last executing test programs: 364.989305ms ago: executing program 2 (id=3): r0 = creat(&(0x7f00000000c0)='./file0\x00', 0xdafbe5d6891b6e4) write$binfmt_elf32(r0, &(0x7f00000005c0)={{0x7f, 0x45, 0x4c, 0x46, 0x80, 0xd, 0x4, 0x0, 0x100020001, 0x2, 0x6, 0x1, 0xdd, 0x38, 0x345, 0x8, 0x5, 0x20, 0x1, 0x5, 0x9, 0x100}, [{0x3, 0x4, 0x5, 0x6, 0x80, 0x6, 0x2, 0x5ba2}], "", ['\x00']}, 0x158) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000180)='./file0\x00', 0x8) close(r0) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 354.355547ms ago: executing program 0 (id=1): fstat(0xffffffffffffffff, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x4000000000000, 0x40, &(0x7f0000000640)=@raw={'raw\x00', 0x41, 0x3, 0x378, 0x0, 0x0, 0x0, 0x240, 0x0, 0x318, 0x1f0, 0x1f0, 0x318, 0x1f0, 0x3, 0x0, {[{{@ip={@multicast1, @empty, 0x0, 0xff, 'macvlan1\x00', 'wg1\x00', {}, {}, 0x6}, 0x0, 0x1c0, 0x208, 0x0, {0x0, 0xffffffffa0028000}, [@common=@inet=@hashlimit2={{0x150}, {'tunl0\x00', {0x4, 0x9b8b, 0x10, 0x1, 0xffffffff, 0x10000, 0xf0df, 0x20}, {0xae6b5d1}}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x6, 0x3, 0x1, 'pptp\x00', {0x80}}}}, {{@ip={@private=0xa010100, @rand_addr=0x64010101, 0xffffff00, 0x0, 'pim6reg\x00', 'bridge_slave_1\x00', {0xff}, {0x101}, 0x6, 0x2}, 0x0, 0x70, 0xd8}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x2, 0x9, 0x7, 'pptp\x00', 'syz1\x00', {0xb98}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x3d8) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f0000000380)='sysfs\x00', 0x10000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/class/net/bridge0/bridge/multicast_snooping\x00', 0x1, 0x0) write$cgroup_pid(r0, &(0x7f0000002440), 0x12) 350.750037ms ago: executing program 3 (id=4): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = fsopen(&(0x7f00000001c0)='bpf\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x1, 0xd) fchdir(r1) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) 323.152993ms ago: executing program 3 (id=6): r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x268}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) munmap(&(0x7f0000cc7000/0x2000)=nil, 0x2000) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa07, 0x0) 296.621167ms ago: executing program 2 (id=7): ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) r0 = fsopen(&(0x7f0000000080)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x8) r2 = openat$cgroup_ro(r1, &(0x7f0000000240)='cgroup.controllers\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f0000004000)={0x2020}, 0x2020) 271.274452ms ago: executing program 2 (id=8): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0x1bc, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {}, {0xffffffffffffffff, 0x0, 0x0, 0x17ffffffffffb}, 0x40}, [@tmpl={0x104, 0x5, [{{@in6=@private1, 0x0, 0x3c}, 0x0, @in=@broadcast}, {{@in=@initdev={0xac, 0x1e, 0xfc, 0x0}, 0x0, 0x3c}, 0x0, @in6=@dev={0xfe, 0x80, '\x00', 0x1}}, {{@in6=@mcast1, 0x0, 0x6c}, 0x0, @in=@remote, 0x0, 0x1}, {{@in=@rand_addr=0x64010101, 0x0, 0x6c}, 0x0, @in=@local, 0x0, 0x0, 0x2}]}]}, 0x1bc}}, 0x0) r0 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4ea3, 0xe3, @mcast2, 0x9}, 0x1c) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000019200)=@raw={'raw\x00', 0x8, 0x3, 0x4d8, 0x180, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x408, 0xffffffff, 0xffffffff, 0x408, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@loopback, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x158, 0x180, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@iprange={{0x68}, {@ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @ipv4=@multicast2, @ipv6=@loopback, @ipv6=@empty}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x538) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x952f, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0xff8a}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 259.288394ms ago: executing program 4 (id=5): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) syz_mount_image$vfat(&(0x7f0000000300), &(0x7f0000000280)='./bus\x00', 0x3c9c9b, 0x0, 0x0, 0x0, &(0x7f0000000140)) mount$overlay(0x0, &(0x7f0000000580)='./file0\x00', &(0x7f0000000b80), 0x4008, &(0x7f00000002c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000400)='./file0/file1\x00', 0x40, 0x83) fcntl$setstatus(r0, 0x4, 0x76800) fsync(r0) 218.783341ms ago: executing program 4 (id=9): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001c40)={0x8, 0x3, &(0x7f0000001300)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000001200)='syzkaller\x00'}, 0x80) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x80) prlimit64(0x0, 0x7, &(0x7f0000000040)={0x0, 0x100}, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000003c0)={r0, r2}, 0x10) 179.843058ms ago: executing program 0 (id=10): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB="0900000004000000080000000a"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0xb, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000200000000000000000850000002a0000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r0}, &(0x7f0000000040), &(0x7f0000000080)=r1}, 0x20) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 128.383117ms ago: executing program 1 (id=2): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x8004745a, 0x0) 75.604186ms ago: executing program 1 (id=11): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x80782, 0x0) ioctl$TCXONC(r0, 0x540a, 0x2) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000000)) r1 = ioctl$TIOCGPTPEER(r0, 0x5441, 0x6) write(r1, &(0x7f0000000180)='g', 0x1) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000140)={0x7, 0x3, 0x6, 0x7fff, 0x17, "ee1dd756f560f25a63b2f119c3439425ea59d8"}) 