Warning: Permanently added '10.128.0.81' (ED25519) to the list of known hosts. 2026/09/20 22:29:17 parsed 1 programs 2026/09/20 22:29:17 serving rpc on tcp://46475 Setting up swapspace version 1, size = 127995904 bytes [ 37.366289][ T29] kauditd_printk_skb: 34 callbacks suppressed [ 37.366297][ T29] audit: type=1400 audit(1789943358.110:108): avc: denied { unlink } for pid=394 comm="syz-executor" name="swap-file" dev="sda1" ino=2027 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 37.422086][ T394] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 37.952210][ T29] audit: type=1401 audit(1789943358.690:109): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 38.024279][ T432] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.031495][ T432] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.038913][ T432] device bridge_slave_0 entered promiscuous mode [ 38.046805][ T432] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.053830][ T432] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.061211][ T432] device bridge_slave_1 entered promiscuous mode [ 38.098145][ T432] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.105195][ T432] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.112509][ T432] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.119549][ T432] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.135868][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 38.143420][ T339] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.150668][ T339] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.160793][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 38.168914][ T339] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.175954][ T339] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.184321][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 38.192621][ T339] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.199772][ T339] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.211726][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 38.220726][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 38.238821][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 38.247234][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 38.255125][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 38.262642][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 38.270459][ T432] device veth0_vlan entered promiscuous mode [ 38.280626][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 38.289598][ T432] device veth1_macvtap entered promiscuous mode [ 38.299475][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 38.309193][ T339] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/09/20 22:29:19 executed programs: 0 [ 38.510527][ T447] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.517705][ T447] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.525010][ T447] device bridge_slave_0 entered promiscuous mode [ 38.532363][ T447] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.539493][ T447] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.546878][ T447] device bridge_slave_1 entered promiscuous mode [ 38.587003][ T447] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.594058][ T447] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.601354][ T447] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.608390][ T447] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.629999][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 38.637616][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.644827][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.654273][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 38.662451][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.669537][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.682016][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 38.690252][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.697301][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.708707][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 38.721836][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 38.734864][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 38.751706][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 38.759663][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 