Warning: Permanently added '10.128.1.82' (ED25519) to the list of known hosts. 2026/01/06 06:48:45 parsed 1 programs [ 46.181614][ T30] audit: type=1400 audit(1767682126.111:105): avc: denied { unlink } for pid=401 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 46.212654][ T401] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 46.611391][ T30] audit: type=1400 audit(1767682126.541:106): avc: denied { create } for pid=412 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 46.895776][ T410] bridge0: port 1(bridge_slave_0) entered blocking state [ 46.902888][ T410] bridge0: port 1(bridge_slave_0) entered disabled state [ 46.910353][ T410] device bridge_slave_0 entered promiscuous mode [ 46.918160][ T410] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.925238][ T410] bridge0: port 2(bridge_slave_1) entered disabled state [ 46.932819][ T410] device bridge_slave_1 entered promiscuous mode [ 46.978541][ T30] audit: type=1401 audit(1767682126.901:107): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 47.160772][ T410] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.167844][ T410] bridge0: port 2(bridge_slave_1) entered forwarding state [ 47.175133][ T410] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.182175][ T410] bridge0: port 1(bridge_slave_0) entered forwarding state [ 47.211750][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.222319][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.238322][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 47.246297][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 47.269520][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 47.278012][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.285085][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 47.293636][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 47.301914][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.308972][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 47.316600][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 47.333079][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 47.345878][ T410] device veth0_vlan entered promiscuous mode [ 47.352813][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 47.361995][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 47.370093][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 47.378025][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 47.391876][ T410] device veth1_macvtap entered promiscuous mode [ 47.406080][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready 2026/01/06 06:48:47 executed programs: 0 [ 47.415073][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 47.424944][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 47.592847][ T473] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.599916][ T473] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.607619][ T473] device bridge_slave_0 entered promiscuous mode [ 47.615516][ T473] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.622823][ T473] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.630132][ T473] device bridge_slave_1 entered promiscuous mode [ 47.650741][ T475] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.657899][ T475] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.665286][ T475] device bridge_slave_0 entered promiscuous mode [ 47.672617][ T475] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.679657][ T475] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.687690][ T475] device bridge_slave_1 entered promiscuous mode [ 47.785852][ T477] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.793163][ T477] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.800406][ T477] device bridge_slave_0 entered promiscuous mode [ 47.807665][ T477] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.814830][ T477] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.822177][ T477] device bridge_slave_1 entered promiscuous mode [ 47.830079][ T479] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.837717][ T479] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.845053][ T479] device bridge_slave_0 entered promiscuous mode [ 47.873630][ T479] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.880662][ T479] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.888065][ T479] device bridge_slave_1 entered promiscuous mode [ 47.931068][ T480] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.938107][ T480] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.945561][ T480] device bridge_slave_0 entered promiscuous mode [ 47.972587][ T480] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.979683][ T480] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.987223][ T480] device bridge_slave_1 entered promiscuous mode [ 48.112258][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 48.119693][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 48.141374][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 48.148956][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 48.156521][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 48.164901][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 48.173299][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.180307][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.187914][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 48.196314][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 48.204659][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 48.212810][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.219826][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.251650][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 48.260005][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 48.268237][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.275275][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.282946][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 48.291495][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 48.299576][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.306614][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.314145][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 