Warning: Permanently added '10.128.0.157' (ED25519) to the list of known hosts. 2026/08/23 09:50:09 parsed 1 programs [ 33.854858][ T24] kauditd_printk_skb: 30 callbacks suppressed [ 33.854870][ T24] audit: type=1400 audit(1787478610.150:104): avc: denied { unlink } for pid=432 comm="syz-executor" name="swap-file" dev="sda1" ino=2027 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 33.978903][ T432] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 34.451166][ T24] audit: type=1401 audit(1787478610.750:105): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 34.544992][ T24] audit: type=1400 audit(1787478610.840:106): avc: denied { create } for pid=446 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 34.635891][ T454] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.643747][ T454] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.651551][ T454] device bridge_slave_0 entered promiscuous mode [ 34.658431][ T454] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.665878][ T454] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.673379][ T454] device bridge_slave_1 entered promiscuous mode [ 34.703604][ T454] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.710663][ T454] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.717991][ T454] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.725234][ T454] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.742187][ T339] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.749757][ T339] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.758678][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 34.767190][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 34.777408][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 34.786888][ T339] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.794056][ T339] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.804279][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 34.812636][ T339] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.820228][ T339] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.831698][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 34.842462][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 34.856612][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 34.868178][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 34.876808][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 34.885358][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 34.894437][ T454] device veth0_vlan entered promiscuous mode [ 34.903946][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 34.913301][ T454] device veth1_macvtap entered promiscuous mode [ 34.922615][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 34.936990][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/08/23 09:50:11 executed programs: 0 [ 35.478979][ T24] audit: type=1400 audit(1787478611.770:107): avc: denied { write } for pid=423 comm="syz-execprog" path="pipe:[15496]" dev="pipefs" ino=15496 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 35.520890][ T493] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.527998][ T493] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.536129][ T493] device bridge_slave_0 entered promiscuous mode [ 35.543694][ T493] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.550757][ T493] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.558368][ T493] device bridge_slave_1 entered promiscuous mode [ 35.594279][ T493] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.602035][ T493] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.609404][ T493] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.616672][ T493] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.636365][ T458] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 35.644302][ T458] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.652115][ T458] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.660721][ T458] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 35.669650][ T458] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 35.678125][ T458] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.685196][ T458] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.693909][ T7] device bridge_slave_1 left promiscuous mode [ 35.700330][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.707786][ T7] device bridge_slave_0 left promiscuous mode [ 35.714119][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.722088][ T7] device veth1_macvtap left promiscuous mode [ 35.728093][ T7] device veth0_vlan left promiscuous mode [ 35.806654][ T458] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 35.815441][ T458] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 35.823608][ T458] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.830668][ T458] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.841668][ T458] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 35.849820][ T458] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 35.860860][ T458] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 35.869492][ T458] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 35.882028][ T458] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 