Warning: Permanently added '10.128.1.20' (ED25519) to the list of known hosts. 2026/08/31 03:16:37 parsed 1 programs 2026/08/31 03:16:37 serving rpc on tcp://36143 Setting up swapspace version 1, size = 127995904 bytes [ 37.978469][ T36] kauditd_printk_skb: 32 callbacks suppressed [ 37.978486][ T36] audit: type=1400 audit(1788146198.140:106): avc: denied { unlink } for pid=420 comm="syz-executor" name="swap-file" dev="sda1" ino=2027 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 38.045030][ T420] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 38.962459][ T430] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.969588][ T430] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.976657][ T430] bridge_slave_0: entered allmulticast mode [ 38.982962][ T430] bridge_slave_0: entered promiscuous mode [ 38.989656][ T430] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.996697][ T430] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.003921][ T430] bridge_slave_1: entered allmulticast mode [ 39.010294][ T430] bridge_slave_1: entered promiscuous mode [ 39.048137][ T430] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.055183][ T430] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.062503][ T430] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.069562][ T430] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.086828][ T370] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.094215][ T370] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.103859][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.111041][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.119852][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.127089][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.149307][ T430] veth0_vlan: entered promiscuous mode [ 39.159524][ T430] veth1_macvtap: entered promiscuous mode [ 39.208892][ T370] bridge_slave_1: left allmulticast mode [ 39.214593][ T370] bridge_slave_1: left promiscuous mode [ 39.220394][ T370] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.228759][ T370] bridge_slave_0: left allmulticast mode [ 39.234433][ T370] bridge_slave_0: left promiscuous mode [ 39.240679][ T370] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.357653][ T370] veth1_macvtap: left promiscuous mode [ 39.363219][ T370] veth0_vlan: left promiscuous mode [ 39.668426][ T36] audit: type=1401 audit(1788146199.830:107): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 39.721597][ T36] audit: type=1400 audit(1788146199.880:108): avc: denied { create } for pid=467 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 2026/08/31 03:16:40 executed programs: 0 [ 40.184065][ T486] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.191227][ T486] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.198559][ T486] bridge_slave_0: entered allmulticast mode [ 40.204886][ T486] bridge_slave_0: entered promiscuous mode [ 40.211376][ T486] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.218533][ T486] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.225584][ T486] bridge_slave_1: entered allmulticast mode [ 40.231887][ T486] bridge_slave_1: entered promiscuous mode [ 40.271102][ T486] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.278394][ T486] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.285742][ T486] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.292803][ T486] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.311412][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.318998][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.335336][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.342503][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.351779][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.358848][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.379999][ T486] veth0_vlan: entered promiscuous mode [ 40.392557][ T486] veth1_macvtap: entered promiscuous mode [ 40.416671][ T36] audit: type=1400 audit(1788146200.570:109): avc: denied { mount } for pid=490 comm="syz.2.17" name="/" dev="configfs" ino=2612 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 