Warning: Permanently added '10.128.0.156' (ED25519) to the list of known hosts. 2025/06/23 07:38:17 ignoring optional flag "sandboxArg"="0" 2025/06/23 07:38:18 parsed 1 programs [ 70.251751][ T29] kauditd_printk_skb: 29 callbacks suppressed [ 70.251787][ T29] audit: type=1400 audit(1750664298.828:89): avc: denied { create } for pid=433 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 70.277906][ T29] audit: type=1400 audit(1750664298.828:90): avc: denied { write } for pid=433 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 70.298110][ T29] audit: type=1400 audit(1750664298.828:91): avc: denied { read } for pid=433 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 70.369899][ T29] audit: type=1400 audit(1750664298.948:92): avc: denied { unlink } for pid=433 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 70.391013][ T433] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 70.708135][ T29] audit: type=1401 audit(1750664299.278:93): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 70.849926][ T29] audit: type=1400 audit(1750664299.428:94): avc: denied { create } for pid=457 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 70.917488][ T448] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.924467][ T448] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.931815][ T448] device bridge_slave_0 entered promiscuous mode [ 70.942030][ T448] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.948880][ T448] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.967634][ T448] device bridge_slave_1 entered promiscuous mode [ 71.082324][ T448] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.089284][ T448] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.096410][ T448] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.103189][ T448] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.123914][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.140822][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.148092][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 71.155511][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 71.170996][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 71.179066][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.185940][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.193355][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 71.201683][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.208548][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.216032][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 71.224536][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 71.237230][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 71.247370][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 71.255080][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 71.262424][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 71.271494][ T448] device veth0_vlan entered promiscuous mode [ 71.280451][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready 2025/06/23 07:38:19 executed programs: 0 [ 71.289089][ T448] device veth1_macvtap entered promiscuous mode [ 71.297393][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 71.307183][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 71.458796][ T486] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.465772][ T486] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.473015][ T486] device bridge_slave_0 entered promiscuous mode [ 71.480735][ T486] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.487600][ T486] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.494921][ T486] device bridge_slave_1 entered promiscuous mode [ 71.508409][ T488] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.515359][ T488] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.522708][ T488] device bridge_slave_0 entered promiscuous mode [ 71.537059][ T488] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.543925][ T488] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.551225][ T488] device bridge_slave_1 entered promiscuous mode [ 71.598563][ T492] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.605728][ T492] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.612951][ T492] device bridge_slave_0 entered promiscuous mode [ 71.619603][ T492] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.626443][ T492] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.633643][ T492] device bridge_slave_1 entered promiscuous mode [ 71.665095][ T491] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.672065][ T491] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.679174][ T491] device bridge_slave_0 entered promiscuous mode [ 71.685953][ T491] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.692812][ T491] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.700103][ T491] device bridge_slave_1 entered promiscuous mode [ 71.716442][ T489] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.723456][ T489] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.730609][ T489] device bridge_slave_0 entered promiscuous mode [ 71.738699][ T489] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.745612][ T489] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.753014][ T489] device bridge_slave_1 entered promiscuous mode [ 71.938938][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 71.946358][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 71.971731][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 71.979861][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 71.987737][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.994532][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.001779][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 