Warning: Permanently added '10.128.1.2' (ED25519) to the list of known hosts. 2026/07/25 06:33:40 parsed 1 programs 2026/07/25 06:33:40 serving rpc on tcp://45483 [ 22.605144][ T30] audit: type=1400 audit(1784961220.148:64): avc: denied { node_bind } for pid=293 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 22.629609][ T30] audit: type=1400 audit(1784961220.158:65): avc: denied { module_request } for pid=293 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 23.334717][ T30] audit: type=1400 audit(1784961220.878:66): avc: denied { mounton } for pid=299 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.335952][ T299] cgroup: Unknown subsys name 'net' [ 23.366321][ T30] audit: type=1400 audit(1784961220.878:67): avc: denied { mount } for pid=299 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.414325][ T30] audit: type=1400 audit(1784961220.918:68): avc: denied { unmount } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.414525][ T299] cgroup: Unknown subsys name 'devices' [ 23.557599][ T299] cgroup: Unknown subsys name 'hugetlb' [ 23.566621][ T299] cgroup: Unknown subsys name 'rlimit' [ 23.687138][ T30] audit: type=1400 audit(1784961221.238:69): avc: denied { setattr } for pid=299 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.733570][ T30] audit: type=1400 audit(1784961221.238:70): avc: denied { create } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 23.766693][ T30] audit: type=1400 audit(1784961221.238:71): avc: denied { write } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 23.769944][ T303] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 23.793996][ T30] audit: type=1400 audit(1784961221.238:72): avc: denied { read } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 23.835143][ T30] audit: type=1400 audit(1784961221.238:73): avc: denied { mounton } for pid=299 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.851577][ T299] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 24.316625][ T307] request_module fs-gadgetfs succeeded, but still no fs? [ 24.585449][ T317] syz-executor (317) used greatest stack depth: 22760 bytes left [ 24.826944][ T341] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.838409][ T341] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.852856][ T341] device bridge_slave_0 entered promiscuous mode [ 24.861369][ T341] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.869931][ T341] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.881088][ T341] device bridge_slave_1 entered promiscuous mode [ 24.924858][ T341] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.933891][ T341] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.943922][ T341] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.955755][ T341] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.978562][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.988691][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.000016][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.011363][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.023221][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.033210][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.047164][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.057149][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.066048][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.079757][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.095559][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.112663][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.130429][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.141636][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.151100][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.164771][ T341] device veth0_vlan entered promiscuous mode [ 25.181238][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.198878][ T341] device veth1_macvtap entered promiscuous mode [ 25.213814][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.234754][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.275010][ T341] syz-executor (341) used greatest stack depth: 22024 bytes left 2026/07/25 06:33:43 executed programs: 0 [ 25.709131][ T369] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.718641][ T369] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.728819][ T369] device bridge_slave_0 entered promiscuous mode [ 25.737806][ T369] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.748383][ T369] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.761824][ T369] device bridge_slave_1 entered promiscuous mode [ 25.806491][ T369] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.818838][ T369] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.831329][ T369] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.842939][ T369] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.866940][ T346] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.877737][ T346] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.887715][ T346] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.900317][ T346] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.911628][ T346] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.923118][ T346] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.938727][ T346] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.954606][ T346] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.965056][ T346] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.984672][ T346] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.001783][ T346] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.020030][ T346] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.041544][ T346] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.059674][ T346] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.074616][ T346] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.087232][ T369] device veth0_vlan entered promiscuous mode [ 26.106516][ T346] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.121307][ T369] device veth1_macvtap entered promiscuous mode [ 26.135029][ T346] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.155638][ T346] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.194381][ T373] ================================================================== [ 26.206755][ T373] BUG: KASAN: use-after-free in pppol2tp_sock_to_session+0x1a0/0x1b0 [ 26.217907][ T373] Read of size 4 at addr ffff88811f1d9400 by task syz.2.17/373 [ 26.227601][ T373] [ 26.230744][ T373] CPU: 1 PID: 373 Comm: syz.2.17 Not tainted syzkaller #0 [ 26.240818][ T373] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 26.255967][ T373] Call Trace: [ 26.259644][ T373] [ 26.264067][ T373] __dump_stack+0x21/0x30 [ 26.272245][ T373] dump_stack_lvl+0x110/0x170 [ 26.279962][ T373] ? show_regs_print_info+0x20/0x20 [ 26.290148][ T373] ? load_image+0x3f0/0x3f0 [ 26.302430][ T373] ? __local_bh_enable_ip+0x58/0x80 [ 26.313236][ T373] print_address_description+0x7f/0x2c0 [ 26.328008][ T373] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 26.338719][ T373] kasan_report+0x10f/0x150 [ 26.346335][ T373] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 26.358050][ T373] __asan_report_load4_noabort+0x14/0x20 [ 26.367150][ T373] pppol2tp_sock_to_session+0x1a0/0x1b0 [ 26.376071][ T373] pppol2tp_release+0x150/0x2b0 [ 26.387856][ T373] sock_close+0xb8/0x200 [ 26.394934][ T373] ? sock_mmap+0xa0/0xa0 [ 26.400475][ T373] __fput+0x22b/0x900 [ 26.407451][ T373] ____fput+0x15/0x20 [ 26.413243][ T373] task_work_run+0x127/0x190 [ 26.420927][ T373] exit_to_user_mode_loop+0xd0/0xe0 [ 26.430846][ T373] exit_to_user_mode_prepare+0x87/0xd0 [ 26.438887][ T373] syscall_exit_to_user_mode+0x1a/0x30 [ 26.448742][ T373] do_syscall_64+0x58/0xa0 [ 26.457229][ T373] ? clear_bhb_loop+0x50/0xa0 [ 26.465370][ T373] ? clear_bhb_loop+0x50/0xa0 [ 26.471100][ T373] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 26.478707][ T373] RIP: 0033:0x7f9ffeee5e99 [ 26.484534][ T373] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 26.514931][ T373] RSP: 002b:00007fff25182b98 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 26.527229][ T373] RAX: 0000000000000000 RBX: 00007fff25182c80 RCX: 00007f9ffeee5e99 [ 26.539445][ T373] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 26.553212][ T373] RBP: 000000000000662a R08: 0000000000000001 R09: 0000000000000000 [ 26.563770][ T373] R10: 0000001b33020000 R11: 0000000000000246 R12: 00007fff25182cc0 [ 26.575916][ T373] R13: 00007f9fff16dfac R14: 0000000000006661 R15: 00007f9fff16dfa0 [ 26.586829][ T373] [ 26.592598][ T373] [ 26.596903][ T373] Allocated by task 374: [ 26.602901][ T373] __kasan_kmalloc+0xd4/0x100 [ 26.610923][ T373] __kmalloc+0x13d/0x2c0 [ 26.617252][ T373] l2tp_session_create+0x39/0xb60 [ 26.622929][ T373] pppol2tp_connect+0xbf5/0x1640 [ 26.633201][ T373] __sys_connect+0x3cb/0x450 [ 26.639224][ T373] __x64_sys_connect+0x7a/0x90 [ 26.645122][ T373] x64_sys_call+0x7c/0x9a0 [ 26.651235][ T373] do_syscall_64+0x4c/0xa0 [ 26.656581][ T373] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 26.663820][ T373] [ 26.666915][ T373] Freed by task 10: [ 26.672254][ T373] kasan_set_track+0x4a/0x70 [ 26.679567][ T373] kasan_set_free_info+0x23/0x40 [ 26.686402][ T373] ____kasan_slab_free+0x125/0x160 [ 26.694864][ T373] __kasan_slab_free+0x11/0x20 [ 26.703286][ T373] slab_free_freelist_hook+0xc2/0x190 [ 26.713861][ T373] kfree+0xc4/0x270 [ 26.719173][ T373] l2tp_session_put+0xaf/0x1a0 [ 26.727246][ T373] l2tp_session_delete+0x3a9/0x4a0 [ 26.733927][ T373] l2tp_tunnel_del_work+0x180/0x3d0 [ 26.741847][ T373] process_one_work+0x6c8/0xbb0 [ 26.748441][ T373] worker_thread+0xaa0/0x1250 [ 26.758022][ T373] kthread+0x3f5/0x4f0 [ 26.762584][ T373] ret_from_fork+0x1f/0x30 [ 26.767368][ T373] [ 26.771703][ T373] The buggy address belongs to the object at ffff88811f1d9400 [ 26.771703][ T373] which belongs to the cache kmalloc-512 of size 512 [ 26.796926][ T373] The buggy address is located 0 bytes inside of [ 26.796926][ T373] 512-byte region [ffff88811f1d9400, ffff88811f1d9600) [ 26.817027][ T373] The buggy address belongs to the page: [ 26.824309][ T373] page:ffffea00047c7600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11f1d8 [ 26.841225][ T373] head:ffffea00047c7600 order:2 compound_mapcount:0 compound_pincount:0 [ 26.857636][ T373] flags: 0x4000000000010200(slab|head|zone=1) [ 26.867250][ T373] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 [ 26.882861][ T373] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 26.899120][ T373] page dumped because: kasan: bad access detected [ 26.908589][ T373] page_owner tracks the page as allocated [ 26.917475][ T373] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 374, ts 26194125214, free_ts 15004301772 [ 26.949374][ T373] post_alloc_hook+0x192/0x1b0 [ 26.956747][ T373] prep_new_page+0x1c/0x110 [ 26.964737][ T373] get_page_from_freelist+0x2c3a/0x2cd0 [ 26.976733][ T373] __alloc_pages+0x1a2/0x460 [ 26.985468][ T373] new_slab+0xa0/0x4d0 [ 26.993714][ T373] ___slab_alloc+0x3ac/0x840 [ 26.999750][ T373] __slab_alloc+0x49/0x90 [ 27.005707][ T373] __kmalloc+0x16a/0x2c0 [ 27.010933][ T373] l2tp_session_create+0x39/0xb60 [ 27.018939][ T373] pppol2tp_connect+0xbf5/0x1640 [ 27.028005][ T373] __sys_connect+0x3cb/0x450 [ 27.038139][ T373] __x64_sys_connect+0x7a/0x90 [ 27.044704][ T373] x64_sys_call+0x7c/0x9a0 [ 27.054046][ T373] do_syscall_64+0x4c/0xa0 [ 27.062477][ T373] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 27.083937][ T373] page last free stack trace: [ 27.093998][ T373] free_unref_page_prepare+0x5fa/0x600 [ 27.107219][ T373] free_unref_page+0xae/0x540 [ 27.118620][ T373] __put_page+0xad/0xe0 [ 27.124002][ T373] anon_pipe_buf_release+0x15f/0x1d0 [ 27.131368][ T373] pipe_read+0x563/0x1050 [ 27.137592][ T373] vfs_read+0x6c0/0xc20 [ 27.143326][ T373] ksys_read+0x14a/0x260 [ 27.148910][ T373] __x64_sys_read+0x7b/0x90 [ 27.156549][ T373] x64_sys_call+0x96d/0x9a0 [ 27.164676][ T373] do_syscall_64+0x4c/0xa0 [ 27.173505][ T373] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 27.183188][ T373] [ 27.186354][ T373] Memory state around the buggy address: [ 27.194685][ T373] ffff88811f1d9300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.206099][ T373] ffff88811f1d9380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.218383][ T373] >ffff88811f1d9400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.236648][ T373] ^ [ 27.245458][ T373] ffff88811f1d9480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.260789][ T373] ffff88811f1d9500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.278093][ T373] ================================================================== [ 27.299819][ T373] Disabling lock debugging due to kernel taint [ 27.313548][ T373] ------------[ cut here ]------------ [ 27.324135][ T373] WARNING: CPU: 0 PID: 373 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 27.342417][ T373] Modules linked in: [ 27.354443][ T373] CPU: 1 PID: 373 Comm: syz.2.17 Tainted: G B syzkaller #0 [ 27.365951][ T373] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 27.381758][ T373] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 27.391364][ T373] Code: 5d c3 e8 bc a4 0b fd be 02 00 00 00 eb 0a e8 b0 a4 0b fd be 01 00 00 00 4c 89 f7 e8 53 23 f2 fd e9 0f ff ff ff e8 99 a4 0b fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 88 a4 0b fd 4c 89 f7 be 03 [ 27.419032][ T373] RSP: 0018:ffffc90000b07d10 EFLAGS: 00010293 [ 27.429353][ T373] RAX: ffffffff845e1247 RBX: ffff888111832000 RCX: ffff88810e1acf00 [ 27.441874][ T373] RDX: 0000000000000000 RSI: 000000002b49cc80 RDI: 000000000c04eb7d [ 27.454633][ T373] RBP: ffffc90000b07d30 R08: 0000000000000003 R09: 0000000000000004 [ 27.470001][ T373] R10: dffffc0000000000 R11: fffffbfff0e18c4c R12: dffffc0000000000 [ 27.483395][ T373] R13: dffffc0000000000 R14: 000000002b49cc80 R15: ffff88811f1d9400 [ 27.496821][ T373] FS: 0000555560fad500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 27.509468][ T373] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.520029][ T373] CR2: 0000000000000000 CR3: 000000012b4aa000 CR4: 00000000003506a0 [ 27.533270][ T373] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 27.545046][ T373] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 27.559032][ T373] Call Trace: [ 27.562823][ T373] [ 27.566904][ T373] pppol2tp_release+0x150/0x2b0 [ 27.574838][ T373] sock_close+0xb8/0x200 [ 27.580363][ T373] ? sock_mmap+0xa0/0xa0 [ 27.586565][ T373] __fput+0x22b/0x900 [ 27.593207][ T373] ____fput+0x15/0x20 [ 27.597484][ T373] task_work_run+0x127/0x190 [ 27.603508][ T373] exit_to_user_mode_loop+0xd0/0xe0 [ 27.611904][ T373] exit_to_user_mode_prepare+0x87/0xd0 [ 27.620445][ T373] syscall_exit_to_user_mode+0x1a/0x30 [ 27.627969][ T373] do_syscall_64+0x58/0xa0 [ 27.633917][ T373] ? clear_bhb_loop+0x50/0xa0 [ 27.639278][ T373] ? clear_bhb_loop+0x50/0xa0 [ 27.647121][ T373] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 27.656352][ T373] RIP: 0033:0x7f9ffeee5e99 [ 27.662888][ T373] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 27.688921][ T373] RSP: 002b:00007fff25182b98 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 27.702595][ T373] RAX: 0000000000000000 RBX: 00007fff25182c80 RCX: 00007f9ffeee5e99 [ 27.713272][ T373] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 27.725992][ T373] RBP: 000000000000662a R08: 0000000000000001 R09: 0000000000000000 [ 27.737896][ T373] R10: 0000001b33020000 R11: 0000000000000246 R12: 00007fff25182cc0 [ 27.753020][ T373] R13: 00007f9fff16dfac R14: 0000000000006661 R15: 00007f9fff16dfa0 [ 27.766322][ T373] [ 27.772205][ T373] ---[ end trace c542269d6b48bd17 ]---