Warning: Permanently added '10.128.0.160' (ED25519) to the list of known hosts. 2026/11/13 17:24:46 parsed 1 programs 2026/11/13 17:24:46 serving rpc on tcp://33741 [ 20.772277][ T24] audit: type=1400 audit(1794590686.759:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 20.793109][ T24] audit: type=1400 audit(1794590686.759:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 20.812752][ T24] audit: type=1400 audit(1794590686.759:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 21.391469][ T24] audit: type=1400 audit(1794590687.369:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.392561][ T293] cgroup: Unknown subsys name 'net' [ 21.414130][ T24] audit: type=1400 audit(1794590687.369:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.441500][ T24] audit: type=1400 audit(1794590687.409:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.441633][ T293] cgroup: Unknown subsys name 'devices' [ 21.583248][ T293] cgroup: Unknown subsys name 'hugetlb' [ 21.588860][ T293] cgroup: Unknown subsys name 'rlimit' [ 21.761535][ T24] audit: type=1400 audit(1794590687.739:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.784744][ T24] audit: type=1400 audit(1794590687.749:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 21.805201][ T24] audit: type=1400 audit(1794590687.749:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 21.815850][ T297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 21.825477][ T24] audit: type=1400 audit(1794590687.749:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 21.892378][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.347508][ T305] request_module fs-gadgetfs succeeded, but still no fs? [ 22.369842][ T306] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 22.440606][ T303] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.479260][ T303] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.493404][ T303] device bridge_slave_0 entered promiscuous mode [ 22.532437][ T303] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.539490][ T303] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.547696][ T303] device bridge_slave_1 entered promiscuous mode [ 22.719410][ T303] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.726512][ T303] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.733838][ T303] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.740946][ T303] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.865045][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.874229][ T310] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.881625][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 22.889248][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.905505][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.913793][ T310] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.920827][ T310] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.936213][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.944377][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.958162][ T303] device veth0_vlan entered promiscuous mode [ 22.965994][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.975465][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.984134][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.991606][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.008034][ T303] device veth1_macvtap entered promiscuous mode [ 23.015022][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.040394][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.049148][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/11/13 17:24:49 executed programs: 0 [ 23.213974][ T367] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.221023][ T367] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.228558][ T367] device bridge_slave_0 entered promiscuous mode [ 23.235527][ T367] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.242573][ T367] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.249948][ T367] device bridge_slave_1 entered promiscuous mode [ 23.318108][ T365] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.325544][ T365] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.333160][ T365] device bridge_slave_0 entered promiscuous mode [ 23.340889][ T365] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.347993][ T365] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.355370][ T365] device bridge_slave_1 entered promiscuous mode [ 23.417248][ T371] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.424416][ T371] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.431670][ T371] device bridge_slave_0 entered promiscuous mode [ 23.445997][ T370] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.453195][ T370] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.460618][ T370] device bridge_slave_0 entered promiscuous mode [ 23.467882][ T371] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.475147][ T371] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.482606][ T371] device bridge_slave_1 entered promiscuous mode [ 23.501134][ T370] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.508395][ T370] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.515752][ T370] device bridge_slave_1 entered promiscuous mode [ 23.581578][ T372] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.588937][ T372] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.596360][ T372] device bridge_slave_0 entered promiscuous mode [ 23.603384][ T372] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.610412][ T372] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.617841][ T372] device bridge_slave_1 entered promiscuous mode [ 23.649014][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.656549][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.709098][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.717365][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.725627][ T310] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.732663][ T310] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.763453][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 23.771183][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.779904][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.788177][ T310] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.795231][ T310] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.803645][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.811684][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.838617][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.846193][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.853693][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.862331][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.870583][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.877632][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.885069][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.893487][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.901540][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.908592][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.915935][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.924072][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.938470][ T367] device veth0_vlan entered promiscuous mode [ 23.963204][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 23.970884][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.979851][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.988258][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.996644][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.005033][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.012886][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.020843][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.028946][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.036910][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.044419][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.056140][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.063600][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.078792][ T367] device veth1_macvtap entered promiscuous mode [ 24.088404][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.097739][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.106071][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.137640][ T365] device veth0_vlan entered promiscuous mode [ 24.144143][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.151650][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.160287][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.168278][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.176375][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.184631][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.191640][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.198973][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.206585][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.214013][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.222199][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.229291][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.236800][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.245184][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.253352][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.260367][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.267979][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.276221][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.283486][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.290798][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.299121][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.307462][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.315797][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.324142][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.332279][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.349842][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.357997][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.365037][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.373165][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.381086][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.389347][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.397704][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.404742][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.412189][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.438543][ T365] device veth1_macvtap entered promiscuous mode [ 24.453218][ T389] ================================================================== [ 24.453233][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.461315][ T389] BUG: KASAN: use-after-free in pppol2tp_sock_to_session+0x1a0/0x1b0 [ 24.469988][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.477217][ T389] Read of size 4 at addr ffff88811176cc00 by task syz.0.17/389 [ 24.477219][ T389] [ 24.477242][ T389] CPU: 1 PID: 389 Comm: syz.0.17 Not tainted syzkaller #0 [ 24.477254][ T389] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 24.485745][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.492631][ T389] Call Trace: [ 24.492648][ T389] __dump_stack+0x21/0x24 [ 24.492656][ T389] dump_stack_lvl+0x1a7/0x208 [ 24.492671][ T389] ? show_regs_print_info+0x18/0x18 [ 24.495508][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.502068][ T389] ? thaw_kernel_threads+0x220/0x220 [ 24.502079][ T389] print_address_description+0x7f/0x2c0 [ 24.502097][ T389] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 24.514270][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.519520][ T389] kasan_report+0x100/0x140 [ 24.523171][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.527083][ T389] ? __kasan_check_write+0x14/0x20 [ 24.532093][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.536921][ T389] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 24.599924][ T389] __asan_report_load4_noabort+0x14/0x20 [ 24.605533][ T389] pppol2tp_sock_to_session+0x1a0/0x1b0 [ 24.611070][ T389] pppol2tp_release+0x150/0x2b0 [ 24.615903][ T389] sock_close+0xb8/0x200 [ 24.620117][ T389] ? sock_mmap+0xa0/0xa0 [ 24.624349][ T389] __fput+0x2dc/0x730 [ 24.628304][ T389] ____fput+0x15/0x20 [ 24.632285][ T389] task_work_run+0x127/0x190 [ 24.636849][ T389] exit_to_user_mode_loop+0xcb/0xe0 [ 24.642020][ T389] exit_to_user_mode_prepare+0x76/0xa0 [ 24.647454][ T389] syscall_exit_to_user_mode+0x1d/0x40 [ 24.652911][ T389] do_syscall_64+0x3d/0x40 [ 