0s ago: executing program 1 (id=12): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f0000000380)=ANY=[@ANYBLOB="000081000100000000003d00"], 0x4e) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.11' (ED25519) to the list of known hosts. [ 21.636371][ T30] audit: type=1400 audit(1790938915.167:64): avc: denied { mounton } for pid=277 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.637440][ T277] cgroup: Unknown subsys name 'net' [ 21.660482][ T30] audit: type=1400 audit(1790938915.167:65): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.688739][ T30] audit: type=1400 audit(1790938915.197:66): avc: denied { unmount } for pid=277 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.688936][ T277] cgroup: Unknown subsys name 'devices' [ 21.806096][ T277] cgroup: Unknown subsys name 'hugetlb' [ 21.812540][ T277] cgroup: Unknown subsys name 'rlimit' [ 21.918155][ T30] audit: type=1400 audit(1790938915.447:67): avc: denied { setattr } for pid=277 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.942144][ T30] audit: type=1400 audit(1790938915.447:68): avc: denied { mounton } for pid=277 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 21.967808][ T30] audit: type=1400 audit(1790938915.447:69): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.968803][ T279] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.000688][ T30] audit: type=1400 audit(1790938915.527:70): avc: denied { relabelto } for pid=279 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.014994][ T277] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.027240][ T30] audit: type=1400 audit(1790938915.527:71): avc: denied { write } for pid=279 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.062999][ T30] audit: type=1400 audit(1790938915.527:72): avc: denied { read } for pid=277 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.089233][ T30] audit: type=1400 audit(1790938915.527:73): avc: denied { open } for pid=277 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.792373][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.801520][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.809202][ T285] device bridge_slave_0 entered promiscuous mode [ 22.829388][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.837214][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.845712][ T285] device bridge_slave_1 entered promiscuous mode [ 22.865292][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.872908][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.880733][ T286] device bridge_slave_0 entered promiscuous mode [ 22.887870][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.894952][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.902491][ T286] device bridge_slave_1 entered promiscuous mode [ 22.909215][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.916469][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.924336][ T287] device bridge_slave_0 entered promiscuous mode [ 22.933773][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.941358][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.949272][ T287] device bridge_slave_1 entered promiscuous mode [ 23.026451][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.033945][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.041481][ T288] device bridge_slave_0 entered promiscuous mode [ 23.048532][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.056062][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.064492][ T289] device bridge_slave_0 entered promiscuous mode [ 23.073707][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.081120][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.089162][ T289] device bridge_slave_1 entered promiscuous mode [ 23.105258][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.112496][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.120258][ T288] device bridge_slave_1 entered promiscuous mode [ 23.244540][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.252067][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.259386][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.266709][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.294848][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.302026][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.309637][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.316944][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.331277][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.339062][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.347982][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.355907][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.365309][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.372353][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.381228][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.389865][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.417104][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.424914][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.433505][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.440858][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.456849][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.465051][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.472502][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.480267][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.489430][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.497186][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.504651][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.511890][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.519485][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