Warning: Permanently added '10.128.1.198' (ED25519) to the list of known hosts. 2025/11/18 12:44:00 parsed 1 programs [ 45.240175][ T30] audit: type=1400 audit(1763469840.780:105): avc: denied { unlink } for pid=398 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 45.274263][ T398] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 45.773937][ T30] audit: type=1401 audit(1763469841.310:106): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 45.979734][ T428] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.986768][ T428] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.994198][ T428] device bridge_slave_0 entered promiscuous mode [ 46.000990][ T428] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.007991][ T428] bridge0: port 2(bridge_slave_1) entered disabled state [ 46.015470][ T428] device bridge_slave_1 entered promiscuous mode [ 46.052983][ T428] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.060031][ T428] bridge0: port 2(bridge_slave_1) entered forwarding state [ 46.067260][ T428] bridge0: port 1(bridge_slave_0) entered blocking state [ 46.074371][ T428] bridge0: port 1(bridge_slave_0) entered forwarding state [ 46.091763][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 46.099299][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 46.106524][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 46.115828][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 46.124041][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 46.131077][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 46.140504][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 46.148668][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.155793][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 46.167467][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 46.177204][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 46.189771][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 46.201689][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 46.210058][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 46.217400][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 46.225943][ T428] device veth0_vlan entered promiscuous mode [ 46.236890][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 46.246299][ T428] device veth1_macvtap entered promiscuous mode [ 46.254957][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 46.265005][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2025/11/18 12:44:02 executed programs: 0 [ 46.853168][ T468] bridge0: port 1(bridge_slave_0) entered blocking state [ 46.860665][ T468] bridge0: port 1(bridge_slave_0) entered disabled state [ 46.868083][ T468] device bridge_slave_0 entered promiscuous mode [ 46.875068][ T468] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.882260][ T468] bridge0: port 2(bridge_slave_1) entered disabled state [ 46.890124][ T468] device bridge_slave_1 entered promiscuous mode [ 46.932903][ T468] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.940060][ T468] bridge0: port 2(bridge_slave_1) entered forwarding state [ 46.958931][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 46.966432][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 46.974091][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 46.982808][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 46.991331][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 46.999444][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.006486][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 47.015900][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 47.024238][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.031309][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 47.042792][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 47.051718][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 47.064576][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 47.075193][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 47.083401][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 47.091044][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 47.099249][ T468] device veth0_vlan entered promiscuous mode [ 47.108600][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 47.117767][ T468] device veth1_macvtap entered promiscuous mode [ 47.126667][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 47.136393][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 47.161841][ T30] audit: type=1400 