24.657303][ T389] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 24.663177][ T389] RIP: 0033:0x7f678e23d4d9 [ 24.667654][ T389] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 24.687237][ T389] RSP: 002b:00007fff08b81588 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 24.695626][ T389] RAX: 0000000000000000 RBX: 00007fff08b81670 RCX: 00007f678e23d4d9 [ 24.703593][ T389] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 24.711542][ T389] RBP: 0000000000005f6d R08: 0000000000000001 R09: 0000000000000000 [ 24.719520][ T389] R10: 0000001b32c20000 R11: 0000000000000246 R12: 0000000000000000 [ 24.727467][ T389] R13: 00007f678e4b9fac R14: 00007f678e4b9fa8 R15: 00007f678e4b9fa0 [ 24.735420][ T389] [ 24.737728][ T389] Allocated by task 389: [ 24.741945][ T389] __kasan_kmalloc+0xd4/0x100 [ 24.746595][ T389] __kmalloc+0x19f/0x330 [ 24.750808][ T389] l2tp_session_create+0x39/0xb60 [ 24.755809][ T389] pppol2tp_connect+0xbf5/0x1640 [ 24.760719][ T389] __sys_connect+0x3ce/0x450 [ 24.765282][ T389] __x64_sys_connect+0x7a/0x90 [ 24.770024][ T389] do_syscall_64+0x31/0x40 [ 24.774425][ T389] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 24.780287][ T389] [ 24.782679][ T389] Freed by task 388: [ 24.786553][ T389] kasan_set_track+0x4a/0x70 [ 24.791120][ T389] kasan_set_free_info+0x23/0x40 [ 24.796118][ T389] ____kasan_slab_free+0x125/0x160 [ 24.801199][ T389] __kasan_slab_free+0x11/0x20 [ 24.805934][ T389] slab_free_freelist_hook+0xc5/0x190 [ 24.811274][ T389] kfree+0xc0/0x270 [ 24.815058][ T389] l2tp_session_put+0xb2/0x1a0 [ 24.819797][ T389] l2tp_session_delete+0x3a9/0x4a0 [ 24.824885][ T389] l2tp_tunnel_del_work+0x180/0x3d0 [ 24.830055][ T389] process_one_work+0x6fd/0xbc0 [ 24.834894][ T389] worker_thread+0xa8e/0x13c0 [ 24.839544][ T389] kthread+0x324/0x3b0 [ 24.843586][ T389] ret_from_fork+0x1f/0x30 [ 24.847969][ T389] [ 24.850289][ T389] The buggy address belongs to the object at ffff88811176cc00 [ 24.850289][ T389] which belongs to the cache kmalloc-512 of size 512 [ 24.864319][ T389] The buggy address is located 0 bytes inside of [ 24.864319][ T389] 512-byte region [ffff88811176cc00, ffff88811176ce00) [ 24.877391][ T389] The buggy address belongs to the page: [ 24.883021][ T389] page:ffffea000445db00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11176c [ 24.893229][ T389] head:ffffea000445db00 order:2 compound_mapcount:0 compound_pincount:0 [ 24.901538][ T389] flags: 0x4000000000010200(slab|head) [ 24.906978][ T389] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 [ 24.915564][ T389] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 24.924119][ T389] page dumped because: kasan: bad access detected [ 24.930501][ T389] page_owner tracks the page as allocated [ 24.936218][ T389] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 389, ts 24452914461, free_ts 24449812731 [ 24.956588][ T389] prep_new_page+0x176/0x190 [ 24.961168][ T389] get_page_from_freelist+0x225f/0x23f0 [ 24.966688][ T389] __alloc_pages_nodemask+0x29a/0x640 [ 24.972032][ T389] new_slab+0x84/0x3f0 [ 24.976084][ T389] ___slab_alloc+0x2f8/0x4c0 [ 24.980675][ T389] __slab_alloc+0x63/0xa0 [ 24.985015][ T389] kmem_cache_alloc_trace+0x1a8/0x2e0 [ 24.990378][ T389] l2tp_tunnel_create+0x97/0x460 [ 24.995304][ T389] pppol2tp_connect+0x7ef/0x1640 [ 25.000252][ T389] __sys_connect+0x3ce/0x450 [ 25.004819][ T389] __x64_sys_connect+0x7a/0x90 [ 25.009558][ T389] do_syscall_64+0x31/0x40 [ 25.013948][ T389] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.019823][ T389] page last free stack trace: [ 25.024479][ T389] __free_pages_ok+0x80b/0x830 [ 25.029232][ T389] __free_pages+0xd8/0x390 [ 25.033638][ T389] __free_slab+0xcf/0x190 [ 25.038028][ T389] unfreeze_partials+0x150/0x180 [ 25.042936][ T389] put_cpu_partial+0xc1/0x180 [ 25.047590][ T389] __slab_free+0x2c9/0x3a0 [ 25.051982][ T389] ___cache_free+0x10e/0x130 [ 25.056565][ T389] qlink_free+0x50/0x90 [ 25.060714][ T389] qlist_free_all+0x5f/0xb0 [ 25.065200][ T389] kasan_quarantine_reduce+0x14a/0x160 [ 25.070653][ T389] __kasan_slab_alloc+0x2f/0xe0 [ 25.075506][ T389] slab_post_alloc_hook+0x5d/0x2f0 [ 25.080591][ T389] kmem_cache_alloc+0x15a/0x2d0 [ 25.085434][ T389] sock_alloc_inode+0x1b/0xb0 [ 25.090086][ T389] new_inode_pseudo+0x62/0x210 [ 25.094822][ T389] __sock_create+0x12c/0x770 [ 25.099410][ T389] [ 25.101714][ T389] Memory state around the buggy address: [ 25.107334][ T389] ffff88811176cb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.115372][ T389] ffff88811176cb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.123408][ T389] >ffff88811176cc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.131457][ T389] ^ [ 25.135496][ T389] ffff88811176cc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.143548][ T389] ffff88811176cd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.151600][ T389] ================================================================== [ 25.159649][ T389] Disabling lock debugging due to kernel taint [ 25.176232][ T389] ------------[ cut here ]------------ [ 25.177777][ T371] device veth0_vlan entered promiscuous mode [ 25.181732][ T389] WARNING: CPU: 1 PID: 389 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 25.197801][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.198241][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.205436][ T389] Modules linked in: [ 25.214114][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.216447][ T389] CPU: 1 PID: 389 Comm: syz.0.17 Tainted: G B syzkaller #0 [ 25.225326][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.233451][ T389] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 25.241493][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.251475][ T389] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 25.259988][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.266403][ T389] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 25.275274][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.294147][ T389] RSP: 0018:ffffc90000e07d68 EFLAGS: 00010293 [ 25.302211][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.308118][ T389] RAX: ffffffff843003c7 RBX: ffff888111082800 RCX: ffff88810d592800 [ 25.315958][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.323633][ T389] RDX: 0000000000000000 RSI: 000000000ae53760 RDI: 000000000c04eb7d [ 25.331560][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.339466][ T389] RBP: ffffc90000e07d88 R08: 0000000000000003 R09: 0000000000000004 [ 25.347381][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.355242][ T389] R10: dffffc0000000000 R11: fffffbfff0dcfa48 R12: dffffc0000000000 [ 25.363289][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.371097][ T389] R13: dffffc0000000000 R14: 000000000ae53760 R15: ffff88811176cc00 [ 25.378999][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.386985][ T389] FS: 0000555589d1d500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 25.395041][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.403546][ T389] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.417780][ T389] CR2: 0000000000000000 CR3: 00000001100d0000 CR4: 00000000003506a0 [ 25.425951][ T389] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 25.437186][ T389] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 25.445292][ T389] Call Trace: [ 25.449155][ T389] pppol2tp_release+0x150/0x2b0 [ 25.454757][ T389] sock_close+0xb8/0x200 [ 25.455995][ T371] device veth1_macvtap entered promiscuous mode [ 25.459049][ T389] ? sock_mmap+0xa0/0xa0 [ 25.465915][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.470089][ T389] __fput+0x2dc/0x730 [ 25.479631][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.482482][ T389] ____fput+0x15/0x20 [ 25.490345][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.494356][ T389] task_work_run+0x127/0x190 [ 25.502805][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.506867][ T389] exit_to_user_mode_loop+0xcb/0xe0 [ 25.515125][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.520025][ T389] exit_to_user_mode_prepare+0x76/0xa0 [ 25.530490][ T372] device veth0_vlan entered promiscuous mode [ 25.538845][ T389] syscall_exit_to_user_mode+0x1d/0x40 [ 25.544983][ T389] do_syscall_64+0x3d/0x40 [ 25.549407][ T389] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.566234][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.566819][ T389] RIP: 0033:0x7f678e23d4d9 [ 25.576058][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.578590][ T389] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 25.587837][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.608217][ T389] RSP: 002b:00007fff08b81588 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 25.615581][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.625616][ T389] RAX: 0000000000000000 RBX: 00007fff08b81670 RCX: 00007f678e23d4d9 [ 25.632202][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.647691][ T389] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 25.647698][ T389] RBP: 0000000000005f6d R08: 0000000000000001 R09: 0000000000000000 [ 25.647703][ T389] R10: 0000001b32c20000 R11: 0000000000000246 R12: 0000000000000000 [ 25.647709][ T389] R13: 00007f678e4b9fac R14: 00007f678e4b9fa8 R15: 00007f678e4b9fa0 [ 25.647717][ T389] ---[ end trace 5dcea736e5a16991 ]--- [ 25.685944][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.694331][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.702684][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.712182][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.720848][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.736433][ T370] device veth0_vlan entered promiscuous mode [ 25.753594][ T388] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.769197][ T388] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.789009][ T388] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.796623][ T388] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.808620][ T372] device veth1_macvtap entered promiscuous mode [ 25.817359][ T416] ------------[ cut here ]------------ [ 25.826117][ T388] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.834161][ T416] WARNING: CPU: 0 PID: 416 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 25.836860][ T388] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.847059][ T416] Modules linked in: [ 25.859714][ T422] ------------[ cut here ]------------ [ 25.863013][ T416] CPU: 0 PID: 416 Comm: syz.6.46 Tainted: G B W syzkaller #0 [ 25.866504][ T388] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.877870][ T416] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 25.881833][ T422] WARNING: CPU: 1 PID: 422 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 25.895539][ T416] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 25.906777][ T422] Modules linked in: [ 25.912333][ T416] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 25.914419][ T422] CPU: 1 PID: 422 Comm: syz.0.50 Tainted: G B W syzkaller #0 [ 25.936421][ T416] RSP: 0018:ffffc90000e27d68 EFLAGS: 00010293 [ 25.943181][ T370] device veth1_macvtap entered promiscuous mode [ 25.953514][ T422] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 25.956431][ T416] RAX: ffffffff843003c7 RBX: ffff888112a1c000 RCX: ffff8881122da800 [ 25.964325][ T422] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 25.975520][ T416] RDX: 0000000000000000 RSI: 000000001143a5e0 RDI: 000000000c04eb7d [ 25.980085][ T388] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.993158][ T416] RBP: ffffc90000e27d88 R08: ffff888112a1c083 R09: 1ffff11022543810 [ 25.995238][ T422] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 26.014179][ T416] R10: dffffc0000000000 R11: ffffed1022543811 R12: dffffc0000000000 [ 26.022474][ T388] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.032799][ T416] R13: dffffc0000000000 R14: 000000001143a5e0 R15: ffff8881122f4000 [ 26.038026][ T388] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.048834][ T416] FS: 000055557eebe500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 26.056193][ T422] RSP: 0018:ffffc90000f77d68 EFLAGS: 00010293 [ 26.069089][ T388] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.070097][ T416] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 26.079646][ T422] RAX: ffffffff843003c7 RBX: ffff888112354000 RCX: ffff888112ac0000 [ 26.090313][ T416] CR2: 00007fa43c950060 CR3: 00000001120a2000 CR4: 00000000003506b0 [ 26.097905][ T388] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.100349][ T416] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 26.108272][ T439] ------------[ cut here ]------------ [ 26.117705][ T416] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 26.122236][ T388] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.130659][ T416] Call Trace: [ 26.137930][ T422] RDX: 0000000000000000 RSI: 000000000c1493c0 RDI: 000000000c04eb7d [ 26.141168][ T416] pppol2tp_release+0x150/0x2b0 [ 26.149335][ T388] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.154088][ T416] sock_close+0xb8/0x200 [ 26.161314][ T439] WARNING: CPU: 1 PID: 439 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 26.165759][ T416] ? sock_mmap+0xa0/0xa0 [ 26.176698][ T439] Modules linked in: [ 26.180073][ T422] RBP: ffffc90000f77d88 R08: ffff888112354083 R09: 1ffff1102246a810 [ 26.191253][ T439] CPU: 1 PID: 439 Comm: syz.4.68 Tainted: G B W syzkaller #0 [ 26.192985][ T416] __fput+0x2dc/0x730 [ 26.205816][ T422] R10: dffffc0000000000 R11: ffffed102246a811 R12: dffffc0000000000 [ 26.205916][ T439] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 26.214012][ T422] R13: dffffc0000000000 R14: 000000000c1493c0 R15: ffff888112add000 [ 26.214021][ T422] FS: 0000555589d1d500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 26.214027][ T422] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 26.214039][ T422] CR2: 00007ff77fb74718 CR3: 00000001129db000 CR4: 00000000003506b0 [ 26.224513][ T439] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 26.232526][ T416] ____fput+0x15/0x20 [ 26.241488][ T439] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 26.247966][ T416] task_work_run+0x127/0x190 [ 26.258400][ T388] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.263101][ T422] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 26.266441][ T388] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.286009][ T416] exit_to_user_mode_loop+0xcb/0xe0 [ 26.290557][ T439] RSP: 0018:ffffc90000e67d68 EFLAGS: 00010293 [ 26.298576][ T422] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 26.306714][ T388] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.314693][ T416] exit_to_user_mode_prepare+0x76/0xa0 [ 26.319726][ T439] [ 26.325935][ T416] syscall_exit_to_user_mode+0x1d/0x40 [ 26.334088][ T388] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.342330][ T422] Call Trace: [ 26.347377][ T439] RAX: ffffffff843003c7 RBX: ffff888112d75800 RCX: ffff888112ac3c00 [ 26.349650][ T422] pppol2tp_release+0x150/0x2b0 [ 26.356344][ T439] RDX: 0000000000000000 RSI: 000000000a9bfb40 RDI: 000000000c04eb7d [ 26.363462][ T416] do_syscall_64+0x3d/0x40 [ 26.367692][ T439] RBP: ffffc90000e67d88 R08: ffff888112d75883 R09: 1ffff110225aeb10 [ 26.382297][ T422] sock_close+0xb8/0x200 [ 26.394630][ T439] R10: dffffc0000000000 R11: ffffed10225aeb11 R12: dffffc0000000000 [ 26.400224][ T416] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.404255][ T439] R13: dffffc0000000000 R14: 000000000a9bfb40 R15: ffff888112bc2800 [ 26.412317][ T416] RIP: 0033:0x7f5cd421a4d9 [ 26.412327][ T416] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 26.412333][ T416] RSP: 002b:00007ffe76e41988 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 26.412345][ T416] RAX: 0000000000000000 RBX: 00007ffe76e41a70 RCX: 00007f5cd421a4d9 [ 26.412351][ T416] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 26.412357][ T416] RBP: 00000000000064c3 R08: 0000000000000001 R09: 0000000000000000 [ 26.412363][ T416] R10: 0000001b32520000 R11: 0000000000000246 R12: 0000000000000000 [ 26.412370][ T416] R13: 00007f5cd4496fac R14: 00007f5cd4496fa8 R15: 00007f5cd4496fa0 [ 26.412377][ T416] ---[ end trace 5dcea736e5a16992 ]--- [ 26.416787][ T422] ? sock_mmap+0xa0/0xa0 [ 26.424401][ T439] FS: 00005555603bd500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 26.427598][ T422] __fput+0x2dc/0x730 [ 26.430898][ T439] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 26.460056][ T422] ____fput+0x15/0x20 [ 26.469441][ T439] CR2: 00007f860698e6d8 CR3: 00000001128fe000 CR4: 00000000003506a0 [ 26.476639][ T422] task_work_run+0x127/0x190 [ 26.483944][ T439] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 26.495759][ T422] exit_to_user_mode_loop+0xcb/0xe0 [ 26.505643][ T439] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 26.515374][ T422] exit_to_user_mode_prepare+0x76/0xa0 [ 26.522529][ T439] Call Trace: [ 26.529286][ T422] syscall_exit_to_user_mode+0x1d/0x40 [ 26.538574][ T439] pppol2tp_release+0x150/0x2b0 [ 26.549498][ T422] do_syscall_64+0x3d/0x40 [ 26.554980][ T439] sock_close+0xb8/0x200 [ 26.559637][ T422] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.567229][ T439] ? sock_mmap+0xa0/0xa0 [ 26.578787][ T422] RIP: 0033:0x7f678e23d4d9 [ 26.585767][ T439] __fput+0x2dc/0x730 [ 26.589255][ T422] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 26.590530][ T439] ____fput+0x15/0x20 [ 26.594883][ T422] RSP: 002b:00007fff08b81588 EFLAGS: 00000246 [ 26.603009][ T439] task_work_run+0x127/0x190 [ 26.615853][ T422] ORIG_RAX: 00000000000001b4 [ 26.634209][ T439] exit_to_user_mode_loop+0xcb/0xe0 [ 26.647516][ T422] RAX: 0000000000000000 RBX: 00007fff08b81670 RCX: 00007f678e23d4d9 [ 26.648319][ T439] exit_to_user_mode_prepare+0x76/0xa0 [ 26.663184][ T422] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 26.669898][ T439] syscall_exit_to_user_mode+0x1d/0x40 [ 26.675521][ T422] RBP: 00000000000064ed R08: 0000000000000001 R09: 0000000000000000 [ 26.689165][ T439] do_syscall_64+0x3d/0x40 [ 26.699723][ T422] R10: 0000001b32c20000 R11: 0000000000000246 R12: 0000000000000000 [ 26.702822][ T439] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.713480][ T422] R13: 00007f678e4b9fac R14: 00007f678e4b9fa8 R15: 00007f678e4b9fa0 [ 26.723131][ T439] RIP: 0033:0x7fa43bba14d9 [ 26.724886][ T422] ---[ end trace 5dcea736e5a16993 ]--- [ 26.728641][ T439] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 26.763891][ T471] ------------[ cut here ]------------ [ 26.765863][ T439] RSP: 002b:00007ffd5b93b248 EFLAGS: 00000246 [ 26.769401][ T471] WARNING: CPU: 1 PID: 471 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 26.769411][ T471] Modules linked in: [ 26.775945][ T439] ORIG_RAX: 00000000000001b4 [ 26.796548][ T471] [ 26.806385][ T478] ------------[ cut here ]------------ [ 26.809661][ T471] CPU: 1 PID: 471 Comm: syz.6.99 Tainted: G B W syzkaller #0 [ 26.818683][ T439] RAX: 0000000000000000 RBX: 00007ffd5b93b330 RCX: 00007fa43bba14d9 [ 26.822754][ T471] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 26.831843][ T478] WARNING: CPU: 0 PID: 478 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 26.841088][ T471] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 26.851028][ T439] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 26.857161][ T471] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 26.863440][ T439] RBP: 00000000000065db R08: 0000000000000001 R09: 0000000000000000 [ 26.887325][ T471] RSP: 0018:ffffc900013c7d68 EFLAGS: 00010293 [ 26.891030][ T478] Modules linked in: [ 26.901035][ T478] CPU: 0 PID: 478 Comm: syz.0.105 Tainted: G B W syzkaller #0 [ 26.905046][ T471] RAX: ffffffff843003c7 RBX: ffff8881137ef000 RCX: ffff8881134a6400 [ 26.910266][ T439] R10: 0000001b33120000 R11: 0000000000000246 R12: 0000000000000000 [ 26.917967][ T471] RDX: 0000000000000000 RSI: 00000000087970c0 RDI: 000000000c04eb7d [ 26.925925][ T478] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 26.942316][ T471] RBP: ffffc900013c7d88 R08: ffff8881137ef083 R09: 1ffff110226fde10 [ 26.946219][ T439] R13: 00007fa43be1dfac R14: 00007fa43be1dfa8 R15: 00007fa43be1dfa0 [ 26.960210][ T478] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 26.965769][ T471] R10: dffffc0000000000 R11: ffffed10226fde11 R12: dffffc0000000000 [ 26.966972][ T439] ---[ end trace 5dcea736e5a16994 ]--- [ 26.975085][ T471] R13: dffffc0000000000 R14: 00000000087970c0 R15: ffff888113ca2400 [ 26.980336][ T478] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 26.998325][ T471] FS: 000055557eebe500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 27.011617][ T478] RSP: 0018:ffffc900014b7d68 EFLAGS: 00010293 [ 27.017870][ T471] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.025066][ T478] RAX: ffffffff843003c7 RBX: ffff888111e01800 RCX: ffff8881137f5000 [ 27.037619][ T471] CR2: 0000000000000000 CR3: 0000000111481000 CR4: 00000000003506a0 [ 27.037819][ T478] RDX: 0000000000000000 RSI: 00000000133eae20 RDI: 000000000c04eb7d [ 27.046770][ T471] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 27.056113][ T478] RBP: ffffc900014b7d88 R08: ffff888111e01883 R09: 1ffff110223c0310 [ 27.068967][ T471] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 27.072223][ T478] R10: dffffc0000000000 R11: ffffed10223c0311 R12: dffffc0000000000 [ 27.079535][ T471] Call Trace: [ 27.085900][ T478] R13: dffffc0000000000 R14: 00000000133eae20 R15: ffff88811342d400 [ 27.094162][ T471] pppol2tp_release+0x150/0x2b0 [ 27.101034][ T478] FS: 0000555589d1d500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 27.102045][ T471] sock_close+0xb8/0x200 [ 27.112969][ T478] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.121557][ T478] CR2: 00007fa43bdf12f8 CR3: 000000011291c000 CR4: 00000000003506b0 [ 27.131401][ T506] ------------[ cut here ]------------ [ 27.136964][ T471] ? sock_mmap+0xa0/0xa0 [ 27.149038][ T471] __fput+0x2dc/0x730 [ 27.151079][ T506] WARNING: CPU: 0 PID: 506 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 27.157621][ T471] ____fput+0x15/0x20 [ 27.163607][ T478] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 27.175817][ T506] Modules linked in: [ 27.177230][ T471] task_work_run+0x127/0x190 [ 27.180876][ T506] CPU: 0 PID: 506 Comm: syz.2.132 Tainted: G B W syzkaller #0 [ 27.189002][ T471] exit_to_user_mode_loop+0xcb/0xe0 [ 27.193322][ T478] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 27.198241][ T471] exit_to_user_mode_prepare+0x76/0xa0 [ 27.207456][ T506] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 27.218615][ T471] syscall_exit_to_user_mode+0x1d/0x40 [ 27.224289][ T478] Call Trace: [ 27.229229][ T471] do_syscall_64+0x3d/0x40 [ 27.231070][ T478] pppol2tp_release+0x150/0x2b0 [ 27.240955][ T506] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 27.247592][ T478] sock_close+0xb8/0x200 [ 27.251862][ T471] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 27.251871][ T471] RIP: 0033:0x7f5cd421a4d9 [ 27.251881][ T471] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 27.251887][ T471] RSP: 002b:00007ffe76e41988 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 27.251899][ T471] RAX: 0000000000000000 RBX: 00007ffe76e41a70 RCX: 00007f5cd421a4d9 [ 27.251905][ T471] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 27.251910][ T471] RBP: 0000000000006870 R08: 0000000000000001 R09: 0000000000000000 [ 27.251917][ T471] R10: 0000001b32520000 R11: 0000000000000246 R12: 0000000000000000 [ 27.251923][ T471] R13: 00007f5cd4496fac R14: 00007f5cd4496fa8 R15: 00007f5cd4496fa0 [ 27.251931][ T471] ---[ end trace 5dcea736e5a16995 ]--- [ 27.300460][ T506] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 27.307472][ T478] ? sock_mmap+0xa0/0xa0 [ 27.356027][ T506] RSP: 0018:ffffc9000175fd68 EFLAGS: 00010293 [ 27.360747][ T478] __fput+0x2dc/0x730 [ 27.366971][ T506] RAX: ffffffff843003c7 RBX: ffff8881149f1000 RCX: ffff88811483d000 [ 27.370491][ T478] ____fput+0x15/0x20 [ 27.384248][ T478] task_work_run+0x127/0x190 [ 27.388869][ T478] exit_to_user_mode_loop+0xcb/0xe0 [ 27.389101][ T9] device bridge_slave_1 left promiscuous mode [ 27.394305][ T478] exit_to_user_mode_prepare+0x76/0xa0 [ 27.405948][ T478] syscall_exit_to_user_mode+0x1d/0x40 [ 27.411410][ T478] do_syscall_64+0x3d/0x40 [ 27.411492][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.416027][ T506] RDX: 0000000000000000 RSI: 0000000010063440 RDI: 000000000c04eb7d [ 27.431182][ T478] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 27.437535][ T478] RIP: 0033:0x7f678e23d4d9 [ 27.442308][ T506] RBP: ffffc9000175fd88 R08: ffff8881149f1083 R09: 1ffff1102293e210 [ 27.442430][ T9] device bridge_slave_0 left promiscuous mode [ 27.450365][ T506] R10: dffffc0000000000 R11: ffffed102293e211 R12: dffffc0000000000 [ 27.450372][ T506] R13: dffffc0000000000 R14: 0000000010063440 R15: ffff888114d8bc00 [ 27.450380][ T506] FS: 000055555a6c8500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 27.450393][ T506] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.472860][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.491795][ T478] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 27.515690][ T478] RSP: 002b:00007fff08b81588 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 