Warning: Permanently added '10.128.1.124' (ED25519) to the list of known hosts. 2026/09/20 23:56:22 parsed 1 programs 2026/09/20 23:56:22 serving rpc on tcp://40099 [ 24.936479][ T24] audit: type=1400 audit(1789948582.740:64): avc: denied { node_bind } for pid=288 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 24.958393][ T24] audit: type=1400 audit(1789948582.740:65): avc: denied { create } for pid=288 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 24.977999][ T24] audit: type=1400 audit(1789948582.750:66): avc: denied { module_request } for pid=288 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 25.925880][ T24] audit: type=1400 audit(1789948583.730:67): avc: denied { mounton } for pid=294 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.929509][ T294] cgroup: Unknown subsys name 'net' [ 25.948814][ T24] audit: type=1400 audit(1789948583.730:68): avc: denied { mount } for pid=294 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.976028][ T24] audit: type=1400 audit(1789948583.760:69): avc: denied { unmount } for pid=294 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.976465][ T294] cgroup: Unknown subsys name 'devices' [ 26.149951][ T294] cgroup: Unknown subsys name 'hugetlb' [ 26.155573][ T294] cgroup: Unknown subsys name 'rlimit' [ 26.304503][ T24] audit: type=1400 audit(1789948584.110:70): avc: denied { setattr } for pid=294 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 26.328231][ T24] audit: type=1400 audit(1789948584.110:71): avc: denied { create } for pid=294 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 26.348884][ T24] audit: type=1400 audit(1789948584.110:72): avc: denied { write } for pid=294 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.369270][ T24] audit: type=1400 audit(1789948584.110:73): avc: denied { read } for pid=294 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.386512][ T298] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 26.410427][ T294] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.871510][ T300] request_module fs-gadgetfs succeeded, but still no fs? [ 26.882585][ T300] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 27.122728][ T322] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.129816][ T322] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.137339][ T322] device bridge_slave_0 entered promiscuous mode [ 27.145336][ T322] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.152401][ T322] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.159822][ T322] device bridge_slave_1 entered promiscuous mode [ 27.199929][ T322] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.207149][ T322] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.214479][ T322] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.221524][ T322] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.239581][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.247190][ T113] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.254497][ T113] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.265323][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.273552][ T113] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.280624][ T113] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.289979][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.298174][ T113] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.305213][ T113] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.317479][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.326745][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.340595][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.352132][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.360302][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.367721][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.376049][ T322] device veth0_vlan entered promiscuous mode [ 27.386865][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.396106][ T322] device veth1_macvtap entered promiscuous mode [ 27.405804][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.416536][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/09/20 23:56:25 executed programs: 0 [ 28.080417][ T364] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.087467][ T364] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.094969][ T364] device bridge_slave_0 entered promiscuous mode [ 28.102346][ T364] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.109516][ T364] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.116986][ T364] device bridge_slave_1 entered promiscuous mode [ 28.170893][ T364] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.177942][ T364] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.185267][ T364] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.192348][ T364] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.213833][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.221500][ T113] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.229168][ T113] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.237346][ T9] device bridge_slave_1 left promiscuous mode [ 28.243896][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.251649][ T9] device bridge_slave_0 left promiscuous mode [ 28.257764][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.265800][ T9] device veth1_macvtap left promiscuous mode [ 28.271869][ T9] device veth0_vlan left promiscuous mode [ 28.325057][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 28.333260][ T113] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.340471][ T113] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.349053][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 28.357211][ T113] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.364267][ T113] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.375753][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 28.385038][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 28.399315][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 28.411494][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 28.419640][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 28.427010][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 28.435643][ T364] device veth0_vlan entered promiscuous mode [ 28.445220][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 28.454281][ T364] device veth1_macvtap entered promiscuous mode [ 28.463674][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.473718][ T113] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 28.579411][ T369] ================================================================== [ 28.587548][ T369] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 [ 28.594242][ T369] Write of size 8 at addr ffff888110ee3950 by task syz.2.17/369 [ 28.601875][ T369] [ 28.604236][ T369] CPU: 1 PID: 369 Comm: syz.2.17 Not tainted syzkaller #0 [ 28.611355][ T369] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 28.621422][ T369] Call Trace: [ 28.624727][ T369] __dump_stack+0x21/0x24 [ 28.629084][ T369] dump_stack_lvl+0x1a7/0x208 [ 28.633804][ T369] ? show_regs_print_info+0x18/0x18 [ 28.639044][ T369] ? thaw_kernel_threads+0x220/0x220 [ 28.644344][ T369] print_address_description+0x7f/0x2c0 [ 28.650177][ T369] ? mutex_lock+0x85/0xf0 [ 28.654525][ T369] kasan_report+0x100/0x140 [ 28.659051][ T369] ? mutex_lock+0x85/0xf0 [ 28.663430][ T369] kasan_check_range+0x249/0x2a0 [ 28.668389][ T369] __kasan_check_write+0x14/0x20 [ 28.673343][ T369] mutex_lock+0x85/0xf0 [ 28.677512][ T369] ? mutex_trylock+0xb0/0xb0 [ 28.682115][ T369] ? l2tp_session_put+0xb2/0x1a0 [ 28.687080][ T369] ? l2tp_session_delete+0x3a9/0x4a0 [ 28.692384][ T369] pppol2tp_release+0x178/0x2b0 [ 28.697264][ T369] sock_close+0xb8/0x200 [ 28.701526][ T369] ? sock_mmap+0xa0/0xa0 [ 28.705795][ T369] __fput+0x2dc/0x730 [ 28.709820][ T369] ____fput+0x15/0x20 [ 28.713874][ T369] task_work_run+0x127/0x190 [ 28.718489][ T369] do_exit+0xa7c/0x24e0 [ 28.722668][ T369] ? finish_task_switch+0x12e/0x5a0 [ 28.727899][ T369] ? put_task_struct+0x90/0x90 [ 28.732686][ T369] ? remove_hrtimer+0x1aa/0x490 [ 28.737562][ T369] ? __kasan_check_write+0x14/0x20 [ 28.742688][ T369] ? _raw_spin_lock_irq+0x95/0xf0 [ 28.747735][ T369] do_group_exit+0x149/0x310 [ 28.752358][ T369] ? __kasan_check_write+0x14/0x20 [ 28.757491][ T369] ? recalc_sigpending+0x1c4/0x230 [ 28.762619][ T369] get_signal+0xfb1/0x1300 [ 28.767056][ T369] arch_do_signal_or_restart+0xe7/0x11b0 [ 28.772701][ T369] ? nanosleep_copyout+0x120/0x120 [ 28.777824][ T369] ? get_timespec64+0x116/0x1b0 [ 28.782682][ T369] ? __ia32_sys_rt_sigreturn+0x730/0x730 [ 28.788341][ T369] ? __x64_sys_clock_nanosleep+0xb0/0xb0 [ 28.793989][ T369] ? debug_smp_processor_id+0x17/0x20 [ 28.799392][ T369] exit_to_user_mode_loop+0xa2/0xe0 [ 28.804596][ T369] exit_to_user_mode_prepare+0x76/0xa0 [ 28.810064][ T369] syscall_exit_to_user_mode+0x1d/0x40 [ 28.815531][ T369] do_syscall_64+0x3d/0x40 [ 28.820043][ T369] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.825941][ T369] RIP: 0033:0x7fa7a50792d7 [ 28.830360][ T369] Code: Unable to access opcode bytes at RIP 0x7fa7a50792ad. [ 28.837839][ T369] RSP: 002b:00007ffe0b0c4510 EFLAGS: 00000202 ORIG_RAX: 00000000000000e6 [ 28.846272][ T369] RAX: fffffffffffffdfc RBX: 000055558e873500 RCX: 00007fa7a50792d7 [ 28.854255][ T369] RDX: 00007ffe0b0c4550 RSI: 0000000000000000 