38.767479][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 38.775864][ T447] device veth0_vlan entered promiscuous mode [ 38.784903][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 38.798085][ T447] device veth1_macvtap entered promiscuous mode [ 38.807039][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 38.816810][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 38.836610][ T29] audit: type=1400 audit(1789943359.580:110): avc: denied { mount } for pid=451 comm="syz.2.17" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 38.856801][ T452] ================================================================== [ 38.866229][ T452] BUG: KASAN: slab-out-of-bounds in firmware_param_path_get+0xe2/0xf0 [ 38.874394][ T452] Write of size 1 at addr ffff88811367dfff by task syz.2.17/452 [ 38.882013][ T452] [ 38.884327][ T452] CPU: 1 PID: 452 Comm: syz.2.17 Not tainted syzkaller #0 [ 38.891417][ T452] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 38.901495][ T452] Call Trace: [ 38.904783][ T452] [ 38.907702][ T452] dump_stack_lvl+0x38/0x49 [ 38.912193][ T452] print_address_description.constprop.0+0x24/0x160 [ 38.918768][ T452] ? firmware_param_path_get+0xe2/0xf0 [ 38.924209][ T452] kasan_report.cold+0x82/0xdb [ 38.929148][ T452] ? firmware_param_path_get+0xe2/0xf0 [ 38.934690][ T452] __asan_report_store1_noabort+0x17/0x20 [ 38.940484][ T452] firmware_param_path_get+0xe2/0xf0 [ 38.945760][ T452] param_attr_show+0x130/0x1f0 [ 38.950683][ T452] ? func_ptr_is_kernel_text+0x90/0x90 [ 38.956124][ T452] module_attr_show+0x3f/0x70 [ 38.960786][ T452] sysfs_kf_seq_show+0x218/0x430 [ 38.965729][ T452] ? mutex_lock+0x84/0x1e0 [ 38.970144][ T452] kernfs_seq_show+0x146/0x1b0 [ 38.974890][ T452] seq_read_iter+0x3fd/0x1020 [ 38.979570][ T452] kernfs_fop_read_iter+0x3e0/0x550 [ 38.984753][ T452] new_sync_read+0x353/0x6d0 [ 38.989333][ T452] ? ksys_lseek+0x140/0x140 [ 38.993835][ T452] ? selinux_file_permission+0x2f1/0x3f0 [ 38.999455][ T452] vfs_read+0x34a/0x4b0 [ 39.003597][ T452] ksys_read+0x111/0x210 [ 39.007835][ T452] ? vfs_write+0x8e0/0x8e0 [ 39.012251][ T452] ? do_futex+0x13b0/0x13b0 [ 39.016754][ T452] __x64_sys_read+0x6e/0xb0 [ 39.021239][ T452] ? arch_exit_to_user_mode_prepare.constprop.0+0xa2/0xb0 [ 39.028333][ T452] x64_sys_call+0x982/0x990 [ 39.032826][ T452] do_syscall_64+0x33/0x80 [ 39.037247][ T452] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 39.043125][ T452] RIP: 0033:0x7fa5ad35ef99 [ 39.047528][ T452] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 39.067122][ T452] RSP: 002b:00007fa5ad1c0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 39.075569][ T452] RAX: ffffffffffffffda RBX: 00007fa5ad5e6fa0 RCX: 00007fa5ad35ef99 [ 39.083559][ T452] RDX: 000000000000204e RSI: 0000200000002440 RDI: 0000000000000003 [ 39.091525][ T452] RBP: 00007fa5ad3f5ec4 R08: 0000000000000000 R09: 0000000000000000 [ 39.099484][ T452] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 39.107544][ T452] R13: 00007fa5ad5e7038 R14: 00007fa5ad5e6fa0 R15: 00007fff9c181ec8 [ 39.115508][ T452] [ 39.118537][ T452] [ 39.120854][ T452] Allocated by task 402: [ 39.125082][ T452] kasan_save_stack+0x26/0x50 [ 39.129897][ T452] __kasan_kmalloc+0xae/0xe0 [ 39.134476][ T452] kmem_cache_alloc_trace+0x30c/0x4e0 [ 39.139840][ T452] kernfs_iop_get_link+0x5d/0x620 [ 39.144850][ T452] step_into+0x146c/0x1e50 [ 39.149259][ T452] path_openat+0x40f/0x4180 [ 39.153750][ T452] do_filp_open+0x1ab/0x3f0 [ 39.158236][ T452] do_sys_openat2+0x135/0x8f0 [ 39.163053][ T452] __x64_sys_openat+0x124/0x200 [ 39.167933][ T452] x64_sys_call+0x2eb/0x990 [ 39.172503][ T452] do_syscall_64+0x33/0x80 [ 39.176919][ T452] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 39.182804][ T452] [ 39.185188][ T452] Freed by task 402: [ 39.189071][ T452] kasan_save_stack+0x26/0x50 [ 39.193744][ T452] kasan_set_track+0x25/0x30 [ 39.198328][ T452] kasan_set_free_info+0x24/0x40 [ 39.203256][ T452] __kasan_slab_free+0x111/0x150 [ 39.208186][ T452] slab_free_freelist_hook+0x94/0x1a0 [ 39.213556][ T452] kfree+0xc2/0x2a0 [ 39.217352][ T452] kfree_link+0x9/0x10 [ 39.221407][ T452] path_openat+0xb93/0x4180 [ 39.225896][ T452] do_filp_open+0x1ab/0x3f0 [ 39.230384][ T452] do_sys_openat2+0x135/0x8f0 [ 