Warning: Permanently added '10.128.1.78' (ED25519) to the list of known hosts. 2026/07/08 12:27:24 parsed 1 programs 2026/07/08 12:27:24 serving rpc on tcp://40421 [ 24.886732][ T24] audit: type=1400 audit(1783513644.830:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 24.907919][ T24] audit: type=1400 audit(1783513644.830:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 24.927715][ T24] audit: type=1400 audit(1783513644.830:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 25.824871][ T24] audit: type=1400 audit(1783513645.760:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.828314][ T293] cgroup: Unknown subsys name 'net' [ 25.847604][ T24] audit: type=1400 audit(1783513645.760:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.874940][ T24] audit: type=1400 audit(1783513645.800:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.875426][ T293] cgroup: Unknown subsys name 'devices' [ 26.017617][ T293] cgroup: Unknown subsys name 'hugetlb' [ 26.023259][ T293] cgroup: Unknown subsys name 'rlimit' [ 26.172074][ T24] audit: type=1400 audit(1783513646.110:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 26.195622][ T24] audit: type=1400 audit(1783513646.110:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 26.216196][ T24] audit: type=1400 audit(1783513646.110:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.236694][ T24] audit: type=1400 audit(1783513646.110:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.253842][ T297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 26.298298][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.856330][ T304] request_module fs-gadgetfs succeeded, but still no fs? [ 26.899018][ T304] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 26.918823][ T303] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.930277][ T303] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.938083][ T303] device bridge_slave_0 entered promiscuous mode [ 26.947015][ T303] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.954074][ T303] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.970629][ T303] device bridge_slave_1 entered promiscuous mode [ 27.122440][ T303] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.129737][ T303] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.137091][ T303] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.144144][ T303] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.262013][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.276629][ T308] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.284117][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 27.292035][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.326563][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.337336][ T308] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.344536][ T308] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.380354][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.388975][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.397272][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.404739][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.412851][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.421602][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.446608][ T303] device veth0_vlan entered promiscuous mode [ 27.483684][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.521059][ T303] device veth1_macvtap entered promiscuous mode [ 27.546319][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.566583][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/07/08 12:27:27 executed programs: 0 [ 27.883216][ T365] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.890395][ T365] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.898049][ T365] device bridge_slave_0 entered promiscuous mode [ 27.926296][ T365] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.933366][ T365] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.940939][ T365] device bridge_slave_1 entered promiscuous mode [ 28.057002][ T367] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.064069][ T367] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.072003][ T367] device bridge_slave_0 entered promiscuous mode [ 28.079131][ T367] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.086399][ T367] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.093751][ T367] device bridge_slave_1 entered promiscuous mode [ 28.107851][ T370] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.114909][ T370] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.122415][ T370] device bridge_slave_0 entered promiscuous mode [ 28.129489][ T370] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.136633][ T370] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.143985][ T370] device bridge_slave_1 entered promiscuous mode [ 28.178152][ T374] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.185506][ T374] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.192957][ T374] device bridge_slave_0 entered promiscuous mode [ 28.202633][ T374] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.209730][ T374] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.217153][ T374] device bridge_slave_1 entered promiscuous mode [ 28.231491][ T372] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.238919][ T372] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.246450][ T372] device bridge_slave_0 entered promiscuous mode [ 28.255696][ T372] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.262886][ T372] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.270328][ T372] device bridge_slave_1 entered promiscuous mode [ 28.390132][ T367] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.397363][ T367] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.404863][ T367] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.411958][ T367] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.467749][ T370] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.474834][ T370] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.482145][ T370] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.489213][ T370] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.509236][ T372] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.516329][ T372] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.523608][ T372] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.530679][ T372] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.539377][ T374] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.546476][ T374] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.553750][ T374] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.560816][ T374] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.572829][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.580426][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.587757][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.594911][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.602731][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.610075][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.617434][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.624605][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.632451][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 28.640545][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.648115][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 28.656509][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 28.664683][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.671765][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.679408][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 28.687801][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 28.695994][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.703015][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.747352][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.755496][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 28.764082][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 28.772503][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.779596][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.787719][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 28.795953][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.802995][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.810528][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 28.818557][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 28.826667][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 28.834607][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 28.854242][ T367] device veth0_vlan entered promiscuous mode [ 28.866720][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 28.875425][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 28.883924][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 28.892955][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 28.901136][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 28.916968][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 28.924449][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.940737][ T365] device veth0_vlan entered promiscuous mode [ 28.948511][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 28.957279][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 28.966375][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 28.974363][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 28.982947][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 28.990622][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 29.006585][ T367] device veth1_macvtap entered promiscuous mode [ 29.013600][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 29.021515][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 29.029316][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.036981][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 29.045238][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.053938][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.061018][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.068638][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 29.076944][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.085041][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.092120][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.102138][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 29.110664][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.120016][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 29.128503][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.139649][ T365] device veth1_macvtap entered promiscuous mode [ 29.150529][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 29.158775][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 29.167217][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 29.174997][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 29.183905][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.192280][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.199377][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.207038][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 29.215321][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.223640][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.230713][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.238278][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 29.246400][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.278790][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 29.288477][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 29.297358][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 29.305585][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 29.314985][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 29.323433][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.331782][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.338857][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.346542][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 29.354819][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.363338][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.370471][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.377918][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 29.386202][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 29.394499][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 29.402805][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 