Warning: Permanently added '10.128.1.215' (ED25519) to the list of known hosts. 2026/01/17 07:51:31 parsed 1 programs [ 46.254377][ T24] kauditd_printk_skb: 30 callbacks suppressed [ 46.254390][ T24] audit: type=1400 audit(1768636292.090:104): avc: denied { unlink } for pid=416 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 46.354639][ T416] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 47.096162][ T443] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.103248][ T443] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.110798][ T443] device bridge_slave_0 entered promiscuous mode [ 47.117691][ T443] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.124723][ T443] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.132141][ T443] device bridge_slave_1 entered promiscuous mode [ 47.166244][ T443] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.173320][ T443] bridge0: port 2(bridge_slave_1) entered forwarding state [ 47.180713][ T443] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.187765][ T443] bridge0: port 1(bridge_slave_0) entered forwarding state [ 47.205066][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 47.212690][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.220142][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.230275][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 47.238480][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.245516][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 47.254281][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 47.262586][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.269739][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 47.282492][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 47.291573][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 47.305623][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 47.316551][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 47.324828][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 47.332284][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 47.340575][ T443] device veth0_vlan entered promiscuous mode [ 47.350549][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 47.362924][ T443] device veth1_macvtap entered promiscuous mode [ 47.372669][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 47.382657][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 47.444055][ T24] audit: type=1400 audit(1768636293.280:105): avc: denied { create } for pid=454 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 47.569319][ T24] audit: type=1401 audit(1768636293.410:106): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" 2026/01/17 07:51:33 executed programs: 0 [ 47.859479][ T24] audit: type=1400 audit(1768636293.700:107): avc: denied { write } for pid=407 comm="syz-execprog" path="pipe:[15534]" dev="pipefs" ino=15534 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 47.913343][ T476] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.920480][ T476] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.927897][ T476] device bridge_slave_0 entered promiscuous mode [ 47.935022][ T476] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.942171][ T476] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.949519][ T476] device bridge_slave_1 entered promiscuous mode [ 47.987365][ T476] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.994404][ T476] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.002161][ T476] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.009230][ T476] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.029770][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 48.037347][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.044495][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.053286][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 