[ 6.544339][ T24] audit: type=1400 audit(1783221147.280:58): avc: denied { read } for pid=187 comm="getty" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:getty_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 syzkaller syzkaller login: [ 16.019740][ T24] audit: type=1400 audit(1783221156.780:59): avc: denied { transition } for pid=217 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 16.027461][ T24] audit: type=1400 audit(1783221156.780:60): avc: denied { noatsecure } for pid=217 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 16.034376][ T24] audit: type=1400 audit(1783221156.800:61): avc: denied { write } for pid=217 comm="sh" path="pipe:[1458]" dev="pipefs" ino=1458 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 16.046110][ T24] audit: type=1400 audit(1783221156.800:62): avc: denied { rlimitinh } for pid=217 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 16.064919][ T24] audit: type=1400 audit(1783221156.800:63): avc: denied { siginh } for pid=217 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.118' (ED25519) to the list of known hosts. 2026/07/05 03:12:47 parsed 1 programs 2026/07/05 03:12:47 serving rpc on tcp://34763 [ 26.801029][ T24] audit: type=1400 audit(1783221167.570:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 26.822627][ T24] audit: type=1400 audit(1783221167.570:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 26.842485][ T24] audit: type=1400 audit(1783221167.570:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 27.798472][ T24] audit: type=1400 audit(1783221168.560:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 27.802057][ T293] cgroup: Unknown subsys name 'net' [ 27.821277][ T24] audit: type=1400 audit(1783221168.560:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 27.848461][ T24] audit: type=1400 audit(1783221168.590:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 27.848944][ T293] cgroup: Unknown subsys name 'devices' [ 27.962370][ T293] cgroup: Unknown subsys name 'hugetlb' [ 27.968005][ T293] cgroup: Unknown subsys name 'rlimit' [ 28.178334][ T24] audit: type=1400 audit(1783221168.940:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 28.201541][ T24] audit: type=1400 audit(1783221168.940:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 28.221946][ T24] audit: type=1400 audit(1783221168.940:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 28.242260][ T24] audit: type=1400 audit(1783221168.950:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 28.267166][ T298] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 28.288731][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 28.812679][ T306] request_module fs-gadgetfs succeeded, but still no fs? [ 28.835532][ T306] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 29.337210][ T346] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.345243][ T346] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.357185][ T346] device bridge_slave_0 entered promiscuous mode [ 29.372564][ T346] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.379686][ T346] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.387476][ T346] device bridge_slave_1 entered promiscuous mode [ 29.453764][ T346] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.460857][ T346] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.468149][ T346] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.475212][ T346] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.510120][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.518482][ T334] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.525846][ T334] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.542735][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.551082][ T334] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.558131][ T334] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.565822][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.574657][ T334] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.581747][ T334] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.589241][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.613148][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 29.622240][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 29.630426][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 29.639695][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 29.647571][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.655934][ T346] device veth0_vlan entered promiscuous mode 2026/07/05 03:12:50 executed programs: 0 [ 29.667215][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 29.676875][ T346] device veth1_macvtap entered promiscuous mode [ 29.686048][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 29.696084][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 29.817892][ T368] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.825151][ T368] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.832855][ T368] device bridge_slave_0 entered promiscuous mode [ 29.865588][ T368] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.872733][ T368] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.880176][ T368] device bridge_slave_1 entered promiscuous mode [ 29.974499][ T369] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.981609][ T369] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.989024][ T369] device bridge_slave_0 entered promiscuous mode [ 30.012800][ T372] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.019866][ T372] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.027378][ T372] device bridge_slave_0 entered promiscuous mode [ 30.035660][ T372] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.042792][ T372] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.050166][ T372] device bridge_slave_1 entered promiscuous mode [ 30.059620][ T369] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.066717][ T369] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.074144][ T369] device bridge_slave_1 entered promiscuous mode [ 30.105620][ T378] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.112738][ T378] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.120093][ T378] device bridge_slave_0 entered promiscuous mode [ 30.128991][ T378] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.136222][ T378] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.143849][ T378] device bridge_slave_1 entered promiscuous mode [ 30.193719][ T376] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.200836][ T376] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.208211][ T376] device bridge_slave_0 entered promiscuous mode [ 30.217744][ T376] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.224816][ T376] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.232236][ T376] device bridge_slave_1 entered promiscuous mode [ 30.304882][ T378] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.311968][ T378] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.319460][ T378] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.326551][ T378] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.397149][ T334] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.404629][ T334] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.412811][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 30.420187][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 30.447867][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 30.456354][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 30.464727][ T334] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.471775][ T334] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.479492][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 30.487080][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 30.494578][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 30.503526][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 30.511799][ T334] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.518954][ T334] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.526546][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 30.534771][ T334] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.541856][ T334] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.549233][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 30.557503][ T334] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.564539][ T334] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.571931][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 30.579954][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 30.587987][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 30.596068][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 30.604313][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 30.633759][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 30.641934][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 30.682164][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 30.689635][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 30.701380][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 30.709973][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 30.718401][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 30.726731][ T334] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.733817][ T334] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.741392][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 30.749654][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 30.757891][ T334] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.764936][ T334] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.789853][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 30.797525][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 30.806082][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 30.814731][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 30.822659][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 30.831002][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 30.838437][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 30.854635][ T368] device veth0_vlan entered promiscuous mode [ 30.861435][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 30.869365][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 30.877953][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 30.886959][ T378] device veth0_vlan entered promiscuous mode [ 30.901041][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 30.908462][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 30.928853][ T368] device veth1_macvtap entered promiscuous mode [ 30.936640][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 30.944879][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 30.960239][ T378] device veth1_macvtap entered promiscuous mode [ 30.971135][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 30.979278][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 30.987262][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 30.994956][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 31.003478][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 31.011808][ T334] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.018828][ T334] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.026343][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 31.034916][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 31.043268][ T334] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.050292][ T334] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.057692][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 31.065854][ T334] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.072919][ T334] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.080349][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 31.088044][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 31.109419][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 31.117651][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 31.126382][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 31.134949][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 31.143522][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 31.156839][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 31.165380][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 31.174040][ T334] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.181088][ T334] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.196523][ T372] device veth0_vlan entered promiscuous mode [ 31.208227][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 31.216627][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 