Warning: Permanently added '10.128.1.31' (ED25519) to the list of known hosts. 2026/10/23 03:50:31 parsed 1 programs 2026/10/23 03:50:31 serving rpc on tcp://33607 [ 22.278487][ T24] audit: type=1400 audit(1792727431.130:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 22.299944][ T24] audit: type=1400 audit(1792727431.130:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 22.319997][ T24] audit: type=1400 audit(1792727431.130:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 23.204687][ T24] audit: type=1400 audit(1792727432.050:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.208081][ T293] cgroup: Unknown subsys name 'net' [ 23.227577][ T24] audit: type=1400 audit(1792727432.060:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.254709][ T24] audit: type=1400 audit(1792727432.080:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.255268][ T293] cgroup: Unknown subsys name 'devices' [ 23.396888][ T293] cgroup: Unknown subsys name 'hugetlb' [ 23.402487][ T293] cgroup: Unknown subsys name 'rlimit' [ 23.550876][ T24] audit: type=1400 audit(1792727432.400:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.574164][ T24] audit: type=1400 audit(1792727432.400:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 23.594654][ T24] audit: type=1400 audit(1792727432.400:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 23.611731][ T298] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 23.615181][ T24] audit: type=1400 audit(1792727432.400:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 23.658310][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 24.127102][ T300] request_module fs-gadgetfs succeeded, but still no fs? [ 24.138161][ T300] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 24.435138][ T326] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.442282][ T326] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.450273][ T326] device bridge_slave_0 entered promiscuous mode [ 24.458066][ T326] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.465126][ T326] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.472448][ T326] device bridge_slave_1 entered promiscuous mode [ 24.512249][ T326] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.519303][ T326] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.526611][ T326] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.533661][ T326] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.551111][ T327] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.558447][ T327] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.566110][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.573502][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.583188][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.591349][ T327] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.598409][ T327] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.607196][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.615478][ T327] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.622512][ T327] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.634839][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.643943][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.657614][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.669654][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.677789][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.685274][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.693234][ T326] device veth0_vlan entered promiscuous mode [ 24.704758][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.713314][ T326] device veth1_macvtap entered promiscuous mode [ 24.723160][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.733576][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/10/23 03:50:34 executed programs: 0 [ 25.299867][ T365] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.307165][ T365] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.314458][ T365] device bridge_slave_0 entered promiscuous mode [ 25.321532][ T365] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.328577][ T365] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.335973][ T365] device bridge_slave_1 entered promiscuous mode [ 25.381922][ T365] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.388983][ T365] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.396304][ T365] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.403335][ T365] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.424801][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.432384][ T327] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.439704][ T327] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.453821][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.462315][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.470531][ T327] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.477627][ T327] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.486352][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.494633][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.503025][ T327] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.510127][ T327] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.520779][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.529012][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.538670][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.546968][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.555611][ T48] device bridge_slave_1 left promiscuous mode [ 25.561854][ T48] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.569856][ T48] device bridge_slave_0 left promiscuous mode [ 25.576068][ T48] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.583857][ T48] device veth1_macvtap left promiscuous mode [ 25.590056][ T48] device veth0_vlan left promiscuous mode [ 25.637942][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.646910][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.657708][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.665590][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.673565][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.681064][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.689092][ T365] device veth0_vlan entered promiscuous mode [ 25.699472][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.707647][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.716616][ T365] device veth1_macvtap entered promiscuous mode [ 25.725766][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.733313][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.741685][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.750900][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.759388][ T327] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.845284][ T370] ================================================================== [ 25.853411][ T370] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 [ 25.860105][ T370] Write of size 8 at addr ffff88810f8f9150 by task syz.2.17/370 [ 25.867825][ T370] [ 25.870184][ T370] CPU: 0 PID: 370 Comm: syz.2.17 Not tainted syzkaller #0 [ 25.877304][ T370] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 25.887366][ T370] Call Trace: [ 25.890675][ T370] __dump_stack+0x21/0x24 [ 25.895019][ T370] dump_stack_lvl+0x1a7/0x208 [ 25.899715][ T370] ? show_regs_print_info+0x18/0x18 [ 25.904927][ T370] ? thaw_kernel_threads+0x220/0x220 [ 25.910227][ T370] print_address_description+0x7f/0x2c0 [ 25.915784][ T370] ? mutex_lock+0x85/0xf0 [ 25.920127][ T370] kasan_report+0x100/0x140 [ 25.924678][ T370] ? mutex_lock+0x85/0xf0 [ 25.929024][ T370] kasan_check_range+0x249/0x2a0 [ 25.933983][ T370] __kasan_check_write+0x14/0x20 [ 25.938943][ T370] mutex_lock+0x85/0xf0 [ 25.943115][ T370] ? mutex_trylock+0xb0/0xb0 [ 25.947745][ T370] ? l2tp_session_put+0xb2/0x1a0 [ 25.952704][ T370] ? l2tp_session_delete+0x3a9/0x4a0 [ 25.958003][ T370] pppol2tp_release+0x178/0x2b0 [ 25.962877][ T370] sock_close+0xb8/0x200 [ 25.967136][ T370] ? sock_mmap+0xa0/0xa0 [ 25.971413][ T370] __fput+0x2dc/0x730 [ 25.975409][ T370] ____fput+0x15/0x20 [ 25.979404][ T370] task_work_run+0x127/0x190 [ 25.984007][ T370] do_exit+0xa7c/0x24e0 [ 25.988203][ T370] ? finish_task_switch+0x1b7/0x5a0 [ 25.993413][ T370] ? put_task_struct+0x90/0x90 [ 25.998189][ T370] ? remove_hrtimer+0x225/0x490 [ 26.003060][ T370] ? __kasan_check_write+0x14/0x20 [ 26.008187][ T370] ? _raw_spin_lock_irq+0x95/0xf0 [ 26.013232][ T370] do_group_exit+0x149/0x310 [ 26.017838][ T370] ? __kasan_check_write+0x14/0x20 [ 26.022963][ T370] ? recalc_sigpending+0x1c4/0x230 [ 26.028095][ T370] get_signal+0xfb1/0x1300 [ 26.032554][ T370] arch_do_signal_or_restart+0xe7/0x11b0 [ 26.038196][ T370] ? nanosleep_copyout+0x120/0x120 [ 26.043320][ T370] ? get_timespec64+0x116/0x1b0 [ 26.048182][ T370] ? __ia32_sys_rt_sigreturn+0x730/0x730 [ 26.053826][ T370] ? __x64_sys_clock_nanosleep+0xb0/0xb0 [ 26.059476][ T370] ? debug_smp_processor_id+0x17/0x20 [ 26.064860][ T370] exit_to_user_mode_loop+0xa2/0xe0 [ 26.070067][ T370] exit_to_user_mode_prepare+0x76/0xa0 [ 26.075544][ T370] syscall_exit_to_user_mode+0x1d/0x40 [ 26.081015][ T370] do_syscall_64+0x3d/0x40 [ 26.085446][ T370] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.091350][ T370] RIP: 0033:0x7f5b8ef066d7 [ 26.095776][ T370] Code: Unable to access opcode bytes at RIP 0x7f5b8ef066ad. [ 26.103153][ T370] RSP: 002b:00007fffc593e440 EFLAGS: 00000202 ORIG_RAX: 00000000000000e6 [ 26.111577][ T370] RAX: fffffffffffffdfc RBX: 000055556cafe500 RCX: 00007f5b8ef066d7 [ 26.119553][ T370] RDX: 00007fffc593e480 