Warning: Permanently added '10.128.1.40' (ED25519) to the list of known hosts. 2026/10/15 04:36:14 parsed 1 programs 2026/10/15 04:36:14 serving rpc on tcp://37963 [ 35.429811][ T30] kauditd_printk_skb: 31 callbacks suppressed [ 35.429824][ T30] audit: type=1400 audit(1792038975.543:105): avc: denied { unlink } for pid=409 comm="syz-executor" name="swap-file" dev="sda1" ino=2027 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 35.524518][ T409] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 35.931445][ T414] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.938724][ T414] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.946238][ T414] device bridge_slave_0 entered promiscuous mode [ 35.953239][ T414] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.960320][ T414] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.967750][ T414] device bridge_slave_1 entered promiscuous mode [ 36.006985][ T414] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.014110][ T414] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.021412][ T414] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.028434][ T414] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.045114][ T317] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.052386][ T317] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.060097][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 36.067887][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 36.076688][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 36.084874][ T317] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.091917][ T317] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.108909][ T414] device veth0_vlan entered promiscuous mode [ 36.116277][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 36.124602][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 36.132697][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 36.140300][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 36.147731][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 36.156407][ T317] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.163475][ T317] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.171085][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 36.179124][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 36.191624][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 36.200593][ T414] device veth1_macvtap entered promiscuous mode [ 36.210262][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 36.220253][ T317] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 36.457243][ T30] audit: type=1401 audit(1792038976.563:106): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" 2026/10/15 04:36:16 executed programs: 0 [ 36.890085][ T472] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.897312][ T472] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.905122][ T472] device bridge_slave_0 entered promiscuous mode [ 36.912407][ T472] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.919710][ T472] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.927470][ T472] device bridge_slave_1 entered promiscuous mode [ 36.961911][ T472] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.969093][ T472] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.976507][ T472] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.983851][ T472] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.992549][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.000119][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.016418][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 37.024665][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 37.038607][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 37.047098][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 37.055865][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.063073][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.072080][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 37.080775][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 37.088901][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.095945][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.111582][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 37.120010][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 37.129019][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 37.137174][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 37.155119][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 37.163505][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 37.174308][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 37.182362][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 37.190809][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 37.198537][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 37.211754][ T472] device veth0_vlan entered promiscuous mode [ 37.221461][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 37.229655][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 37.238654][ T472] device veth1_macvtap entered promiscuous mode [ 