31.225194][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 31.234603][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 31.243017][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 31.251164][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 31.259040][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 31.267092][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 31.275351][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 31.283572][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 31.291765][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 31.299770][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 31.307778][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 31.315921][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 31.324379][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 31.332012][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 31.351542][ T372] device veth1_macvtap entered promiscuous mode [ 31.360421][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 31.368889][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 31.377662][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 31.408571][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 31.417155][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 31.429002][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 31.437840][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 31.446112][ C0] ================================================================== [ 31.454216][ C0] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x6c/0xb0 [ 31.461591][ C0] Read of size 8 at addr ffff888112e45590 by task ksoftirqd/0/12 [ 31.469315][ C0] [ 31.471661][ C0] CPU: 0 PID: 12 Comm: ksoftirqd/0 Not tainted syzkaller #0 [ 31.478972][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 31.489038][ C0] Call Trace: [ 31.492352][ C0] __dump_stack+0x21/0x24 [ 31.496682][ C0] dump_stack_lvl+0x1a7/0x208 [ 31.501373][ C0] ? show_regs_print_info+0x18/0x18 [ 31.506576][ C0] ? thaw_kernel_threads+0x220/0x220 [ 31.511903][ C0] print_address_description+0x7f/0x2c0 [ 31.517468][ C0] ? rcu_cblist_dequeue+0x6c/0xb0 [ 31.522494][ C0] kasan_report+0x100/0x140 [ 31.526997][ C0] ? rcu_cblist_dequeue+0x6c/0xb0 [ 31.532033][ C0] __asan_report_load8_noabort+0x14/0x20 [ 31.537675][ C0] rcu_cblist_dequeue+0x6c/0xb0 [ 31.542528][ C0] rcu_do_batch+0x448/0xaf0 [ 31.547036][ C0] ? try_to_wake_up+0x64e/0xdf0 [ 31.551892][ C0] ? local_bh_enable+0x20/0x20 [ 31.556662][ C0] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 31.562485][ C0] ? rcu_report_qs_rnp+0x37e/0x390 [ 31.567602][ C0] rcu_core+0x50a/0xca0 [ 31.571762][ C0] ? rcu_cpu_kthread_park+0x90/0x90 [ 31.576960][ C0] ? kvm_sched_clock_read+0x18/0x40 [ 31.582157][ C0] ? sched_clock+0x3a/0x40 [ 31.586571][ C0] ? sched_clock_cpu+0x1b/0x3d0 [ 31.591452][ C0] ? __schedule+0xc0b/0x13e0 [ 31.596045][ C0] rcu_core_si+0x9/0x10 [ 31.600203][ C0] __do_softirq+0x255/0x563 [ 31.604727][ C0] ? ksoftirqd_should_run+0x20/0x20 [ 31.609928][ C0] run_ksoftirqd+0x23/0x30 [ 31.614344][ C0] smpboot_thread_fn+0x464/0x820 [ 31.619283][ C0] kthread+0x324/0x3b0 [ 31.623362][ C0] ? cpu_report_death+0x1b0/0x1b0 [ 31.628392][ C0] ? kthread_blkcg+0xd0/0xd0 [ 31.632990][ C0] ret_from_fork+0x1f/0x30 [ 31.637410][ C0] [ 31.639744][ C0] Allocated by task 392: [ 31.643986][ C0] __kasan_kmalloc+0xd4/0x100 [ 31.648842][ C0] __kmalloc+0x19f/0x330 [ 31.653116][ C0] l2tp_session_create+0x39/0xb60 [ 31.658141][ C0] pppol2tp_connect+0xbf5/0x1640 [ 31.663076][ C0] __sys_connect+0x3ce/0x450 [ 31.667664][ C0] __x64_sys_connect+0x7a/0x90 [ 31.672429][ C0] do_syscall_64+0x31/0x40 [ 31.676861][ C0] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 31.682746][ C0] [ 31.685089][ C0] Freed by task 7: [ 31.688814][ C0] kasan_set_track+0x4a/0x70 [ 31.693405][ C0] kasan_set_free_info+0x23/0x40 [ 31.698347][ C0] ____kasan_slab_free+0x125/0x160 [ 31.703466][ C0] __kasan_slab_free+0x11/0x20 [ 31.708247][ C0] slab_free_freelist_hook+0xc5/0x190 [ 31.713627][ C0] kfree+0xc0/0x270 [ 31.717445][ C0] l2tp_session_put+0xb2/0x1a0 [ 31.722209][ C0] l2tp_session_delete+0x3a9/0x4a0 [ 31.727326][ C0] l2tp_tunnel_del_work+0x180/0x3d0 [ 31.732525][ C0] process_one_work+0x6fd/0xbc0 [ 31.737379][ C0] worker_thread+0xa8e/0x13c0 [ 31.742065][ C0] kthread+0x324/0x3b0 [ 31.746137][ C0] ret_from_fork+0x1f/0x30 [ 31.750550][ C0] [ 31.752881][ C0] Last potentially related work creation: [ 31.758611][ C0] kasan_save_stack+0x3a/0x60 [ 31.763289][ C0] __kasan_record_aux_stack+0xd2/0x100 [ 31.768743][ C0] kasan_record_aux_stack_noalloc+0xb/0x10 [ 31.774560][ C0] call_rcu+0x11a/0x1090 [ 31.778815][ C0] pppol2tp_release+0x1e3/0x2b0 [ 31.783669][ C0] sock_close+0xb8/0x200 [ 31.787914][ C0] __fput+0x2dc/0x730 [ 31.791893][ C0] ____fput+0x15/0x20 [ 31.795895][ C0] task_work_run+0x127/0x190 [ 31.800492][ C0] exit_to_user_mode_loop+0xcb/0xe0 [ 31.805782][ C0] exit_to_user_mode_prepare+0x76/0xa0 [ 31.811251][ C0] syscall_exit_to_user_mode+0x1d/0x40 [ 31.816727][ C0] do_syscall_64+0x3d/0x40 [ 31.821147][ C0] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 31.827030][ C0] [ 31.829362][ C0] The buggy address belongs to the object at ffff888112e45400 [ 31.829362][ C0] which belongs to the cache kmalloc-512 of size 512 [ 31.843419][ C0] The buggy address is located 400 bytes inside of [ 31.843419][ C0] 512-byte region [ffff888112e45400, ffff888112e45600) [ 31.856709][ C0] The buggy address belongs to the page: [ 31.862376][ C0] page:ffffea00044b9100 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112e44 [ 31.872622][ C0] head:ffffea00044b9100 order:2 compound_mapcount:0 compound_pincount:0 [ 31.880958][ C0] flags: 0x4000000000010200(slab|head) [ 31.886444][ C0] raw: 4000000000010200 ffffea00044b6400 0000000300000003 ffff888100043080 [ 31.895030][ C0] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 31.903612][ C0] page dumped because: kasan: bad access detected [ 31.910020][ C0] page_owner tracks the page as allocated [ 31.915743][ C0] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 99, ts 5397720437, free_ts 0 [ 31.933709][ C0] prep_new_page+0x176/0x190 [ 31.938319][ C0] get_page_from_freelist+0x225f/0x23f0 [ 31.943881][ C0] __alloc_pages_nodemask+0x29a/0x640 [ 31.949276][ C0] new_slab+0x84/0x3f0 [ 31.953421][ C0] ___slab_alloc+0x2f8/0x4c0 [ 31.958025][ C0] __slab_alloc+0x63/0xa0 [ 31.962366][ C0] __kmalloc_track_caller+0x1e4/0x310 [ 31.967752][ C0] __alloc_skb+0xdc/0x520 [ 31.972092][ C0] alloc_skb_with_frags+0xa3/0x560 [ 31.977211][ C0] sock_alloc_send_pskb+0x87f/0x9a0 [ 31.982432][ C0] unix_dgram_sendmsg+0x6f3/0x18f0 [ 31.987551][ C0] sock_write_iter+0x2a6/0x3a0 [ 31.992324][ C0] vfs_write+0x770/0xd70 [ 31.996582][ C0] ksys_write+0x14a/0x260 [ 32.000928][ C0] __x64_sys_write+0x7b/0x90 [ 32.005548][ C0] do_syscall_64+0x31/0x40 [ 32.009966][ C0] page_owner free stack trace missing [ 32.015338][ C0] [ 32.017675][ C0] Memory state around the buggy address: [ 32.023313][ C0] ffff888112e45480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.031380][ C0] ffff888112e45500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.039457][ C0] >ffff888112e45580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.047521][ C0] ^ [ 32.052129][ C0] ffff888112e45600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.060194][ C0] ffff888112e45680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.068256][ C0] ================================================================== [ 32.076318][ C0] Disabling lock debugging due to kernel taint [ 32.087864][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 32.103066][ T24] kauditd_printk_skb: 34 callbacks suppressed [ 32.103081][ T24] audit: type=1400 audit(1783221172.860:108): avc: denied { read } for pid=77 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 32.113578][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 32.137530][ T24] audit: type=1400 audit(1783221172.860:109): avc: denied { search } for pid=77 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.143503][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 32.161701][ T24] audit: type=1400 audit(1783221172.860:110): avc: denied { write } for pid=77 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.169872][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 32.192574][ T24] audit: type=1400 audit(1783221172.860:111): avc: denied { add_name } for pid=77 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.224352][ T369] device veth0_vlan entered promiscuous mode [ 32.230517][ T24] audit: type=1400 audit(1783221172.860:112): avc: denied { create } for pid=77 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 32.251424][ T24] audit: type=1400 audit(1783221172.860:113): avc: denied { append open } for pid=77 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 32.275048][ T24] audit: type=1400 audit(1783221172.860:114): avc: denied { getattr } for pid=77 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 32.313148][ T376] device veth0_vlan entered promiscuous mode [ 32.325731][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 32.345401][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 32.354086][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 32.364659][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 32.378825][ T369] device veth1_macvtap entered promiscuous mode [ 32.401827][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 32.414171][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 32.425114][ T441] ------------[ cut here ]------------ [ 32.431830][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 32.439122][ T441] WARNING: CPU: 0 PID: 441 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 32.449815][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 32.457614][ T441] Modules linked in: [ 32.463228][ T443] ------------[ cut here ]------------ [ 32.463461][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 32.468732][ T443] WARNING: CPU: 1 PID: 443 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 32.468743][ T443] Modules linked in: [ 32.477018][ T441] CPU: 0 PID: 441 Comm: syz.0.33 Tainted: G B syzkaller #0 [ 32.498221][ T443] [ 32.500124][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 32.502456][ T443] CPU: 1 PID: 443 Comm: syz.4.34 Tainted: G B syzkaller #0 [ 32.509631][ T441] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 32.519349][ T443] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 32.529451][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 32.538813][ T443] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 32.545713][ T441] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 32.553473][ T443] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 32.559266][ T441] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 32.597844][ T441] RSP: 0018:ffffc90001017d68 EFLAGS: 00010293 [ 32.598434][ T443] RSP: 0018:ffffc90000ed7d68 EFLAGS: 00010293 [ 32.604724][ T441] [ 32.606926][ T443] [ 32.615692][ T443] RAX: ffffffff842e9787 RBX: ffff888114936000 RCX: ffff888114510000 [ 32.623982][ T443] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000c04eb7d [ 32.637833][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 32.650191][ T441] RAX: ffffffff842e9787 RBX: ffff888114932000 RCX: ffff888114923b40 [ 32.659347][ T445] ------------[ cut here ]------------ [ 32.659766][ T443] RBP: ffffc90000ed7d88 R08: ffff888114936083 R09: 1ffff11022926c10 [ 32.665713][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 32.674869][ T443] R10: dffffc0000000000 R11: ffffed1022926c11 R12: dffffc0000000000 [ 32.682498][ T445] WARNING: CPU: 0 PID: 445 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 32.699268][ T443] R13: dffffc0000000000 R14: 0000000000000000 R15: ffff888114b39000 [ 32.699279][ T443] FS: 000055557fb9d500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 32.699287][ T443] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.699295][ T443] CR2: 0000200000000000 CR3: 0000000113696000 CR4: 00000000003506a0 [ 32.699306][ T443] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 32.699313][ T443] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 32.699317][ T443] Call Trace: [ 32.699333][ T443] pppol2tp_release+0x150/0x2b0 [ 32.699344][ T443] sock_close+0xb8/0x200 [ 32.699354][ T443] ? sock_mmap+0xa0/0xa0 [ 32.699365][ T443] __fput+0x2dc/0x730 [ 32.699378][ T443] ____fput+0x15/0x20 [ 32.699395][ T443] task_work_run+0x127/0x190 [ 32.699408][ T443] exit_to_user_mode_loop+0xcb/0xe0 [ 32.699442][ T443] exit_to_user_mode_prepare+0x76/0xa0 [ 32.708098][ T441] RDX: 0000000000000000 