[ 14.930424][ T30] audit: type=1400 audit(1741830572.974:61): avc: denied { transition } for pid=220 comm="sshd" path="/bin/sh" dev="sda1" ino=89 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.941608][ T30] audit: type=1400 audit(1741830572.974:62): avc: denied { noatsecure } for pid=220 comm="sshd" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.949784][ T30] audit: type=1400 audit(1741830572.974:63): avc: denied { write } for pid=220 comm="sh" path="pipe:[14022]" dev="pipefs" ino=14022 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 14.972699][ T30] audit: type=1400 audit(1741830572.974:64): avc: denied { rlimitinh } for pid=220 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.992691][ T30] audit: type=1400 audit(1741830572.974:65): avc: denied { siginh } for pid=220 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 51.251268][ T301] sshd (301) used greatest stack depth: 21920 bytes left Warning: Permanently added '10.128.1.99' (ED25519) to the list of known hosts. [ 58.655666][ T30] audit: type=1400 audit(1741830616.694:66): avc: denied { execmem } for pid=321 comm="syz-executor184" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 58.662945][ T321] cgroup: Unknown subsys name 'net' [ 58.675316][ T30] audit: type=1400 audit(1741830616.694:67): avc: denied { integrity } for pid=321 comm="syz-executor184" lockdown_reason="debugfs access" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=lockdown permissive=1 [ 58.704026][ T30] audit: type=1400 audit(1741830616.704:68): avc: denied { mounton } for pid=321 comm="syz-executor184" path="/syzcgroup/unified" dev="sda1" ino=1926 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 58.704288][ T321] cgroup: Unknown subsys name 'devices' [ 58.730288][ T30] audit: type=1400 audit(1741830616.704:69): avc: denied { mount } for pid=321 comm="syz-executor184" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 58.765369][ T30] audit: type=1400 audit(1741830616.724:70): avc: denied { unmount } for pid=321 comm="syz-executor184" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 58.940929][ T321] cgroup: Unknown subsys name 'hugetlb' [ 58.946637][ T321] cgroup: Unknown subsys name 'rlimit' [ 59.070112][ T30] audit: type=1400 audit(1741830617.114:71): avc: denied { mounton } for pid=321 comm="syz-executor184" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 59.097127][ T30] audit: type=1400 audit(1741830617.114:72): avc: denied { mount } for pid=321 comm="syz-executor184" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 59.121774][ T30] audit: type=1400 audit(1741830617.114:73): avc: denied { setattr } for pid=321 comm="syz-executor184" name="raw-gadget" dev="devtmpfs" ino=250 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 59.129110][ T324] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 59.157083][ T30] audit: type=1400 audit(1741830617.194:74): avc: denied { relabelto } for pid=324 comm="mkswap" name="swap-file" dev="sda1" ino=1929 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 59.183301][ T30] audit: type=1400 audit(1741830617.194:75): avc: denied { write } for pid=324 comm="mkswap" path="/root/swap-file" dev="sda1" ino=1929 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 59.188974][ T321] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 59.335310][ T331] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.342590][ T331] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.350081][ T331] device bridge_slave_0 entered promiscuous mode [ 59.365788][ T331] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.372872][ T331] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.380690][ T331] device bridge_slave_1 entered promiscuous mode [ 59.440710][ T334] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.448080][ T334] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.456224][ T334] device bridge_slave_0 entered promiscuous mode [ 59.479162][ T334] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.488072][ T334] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.496326][ T334] device bridge_slave_1 entered promiscuous mode [ 59.508731][ T332] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.515879][ T332] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.523919][ T332] device bridge_slave_0 entered promiscuous mode [ 59.532287][ T330] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.539457][ T330] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.546852][ T330] device bridge_slave_0 entered promiscuous mode [ 59.563418][ T332] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.571554][ T332] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.579300][ T332] device bridge_slave_1 entered promiscuous mode [ 59.586254][ T330] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.593360][ T330] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.600916][ T330] device bridge_slave_1 entered promiscuous mode [ 59.635751][ T333] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.644224][ T333] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.652417][ T333] device bridge_slave_0 entered promiscuous mode [ 59.675432][ T333] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.684547][ T333] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.692979][ T333] device bridge_slave_1 entered promiscuous mode [ 59.876439][ T331] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.888190][ T331] bridge0: port 2(bridge_slave_1) entered forwarding state [ 59.898346][ T331] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.907637][ T331] bridge0: port 1(bridge_slave_0) entered forwarding state [ 59.930122][ T332] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.937354][ T332] bridge0: port 2(bridge_slave_1) entered