Warning: Permanently added '10.128.1.90' (ED25519) to the list of known hosts. 2026/07/13 09:55:44 parsed 1 programs 2026/07/13 09:55:44 serving rpc on tcp://34377 [ 24.273175][ T24] audit: type=1400 audit(1783936544.040:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 24.293971][ T24] audit: type=1400 audit(1783936544.040:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 24.313512][ T24] audit: type=1400 audit(1783936544.040:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 24.884280][ T24] audit: type=1400 audit(1783936544.650:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 24.885313][ T293] cgroup: Unknown subsys name 'net' [ 24.906945][ T24] audit: type=1400 audit(1783936544.650:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.934387][ T24] audit: type=1400 audit(1783936544.680:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.934563][ T293] cgroup: Unknown subsys name 'devices' [ 25.050374][ T293] cgroup: Unknown subsys name 'hugetlb' [ 25.056005][ T293] cgroup: Unknown subsys name 'rlimit' [ 25.169240][ T24] audit: type=1400 audit(1783936544.940:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.192411][ T24] audit: type=1400 audit(1783936544.940:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 25.212877][ T24] audit: type=1400 audit(1783936544.940:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.216472][ T297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 25.233311][ T24] audit: type=1400 audit(1783936544.940:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.274479][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 25.713436][ T300] request_module fs-gadgetfs succeeded, but still no fs? [ 25.722877][ T300] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 26.196121][ T351] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.203556][ T351] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.210990][ T351] device bridge_slave_0 entered promiscuous mode [ 26.217766][ T351] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.224881][ T351] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.232209][ T351] device bridge_slave_1 entered promiscuous mode [ 26.263582][ T351] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.270641][ T351] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.277889][ T351] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.284944][ T351] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.300748][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.308284][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.315520][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.324580][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.332783][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.339823][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.348472][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.356879][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.363911][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.378242][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.387457][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.404308][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.414865][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.423221][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.430801][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.439053][ T351] device veth0_vlan entered promiscuous mode [ 26.451877][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.460893][ T351] device veth1_macvtap entered promiscuous mode [ 26.469366][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.482553][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/07/13 09:55:46 executed programs: 0 [ 26.720029][ T365] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.727156][ T365] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.734530][ T365] device bridge_slave_0 entered promiscuous mode [ 26.741304][ T365] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.748326][ T365] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.755745][ T365] device bridge_slave_1 entered promiscuous mode [ 26.797016][ T365] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.804099][ T365] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.811379][ T365] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.818386][ T365] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.837384][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.845128][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.853027][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.861778][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.870069][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.877079][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.887568][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.895719][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.902795][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.913298][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.922452][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.934888][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.945293][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.953377][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.961006][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.969277][ T365] device veth0_vlan entered promiscuous mode [ 26.978410][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.987462][ T365] device veth1_macvtap entered promiscuous mode [ 26.996431][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.005907][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.031275][ T402] ================================================================== [ 27.039894][ T402] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 [ 27.047100][ T402] Write of size 8 at addr ffff88811122f550 by task syz.2.17/402 [ 27.054713][ T402] [ 27.057048][ T402] CPU: 0 PID: 402 Comm: syz.2.17 Not tainted syzkaller #0 [ 27.064403][ T402] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 27.074715][ T402] Call Trace: [ 27.077989][ T402] __dump_stack+0x21/0x24 [ 27.082307][ T402] dump_stack_lvl+0x1a7/0x208 [ 27.086967][ T402] ? show_regs_print_info+0x18/0x18 [ 27.092148][ T402] ? thaw_kernel_threads+0x220/0x220 [ 27.097470][ T402] ? debug_smp_processor_id+0x17/0x20 [ 27.102829][ T402] print_address_description+0x7f/0x2c0 [ 27.108349][ T402] ? mutex_lock+0x85/0xf0 [ 27.112661][ T402] kasan_report+0x100/0x140 [ 27.117143][ T402] ? mutex_lock+0x85/0xf0 [ 27.121645][ T402] kasan_check_range+0x249/0x2a0 [ 27.126559][ T402] __kasan_check_write+0x14/0x20 [ 27.131476][ T402] mutex_lock+0x85/0xf0 [ 27.135634][ T402] ? mutex_trylock+0xb0/0xb0 [ 27.140200][ T402] ? l2tp_session_put+0xb2/0x1a0 [ 27.145122][ T402] ? l2tp_session_delete+0x3a9/0x4a0 [ 27.150379][ T402] pppol2tp_release+0x178/0x2b0 [ 27.155230][ T402] sock_close+0xb8/0x200 [ 27.159486][ T402] ? sock_mmap+0xa0/0xa0 [ 27.163731][ T402] __fput+0x2dc/0x730 [ 27.167688][ T402] ____fput+0x15/0x20 [ 27.171645][ T402] task_work_run+0x127/0x190 [ 27.176212][ T402] exit_to_user_mode_loop+0xcb/0xe0 [ 27.181393][ T402] exit_to_user_mode_prepare+0x76/0xa0 [ 27.186845][ T402] syscall_exit_to_user_mode+0x1d/0x40 [ 27.192279][ T402] do_syscall_64+0x3d/0x40 [ 27.196666][ T402] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 27.202558][ T402] RIP: 0033:0x7f7ec24a9e59 [ 27.206951][ T402] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 27.226539][ T402] RSP: 002b:00007fffd8644858 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 27.234951][ T402] RAX: 0000000000000000 RBX: 00007fffd8644940 RCX: 00007f7ec24a9e59 [ 27.243867][ T402] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 27.251825][ T402] RBP: 0000000000006979 R08: 0000000000000001 R09: 0000000000000000 [ 27.259776][ T402] R10: 0000001b32c20000 R11: 0000000000000246 R12: 0000000000000000 [ 27.267724][ T402] R13: 00007f7ec2731fac R14: 00007f7ec2731fa8 R15: 00007f7ec2731fa0 [ 27.275674][ T402] [ 27.277978][ T402] Allocated by task 402: [ 27.283305][ T402] __kasan_kmalloc+0xd4/0x100 [ 27.288067][ T402] __kmalloc+0x19f/0x330 [ 27.292313][ T402] l2tp_session_create+0x39/0xb60 [ 27.297329][ T402] pppol2tp_connect+0xbf5/0x1640 [ 27.302270][ T402] __sys_connect+0x3ce/0x450 [ 27.306843][ T402] __x64_sys_connect+0x7a/0x90 [ 27.311620][ T402] do_syscall_64+0x31/0x40 [ 27.316014][ T402] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 27.323450][ T402] [ 