RSI: 0000000011faa8e0 RDI: 000000000c04eb7d [ 32.719265][ T443] syscall_exit_to_user_mode+0x1d/0x40 [ 32.724122][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 32.732435][ T443] do_syscall_64+0x3d/0x40 [ 32.740119][ T334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 32.748099][ T443] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 32.751191][ T441] RBP: ffffc90001017d88 R08: ffff888114932083 R09: 1ffff11022926410 [ 32.756082][ T443] RIP: 0033:0x7f8c4e8d6e59 [ 32.759836][ T441] R10: dffffc0000000000 R11: ffffed1022926411 R12: dffffc0000000000 [ 32.759845][ T441] R13: dffffc0000000000 R14: 0000000011faa8e0 R15: ffff888114766400 [ 32.759855][ T441] FS: 000055556d281500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 32.759887][ T441] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.765460][ T443] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.768582][ T445] Modules linked in: [ 32.772518][ T443] RSP: 002b:00007ffdacbc34f8 EFLAGS: 00000246 [ 32.777547][ T445] [ 32.786231][ T443] ORIG_RAX: 00000000000001b4 [ 32.787576][ T441] CR2: 00007f301f393780 CR3: 000000010c06a000 CR4: 00000000003506b0 [ 32.799423][ T443] RAX: 0000000000000000 RBX: 00007ffdacbc35e0 RCX: 00007f8c4e8d6e59 [ 32.803728][ T445] CPU: 0 PID: 445 Comm: syz.5.19 Tainted: G B syzkaller #0 [ 32.819044][ T376] device veth1_macvtap entered promiscuous mode [ 32.831594][ T441] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 32.836914][ T443] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 32.839886][ T441] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 32.848826][ T443] RBP: 0000000000007e99 R08: 0000000000000001 R09: 0000000000000000 [ 32.857448][ T445] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 32.873449][ T443] R10: 0000001b33620000 R11: 0000000000000246 R12: 00007ffdacbc3620 [ 32.892455][ T441] Call Trace: [ 32.900259][ T443] R13: 00007f8c4eb5efac R14: 0000000000007ee1 R15: 00007f8c4eb5efa0 [ 32.906118][ T322] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 32.909563][ T443] ---[ end trace aecf4b8e53e17782 ]--- [ 32.918472][ T322] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 32.926470][ T445] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 32.937017][ T441] pppol2tp_release+0x150/0x2b0 [ 32.963681][ T445] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 32.969414][ T322] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 32.973336][ T445] RSP: 0018:ffffc90001027d68 EFLAGS: 00010293 [ 32.984112][ T441] sock_close+0xb8/0x200 [ 33.016282][ T445] [ 33.017396][ T441] ? sock_mmap+0xa0/0xa0 [ 33.032480][ T445] RAX: ffffffff842e9787 RBX: ffff88811498e000 RCX: ffff8881149262c0 [ 33.038810][ T441] __fput+0x2dc/0x730 [ 33.075159][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 33.082069][ T441] ____fput+0x15/0x20 [ 33.107979][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 33.116764][ T445] RDX: 0000000000000000 RSI: 0000000012d53f80 RDI: 000000000c04eb7d [ 33.125849][ T445] RBP: ffffc90001027d88 R08: ffff88811498e083 R09: 1ffff11022931c10 [ 33.149630][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 33.162153][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 33.173808][ T441] task_work_run+0x127/0x190 [ 33.178446][ T441] exit_to_user_mode_loop+0xcb/0xe0 [ 33.183720][ T445] R10: dffffc0000000000 R11: ffffed1022931c11 R12: dffffc0000000000 [ 33.183729][ T445] R13: dffffc0000000000 R14: 0000000012d53f80 R15: ffff8881149e8400 [ 33.183740][ T445] FS: 000055557ab2a500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 33.183748][ T445] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 33.183756][ T445] CR2: 00007ffc496fffd0 CR3: 0000000113964000 CR4: 00000000003506a0 [ 33.183766][ T445] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 33.183791][ T445] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 33.204891][ T441] exit_to_user_mode_prepare+0x76/0xa0 [ 33.256407][ T445] Call Trace: [ 33.259876][ T445] pppol2tp_release+0x150/0x2b0 [ 33.281599][ T473] ------------[ cut here ]------------ [ 33.287186][ T445] sock_close+0xb8/0x200 [ 33.293055][ T445] ? sock_mmap+0xa0/0xa0 [ 33.297501][ T473] WARNING: CPU: 1 PID: 473 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 33.309101][ T445] __fput+0x2dc/0x730 [ 33.318112][ T445] ____fput+0x15/0x20 [ 33.334081][ T473] Modules linked in: [ 33.338042][ T473] CPU: 1 PID: 473 Comm: syz.6.44 Tainted: G B W syzkaller #0 [ 33.345380][ T441] syscall_exit_to_user_mode+0x1d/0x40 [ 33.352690][ T441] do_syscall_64+0x3d/0x40 [ 33.353093][ T445] task_work_run+0x127/0x190 [ 33.361894][ T445] exit_to_user_mode_loop+0xcb/0xe0 [ 33.367325][ T473] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 33.377931][ T445] exit_to_user_mode_prepare+0x76/0xa0 [ 33.382951][ T441] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 33.393892][ T473] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 33.402195][ T441] RIP: 0033:0x7f183147be59 [ 33.406700][ T441] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 33.412400][ T445] syscall_exit_to_user_mode+0x1d/0x40 [ 33.446719][ T473] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 33.459976][ T441] RSP: 002b:00007ffd05590288 EFLAGS: 00000246 [ 33.467158][ T473] RSP: 0018:ffffc90001127d68 EFLAGS: 00010293 [ 33.473423][ T445] do_syscall_64+0x3d/0x40 [ 33.485979][ T473] [ 33.489409][ T473] RAX: ffffffff842e9787 RBX: ffff88811592e800 RCX: ffff8881153162c0 [ 33.489415][ T441] ORIG_RAX: 00000000000001b4 [ 33.508541][ T445] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 33.514624][ T473] RDX: 0000000000000000 RSI: 00000000145d0f20 RDI: 000000000c04eb7d [ 33.522721][ T445] RIP: 0033:0x7f301f4bde59 [ 33.527256][ T473] RBP: ffffc90001127d88 R08: ffff88811592e883 R09: 1ffff11022b25d10 [ 33.535471][ T445] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 33.538388][ T441] RAX: 0000000000000000 RBX: 00007ffd05590370 RCX: 00007f183147be59 [ 33.556045][ T473] R10: dffffc0000000000 R11: ffffed1022b25d11 R12: dffffc0000000000 [ 33.571856][ T473] R13: dffffc0000000000 R14: 00000000145d0f20 R15: ffff888115de6000 [ 33.572340][ T441] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 33.580062][ T473] FS: 00005555911ce500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 33.597629][ T445] RSP: 002b:00007ffc8d794eb8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 33.608560][ T441] RBP: 0000000000007e89 R08: 0000000000000001 R09: 0000000000000000 [ 33.614311][ T445] RAX: 0000000000000000 RBX: 00007ffc8d794fa0 RCX: 00007f301f4bde59 [ 33.633911][ T473] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 33.647541][ T441] R10: 0000001b32e20000 R11: 0000000000000246 R12: 00007ffd055903b0 [ 33.649509][ T473] CR2: 00007ff580bd0ff8 CR3: 0000000115553000 CR4: 00000000003506a0 [ 33.662322][ T441] R13: 00007f1831703fac R14: 0000000000007ebc R15: 00007f1831703fa0 [ 33.671679][ T445] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 33.671687][ T445] RBP: 0000000000007f6a R08: 0000000000000001 R09: 0000000000000000 [ 33.671695][ T445] R10: 0000001b33220000 R11: 0000000000000246 R12: 00007ffc8d794fe0 [ 33.671703][ T445] R13: 00007f301f745fac R14: 0000000000007f9d R15: 00007f301f745fa0 [ 33.671714][ T445] ---[ end trace aecf4b8e53e17783 ]--- [ 33.672603][ T473] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 33.687977][ T441] ---[ end trace aecf4b8e53e17784 ]--- [ 33.703697][ T473] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 33.748012][ T510] ------------[ cut here ]------------ [ 33.766060][ T514] ------------[ cut here ]------------ [ 33.771836][ T514] WARNING: CPU: 1 PID: 514 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 33.774031][ T510] WARNING: CPU: 0 PID: 510 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 33.790609][ T514] Modules linked in: [ 33.802508][ T510] Modules linked in: [ 33.804958][ T473] Call Trace: [ 33.806569][ T510] CPU: 0 PID: 510 Comm: syz.4.65 Tainted: G B W syzkaller #0 [ 33.811042][ T473] pppol2tp_release+0x150/0x2b0 [ 33.828024][ T514] CPU: 1 PID: 514 Comm: syz.5.67 Tainted: G B W syzkaller #0 [ 33.836064][ T510] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 33.838245][ T514] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 33.847362][ T510] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 33.857458][ T473] sock_close+0xb8/0x200 [ 33.864334][ T510] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 33.868319][ T473] ? sock_mmap+0xa0/0xa0 [ 33.897725][ T514] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 33.904537][ T514] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 33.925658][ T510] RSP: 0018:ffffc90001007d68 EFLAGS: 00010293 [ 33.927403][ T514] RSP: 0018:ffffc90001027d68 EFLAGS: 00010293 [ 33.931962][ T473] __fput+0x2dc/0x730 [ 33.933725][ T510] RAX: ffffffff842e9787 RBX: ffff888116e22000 RCX: ffff888116a9e2c0 [ 33.942079][ T514] [ 33.942090][ T514] RAX: ffffffff842e9787 RBX: ffff888116b8f800 RCX: ffff888116ea4f00 [ 33.942097][ T514] RDX: 0000000000000000 RSI: 00000000163eb8c0 RDI: 000000000c04eb7d [ 33.942106][ T514] RBP: ffffc90001027d88 R08: ffff888116b8f883 R09: 1ffff11022d71f10 [ 33.942113][ T514] R10: dffffc0000000000 R11: ffffed1022d71f11 R12: dffffc0000000000 [ 33.942121][ T514] R13: dffffc0000000000 R14: 00000000163eb8c0 R15: ffff888116811400 [ 33.942131][ T514] FS: 000055557ab2a500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 33.942166][ T514] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 33.977797][ T510] RDX: 0000000000000000 RSI: 0000000016e0b300 RDI: 000000000c04eb7d [ 33.991925][ T473] ____fput+0x15/0x20 [ 34.021782][ T473] task_work_run+0x127/0x190 [ 34.026422][ T473] exit_to_user_mode_loop+0xcb/0xe0 [ 34.031933][ T514] CR2: 00007f183152e57e CR3: 00000001158cf000 CR4: 00000000003506a0 [ 34.039933][ T514] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 34.048582][ T473] exit_to_user_mode_prepare+0x76/0xa0 [ 34.055352][ T473] syscall_exit_to_user_mode+0x1d/0x40 [ 34.061089][ T473] do_syscall_64+0x3d/0x40 [ 34.065548][ T473] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 34.072054][ T514] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 34.082168][ T514] Call Trace: [ 34.085486][ T514] pppol2tp_release+0x150/0x2b0 [ 34.089440][ T510] RBP: ffffc90001007d88 R08: ffff888116e22083 R09: 1ffff11022dc4410 [ 34.091172][ T473] RIP: 0033:0x7f1874ee9e59 [ 34.103102][ T514] sock_close+0xb8/0x200 [ 34.103658][ T510] R10: dffffc0000000000 R11: ffffed1022dc4411 R12: dffffc0000000000 [ 34.107460][ T514] ? sock_mmap+0xa0/0xa0 [ 34.115806][ T510] R13: dffffc0000000000 R14: 0000000016e0b300 R15: ffff8881164e7400 [ 34.121023][ T473] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.148988][ T514] __fput+0x2dc/0x730 [ 34.154403][ T514] ____fput+0x15/0x20 [ 34.158462][ T514] task_work_run+0x127/0x190 [ 34.165193][ T514] exit_to_user_mode_loop+0xcb/0xe0 [ 34.170605][ T514] exit_to_user_mode_prepare+0x76/0xa0 [ 34.176192][ T514] syscall_exit_to_user_mode+0x1d/0x40 [ 34.182094][ T473] RSP: 002b:00007ffc49701518 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 34.194384][ T510] FS: 000055557fb9d500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 34.201009][ T514] do_syscall_64+0x3d/0x40 [ 34.208076][ T514] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 34.219942][ T473] RAX: 0000000000000000 RBX: 00007ffc49701600 RCX: 00007f1874ee9e59 [ 34.228277][ T514] RIP: 0033:0x7f301f4bde59 [ 34.233004][ T473] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 34.247405][ T514] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.252809][ T510] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 34.274975][ T510] CR2: 00007ffd0558ed40 CR3: 0000000116a77000 CR4: 00000000003506b0 [ 34.281761][ T546] ------------[ cut here ]------------ [ 34.284844][ T473] RBP: 00000000000081dd R08: 0000000000000001 R09: 0000000000000000 [ 34.291590][ T546] WARNING: CPU: 1 PID: 546 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 34.297641][ T510] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 34.314789][ T514] RSP: 002b:00007ffc8d794eb8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 34.314805][ T514] RAX: 0000000000000000 RBX: 00007ffc8d794fa0 RCX: 00007f301f4bde59 [ 34.314812][ T514] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 34.314818][ T514] RBP: 00000000000083bd R08: 0000000000000001 R09: 0000000000000000 [ 34.314826][ T514] R10: 0000001b33220000 R11: 0000000000000246 R12: 00007ffc8d794fe0 [ 34.314834][ T514] R13: 00007f301f745fac R14: 00000000000083f9 R15: 00007f301f745fa0 [ 34.314843][ T514] ---[ end trace aecf4b8e53e17785 ]--- [ 34.317956][ T546] Modules linked in: [ 34.326211][ T473] R10: 0000001b32f20000 R11: 