[ 28.321947][ T8] device bridge_slave_1 left promiscuous mode [ 28.328258][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.335865][ T8] device bridge_slave_0 left promiscuous mode [ 28.342135][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.350142][ T8] device veth1_macvtap left promiscuous mode [ 28.356211][ T8] device veth0_vlan left promiscuous mode [ 28.362152][ T8] device veth1_macvtap left promiscuous mode [ 28.368170][ T8] device veth0_vlan left promiscuous mode [ 37.319888][ T30] kauditd_printk_skb: 30 callbacks suppressed [ 37.319901][ T30] audit: type=1400 audit(1761593766.927:104): avc: denied { write } for pid=375 comm="sftp-server" path="pipe:[1016]" dev="pipefs" ino=1016 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 Warning: Permanently added '10.128.1.176' (ED25519) to the list of known hosts. 2025/10/27 19:36:15 parsed 1 programs [ 47.211653][ T30] audit: type=1400 audit(1761593776.827:105): avc: denied { unlink } for pid=396 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 47.250471][ T396] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 47.920084][ T408] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.927725][ T408] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.936750][ T408] device bridge_slave_0 entered promiscuous mode [ 47.952734][ T408] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.959909][ T408] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.010486][ T408] device bridge_slave_1 entered promiscuous mode [ 48.158782][ T30] audit: type=1401 audit(1761593777.767:106): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 48.274434][ T408] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.281553][ T408] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.288955][ T408] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.296051][ T408] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.337725][ T345] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.346605][ T345] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.371970][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 48.391085][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 48.422214][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 48.430495][ T345] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.437591][ T345] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.446521][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 48.459313][ T345] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.466431][ T345] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.474939][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 48.502479][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 48.526788][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 48.539565][ T408] device veth0_vlan entered promiscuous mode [ 48.546429][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 48.554601][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 48.562197][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 48.573237][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 48.582710][ T408] device veth1_macvtap entered promiscuous mode [ 48.593328][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready 2025/10/27 19:36:18 executed programs: 0 [ 48.603137][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 48.763674][ T464] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.770771][ T464] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.782997][ T464] device bridge_slave_0 entered promiscuous mode [ 48.810178][ T464] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.817418][ T464] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.825369][ T464] device bridge_slave_1 entered promiscuous mode [ 48.865639][ T465] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.873050][ T465] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.880494][ T465] device bridge_slave_0 entered promiscuous mode [ 48.888606][ T465] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.895987][ T465] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.903469][ T465] device bridge_slave_1 entered promiscuous mode [ 49.009026][ T469] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.016201][ T469] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.023914][ T469] device bridge_slave_0 entered promiscuous mode [ 49.032386][ T469] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.039452][ T469] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.047050][ T469] device bridge_slave_1 entered promiscuous mode [ 49.104022][ T468] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.111122][ T468] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.118619][ T468] device bridge_slave_0 entered promiscuous mode [ 49.125916][ T468] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.133151][ T468] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.140519][ T468] device bridge_slave_1 entered promiscuous mode [ 49.183897][ T470] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.191070][ T470] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.198512][ T470] device bridge_slave_0 entered promiscuous mode [ 