Warning: Permanently added '10.128.1.74' (ED25519) to the list of known hosts. 2026/11/06 14:19:35 parsed 1 programs 2026/11/06 14:19:35 serving rpc on tcp://35105 Setting up swapspace version 1, size = 127995904 bytes [ 33.602274][ T28] kauditd_printk_skb: 32 callbacks suppressed [ 33.602288][ T28] audit: type=1400 audit(1793974776.135:106): avc: denied { unlink } for pid=411 comm="syz-executor" name="swap-file" dev="sda1" ino=2027 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 33.648218][ T411] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 34.352160][ T28] audit: type=1400 audit(1793974776.885:107): avc: denied { create } for pid=425 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 34.472983][ T28] audit: type=1401 audit(1793974777.005:108): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 34.650621][ T442] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.657803][ T442] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.665332][ T442] device bridge_slave_0 entered promiscuous mode [ 34.672393][ T442] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.679613][ T442] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.687132][ T442] device bridge_slave_1 entered promiscuous mode [ 34.723007][ T442] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.730191][ T442] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.737844][ T442] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.745055][ T442] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.763485][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 34.771241][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.778520][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.788264][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 34.796913][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.804147][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.812813][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 34.821104][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.828445][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.840571][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 34.849900][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 34.863556][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 34.876198][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 34.884546][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 34.892409][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 34.900737][ T442] device veth0_vlan entered promiscuous mode [ 34.910650][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 34.920033][ T442] device veth1_macvtap entered promiscuous mode [ 34.929474][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 34.939805][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/11/06 14:19:37 executed programs: 0 [ 35.464238][ T477] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.471466][ T477] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.479002][ T477] device bridge_slave_0 entered promiscuous mode [ 35.489311][ T477] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.496711][ T477] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.504545][ T477] device bridge_slave_1 entered promiscuous mode [ 35.557417][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 35.565205][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 35.574133][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 35.583550][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 35.592072][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.599280][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.607641][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 35.620332][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 35.628800][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 35.637518][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.644768][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.656428][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 35.664925][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 35.679002][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 35.687864][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 35.700859][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 35.709481][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 35.720782][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 35.728802][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 35.737893][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 35.745740][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 35.753981][ T477] device veth0_vlan entered