72.033614][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 72.041745][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 72.050855][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.057680][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.064992][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 72.072195][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 72.079306][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 72.087022][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 72.094909][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 72.103132][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 72.111216][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.118145][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.125367][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 72.133525][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 72.141603][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.148461][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.155877][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 72.179327][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 72.186564][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 72.201751][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 72.208966][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 72.216208][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 72.224106][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 72.232024][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 72.239986][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 72.247647][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 72.255799][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 72.263884][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.270730][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.277986][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 72.286466][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 72.294479][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.301318][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.308588][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 72.336961][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 72.345173][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 72.353327][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.360619][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.368032][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 72.376224][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 72.384258][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.391102][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.398323][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 72.406420][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 72.414481][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 72.422427][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 72.430114][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 72.437224][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 72.444497][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 72.452640][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 72.460683][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.467512][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.474782][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 72.482906][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 72.490886][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.497801][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.505200][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 72.513111][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 72.534157][ T491] device veth0_vlan entered promiscuous mode [ 72.540972][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 72.549712][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 72.557514][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 72.564913][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 72.572322][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 72.579734][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 72.587053][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 72.597778][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 72.606452][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 72.614640][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 72.621996][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 72.629132][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 72.637167][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 72.648427][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 72.656313][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 72.667366][ T489] device veth0_vlan entered promiscuous mode [ 72.682090][ T491] device veth1_macvtap entered promiscuous mode [ 72.690283][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 72.698223][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 72.706096][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 72.713557][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 72.721427][ T486] device veth0_vlan entered promiscuous mode [ 72.728448][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 72.738744][ T489] device veth1_macvtap entered promiscuous mode [ 72.751474][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 72.758714][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 72.766075][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 72.776963][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 72.787333][ T488] device