Warning: Permanently added '10.128.1.205' (ED25519) to the list of known hosts. 2025/11/18 12:20:12 parsed 1 programs [ 45.923779][ T30] audit: type=1400 audit(1763468413.066:105): avc: denied { unlink } for pid=397 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 45.977964][ T397] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 46.688914][ T30] audit: type=1401 audit(1763468413.826:106): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 46.875463][ T449] bridge0: port 1(bridge_slave_0) entered blocking state [ 46.882521][ T449] bridge0: port 1(bridge_slave_0) entered disabled state [ 46.890232][ T449] device bridge_slave_0 entered promiscuous mode [ 46.897533][ T449] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.904850][ T449] bridge0: port 2(bridge_slave_1) entered disabled state [ 46.912339][ T449] device bridge_slave_1 entered promiscuous mode [ 46.950056][ T449] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.957245][ T449] bridge0: port 2(bridge_slave_1) entered forwarding state [ 46.964633][ T449] bridge0: port 1(bridge_slave_0) entered blocking state [ 46.971756][ T449] bridge0: port 1(bridge_slave_0) entered forwarding state [ 46.988073][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 46.995719][ T314] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.002907][ T314] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.012346][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 47.020682][ T314] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.027794][ T314] bridge0: port 1(bridge_slave_0) entered forwarding state [ 47.037256][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 47.045499][ T314] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.052533][ T314] bridge0: port 2(bridge_slave_1) entered forwarding state [ 47.064098][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 47.073561][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 47.087475][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 47.099106][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 47.107420][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 47.114957][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 47.123367][ T449] device veth0_vlan entered promiscuous mode [ 47.132798][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 47.142350][ T449] device veth1_macvtap entered promiscuous mode [ 47.151444][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 47.161466][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2025/11/18 12:20:14 executed programs: 0 [ 47.388919][ T467] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.396376][ T467] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.403850][ T467] device bridge_slave_0 entered promiscuous mode [ 47.411085][ T467] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.418913][ T467] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.426690][ T467] device bridge_slave_1 entered promiscuous mode [ 47.482062][ T467] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.489140][ T467] bridge0: port 2(bridge_slave_1) entered forwarding state [ 47.496458][ T467] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.503497][ T467] bridge0: port 1(bridge_slave_0) entered forwarding state [ 47.520465][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 47.528393][ T314] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.535717][ T314] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.545704][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 47.553916][ T314] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.560954][ T314] bridge0: port 1(bridge_slave_0) entered forwarding state [ 47.573811][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 47.582032][ T314] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.589089][ T314] bridge0: port 2(bridge_slave_1) entered forwarding state [ 47.607764][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 47.617126][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 47.629904][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 47.648084][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 47.656721][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 47.664542][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 47.672809][ T467] device veth0_vlan entered promiscuous mode [ 47.686476][ T467] device veth1_macvtap entered promiscuous mode [ 47.693853][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 47.707069][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 