Warning: Permanently added '10.128.0.178' (ED25519) to the list of known hosts. 2026/06/21 08:12:18 parsed 1 programs 2026/06/21 08:12:18 serving rpc on tcp://41545 [ 25.789038][ T24] audit: type=1400 audit(1782029538.540:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 25.810464][ T24] audit: type=1400 audit(1782029538.540:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 25.830387][ T24] audit: type=1400 audit(1782029538.550:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 26.737729][ T24] audit: type=1400 audit(1782029539.490:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 26.741115][ T293] cgroup: Unknown subsys name 'net' [ 26.761200][ T24] audit: type=1400 audit(1782029539.490:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.788358][ T24] audit: type=1400 audit(1782029539.520:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.788849][ T293] cgroup: Unknown subsys name 'devices' [ 26.932578][ T293] cgroup: Unknown subsys name 'hugetlb' [ 26.938210][ T293] cgroup: Unknown subsys name 'rlimit' [ 27.117428][ T24] audit: type=1400 audit(1782029539.870:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 27.140770][ T24] audit: type=1400 audit(1782029539.870:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 27.161218][ T24] audit: type=1400 audit(1782029539.870:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 27.181619][ T24] audit: type=1400 audit(1782029539.870:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 27.202060][ T297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 27.224337][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 27.619089][ T300] request_module fs-gadgetfs succeeded, but still no fs? [ 27.630854][ T300] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 28.258221][ T346] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.265383][ T346] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.273071][ T346] device bridge_slave_0 entered promiscuous mode [ 28.279913][ T346] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.287027][ T346] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.294368][ T346] device bridge_slave_1 entered promiscuous mode [ 28.334193][ T346] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.341350][ T346] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.348711][ T346] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.355827][ T346] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.373649][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.381777][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.388950][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.397744][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 28.406774][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.413849][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.423641][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 28.431929][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.438949][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.449600][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 28.462886][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 28.476233][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 28.492601][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 28.500823][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 28.508246][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 28.520341][ T346] device veth0_vlan entered promiscuous mode [ 28.530167][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 28.539261][ T346] device veth1_macvtap entered promiscuous mode [ 28.548624][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.562516][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/06/21 08:12:21 executed programs: 0 [ 28.872201][ T364] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.879372][ T364] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.887867][ T364] device bridge_slave_0 entered promiscuous mode [ 28.895123][ T364] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.902255][ T364] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.909772][ T364] device bridge_slave_1 entered promiscuous mode [ 28.954790][ T364] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.961981][ T364] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.969233][ T364] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.976330][ T364] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.994178][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.002705][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.009984][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.019132][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.027889][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.035019][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.045605][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.054544][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.061922][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.073178][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 29.081289][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.090589][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 29.098957][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.112566][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 29.120984][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 29.132286][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 29.140181][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 29.148673][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 29.156354][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 29.165641][ T364] device veth0_vlan entered promiscuous mode [ 29.175533][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 29.183672][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 29.192828][ T364] device veth1_macvtap entered promiscuous mode [ 29.201903][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 29.209519][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 29.217812][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 29.227151][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 29.235516][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 29.303693][ T394] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 29.317164][ T394] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 29.331237][ T394] EXT4-fs (loop2): 1 truncate cleaned up [ 29.336975][ T394] EXT4-fs (loop2): mounted filesystem without journal. Opts: noblock_validity,max_batch_time=0x0000000000000002,lazytime,block_validity,stripe=0x000000000000000d,nombcache,,errors=continue [ 29.362970][ T394] ================================================================== [ 29.371172][ T394] BUG: KASAN: slab-out-of-bounds in ext4_convert_inline_data_nolock+0x313/0xcc0 [ 29.380182][ T394] Read of size 68 at addr ffff888110f9bc80 by task syz.2.17/394 [ 29.387794][ T394] [ 29.390128][ T394] CPU: 1 PID: 394 Comm: syz.2.17 Not tainted syzkaller #0 [ 29.397221][ T394] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 29.407288][ T394] Call Trace: [ 29.410572][ T394] __dump_stack+0x21/0x24 [ 29.414890][ T394] dump_stack_lvl+0x1a7/0x208 [ 29.419580][ T394] ? show_regs_print_info+0x18/0x18 [ 29.424825][ T394] ? thaw_kernel_threads+0x220/0x220 [ 29.430116][ T394] print_address_description+0x7f/0x2c0 [ 29.435664][ T394] ? ext4_convert_inline_data_nolock+0x313/0xcc0 [ 29.441988][ T394] kasan_report+0x100/0x140 [ 29.446480][ T394] ? ext4_convert_inline_data_nolock+0x313/0xcc0 [ 29.452800][ T394] kasan_check_range+0x249/0x2a0 [ 29.457733][ T394] ? ext4_convert_inline_data_nolock+0x313/0xcc0 [ 29.464062][ T394] memcpy+0x2d/0x70 [ 29.467876][ T394] ext4_convert_inline_data_nolock+0x313/0xcc0 [ 29.474033][ T394] ? ext4_get_inode_loc+0x130/0x130 [ 29.479232][ T394] ? ext4_add_dirent_to_inline+0xe5/0x460 [ 29.485087][ T394] ? ext4_add_dirent_to_inline+0x460/0x460 [ 29.490889][ T394] ext4_try_add_inline_entry+0x73d/0xa70 [ 29.496753][ T394] ? ext4_da_write_inline_data_end+0x290/0x290 [ 29.502946][ T394] ? memset+0x35/0x40 [ 29.507046][ T394] ? ext4_fname_setup_ci_filename+0x69/0x480 [ 29.513164][ T394] ext4_add_entry+0x674/0xf90 [ 29.517867][ T394] ? ext4_inc_count+0x1b0/0x1b0 [ 29.522745][ T394] ? __ext4_mark_inode_dirty+0x444/0x610 [ 29.528575][ T394] ext4_mkdir+0x509/0xc60 [ 29.532906][ T394] ? ext4_symlink+0xc80/0xc80 [ 29.537607][ T394] ? security_inode_mkdir+0xbd/0x110 [ 29.542915][ T394] vfs_mkdir+0x42c/0x600 [ 29.547151][ T394] do_mkdirat+0x14c/0x340 [ 29.551475][ T394] __x64_sys_mkdirat+0x7b/0x90 [ 29.556230][ T394] do_syscall_64+0x31/0x40 [ 29.560667][ T394] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 29.566562][ T394] RIP: 0033:0x7f4982849cc7 [ 29.570971][ T394] Code: 00 66 90 