Warning: Permanently added '10.128.0.155' (ED25519) to the list of known hosts. 2026/06/28 05:43:34 parsed 1 programs 2026/06/28 05:43:34 serving rpc on tcp://33689 [ 25.143743][ T24] audit: type=1400 audit(1782625414.949:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 25.168896][ T24] audit: type=1400 audit(1782625414.949:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 25.199973][ T24] audit: type=1400 audit(1782625414.949:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 25.799593][ T24] audit: type=1400 audit(1782625415.609:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.801250][ T293] cgroup: Unknown subsys name 'net' [ 25.832412][ T24] audit: type=1400 audit(1782625415.609:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.856994][ T293] cgroup: Unknown subsys name 'devices' [ 25.857088][ T24] audit: type=1400 audit(1782625415.639:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.039301][ T293] cgroup: Unknown subsys name 'hugetlb' [ 26.044937][ T293] cgroup: Unknown subsys name 'rlimit' [ 26.160704][ T24] audit: type=1400 audit(1782625415.969:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 26.190118][ T24] audit: type=1400 audit(1782625415.969:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.196403][ T297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 26.213162][ T24] audit: type=1400 audit(1782625415.969:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 26.243823][ T24] audit: type=1400 audit(1782625415.969:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.267053][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.684666][ T300] request_module fs-gadgetfs succeeded, but still no fs? [ 26.698572][ T300] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 26.806826][ T309] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.815743][ T309] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.824027][ T309] device bridge_slave_0 entered promiscuous mode [ 26.833062][ T309] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.841061][ T309] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.853333][ T309] device bridge_slave_1 entered promiscuous mode [ 26.896746][ T309] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.913480][ T309] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.926720][ T309] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.935942][ T309] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.958275][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.967048][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.976015][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 26.986499][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.008348][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.019226][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.029343][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.043137][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.053337][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.060792][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.069129][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.077484][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.094283][ T309] device veth0_vlan entered promiscuous mode [ 27.103983][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.114348][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.123967][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.132887][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.146181][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.158892][ T309] device veth1_macvtap entered promiscuous mode [ 27.173439][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.188873][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/06/28 05:43:37 executed programs: 0 [ 27.938568][ T365] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.945777][ T365] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.953417][ T365] device bridge_slave_0 entered promiscuous mode [ 27.961237][ T365] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.968511][ T365] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.977610][ T365] device bridge_slave_1 entered promiscuous mode [ 27.989309][ T7] device bridge_slave_1 left promiscuous mode [ 27.996461][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.004186][ T7] device bridge_slave_0 left promiscuous mode [ 28.011796][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.020851][ T7] device veth1_macvtap left promiscuous mode [ 28.026907][ T7] device veth0_vlan left promiscuous mode [ 28.167266][ T365] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.177288][ T365] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.187032][ T365] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.198971][ T365] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.223887][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.234254][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.242937][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.252381][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 