48.061496][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.068623][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.082382][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 48.090974][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 48.099520][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.106579][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.118599][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 48.126797][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 48.137356][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 48.145464][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 48.159961][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 48.168292][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 48.179096][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 48.187389][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 48.195826][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 48.203498][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 48.211227][ T476] device veth0_vlan entered promiscuous mode [ 48.221981][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 48.230301][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 48.239590][ T476] device veth1_macvtap entered promiscuous mode [ 48.249857][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 48.257947][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 48.266101][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 48.275684][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 48.284010][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 48.428187][ T481] F2FS-fs (loop2): fault_injection options not supported [ 48.436429][ T481] F2FS-fs (loop2): invalid crc value [ 48.443295][ T481] F2FS-fs (loop2): Found nat_bits in checkpoint [ 48.474805][ T481] F2FS-fs (loop2): Start checkpoint disabled! [ 48.482018][ T481] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 48.490691][ T24] audit: type=1400 audit(1768636294.330:108): avc: denied { mount } for pid=480 comm="syz.2.16" name="/" dev="loop2" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 48.517352][ T24] audit: type=1400 audit(1768636294.350:109): avc: denied { write } for pid=480 comm="syz.2.16" name="/" dev="loop2" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 48.538898][ T24] audit: type=1400 audit(1768636294.350:110): avc: denied { add_name } for pid=480 comm="syz.2.16" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 48.559409][ T24] audit: type=1400 audit(1768636294.350:111): avc: denied { create } for pid=480 comm="syz.2.16" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 48.580157][ T24] audit: type=1400 audit(1768636294.350:112): avc: denied { write open } for pid=480 comm="syz.2.16" path="/0/file0/file0" dev="loop2" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 48.603054][ T24] audit: type=1400 audit(1768636294.350:113): avc: denied { ioctl } for pid=480 comm="syz.2.16" path="/0/file0/file0" dev="loop2" ino=10 ioctlcmd=0xf50d scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 48.658872][ T49] attempt to access beyond end of device [ 48.658872][ T49] loop2: rw=2049, want=40968, limit=40427 [ 48.940287][ T487] F2FS-fs (loop2): fault_injection options not supported [ 48.948422][ T487] F2FS-fs (loop2): invalid crc value [ 48.954687][ T487] F2FS-fs (loop2): Found nat_bits in checkpoint [ 48.987840][ T487] F2FS-fs (loop2): Start checkpoint disabled! [ 48.994697][ T487] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 49.057497][ T7] attempt to access beyond end of device [ 49.057497][ T7] loop2: rw=2049, want=40968, limit=40427 [ 49.088595][ T294] device bridge_slave_1 left promiscuous mode [ 49.094773][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.102428][ T294] device bridge_slave_0 left promiscuous mode [ 49.108661][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.116789][ T294] device veth1_macvtap left promiscuous mode [ 49.123321][ T294] device veth0_vlan left promiscuous mode [ 49.457672][ T492] F2FS-fs (loop2): fault_injection options not supported [ 49.465941][ T492] F2FS-fs (loop2): invalid crc value [ 49.472438][ T492] F2FS-fs (loop2): Found nat_bits in checkpoint [ 49.503663][ T492] F2FS-fs (loop2): Start checkpoint disabled! [ 49.510412][ T492] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 49.576933][ T7] attempt to access beyond end of device [ 49.576933][ T7] loop2: rw=2049, want=45104, limit=40427 [ 49.854592][ T497] F2FS-fs (loop2): fault_injection options not supported [ 49.867246][ T497] F2FS-fs (loop2): invalid crc value [ 49.874743][ T497] F2FS-fs (loop2): Found nat_bits in checkpoint [ 49.901928][ T497] F2FS-fs (loop2): Start checkpoint disabled! [ 49.908816][ T497] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 49.968773][ T294] attempt to access beyond end of device [ 49.968773][ T294] loop2: rw=2049, want=40968, limit=40427 [ 50.225406][ T502] F2FS-fs (loop2): fault_injection options not supported [ 50.234904][ T502] F2FS-fs (loop2): invalid crc value [ 50.242387][ T502] F2FS-fs (loop2): Found nat_bits in checkpoint [ 50.271828][ T502] F2FS-fs (loop2): Start checkpoint disabled! [ 50.278670][ T502] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 50.337134][ T294] attempt to access beyond end of device [ 50.337134][ T294] loop2: rw=2049, want=40968, limit=40427 [ 50.619679][ T507] F2FS-fs (loop2): fault_injection options not supported [ 50.627820][ T507] F2FS-fs (loop2): invalid crc value [ 50.634153][ T507] F2FS-fs (loop2): Found nat_bits in checkpoint [ 50.663734][ T507] F2FS-fs (loop2): Start checkpoint disabled! [ 50.670576][ T507] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 50.729163][ T294] attempt to access beyond end of device [ 50.729163][ T294] loop2: rw=2049, want=40968, limit=40427 [ 50.989668][ T512] F2FS-fs (loop2): fault_injection options not supported [ 50.997851][ T512] F2FS-fs (loop2): invalid crc value [ 51.004130][ T512] F2FS-fs (loop2): Found nat_bits in checkpoint [ 51.033638][ T512] F2FS-fs (loop2): Start checkpoint disabled! [ 51.040491][ T512] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 51.098549][ T294] attempt to access beyond end of device [ 51.098549][ T294] loop2: rw=2049, want=40968, limit=40427 [ 51.404812][ T517] F2FS-fs (loop2): fault_injection options not supported [ 51.412964][ T517] F2FS-fs (loop2): invalid crc value [ 51.419512][ T517] F2FS-fs (loop2): Found nat_bits in checkpoint [ 51.448603][ T517] F2FS-fs (loop2): Start checkpoint disabled! [ 51.455408][ T517] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 51.501482][ T517] ------------[ cut here ]------------ [ 51.507043][ T517] WARNING: CPU: 0 PID: 517 at fs/f2fs/segment.c:2582 new_curseg+0xe4f/0x1880 [ 51.515796][ T517] Modules linked in: [ 51.519750][ T517] CPU: 0 PID: 517 Comm: syz.2.23 Not tainted syzkaller #0 [ 51.527011][ T517] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 51.537123][ T517] RIP: 0010:new_curseg+0xe4f/0x1880 [ 51.542347][ T517] Code: 0b 4c 8b bd 30 ff ff ff 4c 89 ff be 08 00 00 00 e8 66 d0 91 ff f0 41 80 0f 04 41 b5 01 45 89 f7 e9 4d fb ff ff e8 f1 51 57 ff <0f> 0b 4c 8b a5 30 ff ff ff 4c 89 e7 be 08 00 00 00 e8 3b d0 91 ff [ 51.562013][ T517] RSP: 0018:ffffc90002617718 EFLAGS: 00010293 [ 51.568138][ T517] RAX: ffffffff820d625f RBX: ffff88810d798018 RCX: ffff888119f24f00 [ 51.576107][ T517] RDX: 0000000000000000 RSI: 0000000000000018 RDI: 0000000000000018 [ 51.584246][ T517] RBP: ffffc90002617808 R08: 0000000000000003 R09: 0000000000000004 [ 51.592249][ T517] R10: dffffc0000000000 R11: fffff520004c2ed4 