Warning: Permanently added '10.128.1.78' (ED25519) to the list of known hosts. 2026/10/11 20:44:00 parsed 1 programs 2026/10/11 20:44:00 serving rpc on tcp://35669 [ 40.748424][ T28] kauditd_printk_skb: 32 callbacks suppressed [ 40.748441][ T28] audit: type=1400 audit(1791751441.430:106): avc: denied { unlink } for pid=413 comm="syz-executor" name="swap-file" dev="sda1" ino=2027 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 40.881433][ T413] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 41.815789][ T432] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.822907][ T432] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.830507][ T432] device bridge_slave_0 entered promiscuous mode [ 41.838394][ T432] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.845451][ T432] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.853057][ T432] device bridge_slave_1 entered promiscuous mode [ 41.900933][ T432] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.908043][ T432] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.915458][ T432] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.923258][ T432] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.944191][ T318] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.951515][ T318] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.959579][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 41.967057][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 41.977002][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 41.985720][ T318] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.993167][ T318] bridge0: port 1(bridge_slave_0) entered forwarding state [ 42.002106][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 42.010440][ T318] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.017674][ T318] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.032477][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 42.042379][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 42.056932][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 42.069699][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 42.078034][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 42.085526][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 42.094200][ T432] device veth0_vlan entered promiscuous mode [ 42.107786][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 42.118053][ T432] device veth1_macvtap entered promiscuous mode [ 42.128248][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 42.139024][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 42.603577][ T28] audit: type=1401 audit(1791751443.280:107): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" 2026/10/11 20:44:03 executed programs: 0 [ 42.879670][ T475] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.886993][ T475] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.894869][ T475] device bridge_slave_0 entered promiscuous mode [ 42.902079][ T475] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.909299][ T475] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.917208][ T475] device bridge_slave_1 entered promiscuous mode [ 42.964668][ T475] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.971971][ T475] bridge0: port 2(bridge_slave_1) entered forwarding state [ 42.979852][ T475] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.986917][ T475] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.008327][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 43.016027][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.023490][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.032803][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 43.041368][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.048551][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.057400][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 43.065931][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.073138][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.086247][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 43.096301][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 43.111512][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 43.123337][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 43.131583][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 43.139487][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 43.148383][ T475] device veth0_vlan entered promiscuous mode [ 43.170661][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 43.180262][ T475] device veth1_macvtap