Warning: Permanently added '10.128.0.30' (ED25519) to the list of known hosts. 2026/06/29 08:36:27 parsed 1 programs 2026/06/29 08:36:27 serving rpc on tcp://46665 [ 20.098133][ T24] audit: type=1400 audit(1782722187.320:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 20.101437][ T24] audit: type=1400 audit(1782722187.320:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 20.105097][ T24] audit: type=1400 audit(1782722187.330:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 20.664279][ T24] audit: type=1400 audit(1782722187.890:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 20.665247][ T293] cgroup: Unknown subsys name 'net' [ 20.686911][ T24] audit: type=1400 audit(1782722187.890:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.714205][ T24] audit: type=1400 audit(1782722187.920:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.714344][ T293] cgroup: Unknown subsys name 'devices' [ 20.830471][ T293] cgroup: Unknown subsys name 'hugetlb' [ 20.836061][ T293] cgroup: Unknown subsys name 'rlimit' [ 20.947452][ T24] audit: type=1400 audit(1782722188.170:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 20.970604][ T24] audit: type=1400 audit(1782722188.170:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 20.990970][ T24] audit: type=1400 audit(1782722188.170:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 20.996317][ T297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 21.011295][ T24] audit: type=1400 audit(1782722188.170:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 21.064850][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.431684][ T299] request_module fs-gadgetfs succeeded, but still no fs? [ 21.441865][ T299] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 21.679294][ T322] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.686383][ T322] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.694001][ T322] device bridge_slave_0 entered promiscuous mode [ 21.701403][ T322] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.708416][ T322] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.715696][ T322] device bridge_slave_1 entered promiscuous mode [ 21.745873][ T322] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.752891][ T322] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.760141][ T322] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.767144][ T322] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.782105][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.789350][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.796527][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 21.803996][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.812922][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.821071][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.828066][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.836187][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.844405][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.851422][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.862893][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.871705][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.883483][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.894400][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.902442][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.910052][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.918044][ T322] device veth0_vlan entered promiscuous mode [ 21.928767][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.937837][ T322] device veth1_macvtap entered promiscuous mode [ 21.946326][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.955583][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/06/29 08:36:29 executed programs: 0 [ 22.409156][ T362] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.416180][ T362] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.423520][ T362] device bridge_slave_0 entered promiscuous mode [ 22.430264][ T362] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.437269][ T362] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.444747][ T362] device bridge_slave_1 entered promiscuous mode [ 22.480104][ T362] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.487114][ T362] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.494346][ T362] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.501358][ T362] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.518790][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.526202][ T327] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.533392][ T327] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.541706][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.549889][ T327] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.556883][ T327] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.567601][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.575792][ T327] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.582812][ T327] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.592966][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.601663][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.610547][ T7] device bridge_slave_1 left promiscuous mode [ 22.616622][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.624248][ T7] device bridge_slave_0 left promiscuous mode [ 22.630411][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.637954][ T7] device veth1_macvtap left promiscuous mode [ 22.644147][ T7] device veth0_vlan left promiscuous mode [ 22.747205][ T362] device veth0_vlan entered promiscuous mode [ 22.753676][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.761957][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.769853][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.777130][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.787846][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 22.795967][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.804724][ T362] device veth1_macvtap entered promiscuous mode [ 22.812942][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 22.820580][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 22.828824][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.837862][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.846028][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.864817][ T366] ================================================================== [ 22.872899][ T366] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 [ 22.879547][ T366] Write of size 8 at addr ffff888110d8b150 by task syz.2.17/366 [ 22.887140][ T366] [ 22.889446][ T366] CPU: 1 PID: 366 Comm: syz.2.17 Not tainted syzkaller #0 [ 22.896518][ T366] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 22.906540][ T366] Call Trace: [ 22.909802][ T366] __dump_stack+0x21/0x24 [ 22.914106][ T366] dump_stack_lvl+0x1a7/0x208 [ 22.918757][ T366] ? show_regs_print_info+0x18/0x18 [ 22.923924][ T366] ? thaw_kernel_threads+0x220/0x220 [ 22.929180][ T366] ? debug_smp_processor_id+0x17/0x20 [ 22.934520][ T366] print_address_description+0x7f/0x2c0 [ 22.940033][ T366] ? mutex_lock+0x85/0xf0 [ 22.944332][ T366] kasan_report+0x100/0x140 [ 22.948819][ T366] ? mutex_lock+0x85/0xf0 [ 22.953124][ T366] kasan_check_range+0x249/0x2a0 [ 22.958030][ T366] __kasan_check_write+0x14/0x20 [ 22.962937][ T366] mutex_lock+0x85/0xf0 [ 22.967061][ T366] ? mutex_trylock+0xb0/0xb0 [ 22.971624][ T366] ? l2tp_session_put+0xb2/0x1a0 [ 22.976536][ T366] ? l2tp_session_delete+0x3a9/0x4a0 [ 22.981789][ T366] pppol2tp_release+0x178/0x2b0 [ 22.986609][ T366] sock_close+0xb8/0x200 [ 22.990821][ T366] ? sock_mmap+0xa0/0xa0 [ 22.995031][ T366] __fput+0x2dc/0x730 [ 22.998981][ T366] ____fput+0x15/0x20 [ 23.002928][ T366] task_work_run+0x127/0x190 [ 23.007486][ T366] exit_to_user_mode_loop+0xcb/0xe0 [ 23.012650][ T366] exit_to_user_mode_prepare+0x76/0xa0 [ 23.018080][ T366] syscall_exit_to_user_mode+0x1d/0x40 [ 23.023506][ T366] do_syscall_64+0x3d/0x40 [ 23.027891][ T366] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 23.033753][ T366] RIP: 0033:0x7f9883577e59 [ 23.038138][ T366] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 23.057715][ T366] RSP: 002b:00007ffcd6426918 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 23.066097][ T366] RAX: 0000000000000000 RBX: 00007ffcd6426a00 RCX: 00007f9883577e59 [ 23.074038][ T366] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 23.081978][ T366] RBP: 000000000000593d R08: 0000000000000001 R09: 0000000000000000 [ 23.089920][ T366] R10: 0000001b32920000 R11: 0000000000000246 R12: 0000000000000000 [ 23.097865][ T366] R13: 00007f98837f0fac R14: 00007f98837f0fa8 R15: 00007f98837f0fa0 [ 23.105812][ T366] [ 23.108109][ T366] Allocated by task 366: [ 23.112323][ T366] __kasan_kmalloc+0xd4/0x100 [ 23.116969][ T366] __kmalloc+0x19f/0x330 [ 23.121182][ T366] l2tp_session_create+0x39/0xb60 [ 23.126185][ T366] pppol2tp_connect+0xbf5/0x1640 [ 23.131116][ T366] __sys_connect+0x3ce/0x450 [ 23.135773][ T366] __x64_sys_connect+0x7a/0x90 [ 23.140508][ T366] do_syscall_64+0x31/0x40 [ 23.144892][ T366] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 23.150752][ T366] [ 23.153056][ T366] Freed by task 366: [ 23.156923][ T366] kasan_set_track+0x4a/0x70 [ 23.161483][ T366] kasan_set_free_info+0x23/0x40 [ 23.166392][ T366] ____kasan_slab_free+0x125/0x160 [ 23.171472][ T366] __kasan_slab_free+0x11/0x20 [ 23.176234][ T366] slab_free_freelist_hook+0xc5/0x190 [ 23.182095][ T366] kfree+0xc0/0x270 [ 23.185874][ T366] l2tp_session_put+0xb2/0x1a0 [ 23.190607][ T366] l2tp_session_delete+0x3a9/0x4a0 [ 23.195695][ T366] pppol2tp_release+0x169/0x2b0 [ 23.200517][ T366] sock_close+0xb8/0x200 [ 23.204729][ T366] __fput+0x2dc/0x730 [ 23.208678][ T366] ____fput+0x15/0x20 [ 23.212629][ T366] task_work_run+0x127/0x190 [ 23.217189][ T366] exit_to_user_mode_loop+0xcb/0xe0 [ 23.222361][ T366] exit_to_user_mode_prepare+0x76/0xa0 [ 23.227789][ T366] syscall_exit_to_user_mode+0x1d/0x40 [ 23.233214][ T366] do_syscall_64+0x3d/0x40 [ 23.237609][ T366] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 23.243472][ T366] [ 23.245778][ T366] The buggy address belongs to the object at ffff888110d8b000 [ 23.245778][ T366] which belongs to the cache kmalloc-512 of size 512 [ 23.259799][ T366] The buggy address is located 336 bytes inside of [ 23.259799][ T366] 512-byte region [ffff888110d8b000, ffff888110d8b200) [ 23.273035][ T366] The buggy address belongs to the page: [ 23.278662][ T366] page:ffffea0004436200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x110d88 [ 23.288872][ T366] head:ffffea0004436200 order:2 compound_mapcount:0 compound_pincount:0 [ 23.297171][ T366] flags: 0x4000000000010200(slab|head) [ 23.302601][ T366] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 [ 23.311156][ T366] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 23.319705][ T366] page dumped because: kasan: bad access detected [ 23.326082][ T366] page_owner tracks the page as allocated [ 23.331777][ T366] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 362, ts 22857230796, free_ts 22837057514 [ 23.352137][ T366] prep_new_page+0x176/0x190 [ 23.356694][ T366] get_page_from_freelist+0x225f/0x23f0 [ 23.362209][ T366] __alloc_pages_nodemask+0x29a/0x640 [ 23.367554][ T366] new_slab+0x84/0x3f0 [ 23.371602][ T366] ___slab_alloc+0x2f8/0x4c0 [ 23.376155][ T366] __slab_alloc+0x63/0xa0 [ 23.380452][ T366] __kmalloc+0x1f9/0x330 [ 23.384666][ T366] qdisc_alloc+0x79/0x720 [ 23.388964][ T366] qdisc_create_dflt+0x6b/0x390 [ 23.393869][ T366] dev_activate+0x292/0x11c0 [ 23.398427][ T366] __dev_open+0x3e9/0x500 [ 23.402733][ T366] __dev_change_flags+0x1e4/0x6a0 [ 23.408700][ T366] dev_change_flags+0x80/0x1a0 [ 23.414203][ T366] do_setlink+0xb19/0x29a0 [ 23.418625][ T366] rtnl_newlink+0x13e6/0x1830 [ 23.423465][ T366] rtnetlink_rcv_msg+0x9e9/0xca0 [ 23.428376][ T366] page last free stack trace: [ 23.435101][ T366] __free_pages_ok+0x80b/0x830 [ 23.439844][ T366] __free_pages+0xd8/0x390 [ 23.444244][ T366] __free_slab+0xcf/0x190 [ 23.448544][ T366] unfreeze_partials+0x150/0x180 [ 23.453452][ T366] put_cpu_partial+0xc1/0x180 [ 23.458098][ T366] __slab_free+0x2c9/0x3a0 [ 23.462484][ T366] ___cache_free+0x10e/0x130 [ 23.467047][ T366] qlink_free+0x50/0x90 [ 23.471169][ T366] qlist_free_all+0x5f/0xb0 [ 23.475666][ T366] kasan_quarantine_reduce+0x14a/0x160 [ 23.481094][ T366] __kasan_slab_alloc+0x2f/0xe0 [ 23.485920][ T366] slab_post_alloc_hook+0x5d/0x2f0 [ 23.491005][ T366] kmem_cache_alloc_trace+0x155/0x2e0 [ 23.496350][ T366] inet_rtm_newaddr+0x2d1/0x1580 [ 23.501260][ T366] rtnetlink_rcv_msg+0x9e9/0xca0 [ 23.506166][ T366] netlink_rcv_skb+0x1e9/0x430 [ 23.510898][ T366] [ 23.513195][ T366] Memory state around the buggy address: [ 23.518799][ T366] ffff888110d8b000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.526841][ T366] ffff888110d8b080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.534875][ T366] >ffff888110d8b100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.542904][ T366] ^ [ 23.549548][ T366] ffff888110d8b180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.557576][ T366] ffff888110d8b200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.565605][ T366] ================================================================== [ 23.573631][ T366] Disabling lock debugging due to kernel taint