Warning: Permanently added '10.128.1.129' (ED25519) to the list of known hosts. 2026/10/17 05:36:36 parsed 1 programs Setting up swapspace version 1, size = 127995904 bytes [ 38.106536][ T24] kauditd_printk_skb: 31 callbacks suppressed [ 38.106548][ T24] audit: type=1400 audit(1792215397.200:105): avc: denied { unlink } for pid=429 comm="syz-executor" name="swap-file" dev="sda1" ino=2027 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 38.158040][ T24] audit: type=1400 audit(1792215397.250:106): avc: denied { write } for pid=431 comm="mkswap" path="pipe:[16413]" dev="pipefs" ino=16413 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 38.181856][ T429] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 38.830347][ T24] audit: type=1400 audit(1792215397.920:107): avc: denied { create } for pid=457 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 39.217944][ T24] audit: type=1401 audit(1792215398.310:108): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 39.255646][ T484] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.262954][ T484] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.270481][ T484] device bridge_slave_0 entered promiscuous mode [ 39.277204][ T484] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.284343][ T484] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.291890][ T484] device bridge_slave_1 entered promiscuous mode [ 39.324560][ T484] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.331622][ T484] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.339134][ T484] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.346312][ T484] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.362771][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 39.370489][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.377798][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.387272][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 39.395669][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.402758][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.411377][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 39.419789][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.427110][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.438667][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 39.454316][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 39.467456][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 39.482885][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 39.491168][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 39.498742][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 39.507603][ T484] device veth0_vlan entered promiscuous mode [ 39.524152][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 39.537492][ T484] device veth1_macvtap entered promiscuous mode [ 39.546637][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 39.556464][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/10/17 05:36:38 executed programs: 0 [ 39.729881][ T494] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.737149][ T494] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.744554][ T494] device bridge_slave_0 entered promiscuous mode [ 39.756751][ T494] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.764226][ T494] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.771991][ T494] device bridge_slave_1 entered promiscuous mode [ 39.812002][ T494] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.819178][ T494] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.826560][ T494] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.833620][ T494] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.842005][ T323] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.849314][ T323] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.870106][ T323] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 39.877679][ T323] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 39.888596][ T323] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 39.897486][ T323] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 39.906855][ T323] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.914008][ T323] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.921663][ T323] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 39.929955][ T323] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 39.938146][ T323] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.945162][ T323] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.963661][ T323] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 39.971837][ T323] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 39.980476][ T323] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 39.988732][ T323] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 39.997138][ T323] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 40.005359][ T323] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 40.016222][ T323] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 40.024197][ T323] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 40.032933][ T323] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 40.040833][ T323] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 40.049677][ T494] device veth0_vlan entered promiscuous mode [ 40.059409][ T323] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 40.067957][ T323] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 40.077473][ T494] device veth1_macvtap entered promiscuous mode [ 40.086402][ T323] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 40.094192][ T323] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 40.102468][ T323] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 40.111907][ T323] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 40.121168][ T323] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 40.267785][ T499] F2FS-fs (loop2): invalid crc value [ 40.274972][ T499] F2FS-fs (loop2): Found nat_bits in checkpoint [ 40.301089][ T499] F2FS-fs (loop2): Start checkpoint disabled! [ 40.308042][ T499] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 40.315656][ T24] audit: type=1400 audit(1792215399.410:109): avc: denied { mount } for pid=498 comm="syz.2.17" name="/" dev="loop2" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 40.337555][ T24] audit: type=1400 audit(1792215399.410:110): avc: denied { write } for pid=498 comm="syz.2.17" name="/" dev="loop2" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 40.360165][ T24] audit: type=1400 audit(1792215399.410:111): avc: denied { add_name } for pid=498 comm="syz.2.17" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 40.380922][ T24] audit: type=1400 audit(1792215399.410:112): avc: denied { create } for pid=498 comm="syz.2.17" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 40.401586][ T24] audit: type=1400 audit(1792215399.410:113): avc: denied { write open } for pid=498 comm="syz.2.17" path="/0/file0/file0" dev="loop2" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 40.424765][ T24] audit: type=1400 audit(1792215399.410:114): avc: denied { ioctl } for pid=498 comm="syz.2.17" path="/0/file0/file0" dev="loop2" ino=10 ioctlcmd=0xf50d scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 40.438674][ T49] attempt to access beyond end of device [ 40.438674][ T49] loop2: rw=2049, want=40968, limit=40427 [ 40.684230][ T505] F2FS-fs (loop2): invalid crc value [ 40.690876][ T505] F2FS-fs (loop2): Found nat_bits in checkpoint [ 40.711102][ T505] F2FS-fs (loop2): Start checkpoint disabled! [ 40.717962][ T505] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 40.746870][ T7] device bridge_slave_1 left promiscuous mode [ 40.753055][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.761475][ T7] device bridge_slave_0 left promiscuous mode [ 40.767878][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.776475][ T7] device veth1_macvtap left promiscuous mode [ 40.782786][ T7] device veth0_vlan left promiscuous mode [ 40.812773][ T49] attempt to access beyond end of device [ 40.812773][ T49] loop2: rw=2049, want=40968, limit=40427 [ 41.067719][ T510] F2FS-fs (loop2): invalid crc value [ 41.074507][ T510] F2FS-fs (loop2): Found nat_bits in checkpoint [ 41.097519][ T510] F2FS-fs (loop2): Start checkpoint disabled! [ 41.104307][ T510] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 41.182704][ T323] attempt to access beyond end of device [ 41.182704][ T323] loop2: rw=2049, want=40968, limit=40427 [ 41.380407][ T515] F2FS-fs (loop2): invalid crc value [ 41.387087][ T515] F2FS-fs (loop2): Found nat_bits in checkpoint [ 41.407950][ T515] F2FS-fs (loop2): Start checkpoint disabled! [ 41.414791][ T515] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 41.478599][ T323] attempt to access beyond end of device [ 41.478599][ T323] loop2: rw=2049, want=40968, limit=40427 [ 41.680346][ T520] F2FS-fs (loop2): invalid crc value [ 41.686757][ T520] F2FS-fs (loop2): Found nat_bits in checkpoint [ 41.707588][ T520] F2FS-fs (loop2): Start checkpoint disabled! [ 41.714499][ T520] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 41.777853][ T7] attempt to access beyond end of device [ 41.777853][ T7] loop2: rw=2049, want=40968, limit=40427 [ 42.019425][ T525] F2FS-fs (loop2): invalid crc value [ 42.026044][ T525] F2FS-fs (loop2): Found nat_bits in checkpoint [ 42.053030][ T525] F2FS-fs (loop2): Start checkpoint disabled! [ 42.059889][ T525] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 42.110142][ T525] ------------[ cut here ]------------ [ 42.115647][ T525] WARNING: CPU: 0 PID: 525 at fs/f2fs/segment.c:2582 new_curseg+0xe3f/0x18d0 [ 42.124854][ T525] Modules linked in: [ 42.128855][ T525] CPU: 0 PID: 525 Comm: syz.2.22 Not tainted syzkaller #0 [ 42.136187][ T525] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 42.146407][ T525] RIP: 0010:new_curseg+0xe3f/0x18d0 [ 42.151900][ T525] Code: 08 00 00 00 e8 a2 c5 91 ff f0 41 80 0e 04 b8 01 00 00 00 48 89 85 58 ff ff ff 41 b4 01 41 89 dd e9 7c fb ff ff e8 a1 35 57 ff <0f> 0b 4c 8b b5 38 ff ff ff 4c 89 f7 be 08 00 00 00 e8 6b c5 91 ff [ 42.171646][ T525] RSP: 0018:ffffc90000f17738 EFLAGS: 00010293 [ 42.177952][ T525] RAX: ffffffff820d811f RBX: 0000000000000018 RCX: ffff88810de03c00 [ 42.186139][ T525] RDX: 0000000000000000 RSI: 0000000000000018 RDI: 0000000000000018 [ 42.194230][ T525] RBP: ffffc90000f17828 R08: 0000000000000003 R09: 0000000000000004 [ 42.202380][ T525] R10: dffffc0000000000 R11: fffff520001e2ed8 R12: ffff88810ef26658 [ 42.210483][ T525] R13: 0000000000000007 R14: 0000000000000018 R15: dffffc0000000000 [ 42.218503][ T525] FS: 00007fb527d0a6c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 42.227588][ T525] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 42.234183][ T525] CR2: 00007f43d2646000 CR3: 000000011c851000 CR4: 00000000003506b0 [ 42.242280][ T525] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 42.250284][ T525] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 42.258548][ T525] Call Trace: [ 42.261839][ T525] __allocate_new_segment+0x13d/0x810 [ 42.267494][ T525] f2fs_allocate_new_section+0x1f3/0x290 [ 42.273233][ T525] ? new_curseg+0x18d0/0x18d0 [ 42.278116][ T525] ? __kasan_check_write+0x14/0x20 [ 42.283229][ T525] ? down_read_trylock+0x106/0x160 [ 42.288523][ T525] ? __init_rwsem+0x1c0/0x1c0 [ 42.293209][ T525] ? has_not_enough_free_secs+0x416/0x900 [ 42.299088][ T525] expand_inode_data+0x690/0xa60 [ 42.304139][ T525] ? f2fs_insert_range+0x5e0/0x5e0 [ 42.309286][ T525] ? inode_dio_wait+0x25a/0x2d0 [ 42.314247][ T525] ? file_update_time+0x3d7/0x440 [ 42.319461][ T525] ? inode_owner_or_capable+0x140/0x140 [ 42.325020][ T525] f2fs_fallocate+0x3dd/0x750 [ 42.329780][ T525] vfs_fallocate+0x4b9/0x590 [ 42.334563][ T525] do_vfs_ioctl+0x123e/0x15d0 [ 42.339429][ T525] ? __ia32_compat_sys_ioctl+0x8c0/0x8c0 [ 42.345092][ T525] ? has_cap_mac_admin+0x370/0x370 [ 42.350493][ T525] ? kmem_cache_free+0x100/0x2d0 [ 42.355452][ T525] ? selinux_file_ioctl+0x3ad/0x4c0 [ 42.360711][ T525] ? putname+0xfe/0x150 [ 42.365010][ T525] ? selinux_file_alloc_security+0x120/0x120 [ 42.371047][ T525] ? do_sys_openat2+0x68e/0x750 [ 42.375980][ T525] ? __fget_files+0x2e1/0x340 [ 42.380868][ T525] ? security_file_ioctl+0x84/0xa0 [ 42.386192][ T525] __se_sys_ioctl+0x9f/0x1a0 [ 42.390803][ T525] __x64_sys_ioctl+0x7b/0x90 [ 42.395601][ T525] do_syscall_64+0x31/0x40 [ 42.400078][ T525] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 42.406002][ T525] RIP: 0033:0x7fb527ea5cb9 [ 42.410555][ T525] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 42.430585][ T525] RSP: 002b:00007fb527d0a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 42.439155][ T525] RAX: ffffffffffffffda RBX: 00007fb528120fa0 RCX: 00007fb527ea5cb9 [ 42.447981][ T525] RDX: 00002000000000c0 RSI: 0000000040305828 RDI: 0000000000000005 [ 42.456000][ T525] RBP: 00007fb527f13bf7 R08: 0000000000000000 R09: 0000000000000000 [ 42.464076][ T525] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 42.472338][ T525] R13: 00007fb528121038 R14: 00007fb528120fa0 R15: 00007ffcfcefaed8 [ 42.480515][ T525] ---[ end trace 42e3cc34bf2b424c ]--- [ 42.486064][ T525] ------------[ cut here ]------------ [ 42.491534][ T525] WARNING: CPU: 0 PID: 525 at fs/f2fs/segment.c:2636 new_curseg+0x14d2/0x18d0 [ 42.500417][ T525] Modules linked in: [ 42.504897][ T525] CPU: 0 PID: 525 Comm: syz.2.22 Tainted: G W syzkaller #0 [ 42.513506][ T525] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 42.523632][ T525] RIP: 0010:new_curseg+0x14d2/0x18d0 [ 42.529273][ T525] Code: ff e8 32 2f 57 ff 0f 0b 4c 8b 75 d0 49 8d 7e 78 be 08 00 00 00 e8 fe be 91 ff f0 41 80 4e 78 04 e9 b7 ed ff ff e8 0e 2f 57 ff <0f> 0b 48 8b 5d d0 48 8d 7b 78 be 08 00 00 00 e8 da be 91 ff f0 80 [ 42.548928][ T525] RSP: 0018:ffffc90000f17738 EFLAGS: 00010293 [ 42.555279][ T525] RAX: ffffffff820d87b2 RBX: ffff8881067d9b01 RCX: ffff88810de03c00 [ 42.563293][ T525] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 [ 42.571407][ T525] RBP: ffffc90000f17828 R08: ffff8881067d9be7 R09: 1ffff11020cfb37c [ 42.579400][ T525] R10: dffffc0000000000 R11: ffffed1020cfb37d R12: 0000000000000000 [ 42.587411][ T525] R13: 0000000000000007 R14: 0000000000000018 R15: 0000000000000018 [ 42.595382][ T525] FS: 00007fb527d0a6c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 42.604383][ T525] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 42.611029][ T525] CR2: 00007f43d2646000 CR3: 000000011c851000 CR4: 00000000003506b0 [ 42.619042][ T525] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 42.627119][ T525] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 42.635287][ T525] Call Trace: [ 42.638742][ T525] __allocate_new_segment+0x13d/0x810 [ 42.644148][ T525] f2fs_allocate_new_section+0x1f3/0x290 [ 42.649918][ T525] ? new_curseg+0x18d0/0x18d0 [ 42.654609][ T525] ? __kasan_check_write+0x14/0x20 [ 42.659944][ T525] ? down_read_trylock+0x106/0x160 [ 42.665130][ T525] ? __init_rwsem+0x1c0/0x1c0 [ 42.669923][ T525] ? has_not_enough_free_secs+0x416/0x900 [ 42.675655][ T525] expand_inode_data+0x690/0xa60 [ 42.680631][ T525] ? f2fs_insert_range+0x5e0/0x5e0 [ 42.686513][ T525] ? inode_dio_wait+0x25a/0x2d0 [ 42.691472][ T525] ? file_update_time+0x3d7/0x440 [ 42.696547][ T525] ? inode_owner_or_capable+0x140/0x140 [ 42.702212][ T525] f2fs_fallocate+0x3dd/0x750 [ 42.706915][ T525] vfs_fallocate+0x4b9/0x590 [ 42.711532][ T525] do_vfs_ioctl+0x123e/0x15d0 [ 42.716548][ T525] ? __ia32_compat_sys_ioctl+0x8c0/0x8c0 [ 42.722210][ T525] ? has_cap_mac_admin+0x370/0x370 [ 42.727392][ T525] ? kmem_cache_free+0x100/0x2d0 [ 42.732358][ T525] ? selinux_file_ioctl+0x3ad/0x4c0 [ 42.737595][ T525] ? putname+0xfe/0x150 [ 42.741768][ T525] ? selinux_file_alloc_security+0x120/0x120 [ 42.747862][ T525] ? do_sys_openat2+0x68e/0x750 [ 42.752854][ T525] ? __fget_files+0x2e1/0x340 [ 42.757705][ T525] ? security_file_ioctl+0x84/0xa0 [ 42.762910][ T525] __se_sys_ioctl+0x9f/0x1a0 [ 42.767679][ T525] __x64_sys_ioctl+0x7b/0x90 [ 42.772354][ T525] do_syscall_64+0x31/0x40 [ 42.776821][ T525] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 42.782745][ T525] RIP: 0033:0x7fb527ea5cb9 [ 42.787229][ T525] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 42.806956][ T525] RSP: 002b:00007fb527d0a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 42.815379][ T525] RAX: ffffffffffffffda RBX: 00007fb528120fa0 RCX: 00007fb527ea5cb9 [ 42.823919][ T525] RDX: 00002000000000c0 RSI: 0000000040305828 RDI: 0000000000000005 [ 42.832925][ T525] RBP: 00007fb527f13bf7 R08: 0000000000000000 R09: 0000000000000000 [ 42.841237][ T525] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 42.849357][ T525] R13: 00007fb528121038 R14: 00007fb528120fa0 R15: 00007ffcfcefaed8 [ 42.857674][ T525] ---[ end trace 42e3cc34bf2b424d ]--- [ 42.863188][ T525] ================================================================== [ 42.871260][ T525] BUG: KASAN: slab-out-of-bounds in reset_curseg+0x508/0x590 [ 42.878617][ T525] Read of size 4 at addr ffff88811cad5bc0 by task syz.2.22/525 [ 42.886330][ T525] [ 42.888741][ T525] CPU: 1 PID: 525 Comm: syz.2.22 Tainted: G W syzkaller #0 [ 42.897300][ T525] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 42.907445][ T525] Call Trace: [ 42.910734][ T525] __dump_stack+0x21/0x24 [ 42.915375][ T525] dump_stack_lvl+0x1a7/0x208 [ 42.920431][ T525] ? show_regs_print_info+0x18/0x18 [ 42.925995][ T525] ? thaw_kernel_threads+0x220/0x220 [ 42.932014][ T525] ? __warn+0x207/0x2a0 [ 42.936565][ T525] print_address_description+0x7f/0x2c0 [ 42.942123][ T525] ? reset_curseg+0x508/0x590 [ 42.946806][ T525] kasan_report+0x100/0x140 [ 42.951384][ T525] ? schedule_preempt_disabled+0x20/0x20 [ 42.957368][ T525] ? reset_curseg+0x508/0x590 [ 42.962131][ T525] __asan_report_load4_noabort+0x14/0x20 [ 42.967851][ T525] reset_curseg+0x508/0x590 [ 42.972358][ T525] new_curseg+0x12ea/0x18d0 [ 42.976859][ T525] __allocate_new_segment+0x13d/0x810 [ 42.982304][ T525] f2fs_allocate_new_section+0x1f3/0x290 [ 42.987941][ T525] ? new_curseg+0x18d0/0x18d0 [ 42.992616][ T525] ? __kasan_check_write+0x14/0x20 [ 42.997901][ T525] ? down_read_trylock+0x106/0x160 [ 43.003109][ T525] ? __init_rwsem+0x1c0/0x1c0 [ 43.007772][ T525] ? has_not_enough_free_secs+0x416/0x900 [ 43.013497][ T525] expand_inode_data+0x690/0xa60 [ 43.018578][ T525] ? f2fs_insert_range+0x5e0/0x5e0 [ 43.023774][ T525] ? inode_dio_wait+0x25a/0x2d0 [ 