Warning: Permanently added '10.128.1.165' (ED25519) to the list of known hosts. 2026/08/03 18:11:11 parsed 1 programs Setting up swapspace version 1, size = 127995904 bytes [ 37.425222][ T30] kauditd_printk_skb: 31 callbacks suppressed [ 37.425236][ T30] audit: type=1400 audit(1785780672.272:105): avc: denied { unlink } for pid=410 comm="syz-executor" name="swap-file" dev="sda1" ino=2027 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 37.462477][ T410] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 38.000608][ T419] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.009514][ T419] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.019648][ T419] device bridge_slave_0 entered promiscuous mode [ 38.027258][ T419] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.038869][ T419] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.051347][ T419] device bridge_slave_1 entered promiscuous mode [ 38.091199][ T419] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.098929][ T419] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.107553][ T419] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.115118][ T419] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.134297][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.143114][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.151853][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 38.163400][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 38.175804][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 38.184718][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.193566][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.203859][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 38.219124][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.230799][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.245323][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 38.256398][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 38.270267][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 38.281962][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 38.290845][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 38.299179][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 38.307538][ T419] device veth0_vlan entered promiscuous mode [ 38.318772][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 38.328423][ T419] device veth1_macvtap entered promiscuous mode [ 38.339207][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 38.350739][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 38.781605][ T30] audit: type=1401 audit(1785780673.622:106): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" 2026/08/03 18:11:13 executed programs: 0 [ 39.097839][ T474] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.107145][ T474] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.114787][ T474] device bridge_slave_0 entered promiscuous mode [ 39.123005][ T8] device bridge_slave_1 left promiscuous mode [ 39.129310][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.137379][ T8] device bridge_slave_0 left promiscuous mode [ 39.143832][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.152575][ T8] device veth1_macvtap left promiscuous mode [ 39.160693][ T8] device veth0_vlan left promiscuous mode [ 39.258089][ T474] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.265868][ T474] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.273509][ T474] device bridge_slave_1 entered promiscuous mode [ 39.307674][ T474] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.315271][ T474] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.322841][ T474] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.330635][ T474] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.348839][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 39.358755][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.367041][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.377380][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 39.386206][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.394100][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.403239][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 