28.261053][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.269592][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.280894][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 28.290076][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.298609][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.310829][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 28.320953][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 28.334913][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 28.349579][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 28.359189][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 28.367247][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 28.376744][ T365] device veth0_vlan entered promiscuous mode [ 28.389558][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 28.400603][ T365] device veth1_macvtap entered promiscuous mode [ 28.413465][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.426833][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 28.452933][ T384] ================================================================== [ 28.462708][ T384] BUG: KASAN: use-after-free in l2tp_session_delete+0x23/0x4a0 [ 28.470564][ T384] Write of size 8 at addr ffff88810fd58408 by task syz.2.17/384 [ 28.479284][ T384] [ 28.481602][ T384] CPU: 1 PID: 384 Comm: syz.2.17 Not tainted syzkaller #0 [ 28.488810][ T384] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 28.499202][ T384] Call Trace: [ 28.502477][ T384] __dump_stack+0x21/0x24 [ 28.506881][ T384] dump_stack_lvl+0x1a7/0x208 [ 28.511654][ T384] ? show_regs_print_info+0x18/0x18 [ 28.517491][ T384] ? thaw_kernel_threads+0x220/0x220 [ 28.523528][ T384] print_address_description+0x7f/0x2c0 [ 28.529486][ T384] ? l2tp_session_delete+0x23/0x4a0 [ 28.535150][ T384] kasan_report+0x100/0x140 [ 28.539936][ T384] ? l2tp_session_delete+0x23/0x4a0 [ 28.545241][ T384] kasan_check_range+0x249/0x2a0 [ 28.550263][ T384] __kasan_check_write+0x14/0x20 [ 28.555205][ T384] l2tp_session_delete+0x23/0x4a0 [ 28.560221][ T384] pppol2tp_release+0x169/0x2b0 [ 28.565104][ T384] sock_close+0xb8/0x200 [ 28.569371][ T384] ? sock_mmap+0xa0/0xa0 [ 28.573790][ T384] __fput+0x2dc/0x730 [ 28.577749][ T384] ____fput+0x15/0x20 [ 28.581705][ T384] task_work_run+0x127/0x190 [ 28.586733][ T384] exit_to_user_mode_loop+0xcb/0xe0 [ 28.591931][ T384] exit_to_user_mode_prepare+0x76/0xa0 [ 28.597385][ T384] syscall_exit_to_user_mode+0x1d/0x40 [ 28.603127][ T384] do_syscall_64+0x3d/0x40 [ 28.607654][ T384] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.615066][ T384] RIP: 0033:0x7f904f2c2e59 [ 28.620187][ T384] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 28.641182][ T384] RSP: 002b:00007fffa3b2cf98 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 28.650596][ T384] RAX: 0000000000000000 RBX: 00007fffa3b2d080 RCX: 00007f904f2c2e59 [ 28.659728][ T384] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 28.668584][ T384] RBP: 0000000000006eea R08: 0000000000000001 R09: 0000000000000000 [ 28.682230][ T384] R10: 0000001b32c20000 R11: 0000000000000246 R12: 0000000000000000 [ 28.695170][ T384] R13: 00007f904f53bfac R14: 00007f904f53bfa8 R15: 00007f904f53bfa0 [ 28.710099][ T384] [ 28.714337][ T384] Allocated by task 384: [ 28.720202][ T384] __kasan_kmalloc+0xd4/0x100 [ 28.727444][ T384] __kmalloc+0x19f/0x330 [ 28.732392][ T384] l2tp_session_create+0x39/0xb60 [ 28.737430][ T384] pppol2tp_connect+0xbf5/0x1640 [ 28.742662][ T384] __sys_connect+0x3ce/0x450 [ 28.748959][ T384] __x64_sys_connect+0x7a/0x90 [ 28.754193][ T384] do_syscall_64+0x31/0x40 [ 28.759040][ T384] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.765839][ T384] [ 28.768259][ T384] Freed by task 48: [ 28.772076][ T384] kasan_set_track+0x4a/0x70 [ 28.776954][ T384] kasan_set_free_info+0x23/0x40 [ 28.782806][ T384] ____kasan_slab_free+0x125/0x160 [ 28.788856][ T384] __kasan_slab_free+0x11/0x20 [ 28.794146][ T384] slab_free_freelist_hook+0xc5/0x190 [ 28.800709][ T384] kfree+0xc0/0x270 [ 28.804509][ T384] l2tp_session_put+0xb2/0x1a0 [ 28.809528][ T384] l2tp_session_delete+0x3a9/0x4a0 [ 28.817863][ T384] l2tp_tunnel_del_work+0x180/0x3d0 [ 28.823624][ T384] process_one_work+0x6fd/0xbc0 [ 28.828932][ T384] worker_thread+0xa8e/0x13c0 [ 28.836108][ T384] kthread+0x324/0x3b0 [ 28.841659][ T384] ret_from_fork+0x1f/0x30 [ 28.846630][ T384] [ 28.849349][ T384] The buggy address belongs to the object at ffff88810fd58400 [ 28.849349][ T384] which belongs to the cache kmalloc-512 of size 512 [ 28.872145][ T384] The buggy address is located 8 bytes inside of [ 28.872145][ T384] 512-byte region [ffff88810fd58400, ffff88810fd58600) [ 28.886127][ T384] The buggy address belongs to the page: [ 28.892668][ T384] page:ffffea00043f5600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10fd58 [ 28.907249][ T384] head:ffffea00043f5600 