Warning: Permanently added '10.128.1.45' (ED25519) to the list of known hosts. 2026/09/09 14:29:53 parsed 1 programs 2026/09/09 14:29:53 serving rpc on tcp://33725 [ 24.291546][ T24] audit: type=1400 audit(1788964193.730:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 24.312387][ T24] audit: type=1400 audit(1788964193.730:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 24.331910][ T24] audit: type=1400 audit(1788964193.730:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 25.234726][ T24] audit: type=1400 audit(1788964194.670:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.237970][ T293] cgroup: Unknown subsys name 'net' [ 25.257477][ T24] audit: type=1400 audit(1788964194.670:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.284684][ T24] audit: type=1400 audit(1788964194.710:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.285053][ T293] cgroup: Unknown subsys name 'devices' [ 25.452962][ T293] cgroup: Unknown subsys name 'hugetlb' [ 25.458551][ T293] cgroup: Unknown subsys name 'rlimit' [ 25.576069][ T24] audit: type=1400 audit(1788964195.010:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.599304][ T24] audit: type=1400 audit(1788964195.010:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.619848][ T24] audit: type=1400 audit(1788964195.010:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.640174][ T24] audit: type=1400 audit(1788964195.010:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.655275][ T297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 25.767058][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.191834][ T299] request_module fs-gadgetfs succeeded, but still no fs? [ 26.202281][ T299] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 26.416732][ T318] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.423937][ T318] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.431447][ T318] device bridge_slave_0 entered promiscuous mode [ 26.438276][ T318] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.445426][ T318] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.452957][ T318] device bridge_slave_1 entered promiscuous mode [ 26.493299][ T318] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.500338][ T318] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.507635][ T318] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.514669][ T318] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.531015][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.538889][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.546168][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.555786][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.563993][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.571001][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.579486][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.587847][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.595078][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.607582][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.616620][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.629642][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.641741][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.649733][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.657315][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.665361][ T318] device veth0_vlan entered promiscuous mode [ 26.676059][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.685094][ T318] device veth1_macvtap entered promiscuous mode [ 26.694745][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.707006][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/09/09 14:29:56 executed programs: 0 [ 27.292411][ T377] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.299517][ T377] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.307316][ T377] device bridge_slave_0 entered promiscuous mode [ 27.314625][ T377] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.321738][ T377] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.329005][ T377] device bridge_slave_1 entered promiscuous mode [ 27.368000][ T377] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.375078][ T377] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.382375][ T377] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.389421][ T377] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.401646][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.408844][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.420420][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 