Warning: Permanently added '10.128.1.60' (ED25519) to the list of known hosts. 2026/07/31 23:21:18 parsed 1 programs 2026/07/31 23:21:18 serving rpc on tcp://39993 [ 24.513845][ T24] audit: type=1400 audit(1785540078.100:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 24.534890][ T24] audit: type=1400 audit(1785540078.100:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 24.554481][ T24] audit: type=1400 audit(1785540078.100:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 25.456465][ T24] audit: type=1400 audit(1785540079.040:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.459997][ T293] cgroup: Unknown subsys name 'net' [ 25.479268][ T24] audit: type=1400 audit(1785540079.050:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.507082][ T24] audit: type=1400 audit(1785540079.070:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.507587][ T293] cgroup: Unknown subsys name 'devices' [ 25.618867][ T293] cgroup: Unknown subsys name 'hugetlb' [ 25.624509][ T293] cgroup: Unknown subsys name 'rlimit' [ 25.833700][ T24] audit: type=1400 audit(1785540079.420:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.857298][ T24] audit: type=1400 audit(1785540079.420:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 25.877986][ T24] audit: type=1400 audit(1785540079.420:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.898424][ T24] audit: type=1400 audit(1785540079.420:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.919805][ T297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 25.942535][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.402923][ T299] request_module fs-gadgetfs succeeded, but still no fs? [ 26.413965][ T299] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 27.022147][ T350] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.029470][ T350] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.036847][ T350] device bridge_slave_0 entered promiscuous mode [ 27.043860][ T350] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.051198][ T350] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.058631][ T350] device bridge_slave_1 entered promiscuous mode [ 27.100518][ T350] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.107726][ T350] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.115139][ T350] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.122249][ T350] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.141274][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.148955][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.156331][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.165474][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.173712][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.180794][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.189551][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.197870][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.204925][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.216829][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.226281][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.240633][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.252400][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.260798][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.268505][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.276722][ T350] device veth0_vlan entered promiscuous mode [ 27.286960][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.296441][ T350] device veth1_macvtap entered promiscuous mode [ 27.306328][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.316686][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/07/31 23:21:21 executed programs: 0 [ 27.626009][ T364] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.633129][ T364] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.640558][ T364] device bridge_slave_0 entered promiscuous mode [ 27.654968][ T364] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.662178][ T364] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.669644][ T364] device bridge_slave_1 entered promiscuous mode [ 27.715998][ T364] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.723093][ T364] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.730415][ T364] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.737513][ T364] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.761600][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.769579][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.776763][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.785994][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.794357][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.801444][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.810299][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.818768][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.825805][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.844035][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.853348][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.867589][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 27.875990][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.887474][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 27.895421][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.903599][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.911494][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.927526][ T364] device veth0_vlan entered promiscuous mode [ 27.940629][ T364] device veth1_macvtap entered promiscuous mode [ 27.947837][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 27.956351][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.964966][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 27.979301][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 27.988297][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.996638][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 28.005367][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 28.109774][ T405] ================================================================== [ 28.117932][ T405] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 [ 28.124673][ T405] Write of size 8 at addr ffff88811119f150 by task syz.2.17/405 [ 28.132319][ T405] [ 28.134686][ T405] CPU: 1 PID: 405 Comm: syz.2.17 Not tainted syzkaller #0 [ 28.141893][ T405] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 28.151959][ T405] Call Trace: [ 28.155388][ T405] __dump_stack+0x21/0x24 [ 28.159746][ T405] dump_stack_lvl+0x1a7/0x208 [ 28.164451][ T405] ? show_regs_print_info+0x18/0x18 [ 28.170121][ T405] ? thaw_kernel_threads+0x220/0x220 [ 28.175437][ T405] print_address_description+0x7f/0x2c0 [ 28.181217][ T405] ? mutex_lock+0x85/0xf0 [ 28.185578][ T405] kasan_report+0x100/0x140 [ 28.190195][ T405] ? mutex_lock+0x85/0xf0 [ 28.194639][ T405] kasan_check_range+0x249/0x2a0 [ 28.199621][ T405] __kasan_check_write+0x14/0x20 [ 28.204580][ T405] mutex_lock+0x85/0xf0 [ 28.208879][ T405] ? mutex_trylock+0xb0/0xb0 [ 28.213491][ T405] ? l2tp_session_put+0xb2/0x1a0 [ 28.218544][ T405] ? l2tp_session_delete+0x3a9/0x4a0 [ 28.223859][ T405] pppol2tp_release+0x178/0x2b0 [ 28.228730][ T405] sock_close+0xb8/0x200 [ 28.233089][ T405] ? sock_mmap+0xa0/0xa0 [ 28.237382][ T405] __fput+0x2dc/0x730 [ 28.241471][ T405] ____fput+0x15/0x20 [ 28.245465][ T405] task_work_run+0x127/0x190 [ 28.250074][ T405] do_exit+0xa7c/0x24e0 [ 28.254248][ T405] ? finish_task_switch+0x1b7/0x5a0 [ 28.259474][ T405] ? put_task_struct+0x90/0x90 [ 28.264426][ T405] ? remove_hrtimer+0x225/0x490 [ 28.269287][ T405] ? __kasan_check_write+0x14/0x20 [ 28.274493][ T405] ? _raw_spin_lock_irq+0x95/0xf0 [ 28.279529][ T405] do_group_exit+0x149/0x310 [ 28.284158][ T405] ? __kasan_check_write+0x14/0x20 [ 28.289276][ T405] ? recalc_sigpending+0x1c4/0x230 [ 28.294398][ T405] get_signal+0xfb1/0x1300 [ 28.298830][ T405] arch_do_signal_or_restart+0xe7/0x11b0 [ 28.304469][ T405] ? nanosleep_copyout+0x120/0x120 [ 28.309618][ T405] ? get_timespec64+0x116/0x1b0 [ 28.314475][ T405] ? __ia32_sys_rt_sigreturn+0x730/0x730 [ 28.320122][ T405] ? __x64_sys_clock_nanosleep+0xb0/0xb0 [ 28.325767][ T405] ? debug_smp_processor_id+0x17/0x20 [ 28.331154][ T405] exit_to_user_mode_loop+0xa2/0xe0 [ 28.336357][ T405] exit_to_user_mode_prepare+0x76/0xa0 [ 28.341828][ T405] syscall_exit_to_user_mode+0x1d/0x40 [ 28.347295][ T405] do_syscall_64+0x3d/0x40 [ 28.351742][ T405] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.357645][ T405] RIP: 0033:0x7fc5f5f5f197 [ 28.362086][ T405] Code: Unable to access opcode bytes at RIP 0x7fc5f5f5f16d. [ 28.369558][ T405] RSP: 002b:00007ffd2ac33bc0 EFLAGS: 00000202 ORIG_RAX: 00000000000000e6 [ 28.377989][ T405] RAX: fffffffffffffdfc RBX: 00005555718f2500 RCX: 00007fc5f5f5f197 [ 28.386002][ T405] RDX: 00007ffd2ac33c00 RSI: 0000000000000000 RDI: 0000000000000000 [ 28.394117][ T405] RBP: 00007fc5f603b00c R08: 0000000000000000 R09: 0000000000000000 [ 28.402102][ T405] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 28.410090][ T405] R13: 00007fc5f622bfac R14: 00007fc5f622bfa0 R15: 00007fc5f622bfa0 [ 28.418079][ T405] [ 28.420417][ T405] Allocated by task 404: [ 28.424682][ T405] __kasan_kmalloc+0xd4/0x100 [ 28.429367][ T405] __kmalloc+0x19f/0x330 [ 