 audit(1772139279.670:106): avc: denied { unlink } for pid=410 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 52.329489][ T410] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 53.590403][ T36] audit: type=1400 audit(1772139280.970:107): avc: denied { create } for pid=440 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 53.736364][ T36] audit: type=1401 audit(1772139281.120:108): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 53.989822][ T450] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.004003][ T450] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.011573][ T450] bridge_slave_0: entered allmulticast mode [ 54.018357][ T450] bridge_slave_0: entered promiscuous mode [ 54.025290][ T450] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.032774][ T450] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.040152][ T450] bridge_slave_1: entered allmulticast mode [ 54.047177][ T450] bridge_slave_1: entered promiscuous mode [ 54.164074][ T450] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.171822][ T450] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.179274][ T450] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.186800][ T450] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.224186][ T319] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.232346][ T319] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.243029][ T335] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.250443][ T335] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.273009][ T335] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.280137][ T335] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.303698][ T450] veth0_vlan: entered promiscuous mode [ 54.318090][ T450] veth1_macvtap: entered promiscuous mode 2026/02/26 20:54:41 executed programs: 0 [ 54.527263][ T480] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.534587][ T480] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.542094][ T480] bridge_slave_0: entered allmulticast mode [ 54.549215][ T480] bridge_slave_0: entered promiscuous mode [ 54.567002][ T480] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.574447][ T480] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.581775][ T480] bridge_slave_1: entered allmulticast mode [ 54.588400][ T480] bridge_slave_1: entered promiscuous mode [ 54.632176][ T483] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.639718][ T483] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.647284][ T483] bridge_slave_0: entered allmulticast mode [ 54.653781][ T483] bridge_slave_0: entered promiscuous mode [ 54.678513][ T483] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.685692][ T483] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.693134][ T483] bridge_slave_1: entered allmulticast mode [ 54.699736][ T483] bridge_slave_1: entered promiscuous mode [ 54.709123][ T485] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.716370][ T485] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.724027][ T485] bridge_slave_0: entered allmulticast mode [ 54.731157][ T485] bridge_slave_0: entered promiscuous mode [ 54.747178][ T485] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.754355][ T485] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.761669][ T485] bridge_slave_1: entered allmulticast mode [ 54.768214][ T485] bridge_slave_1: entered promiscuous mode [ 54.803022][ T335] bridge_slave_1: left allmulticast mode [ 54.809013][ T335] bridge_slave_1: left promiscuous mode [ 54.815212][ T335] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.823718][ T335] bridge_slave_0: left allmulticast mode [ 54.830129][ T335] bridge_slave_0: left promiscuous mode [ 54.835794][ T335] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.917126][ T486] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.924208][ T486] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.931512][ T486] bridge_slave_0: entered allmulticast mode [ 54.938031][ T486] bridge_slave_0: entered promiscuous mode [ 54.949745][ T335] veth1_macvtap: left promiscuous mode [ 54.955362][ T335] veth0_vlan: left promiscuous mode [ 54.996313][ T486] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.003738][ T486] bridge0: port 2(bridge_slave_1) entered disabled state [ 55.011034][ T486] bridge_slave_1: entered allmulticast mode [ 55.017628][ T486] bridge_slave_1: entered promiscuous mode [ 55.217808][ T319] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.224995][ T319] bridge0: port 1(bridge_slave_0) entered forwarding state [ 55.235448][ T319] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.242557][ T319] bridge0: port 1(bridge_slave_0) entered forwarding state [ 55.252970][ T319] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.260182][ T319] bridge0: port 2(bridge_slave_1) entered forwarding state [ 