27.524370][ T506] CR2: 0000000000000000 CR3: 0000000111eb2000 CR4: 00000000003506b0 [ 27.532517][ T478] RAX: 0000000000000000 RBX: 00007fff08b81670 RCX: 00007f678e23d4d9 [ 27.540528][ T506] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 27.540621][ T9] device veth1_macvtap left promiscuous mode [ 27.548997][ T478] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 27.562883][ T506] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 27.570877][ T506] Call Trace: [ 27.570958][ T9] device veth0_vlan left promiscuous mode [ 27.574374][ T478] RBP: 00000000000068a0 R08: 0000000000000001 R09: 0000000000000000 [ 27.588022][ T506] pppol2tp_release+0x150/0x2b0 [ 27.593015][ T506] sock_close+0xb8/0x200 [ 27.597254][ T506] ? sock_mmap+0xa0/0xa0 [ 27.601488][ T506] __fput+0x2dc/0x730 [ 27.605691][ T478] R10: 0000001b32c20000 R11: 0000000000000246 R12: 0000000000000000 [ 27.613947][ T506] ____fput+0x15/0x20 [ 27.617933][ T506] task_work_run+0x127/0x190 [ 27.623126][ T478] R13: 00007f678e4b9fac R14: 00007f678e4b9fa8 R15: 00007f678e4b9fa0 [ 27.631130][ T478] ---[ end trace 5dcea736e5a16996 ]--- [ 27.636781][ T506] exit_to_user_mode_loop+0xcb/0xe0 [ 27.642269][ T506] exit_to_user_mode_prepare+0x76/0xa0 [ 27.648757][ T506] syscall_exit_to_user_mode+0x1d/0x40 [ 27.654469][ T506] do_syscall_64+0x3d/0x40 [ 27.658929][ T506] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 27.665041][ T506] RIP: 0033:0x7f860692c4d9 [ 27.669452][ T506] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 27.689432][ T506] RSP: 002b:00007ffd93f38ae8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 27.698219][ T506] RAX: 0000000000000000 RBX: 00007ffd93f38bd0 RCX: 00007f860692c4d9 [ 27.706855][ T506] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 27.714980][ T506] RBP: 00000000000069e5 R08: 0000000000000001 R09: 0000000000000000 [ 27.723191][ T506] R10: 0000001b32e20000 R11: 0000000000000246 R12: 0000000000000000 [ 27.731178][ T506] R13: 00007f8606ba8fac R14: 00007f8606ba8fa8 R15: 00007f8606ba8fa0 [ 27.739412][ T506] ---[ end trace 5dcea736e5a16997 ]--- [ 27.759041][ T518] ------------[ cut here ]------------ [ 27.765686][ T518] WARNING: CPU: 0 PID: 518 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 27.776013][ T518] Modules linked in: [ 27.780277][ T518] CPU: 0 PID: 518 Comm: syz.3.144 Tainted: G B W syzkaller #0 [ 27.789010][ T518] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 27.799689][ T518] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 27.806191][ T518] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 27.826217][ T518] RSP: 0018:ffffc900014dfd68 EFLAGS: 00010293 [ 27.838936][ T532] ------------[ cut here ]------------ [ 27.841132][ T518] RAX: ffffffff843003c7 RBX: ffff88811547c000 RCX: ffff88810f515000 [ 27.847026][ T531] ------------[ cut here ]------------ [ 27.852533][ T532] WARNING: CPU: 0 PID: 532 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 27.857980][ T531] WARNING: CPU: 1 PID: 531 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 27.868306][ T518] RDX: 0000000000000000 RSI: 0000000014b054e0 RDI: 000000000c04eb7d [ 27.882409][ T531] Modules linked in: [ 27.887828][ T532] Modules linked in: [ 27.891115][ T531] CPU: 1 PID: 531 Comm: syz.6.157 Tainted: G B W syzkaller #0 [ 27.895143][ T532] CPU: 0 PID: 532 Comm: syz.2.159 Tainted: G B W syzkaller #0 [ 27.905861][ T531] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 27.912895][ T518] RBP: ffffc900014dfd88 R08: ffff88811547c083 R09: 1ffff11022a8f810 [ 27.922885][ T531] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 27.930588][ T532] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 27.936066][ T531] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 27.947391][ T518] R10: dffffc0000000000 R11: ffffed1022a8f811 R12: dffffc0000000000 [ 27.970827][ T531] RSP: 0018:ffffc90000e27d68 EFLAGS: 00010293 [ 27.974735][ T532] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 27.979622][ T531] RAX: ffffffff843003c7 RBX: ffff888115de8000 RCX: ffff888115cd3c00 [ 27.986093][ T532] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 27.995234][ T531] RDX: 0000000000000000 RSI: 000000002a6bbc40 RDI: 000000000c04eb7d [ 28.015854][ T518] R13: dffffc0000000000 R14: 0000000014b054e0 R15: ffff88811291cc00 [ 28.025246][ T531] RBP: ffffc90000e27d88 R08: ffff888115de8083 R09: 1ffff11022bbd010 [ 28.031939][ T532] RSP: 0018:ffffc9000160fd68 EFLAGS: 00010293 [ 28.039984][ T531] R10: dffffc0000000000 R11: ffffed1022bbd011 R12: dffffc0000000000 [ 28.053449][ T531] R13: dffffc0000000000 R14: 000000002a6bbc40 R15: ffff88811594c400 [ 28.056193][ T518] FS: 000055555d117500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 28.063141][ T531] FS: 000055557eebe500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 28.074505][ T532] RAX: ffffffff843003c7 RBX: ffff888115de8800 RCX: ffff888115cd5000 [ 28.080627][ T531] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 28.094523][ T531] CR2: 0000000000000000 CR3: 000000010e9a4000 CR4: 00000000003506a0 [ 28.103396][ T518] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 28.105344][ T531] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 28.110953][ T532] RDX: 0000000000000000 RSI: 0000000010687dd0 RDI: 000000000c04eb7d [ 28.123571][ T531] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 28.127159][ T518] CR2: 00007f678e48d2f8 CR3: 0000000114fb1000 CR4: 00000000003506b0 [ 28.134329][ T531] Call Trace: [ 28.142277][ T532] RBP: ffffc9000160fd88 R08: ffff888115de8883 R09: 1ffff11022bbd110 [ 28.145765][ T531] pppol2tp_release+0x150/0x2b0 [ 28.153646][ T518] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 28.158429][ T531] sock_close+0xb8/0x200 2026/11/13 17:24:54 executed programs: 166 [ 28.166684][ T518] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 28.170726][ T532] R10: dffffc0000000000 R11: ffffed1022bbd111 R12: dffffc0000000000 [ 28.178884][ T518] Call Trace: [ 28.187430][ T531] ? sock_mmap+0xa0/0xa0 [ 28.190775][ T518] pppol2tp_release+0x150/0x2b0 [ 28.194557][ T532] R13: dffffc0000000000 R14: 0000000010687dd0 R15: ffff88811594f400 [ 28.199426][ T518] sock_close+0xb8/0x200 [ 28.207518][ T531] __fput+0x2dc/0x730 [ 28.211790][ T518] ? sock_mmap+0xa0/0xa0 [ 28.215892][ T531] ____fput+0x15/0x20 [ 28.219901][ T518] __fput+0x2dc/0x730 [ 28.223920][ T532] FS: 000055555a6c8500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 28.236705][ T518] ____fput+0x15/0x20 [ 28.236723][ T518] task_work_run+0x127/0x190 [ 28.240998][ T531] task_work_run+0x127/0x190 [ 28.245806][ T518] exit_to_user_mode_loop+0xcb/0xe0 [ 28.250040][ T531] exit_to_user_mode_loop+0xcb/0xe0 [ 28.258583][ T532] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 28.260341][ T518] exit_to_user_mode_prepare+0x76/0xa0 [ 28.267176][ T532] CR2: 0000000000000000 CR3: 000000012a6bc000 CR4: 00000000003506a0 [ 28.293408][ T532] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 28.296414][ T531] exit_to_user_mode_prepare+0x76/0xa0 [ 28.304661][ T532] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 28.309105][ T531] syscall_exit_to_user_mode+0x1d/0x40 [ 28.320364][ T531] do_syscall_64+0x3d/0x40 [ 28.324954][ T518] syscall_exit_to_user_mode+0x1d/0x40 [ 28.333632][ T567] ------------[ cut here ]------------ [ 28.337591][ T531] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.343603][ T518] do_syscall_64+0x3d/0x40 [ 28.347189][ T531] RIP: 0033:0x7f5cd421a4d9 [ 28.349702][ T532] Call Trace: [ 28.353832][ T531] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 28.353838][ T531] RSP: 002b:00007ffe76e41988 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 28.353850][ T531] RAX: 0000000000000000 RBX: 00007ffe76e41a70 RCX: 00007f5cd421a4d9 [ 28.353855][ T531] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 28.353861][ T531] RBP: 0000000000006ca8 R08: 0000000000000001 R09: 0000000000000000 [ 28.353866][ T531] R10: 0000001b32520000 R11: 0000000000000246 R12: 0000000000000000 [ 28.353872][ T531] R13: 00007f5cd4496fac R14: 00007f5cd4496fa8 R15: 00007f5cd4496fa0 [ 28.353880][ T531] ---[ end trace 5dcea736e5a16998 ]--- [ 28.354710][ T567] WARNING: CPU: 0 PID: 567 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 28.364701][ T518] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.378247][ T567] Modules linked in: [ 28.386837][ T570] ------------[ cut here ]------------ [ 28.401385][ T567] [ 28.401401][ T567] CPU: 0 PID: 567 Comm: syz.0.180 Tainted: G B W syzkaller #0 [ 28.401406][ T567] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 28.401424][ T567] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 28.401441][ T567] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 28.410229][ T518] RIP: 0033:0x7f181dcf94d9 [ 28.417531][ T532] pppol2tp_release+0x150/0x2b0 [ 28.426613][ T570] WARNING: CPU: 1 PID: 570 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 28.433115][ T567] RSP: 0018:ffffc90000f77d68 EFLAGS: 00010293 [ 28.441661][ T518] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 28.447805][ T532] sock_close+0xb8/0x200 [ 28.452397][ T518] RSP: 002b:00007ffc055ee3f8 EFLAGS: 00000246 [ 28.456380][ T567] [ 28.459562][ T518] ORIG_RAX: 00000000000001b4 [ 28.468606][ T532] ? sock_mmap+0xa0/0xa0 [ 28.477742][ T570] Modules linked in: [ 28.487956][ T567] RAX: ffffffff843003c7 RBX: ffff8881163d2000 RCX: ffff888116500000 [ 28.504320][ T518] RAX: 0000000000000000 RBX: 00007ffc055ee4e0 RCX: 00007f181dcf94d9 [ 28.509351][ T532] __fput+0x2dc/0x730 [ 28.514542][ T518] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 28.523026][ T567] RDX: 0000000000000000 RSI: 0000000026da8340 RDI: 000000000c04eb7d [ 28.531788][ T570] [ 28.548902][ T532] ____fput+0x15/0x20 [ 28.555395][ T518] RBP: 0000000000006c58 R08: 0000000000000001 R09: 0000000000000000 [ 28.559473][ T532] task_work_run+0x127/0x190 [ 28.564002][ T518] R10: 0000001b33020000 R11: 0000000000000246 R12: 0000000000000000 [ 28.566585][ T532] exit_to_user_mode_loop+0xcb/0xe0 [ 28.572923][ T518] R13: 00007f181df75fac R14: 00007f181df75fa8 R15: 00007f181df75fa0 [ 28.574434][ T567] RBP: ffffc90000f77d88 R08: ffff8881163d2083 R09: 1ffff11022c7a410 [ 28.584993][ T570] CPU: 1 PID: 570 Comm: syz.6.183 Tainted: G B W syzkaller #0 [ 28.590671][ T532] exit_to_user_mode_prepare+0x76/0xa0 [ 28.595207][ T570] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 28.603796][ T567] R10: dffffc0000000000 R11: ffffed1022c7a411 R12: dffffc0000000000 [ 28.610695][ T518] ---[ end trace 5dcea736e5a16999 ]--- [ 28.614517][ T532] syscall_exit_to_user_mode+0x1d/0x40 [ 28.621084][ T570] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 28.625015][ T567] R13: dffffc0000000000 R14: 0000000026da8340 R15: ffff888113239c00 [ 28.632670][ T570] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 28.638828][ T532] do_syscall_64+0x3d/0x40 [ 28.647199][ T570] RSP: 0018:ffffc90000e67d68 EFLAGS: 00010293 [ 28.650811][ T532] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.659043][ T570] [ 28.668345][ T567] FS: 0000555589d1d500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 28.679754][ T570] RAX: ffffffff843003c7 RBX: ffff88811666d000 RCX: ffff888116896400 [ 28.684127][ T567] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 28.695474][ T570] RDX: 0000000000000000 RSI: 000000001220a800 RDI: 000000000c04eb7d [ 28.696638][ T532] RIP: 0033:0x7f860692c4d9 [ 28.702201][ T570] RBP: ffffc90000e67d88 R08: ffff88811666d083 R09: 1ffff11022ccda10 [ 28.709205][ T532] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 28.724075][ T570] R10: dffffc0000000000 R11: ffffed1022ccda11 R12: dffffc0000000000 [ 28.736124][ T567] CR2: 0000000000000000 CR3: 000000012a680000 CR4: 00000000003506b0 [ 28.741729][ T570] R13: dffffc0000000000 R14: 000000001220a800 R15: ffff888116623c00 [ 28.746554][ T567] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 28.746561][ T567] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 28.746563][ T567] Call Trace: [ 28.746580][ T567] pppol2tp_release+0x150/0x2b0 [ 28.746590][ T567] sock_close+0xb8/0x200 [ 28.746598][ T567] ? sock_mmap+0xa0/0xa0 [ 28.746608][ T567] __fput+0x2dc/0x730 [ 28.746616][ T567] ____fput+0x15/0x20 [ 28.746625][ T567] task_work_run+0x127/0x190 [ 28.746635][ T567] exit_to_user_mode_loop+0xcb/0xe0 [ 28.746643][ T567] exit_to_user_mode_prepare+0x76/0xa0 [ 28.746654][ T567] syscall_exit_to_user_mode+0x1d/0x40 [ 28.746661][ T567] do_syscall_64+0x3d/0x40 [ 28.746671][ T567] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.746678][ T567] RIP: 0033:0x7f678e23d4d9 [ 28.746694][ T567] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 