0000000000000246 R12: 00007ffc49701640 [ 34.340436][ T546] [ 34.384119][ T510] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 34.393312][ T510] Call Trace: [ 34.396687][ T510] pppol2tp_release+0x150/0x2b0 [ 34.401928][ T473] R13: 00007f1875171fac R14: 0000000000008214 R15: 00007f1875171fa0 [ 34.410025][ T510] sock_close+0xb8/0x200 [ 34.414631][ T550] ------------[ cut here ]------------ [ 34.420135][ T550] WARNING: CPU: 1 PID: 550 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 34.428234][ T510] ? sock_mmap+0xa0/0xa0 [ 34.434724][ T473] ---[ end trace aecf4b8e53e17786 ]--- [ 34.440307][ T510] __fput+0x2dc/0x730 [ 34.441293][ T550] Modules linked in: [ 34.446670][ T510] ____fput+0x15/0x20 [ 34.452689][ T510] task_work_run+0x127/0x190 [ 34.461114][ T546] CPU: 1 PID: 546 Comm: syz.3.83 Tainted: G B W syzkaller #0 [ 34.469647][ T546] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 34.480058][ T550] CPU: 1 PID: 550 Comm: syz.0.85 Tainted: G B W syzkaller #0 [ 34.486317][ T510] exit_to_user_mode_loop+0xcb/0xe0 [ 34.494552][ T510] exit_to_user_mode_prepare+0x76/0xa0 [ 34.498503][ T550] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 34.510734][ T49] device bridge_slave_1 left promiscuous mode [ 34.516895][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.529438][ T546] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 34.534414][ T510] syscall_exit_to_user_mode+0x1d/0x40 [ 34.537852][ T550] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 34.542787][ T510] do_syscall_64+0x3d/0x40 [ 34.548696][ T49] device bridge_slave_0 left promiscuous mode [ 34.553370][ T510] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 34.558686][ T546] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 34.585327][ T550] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 34.599413][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.605845][ T510] RIP: 0033:0x7f8c4e8d6e59 [ 34.617598][ T564] ------------[ cut here ]------------ [ 34.624950][ T550] RSP: 0018:ffffc9000134fd68 EFLAGS: 00010293 [ 34.631361][ T510] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.633718][ T564] WARNING: CPU: 0 PID: 564 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 34.651515][ T546] RSP: 0018:ffffc9000149fd68 EFLAGS: 00010293 [ 34.662176][ T550] RAX: ffffffff842e9787 RBX: ffff88811357b000 RCX: ffff888117f993c0 [ 34.664693][ T564] Modules linked in: [ 34.676387][ T550] RDX: 0000000000000000 RSI: 00000000163eb620 RDI: 000000000c04eb7d [ 34.688445][ T546] [ 34.688517][ T49] device veth1_macvtap left promiscuous mode [ 34.690987][ T546] RAX: ffffffff842e9787 RBX: ffff88811653f000 RCX: ffff888117d4e2c0 2026/07/05 03:12:55 executed programs: 86 [ 34.705066][ T550] RBP: ffffc9000134fd88 R08: ffff88811357b083 R09: 1ffff110226af610 [ 34.708343][ T49] device veth0_vlan left promiscuous mode [ 34.713205][ T550] R10: dffffc0000000000 R11: ffffed10226af611 R12: dffffc0000000000 [ 34.727020][ T546] RDX: 0000000000000000 RSI: 000000002b3f6000 RDI: 000000000c04eb7d [ 34.727577][ T568] ------------[ cut here ]------------ [ 34.735049][ T546] RBP: ffffc9000149fd88 R08: ffff88811653f083 R09: 1ffff11022ca7e10 [ 34.735058][ T546] R10: dffffc0000000000 R11: ffffed1022ca7e11 R12: dffffc0000000000 [ 34.735066][ T546] R13: dffffc0000000000 R14: 000000002b3f6000 R15: ffff888117fe6c00 [ 34.735076][ T546] FS: 000055558f51f500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 34.735084][ T546] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 34.735091][ T546] CR2: 0000200000000000 CR3: 00000001158da000 CR4: 00000000003506a0 [ 34.735102][ T546] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 34.735109][ T546] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 34.744281][ T564] [ 34.749298][ T510] RSP: 002b:00007ffdacbc34f8 EFLAGS: 00000246 [ 34.757935][ T568] WARNING: CPU: 0 PID: 568 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 34.765641][ T550] R13: dffffc0000000000 R14: 00000000163eb620 R15: ffff888116fedc00 [ 34.774670][ T564] CPU: 0 PID: 564 Comm: syz.5.91 Tainted: G B W syzkaller #0 [ 34.780445][ T546] Call Trace: [ 34.788810][ T568] Modules linked in: [ 34.796413][ T550] FS: 000055556d281500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 34.815095][ T564] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 34.822952][ T510] ORIG_RAX: 00000000000001b4 [ 34.850702][ T564] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 34.856052][ T546] pppol2tp_release+0x150/0x2b0 [ 34.867063][ T568] [ 34.870717][ T546] sock_close+0xb8/0x200 [ 34.887591][ T568] CPU: 0 PID: 568 Comm: syz.6.93 Tainted: G B W syzkaller #0 [ 34.888472][ T550] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 34.902720][ T564] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 34.903798][ T546] ? sock_mmap+0xa0/0xa0 [ 34.927469][ T510] RAX: 0000000000000000 RBX: 00007ffdacbc35e0 RCX: 00007f8c4e8d6e59 [ 34.935690][ T550] CR2: 0000200000000000 CR3: 0000000115220000 CR4: 00000000003506a0 [ 34.941403][ T568] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 34.943891][ T510] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 34.957585][ T564] RSP: 0018:ffffc9000126fd68 EFLAGS: 00010293 [ 34.962345][ T546] __fput+0x2dc/0x730 [ 34.971921][ T550] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 34.978529][ T568] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 34.980113][ T546] ____fput+0x15/0x20 [ 34.990479][ T510] RBP: 00000000000083ac R08: 0000000000000001 R09: 0000000000000000 [ 34.990631][ T564] RAX: ffffffff842e9787 RBX: ffff8881152ac800 RCX: ffff8881184613c0 [ 34.998527][ T510] R10: 0000001b33620000 R11: 0000000000000246 R12: 00007ffdacbc3620 [ 35.014684][ T550] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 35.014755][ T568] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 35.022832][ T546] task_work_run+0x127/0x190 [ 35.047015][ T550] Call Trace: [ 35.050325][ T550] pppol2tp_release+0x150/0x2b0 [ 35.055241][ T510] R13: 00007f8c4eb5efac R14: 00000000000083de R15: 00007f8c4eb5efa0 [ 35.055752][ T564] RDX: 0000000000000000 RSI: 000000001792c040 RDI: 000000000c04eb7d [ 35.063719][ T550] sock_close+0xb8/0x200 [ 35.075687][ T510] ---[ end trace aecf4b8e53e17787 ]--- [ 35.081394][ T546] exit_to_user_mode_loop+0xcb/0xe0 [ 35.088066][ T546] exit_to_user_mode_prepare+0x76/0xa0 [ 35.088331][ T564] RBP: ffffc9000126fd88 R08: ffff8881152ac883 R09: 1ffff11022a55910 [ 35.096853][ T550] ? sock_mmap+0xa0/0xa0 [ 35.109658][ T546] syscall_exit_to_user_mode+0x1d/0x40 [ 35.115491][ T568] RSP: 0018:ffffc90001057d68 EFLAGS: 00010293 [ 35.117101][ T550] __fput+0x2dc/0x730 [ 35.129858][ T546] do_syscall_64+0x3d/0x40 [ 35.135225][ T550] ____fput+0x15/0x20 [ 35.139720][ T568] RAX: ffffffff842e9787 RBX: ffff888118678800 RCX: ffff888118460000 [ 35.144496][ T546] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 35.148286][ T564] R10: dffffc0000000000 R11: ffffed1022a55911 R12: dffffc0000000000 [ 35.160186][ T550] task_work_run+0x127/0x190 [ 35.168285][ T546] RIP: 0033:0x7ff580d6fe59 [ 35.176615][ T550] exit_to_user_mode_loop+0xcb/0xe0 [ 35.184776][ T546] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.190699][ T568] RDX: 0000000000000000 RSI: 0000000016c3f600 RDI: 000000000c04eb7d [ 35.212873][ T576] ------------[ cut here ]------------ [ 35.218519][ T550] exit_to_user_mode_prepare+0x76/0xa0 [ 35.220626][ T564] R13: dffffc0000000000 R14: 000000001792c040 R15: ffff888118750c00 [ 35.225673][ T576] WARNING: CPU: 1 PID: 576 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 35.241429][ T564] FS: 000055557ab2a500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 35.243673][ T550] syscall_exit_to_user_mode+0x1d/0x40 [ 35.256670][ T546] RSP: 002b:00007ffeceda3298 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 35.260627][ T568] RBP: ffffc90001057d88 R08: ffff888118678883 R09: 1ffff110230cf110 [ 35.265709][ T576] Modules linked in: [ 35.273180][ T564] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 35.273208][ T564] CR2: 0000200000000000 CR3: 0000000114690000 CR4: 00000000003506b0 [ 35.277686][ T550] do_syscall_64+0x3d/0x40 [ 35.291724][ T568] R10: dffffc0000000000 R11: ffffed10230cf111 R12: dffffc0000000000 [ 35.291734][ T568] R13: dffffc0000000000 R14: 0000000016c3f600 R15: ffff888118273000 [ 35.291776][ T568] FS: 00005555911ce500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 35.297153][ T546] RAX: 0000000000000000 RBX: 00007ffeceda3380 RCX: 00007ff580d6fe59 [ 35.305225][ T564] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 35.312825][ T550] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 35.321915][ T576] [ 35.329819][ T546] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 35.337242][ T568] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 35.343935][ T546] RBP: 00000000000085a8 R08: 0000000000000001 R09: 0000000000000000 [ 35.345695][ T564] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 35.353640][ T550] RIP: 0033:0x7f183147be59 [ 35.368181][ T568] CR2: 0000200000000000 CR3: 0000000116b62000 CR4: 00000000003506b0 [ 35.368194][ T568] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 35.368202][ T568] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 35.368206][ T568] Call Trace: [ 35.368261][ T568] pppol2tp_release+0x150/0x2b0 [ 35.377188][ T546] R10: 0000001b33320000 R11: 0000000000000246 R12: 00007ffeceda33c0 [ 35.381150][ T576] CPU: 0 PID: 576 Comm: syz.4.97 Tainted: G B W syzkaller #0 [ 35.393149][ T546] R13: 00007ff580ff7fac R14: 00000000000085da R15: 00007ff580ff7fa0 [ 35.398820][ T564] Call Trace: [ 35.405306][ T546] ---[ end trace aecf4b8e53e17788 ]--- [ 35.408046][ T568] sock_close+0xb8/0x200 [ 35.413010][ T550] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.423973][ T564] pppol2tp_release+0x150/0x2b0 [ 35.440852][ T568] ? sock_mmap+0xa0/0xa0 [ 35.458574][ T576] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 35.470866][ T550] RSP: 002b:00007ffd05590288 EFLAGS: 00000246 [ 35.480372][ T564] sock_close+0xb8/0x200 [ 35.495639][ T550] ORIG_RAX: 00000000000001b4 [ 35.495648][ T550] RAX: 0000000000000000 RBX: 00007ffd05590370 RCX: 00007f183147be59 [ 35.495656][ T550] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 35.495663][ T550] RBP: 000000000000863d R08: 0000000000000001 R09: 0000000000000000 [ 35.495670][ T550] R10: 0000001b32e20000 R11: 0000000000000246 R12: 00007ffd055903b0 [ 35.495678][ T550] R13: 00007f1831703fac R14: 000000000000867e R15: 00007f1831703fa0 [ 35.495688][ T550] ---[ end trace aecf4b8e53e17789 ]--- [ 35.498789][ T568] __fput+0x2dc/0x730 [ 35.520668][ T564] ? sock_mmap+0xa0/0xa0 [ 35.523888][ T568] ____fput+0x15/0x20 [ 35.540615][ T576] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 35.553801][ T568] task_work_run+0x127/0x190 [ 35.574630][ T564] __fput+0x2dc/0x730 [ 35.576160][ T568] exit_to_user_mode_loop+0xcb/0xe0 [ 35.584313][ T568] exit_to_user_mode_prepare+0x76/0xa0 [ 35.590098][ T568] syscall_exit_to_user_mode+0x1d/0x40 [ 35.595939][ T568] do_syscall_64+0x3d/0x40 [ 35.600313][ T564] ____fput+0x15/0x20 [ 35.606263][ T568] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 35.608730][ T564] task_work_run+0x127/0x190 [ 35.613076][ T568] RIP: 0033:0x7f1874ee9e59 [ 35.622798][ T568] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.638328][ T576] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 35.651830][ T568] RSP: 002b:00007ffc49701518 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 35.674272][ T568] RAX: 0000000000000000 RBX: 00007ffc49701600 RCX: 00007f1874ee9e59 [ 35.682850][ T564] exit_to_user_mode_loop+0xcb/0xe0 [ 35.689171][ T568] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 35.697519][ T568] RBP: 0000000000008786 R08: 0000000000000001 R09: 0000000000000000 [ 35.705973][ T568] R10: 0000001b32f20000 R11: 0000000000000246 R12: 00007ffc49701640 [ 35.712579][ T564] exit_to_user_mode_prepare+0x76/0xa0 [ 35.714863][ T576] RSP: 0018:ffffc900015f7d68 EFLAGS: 00010293 [ 35.725038][ T564] syscall_exit_to_user_mode+0x1d/0x40 [ 35.731109][ T576] RAX: ffffffff842e9787 RBX: ffff8881187c8800 RCX: ffff8881191ea780 [ 35.731118][ T576] RDX: 0000000000000000 RSI: 00000000187cd800 RDI: 000000000c04eb7d [ 35.731127][ T576] RBP: ffffc900015f7d88 R08: ffff8881187c8883 R09: 1ffff110230f9110 [ 35.731136][ T576] R10: dffffc0000000000 R11: ffffed10230f9111 R12: dffffc0000000000 [ 35.731145][ T576] R13: dffffc0000000000 R14: 00000000187cd800 R15: ffff88811934a800 [ 35.731155][ T576] FS: 000055557fb9d500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 35.731190][ T576] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 35.771772][ T564] do_syscall_64+0x3d/0x40 [ 35.788204][ T568] R13: 