Warning: Permanently added '10.128.1.62' (ED25519) to the list of known hosts. 2026/01/17 07:28:24 parsed 1 programs [ 42.839469][ T24] kauditd_printk_skb: 30 callbacks suppressed [ 42.839479][ T24] audit: type=1400 audit(1768634904.710:104): avc: denied { unlink } for pid=407 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 42.939828][ T407] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 43.564262][ T24] audit: type=1401 audit(1768634905.440:105): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 43.624604][ T433] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.632408][ T433] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.640342][ T433] device bridge_slave_0 entered promiscuous mode [ 43.647862][ T433] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.657707][ T433] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.665593][ T433] device bridge_slave_1 entered promiscuous mode [ 43.693285][ T433] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.700629][ T433] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.708410][ T433] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.715620][ T433] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.731327][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.738697][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.746784][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 43.754220][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 43.771983][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 43.780336][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.787373][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.794905][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 43.803548][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.810649][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.818617][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 43.826617][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 43.837885][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 43.848507][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 43.856526][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 43.864185][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 43.872213][ T433] device veth0_vlan entered promiscuous mode [ 43.882382][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 43.891492][ T433] device veth1_macvtap entered promiscuous mode [ 43.900450][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 43.910414][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 43.988428][ T24] audit: type=1400 audit(1768634905.860:106): avc: denied { create } for pid=448 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 2026/01/17 07:28:26 executed programs: 0 [ 44.299655][ T24] audit: type=1400 audit(1768634906.170:107): avc: denied { write } for pid=398 comm="syz-execprog" path="pipe:[14962]" dev="pipefs" ino=14962 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 44.336581][ T467] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.344129][ T467] bridge0: port 1(bridge_slave_0) entered disabled state [ 44.351445][ T467] device bridge_slave_0 entered promiscuous mode [ 44.360048][ T467] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.367097][ T467] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.374440][ T467] device bridge_slave_1 entered promiscuous mode [ 44.401720][ T467] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.408774][ T467] bridge0: port 2(bridge_slave_1) entered forwarding state [ 44.416037][ T467] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.423043][ T467] bridge0: port 1(bridge_slave_0) entered forwarding state [ 44.439515][ T354] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 44.447570][ T354] bridge0: port 1(bridge_slave_0) entered disabled state [ 44.454945][ T354] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.463978][ T354] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 44.472155][ T354] bridge0: port 1(bridge_slave_0) entered blocking state [ 44.479190][ T354] bridge0: port 1(bridge_slave_0) entered forwarding state [ 44.489653][ T354] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 44.497913][ T354] bridge0: port 2(bridge_slave_1) entered blocking state [ 44.504949][ T354] bridge0: port 2(bridge_slave_1) entered forwarding state [ 44.515731][ T354] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 44.534192][ T354] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 44.542558][ T354] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 44.550781][ T354] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 44.558757][ T354] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 44.566439][ T354] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 44.575189][ T467] device veth0_vlan entered promiscuous mode [ 44.584962][ T354] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 44.593977][ T467] device veth1_macvtap entered promiscuous mode [ 44.602612][ T354] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 44.612239][ T354] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 44.737196][ T472] F2FS-fs (loop2): fault_injection options not supported [ 44.745389][ T472] F2FS-fs (loop2): invalid crc value [ 44.751704][ T472] F2FS-fs (loop2): Found nat_bits in checkpoint [ 44.772114][ T472] F2FS-fs (loop2): Start checkpoint disabled! [ 44.778944][ T472] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 44.786579][ T24] audit: type=1400 audit(1768634906.660:108): avc: denied { mount } for pid=471 comm="syz.2.16" name="/" dev="loop2" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 44.816485][ T24] audit: type=1400 audit(1768634906.660:109): avc: denied { write } for pid=471 comm="syz.2.16" name="/" dev="loop2" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 44.838472][ T24] audit: type=1400 audit(1768634906.660:110): avc: denied { add_name } for pid=471 comm="syz.2.16" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 44.850927][ T9] attempt to access beyond end of device [ 44.850927][ T9] loop2: rw=2049, want=45104, limit=40427 [ 44.859192][ T24] audit: type=1400 audit(1768634906.660:111): avc: denied { create } for pid=471 comm="syz.2.16" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 44.890678][ T24] audit: type=1400 audit(1768634906.660:112): avc: denied { write open } for pid=471 comm="syz.2.16" path="/0/file0/file0" dev="loop2" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 44.914001][ T24] audit: type=1400 audit(1768634906.660:113): avc: denied { ioctl } for pid=471 comm="syz.2.16" path="/0/file0/file0" dev="loop2" ino=10 ioctlcmd=0xf50d scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 45.068815][ T477] F2FS-fs (loop2): fault_injection options not supported [ 45.083047][ T477] F2FS-fs (loop2): invalid crc value [ 45.089608][ T477] F2FS-fs (loop2): Found nat_bits in checkpoint [ 45.113099][ T477] F2FS-fs (loop2): Start checkpoint disabled! [ 45.119862][ T477] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 45.163770][ T9] attempt to access beyond end of device [ 45.163770][ T9] loop2: rw=2049, want=40968, limit=40427 [ 45.425015][ T482] F2FS-fs (loop2): fault_injection options not supported [ 45.438418][ T482] F2FS-fs (loop2): invalid crc value [ 45.444642][ T482] F2FS-fs (loop2): Found nat_bits in checkpoint [ 45.467615][ T482] F2FS-fs (loop2): Start checkpoint disabled! [ 45.474430][ T482] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 45.494487][ T221] device bridge_slave_1 left promiscuous mode [ 45.500629][ T221] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.508453][ T221] device bridge_slave_0 left promiscuous mode [ 45.514853][ T221] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.523132][ T221] device veth1_macvtap left promiscuous mode [ 