Warning: Permanently added '10.128.1.101' (ED25519) to the list of known hosts.
2026/08/04 07:01:43 parsed 1 programs
2026/08/04 07:01:43 serving rpc on tcp://45257
[ 22.979143][ T28] audit: type=1400 audit(1785826903.292:64): avc: denied { node_bind } for pid=294 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1
[ 23.000598][ T28] audit: type=1400 audit(1785826903.292:65): avc: denied { module_request } for pid=294 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1
[ 23.806122][ T28] audit: type=1400 audit(1785826904.122:66): avc: denied { mounton } for pid=300 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 23.807131][ T300] cgroup: Unknown subsys name 'net'
[ 23.828916][ T28] audit: type=1400 audit(1785826904.122:67): avc: denied { mount } for pid=300 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 23.856200][ T28] audit: type=1400 audit(1785826904.152:68): avc: denied { unmount } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 23.856369][ T300] cgroup: Unknown subsys name 'devices'
[ 24.003591][ T300] cgroup: Unknown subsys name 'hugetlb'
[ 24.009241][ T300] cgroup: Unknown subsys name 'rlimit'
[ 24.117908][ T28] audit: type=1400 audit(1785826904.432:69): avc: denied { setattr } for pid=300 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 24.141623][ T28] audit: type=1400 audit(1785826904.432:70): avc: denied { create } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 24.150204][ T305] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped).
[ 24.162898][ T28] audit: type=1400 audit(1785826904.432:71): avc: denied { write } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[ 24.191558][ T28] audit: type=1400 audit(1785826904.432:72): avc: denied { read } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
Setting up swapspace version 1, size = 127995904 bytes
[ 24.211978][ T28] audit: type=1400 audit(1785826904.432:73): avc: denied { mounton } for pid=300 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1
[ 24.244304][ T300] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 24.968775][ T307] request_module fs-gadgetfs succeeded, but still no fs?
[ 25.174212][ T326] bridge0: port 1(bridge_slave_0) entered blocking state
[ 25.181260][ T326] bridge0: port 1(bridge_slave_0) entered disabled state
[ 25.188737][ T326] device bridge_slave_0 entered promiscuous mode
[ 25.195798][ T326] bridge0: port 2(bridge_slave_1) entered blocking state
[ 25.202985][ T326] bridge0: port 2(bridge_slave_1) entered disabled state
[ 25.210369][ T326] device bridge_slave_1 entered promiscuous mode
[ 25.249705][ T326] bridge0: port 2(bridge_slave_1) entered blocking state
[ 25.256776][ T326] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 25.264141][ T326] bridge0: port 1(bridge_slave_0) entered blocking state
[ 25.271189][ T326] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 25.291116][ T312] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 25.298855][ T312] bridge0: port 1(bridge_slave_0) entered disabled state
[ 25.306586][ T312] bridge0: port 2(bridge_slave_1) entered disabled state
[ 25.322634][ T312] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 25.331207][ T312] bridge0: port 1(bridge_slave_0) entered blocking state
[ 25.338283][ T312] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 25.345651][ T312] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 25.354016][ T312] bridge0: port 2(bridge_slave_1) entered blocking state
[ 25.361406][ T312] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 25.368913][ T312] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 25.376862][ T312] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 25.389748][ T312] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 25.402093][ T312] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 25.410685][ T312] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 25.418243][ T312] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 25.426760][ T326] device veth0_vlan entered promiscuous mode
