Warning: Permanently added '10.128.1.106' (ED25519) to the list of known hosts. 2026/10/18 14:16:11 parsed 1 programs 2026/10/18 14:16:11 serving rpc on tcp://43385 [ 40.503209][ T28] kauditd_printk_skb: 32 callbacks suppressed [ 40.503226][ T28] audit: type=1400 audit(1792332972.511:106): avc: denied { unlink } for pid=410 comm="syz-executor" name="swap-file" dev="sda1" ino=2027 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 40.596513][ T410] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 41.448352][ T431] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.456087][ T431] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.464096][ T431] device bridge_slave_0 entered promiscuous mode [ 41.472068][ T431] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.479790][ T431] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.488491][ T431] device bridge_slave_1 entered promiscuous mode [ 41.537998][ T431] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.545562][ T431] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.553049][ T431] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.560384][ T431] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.581798][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 41.590032][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.598247][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.609220][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 41.617791][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.625514][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.635233][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 41.643980][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.651559][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.666553][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 41.676214][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 41.691216][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 41.704383][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 41.712910][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 41.720483][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 41.729199][ T431] device veth0_vlan entered promiscuous mode [ 41.741260][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 41.750703][ T431] device veth1_macvtap entered promiscuous mode [ 41.761018][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 41.771768][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 42.149275][ T28] audit: type=1401 audit(1792332974.151:107): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 42.536095][ T8] device bridge_slave_1 left promiscuous mode [ 42.542359][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.551039][ T8] device bridge_slave_0 left promiscuous mode [ 42.559326][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.570412][ T8] device veth1_macvtap left promiscuous mode [ 42.576954][ T8] device veth0_vlan left promiscuous mode 2026/10/18 14:16:14 executed programs: 0 [ 42.904306][ T476] bridge0: port 1(bridge_slave_0) entered blocking state [ 42.912161][ T476] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.921157][ T476] device bridge_slave_0 entered promiscuous mode [ 42.930128][ T476] bridge0: port 2(bridge_slave_1) entered blocking state [ 42.938062][ T476] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.945980][ T476] device bridge_slave_1 entered promiscuous mode [ 43.003513][ T476] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.011616][ T476] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.020603][ T476] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.028565][ T476] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.051221][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 43.059530][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.067126][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.076975][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 43.085696][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.093127][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.105479][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 43.115134][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.122281][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.136430][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 43.146126][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 43.161193][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 43.175299][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 