45.529703][ T221] device veth0_vlan left promiscuous mode [ 45.534108][ T9] attempt to access beyond end of device [ 45.534108][ T9] loop2: rw=2049, want=40968, limit=40427 [ 45.834155][ T487] F2FS-fs (loop2): fault_injection options not supported [ 45.842423][ T487] F2FS-fs (loop2): invalid crc value [ 45.848762][ T487] F2FS-fs (loop2): Found nat_bits in checkpoint [ 45.881724][ T487] F2FS-fs (loop2): Start checkpoint disabled! [ 45.888670][ T487] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 45.930626][ T221] attempt to access beyond end of device [ 45.930626][ T221] loop2: rw=2049, want=45104, limit=40427 [ 46.156488][ T499] F2FS-fs (loop2): fault_injection options not supported [ 46.164393][ T499] F2FS-fs (loop2): invalid crc value [ 46.170671][ T499] F2FS-fs (loop2): Found nat_bits in checkpoint [ 46.190956][ T499] F2FS-fs (loop2): Start checkpoint disabled! [ 46.197876][ T499] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 46.240369][ T221] attempt to access beyond end of device [ 46.240369][ T221] loop2: rw=2049, want=45104, limit=40427 [ 46.500551][ T504] F2FS-fs (loop2): fault_injection options not supported [ 46.510198][ T504] F2FS-fs (loop2): invalid crc value [ 46.516672][ T504] F2FS-fs (loop2): Found nat_bits in checkpoint [ 46.537142][ T504] F2FS-fs (loop2): Start checkpoint disabled! [ 46.544517][ T504] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 46.586928][ T9] attempt to access beyond end of device [ 46.586928][ T9] loop2: rw=2049, want=40968, limit=40427 [ 46.910985][ T509] F2FS-fs (loop2): fault_injection options not supported [ 46.919140][ T509] F2FS-fs (loop2): invalid crc value [ 46.925441][ T509] F2FS-fs (loop2): Found nat_bits in checkpoint [ 46.945683][ T509] F2FS-fs (loop2): Start checkpoint disabled! [ 46.952533][ T509] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 46.994959][ T9] attempt to access beyond end of device [ 46.994959][ T9] loop2: rw=2049, want=40968, limit=40427 [ 47.253513][ T514] F2FS-fs (loop2): fault_injection options not supported [ 47.261460][ T514] F2FS-fs (loop2): invalid crc value [ 47.267657][ T514] F2FS-fs (loop2): Found nat_bits in checkpoint [ 47.287554][ T514] F2FS-fs (loop2): Start checkpoint disabled! [ 47.294675][ T514] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 47.335836][ T9] attempt to access beyond end of device [ 47.335836][ T9] loop2: rw=2049, want=40968, limit=40427 [ 47.555608][ T519] F2FS-fs (loop2): fault_injection options not supported [ 47.563593][ T519] F2FS-fs (loop2): invalid crc value [ 47.569784][ T519] F2FS-fs (loop2): Found nat_bits in checkpoint [ 47.589573][ T519] F2FS-fs (loop2): Start checkpoint disabled! [ 47.596398][ T519] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 47.637986][ T9] attempt to access beyond end of device [ 47.637986][ T9] loop2: rw=2049, want=40968, limit=40427 [ 47.884562][ T524] F2FS-fs (loop2): fault_injection options not supported [ 47.892503][ T524] F2FS-fs (loop2): invalid crc value [ 47.899374][ T524] F2FS-fs (loop2): Found nat_bits in checkpoint [ 47.919851][ T524] F2FS-fs (loop2): Start checkpoint disabled! [ 47.926864][ T524] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 47.957802][ T524] ------------[ cut here ]------------ [ 47.963405][ T524] WARNING: CPU: 0 PID: 524 at fs/f2fs/segment.c:2582 new_curseg+0xe4f/0x1880 [ 47.972340][ T524] Modules linked in: [ 47.976330][ T524] CPU: 0 PID: 524 Comm: syz.2.25 Not tainted syzkaller #0 [ 47.983502][ T524] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 47.993772][ T524] RIP: 0010:new_curseg+0xe4f/0x1880 [ 47.999049][ T524] Code: 0b 4c 8b bd 30 ff ff ff 4c 89 ff be 08 00 00 00 e8 66 d0 91 ff f0 41 80 0f 04 41 b5 01 45 89 f7 e9 4d fb ff ff e8 f1 51 57 ff <0f> 0b 4c 8b a5 30 ff ff ff 4c 89 e7 be 08 00 00 00 e8 3b d0 91 ff [ 48.018961][ T524] RSP: 0018:ffffc90001f67718 EFLAGS: 00010293 [ 48.025052][ T524] RAX: