Warning: Permanently added '10.128.1.224' (ED25519) to the list of known hosts. 2026/01/28 15:29:15 parsed 1 programs [ 45.370224][ T30] audit: type=1400 audit(1769614156.784:105): avc: denied { unlink } for pid=399 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 45.457203][ T399] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 45.933775][ T403] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.941199][ T403] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.949228][ T403] device bridge_slave_0 entered promiscuous mode [ 45.956775][ T403] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.964202][ T403] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.971925][ T403] device bridge_slave_1 entered promiscuous mode [ 46.039474][ T403] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.047055][ T403] bridge0: port 2(bridge_slave_1) entered forwarding state [ 46.054672][ T403] bridge0: port 1(bridge_slave_0) entered blocking state [ 46.061931][ T403] bridge0: port 1(bridge_slave_0) entered forwarding state [ 46.080020][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 46.087411][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 46.095117][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 46.103596][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 46.112885][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 46.121231][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 46.128606][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 46.137768][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 46.146865][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.154126][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 46.166276][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 46.176055][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 46.188950][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 46.200197][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 46.208503][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 46.216473][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 46.225642][ T403] device veth0_vlan entered promiscuous mode [ 46.235384][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 46.244562][ T403] device veth1_macvtap entered promiscuous mode [ 46.254012][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 46.264445][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 46.352096][ T30] audit: type=1401 audit(1769614157.764:106): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 46.614417][ T30] audit: type=1400 audit(1769614158.024:107): avc: denied { create } for pid=442 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 46.740761][ T45] device bridge_slave_1 left promiscuous mode [ 46.747067][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 46.755156][ T45] device bridge_slave_0 left promiscuous mode [ 46.763240][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 46.776076][ T45] device veth1_macvtap left promiscuous mode [ 46.782470][ T45] device veth0_vlan left promiscuous mode 2026/01/28 15:29:18 executed programs: 0 [ 47.168388][ T469] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.175682][ T469] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.184356][ T469] device bridge_slave_0 entered promiscuous mode [ 47.192016][ T469] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.199572][ T469] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.207190][ T469] device bridge_slave_1 entered promiscuous mode [ 47.258140][ T469] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.265628][ T469] bridge0: port 2(bridge_slave_1) entered forwarding state [ 47.273033][ T469] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.280392][ T469] bridge0: port 1(bridge_slave_0) entered forwarding state [ 47.306081][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 47.313996][ T327] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.321703][ T327] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.336981][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 47.345672][ T327] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.352882][ T327] bridge0: port 1(bridge_slave_0) entered forwarding state [ 47.366687][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 47.375239][ T327] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.382926][ T327] bridge0: port 2(bridge_slave_1) entered forwarding state [ 47.401048][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 47.410580][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 47.430837][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 47.442259][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 47.451173][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 47.458536][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 47.467096][ T469] device veth0_vlan entered promiscuous mode [ 47.483992][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 47.493188][ T469] device veth1_macvtap entered promiscuous mode [ 47.502803][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 47.513326][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 47.543052][ T30] audit: type=1400 audit(1769614158.954:108): avc: denied { prog_load } for pid=479 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 47.564214][ T30] audit: type=1400 audit(1769614158.964:109): avc: denied { bpf } for pid=479 comm="syz.2.17" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 47.594377][ T30] audit: type=1400 audit(1769614159.004:110): avc: denied { setopt } for pid=479 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 47.712196][ T30] audit: type=1400 audit(1769614159.124:111): avc: denied { perfmon } for pid=479 comm="syz.2.17" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 47.741263][ T30] audit: type=1400 audit(1769614159.154:112): avc: denied { prog_run } for pid=479 