Warning: Permanently added '10.128.0.198' (ED25519) to the list of known hosts. 2026/09/02 19:34:02 parsed 1 programs 2026/09/02 19:34:02 serving rpc on tcp://39731 [ 24.918206][ T24] audit: type=1400 audit(1788377642.670:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 24.939426][ T24] audit: type=1400 audit(1788377642.680:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 24.958995][ T24] audit: type=1400 audit(1788377642.680:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 25.939721][ T24] audit: type=1400 audit(1788377643.700:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.943110][ T293] cgroup: Unknown subsys name 'net' [ 25.962538][ T24] audit: type=1400 audit(1788377643.700:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.990130][ T24] audit: type=1400 audit(1788377643.730:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.990565][ T293] cgroup: Unknown subsys name 'devices' [ 26.071117][ T293] cgroup: Unknown subsys name 'hugetlb' [ 26.076730][ T293] cgroup: Unknown subsys name 'rlimit' [ 26.239811][ T24] audit: type=1400 audit(1788377644.000:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 26.263249][ T24] audit: type=1400 audit(1788377644.000:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 26.283687][ T24] audit: type=1400 audit(1788377644.000:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.304119][ T24] audit: type=1400 audit(1788377644.000:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.322673][ T297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 26.364670][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.803201][ T299] request_module fs-gadgetfs succeeded, but still no fs? [ 26.814593][ T299] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 26.899491][ T304] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.906582][ T304] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.914554][ T304] device bridge_slave_0 entered promiscuous mode [ 26.922561][ T304] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.929684][ T304] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.937158][ T304] device bridge_slave_1 entered promiscuous mode [ 26.979249][ T304] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.986304][ T304] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.993818][ T304] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.001325][ T304] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.020389][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.028040][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.035705][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.045514][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.053738][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.060816][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.069748][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.077942][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.085015][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.098426][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.107857][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.122909][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.134248][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.142567][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.150924][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.159620][ T304] device veth0_vlan entered promiscuous mode [ 27.171694][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.181428][ T304] device veth1_macvtap entered promiscuous mode [ 27.191288][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.201634][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.970446][ T49] device bridge_slave_1 left promiscuous mode [ 27.976791][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.985124][ T49] device bridge_slave_0 left promiscuous mode [ 27.991929][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.001247][ T49] device veth1_macvtap left promiscuous mode [ 28.007379][ T49] device veth0_vlan left promiscuous mode 2026/09/02 19:34:05 executed programs: 0 [ 28.235526][ T364] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.242873][ T364] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.250524][ T364] device bridge_slave_0 entered promiscuous mode [ 28.257569][ T364] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.264639][ T364] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.272102][ T364] device bridge_slave_1 entered promiscuous mode [ 28.314140][ T364] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.321244][ T364] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.328707][ T364] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.336033][ T364] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.358332][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.366713][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.374308][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.383263][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 28.391577][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.398621][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.408084][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 28.416429][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.423511][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.435062][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 28.444349][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 28.458080][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 28.470112][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 28.478153][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 28.485811][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 28.494631][ T364] device veth0_vlan entered promiscuous mode [ 28.507336][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 28.517243][ T364] device veth1_macvtap entered promiscuous mode [ 28.526697][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.537009][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 28.560079][ T381] ================================================================== [ 28.568360][ T381] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 [ 28.575045][ T381] Write of size 8 at addr ffff88810fd29150 by task syz.2.17/381 [ 28.582694][ T381] [ 28.585038][ T381] CPU: 0 PID: 381 Comm: syz.2.17 Not tainted syzkaller #0 [ 28.592155][ T381] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 28.602215][ T381] Call Trace: [ 28.605507][ T381] __dump_stack+0x21/0x24 [ 28.609844][ T381] dump_stack_lvl+0x1a7/0x208 [ 28.614534][ T381] ? show_regs_print_info+0x18/0x18 [ 28.619730][ T381] ? thaw_kernel_threads+0x220/0x220 [ 28.625007][ T381] ? debug_smp_processor_id+0x17/0x20 [ 28.630396][ T381] print_address_description+0x7f/0x2c0 [ 28.635938][ T381] ? mutex_lock+0x85/0xf0 [ 28.640264][ T381] kasan_report+0x100/0x140 [ 28.644771][ T381] ? mutex_lock+0x85/0xf0 [ 28.649104][ T381] kasan_check_range+0x249/0x2a0 [ 28.654043][ T381] __kasan_check_write+0x14/0x20 [ 28.658976][ T381] mutex_lock+0x85/0xf0 [ 28.663146][ T381] ? mutex_trylock+0xb0/0xb0 [ 28.667725][ T381] ? l2tp_session_put+0xb2/0x1a0 [ 28.672650][ T381] ? l2tp_session_delete+0x3a9/0x4a0 [ 28.677925][ T381] pppol2tp_release+0x178/0x2b0 [ 28.682780][ T381] sock_close+0xb8/0x200 [ 28.687013][ T381] ? sock_mmap+0xa0/0xa0 [ 28.691244][ T381] __fput+0x2dc/0x730 [ 28.695214][ T381] ____fput+0x15/0x20 [ 28.699197][ T381] task_work_run+0x127/0x190 [ 28.703796][ T381] exit_to_user_mode_loop+0xcb/0xe0 [ 28.708993][ T381] exit_to_user_mode_prepare+0x76/0xa0 [ 28.714449][ T381] syscall_exit_to_user_mode+0x1d/0x40 [ 28.719902][ T381] do_syscall_64+0x3d/0x40 [ 28.724310][ T381] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.730196][ T381] RIP: 0033:0x7f149d1c4159 [ 28.734619][ T381] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 28.754216][ T381] RSP: 002b:00007ffe5b8eaf68 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 28.762621][ T381] RAX: 0000000000000000 RBX: 00007ffe5b8eb050 RCX: 00007f149d1c4159 [ 28.770590][ T381] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 28.778558][ T381] RBP: 0000000000006f85 R08: 0000000000000001 R09: 0000000000000000 [ 28.786526][ T381] R10: 0000001b32b20000 R11: 0000000000000246 R12: 0000000000000000 [ 28.794492][ T381] R13: 00007f149d44bfac R14: 00007f149d44bfa8 R15: 00007f149d44bfa0 [ 28.802636][ T381] [ 28.805015][ T381] Allocated by task 381: [ 28.809282][ T381] __kasan_kmalloc+0xd4/0x100 [ 28.813968][ T381] __kmalloc+0x19f/0x330 [ 28.818240][ T381] l2tp_session_create+0x39/0xb60 [ 28.823273][ T381] pppol2tp_connect+0xbf5/0x1640 [ 28.828216][ T381] __sys_connect+0x3ce/0x450 [ 28.832809][ T381] __x64_sys_connect+0x7a/0x90 [ 28.837568][ T381] do_syscall_64+0x31/0x40 [ 28.841988][ T381] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.847889][ T381] [ 28.850211][ T381] Freed by task 381: [ 28.854106][ T381] kasan_set_track+0x4a/0x70 [ 28.858692][ T381] kasan_set_free_info+0x23/0x40 [ 28.863630][ T381] ____kasan_slab_free+0x125/0x160 [ 28.868732][ T381] __kasan_slab_free+0x11/0x20 [ 28.873489][ T381] slab_free_freelist_hook+0xc5/0x190 [ 28.878853][ T381] kfree+0xc0/0x270 [ 28.882652][ T381] l2tp_session_put+0xb2/0x1a0 [ 28.887407][ T381] l2tp_session_delete+0x3a9/0x4a0 [ 28.892512][ T381] pppol2tp_release+0x169/0x2b0 [ 28.897359][ T381] sock_close+0xb8/0x200 [ 28.901661][ T381] __fput+0x2dc/0x730 [ 28.905667][ T381] ____fput+0x15/0x20 [ 28.909647][ T381] task_work_run+0x127/0x190 [ 28.914261][ T381] exit_to_user_mode_loop+0xcb/0xe0 [ 28.919471][ T381] exit_to_user_mode_prepare+0x76/0xa0 [ 28.924948][ T381] syscall_exit_to_user_mode+0x1d/0x40 [ 28.930422][ T381] do_syscall_64+0x3d/0x40 [ 28.934835][ T381] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.940719][ T381] [ 28.943064][ T381] The buggy address belongs to the object at ffff88810fd29000 [ 28.943064][ T381] which belongs to the cache kmalloc-512 of size 512 [ 28.957110][ T381] The buggy address is located 336 bytes inside of [ 28.957110][ T381] 512-byte region [ffff88810fd29000, ffff88810fd29200) [ 28.970383][ T381] The buggy address belongs to the page: [ 28.976053][ T381] page:ffffea00043f4a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10fd28 [ 28.986278][ T381] head:ffffea00043f4a00 order:2 compound_mapcount:0 compound_pincount:0 [ 28.994777][ T381] flags: 0x4000000000010200(slab|head) [ 29.000241][ T381] raw: 4000000000010200 ffffea0004467400 0000000400000004 ffff888100043080 [ 29.008825][ T381] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 29.017403][ T381] page dumped because: kasan: bad access detected [ 29.023808][ T381] page_owner tracks the page as allocated [ 29.029540][ T381] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 96, ts 6616880754, free_ts 0 [ 29.047505][ T381] prep_new_page+0x176/0x190 [ 29.052095][ T381] get_page_from_freelist+0x225f/0x23f0 [ 29.057648][ T381] __alloc_pages_nodemask+0x29a/0x640 [ 29.063025][ T381] new_slab+0x84/0x3f0 [ 29.067102][ T381] ___slab_alloc+0x2f8/0x4c0 [ 29.071687][ T381] __slab_alloc+0x63/0xa0 [ 29.076013][ T381] __kmalloc_track_caller+0x1e4/0x310 [ 29.081382][ T381] __alloc_skb+0xdc/0x520 [ 29.085708][ T381] alloc_uevent_skb+0x85/0x240 [ 29.090477][ T381] kobject_uevent_net_broadcast+0x335/0x5a0 [ 29.096377][ T381] kobject_uevent_env+0x52b/0x700 [ 29.101392][ T381] kobject_synth_uevent+0x452/0x940 [ 29.106579][ T381] store_uevent+0x16/0x30 [ 29.110988][ T381] module_attr_store+0x5f/0x80 [ 29.115740][ T381] sysfs_kf_write+0x129/0x150 [ 29.120413][ T381] kernfs_fop_write_iter+0x2bd/0x400 [ 29.125695][ T381] page_owner free stack trace missing [ 29.131052][ T381] [ 29.133374][ T381] Memory state around the buggy address: [ 29.139025][ T381] ffff88810fd29000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.147255][ T381] ffff88810fd29080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.155410][ T381] >ffff88810fd29100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.163465][ T381] ^ [ 29.170152][ T381] ffff88810fd29180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.178223][ T381] ffff88810fd29200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.186278][ T381] ================================================================== [ 29.194416][ T381] Disabling lock debugging due to kernel taint