ffffffff820d625f RBX: ffff8881184fd5d8 RCX: ffff88811a7b3b40 [ 48.033483][ T524] RDX: 0000000000000000 RSI: 0000000000000018 RDI: 0000000000000018 [ 48.041451][ T524] RBP: ffffc90001f67808 R08: 0000000000000003 R09: 0000000000000004 [ 48.049546][ T524] R10: dffffc0000000000 R11: fffff520003eced4 R12: 0000000000000018 [ 48.057909][ T524] R13: 1ffff1102309fabb R14: 0000000000000018 R15: 0000000000000017 [ 48.066300][ T524] FS: 00007f6d889726c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 48.075874][ T524] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 48.082739][ T524] CR2: 00007fba3c153000 CR3: 0000000119e54000 CR4: 00000000003506b0 [ 48.091015][ T524] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 48.099014][ T524] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 48.107733][ T524] Call Trace: [ 48.111091][ T524] __allocate_new_segment+0x13d/0x810 [ 48.116572][ T524] f2fs_allocate_new_section+0x1f3/0x290 [ 48.122290][ T524] ? new_curseg+0x1880/0x1880 [ 48.127185][ T524] ? __kasan_check_write+0x14/0x20 [ 48.132452][ T524] ? down_read_trylock+0x106/0x160 [ 48.137865][ T524] ? __init_rwsem+0x1c0/0x1c0 [ 48.142577][ T524] ? has_not_enough_free_secs+0x3d7/0x8a0 [ 48.148404][ T524] expand_inode_data+0x5f7/0x9a0 [ 48.153524][ T524] ? f2fs_insert_range+0x5d0/0x5d0 [ 48.158795][ T524] ? inode_dio_wait+0x25a/0x2d0 [ 48.163905][ T524] ? file_update_time+0x2f1/0x440 [ 48.168928][ T524] ? inode_owner_or_capable+0x140/0x140 [ 48.174486][ T524] f2fs_fallocate+0x42b/0x7e0 [ 48.179166][ T524] vfs_fallocate+0x4b4/0x590 [ 48.183757][ T524] do_vfs_ioctl+0x1154/0x14c0 [ 48.188675][ T524] ? __ia32_compat_sys_ioctl+0x8e0/0x8e0 [ 48.194432][ T524] ? has_cap_mac_admin+0x370/0x370 [ 48.199642][ T524] ? kmem_cache_free+0x100/0x2d0 [ 48.204644][ T524] ? selinux_file_ioctl+0x3a0/0x4d0 [ 48.209871][ T524] ? putname+0xfe/0x150 [ 48.214038][ T524] ? selinux_file_alloc_security+0x120/0x120 [ 48.220018][ T524] ? do_sys_openat2+0x68e/0x750 [ 48.224967][ T524] ? __fget_files+0x2c4/0x320 [ 48.229648][ T524] ? security_file_ioctl+0x84/0xa0 [ 48.234772][ T524] __se_sys_ioctl+0x9f/0x1a0 [ 48.239354][ T524] __x64_sys_ioctl+0x7b/0x90 [ 48.243947][ T524] do_syscall_64+0x31/0x40 [ 48.248357][ T524] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 48.254267][ T524] RIP: 0033:0x7f6d88f0a8f9 [ 48.258671][ T524] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 48.279705][ T524] RSP: 002b:00007f6d88972028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 48.288337][ T524] RAX: ffffffffffffffda RBX: 00007f6d89138fa0 RCX: 00007f6d88f0a8f9 [ 48.296637][ T524] RDX: 00002000000000c0 RSI: 0000000040305828 RDI: 0000000000000005 [ 48.304758][ T524] RBP: 00007f6d88f9c1bc R08: 0000000000000000 R09: 0000000000000000 [ 48.313356][ T524] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 48.321730][ T524] R13: 0000000000000000 R14: 00007f6d89138fa0 R15: 00007ffd3448ebe8 [ 48.329734][ T524] ---[ end trace d265f27cc4292dd4 ]--- [ 48.335467][ T524] ------------[ cut here ]------------ [ 48.341017][ T524] WARNING: CPU: 0 PID: 524 at fs/f2fs/segment.c:2636 new_curseg+0x14a6/0x1880 [ 48.349864][ T524] Modules linked in: [ 48.353863][ T524] CPU: 0 PID: 524 Comm: syz.2.25 Tainted: G W syzkaller #0 [ 48.362348][ T524] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 48.372519][ T524] RIP: 0010:new_curseg+0x14a6/0x1880 [ 48.378428][ T524] Code: ff e8 be 4b 57 ff 0f 0b 4c 8b 75 d0 49 8d 7e 78 be 08 00 00 00 e8 0a ca 91 ff f0 41 80 4e 78 04 e9 d4 ed ff ff e8 9a 4b 57 ff <0f> 0b 48 8b 5d d0 48 8d 7b 78 be 08 00 00 00 e8 e6 c9 91 ff f0 80 [ 48.398241][ T524] RSP: 0018:ffffc90001f67718 EFLAGS: 00010293 [ 48.404428][ T524] RAX: ffffffff820d68b6 RBX: ffff888106797901 RCX: ffff88811a7b3b40 [ 48.413032][ T524] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 [ 48.421263][ T524] RBP: ffffc90001f67808 R08: ffff888106797917 R09: 1ffff11020cf2f22 [ 48.429363][ T524] R10: dffffc0000000000 R11: ffffed1020cf2f23 R12: 0000000000000000 [ 48.437346][ T524] R13: 0000000000000018 R14: 0000000000000001 R15: 0000000000000018 [ 48.445416][ T524] FS: 00007f6d889726c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 48.454367][ T524] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 48.460938][ T524] CR2: 00007fba3c153000 CR3: 0000000119e54000 CR4: 00000000003506b0 [ 48.469021][ T524] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 48.477663][ T524] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 48.485656][ T524] Call Trace: [ 48.489025][ T524] __allocate_new_segment+0x13d/0x810 [ 48.494404][ T524] f2fs_allocate_new_section+0x1f3/0x290 [ 48.500126][ T524] ? new_curseg+0x1880/0x1880 [ 48.504827][ T524] ? __kasan_check_write+0x14/0x20 [ 48.510025][ T524] ? down_read_trylock+0x106/0x160 [ 48.515370][ T524] ? __init_rwsem+0x1c0/0x1c0 [ 48.520225][ T524] ? has_not_enough_free_secs+0x3d7/0x8a0 [ 48.526333][ T524] expand_inode_data+0x5f7/0x9a0 [ 48.531367][ T524] ? f2fs_insert_range+0x5d0/0x5d0 [ 48.536670][ T524] ? inode_dio_wait+0x25a/0x2d0 [ 48.541519][ T524] ? file_update_time+0x2f1/0x440 [ 48.546557][ T524] ? inode_owner_or_capable+0x140/0x140 [ 48.552106][ T524] f2fs_fallocate+0x42b/0x7e0 [ 48.556822][ T524] vfs_fallocate+0x4b4/0x590 [ 48.561406][ T524] do_vfs_ioctl+0x1154/0x14c0 [ 48.566278][ T524] ? __ia32_compat_sys_ioctl+0x8e0/0x8e0 [ 48.571907][ T524] ? has_cap_mac_admin+0x370/0x370 [ 48.577062][ T524] ? kmem_cache_free+0x100/0x2d0 [ 48.581987][ T524] ? selinux_file_ioctl+0x3a0/0x4d0 [ 48.587283][ T524] ? putname+0xfe/0x150 [ 48.591436][ T524] ? selinux_file_alloc_security+0x120/0x120 [ 48.597548][ T524] ? do_sys_openat2+0x68e/0x750 [ 48.602626][ T524] ? __fget_files+0x2c4/0x320 [ 48.607513][ T524] ? security_file_ioctl+0x84/0xa0 [ 48.612798][ T524] __se_sys_ioctl+0x9f/0x1a0 [ 48.617524][ T524] __x64_sys_ioctl+0x7b/0x90 [ 48.622110][ T524] do_syscall_64+0x31/0x40 [ 48.626798][ T524] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 48.632712][ T524] RIP: 0033:0x7f6d88f0a8f9 [ 48.637274][ T524] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 48.657145][ T524] RSP: 002b:00007f6d88972028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 48.665585][ T524] RAX: ffffffffffffffda RBX: 00007f6d89138fa0 RCX: 00007f6d88f0a8f9 [ 48.673640][ T524] RDX: 00002000000000c0 RSI: 0000000040305828 RDI: 0000000000000005 [ 48.681626][ T524] RBP: 00007f6d88f9c1bc R08: 0000000000000000 R09: 0000000000000000 [ 48.689747][ T524] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 48.697919][ T524] R13: 0000000000000000 R14: 00007f6d89138fa0 R15: 00007ffd3448ebe8 [ 48.705912][ T524] ---[ end trace d265f27cc4292dd5 ]--- [ 48.711535][ T524] ================================================================== [ 48.719606][ T524] BUG: KASAN: slab-out-of-bounds in reset_curseg+0x4dd/0x560 [ 48.726949][ T524] Read of size 4 at addr ffff88811abff3c0 by task syz.2.25/524 [ 48.734728][ T524] [ 48.737035][ T524] CPU: 1 PID: 524 Comm: syz.2.25 Tainted: G W syzkaller #0 [ 48.745503][ T524] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 48.755986][ T524] Call Trace: [ 48.759261][ T524] __dump_stack+0x21/0x24 [ 48.763573][ T524] dump_stack_lvl+0x1a7/0x208 [ 48.768307][ T524] ? show_regs_print_info+0x18/0x18 [ 48.773491][ T524] ? thaw_kernel_threads+0x220/0x220 [ 48.778756][ T524] print_address_description+0x7f/0x2c0 [ 48.784370][ T524] ? reset_curseg+0x4dd/0x560 [ 48.789229][ T524] kasan_report+0xe2/0x130 [ 48.793634][ T524] ? reset_curseg+0x4dd/0x560 [ 48.798280][ T524] __asan_report_load4_noabort+0x14/0x20 [ 48.803901][ T524] reset_curseg+0x4dd/0x560 [ 48.808671][ T524] new_curseg+0x12e8/0x1880 [ 48.813746][ T524] __allocate_new_segment+0x13d/0x810 [ 48.819198][ T524] f2fs_allocate_new_section+0x1f3/0x290 [ 48.824906][ T524] ? new_curseg+0x1880/0x1880 [ 48.830045][ T524] ? __kasan_check_write+0x14/0x20 [ 48.835167][ T524] ? down_read_trylock+0x106/0x160 [ 48.840446][ T524] ? __init_rwsem+0x1c0/0x1c0 [ 48.845123][ T524] ? has_not_enough_free_secs+0x3d7/0x8a0 [ 48.850829][ T524] expand_inode_data+0x5f7/0x9a0 [ 48.856271][ T524] ? f2fs_insert_range+0x5d0/0x5d0 [ 48.861530][ T524] ? inode_dio_wait+0x25a/0x2d0 [ 48.866539][ T524] ? file_update_time+0x2f1/0x440 [ 48.872232][ T524] ? inode_owner_or_capable+0x140/0x140 [ 48.877759][ T524] f2fs_fallocate+0x42b/0x7e0 [ 48.882405][ T524] vfs_fallocate+0x4b4/0x590 [ 48.887051][ T524] do_vfs_ioctl+0x1154/0x14c0 [ 48.891695][ T524] ? __ia32_compat_sys_ioctl+0x8e0/0x8e0 [ 48.897302][ T524] ? has_cap_mac_admin+0x370/0x370 [ 48.902384][ T524] ? kmem_cache_free+0x100/0x2d0 [ 48.907300][ T524] ? selinux_file_ioctl+0x3a0/0x4d0 [ 48.912735][ T524] ? putname+0xfe/0x150 [ 48.916871][ T524] ? selinux_file_alloc_security+0x120/0x120 [ 48.922919][ T524] ? do_sys_openat2+0x68e/0x750 [ 48.927745][ T524] ? __fget_files+0x2c4/0x320 [ 48.932403][ T524] ? security_file_ioctl+0x84/0xa0 [ 48.937502][ T524] __se_sys_ioctl+0x9f/0x1a0 [ 48.942149][ T524] __x64_sys_ioctl+0x7b/0x90 [ 48.946715][ T524] do_syscall_64+0x31/0x40 [ 48.951101][ T524] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 48.957554][ T524] RIP: 0033:0x7f6d88f0a8f9 [ 48.961937][ T524] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 48.982007][ T524] RSP: 002b:00007f6d88972028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 48.990573][ T524] RAX: ffffffffffffffda RBX: 00007f6d89138fa0 RCX: 00007f6d88f0a8f9 [ 48.998529][ T524] RDX: 00002000000000c0 RSI: 0000000040305828 RDI: 0000000000000005 [ 49.006604][ T524] RBP: 00007f6d88f9c1bc R08: 0000000000000000 R09: 0000000000000000 [ 49.014724][ T524] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 49.022666][ T524] R13: 0000000000000000 R14: 00007f6d89138fa0 R15: 00007ffd3448ebe8 [ 49.030617][ T524] [ 49.033034][ T524] Allocated by task 524: [ 49.037261][ T524] __kasan_kmalloc+0xda/0x110 [ 49.041915][ T524] __kmalloc+0x1a4/0x330 [ 49.046136][ T524] kvmalloc_node+0x88/0x130 [ 49.050618][ T524] f2fs_build_segment_manager+0xdba/0x4900 [ 49.056395][ T524] f2fs_fill_super+0x4a4a/0x72e0 [ 49.061304][ T524] mount_bdev+0x28b/0x3a0 [ 49.065693][ T524] f2fs_mount+0x34/0x40 [ 49.069833][ T524] legacy_get_tree+0xed/0x190 [ 49.074652][ T524] vfs_get_tree+0x89/0x260 [ 49.079034][ T524] do_new_mount+0x25a/0xa20 [ 49.083501][ T524] path_mount+0x585/0xc90 [ 49.087969][ T524] __se_sys_mount+0x320/0x390 [ 49.092623][ T524] __x64_sys_mount+0xbf/0xd0 [ 49.097181][ T524] do_syscall_64+0x31/0x40 [ 49.101592][ T524] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 49.107446][ T524] [ 49.109830][ T524] The buggy address belongs to the object at ffff88811abff000 [ 49.109830][ T524] which belongs to the cache kmalloc-1k of size 1024 [ 49.123963][ T524] The buggy address is located 960 bytes inside of [ 49.123963][ T524] 1024-byte region [ffff88811abff000, ffff88811abff400) [ 49.137302][ T524] The buggy address belongs to the page: [ 49.142926][ T524] page:ffffea00046afe00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11abf8 [ 49.153302][ T524] head:ffffea00046afe00 order:3 compound_mapcount:0 compound_pincount:0 [ 49.161776][ T524] flags: 0x4000000000010200(slab|head) [ 49.167297][ T524] raw: 4000000000010200 0000000000000000 0000000100000001 ffff888100042f00 [ 49.175848][ T524] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 49.184393][ T524] page dumped because: kasan: bad access detected [ 49.190908][ T524] page_owner tracks the page as allocated [ 49.196610][ T524] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 163, ts 4394238510, free_ts 0 [ 49.214905][ T524] prep_new_page+0x179/0x180 [ 49.219558][ T524] get_page_from_freelist+0x223b/0x23d0 [ 49.225085][ T524] __alloc_pages_nodemask+0x290/0x620 [ 49.230669][ T524] new_slab+0x84/0x3f0 [ 49.234837][ T524] ___slab_alloc+0x2a6/0x450 [ 49.239536][ T524] __slab_alloc+0x63/0xa0 [ 49.243837][ T524] __kmalloc+0x1fe/0x330 [ 49.248048][ T524] alloc_pipe_info+0x1fc/0x4b0 [ 49.252868][ T524] create_pipe_files+0x8d/0x6c0 [ 49.257684][ T524] __do_pipe_flags+0x4f/0x200 [ 49.262330][ T524] do_pipe2+0xa7/0x190 [ 49.266461][ T524] __x64_sys_pipe2+0x5a/0x70 [ 49.271021][ T524] do_syscall_64+0x31/0x40 [ 49.275409][ T524] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 49.282417][ T524] page_owner free stack trace missing [ 49.288197][ T524] [ 49.290606][ T524] Memory state around the buggy address: [ 49.296210][ T524] ffff88811abff280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 49.304566][ T524] ffff88811abff300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 49.314064][ T524] >ffff88811abff380: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 49.322202][ T524] ^ [ 49.328514][ T524] ffff88811abff400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 49.336588][ T524] ffff88811abff480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 49.344616][ T524] ================================================================== [ 49.352643][ T524] Disabling lock debugging due to kernel taint [ 49.360418][ T524] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN [ 49.363104][ T24] audit: type=1400 audit(1768634911.230:114): avc: denied { read } for pid=76 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 49.372300][ T524] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 49.372310][ T524] CPU: 1 PID: 524 Comm: syz.2.25 Tainted: G B W syzkaller #0 [ 49.372314][ T524] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 49.372327][ T524] RIP: 0010:update_sit_entry+0x3eb/0xf50 [ 49.372334][ T524] Code: 89 45 a8 49 01 c5 41 f6 d7 41 80 e7 07 44 89 f9 41 bf 01 00 00 00 41 d3 e7 4d 89 ee 49 c1 ee 03 48 b8 00 00 00 00 00 fc ff df <41> 0f b6 04 06 84 c0 0f 85 a5 08 00 00 41 0f b6 5d 00 44 89 f8 41 [ 49.372347][ T524] RSP: 0018:ffffc90001f67330 EFLAGS: 00010246 [ 49.394109][ T24] audit: type=1400 audit(1768634911.230:115): avc: denied { search } for pid=76 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 49.402406][ T524] [ 49.411458][ T24] audit: type=1400 audit(1768634911.230:116): avc: denied { write } for pid=76 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 49.421051][ T524] RAX: dffffc0000000000 RBX: ffff88811abff3c8 RCX: 0000000000000007 [ 49.421057][ T524] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88811abff3c8 [ 49.421062][ T524] RBP: ffffc90001f673b0 R08: ffff88811a7b3b40 R09: 0000000000000003 [ 49.421067][ T524] R10: 00000000ffffffff R11: 0000000000000000 R12: 0000000000004000 [ 49.421071][ T524] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000080 [ 49.421079][ T524] FS: 00007f6d889726c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 49.421084][ T524] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 49.421089][ T524] CR2: 00007f6d88f58040 CR3: 0000000119e54000 CR4: 00000000003506a0 [ 49.421097][ T524] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 49.421102][ T524] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 49.421113][ T524] Call Trace: [ 49.427356][ T24] audit: type=1400 audit(1768634911.230:117): avc: denied { add_name } for pid=76 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 49.446427][ T524] ? __asan_report_store8_noabort+0x17/0x20 [ 49.446437][ T524] f2fs_allocate_data_block+0x159c/0x3a20 [ 49.446449][ T524] ? _raw_spin_trylock_bh+0x150/0x150 [ 49.446457][ T524] ? __dquot_alloc_space+0x2bd/0xb80 [ 49.446471][ T524] ? _raw_spin_unlock+0x4d/0x70 [ 49.452677][ T24] audit: type=1400 audit(1768634911.230:118): avc: denied { create } for pid=76 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 49.473746][ T524] ? f2fs_inode_dirtied+0x26b/0x2a0 [ 49.473755][ T524] ? f2fs_io_type_to_rw_hint+0x1e0/0x1e0 [ 49.473764][ T524] ? f2fs_mark_inode_dirty_sync+0x110/0x140 [ 49.473772][ T524] ? inc_valid_block_count+0x562/0xa90 [ 49.473786][ T524] __allocate_data_block+0x553/0x9d0 [ 49.476637][ T24] audit: type=1400 audit(1768634911.230:119): avc: denied { append open } for pid=76 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 49.497351][ T524] ? f2fs_map_blocks+0x35a0/0x35a0 [ 49.497360][ T524] f2fs_map_blocks+0xda4/0x35a0 [ 49.497369][ T524] ? __kasan_check_write+0x14/0x20 [ 49.497380][ T524] ? f2fs_do_map_lock+0x2e0/0x2e0 [ 49.497388][ T524] ? __kasan_check_write+0x14/0x20 [ 49.497397][ T524] ? down_read_trylock+0x106/0x160 [ 49.497425][ T524] expand_inode_data+0x626/0x9a0 [ 49.505754][ T24] audit: type=1400 audit(1768634911.230:120): avc: denied { getattr } for pid=76 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 49.513494][ T524] ? f2fs_insert_range+0x5d0/0x5d0 [ 49.513503][ T524] ? inode_dio_wait+0x25a/0x2d0 [ 49.513511][ T524] ? file_update_time+0x2f1/0x440 [ 49.513526][ T524] ? inode_owner_or_capable+0x140/0x140 [ 49.778723][ T524] f2fs_fallocate+0x42b/0x7e0 [ 49.783585][ T524] vfs_fallocate+0x4b4/0x590 [ 49.788168][ T524] do_vfs_ioctl+0x1154/0x14c0 [ 49.792824][ T524] ? __ia32_compat_sys_ioctl+0x8e0/0x8e0 [ 49.798549][ T524] ? has_cap_mac_admin+0x370/0x370 [ 49.803721][ T524] ? kmem_cache_free+0x100/0x2d0 [ 49.808629][ T524] ? selinux_file_ioctl+0x3a0/0x4d0 [ 49.813971][ T524] ? putname+0xfe/0x150 [ 49.818100][ T524] ? selinux_file_alloc_security+0x120/0x120 [ 49.824133][ T524] ? do_sys_openat2+0x68e/0x750 [ 49.829064][ T524] ? __fget_files+0x2c4/0x320 [ 49.833898][ T524] ? security_file_ioctl+0x84/0xa0 [ 49.838979][ T524] __se_sys_ioctl+0x9f/0x1a0 [ 49.843540][ T524] __x64_sys_ioctl+0x7b/0x90 [ 49.848259][ T524] do_syscall_64+0x31/0x40 [ 49.852747][ T524] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 49.858614][ T524] RIP: 0033:0x7f6d88f0a8f9 [ 49.863004][ T524] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 49.882951][ T524] RSP: 002b:00007f6d88972028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 49.891435][ T524] RAX: ffffffffffffffda RBX: 00007f6d89138fa0 RCX: 00007f6d88f0a8f9 [ 49.899384][ T524] RDX: 00002000000000c0 RSI: 0000000040305828 RDI: 0000000000000005 [ 49.907529][ T524] RBP: 00007f6d88f9c1bc R08: 0000000000000000 R09: 0000000000000000 [ 49.915742][ T524] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 49.923693][ T524] R13: 0000000000000000 R14: 00007f6d89138fa0 R15: 00007ffd3448ebe8 [ 49.931642][ T524] Modules linked in: [ 49.935978][ T524] ---[ end trace d265f27cc4292dd6 ]--- [ 49.941745][ T524] RIP: 0010:update_sit_entry+0x3eb/0xf50 [ 49.947609][ T524] Code: 89 45 a8 49 01 c5 41 f6 d7 41 80 e7 07 44 89 f9 41 bf 01 00 00 00 41 d3 e7 4d 89 ee 49 c1 ee 03 48 b8 00 00 00 00 00 fc ff df <41> 0f b6 04 06 84 c0 0f 85 a5 08 00 00 41 0f b6 5d 00 44 89 f8 41 [ 49.967267][ T524] RSP: 0018:ffffc90001f67330 EFLAGS: 00010246 [ 49.973341][ T524] RAX: dffffc0000000000 RBX: ffff88811abff3c8 RCX: 0000000000000007 [ 49.981324][ T524] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88811abff3c8 [ 49.989635][ T524] RBP: ffffc90001f673b0 R08: ffff88811a7b3b40 R09: 0000000000000003 [ 49.997614][ T524] R10: 00000000ffffffff R11: 0000000000000000 R12: 0000000000004000 [ 50.005614][ T524] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000080 [ 50.013708][ T524] FS: 00007f6d889726c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 50.022728][ T524] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 50.029524][ T524] CR2: 00007fba3c153000 CR3: 0000000119e54000 CR4: 00000000003506b0 [ 50.037514][ T524] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 50.045614][ T524] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 50.053724][ T524] Kernel panic - not syncing: Fatal exception [ 50.060015][ T524] Kernel Offset: disabled [ 50.064425][ T524] Rebooting in 86400 seconds..