43.028765][ T525] ? file_update_time+0x3d7/0x440 [ 43.033790][ T525] ? inode_owner_or_capable+0x140/0x140 [ 43.039345][ T525] f2fs_fallocate+0x3dd/0x750 [ 43.044027][ T525] vfs_fallocate+0x4b9/0x590 [ 43.048617][ T525] do_vfs_ioctl+0x123e/0x15d0 [ 43.053561][ T525] ? __ia32_compat_sys_ioctl+0x8c0/0x8c0 [ 43.059193][ T525] ? has_cap_mac_admin+0x370/0x370 [ 43.064342][ T525] ? kmem_cache_free+0x100/0x2d0 [ 43.069269][ T525] ? selinux_file_ioctl+0x3ad/0x4c0 [ 43.074462][ T525] ? putname+0xfe/0x150 [ 43.078611][ T525] ? selinux_file_alloc_security+0x120/0x120 [ 43.084748][ T525] ? do_sys_openat2+0x68e/0x750 [ 43.089678][ T525] ? __fget_files+0x2e1/0x340 [ 43.094541][ T525] ? security_file_ioctl+0x84/0xa0 [ 43.099658][ T525] __se_sys_ioctl+0x9f/0x1a0 [ 43.104242][ T525] __x64_sys_ioctl+0x7b/0x90 [ 43.108834][ T525] do_syscall_64+0x31/0x40 [ 43.113239][ T525] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 43.119116][ T525] RIP: 0033:0x7fb527ea5cb9 [ 43.123522][ T525] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 43.143462][ T525] RSP: 002b:00007fb527d0a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 43.152060][ T525] RAX: ffffffffffffffda RBX: 00007fb528120fa0 RCX: 00007fb527ea5cb9 [ 43.160220][ T525] RDX: 00002000000000c0 RSI: 0000000040305828 RDI: 0000000000000005 [ 43.168187][ T525] RBP: 00007fb527f13bf7 R08: 0000000000000000 R09: 0000000000000000 [ 43.176230][ T525] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 43.184533][ T525] R13: 00007fb528121038 R14: 00007fb528120fa0 R15: 00007ffcfcefaed8 [ 43.192691][ T525] [ 43.195006][ T525] Allocated by task 525: [ 43.199345][ T525] __kasan_kmalloc+0xd4/0x100 [ 43.204005][ T525] __kmalloc+0x19f/0x330 [ 43.208232][ T525] kvmalloc_node+0x88/0x130 [ 43.212719][ T525] f2fs_build_segment_manager+0xdb6/0x48c0 [ 43.218806][ T525] f2fs_fill_super+0x4a08/0x73d0 [ 43.223762][ T525] mount_bdev+0x26a/0x380 [ 43.228106][ T525] f2fs_mount+0x34/0x40 [ 43.232263][ T525] legacy_get_tree+0xed/0x190 [ 43.237053][ T525] vfs_get_tree+0x89/0x260 [ 43.241631][ T525] do_new_mount+0x25a/0xa30 [ 43.246222][ T525] path_mount+0x581/0xca0 [ 43.250538][ T525] __se_sys_mount+0x320/0x390 [ 43.255214][ T525] __x64_sys_mount+0xbf/0xd0 [ 43.259806][ T525] do_syscall_64+0x31/0x40 [ 43.264213][ T525] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 43.270105][ T525] [ 43.272426][ T525] The buggy address belongs to the object at ffff88811cad5800 [ 43.272426][ T525] which belongs to the cache kmalloc-1k of size 1024 [ 43.286476][ T525] The buggy address is located 960 bytes inside of [ 43.286476][ T525] 1024-byte region [ffff88811cad5800, ffff88811cad5c00) [ 43.300004][ T525] The buggy address belongs to the page: [ 43.305659][ T525] page:ffffea000472b400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11cad0 [ 43.315982][ T525] head:ffffea000472b400 order:3 compound_mapcount:0 compound_pincount:0 [ 43.324404][ T525] flags: 0x4000000000010200(slab|head) [ 43.329873][ T525] raw: 4000000000010200 ffffea0004728e00 0000000500000005 ffff888100042f00 [ 43.338469][ T525] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 43.347236][ T525] page dumped because: kasan: bad access detected [ 43.353641][ T525] page_owner tracks the page as allocated [ 43.359532][ T525] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 216, ts 15592940479, free_ts 0 [ 43.377431][ T525] prep_new_page+0x176/0x190 [ 43.382026][ T525] get_page_from_freelist+0x225f/0x23f0 [ 43.387603][ T525] __alloc_pages_nodemask+0x29a/0x640 [ 43.392975][ T525] new_slab+0x84/0x3f0 [ 43.397100][ T525] ___slab_alloc+0x2f8/0x4c0 [ 43.401771][ T525] __slab_alloc+0x63/0xa0 [ 43.406257][ T525] __kmalloc_track_caller+0x1e4/0x310 [ 43.411612][ T525] __alloc_skb+0xdc/0x520 [ 43.415953][ T525] __tcp_send_ack+0x9b/0x650 [ 43.420540][ T525] tcp_send_ack+0x3b/0x60 [ 43.424851][ T525] tcp_cleanup_rbuf+0x281/0x5b0 [ 43.429688][ T525] tcp_recvmsg+0x1f07/0x2ee0 [ 43.434260][ T525] inet_recvmsg+0x13a/0x470 [ 43.438744][ T525] sock_read_iter+0x2c2/0x380 [ 43.443576][ T525] vfs_read+0x62a/0xa50 [ 43.448159][ T525] ksys_read+0x14a/0x260 [ 43.452496][ T525] page_owner free stack trace missing [ 43.457847][ T525] [ 43.460170][ T525] Memory state around the buggy address: [ 43.465799][ T525] ffff88811cad5a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 43.473849][ T525] ffff88811cad5b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 43.481906][ T525] >ffff88811cad5b80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 43.489971][ T525] ^ [ 43.496204][ T525] ffff88811cad5c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 43.504265][ T525] ffff88811cad5c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 43.512598][ T525] ================================================================== [ 43.520751][ T525] Disabling lock debugging due to kernel taint [ 43.528631][ T525] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN [ 43.531117][ T24] audit: type=1400 audit(1792215402.620:115): avc: denied { read } for pid=77 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 43.540624][ T525] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 43.540637][ T525] CPU: 1 PID: 525 Comm: syz.2.22 Tainted: G B W syzkaller #0 [ 43.540641][ T525] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 43.540656][ T525] RIP: 0010:update_sit_entry+0x3d6/0xfd0 [ 43.540673][ T525] Code: 89 45 a8 49 01 c7 41 f6 d6 41 80 e6 07 41 bd 01 00 00 00 44 89 f1 41 d3 e5 4d 89 fc 49 c1 ec 03 48 b8 00 00 00 00 00 fc ff df <41> 0f b6 04 04 84 c0 0f 85 3a 09 00 00 41 0f b6 1f 45 89 ee 41 21 [ 43.564515][ T24] audit: type=1400 audit(1792215402.660:116): avc: denied { search } for pid=77 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 43.571398][ T525] RSP: 0018:ffffc90000f17398 EFLAGS: 00010246 [ 43.571411][ T525] RAX: dffffc0000000000 RBX: ffff88811cad5bc8 RCX: 0000000000000007 [ 43.571424][ T525] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88811cad5bc8 [ 43.571438][ T525] RBP: ffffc90000f17410 R08: ffff88811c8e0006 R09: 1ffff1102391c000 [ 43.580416][ T24] audit: type=1400 audit(1792215402.660:117): avc: denied { write } for pid=77 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 43.590224][ T525] R10: dffffc0000000000 R11: ffffed102391c001 R12: 0000000000000000 [ 43.590231][ T525] R13: 0000000000000080 R14: 0000000000000007 R15: 0000000000000000 [ 43.590241][ T525] FS: 00007fb527d0a6c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 43.590248][ T525] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 43.590254][ T525] CR2: 00007fb527ef3400 CR3: 000000011c851000 CR4: 00000000003506a0 [ 43.590267][ T525] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 43.596370][ T24] audit: type=1400 audit(1792215402.660:118): avc: denied { add_name } for pid=77 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 43.615935][ T525] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 43.615938][ T525] Call Trace: [ 43.615959][ T525] f2fs_allocate_data_block+0x10c9/0x3880 [ 43.615979][ T525] ? f2fs_io_type_to_rw_hint+0x1e0/0x1e0 [ 43.637753][ T24] audit: type=1400 audit(1792215402.660:119): avc: denied { create } for pid=77 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 43.643679][ T525] ? f2fs_mark_inode_dirty_sync+0x110/0x140 [ 43.652086][ T24] audit: type=1400 audit(1792215402.660:120): avc: denied { append open } for pid=77 