Warning: Permanently added '10.128.0.212' (ED25519) to the list of known hosts. 2026/09/20 14:59:04 parsed 1 programs 2026/09/20 14:59:04 serving rpc on tcp://42207 [ 24.799012][ T28] audit: type=1400 audit(1789916344.770:64): avc: denied { node_bind } for pid=294 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 24.819857][ T28] audit: type=1400 audit(1789916344.770:65): avc: denied { module_request } for pid=294 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 25.641524][ T28] audit: type=1400 audit(1789916345.610:66): avc: denied { mounton } for pid=300 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.642461][ T300] cgroup: Unknown subsys name 'net' [ 25.664205][ T28] audit: type=1400 audit(1789916345.610:67): avc: denied { mount } for pid=300 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.691512][ T28] audit: type=1400 audit(1789916345.650:68): avc: denied { unmount } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.691672][ T300] cgroup: Unknown subsys name 'devices' [ 25.817706][ T300] cgroup: Unknown subsys name 'hugetlb' [ 25.823305][ T300] cgroup: Unknown subsys name 'rlimit' [ 25.980522][ T28] audit: type=1400 audit(1789916345.950:69): avc: denied { setattr } for pid=300 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 26.003705][ T28] audit: type=1400 audit(1789916345.950:70): avc: denied { create } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 26.013400][ T304] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 26.024230][ T28] audit: type=1400 audit(1789916345.950:71): avc: denied { write } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.052900][ T28] audit: type=1400 audit(1789916345.950:72): avc: denied { read } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.059645][ T300] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.073093][ T28] audit: type=1400 audit(1789916345.950:73): avc: denied { mounton } for pid=300 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 26.799598][ T306] request_module fs-gadgetfs succeeded, but still no fs? [ 26.998145][ T320] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.005207][ T320] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.012608][ T320] device bridge_slave_0 entered promiscuous mode [ 27.019412][ T320] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.026560][ T320] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.033843][ T320] device bridge_slave_1 entered promiscuous mode [ 27.071656][ T320] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.078709][ T320] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.085984][ T320] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.093025][ T320] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.112231][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.119887][ T314] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.127131][ T314] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.135705][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.144144][ T314] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.151185][ T314] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.160547][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.168939][ T314] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.175984][ T314] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.187362][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.196786][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.211363][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.222202][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.230583][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.238117][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.247247][ T320] device veth0_vlan entered promiscuous mode [ 27.257270][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.267172][ T320] device veth1_macvtap entered promiscuous mode [ 27.276093][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.285785][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.318427][ T320] syz-executor (320) used greatest stack depth: 22048 bytes left 2026/09/20 14:59:07 executed programs: 0 [ 27.882470][ T367] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.889666][ T367] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.897081][ T367] device bridge_slave_0 entered promiscuous mode [ 27.903839][ T367] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.910975][ T367] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.918300][ T367] device bridge_slave_1 entered promiscuous mode [ 27.960034][ T367] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.967086][ T367] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.974306][ T367] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.981334][ T367] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.003490][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.011418][ T314] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.018879][ T314] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.031831][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 28.040093][ T314] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.047147][ T314] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.055475][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 28.063742][ T314] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.070790][ T314] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.088445][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 28.097481][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 28.111334][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 28.126283][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 28.134368][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 28.142107][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 28.151199][ T367] device veth0_vlan entered promiscuous mode [ 28.158074][ T43] device bridge_slave_1 left promiscuous mode [ 28.164167][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.171600][ T43] device bridge_slave_0 left promiscuous mode [ 28.177853][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.185510][ T43] device veth1_macvtap left promiscuous mode [ 28.191766][ T43] device veth0_vlan left promiscuous mode [ 28.273607][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 28.282621][ T367] device veth1_macvtap entered promiscuous mode [ 28.291736][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.301310][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 28.327529][ T371] ================================================================== [ 28.335614][ T371] BUG: KASAN: use-after-free in mutex_lock+0x86/0x1b0 [ 28.342369][ T371] Write of size 8 at addr ffff88810ff55550 by task syz.2.17/371 [ 28.349983][ T371] [ 28.352306][ T371] CPU: 0 PID: 371 Comm: syz.2.17 Not tainted syzkaller #0 [ 28.359399][ T371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 28.369439][ T371] Call Trace: [ 28.372705][ T371] [ 28.375627][ T371] __dump_stack+0x21/0x24 [ 28.379952][ T371] dump_stack_lvl+0x110/0x170 [ 28.384622][ T371] ? __cfi_dump_stack_lvl+0x8/0x8 [ 28.389639][ T371] ? mutex_lock+0x86/0x1b0 [ 28.394048][ T371] print_address_description+0x71/0x200 [ 28.399596][ T371] print_report+0x4a/0x60 [ 28.403913][ T371] kasan_report+0x122/0x150 [ 28.408406][ T371] ? mutex_lock+0x86/0x1b0 [ 28.412810][ T371] kasan_check_range+0x249/0x2a0 [ 28.417751][ T371] __kasan_check_write+0x14/0x20 [ 28.422694][ T371] mutex_lock+0x86/0x1b0 [ 28.426922][ T371] ? __cfi_mutex_lock+0x10/0x10 [ 28.431759][ T371] ? kfree+0x6f/0xf0 [ 28.435638][ T371] ? l2tp_session_put+0xaf/0x1a0 [ 28.440588][ T371] ? l2tp_session_delete+0x3df/0x4d0 [ 28.445864][ T371] pppol2tp_release+0x178/0x2b0 [ 28.450705][ T371] sock_close+0xc9/0x220 [ 28.454949][ T371] ? __cfi_sock_close+0x10/0x10 [ 28.459787][ T371] __fput+0x1fd/0x8f0 [ 28.463764][ T371] ____fput+0x15/0x20 [ 28.467734][ T371] task_work_run+0x1e1/0x250 [ 28.472315][ T371] ? __cfi_task_work_run+0x10/0x10 [ 28.477432][ T371] ? __cfi___close_range+0x10/0x10 [ 28.482544][ T371] exit_to_user_mode_loop+0x9b/0xb0 [ 28.487733][ T371] exit_to_user_mode_prepare+0x87/0xd0 [ 28.493179][ T371] syscall_exit_to_user_mode+0x1a/0x30 [ 28.498629][ T371] do_syscall_64+0x58/0xa0 [ 28.503052][ T371] ? clear_bhb_loop+0x30/0x80 [ 28.507716][ T371] ? clear_bhb_loop+0x30/0x80 [ 28.512381][ T371] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 28.518260][ T371] RIP: 0033:0x7f236639e159 [ 28.522678][ T371] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 28.542366][ T371] RSP: 002b:00007fff2d9ed8d8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 28.550789][ T371] RAX: 0000000000000000 RBX: 00007fff2d9ed9c0 RCX: 00007f236639e159 [ 28.558753][ T371] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 28.566711][ T371] RBP: 0000000000006e8a R08: 0000000000000001 R09: 0000000000000000 [ 28.574680][ T371] R10: 0000001b32e20000 R11: 0000000000000246 R12: 0000000000000000 [ 28.582637][ T371] R13: 00007f2366625fac R14: 00007f2366625fa8 R15: 00007f2366625fa0 [ 28.590600][ T371] [ 28.593615][ T371] [ 28.595941][ T371] Allocated by task 371: [ 28.600168][ T371] kasan_set_track+0x4b/0x70 [ 28.604761][ T371] kasan_save_alloc_info+0x1f/0x30 [ 28.609856][ T371] __kasan_kmalloc+0x95/0xb0 [ 28.614434][ T371] __kmalloc+0xb4/0x1e0 [ 28.618576][ T371] l2tp_session_create+0x38/0xbd0 [ 28.623609][ T371] pppol2tp_connect+0xbf5/0x1640 [ 28.628533][ T371] __sys_connect+0x3da/0x460 [ 28.633107][ T371] __x64_sys_connect+0x7a/0x90 [ 28.637881][ T371] x64_sys_call+0x88d/0x9a0 [ 28.642370][ T371] do_syscall_64+0x4c/0xa0 [ 28.646772][ T371] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 28.652647][ T371] [ 28.654952][ T371] Freed by task 371: [ 28.658827][ T371] kasan_set_track+0x4b/0x70 [ 28.663399][ T371] kasan_save_free_info+0x2b/0x40 [ 28.668403][ T371] ____kasan_slab_free+0x132/0x180 [ 28.673498][ T371] __kasan_slab_free+0x11/0x20 [ 28.678244][ T371] slab_free_freelist_hook+0xc2/0x190 [ 28.683598][ T371] __kmem_cache_free+0xb7/0x1b0 [ 28.688436][ T371] kfree+0x6f/0xf0 [ 28.692141][ T371] l2tp_session_put+0xaf/0x1a0 [ 28.696886][ T371] l2tp_session_delete+0x3df/0x4d0 [ 28.701984][ T371] pppol2tp_release+0x169/0x2b0 [ 28.706824][ T371] sock_close+0xc9/0x220 [ 28.711049][ T371] __fput+0x1fd/0x8f0 [ 28.715016][ T371] ____fput+0x15/0x20 [ 28.718980][ T371] task_work_run+0x1e1/0x250 [ 28.723556][ T371] exit_to_user_mode_loop+0x9b/0xb0 [ 28.728736][ T371] exit_to_user_mode_prepare+0x87/0xd0 [ 28.734178][ T371] syscall_exit_to_user_mode+0x1a/0x30 [ 28.739623][ T371] do_syscall_64+0x58/0xa0 [ 28.744029][ T371] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 28.749904][ T371] [ 28.752212][ T371] The buggy address belongs to the object at ffff88810ff55400 [ 28.752212][ T371] which belongs to the cache kmalloc-512 of size 512 [ 28.766243][ T371] The buggy address is located 336 bytes inside of [ 28.766243][ T371] 512-byte region [ffff88810ff55400, ffff88810ff55600) [ 28.779513][ T371] [ 28.781825][ T371] The buggy address belongs to the physical page: [ 28.788215][ T371] page:ffffea00043fd500 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10ff54 [ 28.798446][ T371] head:ffffea00043fd500 order:2 compound_mapcount:0 compound_pincount:0 [ 28.806763][ T371] flags: 0x4000000000010200(slab|head|zone=1) [ 28.812835][ T371] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 [ 28.821417][ T371] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 28.829987][ T371] page dumped because: kasan: bad access detected [ 28.836390][ T371] page_owner tracks the page as allocated [ 28.842092][ T371] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 367, tgid 367 (syz-executor), ts 28313854907, free_ts 25636108771 [ 28.864661][ T371] post_alloc_hook+0x1f5/0x210 [ 28.869431][ T371] prep_new_page+0x1c/0x110 [ 28.873933][ T371] get_page_from_freelist+0x2ca9/0x2d20 [ 28.879482][ T371] __alloc_pages+0x1fa/0x610 [ 28.884074][ T371] alloc_slab_page+0x6e/0xf0 [ 28.888656][ T371] new_slab+0x98/0x3e0 [ 28.892717][ T371] ___slab_alloc+0x70f/0xb70 [ 28.897310][ T371] __slab_alloc+0x5e/0xa0 [ 28.901641][ T371] __kmem_cache_alloc_node+0x204/0x2d0 [ 28.907096][ T371] __kmalloc_node_track_caller+0xa1/0x1e0 [ 28.912812][ T371] __alloc_skb+0x226/0x4a0 [ 28.917231][ T371] netlink_ack+0x373/0x1160 [ 28.921730][ T371] netlink_rcv_skb+0x27e/0x450 [ 28.926491][ T371] rtnetlink_rcv+0x1c/0x20 [ 28.930902][ T371] netlink_unicast+0x8c1/0xa60 [ 28.935657][ T371] netlink_sendmsg+0x8b9/0xbd0 [ 28.940415][ T371] page last free stack trace: [ 28.945075][ T371] free_unref_page_prepare+0x81b/0x820 [ 28.950529][ T371] free_unref_page+0x93/0x530 [ 28.955202][ T371] __free_pages+0x67/0x100 [ 28.959618][ T371] __free_slab+0xc7/0x1a0 [ 28.963940][ T371] discard_slab+0x29/0x40 [ 28.968261][ T371] __slab_free+0x201/0x280 [ 28.972677][ T371] ___cache_free+0xbf/0xd0 [ 28.977103][ T371] qlist_free_all+0xc6/0x140 [ 28.981689][ T371] kasan_quarantine_reduce+0x14a/0x170 [ 28.987146][ T371] __kasan_slab_alloc+0x24/0x80 [ 28.991994][ T371] slab_post_alloc_hook+0x4f/0x2d0 [ 28.997103][ T371] __kmem_cache_alloc_node+0x194/0x2d0 [ 29.002563][ T371] __kmalloc_node+0xa2/0x1e0 [ 29.007157][ T371] kvmalloc_node+0x28a/0x460 [ 29.011739][ T371] seq_read_iter+0x1f1/0xd80 [ 29.016322][ T371] kernfs_fop_read_iter+0x14d/0x4e0 [ 29.021515][ T371] [ 29.023835][ T371] Memory state around the buggy address: [ 29.029455][ T371] ffff88810ff55400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.037510][ T371] ffff88810ff55480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.045566][ T371] >ffff88810ff55500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.053614][ T371] ^ [ 29.060274][ T371] ffff88810ff55580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.068331][ T371] ffff88810ff55600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.076384][ T371] ================================================================== [ 29.086257][ T371] Disabling lock debugging due to kernel taint