Warning: Permanently added '10.128.1.103' (ED25519) to the list of known hosts. 2026/08/25 06:09:10 parsed 1 programs 2026/08/25 06:09:10 serving rpc on tcp://34675 [ 24.666696][ T24] audit: type=1400 audit(1787638150.410:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 24.687586][ T24] audit: type=1400 audit(1787638150.410:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 24.707157][ T24] audit: type=1400 audit(1787638150.410:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 25.614687][ T24] audit: type=1400 audit(1787638151.360:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.618239][ T293] cgroup: Unknown subsys name 'net' [ 25.637548][ T24] audit: type=1400 audit(1787638151.360:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.664863][ T24] audit: type=1400 audit(1787638151.390:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.665351][ T293] cgroup: Unknown subsys name 'devices' [ 25.745857][ T293] cgroup: Unknown subsys name 'hugetlb' [ 25.751510][ T293] cgroup: Unknown subsys name 'rlimit' [ 25.931483][ T24] audit: type=1400 audit(1787638151.670:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.955056][ T24] audit: type=1400 audit(1787638151.670:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 25.975657][ T24] audit: type=1400 audit(1787638151.670:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.989059][ T297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 25.996858][ T24] audit: type=1400 audit(1787638151.670:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.025496][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.482438][ T299] request_module fs-gadgetfs succeeded, but still no fs? [ 26.493534][ T299] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 26.906378][ T334] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.913457][ T334] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.921340][ T334] device bridge_slave_0 entered promiscuous mode [ 26.929533][ T334] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.936682][ T334] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.944179][ T334] device bridge_slave_1 entered promiscuous mode [ 26.989775][ T334] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.996869][ T334] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.004193][ T334] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.011231][ T334] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.029685][ T318] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.037397][ T318] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.045094][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 27.052553][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.062432][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.070725][ T318] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.077797][ T318] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.086436][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.094661][ T318] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.101682][ T318] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.113356][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.122867][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.135959][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.148364][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.157059][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.164574][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.172865][ T334] device veth0_vlan entered promiscuous mode [ 27.183052][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.192550][ T334] device veth1_macvtap entered promiscuous mode [ 27.201851][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.211932][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/08/25 06:09:13 executed programs: 0 [ 27.592660][ T362] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.599833][ T362] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.607312][ T362] device bridge_slave_0 entered promiscuous mode [ 27.615048][ T362] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.622106][ T362] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.629698][ T362] device bridge_slave_1 entered promiscuous mode [ 27.673655][ T362] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.680774][ T362] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.688325][ T362] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.695380][ T362] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.716045][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.727282][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.742988][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.751869][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.760103][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.767170][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.776798][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.785469][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.792548][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.806224][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.815566][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.829247][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.841982][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.850279][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.858284][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.867257][ T362] device veth0_vlan entered promiscuous mode [ 27.877788][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.886947][ T362] device veth1_macvtap entered promiscuous mode [ 27.896703][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.906560][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 27.914961][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.937849][ T387] ================================================================== [ 27.945982][ T387] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 [ 27.952655][ T387] Write of size 8 at addr ffff8881110b8150 by task syz.2.17/387 [ 27.960266][ T387] [ 27.962603][ T387] CPU: 0 PID: 387 Comm: syz.2.17 Not tainted syzkaller #0 [ 27.969873][ T387] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 27.979979][ T387] Call Trace: [ 27.983364][ T387] __dump_stack+0x21/0x24 [ 27.987737][ T387] dump_stack_lvl+0x1a7/0x208 [ 27.992449][ T387] ? show_regs_print_info+0x18/0x18 [ 27.997680][ T387] ? thaw_kernel_threads+0x220/0x220 [ 28.002985][ T387] ? debug_smp_processor_id+0x17/0x20 [ 28.008360][ T387] print_address_description+0x7f/0x2c0 [ 28.013902][ T387] ? mutex_lock+0x85/0xf0 [ 28.018230][ T387] kasan_report+0x100/0x140 [ 28.022732][ T387] ? mutex_lock+0x85/0xf0 [ 28.027082][ T387] kasan_check_range+0x249/0x2a0 [ 28.032029][ T387] __kasan_check_write+0x14/0x20 [ 28.036958][ T387] mutex_lock+0x85/0xf0 [ 28.041120][ T387] ? mutex_trylock+0xb0/0xb0 [ 28.045725][ T387] ? l2tp_session_put+0xb2/0x1a0 [ 28.050672][ T387] ? l2tp_session_delete+0x3a9/0x4a0 [ 28.056145][ T387] pppol2tp_release+0x178/0x2b0 [ 28.061020][ T387] sock_close+0xb8/0x200 [ 28.065272][ T387] ? sock_mmap+0xa0/0xa0 [ 28.069617][ T387] __fput+0x2dc/0x730 [ 28.073599][ T387] ____fput+0x15/0x20 [ 28.077577][ T387] task_work_run+0x127/0x190 [ 28.082162][ T387] exit_to_user_mode_loop+0xcb/0xe0 [ 28.087368][ T387] exit_to_user_mode_prepare+0x76/0xa0 [ 28.092836][ T387] syscall_exit_to_user_mode+0x1d/0x40 [ 28.098300][ T387] do_syscall_64+0x3d/0x40 [ 28.102729][ T387] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.108624][ T387] RIP: 0033:0x7fddb2d270d9 [ 28.113056][ T387] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 28.132662][ T387] RSP: 002b:00007ffe3f088408 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 28.141073][ T387] RAX: 0000000000000000 RBX: 00007ffe3f0884f0 RCX: 00007fddb2d270d9 [ 28.149037][ T387] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 28.157023][ T387] RBP: 0000000000006d08 R08: 0000000000000001 R09: 0000000000000000 [ 28.165082][ T387] R10: 0000001b32920000 R11: 0000000000000246 R12: 0000000000000000 [ 28.173050][ T387] R13: 00007fddb2faefac R14: 00007fddb2faefa8 R15: 00007fddb2faefa0 [ 28.181024][ T387] [ 28.183353][ T387] Allocated by task 387: [ 28.187594][ T387] __kasan_kmalloc+0xd4/0x100 [ 28.192274][ T387] __kmalloc+0x19f/0x330 [ 28.196636][ T387] l2tp_session_create+0x39/0xb60 [ 28.201661][ T387] pppol2tp_connect+0xbf5/0x1640 [ 28.206593][ T387] __sys_connect+0x3ce/0x450 [ 28.211174][ T387] __x64_sys_connect+0x7a/0x90 [ 28.215932][ T387] do_syscall_64+0x31/0x40 [ 28.220403][ T387] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.226301][ T387] [ 28.228630][ T387] Freed by task 387: [ 28.232543][ T387] kasan_set_track+0x4a/0x70 [ 28.237139][ T387] kasan_set_free_info+0x23/0x40 [ 28.242095][ T387] ____kasan_slab_free+0x125/0x160 [ 28.247318][ T387] __kasan_slab_free+0x11/0x20 [ 28.252107][ T387] slab_free_freelist_hook+0xc5/0x190 [ 28.257595][ T387] kfree+0xc0/0x270 [ 28.261401][ T387] l2tp_session_put+0xb2/0x1a0 [ 28.266200][ T387] l2tp_session_delete+0x3a9/0x4a0 [ 28.271306][ T387] pppol2tp_release+0x169/0x2b0 [ 28.276435][ T387] sock_close+0xb8/0x200 [ 28.280698][ T387] __fput+0x2dc/0x730 [ 28.284670][ T387] ____fput+0x15/0x20 [ 28.288643][ T387] task_work_run+0x127/0x190 [ 28.293222][ T387] exit_to_user_mode_loop+0xcb/0xe0 [ 28.298411][ T387] exit_to_user_mode_prepare+0x76/0xa0 [ 28.303876][ T387] syscall_exit_to_user_mode+0x1d/0x40 [ 28.309346][ T387] do_syscall_64+0x3d/0x40 [ 28.313778][ T387] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.319666][ T387] [ 28.321996][ T387] The buggy address belongs to the object at ffff8881110b8000 [ 28.321996][ T387] which belongs to the cache kmalloc-512 of size 512 [ 28.336047][ T387] The buggy address is located 336 bytes inside of [ 28.336047][ T387] 512-byte region [ffff8881110b8000, ffff8881110b8200) [ 28.349392][ T387] The buggy address belongs to the page: [ 28.355050][ T387] page:ffffea0004442e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1110b8 [ 28.365373][ T387] head:ffffea0004442e00 order:2 compound_mapcount:0 compound_pincount:0 [ 28.373822][ T387] flags: 0x4000000000010200(slab|head) [ 28.379305][ T387] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 [ 28.387893][ T387] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 28.396475][ T387] page dumped because: kasan: bad access detected [ 28.402901][ T387] page_owner tracks the page as allocated [ 28.408623][ T387] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 362, ts 27927345867, free_ts 27896166579 [ 28.428506][ T387] prep_new_page+0x176/0x190 [ 28.433093][ T387] get_page_from_freelist+0x225f/0x23f0 [ 28.438633][ T387] __alloc_pages_nodemask+0x29a/0x640 [ 28.443996][ T387] new_slab+0x84/0x3f0 [ 28.448057][ T387] ___slab_alloc+0x2f8/0x4c0 [ 28.452639][ T387] __slab_alloc+0x63/0xa0 [ 28.457047][ T387] __kmalloc_track_caller+0x1e4/0x310 [ 28.462408][ T387] __alloc_skb+0xdc/0x520 [ 28.466725][ T387] __ipv6_ifa_notify+0x200/0xe70 [ 28.471650][ T387] ipv6_ifa_notify+0x85/0xc0 [ 28.476241][ T387] inet6_addr_add+0x5df/0x970 [ 28.480922][ T387] inet6_rtm_newaddr+0x6e1/0x9c0 [ 28.485850][ T387] rtnetlink_rcv_msg+0x9e9/0xca0 [ 28.490775][ T387] netlink_rcv_skb+0x1e9/0x430 [ 28.495527][ T387] rtnetlink_rcv+0x1c/0x20 [ 28.499930][ T387] netlink_unicast+0x86c/0xa30 [ 28.504679][ T387] page last free stack trace: [ 28.509346][ T387] __free_pages_ok+0x80b/0x830 [ 28.514104][ T387] __free_pages+0xd8/0x390 [ 28.518511][ T387] __free_slab+0xcf/0x190 [ 28.522826][ T387] unfreeze_partials+0x150/0x180 [ 28.527766][ T387] put_cpu_partial+0xc1/0x180 [ 28.532463][ T387] __slab_free+0x2c9/0x3a0 [ 28.536871][ T387] ___cache_free+0x10e/0x130 [ 28.541450][ T387] qlink_free+0x50/0x90 [ 28.545598][ T387] qlist_free_all+0x5f/0xb0 [ 28.550106][ T387] kasan_quarantine_reduce+0x14a/0x160 [ 28.555555][ T387] __kasan_slab_alloc+0x2f/0xe0 [ 28.560424][ T387] slab_post_alloc_hook+0x5d/0x2f0 [ 28.565526][ T387] __kmalloc+0x17b/0x330 [ 28.569761][ T387] fib6_info_alloc+0x34/0xe0 [ 28.574345][ T387] ip6_route_info_create+0x4c7/0x1450 [ 28.579736][ T387] ip6_route_add+0x27/0x130 [ 28.584241][ T387] [ 28.586573][ T387] Memory state around the buggy address: [ 28.592193][ T387] ffff8881110b8000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.600262][ T387] ffff8881110b8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.608313][ T387] >ffff8881110b8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.616405][ T387] ^ [ 28.623089][ T387] ffff8881110b8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.631163][ T387] ffff8881110b8200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.639338][ T387] ================================================================== [ 28.647484][ T387] Disabling lock debugging due to kernel taint