55.272159][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.279374][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 55.288689][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.295858][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 55.313478][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.320666][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 55.340204][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.347417][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 55.355639][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.362778][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 55.419873][ T485] veth0_vlan: entered promiscuous mode [ 55.428116][ T480] veth0_vlan: entered promiscuous mode [ 55.449410][ T486] veth0_vlan: entered promiscuous mode [ 55.455580][ T483] veth0_vlan: entered promiscuous mode [ 55.473403][ T480] veth1_macvtap: entered promiscuous mode [ 55.480614][ T485] veth1_macvtap: entered promiscuous mode [ 55.509394][ T486] veth1_macvtap: entered promiscuous mode [ 55.516946][ T483] veth1_macvtap: entered promiscuous mode [ 55.557908][ T36] audit: type=1400 audit(1772139282.950:109): avc: denied { mount } for pid=523 comm="syz.2.19" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 56.167009][ T756] ================================================================== [ 56.175242][ T756] BUG: KASAN: slab-use-after-free in link_path_walk+0x9ea/0xec0 [ 56.183030][ T756] Read of size 1 at addr ffff888109e6cf61 by task syz.1.102/756 [ 56.190707][ T756] [ 56.193095][ T756] CPU: 0 UID: 0 PID: 756 Comm: syz.1.102 Not tainted syzkaller #0 8b81a59e602df1b7c0d78d39d39d8895f23d0c7f [ 56.193130][ T756] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 56.193150][ T756] Call Trace: [ 56.193158][ T756] [ 56.193169][ T756] __dump_stack+0x21/0x30 [ 56.193207][ T756] dump_stack_lvl+0x140/0x1c0 [ 56.193237][ T756] ? __cfi_dump_stack_lvl+0x10/0x10 [ 56.193268][ T756] ? selinux_inode_permission+0x3f2/0x5d0 [ 56.193308][ T756] print_address_description+0x71/0x210 [ 56.193338][ T756] print_report+0x4a/0x70 [ 56.193366][ T756] kasan_report+0x162/0x1a0 [ 56.193412][ T756] ? link_path_walk+0x9ea/0xec0 [ 56.193443][ T756] ? link_path_walk+0x9ea/0xec0 [ 56.193472][ T756] __asan_report_load1_noabort+0x18/0x20 [ 56.193500][ T756] link_path_walk+0x9ea/0xec0 [ 56.193529][ T756] ? stack_depot_save_flags+0x38/0x800 [ 56.193558][ T756] __filename_parentat+0x22a/0x650 [ 56.193591][ T756] ? x64_sys_call+0x2974/0x2ee0 [ 56.193624][ T756] ? do_syscall_64+0x57/0xf0 [ 56.193647][ T756] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 56.193685][ T756] ? vfs_path_parent_lookup+0x70/0x70 [ 56.193722][ T756] ? check_stack_object+0x81/0x150 [ 56.193751][ T756] ? __virt_addr_valid+0x2a6/0x380 [ 56.193776][ T756] ? __check_object_size+0x527/0x830 [ 56.193804][ T756] do_unlinkat+0xfe/0x5a0 [ 56.193829][ T756] ? __cfi_do_unlinkat+0x10/0x10 [ 56.193855][ T756] ? getname_flags+0x208/0x700 [ 56.193886][ T756] ? fpregs_restore_userregs+0x11c/0x260 [ 56.193913][ T756] __x64_sys_unlinkat+0xda/0xf0 [ 56.193938][ T756] x64_sys_call+0x2974/0x2ee0 [ 56.193971][ T756] do_syscall_64+0x57/0xf0 [ 56.193993][ T756] ? clear_bhb_loop+0x50/0xa0 [ 56.194015][ T756] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 56.194049][ T756] RIP: 0033:0x7f7585b9bf79 [ 56.194079][ T756] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 56.194098][ T756] RSP: 002b:00007f75859eb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000107 [ 56.194132][ T756] RAX: ffffffffffffffda RBX: 00007f7585e15fa0 RCX: 00007f7585b9bf79 [ 56.194149][ T756] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000004 [ 56.194164][ T756] RBP: 00007f7585c327e0 R08: 0000000000000000 R09: 0000000000000000 [ 56.194179][ T756] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 56.194193][ T756] R13: 00007f7585e16038 R14: 00007f7585e15fa0 R15: 00007ffc492d5af8 [ 56.194214][ T756] [ 56.194222][ T756] [ 56.451016][ T756] Allocated by task 756: [ 56.455370][ T756] kasan_save_track+0x3e/0x80 [ 56.460340][ T756] kasan_save_alloc_info+0x40/0x50 [ 56.465494][ T756] __kasan_kmalloc+0x96/0xb0 [ 56.470226][ T756] __kmalloc_node_track_caller_noprof+0x251/0x4f0 [ 56.476662][ T756] kstrdup+0x4d/0x130 [ 56.480776][ T756] bpf_symlink+0x2d/0x200 [ 56.485208][ T756] vfs_symlink+0x3ee/0x620 [ 56.489644][ T756] do_symlinkat+0x1ba/0x400 [ 56.494285][ T756] __x64_sys_symlinkat+0x99/0xb0 [ 56.499433][ T756] x64_sys_call+0x1f79/0x2ee0 [ 56.504177][ T756] do_syscall_64+0x57/0xf0 [ 56.508744][ T756] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 56.514945][ T756] [ 56.517560][ T756] Freed by task 758: [ 56.521574][ T756] kasan_save_track+0x3e/0x80 [ 56.526320][ T756] kasan_save_free_info+0x4a/0x60 [ 56.531392][ T756] __kasan_slab_free+0x5f/0x80 [ 56.536371][ T756] kfree+0x158/0x440 [ 56.540539][ T756] bpf_destroy_inode+0x7e/0x180 [ 56.545418][ T756] evict+0x7f5/0xac0 [ 56.549401][ T756] iput+0x635/0x8d0 [ 56.553251][ T756] do_unlinkat+0x3d2/0x5a0 [ 56.557704][ T756] __x64_sys_unlinkat+0xda/0xf0 [ 56.562926][ T756] x64_sys_call+0x2974/0x2ee0 [ 56.567686][ T756] do_syscall_64+0x57/0xf0 [ 56.572202][ T756] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 56.578311][ T756] [ 56.580824][ T756] The buggy address belongs to the object at ffff888109e6cf60 [ 56.580824][ T756] which belongs to the cache kmalloc-8 of size 8 [ 56.594658][ T756] The buggy address is located 1 bytes inside of [ 56.594658][ T756] freed 8-byte region [ffff888109e6cf60, ffff888109e6cf68) [ 56.608572][ T756] [ 56.610915][ T756] The buggy address belongs to the physical page: [ 56.617471][ T756] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888109e6cc80 pfn:0x109e6c [ 56.628508][ T756] anon flags: 0x4000000000000000(zone=1) [ 56.634414][ T756] page_type: f5(slab) [ 56.638423][ T756] raw: 4000000000000000 ffff888100041500 0000000000000000 dead000000000001 [ 56.647319][ T756] raw: ffff888109e6cc80 000000008080007d 00000001f5000000 0000000000000000 [ 56.656273][ T756] page dumped because: kasan: bad access detected [ 56.663088][ T756] page_owner tracks the page as allocated [ 56.668848][ T756] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 2380429319, free_ts 2343133186 [ 56.687739][ T756] post_alloc_hook+0x3b8/0x3f0 [ 56.692882][ T756] prep_new_page+0x20/0x120 [ 56.697783][ T756] get_page_from_freelist+0x496e/0x4a20 [ 56.703724][ T756] __alloc_pages_noprof+0x35f/0x7e0 [ 56.709125][ T756] alloc_slab_page+0x6b/0x1e0 [ 56.714444][ T756] allocate_slab+0x69/0x420 [ 56.719126][ T756] ___slab_alloc+0x5a2/0x8d0 [ 56.723860][ T756] __kmalloc_noprof+0x2fc/0x500 [ 56.729086][ T756] acpi_ns_internalize_name+0x2d6/0x480 [ 56.734841][ T756] acpi_ns_get_node+0x1ab/0x360 [ 56.739825][ T756] acpi_ns_evaluate+0x36b/0xa50 [ 56.744839][ T756] acpi_ut_evaluate_object+0x15a/0x5b0 [ 56.750707][ T756] acpi_ut_execute_CID+0xb4/0x800 [ 56.755953][ T756] acpi_ns_get_device_callback+0x2ba/0x4d0 [ 56.761866][ T756] acpi_ns_walk_namespace+0x22e/0x6b0 [ 56.767264][ T756] acpi_get_devices+0x10c/0x180 [ 56.772304][ T756] page last free pid 1 tgid 1 stack trace: [ 56.778389][ T756] free_unref_page+0xbcf/0xf80 [ 56.783276][ T756] __free_pages+0x6b/0x3b0 [ 56.787721][ T756] __free_slab+0xb5/0x110 [ 56.792080][ T756] free_slab+0x18/0xe0 [ 56.796185][ T756] discard_slab+0x23/0x40 [ 56.800632][ T756] __slab_free+0x1fd/0x2a0 [ 56.805278][ T756] ___cache_free+0xc9/0xe0 [ 56.809910][ T756] qlist_free_all+0xb5/0x130 [ 56.814606][ T756] kasan_quarantine_remove_cache+0x33b/0x360 [ 56.820783][ T756] kasan_cache_shrink+0xd/0x20 [ 56.825576][ T756] kmem_cache_shrink+0x11/0x30 [ 56.830451][ T756] acpi_os_purge_cache+0x19/0x30 [ 56.835408][ T756] acpi_purge_cached_objects+0x93/0xd0 [ 56.840936][ T756] acpi_initialize_objects+0x32/0xb0 [ 56.846640][ T756] acpi_bus_init+0xca/0x700 [ 56.851202][ T756] acpi_init+0xc5/0x23b [ 56.855548][ T756] [ 56.857894][ T756] Memory state around the buggy address: [ 56.863656][ T756] ffff888109e6ce00: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc [ 56.871822][ T756] ffff888109e6ce80: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc [ 56.880212][ T756] >ffff888109e6cf00: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc [ 56.888463][ T756] ^ [ 56.895703][ T756] ffff888109e6cf80: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc [ 56.903861][ T756] ffff888109e6d000: 00 00 00 00 00 00 00 00 00 fc fc fc fc 00 00 00 [ 56.911993][ T756] ================================================================== [ 56.921632][ T756] Disabling lock debugging due to kernel taint [ 56.950735][ T36] audit: type=1400 audit(1772139284.340:110): avc: denied { read } for pid=92 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 57.035588][ T36] audit: type=1400 audit(1772139284.340:111): avc: denied { search } for pid=92 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 57.062380][ T36] audit: type=1400 audit(1772139284.340:112): avc: denied { write } for pid=92 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 57.106642][ T36] audit: type=1400 audit(1772139284.340:113): avc: denied { add_name } for pid=92 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 57.144418][ T36] audit: type=1400 audit(1772139284.340:114): avc: denied { create } for pid=92 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 57.233990][ T36] audit: type=1400 audit(1772139284.340:115): avc: denied { append open } for pid=92 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 57.329642][ T36] audit: type=1400 audit(1772139284.340:116): avc: denied { getattr } for pid=92 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 2026/02/26 20:54:46 executed programs: 451 2026/02/26 20:54:51 executed programs: 1400