48.322293][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 48.331210][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 48.338836][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 48.346924][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 48.382079][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 48.390110][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 48.397518][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 48.405240][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 48.413014][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 48.421205][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 48.429071][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 48.437233][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 48.445383][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 48.453902][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.460948][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.468301][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 48.476865][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 48.485318][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 48.500029][ T475] device veth0_vlan entered promiscuous mode [ 48.513241][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 48.521865][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.528996][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.536656][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 48.544526][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 48.552124][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 48.581432][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 48.589786][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 48.597716][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 48.605209][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 48.613201][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 48.621632][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 48.629970][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 48.638240][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.645533][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.658344][ T475] device veth1_macvtap entered promiscuous mode [ 48.665222][ T473] device veth0_vlan entered promiscuous mode [ 48.679957][ T480] device veth0_vlan entered promiscuous mode [ 48.686299][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 48.694278][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 48.702766][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 48.711175][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 48.719095][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 48.726852][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 48.734337][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 48.742662][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 48.750723][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.757752][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.765141][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 48.775436][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 48.783029][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 48.803767][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 48.812127][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 48.820237][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 48.829126][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 48.837643][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 48.846127][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 48.860193][ T473] device veth1_macvtap entered promiscuous mode [ 48.868680][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 48.877297][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 48.885619][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.893109][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.908494][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 48.916140][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 48.924470][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 48.932876][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 48.940690][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 48.949270][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 48.957655][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 48.965809][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.972956][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.980331][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 48.988021][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 49.000177][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 49.008509][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 49.016742][ T479] device veth0_vlan entered promiscuous mode [ 49.033596][ T479] device veth1_macvtap entered promiscuous mode [ 49.052919][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 49.061328][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 49.062048][ T30] audit: type=1400 audit(1767682128.991:108): avc: denied { create } for pid=526 comm="syz.1.18" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 49.069736][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 49.096935][ T30] audit: type=1400 audit(1767682128.991:109): avc: denied { connect } for pid=526 comm="syz.1.18" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 49.098571][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 49.122127][ T30] audit: type=1400 audit(1767682129.041:110): avc: denied { write } for pid=526 comm="syz.1.18" path="socket:[17729]" dev="sockfs" ino=17729 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 49.125335][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 49.156059][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 49.169147][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 49.177248][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 49.186194][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 