Warning: Permanently added '10.128.1.110' (ED25519) to the list of known hosts. 2026/07/14 11:57:25 parsed 1 programs 2026/07/14 11:57:25 serving rpc on tcp://44179 [ 20.789212][ T24] audit: type=1400 audit(1784030245.790:64): avc: denied { node_bind } for pid=287 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 20.796898][ T24] audit: type=1400 audit(1784030245.790:65): avc: denied { create } for pid=287 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 20.803691][ T24] audit: type=1400 audit(1784030245.790:66): avc: denied { module_request } for pid=287 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 21.648426][ T24] audit: type=1400 audit(1784030246.650:67): avc: denied { mounton } for pid=293 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.651512][ T293] cgroup: Unknown subsys name 'net' [ 21.671149][ T24] audit: type=1400 audit(1784030246.650:68): avc: denied { mount } for pid=293 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.698351][ T24] audit: type=1400 audit(1784030246.680:69): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.698698][ T293] cgroup: Unknown subsys name 'devices' [ 21.866612][ T293] cgroup: Unknown subsys name 'hugetlb' [ 21.872309][ T293] cgroup: Unknown subsys name 'rlimit' [ 21.989003][ T24] audit: type=1400 audit(1784030246.990:70): avc: denied { setattr } for pid=293 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.012169][ T24] audit: type=1400 audit(1784030246.990:71): avc: denied { create } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 22.032545][ T24] audit: type=1400 audit(1784030246.990:72): avc: denied { write } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 22.052944][ T24] audit: type=1400 audit(1784030246.990:73): avc: denied { read } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 22.069905][ T297] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 22.132141][ T293] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.558620][ T300] request_module fs-gadgetfs succeeded, but still no fs? [ 22.569428][ T300] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 23.158431][ T351] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.165533][ T351] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.172860][ T351] device bridge_slave_0 entered promiscuous mode [ 23.179801][ T351] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.186850][ T351] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.194147][ T351] device bridge_slave_1 entered promiscuous mode [ 23.231956][ T351] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.239001][ T351] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.246310][ T351] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.253335][ T351] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.270216][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.277880][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.285308][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.293826][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.302057][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.309082][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.317866][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.326070][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.333110][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.345016][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.354146][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.367025][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.378003][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.386215][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.393526][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.401647][ T351] device veth0_vlan entered promiscuous mode [ 23.411065][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.420085][ T351] device veth1_macvtap entered promiscuous mode [ 23.429050][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.438697][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/07/14 11:57:28 executed programs: 0 [ 23.706346][ T365] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.713410][ T365] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.720798][ T365] device bridge_slave_0 entered promiscuous mode [ 23.727715][ T365] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.734745][ T365] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.742145][ T365] device