27.427886][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.438037][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 27.446450][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.454608][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.461645][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.469101][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 27.478180][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.486329][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.493374][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.503281][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 27.511443][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.520338][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 27.528385][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.540556][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 27.549414][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.560025][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 27.568054][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.576316][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.583818][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.591629][ T377] device veth0_vlan entered promiscuous mode [ 27.600392][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 27.608572][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.617362][ T377] device veth1_macvtap entered promiscuous mode [ 27.625764][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 27.633484][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 27.641882][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.650801][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 27.659033][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.761441][ T383] ================================================================== [ 27.769639][ T383] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 [ 27.776329][ T383] Write of size 8 at addr ffff88810fa2d550 by task syz.2.17/383 [ 27.783954][ T383] [ 27.786305][ T383] CPU: 1 PID: 383 Comm: syz.2.17 Not tainted syzkaller #0 [ 27.793418][ T383] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 27.803479][ T383] Call Trace: [ 27.806779][ T383] __dump_stack+0x21/0x24 [ 27.811113][ T383] dump_stack_lvl+0x1a7/0x208 [ 27.815810][ T383] ? show_regs_print_info+0x18/0x18 [ 27.821063][ T383] ? thaw_kernel_threads+0x220/0x220 [ 27.826353][ T383] print_address_description+0x7f/0x2c0 [ 27.831926][ T383] ? mutex_lock+0x85/0xf0 [ 27.836259][ T383] kasan_report+0x100/0x140 [ 27.840769][ T383] ? mutex_lock+0x85/0xf0 [ 27.845113][ T383] kasan_check_range+0x249/0x2a0 [ 27.850066][ T383] __kasan_check_write+0x14/0x20 [ 27.855014][ T383] mutex_lock+0x85/0xf0 [ 27.859184][ T383] ? mutex_trylock+0xb0/0xb0 [ 27.863788][ T383] ? l2tp_session_put+0xb2/0x1a0 [ 27.868733][ T383] ? l2tp_session_delete+0x3a9/0x4a0 [ 27.874027][ T383] pppol2tp_release+0x178/0x2b0 [ 27.878888][ T383] sock_close+0xb8/0x200 [ 27.883141][ T383] ? sock_mmap+0xa0/0xa0 [ 27.887404][ T383] __fput+0x2dc/0x730 [ 27.891403][ T383] ____fput+0x15/0x20 [ 27.895401][ T383] task_work_run+0x127/0x190 [ 27.899997][ T383] do_exit+0xa7c/0x24e0 [ 27.904160][ T383] ? finish_task_switch+0x1e2/0x5a0 [ 27.909362][ T383] ? switch_mm_irqs_off+0x752/0x990 [ 27.914564][ T383] ? put_task_struct+0x90/0x90 [ 27.919336][ T383] ? remove_hrtimer+0x225/0x490 [ 27.924195][ T383] ? __kasan_check_write+0x14/0x20 [ 27.929304][ T383] ? _raw_spin_lock_irq+0x95/0xf0 [ 27.934319][ T383] do_group_exit+0x149/0x310 [ 27.938908][ T383] ? __kasan_check_write+0x14/0x20 [ 27.944014][ T383] ? recalc_sigpending+0x1c4/0x230 [ 27.949117][ T383] get_signal+0xfb1/0x1300 [ 27.953539][ T383] arch_do_signal_or_restart+0xe7/0x11b0 [ 27.959174][ T383] ? nanosleep_copyout+0x120/0x120 [ 27.964300][ T383] ? get_timespec64+0x116/0x1b0 [ 27.969162][ T383] ? __ia32_sys_rt_sigreturn+0x730/0x730 [ 27.974798][ T383] ? __x64_sys_clock_nanosleep+0xb0/0xb0 [ 27.980429][ T383] ? debug_smp_processor_id+0x17/0x20 [ 27.985798][ T383] exit_to_user_mode_loop+0xa2/0xe0 [ 27.990993][ T383] exit_to_user_mode_prepare+0x76/0xa0 [ 27.996447][ T383] syscall_exit_to_user_mode+0x1d/0x40 [ 28.001895][ T383] do_syscall_64+0x3d/0x40 [ 28.006305][ T383] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.012195][ T383] RIP: 0033:0x7fa425a9b2d7 [ 