Warning: Permanently added '10.128.1.146' (ED25519) to the list of known hosts. 2026/10/25 19:32:04 parsed 1 programs 2026/10/25 19:32:04 serving rpc on tcp://35033 [ 39.440754][ T28] kauditd_printk_skb: 32 callbacks suppressed [ 39.440769][ T28] audit: type=1400 audit(1792956725.400:106): avc: denied { unlink } for pid=412 comm="syz-executor" name="swap-file" dev="sda1" ino=2027 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 39.527217][ T412] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 40.483793][ T28] audit: type=1401 audit(1792956726.440:107): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 40.838705][ T448] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.845904][ T448] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.853506][ T448] device bridge_slave_0 entered promiscuous mode [ 40.860606][ T448] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.867986][ T448] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.875814][ T448] device bridge_slave_1 entered promiscuous mode [ 40.923887][ T448] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.930979][ T448] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.938499][ T448] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.945637][ T448] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.966680][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.974047][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.981987][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 40.989497][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 40.999013][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 41.007370][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.014471][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.023349][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 41.031824][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.038877][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.052267][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 41.062366][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 41.077634][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 41.089923][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 41.098901][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 41.107035][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 41.115849][ T448] device veth0_vlan entered promiscuous mode [ 41.127213][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 41.136748][ T448] device veth1_macvtap entered promiscuous mode [ 41.146833][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 41.157509][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/10/25 19:32:07 executed programs: 0 [ 41.579395][ T476] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.587471][ T476] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.595642][ T476] device bridge_slave_0 entered promiscuous mode [ 41.608225][ T476] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.615406][ T476] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.623113][ T476] device bridge_slave_1 entered promiscuous mode [ 41.679747][ T476] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.686852][ T476] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.694220][ T476] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.701329][ T476] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.722687][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 41.731788][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.739732][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.751842][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 41.760386][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.767440][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.775039][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 