bridge_slave_1 entered promiscuous mode [ 23.785168][ T365] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.792204][ T365] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.799484][ T365] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.806518][ T365] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.829978][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.837776][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.845202][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.859158][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.867598][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.874638][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.883892][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.892238][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.899323][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.919163][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.927491][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.944244][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.952879][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.962002][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.970139][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.978435][ T365] device veth0_vlan entered promiscuous mode [ 23.989318][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.997593][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.006884][ T365] device veth1_macvtap entered promiscuous mode [ 24.015874][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.023440][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.031799][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.045274][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.053462][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.072935][ T396] ================================================================== [ 24.081038][ T396] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 [ 24.087721][ T396] Write of size 8 at addr ffff888110dca550 by task syz.2.17/396 [ 24.095353][ T396] [ 24.097693][ T396] CPU: 1 PID: 396 Comm: syz.2.17 Not tainted syzkaller #0 [ 24.104787][ T396] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 24.114828][ T396] Call Trace: [ 24.118135][ T396] __dump_stack+0x21/0x24 [ 24.122450][ T396] dump_stack_lvl+0x1a7/0x208 [ 24.127118][ T396] ? show_regs_print_info+0x18/0x18 [ 24.132300][ T396] ? thaw_kernel_threads+0x220/0x220 [ 24.137578][ T396] ? debug_smp_processor_id+0x17/0x20 [ 24.142946][ T396] print_address_description+0x7f/0x2c0 [ 24.148481][ T396] ? mutex_lock+0x85/0xf0 [ 24.152798][ T396] kasan_report+0x100/0x140 [ 24.157292][ T396] ? mutex_lock+0x85/0xf0 [ 24.161610][ T396] kasan_check_range+0x249/0x2a0 [ 24.166541][ T396] __kasan_check_write+0x14/0x20 [ 24.171463][ T396] mutex_lock+0x85/0xf0 [ 24.175606][ T396] ? mutex_trylock+0xb0/0xb0 [ 24.180198][ T396] ? l2tp_session_put+0xb2/0x1a0 [ 24.185132][ T396] ? l2tp_session_delete+0x3a9/0x4a0 [ 24.190421][ T396] pppol2tp_release+0x178/0x2b0 [ 24.195287][ T396] sock_close+0xb8/0x200 [ 24.199711][ T396] ? sock_mmap+0xa0/0xa0 [ 24.203948][ T396] __fput+0x2dc/0x730 [ 24.207925][ T396] ____fput+0x15/0x20 [ 24.211894][ T396] task_work_run+0x127/0x190 [ 24.216474][ T396] exit_to_user_mode_loop+0xcb/0xe0 [ 24.221662][ T396] exit_to_user_mode_prepare+0x76/0xa0 [ 24.227111][ T396] syscall_exit_to_user_mode+0x1d/0x40 [ 24.232553][ T396] do_syscall_64+0x3d/0x40 [ 24.236956][ T396] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 24.242841][ T396] RIP: 0033:0x7f980e9bfe59 [ 24.247245][ T396] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 24.266841][ T396] RSP: 002b:00007ffe0e7b6bf8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 24.275256][ T396] RAX: 0000000000000000 RBX: 00007ffe0e7b6ce0 RCX: 00007f980e9bfe59 [ 24.283219][ T396] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 24.291184][ T396] RBP: 0000000000005de4 R08: 0000000000000001 R09: 0000000000000000 [ 24.299156][ T396] R10: 0000001b32c20000 R11: 0000000000000246 R12: 0000000000000000 [ 24.307144][ T396] R13: 00007f980ec47fac R14: 00007f980ec47fa8 R15: 00007f980ec47fa0 [ 24.315101][ T396] [ 24.317417][ T396] Allocated by task 396: [ 24.321648][ T396] __kasan_kmalloc+0xd4/0x100 [ 24.326320][ T396] __kmalloc+0x19f/0x330 [ 24.330547][ T396] l2tp_session_create+0x39/0xb60 [ 24.335653][ T396] pppol2tp_connect+0xbf5/0x1640 [ 24.340576][ T396] __sys_connect+0x3ce/0x450 [ 24.345149][ T396] __x64_sys_connect+0x7a/0x90 [ 24.349901][ T396] do_syscall_64+0x31/0x40 [ 24.354302][ T396] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 24.360191][ T396] [ 24.362596][ T396] Freed by task 396: [ 24.366490][ T396] kasan_set_track+0x4a/0x70 [ 24.371066][ T396] kasan_set_free_info+0x23/0x40 [ 24.375990][ T396] ____kasan_slab_free+0x125/0x160 [ 24.381087][ T396] __kasan_slab_free+0x11/0x20 [ 24.385846][ T396] slab_free_freelist_hook+0xc5/0x190 [ 24.391216][ T396] kfree+0xc0/0x270 [ 24.395033][ T396] l2tp_session_put+0xb2/0x1a0 [ 24.399792][ T396] l2tp_session_delete+0x3a9/0x4a0 [ 24.404921][ T396] pppol2tp_release+0x169/0x2b0 [ 24.409779][ T396] sock_close+0xb8/0x200 [ 24.414023][ T396] __fput+0x2dc/0x730 [ 24.418001][ T396] ____fput+0x15/0x20 [ 24.421980][ T396] task_work_run+0x127/0x190 [ 24.426572][ T396] exit_to_user_mode_loop+0xcb/0xe0 [ 24.431770][ T396] exit_to_user_mode_prepare+0x76/0xa0 [ 24.437238][ T396] syscall_exit_to_user_mode+0x1d/0x40 [ 24.442696][ T396] do_syscall_64+0x3d/0x40 [ 24.447134][ T396] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 24.453024][ T396] [ 24.455356][ T396] The buggy address belongs to the object at ffff888110dca400 [ 24.455356][ T396] which belongs to the cache kmalloc-512 of size 512 [ 24.469405][ T396] The buggy address is located 336 bytes inside of [ 24.469405][ T396] 512-byte region [ffff888110dca400, ffff888110dca600) [ 24.482772][ T396] The buggy address belongs to the page: [ 24.488432][ T396] page:ffffea0004437200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x110dc8 [ 24.498662][ T396] head:ffffea0004437200 order:2 compound_mapcount:0 compound_pincount:0 [ 24.506995][ T396] flags: 0x4000000000010200(slab|head) [ 24.512473][ T396] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 [ 24.521054][ T396] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 24.529630][ T396] page dumped because: kasan: bad access detected [ 24.536046][ T396] page_owner tracks the page as allocated [ 24.541780][ T396] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x152a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 373, ts 24065792116, free_ts 24006379894 [ 24.560092][ T396] prep_new_page+0x176/0x190 [ 24.564683][ T396] get_page_from_freelist+0x225f/0x23f0 [ 24.570230][ T396] __alloc_pages_nodemask+0x29a/0x640 [ 24.575604][ T396] new_slab+0x84/0x3f0 [ 24.579678][ T396] ___slab_alloc+0x2f8/0x4c0 [ 24.584266][ T396] __slab_alloc+0x63/0xa0 [ 24.588598][ T396] __kmalloc+0x1f9/0x330 [ 24.592886][ T396] ___neigh_create+0x6ec/0x1a70 [ 24.597753][ T396] __neigh_create+0x31/0x40 [ 24.602259][ T396] ip6_finish_output2+0x8fe/0x1540 [ 24.607375][ T396] __ip6_finish_output+0x5fd/0x790 [ 24.612482][ T396] ip6_finish_output+0x33/0x1e0 [ 24.617330][ T396] ip6_output+0x1fa/0x420 [ 24.621654][ T396] ndisc_send_skb+0x721/0xbc0 [ 24.626344][ T396] ndisc_send_rs+0x711/0x960 [ 24.630935][ T396] addrconf_dad_completed+0x945/0xe30 [ 24.636307][ T396] page last free stack trace: [ 24.640990][ T396] __free_pages_ok+0x80b/0x830 [ 24.645753][ T396] __free_pages+0xd8/0x390 [ 24.650172][ T396] __free_slab+0xcf/0x190 [ 24.654502][ T396] unfreeze_partials+0x150/0x180 [ 24.659439][ T396] put_cpu_partial+0xc1/0x180 [ 24.664115][ T396] __slab_free+0x2c9/0x3a0 [ 24.668529][ T396] ___cache_free+0x10e/0x130 [ 24.673109][ T396] qlink_free+0x50/0x90 [ 24.677257][ T396] qlist_free_all+0x5f/0xb0 [ 24.681757][ T396] kasan_quarantine_reduce+0x14a/0x160 [ 24.687214][ T396] __kasan_slab_alloc+0x2f/0xe0 [ 24.692063][ T396] slab_post_alloc_hook+0x5d/0x2f0 [ 24.697173][ T396] kmem_cache_alloc+0x15a/0x2d0 [ 24.702020][ T396] __alloc_skb+0x9e/0x520 [ 24.706346][ T396] netlink_ack+0x35c/0xb30 [ 24.710755][ T396] netlink_rcv_skb+0x267/0x430 [ 24.715505][ T396] [ 24.717832][ T396] Memory state around the buggy address: [ 24.723461][ T396] ffff888110dca400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.731521][ T396] ffff888110dca480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.739582][ T396] >ffff888110dca500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.747639][ T396] ^ [ 24.754323][ T396] ffff888110dca580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.762382][ T396] ffff888110dca600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.770438][ T396] ================================================================== [ 24.778505][ T396] Disabling lock debugging due to kernel taint