40.422606][ T491] ================================================================== [ 40.439542][ T36] audit: type=1400 audit(1788146200.580:110): avc: denied { search } for pid=490 comm="syz.2.17" name="/" dev="configfs" ino=2612 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 40.447350][ T491] BUG: KASAN: invalid-free in f_uac1_opts_c_srate_store+0x224/0x2b0 [ 40.447390][ T491] Free of addr ffff88811d05b493 by task syz.2.17/491 [ 40.469597][ T36] audit: type=1400 audit(1788146200.580:111): avc: denied { write } for pid=490 comm="syz.2.17" name="usb_gadget" dev="configfs" ino=2613 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 40.477254][ T491] [ 40.477276][ T491] CPU: 0 UID: 0 PID: 491 Comm: syz.2.17 Not tainted syzkaller #0 a9810099494854320dc90458080791a7261460e6 [ 40.477300][ T491] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 40.477319][ T491] Call Trace: [ 40.477326][ T491] [ 40.477334][ T491] __dump_stack+0x21/0x30 [ 40.477364][ T491] dump_stack_lvl+0x140/0x1c0 [ 40.477388][ T491] ? __cfi_dump_stack_lvl+0x10/0x10 [ 40.477414][ T491] print_address_description+0x71/0x210 [ 40.477439][ T491] print_report+0x4a/0x70 [ 40.477461][ T491] ? f_uac1_opts_c_srate_store+0x224/0x2b0 [ 40.477486][ T491] kasan_report_invalid_free+0x11e/0x160 [ 40.477510][ T491] ? f_uac1_opts_c_srate_store+0x224/0x2b0 [ 40.477533][ T491] ? f_uac1_opts_c_srate_store+0x224/0x2b0 [ 40.477557][ T491] check_slab_allocation+0xdf/0xf0 [ 40.477579][ T491] __kasan_slab_pre_free+0x36/0x50 [ 40.477600][ T491] kfree+0xf8/0x440 [ 40.477616][ T491] ? f_uac1_opts_c_srate_store+0x224/0x2b0 [ 40.477640][ T491] f_uac1_opts_c_srate_store+0x224/0x2b0 [ 40.477664][ T491] ? __cfi_f_uac1_opts_c_srate_store+0x10/0x10 [ 40.477687][ T491] ? down_read+0x7f/0xe0 [ 40.477707][ T491] ? __cfi_down_read+0x10/0x10 [ 40.477728][ T491] configfs_write_iter+0x32f/0x490 [ 40.477750][ T491] ? __cfi_f_uac1_opts_c_srate_store+0x10/0x10 [ 40.477775][ T491] vfs_write+0x75f/0xfd0 [ 40.477794][ T491] ? __cfi_vfs_write+0x10/0x10 [ 40.477812][ T491] ? __cfi_mutex_lock+0x10/0x10 [ 40.477833][ T491] ksys_write+0x145/0x260 [ 40.477851][ T491] ? xfd_validate_state+0x68/0x140 [ 40.477875][ T491] ? __cfi_ksys_write+0x10/0x10 [ 40.477894][ T491] ? __kasan_check_write+0x18/0x20 [ 40.477912][ T491] ? fpregs_restore_userregs+0x11c/0x260 [ 40.477933][ T491] __x64_sys_write+0x7f/0x90 [ 40.477951][ T491] x64_sys_call+0x271c/0x2ee0 [ 40.477968][ T491] do_syscall_64+0x57/0xf0 [ 40.477992][ T491] ? clear_bhb_loop+0x50/0xa0 [ 40.478012][ T491] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 40.478032][ T491] RIP: 0033:0x7f5eb299de99 [ 40.478053][ T491] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 40.478068][ T491] RSP: 002b:00007f5eb3943028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 40.478095][ T491] RAX: ffffffffffffffda RBX: 00007f5eb2c25fa0 RCX: 00007f5eb299de99 [ 40.478108][ T491] RDX: 0000000000000029 RSI: 0000200000000040 RDI: 0000000000000003 [ 40.478120][ T491] RBP: 00007f5eb2a33eaf R08: 0000000000000000 R09: 0000000000000000 [ 40.478132][ T491] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 40.478143][ T491] R13: 00007f5eb2c26038 R14: 00007f5eb2c25fa0 R15: 00007ffe60115ca8 [ 40.478159][ T491] [ 40.478165][ T491] [ 40.485961][ T36] audit: type=1400 audit(1788146200.580:112): avc: denied { add_name } for pid=490 comm="syz.2.17" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 40.506542][ T491] Allocated by task 491: [ 40.506556][ T491] kasan_save_track+0x3e/0x80 [ 40.506579][ T491] kasan_save_alloc_info+0x3a/0x50 [ 40.509619][ T36] audit: type=1400 audit(1788146200.580:113): avc: denied { create } for pid=490 comm="syz.2.17" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 40.520147][ T491] __kasan_kmalloc+0x96/0xb0 [ 40.520185][ T491] __kmalloc_node_track_caller_noprof+0x24e/0x4f0 [ 40.530457][ T36] audit: type=1400 audit(1788146200.580:114): avc: denied { write } for pid=490 comm="syz.2.17" name="c_srate" dev="configfs" ino=5565 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 40.533493][ T491] kstrdup+0x4d/0x130 [ 40.536416][ T36] audit: type=1400 audit(1788146200.580:115): avc: denied { open } for pid=490 comm="syz.2.17" path="/0/config/usb_gadget/g1/functions/uac1.usb0/c_srate" dev="configfs" ino=5565 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 40.540710][ T491] f_uac1_opts_c_srate_store+0x11e/0x2b0 [ 40.540734][ T491] configfs_write_iter+0x32f/0x490 [ 40.904051][ T491] vfs_write+0x75f/0xfd0 [ 40.908285][ T491] ksys_write+0x145/0x260 [ 40.912597][ T491] __x64_sys_write+0x7f/0x90 [ 40.917167][ T491] x64_sys_call+0x271c/0x2ee0 [ 40.921826][ T491] do_syscall_64+0x57/0xf0 [ 40.926682][ T491] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 40.932764][ T491] [ 40.935096][ T491] The buggy address belongs to the object at ffff88811d05b480 [ 40.935096][ T491] which belongs to the cache kmalloc-64 of size 64 [ 40.949217][ T491] The buggy address is located 19 bytes inside of [ 40.949217][ T491] 42-byte region [ffff88811d05b480, ffff88811d05b4aa) [ 40.962401][ T491] [ 40.964711][ T491] The buggy address belongs to the physical page: [ 40.971197][ T491] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11d05b [ 40.980058][ T491] flags: 0x4000000000000000(zone=1) [ 40.985256][ T491] page_type: f5(slab) [ 40.989232][ T491] raw: 4000000000000000 ffff8881000418c0 dead000000000122 0000000000000000 [ 40.997793][ T491] raw: 0000000000000000 0000000080200020 00000001f5000000 0000000000000000 [ 41.006355][ T491] page dumped because: kasan: bad access detected [ 41.012863][ T491] page_owner tracks the page as allocated [ 41.018562][ T491] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x152c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 427, tgid 427 (udevd), ts 40419215463, free_ts 40326640876 [ 41.038348][ T491] post_alloc_hook+0x37d/0x3b0 [ 41.043107][ T491] prep_new_page+0x2d/0x180 [ 41.047614][ T491] get_page_from_freelist+0x4aea/0x4ba0 [ 41.053254][ T491] __alloc_pages_noprof+0x35a/0x7e0 [ 41.058451][ T491] alloc_slab_page+0x6b/0x1e0 [ 41.063188][ T491] allocate_slab+0x69/0x430 [ 41.067677][ T491] ___slab_alloc+0x591/0x8c0 [ 41.072261][ T491] __kmalloc_noprof+0x2fc/0x510 [ 41.077095][ T491] security_inode_init_security+0x11c/0x600 [ 41.082979][ T491] shmem_mknod+0xd5/0x200 [ 41.087639][ T491] shmem_create+0x38/0x50 [ 41.091956][ T491] path_openat+0x150e/0x35a0 [ 41.096540][ T491] do_filp_open+0x1f2/0x440 [ 41.101054][ T491] do_sys_openat2+0x134/0x1d0 [ 41.105727][ T491] __x64_sys_openat+0x13a/0x170 [ 41.110605][ T491] x64_sys_call+0xe69/0x2ee0 [ 41.115186][ T491] page last free pid 13 tgid 13 stack trace: [ 41.121145][ T491] free_unref_page+0xbb8/0xf70 [ 41.126145][ T491] __free_pages+0x6b/0x3b0 [ 41.130566][ T491] __free_slab+0xb2/0x110 [ 41.134979][ T491] free_slab+0x18/0xe0 [ 41.139035][ T491] __put_partials+0x115/0x150 [ 41.143783][ T491] put_cpu_partial+0x91/0xc0 [ 41.148351][ T491] __slab_free+0x1cf/0x2a0 [ 41.152748][ T491] ___cache_free+0xc9/0xe0 [ 41.157177][ T491] qlist_free_all+0xb5/0x130 [ 41.161791][ T491] kasan_quarantine_reduce+0x14f/0x180 [ 41.167518][ T491] __kasan_slab_alloc+0x28/0x90 [ 41.172375][ T491] kmem_cache_alloc_node_noprof+0x1ca/0x420 [ 41.178256][ T491] __alloc_skb+0x10c/0x360 [ 41.182751][ T491] rtmsg_ifinfo_build_skb+0x7a/0x270 [ 41.188041][ T491] rtmsg_ifinfo+0x91/0x1a0 [ 41.192462][ T491] netdev_state_change+0x19a/0x240 [ 41.197565][ T491] [ 41.199873][ T491] Memory state around the buggy address: [ 41.205479][ T491] ffff88811d05b380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 41.213518][ T491] ffff88811d05b400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 41.221655][ T491] >ffff88811d05b480: 00 00 00 00 00 02 fc fc fc fc fc fc fc fc fc fc [ 41.229699][ T491] ^ [ 41.234270][ T491] ffff88811d05b500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 41.242320][ T491] ffff88811d05b580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 41.250386][ T491] ================================================================== [ 41.262249][ T491] Disabling lock debugging due to kernel taint 2026/08/31 03:16:45 executed programs: 234 2026/08/31 03:16:50 executed programs: 535