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 47.767016][ T483] ================================================================== [ 47.775214][ T483] BUG: KASAN: slab-out-of-bounds in l2cap_sock_setsockopt+0x1a1f/0x1df0 [ 47.784023][ T483] Read of size 4 at addr ffff88810c7b35f3 by task syz.2.18/483 [ 47.792024][ T483] [ 47.794353][ T483] CPU: 1 PID: 483 Comm: syz.2.18 Not tainted syzkaller #0 [ 47.801556][ T483] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 47.811960][ T483] Call Trace: [ 47.815234][ T483] [ 47.818163][ T483] __dump_stack+0x21/0x30 [ 47.822503][ T483] dump_stack_lvl+0x110/0x170 [ 47.827448][ T483] ? show_regs_print_info+0x20/0x20 [ 47.832646][ T483] ? load_image+0x3e0/0x3e0 [ 47.837353][ T483] ? lock_sock_nested+0x21c/0x2a0 [ 47.842469][ T483] print_address_description+0x7f/0x2c0 [ 47.848203][ T483] ? l2cap_sock_setsockopt+0x1a1f/0x1df0 [ 47.853922][ T483] kasan_report+0xf1/0x140 [ 47.858424][ T483] ? memcpy+0x56/0x70 [ 47.862890][ T483] ? l2cap_sock_setsockopt+0x1a1f/0x1df0 [ 47.868546][ T483] __asan_report_load_n_noabort+0xf/0x20 [ 47.874207][ T483] l2cap_sock_setsockopt+0x1a1f/0x1df0 [ 47.879887][ T483] ? selinux_socket_setsockopt+0x282/0x360 [ 47.885889][ T483] ? __cgroup_bpf_run_filter_sysctl+0x760/0x760 [ 47.892440][ T483] ? l2cap_sock_shutdown+0xba0/0xba0 [ 47.898102][ T483] ? __fget_files+0x2c4/0x320 [ 47.903091][ T483] ? security_socket_setsockopt+0x82/0xa0 [ 47.908982][ T483] ? l2cap_sock_shutdown+0xba0/0xba0 [ 47.914352][ T483] __sys_setsockopt+0x2e9/0x470 [ 47.919423][ T483] ? __ia32_sys_recv+0xb0/0xb0 [ 47.924325][ T483] ? __kasan_check_write+0x14/0x20 [ 47.929447][ T483] __x64_sys_setsockopt+0xbf/0xd0 [ 47.934943][ T483] x64_sys_call+0x982/0x9a0 [ 47.939550][ T483] do_syscall_64+0x4c/0xa0 [ 47.944162][ T483] ? clear_bhb_loop+0x50/0xa0 [ 47.949142][ T483] ? clear_bhb_loop+0x50/0xa0 [ 47.954257][ T483] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 47.960419][ T483] RIP: 0033:0x7f4e5e338ef9 [ 47.965044][ T483] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 47.985155][ T483] RSP: 002b:00007f4e5e19d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 47.993660][ T483] RAX: ffffffffffffffda RBX: 00007f4e5e5a3fa0 RCX: 00007f4e5e338ef9 [ 48.001951][ T483] RDX: 0000000000000008 RSI: 0000000000000112 RDI: 0000000000000004 [ 48.010015][ T483] RBP: 00007f4e5e3cdee0 R08: 0000000000000001 R09: 0000000000000000 [ 48.018187][ T483] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000000 [ 48.026160][ T483] R13: 00007f4e5e5a4038 R14: 00007f4e5e5a3fa0 R15: 00007ffd5afcbfc8 [ 48.034282][ T483] [ 48.037300][ T483] [ 48.039620][ T483] Allocated by task 483: [ 48.043856][ T483] __kasan_kmalloc+0xda/0x110 [ 48.048533][ T483] __kmalloc+0x13d/0x2c0 [ 48.052989][ T483] __cgroup_bpf_run_filter_setsockopt+0x8e7/0xaa0 [ 48.059633][ T483] __sys_setsockopt+0x40e/0x470 [ 48.064559][ T483] __x64_sys_setsockopt+0xbf/0xd0 [ 48.069668][ T483] x64_sys_call+0x982/0x9a0 [ 48.074168][ T483] do_syscall_64+0x4c/0xa0 [ 48.078587][ T483] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 48.084506][ T483] [ 48.086975][ T483] The buggy address belongs to the object at ffff88810c7b35f0 [ 48.086975][ T483] which belongs to the cache kmalloc-8 of size 8 [ 48.101446][ T483] The buggy address is located 3 bytes inside of [ 48.101446][ T483] 8-byte region [ffff88810c7b35f0, ffff88810c7b35f8) [ 48.114643][ T483] The buggy address belongs to the page: [ 48.120369][ T483] page:ffffea000431ecc0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10c7b3 [ 48.131048][ T483] flags: 0x4000000000000200(slab|zone=1) [ 48.136962][ T483] raw: 4000000000000200 0000000000000000 0000000100000001 ffff888100042300 [ 48.145562][ T483] raw: 0000000000000000 0000000080660066 00000001ffffffff 0000000000000000 [ 48.154407][ T483] page dumped because: kasan: bad access detected [ 48.161183][ T483] page_owner tracks the page as allocated [ 48.167238][ T483] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 3842696357, free_ts 0 [ 48.182766][ T483] post_alloc_hook+0x192/0x1b0 [ 48.187639][ T483] prep_new_page+0x1c/0x110 [ 48.192155][ T483] get_page_from_freelist+0x2d3a/0x2dc0 [ 48.197800][ T483] __alloc_pages+0x1a2/0x460 [ 48.202566][ T483] new_slab+0xa1/0x4d0 [ 48.206919][ T483] ___slab_alloc+0x381/0x810 [ 48.211509][ T483] __slab_alloc+0x49/0x90 [ 48.215921][ T483] __kmalloc_track_caller+0x169/0x2c0 [ 48.221460][ T483] kstrdup_const+0x55/0x90 [ 48.226074][ T483] __kernfs_new_node+0xa8/0x6b0 [ 48.231191][ T483] kernfs_new_node+0x150/0x260 [ 48.236127][ T483] kernfs_create_dir_ns+0x47/0x130 [ 48.241366][ T483] sysfs_create_dir_ns+0x128/0x290 [ 48.246594][ T483] kobject_add_internal+0x6d0/0xcb0 [ 48.251800][ T483] kobject_init_and_add+0x128/0x190 [ 48.257090][ T483] ext4_register_sysfs+0xbb/0x2c0 [ 48.262205][ T483] page_owner free stack trace missing [ 48.267913][ T483] [ 48.270522][ T483] Memory state around the buggy address: [ 48.276420][ T483] ffff88810c7b3480: fc 00 fc fc fc fc 06 fc fc fc fc 04 fc fc fc fc [ 48.284581][ T483] ffff88810c7b3500: 00 fc fc fc fc fb fc fc fc fc fa fc fc fc fc fa [ 48.292822][ T483] >ffff88810c7b3580: fc fc fc fc 05 fc fc fc fc 00 fc fc fc fc 01 fc [ 48.301136][ T483] ^ [ 48.308942][ T483] ffff88810c7b3600: fc fc fc 00 fc fc fc fc fa fc fc fc fc fa fc fc [ 48.317174][ T483] ffff88810c7b3680: fc fc fa fc fc fc fc 00 fc fc fc fc 05 fc fc fc [ 48.325415][ T483] ================================================================== [ 48.333651][ T483] Disabling lock debugging due to kernel taint [ 48.346833][ T30] audit: type=1400 audit(1769614159.754:113): avc: denied { read } for pid=83 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 48.371321][ T30] audit: type=1400 audit(1769614159.754:114): avc: denied { search } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 2026/01/28 15:29:23 executed programs: 228 2026/01/28 15:29:28 executed programs: 529