47.716163][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 47.753473][ T30] audit: type=1400 audit(1763468414.886:107): avc: denied { create } for pid=478 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 47.765057][ T479] ================================================================== [ 47.773574][ T30] audit: type=1400 audit(1763468414.886:108): avc: denied { setopt } for pid=478 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 47.781023][ T479] BUG: KASAN: slab-out-of-bounds in xfrm_policy_inexact_list_reinsert+0x620/0x6d0 [ 47.800479][ T30] audit: type=1400 audit(1763468414.886:109): avc: denied { write } for pid=478 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 47.809308][ T479] Read of size 1 at addr ffff8881185de3f8 by task syz.2.17/479 [ 47.809325][ T479] [ 47.809340][ T479] CPU: 0 PID: 479 Comm: syz.2.17 Not tainted syzkaller #0 [ 47.828614][ T30] audit: type=1400 audit(1763468414.896:110): avc: denied { create } for pid=478 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 47.835840][ T479] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 47.835866][ T479] Call Trace: [ 47.835872][ T479] [ 47.835877][ T479] __dump_stack+0x21/0x30 [ 47.835903][ T479] dump_stack_lvl+0xee/0x150 [ 47.835918][ T479] ? show_regs_print_info+0x20/0x20 [ 47.835936][ T479] ? load_image+0x3a0/0x3a0 [ 47.835951][ T479] ? unwind_get_return_address+0x4d/0x90 [ 47.835971][ T479] print_address_description+0x7f/0x2c0 [ 47.835986][ T479] ? xfrm_policy_inexact_list_reinsert+0x620/0x6d0 [ 47.839448][ T30] audit: type=1400 audit(1763468414.906:111): avc: denied { write } for pid=478 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 47.845455][ T479] kasan_report+0xf1/0x140 [ 47.845488][ T479] ? xfrm_policy_inexact_list_reinsert+0x620/0x6d0 [ 47.845507][ T479] __asan_report_load1_noabort+0x14/0x20 [ 47.865760][ T30] audit: type=1400 audit(1763468414.906:112): avc: denied { nlmsg_write } for pid=478 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 47.875580][ T479] xfrm_policy_inexact_list_reinsert+0x620/0x6d0 [ 47.875607][ T479] xfrm_policy_inexact_insert_node+0x938/0xb50 [ 47.988056][ T479] ? xfrm_netlink_rcv+0x72/0x90 [ 47.992918][ T479] ? netlink_unicast+0x876/0xa40 [ 47.997846][ T479] ? netlink_sendmsg+0x86a/0xb70 [ 48.002756][ T479] ? ____sys_sendmsg+0x5a2/0x8c0 [ 48.007674][ T479] ? ___sys_sendmsg+0x1f0/0x260 [ 48.012643][ T479] ? x64_sys_call+0x4b/0x9a0 [ 48.017331][ T479] ? entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 48.023395][ T479] xfrm_policy_inexact_alloc_chain+0x53a/0xb30 [ 48.029731][ T479] xfrm_policy_inexact_insert+0x70/0x1130 [ 48.035720][ T479] ? __get_hash_thresh+0x10c/0x420 [ 48.040846][ T479] ? policy_hash_bysel+0x110/0x4f0 [ 48.046372][ T479] xfrm_policy_insert+0x126/0x9a0 [ 48.051386][ T479] ? xfrm_policy_construct+0x54f/0x1f00 [ 48.056914][ T479] xfrm_add_policy+0x4d1/0x830 [ 48.061679][ T479] ? xfrm_dump_sa_done+0xc0/0xc0 [ 48.066602][ T479] xfrm_user_rcv_msg+0x45c/0x6e0 [ 48.071524][ T479] ? xfrm_netlink_rcv+0x90/0x90 [ 48.076362][ T479] ? avc_has_perm_noaudit+0x460/0x460 [ 48.081716][ T479] ? x64_sys_call+0x4b/0x9a0 [ 48.086289][ T479] ? selinux_nlmsg_lookup+0x237/0x4c0 [ 48.092183][ T479] netlink_rcv_skb+0x1e0/0x430 [ 48.096951][ T479] ? xfrm_netlink_rcv+0x90/0x90 [ 48.101784][ T479] ? netlink_ack+0xb60/0xb60 [ 48.106357][ T479] ? wait_for_completion_killable_timeout+0x10/0x10 [ 48.112933][ T479] ? __netlink_lookup+0x387/0x3b0 [ 48.117960][ T479] xfrm_netlink_rcv+0x72/0x90 [ 48.122632][ T479] netlink_unicast+0x876/0xa40 [ 48.127381][ T479] netlink_sendmsg+0x86a/0xb70 [ 48.132131][ T479] ? netlink_getsockopt+0x530/0x530 [ 48.137311][ T479] ? sock_alloc_file+0xba/0x260 [ 48.142320][ T479] ? security_socket_sendmsg+0x82/0xa0 [ 48.147775][ T479] ? netlink_getsockopt+0x530/0x530 [ 48.152966][ T479] ____sys_sendmsg+0x5a2/0x8c0 [ 48.157743][ T479] ? __sys_sendmsg_sock+0x40/0x40 [ 48.162763][ T479] ? import_iovec+0x7c/0xb0 [ 48.167248][ T479] ___sys_sendmsg+0x1f0/0x260 [ 48.171914][ T479] ? __sys_sendmsg+0x250/0x250 [ 48.176667][ T479] ? __fdget+0x1a1/0x230 [ 48.181066][ T479] __x64_sys_sendmsg+0x1e2/0x2a0 [ 48.186018][ T479] ? ___sys_sendmsg+0x260/0x260 [ 48.190873][ T479] ? __kasan_check_write+0x14/0x20 [ 48.195974][ T479] ? switch_fpu_return+0x15d/0x2c0 [ 48.201074][ T479] x64_sys_call+0x4b/0x9a0 [ 48.205569][ T479] do_syscall_64+0x4c/0xa0 [ 48.210066][ T479] ? clear_bhb_loop+0x50/0xa0 [ 48.214757][ T479] ? clear_bhb_loop+0x50/0xa0 [ 48.219435][ T479] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 