[ 25.437314][ T312] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 25.446420][ T326] device veth1_macvtap entered promiscuous mode
[ 25.456512][ T312] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 25.466547][ T312] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
2026/08/04 07:01:46 executed programs: 0
[ 26.128068][ T368] bridge0: port 1(bridge_slave_0) entered blocking state
[ 26.135641][ T368] bridge0: port 1(bridge_slave_0) entered disabled state
[ 26.143146][ T368] device bridge_slave_0 entered promiscuous mode
[ 26.153468][ T368] bridge0: port 2(bridge_slave_1) entered blocking state
[ 26.160611][ T368] bridge0: port 2(bridge_slave_1) entered disabled state
[ 26.168153][ T368] device bridge_slave_1 entered promiscuous mode
[ 26.203301][ T43] device bridge_slave_1 left promiscuous mode
[ 26.209532][ T43] bridge0: port 2(bridge_slave_1) entered disabled state
[ 26.217270][ T43] device bridge_slave_0 left promiscuous mode
[ 26.223467][ T43] bridge0: port 1(bridge_slave_0) entered disabled state
[ 26.231569][ T43] device veth1_macvtap left promiscuous mode
[ 26.237722][ T43] device veth0_vlan left promiscuous mode
[ 26.341701][ T368] bridge0: port 2(bridge_slave_1) entered blocking state
[ 26.349375][ T368] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 26.357208][ T368] bridge0: port 1(bridge_slave_0) entered blocking state
[ 26.364791][ T368] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 26.382879][ T312] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 26.390505][ T312] bridge0: port 1(bridge_slave_0) entered disabled state
[ 26.398276][ T312] bridge0: port 2(bridge_slave_1) entered disabled state
[ 26.407883][ T312] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 26.417210][ T312] bridge0: port 1(bridge_slave_0) entered blocking state
[ 26.424426][ T312] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 26.433813][ T312] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 26.442312][ T312] bridge0: port 2(bridge_slave_1) entered blocking state
[ 26.449351][ T312] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 26.460734][ T312] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 26.473188][ T312] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 26.487830][ T312] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 26.500139][ T312] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 26.509007][ T312] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 26.517211][ T312] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 26.525977][ T368] device veth0_vlan entered promiscuous mode
[ 26.536486][ T312] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 26.545597][ T368] device veth1_macvtap entered promiscuous mode
[ 26.554989][ T312] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 26.564852][ T312] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 26.632315][ C0] ==================================================================
[ 26.640437][ C0] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x6c/0xb0
[ 26.648042][ C0] Read of size 8 at addr ffff88810ea2f990 by task kworker/0:2/331
[ 26.655881][ C0]
[ 26.658242][ C0] CPU: 0 PID: 331 Comm: kworker/0:2 Not tainted syzkaller #0
[ 26.665631][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 26.675717][ C0] Workqueue: ipv6_addrconf addrconf_dad_work
[ 26.681733][ C0] Call Trace:
[ 26.685031][ C0]
[ 26.687884][ C0] __dump_stack+0x21/0x24