R12: 0000000000000018 [ 51.600248][ T517] R13: 1ffff11021af3003 R14: 0000000000000018 R15: 000000000000000f [ 51.608250][ T517] FS: 00007f872d6fe6c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 51.617258][ T517] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 51.623849][ T517] CR2: 0000001b3175ffff CR3: 00000001276fb000 CR4: 00000000003506b0 [ 51.631848][ T517] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 51.639935][ T517] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 51.647934][ T517] Call Trace: [ 51.651232][ T517] __allocate_new_segment+0x13d/0x810 [ 51.656627][ T517] f2fs_allocate_new_section+0x1f3/0x290 [ 51.662314][ T517] ? new_curseg+0x1880/0x1880 [ 51.667028][ T517] ? __kasan_check_write+0x14/0x20 [ 51.672129][ T517] ? down_read_trylock+0x106/0x160 [ 51.677332][ T517] ? __init_rwsem+0x1c0/0x1c0 [ 51.682020][ T517] ? has_not_enough_free_secs+0x3d7/0x8a0 [ 51.687787][ T517] expand_inode_data+0x5f7/0x9a0 [ 51.692736][ T517] ? f2fs_insert_range+0x5d0/0x5d0 [ 51.697879][ T517] ? inode_dio_wait+0x25a/0x2d0 [ 51.702767][ T517] ? file_update_time+0x3d7/0x440 [ 51.707835][ T517] ? inode_owner_or_capable+0x140/0x140 [ 51.713397][ T517] f2fs_fallocate+0x42b/0x7e0 [ 51.718112][ T517] vfs_fallocate+0x4b4/0x590 [ 51.722759][ T517] do_vfs_ioctl+0x1154/0x14c0 [ 51.727472][ T517] ? __ia32_compat_sys_ioctl+0x8e0/0x8e0 [ 51.733116][ T517] ? has_cap_mac_admin+0x370/0x370 [ 51.738269][ T517] ? kmem_cache_free+0x100/0x2d0 [ 51.743210][ T517] ? selinux_file_ioctl+0x3a0/0x4d0 [ 51.748644][ T517] ? putname+0xfe/0x150 [ 51.752810][ T517] ? selinux_file_alloc_security+0x120/0x120 [ 51.758920][ T517] ? do_sys_openat2+0x68e/0x750 [ 51.763765][ T517] ? __fget_files+0x2c4/0x320 [ 51.768483][ T517] ? security_file_ioctl+0x84/0xa0 [ 51.773601][ T517] __se_sys_ioctl+0x9f/0x1a0 [ 51.778246][ T517] __x64_sys_ioctl+0x7b/0x90 [ 51.782860][ T517] do_syscall_64+0x31/0x40 [ 51.787308][ T517] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 51.793207][ T517] RIP: 0033:0x7f872dc980b9 [ 51.797665][ T517] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 51.817296][ T517] RSP: 002b:00007f872d6fe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 51.825700][ T517] RAX: ffffffffffffffda RBX: 00007f872dec4fa0 RCX: 00007f872dc980b9 [ 51.833736][ T517] RDX: 00002000000000c0 RSI: 0000000040305828 RDI: 0000000000000005 [ 51.841844][ T517] RBP: 00007f872dd2a9c4 R08: 0000000000000000 R09: 0000000000000000 [ 51.849858][ T517] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 51.857861][ T517] R13: 0000000000000000 R14: 00007f872dec4fa0 R15: 00007ffd6d85c0d8 [ 51.865840][ T517] ---[ end trace 330fe63ab8936b59 ]--- [ 51.871437][ T517] ------------[ cut here ]------------ [ 51.876939][ T517] WARNING: CPU: 0 PID: 517 at fs/f2fs/segment.c:2636 new_curseg+0x14a6/0x1880 [ 51.885790][ T517] Modules linked in: [ 51.889724][ T517] CPU: 0 PID: 517 Comm: syz.2.23 Tainted: G W syzkaller #0 [ 51.898247][ T517] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 51.908707][ T517] RIP: 0010:new_curseg+0x14a6/0x1880 [ 51.914003][ T517] Code: ff e8 be 4b 57 ff 0f 0b 4c 8b 75 d0 49 8d 7e 78 be 08 00 00 00 e8 0a ca 91 ff f0 41 80 4e 78 04 e9 d4 ed ff ff e8 9a 4b 57 ff <0f> 0b 48 8b 5d d0 48 8d 7b 78 be 08 00 00 00 e8 e6 c9 91 ff f0 80 [ 51.933683][ T517] RSP: 0018:ffffc90002617718 EFLAGS: 00010293 [ 51.939800][ T517] RAX: ffffffff820d68b6 RBX: ffff888106381601 RCX: ffff888119f24f00 [ 51.947814][ T517] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 [ 51.955800][ T517] RBP: ffffc90002617808 R08: ffff8881063816bf R09: 1ffff11020c702d7 [ 51.963821][ T517] R10: dffffc0000000000 R11: ffffed1020c702d8 R12: 0000000000000000 [ 51.971931][ T517] R13: 0000000000000018 R14: 0000000000000001 R15: 0000000000000018 [ 51.979954][ T517] FS: 