veth0_vlan entered promiscuous mode [ 72.796503][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 72.804759][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 72.821394][ T492] device veth0_vlan entered promiscuous mode [ 72.829607][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 72.837290][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 72.844686][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 72.852071][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 72.860354][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 72.869207][ T486] device veth1_macvtap entered promiscuous mode [ 72.885953][ T29] audit: type=1400 audit(1750664301.458:95): avc: denied { create } for pid=509 comm="syz.3.19" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 72.888307][ T492] device veth1_macvtap entered promiscuous mode [ 72.915632][ T29] audit: type=1400 audit(1750664301.488:96): avc: denied { connect } for pid=509 comm="syz.3.19" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 72.917222][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 72.935058][ T29] audit: type=1400 audit(1750664301.488:97): avc: denied { write } for pid=509 comm="syz.3.19" path="socket:[15432]" dev="sockfs" ino=15432 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 72.953999][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 72.975550][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 72.984266][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 72.992446][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 73.000355][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 73.008403][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 73.026549][ T488] device veth1_macvtap entered promiscuous mode [ 73.044690][ T481] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 73.052445][ T481] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 73.061383][ T481] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 73.070863][ T481] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 73.078887][ T481] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 73.087313][ T481] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 73.095684][ T481] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 73.146545][ T481] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 73.156956][ T481] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 73.166254][ T481] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 73.180167][ T481] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 73.189673][ T481] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 73.200808][ T481] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 73.227454][ T280] device bridge_slave_1 left promiscuous mode [ 73.239969][ T280] bridge0: port 2(bridge_slave_1) entered disabled state [ 73.260221][ T280] device bridge_slave_0 left promiscuous mode [ 73.297316][ T280] bridge0: port 1(bridge_slave_0) entered disabled state [ 73.306656][ T280] device veth1_macvtap left promiscuous mode [ 73.312659][ T280] device veth0_vlan left promiscuous mode 2025/06/23 07:38:24 executed programs: 239 2025/06/23 07:38:30 executed programs: 503 2025/06/23 07:38:35 executed programs: 787 2025/06/23 07:38:40 executed programs: 1062 2025/06/23 07:38:45 executed programs: 1327 [ 98.745329][ T481] ================================================================== [ 98.753307][ T481] BUG: KASAN: use-after-free in l2tp_session_delete+0x1e/0x440 [ 98.760882][ T481] Write of size 8 at addr ffff88811efbd808 by task kworker/u4:5/481 [ 98.768681][ T481] [ 98.770950][ T481] CPU: 0 PID: 481 Comm: kworker/u4:5 Not tainted 5.15.185-syzkaller #0 [ 98.779012][ T481] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 98.789005][ T481] Workqueue: l2tp l2tp_tunnel_del_work [ 98.794433][ T481] Call Trace: [ 98.797551][ T481] [ 98.800333][ T481] dump_stack_lvl+0x38/0x49 [ 98.804665][ T481] print_address_description.constprop.0+0x24/0x160 [ 98.811091][ T481] ? l2tp_session_delete+0x1e/0x440 [ 98.816210][ T481] kasan_report.cold+0x82/0xdb [ 98.820808][ T481] ? l2tp_session_delete+0x1e/0x440 [ 98.825841][ T481] kasan_check_range+0x148/0x190 [ 98.830616][ T481] __kasan_check_write+0x14/0x20 [ 98.835389][ T481] l2tp_session_delete+0x1e/0x440 [ 98.840263][ T481] l2tp_tunnel_del_work+0x182/0x400 [ 98.845377][ T481] process_one_work+0x62c/0xec0 [ 98.850055][ T481] ? mutex_unlock+0x7e/0x240 [ 98.854485][ T481] worker_thread+0x48e/0xdb0 [ 98.858914][ T481] ? rescuer_thread+0xc30/0xc30 [ 98.863599][ T481] kthread+0x324/0x3e0 [ 98.867503][ T481] ? set_kthread_struct+0x100/0x100 [ 98.872539][ T481] ret_from_fork+0x1f/0x30 [ 98.876790][ T481] [ 98.879651][ T481] [ 98.881822][ T481] Allocated by task 3394: [ 98.885996][ T481] kasan_save_stack+0x26/0x50 [ 98.890511][ T481] __kasan_kmalloc+0xae/0xe0 [ 98.894929][ T481] __kmalloc+0x2e6/0x550 [ 98.899007][ T481] l2tp_session_create+0x38/0xa80 [ 98.903872][ T481] pppol2tp_connect+0xe03/0x1910 [ 98.908645][ T481] __sys_connect_file+0x136/0x190 [ 98.913522][ T481] __sys_connect+0x101/0x130 [ 98.918089][ T481] __x64_sys_connect+0x6e/0xb0 [ 98.922779][ T481] x64_sys_call+0x85c/0x990 [ 98.927119][ T481] do_syscall_64+0x33/0xb0 [ 98.931369][ T481] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 98.937098][ T481] [ 98.939277][ T481] Freed by task 24: [ 98.942912][ T481] kasan_save_stack+0x26/0x50 [ 98.947428][ T481] kasan_set_track+0x25/0x30 [ 98.951858][ T481] kasan_set_free_info+0x24/0x40 [ 98.956628][ T481] __kasan_slab_free+0x111/0x150 [ 98.961400][ T481] slab_free_freelist_hook+0x94/0x1a0 [ 98.966607][ T481] kfree+0xc2/0x2a0 [ 98.970254][ T481] l2tp_session_dec_refcount+0x7a/0x130 [ 98.975646][ T481] pppol2tp_session_destruct+0xa3/0xd0 [ 98.981016][ T481] __sk_destruct+0x42/0x520 [ 98.985441][ T481] sk_destruct+0x9b/0xc0 [ 98.989523][ T481] __sk_free+0xd1/0x350 [ 98.993515][ T481] sk_free+0x45/0x60 [ 98.997248][ T481] pppol2tp_put_sk+0x66/0x90 [ 99.001674][ T481] rcu_do_batch+0x340/0xca0 [ 99.006017][ T481] rcu_core+0x56b/0xac0 [ 99.010005][ T481] rcu_core_si+0x9/0x10 [ 99.013998][ T481] handle_softirqs+0x1c5/0x510 [ 99.018611][ T481] run_ksoftirqd+0x2b/0x40 [ 99.022851][ T481] smpboot_thread_fn+0x502/0x7b0 [ 99.027627][ T481] kthread+0x324/0x3e0 [ 99.031533][ T481] ret_from_fork+0x1f/0x30 [ 99.035786][ T481] [ 99.037951][ T481] Last potentially related work creation: [ 99.043507][ T481] kasan_save_stack+0x26/0x50 [ 99.048038][ T481] __kasan_record_aux_stack+0xd8/0xf0 [ 99.053228][ T481] kasan_record_aux_stack_noalloc+0xb/0x10 [ 99.058873][ T481] __call_rcu_common.constprop.0+0xd7/0x11b0 [ 99.064683][ T481] call_rcu+0x9/0x10 [ 99.068417][ T481] pppol2tp_release+0x292/0x3e0 [ 99.073109][ T481] __sock_release+0xc2/0x270 [ 99.077542][ T481] sock_close+0x10/0x20 [ 99.081530][ T481] __fput+0x319/0x960 [ 99.085343][ T481] ____fput+0x9/0x10 [ 99.089076][ T481] task_work_run+0xc2/0x150 [ 99.093417][ T481] exit_to_user_mode_prepare+0x143/0x150 [ 99.098881][ T481] syscall_exit_to_user_mode+0x21/0x40 [ 99.104179][ T481] do_syscall_64+0x40/0xb0 [ 99.108430][ T481] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 99.114159][ T481] [ 99.116329][ T481] The buggy address belongs to the object at ffff88811efbd800 [ 99.116329][ T481] which belongs to the cache kmalloc-512 of size 512 [ 99.130410][ T481] The buggy address is located 8 bytes inside of [ 99.130410][ T481] 512-byte region [ffff88811efbd800, ffff88811efbda00) [ 99.143451][ T481] The buggy address belongs to the page: [ 99.148898][ T481] page:ffffea00047bef00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11efbc [ 99.158973][ T481] head:ffffea00047bef00 order:2 compound_mapcount:0 compound_pincount:0 [ 99.167148][ T481] flags: 0x4000000000010200(slab|head|zone=1) [ 99.173032][ T481] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100042f00 [ 99.181544][ T481] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 99.189961][ T481] page dumped because: kasan: bad access detected [ 99.196213][ T481] page_owner tracks the page as allocated [ 99.201839][ T481] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 491, ts 71767757178, free_ts 41543953841 [ 99.222074][ T481] prep_new_page+0x1a2/0x310 [ 99.226488][ T481] get_page_from_freelist+0x1ce2/0x30a0 [ 99.231870][ T481] __alloc_pages+0x2d5/0x26f0 [ 99.236388][ T481] allocate_slab+0x39d/0x530 [ 99.240824][ T481] ___slab_alloc.constprop.0+0x3ca/0x890 [ 99.246282][ T481] __slab_alloc.constprop.0+0x42/0x80 [ 99.251485][ T481] __kmalloc_track_caller+0x501/0x540 [ 99.256701][ T481] __alloc_skb+0x8b/0x250 [ 99.260863][ T481] netlink_ack+0x134/0xa00 [ 99.265122][ T481] netlink_rcv_skb+0x27a/0x3c0 [ 99.269798][ T481] rtnetlink_rcv+0x10/0x20 [ 99.274228][ T481] netlink_unicast+0x4f8/0x810 [ 99.278824][ T481] netlink_sendmsg+0x810/0xd10 [ 99.283433][ T481] __sock_sendmsg+0xb5/0xf0 [ 99.287768][ T481] __sys_sendto+0x1e3/0x2f0 [ 99.292105][ T481] __x64_sys_sendto+0xdc/0x1a0 [ 99.296711][ T481] page last free stack trace: [ 99.301224][ T481] free_pcp_prepare+0x1b6/0x4c0 [ 99.305904][ T481] free_unref_page+0x84/0x760 [ 99.310420][ T481] __put_page+0xdb/0x110 [ 99.314496][ T481] anon_pipe_buf_release+0x128/0x1a0 [ 99.319708][ T481] pipe_read+0x574/0xdf0 [ 99.323785][ T481] new_sync_read+0x489/0x6d0 [ 99.328213][ T481] vfs_read+0x34a/0x4b0 [ 99.332247][ T481] ksys_read+0x192/0x210 [ 99.336369][ T481] __x64_sys_read+0x6e/0xb0 [ 99.340710][ T481] x64_sys_call+0x982/0x990 [ 99.345054][ T481] do_syscall_64+0x33/0xb0 [ 99.349332][ T481] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 99.355031][ T481] [ 99.357203][ T481] Memory state around the buggy address: [ 99.362670][ T481] ffff88811efbd700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 99.370566][ T481] ffff88811efbd780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 99.378469][ T481] >ffff88811efbd800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 99.386365][ T481] ^ [ 99.390530][ T481] ffff88811efbd880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 99.398444][ T481] ffff88811efbd900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 99.406412][ T481] ================================================================== [ 99.414328][ T481] Disabling lock debugging due to kernel taint [ 99.433871][ T29] audit: type=1400 audit(1750664328.008:98): avc: denied { read } for pid=77 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 99.503229][ T29] audit: type=1400 audit(1750664328.008:99): avc: denied { search } for pid=77 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 99.554824][ T29] audit: type=1400 audit(1750664328.008:100): avc: denied { write } for pid=77 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 99.625279][ T29] audit: type=1400 audit(1750664328.008:101): avc: denied { add_name } for pid=77 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 99.651720][ T29] audit: type=1400 audit(1750664328.008:102): avc: denied { create } for pid=77 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 99.704378][ T29] audit: type=1400 audit(1750664328.008:103): avc: denied { append open } for pid=77 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 99.754433][ T29] audit: type=1400 audit(1750664328.008:104): avc: denied { getattr } for pid=77 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 2025/06/23 07:38:50 executed programs: 1563 2025/06/23 07:38:55 executed programs: 1843