49.205874][ T470] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.213024][ T470] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.220443][ T470] device bridge_slave_1 entered promiscuous mode [ 49.387055][ T468] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.394154][ T468] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.401587][ T468] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.408681][ T468] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.426351][ T469] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.433456][ T469] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.440749][ T469] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.448078][ T469] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.468089][ T345] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.475443][ T345] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.483108][ T345] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.490516][ T345] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.499383][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 49.506936][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 49.519309][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 49.526926][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 49.555517][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 49.563917][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 49.572873][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 49.581157][ T345] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.588184][ T345] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.595579][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 49.603923][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 49.612356][ T345] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.619408][ T345] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.626928][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 49.635284][ T345] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.642346][ T345] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.649722][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 49.657536][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 49.668281][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 49.676869][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 49.685268][ T345] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.692325][ T345] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.722212][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 49.730424][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 49.739514][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 49.747917][ T345] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.754989][ T345] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.762770][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 49.771059][ T345] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.778298][ T345] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.785981][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 49.794162][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 49.802544][ T345] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.809683][ T345] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.817203][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 49.825540][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 49.833827][ T345] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.840970][ T345] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.848317][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 49.856411][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 49.877197][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 49.885482][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 49.905208][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 49.913537][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 49.930778][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 49.939564][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 49.952832][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 49.960318][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 49.976480][ T464] device veth0_vlan entered promiscuous mode [ 49.988548][ T465] device veth0_vlan entered promiscuous mode [ 49.996058][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 50.004666][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 50.012832][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 50.021318][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 50.029375][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 50.037638][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 50.045881][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 50.054363][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 50.062927][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 50.071507][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 50.079988][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 50.088241][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 50.096525][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 