43.185420][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 43.193483][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 43.202323][ T476] device veth0_vlan entered promiscuous mode [ 43.213258][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 43.223588][ T476] device veth1_macvtap entered promiscuous mode [ 43.233929][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 43.245114][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 43.273188][ T28] audit: type=1400 audit(1792332975.281:108): avc: denied { mount } for pid=480 comm="syz.2.17" name="/" dev="configfs" ino=13990 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 43.281239][ T481] ================================================================== [ 43.298882][ T28] audit: type=1400 audit(1792332975.281:109): avc: denied { search } for pid=480 comm="syz.2.17" name="/" dev="configfs" ino=13990 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 43.305216][ T481] BUG: KASAN: invalid-free in __kmem_cache_free+0xb7/0x1b0 [ 43.328592][ T28] audit: type=1400 audit(1792332975.281:110): avc: denied { write } for pid=480 comm="syz.2.17" name="usb_gadget" dev="configfs" ino=13991 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 43.335096][ T481] Free of addr ffff88811d7b724c by task syz.2.17/481 [ 43.335115][ T481] [ 43.335121][ T481] CPU: 1 PID: 481 Comm: syz.2.17 Not tainted syzkaller #0 [ 43.335141][ T481] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 43.335171][ T481] Call Trace: [ 43.359604][ T28] audit: type=1400 audit(1792332975.281:111): avc: denied { add_name } for pid=480 comm="syz.2.17" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 43.364651][ T481] [ 43.364662][ T481] __dump_stack+0x21/0x24 [ 43.364698][ T481] dump_stack_lvl+0x110/0x170 [ 43.368387][ T28] audit: type=1400 audit(1792332975.281:112): avc: denied { create } for pid=480 comm="syz.2.17" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 43.374520][ T481] ? __cfi_dump_stack_lvl+0x8/0x8 [ 43.374565][ T481] print_address_description+0x71/0x200 [ 43.374595][ T481] print_report+0x4a/0x60 [ 43.374619][ T481] ? __kmem_cache_free+0xb7/0x1b0 [ 43.386657][ T28] audit: type=1400 audit(1792332975.281:113): avc: denied { write } for pid=480 comm="syz.2.17" name="p_srate" dev="configfs" ino=16796 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 43.388079][ T481] kasan_report_invalid_free+0xd5/0xf0 [ 43.409148][ T28] audit: type=1400 audit(1792332975.281:114): avc: denied { open } for pid=480 comm="syz.2.17" path="/0/config/usb_gadget/g1/functions/uac2.usb0/p_srate" dev="configfs" ino=16796 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 43.411185][ T481] ? __kmem_cache_free+0xb7/0x1b0 [ 43.524135][ T481] ? __kmem_cache_free+0xb7/0x1b0 [ 43.529393][ T481] ____kasan_slab_free+0x14f/0x180 [ 43.534633][ T481] __kasan_slab_free+0x11/0x20 [ 43.539447][ T481] slab_free_freelist_hook+0xc2/0x190 [ 43.544841][ T481] ? f_uac2_opts_p_srate_store+0x220/0x2a0 [ 43.550795][ T481] __kmem_cache_free+0xb7/0x1b0 [ 43.555797][ T481] kfree+0x6f/0xf0 [ 43.559562][ T481] f_uac2_opts_p_srate_store+0x220/0x2a0 [ 43.565663][ T481] ? __cfi_f_uac2_opts_p_srate_store+0x10/0x10 [ 43.571931][ T481] ? down_read+0xa6/0xf0 [ 43.576317][ T481] ? __cfi_down_read+0x10/0x10 [ 43.581552][ T481] ? avc_policy_seqno+0x1b/0x70 [ 43.586700][ T481] ? selinux_file_permission+0x2a5/0x510 [ 43.592450][ T481] configfs_write_iter+0x323/0x410 [ 43.597703][ T481] ? __cfi_f_uac2_opts_p_srate_store+0x10/0x10 [ 43.604375][ T481] vfs_write+0x5ef/0xd00 [ 43.609161][ T481] ? __cfi_vfs_write+0x10/0x10 [ 43.614029][ T481] ? __cfi_mutex_lock+0x10/0x10 [ 43.618897][ T481] ? __fdget_pos+0x2cd/0x380 [ 43.623601][ T481] ? ksys_write+0x70/0x260 [ 43.628191][ T481] ksys_write+0x14a/0x260 [ 43.632574][ T481] ? __cfi_ksys_write+0x10/0x10 [ 43.637493][ T481] ? fpregs_restore_userregs+0x128/0x260 [ 43.643418][ T481] __x64_sys_write+0x7b/0x90 [ 43.648137][ T481] x64_sys_call+0x27b/0x9a0 [ 43.652845][ T481] do_syscall_64+0x4c/0xa0 [ 43.657278][ T481] ? clear_bhb_loop+0x30/0x80 [ 43.661998][ T481] ? clear_bhb_loop+0x30/0x80 [ 43.666700][ T481] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 43.672698][ T481] RIP: 0033:0x7f22b659e0d9 [ 43.677141][ T481] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 43.696790][ T481] RSP: 002b:00007f22b7518028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 43.705404][ T481] RAX: ffffffffffffffda RBX: 00007f22b6825fa0 RCX: 00007f22b659e0d9 [ 43.713580][ T481] RDX: 0000000000000101 RSI: 0000200000000d40 RDI: 