28.016614][ T383] Code: Unable to access opcode bytes at RIP 0x7fa425a9b2ad. [ 28.023975][ T383] RSP: 002b:00007ffc4feb9060 EFLAGS: 00000202 ORIG_RAX: 00000000000000e6 [ 28.032387][ T383] RAX: fffffffffffffdfc RBX: 0000555574452500 RCX: 00007fa425a9b2d7 [ 28.040362][ T383] RDX: 00007ffc4feb90a0 RSI: 0000000000000000 RDI: 0000000000000000 [ 28.048334][ T383] RBP: 00007fa425b7703b R08: 0000000000000000 R09: 0000000000000000 [ 28.056298][ T383] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 28.064265][ T383] R13: 00007fa425d67fac R14: 00007fa425d67fa0 R15: 00007fa425d67fa0 [ 28.072236][ T383] [ 28.074565][ T383] Allocated by task 382: [ 28.078827][ T383] __kasan_kmalloc+0xd4/0x100 [ 28.083512][ T383] __kmalloc+0x19f/0x330 [ 28.087760][ T383] l2tp_session_create+0x39/0xb60 [ 28.092786][ T383] pppol2tp_connect+0xbf5/0x1640 [ 28.097729][ T383] __sys_connect+0x3ce/0x450 [ 28.102315][ T383] __x64_sys_connect+0x7a/0x90 [ 28.107070][ T383] do_syscall_64+0x31/0x40 [ 28.111506][ T383] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.117397][ T383] [ 28.119723][ T383] Freed by task 383: [ 28.123644][ T383] kasan_set_track+0x4a/0x70 [ 28.128245][ T383] kasan_set_free_info+0x23/0x40 [ 28.133181][ T383] ____kasan_slab_free+0x125/0x160 [ 28.138292][ T383] __kasan_slab_free+0x11/0x20 [ 28.143061][ T383] slab_free_freelist_hook+0xc5/0x190 [ 28.148433][ T383] kfree+0xc0/0x270 [ 28.152240][ T383] l2tp_session_put+0xb2/0x1a0 [ 28.156998][ T383] l2tp_session_delete+0x3a9/0x4a0 [ 28.162096][ T383] pppol2tp_release+0x169/0x2b0 [ 28.166944][ T383] sock_close+0xb8/0x200 [ 28.171197][ T383] __fput+0x2dc/0x730 [ 28.175178][ T383] ____fput+0x15/0x20 [ 28.179149][ T383] task_work_run+0x127/0x190 [ 28.183735][ T383] do_exit+0xa7c/0x24e0 [ 28.187898][ T383] do_group_exit+0x149/0x310 [ 28.192502][ T383] get_signal+0xfb1/0x1300 [ 28.196922][ T383] arch_do_signal_or_restart+0xe7/0x11b0 [ 28.202568][ T383] exit_to_user_mode_loop+0xa2/0xe0 [ 28.207769][ T383] exit_to_user_mode_prepare+0x76/0xa0 [ 28.213233][ T383] syscall_exit_to_user_mode+0x1d/0x40 [ 28.218697][ T383] do_syscall_64+0x3d/0x40 [ 28.223125][ T383] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.229017][ T383] [ 28.231355][ T383] The buggy address belongs to the object at ffff88810fa2d400 [ 28.231355][ T383] which belongs to the cache kmalloc-512 of size 512 [ 28.245406][ T383] The buggy address is located 336 bytes inside of [ 28.245406][ T383] 512-byte region [ffff88810fa2d400, ffff88810fa2d600) [ 28.258667][ T383] The buggy address belongs to the page: [ 28.264306][ T383] page:ffffea00043e8b00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10fa2c [ 28.274545][ T383] head:ffffea00043e8b00 order:2 compound_mapcount:0 compound_pincount:0 [ 28.282879][ T383] flags: 0x4000000000010200(slab|head) [ 28.288360][ T383] raw: 4000000000010200 ffffea00043e7100 0000000300000003 ffff888100043080 [ 28.296959][ T383] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 28.305537][ T383] page dumped because: kasan: bad access detected [ 28.311971][ T383] page_owner tracks the page as allocated [ 28.317699][ T383] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 96, ts 4939461278, free_ts 0 [ 28.335655][ T383] prep_new_page+0x176/0x190 [ 28.340249][ T383] get_page_from_freelist+0x225f/0x23f0 [ 28.345791][ T383] __alloc_pages_nodemask+0x29a/0x640 [ 28.351154][ T383] new_slab+0x84/0x3f0 [ 28.355229][ T383] ___slab_alloc+0x2f8/0x4c0 [ 28.359811][ T383] __slab_alloc+0x63/0xa0 [ 28.364142][ T383] __kmalloc_track_caller+0x1e4/0x310 [ 28.369518][ T383] __alloc_skb+0xdc/0x520 [ 28.373845][ T383] alloc_uevent_skb+0x85/0x240 [ 28.378605][ T383] kobject_uevent_net_broadcast+0x335/0x5a0 [ 28.384495][ T383] kobject_uevent_env+0x52b/0x700 [ 28.389532][ T383] kobject_synth_uevent+0x452/0x940 [ 28.394766][ T383] store_uevent+0x16/0x30 [ 28.399100][ T383] module_attr_store+0x5f/0x80 [ 28.403875][ T383] sysfs_kf_write+0x129/0x150 [ 28.408553][ T383] kernfs_fop_write_iter+0x2bd/0x400 [ 28.413839][ T383] page_owner free stack trace missing [ 28.419202][ T383] [ 28.421528][ T383] Memory state around the buggy address: [ 28.427154][ T383] ffff88810fa2d400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.435215][ T383] ffff88810fa2d480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.443371][ T383] >ffff88810fa2d500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.451426][ T383] ^ [ 28.458107][ T383] ffff88810fa2d580: fb fb fb fb fb fb fb fb fb fb fb f