37.249384][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 37.257091][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 37.265507][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 37.274759][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 37.283287][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 37.312397][ T30] audit: type=1400 audit(1792038977.423:107): avc: denied { create } for pid=476 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 37.324227][ T477] ================================================================== [ 37.332754][ T30] audit: type=1400 audit(1792038977.423:108): avc: denied { write } for pid=476 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 37.340601][ T477] BUG: KASAN: use-after-free in __ipv6_addr_type+0x272/0x2f0 [ 37.340641][ T477] Read of size 4 at addr ffff888117e13048 by task syz.2.17/477 [ 37.340654][ T477] [ 37.360748][ T30] audit: type=1400 audit(1792038977.423:109): avc: denied { nlmsg_write } for pid=476 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 37.367974][ T477] CPU: 1 PID: 477 Comm: syz.2.17 Not tainted syzkaller #0 [ 37.406434][ T477] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 37.416913][ T477] Call Trace: [ 37.420272][ T477] [ 37.423363][ T477] __dump_stack+0x21/0x30 [ 37.427681][ T477] dump_stack_lvl+0x110/0x170 [ 37.432344][ T477] ? show_regs_print_info+0x20/0x20 [ 37.437697][ T477] ? load_image+0x3f0/0x3f0 [ 37.442347][ T477] ? __xfrm_route_forward+0x37e/0x540 [ 37.447984][ T477] print_address_description+0x7f/0x2c0 [ 37.453525][ T477] ? __ipv6_addr_type+0x272/0x2f0 [ 37.458557][ T477] kasan_report+0x10f/0x150 [ 37.463058][ T477] ? __ipv6_addr_type+0x272/0x2f0 [ 37.468067][ T477] __asan_report_load4_noabort+0x14/0x20 [ 37.473714][ T477] __ipv6_addr_type+0x272/0x2f0 [ 37.478554][ T477] ip6_forward+0xdb2/0x1ba0 [ 37.483133][ T477] ? dst_output+0x80/0x80 [ 37.487447][ T477] ? sk_setup_caps+0x400/0x400 [ 37.492274][ T477] ? ip6table_mangle_table_init+0x60/0x60 [ 37.498265][ T477] ip6_rcv_finish+0x18f/0x360 [ 37.502943][ T477] ipv6_rcv+0xed/0x230 [ 37.506994][ T477] ? ip6_rcv_finish+0x360/0x360 [ 37.511828][ T477] ? refcount_add+0x80/0x80 [ 37.516310][ T477] ? __alloc_skb+0x459/0x730 [ 37.520948][ T477] ? ip6_rcv_finish+0x360/0x360 [ 37.525885][ T477] __netif_receive_skb+0xc8/0x280 [ 37.531041][ T477] netif_receive_skb+0x98/0x3e0 [ 37.535898][ T477] ? netif_receive_skb_core+0x100/0x100 [ 37.541559][ T477] ? copy_page_from_iter+0x2b1/0x680 [ 37.546833][ T477] tun_rx_batched+0x600/0x750 [ 37.551599][ T477] ? local_bh_enable+0x30/0x30 [ 37.556379][ T477] tun_get_user+0x2809/0x33e0 [ 37.561238][ T477] ? tun_do_read+0x1d70/0x1d70 [ 37.566008][ T477] ? futex_exit_release+0x1e0/0x1e0 [ 37.571305][ T477] ? netdev_run_todo+0x8e0/0x950 [ 37.576238][ T477] ? dev_ifsioc+0x130/0xd50 [ 37.580815][ T477] ? dev_ioctl+0xd00/0xd00 [ 37.585217][ T477] ? netdev_refcnt_read+0x60/0x60 [ 37.590222][ T477] ? mutex_lock+0x9b/0x1c0 [ 37.594728][ T477] ? wait_for_completion_killable_timeout+0x10/0x10 [ 37.601309][ T477] ? avc_policy_seqno+0x1b/0x70 [ 37.606159][ T477] ? selinux_file_permission+0x2aa/0x510 [ 37.611862][ T477] tun_chr_write_iter+0x1ed/0x2f0 [ 37.616878][ T477] vfs_write+0x831/0xfd0 [ 37.621243][ T477] ? file_end_write+0x1b0/0x1b0 [ 37.626087][ T477] ? __fget_files+0x2e1/0x340 [ 37.630755][ T477] ? __fdget_pos+0x1f7/0x380 [ 37.635413][ T477] ? ksys_write+0x70/0x260 [ 37.639910][ T477] ksys_write+0x14a/0x260 [ 37.644311][ T477] ? __ia32_sys_read+0x90/0x90 [ 37.649234][ T477] ? __kasan_check_write+0x14/0x20 [ 37.654456][ T477] ? switch_fpu_return+0x15d/0x2c0 [ 37.659593][ T477] __x64_sys_write+0x7b/0x90 [ 37.664170][ T477] x64_sys_call+0x8ef/0x9a0 [ 37.668664][ T477] do_syscall_64+0x4c/0xa0 [ 37.673087][ T477] ? clear_bhb_loop+0x50/0xa0 [ 37.677769][ T477] ? clear_bhb_loop+0x50/0xa0 [ 37.682431][ T477] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 37.688486][ T477] RIP: 0033:0x7fb712061159 [ 37.693076][ T477] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 37.713016][ T477] RSP: 002b:00007fb711ec2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 37.721434][ T477] RAX: ffffffffffffffda RBX: 00007fb7122e8fa0 RCX: 00007fb712061159 [ 37.729507][ T477] RDX: 000000000000ffdd RSI: 0000200000000000 RDI: 0000000000000005 [ 37.737465][ T477] RBP: 00007fb7120f806b R08: 0000000000000000 R09: 0000000000000000 [ 37.745416][ T477] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 37.753476][ T477] R13: 00007fb7122e9038 R14: 00007fb7122e8fa0 R15: 00007ffe8dcd87c8 [ 37.761455][ T477] [ 37.764461][ T477] [ 37.766864][ T477] Allocated by task 477: [ 37.771095][ T477] __kasan_kmalloc+0xd4/0x100 [ 37.775873][ T477] __kmalloc_track_caller+0x13c/0x2c0 [ 37.781311][ T477] __alloc_skb+0x210/0x730 [ 37.785794][ T477] alloc_skb_with_frags+0xa8/0x620 [ 37.790891][ T477] sock_alloc_send_pskb+0x87f/0x9a0 [ 37.796082][ T477] tun_get_user+0xaab/0x33e0 [ 37.800950][ T477] tun_chr_write_iter+0x1ed/0x2f0 [ 37.805978][ T477] vfs_write+0x831/0xfd0 [ 37.810479][ T477] ksys_write+0x14a/0x260 [ 37.814924][ T477] __x64_sys_write+0x7b/0x90 [ 37.819497][ T477] x64_sys_call+0x8ef/0x9a0 [ 37.823984][ T477] do_syscall_64+0x4c/0xa0 [ 37.828501][ T477] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 37.834378][ T477] [ 37.836692][ T477] Freed by task 477: [ 37.840561][ T477] kasan_set_track+0x4a/0x70 [ 37.845224][ T477] kasan_set_free_info+0x23/0x40 [ 37.850141][ T477] ____kasan_slab_free+0x125/0x160 [ 37.855335][ T477] __kasan_slab_free+0x11/0x20 [ 37.860079][ T477] slab_free_freelist_hook+0xc2/0x190 [ 37.865533][ T477] kfree+0xc4/0x270 [ 37.869518][ T477] pskb_expand_head+0x394/0x1280 [ 37.874442][ T477] __pskb_pull_tail+0xba/0x1570 [ 37.879314][ T477] __xfrm_decode_session+0x5b0/0x1de0 [ 37.884942][ T477] __xfrm_route_forward+0x115/0x540 [ 37.890218][ T477] ip6_forward+0xca5/0x1ba0 [ 37.894741][ T477] ip6_rcv_finish+0x18f/0x360 [ 37.899423][ T477] ipv6_rcv+0xed/0x230 [ 37.903578][ T477] __netif_receive_skb+0xc8/0x280 [ 37.908594][ T477] netif_receive_skb+0x98/0x3e0 [ 37.913426][ T477] tun_rx_batched+0x600/0x750 [ 37.918289][ T477] tun_get_user+0x2809/0x33e0 [ 37.923088][ T477] tun_chr_write_iter+0x1ed/0x2f0 [ 37.928300][ T477] vfs_write+0x831/0xfd0 [ 37.932720][ T477] ksys_write+0x14a/0x260 [ 37.937031][ T477] __x64_sys_write+0x7b/0x90 [ 37.942154][ T477] x64_sys_call+0x8ef/0x9a0 [ 37.946642][ T477] do_syscall_64+0x4c/0xa0 [ 37.951129][ T477] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 37.957183][ T477] [ 37.959595][ T477] The buggy address belongs to the object at ffff888117e13000 [ 37.959595][ T477] which belongs to the cache kmalloc-512 of size 512 [ 37.973975][ T477] The buggy address is located 72 bytes inside of [ 37.973975][ T477] 512-byte region [ffff888117e13000, ffff888117e13200) [ 37.987722][ T477] The buggy address belongs to the page: [ 37.993379][ T477] page:ffffea00045f8400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x117e10 [ 38.003796][ T477] head:ffffea00045f8400 order:2 compound_mapcount:0 compound_pincount:0 [ 38.012225][ T477] flags: 0x4000000000010200(slab|head|zone=1) [ 38.018315][ T477] raw: 4000000000010200 ffffea000461f500 0000000200000002 ffff888100042f00 [ 38.027112][ T477] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 38.035675][ T477] page dumped because: kasan: bad access detected [ 38.042068][ T477] page_owner tracks the page as allocated [ 38.047949][ T477] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 114, ts 4674548150, free_ts 0 [ 38.066243][ T477] post_alloc_hook+0x192/0x1b0 [ 38.071182][ T477] prep_new_page+0x1c/0x110 [ 38.075765][ T477] get_page_from_freelist+0x2c3a/0x2cd0 [ 38.081674][ T477] __alloc_pages+0x1a2/0x460 [ 38.086436][ T477] new_slab+0xa0/0x4d0 [ 38.090495][ T477] ___slab_alloc+0x3ac/0x840 [ 38.095249][ T477] __slab_alloc+0x49/0x90 [ 38.099572][ T477] __kmalloc_track_caller+0x169/0x2c0 [ 38.105015][ T477] __alloc_skb+0x210/0x730 [ 38.109501][ T477] alloc_skb_with_frags+0xa8/0x620 [ 38.114776][ T477] sock_alloc_send_pskb+0x87f/0x9a0 [ 38.120046][ T477] unix_dgram_sendmsg+0x6f3/0x19b0 [ 38.125268][ T477] sock_write_iter+0x2a6/0x3a0 [ 38.130530][ T477] vfs_write+0x831/0xfd0 [ 38.134767][ T477] ksys_write+0x14a/0x260 [ 38.139369][ T477] __x64_sys_write+0x7b/0x90 [ 38.143942][ T477] page_owner free stack trace missing [ 38.149285][ T477] [ 38.151595][ T477] Memory state around the buggy address: [ 38.157208][ T477] ffff888117e12f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 38.165246][ T477] ffff888117e12f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 38.173577][ T477] >ffff888117e13000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 38.181905][ T477] ^ [ 38.188527][ T477] ffff888117e13080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 38.196914][ T477] ffff888117e13100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 38.205139][ T477] ================================================================== [ 38.213280][ T477] Disabling lock debugging due to kernel taint [ 38.232140][ T30] audit: type=1400 audit(1792038978.343:110): avc: denied { read } for pid=83 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 38.254438][ T30] audit: type=1400 audit(1792038978.343:111): avc: denied { search } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 38.276986][ T30] audit: type=1400 audit(1792038978.343:112): avc: denied { write } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 38.298528][ T30] audit: type=1400 audit(1792038978.343:113): avc: denied { add_name } for pid=83 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 38.325079][ T30] audit: type=1400 audit(1792038978.343:114): avc: denied { create } for pid=83 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 38.560375][ T317] device bridge_slave_1 left promiscuous mode [ 38.567418][ T317] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.575081][ T317] device bridge_slave_0 left promiscuous mode [ 38.581552][ T317] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.590452][ T317] device veth1_macvtap left promiscuous mode [ 38.596602][ T317] device veth0_vlan left promiscuous mode 2026/10/15 04:36:21 executed programs: 44 2026/10/15 04:36:27 executed programs: 100