39.235046][ T452] __x64_sys_openat+0x124/0x200 [ 39.240054][ T452] x64_sys_call+0x2eb/0x990 [ 39.244631][ T452] do_syscall_64+0x33/0x80 [ 39.249028][ T452] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 39.254905][ T452] [ 39.257215][ T452] The buggy address belongs to the object at ffff88811367c000 [ 39.257215][ T452] which belongs to the cache kmalloc-4k of size 4096 [ 39.271251][ T452] The buggy address is located 4095 bytes to the right of [ 39.271251][ T452] 4096-byte region [ffff88811367c000, ffff88811367d000) [ 39.285298][ T452] The buggy address belongs to the page: [ 39.290914][ T452] page:ffffea00044d9e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113678 [ 39.301173][ T452] head:ffffea00044d9e00 order:3 compound_mapcount:0 compound_pincount:0 [ 39.309483][ T452] flags: 0x4000000000010200(slab|head|zone=1) [ 39.315566][ T452] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043380 [ 39.324259][ T452] raw: 0000000000000000 0000000080040004 00000001ffffffff 0000000000000000 [ 39.332824][ T452] page dumped because: kasan: bad access detected [ 39.339224][ T452] page_owner tracks the page as allocated [ 39.344995][ T452] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 107, ts 4610107504, free_ts 0 [ 39.363041][ T452] prep_new_page+0x1a2/0x310 [ 39.367641][ T452] get_page_from_freelist+0x1ce2/0x30a0 [ 39.373183][ T452] __alloc_pages+0x300/0x2d60 [ 39.377857][ T452] allocate_slab+0x39d/0x530 [ 39.382446][ T452] ___slab_alloc.constprop.0+0x3ca/0x890 [ 39.388073][ T452] __slab_alloc.constprop.0+0x42/0x80 [ 39.393426][ T452] __kmalloc+0x505/0x550 [ 39.397667][ T452] kvmalloc_node+0x1f3/0x230 [ 39.402252][ T452] seq_read_iter+0x684/0x1020 [ 39.406911][ T452] kernfs_fop_read_iter+0x3e0/0x550 [ 39.412114][ T452] new_sync_read+0x353/0x6d0 [ 39.416688][ T452] vfs_read+0x34a/0x4b0 [ 39.420843][ T452] ksys_read+0x111/0x210 [ 39.425064][ T452] __x64_sys_read+0x6e/0xb0 [ 39.429548][ T452] x64_sys_call+0x982/0x990 [ 39.434031][ T452] do_syscall_64+0x33/0x80 [ 39.438476][ T452] page_owner free stack trace missing [ 39.443825][ T452] [ 39.446137][ T452] Memory state around the buggy address: [ 39.451763][ T452] ffff88811367de80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.459808][ T452] ffff88811367df00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.467862][ T452] >ffff88811367df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 39.475914][ T452] ^ [ 39.483888][ T452] ffff88811367e000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 39.491930][ T452] ffff88811367e080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 39.499972][ T452] ================================================================== [ 39.508017][ T452] Disabling lock debugging due to kernel taint [ 39.518344][ T29] audit: type=1400 audit(1789943360.260:111): avc: denied { read } for pid=78 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 39.544550][ T29] audit: type=1400 audit(1789943360.260:112): avc: denied { search } for pid=78 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 39.566409][ T29] audit: type=1400 audit(1789943360.260:113): avc: denied { write } for pid=78 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 39.587943][ T29] audit: type=1400 audit(1789943360.260:114): avc: denied { add_name } for pid=78 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 39.609379][ T29] audit: type=1400 audit(1789943360.260:115): avc: denied { create } for pid=78 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 39.630091][ T29] audit: type=1400 audit(1789943360.260:116): avc: denied { append open } for pid=78 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 39.653203][ T29] audit: type=1400 audit(1789943360.260:117): avc: denied { getattr } for pid=78 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 40.358054][ T52] device bridge_slave_1 left promiscuous mode [ 40.364200][ T52] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.374308][ T52] device bridge_slave_0 left promiscuous mode [ 40.385814][ T52] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.393474][ T52] device veth1_macvtap left promiscuous mode [ 40.399680][ T52] device veth0_vlan left promiscuous mode 2026/09/20 22:29:24 executed programs: 233 2026/09/20 22:29:29 executed programs: 533