promiscuous mode [ 35.763858][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 35.772139][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 35.781322][ T477] device veth1_macvtap entered promiscuous mode [ 35.792523][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 35.800927][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 35.810735][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 35.819686][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 35.847716][ T28] audit: type=1400 audit(1793974778.375:109): avc: denied { mount } for pid=481 comm="syz.2.17" name="/" dev="configfs" ino=13420 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 35.850512][ T482] ================================================================== [ 35.872568][ T28] audit: type=1400 audit(1793974778.375:110): avc: denied { search } for pid=481 comm="syz.2.17" name="/" dev="configfs" ino=13420 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 35.878748][ T482] BUG: KASAN: invalid-free in __kmem_cache_free+0xb7/0x1b0 [ 35.902176][ T28] audit: type=1400 audit(1793974778.375:111): avc: denied { write } for pid=481 comm="syz.2.17" name="usb_gadget" dev="configfs" ino=13421 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 35.909242][ T482] Free of addr ffff8881188fde18 by task syz.2.17/482 [ 35.932765][ T28] audit: type=1400 audit(1793974778.375:112): avc: denied { add_name } for pid=481 comm="syz.2.17" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 35.938970][ T482] [ 35.938977][ T482] CPU: 1 PID: 482 Comm: syz.2.17 Not tainted syzkaller #0 [ 35.959618][ T28] audit: type=1400 audit(1793974778.375:113): avc: denied { create } for pid=481 comm="syz.2.17" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 35.961578][ T482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 35.969599][ T28] audit: type=1400 audit(1793974778.375:114): avc: denied { write } for pid=481 comm="syz.2.17" name="p_srate" dev="configfs" ino=17489 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 35.988708][ T482] Call Trace: [ 35.988718][ T482] [ 35.988723][ T482] __dump_stack+0x21/0x24 [ 35.988744][ T482] dump_stack_lvl+0x110/0x170 [ 35.988758][ T482] ? __cfi_dump_stack_lvl+0x8/0x8 [ 35.988773][ T482] print_address_description+0x71/0x200 [ 35.999693][ T28] audit: type=1400 audit(1793974778.375:115): avc: denied { open } for pid=481 comm="syz.2.17" path="/0/myconfig/usb_gadget/g1/functions/uac2.usb0/p_srate" dev="configfs" ino=17489 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 36.021970][ T482] print_report+0x4a/0x60 [ 36.022000][ T482] ? __kmem_cache_free+0xb7/0x1b0 [ 36.022020][ T482] kasan_report_invalid_free+0xd5/0xf0 [ 36.022038][ T482] ? __kmem_cache_free+0xb7/0x1b0 [ 36.095750][ T482] ? __kmem_cache_free+0xb7/0x1b0 [ 36.100816][ T482] ____kasan_slab_free+0x14f/0x180 [ 36.106010][ T482] __kasan_slab_free+0x11/0x20 [ 36.110783][ T482] slab_free_freelist_hook+0xc2/0x190 [ 36.116421][ T482] ? f_uac2_opts_p_srate_store+0x220/0x2a0 [ 36.122353][ T482] __kmem_cache_free+0xb7/0x1b0 [ 36.127353][ T482] kfree+0x6f/0xf0 [ 36.131180][ T482] f_uac2_opts_p_srate_store+0x220/0x2a0 [ 36.137014][ T482] ? __cfi_f_uac2_opts_p_srate_store+0x10/0x10 [ 36.143611][ T482] ? down_read+0xa6/0xf0 [ 36.147867][ T482] ? __cfi_down_read+0x10/0x10 [ 36.152709][ T482] ? avc_policy_seqno+0x1b/0x70 [ 36.157645][ T482] ? selinux_file_permission+0x2a5/0x510 [ 36.163495][ T482] configfs_write_iter+0x323/0x410 [ 36.168634][ T482] ? __cfi_f_uac2_opts_p_srate_store+0x10/0x10 [ 36.175080][ T482] vfs_write+0x5ef/0xd00 [ 36.179410][ T482] ? __cfi_vfs_write+0x10/0x10 [ 36.184188][ T482] ? __cfi_mutex_lock+0x10/0x10 [ 36.189133][ T482] ? __fdget_pos+0x2cd/0x380 [ 36.193978][ T482] ? ksys_write+0x70/0x260 [ 36.198387][ T482] ksys_write+0x14a/0x260 [ 36.202702][ T482] ? __cfi_ksys_write+0x10/0x10 [ 36.207783][ T482] ? fpregs_restore_userregs+0x128/0x260 [ 36.213522][ T482] __x64_sys_write+0x7b/0x90 [ 36.218232][ T482] x64_sys_call+0x27b/0x9a0 [ 36.222907][ T482] do_syscall_64+0x4c/0xa0 [ 36.227436][ T482] ? clear_bhb_loop+0x30/0x80 [ 36.232337][ T482] ? clear_bhb_loop+0x30/0x80 [ 36.237208][ T482] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 36.243288][ T482] RIP: 0033:0x7f9dc3f9e019 [ 36.247825][ T482] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 36.267627][ T482] RSP: 002b:00007f9dc4dd8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 36.276418][ T482] RAX: ffffffffffffffda RBX: 00007f9dc4225fa0 RCX: 00007f9dc3f9e019 [ 36.284477][ T482] RDX: 0000000000000055 RSI: 0000200000000340 RDI: 0000000000000003 [ 36.292453][ T482] RBP: 00007f9dc403500c R08: 0000000000000000 