[ 26.692240][ C0] dump_stack_lvl+0x110/0x170
[ 26.696940][ C0] ? __cfi_dump_stack_lvl+0x8/0x8
[ 26.701988][ C0] ? debug_smp_processor_id+0x17/0x20
[ 26.707383][ C0] ? rcu_cblist_dequeue+0x6c/0xb0
[ 26.712437][ C0] print_address_description+0x71/0x200
[ 26.718017][ C0] print_report+0x4a/0x60
[ 26.722382][ C0] kasan_report+0x122/0x150
[ 26.726913][ C0] ? rcu_cblist_dequeue+0x6c/0xb0
[ 26.731946][ C0] __asan_report_load8_noabort+0x14/0x20
[ 26.737847][ C0] rcu_cblist_dequeue+0x6c/0xb0
[ 26.742695][ C0] rcu_do_batch+0x4bc/0xc30
[ 26.747403][ C0] ? rcu_core+0xf00/0xf00
[ 26.751765][ C0] rcu_core+0x486/0xf00
[ 26.756111][ C0] ? kvm_sched_clock_read+0x18/0x40
[ 26.761316][ C0] ? sched_clock+0x9/0x10
[ 26.765650][ C0] ? rcu_cpu_kthread_park+0x90/0x90
[ 26.770849][ C0] ? irqtime_account_irq+0x75/0x240
[ 26.776573][ C0] rcu_core_si+0x9/0x10
[ 26.780800][ C0] handle_softirqs+0x1d7/0x600
[ 26.785587][ C0] __do_softirq+0xb/0xd
[ 26.789745][ C0] do_softirq+0xdc/0x130
[ 26.793999][ C0]
[ 26.796944][ C0]
[ 26.799904][ C0] ? __cfi_do_softirq+0x10/0x10
[ 26.804764][ C0] ? mod_delayed_work_on+0xa8/0xe0
[ 26.809889][ C0] __local_bh_enable_ip+0x75/0x80
[ 26.814914][ C0] _raw_write_unlock_bh+0x2f/0x50
[ 26.819942][ C0] addrconf_dad_work+0x928/0x14a0
[ 26.824969][ C0] ? __cfi_addrconf_dad_work+0x10/0x10
[ 26.830452][ C0] ? __schedule+0xbea/0x14b0
[ 26.835046][ C0] process_one_work+0x717/0xc30
[ 26.839904][ C0] worker_thread+0xa4d/0x11d0
[ 26.844577][ C0] kthread+0x281/0x320
[ 26.848642][ C0] ? __cfi_worker_thread+0x10/0x10
[ 26.853754][ C0] ? __cfi_kthread+0x10/0x10
[ 26.858348][ C0] ret_from_fork+0x1f/0x30
[ 26.862764][ C0]
[ 26.865785][ C0]
[ 26.868114][ C0] Allocated by task 372:
[ 26.872439][ C0] kasan_set_track+0x4b/0x70
[ 26.877029][ C0] kasan_save_alloc_info+0x1f/0x30
[ 26.882141][ C0] __kasan_kmalloc+0x95/0xb0
[ 26.886917][ C0] __kmalloc+0xb4/0x1e0
[ 26.891097][ C0] l2tp_session_create+0x38/0xbd0
[ 26.896130][ C0] pppol2tp_connect+0xbf5/0x1640
[ 26.901078][ C0] __sys_connect+0x3da/0x460
[ 26.905695][ C0] __x64_sys_connect+0x7a/0x90
[ 26.910470][ C0] x64_sys_call+0x88d/0x9a0
[ 26.915007][ C0] do_syscall_64+0x4c/0xa0
[ 26.920215][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 26.926133][ C0]
[ 26.928462][ C0] Freed by task 312:
[ 26.932351][ C0] kasan_set_track+0x4b/0x70
[ 26.937839][ C0] kasan_save_free_info+0x2b/0x40
[ 26.942893][ C0] ____kasan_slab_free+0x132/0x180
[ 26.948012][ C0] __kasan_slab_free+0x11/0x20
[ 26.952782][ C0] slab_free_freelist_hook+0xc2/0x190
[ 26.958681][ C0] __kmem_cache_free+0xb7/0x1b0
[ 26.963562][ C0] kfree+0x6f/0xf0
[ 26.967284][ C0] l2tp_session_put+0xaf/0x1a0
[ 26.972048][ C0] l2tp_session_delete+0x3df/0x4d0
[ 26.977506][ C0] l2tp_tunnel_del_work+0x199/0x410
[ 26.982713][ C0] process_one_work+0x717/0xc30
[ 26.987647][ C0] worker_thread+0xa4d/0x11d0
[ 26.992338][ C0] kthread+0x281/0x320
[ 26.996405][ C0] ret_from_fork+0x1f/0x30
[ 27.000821][ C0]
[ 27.003181][ C0] Last potentially related work creation:
[ 27.008926][ C0] kasan_save_stack+0x3a/0x60
[ 27.013628][ C0] __kasan_record_aux_stack+0xb6/0xc0
[ 27.018994][ C0] kasan_record_aux_stack_noalloc+0xb/0x10
[ 27.024809][ C0] call_rcu+0xcf/0xf50
[ 27.028880][ C0] pppol2tp_release+0x1e3/0x2b0
[ 27.033744][ C0] sock_close+0xc9/0x220
[ 27.038015][ C0] __fput+0x1fd/0x8f0
[ 27.042007][ C0] ____fput+0x15/0x20
[ 27.045997][ C0] task_work_run+0x1e1/0x250
[ 27.050591][ C0] exit_to_user_mode_loop+0x9b/0xb0
[ 27.055800][ C0] exit_to_user_mode_prepare+0x87/0xd0
[ 27.061262][ C0] syscall_exit_to_user_mode+0x1a/0x30
[ 27.066716][ C0] do_syscall_64+0x58/0xa0
[ 27.071131][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 27.077028][ C0]
[ 27.079359][ C0] Second to last potentially related work creation:
[ 27.086542][ C0] kasan_save_stack+0x3a/0x60
[ 27.091231][ C0] __kasan_record_aux_stack+0xb6/0xc0
[ 27.096599][ C0] kasan_record_aux_stack_noalloc+0xb/0x10
[ 27.102400][ C0] kvfree_call_rcu+0x8b/0x7a0
[ 27.107096][ C0] ops_init+0x26f/0x470
[ 27.111277][ C0] register_pernet_operations+0x2a0/0x600
[ 27.117009][ C0] register_pernet_subsys+0x28/0x40
[ 27.122216][ C0] ipsec_pfkey_init+0x3c/0xac
[ 27.126913][ C0] do_one_initcall+0x1d6/0x580
[ 27.131677][ C0] do_initcall_level+0x174/0x2df
[ 27.136622][ C0] do_initcalls+0x50/0x92
[ 27.141032][ C0] do_basic_setup+0x92/0x99
[ 27.145539][ C0] kernel_init_freeable+0x2d1/0x42d
[ 27.150838][ C0] kernel_init+0x1d/0x1c0
[ 27.155535][ C0] ret_from_fork+0x1f/0x30
[ 27.160058][ C0]
[ 27.162494][ C0] The buggy address belongs to the object at ffff88810ea2f800
[ 27.162494][ C0] which belongs to the cache kmalloc-512 of size 512
[ 27.176910][ C0] The buggy address is located 400 bytes inside of
[ 27.176910][ C0] 512-byte region [ffff88810ea2f800, ffff88810ea2fa00)
[ 27.190374][ C0]
[ 27.192716][ C0] The buggy address belongs to the physical page:
[ 27.199135][ C0] page:ffffea00043a8b00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10ea2c
[ 27.209499][ C0] head:ffffea00043a8b00 order:2 compound_mapcount:0 compound_pincount:0
[ 27.217823][ C0] flags: 0x4000000000010200(slab|head|zone=1)
[ 27.223900][ C0] raw: 4000000000010200 0000000000000000 dead000000000001 ffff888100042f00
[ 27.232478][ C0] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
[ 27.241068][ C0] page dumped because: kasan: bad access detected
[ 27.247518][ C0] page_owner tracks the page as allocated
[ 27.253234][ C0] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 3473375891, free_ts 3473193845
[ 27.273635][ C0] post_alloc_hook+0x1f5/0x210
[ 27.278442][ C0] prep_new_page+0x1c/0x110
[ 27.282950][ C0] get_page_from_freelist+0x2ca9/0x2d20
[ 27.288758][ C0] __alloc_pages+0x1fa/0x610
[ 27.293538][ C0] alloc_slab_page+0x6e/0xf0
[ 27.298150][ C0] new_slab+0x98/0x3e0
[ 27.302231][ C0] ___slab_alloc+0x70f/0xb70
[ 27.306824][ C0] __slab_alloc+0x5e/0xa0
[ 27.312305][ C0] __kmem_cache_alloc_node+0x204/0x2d0
[ 27.318098][ C0] __kmalloc_node_track_caller+0xa1/0x1e0
[ 27.323885][ C0] __alloc_skb+0x226/0x4a0
[ 27.329098][ C0] inet_netconf_notify_devconf+0x169/0x220
[ 27.335190][ C0] __devinet_sysctl_register+0x2af/0x320
[ 27.340860][ C0] devinet_sysctl_register+0x169/0x1e0
[ 27.346327][ C0] inetdev_init+0x2ca/0x510
[ 27.350851][ C0] inetdev_event+0x1f4/0x10a0
[ 27.355620][ C0] page last free stack trace:
[ 27.360638][ C0] free_unref_page_prepare+0x80c/0x820
[ 27.366277][ C0] free_unref_page+0x93/0x530
[ 27.371186][ C0] __free_pages+0x67/0x100
[ 27.375798][ C0] free_pages+0x82/0x90
[ 27.379991][ C0] __stack_depot_save+0x45f/0x490
[ 27.385035][ C0] kasan_set_track+0x60/0x70
[ 27.389629][ C0] kasan_save_alloc_info+0x1f/0x30
[ 27.394837][ C0] __kasan_kmalloc+0x95/0xb0
[ 27.399430][ C0] kmalloc_trace+0x40/0xb0
[ 27.403847][ C0] ref_tracker_alloc+0x16b/0x4a0
[ 27.408869][ C0] netdev_queue_update_kobjects+0x181/0x470
[ 27.414773][ C0] netdev_register_kobject+0x281/0x330
[ 27.420248][ C0] register_netdevice+0xec9/0x1550
[ 27.425379][ C0] register_netdev+0x3e/0x50
[ 27.429967][ C0] sit_init_net+0x243/0x4e0
[ 27.434504][ C0] ops_init+0x2ce/0x470
[ 27.438710][ C0]
[ 27.441049][ C0] Memory state around the buggy address:
[ 27.446784][ C0] ffff88810ea2f880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 27.454880][ C0] ffff88810ea2f900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 27.463110][ C0] >ffff88810ea2f980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 27.471427][ C0] ^
[ 27.476012][ C0] ffff88810ea2fa00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 27.484066][ C0]