audit(1763469842.700:107): avc: denied { create } for pid=479 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 47.163664][ T480] ================================================================== [ 47.180970][ T30] audit: type=1400 audit(1763469842.700:108): avc: denied { setopt } for pid=479 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 47.188998][ T480] BUG: KASAN: slab-out-of-bounds in xfrm_policy_inexact_list_reinsert+0x620/0x6d0 [ 47.208307][ T30] audit: type=1400 audit(1763469842.700:109): avc: denied { write } for pid=479 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 47.217144][ T480] Read of size 1 at addr ffff8881182213f8 by task syz.2.17/480 [ 47.217159][ T480] [ 47.217173][ T480] CPU: 0 PID: 480 Comm: syz.2.17 Not tainted syzkaller #0 [ 47.236363][ T30] audit: type=1400 audit(1763469842.700:110): avc: denied { create } for pid=479 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 47.243576][ T480] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 47.243598][ T480] Call Trace: [ 47.243603][ T480] [ 47.243610][ T480] __dump_stack+0x21/0x30 [ 47.246207][ T30] audit: type=1400 audit(1763469842.700:111): avc: denied { write } for pid=479 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 47.252993][ T480] dump_stack_lvl+0xee/0x150 [ 47.253020][ T480] ? show_regs_print_info+0x20/0x20 [ 47.253036][ T480] ? load_image+0x3a0/0x3a0 [ 47.253050][ T480] ? unwind_get_return_address+0x4d/0x90 [ 47.253070][ T480] print_address_description+0x7f/0x2c0 [ 47.253085][ T480] ? xfrm_policy_inexact_list_reinsert+0x620/0x6d0 [ 47.253101][ T480] kasan_report+0xf1/0x140 [ 47.253117][ T480] ? xfrm_policy_inexact_list_reinsert+0x620/0x6d0 [ 47.253133][ T480] __asan_report_load1_noabort+0x14/0x20 [ 47.253150][ T480] xfrm_policy_inexact_list_reinsert+0x620/0x6d0 [ 47.253166][ T480] xfrm_policy_inexact_insert_node+0x938/0xb50 [ 47.253180][ T480] ? xfrm_netlink_rcv+0x72/0x90 [ 47.273923][ T30] audit: type=1400 audit(1763469842.700:112): avc: denied { nlmsg_write } for pid=479 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 47.282993][ T480] ? netlink_unicast+0x876/0xa40 [ 47.283021][ T480] ? netlink_sendmsg+0x86a/0xb70 [ 47.409343][ T480] ? ____sys_sendmsg+0x5a2/0x8c0 [ 47.414264][ T480] ? ___sys_sendmsg+0x1f0/0x260 [ 47.419087][ T480] ? x64_sys_call+0x4b/0x9a0 [ 47.423658][ T480] ? entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 47.429712][ T480] xfrm_policy_inexact_alloc_chain+0x53a/0xb30 [ 47.435842][ T480] xfrm_policy_inexact_insert+0x70/0x1130 [ 47.441539][ T480] ? __get_hash_thresh+0x10c/0x420 [ 47.446636][ T480] ? policy_hash_bysel+0x110/0x4f0 [ 47.451717][ T480] xfrm_policy_insert+0x126/0x9a0 [ 47.456712][ T480] ? xfrm_policy_construct+0x54f/0x1f00 [ 47.462228][ T480] xfrm_add_policy+0x4d1/0x830 [ 47.466967][ T480] ? xfrm_dump_sa_done+0xc0/0xc0 [ 47.471877][ T480] xfrm_user_rcv_msg+0x45c/0x6e0 [ 47.476787][ T480] ? xfrm_netlink_rcv+0x90/0x90 [ 47.481611][ T480] ? avc_has_perm_noaudit+0x460/0x460 [ 47.486955][ T480] ? x64_sys_call+0x4b/0x9a0 [ 47.491525][ T480] ? selinux_nlmsg_lookup+0x237/0x4c0 [ 47.496907][ T480] netlink_rcv_skb+0x1e0/0x430 [ 47.501673][ T480] ? xfrm_netlink_rcv+0x90/0x90 [ 47.506522][ T480] ? netlink_ack+0xb60/0xb60 [ 47.511094][ T480] ? wait_for_completion_killable_timeout+0x10/0x10 [ 47.517665][ T480] ? __netlink_lookup+0x387/0x3b0 [ 47.522671][ T480] xfrm_netlink_rcv+0x72/0x90 [ 47.527384][ T480] netlink_unicast+0x876/0xa40 [ 47.532136][ T480] netlink_sendmsg+0x86a/0xb70 [ 47.536881][ T480] ? netlink_getsockopt+0x530/0x530 [ 47.542062][ T480] ? sock_alloc_file+0xba/0x260 [ 47.546894][ T480] ? security_socket_sendmsg+0x82/0xa0 [ 47.552441][ T480] ? netlink_getsockopt+0x530/0x530 [ 47.557643][ T480] ____sys_sendmsg+0x5a2/0x8c0 [ 47.562519][ T480] ? __sys_sendmsg_sock+0x40/0x40 [ 47.567545][ T480] ? import_iovec+0x7c/0xb0 [ 47.572128][ T480] ___sys_sendmsg+0x1f0/0x260 [ 47.576798][ T480] ? __sys_sendmsg+0x250/0x250 [ 47.581549][ T480] ? __fdget+0x1a1/0x230 [ 47.585792][ T480] __x64_sys_sendmsg+0x1e2/0x2a0 [ 47.590854][ T480] ? ___sys_sendmsg+0x260/0x260 [ 47.595712][ T480] ? __kasan_check_write+0x14/0x20 [ 47.600831][ T480] ? switch_fpu_return+0x15d/0x2c0 [ 47.605930][ T480] x64_sys_call+0x4b/0x9a0 [ 47.610340][ T480] do_syscall_64+0x4c/0xa0 [ 47.614738][ T480] ? clear_bhb_loop+0x50/0xa0 [ 47.619395][ T480] ? clear_bhb_loop+0x50/0xa0 [ 47.624048][ T480] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 47.630020][ T480] RIP: 0033:0x7f313564cbe9 [ 47.634415][ T480] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 47.654014][ T480] RSP: 002b:00007f31354bd038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 47.662412][ T480] RAX: ffffffffffffffda RBX: 00007f3135873fa0 RCX: 00007f313564cbe9 [ 47.670370][ T480] RDX: 0000000000004000 RSI: 0000200000000580 RDI: 0000000000000005 [ 47.678328][ T480] RBP: 00007f31356cfe19 R08: 0000000000000000 R09: 0000000000000000 [ 47.686302][ T480] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 47.694282][ T480] R13: 00007f3135874038 R14: 00007f3135873fa0 R15: 00007ffe6c9d9a28 [ 47.702352][ T480] [ 47.705363][ T480] [ 47.707667][ T480] Allocated by task 480: [ 47.711886][ T480] __kasan_kmalloc+0xda/0x110 [ 47.716553][ T480] __kmalloc+0x13d/0x2c0 [ 47.720774][ T480] sk_prot_alloc+0xed/0x320 [ 47.725265][ T480] sk_alloc+0x38/0x430 [ 47.729394][ T480] pfkey_create+0x12a/0x660 [ 47.733876][ T480] __sock_create+0x38d/0x7a0 [ 47.738445][ T480] __sys_socket+0xec/0x190 [ 47.742837][ T480] __x64_sys_socket+0x7a/0x90 [ 47.747491][ T480] x64_sys_call+0x8c5/0x9a0 [ 47.751997][ T480] do_syscall_64+0x4c/0xa0 [ 47.756395][ T480] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 47.762279][ T480] [ 47.764589][ T480] The buggy address belongs to the object at ffff888118221000 [ 47.764589][ T480] which belongs to the cache kmalloc-1k of size 1024 [ 47.778712][ T480] The buggy address is located 1016 bytes inside of [ 47.778712][ T480] 1024-byte region [ffff888118221000, ffff888118221400) [ 47.792136][ T480] The buggy address belongs to the page: [ 47.797742][ T480] page:ffffea0004608800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118220 [ 47.807956][ T480] head:ffffea0004608800 order:3 compound_mapcount:0 compound_pincount:0 [ 47.816348][ T480] flags: 0x4000000000010200(slab|head|zone=1) [ 47.822412][ T480] raw: 4000000000010200 0000000000000000 0000000100000001 ffff888100043080 [ 47.831060][ T480] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 47.839616][ T480] page dumped because: kasan: bad access detected [ 47.846010][ T480] page_owner tracks the page as allocated [ 47.851695][ T480] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 101, ts 4814599026, free_ts 0 [ 47.869727][ T480] post_alloc_hook+0x192/0x1b0 [ 47.874489][ T480] prep_new_page+0x1c/0x110 [ 47.879058][ T480] get_page_from_freelist+0x2cc5/0x2d50 [ 47.884592][ T480] __alloc_pages+0x18f/0x440 [ 47.889160][ T480] new_slab+0xa1/0x4d0 [ 47.893208][ T480] ___slab_alloc+0x381/0x810 [ 47.897777][ T480] __slab_alloc+0x49/0x90 [ 47.902083][ T480] __kmalloc_track_caller+0x169/0x2c0 [ 47.907439][ T480] __alloc_skb+0x21a/0x740 [ 47.911836][ T480] netlink_sendmsg+0x602/0xb70 [ 47.916586][ T480] ____sys_sendmsg+0x5a2/0x8c0 [ 47.921330][ T480] ___sys_sendmsg+0x1f0/0x260 [ 47.925992][ T480] __x64_sys_sendmsg+0x1e2/0x2a0 [ 47.930907][ T480] x64_sys_call+0x4b/0x9a0 [ 47.935301][ T480] do_syscall_64+0x4c/0xa0 [ 47.939699][ T480] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 47.945577][ T480] page_owner free stack trace missing [ 47.950917][ T480] [ 47.953221][ T480] Memory state around the buggy address: [ 47.958823][ T480] ffff888118221280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 47.966858][ T480] ffff888118221300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 47.974892][ T480] >ffff888118221380: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 47.982932][ T480] ^ [ 47.990897][ T480] ffff888118221400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 47.998936][ T480] ffff888118221480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.006972][ T480] ================================================================== [ 48.015355][ T480] Disabling lock debugging due to kernel taint [ 48.035601][ T30] audit: type=1400 audit(1763469843.570:113): avc: denied { read } for pid=83 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 48.057538][ T30] audit: type=1400 audit(1763469843.570:114): avc: denied { search } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 48.641662][ T309] device bridge_slave_1 left promiscuous mode [ 48.647771][ T309] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.656144][ T309] device bridge_slave_0 left promiscuous mode [ 48.662623][ T309] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.670471][ T309] device veth1_macvtap left promiscuous mode [ 48.676449][ T309] device veth0_vlan left promiscuous mode 2025/11/18 12:44:07 executed programs: 226 2025/11/18 12:44:12 executed programs: 527