00007f872d6fe6c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 51.988903][ T517] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 51.995487][ T517] CR2: 0000001b3175ffff CR3: 00000001276fb000 CR4: 00000000003506b0 [ 52.003521][ T517] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 52.011752][ T517] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 52.019785][ T517] Call Trace: [ 52.023096][ T517] __allocate_new_segment+0x13d/0x810 [ 52.028518][ T517] f2fs_allocate_new_section+0x1f3/0x290 [ 52.034161][ T517] ? new_curseg+0x1880/0x1880 [ 52.038893][ T517] ? __kasan_check_write+0x14/0x20 [ 52.044046][ T517] ? down_read_trylock+0x106/0x160 [ 52.049186][ T517] ? __init_rwsem+0x1c0/0x1c0 [ 52.053897][ T517] ? has_not_enough_free_secs+0x3d7/0x8a0 [ 52.059667][ T517] expand_inode_data+0x5f7/0x9a0 [ 52.064619][ T517] ? f2fs_insert_range+0x5d0/0x5d0 [ 52.069776][ T517] ? inode_dio_wait+0x25a/0x2d0 [ 52.074652][ T517] ? file_update_time+0x3d7/0x440 [ 52.079733][ T517] ? inode_owner_or_capable+0x140/0x140 [ 52.085286][ T517] f2fs_fallocate+0x42b/0x7e0 [ 52.090005][ T517] vfs_fallocate+0x4b4/0x590 [ 52.094617][ T517] do_vfs_ioctl+0x1154/0x14c0 [ 52.099375][ T517] ? __ia32_compat_sys_ioctl+0x8e0/0x8e0 [ 52.105025][ T517] ? has_cap_mac_admin+0x370/0x370 [ 52.110223][ T517] ? kmem_cache_free+0x100/0x2d0 [ 52.115173][ T517] ? selinux_file_ioctl+0x3a0/0x4d0 [ 52.120403][ T517] ? putname+0xfe/0x150 [ 52.124577][ T517] ? selinux_file_alloc_security+0x120/0x120 [ 52.130602][ T517] ? do_sys_openat2+0x68e/0x750 [ 52.135466][ T517] ? __fget_files+0x2c4/0x320 [ 52.140190][ T517] ? security_file_ioctl+0x84/0xa0 [ 52.145321][ T517] __se_sys_ioctl+0x9f/0x1a0 [ 52.149958][ T517] __x64_sys_ioctl+0x7b/0x90 [ 52.154561][ T517] do_syscall_64+0x31/0x40 [ 52.159019][ T517] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 52.164925][ T517] RIP: 0033:0x7f872dc980b9 [ 52.169373][ T517] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 52.189047][ T517] RSP: 002b:00007f872d6fe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 52.197522][ T517] RAX: ffffffffffffffda RBX: 00007f872dec4fa0 RCX: 00007f872dc980b9 [ 52.205512][ T517] RDX: 00002000000000c0 RSI: 0000000040305828 RDI: 0000000000000005 [ 52.213525][ T517] RBP: 00007f872dd2a9c4 R08: 0000000000000000 R09: 0000000000000000 [ 52.221957][ T517] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 52.229974][ T517] R13: 0000000000000000 R14: 00007f872dec4fa0 R15: 00007ffd6d85c0d8 [ 52.238000][ T517] ---[ end trace 330fe63ab8936b5a ]--- [ 52.243512][ T517] ================================================================== [ 52.251610][ T517] BUG: KASAN: slab-out-of-bounds in reset_curseg+0x4dd/0x560 [ 52.258986][ T517] Read of size 4 at addr ffff88811a06dbc0 by task syz.2.23/517 [ 52.266613][ T517] [ 52.269070][ T517] CPU: 1 PID: 517 Comm: syz.2.23 Tainted: G W syzkaller #0 [ 52.277548][ T517] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 52.287603][ T517] Call Trace: [ 52.290890][ T517] __dump_stack+0x21/0x24 [ 52.295208][ T517] dump_stack_lvl+0x1a7/0x208 [ 52.299876][ T517] ? show_regs_print_info+0x18/0x18 [ 52.305152][ T517] ? thaw_kernel_threads+0x220/0x220 [ 52.310466][ T517] print_address_description+0x7f/0x2c0 [ 52.316001][ T517] ? reset_curseg+0x4dd/0x560 [ 52.320780][ T517] kasan_report+0xe2/0x130 [ 52.325186][ T517] ? reset_curseg+0x4dd/0x560 [ 52.329965][ T517] __asan_report_load4_noabort+0x14/0x20 [ 52.335581][ T517] reset_curseg+0x4dd/0x560 [ 52.340069][ T517] new_curseg+0x12e8/0x1880 [ 52.344559][ T517] __allocate_new_segment+0x13d/0x810 [ 52.350009][ T517] f2fs_allocate_new_section+0x1f3/0x290 [ 52.355628][ T517] ? new_curseg+0x1880/0x1880 [ 52.360317][ T517] ? __kasan_check_write+0x14/0x20 [ 52.365414][ T517] ? down_read_trylock+0x106/0x160 [ 52.370513][ T517] ? __init_rwsem+0x1c0/0x1c0 [ 52.375268][ T517] ? has_not_enough_free_secs+0x3d7/0x8a0 [ 52.380975][ T517] expand_inode_data+0x5f7/0x9a0 [ 52.385924][ T517] ? f2fs_insert_range+0x5d0/0x5d0 [ 52.391241][ T517] ? inode_dio_wait+0x25a/0x2d0 [ 52.396109][ T517] ? file_update_time+0x3d7/0x440 [ 52.401127][ T517] ? inode_owner_or_capable+0x140/0x140 [ 52.406788][ T517] f2fs_fallocate+0x42b/0x7e0 [ 52.411518][ T517] vfs_fallocate+0x4b4/0x590 [ 52.416104][ T517] do_vfs_ioctl+0x1154/0x14c0 [ 52.420793][ T517] ? __ia32_compat_sys_ioctl+0x8e0/0x8e0 [ 52.426415][ T517] ? has_cap_mac_admin+0x370/0x370 [ 52.431519][ T517] ? kmem_cache_free+0x100/0x2d0 [ 52.436447][ T517] ? selinux_file_ioctl+0x3a0/0x4d0 [ 52.441716][ T517] ? putname+0xfe/0x150 [ 52.445878][ T517] ? selinux_file_alloc_security+0x120/0x120 [ 52.451869][ T517] ? do_sys_openat2+0x68e/0x750 [ 52.456710][ T517] ? __fget_files+0x2c4/0x320 [ 52.461375][ T517] ? security_file_ioctl+0x84/0xa0 [ 52.466477][ T517] __se_sys_ioctl+0x9f/0x1a0 [ 52.471154][ T517] __x64_sys_ioctl+0x7b/0x90 [ 52.475733][ T517] do_syscall_64+0x31/0x40 [ 52.480137][ T517] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 52.486024][ T517] RIP: 0033:0x7f872dc980b9 [ 52.490440][ T517] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 52.510043][ T517] RSP: 002b:00007f872d6fe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 52.518442][ T517] RAX: ffffffffffffffda RBX: 00007f872dec4fa0 RCX: 00007f872dc980b9 [ 52.526402][ T517] RDX: 00002000000000c0 RSI: 0000000040305828 RDI: 0000000000000005 [ 52.534360][ T517] RBP: 00007f872dd2a9c4 R08: 0000000000000000 R09: 0000000000000000 [ 52.542321][ T517] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 52.550282][ T517] R13: 0000000000000000 R14: 00007f872dec4fa0 R15: 00007ffd6d85c0d8 [ 52.558247][ T517] [ 52.560585][ T517] Allocated by task 517: [ 52.564819][ T517] __kasan_kmalloc+0xda/0x110 [ 52.569592][ T517] __kmalloc+0x1a4/0x330 [ 52.573822][ T517] kvmalloc_node+0x88/0x130 [ 52.578311][ T517] f2fs_build_segment_manager+0xdba/0x4900 [ 52.584125][ T517] f2fs_fill_super+0x4a4a/0x72e0 [ 52.589137][ T517] mount_bdev+0x28b/0x3a0 [ 52.593457][ T517] f2fs_mount+0x34/0x40 [ 52.597685][ T517] legacy_get_tree+0xed/0x190 [ 52.602344][ T517] vfs_get_tree+0x89/0x260 [ 52.606753][ T517] do_new_mount+0x25a/0xa20 [ 52.611366][ T517] path_mount+0x585/0xc90 [ 52.615679][ T517] __se_sys_mount+0x320/0x390 [ 52.620345][ T517] __x64_sys_mount+0xbf/0xd0 [ 52.624940][ T517] do_syscall_64+0x31/0x40 [ 52.629350][ T517] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 52.635223][ T517] [ 52.637624][ T517] The buggy address belongs to the object at ffff88811a06d800 [ 52.637624][ T517] which belongs to the cache kmalloc-1k of size 1024 [ 52.651832][ T517] The buggy address is located 960 bytes inside of [ 52.651832][ T517] 1024-byte region [ffff88811a06d800, ffff88811a06dc00) [ 52.665173][ T517] The buggy address belongs to the page: [ 52.670805][ T517] page:ffffea0004681a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11a068 [ 52.681034][ T517] head:ffffea0004681a00 order:3 compound_mapcount:0 compound_pincount:0 [ 52.689439][ T517] flags: 0x4000000000010200(slab|head) [ 52.694893][ T517] raw: 4000000000010200 ffffea000467e200 0000000200000002 ffff888100042f00 [ 52.703467][ T517] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 52.712037][ T517] page dumped because: kasan: bad access detected [ 52.718433][ T517] page_owner tracks the page as allocated [ 52.724284][ T517] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 126, ts 5570261680, free_ts 0 [ 52.742329][ T517] prep_new_page+0x179/0x180 [ 52.747008][ T517] get_page_from_freelist+0x223b/0x23d0 [ 52.752550][ T517] __alloc_pages_nodemask+0x290/0x620 [ 52.757926][ T517] new_slab+0x84/0x3f0 [ 52.761983][ T517] ___slab_alloc+0x2a6/0x450 [ 52.766720][ T517] __slab_alloc+0x63/0xa0 [ 52.771047][ T517] __kmalloc+0x1fe/0x330 [ 52.775284][ T517] load_elf_binary+0x271/0x28e0 [ 52.780137][ T517] bprm_execve+0x88b/0x15f0 [ 52.784633][ T517] do_execveat_common+0x918/0xaa0 [ 52.789644][ T517] __x64_sys_execve+0x92/0xb0 [ 52.794308][ T517] do_syscall_64+0x31/0x40 [ 52.798710][ T517] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 52.804588][ T517] page_owner free stack trace missing [ 52.809942][ T517] [ 52.812269][ T517] Memory state around the buggy address: [ 52.817895][ T517] ffff88811a06da80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 52.826078][ T517] ffff88811a06db00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 52.834138][ T517] >ffff88811a06db80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 52.842183][ T517] ^ [ 52.848320][ T517] ffff88811a06dc00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 52.856369][ T517] ffff88811a06dc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 52.864420][ T517] ================================================================== [ 52.872464][ T517] Disabling lock debugging due to kernel taint [ 52.879620][ T517] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN [ 52.891439][ T517] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 52.896000][ T24] audit: type=1400 audit(1768636298.730:114): avc: denied { read } for pid=77 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 52.899863][ T517] CPU: 1 PID: 517 Comm: syz.2.23 Tainted: G B W syzkaller #0 [ 52.899869][ T517] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 52.899931][ T517] RIP: 0010:update_sit_entry+0x3eb/0xf50 [ 52.921992][ T24] audit: type=1400 audit(1768636298.730:115): avc: denied { search } for pid=77 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 52.930262][ T517] Code: 89 45 a8 49 01 c5 41 f6 d7 41 80 e7 07 44 89 f9 41 bf 01 00 00 00 41 d3 e7 4d 89 ee 49 c1 ee 03 48 b8 00 00 00 00 00 fc ff df <41> 0f b6 04 06 84 c0 0f 85 a5 08 00 00 41 0f b6 5d 00 44 89 f8 41 [ 52.930270][ T517] RSP: 0018:ffffc90002617330 EFLAGS: 00010246 [ 52.930306][ T517] RAX: dffffc0000000000 RBX: ffff88811a06dbc8 RCX: 0000000000000007 [ 52.941530][ T24] audit: type=1400 audit(1768636298.730:116): avc: denied { write } for pid=77 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 52.945996][ T517] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88811a06dbc8 [ 52.968249][ T24] audit: type=1400 audit(1768636298.730:117): avc: denied { add_name } for pid=77 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 52.987163][ T517] RBP: ffffc900026173b0 R08: ffff888119f24f00 R09: 0000000000000003 [ 52.987171][ T517] R10: 00000000ffffffff R11: 0000000000000000 R12: 0000000000004000 [ 52.987177][ T517] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000080 [ 52.987187][ T517] FS: 00007f872d6fe6c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 52.987194][ T517] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 52.987201][ T517] CR2: 00007f872dce5800 CR3: 00000001276fb000 CR4: 00000000003506a0 [ 52.987211][ T517] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 52.987238][ T517] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 52.993879][ T24] audit: type=1400 audit(1768636298.730:118): avc: denied { create } for pid=77 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 53.001268][ T517] Call Trace: [ 53.001286][ T517] ? __asan_report_store8_noabort+0x17/0x20 [ 53.001328][ T517] f2fs_allocate_data_block+0x159c/0x3a20 [ 53.024335][ T24] audit: type=1400 audit(1768636298.730:119): avc: denied { append open } for pid=77 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 53.030459][ T517] ? _raw_spin_trylock_bh+0x150/0x150 [ 53.030471][ T517] ? __dquot_alloc_space+0x2bd/0xb80 [ 53.030515][ T517] ? _raw_spin_unlock+0x4d/0x70 [ 53.051688][ T24] audit: type=1400 