39.411978][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.420198][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.432307][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 39.442212][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 39.457545][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 39.470939][ T474] device veth0_vlan entered promiscuous mode [ 39.478282][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 39.487860][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 39.496457][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 39.512692][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 39.527250][ T474] device veth1_macvtap entered promiscuous mode [ 39.542250][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 39.556997][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 39.577951][ T30] audit: type=1400 audit(1785780674.422:107): avc: denied { prog_load } for pid=479 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 39.609984][ T30] audit: type=1400 audit(1785780674.422:108): avc: denied { bpf } for pid=479 comm="syz.2.17" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 39.635487][ T30] audit: type=1400 audit(1785780674.482:109): avc: denied { setopt } for pid=479 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 39.707171][ T30] audit: type=1400 audit(1785780674.552:110): avc: denied { perfmon } for pid=479 comm="syz.2.17" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 39.732272][ T30] audit: type=1400 audit(1785780674.582:111): avc: denied { prog_run } for pid=479 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 39.758223][ T483] ================================================================== [ 39.766579][ T483] BUG: KASAN: slab-out-of-bounds in hci_sock_setsockopt+0x7f5/0x820 [ 39.774909][ T483] Read of size 4 at addr ffff88812ae118c3 by task syz.2.18/483 [ 39.782845][ T483] [ 39.785285][ T483] CPU: 1 PID: 483 Comm: syz.2.18 Not tainted syzkaller #0 [ 39.792579][ T483] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 39.803597][ T483] Call Trace: [ 39.807134][ T483] [ 39.810479][ T483] __dump_stack+0x21/0x30 [ 39.814806][ T483] dump_stack_lvl+0x110/0x170 [ 39.819949][ T483] ? show_regs_print_info+0x20/0x20 [ 39.825558][ T483] ? load_image+0x3f0/0x3f0 [ 39.831576][ T483] ? lock_sock_nested+0x217/0x2a0 [ 39.836951][ T483] print_address_description+0x7f/0x2c0 [ 39.842995][ T483] ? hci_sock_setsockopt+0x7f5/0x820 [ 39.848449][ T483] kasan_report+0x10f/0x150 [ 39.852964][ T483] ? hci_sock_setsockopt+0x7f5/0x820 [ 39.858521][ T483] __asan_report_load_n_noabort+0xf/0x20 [ 39.864616][ T483] hci_sock_setsockopt+0x7f5/0x820 [ 39.869844][ T483] ? __fget_files+0x2e1/0x340 [ 39.874520][ T483] ? hci_sock_compat_ioctl+0x50/0x50 [ 39.880254][ T483] ? security_socket_setsockopt+0x82/0xa0 [ 39.887124][ T483] ? hci_sock_compat_ioctl+0x50/0x50 [ 39.893219][ T483] __sys_setsockopt+0x2e9/0x470 [ 39.898433][ T483] ? __ia32_sys_recv+0xb0/0xb0 [ 39.903196][ T483] ? __kasan_check_write+0x14/0x20 [ 39.908478][ T483] __x64_sys_setsockopt+0xbf/0xd0 [ 39.914124][ T483] x64_sys_call+0x982/0x9a0 [ 39.919177][ T483] do_syscall_64+0x4c/0xa0 [ 39.924340][ T483] ? clear_bhb_loop+0x50/0xa0 [ 39.930893][ T483] ? clear_bhb_loop+0x50/0xa0 [ 39.935787][ T483] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 39.942330][ T483] RIP: 0033:0x7f85ceadff79 [ 39.946831][ T483] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 39.967882][ T483] RSP: 002b:00007f85ce943028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 39.976684][ T483] RAX: ffffffffffffffda RBX: 00007f85ced59fa0 RCX: 00007f85ceadff79 [ 39.985016][ T483] RDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000008 [ 39.993462][ T483] RBP: 00007f85ceb767e0 R08: 0000000000000001 R09: 0000000000000000 [ 40.002094][ T483] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 40.010630][ T483] R13: 00007f85ced5a038 R14: 00007f85ced59fa0 R15: 00007ffff0751ec8 [ 40.020321][ T483] [ 40.023549][ T483] [ 40.026507][ T483] Allocated by task 483: [ 40.031032][ T483] __kasan_kmalloc+0xd4/0x100 [ 40.036191][ T483] __kmalloc+0x13d/0x2c0 [ 40.041309][ T483] __cgroup_bpf_run_filter_setsockopt+0x8e7/0xaa0 [ 40.049305][ T483] __sys_setsockopt+0x40e/0x470 [ 40.054842][ T483] __x64_sys_setsockopt+0xbf/0xd0 [ 40.060209][ T483] x64_sys_call+0x982/0x9a0 [ 40.065487][ T483] do_syscall_64+0x4c/0xa0 [ 40.070621][ T483] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 40.076602][ T483] [ 40.079030][ T483] The buggy address belongs to the object at ffff88812ae118c0 [ 40.079030][ T483] which belongs to the cache kmalloc-8 of size 8 [ 40.093684][ T483] The buggy address is located 3 bytes inside of [ 40.093684][ T483] 8-byte region [ffff88812ae118c0, ffff88812ae118c8) [ 40.106772][ T483] The buggy address belongs to the page: [ 40.112429][ T483] page:ffffea0004ab8440 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12ae11 [ 40.124252][ T483] flags: 0x4000000000000200(slab|zone=1) [ 40.130507][ T483] raw: 4000000000000200 0000000000000000 dead000000000122 ffff888100042300 [ 40.141401][ T483] raw: 0000000000000000 0000000080660066 00000001ffffffff 0000000000000000 [ 40.151119][ T483] page dumped because: kasan: bad access detected [ 40.157714][ T483] page_owner tracks the page as allocated [ 40.164736][ T483] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 474, ts 39304139539, free_ts 38918708268 [ 40.182212][ T483] post_alloc_hook+0x192/0x1b0 [ 40.187165][ T483] prep_new_page+0x1c/0x110 [ 40.191937][ T483] get_page_from_freelist+0x2c3a/0x2cd0 [ 40.198203][ T483] __alloc_pages+0x1a2/0x460 [ 40.203059][ T483] new_slab+0xa0/0x4d0 [ 40.207121][ T483] ___slab_alloc+0x3ac/0x840 [ 40.212325][ T483] __slab_alloc+0x49/0x90 [ 40.217602][ T483] __kmalloc_track_caller+0x169/0x2c0 [ 40.223489][ T483] kvasprintf+0xe3/0x1a0 [ 40.227732][ T483] kvasprintf_const+0xf2/0x240 [ 40.233460][ T483] kobject_set_name_vargs+0x61/0x110 [ 40.239386][ T483] kobject_init_and_add+0xeb/0x190 [ 40.244880][ T483] netdev_queue_update_kobjects+0x18e/0x3e0 [ 40.250822][ T483] netdev_register_kobject+0x281/0x330 [ 40.257424][ T483] register_netdevice+0xeaa/0x1490 [ 40.262645][ T483] macsec_newlink+0x5c6/0xcf0 [ 40.267496][ T483] page last free stack trace: [ 40.272424][ T483] free_unref_page_prepare+0x5fa/0x600 [ 40.278091][ T483] free_unref_page+0xae/0x540 [ 40.283190][ T483] __free_pages+0x6c/0x100 [ 40.288127][ T483] __vunmap+0x801/0x980 [ 40.292356][ T483] vfree+0x8b/0xc0 [ 40.296067][ T483] kcov_close+0x2b/0x50 [ 40.300554][ T483] __fput+0x22b/0x900 [ 40.304624][ T483] ____fput+0x15/0x20 [ 40.308672][ T483] task_work_run+0x127/0x190 [ 40.313688][ T483] do_exit+0xb70/0x29a0 [ 40.318006][ T483] do_group_exit+0x149/0x310 [ 40.322859][ T483] get_signal+0x64f/0x1430 [ 40.327263][ T483] arch_do_signal_or_restart+0xe2/0x1100 [ 40.333954][ T483] exit_to_user_mode_loop+0xa7/0xe0 [ 40.339409][ T483] exit_to_user_mode_prepare+0x87/0xd0 [ 40.345028][ T483] syscall_exit_to_user_mode+0x1a/0x30 [ 40.350571][ T483] [ 40.353264][ T483] Memory state around the buggy address: [ 40.359369][ T483] ffff88812ae11780: fc fc fc fc fc fc fc fc fc fc fa fc fc fc fc fc [ 40.368489][ T483] ffff88812ae11800: fc fc fc fc fa fc fc fc fc 05 fc fc fc fc fc fc [ 40.377628][ T483] >ffff88812ae11880: fc fc fc fc fc fc fc fc 01 fc fc fc fc fa fc fc [ 40.385967][ T483] ^ [ 40.392751][ T483] ffff88812ae11900: fc fc 05 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.401229][ T483] ffff88812ae11980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.409738][ T483] ================================================================== [ 40.418136][ T483] Disabling lock debugging due to kernel taint [ 40.430136][ T30] audit: type=1400 audit(1785780675.272:112): avc: denied { read } for pid=83 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 40.454453][ T30] audit: type=1400 audit(1785780675.272:113): avc: denied { search } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 40.477517][ T30] audit: type=1400 audit(1785780675.272:114): avc: denied { write } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 2026/08/03 18:11:18 executed programs: 215 2026/08/03 18:11:23 executed programs: 515