RSI: 0000000000000000 RDI: 0000000000000000 [ 26.127535][ T370] RBP: 00007f5b8efe2b20 R08: 0000000000000000 R09: 0000000000000000 [ 26.135511][ T370] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 26.143502][ T370] R13: 00007f5b8f1d1fac R14: 00007f5b8f1d1fa0 R15: 00007f5b8f1d1fa0 [ 26.151477][ T370] [ 26.153814][ T370] Allocated by task 369: [ 26.158066][ T370] __kasan_kmalloc+0xd4/0x100 [ 26.162760][ T370] __kmalloc+0x19f/0x330 [ 26.167044][ T370] l2tp_session_create+0x39/0xb60 [ 26.172070][ T370] pppol2tp_connect+0xbf5/0x1640 [ 26.177008][ T370] __sys_connect+0x3ce/0x450 [ 26.181624][ T370] __x64_sys_connect+0x7a/0x90 [ 26.186412][ T370] do_syscall_64+0x31/0x40 [ 26.190843][ T370] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.196733][ T370] [ 26.199066][ T370] Freed by task 370: [ 26.202960][ T370] kasan_set_track+0x4a/0x70 [ 26.207555][ T370] kasan_set_free_info+0x23/0x40 [ 26.212496][ T370] ____kasan_slab_free+0x125/0x160 [ 26.217631][ T370] __kasan_slab_free+0x11/0x20 [ 26.222405][ T370] slab_free_freelist_hook+0xc5/0x190 [ 26.227780][ T370] kfree+0xc0/0x270 [ 26.231615][ T370] l2tp_session_put+0xb2/0x1a0 [ 26.236385][ T370] l2tp_session_delete+0x3a9/0x4a0 [ 26.241506][ T370] pppol2tp_release+0x169/0x2b0 [ 26.246361][ T370] sock_close+0xb8/0x200 [ 26.250608][ T370] __fput+0x2dc/0x730 [ 26.254590][ T370] ____fput+0x15/0x20 [ 26.258577][ T370] task_work_run+0x127/0x190 [ 26.263179][ T370] do_exit+0xa7c/0x24e0 [ 26.267435][ T370] do_group_exit+0x149/0x310 [ 26.272032][ T370] get_signal+0xfb1/0x1300 [ 26.276458][ T370] arch_do_signal_or_restart+0xe7/0x11b0 [ 26.282124][ T370] exit_to_user_mode_loop+0xa2/0xe0 [ 26.287324][ T370] exit_to_user_mode_prepare+0x76/0xa0 [ 26.292802][ T370] syscall_exit_to_user_mode+0x1d/0x40 [ 26.298263][ T370] do_syscall_64+0x3d/0x40 [ 26.302701][ T370] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.308603][ T370] [ 26.310941][ T370] The buggy address belongs to the object at ffff88810f8f9000 [ 26.310941][ T370] which belongs to the cache kmalloc-512 of size 512 [ 26.325109][ T370] The buggy address is located 336 bytes inside of [ 26.325109][ T370] 512-byte region [ffff88810f8f9000, ffff88810f8f9200) [ 26.338385][ T370] The buggy address belongs to the page: [ 26.344044][ T370] page:ffffea00043e3e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10f8f8 [ 26.354285][ T370] head:ffffea00043e3e00 order:2 compound_mapcount:0 compound_pincount:0 [ 26.362636][ T370] flags: 0x4000000000010200(slab|head) [ 26.368108][ T370] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 [ 26.376696][ T370] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 26.385299][ T370] page dumped because: kasan: bad access detected [ 26.391716][ T370] page_owner tracks the page as allocated [ 26.397448][ T370] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x152a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 0, ts 25775196475, free_ts 25725556978 [ 26.415592][ T370] prep_new_page+0x176/0x190 [ 26.420187][ T370] get_page_from_freelist+0x225f/0x23f0 [ 26.425746][ T370] __alloc_pages_nodemask+0x29a/0x640 [ 26.431118][ T370] new_slab+0x84/0x3f0 [ 26.435187][ T370] ___slab_alloc+0x2f8/0x4c0 [ 26.439777][ T370] __slab_alloc+0x63/0xa0 [ 26.444106][ T370] __kmalloc+0x1f9/0x330 [ 26.448366][ T370] ___neigh_create+0x6ec/0x1a70 [ 26.453235][ T370] __neigh_create+0x31/0x40 [ 26.457744][ T370] ip6_finish_output2+0x8fe/0x1540 [ 26.462860][ T370] __ip6_finish_output+0x5fd/0x790 [ 26.467978][ T370] ip6_finish_output+0x33/0x1e0 [ 26.472843][ T370] ip6_output+0x1fa/0x420 [ 26.477181][ T370] mld_sendpack+0x61e/0xb00 [ 26.481685][ T370] mld_ifc_timer_expire+0x862/0xc60 [ 26.486897][ T370] call_timer_fn+0x38/0x290 [ 26.491396][ T370] page last free stack trace: [ 26.496090][ T370] __free_pages_ok+0x80b/0x830 [ 26.500860][ T370] __free_pages+0xd8/0x390 [ 26.505280][ T370] __free_slab+0xcf/0x190 [ 26.509612][ T370] unfreeze_partials+0x150/0x180 [ 26.514572][ T370] put_cpu_partial+0xc1/0x180 [ 26.519265][ T370] __slab_free+0x2c9/0x3a0 [ 26.523686][ T370] ___cache_free+0x10e/0x130 [ 26.528279][ T370] qlink_free+0x50/0x90 [ 26.532438][ T370] qlist_free_all+0x5f/0xb0 [ 26.536942][ T370] kasan_quarantine_reduce+0x14a/0x160 [ 26.542421][ T370] __kasan_slab_alloc+0x2f/0xe0 [ 26.547296][ T370] slab_post_alloc_hook+0x5d/0x2f0 [ 26.552411][ T370] kmem_cache_alloc_trace+0x155/0x2e0 [ 26.557788][ T370] syslog_print+0x127/0x720 [ 26.562296][ T370] do_syslog+0x94c/0x9a0 [ 26.566541][ T370] __x64_sys_syslog+0x7c/0x90 [ 26.571234][ T370] [ 26.573576][ T370] Memory state around the buggy address: [ 26.579216][ T370] ffff88810f8f9000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.587293][ T370] ffff88810f8f9080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.595354][ T370] >ffff88810f8f910