Warning: Permanently added '10.128.1.82' (ED25519) to the list of known hosts. 2026/10/06 09:05:35 parsed 1 programs 2026/10/06 09:05:35 serving rpc on tcp://33575 [ 24.713586][ T24] audit: type=1400 audit(1791277535.590:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 24.735782][ T24] audit: type=1400 audit(1791277535.590:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 24.759009][ T24] audit: type=1400 audit(1791277535.590:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 25.453061][ T24] audit: type=1400 audit(1791277536.330:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.454022][ T293] cgroup: Unknown subsys name 'net' [ 25.477720][ T24] audit: type=1400 audit(1791277536.330:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.512303][ T24] audit: type=1400 audit(1791277536.360:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.512540][ T293] cgroup: Unknown subsys name 'devices' [ 25.683654][ T293] cgroup: Unknown subsys name 'hugetlb' [ 25.689686][ T293] cgroup: Unknown subsys name 'rlimit' [ 25.861730][ T24] audit: type=1400 audit(1791277536.730:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.888285][ T24] audit: type=1400 audit(1791277536.730:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 25.894653][ T297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 25.912104][ T24] audit: type=1400 audit(1791277536.730:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.942673][ T24] audit: type=1400 audit(1791277536.730:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.966925][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.480820][ T299] request_module fs-gadgetfs succeeded, but still no fs? [ 26.493822][ T299] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 26.920888][ T340] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.929146][ T340] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.937148][ T340] device bridge_slave_0 entered promiscuous mode [ 26.945264][ T340] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.953677][ T340] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.962219][ T340] device bridge_slave_1 entered promiscuous mode [ 27.001550][ T340] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.010335][ T340] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.019244][ T340] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.028056][ T340] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.049566][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.057622][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.066296][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.075928][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.084934][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.093044][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.103047][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.111563][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.119104][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.131269][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.141208][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.155151][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.166500][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.174702][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.184797][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.193735][ T340] device veth0_vlan entered promiscuous mode [ 27.203944][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.213843][ T340] device veth1_macvtap entered promiscuous mode [ 27.224571][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.237406][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/10/06 09:05:38 executed programs: 0 [ 27.615418][ T363] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.622863][ T363] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.631813][ T363] device bridge_slave_0 entered promiscuous mode [ 27.645433][ T363] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.653163][ T363] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.661110][ T363] device bridge_slave_1 entered promiscuous mode [ 27.702086][ T363] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.710318][ T363] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.719353][ T363] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.729905][ T363] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.753499][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.761564][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.770113][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.786455][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.796185][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.803281][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.813180][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.822975][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.831231][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.850738][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.860450][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.877316][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.892510][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.900670][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.909301][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.918300][ T363] device veth0_vlan entered promiscuous mode [ 27.931620][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 27.940408][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.950901][ T363] device veth1_macvtap entered promiscuous mode [ 27.966113][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 27.975178][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 27.989411][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.003015][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 28.011514][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 28.112396][ T402] ================================================================== [ 28.122440][ T402] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 [ 28.130003][ T402] Write of size 8 at addr ffff88810fd0b150 by task syz.2.17/402 [ 28.138967][ T402] [ 28.142274][ T402] CPU: 1 PID: 402 Comm: syz.2.17 Not tainted syzkaller #0 [ 28.150179][ T402] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 28.161956][ T402] Call Trace: [ 28.165627][ T402] __dump_stack+0x21/0x24 [ 28.170157][ T402] dump_stack_lvl+0x1a7/0x208 [ 28.174850][ T402] ? show_regs_print_info+0x18/0x18 [ 28.180067][ T402] ? thaw_kernel_threads+0x220/0x220 [ 28.185710][ T402] print_address_description+0x7f/0x2c0 [ 28.191471][ T402] ? mutex_lock+0x85/0xf0 [ 28.196513][ T402] kasan_report+0x100/0x140 [ 28.201201][ T402] ? mutex_lock+0x85/0xf0 [ 28.205818][ T402] kasan_check_range+0x249/0x2a0 [ 28.212785][ T402] __kasan_check_write+0x14/0x20 [ 28.218014][ T402] mutex_lock+0x85/0xf0 [ 28.222549][ T402] ? mutex_trylock+0xb0/0xb0 [ 28.227248][ T402] ? l2tp_session_put+0xb2/0x1a0 [ 28.232327][ T402] ? l2tp_session_delete+0x3a9/0x4a0 [ 28.238076][ T402] pppol2tp_release+0x178/0x2b0 [ 28.243114][ T402] sock_close+0xb8/0x200 [ 28.247464][ T402] ? sock_mmap+0xa0/0xa0 [ 28.252066][ T402] __fput+0x2dc/0x730 [ 28.256049][ T402] ____fput+0x15/0x20 [ 28.260030][ T402] task_work_run+0x127/0x190 [ 28.264740][ T402] do_exit+0xa7c/0x24e0 [ 28.269187][ T402] ? finish_task_switch+0x1b7/0x5a0 [ 28.274688][ T402] ? put_task_struct+0x90/0x90 [ 28.279564][ T402] ? remove_hrtimer+0x225/0x490 [ 28.284614][ T402] ? __kasan_check_write+0x14/0x20 [ 28.289722][ T402] ? _raw_spin_lock_irq+0x95/0xf0 [ 28.294999][ T402] do_group_exit+0x149/0x310 [ 28.299602][ T402] ? __kasan_check_write+0x14/0x20 [ 28.304827][ T402] ? recalc_sigpending+0x1c4/0x230 [ 28.310042][ T402] get_signal+0xfb1/0x1300 [ 28.314807][ T402] arch_do_signal_or_restart+0xe7/0x11b0 [ 28.320428][ T402] ? nanosleep_copyout+0x120/0x120 [ 28.325991][ T402] ? get_timespec64+0x116/0x1b0 [ 28.331083][ T402] ? __ia32_sys_rt_sigreturn+0x730/0x730 [ 28.336815][ T402] ? __x64_sys_clock_nanosleep+0xb0/0xb0 [ 28.342539][ T402] ? debug_smp_processor_id+0x17/0x20 [ 28.348022][ T402] exit_to_user_mode_loop+0xa2/0xe0 [ 28.353400][ T402] exit_to_user_mode_prepare+0x76/0xa0 [ 28.358866][ T402] syscall_exit_to_user_mode+0x1d/0x40 [ 28.364352][ T402] do_syscall_64+0x3d/0x40 [ 28.368877][ T402] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.375992][ T402] RIP: 0033:0x7f54fed9a317 [ 28.380586][ T402] Code: Unable to access opcode bytes at RIP 0x7f54fed9a2ed. [ 28.388147][ T402] RSP: 002b:00007fffb6b99b90 EFLAGS: 00000202 ORIG_RAX: 00000000000000e6 [ 28.396651][ T402] RAX: fffffffffffffdfc RBX: 0000555591899500 RCX: 00007f54fed9a317 [ 28.404794][ T402] RDX: 00007fffb6b99bd0 RSI: 0000000000000000 