50.104237][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 50.111779][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 50.119174][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 50.135603][ T464] device veth1_macvtap entered promiscuous mode [ 50.148320][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 50.156797][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 50.165461][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 50.173456][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 50.182195][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 50.190382][ T345] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.197618][ T345] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.205162][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 50.213630][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 50.222197][ T345] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.229237][ T345] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.237061][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 50.246408][ T468] device veth0_vlan entered promiscuous mode [ 50.260274][ T468] device veth1_macvtap entered promiscuous mode [ 50.272203][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 50.280564][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 50.289704][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 50.298182][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 50.307167][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 50.315885][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 50.323764][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 50.336279][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 50.344993][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 50.358657][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 50.367221][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 50.375430][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 50.383912][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 50.402337][ T465] device veth1_macvtap entered promiscuous mode [ 50.414608][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 50.423250][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 50.431893][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 50.440067][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 50.448516][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 50.456453][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 50.464910][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 50.474874][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 50.483406][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 50.492403][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 50.500309][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 50.517330][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 50.525270][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 50.533138][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 50.541510][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 50.549881][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 50.558457][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 50.569080][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 50.577572][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 50.589634][ T469] device veth0_vlan entered promiscuous mode [ 50.599219][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 50.607690][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 50.623754][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 50.631629][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 50.647603][ T470] device veth0_vlan entered promiscuous mode [ 50.657100][ T30] audit: type=1400 audit(1761593780.267:107): avc: denied { create } for pid=518 comm="syz.3.19" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 50.723741][ T30] audit: type=1400 audit(1761593780.267:108): avc: denied { connect } for pid=520 comm="syz.5.16" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 50.750211][ T30] audit: type=1400 audit(1761593780.267:109): avc: denied { write } for pid=520 comm="syz.5.16" path="socket:[18544]" dev="sockfs" ino=18544 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 50.764354][ T469] device veth1_macvtap entered promiscuous mode [ 50.793521][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 50.810032][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 50.819340][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 50.860993][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 50.879658][ T470] device veth1_macvtap entered promiscuous mode [ 50.907140][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 50.917240][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 50.982061][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 50.992621][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 51.007627][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 51.033224][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 51.046789][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 51.071821][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 