forwarding state [ 59.945031][ T332] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.954870][ T332] bridge0: port 1(bridge_slave_0) entered forwarding state [ 59.976671][ T330] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.983804][ T330] bridge0: port 2(bridge_slave_1) entered forwarding state [ 59.991168][ T330] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.998026][ T330] bridge0: port 1(bridge_slave_0) entered forwarding state [ 60.021944][ T334] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.028834][ T334] bridge0: port 2(bridge_slave_1) entered forwarding state [ 60.035940][ T334] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.042870][ T334] bridge0: port 1(bridge_slave_0) entered forwarding state [ 60.055595][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.063079][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.070589][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.078056][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.085404][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.093307][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.100520][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.109014][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.117542][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 60.125224][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 60.154986][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 60.164631][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.171820][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 60.179204][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 60.187346][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.194237][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 60.221783][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 60.230339][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 60.238840][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 60.246641][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 60.254953][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.261833][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 60.270286][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 60.278374][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.285356][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 60.307365][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 60.329062][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 60.337199][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.344080][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 60.352387][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 60.360713][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.367565][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 60.375105][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 60.383341][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 60.390774][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 60.398642][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 60.406569][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 60.436975][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 60.445070][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 60.453147][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 60.462205][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 60.469735][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 60.478126][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 60.486155][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.493092][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 60.500484][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 60.508770][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 60.516698][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.523564][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 60.530897][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 60.540415][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 60.548478][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.555406][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 60.562687][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 60.571178][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 60.579367][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.586207][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 60.593595][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 60.601723][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 60.609730][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 60.617590][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 60.625513][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 60.633419][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 60.641447][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 60.649556][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 60.657344][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 60.665361][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 60.688830][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 60.696839][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 60.704950][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 60.713363][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 60.721973][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 60.730592][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 60.741304][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 60.749608][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 60.765978][ T331] device veth0_vlan entered promiscuous mode [ 60.774791][ T334] device veth0_vlan entered promiscuous mode [ 60.781663][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 