29.411355][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 29.419864][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.431547][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 29.439962][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.447963][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 29.456826][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.477852][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 29.486727][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.499730][ T390] ================================================================== [ 29.507879][ T390] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 [ 29.514572][ T390] Write of size 8 at addr ffff8881291b8550 by task syz.1.18/390 [ 29.522199][ T390] [ 29.524537][ T390] CPU: 0 PID: 390 Comm: syz.1.18 Not tainted syzkaller #0 [ 29.531639][ T390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 29.541689][ T390] Call Trace: [ 29.544977][ T390] __dump_stack+0x21/0x24 [ 29.549308][ T390] dump_stack_lvl+0x1a7/0x208 [ 29.553984][ T390] ? show_regs_print_info+0x18/0x18 [ 29.559317][ T390] ? thaw_kernel_threads+0x220/0x220 [ 29.564603][ T390] ? debug_smp_processor_id+0x17/0x20 [ 29.569979][ T390] print_address_description+0x7f/0x2c0 [ 29.575553][ T390] ? mutex_lock+0x85/0xf0 [ 29.579880][ T390] kasan_report+0x100/0x140 [ 29.584387][ T390] ? mutex_lock+0x85/0xf0 [ 29.588811][ T390] kasan_check_range+0x249/0x2a0 [ 29.593756][ T390] __kasan_check_write+0x14/0x20 [ 29.598700][ T390] mutex_lock+0x85/0xf0 [ 29.602868][ T390] ? mutex_trylock+0xb0/0xb0 [ 29.607641][ T390] ? l2tp_session_put+0xb2/0x1a0 [ 29.612589][ T390] ? l2tp_session_delete+0x3a9/0x4a0 [ 29.617869][ T390] pppol2tp_release+0x178/0x2b0 [ 29.622717][ T390] sock_close+0xb8/0x200 [ 29.626956][ T390] ? sock_mmap+0xa0/0xa0 [ 29.631217][ T390] __fput+0x2dc/0x730 [ 29.635197][ T390] ____fput+0x15/0x20 [ 29.639176][ T390] task_work_run+0x127/0x190 [ 29.643761][ T390] exit_to_user_mode_loop+0xcb/0xe0 [ 29.648985][ T390] exit_to_user_mode_prepare+0x76/0xa0 [ 29.654441][ T390] syscall_exit_to_user_mode+0x1d/0x40 [ 29.659893][ T390] do_syscall_64+0x3d/0x40 [ 29.664309][ T390] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 29.670206][ T390] RIP: 0033:0x7f1f81c7ae59 [ 29.674629][ T390] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 29.694412][ T390] RSP: 002b:00007fff9e3d69b8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 29.702848][ T390] RAX: 0000000000000000 RBX: 00007fff9e3d6aa0 RCX: 00007f1f81c7ae59 [ 29.710823][ T390] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 29.718982][ T390] RBP: 0000000000007316 R08: 0000000000000001 R09: 0000000000000000 [ 29.727064][ T390] R10: 0000001b32e20000 R11: 0000000000000246 R12: 00007fff9e3d6ae0 [ 29.735120][ T390] R13: 00007f1f81f02fac R14: 0000000000007349 R15: 00007f1f81f02fa0 [ 29.743092][ T390] [ 29.745420][ T390] Allocated by task 391: [ 29.749662][ T390] __kasan_kmalloc+0xd4/0x100 [ 29.754374][ T390] __kmalloc+0x19f/0x330 [ 29.758635][ T390] l2tp_session_create+0x39/0xb60 [ 29.763938][ T390] pppol2tp_connect+0xbf5/0x1640 [ 29.768870][ T390] __sys_connect+0x3ce/0x450 [ 29.773625][ T390] __x64_sys_connect+0x7a/0x90 [ 29.778383][ T390] do_syscall_64+0x31/0x40 [ 29.782795][ T390] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 29.788675][ T390] [ 29.790997][ T390] Freed by task 390: [ 29.794886][ T390] kasan_set_track+0x4a/0x70 [ 29.799475][ T390] kasan_set_free_info+0x23/0x40 [ 29.804406][ T390] ____kasan_slab_free+0x125/0x160 [ 29.809518][ T390] __kasan_slab_free+0x11/0x20 [ 29.814276][ T390] slab_free_freelist_hook+0xc5/0x190 [ 29.819639][ T390] kfree+0xc0/0x270 [ 29.823441][ T390] l2tp_session_put+0xb2/0x1a0 [ 29.828200][ T390] l2tp_session_delete+0x3a9/0x4a0 [ 29.833301][ T390] pppol2tp_release+0x169/0x2b0 [ 29.838160][ T390] sock_close+0xb8/0x200 [ 29.842413][ T390] __fput+0x2dc/0x730 [ 29.846389][ T390] ____fput+0x15/0x20 [ 29.850364][ T390] task_work_run+0x127/0x190 [ 29.854952][ T390] exit_to_user_mode_loop+0xcb/0xe0 [ 29.860145][ T390] exit_to_user_mode_prepare+0x76/0xa0 [ 29.865601][ T390] syscall_exit_to_user_mode+0x1d/0x40 [ 29.871049][ T390] do_syscall_64+0x3d/0x40 [ 29.875461][ T390] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 29.881343][ T390] [ 29.883681][ T390] The buggy address belongs to the object at ffff8881291b8400 [ 29.883681][ T390] which belongs to the cache kmalloc-512 of size 512 [ 29.897778][ T390] The buggy address is located 336 bytes inside of [ 29.897778][ T390] 512-byte region [ffff8881291b8400, ffff8881291b8600) [ 29.911216][ T390] The buggy address belongs to the page: [ 29.916882][ T390] page:ffffea0004a46e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1291b8 [ 29.927115][ T390] head:ffffea0004a46e00 order:2 compound_mapcount:0 compound_pincount:0 [ 29.935457][ T390] flags: 0x4000000000010200(slab|head) [ 29.940914][ T390] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 [ 29.949500][ T390] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 29.958075][ T390] page dumped because: kasan: bad access detected [ 29.964482][ T390] page_owner tracks the page as allocated [ 29.970230][ T390] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x152a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 347, ts 29496585003, free_ts 27783405892 [ 29.988538][ T390] prep_new_page+0x176/0x190 [ 29.993131][ T390] get_page_from_freelist+0x225f/0x23f0 [ 29.998672][ T390] __alloc_pages_nodemask+0x29a/0x640 [ 30.004040][ T390] new_slab+0x84/0x3f0 [ 30.008104][ T390] ___slab_alloc+0x2f8/0x4c0 [ 30.012687][ T390] __slab_alloc+0x63/0xa0 [ 30.017011][ T390] __kmalloc+0x1f9/0x330 [ 30.021242][ T390] ___neigh_create+0x6ec/0x1a70 [ 30.026106][ T390] __neigh_create+0x31/0x40 [ 30.030626][ T390] ip6_finish_output2+0x8fe/0x1540 [ 30.035823][ T390] __ip6_finish_output+0x5fd/0x790 [ 30.040967][ T390] ip6_finish_output+0x33/0x1e0 [ 30.045816][ T390] ip6_output+0x1fa/0x420 [ 30.050168][ T390] ndisc_send_skb+0x721/0xbc0 [ 30.054859][ T390] ndisc_send_ns+0x879/0xb10 [ 30.059457][ T390] addrconf_dad_work+0xa40/0x1480 [ 30.064467][ T390] page last free stack trace: [ 30.069143][ T390] free_unref_page_prepare+0x2b7/0x2d0 [ 30.074618][ T390] __free_pages+0x146/0x390 [ 30.079119][ T390] __vunmap+0x801/0x980 [ 30.083353][ T390] vfree+0x61/0x90 [ 30.087067][ T390] kcov_close+0x2b/0x50 [ 30.091216][ T390] __fput+0x2dc/0x730 [ 30.095191][ T390] ____fput+0x15/0x20 [ 30.099165][ T390] task_work_run+0x127/0x190 [ 30.103753][ T390] do_exit+0xa7c/0x24e0 [ 30.107901][ T390] do_group_exit+0x149/0x310 [ 30.112482][ T390] get_signal+0xfb1/0x1300 [ 30.116896][ T390] arch_do_signal_or_restart+0xe7/0x11b0 [ 30.122519][ T390] exit_to_user_mode_loop+0xa2/0xe0 [ 30.127710][ T390] exit_to_user_mode_prepare+0x76/0xa0 [ 30.133167][ T390] syscall_exit_to_user_mode+0x1d/0x40 [ 30.138620][ T390] do_syscall_64+0x3d/0x40 [ 30.143044][ T390] [ 30.145364][ T390] Memory state around the buggy address: [ 30.150988][ T390] ffff8881291b8400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.159048][ T390] ffff8881291b8480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.167121][ T390] >ffff8881291b8500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.175179][ T390] ^ [ 30.181943][ T390] ffff8881291b8580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.190009][ T390] ffff8881291b8600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.198059][ T390] ================================================================== [ 30.206117][ T390] Disabling lock debugging due to kernel taint [ 30.223493][ T24] kauditd_printk_skb: 34 callbacks suppressed [ 30.223505][ T24] audit: type=1400 audit(1783513650.160:108): avc: denied { read } for pid=77 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 30.251925][ T24] audit: type=1400 audit(1783513650.160:109): avc: denied { search } for pid=77 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 30.274238][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 30.284787][ T24] audit: type=1400 audit(1783513650.160:110): avc: denied { write } for pid=77 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 30.289290][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 30.307897][ T24] audit: type=1400 audit(1783513650.160:111): avc: denied { add_name } for pid=77 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 30.323424][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 30.343664][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 30.350074][ T24] audit: type=1400 audit(1783513650.160:112): avc: denied { create } for pid=77 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 30.355366][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 30.372387][ T24] audit: type=1400 audit(1783513650.160:113): avc: denied { append open } for pid=77 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 30.382839][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 30.412319][ T396] ------------[ cut here ]------------ [ 30.414353][ T374] device veth0_vlan entered promiscuous mode [ 30.424543][ T24] audit: type=1400 audit(1783513650.160:114): avc: denied { getattr } for pid=77 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 30.449143][ T372] device veth0_vlan entered promiscuous mode [ 30.466735][ T396] WARNING: CPU: 0 PID: 396 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 30.468451][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 30.484064][ T396] Modules linked in: [ 30.487588][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 30.490583][ T396] CPU: 0 PID: 396 Comm: syz.1.23 Tainted: G B syzkaller #0 [ 30.498807][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 30.504398][ T396] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 30.512628][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 30.531275][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 30.540019][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 30.545442][ T396] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 30.561401][ T374] device veth1_macvtap entered promiscuous mode [ 30.567775][ T396] Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 [ 30.574753][ T370] device veth0_vlan entered promiscuous mode [ 30.594210][ T396] RSP: 0018:ffffc90000dd7d68 EFLAGS: 00010293 [ 30.602901][ T396] RAX: ffffffff842ec3a7 RBX: ffff888129732000 RCX: ffff888113c52780 [ 30.611220][ T396] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000c04eb7d [ 30.624693][ T396] RBP: ffffc90000dd7d88 R08: ffff888129732083 R09: 1ffff110252e6410 [ 30.633331][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 30.640689][ T396] R10: dffffc0000000000 R11: ffffed10252e6411 R12: dffffc0000000000 [ 30.640982][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 30.654260][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 30.659719][ T396] R13: dffffc0000000000 R14: 0000000000000000 R15: ffff888113e85000 [ 30.666462][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 30.673091][ T396] FS: 000055558b5be500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 30.682739][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 30.691315][ T396] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 30.698846][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 30.704062][ T396] CR2: 0000200000000000 CR3: 0000000129c27000 CR4: 00000000003506b0 [ 30.713575][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 30.720701][ T396] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 30.746794][ T396] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 30.755063][ T396] Call Trace: [ 30.758750][ T396] pppol2tp_release+0x150/0x2b0 [ 30.764805][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 30.773618][ T396] sock_close+0xb8/0x200 [ 30.778461][ T396] ? sock_mmap+0xa0/0xa0 [ 30.782747][ T396] __fput+0x2dc/0x730 [ 30.788204][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 30.795681][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 30.804151][ T396] ____fput+0x15/0x20 [ 30.808483][ T396] task_work_run+0x127/0x190 [ 30.809728][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 30.814484][ T396] exit_to_user_mode_loop+0xcb/0xe0 [ 30.821614][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 30.830558][ T396] exit_to_user_mode_prepare+0x76/0xa0 [ 30.836211][ T389] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 30.841267][ T396] syscall_exit_to_user_mode+0x1d/0x40 [ 30.852699][ T372] device veth1_macvtap entered promiscuous mode [ 30.854374][ T396] do_syscall_64+0x3d/0x40 [ 30.865052][ T396] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 30.871357][ T396] RIP: 0033:0x7f1f81c7ae59 [ 30.876347][ T396] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 30.896995][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 30.905099][ T396] RSP: 002b:00007fff9e3d69b8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 30.914032][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 30.921975][ T396] RAX: 0000000000000000 RBX: 00007fff9e3d6aa0 RCX: 00007f1f81c7ae59 [ 30.930992][ T396] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 30.939393][ T396] RBP: 0000000000007668 R08: 0000000000000001 R09: 0000000000000000 [ 30.941945][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 30.947990][ T396] R10: 0000001b32e20000 R11: 0000000000000246 R12: 00007fff9e3d6ae0 [ 30.965397][ T370] device veth1_macvtap entered promiscuous mode [ 30.972638][ T396] R13: 00007f1f81f02fac R14: 00000000000076d9 R15: 00007f1f81f02fa0 [ 30.981107][ T396] ---[ end trace a8b2d1e3a64b5102 ]--- [ 30.998657][ T417] ------------[ cut here ]------------ [ 31.004198][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 31.011853][ T417] WARNING: CPU: 0 PID: 417 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 31.022805][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 31.023585][ T417] Modules linked in: [ 31.031413][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 31.039147][ T417] [ 31.045760][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 31.054687][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 31.062844][ T417] CPU: 1 PID: 417 Comm: syz.1.33 Tainted: G B W syzkaller #0 [ 31.062851][ T417] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 31.062868][ T417] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 31.062900][ T417] Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 [ 31.062908][ T417] RSP: 0018:ffffc90000e27d68 EFLAGS: 00010293 [ 31.062920][ T417] RAX: ffffffff842ec3a7 RBX: ffff8881147a3800 RCX: ffff888128e793c0 [ 31.062928][ T417] RDX: 0000000000000000 RSI: 00000000085b0d40 RDI: 000000000c04eb7d [ 31.062936][ T417] RBP: ffffc90000e27d88 R08: ffff8881147a3883 R09: 1ffff110228f4710 [ 31.062945][ T417] R10: dffffc0000000000 R11: ffffed10228f4711 R12: dffffc0000000000 [ 31.062953][ T417] R13: dffffc0000000000 R14: 00000000085b0d40 R15: ffff888114c98400 [ 31.062964][ T417] FS: 000055558b5be500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 31.062971][ T417] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 31.062979][ T417] CR2: 00007ffbf54bbdac CR3: 0000000114244000 CR4: 00000000003506a0 [ 31.063008][ T417] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 31.186205][ T417] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 31.194323][ T417] Call Trace: [ 31.197692][ T417] pppol2tp_release+0x150/0x2b0 [ 31.202574][ T417] sock_close+0xb8/0x200 [ 31.207117][ T417] ? sock_mmap+0xa0/0xa0 [ 31.211391][ T417] __fput+0x2dc/0x730 [ 31.215396][ T417] ____fput+0x15/0x20 [ 31.219656][ T417] task_work_run+0x127/0x190 [ 31.225478][ T417] exit_to_user_mode_loop+0xcb/0xe0 [ 31.231870][ T417] exit_to_user_mode_prepare+0x76/0xa0 [ 31.242791][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 31.250921][ T417] syscall_exit_to_user_mode+0x1d/0x40 [ 31.250933][ T417] do_syscall_64+0x3d/0x40 [ 31.250944][ T417] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 31.250953][ T417] RIP: 0033:0x7f1f81c7ae59 [ 31.250965][ T417] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 31.250972][ T417] RSP: 002b:00007fff9e3d69b8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 31.250986][ T417] RAX: 0000000000000000 RBX: 00007fff9e3d6aa0 RCX: 00007f1f81c7ae59 [ 31.250994][ T417] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 31.251000][ T417] RBP: 00000000000078f2 R08: 0000000000000001 R09: 0000000000000000 [ 31.251008][ T417] R10: 0000001b32e20000 R11: 0000000000000246 R12: 00007fff9e3d6ae0 [ 31.251016][ T417] R13: 00007f1f81f02fac R14: 0000000000007924 R15: 00007f1f81f02fa0 [ 31.251025][ T417] ---[ end trace a8b2d1e3a64b5103 ]--- [ 31.347286][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 31.371020][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 31.392841][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 31.410157][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 31.420801][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 31.476045][ T455] ------------[ cut here ]------------ [ 31.496299][ T460] ------------[ cut here ]------------ [ 31.502272][ T462] ------------[ cut here ]------------ [ 31.514900][ T455] WARNING: CPU: 1 PID: 455 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 31.519069][ T462] WARNING: CPU: 0 PID: 462 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 31.542646][ T460] WARNING: CPU: 1 PID: 460 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 31.557550][ T469] ------------[ cut here ]------------ [ 31.564527][ T455] Modules linked in: [ 31.577291][ T469] WARNING: CPU: 0 PID: 469 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 31.583469][ T455] CPU: 1 PID: 455 Comm: syz.5.47 Tainted: G B W syzkaller #0 [ 31.598008][ T460] Modules linked in: [ 31.601978][ T460] CPU: 1 PID: 460 Comm: syz.3.51 Tainted: G B W syzkaller #0 [ 31.614897][ T460] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 31.625709][ T455] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 31.635998][ T460] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 31.642365][ T460] Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 [ 31.644093][ T455] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 31.668500][ T455] Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 [ 31.674060][ T469] Modules linked in: [ 31.688296][ T455] RSP: 0018:ffffc90000ed7d68 EFLAGS: 00010293 [ 31.688310][ T455] RAX: ffffffff842ec3a7 RBX: ffff88811602e000 RCX: ffff888115de13c0 [ 31.688318][ T455] RDX: 0000000000000000 RSI: 00000000132525e0 RDI: 000000000c04eb7d [ 31.688327][ T455] RBP: ffffc90000ed7d88 R08: ffff88811602e083 R09: 1ffff11022c05c10 [ 31.688335][ T455] R10: dffffc0000000000 R11: ffffed1022c05c11 R12: dffffc0000000000 [ 31.688344][ T455] R13: dffffc0000000000 R14: 00000000132525e0 R15: ffff888115e0cc00 [ 31.688354][ T455] FS: 00005555781a5500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 31.688362][ T455] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 31.688370][ T455] CR2: 00007f52206ac060 CR3: 0000000129c26000 CR4: 00000000003506a0 [ 31.688381][ T455] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 31.688388][ T455] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 31.688391][ T455] Call Trace: [ 31.688408][ T455] pppol2tp_release+0x150/0x2b0 [ 31.688420][ T455] sock_close+0xb8/0x200 [ 31.688429][ T455] ? sock_mmap+0xa0/0xa0 [ 31.688441][ T455] __fput+0x2dc/0x730 [ 31.688452][ T455] ____fput+0x15/0x20 [ 31.688463][ T455] task_work_run+0x127/0x190 [ 31.688476][ T455] exit_to_user_mode_loop+0xcb/0xe0 [ 31.688485][ T455] exit_to_user_mode_prepare+0x76/0xa0 [ 31.688532][ T455] syscall_exit_to_user_mode+0x1d/0x40 [ 31.722212][ T462] Modules linked in: [ 31.724664][ T455] do_syscall_64+0x3d/0x40 [ 31.763314][ T469] [ 31.780580][ T455] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 31.787126][ T462] [ 31.788032][ T455] RIP: 0033:0x7f3deaa33e59 [ 31.801042][ T462] CPU: 0 PID: 462 Comm: syz.1.52 Tainted: G B W syzkaller #0 [ 31.805455][ T455] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 31.811578][ T484] ------------[ cut here ]------------ [ 31.824816][ T460] RSP: 0018:ffffc90000e97d68 EFLAGS: 00010293 [ 31.826071][ T455] RSP: 002b:00007ffc08e382a8 EFLAGS: 00000246 [ 31.830101][ T460] [ 31.850802][ T455] ORIG_RAX: 00000000000001b4 [ 31.858396][ T460] RAX: ffffffff842ec3a7 RBX: ffff888115c82800 RCX: ffff888115de62c0 [ 31.886826][ T462] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 31.889480][ T460] RDX: 0000000000000000 RSI: 0000000015e0fc00 RDI: 000000000c04eb7d [ 31.895061][ T462] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 31.897382][ T460] RBP: ffffc90000e97d88 R08: ffff888115c82883 R09: 1ffff11022b90510 [ 31.897391][ T460] R10: dffffc0000000000 R11: ffffed1022b90511 R12: dffffc0000000000 [ 31.897399][ T460] R13: dffffc0000000000 R14: 0000000015e0fc00 R15: ffff888115f09c00 [ 31.897409][ T460] FS: 00005555640ad500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 31.897417][ T460] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 31.897425][ T460] CR2: 00007f52206ac060 CR3: 00000001160f5000 CR4: 00000000003506a0 [ 31.897436][ T460] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 31.897443][ T460] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 31.897446][ T460] Call Trace: [ 31.897489][ T460] pppol2tp_release+0x150/0x2b0 [ 31.923337][ T484] WARNING: CPU: 0 PID: 484 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 31.931288][ T460] sock_close+0xb8/0x200 [ 31.935730][ T469] CPU: 0 PID: 469 Comm: syz.0.55 Tainted: G B W syzkaller #0 [ 31.943372][ T460] ? sock_mmap+0xa0/0xa0 [ 31.956219][ T462] Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 [ 31.959501][ T455] RAX: 0000000000000000 RBX: 00007ffc08e38390 RCX: 00007f3deaa33e59 [ 31.971837][ T484] Modules linked in: [ 31.985038][ T455] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 31.991423][ T462] RSP: 0018:ffffc90000fb7d68 EFLAGS: 00010293 [ 32.000365][ T460] __fput+0x2dc/0x730 [ 32.013480][ T469] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 32.017969][ T455] RBP: 0000000000007ac9 R08: 0000000000000001 R09: 0000000000000000 [ 32.033815][ T469] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 32.034645][ T460] ____fput+0x15/0x20 [ 32.055426][ T462] [ 32.062731][ T455] R10: 0000001b33020000 R11: 0000000000000246 R12: 00007ffc08e383d0 [ 32.075922][ T484] [ 32.081930][ T455] R13: 00007f3deacbbfac R14: 0000000000007b01 R15: 00007f3deacbbfa0 [ 32.101986][ T462] RAX: ffffffff842ec3a7 RBX: ffff888116110800 RCX: ffff888115f20000 [ 32.103610][ T460] task_work_run+0x127/0x190 [ 32.111376][ T469] Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 [ 32.113882][ T460] exit_to_user_mode_loop+0xcb/0xe0 [ 32.123896][ T469] RSP: 0018:ffffc90000fe7d68 EFLAGS: 00010293 [ 32.126577][ T455] ---[ end trace a8b2d1e3a64b5104 ]--- [ 32.134730][ T484] CPU: 0 PID: 484 Comm: syz.6.59 Tainted: G B W syzkaller #0 [ 32.142249][ T462] RDX: 0000000000000000 RSI: 000000000e961a90 RDI: 000000000c04eb7d [ 32.142258][ T462] RBP: ffffc90000fb7d88 R08: ffff888116110883 R09: 1ffff11022c22110 [ 32.142267][ T462] R10: dffffc0000000000 R11: ffffed1022c22111 R12: dffffc0000000000 [ 32.142294][ T462] R13: dffffc0000000000 R14: 000000000e961a90 R15: ffff888115e0fc00 [ 32.166529][ T484] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 32.166547][ T484] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 32.166584][ T484] Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 [ 32.172589][ T469] [ 32.178296][ T484] RSP: 0018:ffffc900010c7d68 EFLAGS: 00010293 [ 32.184272][ T460] exit_to_user_mode_prepare+0x76/0xa0 [ 32.193669][ T484] [ 32.200802][ T469] RAX: ffffffff842ec3a7 RBX: ffff888116389800 RCX: ffff888116024f00 [ 32.208331][ T484] RAX: ffffffff842ec3a7 RBX: ffff888116475800 RCX: ffff8881168293c0 [ 32.225652][ T460] syscall_exit_to_user_mode+0x1d/0x40 [ 32.248115][ T484] RDX: 0000000000000000 RSI: 000000000ef06360 RDI: 000000000c04eb7d [ 32.263365][ T462] FS: 000055558b5be500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 32.279195][ T484] RBP: ffffc900010c7d88 R08: ffff888116475883 R09: 1ffff11022c8eb10 [ 32.291133][ T469] RDX: 0000000000000000 RSI: 000000000004e920 RDI: 000000000c04eb7d [ 32.311015][ T460] do_syscall_64+0x3d/0x40 [ 32.316418][ T462] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.350632][ T469] RBP: ffffc90000fe7d88 R08: ffff888116389883 R09: 1ffff11022c71310 [ 32.355933][ T484] R10: dffffc0000000000 R11: ffffed1022c8eb11 R12: dffffc0000000000 [ 32.361960][ T469] R10: dffffc0000000000 R11: ffffed1022c71311 R12: dffffc0000000000 [ 32.369378][ T460] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 32.375365][ T462] CR2: 00007f3deb7ee060 CR3: 0000000116011000 CR4: 00000000003506a0 [ 32.389163][ T469] R13: dffffc0000000000 R14: 000000000004e920 R15: ffff888116214c00 [ 32.400948][ T462] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 32.408549][ T484] R13: dffffc0000000000 R14: 000000000ef06360 R15: ffff8881169d4c00 [ 32.410226][ T469] FS: 0000555572903500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 32.421133][ T460] RIP: 0033:0x7f96854c2e59 [ 32.430735][ T462] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 32.430740][ T462] Call Trace: [ 32.430756][ T462] pppol2tp_release+0x150/0x2b0 [ 32.430770][ T462] sock_close+0xb8/0x200 [ 32.430861][ T462] ? sock_mmap+0xa0/0xa0 [ 32.430874][ T462] __fput+0x2dc/0x730 [ 32.430887][ T462] ____fput+0x15/0x20 [ 32.430899][ T462] task_work_run+0x127/0x190 [ 32.430912][ T462] exit_to_user_mode_loop+0xcb/0xe0 [ 32.430923][ T462] exit_to_user_mode_prepare+0x76/0xa0 [ 32.430935][ T462] syscall_exit_to_user_mode+0x1d/0x40 [ 32.430945][ T462] do_syscall_64+0x3d/0x40 [ 32.430956][ T462] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 32.430966][ T462] RIP: 0033:0x7f1f81c7ae59 [ 32.430977][ T462] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.430984][ T462] RSP: 002b:00007fff9e3d69b8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 32.430998][ T462] RAX: 0000000000000000 RBX: 00007fff9e3d6aa0 RCX: 00007f1f81c7ae59 [ 32.431005][ T462] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 32.431012][ T462] RBP: 0000000000007add R08: 0000000000000001 R09: 0000000000000000 [ 32.431020][ T462] R10: 0000001b32e20000 R11: 0000000000000246 R12: 00007fff9e3d6ae0 [ 32.431048][ T462] R13: 00007f1f81f02fac R14: 0000000000007b10 R15: 00007f1f81f02fa0 [ 32.441778][ T484] FS: 000055558d533500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 32.445407][ T469] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.448039][ T484] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.452250][ T469] CR2: 00007f3deac832f8 CR3: 00000001159bc000 CR4: 00000000003506a0 [ 32.456065][ T484] CR2: 0000382121cc2000 CR3: 000000011665e000 CR4: 00000000003506b0 [ 32.460651][ T462] ---[ end trace a8b2d1e3a64b5105 ]--- [ 32.464233][ T484] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 32.468940][ T469] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 32.474247][ T460] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.495933][ T469] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 32.495945][ T469] Call Trace: [ 32.503680][ T484] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 32.545902][ T460] RSP: 002b:00007ffcc910d778 EFLAGS: 00000246 [ 32.586683][ T484] Call Trace: [ 32.607428][ T469] pppol2tp_release+0x150/0x2b0 [ 32.611865][ T484] pppol2tp_release+0x150/0x2b0 [ 32.614885][ T469] sock_close+0xb8/0x200 [ 32.664291][ T484] sock_close+0xb8/0x200 [ 32.672959][ T469] ? sock_mmap+0xa0/0xa0 [ 32.676941][ T460] ORIG_RAX: 00000000000001b4 [ 32.679672][ T469] __fput+0x2dc/0x730 [ 32.684478][ T460] RAX: 0000000000000000 RBX: 00007ffcc910d860 RCX: 00007f96854c2e59 [ 32.684485][ T460] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 32.684492][ T460] RBP: 0000000000007ad7 R08: 0000000000000001 R09: 0000000000000000 [ 32.684500][ T460] R10: 0000001b33120000 R11: 0000000000000246 R12: 00007ffcc910d8a0 [ 32.684531][ T460] R13: 00007f968574afac R14: 0000000000007b10 R15: 00007f968574afa0 [ 32.690554][ T469] ____fput+0x15/0x20 [ 32.734558][ T460] ---[ end trace a8b2d1e3a64b5106 ]--- [ 32.741816][ T469] task_work_run+0x127/0x190 [ 32.766540][ T469] exit_to_user_mode_loop+0xcb/0xe0 [ 32.766963][ T507] ------------[ cut here ]------------ [ 32.772213][ T469] exit_to_user_mode_prepare+0x76/0xa0 [ 32.772257][ T469] syscall_exit_to_user_mode+0x1d/0x40 [ 32.782149][ T484] ? sock_mmap+0xa0/0xa0 [ 32.784393][ T469] do_syscall_64+0x3d/0x40 [ 32.799558][ T469] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 32.805578][ T469] RIP: 0033:0x7ffbf5231e59 [ 32.810323][ T469] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 2026/07/08 12:27:32 executed programs: 63 [ 32.830215][ T469] RSP: 002b:00007ffeb4b66588 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 32.839163][ T484] __fput+0x2dc/0x730 [ 32.843299][ T484] ____fput+0x15/0x20 [ 32.847540][ T469] RAX: 0000000000000000 RBX: 00007ffeb4b66670 RCX: 00007ffbf5231e59 [ 32.848825][ T507] WARNING: CPU: 0 PID: 507 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 32.864105][ T469] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 32.878421][ T484] task_work_run+0x127/0x190 [ 32.883086][ T484] exit_to_user_mode_loop+0xcb/0xe0 [ 32.888587][ T507] Modules linked in: [ 32.888889][ T513] ------------[ cut here ]------------ [ 32.892546][ T507] CPU: 0 PID: 507 Comm: syz.1.68 Tainted: G B W syzkaller #0 [ 32.901436][ T469] RBP: 0000000000007b20 R08: 0000000000000001 R09: 0000000000000000 [ 32.907350][ T484] exit_to_user_mode_prepare+0x76/0xa0 [ 32.920504][ T513] WARNING: CPU: 1 PID: 513 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 32.920517][ T513] Modules linked in: [ 32.930758][ T469] R10: 0000001b32c20000 R11: 0000000000000246 R12: 00007ffeb4b666b0 [ 32.934081][ T507] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 32.935113][ T513] [ 32.943086][ T507] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 32.961999][ T469] R13: 00007ffbf54b9fac R14: 0000000000007b53 R15: 00007ffbf54b9fa0 [ 32.963328][ T484] syscall_exit_to_user_mode+0x1d/0x40 [ 32.971070][ T469] ---[ end trace a8b2d1e3a64b5107 ]--- [ 32.981165][ T484] do_syscall_64+0x3d/0x40 [ 32.985622][ T484] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 32.988428][ T513] CPU: 1 PID: 513 Comm: syz.3.72 Tainted: G B W syzkaller #0 [ 32.991921][ T507] Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 [ 33.001093][ T513] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 33.030395][ T484] RIP: 0033:0x7f521f8f1e59 [ 33.034921][ T484] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 33.034929][ T507] RSP: 0018:ffffc90000e77d68 EFLAGS: 00010293 [ 33.065464][ T513] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 33.072150][ T513] Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 [ 33.093638][ T507] RAX: ffffffff842ec3a7 RBX: ffff888117421800 RCX: ffff888116f613c0 [ 33.101893][ T513] RSP: 0018:ffffc90000f77d68 EFLAGS: 00010293 [ 33.110087][ T513] RAX: ffffffff842ec3a7 RBX: ffff888113278800 RCX: ffff888116edcf00 [ 33.116650][ T507] RDX: 0000000000000000 RSI: 000000001694b400 RDI: 000000000c04eb7d [ 33.119464][ T513] RDX: 0000000000000000 RSI: 0000000015a4b720 RDI: 000000000c04eb7d [ 33.141539][ T484] RSP: 002b:00007ffff00a6988 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 33.150136][ T507] RBP: ffffc90000e77d88 R08: ffff888117421883 R09: 1ffff11022e84310 [ 33.158441][ T513] RBP: ffffc90000f77d88 R08: ffff888113278883 R09: 1ffff1102264f110 [ 33.179487][ T507] R10: dffffc0000000000 R11: ffffed1022e84311 R12: dffffc0000000000 [ 33.189723][ T535] ------------[ cut here ]------------ [ 33.195396][ T513] R10: dffffc0000000000 R11: ffffed102264f111 R12: dffffc0000000000 [ 33.198371][ T484] RAX: 0000000000000000 RBX: 00007ffff00a6a70 RCX: 00007f521f8f1e59 [ 33.210021][ T535] WARNING: CPU: 1 PID: 535 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 33.213287][ T507] R13: dffffc0000000000 R14: 000000001694b400 R15: ffff88811724dc00 [ 33.223899][ T513] R13: dffffc0000000000 R14: 0000000015a4b720 R15: ffff88811756a800 [ 33.230039][ T484] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 33.238539][ T535] Modules linked in: [ 33.254826][ T507] FS: 000055558b5be500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 33.262821][ T535] CPU: 1 PID: 535 Comm: syz.0.82 Tainted: G B W syzkaller #0 [ 33.270464][ T484] RBP: 0000000000007beb R08: 0000000000000001 R09: 0000000000000000 [ 33.280338][ T513] FS: 00005555640ad500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 33.280346][ T513] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 33.280355][ T513] CR2: 0000200000000000 CR3: 0000000116631000 CR4: 00000000003506a0 [ 33.280382][ T513] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 33.290124][ T507] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 33.298174][ T535] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 33.322652][ T507] CR2: 00007f3deb7eb6b8 CR3: 000000011608d000 CR4: 00000000003506b0 [ 33.338156][ T535] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 33.342541][ T513] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 33.344551][ T535] Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 [ 33.353415][ T513] Call Trace: [ 33.375849][ T484] R10: 0000001b33320000 R11: 0000000000000246 R12: 00007ffff00a6ab0 [ 33.375858][ T484] R13: 00007f521fb79fac R14: 0000000000007c39 R15: 00007f521fb79fa0 [ 33.375868][ T484] ---[ end trace a8b2d1e3a64b5108 ]--- [ 33.392095][ T535] RSP: 0018:ffffc9000133fd68 EFLAGS: 00010293 [ 33.392109][ T535] RAX: ffffffff842ec3a7 RBX: ffff888117718800 RCX: ffff88811835cf00 [ 33.392116][ T535] RDX: 0000000000000000 RSI: 0000000021f1de18 RDI: 000000000c04eb7d [ 33.392151][ T535] RBP: ffffc9000133fd88 R08: ffff888117718883 R09: 1ffff11022ee3110 [ 33.411048][ T507] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 33.440684][ T507] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 33.449052][ T544] ------------[ cut here ]------------ [ 33.450131][ T507] Call Trace: [ 33.454831][ T544] WARNING: CPU: 1 PID: 544 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 33.458582][ T507] pppol2tp_release+0x150/0x2b0 [ 33.473042][ T513] pppol2tp_release+0x150/0x2b0 [ 33.484478][ T507] sock_close+0xb8/0x200 [ 33.489153][ T513] sock_close+0xb8/0x200 [ 33.495300][ T513] ? sock_mmap+0xa0/0xa0 [ 33.496899][ T544] Modules linked in: [ 33.504396][ T507] ? sock_mmap+0xa0/0xa0 [ 33.508774][ T544] CPU: 1 PID: 544 Comm: syz.5.87 Tainted: G B W syzkaller #0 [ 33.510084][ T547] ------------[ cut here ]------------ [ 33.520645][ T535] R10: dffffc0000000000 R11: ffffed1022ee3111 R12: dffffc0000000000 [ 33.523026][ T513] __fput+0x2dc/0x730 [ 33.532242][ T544] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 33.536204][ T507] __fput+0x2dc/0x730 [ 33.546025][ T535] R13: dffffc0000000000 R14: 0000000021f1de18 R15: ffff8881182d9800 [ 33.552625][ T513] ____fput+0x15/0x20 [ 33.557867][ T544] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 33.566087][ T507] ____fput+0x15/0x20 [ 33.568797][ T544] Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 [ 33.591321][ T513] task_work_run+0x127/0x190 [ 33.591894][ T535] FS: 0000555572903500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 33.596014][ T507] task_work_run+0x127/0x190 [ 33.596027][ T507] exit_to_user_mode_loop+0xcb/0xe0 [ 33.596037][ T507] exit_to_user_mode_prepare+0x76/0xa0 [ 33.596050][ T507] syscall_exit_to_user_mode+0x1d/0x40 [ 33.596090][ T507] do_syscall_64+0x3d/0x40 [ 33.606039][ T535] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 33.610185][ T547] WARNING: CPU: 0 PID: 547 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 33.614867][ T535] CR2: 00007f52206ac060 CR3: 0000000113f3a000 CR4: 00000000003506a0 [ 33.620716][ T513] exit_to_user_mode_loop+0xcb/0xe0 [ 33.626853][ T544] RSP: 0018:ffffc900013bfd68 EFLAGS: 00010293 [ 33.630872][ T507] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 33.637846][ T544] [ 33.647606][ T547] Modules linked in: [ 33.655902][ T535] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 33.663632][ T513] exit_to_user_mode_prepare+0x76/0xa0 [ 33.667427][ T535] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 33.684819][ T513] syscall_exit_to_user_mode+0x1d/0x40 [ 33.688382][ T544] RAX: ffffffff842ec3a7 RBX: ffff88811855b000 RCX: ffff88811844cf00 [ 33.692752][ T513] do_syscall_64+0x3d/0x40 [ 33.700939][ T544] RDX: 0000000000000000 RSI: 000000001862b300 RDI: 000000000c04eb7d [ 33.706356][ T547] [ 33.714775][ T507] RIP: 0033:0x7f1f81c7ae59 [ 33.727261][ T547] CPU: 0 PID: 547 Comm: syz.6.88 Tainted: G B W syzkaller #0 [ 33.729847][ T535] Call Trace: [ 33.733635][ T547] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 33.742817][ T507] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 33.745536][ T513] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 33.756131][ T544] RBP: ffffc900013bfd88 R08: ffff88811855b083 R09: 1ffff110230ab610 [ 33.776329][ T547] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 33.781512][ T535] pppol2tp_release+0x150/0x2b0 [ 33.790095][ T547] Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 [ 33.796000][ T507] RSP: 002b:00007fff9e3d69b8 EFLAGS: 00000246 [ 33.801258][ T513] RIP: 0033:0x7f96854c2e59 [ 33.820467][ T535] sock_close+0xb8/0x200 [ 33.827189][ T547] RSP: 0018:ffffc90001257d68 EFLAGS: 00010293 [ 33.830986][ T544] R10: dffffc0000000000 R11: ffffed10230ab611 R12: dffffc0000000000 [ 33.835181][ T547] [ 33.841396][ T507] ORIG_RAX: 00000000000001b4 [ 33.851186][ T547] RAX: ffffffff842ec3a7 RBX: ffff8881177fc000 RCX: ffff888118448000 [ 33.851771][ T535] ? sock_mmap+0xa0/0xa0 [ 33.859899][ T513] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 33.864559][ T544] R13: dffffc0000000000 R14: 000000001862b300 R15: ffff888118462000 [ 33.876165][ T547] RDX: 0000000000000000 RSI: 0000000017c2c480 RDI: 000000000c04eb7d [ 33.888752][ T507] RAX: 0000000000000000 RBX: 00007fff9e3d6aa0 RCX: 00007f1f81c7ae59 [ 33.903994][ T513] RSP: 002b:00007ffcc910d778 EFLAGS: 00000246 [ 33.904953][ T535] __fput+0x2dc/0x730 [ 33.913063][ T513] ORIG_RAX: 00000000000001b4 [ 33.919323][ T507] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 33.922878][ T547] RBP: ffffc90001257d88 R08: ffff8881177fc083 R09: 1ffff11022eff810 [ 33.927663][ T544] FS: 00005555781a5500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 33.935496][ T513] RAX: 0000000000000000 RBX: 00007ffcc910d860 RCX: 00007f96854c2e59 [ 33.943624][ T535] ____fput+0x15/0x20 [ 33.952890][ T547] R10: dffffc0000000000 R11: ffffed1022eff811 R12: dffffc0000000000 [ 33.960828][ T507] RBP: 0000000000007fb9 R08: 0000000000000001 R09: 0000000000000000 [ 33.965411][ T547] R13: dffffc0000000000 R14: 0000000017c2c480 R15: ffff88811882b800 [ 33.973446][ T544] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 33.981246][ T513] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 33.989689][ T507] R10: 0000001b32e20000 R11: 0000000000000246 R12: 00007fff9e3d6ae0 [ 34.003749][ T513] RBP: 0000000000008047 R08: 0000000000000001 R09: 0000000000000000 [ 34.012547][ T535] task_work_run+0x127/0x190 [ 34.024402][ T547] FS: 000055558d533500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 34.024510][ T544] CR2: 00007f52206ac060 CR3: 00000001170f3000 CR4: 00000000003506a0 [ 34.033785][ T535] exit_to_user_mode_loop+0xcb/0xe0 [ 34.044975][ T513] R10: 0000001b33120000 R11: 0000000000000246 R12: 00007ffcc910d8a0 [ 34.047244][ T507] R13: 00007f1f81f02fac R14: 000000000000800c R15: 00007f1f81f02fa0 [ 34.062947][ T513] R13: 00007f968574afac R14: 0000000000008079 R15: 00007f968574afa0 [ 34.062963][ T544] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 34.076058][ T547] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 34.079993][ T535] exit_to_user_mode_prepare+0x76/0xa0 [ 34.085864][ T547] CR2: 0000200000000000 CR3: 0000000118305000 CR4: 00000000003506b0 [ 34.091585][ T507] ---[ end trace a8b2d1e3a64b5109 ]--- [ 34.100924][ T513] ---[ end trace a8b2d1e3a64b510a ]--- [ 34.105287][ T544] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 34.118370][ T547] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 34.126414][ T547] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 34.131286][ T535] syscall_exit_to_user_mode+0x1d/0x40 [ 34.141599][ T547] Call Trace: [ 34.142425][ T535] do_syscall_64+0x3d/0x40 [ 34.149417][ T547] pppol2tp_release+0x150/0x2b0 [ 34.154296][ T547] sock_close+0xb8/0x200 [ 34.154927][ T544] Call Trace: [ 34.166720][ T544] pppol2tp_release+0x150/0x2b0 [ 34.171625][ T544] sock_close+0xb8/0x200 [ 34.179569][ T547] ? sock_mmap+0xa0/0xa0 [ 34.186069][ T535] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 34.194245][ T553] ------------[ cut here ]------------ [ 34.199902][ T544] ? sock_mmap+0xa0/0xa0 [ 34.200019][ T547] __fput+0x2dc/0x730 [ 34.204382][ T535] RIP: 0033:0x7ffbf5231e59 [ 34.210189][ T547] ____fput+0x15/0x20 [ 34.214575][ T553] WARNING: CPU: 1 PID: 553 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 34.217241][ T547] task_work_run+0x127/0x190 [ 34.229980][ T544] __fput+0x2dc/0x730 [ 34.232692][ T547] exit_to_user_mode_loop+0xcb/0xe0 [ 34.236708][ T535] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.247873][ T547] exit_to_user_mode_prepare+0x76/0xa0 [ 34.261469][ T544] ____fput+0x15/0x20 [ 34.267669][ T547] syscall_exit_to_user_mode+0x1d/0x40 [ 34.270780][ T553] Modules linked in: [ 34.280257][ T553] CPU: 1 PID: 553 Comm: syz.1.91 Tainted: G B W syzkaller #0 [ 34.288991][ T544] task_work_run+0x127/0x190 [ 34.293674][ T544] exit_to_user_mode_loop+0xcb/0xe0 [ 34.299089][ T535] RSP: 002b:00007ffeb4b66588 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 34.307791][ T553] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 34.318328][ T544] exit_to_user_mode_prepare+0x76/0xa0 [ 34.322134][ T547] do_syscall_64+0x3d/0x40 [ 34.324151][ T544] syscall_exit_to_user_mode+0x1d/0x40 [ 34.333929][ T535] RAX: 0000000000000000 RBX: 00007ffeb4b66670 RCX: 00007ffbf5231e59 [ 34.334220][ T547] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 34.342152][ T553] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 34.349649][ T547] RIP: 0033:0x7f521f8f1e59 [ 34.354602][ T544] do_syscall_64+0x3d/0x40 [ 34.360370][ T547] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.363435][ T535] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 34.391150][ T544] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 34.397430][ T553] Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 [ 34.415318][ T547] RSP: 002b:00007ffff00a6988 EFLAGS: 00000246 [ 34.417339][ T544] RIP: 0033:0x7f3deaa33e59 [ 34.417346][ T547] ORIG_RAX: 00000000000001b4 [ 34.432759][ T544] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.452671][ T553] RSP: 0018:ffffc90000e77d68 EFLAGS: 00010293 [ 34.452685][ T553] RAX: ffffffff842ec3a7 RBX: ffff88811327e000 RCX: ffff888118b32780 [ 34.452692][ T553] RDX: 0000000000000000 RSI: 0000000017405660 RDI: 000000000c04eb7d [ 34.452701][ T553] RBP: ffffc90000e77d88 R08: ffff88811327e083 R09: 1ffff1102264fc10 [ 34.452709][ T553] R10: dffffc0000000000 R11: ffffed102264fc11 R12: dffffc0000000000 [ 34.452717][ T553] R13: dffffc0000000000 R14: 0000000017405660 R15: ffff888118a7d800 [ 34.452727][ T553] FS: 000055558b5be500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 34.452735][ T553] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 34.452783][ T553] CR2: 00007f9685323ff8 CR3: 0000000118b23000 CR4: 00000000003506a0 [ 34.473984][ T547] RAX: 0000000000000000 RBX: 00007ffff00a6a70 RCX: 00007f521f8f1e59 [ 34.479863][ T535] RBP: 0000000000008180 R08: 0000000000000001 R09: 0000000000000000 [ 34.489518][ T48] device bridge_slave_1 left promiscuous mode [ 34.497419][ T535] R10: 0000001b32c20000 R11: 0000000000000246 R12: 00007ffeb4b666b0 [ 34.523530][ T48] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.534303][ T544] RSP: 002b:00007ffc08e382a8 EFLAGS: 00000246 [ 34.540039][ T547] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 34.545458][ T553] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 34.554708][ T547] RBP: 00000000000082ba R08: 0000000000000001 R09: 0000000000000000 [ 34.566496][ T544] ORIG_RAX: 00000000000001b4 [ 34.566505][ T544] RAX: 0000000000000000 RBX: 00007ffc08e38390 RCX: 00007f3deaa33e59 [ 34.566512][ T544] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 34.566519][ T544] RBP: 000000000000827b R08: 0000000000000001 R09: 0000000000000000 [ 34.566526][ T544] R10: 0000001b33020000 R11: 0000000000000246 R12: 00007ffc08e383d0 [ 34.566533][ T544] R13: 00007f3deacbbfac R14: 00000000000082ae R15: 00007f3deacbbfa0 [ 34.566543][ T544] ---[ end trace a8b2d1e3a64b510b ]--- [ 34.569641][ T553] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 34.591778][ T48] device bridge_slave_0 left promiscuous mode [ 34.605947][ T535] R13: 00007ffbf54b9fac R14: 00000000000081b3 R15: 00007ffbf54b9fa0 [ 34.622344][ T48] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.627783][ T547] R10: 0000001b33320000 R11: 0000000000000246 R12: 00007ffff00a6ab0 [ 34.639996][ T553] Call Trace: [ 34.652267][ T547] R13: 00007f521fb79fac R14: 00000000000082ee R15: 00007f521fb79fa0 [ 34.680733][ T553] pppol2tp_release+0x150/0x2b0 [ 34.684260][ T535] ---[ end trace a8b2d1e3a64b510c ]--- [ 34.699988][ T553] sock_close+0xb8/0x200 [ 34.705330][ T48] device veth1_macvtap left promiscuous mode [ 34.711431][ T547] ---[ end trace a8b2d1e3a64b510d ]--- [ 34.720178][ T569] ------------[ cut here ]------------ [ 34.725708][ T569] WARNING: CPU: 1 PID: 569 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 34.726040][ T48] device veth0_vlan left promiscuous mode [ 34.746693][ T571] ------------[ cut here ]------------ [ 34.755165][ T571] WARNING: CPU: 1 PID: 571 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 34.765992][ T553] ? sock_mmap+0xa0/0xa0 [ 34.768140][ T569] Modules linked in: [ 34.776040][ T569] CPU: 1 PID: 569 Comm: syz.5.99 Tainted: G B W syzkaller #0 [ 34.783405][ T553] __fput+0x2dc/0x730 [ 34.785386][ T578] ------------[ cut here ]------------ [ 34.794241][ T571] Modules linked in: [ 34.798505][ T578] WARNING: CPU: 1 PID: 578 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 34.808699][ T571] CPU: 1 PID: 571 Comm: syz.0.101 Tainted: G B W syzkaller #0 [ 34.816441][ T553] ____fput+0x15/0x20 [ 34.817579][ T569] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 34.831178][ T553] task_work_run+0x127/0x190 [ 34.831864][ T571] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 34.846572][ T569] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 34.853064][ T578] Modules linked in: [ 34.855088][ T553] exit_to_user_mode_loop+0xcb/0xe0 [ 34.857311][ T569] Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 [ 34.876617][ T553] exit_to_user_mode_prepare+0x76/0xa0 [ 34.883208][ T578] CPU: 1 PID: 578 Comm: syz.6.103 Tainted: G B W syzkaller #0 [ 34.896827][ T571] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 34.901253][ T553] syscall_exit_to_user_mode+0x1d/0x40 [ 34.903526][ T571] Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 [ 34.928420][ T578] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 34.938758][ T569] RSP: 0018:ffffc90000fe7d68 EFLAGS: 00010293 [ 34.943465][ T553] do_syscall_64+0x3d/0x40 [ 34.944850][ T569] RAX: ffffffff842ec3a7 RBX: ffff8881194a1000 RCX: ffff8881196bbb40 [ 34.944858][ T569] RDX: 0000000000000000 RSI: 0000000013f37b10 RDI: 000000000c04eb7d [ 34.944866][ T569] RBP: ffffc90000fe7d88 R08: ffff8881194a1083 R09: 1ffff11023294210 [ 34.944899][ T569] R10: dffffc0000000000 R11: ffffed1023294211 R12: dffffc0000000000 [ 34.957418][ T553] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 34.957429][ T553] RIP: 0033:0x7f1f81c7ae59 [ 34.957441][ T553] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.957448][ T553] RSP: 002b:00007fff9e3d69b8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 34.957462][ T553] RAX: 0000000000000000 RBX: 00007fff9e3d6aa0 RCX: 00007f1f81c7ae59 [ 34.957469][ T553] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 34.957477][ T553] RBP: 000000000000856d R08: 0000000000000001 R09: 0000000000000000 [ 34.957484][ T553] R10: 0000001b32e20000 R11: 0000000000000246 R12: 00007fff9e3d6ae0 [ 34.957492][ T553] R13: 00007f1f81f02fac R14: 00000000000085a0 R15: 00007f1f81f02fa0 [ 34.957501][ T553] ---[ end trace a8b2d1e3a64b510e ]--- [ 34.968062][ T571] RSP: 0018:ffffc90001257d68 EFLAGS: 00010293 [ 34.980289][ T578] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 34.992461][ T569] R13: dffffc0000000000 R14: 0000000013f37b10 R15: ffff888118b00000 [ 35.012220][ T571] [ 35.020128][ T578] Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 [ 35.020157][ T578] RSP: 0018:ffffc9000158fd68 EFLAGS: 00010293 [ 35.028814][ T571] RAX: ffffffff842ec3a7 RBX: ffff8881194a7000 RCX: ffff8881196be2c0 [ 35.076349][ T578] [ 35.096761][ T571] RDX: 0000000000000000 RSI: 0000000016fa9340 RDI: 000000000c04eb7d [ 35.135453][ T571] RBP: ffffc90001257d88 R08: ffff8881194a7083 R09: 1ffff11023294e10 [ 35.144800][ T569] FS: 00005555781a5500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 35.154755][ T587] ------------[ cut here ]------------ [ 35.160362][ T571] R10: dffffc0000000000 R11: ffffed1023294e11 R12: dffffc0000000000 [ 35.169023][ T569] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 35.175715][ T587] WARNING: CPU: 1 PID: 587 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 35.186044][ T569] CR2: 00007f1f81f04dac CR3: 0000000117d14000 CR4: 00000000003506a0 [ 35.194213][ T569] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 35.204586][ T571] R13: dffffc0000000000 R14: 0000000016fa9340 R15: ffff888119497400 [ 35.212947][ T569] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 35.214488][ T578] RAX: ffffffff842ec3a7 RBX: ffff888119854000 RCX: ffff8881198062c0 [ 35.221570][ T587] Modules linked in: [ 35.229114][ T569] Call Trace: [ 35.237142][ T571] FS: 0000555572903500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 35.246319][ T587] [ 35.248697][ T587] CPU: 1 PID: 587 Comm: syz.1.108 Tainted: G B W syzkaller #0 [ 35.257584][ T569] pppol2tp_release+0x150/0x2b0 [ 35.262480][ T569] sock_close+0xb8/0x200 [ 35.264138][ T578] RDX: 0000000000000000 RSI: 0000000016fa9720 RDI: 000000000c04eb7d [ 35.267280][ T571] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 35.284814][ T569] ? sock_mmap+0xa0/0xa0 [ 35.289541][ T587] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 35.299899][ T569] __fput+0x2dc/0x730 [ 35.302459][ T578] RBP: ffffc9000158fd88 R08: ffff888119854083 R09: 1ffff1102330a810 [ 35.306582][ T569] ____fput+0x15/0x20 [ 35.316702][ T587] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 35.323123][ T571] CR2: 0000382121cdb000 CR3: 0000000118305000 CR4: 00000000003506a0 [ 35.331580][ T569] task_work_run+0x127/0x190 [ 35.337651][ T587] Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 [ 35.356666][ T578] R10: dffffc0000000000 R11: ffffed102330a811 R12: dffffc0000000000 [ 35.363545][ T569] exit_to_user_mode_loop+0xcb/0xe0 [ 35.371147][ T597] ------------[ cut here ]------------ [ 35.376671][ T571] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 35.376920][ T578] R13: dffffc0000000000 R14: 0000000016fa9720 R15: ffff888119497c00 [ 35.384663][ T571] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 35.384667][ T571] Call Trace: [ 35.384733][ T571] pppol2tp_release+0x150/0x2b0 [ 35.406604][ T597] WARNING: CPU: 0 PID: 597 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 35.409736][ T569] exit_to_user_mode_prepare+0x76/0xa0 [ 35.425000][ T587] RSP: 0018:ffffc9000155fd68 EFLAGS: 00010293 [ 35.426459][ T578] FS: 000055558d533500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 35.431421][ T569] syscall_exit_to_user_mode+0x1d/0x40 [ 35.445951][ T597] Modules linked in: [ 35.446336][ T587] RAX: ffffffff842ec3a7 RBX: ffff88811968e800 RCX: ffff888119c1e2c0 [ 35.449928][ T597] CPU: 0 PID: 597 Comm: syz.3.113 Tainted: G B W syzkaller #0 [ 35.457949][ T569] do_syscall_64+0x3d/0x40 [ 35.457961][ T569] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 35.457970][ T569] RIP: 0033:0x7f3deaa33e59 [ 35.457982][ T569] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.457989][ T569] RSP: 002b:00007ffc08e382a8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 35.458002][ T569] RAX: 0000000000000000 RBX: 00007ffc08e38390 RCX: 00007f3deaa33e59 [ 35.458026][ T569] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 35.477082][ T578] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 35.482062][ T571] sock_close+0xb8/0x200 [ 35.506512][ T597] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 35.509915][ T587] RDX: 0000000000000000 RSI: 0000000016fa95e0 RDI: 000000000c04eb7d [ 35.523719][ T578] CR2: 0000382121ce2000 CR3: 000000011973f000 CR4: 00000000003506b0 [ 35.527313][ T587] RBP: ffffc9000155fd88 R08: ffff88811968e883 R09: 1ffff110232d1d10 [ 35.534130][ T597] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 35.537062][ T569] RBP: 000000000000877b R08: 0000000000000001 R09: 0000000000000000 [ 35.552815][ T578] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 35.555057][ T587] R10: dffffc0000000000 R11: ffffed10232d1d11 R12: dffffc0000000000 [ 35.563549][ T597] Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 [ 35.571022][ T571] ? sock_mmap+0xa0/0xa0 [ 35.577873][ T578] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 35.585182][ T569] R10: 0000001b33020000 R11: 0000000000000246 R12: 00007ffc08e383d0 [ 35.593657][ T597] RSP: 0018:ffffc900015f7d68 EFLAGS: 00010293 [ 35.602398][ T587] R13: dffffc0000000000 R14: 0000000016fa95e0 R15: ffff888119eab000 [ 35.636458][ T578] Call Trace: [ 35.641508][ T571] __fput+0x2dc/0x730 [ 35.658842][ T578] pppol2tp_release+0x150/0x2b0 [ 35.662922][ T569] R13: 00007f3deacbbfac R14: 00000000000087ae R15: 00007f3deacbbfa0 [ 35.675776][ T569] ---[ end trace a8b2d1e3a64b510f ]--- [ 35.681474][ T597] [ 35.683848][ T597] RAX: ffffffff842ec3a7 RBX: ffff88811359a000 RCX: ffff888119fb3b40 [ 35.687672][ T571] ____fput+0x15/0x20 [ 35.694492][ T578] sock_close+0xb8/0x200 [ 35.702853][ T571] task_work_run+0x127/0x190 [ 35.707547][ T587] FS: 000055558b5be500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 35.709159][ T578] ? sock_mmap+0xa0/0xa0 [ 35.721099][ T597] RDX: 0000000000000000 RSI: 000000001a439000 RDI: 000000000c04eb7d [ 35.726501][ T571] exit_to_user_mode_loop+0xcb/0xe0 [ 35.738260][ T578] __fput+0x2dc/0x730 [ 35.742577][ T571] exit_to_user_mode_prepare+0x76/0xa0 [ 35.746859][ T578] ____fput+0x15/0x20 [ 35.748988][ T587] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 35.752562][ T597] RBP: ffffc900015f7d88 R08: ffff88811359a083 R09: 1ffff110226b3410 [ 35.764974][ T571] syscall_exit_to_user_mode+0x1d/0x40 [ 35.772877][ T603] ------------[ cut here ]------------ [ 35.777514][ T578] task_work_run+0x127/0x190 [ 35.779254][ T587] CR2: 0000200000000000 CR3: 0000000119f01000 CR4: 00000000003506a0 [ 35.783386][ T578] exit_to_user_mode_loop+0xcb/0xe0 [ 35.793107][ T571] do_syscall_64+0x3d/0x40 [ 35.798850][ T597] R10: dffffc0000000000 R11: ffffed10226b3411 R12: dffffc0000000000 [ 35.801390][ T603] WARNING: CPU: 1 PID: 603 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 35.809750][ T578] exit_to_user_mode_prepare+0x76/0xa0 [ 35.819319][ T571] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 35.825273][ T597] R13: dffffc0000000000 R14: 000000001a439000 R15: ffff88811a43a800 [ 35.830704][ T587] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 35.846647][ T578] syscall_exit_to_user_mode+0x1d/0x40 [ 35.846658][ T578] do_syscall_64+0x3d/0x40 [ 35.846670][ T578] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 35.846680][ T578] RIP: 0033:0x7f521f8f1e59 [ 35.846691][ T578] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.846698][ T578] RSP: 002b:00007ffff00a6988 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 35.846712][ T578] RAX: 0000000000000000 RBX: 00007ffff00a6a70 RCX: 00007f521f8f1e59 [ 35.846719][ T578] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 35.846726][ T578] RBP: 00000000000087b3 R08: 0000000000000001 R09: 0000000000000000 [ 35.846734][ T578] R10: 0000001b33320000 R11: 0000000000000246 R12: 00007ffff00a6ab0 [ 35.846741][ T578] R13: 00007f521fb79fac R14: 00000000000087e5 R15: 00007f521fb79fa0 [ 35.846751][ T578] ---[ end trace a8b2d1e3a64b5110 ]--- [ 35.846970][ T597] FS: 00005555640ad500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 35.864687][ T571] RIP: 0033:0x7ffbf5231e59 [ 35.867469][ T603] Modules linked in: [ 35.889958][ T587] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 35.914181][ T603] [ 35.921495][ T597] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 35.928451][ T571] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.938240][ T597] CR2: 0000382121ce4000 CR3: 000000011a5d7000 CR4: 00000000003506b0 [ 35.972562][ T603] CPU: 0 PID: 603 Comm: syz.5.116 Tainted: G B W syzkaller #0 [ 35.977580][ T587] Call Trace: [ 36.016591][ T587] pppol2tp_release+0x150/0x2b0 [ 36.021617][ T587] sock_close+0xb8/0x200 [ 36.027117][ T587] ? sock_mmap+0xa0/0xa0 [ 36.031501][ T587] __fput+0x2dc/0x730 [ 36.035518][ T587] ____fput+0x15/0x20 [ 36.039794][ T571] RSP: 002b:00007ffeb4b66588 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 36.040001][ T597] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 36.056488][ T603] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 36.066694][ T571] RAX: 0000000000000000 RBX: 00007ffeb4b66670 RCX: 00007ffbf5231e59 [ 36.074767][ T571] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 36.083102][ T587] task_work_run+0x127/0x190 [ 36.087809][ T587] exit_to_user_mode_loop+0xcb/0xe0 [ 36.094364][ T587] exit_to_user_mode_prepare+0x76/0xa0 [ 36.099854][ T603] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 36.099866][ T603] Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 [ 36.099874][ T603] RSP: 0018:ffffc90000cd7d68 EFLAGS: 00010293 [ 36.106802][ T587] syscall_exit_to_user_mode+0x1d/0x40 [ 36.134512][ T571] RBP: 0000000000008795 R08: 0000000000000001 R09: 0000000000000000 [ 36.146181][ T587] do_syscall_64+0x3d/0x40 [ 36.150658][ T587] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 36.150816][ T597] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 36.164995][ T597] Call Trace: [ 36.168385][ T597] pppol2tp_release+0x150/0x2b0 [ 36.173260][ T597] sock_close+0xb8/0x200 [ 36.177602][ T597] ? sock_mmap+0xa0/0xa0 [ 36.180889][ T587] RIP: 0033:0x7f1f81c7ae59 [ 36.183307][ T597] __fput+0x2dc/0x730 [ 36.196674][ T571] R10: 0000001b32c20000 R11: 0000000000000246 R12: 00007ffeb4b666b0 [ 36.199862][ T597] ____fput+0x15/0x20 [ 36.208811][ T587] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 36.209499][ T615] ------------[ cut here ]------------ [ 36.234056][ T603] RAX: ffffffff842ec3a7 RBX: ffff888113526800 RCX: ffff88811a6913c0 [ 36.235565][ T571] R13: 00007ffbf54b9fac R14: 00000000000087c8 R15: 00007ffbf54b9fa0 [ 36.244194][ T597] task_work_run+0x127/0x190 [ 36.252558][ T587] RSP: 002b:00007fff9e3d69b8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 36.255380][ T603] RDX: 0000000000000000 RSI: 0000000016fa9d20 RDI: 000000000c04eb7d [ 36.271822][ T615] WARNING: CPU: 0 PID: 615 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 36.281862][ T571] ---[ end trace a8b2d1e3a64b5111 ]--- [ 36.292730][ T597] exit_to_user_mode_loop+0xcb/0xe0 [ 36.298381][ T617] ------------[ cut here ]------------ [ 36.301880][ T587] RAX: 0000000000000000 RBX: 00007fff9e3d6aa0 RCX: 00007f1f81c7ae59 [ 36.304026][ T597] exit_to_user_mode_prepare+0x76/0xa0 [ 36.318051][ T617] WARNING: CPU: 0 PID: 617 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 36.319052][ T587] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 36.328406][ T615] Modules linked in: [ 36.336527][ T587] RBP: 0000000000008924 R08: 0000000000000001 R09: 0000000000000000 [ 36.337569][ T617] Modules linked in: [ 36.340581][ T587] R10: 0000001b32e20000 R11: 0000000000000246 R12: 00007fff9e3d6ae0 [ 36.348746][ T615] [ 36.360503][ T587] R13: 00007f1f81f02fac R14: 0000000000008960 R15: 00007f1f81f02fa0 [ 36.360513][ T587] ---[ end trace a8b2d1e3a64b5112 ]--- [ 36.376614][ T597] syscall_exit_to_user_mode+0x1d/0x40 [ 36.382108][ T597] do_syscall_64+0x3d/0x40 [ 36.386692][ T603] RBP: ffffc90000cd7d88 R08: ffff888113526883 R09: 1ffff110226a4d10 [ 36.394869][ T603] R10: dffffc0000000000 R11: ffffed10226a4d11 R12: dffffc0000000000 [ 36.403301][ T617] [ 36.405672][ T617] CPU: 0 PID: 617 Comm: syz.0.122 Tainted: G B W syzkaller #0 [ 36.414778][ T597] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 36.421413][ T617] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 36.431663][ T597] RIP: 0033:0x7f96854c2e59 [ 36.436180][ T615] CPU: 1 PID: 615 Comm: syz.6.121 Tainted: G B W syzkaller #0 [ 36.436187][ T615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 36.436253][ T615] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 36.445037][ T597] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 36.458302][ T615] Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 [ 36.462309][ T617] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 36.482443][ T615] RSP: 0018:ffffc90000ca7d68 EFLAGS: 00010293 [ 36.502438][ T603] R13: dffffc0000000000 R14: 0000000016fa9d20 R15: ffff88811ac73c00 [ 36.507934][ T597] RSP: 002b:00007ffcc910d778 EFLAGS: 00000246 [ 36.514150][ T603] FS: 00005555781a5500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 36.521802][ T615] [ 36.528006][ T603] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.537141][ T597] ORIG_RAX: 00000000000001b4 [ 36.539781][ T603] CR2: 00007f1f81d2d57e CR3: 000000011ac03000 CR4: 00000000003506b0 [ 36.546293][ T597] RAX: 0000000000000000 RBX: 00007ffcc910d860 RCX: 00007f96854c2e59 [ 36.563752][ T617] Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 [ 36.567626][ T615] RAX: ffffffff842ec3a7 RBX: ffff88811b210000 RCX: ffff88811a5c13c0 [ 36.594280][ T597] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 36.599531][ T603] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 36.610821][ T603] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 36.610873][ T617] RSP: 0018:ffffc90001737d68 EFLAGS: 00010293 [ 36.619302][ T603] Call Trace: [ 36.621539][ T615] RDX: 0000000000000000 RSI: 000000000bd5bfe0 RDI: 000000000c04eb7d [ 36.625655][ T603] pppol2tp_release+0x150/0x2b0 [ 36.630614][ T615] RBP: ffffc90000ca7d88 R08: ffff88811b210083 R09: 1ffff11023642010 [ 36.639384][ T603] sock_close+0xb8/0x200 [ 36.645467][ T617] [ 36.656572][ T603] ? sock_mmap+0xa0/0xa0 [ 36.664150][ T603] __fput+0x2dc/0x730 [ 36.664604][ T597] RBP: 00000000000089fd R08: 0000000000000001 R09: 0000000000000000 [ 36.675658][ T603] ____fput+0x15/0x20 [ 36.681493][ T603] task_work_run+0x127/0x190 [ 36.686123][ T615] R10: dffffc0000000000 R11: ffffed1023642011 R12: dffffc0000000000 [ 36.686133][ T615] R13: dffffc0000000000 R14: 000000000bd5bfe0 