Warning: Permanently added '10.128.0.50' (ED25519) to the list of known hosts. 2026/10/11 06:00:30 parsed 1 programs 2026/10/11 06:00:30 serving rpc on tcp://36381 [ 23.758565][ T24] audit: type=1400 audit(1791698430.839:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 23.779513][ T24] audit: type=1400 audit(1791698430.839:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 23.799539][ T24] audit: type=1400 audit(1791698430.839:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 24.399351][ T24] audit: type=1400 audit(1791698431.479:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 24.400383][ T293] cgroup: Unknown subsys name 'net' [ 24.421987][ T24] audit: type=1400 audit(1791698431.479:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.449284][ T24] audit: type=1400 audit(1791698431.509:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.449441][ T293] cgroup: Unknown subsys name 'devices' [ 24.561462][ T293] cgroup: Unknown subsys name 'hugetlb' [ 24.567035][ T293] cgroup: Unknown subsys name 'rlimit' [ 24.709325][ T24] audit: type=1400 audit(1791698431.789:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 24.732473][ T24] audit: type=1400 audit(1791698431.789:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 24.752863][ T24] audit: type=1400 audit(1791698431.789:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 24.758461][ T297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 24.773105][ T24] audit: type=1400 audit(1791698431.789:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 24.822214][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 25.188624][ T301] request_module fs-gadgetfs succeeded, but still no fs? [ 25.199156][ T301] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 25.426443][ T317] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.433510][ T317] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.440872][ T317] device bridge_slave_0 entered promiscuous mode [ 25.447566][ T317] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.454687][ T317] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.461926][ T317] device bridge_slave_1 entered promiscuous mode [ 25.492683][ T317] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.499704][ T317] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.507137][ T317] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.514166][ T317] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.530073][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.537899][ T48] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.545110][ T48] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.554893][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.563039][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.570064][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.578350][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.586566][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.593594][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.605184][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.614074][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.626065][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.637227][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.645254][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.652585][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.660663][ T317] device veth0_vlan entered promiscuous mode [ 25.669734][ T317] device veth1_macvtap entered promiscuous mode [ 25.676731][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.688652][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.697138][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/10/11 06:00:33 executed programs: 0 [ 26.172093][ T7] device bridge_slave_1 left promiscuous mode [ 26.178286][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.185750][ T7] device bridge_slave_0 left promiscuous mode [ 26.191904][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.199462][ T7] device veth1_macvtap left promiscuous mode [ 26.205557][ T7] device veth0_vlan left promiscuous mode [ 26.294018][ T365] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.301079][ T365] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.308373][ T365] device bridge_slave_0 entered promiscuous mode [ 26.315243][ T365] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.322284][ T365] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.329531][ T365] device bridge_slave_1 entered promiscuous mode [ 26.361897][ T365] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.368921][ T365] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.376182][ T365] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.383230][ T365] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.397893][ T48] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.405252][ T48] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.412789][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 26.420446][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.428975][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.437118][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.444152][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.452497][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.460657][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.467665][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.478591][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.487441][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.499579][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.511044][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.519095][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.526429][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.534519][ T365] device veth0_vlan entered promiscuous mode [ 26.544750][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.553850][ T365] device veth1_macvtap entered promiscuous mode [ 26.563739][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.573280][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.641078][ T383] ================================================================== [ 26.649169][ T383] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 [ 26.655818][ T383] Write of size 8 at addr ffff88810f10c550 by task syz.2.17/383 [ 26.663416][ T383] [ 26.665731][ T383] CPU: 0 PID: 383 Comm: syz.2.17 Not tainted syzkaller #0 [ 26.672814][ T383] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 26.682848][ T383] Call Trace: [ 26.686116][ T383] __dump_stack+0x21/0x24 [ 26.690422][ T383] dump_stack_lvl+0x1a7/0x208 [ 26.695077][ T383] ? show_regs_print_info+0x18/0x18 [ 26.700249][ T383] ? thaw_kernel_threads+0x220/0x220 [ 26.705526][ T383] print_address_description+0x7f/0x2c0 [ 26.711053][ T383] ? mutex_lock+0x85/0xf0 [ 26.715366][ T383] kasan_report+0x100/0x140 [ 26.719859][ T383] ? mutex_lock+0x85/0xf0 [ 26.724171][ T383] kasan_check_range+0x249/0x2a0 [ 26.729088][ T383] __kasan_check_write+0x14/0x20 [ 26.734011][ T383] mutex_lock+0x85/0xf0 [ 26.738143][ T383] ? mutex_trylock+0xb0/0xb0 [ 26.742709][ T383] ? l2tp_session_put+0xb2/0x1a0 [ 26.747621][ T383] ? l2tp_session_delete+0x3a9/0x4a0 [ 26.752890][ T383] pppol2tp_release+0x178/0x2b0 [ 26.757718][ T383] sock_close+0xb8/0x200 [ 26.762023][ T383] ? sock_mmap+0xa0/0xa0 [ 26.766245][ T383] __fput+0x2dc/0x730 [ 26.770205][ T383] ____fput+0x15/0x20 [ 26.774162][ T383] task_work_run+0x127/0x190 [ 26.778727][ T383] do_exit+0xa7c/0x24e0 [ 26.782860][ T383] ? finish_task_switch+0x1b7/0x5a0 [ 26.788036][ T383] ? put_task_struct+0x90/0x90 [ 26.792778][ T383] ? remove_hrtimer+0x225/0x490 [ 26.797612][ T383] ? __kasan_check_write+0x14/0x20 [ 26.802699][ T383] ? _raw_spin_lock_irq+0x95/0xf0 [ 26.807701][ T383] do_group_exit+0x149/0x310 [ 26.812352][ T383] ? __kasan_check_write+0x14/0x20 [ 26.817438][ T383] ? recalc_sigpending+0x1c4/0x230 [ 26.822523][ T383] get_signal+0xfb1/0x1300 [ 26.826916][ T383] arch_do_signal_or_restart+0xe7/0x11b0 [ 26.832525][ T383] ? nanosleep_copyout+0x120/0x120 [ 26.837614][ T383] ? get_timespec64+0x116/0x1b0 [ 26.842439][ T383] ? __ia32_sys_rt_sigreturn+0x730/0x730 [ 26.848051][ T383] ? __x64_sys_clock_nanosleep+0xb0/0xb0 [ 26.853660][ T383] ? debug_smp_processor_id+0x17/0x20 [ 26.859010][ T383] exit_to_user_mode_loop+0xa2/0xe0 [ 26.864220][ T383] exit_to_user_mode_prepare+0x76/0xa0 [ 26.869658][ T383] syscall_exit_to_user_mode+0x1d/0x40 [ 26.875090][ T383] do_syscall_64+0x3d/0x40 [ 26.879481][ T383] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.885356][ T383] RIP: 0033:0x7f84ce34fa0e [ 26.889752][ T383] Code: Unable to access opcode bytes at RIP 0x7f84ce34f9e4. [ 26.897091][ T383] RSP: 002b:00007f84ce1efe78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 [ 26.905478][ T383] RAX: fffffffffffffdfc RBX: 00007f84ce1f06c0 RCX: 00007f84ce34fa0e [ 26.913428][ T383] RDX: 00007f84ce1efed0 RSI: 0000000000000000 RDI: 0000000000000000 [ 26.921388][ T383] RBP: 00007f84ce426888 R08: 0000000000000000 R09: 0000000000000000 [ 26.929334][ T383] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 26.937284][ T383] R13: 00007f84ce617038 R14: 00007f84ce616fa0 R15: 00007ffed5595ee8 [ 26.945235][ T383] [ 26.947540][ T383] Allocated by task 382: [ 26.951767][ T383] __kasan_kmalloc+0xd4/0x100 [ 26.956419][ T383] __kmalloc+0x19f/0x330 [ 26.960635][ T383] l2tp_session_create+0x39/0xb60 [ 26.965632][ T383] pppol2tp_connect+0xbf5/0x1640 [ 26.970543][ T383] __sys_connect+0x3ce/0x450 [ 26.975113][ T383] __x64_sys_connect+0x7a/0x90 [ 26.979852][ T383] do_syscall_64+0x31/0x40 [ 26.984262][ T383] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.990131][ T383] [ 26.992439][ T383] Freed by task 383: [ 26.996308][ T383] kasan_set_track+0x4a/0x70 [ 27.000870][ T383] kasan_set_free_info+0x23/0x40 [ 27.005784][ T383] ____kasan_slab_free+0x125/0x160 [ 27.010866][ T383] __kasan_slab_free+0x11/0x20 [ 27.015605][ T383] slab_free_freelist_hook+0xc5/0x190 [ 27.020949][ T383] kfree+0xc0/0x270 [ 27.024730][ T383] l2tp_session_put+0xb2/0x1a0 [ 27.029465][ T383] l2tp_session_delete+0x3a9/0x4a0 [ 27.034550][ T383] pppol2tp_release+0x169/0x2b0 [ 27.039374][ T383] sock_close+0xb8/0x200 [ 27.043590][ T383] __fput+0x2dc/0x730 [ 27.047551][ T383] ____fput+0x15/0x20 [ 27.051511][ T383] task_work_run+0x127/0x190 [ 27.056081][ T383] do_exit+0xa7c/0x24e0 [ 27.060209][ T383] do_group_exit+0x149/0x310 [ 27.064774][ T383] get_signal+0xfb1/0x1300 [ 27.069191][ T383] arch_do_signal_or_restart+0xe7/0x11b0 [ 27.074799][ T383] exit_to_user_mode_loop+0xa2/0xe0 [ 27.079988][ T383] exit_to_user_mode_prepare+0x76/0xa0 [ 27.085433][ T383] syscall_exit_to_user_mode+0x1d/0x40 [ 27.090882][ T383] do_syscall_64+0x3d/0x40 [ 27.095277][ T383] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 27.101139][ T383] [ 27.103473][ T383] The buggy address belongs to the object at ffff88810f10c400 [ 27.103473][ T383] which belongs to the cache kmalloc-512 of size 512 [ 27.117511][ T383] The buggy address is located 336 bytes inside of [ 27.117511][ T383] 512-byte region [ffff88810f10c400, ffff88810f10c600) [ 27.130759][ T383] The buggy address belongs to the page: [ 27.136387][ T383] page:ffffea00043c4300 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10f10c [ 27.146599][ T383] head:ffffea00043c4300 order:2 compound_mapcount:0 compound_pincount:0 [ 27.154920][ T383] flags: 0x4000000000010200(slab|head) [ 27.160360][ T383] raw: 4000000000010200 ffffea00043fcb00 0000000400000004 ffff888100043080 [ 27.168918][ T383] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 27.177473][ T383] page dumped because: kasan: bad access detected [ 27.183861][ T383] page_owner tracks the page as allocated [ 27.189562][ T383] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 96, ts 3818945358, free_ts 0 [ 27.207613][ T383] prep_new_page+0x176/0x190 [ 27.212186][ T383] get_page_from_freelist+0x225f/0x23f0 [ 27.217704][ T383] __alloc_pages_nodemask+0x29a/0x640 [ 27.223054][ T383] new_slab+0x84/0x3f0 [ 27.227100][ T383] ___slab_alloc+0x2f8/0x4c0 [ 27.231668][ T383] __slab_alloc+0x63/0xa0 [ 27.235975][ T383] __kmalloc_track_caller+0x1e4/0x310 [ 27.241321][ T383] __alloc_skb+0xdc/0x520 [ 27.245626][ T383] alloc_uevent_skb+0x85/0x240 [ 27.250367][ T383] kobject_uevent_net_broadcast+0x335/0x5a0 [ 27.256237][ T383] kobject_uevent_env+0x52b/0x700 [ 27.261238][ T383] kobject_synth_uevent+0x452/0x940 [ 27.266415][ T383] uevent_store+0x4b/0x70 [ 27.270728][ T383] drv_attr_store+0x79/0xa0 [ 27.275301][ T383] sysfs_kf_write+0x129/0x150 [ 27.279962][ T383] kernfs_fop_write_iter+0x2bd/0x400 [ 27.285218][ T383] page_owner free stack trace missing [ 27.290560][ T383] [ 27.292864][ T383] Memory state around the buggy address: [ 27.298474][ T383] ffff88810f10c400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.306515][ T383] ffff88810f10c480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.314553][ T383] >ffff88810f10c500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.322587][ T383] ^ [ 27.329234][ T383] ffff88810f10c580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.337269][ T383] ffff88810f10c600: fc fc fc fc fc fc fc fc fc fc fc fc fc