.527066][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.535151][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.564188][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.573269][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.582097][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.590595][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.598801][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.607346][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.616561][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.623722][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.631278][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.639958][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.647021][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.674379][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.683629][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.692145][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.699264][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.708239][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.716900][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.723953][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.731470][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.740135][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.748467][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.757423][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.767447][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.775934][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.784295][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.791875][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.825816][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.834137][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.842815][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.851848][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.860495][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.869559][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.878451][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.886842][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.895332][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.904725][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.913426][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.920576][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.928639][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.936853][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.944762][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.953897][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.962319][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.969578][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.978236][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.987115][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.995349][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.004971][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.013461][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.020521][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.028078][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.037146][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.045363][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.053101][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.061290][ T288] device veth0_vlan entered promiscuous mode [ 24.072105][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.080751][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.098520][ T286] device veth0_vlan entered promiscuous mode [ 24.110797][ T289] device veth0_vlan entered promiscuous mode [ 24.119938][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.129065][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.138703][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.147537][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.156695][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.165412][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.174611][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.183053][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.191556][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.199767][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.208478][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.216110][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.223503][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.231347][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.247374][ T285] device veth0_vlan entered promiscuous mode [ 24.257451][ T288] device veth1_macvtap entered promiscuous mode [ 24.265885][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.274945][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.284779][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.292781][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.301639][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.310365][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.318604][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.326354][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.334227][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.346016][ T286] device veth1_macvtap entered promiscuous mode [ 24.359744][ T285] device veth1_macvtap entered promiscuous mode [ 