R15: ffff88811a6b2000 [ 36.686143][ T615] FS: 000055558d533500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 36.686152][ T615] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.686160][ T615] CR2: 0000200000000000 CR3: 000000011b364000 CR4: 00000000003506a0 [ 36.686171][ T615] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 36.686178][ T615] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 36.686182][ T615] Call Trace: [ 36.686197][ T615] pppol2tp_release+0x150/0x2b0 [ 36.686241][ T615] sock_close+0xb8/0x200 [ 36.695205][ T617] RAX: ffffffff842ec3a7 RBX: ffff88811ae6d000 RCX: ffff88811a5c2780 [ 36.706041][ T597] R10: 0000001b33120000 R11: 0000000000000246 R12: 00007ffcc910d8a0 [ 36.718190][ T617] RDX: 0000000000000000 RSI: 000000001ae6e000 RDI: 000000000c04eb7d [ 36.730726][ T615] ? sock_mmap+0xa0/0xa0 [ 36.740911][ T603] exit_to_user_mode_loop+0xcb/0xe0 [ 36.756319][ T615] __fput+0x2dc/0x730 [ 36.764870][ T617] RBP: ffffc90001737d88 R08: ffff88811ae6d083 R09: 1ffff110235cda10 [ 36.776032][ T597] R13: 00007f968574afac R14: 0000000000008a31 R15: 00007f968574afa0 [ 36.780013][ T603] exit_to_user_mode_prepare+0x76/0xa0 [ 36.784174][ T629] ------------[ cut here ]------------ [ 36.791373][ T617] R10: dffffc0000000000 R11: ffffed10235cda11 R12: dffffc0000000000 [ 36.792780][ T597] ---[ end trace a8b2d1e3a64b5113 ]--- [ 36.800529][ T603] syscall_exit_to_user_mode+0x1d/0x40 [ 36.810424][ T615] ____fput+0x15/0x20 [ 36.814827][ T617] R13: dffffc0000000000 R14: 000000001ae6e000 R15: ffff88811a6b2c00 [ 36.819923][ T629] WARNING: CPU: 1 PID: 629 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 36.827973][ T603] do_syscall_64+0x3d/0x40 [ 36.833251][ T615] task_work_run+0x127/0x190 [ 36.839343][ T617] FS: 0000555572903500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 36.846013][ T615] exit_to_user_mode_loop+0xcb/0xe0 [ 36.851280][ T603] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 36.861009][ T629] Modules linked in: [ 36.865594][ T617] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.870399][ T629] [ 36.887084][ T603] RIP: 0033:0x7f3deaa33e59 [ 36.902795][ T615] exit_to_user_mode_prepare+0x76/0xa0 [ 36.909617][ T617] CR2: 00007f1f82a35060 CR3: 000000011b18e000 CR4: 00000000003506b0 [ 36.913289][ T615] syscall_exit_to_user_mode+0x1d/0x40 [ 36.921302][ T603] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 36.926588][ T629] CPU: 1 PID: 629 Comm: syz.1.128 Tainted: G B W syzkaller #0 [ 36.926596][ T629] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 36.926613][ T629] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 36.926623][ T629] Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 [ 36.926650][ T629] RSP: 0018:ffffc900017a7d68 EFLAGS: 00010293 [ 36.950872][ T617] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 36.955615][ T615] do_syscall_64+0x3d/0x40 [ 36.985427][ T617] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 37.006573][ T629] [ 37.011061][ T603] RSP: 002b:00007ffc08e382a8 EFLAGS: 00000246 [ 37.018452][ T615] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 37.024092][ T603] ORIG_RAX: 00000000000001b4 [ 37.026893][ T629] RAX: ffffffff842ec3a7 RBX: ffff88811c1a4000 RCX: ffff88811c3ea780 [ 37.032989][ T603] RAX: 0000000000000000 RBX: 00007ffc08e38390 RCX: 00007f3deaa33e59 [ 37.037396][ T615] RIP: 0033:0x7f521f8f1e59 [ 37.047346][ T617] Call Trace: [ 37.054648][ T629] RDX: 0000000000000000 RSI: 000000000efa8800 RDI: 000000000c04eb7d [ 37.058715][ T603] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 37.078112][ T617] pppol2tp_release+0x150/0x2b0 [ 37.082999][ T617] sock_close+0xb8/0x200 [ 37.086914][ T629] RBP: ffffc900017a7d88 R08: ffff88811c1a4083 R09: 1ffff11023834810 [ 37.087941][ T617] ? sock_mmap+0xa0/0xa0 [ 37.095474][ T629] R10: dffffc0000000000 R11: ffffed1023834811 R12: dffffc0000000000 [ 37.100036][ T603] RBP: 0000000000008b8f R08: 0000000000000001 R09: 0000000000000000 [ 37.114480][ T629] R13: dffffc0000000000 R14: 000000000efa8800 R15: ffff88811c1f7400 [ 37.116715][ T615] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 37.124066][ T629] FS: 000055558b5be500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 37.148144][ T615] RSP: 002b:00007ffff00a6988 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 37.153158][ T603] R10: 0000001b33020000 R11: 0000000000000246 R12: 00007ffc08e383d0 [ 37.162736][ T615] RAX: 0000000000000000 RBX: 00007ffff00a6a70 RCX: 00007f521f8f1e59 [ 37.169697][ T617] __fput+0x2dc/0x730 [ 37.181125][ T615] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 37.189686][ T615] RBP: 0000000000008d42 R08: 0000000000000001 R09: 0000000000000000 [ 37.196614][ T629] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.203778][ T603] R13: 00007f3deacbbfac R14: 0000000000008bc2 R15: 00007f3deacbbfa0 [ 37.210337][ T617] ____fput+0x15/0x20 [ 37.213237][ T603] ---[ end trace a8b2d1e3a64b5114 ]--- [ 37.222150][ T615] R10: 0000001b33320000 R11: 0000000000000246 R12: 00007ffff00a6ab0 [ 37.232115][ T629] CR2: 00007f968627d060 CR3: 000000010edc1000 CR4: 00000000003506a0 [ 37.240278][ T615] R13: 00007f521fb79fac R14: 0000000000008d75 R15: 00007f521fb79fa0 [ 37.240289][ T615] ---[ end trace a8b2d1e3a64b5115 ]--- [ 37.255833][ T617] task_work_run+0x127/0x190 [ 37.260483][ T617] exit_to_user_mode_loop+0xcb/0xe0 [ 37.283623][ T617] exit_to_user_mode_prepare+0x76/0xa0 [ 37.294192][ T648] ------------[ cut here ]------------ [ 37.299045][ T617] syscall_exit_to_user_mode+0x1d/0x40 [ 37.306408][ T647] ------------[ cut here ]------------ [ 37.311993][ T647] WARNING: CPU: 1 PID: 647 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 37.323373][ T617] do_syscall_64+0x3d/0x40 [ 37.328898][ T617] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 37.336139][ T648] WARNING: CPU: 1 PID: 648 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 37.346154][ T617] RIP: 0033:0x7ffbf5231e59 [ 37.346168][ T617] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 37.346175][ T617] RSP: 002b:00007ffeb4b66588 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 37.355903][ T629] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 37.373600][ T617] RAX: 0000000000000000 RBX: 00007ffeb4b66670 RCX: 00007ffbf5231e59 [ 37.390177][ T648] Modules linked in: [ 37.395339][ T647] Modules linked in: [ 37.399063][ T617] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 37.399072][ T617] RBP: 0000000000008da0 R08: 0000000000000001 R09: 0000000000000000 [ 37.399079][ T617] R10: 0000001b32c20000 R11: 0000000000000246 R12: 00007ffeb4b666b0 [ 37.399087][ T617] R13: 00007ffbf54b9fac R14: 0000000000008dd2 R15: 00007ffbf54b9fa0 [ 37.399098][ T617] ---[ end trace a8b2d1e3a64b5116 ]--- [ 37.400941][ T629] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 37.413533][ T647] [ 37.429474][ T648] CPU: 1 PID: 648 Comm: syz.5.139 Tainted: G B W syzkaller #0 [ 37.451997][ T647] CPU: 0 PID: 647 Comm: syz.6.135 Tainted: G B W syzkaller #0 [ 37.469622][ T657] ------------[ cut here ]------------ [ 37.475560][ T657] WARNING: CPU: 0 PID: 657 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 37.481124][ T629] Call Trace: [ 37.488262][ T657] Modules linked in: [ 37.489574][ T629] pppol2tp_release+0x150/0x2b0 [ 37.493507][ T657] CPU: 0 PID: 657 Comm: syz.0.142 Tainted: G B W syzkaller #0 [ 37.498235][ T648] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 37.507569][ T647] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 37.517920][ T629] sock_close+0xb8/0x200 [ 37.527641][ T657] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 37.532249][ T629] ? sock_mmap+0xa0/0xa0 [ 37.541874][ T657] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 37.549689][ T648] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 37.560330][ T647] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 37.566935][ T629] __fput+0x2dc/0x730 [ 37.566954][ T657] Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 [ 37.570965][ T629] ____fput+0x15/0x20 [ 37.571004][ T629] task_work_run+0x127/0x190 [ 37.599460][ T647] Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 [ 37.613878][ T648] Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 [ 37.639188][ T657] RSP: 0018:ffffc900016efd68 EFLAGS: 00010293 [ 37.646807][ T648] RSP: 0018:ffffc90000ca7d68 EFLAGS: 00010293 [ 37.650197][ T657] RAX: ffffffff842ec3a7 RBX: ffff88811e02e800 RCX: ffff888119d38000 [ 37.653107][ T648] RAX: ffffffff842ec3a7 RBX: ffff88811d0f3800 RCX: ffff88810eea2780 [ 37.661943][ T647] RSP: 0018:ffffc90000de7d68 EFLAGS: 00010293 [ 37.669351][ T629] exit_to_user_mode_loop+0xcb/0xe0 [ 37.669717][ T663] ------------[ cut here ]------------ [ 37.675440][ T629] exit_to_user_mode_prepare+0x76/0xa0 [ 37.675453][ T629] syscall_exit_to_user_mode+0x1d/0x40 [ 37.675487][ T629] do_syscall_64+0x3d/0x40 [ 37.682890][ T657] RDX: 0000000000000000 RSI: 000000000d617150 RDI: 000000000c04eb7d [ 37.687994][ T648] RDX: 0000000000000000 RSI: 000000000dc951c0 RDI: 000000000c04eb7d [ 37.691927][ T647] [ 37.698108][ T629] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 37.702596][ T663] WARNING: CPU: 0 PID: 663 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 37.710379][ T648] RBP: ffffc90000ca7d88 R08: ffff88811d0f3883 R09: 1ffff11023a1e710 [ 37.718043][ T647] RAX: ffffffff842ec3a7 RBX: ffff88811d0f0800 RCX: ffff88811cd962c0 [ 37.720753][ T648] R10: dffffc0000000000 R11: ffffed1023a1e711 R12: dffffc0000000000 [ 37.726576][ T657] RBP: ffffc900016efd88 R08: ffff88811e02e883 R09: 1ffff11023c05d10 [ 37.736689][ T629] RIP: 0033:0x7f1f81c7ae59 [ 37.760230][ T647] RDX: 0000000000000000 RSI: 000000001c196800 RDI: 000000000c04eb7d [ 37.769153][ T648] R13: dffffc0000000000 R14: 000000000dc951c0 R15: ffff88811c196800 [ 37.788636][ T657] R10: dffffc0000000000 R11: ffffed1023c05d11 R12: dffffc0000000000 [ 37.789142][ T648] FS: 00005555781a5500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 37.796808][ T647] RBP: ffffc90000de7d88 R08: ffff88811d0f0883 R09: 1ffff11023a1e110 [ 37.806403][ T629] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 37.813901][ T663] Modules linked in: [ 37.833735][ T647] R10: dffffc0000000000 R11: ffffed1023a1e111 R12: dffffc0000000000 [ 37.834114][ T657] R13: dffffc0000000000 R14: 000000000d617150 R15: ffff88811a75d800 [ 37.837775][ T647] R13: dffffc0000000000 R14: 000000001c196800 R15: ffff88811c197000 [ 37.837793][ T647] FS: 000055558d533500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 37.847082][ T648] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.854096][ T663] [ 37.861967][ T657] FS: 0000555572903500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 37.871290][ T647] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.877785][ T648] CR2: 00007f96857122f8 CR3: 0000000128536000 CR4: 00000000003506a0 [ 37.880031][ T647] CR2: 0000200000000000 CR3: 000000011cf73000 CR4: 00000000003506b0 [ 37.888841][ T648] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 37.895900][ T663] CPU: 0 PID: 663 Comm: syz.3.145 Tainted: G B W syzkaller #0 [ 37.903611][ T629] RSP: 002b:00007fff9e3d69b8 EFLAGS: 00000246 [ 37.911774][ T647] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 37.919553][ T657] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.928556][ T663] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 37.934424][ T648] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 37.942556][ T647] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 37.948883][ T629] ORIG_RAX: 00000000000001b4 [ 37.959176][ T657] CR2: 00007f96857122f8 CR3: 0000000119540000 CR4: 00000000003506a0 [ 37.967049][ T648] Call Trace: [ 37.975666][ T663] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 37.980030][ T648] pppol2tp_release+0x150/0x2b0 [ 37.988048][ T657] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 37.991171][ T629] RAX: 0000000000000000 RBX: 00007fff9e3d6aa0 RCX: 00007f1f81c7ae59 [ 37.997631][ T647] Call Trace: [ 38.002513][ T648] sock_close+0xb8/0x200 [ 38.010255][ T663] Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 [ 38.018803][ T629] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 38.021580][ T657] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 38.025746][ T629] RBP: 0000000000008f81 R08: 0000000000000001 R09: 0000000000000000 [ 38.045580][ T647] pppol2tp_release+0x150/0x2b0 [ 38.054147][ T648] ? sock_mmap+0xa0/0xa0 [ 38.061646][ T663] RSP: 0018:ffffc90000e27d68 EFLAGS: 00010293 [ 38.070262][ T648] __fput+0x2dc/0x730 [ 38.074614][ T663] [ 38.079295][ T648] ____fput+0x15/0x20 [ 38.084975][ T647] sock_close+0xb8/0x200 [ 38.089777][ T629] R10: 