35.890724][ T458] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 35.901873][ T458] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 35.909902][ T458] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 35.917940][ T458] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 35.925975][ T458] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 35.934404][ T493] device veth0_vlan entered promiscuous mode [ 35.943990][ T458] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 35.952602][ T458] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 35.963051][ T493] device veth1_macvtap entered promiscuous mode [ 35.975479][ T458] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 35.983315][ T458] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 35.992133][ T458] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 36.005892][ T458] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 36.015753][ T458] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 36.103537][ T498] EXT4-fs (loop2): 1 orphan inode deleted [ 36.109756][ T498] EXT4-fs (loop2): mounted filesystem without journal. Opts: errors=remount-ro,nodiscard,noquota,init_itable,stripe=0x0000000000000079,resgid=0x0000000000000000,sysvgroups,bsddf,lazytime, [ 36.129002][ T24] audit: type=1400 audit(1787478612.420:108): avc: denied { mount } for pid=497 comm="syz.2.16" name="/" dev="loop2" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 36.129024][ T498] ext4 filesystem being mounted at /0/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 36.162550][ T24] audit: type=1400 audit(1787478612.460:109): avc: denied { write } for pid=497 comm="syz.2.16" name="/" dev="loop2" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 36.184123][ T24] audit: type=1400 audit(1787478612.460:110): avc: denied { add_name } for pid=497 comm="syz.2.16" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 36.205033][ T24] audit: type=1400 audit(1787478612.460:111): avc: denied { create } for pid=497 comm="syz.2.16" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 36.225973][ T24] audit: type=1400 audit(1787478612.460:112): avc: denied { write open } for pid=497 comm="syz.2.16" path="/0/file1/bus" dev="loop2" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 36.250618][ T24] audit: type=1400 audit(1787478612.460:113): avc: denied { read } for pid=497 comm="syz.2.16" name="bus" dev="loop2" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 36.250661][ T502] ================================================================== [ 36.280231][ T502] BUG: KASAN: use-after-free in ext4_find_extent+0xbfb/0xe30 [ 36.287914][ T502] Read of size 4 at addr ffff88812ba77f08 by task syz.2.16/502 [ 36.295540][ T502] [ 36.297959][ T502] CPU: 1 PID: 502 Comm: syz.2.16 Not tainted syzkaller #0 [ 36.305269][ T502] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 36.315319][ T502] Call Trace: [ 36.318752][ T502] __dump_stack+0x21/0x24 [ 36.323317][ T502] dump_stack_lvl+0x1a7/0x208 [ 36.328008][ T502] ? show_regs_print_info+0x18/0x18 [ 36.333292][ T502] ? thaw_kernel_threads+0x220/0x220 [ 36.338594][ T502] print_address_description+0x7f/0x2c0 [ 36.344337][ T502] ? ext4_find_extent+0xbfb/0xe30 [ 36.349476][ T502] kasan_report+0x100/0x140 [ 36.354092][ T502] ? __read_extent_tree_block+0x1e4/0x780 [ 36.361508][ T502] ? ext4_find_extent+0xbfb/0xe30 [ 36.366540][ T502] __asan_report_load4_noabort+0x14/0x20 [ 36.372618][ T502] ext4_find_extent+0xbfb/0xe30 [ 36.377620][ T502] ext4_ext_remove_space+0x2ed/0x42d0 [ 36.383333][ T502] ? __kasan_slab_free+0x11/0x20 [ 36.388661][ T502] ? _raw_write_trylock+0x150/0x150 [ 36.394021][ T502] ? ext4_ext_index_trans_blocks+0x100/0x100 [ 36.400000][ T502] ? ext4_da_release_space+0x184/0x420 [ 36.406118][ T502] ? ext4_es_remove_extent+0x229/0x370 [ 36.411583][ T502] ext4_punch_hole+0x6f1/0xac0 [ 36.416442][ T502] ext4_fallocate+0x275/0x1a60 [ 36.421432][ T502] ? fsnotify_perm+0x66/0x4a0 [ 36.426112][ T502] ? preempt_count_add+0x90/0x1b0 [ 36.431167][ T502] vfs_fallocate+0x4b9/0x590 [ 36.435846][ T502] __x64_sys_fallocate+0xc0/0x110 [ 36.440931][ T502] do_syscall_64+0x31/0x40 [ 36.445762][ T502] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 36.451836][ T502] RIP: 0033:0x7f3ba3461479 [ 36.456449][ T502] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 36.476517][ T502] RSP: 002b:00007f3ba2ea8028 EFLAGS: 00000246 ORIG_RAX: 000000000000011d [ 36.485333][ T502] RAX: ffffffffffffffda RBX: 00007f3ba3690080 RCX: 00007f3ba3461479 [ 36.493368][ T502] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004 [ 36.501464][ T502] RBP: 00007f3ba34f21bc R08: 0000000000000000 R09: 0000000000000000 [ 36.509441][ T502] R10: 0000000000001a00 R11: 0000000000000246 R12: 0000000000000000 [ 36.517950][ T502] R13: 0000000000000000 R14: 00007f3ba3690080 R15: 00007ffc2092ebc8 [ 36.526147][ T502] [ 36.528857][ T502] The buggy address belongs to the page: [ 36.534959][ T502] page:ffffea0004ae9dc0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12ba77 [ 36.545476][ T502] flags: 0x4000000000000000() [ 36.550147][ T502] raw: 4000000000000000 ffffea0004ae9dc8 ffffea0004ae9dc8 0000000000000000 [ 36.559037][ T502] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 