last executing test programs: 257.263314ms ago: executing program 0 (id=1): r0 = socket$can_raw(0x1d, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = gettid() timer_create(0x1, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r2, 0x0, 0x40010000008ebc, 0x1) 202.075655ms ago: executing program 3 (id=4): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) wait4(0x0, &(0x7f00000001c0), 0x1000000, &(0x7f0000000400)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/nf_conntrack_expect\x00') preadv(r2, &(0x7f0000000140)=[{&(0x7f0000000000)=""/197, 0xc5}], 0x1, 0xf, 0xffff) 160.008916ms ago: executing program 1 (id=2): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0) ioctl$NILFS_IOCTL_GET_SUINFO(r0, 0x80186e84, &(0x7f0000000080)={&(0x7f0000000000)=[{0xdf9, 0x4}], 0x1, 0x10, 0x4, 0x7}) 109.568797ms ago: executing program 1 (id=6): r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000080)={r2, r1, 0x15, 0x0, @val=@iter={0x0}}, 0x20) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) connect$inet(r3, &(0x7f00000002c0)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) sendmsg$inet(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000500)}, 0x4004045) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x23, &(0x7f0000000100)={&(0x7f0000fe6000/0x14000)=nil, 0x14000, 0x0, 0x0, 0x0, &(0x7f0000000680)=""/169, 0xa9, 0x0, 0x0}, &(0x7f0000000400)=0x40) 98.136897ms ago: executing program 2 (id=3): r0 = socket$can_raw(0x1d, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$BTRFS_IOC_SEND(0xffffffffffffffff, 0x40489426, &(0x7f00000003c0)={{}, 0x1, &(0x7f0000000380)=[0x6], 0x4, 0x2}) r4 = gettid() timer_create(0x1, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) splice(r0, 0x0, r5, 0x0, 0x40010000008ebc, 0x1) 73.626068ms ago: executing program 1 (id=7): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f00000007c0)={0x1f, 0x0, @none, 0x4}, 0xe) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r1, 0xffffffffffffffff, 0x0) 38.167859ms ago: executing program 1 (id=8): eventfd2(0xffffffff, 0x1) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f00000007c0)={0x1f, 0x0, @none, 0x4}, 0xe) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r1, 0xffffffffffffffff, 0x0) 0s ago: executing program 1 (id=9): r0 = socket$inet6(0xa, 0x80001, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x1123102, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(0xffffffffffffffff, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x1, 0x80, 0x1, 0x255}, &(0x7f00000014c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7fffde, 0x200, 0x2, 0x15e, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x40080, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90f, 0x200, 0x3, 0x0, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x3, 0x1e9}}], 0x1, &(0x7f0000000340)={0x2e, 0x2, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x700, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x8007, 0x0, 0x0}}, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000340)={{0x2, 0x3, 0xf3b, 0x2, 0x13fffffc}}) mount$9p_fd(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f00000004c0), 0x14000, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f00000003c0), 0x6e, &(0x7f0000000a80)=[{&(0x7f0000000440)=""/74, 0x4a}, {&(0x7f0000000540)=""/252, 0xfc}, {&(0x7f00000009c0)=""/129, 0x81}], 0x3, &(0x7f0000000ac0)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x20}, 0x40) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.217' (ED25519) to the list of known hosts. [ 20.859723][ T28] audit: type=1400 audit(1784841246.551:64): avc: denied { mounton } for pid=279 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 20.860748][ T279] cgroup: Unknown subsys name 'net' [ 20.882575][ T28] audit: type=1400 audit(1784841246.551:65): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.909852][ T28] audit: type=1400 audit(1784841246.581:66): avc: denied { unmount } for pid=279 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.909990][ T279] cgroup: Unknown subsys name 'devices' [ 21.053846][ T279] cgroup: Unknown subsys name 'hugetlb' [ 21.059458][ T279] cgroup: Unknown subsys name 'rlimit' [ 21.161321][ T28] audit: type=1400 audit(1784841246.851:67): avc: denied { setattr } for pid=279 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.184505][ T28] audit: type=1400 audit(1784841246.851:68): avc: denied { mounton } for pid=279 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 21.209290][ T28] audit: type=1400 audit(1784841246.851:69): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.217769][ T281] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 21.241578][ T28] audit: type=1400 audit(1784841246.931:70): avc: denied { relabelto } for pid=281 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.267024][ T279] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.267104][ T28] audit: type=1400 audit(1784841246.931:71): avc: denied { write } for pid=281 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.301491][ T28] audit: type=1400 audit(1784841246.961:72): avc: denied { read } for pid=279 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.327400][ T28] audit: type=1400 audit(1784841246.961:73): avc: denied { open } for pid=279 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.578664][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.585868][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.593296][ T287] device bridge_slave_0 entered promiscuous mode [ 22.601150][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.608368][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.615721][ T287] device bridge_slave_1 entered promiscuous mode [ 22.665781][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.672868][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.680290][ T288] device bridge_slave_0 entered promiscuous mode [ 22.688839][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.695944][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.703396][ T288] device bridge_slave_1 entered promiscuous mode [ 22.734663][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.741714][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.749193][ T289] device bridge_slave_0 entered promiscuous mode [ 22.757381][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.764478][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.771899][ T289] device bridge_slave_1 entered promiscuous mode [ 22.842790][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.849849][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.857291][ T290] device bridge_slave_0 entered promiscuous mode [ 22.864316][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.871344][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.878811][ T290] device bridge_slave_1 entered promiscuous mode [ 22.893623][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.900774][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.908323][ T291] device bridge_slave_0 entered promiscuous mode [ 22.943702][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.950870][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.958339][ T291] device bridge_slave_1 entered promiscuous mode [ 23.027261][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.034334][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.041630][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.048698][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.105393][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.112492][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.119747][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.126789][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.135262][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.142322][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.149658][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.156684][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.192107][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.199260][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.206662][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.213742][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.225989][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.233966][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.241298][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.248772][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.256018][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.263301][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.270400][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.278021][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.285239][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.315181][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.322801][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.330276][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.338767][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.345834][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.353260][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.361415][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.368469][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.376159][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.384370][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.391381][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.410327][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.418601][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.425696][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.433218][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.443971][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.465082][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.473403][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.481281][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.489295][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.497644][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.504716][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.512255][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.520214][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.528482][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.535528][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.557112][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.565554][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.573989][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.581027][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.593458][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.601874][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.610071][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.617121][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.630421][ T290] device veth0_vlan entered promiscuous mode [ 23.642387][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.649890][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.657674][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.665817][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.674089][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.682602][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.690917][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.699306][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.707481][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.715082][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.723247][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.731629][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.740013][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.747112][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.759537][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 23.767257][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.775280][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.783543][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.791608][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.799964][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.808291][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.816571][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.824711][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.832694][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.840969][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.849191][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.856243][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.863906][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.871388][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.880014][ T287] device veth0_vlan entered promiscuous mode [ 23.896296][ T287] device veth1_macvtap entered promiscuous mode [ 23.903470][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.912190][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.920326][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.931695][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.940058][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.952914][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.961414][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.970536][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.978961][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.989399][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.997718][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.010821][ T288] device veth0_vlan entered promiscuous mode [ 24.024386][ T290] device veth1_macvtap entered promiscuous mode [ 24.031706][ T289] device veth0_vlan entered promiscuous mode [ 24.040320][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.048210][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.056421][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.064890][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.073314][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.081580][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.089660][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.097823][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.106385][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.114919][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.122508][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.129912][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.137655][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.153022][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.161336][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.177457][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.186007][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.194442][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.202815][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.211137][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.219750][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.228064][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.236468][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.246935][ T288] device veth1_macvtap entered promiscuous mode [ 24.267520][ T287] request_module fs-gadgetfs succeeded, but still no fs? [ 24.276696][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.285863][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.293545][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.301037][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.308824][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.317246][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.325786][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.334247][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.344522][ T291] device veth0_vlan entered promiscuous mode [ 24.353470][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.366183][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.378320][ T289] device veth1_macvtap entered promiscuous mode [ 24.392113][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.399925][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.408449][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.427629][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.437982][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.449042][ T291] device veth1_macvtap entered promiscuous mode [ 24.466132][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.486358][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.500976][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.533179][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.587507][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.675254][ T8] ================================================================== [ 24.683357][ T8] BUG: KASAN: use-after-free in l2tp_tunnel_del_work+0xd8/0x410 [ 24.691022][ T8] Read of size 8 at addr ffff888112979c80 by task kworker/u4:0/8 [ 24.698752][ T8] [ 24.701130][ T8] CPU: 0 PID: 8 Comm: kworker/u4:0 Not tainted syzkaller #0 [ 24.708418][ T8] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 24.718511][ T8] Workqueue: l2tp l2tp_tunnel_del_work [ 24.724015][ T8] Call Trace: [ 24.727380][ T8] [ 24.730308][ T8] __dump_stack+0x21/0x24 [ 24.734648][ T8] dump_stack_lvl+0x110/0x170 [ 24.739332][ T8] ? __cfi_dump_stack_lvl+0x8/0x8 [ 24.744361][ T8] ? __cfi__printk+0x8/0x8 [ 24.748777][ T8] ? __schedule+0xbea/0x14b0 [ 24.753502][ T8] ? l2tp_tunnel_del_work+0xd8/0x410 [ 24.758787][ T8] print_address_description+0x71/0x200 [ 24.764348][ T8] print_report+0x4a/0x60 [ 24.768684][ T8] kasan_report+0x122/0x150 [ 24.773193][ T8] ? l2tp_tunnel_del_work+0xd8/0x410 [ 24.778482][ T8] __asan_report_load8_noabort+0x14/0x20 [ 24.784114][ T8] l2tp_tunnel_del_work+0xd8/0x410 [ 24.789229][ T8] process_one_work+0x717/0xc30 [ 24.794177][ T8] worker_thread+0xa4d/0x11d0 [ 24.798874][ T8] kthread+0x281/0x320 [ 24.802943][ T8] ? __cfi_worker_thread+0x10/0x10 [ 24.808063][ T8] ? __cfi_kthread+0x10/0x10 [ 24.812655][ T8] ret_from_fork+0x1f/0x30 [ 24.817074][ T8] [ 24.820353][ T8] [ 24.822699][ T8] Allocated by task 316: [ 24.826926][ T8] kasan_set_track+0x4b/0x70 [ 24.831514][ T8] kasan_save_alloc_info+0x1f/0x30 [ 24.836617][ T8] __kasan_kmalloc+0x95/0xb0 [ 24.841209][ T8] __kmalloc+0xb4/0x1e0 [ 24.845377][ T8] l2tp_session_create+0x38/0xbd0 [ 24.850400][ T8] pppol2tp_connect+0xbf5/0x1640 [ 24.855360][ T8] __sys_connect+0x3da/0x460 [ 24.859964][ T8] __x64_sys_connect+0x7a/0x90 [ 24.864747][ T8] x64_sys_call+0x88d/0x9a0 [ 24.869258][ T8] do_syscall_64+0x4c/0xa0 [ 24.873678][ T8] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 24.879576][ T8] [ 24.881894][ T8] Freed by task 316: [ 24.885791][ T8] kasan_set_track+0x4b/0x70 [ 24.890472][ T8] kasan_save_free_info+0x2b/0x40 [ 24.895601][ T8] ____kasan_slab_free+0x132/0x180 [ 24.900727][ T8] __kasan_slab_free+0x11/0x20 [ 24.905754][ T8] slab_free_freelist_hook+0xc2/0x190 [ 24.911125][ T8] __kmem_cache_free+0xb7/0x1b0 [ 24.915984][ T8] kfree+0x6f/0xf0 [ 24.919704][ T8] l2tp_session_put+0xaf/0x1a0 [ 24.924511][ T8] pppol2tp_ioctl+0x748/0x960 [ 24.929192][ T8] pppox_ioctl+0x1f6/0x330 [ 24.933617][ T8] sock_do_ioctl+0x114/0x330 [ 24.938336][ T8] sock_ioctl+0x475/0x700 [ 24.942877][ T8] __se_sys_ioctl+0x12f/0x1b0 [ 24.947568][ T8] __x64_sys_ioctl+0x7b/0x90 [ 24.952161][ T8] x64_sys_call+0x58b/0x9a0 [ 24.956682][ T8] do_syscall_64+0x4c/0xa0 [ 24.961108][ T8] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 24.967007][ T8] [ 24.969332][ T8] The buggy address belongs to the object at ffff888112979c00 [ 24.969332][ T8] which belongs to the cache kmalloc-512 of size 512 [ 24.983384][ T8] The buggy address is located 128 bytes inside of [ 24.983384][ T8] 512-byte region [ffff888112979c00, ffff888112979e00) [ 24.996750][ T8] [ 24.999076][ T8] The buggy address belongs to the physical page: [ 25.005491][ T8] page:ffffea00044a5e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112978 [ 25.015731][ T8] head:ffffea00044a5e00 order:2 compound_mapcount:0 compound_pincount:0 [ 25.024153][ T8] flags: 0x4000000000010200(slab|head|zone=1) [ 25.030238][ T8] raw: 4000000000010200 ffffea000447a700 dead000000000002 ffff888100042f00 [ 25.038829][ T8] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 25.047409][ T8] page dumped because: kasan: bad access detected [ 25.053835][ T8] page_owner tracks the page as allocated [ 25.059568][ T8] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 111, tgid 111 (udevd), ts 4107911879, free_ts 0 [ 25.079207][ T8] post_alloc_hook+0x1f5/0x210 [ 25.083990][ T8] prep_new_page+0x1c/0x110 [ 25.088498][ T8] get_page_from_freelist+0x2ca9/0x2d20 [ 25.094044][ T8] __alloc_pages+0x1fa/0x610 [ 25.098633][ T8] alloc_slab_page+0x6e/0xf0 [ 25.103309][ T8] new_slab+0x98/0x3e0 [ 25.107376][ T8] ___slab_alloc+0x70f/0xb70 [ 25.111961][ T8] __slab_alloc+0x5e/0xa0 [ 25.116292][ T8] __kmem_cache_alloc_node+0x204/0x2d0 [ 25.121838][ T8] __kmalloc_node_track_caller+0xa1/0x1e0 [ 25.127646][ T8] __alloc_skb+0x226/0x4a0 [ 25.132052][ T8] alloc_skb_with_frags+0xa8/0x620 [ 25.137160][ T8] sock_alloc_send_pskb+0x87f/0x9a0 [ 25.142361][ T8] unix_dgram_sendmsg+0x5c1/0x1710 [ 25.147470][ T8] sock_write_iter+0x2ea/0x3f0 [ 25.152234][ T8] vfs_write+0x5ef/0xd00 [ 25.156478][ T8] page_owner free stack trace missing [ 25.161844][ T8] [ 25.164167][ T8] Memory state around the buggy address: [ 25.169833][ T8] ffff888112979b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.177944][ T8] ffff888112979c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.186067][ T8] >ffff888112979c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.194133][ T8] ^ [ 25.198207][ T8] ffff888112979d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.206247][ T8] ffff888112979d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.214287][ T8] ================================================================== [ 25.222516][ T8] Disabling lock debugging due to kernel taint [ 25.226002][ T317] ------------[ cut here ]------------ [ 25.234201][ T317] WARNING: CPU: 1 PID: 317 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 25.244235][ T317] Modules linked in: [ 25.248138][ T317] CPU: 1 PID: 317 Comm: syz.1.2 Tainted: G B syzkaller #0 [ 25.256721][ T317] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 25.266911][ T317] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 25.273336][ T317] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 25.293044][ T317] RSP: 0018:ffffc9000dc8fb90 EFLAGS: 00010293 [ 25.299125][ T317] RAX: ffffffff849bb307 RBX: ffff888112cad000 RCX: ffff88811020e540 [ 25.307166][ T317] RDX: 0000000000000000 RSI: 000000000fb5ba80 RDI: 000000000c04eb7d [ 25.315172][ T317] RBP: ffffc9000dc8fbb0 R08: ffff888112cad083 R09: 1ffff11022595a10 [ 25.323211][ T317] R10: dffffc0000000000 R11: ffffed1022595a11 R12: dffffc0000000000 [ 25.331209][ T317] R13: dffffc0000000000 R14: 000000000fb5ba80 R15: ffff888112979c00 [ 25.339296][ T317] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 25.348278][ T317] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.354903][ T317] CR2: 0000001b2ed1dff8 CR3: 0000000133072000 CR4: 00000000003506a0 [ 25.362914][ T317] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 25.370896][ T317] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 25.378919][ T317] Call Trace: [ 25.382235][ T317] [ 25.385167][ T317] pppol2tp_release+0x150/0x2b0 [ 25.390026][ T317] sock_close+0xc9/0x220 [ 25.394319][ T317] ? __cfi_sock_close+0x10/0x10 [ 25.399180][ T317] __fput+0x1fd/0x8f0 [ 25.403212][ T317] ____fput+0x15/0x20 [ 25.407203][ T317] task_work_run+0x1e1/0x250 [ 25.411916][ T317] ? __cfi_task_work_run+0x10/0x10 [ 25.417135][ T317] ? free_nsproxy+0x21f/0x270 [ 25.421860][ T317] do_exit+0xaf2/0x2850 [ 25.426041][ T317] ? __cfi_do_exit+0x10/0x10 [ 25.430653][ T317] ? xfd_validate_state+0x70/0x150 [ 25.435817][ T317] ? __kasan_check_write+0x14/0x20 [ 25.440935][ T317] __x64_sys_exit+0x40/0x40 [ 25.445495][ T317] x64_sys_call+0x67/0x9a0 [ 25.449917][ T317] do_syscall_64+0x4c/0xa0 [ 25.454388][ T317] ? clear_bhb_loop+0x30/0x80 [ 25.459071][ T317] ? clear_bhb_loop+0x30/0x80 [ 25.463794][ T317] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 25.469698][ T317] RIP: 0033:0x7fb454b9de99 [ 25.474183][ T317] Code: Unable to access opcode bytes at 0x7fb454b9de6f. [ 25.481201][ T317] RSP: 002b:00007fb455ad3ef8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 25.489668][ T317] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007fb454b9de99 [ 25.498034][ T317] RDX: 00007fb455ad49c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 25.506147][ T317] RBP: 00007fb454c33eaf R08: 0000000000000000 R09: 0000000000000058 [ 25.514154][ T317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 25.522168][ T317] R13: 00007fb454e26038 R14: 00007fb454e25fa0 R15: 00007ffc72e0b7a8 [ 25.530149][ T317] [ 25.533225][ T317] ---[ end trace 0000000000000000 ]--- [ 25.540156][ T8] ------------[ cut here ]------------ [ 25.545692][ T8] refcount_t: underflow; use-after-free. [ 25.580682][ T8] WARNING: CPU: 1 PID: 8 at lib/refcount.c:28 refcount_warn_saturate+0x120/0x1a0 [ 25.591097][ T8] Modules linked in: [ 25.595125][ T8] CPU: 1 PID: 8 Comm: kworker/u4:0 Tainted: G B W syzkaller #0 [ 25.604059][ T8] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 25.614254][ T8] Workqueue: l2tp l2tp_tunnel_del_work [ 25.619813][ T8] RIP: 0010:refcount_warn_saturate+0x120/0x1a0 [ 25.626110][ T8] Code: 05 01 48 c7 c7 80 0c ca 85 e8 bc 28 d9 fe 0f 0b eb c3 e8 13 9a 08 ff c6 05 f4 c9 26 05 01 48 c7 c7 e0 0c ca 85 e8 a0 28 d9 fe <0f> 0b eb a7 e8 f7 99 08 ff c6 05 d5 c9 26 05 01 48 c7 c7 20 0c ca [ 25.645872][ T8] RSP: 0018:ffffc90000087c38 EFLAGS: 00010246 [ 25.651988][ T8] RAX: 5f0c61959b857300 RBX: 0000000000000003 RCX: ffff88810029a880 [ 25.659968][ T8] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 [ 25.667978][ T8] RBP: ffffc90000087c48 R08: ffffc90000087947 R09: 1ffff92000010f28 [ 25.675989][ T8] R10: dffffc0000000000 R11: fffff52000010f29 R12: 1ffff1102252f390 [ 25.684004][ T8] R13: dffffc0000000000 R14: 0000000000000003 R15: 0000000000000000 [ 25.691987][ T8] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 25.700920][ T8] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.707532][ T8] CR2: 0000001b2ed1dff8 CR3: 000000000700f000 CR4: 00000000003506a0 [ 25.715792][ T8] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 25.723803][ T8] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 25.731809][ T8] Call Trace: [ 25.735086][ T8] [ 25.738012][ T8] l2tp_session_put+0xc8/0x1a0 [ 25.742811][ T8] l2tp_session_delete+0x3df/0x4d0 [ 25.747921][ T8] l2tp_tunnel_del_work+0x199/0x410 [ 25.753154][ T8] process_one_work+0x717/0xc30 [ 25.758005][ T8] worker_thread+0xa4d/0x11d0 [ 25.762713][ T8] kthread+0x281/0x320 [ 25.766787][ T8] ? __cfi_worker_thread+0x10/0x10 [ 25.771926][ T8] ? __cfi_kthread+0x10/0x10 [ 25.776519][ T8] ret_from_fork+0x1f/0x30 [ 25.780942][ T8] [ 25.784013][ T8] ---[ end trace 0000000000000000 ]---