Warning: Permanently added '10.128.1.112' (ED25519) to the list of known hosts. 2026/08/04 08:56:58 parsed 1 programs 2026/08/04 08:56:58 serving rpc on tcp://35961 [ 24.920290][ T28] audit: type=1400 audit(1785833818.908:64): avc: denied { node_bind } for pid=294 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 24.941113][ T28] audit: type=1400 audit(1785833818.908:65): avc: denied { module_request } for pid=294 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 25.994828][ T28] audit: type=1400 audit(1785833819.978:66): avc: denied { mounton } for pid=300 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.997554][ T300] cgroup: Unknown subsys name 'net' [ 26.017489][ T28] audit: type=1400 audit(1785833819.988:67): avc: denied { mount } for pid=300 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.045587][ T28] audit: type=1400 audit(1785833820.038:68): avc: denied { unmount } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.065527][ T300] cgroup: Unknown subsys name 'devices' [ 26.186934][ T300] cgroup: Unknown subsys name 'hugetlb' [ 26.192546][ T300] cgroup: Unknown subsys name 'rlimit' [ 26.303114][ T28] audit: type=1400 audit(1785833820.288:69): avc: denied { setattr } for pid=300 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 26.326395][ T28] audit: type=1400 audit(1785833820.288:70): avc: denied { create } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.346798][ T28] audit: type=1400 audit(1785833820.288:71): avc: denied { write } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.367130][ T28] audit: type=1400 audit(1785833820.288:72): avc: denied { read } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 26.387467][ T28] audit: type=1400 audit(1785833820.288:73): avc: denied { mounton } for pid=300 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 26.389787][ T304] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 26.460109][ T300] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 27.187898][ T310] request_module fs-gadgetfs succeeded, but still no fs? [ 27.442907][ T324] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.455067][ T324] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.462555][ T324] device bridge_slave_0 entered promiscuous mode [ 27.486720][ T324] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.493776][ T324] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.515277][ T324] device bridge_slave_1 entered promiscuous mode [ 27.810791][ T324] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.817909][ T324] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.825219][ T324] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.832272][ T324] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.864643][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.872255][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.881448][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 27.889094][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 27.905909][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 27.914180][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.921255][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.928770][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 27.937002][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.944038][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.952001][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 27.960073][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 27.975848][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.988384][ T324] device veth0_vlan entered promiscuous mode [ 27.995147][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 28.004684][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 28.013029][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 28.027034][ T324] device veth1_macvtap entered promiscuous mode [ 28.033974][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 28.045948][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.056857][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/08/04 08:57:02 executed programs: 0 [ 28.237881][ T371] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.245051][ T371] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.252425][ T371] device bridge_slave_0 entered promiscuous mode [ 28.260602][ T371] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.267709][ T371] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.275351][ T371] device bridge_slave_1 entered promiscuous mode [ 28.367779][ T372] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.374856][ T372] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.382310][ T372] device bridge_slave_0 entered promiscuous mode [ 28.391725][ T372] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.399008][ T372] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.406482][ T372] device bridge_slave_1 entered promiscuous mode [ 28.489236][ T374] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.496522][ T374] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.503881][ T374] device bridge_slave_0 entered promiscuous mode [ 28.517507][ T376] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.524553][ T376] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.532164][ T376] device bridge_slave_0 entered promiscuous mode [ 28.539643][ T376] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.546766][ T376] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.554160][ T376] device bridge_slave_1 entered promiscuous mode [ 28.560808][ T374] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.567889][ T374] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.575421][ T374] device bridge_slave_1 entered promiscuous mode [ 28.607225][ T377] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.614274][ T377] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.621785][ T377] device bridge_slave_0 entered promiscuous mode [ 28.645772][ T377] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.652831][ T377] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.660367][ T377] device bridge_slave_1 entered promiscuous mode [ 28.799480][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 28.806972][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.834359][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 28.842793][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 28.851338][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.858428][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.889208][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.897149][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 28.904750][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 28.913263][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 28.922728][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.929796][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.965859][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 28.973278][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 28.981422][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 28.989996][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 28.998154][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 29.006268][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.014139][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.022408][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.029454][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.036886][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.045053][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.052076][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.059581][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 29.071242][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 29.079702][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.087884][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.094897][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.114371][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 29.122079][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.129641][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.137879][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.144894][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.152490][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.161103][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.168198][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.175676][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 29.184679][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.194801][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 29.203147][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.211351][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.218437][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.233004][ T371] device veth0_vlan entered promiscuous mode [ 29.251830][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 29.259834][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 29.267463][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 29.276395][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 29.284642][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 29.293012][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.300940][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.308945][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.316915][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.331650][ T371] device veth1_macvtap entered promiscuous mode [ 29.345694][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 29.354096][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.367276][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.387849][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 29.395874][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 29.403261][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 29.410936][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 29.419214][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 29.427506][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 29.435874][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 29.444113][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 29.452444][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 29.466779][ T374] device veth0_vlan entered promiscuous mode [ 29.476173][ T376] device veth0_vlan entered promiscuous mode [ 29.482882][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 29.491550][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 29.500179][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 29.507649][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 29.515412][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.523516][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.530572][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.537969][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.546210][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.553233][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.560668][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 29.584845][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 29.593337][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 29.602505][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 29.616617][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 29.616702][ T396] ================================================================== [ 29.626035][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 29.632352][ T396] BUG: KASAN: use-after-free in pppol2tp_sock_to_session+0x1a0/0x1b0 [ 29.640240][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 29.647584][ T396] Read of size 4 at addr ffff88812152e800 by task syz.0.17/396 [ 29.647600][ T396] [ 29.647620][ T396] CPU: 0 PID: 396 Comm: syz.0.17 Not tainted syzkaller #0 [ 29.671724][ T396] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 29.681804][ T396] Call Trace: [ 29.685095][ T396] [ 29.688035][ T396] __dump_stack+0x21/0x24 [ 29.692366][ T396] dump_stack_lvl+0x110/0x170 [ 29.697034][ T396] ? __cfi_dump_stack_lvl+0x8/0x8 [ 29.702139][ T396] ? _raw_spin_lock_bh+0x94/0xf0 [ 29.707072][ T396] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 29.712801][ T396] print_address_description+0x71/0x200 [ 29.718342][ T396] print_report+0x4a/0x60 [ 29.722671][ T396] kasan_report+0x122/0x150 [ 29.727175][ T396] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 29.732900][ T396] __asan_report_load4_noabort+0x14/0x20 [ 29.738538][ T396] pppol2tp_sock_to_session+0x1a0/0x1b0 [ 29.744085][ T396] pppol2tp_release+0x150/0x2b0 [ 29.748934][ T396] sock_close+0xc9/0x220 [ 29.753182][ T396] ? __cfi_sock_close+0x10/0x10 [ 29.758037][ T396] __fput+0x1fd/0x8f0 [ 29.762030][ T396] ____fput+0x15/0x20 [ 29.766005][ T396] task_work_run+0x1e1/0x250 [ 29.770591][ T396] ? __cfi_task_work_run+0x10/0x10 [ 29.775702][ T396] ? __cfi___close_range+0x10/0x10 [ 29.780849][ T396] exit_to_user_mode_loop+0x9b/0xb0 [ 29.786052][ T396] exit_to_user_mode_prepare+0x87/0xd0 [ 29.791521][ T396] syscall_exit_to_user_mode+0x1a/0x30 [ 29.796979][ T396] do_syscall_64+0x58/0xa0 [ 29.801387][ T396] ? clear_bhb_loop+0x30/0x80 [ 29.806054][ T396] ? clear_bhb_loop+0x30/0x80 [ 29.810728][ T396] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 29.816644][ T396] RIP: 0033:0x7f3b8599e019 [ 29.821045][ T396] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 29.840640][ T396] RSP: 002b:00007ffffdbbf808 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 29.849095][ T396] RAX: 0000000000000000 RBX: 00007ffffdbbf8f0 RCX: 00007f3b8599e019 [ 29.857059][ T396] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 29.865046][ T396] RBP: 000000000000739f R08: 0000000000000001 R09: 0000000000000000 [ 29.873015][ T396] R10: 0000001b33020000 R11: 0000000000000246 R12: 00007ffffdbbf930 [ 29.880977][ T396] R13: 00007f3b85c25fac R14: 00000000000073d3 R15: 00007f3b85c25fa0 [ 29.888948][ T396] [ 29.891965][ T396] [ 29.894274][ T396] Allocated by task 397: [ 29.898497][ T396] kasan_set_track+0x4b/0x70 [ 29.903085][ T396] kasan_save_alloc_info+0x1f/0x30 [ 29.908211][ T396] __kasan_kmalloc+0x95/0xb0 [ 29.912812][ T396] __kmalloc+0xb4/0x1e0 [ 29.916976][ T396] l2tp_session_create+0x38/0xbd0 [ 29.921986][ T396] pppol2tp_connect+0xbf5/0x1640 [ 29.926926][ T396] __sys_connect+0x3da/0x460 [ 29.931507][ T396] __x64_sys_connect+0x7a/0x90 [ 29.936258][ T396] x64_sys_call+0x88d/0x9a0 [ 29.940754][ T396] do_syscall_64+0x4c/0xa0 [ 29.945160][ T396] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 29.951048][ T396] [ 29.953363][ T396] Freed by task 8: [ 29.957065][ T396] kasan_set_track+0x4b/0x70 [ 29.961646][ T396] kasan_save_free_info+0x2b/0x40 [ 29.966658][ T396] ____kasan_slab_free+0x132/0x180 [ 29.971763][ T396] __kasan_slab_free+0x11/0x20 [ 29.976559][ T396] slab_free_freelist_hook+0xc2/0x190 [ 29.981937][ T396] __kmem_cache_free+0xb7/0x1b0 [ 29.986798][ T396] kfree+0x6f/0xf0 [ 29.990505][ T396] l2tp_session_put+0xaf/0x1a0 [ 29.995263][ T396] l2tp_session_delete+0x3df/0x4d0 [ 30.000364][ T396] l2tp_tunnel_del_work+0x199/0x410 [ 30.005546][ T396] process_one_work+0x717/0xc30 [ 30.010381][ T396] worker_thread+0xa4d/0x11d0 [ 30.015053][ T396] kthread+0x281/0x320 [ 30.019122][ T396] ret_from_fork+0x1f/0x30 [ 30.023533][ T396] [ 30.025855][ T396] The buggy address belongs to the object at ffff88812152e800 [ 30.025855][ T396] which belongs to the cache kmalloc-512 of size 512 [ 30.039894][ T396] The buggy address is located 0 bytes inside of [ 30.039894][ T396] 512-byte region [ffff88812152e800, ffff88812152ea00) [ 30.052976][ T396] [ 30.055287][ T396] The buggy address belongs to the physical page: [ 30.061690][ T396] page:ffffea0004854b00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12152c [ 30.071918][ T396] head:ffffea0004854b00 order:2 compound_mapcount:0 compound_pincount:0 [ 30.080252][ T396] flags: 0x4000000000010200(slab|head|zone=1) [ 30.086320][ T396] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 [ 30.094910][ T396] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 30.103498][ T396] page dumped because: kasan: bad access detected [ 30.109897][ T396] page_owner tracks the page as allocated [ 30.115606][ T396] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 397, tgid 396 (syz.0.17), ts 29616400205, free_ts 29582390774 [ 30.137833][ T396] post_alloc_hook+0x1f5/0x210 [ 30.142614][ T396] prep_new_page+0x1c/0x110 [ 30.147105][ T396] get_page_from_freelist+0x2ca9/0x2d20 [ 30.152663][ T396] __alloc_pages+0x1fa/0x610 [ 30.157257][ T396] alloc_slab_page+0x6e/0xf0 [ 30.161835][ T396] new_slab+0x98/0x3e0 [ 30.165902][ T396] ___slab_alloc+0x70f/0xb70 [ 30.170503][ T396] __slab_alloc+0x5e/0xa0 [ 30.174832][ T396] __kmem_cache_alloc_node+0x204/0x2d0 [ 30.180286][ T396] __kmalloc+0xa4/0x1e0 [ 30.184430][ T396] l2tp_session_create+0x38/0xbd0 [ 30.189450][ T396] pppol2tp_connect+0xbf5/0x1640 [ 30.194375][ T396] __sys_connect+0x3da/0x460 [ 30.198953][ T396] __x64_sys_connect+0x7a/0x90 [ 30.203711][ T396] x64_sys_call+0x88d/0x9a0 [ 30.208207][ T396] do_syscall_64+0x4c/0xa0 [ 30.212630][ T396] page last free stack trace: [ 30.217287][ T396] free_unref_page_prepare+0x80c/0x820 [ 30.222737][ T396] free_unref_page+0x93/0x530 [ 30.227404][ T396] __free_pages+0x67/0x100 [ 30.231814][ T396] free_large_kmalloc+0xae/0xf0 [ 30.236663][ T396] kfree+0x8b/0xf0 [ 30.240376][ T396] tipc_nametbl_stop+0x1294/0x12f0 [ 30.245482][ T396] tipc_exit_net+0x99/0x150 [ 30.249972][ T396] cleanup_net+0x5b0/0xb10 [ 30.254375][ T396] process_one_work+0x717/0xc30 [ 30.259230][ T396] worker_thread+0xa4d/0x11d0 [ 30.263900][ T396] kthread+0x281/0x320 [ 30.267971][ T396] ret_from_fork+0x1f/0x30 [ 30.272377][ T396] [ 30.274696][ T396] Memory state around the buggy address: [ 30.280316][ T396] ffff88812152e700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.288367][ T396] ffff88812152e780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 30.296433][ T396] >ffff88812152e800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.304472][ T396] ^ [ 30.308523][ T396] ffff88812152e880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.316576][ T396] ffff88812152e900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 30.324636][ T396] ================================================================== [ 30.337245][ T28] kauditd_printk_skb: 34 callbacks suppressed [ 30.337256][ T28] audit: type=1400 audit(1785833824.328:108): avc: denied { read } for pid=84 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 30.345042][ T396] Disabling lock debugging due to kernel taint [ 30.368324][ T374] device veth1_macvtap entered promiscuous mode [ 30.377851][ T396] ------------[ cut here ]------------ [ 30.383349][ T396] WARNING: CPU: 1 PID: 396 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 30.384400][ T28] audit: type=1400 audit(1785833824.328:109): avc: denied { search } for pid=84 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 30.393445][ T396] Modules linked in: [ 30.414786][ T28] audit: type=1400 audit(1785833824.328:110): avc: denied { write } for pid=84 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 30.414810][ T28] audit: type=1400 audit(1785833824.328:111): avc: denied { add_name } for pid=84 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 30.414830][ T28] audit: type=1400 audit(1785833824.328:112): avc: denied { create } for pid=84 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 30.419135][ T396] [ 30.440852][ T28] audit: type=1400 audit(1785833824.328:113): avc: denied { append open } for pid=84 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 30.460857][ T396] CPU: 1 PID: 396 Comm: syz.0.17 Tainted: G B syzkaller #0 [ 30.497152][ T376] device veth1_macvtap entered promiscuous mode [ 30.506243][ T396] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 30.514845][ T28] audit: type=1400 audit(1785833824.328:114): avc: denied { getattr } for pid=84 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 30.521089][ T396] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 30.521121][ T396] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 30.576939][ T372] device veth0_vlan entered promiscuous mode [ 30.579751][ T396] RSP: 0018:ffffc90000a87cb0 EFLAGS: 00010293 [ 30.591783][ T396] RAX: ffffffff849bb307 RBX: ffff88811881f000 RCX: ffff88812c7c1440 [ 30.599862][ T396] RDX: 0000000000000000 RSI: 00000000311b0200 RDI: 000000000c04eb7d [ 30.604212][ T372] device veth1_macvtap entered promiscuous mode [ 30.607871][ T396] RBP: ffffc90000a87cd0 R08: ffffffff87b757e7 R09: 1ffffffff0f6eafc [ 30.622138][ T396] R10: dffffc0000000000 R11: fffffbfff0f6eafd R12: dffffc0000000000 [ 30.630177][ T396] R13: dffffc0000000000 R14: 00000000311b0200 R15: ffff88812152e800 [ 30.638204][ T396] FS: 0000555578bf8500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 30.647163][ T396] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 30.653754][ T396] CR2: 000008a770d44000 CR3: 000000012c89b000 CR4: 00000000003506a0 [ 30.661757][ T396] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 30.669745][ T396] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 30.677761][ T396] Call Trace: [ 30.681043][ T396] [ 30.683973][ T396] pppol2tp_release+0x150/0x2b0 [ 30.688890][ T396] sock_close+0xc9/0x220 [ 30.693160][ T396] ? __cfi_sock_close+0x10/0x10 [ 30.698051][ T396] __fput+0x1fd/0x8f0 [ 30.702062][ T396] ____fput+0x15/0x20 [ 30.706066][ T396] task_work_run+0x1e1/0x250 [ 30.710669][ T396] ? __cfi_task_work_run+0x10/0x10 [ 30.715830][ T396] ? __cfi___close_range+0x10/0x10 [ 30.720948][ T396] exit_to_user_mode_loop+0x9b/0xb0 [ 30.726165][ T396] exit_to_user_mode_prepare+0x87/0xd0 [ 30.731630][ T396] syscall_exit_to_user_mode+0x1a/0x30 [ 30.737118][ T396] do_syscall_64+0x58/0xa0 [ 30.741556][ T396] ? clear_bhb_loop+0x30/0x80 [ 30.746311][ T396] ? clear_bhb_loop+0x30/0x80 [ 30.750996][ T396] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 30.756932][ T396] RIP: 0033:0x7f3b8599e019 [ 30.761362][ T396] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 30.780997][ T396] RSP: 002b:00007ffffdbbf808 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 30.789448][ T396] RAX: 0000000000000000 RBX: 00007ffffdbbf8f0 RCX: 00007f3b8599e019 [ 30.797440][ T396] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 30.805447][ T396] RBP: 000000000000739f R08: 0000000000000001 R09: 0000000000000000 [ 30.813404][ T396] R10: 0000001b33020000 R11: 0000000000000246 R12: 00007ffffdbbf930 [ 30.821400][ T396] R13: 00007f3b85c25fac R14: 00000000000073d3 R15: 00007f3b85c25fa0 [ 30.829402][ T396] [ 30.832439][ T396] ---[ end trace 0000000000000000 ]--- [ 30.848600][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 30.866130][ T398] ------------[ cut here ]------------ [ 30.868226][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 30.871646][ T398] WARNING: CPU: 0 PID: 398 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 30.880636][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 30.889504][ T398] Modules linked in: [ 30.889516][ T398] CPU: 0 PID: 398 Comm: syz.1.18 Tainted: G B W syzkaller #0 [ 30.898416][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 30.901357][ T398] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 30.912533][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 30.917547][ T398] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 30.930464][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 30.935657][ T398] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 30.935674][ T398] RSP: 0018:ffffc90000aa7cb0 EFLAGS: 00010293 [ 30.944371][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 30.950338][ T398] RAX: ffffffff849bb307 RBX: ffff8881189e2000 RCX: ffff88811880e540 [ 30.950354][ T398] RDX: 0000000000000000 RSI: 0000000016679c00 RDI: 000000000c04eb7d [ 30.972238][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 30.976287][ T398] RBP: ffffc90000aa7cd0 R08: ffff8881189e2083 R09: 1ffff1102313c410 [ 30.985310][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 30.992273][ T398] R10: dffffc0000000000 R11: ffffed102313c411 R12: dffffc0000000000 [ 31.001056][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 31.008432][ T398] R13: dffffc0000000000 R14: 0000000016679c00 R15: ffff888131bd9c00 [ 31.017691][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 31.024080][ T398] FS: 000055558ad9b500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 31.024099][ T398] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 31.052296][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 31.055974][ T398] CR2: 00005582800a16d0 CR3: 000000012c49f000 CR4: 00000000003506b0 [ 31.071391][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 31.075522][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 31.079491][ T398] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 31.092004][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 31.095502][ T398] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 31.104599][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 31.111462][ T398] Call Trace: [ 31.120208][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 31.127466][ T398] [ 31.136102][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 31.138553][ T398] pppol2tp_release+0x150/0x2b0 [ 31.146869][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 31.148946][ T398] sock_close+0xc9/0x220 [ 31.157869][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 31.161850][ T398] ? __cfi_sock_close+0x10/0x10 [ 31.171229][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 31.174218][ T398] __fput+0x1fd/0x8f0 [ 31.199321][ T398] ____fput+0x15/0x20 [ 31.203335][ T398] task_work_run+0x1e1/0x250 [ 31.208071][ T398] ? __cfi_task_work_run+0x10/0x10 [ 31.213227][ T398] ? __cfi___close_range+0x10/0x10 [ 31.218461][ T398] exit_to_user_mode_loop+0x9b/0xb0 [ 31.223695][ T398] exit_to_user_mode_prepare+0x87/0xd0 [ 31.229293][ T398] syscall_exit_to_user_mode+0x1a/0x30 [ 31.234797][ T398] do_syscall_64+0x58/0xa0 [ 31.239351][ T398] ? clear_bhb_loop+0x30/0x80 [ 31.244063][ T398] ? clear_bhb_loop+0x30/0x80 [ 31.248870][ T398] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 31.254798][ T398] RIP: 0033:0x7fc4bc19e019 [ 31.259330][ T398] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 31.279117][ T398] RSP: 002b:00007ffc6172fc08 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 31.287655][ T398] RAX: 0000000000000000 RBX: 00007ffc6172fcf0 RCX: 00007fc4bc19e019 [ 31.295746][ T398] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 31.303750][ T398] RBP: 000000000000787d R08: 0000000000000001 R09: 0000000000000000 [ 31.311807][ T398] R10: 0000001b33120000 R11: 0000000000000246 R12: 00007ffc6172fd30 [ 31.319988][ T398] R13: 00007fc4bc425fac R14: 00000000000078b0 R15: 00007fc4bc425fa0 [ 31.328089][ T398] [ 31.331135][ T398] ---[ end trace 0000000000000000 ]--- [ 31.340148][ T404] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 31.348114][ T404] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 31.369039][ T404] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 31.383376][ T418] ------------[ cut here ]------------ [ 31.389022][ T418] WARNING: CPU: 0 PID: 418 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 31.399177][ T418] Modules linked in: [ 31.403098][ T418] CPU: 0 PID: 418 Comm: syz.3.20 Tainted: G B W syzkaller #0 [ 31.411719][ T418] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 31.412100][ T404] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 31.421800][ T418] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 31.430169][ T404] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 31.435570][ T418] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 31.444115][ T404] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 31.463007][ T418] RSP: 0018:ffffc90000aa7cb0 EFLAGS: 00010293 [ 31.473292][ T404] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 31.477186][ T418] RAX: ffffffff849bb307 RBX: ffff8881193c0000 RCX: ffff88811880d100 [ 31.477201][ T418] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000c04eb7d [ 31.477212][ T418] RBP: ffffc90000aa7cd0 R08: ffff8881193c0083 R09: 1ffff11023278010 [ 31.509165][ T418] R10: dffffc0000000000 R11: ffffed1023278011 R12: dffffc0000000000 [ 31.510185][ T404] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 31.517190][ T418] R13: dffffc0000000000 R14: 0000000000000000 R15: ffff888131bfe000 [ 31.517208][ T418] FS: 000055556180a500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 31.517225][ T418] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 31.536654][ T377] device veth0_vlan entered promiscuous mode [ 31.542299][ T418] CR2: 0000200000000740 CR3: 00000001171eb000 CR4: 00000000003506b0 [ 31.562842][ T418] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 31.570870][ T418] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 31.578868][ T418] Call Trace: [ 31.582146][ T418] [ 31.585106][ T418] pppol2tp_release+0x150/0x2b0 [ 31.589973][ T418] sock_close+0xc9/0x220 [ 31.594234][ T418] ? __cfi_sock_close+0x10/0x10 [ 31.599132][ T418] __fput+0x1fd/0x8f0 [ 31.603139][ T418] ____fput+0x15/0x20 [ 31.607161][ T418] task_work_run+0x1e1/0x250 [ 31.611759][ T418] ? __cfi_task_work_run+0x10/0x10 [ 31.616896][ T418] ? __cfi___close_range+0x10/0x10 [ 31.622034][ T418] exit_to_user_mode_loop+0x9b/0xb0 [ 31.627267][ T418] exit_to_user_mode_prepare+0x87/0xd0 [ 31.632735][ T418] syscall_exit_to_user_mode+0x1a/0x30 [ 31.638272][ T418] do_syscall_64+0x58/0xa0 [ 31.642729][ T418] ? clear_bhb_loop+0x30/0x80 [ 31.647446][ T418] ? clear_bhb_loop+0x30/0x80 [ 31.652132][ T418] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 31.658097][ T418] RIP: 0033:0x7f2595b9e019 [ 31.662520][ T418] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 31.682163][ T418] RSP: 002b:00007fff4c4d0328 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 31.690610][ T418] RAX: 0000000000000000 RBX: 00007fff4c4d0410 RCX: 00007f2595b9e019 [ 31.698618][ T418] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 31.706624][ T418] RBP: 0000000000007a87 R08: 0000000000000001 R09: 0000000000000000 [ 31.714587][ T418] R10: 0000001b33520000 R11: 0000000000000246 R12: 00007fff4c4d0450 [ 31.722692][ T418] R13: 00007f2595e25fac R14: 0000000000007aba R15: 00007f2595e25fa0 [ 31.730745][ T418] [ 31.733770][ T418] ---[ end trace 0000000000000000 ]--- [ 31.766591][ T431] ------------[ cut here ]------------ [ 31.772087][ T431] WARNING: CPU: 0 PID: 431 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 31.773257][ T429] ------------[ cut here ]------------ [ 31.782131][ T431] Modules linked in: [ 31.782143][ T431] CPU: 0 PID: 431 Comm: syz.3.34 Tainted: G B W syzkaller #0 [ 31.782162][ T431] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 31.782171][ T431] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 31.787809][ T429] WARNING: CPU: 1 PID: 429 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 31.791557][ T431] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 31.800482][ T429] Modules linked in: [ 31.810302][ T431] RSP: 0018:ffffc90000af7cb0 EFLAGS: 00010293 [ 31.810318][ T431] RAX: ffffffff849bb307 RBX: ffff888119a90000 RCX: ffff888119b7a880 [ 31.810331][ T431] RDX: 0000000000000000 RSI: 0000000021a4ba40 RDI: 000000000c04eb7d [ 31.810342][ T431] RBP: ffffc90000af7cd0 R08: ffff888119a90083 R09: 1ffff11023352010 [ 31.810354][ T431] R10: dffffc0000000000 R11: ffffed1023352011 R12: dffffc0000000000 [ 31.810366][ T431] R13: dffffc0000000000 R14: 0000000021a4ba40 R15: ffff88812c8e6800 [ 31.810378][ T431] FS: 000055556180a500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 31.810392][ T431] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 31.810403][ T431] CR2: 0000200000000740 CR3: 00000001304b1000 CR4: 00000000003506b0 [ 31.810418][ T431] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 31.810428][ T431] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 31.810439][ T431] Call Trace: [ 31.810444][ T431] [ 31.810450][ T431] pppol2tp_release+0x150/0x2b0 [ 31.810473][ T431] sock_close+0xc9/0x220 [ 31.810497][ T431] ? __cfi_sock_close+0x10/0x10 [ 31.816961][ T429] [ 31.826854][ T431] __fput+0x1fd/0x8f0 [ 31.826881][ T431] ____fput+0x15/0x20 [ 31.826902][ T431] task_work_run+0x1e1/0x250 [ 31.826924][ T431] ? __cfi_task_work_run+0x10/0x10 [ 31.846783][ T429] CPU: 1 PID: 429 Comm: syz.1.35 Tainted: G B W syzkaller #0 [ 31.850486][ T431] ? __cfi___close_range+0x10/0x10 [ 31.856882][ T429] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 31.864529][ T431] exit_to_user_mode_loop+0x9b/0xb0 [ 31.872715][ T429] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 31.880678][ T431] exit_to_user_mode_prepare+0x87/0xd0 [ 31.880702][ T431] syscall_exit_to_user_mode+0x1a/0x30 [ 31.880721][ T431] do_syscall_64+0x58/0xa0 [ 31.880743][ T431] ? clear_bhb_loop+0x30/0x80 [ 31.880760][ T431] ? clear_bhb_loop+0x30/0x80 [ 31.880777][ T431] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 31.880805][ T431] RIP: 0033:0x7f2595b9e019 [ 31.880820][ T431] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 31.880837][ T431] RSP: 002b:00007fff4c4d0328 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 31.880859][ T431] RAX: 0000000000000000 RBX: 00007fff4c4d0410 RCX: 00007f2595b9e019 [ 31.880872][ T431] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 31.880884][ T431] RBP: 0000000000007c05 R08: 0000000000000001 R09: 0000000000000000 [ 31.888902][ T429] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 31.896891][ T431] R10: 0000001b33520000 R11: 0000000000000246 R12: 00007fff4c4d0450 [ 31.896906][ T431] R13: 00007f2595e25fac R14: 0000000000007c37 R15: 00007f2595e25fa0 [ 31.905928][ T429] RSP: 0018:ffffc90000a87cb0 EFLAGS: 00010293 [ 31.905945][ T429] RAX: ffffffff849bb307 RBX: ffff888119824000 RCX: ffff8881194d0000 [ 31.912524][ T431] [ 31.920695][ T429] RDX: 0000000000000000 RSI: 0000000019aea000 RDI: 000000000c04eb7d [ 31.928685][ T431] ---[ end trace 0000000000000000 ]--- [ 32.166308][ T429] RBP: ffffc90000a87cd0 R08: ffff888119824083 R09: 1ffff11023304810 [ 32.174302][ T429] R10: dffffc0000000000 R11: ffffed1023304811 R12: dffffc0000000000 [ 32.182329][ T429] R13: dffffc0000000000 R14: 0000000019aea000 R15: ffff88812d3b7c00 [ 32.190363][ T429] FS: 000055558ad9b500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 32.199349][ T429] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.205982][ T429] CR2: 0000200000000740 CR3: 0000000132a3f000 CR4: 00000000003506a0 [ 32.213971][ T429] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 32.221989][ T429] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 32.229990][ T429] Call Trace: [ 32.233280][ T429] [ 32.236258][ T429] pppol2tp_release+0x150/0x2b0 [ 32.241129][ T429] sock_close+0xc9/0x220 [ 32.245423][ T429] ? __cfi_sock_close+0x10/0x10 [ 32.250318][ T429] __fput+0x1fd/0x8f0 [ 32.254414][ T429] ____fput+0x15/0x20 [ 32.258473][ T429] task_work_run+0x1e1/0x250 [ 32.263100][ T429] ? __cfi_task_work_run+0x10/0x10 [ 32.268285][ T429] ? __cfi___close_range+0x10/0x10 [ 32.273428][ T429] exit_to_user_mode_loop+0x9b/0xb0 [ 32.278745][ T429] exit_to_user_mode_prepare+0x87/0xd0 [ 32.284244][ T429] syscall_exit_to_user_mode+0x1a/0x30 [ 32.289757][ T429] do_syscall_64+0x58/0xa0 [ 32.294195][ T429] ? clear_bhb_loop+0x30/0x80 [ 32.298928][ T429] ? clear_bhb_loop+0x30/0x80 [ 32.303626][ T429] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 32.309681][ T429] RIP: 0033:0x7fc4bc19e019 [ 32.314117][ T429] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.333765][ T429] RSP: 002b:00007ffc6172fc08 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 32.342218][ T429] RAX: 0000000000000000 RBX: 00007ffc6172fcf0 RCX: 00007fc4bc19e019 [ 32.350242][ T429] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 32.358339][ T429] RBP: 0000000000007c04 R08: 0000000000000001 R09: 0000000000000000 [ 32.366375][ T429] R10: 0000001b33120000 R11: 0000000000000246 R12: 00007ffc6172fd30 [ 32.374374][ T429] R13: 00007fc4bc425fac R14: 0000000000007c36 R15: 00007fc4bc425fa0 [ 32.382498][ T429] [ 32.385555][ T429] ---[ end trace 0000000000000000 ]--- [ 32.421166][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 32.430306][ T472] ------------[ cut here ]------------ [ 32.436203][ T472] WARNING: CPU: 0 PID: 472 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 32.442811][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 32.446397][ T472] Modules linked in: [ 32.446410][ T472] CPU: 0 PID: 472 Comm: syz.1.54 Tainted: G B W syzkaller #0 [ 32.446429][ T472] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 32.446438][ T472] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 32.446465][ T472] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 32.446478][ T472] RSP: 0018:ffffc90000af7cb0 EFLAGS: 00010293 [ 32.446492][ T472] RAX: ffffffff849bb307 RBX: ffff88811ad78000 RCX: ffff88811acd1440 [ 32.446505][ T472] RDX: 0000000000000000 RSI: 000000001adca000 RDI: 000000000c04eb7d [ 32.446517][ T472] RBP: ffffc90000af7cd0 R08: ffff88811ad78083 R09: 1ffff110235af010 [ 32.446529][ T472] R10: dffffc0000000000 R11: ffffed10235af011 R12: dffffc0000000000 [ 32.446542][ T472] R13: dffffc0000000000 R14: 000000001adca000 R15: ffff88812d94b000 [ 32.446554][ T472] FS: 000055558ad9b500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 32.446570][ T472] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.446582][ T472] CR2: 0000200000000740 CR3: 0000000115bb5000 CR4: 00000000003506b0 [ 32.446597][ T472] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 32.491038][ T377] device veth1_macvtap entered promiscuous mode [ 32.503737][ T472] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 32.596558][ T472] Call Trace: [ 32.599858][ T472] [ 32.602804][ T472] pppol2tp_release+0x150/0x2b0 [ 32.607789][ T472] sock_close+0xc9/0x220 [ 32.612052][ T472] ? __cfi_sock_close+0x10/0x10 [ 32.617034][ T472] __fput+0x1fd/0x8f0 [ 32.621045][ T472] ____fput+0x15/0x20 [ 32.625166][ T472] task_work_run+0x1e1/0x250 [ 32.629779][ T472] ? __cfi_task_work_run+0x10/0x10 [ 32.634897][ T472] ? __cfi___close_range+0x10/0x10 [ 32.640128][ T472] exit_to_user_mode_loop+0x9b/0xb0 [ 32.645398][ T472] exit_to_user_mode_prepare+0x87/0xd0 [ 32.650853][ T472] syscall_exit_to_user_mode+0x1a/0x30 [ 32.656406][ T472] do_syscall_64+0x58/0xa0 [ 32.660861][ T472] ? clear_bhb_loop+0x30/0x80 [ 32.665648][ T472] ? clear_bhb_loop+0x30/0x80 [ 32.670354][ T472] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 32.676540][ T472] RIP: 0033:0x7fc4bc19e019 [ 32.680956][ T472] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.700693][ T472] RSP: 002b:00007ffc6172fc08 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 32.709264][ T472] RAX: 0000000000000000 RBX: 00007ffc6172fcf0 RCX: 00007fc4bc19e019 [ 32.717334][ T472] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 32.725387][ T472] RBP: 0000000000007e8d R08: 0000000000000001 R09: 0000000000000000 [ 32.733365][ T472] R10: 0000001b33120000 R11: 0000000000000246 R12: 00007ffc6172fd30 [ 32.741427][ T472] R13: 00007fc4bc425fac R14: 0000000000007ec7 R15: 00007fc4bc425fa0 [ 32.749499][ T472] [ 32.752509][ T472] ---[ end trace 0000000000000000 ]--- [ 32.780086][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 32.793591][ T483] ------------[ cut here ]------------ [ 32.799206][ T483] WARNING: CPU: 1 PID: 483 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 32.800192][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 32.809554][ T483] Modules linked in: [ 32.821463][ T483] CPU: 1 PID: 483 Comm: syz.6.59 Tainted: G B W syzkaller #0 [ 32.830133][ T483] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 32.840207][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 32.840666][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 32.848527][ T483] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 32.862902][ T483] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 32.882589][ T483] RSP: 0018:ffffc90000e27cb0 EFLAGS: 00010293 [ 32.888711][ T483] RAX: ffffffff849bb307 RBX: ffff88811b4c3000 RCX: ffff88811acd5100 [ 32.896710][ T483] RDX: 0000000000000000 RSI: 0000000032b41140 RDI: 000000000c04eb7d [ 32.904671][ T483] RBP: ffffc90000e27cd0 R08: ffff88811b4c3083 R09: 1ffff11023698610 [ 32.912669][ T483] R10: dffffc0000000000 R11: ffffed1023698611 R12: dffffc0000000000 [ 32.920813][ T483] R13: dffffc0000000000 R14: 0000000032b41140 R15: ffff88812d9f1400 [ 32.928827][ T483] FS: 0000555576296500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 32.937788][ T483] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.944361][ T483] CR2: 000055558ad9b4e8 CR3: 0000000130508000 CR4: 00000000003506a0 [ 32.952369][ T483] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 32.960383][ T483] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 32.968389][ T483] Call Trace: [ 32.971677][ T483] [ 32.974611][ T483] pppol2tp_release+0x150/0x2b0 [ 32.979503][ T483] sock_close+0xc9/0x220 [ 32.983762][ T483] ? __cfi_sock_close+0x10/0x10 [ 32.988657][ T483] __fput+0x1fd/0x8f0 [ 32.992666][ T483] ____fput+0x15/0x20 [ 32.996772][ T483] task_work_run+0x1e1/0x250 [ 33.001362][ T483] ? __cfi_task_work_run+0x10/0x10 [ 33.006505][ T483] ? __cfi___close_range+0x10/0x10 [ 33.011629][ T483] exit_to_user_mode_loop+0x9b/0xb0 [ 33.016848][ T483] exit_to_user_mode_prepare+0x87/0xd0 [ 33.022317][ T483] syscall_exit_to_user_mode+0x1a/0x30 [ 33.027798][ T483] do_syscall_64+0x58/0xa0 [ 33.032228][ T483] ? clear_bhb_loop+0x30/0x80 [ 33.036950][ T483] ? clear_bhb_loop+0x30/0x80 [ 33.041639][ T483] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 33.047577][ T483] RIP: 0033:0x7f09ae19e019 [ 33.052020][ T483] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 33.071664][ T483] RSP: 002b:00007ffc20291f28 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 33.080199][ T483] RAX: 0000000000000000 RBX: 00007ffc20292010 RCX: 00007f09ae19e019 [ 33.088220][ T483] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 33.096217][ T483] RBP: 0000000000008006 R08: 0000000000000001 R09: 0000000000000000 [ 33.104193][ T483] R10: 0000001b33220000 R11: 0000000000000246 R12: 00007ffc20292050 [ 33.112209][ T483] R13: 00007f09ae425fac R14: 000000000000803b R15: 00007f09ae425fa0 [ 33.120228][ T483] [ 33.123245][ T483] ---[ end trace 0000000000000000 ]--- [ 33.174969][ T503] ------------[ cut here ]------------ [ 33.180568][ T503] WARNING: CPU: 1 PID: 503 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 33.182102][ T28] audit: type=1400 audit(1785833827.168:115): avc: denied { write } for pid=294 comm="syz-execprog" path="pipe:[15175]" dev="pipefs" ino=15175 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 33.190618][ T503] Modules linked in: 2026/08/04 08:57:07 executed programs: 55 [ 33.217634][ T503] CPU: 1 PID: 503 Comm: syz.5.21 Tainted: G B W syzkaller #0 [ 33.226259][ T503] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 33.236443][ T503] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 33.242792][ T503] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 33.262442][ T503] RSP: 0018:ffffc90000f1fcb0 EFLAGS: 00010293 [ 33.268557][ T503] RAX: ffffffff849bb307 RBX: ffff88811ba19000 RCX: ffff88811b833cc0 [ 33.276586][ T503] RDX: 0000000000000000 RSI: 000000001719fb00 RDI: 000000000c04eb7d [ 33.284575][ T503] RBP: ffffc90000f1fcd0 R08: ffff88811ba19083 R09: 1ffff11023743210 [ 33.292591][ T503] R10: dffffc0000000000 R11: ffffed1023743211 R12: dffffc0000000000 [ 33.300594][ T503] R13: dffffc0000000000 R14: 000000001719fb00 R15: ffff88812e63e400 [ 33.308629][ T503] FS: 00005555935ac500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 33.317691][ T503] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 33.324290][ T503] CR2: 00007fc4bc15dfd0 CR3: 000000012ded0000 CR4: 00000000003506a0 [ 33.332316][ T503] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 33.340325][ T503] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 33.348350][ T503] Call Trace: [ 33.351655][ T503] [ 33.354595][ T503] pppol2tp_release+0x150/0x2b0 [ 33.359487][ T503] sock_close+0xc9/0x220 [ 33.363755][ T503] ? __cfi_sock_close+0x10/0x10 [ 33.368664][ T503] __fput+0x1fd/0x8f0 [ 33.372675][ T503] ____fput+0x15/0x20 [ 33.376713][ T503] task_work_run+0x1e1/0x250 [ 33.381353][ T503] ? __cfi_task_work_run+0x10/0x10 [ 33.386516][ T503] ? __cfi___close_range+0x10/0x10 [ 33.391650][ T503] exit_to_user_mode_loop+0x9b/0xb0 [ 33.397165][ T503] exit_to_user_mode_prepare+0x87/0xd0 [ 33.402675][ T503] syscall_exit_to_user_mode+0x1a/0x30 [ 33.408190][ T503] do_syscall_64+0x58/0xa0 [ 33.412659][ T503] ? clear_bhb_loop+0x30/0x80 [ 33.417371][ T503] ? clear_bhb_loop+0x30/0x80 [ 33.422074][ T503] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 33.428016][ T503] RIP: 0033:0x7f2eb179e019 [ 33.432441][ T503] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 33.452088][ T503] RSP: 002b:00007fffd3470c18 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 33.460534][ T503] RAX: 0000000000000000 RBX: 00007fffd3470d00 RCX: 00007f2eb179e019 [ 33.468553][ T503] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 33.476688][ T503] RBP: 0000000000008186 R08: 0000000000000001 R09: 0000000000000000 [ 33.484668][ T503] R10: 0000001b33720000 R11: 0000000000000246 R12: 00007fffd3470d40 [ 33.492684][ T503] R13: 00007f2eb1a25fac R14: 00000000000081b9 R15: 00007f2eb1a25fa0 [ 33.500691][ T503] [ 33.503720][ T503] ---[ end trace 0000000000000000 ]--- [ 33.538644][ T533] ------------[ cut here ]------------ [ 33.544247][ T533] WARNING: CPU: 0 PID: 533 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 33.554305][ T533] Modules linked in: [ 33.558289][ T533] CPU: 0 PID: 533 Comm: syz.5.82 Tainted: G B W syzkaller #0 [ 33.566924][ T533] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 33.577008][ T533] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 33.583358][ T533] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 33.603015][ T533] RSP: 0018:ffffc9000109fcb0 EFLAGS: 00010293 [ 33.609125][ T533] RAX: ffffffff849bb307 RBX: ffff88811d0b0000 RCX: ffff88811cd99440 [ 33.617155][ T533] RDX: 0000000000000000 RSI: 00000000172034c0 RDI: 000000000c04eb7d [ 33.625163][ T533] RBP: ffffc9000109fcd0 R08: ffff88811d0b0083 R09: 1ffff11023a16010 [ 33.633146][ T533] R10: dffffc0000000000 R11: ffffed1023a16011 R12: dffffc0000000000 [ 33.641340][ T533] R13: dffffc0000000000 R14: 00000000172034c0 R15: ffff88812c4f2c00 [ 33.649539][ T533] FS: 00005555935ac500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 33.658521][ T533] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 33.665154][ T533] CR2: 0000200000000740 CR3: 000000012cee6000 CR4: 00000000003506b0 [ 33.673144][ T533] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 33.681166][ T533] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 33.689177][ T533] Call Trace: [ 33.692475][ T533] [ 33.695465][ T533] pppol2tp_release+0x150/0x2b0 [ 33.700338][ T533] sock_close+0xc9/0x220 [ 33.704609][ T533] ? __cfi_sock_close+0x10/0x10 [ 33.709519][ T533] __fput+0x1fd/0x8f0 [ 33.713523][ T533] ____fput+0x15/0x20 [ 33.717700][ T533] task_work_run+0x1e1/0x250 [ 33.722329][ T533] ? __cfi_task_work_run+0x10/0x10 [ 33.727561][ T533] ? __cfi___close_range+0x10/0x10 [ 33.732698][ T533] exit_to_user_mode_loop+0x9b/0xb0 [ 33.737945][ T533] exit_to_user_mode_prepare+0x87/0xd0 [ 33.743420][ T533] syscall_exit_to_user_mode+0x1a/0x30 [ 33.748935][ T533] do_syscall_64+0x58/0xa0 [ 33.753382][ T533] ? clear_bhb_loop+0x30/0x80 [ 33.758109][ T533] ? clear_bhb_loop+0x30/0x80 [ 33.762824][ T533] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 33.768821][ T533] RIP: 0033:0x7f2eb179e019 [ 33.773284][ T533] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 33.792954][ T533] RSP: 002b:00007fffd3470c18 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 33.801425][ T533] RAX: 0000000000000000 RBX: 00007fffd3470d00 RCX: 00007f2eb179e019 [ 33.809464][ T533] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 33.817463][ T533] RBP: 00000000000082f2 R08: 0000000000000001 R09: 0000000000000000 [ 33.825483][ T533] R10: 0000001b33720000 R11: 0000000000000246 R12: 00007fffd3470d40 [ 33.833463][ T533] R13: 00007f2eb1a25fac R14: 0000000000008325 R15: 00007f2eb1a25fa0 [ 33.841486][ T533] [ 33.844517][ T533] ---[ end trace 0000000000000000 ]--- [ 33.871936][ T561] ------------[ cut here ]------------ [ 33.877465][ T561] WARNING: CPU: 1 PID: 561 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 33.887538][ T561] Modules linked in: [ 33.891446][ T561] CPU: 1 PID: 561 Comm: syz.1.95 Tainted: G B W syzkaller #0 [ 33.900143][ T561] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 33.910260][ T561] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 33.916651][ T561] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 33.936297][ T561] RSP: 0018:ffffc9000125fcb0 EFLAGS: 00010293 [ 33.942382][ T561] RAX: ffffffff849bb307 RBX: ffff88811b3bd000 RCX: ffff88811d7a3cc0 [ 33.950416][ T561] RDX: 0000000000000000 RSI: 0000000017d22740 RDI: 000000000c04eb7d [ 33.958513][ T561] RBP: ffffc9000125fcd0 R08: ffff88811b3bd083 R09: 1ffff11023677a10 [ 33.966538][ T561] R10: dffffc0000000000 R11: ffffed1023677a11 R12: dffffc0000000000 [ 33.974521][ T561] R13: dffffc0000000000 R14: 0000000017d22740 R15: ffff88812c5b9400 [ 33.982523][ T561] FS: 000055558ad9b500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 33.991479][ T561] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 33.998118][ T561] CR2: 0000200000000740 CR3: 00000001328d2000 CR4: 00000000003506a0 [ 34.006146][ T561] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 34.014130][ T561] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 34.022141][ T561] Call Trace: [ 34.025459][ T561] [ 34.028407][ T561] pppol2tp_release+0x150/0x2b0 [ 34.033291][ T561] sock_close+0xc9/0x220 [ 34.037611][ T561] ? __cfi_sock_close+0x10/0x10 [ 34.042496][ T561] __fput+0x1fd/0x8f0 [ 34.046526][ T561] ____fput+0x15/0x20 [ 34.050533][ T561] task_work_run+0x1e1/0x250 [ 34.055171][ T561] ? __cfi_task_work_run+0x10/0x10 [ 34.060327][ T561] ? __cfi___close_range+0x10/0x10 [ 34.065493][ T561] exit_to_user_mode_loop+0x9b/0xb0 [ 34.070715][ T561] exit_to_user_mode_prepare+0x87/0xd0 [ 34.076217][ T561] syscall_exit_to_user_mode+0x1a/0x30 [ 34.081695][ T561] do_syscall_64+0x58/0xa0 [ 34.086150][ T561] ? clear_bhb_loop+0x30/0x80 [ 34.090841][ T561] ? clear_bhb_loop+0x30/0x80 [ 34.095549][ T561] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 34.101472][ T561] RIP: 0033:0x7fc4bc19e019 [ 34.105918][ T561] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.125582][ T561] RSP: 002b:00007ffc6172fc08 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 34.134013][ T561] RAX: 0000000000000000 RBX: 00007ffc6172fcf0 RCX: 00007fc4bc19e019 [ 34.142031][ T561] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 34.150042][ T561] RBP: 0000000000008440 R08: 0000000000000001 R09: 0000000000000000 [ 34.158080][ T561] R10: 0000001b33120000 R11: 0000000000000246 R12: 00007ffc6172fd30 [ 34.166085][ T561] R13: 00007fc4bc425fac R14: 0000000000008472 R15: 00007fc4bc425fa0 [ 34.174079][ T561] [ 34.177136][ T561] ---[ end trace 0000000000000000 ]--- [ 34.208525][ T594] ------------[ cut here ]------------ [ 34.214048][ T594] WARNING: CPU: 1 PID: 594 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 34.216629][ T595] ------------[ cut here ]------------ [ 34.224328][ T594] Modules linked in: [ 34.229693][ T595] WARNING: CPU: 0 PID: 595 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 34.233588][ T594] CPU: 1 PID: 594 Comm: syz.3.110 Tainted: G B W syzkaller #0 [ 34.243660][ T595] Modules linked in: [ 34.252389][ T594] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 34.252400][ T594] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 34.252425][ T594] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 34.252439][ T594] RSP: 0018:ffffc90001027cb0 EFLAGS: 00010293 [ 34.256408][ T595] [ 34.256415][ T595] CPU: 0 PID: 595 Comm: syz.1.112 Tainted: G B W syzkaller #0 [ 34.256433][ T595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 34.256443][ T595] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 34.266560][ T594] [ 34.266566][ T594] RAX: ffffffff849bb307 RBX: ffff88811e0a9000 RCX: ffff88811db5d100 [ 34.272875][ T595] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 34.292551][ T594] RDX: 0000000000000000 RSI: 00000000304693c0 RDI: 000000000c04eb7d [ 34.292566][ T594] RBP: ffffc90001027cd0 R08: ffff88811e0a9083 R09: 1ffff11023c15210 [ 34.292578][ T594] R10: dffffc0000000000 R11: ffffed1023c15211 R12: dffffc0000000000 [ 34.292591][ T594] R13: dffffc0000000000 R14: 00000000304693c0 R15: ffff88811d883000 [ 34.292604][ T594] FS: 000055556180a500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 34.292620][ T594] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 34.292632][ T594] CR2: 0000200000000740 CR3: 000000012def3000 CR4: 00000000003506a0 [ 34.292647][ T594] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 34.299118][ T595] RSP: 0018:ffffc9000130fcb0 EFLAGS: 00010293 [ 34.301162][ T594] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 34.309897][ T595] [ 34.309902][ T595] RAX: ffffffff849bb307 RBX: ffff88811e31f000 RCX: ffff88811dbebcc0 [ 34.309915][ T595] RDX: 0000000000000000 RSI: 000000002c879700 RDI: 000000000c04eb7d [ 34.309926][ T595] RBP: ffffc9000130fcd0 R08: ffff88811e31f083 R09: 1ffff11023c63e10 [ 34.309939][ T595] R10: dffffc0000000000 R11: ffffed1023c63e11 R12: dffffc0000000000 [ 34.320055][ T594] Call Trace: [ 34.320061][ T594] [ 34.326545][ T595] R13: dffffc0000000000 R14: 000000002c879700 R15: ffff88811e2d9800 [ 34.328715][ T594] pppol2tp_release+0x150/0x2b0 [ 34.336911][ T595] FS: 000055558ad9b500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 34.356335][ T594] sock_close+0xc9/0x220 [ 34.356362][ T594] ? __cfi_sock_close+0x10/0x10 [ 34.356386][ T594] __fput+0x1fd/0x8f0 [ 34.356409][ T594] ____fput+0x15/0x20 [ 34.356428][ T594] task_work_run+0x1e1/0x250 [ 34.356450][ T594] ? __cfi_task_work_run+0x10/0x10 [ 34.356471][ T594] ? __cfi___close_range+0x10/0x10 [ 34.356489][ T594] exit_to_user_mode_loop+0x9b/0xb0 [ 34.364464][ T595] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 34.372472][ T594] exit_to_user_mode_prepare+0x87/0xd0 [ 34.372491][ T594] syscall_exit_to_user_mode+0x1a/0x30 [ 34.372508][ T594] do_syscall_64+0x58/0xa0 [ 34.372528][ T594] ? clear_bhb_loop+0x30/0x80 [ 34.372543][ T594] ? clear_bhb_loop+0x30/0x80 [ 34.372559][ T594] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 34.380699][ T595] CR2: 00007f09ae427dac CR3: 000000011da9b000 CR4: 00000000003506b0 [ 34.388545][ T594] RIP: 0033:0x7f2595b9e019 [ 34.388564][ T594] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.388581][ T594] RSP: 002b:00007fff4c4d0328 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 34.388602][ T594] RAX: 0000000000000000 RBX: 00007fff4c4d0410 RCX: 00007f2595b9e019 [ 34.397730][ T595] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 34.404121][ T594] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 34.412250][ T595] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 34.420074][ T594] RBP: 0000000000008590 R08: 0000000000000001 R09: 0000000000000000 [ 34.420086][ T594] R10: 0000001b33520000 R11: 0000000000000246 R12: 00007fff4c4d0450 [ 34.420098][ T594] R13: 00007f2595e25fac R14: 00000000000085c3 R15: 00007f2595e25fa0 [ 34.420113][ T594] [ 34.420119][ T594] ---[ end trace 0000000000000000 ]--- [ 34.677921][ T595] Call Trace: [ 34.681229][ T595] [ 34.684177][ T595] pppol2tp_release+0x150/0x2b0 [ 34.689180][ T595] sock_close+0xc9/0x220 [ 34.693457][ T595] ? __cfi_sock_close+0x10/0x10 [ 34.698427][ T595] __fput+0x1fd/0x8f0 [ 34.702566][ T595] ____fput+0x15/0x20 [ 34.706672][ T595] task_work_run+0x1e1/0x250 [ 34.711313][ T595] ? __cfi_task_work_run+0x10/0x10 [ 34.716517][ T595] ? __cfi___close_range+0x10/0x10 [ 34.721643][ T595] exit_to_user_mode_loop+0x9b/0xb0 [ 34.726954][ T595] exit_to_user_mode_prepare+0x87/0xd0 [ 34.732429][ T595] syscall_exit_to_user_mode+0x1a/0x30 [ 34.737986][ T595] do_syscall_64+0x58/0xa0 [ 34.742424][ T595] ? clear_bhb_loop+0x30/0x80 [ 34.747210][ T595] ? clear_bhb_loop+0x30/0x80 [ 34.751905][ T595] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 34.758094][ T595] RIP: 0033:0x7fc4bc19e019 [ 34.762531][ T595] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.782303][ T595] RSP: 002b:00007ffc6172fc08 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 34.790834][ T595] RAX: 0000000000000000 RBX: 00007ffc6172fcf0 RCX: 00007fc4bc19e019 [ 34.798954][ T595] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 34.807084][ T595] RBP: 0000000000008590 R08: 0000000000000001 R09: 0000000000000000 [ 34.815139][ T595] R10: 0000001b33120000 R11: 0000000000000246 R12: 00007ffc6172fd30 [ 34.823240][ T595] R13: 00007fc4bc425fac R14: 00000000000085c3 R15: 00007fc4bc425fa0 [ 34.831334][ T595] [ 34.834365][ T595] ---[ end trace 0000000000000000 ]--- [ 34.859372][ T633] ------------[ cut here ]------------ [ 34.865037][ T633] WARNING: CPU: 0 PID: 633 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 34.875084][ T633] Modules linked in: [ 34.879003][ T633] CPU: 0 PID: 633 Comm: syz.0.129 Tainted: G B W syzkaller #0 [ 34.887750][ T633] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 34.897859][ T633] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 34.904227][ T633] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 34.923928][ T633] RSP: 0018:ffffc9000155fcb0 EFLAGS: 00010293 [ 34.930073][ T633] RAX: ffffffff849bb307 RBX: ffff88811e57c000 RCX: ffff88811eafe540 [ 34.938082][ T633] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000c04eb7d [ 34.946107][ T633] RBP: ffffc9000155fcd0 R08: ffff88811e57c083 R09: 1ffff11023caf810 [ 34.954107][ T633] R10: dffffc0000000000 R11: ffffed1023caf811 R12: dffffc0000000000 [ 34.962160][ T633] R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88811e36c400 [ 34.970175][ T633] FS: 0000555578bf8500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 34.979281][ T633] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 34.985912][ T633] CR2: 0000200000000740 CR3: 000000011f11f000 CR4: 00000000003506b0 [ 34.993900][ T633] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 35.002040][ T633] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 35.010106][ T633] Call Trace: [ 35.013409][ T633] [ 35.016381][ T633] pppol2tp_release+0x150/0x2b0 [ 35.021273][ T633] sock_close+0xc9/0x220 [ 35.025579][ T633] ? __cfi_sock_close+0x10/0x10 [ 35.030464][ T633] __fput+0x1fd/0x8f0 [ 35.034485][ T633] ____fput+0x15/0x20 [ 35.038545][ T633] task_work_run+0x1e1/0x250 [ 35.043166][ T633] ? __cfi_task_work_run+0x10/0x10 [ 35.048354][ T633] ? __cfi___close_range+0x10/0x10 [ 35.053499][ T633] exit_to_user_mode_loop+0x9b/0xb0 [ 35.058759][ T633] exit_to_user_mode_prepare+0x87/0xd0 [ 35.064255][ T633] syscall_exit_to_user_mode+0x1a/0x30 [ 35.069790][ T633] do_syscall_64+0x58/0xa0 [ 35.074235][ T633] ? clear_bhb_loop+0x30/0x80 [ 35.078986][ T633] ? clear_bhb_loop+0x30/0x80 [ 35.083691][ T633] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 35.089644][ T633] RIP: 0033:0x7f3b8599e019 [ 35.094076][ T633] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.113727][ T633] RSP: 002b:00007ffffdbbf808 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 35.122181][ T633] RAX: 0000000000000000 RBX: 00007ffffdbbf8f0 RCX: 00007f3b8599e019 [ 35.130227][ T633] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 35.138274][ T633] RBP: 00000000000087fd R08: 0000000000000001 R09: 0000000000000000 [ 35.146299][ T633] R10: 0000001b33020000 R11: 0000000000000246 R12: 00007ffffdbbf930 [ 35.154287][ T633] R13: 00007f3b85c25fac R14: 000000000000884e R15: 00007f3b85c25fa0 [ 35.162332][ T633] [ 35.165418][ T633] ---[ end trace 0000000000000000 ]--- [ 35.191492][ T664] ------------[ cut here ]------------ [ 35.197060][ T664] WARNING: CPU: 1 PID: 664 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 35.207169][ T664] Modules linked in: [ 35.211083][ T664] CPU: 1 PID: 664 Comm: syz.3.145 Tainted: G B W syzkaller #0 [ 35.219852][ T664] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 35.230102][ T664] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 35.236547][ T664] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 35.256488][ T664] RSP: 0018:ffffc90001627cb0 EFLAGS: 00010293 [ 35.257950][ T669] ------------[ cut here ]------------ [ 35.262578][ T664] RAX: ffffffff849bb307 RBX: ffff888120984000 RCX: ffff88810f40d100 [ 35.262594][ T664] RDX: 0000000000000000 RSI: 00000000303e4bc0 RDI: 000000000c04eb7d [ 35.262606][ T664] RBP: ffffc90001627cd0 R08: ffff888120984083 R09: 1ffff11024130810 [ 35.268118][ T669] WARNING: CPU: 0 PID: 669 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 35.268152][ T669] Modules linked in: [ 35.268161][ T669] CPU: 0 PID: 669 Comm: syz.6.149 Tainted: G B W syzkaller #0 [ 35.268197][ T669] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 35.268208][ T669] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 35.268240][ T669] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 35.268257][ T669] RSP: 0018:ffffc90001637cb0 EFLAGS: 00010293 [ 35.268273][ T669] RAX: ffffffff849bb307 RBX: ffff88812081d000 RCX: ffff888117e5d100 [ 35.268288][ T669] RDX: 0000000000000000 RSI: 00000000201ae000 RDI: 000000000c04eb7d [ 35.268301][ T669] RBP: ffffc90001637cd0 R08: ffff88812081d083 R09: 1ffff11024103a10 [ 35.268316][ T669] R10: dffffc0000000000 R11: ffffed1024103a11 R12: dffffc0000000000 [ 35.268330][ T669] R13: dffffc0000000000 R14: 00000000201ae000 R15: ffff888120a41400 [ 35.268345][ T669] FS: 0000555576296500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 35.268363][ T669] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 35.276513][ T664] R10: dffffc0000000000 R11: ffffed1024130811 R12: dffffc0000000000 [ 35.284346][ T669] CR2: 0000200000000740 CR3: 0000000120390000 CR4: 00000000003506b0 [ 35.292494][ T664] R13: dffffc0000000000 R14: 00000000303e4bc0 R15: ffff8881201ae000 [ 35.302316][ T669] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 35.302328][ T669] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 35.302340][ T669] Call Trace: [ 35.302345][ T669] [ 35.302351][ T669] pppol2tp_release+0x150/0x2b0 [ 35.306414][ T664] FS: 000055556180a500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 35.314905][ T669] sock_close+0xc9/0x220 [ 35.325944][ T664] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 35.331299][ T669] ? __cfi_sock_close+0x10/0x10 [ 35.351662][ T664] CR2: 0000200000000740 CR3: 000000011d93e000 CR4: 00000000003506a0 [ 35.357020][ T669] __fput+0x1fd/0x8f0 [ 35.357048][ T669] ____fput+0x15/0x20 [ 35.365224][ T664] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 35.372998][ T669] task_work_run+0x1e1/0x250 [ 35.381129][ T664] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 35.388983][ T669] ? __cfi_task_work_run+0x10/0x10 [ 35.389011][ T669] ? __cfi___close_range+0x10/0x10 [ 35.389032][ T669] exit_to_user_mode_loop+0x9b/0xb0 [ 35.397164][ T664] Call Trace: [ 35.397170][ T664] [ 35.397176][ T664] pppol2tp_release+0x150/0x2b0 [ 35.397198][ T664] sock_close+0xc9/0x220 [ 35.397222][ T664] ? __cfi_sock_close+0x10/0x10 [ 35.397246][ T664] __fput+0x1fd/0x8f0 [ 35.406272][ T669] exit_to_user_mode_prepare+0x87/0xd0 [ 35.406295][ T669] syscall_exit_to_user_mode+0x1a/0x30 [ 35.412883][ T664] ____fput+0x15/0x20 [ 35.420864][ T669] do_syscall_64+0x58/0xa0 [ 35.420885][ T669] ? clear_bhb_loop+0x30/0x80 [ 35.420901][ T669] ? clear_bhb_loop+0x30/0x80 [ 35.420917][ T669] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 35.420942][ T669] RIP: 0033:0x7f09ae19e019 [ 35.429108][ T664] task_work_run+0x1e1/0x250 [ 35.436922][ T669] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.436938][ T669] RSP: 002b:00007ffc20291f28 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 35.436957][ T669] RAX: 0000000000000000 RBX: 00007ffc20292010 RCX: 00007f09ae19e019 [ 35.444919][ T664] ? __cfi_task_work_run+0x10/0x10 [ 35.452977][ T669] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 35.456366][ T664] ? __cfi___close_range+0x10/0x10 [ 35.459119][ T669] RBP: 0000000000008965 R08: 0000000000000001 R09: 0000000000000000 [ 35.463963][ T664] exit_to_user_mode_loop+0x9b/0xb0 [ 35.472897][ T669] R10: 0000001b33220000 R11: 0000000000000246 R12: 00007ffc20292050 [ 35.472913][ T669] R13: 00007f09ae425fac R14: 000000000000899a R15: 00007f09ae425fa0 [ 35.472928][ T669] [ 35.472934][ T669] ---[ end trace 0000000000000000 ]--- [ 35.703223][ T664] exit_to_user_mode_prepare+0x87/0xd0 [ 35.708834][ T664] syscall_exit_to_user_mode+0x1a/0x30 [ 35.714329][ T664] do_syscall_64+0x58/0xa0 [ 35.718860][ T664] ? clear_bhb_loop+0x30/0x80 [ 35.723563][ T664] ? clear_bhb_loop+0x30/0x80 [ 35.728367][ T664] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 35.734295][ T664] RIP: 0033:0x7f2595b9e019 [ 35.738857][ T664] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.758588][ T664] RSP: 002b:00007fff4c4d0328 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 35.767107][ T664] RAX: 0000000000000000 RBX: 00007fff4c4d0410 RCX: 00007f2595b9e019 [ 35.775174][ T664] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 35.783166][ T664] RBP: 000000000000895f R08: 0000000000000001 R09: 0000000000000000 [ 35.791233][ T664] R10: 0000001b33520000 R11: 0000000000000246 R12: 00007fff4c4d0450 [ 35.799475][ T664] R13: 00007f2595e25fac R14: 0000000000008999 R15: 00007f2595e25fa0 [ 35.807729][ T664] [ 35.810767][ T664] ---[ end trace 0000000000000000 ]--- [ 35.833751][ T701] ------------[ cut here ]------------ [ 35.839457][ T701] WARNING: CPU: 1 PID: 701 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 35.849561][ T701] Modules linked in: [ 35.853463][ T701] CPU: 1 PID: 701 Comm: syz.6.164 Tainted: G B W syzkaller #0 [ 35.862236][ T701] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 35.872467][ T701] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 35.879053][ T701] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 35.898750][ T701] RSP: 0018:ffffc9000152fcb0 EFLAGS: 00010293 [ 35.904844][ T701] RAX: ffffffff849bb307 RBX: ffff88810b887000 RCX: ffff88811b2c9440 [ 35.912853][ T701] RDX: 0000000000000000 RSI: 000000001cb2fd40 RDI: 000000000c04eb7d [ 35.920880][ T701] RBP: ffffc9000152fcd0 R08: ffff88810b887083 R09: 1ffff11021710e10 [ 35.928932][ T701] R10: dffffc0000000000 R11: ffffed1021710e11 R12: dffffc0000000000 [ 35.936942][ T701] R13: dffffc0000000000 R14: 000000001cb2fd40 R15: ffff88812019c000 [ 35.944925][ T701] FS: 0000555576296500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 35.953925][ T701] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 35.960587][ T701] CR2: 0000200000000740 CR3: 000000012de90000 CR4: 00000000003506a0 [ 35.968609][ T701] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 35.976628][ T701] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 35.984617][ T701] Call Trace: [ 35.987938][ T701] [ 35.990894][ T701] pppol2tp_release+0x150/0x2b0 [ 35.995805][ T701] sock_close+0xc9/0x220 [ 36.000067][ T701] ? __cfi_sock_close+0x10/0x10 [ 36.004944][ T701] __fput+0x1fd/0x8f0 [ 36.008993][ T701] ____fput+0x15/0x20 [ 36.013009][ T701] task_work_run+0x1e1/0x250 [ 36.017650][ T701] ? __cfi_task_work_run+0x10/0x10 [ 36.022786][ T701] ? __cfi___close_range+0x10/0x10 [ 36.027946][ T701] exit_to_user_mode_loop+0x9b/0xb0 [ 36.033159][ T701] exit_to_user_mode_prepare+0x87/0xd0 [ 36.038686][ T701] syscall_exit_to_user_mode+0x1a/0x30 [ 36.044189][ T701] do_syscall_64+0x58/0xa0 [ 36.048651][ T701] ? clear_bhb_loop+0x30/0x80 [ 36.053362][ T701] ? clear_bhb_loop+0x30/0x80 [ 36.058081][ T701] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 36.063996][ T701] RIP: 0033:0x7f09ae19e019 [ 36.068440][ T701] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 36.088094][ T701] RSP: 002b:00007ffc20291f28 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 36.096556][ T701] RAX: 0000000000000000 RBX: 00007ffc20292010 RCX: 00007f09ae19e019 [ 36.104545][ T701] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 36.112558][ T701] RBP: 0000000000008be9 R08: 0000000000000001 R09: 0000000000000000 [ 36.120635][ T701] R10: 0000001b33220000 R11: 0000000000000246 R12: 00007ffc20292050 [ 36.128685][ T701] R13: 00007f09ae425fac R14: 0000000000008c1c R15: 00007f09ae425fa0 [ 36.136812][ T701] [ 36.139843][ T701] ---[ end trace 0000000000000000 ]--- [ 36.164011][ T731] ------------[ cut here ]------------ [ 36.169578][ T731] WARNING: CPU: 0 PID: 731 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 36.179693][ T731] Modules linked in: [ 36.183601][ T731] CPU: 0 PID: 731 Comm: syz.6.176 Tainted: G B W syzkaller #0 [ 36.192398][ T731] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 36.202825][ T731] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 36.209645][ T731] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 36.229405][ T731] RSP: 0018:ffffc90001a8fcb0 EFLAGS: 00010293 [ 36.235591][ T731] RAX: ffffffff849bb307 RBX: ffff88812e297000 RCX: ffff88810e580000 [ 36.243646][ T731] RDX: 0000000000000000 RSI: 000000001cb94a40 RDI: 000000000c04eb7d [ 36.251673][ T731] RBP: ffffc90001a8fcd0 R08: ffff88812e297083 R09: 1ffff11025c52e10 [ 36.259696][ T731] R10: dffffc0000000000 R11: ffffed1025c52e11 R12: dffffc0000000000 [ 36.267721][ T731] R13: dffffc0000000000 R14: 000000001cb94a40 R15: ffff888109719c00 [ 36.275866][ T731] FS: 0000555576296500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 36.284813][ T731] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.291453][ T731] CR2: 0000200000000740 CR3: 000000012de93000 CR4: 00000000003506b0 [ 36.299475][ T731] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 36.307489][ T731] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 36.315498][ T731] Call Trace: [ 36.318792][ T731] [ 36.321742][ T731] pppol2tp_release+0x150/0x2b0 [ 36.326642][ T731] sock_close+0xc9/0x220 [ 36.330914][ T731] ? __cfi_sock_close+0x10/0x10 [ 36.335825][ T731] __fput+0x1fd/0x8f0 [ 36.339834][ T731] ____fput+0x15/0x20 [ 36.343838][ T731] task_work_run+0x1e1/0x250 [ 36.348504][ T731] ? __cfi_task_work_run+0x10/0x10 [ 36.353651][ T731] ? __cfi___close_range+0x10/0x10 [ 36.359303][ T731] exit_to_user_mode_loop+0x9b/0xb0 [ 36.364550][ T731] exit_to_user_mode_prepare+0x87/0xd0 [ 36.370283][ T731] syscall_exit_to_user_mode+0x1a/0x30 [ 36.375808][ T731] do_syscall_64+0x58/0xa0 [ 36.380243][ T731] ? clear_bhb_loop+0x30/0x80 [ 36.384952][ T731] ? clear_bhb_loop+0x30/0x80 [ 36.389689][ T731] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 36.395630][ T731] RIP: 0033:0x7f09ae19e019 [ 36.400058][ T731] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 36.419707][ T731] RSP: 002b:00007ffc20291f28 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 36.428191][ T731] RAX: 0000000000000000 RBX: 00007ffc20292010 RCX: 00007f09ae19e019 [ 36.436552][ T731] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 36.444553][ T731] RBP: 0000000000008d34 R08: 0000000000000001 R09: 0000000000000000 [ 36.452643][ T731] R10: 0000001b33220000 R11: 0000000000000246 R12: 00007ffc20292050 [ 36.460663][ T731] R13: 00007f09ae425fac R14: 0000000000008d66 R15: 00007f09ae425fa0 [ 36.468679][ T731] [ 36.471713][ T731] ---[ end trace 0000000000000000 ]--- [ 36.491983][ T762] ------------[ cut here ]------------ [ 36.497484][ T762] WARNING: CPU: 0 PID: 762 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 36.507507][ T762] Modules linked in: [ 36.511403][ T762] CPU: 0 PID: 762 Comm: syz.5.193 Tainted: G B W syzkaller #0 [ 36.520377][ T762] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 36.530593][ T762] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 36.536960][ T762] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 36.556609][ T762] RSP: 0018:ffffc90001ab7cb0 EFLAGS: 00010293 [ 36.562686][ T762] RAX: ffffffff849bb307 RBX: ffff88812ffe5000 RCX: ffff88810df98000 [ 36.570690][ T762] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000c04eb7d [ 36.578696][ T762] RBP: ffffc90001ab7cd0 R08: ffff88812ffe5083 R09: 1ffff11025ffca10 [ 36.586718][ T762] R10: dffffc0000000000 R11: ffffed1025ffca11 R12: dffffc0000000000 [ 36.594705][ T762] R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88810e13a000 [ 36.602990][ T762] FS: 00005555935ac500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 36.612280][ T762] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.618938][ T762] CR2: 0000200000000740 CR3: 0000000120c6f000 CR4: 00000000003506b0 [ 36.626952][ T762] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 36.634929][ T762] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 36.642953][ T762] Call Trace: [ 36.646262][ T762] [ 36.649208][ T762] pppol2tp_release+0x150/0x2b0 [ 36.654096][ T762] sock_close+0xc9/0x220 [ 36.658437][ T762] ? __cfi_sock_close+0x10/0x10 [ 36.663318][ T762] __fput+0x1fd/0x8f0 [ 36.667355][ T762] ____fput+0x15/0x20 [ 36.671354][ T762] task_work_run+0x1e1/0x250 [ 36.676320][ T762] ? __cfi_task_work_run+0x10/0x10 [ 36.681461][ T762] ? __cfi___close_range+0x10/0x10 [ 36.686875][ T762] exit_to_user_mode_loop+0x9b/0xb0 [ 36.692097][ T762] exit_to_user_mode_prepare+0x87/0xd0 [ 36.697609][ T762] syscall_exit_to_user_mode+0x1a/0x30 [ 36.703081][ T762] do_syscall_64+0x58/0xa0 [ 36.707562][ T762] ? clear_bhb_loop+0x30/0x80 [ 36.712256][ T762] ? clear_bhb_loop+0x30/0x80 [ 36.716995][ T762] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 36.723007][ T762] RIP: 0033:0x7f2eb179e019 [ 36.727461][ T762] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 36.747115][ T762] RSP: 002b:00007fffd3470c18 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 36.755786][ T762] RAX: 0000000000000000 RBX: 00007fffd3470d00 RCX: 00007f2eb179e019 [ 36.763781][ T762] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 36.771847][ T762] RBP: 0000000000008e7a R08: 0000000000000001 R09: 0000000000000000 [ 36.779862][ T762] R10: 0000001b33720000 R11: 0000000000000246 R12: 00007fffd3470d40 [ 36.787864][ T762] R13: 00007f2eb1a25fac R14: 0000000000008eae R15: 00007f2eb1a25fa0 [ 36.795882][ T762] [ 36.798918][ T762] ---[ end trace 0000000000000000 ]--- [ 36.815294][ T791] ------------[ cut here ]------------ [ 36.820861][ T791] WARNING: CPU: 0 PID: 791 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 36.831018][ T791] Modules linked in: [ 36.835060][ T791] CPU: 0 PID: 791 Comm: syz.5.207 Tainted: G B W syzkaller #0 [ 36.843749][ T791] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 36.854263][ T791] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 36.860791][ T791] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 36.880443][ T791] RSP: 0018:ffffc90001c27cb0 EFLAGS: 00010293 [ 36.886548][ T791] RAX: ffffffff849bb307 RBX: ffff88810e90e000 RCX: ffff888111e08000 [ 36.894540][ T791] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000c04eb7d [ 36.902569][ T791] RBP: ffffc90001c27cd0 R08: ffff88810e90e083 R09: 1ffff11021d21c10 [ 36.910585][ T791] R10: dffffc0000000000 R11: ffffed1021d21c11 R12: dffffc0000000000 [ 36.918626][ T791] R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881202bac00 [ 36.926674][ T791] FS: 00005555935ac500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 36.935633][ T791] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.942223][ T791] CR2: 0000200000000740 CR3: 000000012d0a4000 CR4: 00000000003506b0 [ 36.950241][ T791] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 36.958261][ T791] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 36.966287][ T791] Call Trace: [ 36.969580][ T791] [ 36.972518][ T791] pppol2tp_release+0x150/0x2b0 [ 36.977419][ T791] sock_close+0xc9/0x220 [ 36.981680][ T791] ? __cfi_sock_close+0x10/0x10 [ 36.986579][ T791] __fput+0x1fd/0x8f0 [ 36.990576][ T791] ____fput+0x15/0x20 [ 36.994576][ T791] task_work_run+0x1e1/0x250 [ 36.999230][ T791] ? __cfi_task_work_run+0x10/0x10 [ 37.004376][ T791] ? __cfi___close_range+0x10/0x10 [ 37.009533][ T791] exit_to_user_mode_loop+0x9b/0xb0 [ 37.014747][ T791] exit_to_user_mode_prepare+0x87/0xd0 [ 37.020251][ T791] syscall_exit_to_user_mode+0x1a/0x30 [ 37.025750][ T791] do_syscall_64+0x58/0xa0 [ 37.030183][ T791] ? clear_bhb_loop+0x30/0x80 [ 37.034873][ T791] ? clear_bhb_loop+0x30/0x80 [ 37.039597][ T791] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 37.045530][ T791] RIP: 0033:0x7f2eb179e019 [ 37.049981][ T791] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 37.069681][ T791] RSP: 002b:00007fffd3470c18 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 37.078132][ T791] RAX: 0000000000000000 RBX: 00007fffd3470d00 RCX: 00007f2eb179e019 [ 37.086169][ T791] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 37.094158][ T791] RBP: 0000000000008fbf R08: 0000000000000001 R09: 0000000000000000 [ 37.102189][ T791] R10: 0000001b33720000 R11: 0000000000000246 R12: 00007fffd3470d40 [ 37.110207][ T791] R13: 00007f2eb1a25fac R14: 0000000000008ff1 R15: 00007f2eb1a25fa0 [ 37.118257][ T791] [ 37.121295][ T791] ---[ end trace 0000000000000000 ]--- [ 37.162386][ T821] ------------[ cut here ]------------ [ 37.168140][ T821] WARNING: CPU: 1 PID: 821 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 37.178421][ T821] Modules linked in: [ 37.182429][ T821] CPU: 1 PID: 821 Comm: syz.3.219 Tainted: G B W syzkaller #0 [ 37.182587][ T825] ------------[ cut here ]------------ [ 37.191257][ T821] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 37.196666][ T825] WARNING: CPU: 0 PID: 825 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 37.196700][ T825] Modules linked in: [ 37.196710][ T825] CPU: 0 PID: 825 Comm: syz.1.220 Tainted: G B W syzkaller #0 [ 37.196727][ T825] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 37.196737][ T825] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 37.196760][ T825] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 37.207200][ T821] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 37.216823][ T825] RSP: 0018:ffffc90001dffcb0 EFLAGS: 00010293 [ 37.216843][ T825] RAX: ffffffff849bb307 RBX: ffff888110d0a000 RCX: ffff888133462880 [ 37.220723][ T821] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 37.229419][ T825] RDX: 0000000000000000 RSI: 000000002bdb7af0 RDI: 000000000c04eb7d [ 37.229452][ T825] RBP: ffffc90001dffcd0 R08: ffff888110d0a083 R09: 1ffff110221a1410 [ 37.229466][ T825] R10: dffffc0000000000 R11: ffffed10221a1411 R12: dffffc0000000000 [ 37.239802][ T821] RSP: 0018:ffffc90001e6fcb0 EFLAGS: 00010293 [ 37.246003][ T825] R13: dffffc0000000000 R14: 000000002bdb7af0 R15: ffff8881336ef800 [ 37.246018][ T825] FS: 000055558ad9b500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 37.265876][ T821] [ 37.272041][ T825] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.278247][ T821] RAX: ffffffff849bb307 RBX: ffff888133989000 RCX: ffff888133463cc0 [ 37.286091][ T825] CR2: 0000200000000740 CR3: 000000012191c000 CR4: 00000000003506b0 [ 37.305702][ T821] RDX: 0000000000000000 RSI: 000000001cb16600 RDI: 000000000c04eb7d [ 37.313663][ T825] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 37.322007][ T821] RBP: ffffc90001e6fcd0 R08: ffff888133989083 R09: 1ffff11026731210 [ 37.329615][ T825] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 37.329629][ T825] Call Trace: [ 37.329633][ T825] [ 37.329639][ T825] pppol2tp_release+0x150/0x2b0 [ 37.329664][ T825] sock_close+0xc9/0x220 [ 37.329689][ T825] ? __cfi_sock_close+0x10/0x10 [ 37.335758][ T821] R10: dffffc0000000000 R11: ffffed1026731211 R12: dffffc0000000000 [ 37.335773][ T821] R13: dffffc0000000000 R14: 000000001cb16600 R15: ffff888133704400 [ 37.343729][ T825] __fput+0x1fd/0x8f0 [ 37.352666][ T821] FS: 000055556180a500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 37.355035][ T825] ____fput+0x15/0x20 [ 37.361610][ T821] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.369587][ T825] task_work_run+0x1e1/0x250 [ 37.377570][ T821] CR2: 0000200000000740 CR3: 000000011e98b000 CR4: 00000000003506a0 [ 37.385551][ T825] ? __cfi_task_work_run+0x10/0x10 [ 37.393517][ T821] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 37.401502][ T825] ? __cfi___close_range+0x10/0x10 [ 37.401525][ T825] exit_to_user_mode_loop+0x9b/0xb0 [ 37.401546][ T825] exit_to_user_mode_prepare+0x87/0xd0 [ 37.401566][ T825] syscall_exit_to_user_mode+0x1a/0x30 [ 37.401584][ T825] do_syscall_64+0x58/0xa0 [ 37.401616][ T825] ? clear_bhb_loop+0x30/0x80 [ 37.401632][ T825] ? clear_bhb_loop+0x30/0x80 [ 37.401647][ T825] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 37.409806][ T821] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 37.412920][ T825] RIP: 0033:0x7fc4bc19e019 [ 37.415880][ T821] Call Trace: [ 37.415886][ T821] [ 37.420718][ T825] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 37.424958][ T821] pppol2tp_release+0x150/0x2b0 [ 37.429834][ T825] RSP: 002b:00007ffc6172fc08 EFLAGS: 00000246 [ 37.437902][ T821] sock_close+0xc9/0x220 [ 37.445866][ T825] ORIG_RAX: 00000000000001b4 [ 37.449847][ T821] ? __cfi_sock_close+0x10/0x10 [ 37.458789][ T825] RAX: 0000000000000000 RBX: 00007ffc6172fcf0 RCX: 00007fc4bc19e019 [ 37.462761][ T821] __fput+0x1fd/0x8f0 [ 37.469370][ T825] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 37.473965][ T821] ____fput+0x15/0x20 [ 37.482151][ T825] RBP: 0000000000009118 R08: 0000000000000001 R09: 0000000000000000 [ 37.487335][ T821] task_work_run+0x1e1/0x250 [ 37.495320][ T825] R10: 0000001b33120000 R11: 0000000000000246 R12: 00007ffc6172fd30 [ 37.495333][ T825] R13: 00007fc4bc425fac R14: 000000000000914b R15: 00007fc4bc425fa0 [ 37.500440][ T821] ? __cfi_task_work_run+0x10/0x10 [ 37.505648][ T825] [ 37.511087][ T821] ? __cfi___close_range+0x10/0x10 [ 37.516578][ T825] ---[ end trace 0000000000000000 ]--- [ 37.520978][ T821] exit_to_user_mode_loop+0x9b/0xb0 [ 37.526479][ T828] ------------[ cut here ]------------ [ 37.530344][ T821] exit_to_user_mode_prepare+0x87/0xd0 [ 37.536242][ T828] WARNING: CPU: 0 PID: 828 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 37.544202][ T821] syscall_exit_to_user_mode+0x1a/0x30 [ 37.548639][ T828] Modules linked in: [ 37.551900][ T821] do_syscall_64+0x58/0xa0 [ 37.554828][ T828] [ 37.554835][ T828] CPU: 0 PID: 828 Comm: syz.6.221 Tainted: G B W syzkaller #0 [ 37.574801][ T821] ? clear_bhb_loop+0x30/0x80 [ 37.579573][ T828] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 37.579584][ T828] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 37.579608][ T828] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 37.579623][ T828] RSP: 0018:ffffc90001c27cb0 EFLAGS: 00010293 [ 37.585694][ T821] ? clear_bhb_loop+0x30/0x80 [ 37.589924][ T828] RAX: ffffffff849bb307 RBX: ffff888110d0c000 RCX: ffff888132636540 [ 37.594597][ T821] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 37.599447][ T828] RDX: 0000000000000000 RSI: 0000000033704400 RDI: 000000000c04eb7d [ 37.607422][ T821] RIP: 0033:0x7f2595b9e019 [ 37.611392][ T828] RBP: ffffc90001c27cd0 R08: ffff888110d0c083 R09: 1ffff110221a1810 [ 37.619381][ T821] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 37.623365][ T828] R10: dffffc0000000000 R11: ffffed10221a1811 R12: dffffc0000000000 [ 37.631351][ T821] RSP: 002b:00007fff4c4d0328 EFLAGS: 00000246 [ 37.635955][ T828] R13: dffffc0000000000 R14: 0000000033704400 R15: ffff8881336ee000 [ 37.635970][ T828] FS: 0000555576296500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 37.635986][ T828] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.635998][ T828] CR2: 0000200000000740 CR3: 000000010fe5b000 CR4: 00000000003506b0 [ 37.636012][ T828] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 37.636022][ T828] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 37.636038][ T828] Call Trace: [ 37.636043][ T828] [ 37.636050][ T828] pppol2tp_release+0x150/0x2b0 [ 37.636071][ T828] sock_close+0xc9/0x220 [ 37.636095][ T828] ? __cfi_sock_close+0x10/0x10 [ 37.636120][ T828] __fput+0x1fd/0x8f0 [ 37.644082][ T821] ORIG_RAX: 00000000000001b4 [ 37.652063][ T828] ____fput+0x15/0x20 [ 37.657201][ T821] RAX: 0000000000000000 RBX: 00007fff4c4d0410 RCX: 00007f2595b9e019 [ 37.660221][ T828] task_work_run+0x1e1/0x250 [ 37.665346][ T821] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 37.670796][ T828] ? __cfi_task_work_run+0x10/0x10 [ 37.675997][ T821] RBP: 0000000000009112 R08: 0000000000000001 R09: 0000000000000000 [ 37.681456][ T828] ? __cfi___close_range+0x10/0x10 [ 37.686980][ T821] R10: 0000001b33520000 R11: 0000000000000246 R12: 00007fff4c4d0450 [ 37.697039][ T828] exit_to_user_mode_loop+0x9b/0xb0 [ 37.702395][ T821] R13: 00007f2595e25fac R14: 000000000000914b R15: 00007f2595e25fa0 [ 37.706309][ T828] exit_to_user_mode_prepare+0x87/0xd0 [ 37.710719][ T821] [ 37.713038][ T828] syscall_exit_to_user_mode+0x1a/0x30 [ 37.722086][ T821] ---[ end trace 0000000000000000 ]--- [ 37.726407][ T828] do_syscall_64+0x58/0xa0 [ 37.726429][ T828] ? clear_bhb_loop+0x30/0x80 [ 37.726443][ T828] ? clear_bhb_loop+0x30/0x80 [ 37.726459][ T828] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 37.726481][ T828] RIP: 0033:0x7f09ae19e019 [ 37.726496][ T828] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 38.044081][ T828] RSP: 002b:00007ffc20291f28 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 38.052526][ T828] RAX: 0000000000000000 RBX: 00007ffc20292010 RCX: 00007f09ae19e019 [ 38.060520][ T828] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 38.068520][ T828] RBP: 000000000000911a R08: 0000000000000001 R09: 0000000000000000 [ 38.076526][ T828] R10: 0000001b33220000 R11: 0000000000000246 R12: 00007ffc20292050 [ 38.084486][ T828] R13: 00007f09ae425fac R14: 000000000000914d R15: 00007f09ae425fa0 [ 38.092484][ T828] [ 38.095523][ T828] ---[ end trace 0000000000000000 ]--- [ 38.133908][ T839] ------------[ cut here ]------------ [ 38.139533][ T839] WARNING: CPU: 1 PID: 839 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 38.149573][ T839] Modules linked in: [ 38.153474][ T839] CPU: 1 PID: 839 Comm: syz.0.229 Tainted: G B W syzkaller #0 [ 38.162181][ T839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 38.172266][ T839] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 38.178645][ T839] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 38.198415][ T839] RSP: 0018:ffffc90001f7fcb0 EFLAGS: 00010293 [ 38.204510][ T839] RAX: ffffffff849bb307 RBX: ffff888110c59000 RCX: ffff88812ed20000 [ 38.212532][ T839] RDX: 0000000000000000 RSI: 000000002fa63800 RDI: 000000000c04eb7d [ 38.220551][ T839] RBP: ffffc90001f7fcd0 R08: ffff888110c59083 R09: 1ffff1102218b210 2026/08/04 08:57:12 executed programs: 220 [ 38.228570][ T839] R10: dffffc0000000000 R11: ffffed102218b211 R12: dffffc0000000000 [ 38.236611][ T839] R13: dffffc0000000000 R14: 000000002fa63800 R15: ffff88812fc2a000 [ 38.244601][ T839] FS: 0000555578bf8500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 38.253564][ T839] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 