syzkaller syzkaller login: [ 12.330481][ T28] kauditd_printk_skb: 48 callbacks suppressed [ 12.330494][ T28] audit: type=1400 audit(1791053336.869:59): avc: denied { transition } for pid=223 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.334474][ T28] audit: type=1400 audit(1791053336.869:60): avc: denied { noatsecure } for pid=223 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.337207][ T28] audit: type=1400 audit(1791053336.869:61): avc: denied { write } for pid=223 comm="sh" path="pipe:[15120]" dev="pipefs" ino=15120 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 12.340247][ T28] audit: type=1400 audit(1791053336.869:62): avc: denied { rlimitinh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.342950][ T28] audit: type=1400 audit(1791053336.869:63): avc: denied { siginh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.12' (ED25519) to the list of known hosts. 2026/10/03 18:49:05 parsed 1 programs 2026/10/03 18:49:05 serving rpc on tcp://46863 [ 21.385294][ T28] audit: type=1400 audit(1791053345.929:64): avc: denied { node_bind } for pid=295 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 21.406463][ T28] audit: type=1400 audit(1791053345.929:65): avc: denied { module_request } for pid=295 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 22.178809][ T28] audit: type=1400 audit(1791053346.719:66): avc: denied { mounton } for pid=301 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.179782][ T301] cgroup: Unknown subsys name 'net' [ 22.201464][ T28] audit: type=1400 audit(1791053346.719:67): avc: denied { mount } for pid=301 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.228726][ T28] audit: type=1400 audit(1791053346.759:68): avc: denied { unmount } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.228899][ T301] cgroup: Unknown subsys name 'devices' [ 22.373298][ T301] cgroup: Unknown subsys name 'hugetlb' [ 22.378895][ T301] cgroup: Unknown subsys name 'rlimit' [ 22.487402][ T28] audit: type=1400 audit(1791053347.029:69): avc: denied { setattr } for pid=301 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.510618][ T28] audit: type=1400 audit(1791053347.029:70): avc: denied { create } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 22.531015][ T28] audit: type=1400 audit(1791053347.029:71): avc: denied { write } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 22.531896][ T306] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.551310][ T28] audit: type=1400 audit(1791053347.029:72): avc: denied { read } for pid=301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 22.580015][ T28] audit: type=1400 audit(1791053347.029:73): avc: denied { mounton } for pid=301 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.615169][ T301] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.242191][ T308] request_module fs-gadgetfs succeeded, but still no fs? [ 23.332409][ T316] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.339467][ T316] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.346877][ T316] device bridge_slave_0 entered promiscuous mode [ 23.353687][ T316] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.360700][ T316] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.368061][ T316] device bridge_slave_1 entered promiscuous mode [ 23.405341][ T316] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.412424][ T316] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.419660][ T316] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.426694][ T316] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.443530][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.450813][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.458251][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.465931][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.475504][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.483752][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.490772][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.499649][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.507906][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.514957][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.527154][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.538879][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.548501][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.559464][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.567623][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.575226][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.584305][ T316] device veth0_vlan entered promiscuous mode [ 23.593728][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.602553][ T316] device veth1_macvtap entered promiscuous mode [ 23.611334][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.620863][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.647338][ T316] syz-executor (316) used greatest stack depth: 21856 bytes left 2026/10/03 18:49:08 executed programs: 0 [ 24.247185][ T368] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.254386][ T368] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.261775][ T368] device bridge_slave_0 entered promiscuous mode [ 24.272047][ T368] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.279071][ T368] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.286445][ T368] device bridge_slave_1 entered promiscuous mode [ 24.323485][ T368] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.330520][ T368] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.337805][ T368] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.344836][ T368] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.362806][ T322] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.370345][ T322] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.377709][ T322] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.389806][ T322] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.398153][ T322] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.406497][ T322] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.413553][ T322] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.425879][ T322] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.434225][ T322] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.442439][ T322] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.449449][ T322] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.460092][ T322] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.468556][ T322] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.480948][ T322] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.489090][ T322] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.501430][ T322] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.509945][ T322] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.524278][ T322] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.532224][ T322] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.541047][ T322] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.548623][ T322] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.556654][ T368] device veth0_vlan entered promiscuous mode [ 24.569850][ T322] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.577937][ T322] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.586834][ T368] device veth1_macvtap entered promiscuous mode [ 24.595327][ T322] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.603061][ T322] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.611256][ T322] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.621872][ T8] device bridge_slave_1 left promiscuous mode [ 24.627992][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.635455][ T8] device bridge_slave_0 left promiscuous mode [ 24.641539][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.649541][ T8] device veth1_macvtap left promiscuous mode [ 24.655626][ T8] device veth0_vlan left promiscuous mode [ 24.706389][ T322] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.714624][ T322] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.772075][ T373] ================================================================== [ 24.780180][ T373] BUG: KASAN: use-after-free in mutex_lock+0x86/0x1b0 [ 24.786956][ T373] Write of size 8 at addr ffff88810ff09150 by task syz.2.17/373 [ 24.794589][ T373] [ 24.796919][ T373] CPU: 1 PID: 373 Comm: syz.2.17 Not tainted syzkaller #0 [ 24.804035][ T373] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 24.814098][ T373] Call Trace: [ 24.817372][ T373] [ 24.820298][ T373] __dump_stack+0x21/0x24 [ 24.824633][ T373] dump_stack_lvl+0x110/0x170 [ 24.829320][ T373] ? __cfi_dump_stack_lvl+0x8/0x8 [ 24.834351][ T373] ? mutex_lock+0x86/0x1b0 [ 24.838766][ T373] print_address_description+0x71/0x200 [ 24.844309][ T373] print_report+0x4a/0x60 [ 24.848630][ T373] kasan_report+0x122/0x150 [ 24.853121][ T373] ? mutex_lock+0x86/0x1b0 [ 24.857520][ T373] kasan_check_range+0x249/0x2a0 [ 24.862444][ T373] __kasan_check_write+0x14/0x20 [ 24.867366][ T373] mutex_lock+0x86/0x1b0 [ 24.871590][ T373] ? __cfi_mutex_lock+0x10/0x10 [ 24.876444][ T373] ? kfree+0x6f/0xf0 [ 24.880322][ T373] ? l2tp_session_put+0xaf/0x1a0 [ 24.885242][ T373] ? l2tp_session_delete+0x3df/0x4d0 [ 24.890513][ T373] pppol2tp_release+0x178/0x2b0 [ 24.895352][ T373] sock_close+0xc9/0x220 [ 24.899576][ T373] ? __cfi_sock_close+0x10/0x10 [ 24.904411][ T373] __fput+0x1fd/0x8f0 [ 24.908377][ T373] ____fput+0x15/0x20 [ 24.912342][ T373] task_work_run+0x1e1/0x250 [ 24.916916][ T373] ? __cfi_task_work_run+0x10/0x10 [ 24.922017][ T373] ? free_nsproxy+0x21f/0x270 [ 24.926684][ T373] do_exit+0xb0d/0x29f0 [ 24.930827][ T373] ? __cfi_do_exit+0x10/0x10 [ 24.935403][ T373] ? __kasan_check_write+0x14/0x20 [ 24.940497][ T373] ? __kasan_check_write+0x14/0x20 [ 24.945589][ T373] ? _raw_spin_lock_irq+0x95/0xf0 [ 24.950599][ T373] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 24.956131][ T373] do_group_exit+0x21b/0x2e0 [ 24.960708][ T373] ? __kasan_check_write+0x14/0x20 [ 24.965806][ T373] ? recalc_sigpending+0x180/0x1c0 [ 24.970900][ T373] get_signal+0x167c/0x1700 [ 24.975391][ T373] ? __cfi_get_signal+0x10/0x10 [ 24.980232][ T373] ? usleep_range_state+0x130/0x130 [ 24.985415][ T373] arch_do_signal_or_restart+0xd1/0x11c0 [ 24.991035][ T373] ? hrtimer_nanosleep+0x18f/0x340 [ 24.996134][ T373] ? __cfi_hrtimer_nanosleep+0x10/0x10 [ 25.001581][ T373] ? __cfi_hrtimer_wakeup+0x10/0x10 [ 25.006761][ T373] ? get_timespec64+0x116/0x1b0 [ 25.011605][ T373] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 25.017748][ T373] ? __x64_sys_clock_nanosleep+0xb0/0xb0 [ 25.023365][ T373] ? do_user_addr_fault+0x9a5/0x1030 [ 25.028635][ T373] exit_to_user_mode_loop+0x7a/0xb0 [ 25.033816][ T373] exit_to_user_mode_prepare+0x87/0xd0 [ 25.039259][ T373] syscall_exit_to_user_mode+0x1a/0x30 [ 25.044701][ T373] do_syscall_64+0x58/0xa0 [ 25.049104][ T373] ? clear_bhb_loop+0x30/0x80 [ 25.053764][ T373] ? clear_bhb_loop+0x30/0x80 [ 25.058423][ T373] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 25.064297][ T373] RIP: 0033:0x7f24585592d7 [ 25.068694][ T373] Code: Unable to access opcode bytes at 0x7f24585592ad. [ 25.075688][ T373] RSP: 002b:00007fff1385c6e0 EFLAGS: 00000202 ORIG_RAX: 00000000000000e6 [ 25.084086][ T373] RAX: fffffffffffffdfc RBX: 00005555610af500 RCX: 00007f24585592d7 [ 25.092043][ T373] RDX: 00007fff1385c720 RSI: 0000000000000000 RDI: 0000000000000000 [ 25.100004][ T373] RBP: 00007f245863506b R08: 0000000000000000 R09: 0000000000000000 [ 25.107975][ T373] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 25.115943][ T373] R13: 00007f2458825fac R14: 00007f2458825fa0 R15: 00007f2458825fa0 [ 25.123907][ T373] [ 25.126915][ T373] [ 25.129220][ T373] Allocated by task 372: [ 25.133439][ T373] kasan_set_track+0x4b/0x70 [ 25.138017][ T373] kasan_save_alloc_info+0x1f/0x30 [ 25.143114][ T373] __kasan_kmalloc+0x95/0xb0 [ 25.147700][ T373] __kmalloc+0xb4/0x1e0 [ 25.151840][ T373] l2tp_session_create+0x38/0xbd0 [ 25.156860][ T373] pppol2tp_connect+0xbf5/0x1640 [ 25.161797][ T373] __sys_connect+0x3da/0x460 [ 25.166378][ T373] __x64_sys_connect+0x7a/0x90 [ 25.171135][ T373] x64_sys_call+0x88d/0x9a0 [ 25.175633][ T373] do_syscall_64+0x4c/0xa0 [ 25.180056][ T373] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 25.185932][ T373] [ 25.188241][ T373] Freed by task 373: [ 25.192117][ T373] kasan_set_track+0x4b/0x70 [ 25.196696][ T373] kasan_save_free_info+0x2b/0x40 [ 25.201707][ T373] ____kasan_slab_free+0x132/0x180 [ 25.206804][ T373] __kasan_slab_free+0x11/0x20 [ 25.211553][ T373] slab_free_freelist_hook+0xc2/0x190 [ 25.216915][ T373] __kmem_cache_free+0xb7/0x1b0 [ 25.221753][ T373] kfree+0x6f/0xf0 [ 25.225458][ T373] l2tp_session_put+0xaf/0x1a0 [ 25.230204][ T373] l2tp_session_delete+0x3df/0x4d0 [ 25.235306][ T373] pppol2tp_release+0x169/0x2b0 [ 25.240138][ T373] sock_close+0xc9/0x220 [ 25.244360][ T373] __fput+0x1fd/0x8f0 [ 25.248325][ T373] ____fput+0x15/0x20 [ 25.252290][ T373] task_work_run+0x1e1/0x250 [ 25.256867][ T373] do_exit+0xb0d/0x29f0 [ 25.261010][ T373] do_group_exit+0x21b/0x2e0 [ 25.265583][ T373] get_signal+0x167c/0x1700 [ 25.270074][ T373] arch_do_signal_or_restart+0xd1/0x11c0 [ 25.275688][ T373] exit_to_user_mode_loop+0x7a/0xb0 [ 25.280871][ T373] exit_to_user_mode_prepare+0x87/0xd0 [ 25.286311][ T373] syscall_exit_to_user_mode+0x1a/0x30 [ 25.291758][ T373] do_syscall_64+0x58/0xa0 [ 25.296164][ T373] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 25.302050][ T373] [ 25.304355][ T373] The buggy address belongs to the object at ffff88810ff09000 [ 25.304355][ T373] which belongs to the cache kmalloc-512 of size 512 [ 25.318383][ T373] The buggy address is located 336 bytes inside of [ 25.318383][ T373] 512-byte region [ffff88810ff09000, ffff88810ff09200) [ 25.331635][ T373] [ 25.333946][ T373] The buggy address belongs to the physical page: [ 25.340333][ T373] page:ffffea00043fc200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10ff08 [ 25.350561][ T373] head:ffffea00043fc200 order:2 compound_mapcount:0 compound_pincount:0 [ 25.358863][ T373] flags: 0x4000000000010200(slab|head|zone=1) [ 25.364961][ T373] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 [ 25.373542][ T373] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 25.382107][ T373] page dumped because: kasan: bad access detected [ 25.388511][ T373] page_owner tracks the page as allocated [ 25.394206][ T373] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 39, tgid 39 (kworker/1:1), ts 24726398573, free_ts 22172195995 [ 25.415899][ T373] post_alloc_hook+0x1f5/0x210 [ 25.420652][ T373] prep_new_page+0x1c/0x110 [ 25.425140][ T373] get_page_from_freelist+0x2ca9/0x2d20 [ 25.430733][ T373] __alloc_pages+0x1fa/0x610 [ 25.435321][ T373] alloc_slab_page+0x6e/0xf0 [ 25.439893][ T373] new_slab+0x98/0x3e0 [ 25.443947][ T373] ___slab_alloc+0x70f/0xb70 [ 25.448527][ T373] __slab_alloc+0x5e/0xa0 [ 25.452844][ T373] __kmem_cache_alloc_node+0x204/0x2d0 [ 25.458293][ T373] __kmalloc_node_track_caller+0xa1/0x1e0 [ 25.463998][ T373] __alloc_skb+0x226/0x4a0 [ 25.468399][ T373] __ipv6_ifa_notify+0x200/0xe80 [ 25.473326][ T373] addrconf_dad_completed+0x192/0xe80 [ 25.478681][ T373] addrconf_dad_work+0xc1b/0x14a0 [ 25.483689][ T373] process_one_work+0x717/0xc30 [ 25.488521][ T373] worker_thread+0xa4d/0x11d0 [ 25.493181][ T373] page last free stack trace: [ 25.497831][ T373] free_unref_page_prepare+0x81b/0x820 [ 25.503279][ T373] free_unref_page+0x93/0x530 [ 25.507941][ T373] __free_pages+0x67/0x100 [ 25.512341][ T373] __free_slab+0xc7/0x1a0 [ 25.516648][ T373] discard_slab+0x29/0x40 [ 25.520967][ T373] __slab_free+0x201/0x280 [ 25.525371][ T373] ___cache_free+0xbf/0xd0 [ 25.529773][ T373] qlist_free_all+0xc6/0x140 [ 25.534346][ T373] kasan_quarantine_reduce+0x14a/0x170 [ 25.539787][ T373] __kasan_slab_alloc+0x24/0x80 [ 25.544619][ T373] slab_post_alloc_hook+0x4f/0x2d0 [ 25.549714][ T373] __kmem_cache_alloc_node+0x194/0x2d0 [ 25.555161][ T373] __kmalloc_node+0xa2/0x1e0 [ 25.559732][ T373] kvmalloc_node+0x28a/0x460 [ 25.564302][ T373] seq_read_iter+0x1f1/0xd80 [ 25.568873][ T373] kernfs_fop_read_iter+0x14d/0x4e0 [ 25.574059][ T373] [ 25.576363][ T373] Memory state around the buggy address: [ 25.581973][ T373] ffff88810ff09000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.590014][ T373] ffff88810ff09080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.598052][ T373] >ffff88810ff09100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.606087][ T373] ^ [ 25.612738][ T373] ffff88810ff09180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.620779][ T373] ffff88810ff09200: fc fc fc fc fc fc f