48.225316][ T479] RIP: 0033:0x7f08b7581be9 [ 48.229724][ T479] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 48.249330][ T479] RSP: 002b:00007f08b73f2038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 48.257741][ T479] RAX: ffffffffffffffda RBX: 00007f08b77a8fa0 RCX: 00007f08b7581be9 [ 48.265702][ T479] RDX: 0000000000004000 RSI: 0000200000000580 RDI: 0000000000000005 [ 48.273834][ T479] RBP: 00007f08b7604e19 R08: 0000000000000000 R09: 0000000000000000 [ 48.281787][ T479] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 48.289740][ T479] R13: 00007f08b77a9038 R14: 00007f08b77a8fa0 R15: 00007ffd8f4ec5e8 [ 48.297701][ T479] [ 48.300702][ T479] [ 48.303005][ T479] Allocated by task 479: [ 48.307327][ T479] __kasan_kmalloc+0xda/0x110 [ 48.311994][ T479] __kmalloc+0x13d/0x2c0 [ 48.316307][ T479] sk_prot_alloc+0xed/0x320 [ 48.320875][ T479] sk_alloc+0x38/0x430 [ 48.324920][ T479] pfkey_create+0x12a/0x660 [ 48.329404][ T479] __sock_create+0x38d/0x7a0 [ 48.333983][ T479] __sys_socket+0xec/0x190 [ 48.338376][ T479] __x64_sys_socket+0x7a/0x90 [ 48.343034][ T479] x64_sys_call+0x8c5/0x9a0 [ 48.347525][ T479] do_syscall_64+0x4c/0xa0 [ 48.351922][ T479] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 48.357799][ T479] [ 48.360101][ T479] The buggy address belongs to the object at ffff8881185de000 [ 48.360101][ T479] which belongs to the cache kmalloc-1k of size 1024 [ 48.374441][ T479] The buggy address is located 1016 bytes inside of [ 48.374441][ T479] 1024-byte region [ffff8881185de000, ffff8881185de400) [ 48.388006][ T479] The buggy address belongs to the page: [ 48.394222][ T479] page:ffffea0004617600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1185d8 [ 48.404987][ T479] head:ffffea0004617600 order:3 compound_mapcount:0 compound_pincount:0 [ 48.413317][ T479] flags: 0x4000000000010200(slab|head|zone=1) [ 48.419419][ T479] raw: 4000000000010200 0000000000000000 0000000100000001 ffff888100043080 [ 48.428100][ T479] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 48.436778][ T479] page dumped because: kasan: bad access detected [ 48.443273][ T479] page_owner tracks the page as allocated [ 48.449004][ T479] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 101, ts 5022887137, free_ts 0 [ 48.467047][ T479] post_alloc_hook+0x192/0x1b0 [ 48.471814][ T479] prep_new_page+0x1c/0x110 [ 48.476391][ T479] get_page_from_freelist+0x2cc5/0x2d50 [ 48.481920][ T479] __alloc_pages+0x18f/0x440 [ 48.486692][ T479] new_slab+0xa1/0x4d0 [ 48.490754][ T479] ___slab_alloc+0x381/0x810 [ 48.495323][ T479] __slab_alloc+0x49/0x90 [ 48.499636][ T479] __kmalloc_track_caller+0x169/0x2c0 [ 48.504990][ T479] __alloc_skb+0x21a/0x740 [ 48.509396][ T479] netlink_sendmsg+0x602/0xb70 [ 48.514148][ T479] ____sys_sendmsg+0x5a2/0x8c0 [ 48.519308][ T479] ___sys_sendmsg+0x1f0/0x260 [ 48.523968][ T479] __x64_sys_sendmsg+0x1e2/0x2a0 [ 48.528885][ T479] x64_sys_call+0x4b/0x9a0 [ 48.533406][ T479] do_syscall_64+0x4c/0xa0 [ 48.537918][ T479] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 48.543821][ T479] page_owner free stack trace missing [ 48.549514][ T479] [ 48.551814][ T479] Memory state around the buggy address: [ 48.557573][ T479] ffff8881185de280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 48.565632][ T479] ffff8881185de300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 48.573733][ T479] >ffff8881185de380: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 48.581782][ T479] ^ [ 48.589744][ T479] ffff8881185de400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.597783][ T479] ffff8881185de480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.605838][ T479] ================================================================== [ 48.613896][ T479] Disabling lock debugging due to kernel taint [ 48.629924][ T30] audit: type=1400 audit(1763468415.766:113): avc: denied { read } for pid=83 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 48.652426][ T30] audit: type=1400 audit(1763468415.766:114): avc: denied { search } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 49.224869][ T8] device bridge_slave_1 left promiscuous mode [ 49.231235][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.243870][ T8] device bridge_slave_0 left promiscuous mode [ 49.250172][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.259178][ T8] device veth1_macvtap left promiscuous mode [ 49.265594][ T8] device veth0_vlan left promiscuous mode 2025/11/18 12:20:19 executed programs: 222 2025/11/18 12:20:24 executed programs: 522