audit(1768636298.730:120): avc: denied { getattr } for pid=77 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 53.058943][ T517] ? f2fs_inode_dirtied+0x26b/0x2a0 [ 53.058955][ T517] ? f2fs_io_type_to_rw_hint+0x1e0/0x1e0 [ 53.058998][ T517] ? f2fs_mark_inode_dirty_sync+0x110/0x140 [ 53.227407][ T517] ? inc_valid_block_count+0x562/0xa90 [ 53.232882][ T517] __allocate_data_block+0x553/0x9d0 [ 53.238157][ T517] ? f2fs_map_blocks+0x35a0/0x35a0 [ 53.243255][ T517] f2fs_map_blocks+0xda4/0x35a0 [ 53.248092][ T517] ? __kasan_check_write+0x14/0x20 [ 53.253232][ T517] ? f2fs_do_map_lock+0x2e0/0x2e0 [ 53.258262][ T517] ? __kasan_check_write+0x14/0x20 [ 53.263362][ T517] ? down_read_trylock+0x106/0x160 [ 53.268465][ T517] expand_inode_data+0x626/0x9a0 [ 53.273392][ T517] ? f2fs_insert_range+0x5d0/0x5d0 [ 53.278493][ T517] ? inode_dio_wait+0x25a/0x2d0 [ 53.283327][ T517] ? file_update_time+0x3d7/0x440 [ 53.288337][ T517] ? inode_owner_or_capable+0x140/0x140 [ 53.293876][ T517] f2fs_fallocate+0x42b/0x7e0 [ 53.298625][ T517] vfs_fallocate+0x4b4/0x590 [ 53.303199][ T517] do_vfs_ioctl+0x1154/0x14c0 [ 53.307880][ T517] ? __ia32_compat_sys_ioctl+0x8e0/0x8e0 [ 53.313497][ T517] ? has_cap_mac_admin+0x370/0x370 [ 53.318601][ T517] ? kmem_cache_free+0x100/0x2d0 [ 53.323539][ T517] ? selinux_file_ioctl+0x3a0/0x4d0 [ 53.328900][ T517] ? putname+0xfe/0x150 [ 53.333049][ T517] ? selinux_file_alloc_security+0x120/0x120 [ 53.339031][ T517] ? do_sys_openat2+0x68e/0x750 [ 53.343890][ T517] ? __fget_files+0x2c4/0x320 [ 53.348568][ T517] ? security_file_ioctl+0x84/0xa0 [ 53.353700][ T517] __se_sys_ioctl+0x9f/0x1a0 [ 53.358639][ T517] __x64_sys_ioctl+0x7b/0x90 [ 53.363234][ T517] do_syscall_64+0x31/0x40 [ 53.367644][ T517] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 53.373528][ T517] RIP: 0033:0x7f872dc980b9 [ 53.377959][ T517] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 53.397549][ T517] RSP: 002b:00007f872d6fe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 53.406043][ T517] RAX: ffffffffffffffda RBX: 00007f872dec4fa0 RCX: 00007f872dc980b9 [ 53.414017][ T517] RDX: 00002000000000c0 RSI: 0000000040305828 RDI: 0000000000000005 [ 53.421986][ T517] RBP: 00007f872dd2a9c4 R08: 0000000000000000 R09: 0000000000000000 [ 53.429948][ T517] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 53.437928][ T517] R13: 0000000000000000 R14: 00007f872dec4fa0 R15: 00007ffd6d85c0d8 [ 53.445917][ T517] Modules linked in: [ 53.450486][ T517] ---[ end trace 330fe63ab8936b5b ]--- [ 53.456134][ T517] RIP: 0010:update_sit_entry+0x3eb/0xf50 [ 53.461966][ T517] Code: 89 45 a8 49 01 c5 41 f6 d7 41 80 e7 07 44 89 f9 41 bf 01 00 00 00 41 d3 e7 4d 89 ee 49 c1 ee 03 48 b8 00 00 00 00 00 fc ff df <41> 0f b6 04 06 84 c0 0f 85 a5 08 00 00 41 0f b6 5d 00 44 89 f8 41 [ 53.481662][ T517] RSP: 0018:ffffc90002617330 EFLAGS: 00010246 [ 53.487863][ T517] RAX: dffffc0000000000 RBX: ffff88811a06dbc8 RCX: 0000000000000007 [ 53.495852][ T517] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88811a06dbc8 [ 53.503887][ T517] RBP: ffffc900026173b0 R08: ffff888119f24f00 R09: 0000000000000003 [ 53.511887][ T517] R10: 00000000ffffffff R11: 0000000000000000 R12: 0000000000004000 [ 53.520118][ T517] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000080 [ 53.528144][ T517] FS: 00007f872d6fe6c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 53.537288][ T517] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 53.543890][ T517] CR2: 00007f872dce5800 CR3: 00000001276fb000 CR4: 00000000003506a0 [ 53.551989][ T517] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 53.560012][ T517] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 53.568042][ T517] Kernel panic - not syncing: Fatal exception [ 53.574437][ T517] Kernel Offset: disabled [ 53.578761][ T517] Rebooting in 86400 seconds..