order:2 compound_mapcount:0 compound_pincount:0 [ 28.920938][ T384] flags: 0x4000000000010200(slab|head) [ 28.927681][ T384] raw: 4000000000010200 ffffea0004448700 0000000200000002 ffff888100043080 [ 28.939020][ T384] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 28.950657][ T384] page dumped because: kasan: bad access detected [ 28.960181][ T384] page_owner tracks the page as allocated [ 28.966517][ T384] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 96, ts 5280209113, free_ts 0 [ 28.985632][ T384] prep_new_page+0x176/0x190 [ 28.990746][ T384] get_page_from_freelist+0x225f/0x23f0 [ 28.996723][ T384] __alloc_pages_nodemask+0x29a/0x640 [ 29.003802][ T384] new_slab+0x84/0x3f0 [ 29.008484][ T384] ___slab_alloc+0x2f8/0x4c0 [ 29.013625][ T384] __slab_alloc+0x63/0xa0 [ 29.018293][ T384] __kmalloc_track_caller+0x1e4/0x310 [ 29.024270][ T384] __alloc_skb+0xdc/0x520 [ 29.028593][ T384] alloc_uevent_skb+0x85/0x240 [ 29.033565][ T384] kobject_uevent_net_broadcast+0x335/0x5a0 [ 29.039676][ T384] kobject_uevent_env+0x52b/0x700 [ 29.047532][ T384] kobject_synth_uevent+0x452/0x940 [ 29.052754][ T384] store_uevent+0x16/0x30 [ 29.057090][ T384] module_attr_store+0x5f/0x80 [ 29.062304][ T384] sysfs_kf_write+0x129/0x150 [ 29.068657][ T384] kernfs_fop_write_iter+0x2bd/0x400 [ 29.074420][ T384] page_owner free stack trace missing [ 29.080148][ T384] [ 29.082468][ T384] Memory state around the buggy address: [ 29.089303][ T384] ffff88810fd58300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.097355][ T384] ffff88810fd58380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 29.105582][ T384] >ffff88810fd58400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.113625][ T384] ^ [ 29.118063][ T384] ffff88810fd58480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.126247][ T384] ffff88810fd58500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.134287][ T384] ================================================================== [ 29.142413][ T384] Disabling lock debugging due to kernel taint [ 29.152399][ T384] ------------[ cut here ]------------ [ 29.159004][ T384] refcount_t: underflow; use-after-free. [ 29.167014][ T384] WARNING: CPU: 1 PID: 384 at lib/refcount.c:28 refcount_warn_saturate+0x120/0x1a0 [ 29.178420][ T384] Modules linked in: [ 29.184007][ T384] CPU: 0 PID: 384 Comm: syz.2.17 Tainted: G B syzkaller #0 [ 29.193871][ T384] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 29.204868][ T384] RIP: 0010:refcount_warn_saturate+0x120/0x1a0 [ 29.211518][ T384] Code: 04 01 48 c7 c7 20 45 40 85 e8 5c a4 3a 02 0f 0b eb c3 e8 33 94 26 ff c6 05 51 81 82 04 01 48 c7 c7 80 45 40 85 e8 40 a4 3a 02 <0f> 0b eb a7 e8 17 94 26 ff c6 05 32 81 82 04 01 48 c7 c7 a0 44 40 [ 29.233026][ T384] RSP: 0018:ffffc90000ca7d18 EFLAGS: 00010246 [ 29.241476][ T384] RAX: 89a7a43a65409400 RBX: 0000000000000003 RCX: ffff88812b4da780 [ 29.250789][ T384] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 29.260074][ T384] RBP: ffffc90000ca7d28 R08: ffff8881f7127453 R09: 1ffff1103ee24e8a [ 29.268423][ T384] R10: dffffc0000000000 R11: ffffed103ee24e8b R12: 0000000000000000 [ 29.276873][ T384] R13: dffffc0000000000 R14: 0000000000000003 R15: 0000000000000000 [ 29.284906][ T384] FS: 000055557fd78500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 29.293973][ T384] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.300972][ T384] CR2: 0000200000000000 CR3: 000000011063c000 CR4: 00000000003506a0 [ 29.309705][ T384] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 29.317925][ T384] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 29.325915][ T384] Call Trace: [ 29.329236][ T384] l2tp_session_put+0xcb/0x1a0 [ 29.333993][ T384] l2tp_session_delete+0x3a9/0x4a0 [ 29.339230][ T384] pppol2tp_release+0x169/0x2b0 [ 29.344116][ T384] sock_close+0xb8/0x200 [ 29.348371][ T384] ? sock_mmap+0xa0/0xa0 [ 29.353951][ T384] __fput+0x2dc/0x730 [ 29.357953][ T384] ____fput+0x15/0x20 [ 29.362577][ T384] task_work_run+0x127/0x190 [ 29.367419][ T384] exit_to_user_mode_loop+0xcb/0xe0 [ 29.372861][ T384] exit_to_user_mode_prepare+0x76/0xa0 [ 29.379227][ T384] syscall_exit_to_user_mode+0x1d/0x40 [ 29.385292][ T384] do_syscall_64+0x3d/0x40 [ 29.389890][ T384] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 29.395967][ T384] RIP: 0033:0x7f904f2c2e59 [ 29.400603][ T384] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 29.422106][ T384] RSP: 002b:00007fffa3b2cf98 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 29.431587][ T384] RAX: 0000000000000000 RBX: 00007fffa3b2d080 RCX: 00007f904f2c2e59 [ 29.440213][ T384] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 29.449291][ T384] RBP: 0000000000006eea R08: 0000000000000001 R09: 0000000000000000 [ 29.458493][ T384] R10: 0000001b32c20000 R11: 0000000000000246 R12: 0000000000000000 [ 29.466636][ T384] R13: 00007f904f53bfac R14: 00007f904f53bfa8 R15: 00007f904f53bfa0 [ 29.474800][ T384] ---[ end trace 3f8df15c5b8bc8c4 ]---