R09: 0000000000000000 [ 36.300652][ T482] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 36.308721][ T482] R13: 00007f9dc4226038 R14: 00007f9dc4225fa0 R15: 00007ffc3cfab8d8 [ 36.317364][ T482] [ 36.320558][ T482] [ 36.322865][ T482] Allocated by task 482: [ 36.327112][ T482] kasan_set_track+0x4b/0x70 [ 36.331774][ T482] kasan_save_alloc_info+0x1f/0x30 [ 36.337061][ T482] __kasan_kmalloc+0x95/0xb0 [ 36.341666][ T482] __kmalloc_node_track_caller+0xb1/0x1e0 [ 36.347494][ T482] kstrdup+0x3b/0x80 [ 36.351783][ T482] f_uac2_opts_p_srate_store+0x11a/0x2a0 [ 36.357518][ T482] configfs_write_iter+0x323/0x410 [ 36.363244][ T482] vfs_write+0x5ef/0xd00 [ 36.367489][ T482] ksys_write+0x14a/0x260 [ 36.372075][ T482] __x64_sys_write+0x7b/0x90 [ 36.376674][ T482] x64_sys_call+0x27b/0x9a0 [ 36.381478][ T482] do_syscall_64+0x4c/0xa0 [ 36.386242][ T482] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 36.392564][ T482] [ 36.395087][ T482] Last potentially related work creation: [ 36.401740][ T482] kasan_save_stack+0x3a/0x60 [ 36.406629][ T482] __kasan_record_aux_stack+0xb6/0xc0 [ 36.413007][ T482] kasan_record_aux_stack_noalloc+0xb/0x10 [ 36.419174][ T482] kvfree_call_rcu+0x8b/0x7a0 [ 36.424746][ T482] kernfs_unlink_open_file+0x34e/0x400 [ 36.430576][ T482] kernfs_fop_release+0x230/0x2f0 [ 36.435600][ T482] __fput+0x1fd/0x8f0 [ 36.439581][ T482] ____fput+0x15/0x20 [ 36.443992][ T482] task_work_run+0x1e1/0x250 [ 36.448961][ T482] exit_to_user_mode_loop+0x9b/0xb0 [ 36.454329][ T482] exit_to_user_mode_prepare+0x87/0xd0 [ 36.460231][ T482] syscall_exit_to_user_mode+0x1a/0x30 [ 36.465875][ T482] do_syscall_64+0x58/0xa0 [ 36.470347][ T482] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 36.476289][ T482] [ 36.478717][ T482] The buggy address belongs to the object at ffff8881188fde00 [ 36.478717][ T482] which belongs to the cache kmalloc-96 of size 96 [ 36.493008][ T482] The buggy address is located 24 bytes inside of [ 36.493008][ T482] 96-byte region [ffff8881188fde00, ffff8881188fde60) [ 36.506211][ T482] [ 36.508563][ T482] The buggy address belongs to the physical page: [ 36.514959][ T482] page:ffffea0004623f40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1188fd [ 36.525551][ T482] flags: 0x4000000000000200(slab|zone=1) [ 36.531194][ T482] raw: 4000000000000200 ffffea0004635b40 dead000000000004 ffff888100042900 [ 36.540123][ T482] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 36.548952][ T482] page dumped because: kasan: bad access detected [ 36.555683][ T482] page_owner tracks the page as allocated [ 36.561388][ T482] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 116, tgid 116 (udevd), ts 5178378071, free_ts 0 [ 36.577984][ T482] post_alloc_hook+0x1f5/0x210 [ 36.582831][ T482] prep_new_page+0x1c/0x110 [ 36.588489][ T482] get_page_from_freelist+0x2ca9/0x2d20 [ 36.594142][ T482] __alloc_pages+0x1fa/0x610 [ 36.599008][ T482] alloc_slab_page+0x6e/0xf0 [ 36.603611][ T482] new_slab+0x98/0x3e0 [ 36.607955][ T482] ___slab_alloc+0x70f/0xb70 [ 36.612974][ T482] __slab_alloc+0x5e/0xa0 [ 36.617568][ T482] __kmem_cache_alloc_node+0x204/0x2d0 [ 36.623210][ T482] kmalloc_trace+0x29/0xb0 [ 36.628084][ T482] kernfs_fop_open+0x706/0xb80 [ 36.633190][ T482] do_dentry_open+0x885/0x11f0 [ 36.638125][ T482] vfs_open+0x73/0x80 [ 36.642282][ T482] path_openat+0x2699/0x2f30 [ 36.647074][ T482] do_filp_open+0x1ee/0x420 [ 36.651642][ T482] do_sys_openat2+0x15e/0x820 [ 36.656688][ T482] page_owner free stack trace missing [ 36.662729][ T482] [ 36.665044][ T482] Memory state around the buggy address: [ 36.671094][ T482] ffff8881188fdd00: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 36.679234][ T482] ffff8881188fdd80: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc [ 36.687372][ T482] >ffff8881188fde00: 00 00 00 00 00 00 00 00 00 03 fc fc fc fc fc fc [ 36.695503][ T482] ^ [ 36.700336][ T482] ffff8881188fde80: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 36.708443][ T482] ffff8881188fdf00: 00 00 00 00 00 00 00 00 00 01 fc fc fc fc fc fc [ 36.716756][ T482] ================================================================== [ 36.732672][ T482] Disabling lock debugging due to kernel taint [ 37.152587][ T8] device bridge_slave_1 left promiscuous mode [ 37.158821][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.166350][ T8] device bridge_slave_0 left promiscuous mode [ 37.172661][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.180512][ T8] device veth1_macvtap left promiscuous mode [ 37.186900][ T8] device veth0_vlan left promiscuous mode 2026/11/06 14:19:43 executed programs: 222 2026/11/06 14:19:48 executed programs: 519