00007f1875171fac R14: 00000000000087ba R15: 00007f1875171fa0 [ 35.791827][ T564] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 35.799959][ T568] ---[ end trace aecf4b8e53e1778a ]--- [ 35.810282][ T564] RIP: 0033:0x7f301f4bde59 [ 35.811987][ T576] CR2: 00007ff580bd0ff8 CR3: 00000001164db000 CR4: 00000000003506a0 [ 35.831225][ T576] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 35.836822][ T564] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.839278][ T576] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 35.868078][ T576] Call Trace: [ 35.871474][ T576] pppol2tp_release+0x150/0x2b0 [ 35.876349][ T576] sock_close+0xb8/0x200 [ 35.881035][ T576] ? sock_mmap+0xa0/0xa0 [ 35.885350][ T576] __fput+0x2dc/0x730 [ 35.889412][ T576] ____fput+0x15/0x20 [ 35.892418][ T599] ------------[ cut here ]------------ [ 35.893597][ T576] task_work_run+0x127/0x190 [ 35.903518][ T599] WARNING: CPU: 1 PID: 599 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 35.909664][ T576] exit_to_user_mode_loop+0xcb/0xe0 [ 35.922363][ T564] RSP: 002b:00007ffc8d794eb8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 35.927118][ T576] exit_to_user_mode_prepare+0x76/0xa0 [ 35.931040][ T564] RAX: 0000000000000000 RBX: 00007ffc8d794fa0 RCX: 00007f301f4bde59 [ 35.944523][ T599] Modules linked in: [ 35.948462][ T599] CPU: 0 PID: 599 Comm: syz.0.107 Tainted: G B W syzkaller #0 [ 35.957349][ T564] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 35.965389][ T576] syscall_exit_to_user_mode+0x1d/0x40 [ 35.965400][ T576] do_syscall_64+0x3d/0x40 [ 35.965412][ T576] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 35.965421][ T576] RIP: 0033:0x7f8c4e8d6e59 [ 35.965433][ T576] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.965440][ T576] RSP: 002b:00007ffdacbc34f8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 35.965453][ T576] RAX: 0000000000000000 RBX: 00007ffdacbc35e0 RCX: 00007f8c4e8d6e59 [ 35.965460][ T576] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 35.965467][ T576] RBP: 0000000000008951 R08: 0000000000000001 R09: 0000000000000000 [ 35.965475][ T576] R10: 0000001b33620000 R11: 0000000000000246 R12: 00007ffdacbc3620 [ 35.965482][ T576] R13: 00007f8c4eb5efac R14: 0000000000008984 R15: 00007f8c4eb5efa0 [ 35.965492][ T576] ---[ end trace aecf4b8e53e1778b ]--- [ 36.025557][ T599] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 36.035326][ T564] RBP: 000000000000871a R08: 0000000000000001 R09: 0000000000000000 [ 36.067612][ T599] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 36.082751][ T564] R10: 0000001b33220000 R11: 0000000000000246 R12: 00007ffc8d794fe0 [ 36.098989][ T615] ------------[ cut here ]------------ [ 36.110226][ T615] WARNING: CPU: 0 PID: 615 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 36.115810][ T599] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 36.141441][ T564] R13: 00007f301f745fac R14: 000000000000874c R15: 00007f301f745fa0 [ 36.149823][ T615] Modules linked in: [ 36.155860][ T622] ------------[ cut here ]------------ [ 36.161929][ T615] CPU: 0 PID: 615 Comm: syz.3.114 Tainted: G B W syzkaller #0 [ 36.170387][ T599] RSP: 0018:ffffc9000170fd68 EFLAGS: 00010293 [ 36.170762][ T622] WARNING: CPU: 1 PID: 622 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 36.181019][ T564] ---[ end trace aecf4b8e53e1778c ]--- [ 36.188274][ T599] [ 36.197063][ T615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 36.197906][ T599] RAX: ffffffff842e9787 RBX: ffff88811976b000 RCX: ffff888129ed93c0 [ 36.216431][ T626] ------------[ cut here ]------------ [ 36.222167][ T626] WARNING: CPU: 1 PID: 626 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 36.231574][ T615] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 36.232855][ T622] Modules linked in: [ 36.242611][ T599] RDX: 0000000000000000 RSI: 00000000195ce280 RDI: 000000000c04eb7d [ 36.246641][ T615] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 36.254271][ T626] Modules linked in: [ 36.271580][ T615] RSP: 0018:ffffc900017e7d68 EFLAGS: 00010293 [ 36.273201][ T622] CPU: 1 PID: 622 Comm: syz.4.117 Tainted: G B W syzkaller #0 [ 36.276674][ T615] [ 36.281688][ T599] RBP: ffffc9000170fd88 R08: ffff88811976b083 R09: 1ffff110232ed610 [ 36.281697][ T599] R10: dffffc0000000000 R11: ffffed10232ed611 R12: dffffc0000000000 [ 36.281705][ T599] R13: dffffc0000000000 R14: 00000000195ce280 R15: ffff88812d4dec00 [ 36.281717][ T599] FS: 000055556d281500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 36.281725][ T599] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.281733][ T599] CR2: 00007f301f393780 CR3: 00000001195f8000 CR4: 00000000003506a0 [ 36.281744][ T599] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 36.281751][ T599] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 36.281755][ T599] Call Trace: [ 36.281771][ T599] pppol2tp_release+0x150/0x2b0 [ 36.281783][ T599] sock_close+0xb8/0x200 [ 36.281794][ T599] ? sock_mmap+0xa0/0xa0 [ 36.281806][ T599] __fput+0x2dc/0x730 [ 36.281819][ T599] ____fput+0x15/0x20 [ 36.281830][ T599] task_work_run+0x127/0x190 [ 36.281843][ T599] exit_to_user_mode_loop+0xcb/0xe0 [ 36.281854][ T599] exit_to_user_mode_prepare+0x76/0xa0 [ 36.281867][ T599] syscall_exit_to_user_mode+0x1d/0x40 [ 36.281878][ T599] do_syscall_64+0x3d/0x40 [ 36.281889][ T599] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 36.281898][ T599] RIP: 0033:0x7f183147be59 [ 36.281910][ T599] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 36.281917][ T599] RSP: 002b:00007ffd05590288 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 36.281953][ T599] RAX: 0000000000000000 RBX: 00007ffd05590370 RCX: 00007f183147be59 [ 36.346261][ T615] RAX: ffffffff842e9787 RBX: ffff8881157f7000 RCX: ffff8881160d3b40 [ 36.349260][ T626] [ 36.365963][ T615] RDX: 0000000000000000 RSI: 0000000019d5f320 RDI: 000000000c04eb7d [ 36.369983][ T622] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 36.406085][ T615] RBP: ffffc900017e7d88 R08: ffff8881157f7083 R09: 1ffff11022afee10 [ 36.408193][ T626] CPU: 1 PID: 626 Comm: syz.6.119 Tainted: G B W syzkaller #0 [ 36.420710][ T599] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 36.437647][ T626] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 36.437666][ T626] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 36.437678][ T626] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 36.437685][ T626] RSP: 0018:ffffc90001857d68 EFLAGS: 00010293 [ 36.437698][ T626] RAX: ffffffff842e9787 RBX: ffff88811a703800 RCX: ffff88811a3fa780 [ 36.437706][ T626] RDX: 0000000000000000 RSI: 000000001782b400 RDI: 000000000c04eb7d [ 36.437714][ T626] RBP: ffffc90001857d88 R08: ffff88811a703883 R09: 1ffff110234e0710 [ 36.437723][ T626] R10: dffffc0000000000 R11: ffffed10234e0711 R12: dffffc0000000000 [ 36.437756][ T626] R13: dffffc0000000000 R14: 000000001782b400 R15: ffff88811a37c400 [ 36.449923][ T615] R10: dffffc0000000000 R11: ffffed1022afee11 R12: dffffc0000000000 [ 36.455202][ T622] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 36.496409][ T615] R13: dffffc0000000000 R14: 0000000019d5f320 R15: ffff888119d11400 [ 36.503185][ T626] FS: 00005555911ce500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 36.508723][ T615] FS: 000055558f51f500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 36.519203][ T626] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.528797][ T615] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.551121][ T626] CR2: 00007f301f747dac CR3: 0000000113507000 CR4: 00000000003506a0 [ 36.585096][ T615] CR2: 00007ffc8d7950b8 CR3: 0000000118e9c000 CR4: 00000000003506b0 [ 36.589992][ T599] RBP: 0000000000008bf7 R08: 0000000000000001 R09: 0000000000000000 [ 36.629536][ T615] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 36.631570][ T626] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 36.637847][ T622] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 36.644077][ T626] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 36.655420][ T638] ------------[ cut here ]------------ [ 36.659979][ T626] Call Trace: [ 36.668458][ T622] RSP: 0018:ffffc90001007d68 EFLAGS: 00010293 [ 36.675914][ T615] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 36.684985][ T638] WARNING: CPU: 0 PID: 638 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 36.704967][ T599] R10: 0000001b32e20000 R11: 0000000000000246 R12: 00007ffd055903b0 [ 36.714053][ T622] [ 36.717166][ T599] R13: 00007f1831703fac R14: 0000000000008c2c R15: 00007f1831703fa0 [ 36.720390][ T622] RAX: ffffffff842e9787 RBX: ffff88811a1dc000 RCX: ffff88811a01e2c0 [ 36.726556][ T626] pppol2tp_release+0x150/0x2b0 [ 36.726569][ T626] sock_close+0xb8/0x200 [ 36.726580][ T626] ? sock_mmap+0xa0/0xa0 [ 36.726623][ T626] __fput+0x2dc/0x730 [ 36.736573][ T622] RDX: 0000000000000000 RSI: 0000000019d5fae0 RDI: 000000000c04eb7d [ 36.744644][ T599] ---[ end trace aecf4b8e53e1778d ]--- [ 36.753513][ T638] Modules linked in: [ 36.770436][ T626] ____fput+0x15/0x20 [ 36.772087][ T622] RBP: ffffc90001007d88 R08: ffff88811a1dc083 R09: 1ffff1102343b810 [ 36.783206][ T626] task_work_run+0x127/0x190 [ 36.790938][ T622] R10: dffffc0000000000 R11: ffffed102343b811 R12: dffffc0000000000 [ 36.796852][ T615] Call Trace: [ 36.802841][ T638] [ 36.807893][ T615] pppol2tp_release+0x150/0x2b0 [ 36.810191][ T622] R13: dffffc0000000000 R14: 0000000019d5fae0 R15: ffff888119d11000 [ 36.836045][ T615] sock_close+0xb8/0x200 [ 36.853775][ T638] CPU: 0 PID: 638 Comm: syz.5.125 Tainted: G B W syzkaller #0 [ 36.857319][ T626] exit_to_user_mode_loop+0xcb/0xe0 [ 36.868412][ T638] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 36.883781][ T638] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 36.886336][ T626] exit_to_user_mode_prepare+0x76/0xa0 [ 36.890255][ T622] FS: 000055557fb9d500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 36.896234][ T615] ? sock_mmap+0xa0/0xa0 [ 36.905567][ T638] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 36.911581][ T626] syscall_exit_to_user_mode+0x1d/0x40 [ 36.930235][ T622] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.941364][ T638] RSP: 0018:ffffc9000179fd68 EFLAGS: 00010293 [ 36.944625][ T615] __fput+0x2dc/0x730 [ 36.951094][ T638] RAX: ffffffff842e9787 RBX: ffff888118fae800 RCX: ffff88811a5a2780 [ 36.959498][ T615] ____fput+0x15/0x20 [ 36.965509][ T622] CR2: 00007f301f393780 CR3: 000000011a04e000 CR4: 00000000003506b0 [ 36.970614][ T615] task_work_run+0x127/0x190 [ 36.979610][ T615] exit_to_user_mode_loop+0xcb/0xe0 [ 36.984022][ T638] RDX: 0000000000000000 RSI: 0000000017867000 RDI: 000000000c04eb7d [ 36.987852][ T626] do_syscall_64+0x3d/0x40 [ 36.994479][ T622] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 37.008615][ T615] exit_to_user_mode_prepare+0x76/0xa0 [ 37.013261][ T638] RBP: ffffc9000179fd88 R08: ffff888118fae883 R09: 1ffff110231f5d10 [ 37.019472][ T626] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 37.023710][ T638] R10: dffffc0000000000 R11: ffffed10231f5d11 R12: dffffc0000000000 [ 37.036171][ T615] syscall_exit_to_user_mode+0x1d/0x40 [ 37.043998][ T626] RIP: 0033:0x7f1874ee9e59 [ 37.046035][ T622] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 37.053339][ T615] do_syscall_64+0x3d/0x40 [ 37.061018][ T626] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 37.073746][ T638] R13: dffffc0000000000 R14: 0000000017867000 R15: ffff88811a519000 [ 37.081882][ T615] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 37.089942][ T622] Call Trace: [ 37.098300][ T622] pppol2tp_release+0x150/0x2b0 [ 37.101304][ T615] RIP: 0033:0x7ff580d6fe59 [ 37.103898][ T638] FS: 000055557ab2a500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 37.120349][ T626] RSP: 002b:00007ffc49701518 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 37.126059][ T622] sock_close+0xb8/0x200 [ 37.130806][ T615] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 37.134184][ T622] ? sock_mmap+0xa0/0xa0 [ 37.157420][ T638] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.165768][ T626] RAX: 0000000000000000 RBX: 00007ffc49701600 RCX: 00007f1874ee9e59 [ 37.174212][ T638] CR2: 00007f301f393780 CR3: 000000011b010000 CR4: 00000000003506b0 [ 37.183920][ T626] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 37.193281][ T638] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 37.201791][ T622] __fput+0x2dc/0x730 [ 37.205884][ T622] ____fput+0x15/0x20 [ 37.206663][ T615] RSP: 002b:00007ffeceda3298 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 37.218355][ T622] task_work_run+0x127/0x190 [ 37.218368][ T622] exit_to_user_mode_loop+0xcb/0xe0 [ 37.218379][ T622] exit_to_user_mode_prepare+0x76/0xa0 [ 