RDI: 0000000000000000 [ 28.413107][ T402] RBP: 00007f54fee768e0 R08: 0000000000000000 R09: 0000000000000000 [ 28.421857][ T402] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 28.430218][ T402] R13: 00007f54ff066fac R14: 00007f54ff066fa0 R15: 00007f54ff066fa0 [ 28.438381][ T402] [ 28.440718][ T402] Allocated by task 401: [ 28.445079][ T402] __kasan_kmalloc+0xd4/0x100 [ 28.449782][ T402] __kmalloc+0x19f/0x330 [ 28.454298][ T402] l2tp_session_create+0x39/0xb60 [ 28.461438][ T402] pppol2tp_connect+0xbf5/0x1640 [ 28.466887][ T402] __sys_connect+0x3ce/0x450 [ 28.471764][ T402] __x64_sys_connect+0x7a/0x90 [ 28.477359][ T402] do_syscall_64+0x31/0x40 [ 28.484028][ T402] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.492091][ T402] [ 28.495870][ T402] Freed by task 402: [ 28.501596][ T402] kasan_set_track+0x4a/0x70 [ 28.508536][ T402] kasan_set_free_info+0x23/0x40 [ 28.518523][ T402] ____kasan_slab_free+0x125/0x160 [ 28.526328][ T402] __kasan_slab_free+0x11/0x20 [ 28.532826][ T402] slab_free_freelist_hook+0xc5/0x190 [ 28.539702][ T402] kfree+0xc0/0x270 [ 28.544463][ T402] l2tp_session_put+0xb2/0x1a0 [ 28.550391][ T402] l2tp_session_delete+0x3a9/0x4a0 [ 28.558594][ T402] pppol2tp_release+0x169/0x2b0 [ 28.565582][ T402] sock_close+0xb8/0x200 [ 28.570401][ T402] __fput+0x2dc/0x730 [ 28.574926][ T402] ____fput+0x15/0x20 [ 28.580123][ T402] task_work_run+0x127/0x190 [ 28.584831][ T402] do_exit+0xa7c/0x24e0 [ 28.590137][ T402] do_group_exit+0x149/0x310 [ 28.595535][ T402] get_signal+0xfb1/0x1300 [ 28.600324][ T402] arch_do_signal_or_restart+0xe7/0x11b0 [ 28.606166][ T402] exit_to_user_mode_loop+0xa2/0xe0 [ 28.613559][ T402] exit_to_user_mode_prepare+0x76/0xa0 [ 28.619525][ T402] syscall_exit_to_user_mode+0x1d/0x40 [ 28.626091][ T402] do_syscall_64+0x3d/0x40 [ 28.630883][ T402] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.636874][ T402] [ 28.640625][ T402] The buggy address belongs to the object at ffff88810fd0b000 [ 28.640625][ T402] which belongs to the cache kmalloc-512 of size 512 [ 28.658765][ T402] The buggy address is located 336 bytes inside of [ 28.658765][ T402] 512-byte region [ffff88810fd0b000, ffff88810fd0b200) [ 28.672838][ T402] The buggy address belongs to the page: [ 28.678569][ T402] page:ffffea00043f4200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10fd08 [ 28.689881][ T402] head:ffffea00043f4200 order:2 compound_mapcount:0 compound_pincount:0 [ 28.699073][ T402] flags: 0x4000000000010200(slab|head) [ 28.705156][ T402] raw: 4000000000010200 ffffea000441a900 0000000600000006 ffff888100043080 [ 28.714626][ T402] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 28.723791][ T402] page dumped because: kasan: bad access detected [ 28.730728][ T402] page_owner tracks the page as allocated [ 28.736471][ T402] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 96, ts 4992639697, free_ts 0 [ 28.755534][ T402] prep_new_page+0x176/0x190 [ 28.760136][ T402] get_page_from_freelist+0x225f/0x23f0 [ 28.765685][ T402] __alloc_pages_nodemask+0x29a/0x640 [ 28.771048][ T402] new_slab+0x84/0x3f0 [ 28.775153][ T402] ___slab_alloc+0x2f8/0x4c0 [ 28.779846][ T402] __slab_alloc+0x63/0xa0 [ 28.784496][ T402] __kmalloc_track_caller+0x1e4/0x310 [ 28.789868][ T402] __alloc_skb+0xdc/0x520 [ 28.794391][ T402] alloc_uevent_skb+0x85/0x240 [ 28.799166][ T402] kobject_uevent_net_broadcast+0x335/0x5a0 [ 28.805210][ T402] kobject_uevent_env+0x52b/0x700 [ 28.810590][ T402] kobject_synth_uevent+0x452/0x940 [ 28.815891][ T402] store_uevent+0x16/0x30 [ 28.820464][ T402] module_attr_store+0x5f/0x80 [ 28.825717][ T402] sysfs_kf_write+0x129/0x150 [ 28.830785][ T402] kernfs_fop_write_iter+0x2bd/0x400 [ 28.836278][ T402] page_owner free stack trace missing [ 28.841842][ T402] [ 28.844390][ T402] Memory state around the buggy address: [ 28.850313][ T402] ffff88810fd0b000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.859362][ T402] ffff88810fd0b080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.867526][ T402] >ffff88810fd0b100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.876627][ T402] ^ [ 28.884406][ T402] ffff88810fd0b180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.893556][ T402] ffff88810fd0b200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.903121][ T402] ================================================================== [ 28.912583][ T402] Disablin