38.260185][ T839] CR2: 00007fc4bcfabff8 CR3: 0000000112206000 CR4: 00000000003506a0 [ 38.268239][ T839] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 38.276333][ T839] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 38.284320][ T839] Call Trace: [ 38.287695][ T839] [ 38.290646][ T839] pppol2tp_release+0x150/0x2b0 [ 38.295547][ T839] sock_close+0xc9/0x220 [ 38.299806][ T839] ? __cfi_sock_close+0x10/0x10 [ 38.304682][ T839] __fput+0x1fd/0x8f0 [ 38.308717][ T839] ____fput+0x15/0x20 [ 38.312729][ T839] task_work_run+0x1e1/0x250 [ 38.317368][ T839] ? __cfi_task_work_run+0x10/0x10 [ 38.322520][ T839] ? __cfi___close_range+0x10/0x10 [ 38.327671][ T839] exit_to_user_mode_loop+0x9b/0xb0 [ 38.332884][ T839] exit_to_user_mode_prepare+0x87/0xd0 [ 38.338489][ T839] syscall_exit_to_user_mode+0x1a/0x30 [ 38.343968][ T839] do_syscall_64+0x58/0xa0 [ 38.348440][ T839] ? clear_bhb_loop+0x30/0x80 [ 38.353138][ T839] ? clear_bhb_loop+0x30/0x80 [ 38.357876][ T839] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 38.363790][ T839] RIP: 0033:0x7f3b8599e019 [ 38.368255][ T839] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 38.387923][ T839] RSP: 002b:00007ffffdbbf808 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 38.396372][ T839] RAX: 0000000000000000 RBX: 00007ffffdbbf8f0 RCX: 00007f3b8599e019 [ 38.404358][ T839] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 38.412442][ T839] RBP: 00000000000094d0 R08: 0000000000000001 R09: 0000000000000000 [ 38.420440][ T839] R10: 0000001b33020000 R11: 0000000000000246 R12: 00007ffffdbbf930 [ 38.428543][ T839] R13: 00007f3b85c25fac R14: 000000000000950c R15: 00007f3b85c25fa0 [ 38.436555][ T839] [ 38.439585][ T839] ---[ end trace 0000000000000000 ]--- [ 38.463470][ T878] ------------[ cut here ]------------ [ 38.469098][ T878] WARNING: CPU: 0 PID: 878 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 38.479281][ T878] Modules linked in: [ 38.483197][ T878] CPU: 0 PID: 878 Comm: syz.3.248 Tainted: G B W syzkaller #0 [ 38.492113][ T878] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 38.498378][ T875] ------------[ cut here ]------------ [ 38.502303][ T878] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 38.507764][ T875] WARNING: CPU: 1 PID: 875 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 38.513986][ T878] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 38.523956][ T875] Modules linked in: [ 38.543556][ T878] RSP: 0018:ffffc9000217fcb0 EFLAGS: 00010293 [ 38.543563][ T875] [ 38.543569][ T878] [ 38.543573][ T878] RAX: ffffffff849bb307 RBX: ffff8881338e3000 RCX: ffff888113e2bcc0 [ 38.547462][ T875] CPU: 1 PID: 875 Comm: syz.6.247 Tainted: G B W syzkaller #0 [ 38.553514][ T878] RDX: 0000000000000000 RSI: 000000002ceecd00 RDI: 000000000c04eb7d [ 38.555850][ T875] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 38.555861][ T875] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 38.558226][ T878] RBP: ffffc9000217fcd0 R08: ffff8881338e3083 R09: 1ffff1102671c610 [ 38.566211][ T875] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 38.574866][ T878] R10: dffffc0000000000 R11: ffffed102671c611 R12: dffffc0000000000 [ 38.582855][ T875] RSP: 0018:ffffc90001ef7cb0 EFLAGS: 00010293 [ 38.592924][ T878] R13: dffffc0000000000 R14: 000000002ceecd00 R15: ffff88812fd2ac00 [ 38.599267][ T875] [ 38.599272][ T875] RAX: ffffffff849bb307 RBX: ffff888114173000 RCX: ffff8881129f6540 [ 38.607254][ T878] FS: 000055556180a500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 38.626861][ T875] RDX: 0000000000000000 RSI: 000000002fd2ac00 RDI: 000000000c04eb7d [ 38.634816][ T878] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 38.640880][ T875] RBP: ffffc90001ef7cd0 R08: ffff888114173083 R09: 1ffff1102282e610 [ 38.648864][ T878] CR2: 0000200000000740 CR3: 00000001216e8000 CR4: 00000000003506b0 [ 38.651181][ T875] R10: dffffc0000000000 R11: ffffed102282e611 R12: dffffc0000000000 [ 38.659165][ T878] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 38.668093][ T875] R13: dffffc0000000000 R14: 000000002fd2ac00 R15: ffff88812fd28c00 [ 38.676070][ T878] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 38.682646][ T875] FS: 0000555576296500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 38.690622][ T878] Call Trace: [ 38.690628][ T878] [ 38.690635][ T878] pppol2tp_release+0x150/0x2b0 [ 38.698610][ T875] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 38.706599][ T878] sock_close+0xc9/0x220 [ 38.714553][ T875] CR2: 0000200000000740 CR3: 000000012cb38000 CR4: 00000000003506a0 [ 38.722535][ T878] ? __cfi_sock_close+0x10/0x10 [ 38.730506][ T875] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 38.730519][ T875] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 38.739455][ T878] __fput+0x1fd/0x8f0 [ 38.742724][ T875] Call Trace: [ 38.742729][ T875] [ 38.745661][ T878] ____fput+0x15/0x20 [ 38.750502][ T875] pppol2tp_release+0x150/0x2b0 [ 38.757095][ T878] task_work_run+0x1e1/0x250 [ 38.757118][ T878] ? __cfi_task_work_run+0x10/0x10 [ 38.757138][ T878] ? __cfi___close_range+0x10/0x10 [ 38.761375][ T875] sock_close+0xc9/0x220 [ 38.769380][ T878] exit_to_user_mode_loop+0x9b/0xb0 [ 38.774198][ T875] ? __cfi_sock_close+0x10/0x10 [ 38.782174][ T878] exit_to_user_mode_prepare+0x87/0xd0 [ 38.790148][ T875] __fput+0x1fd/0x8f0 [ 38.794117][ T878] syscall_exit_to_user_mode+0x1a/0x30 [ 38.797412][ T875] ____fput+0x15/0x20 [ 38.800334][ T878] do_syscall_64+0x58/0xa0 [ 38.804299][ T875] task_work_run+0x1e1/0x250 [ 38.809155][ T878] ? clear_bhb_loop+0x30/0x80 [ 38.809174][ T878] ? clear_bhb_loop+0x30/0x80 [ 38.813764][ T875] ? __cfi_task_work_run+0x10/0x10 [ 38.818882][ T878] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 38.823986][ T875] ? __cfi___close_range+0x10/0x10 [ 38.828263][ T878] RIP: 0033:0x7f2595b9e019 [ 38.833450][ T875] exit_to_user_mode_loop+0x9b/0xb0 [ 38.838305][ T878] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 38.843757][ T875] exit_to_user_mode_prepare+0x87/0xd0 [ 38.847755][ T878] RSP: 002b:00007fff4c4d0328 EFLAGS: 00000246 [ 38.853177][ T875] syscall_exit_to_user_mode+0x1a/0x30 [ 38.857157][ T878] ORIG_RAX: 00000000000001b4 [ 38.861559][ T875] do_syscall_64+0x58/0xa0 [ 38.866147][ T878] RAX: 0000000000000000 RBX: 00007fff4c4d0410 RCX: 00007f2595b9e019 [ 38.870813][ T875] ? clear_bhb_loop+0x30/0x80 [ 38.875512][ T878] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 38.880601][ T875] ? clear_bhb_loop+0x30/0x80 [ 38.886536][ T878] RBP: 000000000000962d R08: 0000000000000001 R09: 0000000000000000 [ 38.891595][ T875] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 38.896013][ T878] R10: 0000001b33520000 R11: 0000000000000246 R12: 00007fff4c4d0450 [ 38.896026][ T878] R13: 00007f2595e25fac R14: 0000000000009662 R15: 00007f2595e25fa0 [ 38.901211][ T875] RIP: 0033:0x7f09ae19e019 [ 38.921051][ T878] [ 38.926321][ T875] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 38.926337][ T875] RSP: 002b:00007ffc20291f28 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 38.926354][ T875] RAX: 0000000000000000 RBX: 00007ffc20292010 RCX: 00007f09ae19e019 [ 38.926364][ T875] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 38.926375][ T875] RBP: 000000000000962b R08: 0000000000000001 R09: 0000000000000000 [ 38.926386][ T875] R10: 0000001b33220000 R11: 0000000000000246 R12: 00007ffc20292050 [ 38.932437][ T878] ---[ end trace 0000000000000000 ]--- [ 38.937892][ T875] R13: 00007f09ae425fac R14: 0000000000009662 R15: 00007f09ae425fa0 [ 38.937910][ T875] [ 39.087361][ T875] ---[ end trace 0000000000000000 ]--- [ 39.104434][ T901] ------------[ cut here ]------------ [ 39.110118][ T901] WARNING: CPU: 1 PID: 901 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 39.120222][ T901] Modules linked in: [ 39.124127][ T901] CPU: 1 PID: 901 Comm: syz.1.260 Tainted: G B W syzkaller #0 [ 39.132910][ T901] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 39.143089][ T901] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 39.149608][ T901] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 39.169425][ T901] RSP: 0018:ffffc90001b3fcb0 EFLAGS: 00010293 [ 39.175586][ T901] RAX: ffffffff849bb307 RBX: ffff88812e767000 RCX: ffff888113509440 [ 39.183575][ T901] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000c04eb7d [ 39.191647][ T901] RBP: ffffc90001b3fcd0 R08: ffff88812e767083 R09: 1ffff11025cece10 [ 39.199723][ T901] R10: dffffc0000000000 R11: ffffed1025cece11 R12: dffffc0000000000 [ 39.207733][ T901] R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88813072e400 [ 39.215737][ T901] FS: 000055558ad9b500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 39.224683][ T901] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 39.231306][ T901] CR2: 0000200000000740 CR3: 0000000132014000 CR4: 00000000003506a0 [ 39.239334][ T901] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 39.247361][ T901] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 39.255357][ T901] Call Trace: [ 39.258649][ T901] [ 39.261598][ T901] pppol2tp_release+0x150/0x2b0 [ 39.266496][ T901] sock_close+0xc9/0x220 [ 39.270765][ T901] ? __cfi_sock_close+0x10/0x10 [ 39.275658][ T901] __fput+0x1fd/0x8f0 [ 39.279657][ T901] ____fput+0x15/0x20 [ 39.283654][ T901] task_work_run+0x1e1/0x250 [ 39.288306][ T901] ? __cfi_task_work_run+0x10/0x10 [ 39.293440][ T901] ? __cfi___close_range+0x10/0x10 [ 39.298602][ T901] exit_to_user_mode_loop+0x9b/0xb0 [ 39.303831][ T901] exit_to_user_mode_prepare+0x87/0xd0 [ 39.309337][ T901] syscall_exit_to_user_mode+0x1a/0x30 [ 39.314844][ T901] do_syscall_64+0x58/0xa0 [ 39.319314][ T901] ? clear_bhb_loop+0x30/0x80 [ 39.324025][ T901] ? clear_bhb_loop+0x30/0x80 [ 39.328750][ T901] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 39.334675][ T901] RIP: 0033:0x7fc4bc19e019 [ 39.339134][ T901] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 39.358797][ T901] RSP: 002b:00007ffc6172fc08 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 39.367257][ T901] RAX: 0000000000000000 RBX: 00007ffc6172fcf0 RCX: 00007fc4bc19e019 [ 39.375255][ T901] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 39.383246][ T901] RBP: 00000000000098ae R08: 0000000000000001 R09: 0000000000000000 [ 39.391264][ T901] R10: 0000001b33120000 R11: 0000000000000246 R12: 00007ffc6172fd30 [ 39.399272][ T901] R13: 00007fc4bc425fac R14: 00000000000098e3 R15: 00007fc4bc425fa0 [ 39.407299][ T901] [ 39.410325][ T901] ---[ end trace 0000000000000000 ]--- [ 39.426639][ T926] ------------[ cut here ]------------ [ 39.432204][ T926] WARNING: CPU: 1 PID: 926 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 39.442336][ T926] Modules linked in: [ 39.446295][ T926] CPU: 1 PID: 926 Comm: syz.1.271 Tainted: G B W syzkaller #0 [ 39.455002][ T926] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 39.465090][ T926] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 39.471440][ T926] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 39.491116][ T926] RSP: 0018:ffffc900021cfcb0 EFLAGS: 00010293 [ 39.497250][ T926] RAX: ffffffff849bb307 RBX: ffff888110c98000 RCX: ffff888130b66540 [ 39.505316][ T926] RDX: 0000000000000000 RSI: 0000000014ea3550 RDI: 000000000c04eb7d [ 39.513328][ T926] RBP: ffffc900021cfcd0 R08: ffff888110c98083 R09: 1ffff11022193010 [ 39.521429][ T926] R10: dffffc0000000000 R11: ffffed1022193011 R12: dffffc0000000000 [ 39.529437][ T926] R13: dffffc0000000000 R14: 0000000014ea3550 R15: ffff88812f8d2400 [ 39.537449][ T926] FS: 000055558ad9b500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 39.546409][ T926] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 39.552982][ T926] CR2: 00007f09ae1bd1b0 CR3: 0000000110980000 CR4: 00000000003506a0 [ 39.561009][ T926] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 39.569018][ T926] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 39.577016][ T926] Call Trace: [ 39.580300][ T926] [ 39.583224][ T926] pppol2tp_release+0x150/0x2b0 [ 39.588104][ T926] sock_close+0xc9/0x220 [ 39.592379][ T926] ? __cfi_sock_close+0x10/0x10 [ 39.597274][ T926] __fput+0x1fd/0x8f0 [ 39.601265][ T926] ____fput+0x15/0x20 [ 39.605279][ T926] task_work_run+0x1e1/0x250 [ 39.609877][ T926] ? __cfi_task_work_run+0x10/0x10 [ 39.615020][ T926] ? __cfi___close_range+0x10/0x10 [ 39.620165][ T926] exit_to_user_mode_loop+0x9b/0xb0 [ 39.625406][ T926] exit_to_user_mode_prepare+0x87/0xd0 [ 39.630897][ T926] syscall_exit_to_user_mode+0x1a/0x30 [ 39.636390][ T926] do_syscall_64+0x58/0xa0