37.218391][ T622] syscall_exit_to_user_mode+0x1d/0x40 [ 37.218401][ T622] do_syscall_64+0x3d/0x40 [ 37.218412][ T622] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 37.218421][ T622] RIP: 0033:0x7f8c4e8d6e59 [ 37.218433][ T622] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 37.218440][ T622] RSP: 002b:00007ffdacbc34f8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 37.218455][ T622] RAX: 0000000000000000 RBX: 00007ffdacbc35e0 RCX: 00007f8c4e8d6e59 [ 37.218462][ T622] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 37.218469][ T622] RBP: 0000000000008d1c R08: 0000000000000001 R09: 0000000000000000 [ 37.218477][ T622] R10: 0000001b33620000 R11: 0000000000000246 R12: 00007ffdacbc3620 [ 37.218503][ T622] R13: 00007f8c4eb5efac R14: 0000000000008d4f R15: 00007f8c4eb5efa0 [ 37.226421][ T626] RBP: 0000000000008d46 R08: 0000000000000001 R09: 0000000000000000 [ 37.233257][ T638] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 37.234943][ T626] R10: 0000001b32f20000 R11: 0000000000000246 R12: 00007ffc49701640 [ 37.239252][ T638] Call Trace: [ 37.243760][ T615] RAX: 0000000000000000 RBX: 00007ffeceda3380 RCX: 00007ff580d6fe59 [ 37.243768][ T615] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 37.243775][ T615] RBP: 0000000000008ce3 R08: 0000000000000001 R09: 0000000000000000 [ 37.243783][ T615] R10: 0000001b33320000 R11: 0000000000000246 R12: 00007ffeceda33c0 [ 37.243792][ T615] R13: 00007ff580ff7fac R14: 0000000000008d16 R15: 00007ff580ff7fa0 [ 37.243801][ T615] ---[ end trace aecf4b8e53e1778e ]--- [ 37.244190][ T626] R13: 00007f1875171fac R14: 0000000000008d8b R15: 00007f1875171fa0 [ 37.259679][ T622] ---[ end trace aecf4b8e53e1778f ]--- [ 37.286646][ T626] ---[ end trace aecf4b8e53e17790 ]--- [ 37.299824][ T638] pppol2tp_release+0x150/0x2b0 [ 37.420289][ T638] sock_close+0xb8/0x200 [ 37.424630][ T638] ? sock_mmap+0xa0/0xa0 [ 37.428918][ T638] __fput+0x2dc/0x730 [ 37.432957][ T638] ____fput+0x15/0x20 [ 37.436960][ T638] task_work_run+0x127/0x190 [ 37.441624][ T638] exit_to_user_mode_loop+0xcb/0xe0 [ 37.446845][ T638] exit_to_user_mode_prepare+0x76/0xa0 [ 37.458758][ T677] ------------[ cut here ]------------ [ 37.465770][ T673] ------------[ cut here ]------------ [ 37.474454][ T677] WARNING: CPU: 1 PID: 677 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 37.485267][ T673] WARNING: CPU: 1 PID: 673 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 37.487351][ T638] syscall_exit_to_user_mode+0x1d/0x40 [ 37.498186][ T677] Modules linked in: [ 37.508006][ T673] Modules linked in: [ 37.513057][ T677] CPU: 1 PID: 677 Comm: syz.4.145 Tainted: G B W syzkaller #0 [ 37.523240][ T673] CPU: 1 PID: 673 Comm: syz.0.144 Tainted: G B W syzkaller #0 [ 37.532690][ T677] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 37.543407][ T673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 37.555056][ T638] do_syscall_64+0x3d/0x40 [ 37.559513][ T638] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 37.560765][ T677] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 37.573757][ T673] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 37.580119][ T673] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 37.601199][ T692] ------------[ cut here ]------------ [ 37.602939][ T677] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 37.606794][ T638] RIP: 0033:0x7f301f4bde59 [ 37.631640][ T692] WARNING: CPU: 0 PID: 692 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 37.639000][ T673] RSP: 0018:ffffc9000170fd68 EFLAGS: 00010293 [ 37.656573][ T677] RSP: 0018:ffffc900018d7d68 EFLAGS: 00010293 [ 37.662751][ T692] Modules linked in: [ 37.663400][ T673] RAX: ffffffff842e9787 RBX: ffff88811c3c3800 RCX: ffff88811c7b13c0 [ 37.666787][ T692] CPU: 0 PID: 692 Comm: syz.3.152 Tainted: G B W syzkaller #0 [ 37.676350][ T697] ------------[ cut here ]------------ [ 37.688927][ T677] RAX: ffffffff842e9787 RBX: ffff88811c3c6800 RCX: ffff88811c7b2780 [ 37.697199][ T673] RDX: 0000000000000000 RSI: 0000000010223220 RDI: 000000000c04eb7d [ 37.697877][ T638] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 37.706464][ T677] RDX: 0000000000000000 RSI: 000000000dc8bb60 RDI: 000000000c04eb7d [ 37.727152][ T692] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 37.735347][ T697] WARNING: CPU: 1 PID: 697 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 37.744561][ T692] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 37.754821][ T673] RBP: ffffc9000170fd88 R08: ffff88811c3c3883 R09: 1ffff11023878710 [ 37.760850][ T638] RSP: 002b:00007ffc8d794eb8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 37.769192][ T697] Modules linked in: [ 37.777101][ T692] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 37.777110][ T673] R10: dffffc0000000000 R11: ffffed1023878711 R12: dffffc0000000000 [ 37.777143][ T673] R13: dffffc0000000000 R14: 0000000010223220 R15: ffff88810ee01c00 [ 37.781166][ T677] RBP: ffffc900018d7d88 R08: ffff88811c3c6883 R09: 1ffff11023878d10 [ 37.801532][ T697] [ 37.808797][ T638] RAX: 0000000000000000 RBX: 00007ffc8d794fa0 RCX: 00007f301f4bde59 [ 37.817167][ T697] CPU: 1 PID: 697 Comm: syz.6.154 Tainted: G B W syzkaller #0 [ 37.824745][ T692] RSP: 0018:ffffc90001bcfd68 EFLAGS: 00010293 [ 37.827466][ T673] FS: 000055556d281500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 37.835093][ T692] [ 37.844222][ T697] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 37.849838][ T638] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 37.859159][ T673] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.861058][ T677] R10: dffffc0000000000 R11: ffffed1023878d11 R12: dffffc0000000000 [ 37.861094][ T677] R13: dffffc0000000000 R14: 000000000dc8bb60 R15: ffff88810ee00c00 [ 37.871777][ T697] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 37.879216][ T638] RBP: 0000000000008ef5 R08: 0000000000000001 R09: 0000000000000000 [ 37.886381][ T673] CR2: 0000200000000000 CR3: 00000001165d6000 CR4: 00000000003506a0 [ 37.894706][ T692] RAX: ffffffff842e9787 RBX: ffff88811c689000 RCX: ffff88811cf393c0 [ 37.902666][ T697] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 37.908401][ T692] RDX: 0000000000000000 RSI: 0000000019e6c1a0 RDI: 000000000c04eb7d [ 37.916830][ T673] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 37.932387][ T638] R10: 0000001b33220000 R11: 0000000000000246 R12: 00007ffc8d794fe0 [ 37.952974][ T697] RSP: 0018:ffffc90001bf7d68 EFLAGS: 00010293 [ 37.967999][ T677] FS: 000055557fb9d500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 37.968008][ T677] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.968023][ T677] CR2: 00007ffe924d0c34 CR3: 0000000116874000 CR4: 00000000003506b0 [ 37.968034][ T677] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 37.968042][ T677] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 37.968045][ T677] Call Trace: [ 37.968062][ T677] pppol2tp_release+0x150/0x2b0 [ 37.968074][ T677] sock_close+0xb8/0x200 [ 37.968084][ T677] ? sock_mmap+0xa0/0xa0 [ 37.968096][ T677] __fput+0x2dc/0x730 [ 37.968109][ T677] ____fput+0x15/0x20 [ 37.968120][ T677] task_work_run+0x127/0x190 [ 37.968133][ T677] exit_to_user_mode_loop+0xcb/0xe0 [ 37.968145][ T677] exit_to_user_mode_prepare+0x76/0xa0 [ 37.968157][ T677] syscall_exit_to_user_mode+0x1d/0x40 [ 37.968168][ T677] do_syscall_64+0x3d/0x40 [ 37.968180][ T677] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 37.968189][ T677] RIP: 0033:0x7f8c4e8d6e59 [ 37.968202][ T677] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 37.968209][ T677] RSP: 002b:00007ffdacbc34f8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 37.979236][ T697] [ 37.991349][ T692] RBP: ffffc90001bcfd88 R08: ffff88811c689083 R09: 1ffff110238d1210 [ 37.998540][ T673] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 38.013957][ T638] R13: 00007f301f745fac R14: 0000000000008f28 R15: 00007f301f745fa0 [ 38.013979][ T638] ---[ end trace aecf4b8e53e17791 ]--- [ 38.022600][ T697] RAX: ffffffff842e9787 RBX: ffff88811d17d000 RCX: ffff88811b2b4f00 [ 38.034364][ T677] RAX: 0000000000000000 RBX: 00007ffdacbc35e0 RCX: 00007f8c4e8d6e59 [ 38.034373][ T677] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 38.034380][ T677] RBP: 0000000000009232 R08: 0000000000000001 R09: 0000000000000000 [ 38.034411][ T677] R10: 0000001b33620000 R11: 0000000000000246 R12: 00007ffdacbc3620 [ 38.039585][ T697] RDX: 0000000000000000 RSI: 000000001ac22770 RDI: 000000000c04eb7d [ 38.080303][ T677] R13: 00007f8c4eb5efac R14: 0000000000009265 R15: 00007f8c4eb5efa0 [ 38.082934][ T692] R10: dffffc0000000000 R11: ffffed10238d1211 R12: dffffc0000000000 [ 38.107910][ T677] ---[ end trace aecf4b8e53e17792 ]--- [ 38.113012][ T673] Call Trace: [ 38.114225][ T697] RBP: ffffc90001bf7d88 R08: ffff88811d17d083 R09: 1ffff11023a2fa10 [ 38.127928][ T673] pppol2tp_release+0x150/0x2b0 [ 38.179011][ T697] R10: dffffc0000000000 R11: ffffed1023a2fa11 R12: dffffc0000000000 [ 38.184555][ T692] R13: dffffc0000000000 R14: 0000000019e6c1a0 R15: ffff88811ceed400 [ 38.245905][ T673] sock_close+0xb8/0x200 [ 38.250323][ T673] ? sock_mmap+0xa0/0xa0 [ 38.254794][ T673] __fput+0x2dc/0x730 [ 38.258862][ T673] ____fput+0x15/0x20 [ 38.263200][ T673] task_work_run+0x127/0x190 [ 38.267940][ T673] exit_to_user_mode_loop+0xcb/0xe0 [ 38.273441][ T673] exit_to_user_mode_prepare+0x76/0xa0 [ 38.279353][ T673] syscall_exit_to_user_mode+0x1d/0x40 [ 38.285318][ T673] do_syscall_64+0x3d/0x40 [ 38.289760][ T673] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 38.290760][ T697] R13: dffffc0000000000 R14: 000000001ac22770 R15: ffff88811cde1800 [ 38.296465][ T692] FS: 000055558f51f500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 38.314280][ T697] FS: 00005555911ce500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 38.320659][ T673] RIP: 0033:0x7f183147be59 [ 38.331717][ T673] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 38.360770][ T692] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 38.370963][ T697] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 38.376360][ T692] CR2: 00007f8c4e737ff8 CR3: 000000011cf74000 CR4: 00000000003506a0 [ 38.377584][ T697] CR2: 0000200000000000 CR3: 000000011d3ec000 CR4: 00000000003506b0 [ 38.377596][ T697] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 38.377624][ T697] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 38.395912][ T673] RSP: 002b:00007ffd05590288 EFLAGS: 00000246 [ 38.412629][ T692] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 38.416010][ T697] Call Trace: [ 38.423671][ T692] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 38.442703][ T673] ORIG_RAX: 00000000000001b4 [ 38.447413][ T673] RAX: 0000000000000000 RBX: 00007ffd05590370 RCX: 00007f183147be59 [ 38.459280][ T697] pppol2tp_release+0x150/0x2b0 [ 38.466967][ T692] Call Trace: [ 38.470364][ T673] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 38.474131][ T697] sock_close+0xb8/0x200 [ 38.487176][ T692] pppol2tp_release+0x150/0x2b0 [ 38.497086][ T673] RBP: 000000000000922e R08: 0000000000000001 R09: 0000000000000000 [ 38.505353][ T731] ------------[ cut here ]------------ [ 38.506498][ T692] sock_close+0xb8/0x200 [ 38.515655][ T697] ? sock_mmap+0xa0/0xa0 [ 38.519941][ T697] __fput+0x2dc/0x730 [ 38.524108][ T692] ? sock_mmap+0xa0/0xa0 [ 38.530289][ T673] R10: 0000001b32e20000 R11: 0000000000000246 R12: 00007ffd055903b0 [ 38.533057][ T731] WARNING: CPU: 0 PID: 731 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 38.543300][ T692] __fput+0x2dc/0x730 [ 38.551793][ T697] ____fput+0x15/0x20 [ 38.557569][ T673] R13: 00007f1831703fac R14: 0000000000009265 R15: 00007f1831703fa0 [ 38.571336][ T692] ____fput+0x15/0x20 [ 38.574936][ T697] task_work_run+0x127/0x190 [ 38.575544][ T692] task_work_run+0x127/0x190 [ 38.580111][ T697] exit_to_user_mode_loop+0xcb/0xe0 [ 38.580122][ T697] exit_to_user_mode_prepare+0x76/0xa0 [ 38.580167][ T697] syscall_exit_to_user_mode+0x1d/0x40 [ 38.595839][ T673] ---[ end trace aecf4b8e53e17793 ]--- [ 38.602857][ T731] Modules linked in: [ 38.610464][ T731] CPU: 0 PID: 731 Comm: syz.5.171 Tainted: G B W syzkaller #0 [ 38.619530][ T697] do_syscall_64+0x3d/0x40 [ 38.630381][ T692] exit_to_user_mode_loop+0xcb/0xe0 [ 38.638923][ T731] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 38.646014][ T692] exit_to_user_mode_prepare+0x76/0xa0 [ 38.656858][ T697] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 38.667731][ T731] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 38.674744][ T697] RIP: 0033:0x7f1874ee9e59 [ 38.676045][ T692] syscall_exit_to_user_mode+0x1d/0x40 [ 38.679259][ T697] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 38.691209][ T749] ------------[ cut here ]------------ [ 38.712202][ T692] do_syscall_64+0x3d/0x40 [ 38.715647][ T731] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 38.716740][ T692] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 38.737372][ T731] RSP: 0018:ffffc90001dcfd68 EFLAGS: 00010293 [ 38.748469][ T697] RSP: 002b:00007ffc49701518 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 38.751039][ T749] WARNING: CPU: 1 PID: 749 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 38.767685][ T731] RAX: ffffffff842e9787 RBX: ffff88811d6b4000 RCX: ffff88811c46e2c0 [ 38.771328][ T749] Modules linked in: [ 38.780095][ T697] RAX: 0000000000000000 RBX: 00007ffc49701600 RCX: 00007f1874ee9e59 [ 38.780140][ T692] RIP: 0033:0x7ff580d6fe59 [ 38.788914][ T753] ------------[ cut here ]------------ [ 38.796468][ T749] CPU: 1 PID: 749 Comm: syz.0.180 Tainted: G B W syzkaller #0 [ 38.798225][ T697] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 38.810476][ T692] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 38.815431][ T753] WARNING: CPU: 0 PID: 753 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 38.834995][ T749] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 38.844522][ T731] RDX: 0000000000000000 RSI: 000000001d650000 RDI: 000000000c04eb7d [ 38.844531][ T731] RBP: ffffc90001dcfd88 R08: ffff88811d6b4083 R09: 1ffff11023ad6810 [ 38.844569][ T731] R10: dffffc0000000000 R11: ffffed1023ad6811 R12: dffffc0000000000 [ 38.855711][ T749] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 38.862636][ T697] RBP: 00000000000092f9 R08: 0000000000000001 R09: 0000000000000000 [ 38.862675][ T697] R10: 0000001b32f20000 R11: 0000000000000246 R12: 00007ffc49701640 [ 38.871325][ T692] RSP: 002b:00007ffeceda3298 EFLAGS: 00000246 [ 38.878661][ T731] R13: dffffc0000000000 R14: 000000001d650000 R15: ffff88811c648800 [ 38.885557][ T749] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 38.893148][ T753] Modules linked in: [ 38.901814][ T692] ORIG_RAX: 00000000000001b4 [ 38.907134][ T697] R13: 00007f1875171fac R14: 000000000000932c R15: 00007f1875171fa0 [ 38.915696][ T692] RAX: 0000000000000000 RBX: 00007ffeceda3380 RCX: 00007ff580d6fe59 [ 38.934787][ T731] FS: 000055557ab2a500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 38.939234][ T749] RSP: 0018:ffffc9000170fd68 EFLAGS: 00010293 [ 38.943331][ T753] [ 38.951845][ T749] [ 38.959347][ T731] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 38.968851][ T692] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 38.974402][ T753] CPU: 0 PID: 753 Comm: syz.4.182 Tainted: G B W syzkaller #0 [ 38.977088][ T692] RBP: 00000000000092ba R08: 0000000000000001 R09: 0000000000000000 [ 38.979045][ T753] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 38.979063][ T753] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 38.979104][ T753] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 38.986373][ T749] RAX: ffffffff842e9787 RBX: ffff88811db11800 RCX: ffff88811d2093c0 [ 38.993682][ T697] ---[ end trace aecf4b8e53e17794 ]--- [ 39.002854][ T692] R10: 0000001b33320000 R11: 0000000000000246 R12: 00007ffeceda33c0 [ 39.010264][ T731] CR2: 0000200000000000 CR3: 000000011a40a000 CR4: 00000000003506b0 [ 39.020901][ T749] RDX: 0000000000000000 RSI: 000000001be415b0 RDI: 000000000c04eb7d [ 39.026742][ T753] RSP: 0018:ffffc90001eafd68 EFLAGS: 00010293 [ 39.046891][ T692] R13: 00007ff580ff7fac R14: 00000000000092f4 R15: 00007ff580ff7fa0 [ 39.054729][ T731] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 39.070630][ T692] ---[ end trace aecf4b8e53e17795 ]--- [ 39.092423][ T731] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 39.105111][ T749] RBP: ffffc9000170fd88 R08: ffff88811db11883 R09: 1ffff11023b62310 [ 39.106810][ T753] [ 39.114136][ T749] R10: dffffc0000000000 R11: ffffed1023b62311 R12: dffffc0000000000 [ 39.119775][ T731] Call Trace: [ 39.129208][ T749] R13: dffffc0000000000 R14: 000000001be415b0 R15: ffff888107bbdc00 [ 39.144685][ T753] RAX: ffffffff842e9787 RBX: ffff88811bb1c800 RCX: ffff88811d3d62c0 [ 39.169825][ T749] FS: 000055556d281500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 39.182851][ T731] pppol2tp_release+0x150/0x2b0 [ 39.187747][ T731] sock_close+0xb8/0x200 [ 39.189610][ T749] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 39.215418][ T771] ------------[ cut here ]------------ [ 39.221028][ T753] RDX: 0000000000000000 RSI: 000000001855be00 RDI: 000000000c04eb7d [ 39.223985][ T749] CR2: 00007ffc49700ca0 CR3: 0000000119723000 CR4: 00000000003506a0 [ 39.229057][ T753] RBP: ffffc90001eafd88 R08: ffff88811bb1c883 R09: 1ffff11023763910 [ 39.245167][ T771] WARNING: CPU: 1 PID: 771 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 39.250926][ T731] ? sock_mmap+0xa0/0xa0 [ 39.261344][ T773] ------------[ cut here ]------------ [ 39.262984][ T731] __fput+0x2dc/0x730 [ 39.267056][ T749] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 39.270890][ T731] ____fput+0x15/0x20 [ 39.279792][ T771] Modules linked in: [ 39.282961][ T753] R10: dffffc0000000000 R11: ffffed1023763911 R12: dffffc0000000000 [ 39.283177][ T771] [ 39.286899][ T753] R13: dffffc0000000000 R14: 000000001855be00 R15: ffff8881079f2800 [ 39.295845][ T773] WARNING: CPU: 1 PID: 773 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 39.297476][ T731] task_work_run+0x127/0x190 [ 39.305874][ T749] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 39.315402][ T771] CPU: 0 PID: 771 Comm: syz.3.191 Tainted: G B W syzkaller #0 [ 39.320401][ T773] Modules linked in: [ 39.327931][ T753] FS: 000055557fb9d500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 39.327940][ T753] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 39.327975][ T753] CR2: 00007f1874dafda0 CR3: 000000011d984000 CR4: 00000000003506b0 [ 39.337713][ T749] Call Trace: [ 39.340646][ T731] exit_to_user_mode_loop+0xcb/0xe0 [ 39.350046][ T773] [ 39.356082][ T753] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 39.364534][ T749] pppol2tp_release+0x150/0x2b0 [ 39.368251][ T771] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 39.372899][ T749] sock_close+0xb8/0x200 [ 39.374877][ T731] exit_to_user_mode_prepare+0x76/0xa0 [ 39.374924][ T731] syscall_exit_to_user_mode+0x1d/0x40 [ 39.383489][ T773] CPU: 1 PID: 773 Comm: syz.6.192 Tainted: G B W syzkaller #0 [ 39.387833][ T753] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 39.398378][ T749] ? sock_mmap+0xa0/0xa0 [ 39.402262][ T771] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 39.407958][ T749] __fput+0x2dc/0x730 [ 39.413124][ T731] do_syscall_64+0x3d/0x40 [ 39.422126][ T773] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 39.429747][ T753] Call Trace: [ 39.434422][ T749] ____fput+0x15/0x20 [ 39.440372][ T771] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 39.444795][ T773] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 39.448730][ T731] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 39.459270][ T749] task_work_run+0x127/0x190 [ 39.462159][ T753] pppol2tp_release+0x150/0x2b0 [ 39.466460][ T749] exit_to_user_mode_loop+0xcb/0xe0 [ 39.485755][ T771] RSP: 0018:ffffc90001f37d68 EFLAGS: 00010293 [ 39.485767][ T771] RAX: ffffffff842e9787 RBX: ffff88811bb17800 RCX: ffff88810739cf00 [ 39.485775][ T771] RDX: 0000000000000000 RSI: 000000001d24da20 RDI: 000000000c04eb7d [ 39.485784][ T771] RBP: ffffc90001f37d88 R08: ffff88811bb17883 R09: 1ffff11023762f10 [ 39.485793][ T771] R10: dffffc0000000000 R11: ffffed1023762f11 R12: dffffc0000000000 [ 39.485800][ T771] R13: dffffc0000000000 R14: 000000001d24da20 R15: ffff88811cd73800 [ 39.485811][ T771] FS: 000055558f51f500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 39.485820][ T771] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 39.485829][ T771] CR2: 00007f428f460492 CR3: 000000012114f000 CR4: 00000000003506b0 [ 39.485840][ T771] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 39.485848][ T771] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 39.485851][ T771] Call Trace: [ 39.485864][ T771] pppol2tp_release+0x150/0x2b0 [ 39.485912][ T771] sock_close+0xb8/0x200 [ 39.494525][ T773] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 39.498395][ T731] RIP: 0033:0x7f301f4bde59 [ 39.503394][ T773] RSP: 0018:ffffc90001bf7d68 EFLAGS: 00010293 [ 39.507798][ T771] ? sock_mmap+0xa0/0xa0 [ 39.513639][ T749] exit_to_user_mode_prepare+0x76/0xa0 [ 39.519127][ T731] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 39.527629][ T773] [ 39.535092][ T771] __fput+0x2dc/0x730 [ 39.543594][ T749] syscall_exit_to_user_mode+0x1d/0x40 [ 39.551138][ T753] sock_close+0xb8/0x200 [ 39.559539][ T773] RAX: ffffffff842e9787 RBX: ffff88811bb14800 RCX: ffff888107398000 [ 39.567995][ T731] RSP: 002b:00007ffc8d794eb8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 39.575501][ T749] do_syscall_64+0x3d/0x40 [ 39.582845][ T771] ____fput+0x15/0x20 [ 39.591171][ T773] RDX: 0000000000000000 RSI: 000000001d24dc20 RDI: 000000000c04eb7d [ 39.598717][ T753] ? sock_mmap+0xa0/0xa0 [ 39.602445][ T749] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 39.606799][ T753] __fput+0x2dc/0x730 [ 39.611349][ T749] RIP: 0033:0x7f183147be59 [ 39.630703][ T731] RAX: 0000000000000000 RBX: 00007ffc8d794fa0 RCX: 00007f301f4bde59 [ 39.630733][ T731] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 39.630757][ T731] RBP: 0000000000009640 R08: 0000000000000001 R09: 0000000000000000 [ 39.635314][ T771] task_work_run+0x127/0x190 [ 39.641654][ T731] R10: 0000001b33220000 R11: 0000000000000246 R12: 00007ffc8d794fe0 [ 39.649583][ T773] RBP: ffffc90001bf7d88 R08: ffff88811bb14883 R09: 1ffff11023762910 [ 39.651013][ T731] R13: 00007f301f745fac R14: 0000000000009672 R15: 00007f301f745fa0 2026/07/05 03:13:00 executed programs: 186 [ 39.671053][ T771] exit_to_user_mode_loop+0xcb/0xe0 [ 39.673137][ T749] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 39.677039][ T771] exit_to_user_mode_prepare+0x76/0xa0 [ 39.682561][ T753] ____fput+0x15/0x20 [ 39.695398][ T771] syscall_exit_to_user_mode+0x1d/0x40 [ 39.703308][ T749] RSP: 002b:00007ffd05590288 EFLAGS: 00000246 [ 39.719694][ T771] do_syscall_64+0x3d/0x40 [ 39.724057][ T731] ---[ end trace aecf4b8e53e17796 ]--- [ 39.733883][ T773] R10: dffffc0000000000 R11: ffffed1023762911 R12: dffffc0000000000 [ 39.738608][ T753] task_work_run+0x127/0x190 [ 39.746719][ T771] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 39.772596][ T753] exit_to_user_mode_loop+0xcb/0xe0 [ 39.785697][ T773] R13: dffffc0000000000 R14: 000000001d24dc20 R15: ffff888106de8800 [ 39.796889][ T749] ORIG_RAX: 00000000000001b4 [ 39.819901][ T773] FS: 00005555911ce500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 39.823239][ T753] exit_to_user_mode_prepare+0x76/0xa0 [ 39.827082][ T771] RIP: 0033:0x7ff580d6fe59 [ 39.832424][ T753] syscall_exit_to_user_mode+0x1d/0x40 [ 39.837456][ T773] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 39.841872][ T753] do_syscall_64+0x3d/0x40 [ 39.846849][ T771] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 39.855366][ T753] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 39.859762][ T773] CR2: 00007f301f747dac CR3: 000000011e5a8000 CR4: 00000000003506a0 [ 39.865907][ T749] RAX: 0000000000000000 RBX: 00007ffd05590370 RCX: 00007f183147be59 [ 39.872066][ T771] RSP: 002b:00007ffeceda3298 EFLAGS: 00000246 [ 39.891501][ T753] RIP: 0033:0x7f8c4e8d6e59 [ 39.892863][ T773] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 39.914301][ T753] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 39.918984][ T771] ORIG_RAX: 00000000000001b4 [ 39.950599][ T749] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 39.958888][ T773] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 39.969505][ T749] RBP: 00000000000096ec R08: 0000000000000001 R09: 0000000000000000 [ 39.976469][ T773] Call Trace: [ 39.991918][ T753] RSP: 002b:00007ffdacbc34f8 EFLAGS: 00000246 [ 40.004751][ T771] RAX: 0000000000000000 RBX: 00007ffeceda3380 RCX: 00007ff580d6fe59 [ 40.012454][ T749] R10: 0000001b32e20000 R11: 0000000000000246 R12: 00007ffd055903b0 [ 40.020270][ T773] pppol2tp_release+0x150/0x2b0 [ 40.028816][ T753] ORIG_RAX: 00000000000001b4 [ 40.032263][ T771] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 40.037993][ T753] RAX: 0000000000000000 RBX: 00007ffdacbc35e0 RCX: 00007f8c4e8d6e59 [ 40.045699][ T773] sock_close+0xb8/0x200 [ 40.053933][ T749] R13: 00007f1831703fac R14: 0000000000009727 R15: 00007f1831703fa0 [ 40.058500][ T773] ? sock_mmap+0xa0/0xa0 [ 40.063004][ T753] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 40.071283][ T771] RBP: 0000000000009910 R08: 0000000000000001 R09: 0000000000000000 [ 40.082314][ T749] ---[ end