24.367100][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.376155][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.385757][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.395264][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.411489][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.436039][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.445620][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.454872][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.464959][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.474190][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.490526][ T289] device veth1_macvtap entered promiscuous mode [ 24.499590][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.508557][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.517499][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.526677][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.535778][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.559421][ T288] request_module fs-gadgetfs succeeded, but still no fs? [ 24.561290][ T287] device veth0_vlan entered promiscuous mode [ 24.577163][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.586742][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.595617][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.604407][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.612997][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.621572][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.630320][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.639486][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.671607][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.684502][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.692643][ T308] process 'syz.2.3' launched './file0' with NULL argv: empty string added [ 24.703842][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.715446][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.739149][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.772597][ T319] xt_hashlimit: size too large, truncated to 1048576 [ 24.774555][ T287] device veth1_macvtap entered promiscuous mode [ 24.809167][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.822414][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.862436][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.876988][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.080891][ T330] ================================================================== [ 25.092265][ T330] BUG: KASAN: use-after-free in pppol2tp_sock_to_session+0x1a0/0x1b0 [ 25.100540][ T330] Read of size 4 at addr ffff888129f3f400 by task syz.1.2/330 [ 25.107998][ T330] [ 25.110318][ T330] CPU: 0 PID: 330 Comm: syz.1.2 Not tainted syzkaller #0 [ 25.117620][ T330] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 25.128402][ T330] Call Trace: [ 25.131956][ T330] [ 25.135108][ T330] __dump_stack+0x21/0x30 [ 25.139647][ T330] dump_stack_lvl+0x110/0x170 [ 25.144457][ T330] ? show_regs_print_info+0x20/0x20 [ 25.150075][ T330] ? load_image+0x3f0/0x3f0 [ 25.155135][ T330] ? __local_bh_enable_ip+0x58/0x80 [ 25.160911][ T330] print_address_description+0x7f/0x2c0 [ 25.166497][ T330] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 25.172438][ T330] kasan_report+0x10f/0x150 [ 25.177638][ T330] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 25.183450][ T330] __asan_report_load4_noabort+0x14/0x20 [ 25.189391][ T330] pppol2tp_sock_to_session+0x1a0/0x1b0 [ 25.195020][ T330] pppol2tp_release+0x150/0x2b0 [ 25.199951][ T330] sock_close+0xb8/0x200 [ 25.204214][ T330] ? sock_mmap+0xa0/0xa0 [ 25.208626][ T330] __fput+0x22b/0x900 [ 25.212921][ T330] ____fput+0x15/0x20 [ 25.217002][ T330] task_work_run+0x127/0x190 [ 25.221604][ T330] do_exit+0xb70/0x29a0 [ 25.225934][ T330] ? __se_sys_clock_nanosleep+0x30b/0x3a0 [ 25.231752][ T330] ? put_task_struct+0x90/0x90 [ 25.236890][ T330] ? __kasan_check_write+0x14/0x20 [ 25.242110][ T330] __x64_sys_exit+0x40/0x40 [ 25.246704][ T330] x64_sys_call+0x44/0x9a0 [ 25.251213][ T330] do_syscall_64+0x4c/0xa0 [ 25.255818][ T330] ? clear_bhb_loop+0x50/0xa0 [ 25.260493][ T330] ? clear_bhb_loop+0x50/0xa0 [ 25.265260][ T330] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 25.271336][ T330] RIP: 0033:0x7f5a1981b159 [ 25.275929][ T330] Code: Unable to access opcode bytes at RIP 0x7f5a1981b12f. [ 25.283554][ T330] RSP: 002b:00007f5a18273ef8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 25.292173][ T330] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007f5a1981b159 [ 25.300328][ T330] RDX: 00007f5a182749c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 25.308644][ T330] RBP: 00007f5a198b206b R08: 0000000000000000 R09: 0000000000000058 [ 25.316874][ T330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 25.325015][ T330] R13: 00007f5a19aa3038 R14: 00007f5a19aa2fa0 R15: 00007fff4031d2f8 [ 25.333448][ T330] [ 25.336467][ T330] [ 25.338900][ T330] Allocated by task 329: [ 25.343436][ T330] __kasan_kmalloc+0xd4/0x100 [ 25.348294][ T330] __kmalloc+0x13d/0x2c0 [ 25.352824][ T330] l2tp_session_create+0x39/0xb60 [ 25.359016][ T330] pppol2tp_connect+0xbf5/0x1640 [ 25.364037][ T330] __sys_connect+0x3cb/0x450 [ 25.369042][ T330] __x64_sys_connect+0x7a/0x90 [ 25.374246][ T330] x64_sys_call+0x7c/0x9a0 [ 25.378853][ T330] do_syscall_64+0x4c/0xa0 [ 25.383382][ T330] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 25.389736][ T330] [ 25.392078][ T330] Freed by task 45: [ 25.395872][ T330] kasan_set_track+0x4a/0x70 [ 25.400669][ T330] kasan_set_free_info+0x23/0x40 [ 25.405829][ T330] ____kasan_slab_free+0x125/0x160 [ 25.411403][ T330] __kasan_slab_free+0x11/0x20 [ 25.416635][ T330] slab_free_freelist_hook+0xc2/0x190 [ 25.422050][ T330] kfree+0xc4/0x270 [ 25.426126][ T330] l2tp_session_put+0xaf/0x1a0 [ 25.431094][ T330] l2tp_session_delete+0x3a9/0x4a0 [ 25.436197][ T330] l2tp_tunnel_del_work+0x180/0x3d0 [ 25.441481][ T330] process_one_work+0x6c8/0xbb0 [ 25.446417][ T330] worker_thread+0xaa0/0x1250 [ 25.451094][ T330] kthread+0x3f5/0x4f0 [ 25.455165][ T330] ret_from_fork+0x1f/0x30 [ 25.459752][ T330] [ 25.462163][ T330] The buggy address belongs to the object at ffff888129f3f400 [ 25.462163][ T330] which belongs to the cache kmalloc-512 of size 512 [ 25.476918][ T330] The buggy address is located 0 bytes inside of [ 25.476918][ T330] 512-byte region [ffff888129f3f400, ffff888129f3f600) [ 25.490376][ T330] The buggy address belongs to the page: [ 25.496175][ T330] page:ffffea0004a7cf00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x129f3c [ 25.506427][ T330] head:ffffea0004a7cf00 order:2 compound_mapcount:0 compound_pincount:0 [ 25.514832][ T330] flags: 0x4000000000010200(slab|head|zone=1) [ 25.521259][ T330] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 [ 25.529844][ T330] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 25.539383][ T330] page dumped because: kasan: bad access detected [ 25.546683][ T330] page_owner tracks the page as allocated [ 25.552667][ T330] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x152a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 39, ts 24894681306, free_ts 0 [ 25.570225][ T330] post_alloc_hook+0x192/0x1b0 [ 25.575023][ T330] prep_new_page+0x1c/0x110 [ 25.579528][ T330] get_page_from_freelist+0x2c3a/0x2cd0 [ 25.585264][ T330] __alloc_pages+0x1a2/0x460 [ 25.589968][ T330] new_slab+0xa0/0x4d0 [ 25.594204][ T330] ___slab_alloc+0x3ac/0x840 [ 25.598805][ T330] __slab_alloc+0x49/0x90 [ 25.603220][ T330] __kmalloc+0x16a/0x2c0 [ 25.607556][ T330] ___neigh_create+0x6fb/0x1c50 [ 25.612711][ T330] __neigh_create+0x31/0x40 [ 25.617327][ T330] ip6_finish_output2+0xae3/0x1790 [ 25.622434][ T330] __ip6_finish_output+0x623/0x7e0 [ 25.627794][ T330] ip6_finish_output+0x31/0x220 [ 25.632906][ T330] ip6_output+0x1fa/0x410 [ 25.637361][ T330] ndisc_send_skb+0x7f8/0xd00 [ 25.642036][ T330] ndisc_send_ns+0x879/0xb10 [ 25.646795][ T330] page_owner free stack trace missing [ 25.652268][ T330] [ 25.654784][ T330] Memory state around the buggy address: [ 25.660581][ T330] ffff888129f3f300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.668643][ T330] ffff888129f3f380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.676875][ T330] >ffff888129f3f400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.685372][ T330] ^ [ 25.689430][ T330] ffff888129f3f480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.697744][ T330] ffff888129f3f500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.706345][ T330] ================================================================== [ 25.714718][ T330] Disabling lock debugging due to kernel taint [ 25.731900][ T330] ------------[ cut here ]------------ [ 25.738191][ T330] WARNING: CPU: 1 PID: 330 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 25.765676][ T330] Modules linked in: [ 25.781061][ T330] CPU: 1 PID: 330 Comm: syz.1.2 Tainted: G B syzkaller #0 [ 25.790912][ T330] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 25.801314][ T330] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 25.808435][ T330] Code: 5d c3 e8 9c b6 0a fd be 02 00 00 00 eb 0a e8 90 b6 0a fd be 01 00 00 00 4c 89 f7 e8 e3 35 f1 fd e9 0f ff ff ff e8 79 b6 0a fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 68 b6 0a fd 4c 89 f7 be 03 [ 25.829575][ T330] RSP: 0018:ffffc900080f7bf0 EFLAGS: 00010293 [ 25.836423][ T330] RAX: ffffffff845f24a7 RBX: ffff88810f47c000 RCX: ffff88810d62d000 [ 25.845315][ T330] RDX: 0000000000000000 RSI: 000000000cb44c60 RDI: 000000000c04eb7d [ 25.853625][ T330] RBP: ffffc900080f7c10 R08: 0000000000000003 R09: 0000000000000004 [ 25.862129][ T330] R10: dffffc0000000000 R11: fffffbfff0e1904c R12: dffffc0000000000 [ 25.870605][ T330] R13: dffffc0000000000 R14: 000000000cb44c60 R15: ffff888129f3f400 [ 25.879219][ T330] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 25.888872][ T330] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.895706][ T330] CR2: 00007f5a19a6c2f8 CR3: 000000010d7c1000 CR4: 00000000003506a0 [ 25.903761][ T330] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 25.911873][ T330] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 25.921208][ T330] Call Trace: [ 25.924627][ T330] [ 25.927797][ T330] pppol2tp_release+0x150/0x2b0 [ 25.932665][ T330] sock_close+0xb8/0x200 [ 25.936964][ T330] ? sock_mmap+0xa0/0xa0 [ 25.941235][ T330] __fput+0x22b/0x900 [ 25.945690][ T330] ____fput+0x15/0x20 [ 25.950338][ T330] task_work_run+0x127/0x190 [ 25.955180][ T330] do_exit+0xb70/0x29a0 [ 25.959448][ T330] ? __se_sys_clock_nanosleep+0x30b/0x3a0 [ 25.965644][ T330] ? put_task_struct+0x90/0x90 [ 25.970808][ T330] ? __kasan_check_write+0x14/0x20 [ 25.976314][ T330] __x64_sys_exit+0x40/0x40 [ 25.999675][ T330] x64_sys_call+0x44/0x9a0 [ 26.004765][ T330] do_syscall_64+0x4c/0xa0 [ 26.009468][ T330] ? clear_bhb_loop+0x50/0xa0 [ 26.014664][ T330] ? clear_bhb_loop+0x50/0xa0 [ 26.019838][ T330] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 26.026194][ T330] RIP: 0033:0x7f5a1981b159 [ 26.030701][ T330] Code: Unable to access opcode bytes at RIP 0x7f5a1981b12f. [ 26.038570][ T330] RSP: 002b:00007f5a18273ef8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 26.047813][ T330] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007f5a1981b159 [ 26.056022][ T330] RDX: 00007f5a182749c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 26.064210][ T330] RBP: 00007f5a198b206b R08: 0000000000000000 R09: 0000000000000058 [ 26.072902][ T330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 26.084646][ T330] R13: 00007f5a19aa3038 R14: 00007f5a19aa2fa0 R15: 00007fff4031d2f8 [ 26.093540][ T330] [ 26.097101][ T330] ---[ end trace 7b89ea07d6fbf82b ]---