0000001b32e20000 R11: 0000000000000246 R12: 00007fff9e3d6ae0 [ 38.091355][ T647] ? sock_mmap+0xa0/0xa0 [ 38.095331][ T629] R13: 00007f1f81f02fac R14: 0000000000008fb5 R15: 00007f1f81f02fa0 [ 38.099717][ T663] RAX: ffffffff842ec3a7 RBX: ffff88811d09a800 RCX: ffff88811b3113c0 [ 38.108493][ T648] task_work_run+0x127/0x190 [ 38.111934][ T657] Call Trace: [ 38.120634][ T648] exit_to_user_mode_loop+0xcb/0xe0 [ 38.127898][ T647] __fput+0x2dc/0x730 [ 38.127942][ T647] ____fput+0x15/0x20 [ 38.133560][ T629] ---[ end trace a8b2d1e3a64b5117 ]--- [ 38.136079][ T663] RDX: 0000000000000000 RSI: 000000000f791cb0 RDI: 000000000c04eb7d [ 38.162913][ T647] task_work_run+0x127/0x190 [ 38.166137][ T648] exit_to_user_mode_prepare+0x76/0xa0 [ 38.167820][ T657] pppol2tp_release+0x150/0x2b0 [ 38.176622][ T648] syscall_exit_to_user_mode+0x1d/0x40 2026/07/08 12:27:38 executed programs: 139 [ 38.178462][ T647] exit_to_user_mode_loop+0xcb/0xe0 [ 38.183782][ T648] do_syscall_64+0x3d/0x40 [ 38.189006][ T657] sock_close+0xb8/0x200 [ 38.189016][ T657] ? sock_mmap+0xa0/0xa0 [ 38.189028][ T657] __fput+0x2dc/0x730 [ 38.189040][ T657] ____fput+0x15/0x20 [ 38.189050][ T657] task_work_run+0x127/0x190 [ 38.189061][ T657] exit_to_user_mode_loop+0xcb/0xe0 [ 38.189101][ T657] exit_to_user_mode_prepare+0x76/0xa0 [ 38.201280][ T648] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 38.204248][ T647] exit_to_user_mode_prepare+0x76/0xa0 [ 38.232340][ T648] RIP: 0033:0x7f3deaa33e59 [ 38.237497][ T663] RBP: ffffc90000e27d88 R08: ffff88811d09a883 R09: 1ffff11023a13510 [ 38.244059][ T648] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 38.249570][ T657] syscall_exit_to_user_mode+0x1d/0x40 [ 38.275315][ T663] R10: dffffc0000000000 R11: ffffed1023a13511 R12: dffffc0000000000 [ 38.286149][ T663] R13: dffffc0000000000 R14: 000000000f791cb0 R15: ffff88811afc3800 [ 38.287111][ T648] RSP: 002b:00007ffc08e382a8 EFLAGS: 00000246 [ 38.294162][ T663] FS: 00005555640ad500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 38.294171][ T663] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 38.294180][ T663] CR2: 00007f1f81f04dac CR3: 000000011dff1000 CR4: 00000000003506b0 [ 38.294195][ T663] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 38.302492][ T648] ORIG_RAX: 00000000000001b4 [ 38.309844][ T657] do_syscall_64+0x3d/0x40 [ 38.317078][ T648] RAX: 0000000000000000 RBX: 00007ffc08e38390 RCX: 00007f3deaa33e59 [ 38.324874][ T647] syscall_exit_to_user_mode+0x1d/0x40 [ 38.334346][ T648] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 38.337409][ T657] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 38.350552][ T648] RBP: 0000000000009189 R08: 0000000000000001 R09: 0000000000000000 [ 38.355428][ T647] do_syscall_64+0x3d/0x40 [ 38.381684][ T648] R10: 0000001b33020000 R11: 0000000000000246 R12: 00007ffc08e383d0 [ 38.381962][ T663] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 38.390500][ T648] R13: 00007f3deacbbfac R14: 00000000000091bc R15: 00007f3deacbbfa0 [ 38.398249][ T657] RIP: 0033:0x7ffbf5231e59 [ 38.410233][ T663] Call Trace: [ 38.413688][ T663] pppol2tp_release+0x150/0x2b0 [ 38.418664][ T647] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 38.424588][ T647] RIP: 0033:0x7f521f8f1e59 [ 38.429734][ T648] ---[ end trace a8b2d1e3a64b5118 ]--- [ 38.434100][ T657] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 38.455206][ T663] sock_close+0xb8/0x200 [ 38.459650][ T663] ? sock_mmap+0xa0/0xa0 [ 38.463926][ T663] __fput+0x2dc/0x730 [ 38.468773][ T647] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 38.488537][ T663] ____fput+0x15/0x20 [ 38.494016][ T663] task_work_run+0x127/0x190 [ 38.503765][ T663] exit_to_user_mode_loop+0xcb/0xe0 [ 38.510131][ T675] ------------[ cut here ]------------ [ 38.512967][ T657] RSP: 002b:00007ffeb4b66588 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 38.524317][ T675] WARNING: CPU: 1 PID: 675 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 38.527337][ T663] exit_to_user_mode_prepare+0x76/0xa0 [ 38.540031][ T647] RSP: 002b:00007ffff00a6988 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 38.548369][ T675] Modules linked in: [ 38.550093][ T657] RAX: 0000000000000000 RBX: 00007ffeb4b66670 RCX: 00007ffbf5231e59 [ 38.553462][ T675] CPU: 1 PID: 675 Comm: syz.5.151 Tainted: G B W syzkaller #0 [ 38.561402][ T663] syscall_exit_to_user_mode+0x1d/0x40 [ 38.570595][ T675] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 38.576074][ T647] RAX: 0000000000000000 RBX: 00007ffff00a6a70 RCX: 00007f521f8f1e59 [ 38.586880][ T675] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 38.594213][ T657] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 38.607875][ T663] do_syscall_64+0x3d/0x40 [ 38.612328][ T663] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 38.618309][ T647] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 38.626485][ T657] RBP: 0000000000009226 R08: 0000000000000001 R09: 0000000000000000 [ 38.633372][ T675] Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 [ 38.639093][ T663] RIP: 0033:0x7f96854c2e59 [ 38.659073][ T675] RSP: 0018:ffffc900017efd68 EFLAGS: 00010293 [ 38.660457][ T657] R10: 0000001b32c20000 R11: 0000000000000246 R12: 00007ffeb4b666b0 [ 38.666434][ T675] RAX: ffffffff842ec3a7 RBX: ffff88810ee55000 RCX: ffff88811b1562c0 [ 38.673298][ T647] RBP: 0000000000009189 R08: 0000000000000001 R09: 0000000000000000 [ 38.682015][ T675] RDX: 0000000000000000 RSI: 000000000d617600 RDI: 000000000c04eb7d [ 38.689638][ T657] R13: 00007ffbf54b9fac R14: 0000000000009259 R15: 00007ffbf54b9fa0 [ 38.698659][ T675] RBP: ffffc900017efd88 R08: ffff88810ee55083 R09: 1ffff11021dcaa10 [ 38.705774][ T647] R10: 0000001b33320000 R11: 0000000000000246 R12: 00007ffff00a6ab0 [ 38.714825][ T675] R10: dffffc0000000000 R11: ffffed1021dcaa11 R12: dffffc0000000000 [ 38.721517][ T663] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 38.731017][ T675] R13: dffffc0000000000 R14: 000000000d617600 R15: ffff88811d004800 [ 38.749425][ T657] ---[ end trace a8b2d1e3a64b5119 ]--- [ 38.761196][ T675] FS: 00005555781a5500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 38.769225][ T647] R13: 00007f521fb79fac R14: 00000000000091bb R15: 00007f521fb79fa0 [ 38.787490][ T675] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 38.792967][ T647] ---[ end trace a8b2d1e3a64b511a ]--- [ 38.804119][ T663] RSP: 002b:00007ffcc910d778 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 38.812776][ T675] CR2: 00007f1f81d2d57e CR3: 000000011b8ef000 CR4: 00000000003506a0 [ 38.818505][ T663] RAX: 0000000000000000 RBX: 00007ffcc910d860 RCX: 00007f96854c2e59 [ 38.829598][ T663] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 38.837663][ T663] RBP: 00000000000092ec R08: 0000000000000001 R09: 0000000000000000 [ 38.849860][ T675] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 38.862877][ T691] ------------[ cut here ]------------ [ 38.863445][ T694] ------------[ cut here ]------------ [ 38.875065][ T675] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 38.878785][ T691] refcount_t: underflow; use-after-free. [ 38.889922][ T663] R10: 0000001b33120000 R11: 0000000000000246 R12: 00007ffcc910d8a0 [ 38.899081][ T663] R13: 00007f968574afac R14: 0000000000009320 R15: 00007f968574afa0 [ 38.900901][ T691] WARNING: CPU: 1 PID: 691 at lib/refcount.c:28 refcount_warn_saturate+0x120/0x1a0 [ 38.910803][ T694] WARNING: CPU: 0 PID: 694 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 38.926692][ T675] Call Trace: [ 38.931632][ T663] ---[ end trace a8b2d1e3a64b511b ]--- [ 38.936032][ T691] Modules linked in: [ 38.937805][ T675] pppol2tp_release+0x150/0x2b0 [ 38.941354][ T691] CPU: 1 PID: 691 Comm: syz.6.159 Tainted: G B W syzkaller #0 [ 38.955849][ T694] Modules linked in: [ 38.960447][ T675] sock_close+0xb8/0x200 [ 38.964728][ T675] ? sock_mmap+0xa0/0xa0 [ 38.969121][ T691] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 38.971506][ T694] CPU: 1 PID: 694 Comm: syz.0.160 Tainted: G B W syzkaller #0 [ 38.988771][ T694] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 38.996540][ T675] __fput+0x2dc/0x730 [ 39.008038][ T691] RIP: 0010:refcount_warn_saturate+0x120/0x1a0 [ 39.015015][ T694] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 39.021664][ T694] Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 [ 39.021754][ T703] ------------[ cut here ]------------ [ 39.042130][ T694] RSP: 0000:ffffc90000ef7d68 EFLAGS: 00010293 [ 39.048507][ T691] Code: 04 01 48 c7 c7 e0 48 40 85 e8 7c ca 3a 02 0f 0b eb c3 e8 73 89 26 ff c6 05 b1 75 82 04 01 48 c7 c7 40 49 40 85 e8 60 ca 3a 02 <0f> 0b eb a7 e8 57 89 26 ff c6 05 92 75 82 04 01 48 c7 c7 60 48 40 [ 39.059321][ T694] RAX: ffffffff842ec3a7 RBX: ffff88811da61000 RCX: ffff88811c18cf00 [ 39.073273][ T675] ____fput+0x15/0x20 [ 39.084968][ T675] task_work_run+0x127/0x190 [ 39.089905][ T675] exit_to_user_mode_loop+0xcb/0xe0 [ 39.095144][ T675] exit_to_user_mode_prepare+0x76/0xa0 [ 39.100708][ T694] RDX: 0000000000000000 RSI: 000000001d9a1100 RDI: 000000000c04eb7d [ 39.108797][ T703] WARNING: CPU: 0 PID: 703 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 39.111994][ T691] RSP: 0018:ffffc90000ee7d18 EFLAGS: 00010246 [ 39.122595][ T675] syscall_exit_to_user_mode+0x1d/0x40 [ 39.125700][ T691] RAX: b567b14ea0fb1500 RBX: 0000000000000003 RCX: ffff88811b150000 [ 39.131342][ T694] RBP: ffffc90000ef7d88 R08: ffff88811da61083 R09: 1ffff11023b4c210 [ 39.140270][ T691] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 39.147801][ T703] Modules linked in: [ 39.157155][ T691] RBP: ffffc90000ee7d28 R08: ffff8881f7152fbf R09: 1ffff1103ee2a5f7 [ 39.159979][ T675] do_syscall_64+0x3d/0x40 [ 39.167703][ T691] R10: dffffc0000000000 R11: ffffed103ee2a5f8 R12: 0000000000000000 [ 39.172241][ T703] CPU: 0 PID: 703 Comm: syz.1.166 Tainted: G B W syzkaller #0 [ 39.180017][ T691] R13: dffffc0000000000 R14: 0000000000000003 R15: 0000000000000000 [ 39.189155][ T675] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 39.202537][ T694] R10: dffffc0000000000 R11: ffffed1023b4c211 R12: dffffc0000000000 [ 39.210678][ T675] RIP: 0033:0x7f3deaa33e59 [ 39.215128][ T675] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 39.225159][ T691] FS: 000055558d533500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 39.235276][ T703] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 39.254139][ T694] R13: dffffc0000000000 R14: 000000001d9a1100 R15: ffff88811c310400 [ 39.262361][ T694] FS: 0000555572903500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 39.272016][ T703] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 39.278527][ T675] RSP: 002b:00007ffc08e382a8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 39.281045][ T691] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 39.291012][ T694] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 39.295395][ T691] CR2: 00007f968574cdac CR3: 000000011e2ac000 CR4: 00000000003506a0 [ 39.301762][ T703] Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 [ 39.309172][ T691] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 39.332386][ T675] RAX: 0000000000000000 RBX: 00007ffc08e38390 RCX: 00007f3deaa33e59 [ 39.345433][ T694] CR2: 0000200000000000 CR3: 00000001273ad000 CR4: 00000000003506b0 [ 39.353589][ T675] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 39.358612][ T691] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 39.361756][ T694] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 39.374182][ T691] Call Trace: [ 39.378295][ T675] RBP: 0000000000009643 R08: 0000000000000001 R09: 0000000000000000 [ 39.383686][ T691] l2tp_session_put+0xcb/0x1a0 [ 39.389138][ T703] RSP: 0018:ffffc900017ffd68 EFLAGS: 00010293 [ 39.400163][ T675] R10: 0000001b33020000 R11: 0000000000000246 R12: 00007ffc08e383d0 [ 39.408295][ T694] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 39.416911][ T703] RAX: ffffffff842ec3a7 RBX: ffff88811d077000 RCX: ffff8881075c62c0 [ 39.424921][ T703] RDX: 0000000000000000 RSI: 000000001d510600 RDI: 000000000c04eb7d [ 39.425224][ T691] l2tp_session_delete+0x3a9/0x4a0 [ 39.433124][ T675] R13: 00007f3deacbbfac R14: 0000000000009676 R15: 00007f3deacbbfa0 [ 39.440425][ T691] pppol2tp_release+0x169/0x2b0 [ 39.446251][ T694] Call Trace: [ 39.454457][ T694] pppol2tp_release+0x150/0x2b0 [ 39.459426][ T703] RBP: ffffc900017ffd88 R08: ffff88811d077083 R09: 1ffff11023a0ee10 [ 39.467484][ T675] ---[ end trace a8b2d1e3a64b511c ]--- [ 39.473107][ T694] sock_close+0xb8/0x200 [ 39.477431][ T694] ? sock_mmap+0xa0/0xa0 [ 39.481698][ T694] __fput+0x2dc/0x730 [ 39.483429][ T691] sock_close+0xb8/0x200