entered promiscuous mode [ 43.191206][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 43.210615][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 43.236246][ T28] audit: type=1400 audit(1791751443.910:108): avc: denied { mount } for pid=479 comm="syz.2.17" name="/" dev="configfs" ino=13519 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 43.243588][ T480] ================================================================== [ 43.264507][ T28] audit: type=1400 audit(1791751443.910:109): avc: denied { search } for pid=479 comm="syz.2.17" name="/" dev="configfs" ino=13519 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 43.267597][ T480] BUG: KASAN: invalid-free in __kmem_cache_free+0xb7/0x1b0 [ 43.290419][ T28] audit: type=1400 audit(1791751443.910:110): avc: denied { write } for pid=479 comm="syz.2.17" name="usb_gadget" dev="configfs" ino=13520 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 43.297356][ T480] Free of addr ffff88811d642413 by task syz.2.17/480 [ 43.320727][ T28] audit: type=1400 audit(1791751443.910:111): avc: denied { add_name } for pid=479 comm="syz.2.17" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 43.327482][ T480] [ 43.327494][ T480] CPU: 1 PID: 480 Comm: syz.2.17 Not tainted syzkaller #0 [ 43.351572][ T28] audit: type=1400 audit(1791751443.910:112): avc: denied { create } for pid=479 comm="syz.2.17" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 43.357100][ T480] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 43.377510][ T28] audit: type=1400 audit(1791751443.920:113): avc: denied { write } for pid=479 comm="syz.2.17" name="c_srate" dev="configfs" ino=17476 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 43.387084][ T480] Call Trace: [ 43.387096][ T480] [ 43.387105][ T480] __dump_stack+0x21/0x24 [ 43.410327][ T28] audit: type=1400 audit(1791751443.920:114): avc: denied { open } for pid=479 comm="syz.2.17" path="/0/config/usb_gadget/g1/functions/uac1.usb0/c_srate" dev="configfs" ino=17476 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 43.413023][ T480] dump_stack_lvl+0x110/0x170 [ 43.451296][ T480] ? __cfi_dump_stack_lvl+0x8/0x8 [ 43.456456][ T480] print_address_description+0x71/0x200 [ 43.462207][ T480] print_report+0x4a/0x60 [ 43.466643][ T480] ? __kmem_cache_free+0xb7/0x1b0 [ 43.471688][ T480] kasan_report_invalid_free+0xd5/0xf0 [ 43.477179][ T480] ? __kmem_cache_free+0xb7/0x1b0 [ 43.482357][ T480] ? __kmem_cache_free+0xb7/0x1b0 [ 43.487407][ T480] ____kasan_slab_free+0x14f/0x180 [ 43.492547][ T480] __kasan_slab_free+0x11/0x20 [ 43.497327][ T480] slab_free_freelist_hook+0xc2/0x190 [ 43.502809][ T480] ? f_uac1_opts_c_srate_store+0x220/0x2a0 [ 43.508722][ T480] __kmem_cache_free+0xb7/0x1b0 [ 43.513703][ T480] kfree+0x6f/0xf0 [ 43.517524][ T480] f_uac1_opts_c_srate_store+0x220/0x2a0 [ 43.523275][ T480] ? __cfi_f_uac1_opts_c_srate_store+0x10/0x10 [ 43.529445][ T480] ? down_read+0xa6/0xf0 [ 43.533713][ T480] ? __cfi_down_read+0x10/0x10 [ 43.538485][ T480] ? avc_policy_seqno+0x1b/0x70 [ 43.543362][ T480] ? selinux_file_permission+0x2a5/0x510 [ 43.549021][ T480] configfs_write_iter+0x323/0x410 [ 43.554152][ T480] ? __cfi_f_uac1_opts_c_srate_store+0x10/0x10 [ 43.560493][ T480] vfs_write+0x5ef/0xd00 [ 43.564777][ T480] ? __cfi_vfs_write+0x10/0x10 [ 43.569556][ T480] ? __cfi_mutex_lock+0x10/0x10 [ 43.574433][ T480] ? __fdget_pos+0x2cd/0x380 [ 43.579135][ T480] ? ksys_write+0x70/0x260 [ 43.583668][ T480] ksys_write+0x14a/0x260 [ 43.588273][ T480] ? __cfi_ksys_write+0x10/0x10 [ 43.593254][ T480] ? fpregs_restore_userregs+0x128/0x260 [ 43.599017][ T480] __x64_sys_write+0x7b/0x90 [ 43.603985][ T480] x64_sys_call+0x27b/0x9a0 [ 43.608541][ T480] do_syscall_64+0x4c/0xa0 [ 43.612989][ T480] ? clear_bhb_loop+0x30/0x80 [ 43.617701][ T480] ? clear_bhb_loop+0x30/0x80 [ 43.622398][ T480] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 43.628347][ T480] RIP: 0033:0x7f072c39e159 [ 43.632976][ T480] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 43.652868][ T480] RSP: 002b:00007f072d2c3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 43.661428][ T480] RAX: ffffffffffffffda RBX: 00007f072c625fa0 RCX: 00007f072c39e159 [ 43.669696][ T480] RDX: 0000000000000029 RSI: 0000200000000040 RDI: 0000000000000003 [ 43.678008][ T480] RBP: 00007f072c43503b R08: 0000000000000000 R09: 0000000000000000 [ 43.686026][ T480] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 43.694211][ T480] R13: 00007f072c626038 R14: 00007f072c625fa0 R15: 00007ffd4b0cae98 [ 43.702465][ T480] [ 43.705503][ T480] [ 43.707839][ T480] Allocated by task 480: [ 43.712092][ T480] kasan_set_track+0x4b/0x70 [ 43.716716][ T480] kasan_save_alloc_info+0x1f/0x30 [ 43.721850][ T480] __kasan_kmalloc+0x95/0xb0 [ 43.726467][ T480] __kmalloc_node_track_caller+0xb1/0x1e0 [ 43.732212][ T480] kstrdup+0x3b/0x80 [ 43.736306][ T480] f_uac1_opts_c_srate_store+0x11a/0x2a0 [ 43.742133][ T480] configfs_write_iter+0x323/0x410 [ 43.747354][ T480] vfs_write+0x5ef/0xd00 [ 43.751613][ T480] ksys_write+0x14a/0x260 [ 43.755997][ T480] __x64_sys_write+0x7b/0x90 [ 43.760592][ T480] x64_sys_call+0x27b/0x9a0 [ 43.765113][ T480] do_syscall_64+0x4c/0xa0 [ 43.769718][ T480] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 43.775621][ T480] [ 43.778042][ T480] The buggy address belongs to the object at ffff88811d642400 [ 43.778042][ T480] which belongs to the cache kmalloc-64 of size 64 [ 43.792476][ T480] The buggy address is located 19 bytes inside of [ 43.792476][ T480] 64-byte region [ffff88811d642400, ffff88811d642440) [ 43.805606][ T480] [ 43.807939][ T480] The buggy address belongs to the physical page: [ 43.814813][ T480] page:ffffea0004759080 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11d642 [ 43.825253][ T480] flags: 0x4000000000000200(slab|zone=1) [ 43.831059][ T480] raw: 4000000000000200 0000000000000000 dead000000000122 ffff888100042780 [ 43.840016][ T480] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 43.848609][ T480] page dumped because: kasan: bad access detected [ 43.855066][ T480] page_owner tracks the page as allocated [ 43.861305][ T480] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 475, tgid 475 (syz-executor), ts 43225678352, free_ts 43225503342 [ 43.879815][ T480] post_alloc_hook+0x1f5/0x210 [ 43.884632][ T480] prep_new_page+0x1c/0x110 [ 43.889240][ T480] get_page_from_freelist+0x2ca9/0x2d20 [ 43.894806][ T480] __alloc_pages+0x1fa/0x610 [ 43.899424][ T480] alloc_slab_page+0x6e/0xf0 [ 43.904089][ T480] new_slab+0x98/0x3e0 [ 43.908191][ T480] ___slab_alloc+0x70f/0xb70 [ 43.912798][ T480] __slab_alloc+0x5e/0xa0 [ 43.917301][ T480] __kmem_cache_alloc_node+0x204/0x2d0 [ 43.922960][ T480] __kmalloc_node+0xa2/0x1e0 [ 43.927656][ T480] kvmalloc_node+0x28a/0x460 [ 43.932319][ T480] simple_xattr_alloc+0x43/0xa0 [ 43.937188][ T480] shmem_initxattrs+0x8d/0x1e0 [ 43.941999][ T480] security_inode_init_security+0x295/0x3c0 [ 43.947947][ T480] shmem_mknod+0xb8/0x1d0 [ 43.952310][ T480] shmem_mkdir+0x2f/0x60 [ 43.956582][ T480] page last free stack trace: [ 43.961343][ T480] free_unref_page_prepare+0x81b/0x820 [ 43.966814][ T480] free_unref_page+0x93/0x530 [ 43.971519][ T480] __free_pages+0x67/0x100 [ 43.975960][ T480] free_pages+0x82/0x90 [ 43.980129][ T480] selinux_genfs_get_sid+0x20b/0x250 [ 43.985429][ T480] inode_doinit_with_dentry+0x884/0xd90 [ 43.991078][ T480] sb_finish_set_opts+0x6ef/0xa10 [ 43.996120][ T480] selinux_set_mnt_opts+0x12eb/0x17a0 [ 44.001595][ T480] security_sb_set_mnt_opts+0x83/0xe0 [ 44.006997][ T480] vfs_get_tree+0x15f/0x270 [ 44.011507][ T480] do_new_mount+0x251/0xb40 [ 44.016017][ T480] path_mount+0x640/0xfd0 [ 44.020375][ T480] __se_sys_mount+0x320/0x390 [ 44.025165][ T480] __x64_sys_mount+0xbf/0xd0 [ 44.029787][ T480] x64_sys_call+0x65d/0x9a0 [ 44.034298][ T480] do_syscall_64+0x4c/0xa0 [ 44.038741][ T480] [ 44.041066][ T480] Memory state around the buggy address: [ 44.046692][ T480] ffff88811d642300: 00 00 00 00 00 00 00 03 fc fc fc fc fc fc fc fc [ 44.054756][ T480] ffff88811d642380: 00 00 00 00 00 00 00 03 fc fc fc fc fc fc fc fc [ 44.062820][ T480] >ffff88811d642400: 00 00 00 00 00 02 fc fc fc fc fc fc fc fc fc fc [ 44.070905][ T480] ^ [ 44.075542][ T480] ffff88811d642480: 00 00 00 00 00 00 00 03 fc fc fc fc fc fc fc fc [ 44.083620][ T480] ffff88811d642500: 00 00 00 00 00 00 00 03 fc fc fc fc fc fc fc fc [ 44.091706][ T480] ================================================================== [ 44.105722][ T28] audit: type=1400 audit(1791751444.780:115): avc: denied { read } for pid=84 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 44.115734][ T480] Disabling lock debugging due to kernel taint [ 44.448830][ T41] device bridge_slave_1 left promiscuous mode [ 44.455440][ T41] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.464123][ T41] device bridge_slave_0 left promiscuous mode [ 44.470955][ T41] bridge0: port 1(bridge_slave_0) entered disabled state [ 44.479540][ T41] device veth1_macvtap left promiscuous mode [ 44.485666][ T41] device veth0_vlan left promiscuous mode 2026/10/11 20:44:08 executed programs: 222 2026/10/11 20:44:13 executed programs: 520