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 43.659885][ T525] ? inc_valid_block_count+0x590/0xaf0 [ 43.659896][ T525] __allocate_data_block+0x52b/0xa00 [ 43.659908][ T525] ? f2fs_map_blocks+0x34e0/0x34e0 [ 43.659920][ T525] f2fs_map_blocks+0xd94/0x34e0 [ 43.659937][ T525] ? f2fs_do_map_lock+0x2e0/0x2e0 [ 43.668675][ T24] audit: type=1400 audit(1792215402.660:121): avc: denied { getattr } for pid=77 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 43.689648][ T525] ? __kasan_check_write+0x14/0x20 [ 43.689659][ T525] ? down_read_trylock+0x106/0x160 [ 43.689673][ T525] expand_inode_data+0x6bf/0xa60 [ 43.689691][ T525] ? f2fs_insert_range+0x5e0/0x5e0 [ 43.902708][ T525] ? inode_dio_wait+0x25a/0x2d0 [ 43.907554][ T525] ? file_update_time+0x3d7/0x440 [ 43.912588][ T525] ? inode_owner_or_capable+0x140/0x140 [ 43.918199][ T525] f2fs_fallocate+0x3dd/0x750 [ 43.922894][ T525] vfs_fallocate+0x4b9/0x590 [ 43.927698][ T525] do_vfs_ioctl+0x123e/0x15d0 [ 43.932887][ T525] ? __ia32_compat_sys_ioctl+0x8c0/0x8c0 [ 43.938737][ T525] ? has_cap_mac_admin+0x370/0x370 [ 43.943967][ T525] ? kmem_cache_free+0x100/0x2d0 [ 43.949156][ T525] ? selinux_file_ioctl+0x3ad/0x4c0 [ 43.954348][ T525] ? putname+0xfe/0x150 [ 43.958573][ T525] ? selinux_file_alloc_security+0x120/0x120 [ 43.964554][ T525] ? do_sys_openat2+0x68e/0x750 [ 43.969411][ T525] ? __fget_files+0x2e1/0x340 [ 43.974165][ T525] ? security_file_ioctl+0x84/0xa0 [ 43.979586][ T525] __se_sys_ioctl+0x9f/0x1a0 [ 43.984269][ T525] __x64_sys_ioctl+0x7b/0x90 [ 43.988854][ T525] do_syscall_64+0x31/0x40 [ 43.993409][ T525] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 43.999310][ T525] RIP: 0033:0x7fb527ea5cb9 [ 44.003778][ T525] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 44.024812][ T525] RSP: 002b:00007fb527d0a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 44.033606][ T525] RAX: ffffffffffffffda RBX: 00007fb528120fa0 RCX: 00007fb527ea5cb9 [ 44.041600][ T525] RDX: 00002000000000c0 RSI: 0000000040305828 RDI: 0000000000000005 [ 44.049839][ T525] RBP: 00007fb527f13bf7 R08: 0000000000000000 R09: 0000000000000000 [ 44.058033][ T525] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 44.066002][ T525] R13: 00007fb528121038 R14: 00007fb528120fa0 R15: 00007ffcfcefaed8 [ 44.074693][ T525] Modules linked in: [ 44.079035][ T525] ---[ end trace 42e3cc34bf2b424e ]--- [ 44.084772][ T525] RIP: 0010:update_sit_entry+0x3d6/0xfd0 [ 44.090982][ T525] Code: 89 45 a8 49 01 c7 41 f6 d6 41 80 e6 07 41 bd 01 00 00 00 44 89 f1 41 d3 e5 4d 89 fc 49 c1 ec 03 48 b8 00 00 00 00 00 fc ff df <41> 0f b6 04 04 84 c0 0f 85 3a 09 00 00 41 0f b6 1f 45 89 ee 41 21 [ 44.111623][ T525] RSP: 0018:ffffc90000f17398 EFLAGS: 00010246 [ 44.117952][ T525] RAX: dffffc0000000000 RBX: ffff88811cad5bc8 RCX: 0000000000000007 [ 44.126051][ T525] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88811cad5bc8 [ 44.134035][ T525] RBP: ffffc90000f17410 R08: ffff88811c8e0006 R09: 1ffff1102391c000 [ 44.142252][ T525] R10: dffffc0000000000 R11: ffffed102391c001 R12: 0000000000000000 [ 44.150248][ T525] R13: 0000000000000080 R14: 0000000000000007 R15: 0000000000000000 [ 44.158410][ T525] FS: 00007fb527d0a6c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 44.167610][ T525] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 44.174282][ T525] CR2: 00007fb527ef3400 CR3: 000000011c851000 CR4: 00000000003506a0 [ 44.182447][ T525] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 44.190785][ T525] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 44.199086][ T525] Kernel panic - not syncing: Fatal exception [ 44.205529][ T525] Kernel Offset: disabled [ 44.209861][ T525] Rebooting in 86400 seconds..