28.433626][ T405] l2tp_session_create+0x39/0xb60 [ 28.438686][ T405] pppol2tp_connect+0xbf5/0x1640 [ 28.443634][ T405] __sys_connect+0x3ce/0x450 [ 28.448237][ T405] __x64_sys_connect+0x7a/0x90 [ 28.453011][ T405] do_syscall_64+0x31/0x40 [ 28.457436][ T405] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.463326][ T405] [ 28.465751][ T405] Freed by task 405: [ 28.469787][ T405] kasan_set_track+0x4a/0x70 [ 28.474405][ T405] kasan_set_free_info+0x23/0x40 [ 28.479349][ T405] ____kasan_slab_free+0x125/0x160 [ 28.484636][ T405] __kasan_slab_free+0x11/0x20 [ 28.489583][ T405] slab_free_freelist_hook+0xc5/0x190 [ 28.494961][ T405] kfree+0xc0/0x270 [ 28.498775][ T405] l2tp_session_put+0xb2/0x1a0 [ 28.503545][ T405] l2tp_session_delete+0x3a9/0x4a0 [ 28.508665][ T405] pppol2tp_release+0x169/0x2b0 [ 28.513609][ T405] sock_close+0xb8/0x200 [ 28.517861][ T405] __fput+0x2dc/0x730 [ 28.521850][ T405] ____fput+0x15/0x20 [ 28.525961][ T405] task_work_run+0x127/0x190 [ 28.530557][ T405] do_exit+0xa7c/0x24e0 [ 28.534740][ T405] do_group_exit+0x149/0x310 [ 28.539335][ T405] get_signal+0xfb1/0x1300 [ 28.543804][ T405] arch_do_signal_or_restart+0xe7/0x11b0 [ 28.549487][ T405] exit_to_user_mode_loop+0xa2/0xe0 [ 28.555224][ T405] exit_to_user_mode_prepare+0x76/0xa0 [ 28.560900][ T405] syscall_exit_to_user_mode+0x1d/0x40 [ 28.566448][ T405] do_syscall_64+0x3d/0x40 [ 28.570925][ T405] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.576907][ T405] [ 28.579249][ T405] The buggy address belongs to the object at ffff88811119f000 [ 28.579249][ T405] which belongs to the cache kmalloc-512 of size 512 [ 28.593311][ T405] The buggy address is located 336 bytes inside of [ 28.593311][ T405] 512-byte region [ffff88811119f000, ffff88811119f200) [ 28.606588][ T405] The buggy address belongs to the page: [ 28.612362][ T405] page:ffffea0004446700 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11119c [ 28.622983][ T405] head:ffffea0004446700 order:2 compound_mapcount:0 compound_pincount:0 [ 28.631322][ T405] flags: 0x4000000000010200(slab|head) [ 28.636797][ T405] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 [ 28.645391][ T405] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 28.653979][ T405] page dumped because: kasan: bad access detected [ 28.660397][ T405] page_owner tracks the page as allocated [ 28.666138][ T405] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 394, ts 28018422619, free_ts 27987793393 [ 28.685932][ T405] prep_new_page+0x176/0x190 [ 28.690553][ T405] get_page_from_freelist+0x225f/0x23f0 [ 28.696376][ T405] __alloc_pages_nodemask+0x29a/0x640 [ 28.701760][ T405] new_slab+0x84/0x3f0 [ 28.705839][ T405] ___slab_alloc+0x2f8/0x4c0 [ 28.710433][ T405] __slab_alloc+0x63/0xa0 [ 28.714785][ T405] __kmalloc_track_caller+0x1e4/0x310 [ 28.720164][ T405] __alloc_skb+0xdc/0x520 [ 28.724624][ T405] __ipv6_ifa_notify+0x200/0xe70 [ 28.729673][ T405] addrconf_dad_completed+0x18c/0xe30 [ 28.735141][ T405] addrconf_dad_work+0xc5f/0x1480 [ 28.740373][ T405] process_one_work+0x6fd/0xbc0 [ 28.745341][ T405] worker_thread+0xa8e/0x13c0 [ 28.750058][ T405] kthread+0x324/0x3b0 [ 28.754135][ T405] ret_from_fork+0x1f/0x30 [ 28.758557][ T405] page last free stack trace: [ 28.763243][ T405] __free_pages_ok+0x80b/0x830 [ 28.768106][ T405] __free_pages+0xd8/0x390 [ 28.772545][ T405] __free_slab+0xcf/0x190 [ 28.776877][ T405] unfreeze_partials+0x150/0x180 [ 28.781829][ T405] put_cpu_partial+0xc1/0x180 [ 28.786508][ T405] __slab_free+0x2c9/0x3a0 [ 28.790929][ T405] ___cache_free+0x10e/0x130 [ 28.795526][ T405] qlink_free+0x50/0x90 [ 28.799729][ T405] qlist_free_all+0x5f/0xb0 [ 28.804258][ T405] kasan_quarantine_reduce+0x14a/0x160 [ 28.809809][ T405] __kasan_slab_alloc+0x2f/0xe0 [ 28.814674][ T405] slab_post_alloc_hook+0x5d/0x2f0 [ 28.819797][ T405] kmem_cache_alloc_trace+0x155/0x2e0 [ 28.825294][ T405] syslog_print+0x127/0x720 [ 28.829811][ T405] do_syslog+0x94c/0x9a0 [ 28.834072][ T405] __x64_sys_syslog+0x7c/0x90 [ 28.838837][ T405] [ 28.841444][ T405] Memory state around the buggy address: [ 28.847267][ T405] ffff88811119f000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.855338][ T405] ffff88811119f080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.863411][ T405] >ffff88811119f100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.871473][ T405] ^ [ 28.878151][ T405] ffff88811119f180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.886222][ T405] ffff88811119f200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.894825][ T405] ================================================================== [ 28.902902][ T405] Disabling lock debugging due to kernel taint