RDI: 0000000000000000 [ 28.862356][ T369] RBP: 00007fa7a515506b R08: 0000000000000000 R09: 0000000000000000 [ 28.870342][ T369] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 28.878329][ T369] R13: 00007fa7a5345fac R14: 00007fa7a5345fa0 R15: 00007fa7a5345fa0 [ 28.886321][ T369] [ 28.888675][ T369] Allocated by task 368: [ 28.892948][ T369] __kasan_kmalloc+0xd4/0x100 [ 28.897632][ T369] __kmalloc+0x19f/0x330 [ 28.901922][ T369] l2tp_session_create+0x39/0xb60 [ 28.906967][ T369] pppol2tp_connect+0xbf5/0x1640 [ 28.911918][ T369] __sys_connect+0x3ce/0x450 [ 28.916513][ T369] __x64_sys_connect+0x7a/0x90 [ 28.921287][ T369] do_syscall_64+0x31/0x40 [ 28.925735][ T369] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.931648][ T369] [ 28.934007][ T369] Freed by task 369: [ 28.937915][ T369] kasan_set_track+0x4a/0x70 [ 28.942517][ T369] kasan_set_free_info+0x23/0x40 [ 28.947466][ T369] ____kasan_slab_free+0x125/0x160 [ 28.952582][ T369] __kasan_slab_free+0x11/0x20 [ 28.957353][ T369] slab_free_freelist_hook+0xc5/0x190 [ 28.962755][ T369] kfree+0xc0/0x270 [ 28.966566][ T369] l2tp_session_put+0xb2/0x1a0 [ 28.971333][ T369] l2tp_session_delete+0x3a9/0x4a0 [ 28.976470][ T369] pppol2tp_release+0x169/0x2b0 [ 28.981331][ T369] sock_close+0xb8/0x200 [ 28.985596][ T369] __fput+0x2dc/0x730 [ 28.989591][ T369] ____fput+0x15/0x20 [ 28.993590][ T369] task_work_run+0x127/0x190 [ 28.998201][ T369] do_exit+0xa7c/0x24e0 [ 29.002365][ T369] do_group_exit+0x149/0x310 [ 29.006963][ T369] get_signal+0xfb1/0x1300 [ 29.011384][ T369] arch_do_signal_or_restart+0xe7/0x11b0 [ 29.017026][ T369] exit_to_user_mode_loop+0xa2/0xe0 [ 29.022237][ T369] exit_to_user_mode_prepare+0x76/0xa0 [ 29.027699][ T369] syscall_exit_to_user_mode+0x1d/0x40 [ 29.033163][ T369] do_syscall_64+0x3d/0x40 [ 29.037587][ T369] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 29.043487][ T369] [ 29.045851][ T369] The buggy address belongs to the object at ffff888110ee3800 [ 29.045851][ T369] which belongs to the cache kmalloc-512 of size 512 [ 29.059910][ T369] The buggy address is located 336 bytes inside of [ 29.059910][ T369] 512-byte region [ffff888110ee3800, ffff888110ee3a00) [ 29.073269][ T369] The buggy address belongs to the page: [ 29.078923][ T369] page:ffffea000443b800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x110ee0 [ 29.089159][ T369] head:ffffea000443b800 order:2 compound_mapcount:0 compound_pincount:0 [ 29.097491][ T369] flags: 0x4000000000010200(slab|head) [ 29.102969][ T369] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 [ 29.111560][ T369] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 29.120151][ T369] page dumped because: kasan: bad access detected [ 29.126564][ T369] page_owner tracks the page as allocated [ 29.132301][ T369] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 364, ts 28486295276, free_ts 28398531522 [ 29.152791][ T369] prep_new_page+0x176/0x190 [ 29.157384][ T369] get_page_from_freelist+0x225f/0x23f0 [ 29.162935][ T369] __alloc_pages_nodemask+0x29a/0x640 [ 29.168311][ T369] new_slab+0x84/0x3f0 [ 29.172381][ T369] ___slab_alloc+0x2f8/0x4c0 [ 29.176971][ T369] __slab_alloc+0x63/0xa0 [ 29.181300][ T369] __kmalloc_track_caller+0x1e4/0x310 [ 29.186677][ T369] __alloc_skb+0xdc/0x520 [ 29.191011][ T369] netlink_ack+0x35c/0xb30 [ 29.195430][ T369] netlink_rcv_skb+0x267/0x430 [ 29.200201][ T369] rtnetlink_rcv+0x1c/0x20 [ 29.204627][ T369] netlink_unicast+0x86c/0xa30 [ 29.209415][ T369] netlink_sendmsg+0x949/0xb70 [ 29.214183][ T369] __sys_sendto+0x467/0x620 [ 29.218687][ T369] __x64_sys_sendto+0xe5/0x100 [ 29.223456][ T369] do_syscall_64+0x31/0x40 [ 29.227874][ T369] page last free stack trace: [ 29.232556][ T369] __free_pages_ok+0x80b/0x830 [ 29.237326][ T369] __free_pages+0xd8/0x390 [ 29.241763][ T369] __free_slab+0xcf/0x190 [ 29.246094][ T369] unfreeze_partials+0x150/0x180 [ 29.251386][ T369] put_cpu_partial+0xc1/0x180 [ 29.256066][ T369] __slab_free+0x2c9/0x3a0 [ 29.260497][ T369] ___cache_free+0x10e/0x130 [ 29.265090][ T369] qlink_free+0x50/0x90 [ 29.269257][ T369] qlist_free_all+0x5f/0xb0 [ 29.273791][ T369] kasan_quarantine_reduce+0x14a/0x160 [ 29.279257][ T369] __kasan_slab_alloc+0x2f/0xe0 [ 29.284119][ T369] slab_post_alloc_hook+0x5d/0x2f0 [ 29.289267][ T369] __kmalloc+0x17b/0x330 [ 29.293518][ T369] qdisc_alloc+0x79/0x720 [ 29.297852][ T369] qdisc_create_dflt+0x6b/0x390 [ 29.302711][ T369] dev_activate+0x292/0x11c0 [ 29.307294][ T369] [ 29.309628][ T369] Memory state around the buggy address: [ 29.315258][ T369] ffff888110ee3800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.323332][ T369] ffff888110ee3880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.331416][ T