0000000000000003 [ 43.721565][ T481] RBP: 00007f22b6635024 R08: 0000000000000000 R09: 0000000000000000 [ 43.729636][ T481] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 43.737618][ T481] R13: 00007f22b6826038 R14: 00007f22b6825fa0 R15: 00007fff5dd873c8 [ 43.745712][ T481] [ 43.748824][ T481] [ 43.751161][ T481] Allocated by task 481: [ 43.755482][ T481] kasan_set_track+0x4b/0x70 [ 43.760088][ T481] kasan_save_alloc_info+0x1f/0x30 [ 43.765205][ T481] __kasan_kmalloc+0x95/0xb0 [ 43.769854][ T481] __kmalloc_node_track_caller+0xb1/0x1e0 [ 43.775595][ T481] kstrdup+0x3b/0x80 [ 43.779502][ T481] f_uac2_opts_p_srate_store+0x11a/0x2a0 [ 43.785148][ T481] configfs_write_iter+0x323/0x410 [ 43.790289][ T481] vfs_write+0x5ef/0xd00 [ 43.794561][ T481] ksys_write+0x14a/0x260 [ 43.799106][ T481] __x64_sys_write+0x7b/0x90 [ 43.803843][ T481] x64_sys_call+0x27b/0x9a0 [ 43.808391][ T481] do_syscall_64+0x4c/0xa0 [ 43.812825][ T481] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 43.818771][ T481] [ 43.821100][ T481] The buggy address belongs to the object at ffff88811d7b7240 [ 43.821100][ T481] which belongs to the cache kmalloc-32 of size 32 [ 43.834987][ T481] The buggy address is located 12 bytes inside of [ 43.834987][ T481] 32-byte region [ffff88811d7b7240, ffff88811d7b7260) [ 43.848108][ T481] [ 43.850439][ T481] The buggy address belongs to the physical page: [ 43.856946][ T481] page:ffffea000475edc0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11d7b7 [ 43.867385][ T481] flags: 0x4000000000000200(slab|zone=1) [ 43.873054][ T481] raw: 4000000000000200 0000000000000000 dead000000000122 ffff888100042600 [ 43.881644][ T481] raw: 0000000000000000 0000000080400040 00000001ffffffff 0000000000000000 [ 43.890243][ T481] page dumped because: kasan: bad access detected [ 43.896699][ T481] page_owner tracks the page as allocated [ 43.902443][ T481] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL), pid 476, tgid 476 (syz-executor), ts 43259097498, free_ts 43043905584 [ 43.922118][ T481] post_alloc_hook+0x1f5/0x210 [ 43.927044][ T481] prep_new_page+0x1c/0x110 [ 43.931948][ T481] get_page_from_freelist+0x2ca9/0x2d20 [ 43.937639][ T481] __alloc_pages+0x1fa/0x610 [ 43.942361][ T481] alloc_slab_page+0x6e/0xf0 [ 43.947243][ T481] new_slab+0x98/0x3e0 [ 43.951343][ T481] ___slab_alloc+0x70f/0xb70 [ 43.955956][ T481] __slab_alloc+0x5e/0xa0 [ 43.960528][ T481] __kmem_cache_alloc_node+0x204/0x2d0 [ 43.966172][ T481] kmalloc_trace+0x29/0xb0 [ 43.970624][ T481] ref_tracker_alloc+0x16b/0x4a0 [ 43.975577][ T481] fib_check_nh+0x946/0x1490 [ 43.980276][ T481] fib_create_info+0x1083/0x1fc0 [ 43.985244][ T481] fib_table_insert+0xaf/0x1de0 [ 43.990104][ T481] fib_add_ifaddr+0xa54/0xdb0 [ 43.994807][ T481] fib_netdev_event+0x22e/0x5a0 [ 43.999678][ T481] page last free stack trace: [ 44.004427][ T481] free_unref_page_prepare+0x81b/0x820 [ 44.009925][ T481] free_unref_page+0x93/0x530 [ 44.014632][ T481] __free_pages+0x67/0x100 [ 44.019158][ T481] __free_slab+0xc7/0x1a0 [ 44.023499][ T481] __unfreeze_partials+0x15a/0x190 [ 44.028637][ T481] put_cpu_partial+0xa9/0x100 [ 44.033427][ T481] __slab_free+0x1c4/0x280 [ 44.038058][ T481] ___cache_free+0xbf/0xd0 [ 44.042592][ T481] qlist_free_all+0xc6/0x140 [ 44.047403][ T481] kasan_quarantine_reduce+0x14a/0x170 [ 44.052880][ T481] __kasan_slab_alloc+0x24/0x80 [ 44.057824][ T481] slab_post_alloc_hook+0x4f/0x2d0 [ 44.062958][ T481] kmem_cache_alloc_lru+0x104/0x280 [ 44.068165][ T481] sock_alloc_inode+0x28/0xc0 [ 44.072849][ T481] new_inode_pseudo+0x70/0x1f0 [ 44.077617][ T481] __sock_create+0x12c/0x7c0 [ 44.082220][ T481] [ 44.084630][ T481] Memory state around the buggy address: [ 44.090279][ T481] ffff88811d7b7100: 00 00 00 00 fc fc fc fc fa fb fb fb fc fc fc fc [ 44.098359][ T481] ffff88811d7b7180: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 44.106534][ T481] >ffff88811d7b7200: 00 00 00 00 fc fc fc fc 00 00 02 fc fc fc fc fc [ 44.114606][ T481] ^ [ 44.121042][ T481] ffff88811d7b7280: fc fc fc fc fc fc fc fc fa fb fb fb fc fc fc fc [ 44.129106][ T481] ffff88811d7b7300: fa fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc [ 44.137169][ T481] ================================================================== [ 44.149548][ T28] audit: type=1400 audit(1792332976.151:115): avc: denied { read } for pid=84 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 44.154902][ T481] Disabling lock debugging due to kernel taint 2026/10/18 14:16:19 executed programs: 222 2026/10/18 14:16:24 executed programs: 519