41.783666][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.790813][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.804176][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 41.815136][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 41.830584][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 41.839190][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 41.852530][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 41.860566][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 41.868886][ T476] device veth0_vlan entered promiscuous mode [ 41.875713][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 41.884250][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 41.896897][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 41.905258][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 41.914709][ T476] device veth1_macvtap entered promiscuous mode [ 41.924469][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 41.933063][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 41.941897][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 41.951912][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 41.960842][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 41.985273][ T28] audit: type=1400 audit(1792956727.940:108): avc: denied { mount } for pid=481 comm="syz.2.17" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 42.008013][ T482] printk: console [ttyS0] disabled [ 42.016166][ T482] printk: console [ttyS0] enabled [ 42.030890][ T482] ================================================================== [ 42.039504][ T482] BUG: KASAN: use-after-free in string+0x20f/0x2a0 [ 42.046059][ T482] Read of size 1 at addr ffff888109b51690 by task syz.2.17/482 [ 42.053627][ T482] [ 42.056048][ T482] CPU: 1 PID: 482 Comm: syz.2.17 Not tainted syzkaller #0 [ 42.063276][ T482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 42.073604][ T482] Call Trace: [ 42.076980][ T482] [ 42.080224][ T482] __dump_stack+0x21/0x24 [ 42.084716][ T482] dump_stack_lvl+0x110/0x170 [ 42.089429][ T482] ? __cfi_dump_stack_lvl+0x8/0x8 [ 42.094840][ T482] ? string+0x20f/0x2a0 [ 42.099651][ T482] print_address_description+0x71/0x200 [ 42.105307][ T482] print_report+0x4a/0x60 [ 42.109650][ T482] kasan_report+0x122/0x150 [ 42.114270][ T482] ? string+0x20f/0x2a0 [ 42.118457][ T482] __asan_report_load1_noabort+0x14/0x20 [ 42.124099][ T482] string+0x20f/0x2a0 [ 42.128091][ T482] vsnprintf+0xec5/0x1990 [ 42.132424][ T482] seq_printf+0x185/0x280 [ 42.136774][ T482] ? __cfi_seq_printf+0x10/0x10 [ 42.141628][ T482] ? radix_tree_lookup+0x248/0x290 [ 42.146743][ T482] ? _find_next_bit+0x129/0x130 [ 42.151599][ T482] show_interrupts+0x8f9/0xa00 [ 42.156375][ T482] seq_read_iter+0x992/0xd80 [ 42.161026][ T482] proc_reg_read_iter+0x1e0/0x2b0 [ 42.166065][ T482] generic_file_splice_read+0x1d9/0x530 [ 42.171629][ T482] ? __cfi_generic_file_splice_read+0x10/0x10 [ 42.177806][ T482] ? __kasan_check_read+0x11/0x20 [ 42.182836][ T482] ? fsnotify_perm+0x269/0x5b0 [ 42.187618][ T482] ? security_file_permission+0x94/0xb0 [ 42.193359][ T482] ? rw_verify_area+0xa7/0x1c0 [ 42.198142][ T482] splice_direct_to_actor+0x3d0/0xb30 [ 42.203536][ T482] ? __cfi_direct_splice_actor+0x10/0x10 [ 42.209301][ T482] ? __cfi_splice_direct_to_actor+0x10/0x10 [ 42.215301][ T482] ? security_file_permission+0x94/0xb0 [ 42.221159][ T482] ? rw_verify_area+0xa7/0x1c0 [ 42.225969][ T482] do_splice_direct+0x1c2/0x2d0 [ 42.230960][ T482] ? __cfi_do_splice_direct+0x10/0x10 [ 42.236375][ T482] ? security_file_permission+0x94/0xb0 [ 42.242111][ T482] do_sendfile+0x515/0xe20 [ 42.246569][ T482] ? do_preadv+0x390/0x390 [ 42.251171][ T482] ? __se_sys_futex+0x136/0x310 [ 42.256029][ T482] __x64_sys_sendfile64+0x199/0x1f0 [ 42.261236][ T482] ? __cfi___x64_sys_sendfile64+0x10/0x10 [ 