28.756838][ T570] FS: 000055557eebe500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 28.765375][ T532] RSP: 002b:00007ffd93f38ae8 EFLAGS: 00000246 [ 28.788027][ T570] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 28.791243][ T567] RSP: 002b:00007fff08b81588 EFLAGS: 00000246 [ 28.811341][ T570] CR2: 00007f181eaa8060 CR3: 000000012a685000 CR4: 00000000003506a0 [ 28.835174][ T532] ORIG_RAX: 00000000000001b4 [ 28.849188][ T570] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 28.853292][ T567] ORIG_RAX: 00000000000001b4 [ 28.859646][ T570] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 28.863466][ T532] RAX: 0000000000000000 RBX: 00007ffd93f38bd0 RCX: 00007f860692c4d9 [ 28.869663][ T570] Call Trace: [ 28.874989][ T567] RAX: 0000000000000000 RBX: 00007fff08b81670 RCX: 00007f678e23d4d9 [ 28.877194][ T570] pppol2tp_release+0x150/0x2b0 [ 28.884440][ T567] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 28.890631][ T570] sock_close+0xb8/0x200 [ 28.898817][ T532] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 28.901257][ T570] ? sock_mmap+0xa0/0xa0 [ 28.910064][ T567] RBP: 0000000000006e95 R08: 0000000000000001 R09: 0000000000000000 [ 28.917862][ T570] __fput+0x2dc/0x730 [ 28.921292][ T532] RBP: 0000000000006ca7 R08: 0000000000000001 R09: 0000000000000000 [ 28.940872][ T570] ____fput+0x15/0x20 [ 28.950851][ T567] R10: 0000001b32c20000 R11: 0000000000000246 R12: 0000000000000000 [ 28.954864][ T570] task_work_run+0x127/0x190 [ 28.965257][ T567] R13: 00007f678e4b9fac R14: 00007f678e4b9fa8 R15: 00007f678e4b9fa0 [ 28.979379][ T570] exit_to_user_mode_loop+0xcb/0xe0 [ 28.983924][ T567] ---[ end trace 5dcea736e5a1699a ]--- [ 29.002899][ T570] exit_to_user_mode_prepare+0x76/0xa0 [ 29.012770][ T532] R10: 0000001b32e20000 R11: 0000000000000246 R12: 0000000000000000 [ 29.023701][ T570] syscall_exit_to_user_mode+0x1d/0x40 [ 29.034768][ T532] R13: 00007f8606ba8fac R14: 00007f8606ba8fa8 R15: 00007f8606ba8fa0 [ 29.047881][ T570] do_syscall_64+0x3d/0x40 [ 29.051399][ T532] ---[ end trace 5dcea736e5a1699b ]--- [ 29.063410][ T570] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 29.148648][ T570] RIP: 0033:0x7f5cd421a4d9 [ 29.156239][ T570] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 29.177275][ T570] RSP: 002b:00007ffe76e41988 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 29.189894][ T570] RAX: 0000000000000000 RBX: 00007ffe76e41a70 RCX: 00007f5cd421a4d9 [ 29.202578][ T570] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 29.210659][ T570] RBP: 0000000000006eb3 R08: 0000000000000001 R09: 0000000000000000 [ 29.218782][ T570] R10: 0000001b32520000 R11: 0000000000000246 R12: 0000000000000000 [ 29.227496][ T655] ------------[ cut here ]------------ [ 29.228400][ T570] R13: 00007f5cd4496fac R14: 00007f5cd4496fa8 R15: 00007f5cd4496fa0 [ 29.241117][ T655] WARNING: CPU: 0 PID: 655 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 29.243034][ T570] ---[ end trace 5dcea736e5a1699c ]--- [ 29.258955][ T655] Modules linked in: [ 29.267955][ T664] ------------[ cut here ]------------ [ 29.273125][ T655] CPU: 1 PID: 655 Comm: syz.2.268 Tainted: G B W syzkaller #0 [ 29.275357][ T664] WARNING: CPU: 0 PID: 664 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 29.283322][ T655] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 29.308632][ T670] ------------[ cut here ]------------ [ 29.309224][ T655] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 29.317107][ T664] Modules linked in: [ 29.322799][ T655] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 29.326631][ T670] WARNING: CPU: 0 PID: 670 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 29.347668][ T655] RSP: 0018:ffffc900016e7d68 EFLAGS: 00010293 [ 29.360353][ T655] RAX: ffffffff843003c7 RBX: ffff8881161bf000 RCX: ffff888117c6e400 [ 29.363277][ T664] CPU: 0 PID: 664 Comm: syz.3.277 Tainted: G B W syzkaller #0 [ 29.368408][ T655] RDX: 0000000000000000 RSI: 000000002a6bfaa0 RDI: 000000000c04eb7d [ 29.385266][ T664] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 29.389489][ T655] RBP: ffffc900016e7d88 R08: ffff8881161bf083 R09: 1ffff11022c37e10 [ 29.395968][ T664] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 29.406189][ T655] R10: dffffc0000000000 R11: ffffed1022c37e11 R12: dffffc0000000000 [ 29.417444][ T664] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 29.423147][ T655] R13: dffffc0000000000 R14: 000000002a6bfaa0 R15: ffff88811772a400 [ 29.437643][ T670] Modules linked in: [ 29.448214][ T655] FS: 000055555a6c8500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 29.455403][ T664] RSP: 0018:ffffc90001787d68 EFLAGS: 00010293 [ 29.458906][ T655] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.465794][ T670] CPU: 0 PID: 670 Comm: syz.6.284 Tainted: G B W syzkaller #0 [ 29.474054][ T655] CR2: 0000000000000000 CR3: 0000000129150000 CR4: 00000000003506a0 [ 29.482621][ T664] RAX: ffffffff843003c7 RBX: ffff8881160bb000 RCX: ffff888117b39400 [ 29.490617][ T655] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 29.495743][ T670] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 29.505873][ T655] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 29.514189][ T664] RDX: 0000000000000000 RSI: 0000000011cdef00 RDI: 000000000c04eb7d [ 29.524460][ T655] Call Trace: [ 29.534264][ T685] ------------[ cut here ]------------ [ 29.537280][ T655] pppol2tp_release+0x150/0x2b0 [ 29.539828][ T685] WARNING: CPU: 0 PID: 685 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 29.547661][ T655] sock_close+0xb8/0x200 [ 29.555678][ T664] RBP: ffffc90001787d88 R08: ffff8881160bb083 R09: 1ffff11022c17610 [ 29.561001][ T655] ? sock_mmap+0xa0/0xa0 [ 29.567383][ T670] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 29.574670][ T655] __fput+0x2dc/0x730 [ 29.578196][ T664] R10: dffffc0000000000 R11: ffffed1022c17611 R12: dffffc0000000000 [ 29.583624][ T655] ____fput+0x15/0x20 [ 29.591008][ T685] Modules linked in: [ 29.596523][ T655] task_work_run+0x127/0x190 [ 29.598376][ T685] CPU: 0 PID: 685 Comm: syz.0.298 Tainted: G B W syzkaller #0 [ 29.604677][ T655] exit_to_user_mode_loop+0xcb/0xe0 [ 29.611410][ T670] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 29.618790][ T655] exit_to_user_mode_prepare+0x76/0xa0 [ 29.636712][ T685] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 29.643937][ T655] syscall_exit_to_user_mode+0x1d/0x40 [ 29.652800][ T664] R13: dffffc0000000000 R14: 0000000011cdef00 R15: ffff88811772a000 [ 29.660199][ T655] do_syscall_64+0x3d/0x40 [ 29.665808][ T664] FS: 000055555d117500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 29.671615][ T655] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 29.678923][ T685] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 29.687619][ T655] RIP: 0033:0x7f860692c4d9 [ 29.691706][ T670] RSP: 0018:ffffc90001837d68 EFLAGS: 00010293 [ 29.697035][ T655] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 29.701561][ T685] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 29.701567][ T685] RSP: 0018:ffffc900018f7d68 EFLAGS: 00010293 [ 29.722585][ T655] RSP: 002b:00007ffd93f38ae8 EFLAGS: 00000246 [ 29.744109][ T670] RAX: ffffffff843003c7 RBX: ffff8881121b8000 RCX: ffff888117be5000 [ 29.748918][ T655] ORIG_RAX: 00000000000001b4 [ 29.753065][ T664] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.762203][ T655] RAX: 0000000000000000 RBX: 00007ffd93f38bd0 RCX: 00007f860692c4d9 [ 29.768652][ T670] RDX: 0000000000000000 RSI: 0000000011cde100 RDI: 000000000c04eb7d [ 29.773774][ T655] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 29.780353][ T664] CR2: 0000000000000000 CR3: 0000000113426000 CR4: 00000000003506b0 [ 29.801329][ T655] RBP: 0000000000007215 R08: 0000000000000001 R09: 0000000000000000 [ 29.805767][ T670] RBP: ffffc90001837d88 R08: ffff8881121b8083 R09: 1ffff11022437010 [ 29.820878][ T670] R10: dffffc0000000000 R11: ffffed1022437011 R12: dffffc0000000000 [ 29.824143][ T655] R10: 0000001b32e20000 R11: 0000000000000246 R12: 0000000000000000 [ 29.828971][ T670] R13: dffffc0000000000 R14: 0000000011cde100 R15: ffff888112ad6800 [ 29.837435][ T700] ------------[ cut here ]------------ [ 29.845020][ T664] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 29.850878][ T655] R13: 00007f8606ba8fac R14: 00007f8606ba8fa8 R15: 00007f8606ba8fa0 [ 29.858495][ T685] RAX: ffffffff843003c7 RBX: ffff888117c24800 RCX: ffff888125cd3c00 [ 29.867147][ T700] WARNING: CPU: 1 PID: 700 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 29.875273][ T664] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 29.885547][ T655] ---[ end trace 5dcea736e5a1699d ]--- [ 29.892672][ T670] FS: 000055557eebe500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 29.892687][ T670] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.907704][ T700] Modules linked in: [ 29.914183][ T685] RDX: 0000000000000000 RSI: 0000000017f69680 RDI: 000000000c04eb7d [ 29.918120][ T700] [ 29.926068][ T664] Call Trace: [ 29.926083][ T664] pppol2tp_release+0x150/0x2b0 [ 29.926098][ T664] sock_close+0xb8/0x200 [ 29.940837][ T670] CR2: 00007fa43c950060 CR3: 00000001129e6000 CR4: 00000000003506b0 [ 29.944159][ T700] CPU: 1 PID: 700 Comm: syz.4.313 Tainted: G B W syzkaller #0 [ 29.950639][ T685] RBP: ffffc900018f7d88 R08: ffff888117c24883 R09: 1ffff11022f84910 [ 29.957940][ T700] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 29.966428][ T670] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 29.983591][ T664] ? sock_mmap+0xa0/0xa0 [ 29.987864][ T664] __fput+0x2dc/0x730 [ 29.987918][ T700] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 29.991885][ T685] R10: dffffc0000000000 R11: ffffed1022f84911 R12: dffffc0000000000 [ 29.991890][ T685] R13: dffffc0000000000 R14: 0000000017f69680 R15: ffff888117571000 [ 29.991898][ T685] FS: 0000555589d1d500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 29.991904][ T685] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.991909][ T685] CR2: 0000000000000000 CR3: 0000000117fd6000 CR4: 00000000003506b0 [ 29.991918][ T685] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 29.991924][ T685] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 29.991933][ T685] Call Trace: [ 29.991944][ T685] pppol2tp_release+0x150/0x2b0 [ 29.991955][ T685] sock_close+0xb8/0x200 [ 29.991964][ T685] ? sock_mmap+0xa0/0xa0 [ 29.991972][ T685] __fput+0x2dc/0x730 [ 29.991982][ T685] ____fput+0x15/0x20 [ 29.991997][ T685] task_work_run+0x127/0x190 [ 30.009355][ T700] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 30.015954][ T664] ____fput+0x15/0x20 [ 30.026461][ T700] RSP: 0018:ffffc9000188fd68 EFLAGS: 00010293 [ 30.031576][ T670] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 30.040961][ T700] [ 30.046403][ T664] task_work_run+0x127/0x190 [ 30.057464][ T700] RAX: ffffffff843003c7 RBX: ffff888112eb0000 RCX: ffff88812be80000 [ 30.057738][ T664] exit_to_user_mode_loop+0xcb/0xe0 [ 30.064785][ T700] RDX: 0000000000000000 RSI: 000000001548bb60 RDI: 000000000c04eb7d [ 30.066762][ T685] exit_to_user_mode_loop+0xcb/0xe0 [ 30.073411][ T700] RBP: ffffc9000188fd88 R08: ffff888112eb0083 R09: 1ffff110225d6010 [ 30.076025][ T664] exit_to_user_mode_prepare+0x76/0xa0 [ 30.080794][ T700] R10: dffffc0000000000 R11: ffffed10225d6011 R12: dffffc0000000000 [ 30.083534][ T670] Call Trace: [ 30.083550][ T670] pppol2tp_release+0x150/0x2b0 [ 30.083561][ T670] sock_close+0xb8/0x200 [ 30.083569][ T670] ? sock_mmap+0xa0/0xa0 [ 30.083579][ T670] __fput+0x2dc/0x730 [ 30.083589][ T670] ____fput+0x15/0x20 [ 30.083605][ T670] task_work_run+0x127/0x190 [ 30.106046][ T700] R13: dffffc0000000000 R14: 000000001548bb60 R15: ffff88812c668000 [ 30.108292][ T685] exit_to_user_mode_prepare+0x76/0xa0 [ 30.114805][ T700] FS: 00005555603bd500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 30.121804][ T664] syscall_exit_to_user_mode+0x1d/0x40 [ 30.124098][ T700] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 30.128495][ T664] do_syscall_64+0x3d/0x40 [ 30.128506][ T664] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 30.128514][ T664] RIP: 0033:0x7f181dcf94d9 [ 30.128529][ T664] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 30.137112][ T700] CR2: 00007f86076db060 CR3: 000000010bc8a000 CR4: 00000000003506a0 [ 30.143074][ T685] syscall_exit_to_user_mode+0x1d/0x40 [ 30.150149][ T700] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 30.156570][ T670] exit_to_user_mode_loop+0xcb/0xe0 [ 30.164730][ T700] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 30.168885][ T670] exit_to_user_mode_prepare+0x76/0xa0 [ 30.180591][ T700] Call Trace: [ 30.185238][ T685] do_syscall_64+0x3d/0x40 [ 30.193678][ T700] pppol2tp_release+0x150/0x2b0 [ 30.197529][ T664] RSP: 002b:00007ffc055ee3f8 EFLAGS: 00000246 [ 30.204015][ T700] sock_close+0xb8/0x200 [ 30.206007][ T685] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 30.215535][ T700] ? sock_mmap+0xa0/0xa0 [ 30.220476][ T664] ORIG_RAX: 00000000000001b4 [ 30.230904][ T700] __fput+0x2dc/0x730 [ 30.233977][ T670] syscall_exit_to_user_mode+0x1d/0x40 [ 30.242993][ T700] ____fput+0x15/0x20 [ 30.245323][ T685] RIP: 0033:0x7f678e23d4d9 [ 30.252815][ T700] task_work_run+0x127/0x190 [ 30.255212][ T664] RAX: 0000000000000000 RBX: 00007ffc055ee4e0 RCX: 00007f181dcf94d9 [ 30.277337][ T700] exit_to_user_mode_loop+0xcb/0xe0 [ 30.283654][ T685] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 30.291002][ T700] exit_to_user_mode_prepare+0x76/0xa0 [ 30.297284][ T670] do_syscall_64+0x3d/0x40 [ 30.304304][ T700] syscall_exit_to_user_mode+0x1d/0x40 [ 30.310154][ T685] RSP: 002b:00007fff08b81588 EFLAGS: 00000246 [ 30.316238][ T700] do_syscall_64+0x3d/0x40 [ 30.319659][ T670] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 30.323132][ T700] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 30.328791][ T670] RIP: 0033:0x7f5cd421a4d9 [ 30.335499][ T700] RIP: 0033:0x7fa43bba14d9 [ 30.338337][ T685] ORIG_RAX: 00000000000001b4 [ 30.349297][ T700] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 30.354119][ T664] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 30.362429][ T700] RSP: 002b:00007ffd5b93b248 EFLAGS: 00000246 [ 30.364841][ T670] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 30.372091][ T700] ORIG_RAX: 00000000000001b4 [ 30.376032][ T664] RBP: 000000000000723d R08: 0000000000000001 R09: 0000000000000000 [ 30.394192][ T700] RAX: 0000000000000000 RBX: 00007ffd5b93b330 RCX: 00007fa43bba14d9 [ 30.409052][ T685] RAX: 0000000000000000 RBX: 00007fff08b81670 RCX: 00007f678e23d4d9 [ 30.418039][ T700] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 30.419832][ T670] RSP: 002b:00007ffe76e41988 EFLAGS: 00000246 [ 30.425226][ T700] RBP: 000000000000746a R08: 0000000000000001 R09: 0000000000000000 [ 30.431521][ T670] ORIG_RAX: 00000000000001b4 [ 30.442314][ T700] R10: 0000001b33120000 R11: 0000000000000246 R12: 0000000000000000 [ 30.446590][ T685] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 30.456504][ T700] R13: 00007fa43be1dfac R14: 00007fa43be1dfa8 R15: 00007fa43be1dfa0 [ 30.460052][ T685] RBP: 0000000000007347 R08: 0000000000000001 R09: 0000000000000000 [ 30.513856][ T700] ---[ end trace 5dcea736e5a1699e ]--- [ 30.550572][ T664] R10: 0000001b33020000 R11: 0000000000000246 R12: 0000000000000000 [ 30.552059][ T670] RAX: 0000000000000000 RBX: 00007ffe76e41a70 RCX: 00007f5cd421a4d9 [ 30.560952][ T664] R13: 00007f181df75fac R14: 00007f181df75fa8 R15: 00007f181df75fa0 [ 30.565021][ T670] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 30.565027][ T670] RBP: 0000000000007266 R08: 0000000000000001 R09: 0000000000000000 [ 30.565033][ T670] R10: 0000001b32520000 R11: 0000000000000246 R12: 0000000000000000 [ 30.565040][ T670] R13: 00007f5cd4496fac R14: 00007f5cd4496fa8 R15: 00007f5cd4496fa0 [ 30.565052][ T670] ---[ end trace 5dcea736e5a1699f ]--- [ 30.573531][ T664] ---[ end trace 5dcea736e5a169a0 ]--- [ 30.581376][ T685] R10: 0000001b32c20000 R11: 0000000000000246 R12: 0000000000000000 [ 30.683370][ T685] R13: 00007f678e4b9fac R14: 00007f678e4b9fa8 R15: 00007f678e4b9fa0 [ 30.691429][ T685] ---[ end trace 5dcea736e5a169a1 ]--- [ 30.714936][ T775] ------------[ cut here ]------------ [ 30.720459][ T775] WARNING: CPU: 1 PID: 775 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 30.733217][ T775] Modules linked in: [ 30.740388][ T775] CPU: 0 PID: 775 Comm: syz.4.389 Tainted: G B W syzkaller #0 [ 30.759510][ T787] ------------[ cut here ]------------ [ 30.759587][ T785] ------------[ cut here ]------------ [ 30.765037][ T787] refcount_t: underflow; use-after-free. [ 30.776295][ T775] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 30.777894][ T786] ------------[ cut here ]------------ [ 30.787792][ T775] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 30.793702][ T785] WARNING: CPU: 1 PID: 785 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 30.799439][ T787] WARNING: CPU: 0 PID: 787 at lib/refcount.c:28 refcount_warn_saturate+0x120/0x1a0 [ 30.814553][ T785] Modules linked in: [ 30.819827][ T775] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 30.825322][ T786] WARNING: CPU: 1 PID: 786 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 30.841627][ T787] Modules linked in: [ 30.851851][ T775] RSP: 0018:ffffc90001f77d68 EFLAGS: 00010293 [ 30.855490][ T785] CPU: 1 PID: 785 Comm: syz.6.398 Tainted: G B W syzkaller #0 [ 30.856924][ T787] [ 30.861999][ T785] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 30.871678][ T775] [ 30.879354][ T785] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 30.884966][ T775] RAX: ffffffff843003c7 RBX: ffff88811924a800 RCX: ffff88811940d000 [ 30.889039][ T785] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 30.891674][ T775] RDX: 0000000000000000 RSI: 0000000011274b80 RDI: 000000000c04eb7d [ 30.904174][ T786] Modules linked in: [ 30.919772][ T787] CPU: 0 PID: 787 Comm: syz.0.400 Tainted: G B W syzkaller #0 [ 30.932184][ T785] RSP: 0018:ffffc90002197d68 EFLAGS: 00010293 [ 30.940189][ T798] ------------[ cut here ]------------ [ 30.940268][ T787] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 30.946666][ T798] WARNING: CPU: 1 PID: 798 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 30.952051][ T775] RBP: ffffc90001f77d88 R08: ffff88811924a883 R09: 1ffff11023249510 [ 30.961973][ T785] [ 30.972162][ T787] RIP: 0010:refcount_warn_saturate+0x120/0x1a0 [ 30.980127][ T798] Modules linked in: [ 30.982535][ T787] Code: 04 01 48 c7 c7 00 53 40 85 e8 5c 0e 3c 02 0f 0b eb c3 e8 63 80 26 ff c6 05 22 70 82 04 01 48 c7 c7 60 53 40 85 e8 40 0e 3c 02 <0f> 0b eb a7 e8 47 80 26 ff c6 05 03 70 82 04 01 48 c7 c7 80 52 40 [ 30.989309][ T798] [ 30.992662][ T775] R10: dffffc0000000000 R11: ffffed1023249511 R12: dffffc0000000000 [ 31.012390][ T785] RAX: ffffffff843003c7 RBX: ffff888119640000 RCX: ffff8881198cbc00 [ 31.014597][ T786] [ 31.032884][ T785] RDX: 0000000000000000 RSI: 00000000157e94c0 RDI: 000000000c04eb7d [ 31.033154][ T787] RSP: 0018:ffffc90002237d18 EFLAGS: 00010246 [ 31.040848][ T785] RBP: ffffc90002197d88 R08: ffff888119640083 R09: 1ffff110232c8010 [ 31.040859][ T787] [ 31.054971][ T798] CPU: 1 PID: 798 Comm: syz.2.411 Tainted: G B W syzkaller #0 [ 31.057552][ T786] CPU: 0 PID: 786 Comm: syz.3.399 Tainted: G B W syzkaller #0 [ 31.066114][ T785] R10: dffffc0000000000 R11: ffffed10232c8011 R12: dffffc0000000000 [ 31.066121][ T785] R13: dffffc0000000000 R14: 00000000157e94c0 R15: ffff888119611400 [ 31.066130][ T785] FS: 000055557eebe500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 31.066137][ T785] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 31.066143][ T785] CR2: 00007ff77fb8d4d0 CR3: 000000011925c000 CR4: 00000000003506a0 [ 31.066151][ T785] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 31.066156][ T785] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 31.066159][ T785] Call Trace: [ 31.066175][ T785] pppol2tp_release+0x150/0x2b0 [ 31.066185][ T785] sock_close+0xb8/0x200 [ 31.066199][ T785] ? sock_mmap+0xa0/0xa0 [ 31.075294][ T787] RAX: af05c9f67cfbcd00 RBX: 0000000000000003 RCX: ffff888119871400 [ 31.082944][ T798] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 31.091020][ T775] R13: dffffc0000000000 R14: 0000000011274b80 R15: ffff8881193cc000 [ 31.099841][ T785] __fput+0x2dc/0x730 [ 31.106567][ T787] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 31.114520][ T786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 31.122700][ T775] FS: 00005555603bd500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 31.130546][ T798] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 31.133961][ T787] RBP: ffffc90002237d28 R08: ffff8881f7052fff R09: 1ffff1103ee0a5ff [ 31.138617][ T798] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 31.143304][ T775] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 31.147257][ T785] ____fput+0x15/0x20 [ 31.155411][ T787] R10: dffffc0000000000 R11: ffffed103ee0a600 R12: 0000000000000000 [ 31.165371][ T798] RSP: 0018:ffffc90001eb7d68 EFLAGS: 00010293 [ 31.173515][ T786] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 31.177435][ T798] [ 31.185598][ T775] CR2: 0000000000000000 CR3: 0000000117f5d000 CR4: 00000000003506b0 [ 31.195554][ T785] task_work_run+0x127/0x190 [ 31.204596][ T786] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 31.210824][ T785] exit_to_user_mode_loop+0xcb/0xe0 [ 31.219020][ T787] R13: dffffc0000000000 R14: 0000000000000003 R15: 0000000000000000 [ 31.238688][ T775] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 31.245459][ T786] RSP: 0018:ffffc9000209fd68 EFLAGS: 00010293 [ 31.249315][ T798] RAX: ffffffff843003c7 RBX: ffff8881198fc000 RCX: ffff888119a2e400 [ 31.257439][ T787] FS: 0000555589d1d500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 31.263428][ T775] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 31.269879][ T786] [ 31.272082][ T798] RDX: 0000000000000000 RSI: 00000000157e95c0 RDI: 000000000c04eb7d [ 31.280195][ T787] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 31.284681][ T785] exit_to_user_mode_prepare+0x76/0xa0 [ 31.304698][ T786] RAX: ffffffff843003c7 RBX: ffff888119642000 RCX: ffff8881198cd000 [ 31.309581][ T798] RBP: ffffc90001eb7d88 R08: ffff8881198fc083 R09: 1ffff1102331f810 [ 31.317702][ T786] RDX: 0000000000000000 RSI: 0000000018430340 RDI: 000000000c04eb7d [ 31.325865][ T775] Call Trace: [ 31.332571][ T787] CR2: 0000000000000000 CR3: 00000001191f8000 CR4: 00000000003506b0 [ 31.339728][ T798] R10: dffffc0000000000 R11: ffffed102331f811 R12: dffffc0000000000 [ 31.348757][ T786] RBP: ffffc9000209fd88 R08: ffff888119642083 R09: 1ffff110232c8410 [ 31.356548][ T785] syscall_exit_to_user_mode+0x1d/0x40 [ 31.358984][ T787] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 31.366849][ T775] pppol2tp_release+0x150/0x2b0 [ 31.373610][ T786] R10: dffffc0000000000 R11: ffffed10232c8411 R12: dffffc0000000000 [ 31.378959][ T785] do_syscall_64+0x3d/0x40 [ 31.387414][ T787] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 31.396049][ T798] R13: dffffc0000000000 R14: 00000000157e95c0 R15: ffff888119ae3000 [ 31.403219][ T786] R13: dffffc0000000000 R14: 0000000018430340 R15: ffff888119612c00 [ 31.406313][ T775] sock_close+0xb8/0x200 [ 31.414449][ T787] Call Trace: [ 31.422267][ T798] FS: 000055555a6c8500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 31.430469][ T786] FS: 000055555d117500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 31.435739][ T785] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 31.443873][ T787] l2tp_session_put+0xcb/0x1a0 [ 31.448539][ T775] ? sock_mmap+0xa0/0xa0 [ 31.456717][ T786] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 31.460982][ T785] RIP: 0033:0x7f5cd421a4d9 [ 31.469335][ T787] l2tp_session_delete+0x3a9/0x4a0 [ 31.477171][ T798] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 31.485430][ T786] CR2: 0000000000000000 CR3: 0000000114b02000 CR4: 00000000003506b0 [ 31.489415][ T775] __fput+0x2dc/0x730 [ 31.492990][ T786] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 31.501728][ T785] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 31.510957][ T787] pppol2tp_release+0x169/0x2b0 [ 31.516658][ T775] ____fput+0x15/0x20 [ 31.521590][ T787] sock_close+0xb8/0x200 [ 31.525615][ T798] CR2: 00007ff77fb8d4d0 CR3: 00000001194be000 CR4: 00000000003506a0 [ 31.525629][ T798] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 31.532426][ T786] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 31.536651][ T798] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 31.541717][ T786] Call Trace: [ 31.548516][ T775] task_work_run+0x127/0x190 [ 31.556724][ T787] ? sock_mmap+0xa0/0xa0 [ 31.560428][ T785] RSP: 002b:00007ffe76e41988 EFLAGS: 00000246 [ 31.568552][ T787] __fput+0x2dc/0x730 [ 31.588178][ T798] Call Trace: [ 31.609327][ T786] pppol2tp_release+0x150/0x2b0 [ 31.617192][ T775] exit_to_user_mode_loop+0xcb/0xe0 [ 31.617207][ T775] exit_to_user_mode_prepare+0x76/0xa0 [ 31.633196][ T787] ____fput+0x15/0x20 [ 31.633206][ T787] task_work_run+0x127/0x190 [ 31.633215][ T787] exit_to_user_mode_loop+0xcb/0xe0 [ 31.633223][ T787] exit_to_user_mode_prepare+0x76/0xa0 [ 31.633236][ T787] syscall_exit_to_user_mode+0x1d/0x40 [ 31.633244][ T787] do_syscall_64+0x3d/0x40 [ 31.633256][ T787] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 31.633264][ T787] RIP: 0033:0x7f678e23d4d9 [ 31.633273][ T787] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 31.633287][ T787] RSP: 002b:00007fff08b81588 EFLAGS: 00000246 [ 31.636639][ T775] syscall_exit_to_user_mode+0x1d/0x40 [ 31.641231][ T786] sock_close+0xb8/0x200 [ 31.645709][ T775] do_syscall_64+0x3d/0x40 [ 31.651854][ T787] ORIG_RAX: 00000000000001b4 [ 31.655559][ T785] ORIG_RAX: 00000000000001b4 [ 31.658795][ T787] RAX: 0000000000000000 RBX: 00007fff08b81670 RCX: 00007f678e23d4d9 [ 31.663665][ T798] pppol2tp_release+0x150/0x2b0 [ 31.668908][ T786] ? sock_mmap+0xa0/0xa0 [ 31.674350][ T785] RAX: 0000000000000000 RBX: 00007ffe76e41a70 RCX: 00007f5cd421a4d9 [ 31.678260][ T787] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 31.682863][ T775] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 31.688087][ T786] __fput+0x2dc/0x730 [ 31.693521][ T798] sock_close+0xb8/0x200 [ 31.698983][ T787] RBP: 0000000000007811 R08: 0000000000000001 R09: 0000000000000000 [ 31.703658][ T785] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 31.709505][ T787] R10: 0000001b32c20000 R11: 0000000000000246 R12: 0000000000000000 [ 31.713875][ T775] RIP: 0033:0x7fa43bba14d9 [ 31.733567][ T786] ____fput+0x15/0x20 [ 31.739589][ T798] ? sock_mmap+0xa0/0xa0 [ 31.745065][ T786] task_work_run+0x127/0x190 [ 31.749350][ T785] RBP: 000000000000780e R08: 0000000000000001 R09: 0000000000000000 [ 31.753699][ T786] exit_to_user_mode_loop+0xcb/0xe0 [ 31.758387][ T798] __fput+0x2dc/0x730 [ 31.763097][ T787] R13: 00007f678e4b9fac R14: 00007f678e4b9fa8 R15: 00007f678e4b9fa0 [ 31.771105][ T785] R10: 0000001b32520000 R11: 0000000000000246 R12: 0000000000000000 [ 31.775923][ T786] exit_to_user_mode_prepare+0x76/0xa0 [ 31.780170][ T798] ____fput+0x15/0x20 [ 31.788410][ T787] ---[ end trace 5dcea736e5a169a2 ]--- [ 31.796554][ T785] R13: 00007f5cd4496fac R14: 00007f5cd4496fa8 R15: 00007f5cd4496fa0 [ 31.802389][ T786] syscall_exit_to_user_mode+0x1d/0x40 [ 31.806417][ T775] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 31.810576][ T786] do_syscall_64+0x3d/0x40 [ 31.818588][ T785] ---[ end trace 5dcea736e5a169a3 ]--- [ 31.829499][ T786] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 31.834991][ T798] task_work_run+0x127/0x190 [ 31.840793][ T786] RIP: 0033:0x7f181dcf94d9 [ 31.843061][ T775] RSP: 002b:00007ffd5b93b248 EFLAGS: 00000246 [ 31.849501][ T786] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 31.852000][ T798] exit_to_user_mode_loop+0xcb/0xe0 [ 31.861576][ T786] RSP: 002b:00007ffc055ee3f8 EFLAGS: 00000246 [ 31.865523][ T775] ORIG_RAX: 00000000000001b4 [ 31.871512][ T786] ORIG_RAX: 00000000000001b4 [ 31.878072][ T775] RAX: 0000000000000000 RBX: 00007ffd5b93b330 RCX: 00007fa43bba14d9 [ 31.887355][ T786] RAX: 0000000000000000 RBX: 00007ffc055ee4e0 RCX: 00007f181dcf94d9 [ 31.893080][ T798] exit_to_user_mode_prepare+0x76/0xa0 [ 31.898568][ T786] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 31.901108][ T798] syscall_exit_to_user_mode+0x1d/0x40 [ 31.913202][ T786] RBP: 0000000000007820 R08: 0000000000000001 R09: 0000000000000000 [ 31.913763][ T775] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 31.938690][ T786] R10: 0000001b33020000 R11: 0000000000000246 R12: 0000000000000000 [ 31.944709][ T775] RBP: 00000000000077e4 R08: 0000000000000001 R09: 0000000000000000 [ 31.949151][ T798] do_syscall_64+0x3d/0x40 [ 31.953782][ T775] R10: 0000001b33120000 R11: 0000000000000246 R12: 0000000000000000 [ 31.959055][ T786] R13: 00007f181df75fac R14: 00007f181df75fa8 R15: 00007f181df75fa0 [ 31.965488][ T775] R13: 00007fa43be1dfac R14: 00007fa43be1dfa8 R15: 00007fa43be1dfa0 [ 31.986392][ T798] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 31.989706][ T775] ---[ end trace 5dcea736e5a169a4 ]--- [ 31.997101][ T798] RIP: 0033:0x7f860692c4d9 [ 32.000004][ T786] ---[ end trace 5dcea736e5a169a5 ]--- [ 32.004582][ T798] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.140729][ T798] RSP: 002b:00007ffd93f38ae8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 32.151112][ T798] RAX: 0000000000000000 RBX: 00007ffd93f38bd0 RCX: 00007f860692c4d9 [ 32.161335][ T798] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 32.170470][ T798] RBP: 00000000000078be R08: 0000000000000001 R09: 0000000000000000 [ 32.179461][ T798] R10: 0000001b32e20000 R11: 0000000000000246 R12: 0000000000000000 [ 32.187586][ T798] R13: 00007f8606ba8fac R14: 00007f8606ba8fa8 R15: 00007f8606ba8fa0 [ 32.195658][ T798] ---[ end trace 5dcea736e5a169a6 ]--- [ 32.197517][ T822] ------------[ cut here ]------------ [ 32.213064][ T822] WARNING: CPU: 0 PID: 822 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 32.226958][ T822] Modules linked in: [ 32.232216][ T831] ------------[ cut here ]------------ [ 32.232993][ T830] ------------[ cut here ]------------ [ 32.237723][ T831] WARNING: CPU: 0 PID: 831 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 32.246300][ T832] ------------[ cut here ]------------ [ 32.254817][ T822] CPU: 0 PID: 822 Comm: syz.4.437 Tainted: G B W syzkaller #0 [ 32.261976][ T830] WARNING: CPU: 1 PID: 830 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 32.268640][ T831] Modules linked in: [ 32.277327][ T822] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 32.281202][ T832] WARNING: CPU: 1 PID: 832 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 32.281253][ T822] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 32.294164][ T832] Modules linked in: [ 32.303604][ T831] [ 32.311791][ T830] Modules linked in: [ 32.314080][ T831] CPU: 0 PID: 831 Comm: syz.2.446 Tainted: G B W syzkaller #0 [ 32.317699][ T830] CPU: 1 PID: 830 Comm: syz.0.443 Tainted: G B W syzkaller #0 [ 32.326555][ T822] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 32.338413][ T832] [ 32.357106][ T830] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 32.357347][ T831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 32.370523][ T832] CPU: 1 PID: 832 Comm: syz.3.445 Tainted: G B W syzkaller #0 [ 32.377634][ T831] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 32.391204][ T830] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 32.392639][ T822] RSP: 0018:ffffc90002507d68 EFLAGS: 00010293 [ 32.399790][ T830] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 32.404979][ T831] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 32.425471][ T832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 32.446164][ T822] RAX: ffffffff843003c7 RBX: ffff88811999e800 RCX: ffff88810de46400 [ 32.456619][ T830] RSP: 0018:ffffc900025afd68 EFLAGS: 00010293 [ 32.462555][ T822] RDX: 0000000000000000 RSI: 0000000014fcee40 RDI: 000000000c04eb7d [ 32.472817][ T830] RAX: ffffffff843003c7 RBX: ffff88811999c800 RCX: ffff888119450000 [ 32.476591][ T822] RBP: ffffc90002507d88 R08: ffff88811999e883 R09: 1ffff11023333d10 [ 32.488285][ T830] RDX: 0000000000000000 RSI: 000000001861b300 RDI: 000000000c04eb7d [ 32.492503][ T831] RSP: 0018:ffffc9000257fd68 EFLAGS: 00010293 [ 32.504379][ T832] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 32.506842][ T822] R10: dffffc0000000000 R11: ffffed1023333d11 R12: dffffc0000000000 [ 32.517053][ T830] RBP: ffffc900025afd88 R08: ffff88811999c883 R09: 1ffff11023333910 [ 32.522863][ T831] RAX: ffffffff843003c7 RBX: ffff888119a6b000 RCX: ffff888119453c00 [ 32.533864][ T832] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 32.536953][ T822] R13: dffffc0000000000 R14: 0000000014fcee40 R15: ffff888119b0e000 [ 32.556304][ T830] R10: dffffc0000000000 R11: ffffed1023333911 R12: dffffc0000000000 [ 32.565844][ T831] RDX: 0000000000000000 RSI: 000000001980c320 RDI: 000000000c04eb7d [ 32.573662][ T832] RSP: 0018:ffffc9000264fd68 EFLAGS: 00010293 [ 32.584446][ T831] RBP: ffffc9000257fd88 R08: ffff888119a6b083 R09: 1ffff1102334d610 [ 32.586800][ T830] R13: dffffc0000000000 R14: 000000001861b300 R15: ffff888119b0f800 [ 32.595192][ T822] FS: 00005555603bd500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 32.603595][ T832] RAX: ffffffff843003c7 RBX: ffff88811999b000 RCX: ffff888119455000 [ 32.611563][ T831] R10: dffffc0000000000 R11: ffffed102334d611 R12: dffffc0000000000 [ 32.620209][ T830] FS: 0000555589d1d500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 32.629194][ T822] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.637245][ T832] RDX: 0000000000000000 RSI: 0000000014aef1a8 RDI: 000000000c04eb7d [ 32.643927][ T831] R13: dffffc0000000000 R14: 000000001980c320 R15: ffff888119696400 [ 32.652154][ T832] RBP: ffffc9000264fd88 R08: ffff88811999b083 R09: 1ffff11023333610 [ 32.659185][ T822] CR2: 00007f5cd4fc9060 CR3: 00000001196c2000 CR4: 00000000003506b0 [ 32.667777][ T830] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.681405][ T832] R10: dffffc0000000000 R11: ffffed1023333611 R12: dffffc0000000000 [ 32.689522][ T831] FS: 000055555a6c8500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 32.689793][ T830] CR2: 0000000000000000 CR3: 0000000119f37000 CR4: 00000000003506a0 [ 32.706624][ T822] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 32.707851][ T832] R13: dffffc0000000000 R14: 0000000014aef1a8 R15: ffff88811a019800 [ 32.714880][ T831] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.723804][ T830] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 32.730942][ T822] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 32.738306][ T832] FS: 000055555d117500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 32.746336][ T822] Call Trace: [ 32.755769][ T830] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 32.757912][ T831] CR2: 000055557eed9908 CR3: 0000000119d42000 CR4: 00000000003506b0 [ 32.766566][ T832] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.775749][ T822] pppol2tp_release+0x150/0x2b0 [ 32.780640][ T830] Call Trace: [ 32.785994][ T831] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 32.789931][ T832] CR2: 0000000000000000 CR3: 000000010c6ca000 CR4: 00000000003506a0 [ 32.796762][ T822] sock_close+0xb8/0x200 [ 32.805735][ T830] pppol2tp_release+0x150/0x2b0 [ 32.810556][ T831] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 32.813853][ T830] sock_close+0xb8/0x200 [ 32.822563][ T822] ? sock_mmap+0xa0/0xa0 [ 32.827995][ T832] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 32.830209][ T822] __fput+0x2dc/0x730 [ 32.839145][ T832] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 32.844036][ T831] Call Trace: [ 32.850635][ T830] ? sock_mmap+0xa0/0xa0 [ 32.857784][ T822] ____fput+0x15/0x20 [ 32.861980][ T822] task_work_run+0x127/0x190 [ 32.862963][ T830] __fput+0x2dc/0x730 [ 32.866648][ T822] exit_to_user_mode_loop+0xcb/0xe0 [ 32.875330][ T830] ____fput+0x15/0x20 [ 32.876207][ T831] pppol2tp_release+0x150/0x2b0 [ 32.879721][ T832] Call Trace: [ 32.884809][ T822] exit_to_user_mode_prepare+0x76/0xa0 [ 32.887869][ T830] task_work_run+0x127/0x190 [ 32.893676][ T831] sock_close+0xb8/0x200 [ 32.899996][ T832] pppol2tp_release+0x150/0x2b0 [ 32.907314][ T832] sock_close+0xb8/0x200 [ 32.908199][ T822] syscall_exit_to_user_mode+0x1d/0x40 [ 32.912942][ T830] exit_to_user_mode_loop+0xcb/0xe0 [ 32.917329][ T831] ? sock_mmap+0xa0/0xa0 [ 32.923123][ T832] ? sock_mmap+0xa0/0xa0 [ 32.926840][ T831] __fput+0x2dc/0x730 [ 32.930672][ T832] __fput+0x2dc/0x730 [ 32.930682][ T832] ____fput+0x15/0x20 [ 32.930691][ T832] task_work_run+0x127/0x190 [ 32.930706][ T832] exit_to_user_mode_loop+0xcb/0xe0 [ 32.935159][ T822] do_syscall_64+0x3d/0x40 [ 32.938824][ T830] exit_to_user_mode_prepare+0x76/0xa0 [ 32.942951][ T831] ____fput+0x15/0x20 [ 32.950371][ T830] syscall_exit_to_user_mode+0x1d/0x40 [ 32.953430][ T822] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 32.960071][ T830] do_syscall_64+0x3d/0x40 [ 32.963350][ T831] task_work_run+0x127/0x190 [ 32.967468][ T832] exit_to_user_mode_prepare+0x76/0xa0 [ 32.973537][ T822] RIP: 0033:0x7fa43bba14d9 [ 32.978458][ T830] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 32.983824][ T822] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.988867][ T830] RIP: 0033:0x7f678e23d4d9 [ 32.992989][ T831] exit_to_user_mode_loop+0xcb/0xe0 [ 32.999286][ T830] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 33.003271][ T822] RSP: 002b:00007ffd5b93b248 EFLAGS: 00000246 [ 33.025088][ T832] syscall_exit_to_user_mode+0x1d/0x40 [ 33.028353][ T831] exit_to_user_mode_prepare+0x76/0xa0 [ 33.034361][ T832] do_syscall_64+0x3d/0x40 [ 33.052311][ T822] ORIG_RAX: 00000000000001b4 [ 33.060566][ T830] RSP: 002b:00007fff08b81588 EFLAGS: 00000246 [ 