27.325762][ T402] Freed by task 402: [ 27.329636][ T402] kasan_set_track+0x4a/0x70 [ 27.334401][ T402] kasan_set_free_info+0x23/0x40 [ 27.339312][ T402] ____kasan_slab_free+0x125/0x160 [ 27.344398][ T402] __kasan_slab_free+0x11/0x20 [ 27.349223][ T402] slab_free_freelist_hook+0xc5/0x190 [ 27.354573][ T402] kfree+0xc0/0x270 [ 27.358355][ T402] l2tp_session_put+0xb2/0x1a0 [ 27.363099][ T402] l2tp_session_delete+0x3a9/0x4a0 [ 27.368200][ T402] pppol2tp_release+0x169/0x2b0 [ 27.373027][ T402] sock_close+0xb8/0x200 [ 27.377332][ T402] __fput+0x2dc/0x730 [ 27.381284][ T402] ____fput+0x15/0x20 [ 27.385238][ T402] task_work_run+0x127/0x190 [ 27.389818][ T402] exit_to_user_mode_loop+0xcb/0xe0 [ 27.394994][ T402] exit_to_user_mode_prepare+0x76/0xa0 [ 27.400429][ T402] syscall_exit_to_user_mode+0x1d/0x40 [ 27.405870][ T402] do_syscall_64+0x3d/0x40 [ 27.410261][ T402] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 27.416122][ T402] [ 27.418451][ T402] The buggy address belongs to the object at ffff88811122f400 [ 27.418451][ T402] which belongs to the cache kmalloc-512 of size 512 [ 27.432569][ T402] The buggy address is located 336 bytes inside of [ 27.432569][ T402] 512-byte region [ffff88811122f400, ffff88811122f600) [ 27.445922][ T402] The buggy address belongs to the page: [ 27.451596][ T402] page:ffffea0004448b00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11122c [ 27.461813][ T402] head:ffffea0004448b00 order:2 compound_mapcount:0 compound_pincount:0 [ 27.470129][ T402] flags: 0x4000000000010200(slab|head) [ 27.475568][ T402] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 [ 27.484123][ T402] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 27.492679][ T402] page dumped because: kasan: bad access detected [ 27.499062][ T402] page_owner tracks the page as allocated [ 27.504766][ T402] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x152a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 332, ts 27029223808, free_ts 27026048070 [ 27.523052][ T402] prep_new_page+0x176/0x190 [ 27.527618][ T402] get_page_from_freelist+0x225f/0x23f0 [ 27.533234][ T402] __alloc_pages_nodemask+0x29a/0x640 [ 27.538576][ T402] new_slab+0x84/0x3f0 [ 27.542632][ T402] ___slab_alloc+0x2f8/0x4c0 [ 27.547197][ T402] __slab_alloc+0x63/0xa0 [ 27.551501][ T402] __kmalloc+0x1f9/0x330 [ 27.555717][ T402] ___neigh_create+0x6ec/0x1a70 [ 27.560552][ T402] __neigh_create+0x31/0x40 [ 27.565036][ T402] ip6_finish_output2+0x8fe/0x1540 [ 27.570131][ T402] __ip6_finish_output+0x5fd/0x790 [ 27.575320][ T402] ip6_finish_output+0x33/0x1e0 [ 27.580144][ T402] ip6_output+0x1fa/0x420 [ 27.584446][ T402] ndisc_send_skb+0x721/0xbc0 [ 27.589101][ T402] ndisc_send_ns+0x879/0xb10 [ 27.593660][ T402] addrconf_dad_work+0xa40/0x1480 [ 27.598650][ T402] page last free stack trace: [ 27.603327][ T402] __free_pages_ok+0x80b/0x830 [ 27.608067][ T402] __free_pages+0xd8/0x390 [ 27.612510][ T402] __free_slab+0xcf/0x190 [ 27.616817][ T402] unfreeze_partials+0x150/0x180 [ 27.621727][ T402] put_cpu_partial+0xc1/0x180 [ 27.626373][ T402] __slab_free+0x2c9/0x3a0 [ 27.630853][ T402] ___cache_free+0x10e/0x130 [ 27.635414][ T402] qlink_free+0x50/0x90 [ 27.639585][ T402] qlist_free_all+0x5f/0xb0 [ 27.644063][ T402] kasan_quarantine_reduce+0x14a/0x160 [ 27.649498][ T402] __kasan_slab_alloc+0x2f/0xe0 [ 27.654408][ T402] slab_post_alloc_hook+0x5d/0x2f0 [ 27.659498][ T402] kmem_cache_alloc_trace+0x155/0x2e0 [ 27.664929][ T402] kernfs_iop_get_link+0x66/0x600 [ 27.669965][ T402] vfs_readlink+0x16f/0x3e0 [ 27.674479][ T402] do_readlinkat+0x251/0x490 [ 27.679331][ T402] [ 27.681645][ T402] Memory state around the buggy address: [ 27.687252][ T402] ffff88811122f400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.695290][ T402] ffff88811122f480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.703327][ T402] >ffff88811122f500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.711374][ T402] ^ [ 27.718022][ T402] ffff88811122f580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.726056][ T402] ffff88811122f600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.734131][ T402] ================================================================== [ 27.742177][ T402] Disabling lock debugging due to kernel taint