trace aecf4b8e53e17797 ]--- [ 40.093779][ T773] __fput+0x2dc/0x730 [ 40.109283][ T753] RBP: 000000000000975c R08: 0000000000000001 R09: 0000000000000000 [ 40.120749][ T771] R10: 0000001b33320000 R11: 0000000000000246 R12: 00007ffeceda33c0 [ 40.120758][ T771] R13: 00007ff580ff7fac R14: 0000000000009942 R15: 00007ff580ff7fa0 [ 40.120768][ T771] ---[ end trace aecf4b8e53e17798 ]--- [ 40.150464][ T773] ____fput+0x15/0x20 [ 40.156623][ T786] ------------[ cut here ]------------ [ 40.162427][ T773] task_work_run+0x127/0x190 [ 40.167280][ T786] WARNING: CPU: 1 PID: 786 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 40.181447][ T773] exit_to_user_mode_loop+0xcb/0xe0 [ 40.186746][ T773] exit_to_user_mode_prepare+0x76/0xa0 [ 40.195139][ T753] R10: 0000001b33620000 R11: 0000000000000246 R12: 00007ffdacbc3620 [ 40.201230][ T786] Modules linked in: [ 40.209165][ T786] CPU: 1 PID: 786 Comm: syz.0.199 Tainted: G B W syzkaller #0 [ 40.218190][ T791] ------------[ cut here ]------------ [ 40.220403][ T773] syscall_exit_to_user_mode+0x1d/0x40 [ 40.224332][ T791] WARNING: CPU: 0 PID: 791 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 40.233878][ T786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 40.239718][ T753] R13: 00007f8c4eb5efac R14: 000000000000978f R15: 00007f8c4eb5efa0 [ 40.258050][ T773] do_syscall_64+0x3d/0x40 [ 40.262794][ T786] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 40.269198][ T773] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 40.275282][ T791] Modules linked in: [ 40.275950][ T786] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 40.279231][ T791] CPU: 0 PID: 791 Comm: syz.3.202 Tainted: G B W syzkaller #0 [ 40.299602][ T773] RIP: 0033:0x7f1874ee9e59 [ 40.309841][ T753] ---[ end trace aecf4b8e53e17799 ]--- [ 40.318661][ T773] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 40.335448][ T791] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 40.347078][ T786] RSP: 0018:ffffc90001e7fd68 EFLAGS: 00010293 [ 40.356468][ T786] RAX: ffffffff842e9787 RBX: ffff88810acb2000 RCX: ffff88810ab7bb40 [ 40.366046][ T799] ------------[ cut here ]------------ [ 40.371740][ T773] RSP: 002b:00007ffc49701518 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 40.379270][ T791] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 40.380691][ T786] RDX: 0000000000000000 RSI: 000000001d24d2e0 RDI: 000000000c04eb7d [ 40.387474][ T791] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 40.394996][ T773] RAX: 0000000000000000 RBX: 00007ffc49701600 RCX: 00007f1874ee9e59 [ 40.415077][ T799] WARNING: CPU: 0 PID: 799 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 40.422581][ T786] RBP: ffffc90001e7fd88 R08: ffff88810acb2083 R09: 1ffff11021596410 [ 40.434183][ T799] Modules linked in: [ 40.441293][ T786] R10: dffffc0000000000 R11: ffffed1021596411 R12: dffffc0000000000 [ 40.444911][ T791] RSP: 0018:ffffc9000209fd68 EFLAGS: 00010293 [ 40.455957][ T773] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 40.459392][ T799] CPU: 0 PID: 799 Comm: syz.4.205 Tainted: G B W syzkaller #0 [ 40.467048][ T786] R13: dffffc0000000000 R14: 000000001d24d2e0 R15: ffff88811e173800 [ 40.483112][ T773] RBP: 000000000000993d R08: 0000000000000001 R09: 0000000000000000 [ 40.488899][ T791] RAX: ffffffff842e9787 RBX: ffff88810b030000 RCX: ffff88812c1d62c0 [ 40.499590][ T773] R10: 0000001b32f20000 R11: 0000000000000246 R12: 00007ffc49701640 [ 40.504090][ T791] RDX: 0000000000000000 RSI: 000000000aca0be0 RDI: 000000000c04eb7d [ 40.515876][ T799] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 40.516986][ T786] FS: 000055556d281500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 40.535201][ T773] R13: 00007f1875171fac R14: 0000000000009970 R15: 00007f1875171fa0 [ 40.543372][ T773] ---[ end trace aecf4b8e53e1779a ]--- [ 40.543937][ T791] RBP: ffffc9000209fd88 R08: ffff88810b030083 R09: 1ffff11021606010 [ 40.556996][ T786] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 40.566980][ T799] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 40.571164][ T786] CR2: 00007f301f393780 CR3: 00000001165d1000 CR4: 00000000003506a0 [ 40.573949][ T791] R10: dffffc0000000000 R11: ffffed1021606011 R12: dffffc0000000000 [ 40.582354][ T805] ------------[ cut here ]------------ [ 40.590433][ T799] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 40.601327][ T786] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 40.616893][ T791] R13: dffffc0000000000 R14: 000000000aca0be0 R15: ffff88812e02a800 [ 40.623519][ T805] WARNING: CPU: 1 PID: 805 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 40.641058][ T805] Modules linked in: [ 40.645897][ T786] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 40.651125][ T791] FS: 000055558f51f500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 40.659396][ T805] CPU: 1 PID: 805 Comm: syz.6.209 Tainted: G B W syzkaller #0 [ 40.663732][ T799] RSP: 0018:ffffc900020efd68 EFLAGS: 00010293 [ 40.672185][ T809] ------------[ cut here ]------------ [ 40.677809][ T799] RAX: ffffffff842e9787 RBX: ffff88810abd6000 RCX: ffff88812e4a62c0 [ 40.686633][ T786] Call Trace: [ 40.693273][ T791] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 40.696567][ T805] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 40.702553][ T791] CR2: 00007ffc8d7950b8 CR3: 000000011df2c000 CR4: 00000000003506b0 [ 40.711815][ T786] pppol2tp_release+0x150/0x2b0 [ 40.720294][ T799] RDX: 0000000000000000 RSI: 0000000016345040 RDI: 000000000c04eb7d [ 40.724689][ T809] WARNING: CPU: 1 PID: 809 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 40.733210][ T791] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 40.743256][ T805] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 40.751216][ T799] RBP: ffffc900020efd88 R08: ffff88810abd6083 R09: 1ffff1102157ac10 [ 40.757145][ T786] sock_close+0xb8/0x200 [ 40.769499][ T791] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 40.769764][ T805] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 40.797236][ T809] Modules linked in: [ 40.797366][ T791] Call Trace: [ 40.801571][ T809] CPU: 1 PID: 809 Comm: syz.5.210 Tainted: G B W syzkaller #0 [ 40.804687][ T799] R10: dffffc0000000000 R11: ffffed102157ac11 R12: dffffc0000000000 [ 40.813494][ T786] ? sock_mmap+0xa0/0xa0 [ 40.821429][ T791] pppol2tp_release+0x150/0x2b0 [ 40.825748][ T809] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 40.840418][ T791] sock_close+0xb8/0x200 [ 40.840746][ T786] __fput+0x2dc/0x730 [ 40.844899][ T791] ? sock_mmap+0xa0/0xa0 [ 40.848721][ T786] ____fput+0x15/0x20 [ 40.853021][ T799] R13: dffffc0000000000 R14: 0000000016345040 R15: ffff88812a751000 [ 40.857503][ T805] RSP: 0018:ffffc90002127d68 EFLAGS: 00010293 [ 40.865256][ T791] __fput+0x2dc/0x730 [ 40.871493][ T786] task_work_run+0x127/0x190 [ 40.875393][ T791] ____fput+0x15/0x20 [ 40.879724][ T786] exit_to_user_mode_loop+0xcb/0xe0 [ 40.884288][ T799] FS: 000055557fb9d500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 40.889423][ T809] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 40.898407][ T791] task_work_run+0x127/0x190 [ 40.904324][ T805] RAX: ffffffff842e9787 RBX: ffff88810abf4000 RCX: ffff88812e4a13c0 [ 40.909326][ T791] exit_to_user_mode_loop+0xcb/0xe0 [ 40.916898][ T805] RDX: 0000000000000000 RSI: 0000000016345b20 RDI: 000000000c04eb7d [ 40.922685][ T799] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 40.930219][ T786] exit_to_user_mode_prepare+0x76/0xa0 [ 40.937162][ T791] exit_to_user_mode_prepare+0x76/0xa0 [ 40.942236][ T809] Code: 5d c3 e8 0c 0b 36 fd be 02 00 00 00 eb 0a e8 00 0b 36 fd be 01 00 00 00 4c 89 f7 e8 73 75 0f fe e9 0f ff ff ff e8 e9 0a 36 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 d8 0a 36 fd 4c 89 f7 be 03 [ 40.942273][ T809] RSP: 0018:ffffc90002177d68 EFLAGS: 00010293 [ 40.948246][ T799] CR2: 00007ffc8d7950b8 CR3: 000000011d018000 CR4: 00000000003506b0 [ 40.967356][ T805] RBP: ffffc90002127d88 R08: ffff88810abf4083 R09: 1ffff1102157e810 [ 40.967365][ T805] R10: dffffc0000000000 R11: ffffed102157e811 R12: dffffc0000000000 [ 40.967406][ T805] R13: dffffc0000000000 R14: 0000000016345b20 R15: ffff888129eb5000 [ 40.974341][ T791] syscall_exit_to_user_mode+0x1d/0x40 [ 40.981563][ T786] syscall_exit_to_user_mode+0x1d/0x40 [ 40.990027][ T791] do_syscall_64+0x3d/0x40 [ 40.997594][ T786] do_syscall_64+0x3d/0x40 [ 41.006557][ T799] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 41.011176][ T805] FS: 00005555911ce500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 41.017171][ T799] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 41.021007][ T809] [ 41.025830][ T799] Call Trace: [ 41.033522][ T786] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 41.043071][ T791] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 41.050472][ T805] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.053468][ T791] RIP: 0033:0x7ff580d6fe59 [ 41.056057][ T805] CR2: 00007f301f393780 CR3: 000000011f169000 CR4: 00000000003506a0 [ 41.062374][ T799] pppol2tp_release+0x150/0x2b0 [ 41.067881][ T809] RAX: ffffffff842e9787 RBX: ffff88810abf5000 RCX: ffff88810b2213c0 [ 41.067890][ T809] RDX: 0000000000000000 RSI: 0000000016345900 RDI: 000000000c04eb7d [ 41.067928][ T809] RBP: ffffc90002177d88 R08: ffff88810abf5083 R09: 1ffff1102157ea10 [ 41.075243][ T791] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 41.079033][ T786] RIP: 0033:0x7f183147be59 [ 41.087732][ T799] sock_close+0xb8/0x200 [ 41.091910][ T809] R10: dffffc0000000000 R11: ffffed102157ea11 R12: dffffc0000000000 [ 41.091948][ T809] R13: dffffc0000000000 R14: 0000000016345900 R15: ffff888128fd9800 [ 41.100687][ T791] RSP: 002b:00007ffeceda3298 EFLAGS: 00000246 [ 41.107972][ T805] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 41.116648][ T799] ? sock_mmap+0xa0/0xa0 [ 41.135755][ T786] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 41.140731][ T791] ORIG_RAX: 00000000000001b4 [ 41.144437][ T809] FS: 000055557ab2a500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 41.152998][ T791] RAX: 0000000000000000 RBX: 00007ffeceda3380 RCX: 00007ff580d6fe59 [ 41.160456][ T786] RSP: 002b:00007ffd05590288 EFLAGS: 00000246 [ 41.160586][ T809] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.174511][ T805] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 41.179086][ T799] __fput+0x2dc/0x730 [ 41.198449][ T791] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 41.203747][ T786] ORIG_RAX: 00000000000001b4 [ 41.212080][ T809] CR2: 00007f301f393780 CR3: 000000012e2f9000 CR4: 00000000003506a0 [ 41.220630][ T799] ____fput+0x15/0x20 [ 41.226197][ T809] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 41.233151][ T786] RAX: 0000000000000000 RBX: 00007ffd05590370 RCX: 00007f183147be59 [ 41.240714][ T791] RBP: 0000000000009cf7 R08: 0000000000000001 R09: 0000000000000000 [ 41.245204][ T799] task_work_run+0x127/0x190 [ 41.252650][ T805] Call Trace: [ 41.257862][ T786] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 41.265405][ T809] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 41.269904][ T799] exit_to_user_mode_loop+0xcb/0xe0 [ 41.277392][ T805] pppol2tp_release+0x150/0x2b0 [ 41.285882][ T786] RBP: 0000000000009cbd R08: 0000000000000001 R09: 0000000000000000 [ 41.293419][ T791] R10: 0000001b33320000 R11: 0000000000000246 R12: 00007ffeceda33c0 [ 41.298505][ T799] exit_to_user_mode_prepare+0x76/0xa0 [ 41.301219][ T809] Call Trace: [ 41.309649][ T786] R10: 0000001b32e20000 R11: 0000000000000246 R12: 00007ffd055903b0 [ 41.317262][ T791] R13: 00007ff580ff7fac R14: 0000000000009d2c R15: 00007ff580ff7fa0 [ 41.323067][ T799] syscall_exit_to_user_mode+0x1d/0x40 [ 41.327530][ T805] sock_close+0xb8/0x200 [ 41.336028][ T786] R13: 00007f1831703fac R14: 0000000000009cef R15: 00007f1831703fa0 [ 41.343433][ T791] ---[ end trace aecf4b8e53e1779b ]--- [ 41.352467][ T799] do_syscall_64+0x3d/0x40 [ 41.360145][ T809] pppol2tp_release+0x150/0x2b0 [ 41.378149][ T786] ---[ end trace aecf4b8e53e1779c ]--- [ 41.385870][ T805] ? sock_mmap+0xa0/0xa0 [ 41.385881][ T805] __fput+0x2dc/0x730 [ 41.385922][ T805] ____fput+0x15/0x20 [ 41.392194][ T799] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 41.396206][ T805] task_work_run+0x127/0x190 [ 41.428478][ T799] RIP: 0033:0x7f8c4e8d6e59 [ 41.433695][ T799] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 41.440680][ T809] sock_close+0xb8/0x200 [ 41.462467][ T811] ------------[ cut here ]------------ [ 41.467153][ T809] ? sock_mmap+0xa0/0xa0 [ 41.473478][ T809] __fput+0x2dc/0x730 [ 41.480517][ T811] WARNING: CPU: 0 PID: 811 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 41.480818][ T805] exit_to_user_mode_loop+0xcb/0xe0