33.063838][ T822] RAX: 0000000000000000 RBX: 00007ffd5b93b330 RCX: 00007fa43bba14d9 [ 33.070367][ T832] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 33.075090][ T831] syscall_exit_to_user_mode+0x1d/0x40 [ 33.078499][ T832] RIP: 0033:0x7f181dcf94d9 [ 33.085488][ T822] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 33.095978][ T830] ORIG_RAX: 00000000000001b4 [ 33.098632][ T831] do_syscall_64+0x3d/0x40 [ 33.108444][ T830] RAX: 0000000000000000 RBX: 00007fff08b81670 RCX: 00007f678e23d4d9 [ 33.116488][ T822] RBP: 0000000000007daf R08: 0000000000000001 R09: 0000000000000000 [ 33.125120][ T832] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 33.126305][ T822] R10: 0000001b33120000 R11: 0000000000000246 R12: 0000000000000000 [ 33.137674][ T832] RSP: 002b:00007ffc055ee3f8 EFLAGS: 00000246 [ 33.141635][ T831] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 33.165359][ T830] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 2026/11/13 17:24:59 executed programs: 474 [ 33.169206][ T822] R13: 00007fa43be1dfac R14: 00007fa43be1dfa8 R15: 00007fa43be1dfa0 [ 33.179550][ T830] RBP: 0000000000007dcb R08: 0000000000000001 R09: 0000000000000000 [ 33.181127][ T822] ---[ end trace 5dcea736e5a169a7 ]--- [ 33.193387][ T832] ORIG_RAX: 00000000000001b4 [ 33.198135][ T831] RIP: 0033:0x7f860692c4d9 [ 33.210146][ T830] R10: 0000001b32c20000 R11: 0000000000000246 R12: 0000000000000000 [ 33.222252][ T831] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 33.231025][ T832] RAX: 0000000000000000 RBX: 00007ffc055ee4e0 RCX: 00007f181dcf94d9 [ 33.251240][ T831] RSP: 002b:00007ffd93f38ae8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 33.263375][ T830] R13: 00007f678e4b9fac R14: 00007f678e4b9fa8 R15: 00007f678e4b9fa0 [ 33.265015][ T831] RAX: 0000000000000000 RBX: 00007ffd93f38bd0 RCX: 00007f860692c4d9 [ 33.275652][ T832] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 33.282807][ T831] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 33.288550][ T830] ---[ end trace 5dcea736e5a169a8 ]--- [ 33.296607][ T831] RBP: 0000000000007dd1 R08: 0000000000000001 R09: 0000000000000000 [ 33.306404][ T832] RBP: 0000000000007dd0 R08: 0000000000000001 R09: 0000000000000000 [ 33.321306][ T831] R10: 0000001b32e20000 R11: 0000000000000246 R12: 0000000000000000 [ 33.328205][ T832] R10: 0000001b33020000 R11: 0000000000000246 R12: 0000000000000000 [ 33.332129][ T831] R13: 00007f8606ba8fac R14: 00007f8606ba8fa8 R15: 00007f8606ba8fa0 [ 33.343334][ T832] R13: 00007f181df75fac R14: 00007f181df75fa8 R15: 00007f181df75fa0 [ 33.349466][ T831] ---[ end trace 5dcea736e5a169a9 ]--- [ 33.355627][ T832] ---[ end trace 5dcea736e5a169aa ]--- [ 33.371960][ T891] ------------[ cut here ]------------ [ 33.377529][ T891] WARNING: CPU: 1 PID: 891 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 33.387892][ T891] Modules linked in: [ 33.393947][ T891] CPU: 1 PID: 891 Comm: syz.6.504 Tainted: G B W syzkaller #0 [ 33.403263][ T891] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 33.413685][ T891] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 33.425225][ T904] ------------[ cut here ]------------ [ 33.430703][ T891] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 33.430719][ T891] RSP: 0018:ffffc90002b3fd68 EFLAGS: 00010293 [ 33.459104][ T909] ------------[ cut here ]------------ [ 33.462855][ T891] [ 33.467434][ T909] WARNING: CPU: 1 PID: 909 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 33.480830][ T891] RAX: ffffffff843003c7 RBX: ffff88811b088000 RCX: ffff88811af81400 [ 33.483291][ T909] Modules linked in: [ 33.498973][ T917] ------------[ cut here ]------------ [ 33.499514][ T891] RDX: 0000000000000000 RSI: 000000001b085500 RDI: 000000000c04eb7d [ 33.504576][ T904] WARNING: CPU: 1 PID: 904 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 33.504580][ T904] Modules linked in: [ 33.504596][ T904] CPU: 1 PID: 904 Comm: syz.2.517 Tainted: G B W syzkaller #0 [ 33.504602][ T904] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 33.504612][ T904] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 33.504627][ T904] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 33.517623][ T891] RBP: ffffc90002b3fd88 R08: ffff88811b088083 R09: 1ffff11023611010 [ 33.522861][ T917] WARNING: CPU: 1 PID: 917 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 33.530834][ T891] R10: dffffc0000000000 R11: ffffed1023611011 R12: dffffc0000000000 [ 33.535167][ T909] CPU: 1 PID: 909 Comm: syz.4.524 Tainted: G B W syzkaller #0 [ 33.535181][ T909] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 33.548876][ T891] R13: dffffc0000000000 R14: 000000001b085500 R15: ffff88811a954400 [ 33.553879][ T917] Modules linked in: [ 33.591824][ T891] FS: 000055557eebe500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 33.597651][ T904] RSP: 0018:ffffc90002b7fd68 EFLAGS: 00010293 [ 33.622352][ T891] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 33.624323][ T909] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 33.633266][ T891] CR2: 0000000000000000 CR3: 000000011a24e000 CR4: 00000000003506b0 [ 33.637131][ T909] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 33.655398][ T891] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 33.656205][ T904] [ 33.672676][ T891] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 33.683889][ T917] [ 33.704513][ T909] RSP: 0018:ffffc900029f7d68 EFLAGS: 00010293 [ 33.710604][ T909] RAX: ffffffff843003c7 RBX: ffff88811b089800 RCX: ffff88811af86400 [ 33.716724][ T891] Call Trace: [ 33.718644][ T904] RAX: ffffffff843003c7 RBX: ffff88811b08c000 RCX: ffff88811b05d000 [ 33.729842][ T904] RDX: 0000000000000000 RSI: 00000000198b48c0 RDI: 000000000c04eb7d [ 33.737892][ T917] CPU: 1 PID: 917 Comm: syz.3.530 Tainted: G B W syzkaller #0 [ 33.739399][ T891] pppol2tp_release+0x150/0x2b0 [ 33.746534][ T909] RDX: 0000000000000000 RSI: 00000000198b42e0 RDI: 000000000c04eb7d [ 33.746541][ T909] RBP: ffffc900029f7d88 R08: ffff88811b089883 R09: 1ffff11023611310 [ 33.746547][ T909] R10: dffffc0000000000 R11: ffffed1023611311 R12: dffffc0000000000 [ 33.746554][ T909] R13: dffffc0000000000 R14: 00000000198b42e0 R15: ffff88811c389000 [ 33.746570][ T909] FS: 00005555603bd500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 33.759420][ T891] sock_close+0xb8/0x200 [ 33.768617][ T904] RBP: ffffc90002b7fd88 R08: ffff88811b08c083 R09: 1ffff11023611810 [ 33.775541][ T891] ? sock_mmap+0xa0/0xa0 [ 33.784660][ T917] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 33.805387][ T891] __fput+0x2dc/0x730 [ 33.809368][ T909] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 33.829910][ T904] R10: dffffc0000000000 R11: ffffed1023611811 R12: dffffc0000000000 [ 33.833185][ T891] ____fput+0x15/0x20 [ 33.838106][ T917] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 33.843479][ T950] ------------[ cut here ]------------ [ 33.848322][ T904] R13: dffffc0000000000 R14: 00000000198b48c0 R15: ffff88811a957c00 [ 33.854139][ T891] task_work_run+0x127/0x190 [ 33.861868][ T917] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 33.866488][ T950] WARNING: CPU: 0 PID: 950 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 33.886010][ T909] CR2: 0000000000000000 CR3: 0000000119cf0000 CR4: 00000000003506a0 [ 33.896682][ T891] exit_to_user_mode_loop+0xcb/0xe0 [ 33.904090][ T904] FS: 000055555a6c8500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 33.909214][ T891] exit_to_user_mode_prepare+0x76/0xa0 [ 33.918205][ T909] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 33.923712][ T950] Modules linked in: [ 33.931720][ T904] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 33.935631][ T891] syscall_exit_to_user_mode+0x1d/0x40 [ 33.942108][ T909] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 33.942117][ T909] Call Trace: [ 33.947655][ T950] CPU: 0 PID: 950 Comm: syz.0.563 Tainted: G B W syzkaller #0 [ 33.955855][ T917] RSP: 0018:ffffc90002ca7d68 EFLAGS: 00010293 [ 33.958897][ T891] do_syscall_64+0x3d/0x40 [ 33.967516][ T904] CR2: 0000000000000000 CR3: 000000011ad1f000 CR4: 00000000003506a0 [ 33.973589][ T950] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 33.978053][ T909] pppol2tp_release+0x150/0x2b0 [ 33.985957][ T891] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 33.996122][ T904] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 34.000903][ T950] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 34.006829][ T904] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 34.014767][ T917] [ 34.021175][ T909] sock_close+0xb8/0x200 [ 34.029095][ T950] Code: 5d c3 e8 7c b3 34 fd be 02 00 00 00 eb 0a e8 70 b3 34 fd be 01 00 00 00 4c 89 f7 e8 f3 31 0e fe e9 0f ff ff ff e8 59 b3 34 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 48 b3 34 fd 4c 89 f7 be 03 [ 34.031673][ T904] Call Trace: [ 34.035661][ T891] RIP: 0033:0x7f5cd421a4d9 [ 34.055536][ T909] ? sock_mmap+0xa0/0xa0 [ 34.058600][ T917] RAX: ffffffff843003c7 RBX: ffff88811b08d000 RCX: ffff88811af82800 [ 34.063124][ T909] __fput+0x2dc/0x730 [ 34.067263][ T950] RSP: 0018:ffffc90002db7d68 EFLAGS: 00010293 [ 34.075360][ T909] ____fput+0x15/0x20 [ 34.079208][ T917] RDX: 0000000000000000 RSI: 00000000198b4540 RDI: 000000000c04eb7d [ 34.085468][ T904] pppol2tp_release+0x150/0x2b0 [ 34.089244][ T950] [ 34.097385][ T909] task_work_run+0x127/0x190 [ 34.102103][ T891] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.104498][ T909] exit_to_user_mode_loop+0xcb/0xe0 [ 34.108939][ T891] RSP: 002b:00007ffe76e41988 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 34.108951][ T891] RAX: 0000000000000000 RBX: 00007ffe76e41a70 RCX: 00007f5cd421a4d9 [ 34.108964][ T891] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 34.128806][ T904] sock_close+0xb8/0x200 [ 34.133783][ T917] RBP: ffffc90002ca7d88 R08: ffff88811b08d083 R09: 1ffff11023611a10 [ 34.142404][ T904] ? sock_mmap+0xa0/0xa0 [ 34.150247][ T950] RAX: ffffffff843003c7 RBX: ffff88811c6e4000 RCX: ffff88811c7c3c00 [ 34.158375][ T909] exit_to_user_mode_prepare+0x76/0xa0 [ 34.162464][ T950] RDX: 0000000000000000 RSI: 000000000ef5f000 RDI: 000000000c04eb7d [ 34.170575][ T904] __fput+0x2dc/0x730 [ 34.174672][ T891] RBP: 0000000000008245 R08: 0000000000000001 R09: 0000000000000000 [ 34.182886][ T909] syscall_exit_to_user_mode+0x1d/0x40 [ 34.188122][ T917] R10: dffffc0000000000 R11: ffffed1023611a11 R12: dffffc0000000000 [ 34.196220][ T904] ____fput+0x15/0x20 [ 34.200108][ T950] RBP: ffffc90002db7d88 R08: ffff88811c6e4083 R09: 1ffff110238dc810 [ 34.208250][ T909] do_syscall_64+0x3d/0x40 [ 34.213560][ T891] R10: 0000001b32520000 R11: 0000000000000246 R12: 0000000000000000 [ 34.221660][ T904] task_work_run+0x127/0x190 [ 34.225463][ T917] R13: dffffc0000000000 R14: 00000000198b4540 R15: ffff88811c354400 [ 34.233629][ T909] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 34.237823][ T950] R10: dffffc0000000000 R11: ffffed10238dc811 R12: dffffc0000000000 [ 34.245981][ T904] exit_to_user_mode_loop+0xcb/0xe0 [ 34.250404][ T891] R13: 00007f5cd4496fac R14: 00007f5cd4496fa8 R15: 00007f5cd4496fa0 [ 34.258532][ T909] RIP: 0033:0x7fa43bba14d9 [ 34.272256][ T917] FS: 000055555d117500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 34.272264][ T917] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 34.272276][ T917] CR2: 0000000000000000 CR3: 0000000117f51000 CR4: 00000000003506b0 [ 34.277806][ T904] exit_to_user_mode_prepare+0x76/0xa0 [ 34.298769][ T950] R13: dffffc0000000000 R14: 000000000ef5f000 R15: ffff888110d5a400 [ 34.298778][ T950] FS: 0000555589d1d500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 34.298784][ T950] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 34.298797][ T950] CR2: 0000000000000000 CR3: 000000010ed8f000 CR4: 00000000003506b0 [ 34.305672][ T909] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.313371][ T891] ---[ end trace 5dcea736e5a169ab ]--- [ 34.319051][ T909] RSP: 002b:00007ffd5b93b248 EFLAGS: 00000246 [ 34.326868][ T917] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 34.336020][ T904] syscall_exit_to_user_mode+0x1d/0x40 [ 34.354316][ T950] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 34.371447][ T909] ORIG_RAX: 00000000000001b4 [ 34.375576][ T917] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 34.382766][ T909] RAX: 0000000000000000 RBX: 00007ffd5b93b330 RCX: 00007fa43bba14d9 [ 34.400781][ T917] Call Trace: [ 34.403355][ T904] do_syscall_64+0x3d/0x40 [ 34.412642][ T917] pppol2tp_release+0x150/0x2b0 [ 34.416178][ T909] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 34.424579][ T955] ------------[ cut here ]------------