51.442729][ T8] device bridge_slave_1 left promiscuous mode [ 51.449263][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.474057][ T8] device bridge_slave_0 left promiscuous mode [ 51.480242][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.524126][ T8] device veth1_macvtap left promiscuous mode [ 51.530192][ T8] device veth0_vlan left promiscuous mode 2025/10/27 19:36:23 executed programs: 195 2025/10/27 19:36:28 executed programs: 426 2025/10/27 19:36:33 executed programs: 634 [ 64.254490][ T8] ================================================================== [ 64.262631][ T8] BUG: KASAN: use-after-free in l2tp_session_delete+0x24/0x4a0 [ 64.270226][ T8] Write of size 8 at addr ffff88812a5a4408 by task kworker/u4:0/8 [ 64.278053][ T8] [ 64.280397][ T8] CPU: 1 PID: 8 Comm: kworker/u4:0 Not tainted syzkaller #0 [ 64.287679][ T8] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 64.297759][ T8] Workqueue: l2tp l2tp_tunnel_del_work [ 64.303244][ T8] Call Trace: [ 64.306520][ T8] [ 64.309448][ T8] __dump_stack+0x21/0x30 [ 64.313784][ T8] dump_stack_lvl+0xee/0x150 [ 64.318378][ T8] ? show_regs_print_info+0x20/0x20 [ 64.323580][ T8] ? load_image+0x3a0/0x3a0 [ 64.328206][ T8] ? __switch_to+0x51d/0xe20 [ 64.332809][ T8] print_address_description+0x7f/0x2c0 [ 64.338370][ T8] ? l2tp_session_delete+0x24/0x4a0 [ 64.343584][ T8] kasan_report+0xf1/0x140 [ 64.348016][ T8] ? l2tp_session_delete+0x24/0x4a0 [ 64.353218][ T8] kasan_check_range+0x280/0x290 [ 64.358176][ T8] __kasan_check_write+0x14/0x20 [ 64.363204][ T8] l2tp_session_delete+0x24/0x4a0 [ 64.368238][ T8] l2tp_tunnel_del_work+0x1d2/0x3e0 [ 64.373442][ T8] process_one_work+0x6be/0xba0 [ 64.378333][ T8] worker_thread+0xa59/0x1200 [ 64.383192][ T8] kthread+0x411/0x500 [ 64.387267][ T8] ? worker_clr_flags+0x190/0x190 [ 64.392294][ T8] ? kthread_blkcg+0xd0/0xd0 [ 64.396892][ T8] ret_from_fork+0x1f/0x30 [ 64.401313][ T8] [ 64.404347][ T8] [ 64.406667][ T8] Allocated by task 1779: [ 64.410999][ T8] __kasan_kmalloc+0xda/0x110 [ 64.415678][ T8] __kmalloc+0x13d/0x2c0 [ 64.419950][ T8] l2tp_session_create+0x39/0xb60 [ 64.424978][ T8] pppol2tp_connect+0xb35/0x1570 [ 64.429932][ T8] __sys_connect+0x389/0x410 [ 64.434526][ T8] __x64_sys_connect+0x7a/0x90 [ 64.439300][ T8] x64_sys_call+0x7c/0x9a0 [ 64.443721][ T8] do_syscall_64+0x4c/0xa0 [ 64.448180][ T8] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 64.454077][ T8] [ 64.456423][ T8] Freed by task 1790: [ 64.460483][ T8] kasan_set_track+0x4a/0x70 [ 64.465073][ T8] kasan_set_free_info+0x23/0x40 [ 64.470013][ T8] ____kasan_slab_free+0x125/0x160 [ 64.475123][ T8] __kasan_slab_free+0x11/0x20 [ 64.479974][ T8] slab_free_freelist_hook+0xc2/0x190 [ 64.485435][ T8] kfree+0xc4/0x270 [ 64.489246][ T8] l2tp_session_dec_refcount+0xaf/0x1a0 [ 64.494792][ T8] pppol2tp_session_destruct+0xb1/0xf0 [ 64.500260][ T8] __sk_destruct+0x56/0x5e0 [ 64.504780][ T8] __sk_free+0x313/0x410 [ 64.509026][ T8] sk_free+0x54/0x90 [ 64.512935][ T8] pppol2tp_put_sk+0x7a/0xb0 [ 64.517540][ T8] rcu_do_batch+0x51d/0xba0 [ 64.522046][ T8] rcu_core+0x5e4/0xf80 [ 64.526200][ T8] rcu_core_si+0x9/0x10 [ 64.530383][ T8] handle_softirqs+0x250/0x560 [ 64.535233][ T8] __do_softirq+0xb/0xd [ 64.539405][ T8] [ 64.541728][ T8] Last potentially related work creation: [ 64.547435][ T8] kasan_save_stack+0x3a/0x60 [ 64.552116][ T8] __kasan_record_aux_stack+0xd2/0x100 [ 64.557580][ T8] kasan_record_aux_stack_noalloc+0xb/0x10 [ 64.563392][ T8] call_rcu+0x105/0xfe0 [ 64.567545][ T8] pppol2tp_release+0x208/0x2d0 [ 64.572565][ T8] sock_close+0xe0/0x270 [ 64.576811][ T8] __fput+0x20b/0x8b0 [ 64.580793][ T8] ____fput+0x15/0x20 [ 64.584772][ T8] task_work_run+0x127/0x190 [ 64.589363][ T8] exit_to_user_mode_loop+0xd0/0xe0 [ 64.594590][ T8] exit_to_user_mode_prepare+0x87/0xd0 [ 64.600054][ T8] syscall_exit_to_user_mode+0x1a/0x30 [ 64.605524][ T8] do_syscall_64+0x58/0xa0 [ 64.609963][ T8] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 64.615873][ T8] [ 64.618289][ T8] Second to last potentially related work creation: [ 64.624958][ T8] kasan_save_stack+0x3a/0x60 [ 64.629636][ T8] __kasan_record_aux_stack+0xd2/0x100 [ 64.635102][ T8] kasan_record_aux_stack_noalloc+0xb/0x10 [ 64.640941][ T8] kvfree_call_rcu+0xae/0x7e0 [ 64.645628][ T8] l2tp_tunnel_destruct+0x206/0x280 [ 64.650833][ T8] __sk_destruct+0x56/0x5e0 [ 64.655380][ T8] rcu_do_batch+0x51d/0xba0 [ 64.659895][ T8] rcu_core+0x5e4/0xf80 [ 64.664184][ T8] rcu_core_si+0x9/0x10 [ 64.668354][ T8] handle_softirqs+0x250/0x560 [ 64.673120][ T8] __irq_exit_rcu+0x52/0xf0 [ 64.677715][ T8] irq_exit_rcu+0x9/0x10 [ 64.681959][ T8] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 64.687683][ T8] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 64.693669][ T8] [ 64.696014][ T8] The buggy address belongs to the object at ffff88812a5a4400 [ 64.696014][ T8] which belongs to the cache kmalloc-512 of size 512 [ 64.710067][ T8] The buggy address is located 8 bytes inside of [ 64.710067][ T8] 512-byte region [ffff88812a5a4400, ffff88812a5a4600) [ 64.723292][ T8] The buggy address belongs to the page: [ 64.728918][ T8] page:ffffea0004a96900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12a5a4 [ 64.739252][ T8] head:ffffea0004a96900 order:2 compound_mapcount:0 compound_pincount:0 [ 64.747583][ T8] flags: 0x4000000000010200(slab|head|zone=1) [ 64.753667][ T8] raw: 4000000000010200 ffffea0004af5900 0000000300000003 ffff888100042f00 [ 64.762268][ T8] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 64.770844][ T8] page dumped because: kasan: bad access detected [ 64.777256][ T8] page_owner tracks the page as allocated [ 64.782964][ T8] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 21, ts 24983226284, free_ts 0 [ 64.801030][ T8] post_alloc_hook+0x192/0x1b0 [ 64.805810][ T8] prep_new_page+0x1c/0x110 [ 64.810318][ T8] get_page_from_freelist+0x2cc5/0x2d50 [ 64.815926][ T8] __alloc_pages+0x18f/0x440 [ 64.820525][ T8] new_slab+0xa1/0x4d0 [ 64.824659][ T8] ___slab_alloc+0x381/0x810 [ 64.829270][ T8] __slab_alloc+0x49/0x90 [ 64.833620][ T8] __kmalloc+0x16a/0x2c0 [ 64.837895][ T8] kvmalloc_node+0x206/0x300 [ 64.842684][ T8] alloc_swap_slot_cache+0x4d/0x3e0 [ 64.847893][ T8] cpuhp_invoke_callback+0x250/0xec0 [ 64.853253][ T8] cpuhp_thread_fun+0x36b/0x6b0 [ 64.858285][ T8] smpboot_thread_fn+0x45a/0x8c0 [ 64.863430][ T8] kthread+0x411/0x500 [ 64.867502][ T8] ret_from_fork+0x1f/0x30 [ 64.872010][ T8] page_owner free stack trace missing [ 64.877401][ T8] [ 64.879727][ T8] Memory state around the buggy address: [ 64.885358][ T8] ffff88812a5a4300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 64.893645][ T8] ffff88812a5a4380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 64.901709][ T8] >ffff88812a5a4400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 64.909902][ T8] ^ [ 64.914754][ T8] ffff88812a5a4480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 64.922899][ T8] ffff88812a5a4500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 64.930956][ T8] ================================================================== [ 64.939015][ T8] Disabling lock debugging due to kernel taint [ 64.958371][ T30] audit: type=1400 audit(1761593794.567:110): avc: denied { read } for pid=83 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 64.997258][ T8] ------------[ cut here ]------------ [ 65.002879][ T8] refcount_t: underflow; use-after-free. [ 65.008646][ T8] WARNING: CPU: 1 PID: 8 at lib/refcount.c:28 refcount_warn_saturate+0x120/0x1a0 [ 65.018918][ T8] Modules linked in: [ 65.023091][ T8] CPU: 1 PID: 8 Comm: kworker/u4:0 Tainted: G B syzkaller #0 [ 65.083287][ T8] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 65.104105][ T8] Workqueue: l2tp l2tp_tunnel_del_work [ 65.138219][ T8] RIP: 0010:refcount_warn_saturate+0x120/0x1a0 [ 65.145104][ T30] audit: type=1400 audit(1761593794.567:111): avc: denied { search } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 65.170506][ T30] audit: type=1400 audit(1761593794.567:112): avc: denied { write } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 65.234642][ T8] Code: 04 01 48 c7 c7 c0 0d 63 85 e8 3c bc 53 02 0f 0b eb c3 e8 f3 9d 1c ff c6 05 5e ec 99 04 01 48 c7 c7 20 0e 63 85 e8 20 bc 53 02 <0f> 0b eb a7 e8 d7 9d 1c ff c6 05 3f ec 99 04 01 48 c7 c7 60 0d 63 [ 65.234962][ T30] audit: type=1400 audit(1761593794.567:113): avc: denied { add_name } for pid=83 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 65.260453][ T8] RSP: 0018:ffffc90000087c38 EFLAGS: 00010246 [ 65.315585][ T30] audit: type=1400 audit(1761593794.567:114): avc: denied { create } for pid=83 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 65.336250][ T8] [ 65.380369][ T30] audit: type=1400 audit(1761593794.567:115): avc: denied { append open } for pid=83 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 65.392396][ T8] RAX: c501f62a5e520300 RBX: 0000000000000003 RCX: ffff888100274f00 [ 65.414488][ T8] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 65.441840][ T8] RBP: ffffc90000087c48 R08: dffffc0000000000 R09: ffffed103ee24e93 [ 65.505946][ T8] R10: ffffed103ee24e93 R11: 1ffff1103ee24e92 R12: ffff88810b0d2c20 [ 65.536038][ T30] audit: type=1400 audit(1761593794.567:116): avc: denied { getattr } for pid=83 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 65.571558][ T8] R13: dffffc0000000000 R14: 0000000000000003 R15: 0000000000000000 [ 65.666401][ T8] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 65.679377][ T8] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 65.692456][ T8] CR2: 0000400000180000 CR3: 000000011d9a6000 CR4: 00000000003506a0 [ 65.723968][ T8] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 65.732072][ T8] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 65.759642][ T8] Call Trace: [ 65.763117][ T8] [ 65.766075][ T8] l2tp_session_dec_refcount+0xc8/0x1a0 [ 65.771666][ T8] l2tp_session_delete+0x3ab/0x4a0 [ 65.776877][ T8] l2tp_tunnel_del_work+0x1d2/0x3e0 [ 65.792666][ T8] process_one_work+0x6be/0xba0 [ 65.797965][ T8] worker_thread+0xa59/0x1200 [ 65.803314][ T8] kthread+0x411/0x500 [ 65.807435][ T8] ? worker_clr_flags+0x190/0x190 [ 65.814015][ T8] ? kthread_blkcg+0xd0/0xd0 [ 65.818726][ T8] ret_from_fork+0x1f/0x30 [ 65.825232][ T8] [ 65.828633][ T8] ---[ end trace 1d4f1c76c7bfb36f ]--- 2025/10/27 19:36:38 executed programs: 825