36.567923][ T502] page dumped because: kasan: bad access detected [ 36.574355][ T502] page_owner info is not present (never set?) [ 36.580677][ T502] [ 36.582998][ T502] Memory state around the buggy address: [ 36.588616][ T502] ffff88812ba77e00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 36.597081][ T502] ffff88812ba77e80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 36.605157][ T502] >ffff88812ba77f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 36.613290][ T502] ^ [ 36.617627][ T502] ffff88812ba77f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 36.625673][ T502] ffff88812ba78000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 36.634240][ T502] ================================================================== [ 36.642288][ T502] Disabling lock debugging due to kernel taint [ 36.649623][ T502] ------------[ cut here ]------------ [ 36.655158][ T502] kernel BUG at fs/ext4/extents.c:3199! [ 36.660730][ T502] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 36.666954][ T502] CPU: 1 PID: 502 Comm: syz.2.16 Tainted: G B syzkaller #0 [ 36.675718][ T502] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 36.685907][ T502] RIP: 0010:ext4_split_extent_at+0xe1d/0xe40 [ 36.691966][ T502] Code: fb ff ff 89 d9 80 e1 07 fe c1 38 c1 0f 8c f7 fb ff ff 48 89 df 49 89 f5 e8 00 dc d2 ff 4c 89 ee e9 e4 fb ff ff e8 a3 66 98 ff <0f> 0b e8 9c 66 98 ff 0f 0b e8 95 66 98 ff 0f 0b e8 8e 66 98 ff 0f [ 36.711998][ T502] RSP: 0018:ffffc90002f87960 EFLAGS: 00010293 [ 36.718475][ T502] RAX: ffffffff81cc4b1d RBX: 1ffff11025758fc1 RCX: ffff88811775cf00 [ 36.726804][ T502] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 [ 36.735390][ T502] RBP: ffffc90002f87ab0 R08: 0000000000000000 R09: 0000000050000028 [ 36.743750][ T502] R10: dffffc0000000000 R11: fffffbfff0dcf848 R12: 0000000000000000 [ 36.752019][ T502] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 36.760744][ T502] FS: 00007f3ba2ea86c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 36.769847][ T502] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.776567][ T502] CR2: 00007f3ba34aebc0 CR3: 00000001186a9000 CR4: 00000000003506a0 [ 36.784618][ T502] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 36.793983][ T502] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 36.802355][ T502] Call Trace: [ 36.805827][ T502] ? __asan_report_load2_noabort+0x14/0x20 [ 36.811851][ T502] ? ext4_ext_try_to_merge_right+0x830/0x830 [ 36.818118][ T502] ext4_ext_remove_space+0x629/0x42d0 [ 36.823487][ T502] ? __kasan_slab_free+0x11/0x20 [ 36.828416][ T502] ? _raw_write_trylock+0x150/0x150 [ 36.833611][ T502] ? ext4_ext_index_trans_blocks+0x100/0x100 [ 36.840243][ T502] ? ext4_da_release_space+0x184/0x420 [ 36.846236][ T502] ? ext4_es_remove_extent+0x229/0x370 [ 36.852516][ T502] ext4_punch_hole+0x6f1/0xac0 [ 36.857448][ T502] ext4_fallocate+0x275/0x1a60 [ 36.862704][ T502] ? fsnotify_perm+0x66/0x4a0 [ 36.867670][ T502] ? preempt_count_add+0x90/0x1b0 [ 36.872813][ T502] vfs_fallocate+0x4b9/0x590 [ 36.878463][ T502] __x64_sys_fallocate+0xc0/0x110 [ 36.883766][ T502] do_syscall_64+0x31/0x40 [ 36.888391][ T502] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 36.894401][ T502] RIP: 0033:0x7f3ba3461479 [ 36.898903][ T502] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 36.919421][ T502] RSP: 002b:00007f3ba2ea8028 EFLAGS: 00000246 ORIG_RAX: 000000000000011d [ 36.928180][ T502] RAX: ffffffffffffffda RBX: 00007f3ba3690080 RCX: 00007f3ba3461479 [ 36.936566][ T502] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004 [ 36.944745][ T502] RBP: 00007f3ba34f21bc R08: 0000000000000000 R09: 0000000000000000 [ 36.953350][ T502] R10: 0000000000001a00 R11: 0000000000000246 R12: 0000000000000000 [ 36.961514][ T502] R13: 0000000000000000 R14: 00007f3ba3690080 R15: 00007ffc2092ebc8 [ 36.969761][ T502] Modules linked in: [ 36.975541][ T502] ---[ end trace 9182fbeb6e08c9a1 ]--- [ 36.981574][ T502] RIP: 0010:ext4_split_extent_at+0xe1d/0xe40 [ 36.988062][ T502] Code: fb ff ff 89 d9 80 e1 07 fe c1 38 c1 0f 8c f7 fb ff ff 48 89 df 49 89 f5 e8 00 dc d2 ff 4c 89 ee e9 e4 fb ff ff e8 a3 66 98 ff <0f> 0b e8 9c 66 98 ff 0f 0b e8 95 66 98 ff 0f 0b e8 8e 66 98 ff 0f [ 37.008547][ T502] RSP: 0018:ffffc90002f87960 EFLAGS: 00010293 [ 37.014820][ T502] RAX: ffffffff81cc4b1d RBX: 1ffff11025758fc1 RCX: ffff88811775cf00 [ 37.023429][ T502] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 [ 37.031776][ T502] RBP: ffffc90002f87ab0 R08: 0000000000000000 R09: 0000000050000028 [ 37.040082][ T502] R10: dffffc0000000000 R11: fffffbfff0dcf848 R12: 0000000000000000 [ 37.048438][ T502] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 37.057237][ T502] FS: 00007f3ba2ea86c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 37.066290][ T502] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.072919][ T502] CR2: 00007fccc5ae7000 CR3: 00000001186a9000 CR4: 00000000003506b0 [ 37.080940][ T502] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 37.088980][ T502] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 37.097101][ T502] Kernel panic - not syncing: Fatal exception [ 37.103479][ T502] Kernel Offset: disabled [ 37.107918][ T502] Rebooting in 86400 seconds..