60.791208][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 60.799063][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 60.806973][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 60.814930][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 60.822941][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 60.830415][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 60.837858][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 60.845271][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 60.855347][ T332] device veth0_vlan entered promiscuous mode [ 60.868984][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 60.877250][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 60.885518][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 60.893970][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 60.902494][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 60.910695][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 60.918865][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 60.926173][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 60.935095][ T331] device veth1_macvtap entered promiscuous mode [ 60.945421][ T332] device veth1_macvtap entered promiscuous mode [ 60.953714][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 60.962188][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 60.969897][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 60.977365][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 60.985177][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 61.000470][ T334] device veth1_macvtap entered promiscuous mode [ 61.007951][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 61.016195][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 61.024671][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 61.034284][ T330] device veth0_vlan entered promiscuous mode [ 61.047974][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 61.056075][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 61.064433][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 61.073060][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 61.081944][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 61.090186][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 61.099010][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 61.107610][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 61.120025][ T333] device veth0_vlan entered promiscuous mode [ 61.133487][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 61.142120][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 61.151660][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 61.159643][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 61.167488][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 61.175082][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 61.193715][ T331] request_module fs-gadgetfs succeeded, but still no fs? executing program executing program executing program executing program executing program executing program [ 61.194387][ T330] device veth1_macvtap entered promiscuous mode [ 61.214797][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 61.224129][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 61.240628][ T333] device veth1_macvtap entered promiscuous mode executing program executing program executing program executing program executing program executing program executing program [ 61.280313][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 61.292946][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 61.301974][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 61.312837][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready executing program executing program executing program executing program executing program executing program [ 61.332310][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 61.352008][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 61.375745][ T353] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 61.393505][ T353] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 64.543525][ T353] ================================================================== [ 64.551583][ T353] BUG: KASAN: use-after-free in l2tp_session_delete+0x24/0x4e0 [ 64.558992][ T353] Write of size 8 at addr ffff8881166a7408 by task kworker/u4:3/353 [ 64.566904][ T353] [ 64.569195][ T353] CPU: 1 PID: 353 Comm: kworker/u4:3 Not tainted 5.15.178-syzkaller-00013-g7d1f9b5c2ff5 #0 [ 64.579214][ T353] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 64.589176][ T353] Workqueue: l2tp l2tp_tunnel_del_work [ 64.594481][ T353] Call Trace: [ 64.597590][ T353] [ 64.600372][ T353] dump_stack_lvl+0x151/0x1c0 [ 64.604917][ T353] ? io_uring_drop_tctx_refs+0x190/0x190 [ 64.610359][ T353] ? panic+0x760/0x760 [ 64.614255][ T353] ? __switch_to+0x62a/0x1190 [ 64.618773][ T353] print_address_description+0x87/0x3b0 [ 64.624154][ T353] ? __kasan_check_read+0x11/0x20 [ 64.629024][ T353] kasan_report+0x179/0x1c0 [ 64.633364][ T353] ? schedule_preempt_disabled+0x20/0x20 [ 64.638818][ T353] ? l2tp_session_delete+0x24/0x4e0 [ 64.643856][ T353] ? l2tp_session_delete+0x24/0x4e0 [ 64.648885][ T353] kasan_check_range+0x293/0x2a0 [ 64.653657][ T353] __kasan_check_write+0x14/0x20 [ 64.658557][ T353] l2tp_session_delete+0x24/0x4e0 [ 64.663464][ T353] l2tp_tunnel_del_work+0x19d/0x380 [ 64.668465][ T353] process_one_work+0x6bb/0xc10 [ 64.673138][ T353] worker_thread+0xad5/0x12a0 [ 64.677824][ T353] ? _raw_spin_lock+0x1b0/0x1b0 [ 64.682778][ T353] kthread+0x421/0x510 [ 64.686692][ T353] ? worker_clr_flags+0x180/0x180 executing program executing program executing program executing program executing program executing program executing program [ 64.691586][ T353] ? kthread_blkcg+0xd0/0xd0 [ 64.696151][ T353] ret_from_fork+0x1f/0x30 [ 64.700395][ T353] [ 64.703255][ T353] [ 64.705428][ T353] Allocated by task 649: [ 64.710349][ T353] ____kasan_kmalloc+0xdb/0x110 [ 64.715754][ T353] __kasan_kmalloc+0x9/0x10 [ 64.721398][ T353] __kmalloc+0x13f/0x2c0 [ 64.725491][ T353] l2tp_session_create+0x38/0xb60 [ 64.730576][ T353] pppol2tp_connect+0xc5d/0x1690 [ 64.735281][ T353] __sys_connect+0x38b/0x410 executing program [ 64.739716][ T353] __x64_sys_connect+0x7a/0x90 [ 64.744874][ T353] x64_sys_call+0x14e/0x9a0 [ 64.749706][ T353] do_syscall_64+0x3b/0xb0 [ 64.754002][ T353] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 64.759736][ T353] [ 64.761897][ T353] Freed by task 333: [ 64.765904][ T353] kasan_set_track+0x4b/0x70 [ 64.770328][ T353] kasan_set_free_info+0x23/0x40 [ 64.775094][ T353] ____kasan_slab_free+0x126/0x160 [ 64.780145][ T353] __kasan_slab_free+0x11/0x20 [ 64.784770][ T353] slab_free_freelist_hook+0xbd/0x190 [ 64.789949][ T353] kfree+0xcc/0x270 [ 64.793589][ T353] l2tp_session_dec_refcount+0xa9/0x1b0 [ 64.798970][ T353] pppol2tp_session_destruct+0xaf/0xf0 [ 64.804444][ T353] __sk_destruct+0x56/0x5b0 [ 64.808877][ T353] __sk_free+0x36c/0x470 [ 64.813189][ T353] sk_free+0x51/0x80 [ 64.816926][ T353] pppol2tp_put_sk+0x77/0xb0 [ 64.821440][ T353] rcu_do_batch+0x57a/0xc10 [ 64.825780][ T353] rcu_core+0x517/0x1020 [ 64.829862][ T353] rcu_core_si+0x9/0x10 [ 64.833936][ T353] handle_softirqs+0x25e/0x5c0 [ 64.838541][ T353] __do_softirq+0xb/0xd [ 64.842534][ T353] executing program executing program [ 64.844784][ T353] Last potentially related work creation: [ 64.850355][ T353] kasan_save_stack+0x3b/0x60 [ 64.854876][ T353] __kasan_record_aux_stack+0xd3/0xf0 [ 64.860087][ T353] kasan_record_aux_stack_noalloc+0xb/0x10 [ 64.866385][ T353] call_rcu+0x123/0x10b0 [ 64.870479][ T353] pppol2tp_release+0x20f/0x2d0 [ 64.875183][ T353] sock_close+0xdf/0x270 [ 64.879821][ T353] __fput+0x228/0x8c0 [ 64.883627][ T353] ____fput+0x15/0x20 [ 64.887449][ T353] task_work_run+0x129/0x190 executing program executing program executing program [ 64.891886][ T353] exit_to_user_mode_loop+0xc4/0xe0 [ 64.897222][ T353] exit_to_user_mode_prepare+0x5a/0xa0 [ 64.902494][ T353] syscall_exit_to_user_mode+0x26/0x160 [ 64.907959][ T353] do_syscall_64+0x47/0xb0 [ 64.912883][ T353] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 64.919312][ T353] [ 64.921493][ T353] Second to last potentially related work creation: [ 64.928149][ T353] kasan_save_stack+0x3b/0x60 [ 64.932659][ T353] __kasan_record_aux_stack+0xd3/0xf0 [ 64.937883][ T353] kasan_record_aux_stack_noalloc+0xb/0x10 [ 64.943715][ T353] call_rcu+0x123/0x10b0 [ 64.947795][ T353] pppol2tp_release+0x20f/0x2d0 [ 64.952488][ T353] sock_close+0xdf/0x270 [ 64.956568][ T353] __fput+0x228/0x8c0 [ 64.960377][ T353] ____fput+0x15/0x20 [ 64.964213][ T353] task_work_run+0x129/0x190 [ 64.968656][ T353] exit_to_user_mode_loop+0xc4/0xe0 [ 64.973699][ T353] exit_to_user_mode_prepare+0x5a/0xa0 [ 64.978991][ T353] syscall_exit_to_user_mode+0x26/0x160 [ 64.984437][ T353] do_syscall_64+0x47/0xb0 [ 64.988856][ T353] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 64.995833][ T353] [ 64.998494][ T353] The buggy address belongs to the object at ffff8881166a7400 [ 64.998494][ T353] which belongs to the cache kmalloc-512 of size 512 [ 65.012942][ T353] The buggy address is located 8 bytes inside of [ 65.012942][ T353] 512-byte region [ffff8881166a7400, ffff8881166a7600) [ 65.026121][ T353] The buggy address belongs to the page: [ 65.031608][ T353] page:ffffea000459a900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1166a4 [ 65.041762][ T353] head:ffffea000459a900 order:2 compound_mapcount:0 compound_pincount:0 [ 65.051135][ T353] flags: 0x4000000000010200(slab|head|zone=1) [ 65.058893][ T353] raw: 4000000000010200 ffffea000459c500 0000000400000004 ffff888100042f00 [ 65.067497][ T353] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 65.076004][ T353] page dumped because: kasan: bad access detected [ 65.082430][ T353] page_owner tracks the page as allocated [ 65.088424][ T353] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 114, ts 7683269238, free_ts 0 [ 65.107088][ T353] post_alloc_hook+0x1a3/0x1b0 [ 65.111681][ T353] prep_new_page+0x1b/0x110 [ 65.116067][ T353] get_page_from_freelist+0x3550/0x35d0 [ 65.121406][ T353] __alloc_pages+0x27e/0x8f0 [ 65.126081][ T353] new_slab+0x9a/0x4e0 [ 65.130122][ T353] ___slab_alloc+0x39e/0x830 [ 65.134554][ T353] __slab_alloc+0x4a/0x90 [ 65.138837][ T353] __kmalloc_track_caller+0x171/0x2c0 [ 65.144048][ T353] __alloc_skb+0x10c/0x550 [ 65.149468][ T353] alloc_skb_with_frags+0xa6/0x680 [ 65.154424][ T353] sock_alloc_send_pskb+0x915/0xa50 [ 65.160144][ T353] unix_dgram_sendmsg+0x6fd/0x2090 [ 65.165464][ T353] sock_write_iter+0x39b/0x530 [ 65.170150][ T353] vfs_write+0xd5d/0x1110 [ 65.174942][ T353] ksys_write+0x199/0x2c0 [ 65.180444][ T353] __x64_sys_write+0x7b/0x90 [ 65.187671][ T353] page_owner free stack trace missing [ 65.194814][ T353] [ 65.197116][ T353] Memory state around the buggy address: [ 65.202706][ T353] ffff8881166a7300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 65.210707][ T353] ffff8881166a7380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 65.218832][ T353] >ffff8881166a7400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 65.227179][ T353] ^ [ 65.231371][ T353] ffff8881166a7480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 65.239324][ T353] ffff8881166a7500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 65.247305][ T353] ================================================================== [ 65.255369][ T353] Disabling lock debugging due to kernel taint executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program