49.194701][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 49.203526][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 49.212082][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 49.220646][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 49.234903][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 49.246054][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 49.254332][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 49.262238][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 49.280922][ T477] device veth0_vlan entered promiscuous mode [ 49.303486][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 49.314268][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 49.326243][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 49.335176][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 49.346368][ T480] device veth1_macvtap entered promiscuous mode [ 49.372160][ T341] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 49.416841][ T341] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 49.441234][ T341] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 49.464603][ T477] device veth1_macvtap entered promiscuous mode [ 49.481802][ T8] device bridge_slave_1 left promiscuous mode [ 49.487969][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.516228][ T8] device bridge_slave_0 left promiscuous mode [ 49.522500][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.540953][ T8] device veth1_macvtap left promiscuous mode [ 49.546979][ T8] device veth0_vlan left promiscuous mode [ 49.797877][ T560] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 49.812200][ T560] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 49.834286][ T560] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 49.855244][ T560] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 49.877321][ T560] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 49.900177][ T560] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 49.929933][ T560] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 49.951934][ T560] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 49.969853][ T560] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/01/06 06:48:52 executed programs: 240 2026/01/06 06:48:57 executed programs: 475 2026/01/06 06:49:02 executed programs: 733 2026/01/06 06:49:08 executed programs: 1000 2026/01/06 06:49:13 executed programs: 1250 [ 75.223172][ T321] ================================================================== [ 75.231274][ T321] BUG: KASAN: use-after-free in l2tp_session_delete+0x24/0x4a0 [ 75.238821][ T321] Write of size 8 at addr ffff888132478408 by task kworker/u4:3/321 [ 75.246778][ T321] [ 75.249093][ T321] CPU: 0 PID: 321 Comm: kworker/u4:3 Not tainted syzkaller #0 [ 75.256533][ T321] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 75.266569][ T321] Workqueue: l2tp l2tp_tunnel_del_work [ 75.272030][ T321] Call Trace: [ 75.275297][ T321] [ 75.278209][ T321] __dump_stack+0x21/0x30 [ 75.282613][ T321] dump_stack_lvl+0xee/0x150 [ 75.287191][ T321] ? show_regs_print_info+0x20/0x20 [ 75.292367][ T321] ? load_image+0x3a0/0x3a0 [ 75.296850][ T321] ? __switch_to+0x51d/0xe20 [ 75.301520][ T321] print_address_description+0x7f/0x2c0 [ 75.307044][ T321] ? l2tp_session_delete+0x24/0x4a0 [ 75.312223][ T321] kasan_report+0xf1/0x140 [ 75.316620][ T321] ? l2tp_session_delete+0x24/0x4a0 [ 75.321796][ T321] kasan_check_range+0x280/0x290 [ 75.326713][ T321] __kasan_check_write+0x14/0x20 [ 75.331629][ T321] l2tp_session_delete+0x24/0x4a0 [ 75.336720][ T321] l2tp_tunnel_del_work+0x1d2/0x3e0 [ 75.341898][ T321] process_one_work+0x6be/0xba0 [ 75.346728][ T321] worker_thread+0xa59/0x1200 [ 75.351383][ T321] ? _raw_spin_lock_irqsave+0xb0/0x110 [ 75.356910][ T321] ? __kthread_parkme+0xac/0x200 [ 75.361824][ T321] kthread+0x411/0x500 [ 75.365868][ T321] ? worker_clr_flags+0x190/0x190 [ 75.370916][ T321] ? kthread_blkcg+0xd0/0xd0 [ 75.375505][ T321] ret_from_fork+0x1f/0x30 [ 75.379927][ T321] [ 75.382930][ T321] [ 75.385233][ T321] Allocated by task 3214: [ 75.389531][ T321] __kasan_kmalloc+0xda/0x110 [ 75.394189][ T321] __kmalloc+0x13d/0x2c0 [ 75.398410][ T321] l2tp_session_create+0x39/0xb60 [ 75.403411][ T321] pppol2tp_connect+0xb35/0x1570 [ 75.408346][ T321] __sys_connect+0x389/0x410 [ 75.412934][ T321] __x64_sys_connect+0x7a/0x90 [ 75.417674][ T321] x64_sys_call+0x7c/0x9a0 [ 75.422068][ T321] do_syscall_64+0x4c/0xa0 [ 75.426465][ T321] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 75.432431][ T321] [ 75.434732][ T321] Freed by task 20: [ 75.438513][ T321] kasan_set_track+0x4a/0x70 [ 75.443085][ T321] kasan_set_free_info+0x23/0x40 [ 75.448001][ T321] ____kasan_slab_free+0x125/0x160 [ 75.453085][ T321] __kasan_slab_free+0x11/0x20 [ 75.457826][ T321] slab_free_freelist_hook+0xc2/0x190 [ 75.463177][ T321] kfree+0xc4/0x270 [ 75.466965][ T321] l2tp_session_dec_refcount+0xaf/0x1a0 [ 75.472485][ T321] pppol2tp_session_destruct+0xb1/0xf0 [ 75.477920][ T321] __sk_destruct+0x56/0x5e0 [ 75.482399][ T321] __sk_free+0x313/0x410 [ 75.486705][ T321] sk_free+0x54/0x90 [ 75.490574][ T321] pppol2tp_put_sk+0x7a/0xb0 [ 75.495148][ T321] rcu_do_batch+0x51d/0xba0 [ 75.499728][ T321] rcu_core+0x5e4/0xf80 [ 75.503860][ T321] rcu_core_si+0x9/0x10 [ 75.507997][ T321] handle_softirqs+0x250/0x560 [ 75.512737][ T321] __irq_exit_rcu+0x52/0xf0 [ 75.517248][ T321] irq_exit_rcu+0x9/0x10 [ 75.521516][ T321] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 75.527139][ T321] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 75.533100][ T321] [ 75.535402][ T321] Last potentially related work creation: [ 75.541092][ T321] kasan_save_stack+0x3a/0x60 [ 75.545748][ T321] __kasan_record_aux_stack+0xd2/0x100 [ 75.551184][ T321] kasan_record_aux_stack_noalloc+0xb/0x10 [ 75.556969][ T321] call_rcu+0x105/0xfe0 [ 75.561103][ T321] pppol2tp_release+0x208/0x2d0 [ 75.566116][ T321] sock_close+0xe0/0x270 [ 75.570334][ T321] __fput+0x20b/0x8b0 [ 75.574377][ T321] ____fput+0x15/0x20 [ 75.578347][ T321] task_work_run+0x127/0x190 [ 75.583019][ T321] exit_to_user_mode_loop+0xd0/0xe0 [ 75.588379][ T321] exit_to_user_mode_prepare+0x87/0xd0 [ 75.594165][ T321] syscall_exit_to_user_mode+0x1a/0x30 [ 75.599723][ T321] do_syscall_64+0x58/0xa0 [ 75.604123][ T321] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 75.609998][ T321] [ 75.612313][ T321] The buggy address belongs to the object at ffff888132478400 [ 75.612313][ T321] which belongs to the cache kmalloc-512 of size 512 [ 75.626604][ T321] The buggy address is located 8 bytes inside of [ 75.626604][ T321] 512-byte region [ffff888132478400, ffff888132478600) [ 75.639693][ T321] The buggy address belongs to the page: [ 75.645447][ T321] page:ffffea0004c91e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x132478 [ 75.655944][ T321] head:ffffea0004c91e00 order:2 compound_mapcount:0 compound_pincount:0 [ 75.664346][ T321] flags: 0x4000000000010200(slab|head|zone=1) [ 75.670447][ T321] raw: 4000000000010200 ffffea000435c600 0000000200000002 ffff888100042f00 [ 75.679021][ T321] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 75.687680][ T321] page dumped because: kasan: bad access detected [ 75.694355][ T321] page_owner tracks the page as allocated [ 75.700046][ T321] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 475, ts 47496182431, free_ts 0 [ 75.719816][ T321] post_alloc_hook+0x192/0x1b0 [ 75.724656][ T321] prep_new_page+0x1c/0x110 [ 75.729139][ T321] get_page_from_freelist+0x2cc5/0x2d50 [ 75.734679][ T321] __alloc_pages+0x18f/0x440 [ 75.739250][ T321] new_slab+0xa1/0x4d0 [ 75.743559][ T321] ___slab_alloc+0x381/0x810 [ 75.748160][ T321] __slab_alloc+0x49/0x90 [ 75.752565][ T321] kmem_cache_alloc_trace+0x146/0x270 [ 75.757938][ T321] inetdev_init+0x84/0x500 [ 75.762331][ T321] inetdev_event+0x1f8/0x10a0 [ 75.766988][ T321] raw_notifier_call_chain+0x90/0x100 [ 75.772337][ T321] call_netdevice_notifiers+0x111/0x190 [ 75.777866][ T321] register_netdevice+0x1039/0x13a0 [ 75.783081][ T321] register_netdev+0x3e/0x50 [ 75.787671][ T321] loopback_net_init+0x74/0x150 [ 75.792520][ T321] ops_init+0x1ba/0x4a0 [ 75.796662][ T321] page_owner free stack trace missing [ 75.802009][ T321] [ 75.804313][ T321] Memory state around the buggy address: [ 75.810092][ T321] ffff888132478300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 75.818142][ T321] ffff888132478380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 75.826294][ T321] >ffff888132478400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 75.834515][ T321] ^ [ 75.838847][ T321] ffff888132478480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 75.846952][ T321] ffff888132478500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 75.855003][ T321] ================================================================== [ 75.863125][ T321] Disabling lock debugging due to kernel taint [ 75.878060][ T321] ------------[ cut here ]------------ [ 75.884212][ T321] refcount_t: underflow; use-after-free. [ 75.890022][ T321] WARNING: CPU: 0 PID: 321 at lib/refcount.c:28 refcount_warn_saturate+0x120/0x1a0 [ 75.901839][ T30] audit: type=1400 audit(1767682155.821:111): avc: denied { read } for pid=83 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 75.935316][ T321] Modules linked in: [ 75.939260][ T321] CPU: 0 PID: 321 Comm: kworker/u4:3 Tainted: G B syzkaller #0 [ 75.948787][ T321] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 75.950747][ T30] audit: type=1400 audit(1767682155.821:112): avc: denied { search } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 75.968664][ T321] Workqueue: l2tp l2tp_tunnel_del_work [ 75.987017][ T321] RIP: 0010:refcount_warn_saturate+0x120/0x1a0 [ 75.995313][ T321] Code: 04 01 48 c7 c7 80 0f 63 85 e8 bc c3 53 02 0f 0b eb c3 e8 d3 95 1c ff c6 05 5e e1 99 04 01 48 c7 c7 e0 0f 63 85 e8 a0 c3 53 02 <0f> 0b eb a7 e8 b7 95 1c ff c6 05 3f e1 99 04 01 48 c7 c7 20 0f 63 [ 76.015088][ T30] audit: type=1400 audit(1767682155.821:113): avc: denied { write } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 76.015112][ T30] audit: type=1400 audit(1767682155.821:114): avc: denied { add_name } for pid=83 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 76.015129][ T30] audit: type=1400 audit(1767682155.821:115): avc: denied { create } for pid=83 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 76.015144][ T30] audit: type=1400 audit(1767682155.821:116): avc: denied { append open } for pid=83 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 76.015162][ T30] audit: type=1400 audit(1767682155.821:117): avc: denied { getattr } for pid=83 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 76.123654][ T321] RSP: 0018:ffffc90000af7c38 EFLAGS: 00010246 [ 76.129819][ T321] RAX: 4381398b8deecd00 RBX: 0000000000000003 RCX: ffff88810ae962c0 [ 76.138163][ T321] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 76.146175][ T321] RBP: ffffc90000af7c48 R08: dffffc0000000000 R09: fffff5200015eed5 [ 76.154780][ T321] R10: fffff5200015eed5 R11: 1ffff9200015eed4 R12: ffff888132478020 [ 76.162925][ T321] R13: dffffc0000000000 R14: 0000000000000003 R15: 0000000000000000 [ 76.171186][ T321] FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 76.180110][ T321] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 76.186724][ T321] CR2: 000055558f4984a8 CR3: 0000000130e21000 CR4: 00000000003506b0 [ 76.194807][ T321] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 76.202890][ T321] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 76.210957][ T321] Call Trace: [ 76.214230][ T321] [ 76.217149][ T321] l2tp_session_dec_refcount+0xc8/0x1a0 [ 76.222731][ T321] l2tp_session_delete+0x3ab/0x4a0 [ 76.227935][ T321] l2tp_tunnel_del_work+0x1d2/0x3e0 [ 76.233198][ T321] process_one_work+0x6be/0xba0 [ 76.238085][ T321] worker_thread+0xa59/0x1200 [ 76.242799][ T321] ? _raw_spin_lock_irqsave+0xb0/0x110 [ 76.248339][ T321] ? __kthread_parkme+0xac/0x200 [ 76.253295][ T321] kthread+0x411/0x500 [ 76.257368][ T321] ? worker_clr_flags+0x190/0x190 [ 76.262502][ T321] ? kthread_blkcg+0xd0/0xd0 [ 76.267140][ T321] ret_from_fork+0x1f/0x30 [ 76.271576][ T321] [ 76.274585][ T321] ---[ end trace 81b54572c5ab386b ]--- 2026/01/06 06:49:18 executed programs: 1443 2026/01/06 06:49:23 executed programs: 1703