Warning: Permanently added '10.128.1.190' (ED25519) to the list of known hosts. 2026/03/03 16:37:43 parsed 1 programs Setting up swapspace version 1, size = 127995904 bytes [ 44.494926][ T30] audit: type=1400 audit(1772555863.838:105): avc: denied { unlink } for pid=388 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 44.562274][ T388] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 45.200622][ T409] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.208514][ T409] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.217119][ T409] device bridge_slave_0 entered promiscuous mode [ 45.225202][ T409] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.234008][ T409] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.243887][ T409] device bridge_slave_1 entered promiscuous mode [ 45.309162][ T409] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.316885][ T409] bridge0: port 2(bridge_slave_1) entered forwarding state [ 45.326300][ T409] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.335720][ T409] bridge0: port 1(bridge_slave_0) entered forwarding state [ 45.359175][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 45.372333][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.381617][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.391951][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 45.401892][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.411235][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 45.421653][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 45.432111][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.443603][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 45.461562][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 45.472868][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 45.489889][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 45.509003][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 45.519062][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 45.527292][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 45.536955][ T409] device veth0_vlan entered promiscuous mode [ 45.551052][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 45.562564][ T409] device veth1_macvtap entered promiscuous mode [ 45.572861][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 45.585408][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 45.977119][ T30] audit: type=1401 audit(1772555865.318:106): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" 2026/03/03 16:37:45 executed programs: 0 [ 46.243667][ T453] bridge0: port 1(bridge_slave_0) entered blocking state [ 46.251599][ T453] bridge0: port 1(bridge_slave_0) entered disabled state [ 46.260982][ T453] device bridge_slave_0 entered promiscuous mode [ 46.268810][ T453] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.276845][ T453] bridge0: port 2(bridge_slave_1) entered disabled state [ 46.284911][ T453] device bridge_slave_1 entered promiscuous mode [ 46.319906][ T453] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.327443][ T453] bridge0: port 2(bridge_slave_1) entered forwarding state [ 46.335432][ T453] bridge0: port 1(bridge_slave_0) entered blocking state [ 46.343460][ T453] bridge0: port 1(bridge_slave_0) entered forwarding state [ 46.361849][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 46.370606][ T308] bridge0: port 1(bridge_slave_0) entered disabled state [ 46.378880][ T308] bridge0: port 2(bridge_slave_1) entered disabled state [ 46.389251][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 46.399603][ T308] bridge0: port 1(bridge_slave_0) entered blocking state [ 46.408641][ T308] bridge0: port 1(bridge_slave_0) entered forwarding state [ 46.418682][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 46.428394][ T308] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.437087][ T308] bridge0: port 2(bridge_slave_1) entered forwarding state [ 46.450610][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 46.461199][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 46.480210][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 46.493192][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 46.503389][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 46.512404][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 46.522287][ T453] device veth0_vlan entered promiscuous mode [ 46.538062][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 46.548284][ T453] device veth1_macvtap entered promiscuous mode [ 46.558028][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 46.571556][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 46.601732][ T30] audit: type=1400 audit(1772555865.938:107): avc: denied { prog_load } for pid=457 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 46.632832][ T30] audit: type=1400 audit(1772555865.938:108): avc: denied { bpf } for pid=457 comm="syz.2.17" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 46.656995][ T30] audit: type=1400 audit(1772555865.998:109): avc: denied { setopt } for pid=457 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 46.749126][ T30] audit: type=1400 audit(1772555866.088:110): avc: denied { perfmon } for pid=457 comm="syz.2.17" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 46.770902][ T30] audit: type=1400 audit(1772555866.108:111): avc: denied { prog_run } for pid=457 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 46.798164][ T461] ================================================================== [ 46.809476][ T461] BUG: KASAN: slab-out-of-bounds in hci_sock_setsockopt+0x7f1/0x820 [ 46.818431][ T461] Read of size 4 at addr ffff88810b27d11b by task syz.2.18/461 [ 46.826910][ T461] [ 46.829513][ T461] CPU: 0 PID: 461 Comm: syz.2.18 Not tainted syzkaller #0 [ 46.837357][ T461] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 46.847843][ T461] Call Trace: [ 46.851116][ T461] [ 46.854310][ T461] __dump_stack+0x21/0x30 [ 46.859183][ T461] dump_stack_lvl+0x110/0x170 [ 46.864035][ T461] ? show_regs_print_info+0x20/0x20 [ 46.870122][ T461] ? load_image+0x3e0/0x3e0 [ 46.875498][ T461] ? lock_sock_nested+0x21c/0x2a0 [ 46.881067][ T461] print_address_description+0x7f/0x2c0 [ 46.887235][ T461] ? hci_sock_setsockopt+0x7f1/0x820 [ 46.892959][ T461] kasan_report+0xf1/0x140 [ 46.897539][ T461] ? hci_sock_setsockopt+0x7f1/0x820 [ 46.903100][ T461] __asan_report_load_n_noabort+0xf/0x20 [ 46.909084][ T461] hci_sock_setsockopt+0x7f1/0x820 [ 46.915122][ T461] ? __fget_files+0x2c4/0x320 [ 46.920321][ T461] ? hci_sock_compat_ioctl+0x50/0x50 [ 46.926345][ T461] ? security_socket_setsockopt+0x82/0xa0 [ 46.932959][ T461] ? hci_sock_compat_ioctl+0x50/0x50 [ 46.939997][ T461] __sys_setsockopt+0x2e9/0x470 [ 46.945894][ T461] ? __ia32_sys_recv+0xb0/0xb0 [ 46.951170][ T461] ? __kasan_check_write+0x14/0x20 [ 46.956911][ T461] __x64_sys_setsockopt+0xbf/0xd0 [ 46.962616][ T461] x64_sys_call+0x982/0x9a0 [ 46.967214][ T461] do_syscall_64+0x4c/0xa0 [ 46.971953][ T461] ? clear_bhb_loop+0x50/0xa0 [ 46.976800][ T461] ? clear_bhb_loop+0x50/0xa0 [ 46.981469][ T461] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 46.987902][ T461] RIP: 0033:0x7fd7c8290f79 [ 46.992568][ T461] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 47.013864][ T461] RSP: 002b:00007fd7c80f4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 47.022268][ T461] RAX: ffffffffffffffda RBX: 00007fd7c850afa0 RCX: 00007fd7c8290f79 [ 47.030670][ T461] RDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000008 [ 47.039153][ T461] RBP: 00007fd7c83277e0 R08: 0000000000000001 R09: 0000000000000000 [ 47.048133][ T461] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 47.056742][ T461] R13: 00007fd7c850b038 R14: 00007fd7c850afa0 R15: 00007ffd57736e98 [ 47.065951][ T461] [ 47.069304][ T461] [ 47.071697][ T461] Allocated by task 461: [ 47.076640][ T461] __kasan_kmalloc+0xda/0x110 [ 47.082233][ T461] __kmalloc+0x13d/0x2c0 [ 47.087229][ T461] __cgroup_bpf_run_filter_setsockopt+0x8e7/0xaa0 [ 47.094954][ T461] __sys_setsockopt+0x40e/0x470 [ 47.100761][ T461] __x64_sys_setsockopt+0xbf/0xd0 [ 47.105888][ T461] x64_sys_call+0x982/0x9a0 [ 47.110843][ T461] do_syscall_64+0x4c/0xa0 [ 47.115876][ T461] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 47.122546][ T461] [ 47.125237][ T461] The buggy address belongs to the object at ffff88810b27d118 [ 47.125237][ T461] which belongs to the cache kmalloc-8 of size 8 [ 47.140188][ T461] The buggy address is located 3 bytes inside of [ 47.140188][ T461] 8-byte region [ffff88810b27d118, ffff88810b27d120) [ 47.154792][ T461] The buggy address belongs to the page: [ 47.160875][ T461] page:ffffea00042c9f40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10b27d [ 47.172234][ T461] flags: 0x4000000000000200(slab|zone=1) [ 47.178405][ T461] raw: 4000000000000200 ffffea000416fc00 0000000400000004 ffff888100042300 [ 47.187803][ T461] raw: 0000000000000000 0000000080660066 00000001ffffffff 0000000000000000 [ 47.197540][ T461] page dumped because: kasan: bad access detected [ 47.204746][ T461] page_owner tracks the page as allocated [ 47.211140][ T461] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 2654702723, free_ts 0 [ 47.227291][ T461] post_alloc_hook+0x192/0x1b0 [ 47.233042][ T461] prep_new_page+0x1c/0x110 [ 47.237903][ T461] get_page_from_freelist+0x2d3a/0x2dc0 [ 47.244296][ T461] __alloc_pages+0x1a2/0x460 [ 47.249357][ T461] new_slab+0xa1/0x4d0 [ 47.253982][ T461] ___slab_alloc+0x381/0x810 [ 47.259209][ T461] __slab_alloc+0x49/0x90 [ 47.264460][ T461] __kmalloc_track_caller+0x169/0x2c0 [ 47.270358][ T461] kvasprintf+0xe3/0x1a0 [ 47.276310][ T461] kvasprintf_const+0xf2/0x240 [ 47.281848][ T461] kobject_set_name_vargs+0x61/0x110 [ 47.287669][ T461] kobject_add+0x121/0x230 [ 47.292746][ T461] __irq_alloc_descs+0x2ac/0x480 [ 47.298112][ T461] irq_domain_alloc_irqs_locked+0x81/0xad0 [ 47.304261][ T461] __irq_domain_alloc_irqs+0x6b/0xb0 [ 47.309883][ T461] __msi_domain_alloc_irqs+0x33a/0x1020 [ 47.316048][ T461] page_owner free stack trace missing [ 47.321918][ T461] [ 47.324242][ T461] Memory state around the buggy address: [ 47.330209][ T461] ffff88810b27d000: 06 fc fc fc fc 06 fc fc fc fc 00 fc fc fc fc 00 [ 47.339376][ T461] ffff88810b27d080: fc fc fc fc 03 fc fc fc fc fb fc fc fc fc 05 fc [ 47.350314][ T461] >ffff88810b27d100: fc fc fc 01 fc fc fc fc fb fc fc fc fc 00 fc fc [ 47.359983][ T461] ^ [ 47.365720][ T461] ffff88810b27d180: fc fc fb fc fc fc fc 06 fc fc fc fc 06 fc fc fc [ 47.374862][ T461] ffff88810b27d200: fc 00 fc fc fc fc 07 fc fc fc fc 03 fc fc fc fc [ 47.384006][ T461] ================================================================== [ 47.393308][ T461] Disabling lock debugging due to kernel taint [ 47.404188][ T30] audit: type=1400 audit(1772555866.738:112): avc: denied { read } for pid=83 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 47.428711][ T30] audit: type=1400 audit(1772555866.738:113): avc: denied { search } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 47.455512][ T30] audit: type=1400 audit(1772555866.738:114): avc: denied { write } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 47.595915][ T8] device bridge_slave_1 left promiscuous mode [ 47.603155][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.613062][ T8] device bridge_slave_0 left promiscuous mode [ 47.619545][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.628266][ T8] device veth1_macvtap left promiscuous mode [ 47.634776][ T8] device veth0_vlan left promiscuous mode 2026/03/03 16:37:50 executed programs: 226 2026/03/03 16:37:55 executed programs: 526