42.266966][ T482] ? fpregs_restore_userregs+0x128/0x260 [ 42.272866][ T482] ? switch_fpu_return+0xe/0x10 [ 42.277731][ T482] x64_sys_call+0x62c/0x9a0 [ 42.282328][ T482] do_syscall_64+0x4c/0xa0 [ 42.286930][ T482] ? clear_bhb_loop+0x30/0x80 [ 42.291897][ T482] ? clear_bhb_loop+0x30/0x80 [ 42.296642][ T482] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 42.302564][ T482] RIP: 0033:0x7f33c119e159 [ 42.307174][ T482] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 42.326805][ T482] RSP: 002b:00007f33c2026028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 42.335421][ T482] RAX: ffffffffffffffda RBX: 00007f33c1425fa0 RCX: 00007f33c119e159 [ 42.343700][ T482] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000007 [ 42.351892][ T482] RBP: 00007f33c123506b R08: 0000000000000000 R09: 0000000000000000 [ 42.359973][ T482] R10: 00000000000007ff R11: 0000000000000246 R12: 0000000000000000 [ 42.368141][ T482] R13: 00007f33c1426038 R14: 00007f33c1425fa0 R15: 00007ffdba867198 [ 42.376222][ T482] [ 42.379252][ T482] [ 42.381612][ T482] Allocated by task 1: [ 42.385709][ T482] kasan_set_track+0x4b/0x70 [ 42.390426][ T482] kasan_save_alloc_info+0x1f/0x30 [ 42.395571][ T482] __kasan_kmalloc+0x95/0xb0 [ 42.400200][ T482] __kmalloc_node_track_caller+0xb1/0x1e0 [ 42.406043][ T482] kvasprintf+0xe8/0x1a0 [ 42.410396][ T482] kasprintf+0xdf/0x130 [ 42.414677][ T482] uart_add_one_port+0x38b/0x1cf0 [ 42.419764][ T482] serial8250_register_8250_port+0x1368/0x1b70 [ 42.426103][ T482] serial_pnp_probe+0x51e/0x710 [ 42.430967][ T482] pnp_device_probe+0x312/0x4d0 [ 42.435923][ T482] really_probe+0x2d7/0x9a0 [ 42.440541][ T482] __driver_probe_device+0x193/0x270 [ 42.445987][ T482] driver_probe_device+0x54/0x3e0 [ 42.451128][ T482] __driver_attach+0x41a/0x5d0 [ 42.455913][ T482] bus_for_each_dev+0x18c/0x200 [ 42.460771][ T482] driver_attach+0x42/0x50 [ 42.465211][ T482] bus_add_driver+0x322/0x560 [ 42.469902][ T482] driver_register+0x335/0x440 [ 42.474686][ T482] pnp_register_driver+0x7d/0x90 [ 42.479641][ T482] serial8250_pnp_init+0x15/0x20 [ 42.484695][ T482] serial8250_init+0xa0/0x16e [ 42.489481][ T482] do_one_initcall+0x1d6/0x580 [ 42.494446][ T482] do_initcall_level+0x174/0x2df [ 42.499408][ T482] do_initcalls+0x50/0x92 [ 42.503761][ T482] do_basic_setup+0x92/0x99 [ 42.508306][ T482] kernel_init_freeable+0x2d1/0x42d [ 42.513538][ T482] kernel_init+0x1d/0x1c0 [ 42.518011][ T482] ret_from_fork+0x1f/0x30 [ 42.522444][ T482] [ 42.524883][ T482] Freed by task 482: [ 42.528783][ T482] kasan_set_track+0x4b/0x70 [ 42.533407][ T482] kasan_save_free_info+0x2b/0x40 [ 42.538660][ T482] ____kasan_slab_free+0x132/0x180 [ 42.543844][ T482] __kasan_slab_free+0x11/0x20 [ 42.548632][ T482] slab_free_freelist_hook+0xc2/0x190 [ 42.554223][ T482] __kmem_cache_free+0xb7/0x1b0 [ 42.559111][ T482] kfree+0x6f/0xf0 [ 42.562853][ T482] uart_remove_one_port+0x36a/0x720 [ 42.568072][ T482] serial8250_unregister_port+0xad/0x250 [ 42.573863][ T482] serial_pnp_remove+0x6b/0x90 [ 42.578770][ T482] pnp_device_remove+0x84/0x260 [ 42.583638][ T482] device_release_driver_internal+0x486/0x7e0 [ 42.589803][ T482] device_driver_detach+0x3b/0x40 [ 42.595024][ T482] unbind_store+0x2e5/0x300 [ 42.599552][ T482] drv_attr_store+0x88/0xb0 [ 42.604093][ T482] sysfs_kf_write+0x137/0x150 [ 42.608793][ T482] kernfs_fop_write_iter+0x307/0x470 [ 42.614107][ T482] vfs_write+0x5ef/0xd00 [ 42.618396][ T482] ksys_write+0x14a/0x260 [ 42.622855][ T482] __x64_sys_write+0x7b/0x90 [ 42.627583][ T482] x64_sys_call+0x27b/0x9a0 [ 42.632576][ T482] do_syscall_64+0x4c/0xa0 [ 42.637021][ T482] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 42.642945][ T482] [ 42.645367][ T482] The buggy address belongs to the object at ffff888109b51690 [ 42.645367][ T482] which belongs to the cache kmalloc-8 of size 8 [ 42.659617][ T482] The buggy address is located 0 bytes inside of [ 42.659617][ T482] 8-byte region [ffff888109b51690, ffff888109b51698) [ 42.672959][ T482] [ 42.675389][ T482] The buggy address belongs to the physical page: [ 42.681989][ T482] page:ffffea000426d440 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109b51 [ 42.692371][ T482] flags: 0x4000000000000200(slab|zone=1) [ 42.698044][ T482] raw: 4000000000000200 0000000000000000 dead000000000001 ffff888100042300 [ 42.706652][ T482] raw: 0000000000000000 0000000000660066 00000001ffffffff 0000000000000000 [ 42.715243][ T482] page dumped because: kasan: bad access detected [ 42.721674][ T482] page_owner tracks the page as allocated [ 42.727532][ T482] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 2551818490, free_ts 0 [ 42.744143][ T482] post_alloc_hook+0x1f5/0x210 [ 42.748947][ T482] prep_new_page+0x1c/0x110 [ 42.753487][ T482] get_page_from_freelist+0x2ca9/0x2d20 [ 42.759156][ T482] __alloc_pages+0x1fa/0x610 [ 42.763798][ T482] alloc_slab_page+0x6e/0xf0 [ 42.768548][ T482] new_slab+0x98/0x3e0 [ 42.772724][ T482] ___slab_alloc+0x70f/0xb70 [ 42.777346][ T482] __slab_alloc+0x5e/0xa0 [ 42.781702][ T482] __kmem_cache_alloc_node+0x204/0x2d0 [ 42.787192][ T482] __kmalloc+0xa4/0x1e0 [ 42.791367][ T482] acpi_ns_internalize_name+0x2cd/0x3b0 [ 42.796951][ T482] acpi_ns_get_node+0x1a7/0x360 [ 42.801979][ T482] acpi_get_handle+0x184/0x290 [ 42.806780][ T482] acpi_has_method+0x89/0xe0 [ 42.811399][ T482] handle_ioapic_add+0xaf/0x970 [ 42.816279][ T482] acpi_ns_walk_namespace+0x251/0x680 [ 42.821776][ T482] page_owner free stack trace missing [ 42.827177][ T482] [ 42.829514][ T482] Memory state around the buggy address: [ 42.835156][ T482] ffff888109b51580: fc fc fc fc fa fc fc fc fc fa fc fc fc fc fa fc [ 42.843230][ T482] ffff888109b51600: fc fc fc fa fc fc fc fc fa fc fc fc fc 00 fc fc [ 42.851429][ T482] >ffff888109b51680: fc fc fa fc fc fc fc 00 fc fc fc fc fa fc fc fc [ 42.859502][ T482] ^ [ 42.864135][ T482] ffff888109b51700: fc 04 fc fc fc fc fa fc fc fc fc fa fc fc fc fc [ 42.872220][ T482] ffff888109b51780: fa fc fc fc fc fa fc fc fc fc fa fc fc fc fc fa [ 42.880320][ T482] ================================================================== [ 42.888394][ T482] Disabling lock debugging due to kernel taint [ 42.902159][ T28] audit: type=1400 audit(1792956728.860:109): avc: denied { unmount } for pid=476 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 42.934925][ T28] audit: type=1400 audit(1792956728.860:110): avc: denied { unmount } for pid=476 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 42.955928][ T28] audit: type=1400 audit(1792956728.860:111): avc: denied { read } for pid=84 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 42.979321][ T28] audit: type=1400 audit(1792956728.860:112): avc: denied { search } for pid=84 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 43.001382][ T28] audit: type=1400 audit(1792956728.860:113): avc: denied { write } for pid=84 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 43.024171][ T28] audit: type=1400 audit(1792956728.860:114): avc: denied { add_name } for pid=84 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 43.046219][ T28] audit: type=1400 audit(1792956728.860:115): avc: denied { create } for pid=84 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 43.421778][ T43] device bridge_slave_1 left promiscuous mode [ 43.428108][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.436456][ T43] device bridge_slave_0 left promiscuous mode [ 43.443437][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.452476][ T43] device veth1_macvtap left promiscuous mode [ 43.460560][ T43] device veth0_vlan left promiscuous mode syzkaller 2026/10/25 19:32:12 executed programs: 206 2026/10/25 19:32:17 executed programs: 506