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 db f7 ff ff 66 2e 0f 1f 84 00 00 00 00 00 90 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 29.590573][ T394] RSP: 002b:00007ffe47e266d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 29.599114][ T394] RAX: ffffffffffffffda RBX: 00007ffe47e26760 RCX: 00007f4982849cc7 [ 29.607089][ T394] RDX: 00000000000001ff RSI: 0000200000000080 RDI: 00000000ffffff9c [ 29.615249][ T394] RBP: 0000200000000140 R08: 0000200000000080 R09: 0000000000000000 [ 29.623239][ T394] R10: 0000200000000140 R11: 0000000000000246 R12: 0000200000000080 [ 29.631303][ T394] R13: 00007ffe47e26720 R14: 0000000000000000 R15: 0000000000000000 [ 29.639291][ T394] [ 29.641639][ T394] Allocated by task 95: [ 29.645880][ T394] __kasan_kmalloc+0xd4/0x100 [ 29.650553][ T394] kmem_cache_alloc_trace+0x179/0x2e0 [ 29.655916][ T394] kernfs_iop_get_link+0x66/0x600 [ 29.660932][ T394] vfs_readlink+0x16f/0x3e0 [ 29.665447][ T394] do_readlinkat+0x251/0x490 [ 29.670026][ T394] __x64_sys_readlink+0x7f/0x90 [ 29.674869][ T394] do_syscall_64+0x31/0x40 [ 29.679279][ T394] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 29.685164][ T394] [ 29.687488][ T394] Freed by task 95: [ 29.691290][ T394] kasan_set_track+0x4a/0x70 [ 29.695895][ T394] kasan_set_free_info+0x23/0x40 [ 29.700836][ T394] ____kasan_slab_free+0x125/0x160 [ 29.705951][ T394] __kasan_slab_free+0x11/0x20 [ 29.710798][ T394] slab_free_freelist_hook+0xc5/0x190 [ 29.716159][ T394] kfree+0xc0/0x270 [ 29.719956][ T394] kfree_link+0x15/0x20 [ 29.724105][ T394] vfs_readlink+0x220/0x3e0 [ 29.728629][ T394] do_readlinkat+0x251/0x490 [ 29.733227][ T394] __x64_sys_readlink+0x7f/0x90 [ 29.738083][ T394] do_syscall_64+0x31/0x40 [ 29.742498][ T394] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 29.748392][ T394] [ 29.750733][ T394] The buggy address belongs to the object at ffff888110f9a000 [ 29.750733][ T394] which belongs to the cache kmalloc-4k of size 4096 [ 29.764786][ T394] The buggy address is located 3200 bytes to the right of [ 29.764786][ T394] 4096-byte region [ffff888110f9a000, ffff888110f9b000) [ 29.778902][ T394] The buggy address belongs to the page: [ 29.784648][ T394] page:ffffea000443e600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x110f98 [ 29.794877][ T394] head:ffffea000443e600 order:3 compound_mapcount:0 compound_pincount:0 [ 29.803208][ T394] flags: 0x4000000000010200(slab|head) [ 29.808684][ T394] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100042c00 [ 29.817292][ T394] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 29.825868][ T394] page dumped because: kasan: bad access detected [ 29.832272][ T394] page_owner tracks the page as allocated [ 29.837988][ T394] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 107, ts 5385175749, free_ts 0 [ 29.856130][ T394] prep_new_page+0x176/0x190 [ 29.860725][ T394] get_page_from_freelist+0x225f/0x23f0 [ 29.866291][ T394] __alloc_pages_nodemask+0x29a/0x640 [ 29.871666][ T394] new_slab+0x84/0x3f0 [ 29.875757][ T394] ___slab_alloc+0x2f8/0x4c0 [ 29.880343][ T394] __slab_alloc+0x63/0xa0 [ 29.884678][ T394] kmem_cache_alloc_trace+0x1a8/0x2e0 [ 29.890046][ T394] kernfs_iop_get_link+0x66/0x600 [ 29.895068][ T394] vfs_readlink+0x16f/0x3e0 [ 29.899564][ T394] do_readlinkat+0x251/0x490 [ 29.904243][ T394] __x64_sys_readlink+0x7f/0x90 [ 29.909126][ T394] do_syscall_64+0x31/0x40 [ 29.913580][ T394] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 29.919463][ T394] page_owner free stack trace missing [ 29.924907][ T394] [ 29.927228][ T394] Memory state around the buggy address: [ 29.932887][ T394] ffff888110f9bb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.941102][ T394] ffff888110f9bc00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.949182][ T394] >ffff888110f9bc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.957232][ T394] ^ [ 29.961296][ T394] ffff888110f9bd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.969592][ T394] ffff888110f9bd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.977668][ T394] ================================================================== [ 29.985725][ T394] Disabling lock debugging due to kernel taint [ 29.997295][ T394] EXT4-fs error (device loop2): ext4_check_all_de:659: inode #12: block 7: comm syz.2.17: bad entry in directory: directory entry overrun - offset=0, inode=901261600, rec_len=7976, size=124 fake=0