Warning: Permanently added '10.128.1.181' (ED25519) to the list of known hosts. 2026/09/01 12:34:46 parsed 1 programs 2026/09/01 12:34:46 serving rpc on tcp://42143 [ 19.878907][ T24] audit: type=1400 audit(1788266086.740:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 19.899647][ T24] audit: type=1400 audit(1788266086.740:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 19.919494][ T24] audit: type=1400 audit(1788266086.740:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 20.512525][ T24] audit: type=1400 audit(1788266087.370:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 20.513565][ T293] cgroup: Unknown subsys name 'net' [ 20.535210][ T24] audit: type=1400 audit(1788266087.370:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.562434][ T24] audit: type=1400 audit(1788266087.410:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.562600][ T293] cgroup: Unknown subsys name 'devices' [ 20.678426][ T293] cgroup: Unknown subsys name 'hugetlb' [ 20.684070][ T293] cgroup: Unknown subsys name 'rlimit' [ 20.826030][ T24] audit: type=1400 audit(1788266087.680:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 20.849287][ T24] audit: type=1400 audit(1788266087.680:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 20.869677][ T297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 20.869777][ T24] audit: type=1400 audit(1788266087.680:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 20.898691][ T24] audit: type=1400 audit(1788266087.680:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 20.923838][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.247761][ T299] request_module fs-gadgetfs succeeded, but still no fs? [ 21.258054][ T299] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 21.661146][ T332] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.668489][ T332] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.675781][ T332] device bridge_slave_0 entered promiscuous mode [ 21.682727][ T332] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.689851][ T332] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.697230][ T332] device bridge_slave_1 entered promiscuous mode [ 21.727954][ T332] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.734998][ T332] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.742305][ T332] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.749338][ T332] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.765545][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.772943][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.780245][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 21.788054][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.801231][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.809379][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.816381][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.823797][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.832132][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.839250][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.852268][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.860216][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.871088][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.883180][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.891203][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.898737][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.906620][ T332] device veth0_vlan entered promiscuous mode [ 21.916064][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.925037][ T332] device veth1_macvtap entered promiscuous mode [ 21.934450][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.943859][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/09/01 12:34:49 executed programs: 0 [ 22.288015][ T365] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.295068][ T365] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.302601][ T365] device bridge_slave_0 entered promiscuous mode [ 22.309728][ T365] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.316926][ T365] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.324300][ T365] device bridge_slave_1 entered promiscuous mode [ 22.361132][ T365] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.368200][ T365] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.375429][ T365] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.382461][ T365] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.398011][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.405707][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.413372][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.425311][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.433429][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.440451][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.448973][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.457141][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.464148][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.474813][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.487302][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.499083][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.510152][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.518244][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.525611][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.534216][ T365] device veth0_vlan entered promiscuous mode [ 22.546926][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.555767][ T365] device veth1_macvtap entered promiscuous mode [ 22.564470][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.574367][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.637806][ T370] ================================================================== [ 22.645916][ T370] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 [ 22.652605][ T370] Write of size 8 at addr ffff888110a5c150 by task syz.2.17/370 [ 22.660207][ T370] [ 22.662528][ T370] CPU: 1 PID: 370 Comm: syz.2.17 Not tainted syzkaller #0 [ 22.669606][ T370] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 22.679644][ T370] Call Trace: [ 22.682913][ T370] __dump_stack+0x21/0x24 [ 22.687225][ T370] dump_stack_lvl+0x1a7/0x208 [ 22.691898][ T370] ? show_regs_print_info+0x18/0x18 [ 22.697090][ T370] ? thaw_kernel_threads+0x220/0x220 [ 22.702352][ T370] print_address_description+0x7f/0x2c0 [ 22.707875][ T370] ? mutex_lock+0x85/0xf0 [ 22.712181][ T370] kasan_report+0x100/0x140 [ 22.716659][ T370] ? mutex_lock+0x85/0xf0 [ 22.720969][ T370] kasan_check_range+0x249/0x2a0 [ 22.725886][ T370] __kasan_check_write+0x14/0x20 [ 22.730817][ T370] mutex_lock+0x85/0xf0 [ 22.734950][ T370] ? mutex_trylock+0xb0/0xb0 [ 22.739553][ T370] ? l2tp_session_put+0xb2/0x1a0 [ 22.744486][ T370] ? l2tp_session_delete+0x3a9/0x4a0 [ 22.749747][ T370] pppol2tp_release+0x178/0x2b0 [ 22.754576][ T370] sock_close+0xb8/0x200 [ 22.758791][ T370] ? sock_mmap+0xa0/0xa0 [ 22.763008][ T370] __fput+0x2dc/0x730 [ 22.766976][ T370] ____fput+0x15/0x20 [ 22.770932][ T370] task_work_run+0x127/0x190 [ 22.775507][ T370] do_exit+0xa7c/0x24e0 [ 22.779641][ T370] ? finish_task_switch+0x1e2/0x5a0 [ 22.784816][ T370] ? put_task_struct+0x90/0x90 [ 22.789555][ T370] ? remove_hrtimer+0x1aa/0x490 [ 22.794393][ T370] ? __kasan_check_write+0x14/0x20 [ 22.799493][ T370] ? _raw_spin_lock_irq+0x95/0xf0 [ 22.804494][ T370] do_group_exit+0x149/0x310 [ 22.809059][ T370] ? __kasan_check_write+0x14/0x20 [ 22.814145][ T370] ? recalc_sigpending+0x1c4/0x230 [ 22.819256][ T370] get_signal+0xfb1/0x1300 [ 22.823776][ T370] arch_do_signal_or_restart+0xe7/0x11b0 [ 22.829391][ T370] ? nanosleep_copyout+0x120/0x120 [ 22.834485][ T370] ? get_timespec64+0x116/0x1b0 [ 22.839324][ T370] ? __ia32_sys_rt_sigreturn+0x730/0x730 [ 22.844930][ T370] ? __x64_sys_clock_nanosleep+0xb0/0xb0 [ 22.850542][ T370] ? debug_smp_processor_id+0x17/0x20 [ 22.855893][ T370] exit_to_user_mode_loop+0xa2/0xe0 [ 22.861070][ T370] exit_to_user_mode_prepare+0x76/0xa0 [ 22.866509][ T370] syscall_exit_to_user_mode+0x1d/0x40 [ 22.871942][ T370] do_syscall_64+0x3d/0x40 [ 22.876353][ T370] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 22.882257][ T370] RIP: 0033:0x7fad83dac2d7 [ 22.886672][ T370] Code: Unable to access opcode bytes at RIP 0x7fad83dac2ad. [ 22.894020][ T370] RSP: 002b:00007ffce2906ad0 EFLAGS: 00000202 ORIG_RAX: 00000000000000e6 [ 22.902419][ T370] RAX: fffffffffffffdfc RBX: 0000555582af0500 RCX: 00007fad83dac2d7 [ 22.910385][ T370] RDX: 00007ffce2906b10 RSI: 0000000000000000 RDI: 0000000000000000 [ 22.918369][ T370] RBP: 00007fad83e88024 R08: 0000000000000000 R09: 0000000000000000 [ 22.926324][ T370] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 22.934276][ T370] R13: 00007fad84078fac R14: 00007fad84078fa0 R15: 00007fad84078fa0 [ 22.942232][ T370] [ 22.944554][ T370] Allocated by task 369: [ 22.948787][ T370] __kasan_kmalloc+0xd4/0x100 [ 22.953447][ T370] __kmalloc+0x19f/0x330 [ 22.957663][ T370] l2tp_session_create+0x39/0xb60 [ 22.962662][ T370] pppol2tp_connect+0xbf5/0x1640 [ 22.967575][ T370] __sys_connect+0x3ce/0x450 [ 22.972140][ T370] __x64_sys_connect+0x7a/0x90 [ 22.976913][ T370] do_syscall_64+0x31/0x40 [ 22.981307][ T370] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 22.987167][ T370] [ 22.989478][ T370] Freed by task 370: [ 22.993347][ T370] kasan_set_track+0x4a/0x70 [ 22.997913][ T370] kasan_set_free_info+0x23/0x40 [ 23.002840][ T370] ____kasan_slab_free+0x125/0x160 [ 23.007932][ T370] __kasan_slab_free+0x11/0x20 [ 23.012677][ T370] slab_free_freelist_hook+0xc5/0x190 [ 23.018026][ T370] kfree+0xc0/0x270 [ 23.021813][ T370] l2tp_session_put+0xb2/0x1a0 [ 23.026692][ T370] l2tp_session_delete+0x3a9/0x4a0 [ 23.031788][ T370] pppol2tp_release+0x169/0x2b0 [ 23.036619][ T370] sock_close+0xb8/0x200 [ 23.040848][ T370] __fput+0x2dc/0x730 [ 23.044809][ T370] ____fput+0x15/0x20 [ 23.048772][ T370] task_work_run+0x127/0x190 [ 23.053342][ T370] do_exit+0xa7c/0x24e0 [ 23.057477][ T370] do_group_exit+0x149/0x310 [ 23.062041][ T370] get_signal+0xfb1/0x1300 [ 23.066434][ T370] arch_do_signal_or_restart+0xe7/0x11b0 [ 23.072042][ T370] exit_to_user_mode_loop+0xa2/0xe0 [ 23.077214][ T370] exit_to_user_mode_prepare+0x76/0xa0 [ 23.082649][ T370] syscall_exit_to_user_mode+0x1d/0x40 [ 23.088084][ T370] do_syscall_64+0x3d/0x40 [ 23.092477][ T370] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 23.098344][ T370] [ 23.100652][ T370] The buggy address belongs to the object at ffff888110a5c000 [ 23.100652][ T370] which belongs to the cache kmalloc-512 of size 512 [ 23.114682][ T370] The buggy address is located 336 bytes inside of [ 23.114682][ T370] 512-byte region [ffff888110a5c000, ffff888110a5c200) [ 23.127945][ T370] The buggy address belongs to the page: [ 23.133577][ T370] page:ffffea0004429700 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x110a5c [ 23.143962][ T370] head:ffffea0004429700 order:2 compound_mapcount:0 compound_pincount:0 [ 23.152261][ T370] flags: 0x4000000000010200(slab|head) [ 23.157698][ T370] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 [ 23.166255][ T370] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 23.174808][ T370] page dumped because: kasan: bad access detected [ 23.181283][ T370] page_owner tracks the page as allocated [ 23.186989][ T370] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 369, ts 22598103476, free_ts 22588156580 [ 23.207358][ T370] prep_new_page+0x176/0x190 [ 23.211925][ T370] get_page_from_freelist+0x225f/0x23f0 [ 23.217451][ T370] __alloc_pages_nodemask+0x29a/0x640 [ 23.222797][ T370] new_slab+0x84/0x3f0 [ 23.226838][ T370] ___slab_alloc+0x2f8/0x4c0 [ 23.231404][ T370] __slab_alloc+0x63/0xa0 [ 23.235705][ T370] kmem_cache_alloc_trace+0x1a8/0x2e0 [ 23.241048][ T370] l2tp_tunnel_create+0x97/0x460 [ 23.245958][ T370] pppol2tp_connect+0x7ef/0x1640 [ 23.250877][ T370] __sys_connect+0x3ce/0x450 [ 23.255455][ T370] __x64_sys_connect+0x7a/0x90 [ 23.260285][ T370] do_syscall_64+0x31/0x40 [ 23.264703][ T370] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 23.270566][ T370] page last free stack trace: [ 23.275223][ T370] __free_pages_ok+0x80b/0x830 [ 23.279960][ T370] __free_pages+0xd8/0x390 [ 23.284350][ T370] __free_slab+0xcf/0x190 [ 23.288651][ T370] unfreeze_partials+0x150/0x180 [ 23.293567][ T370] put_cpu_partial+0xc1/0x180 [ 23.298218][ T370] __slab_free+0x2c9/0x3a0 [ 23.302609][ T370] ___cache_free+0x10e/0x130 [ 23.307173][ T370] qlink_free+0x50/0x90 [ 23.311305][ T370] qlist_free_all+0x5f/0xb0 [ 23.315785][ T370] kasan_quarantine_reduce+0x14a/0x160 [ 23.321238][ T370] __kasan_slab_alloc+0x2f/0xe0 [ 23.326064][ T370] slab_post_alloc_hook+0x5d/0x2f0 [ 23.331163][ T370] kmem_cache_alloc_trace+0x155/0x2e0 [ 23.336512][ T370] ____ip_mc_inc_group+0x1b7/0x8b0 [ 23.341598][ T370] ip_mc_up+0x112/0x1f0 [ 23.345728][ T370] inetdev_event+0xbf2/0x1010 [ 23.350376][ T370] [ 23.352680][ T370] Memory state around the buggy address: [ 23.358374][ T370] ffff888110a5c000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.366408][ T370] ffff888110a5c080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.374461][ T370] >ffff888110a5c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.382492][ T370] ^ [ 23.389138][ T370] ffff888110a5c180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.397173][ T370] ffff888110a5c200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.405290][ T370] ================================================================== [ 23.413328][ T370] Disabling lock debugging due to kernel taint