last executing test programs:
43.681693ms ago: executing program 3 (id=4):
socket$nl_netfilter(0x10, 0x3, 0xc)
bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0)
setns(0xc9, 0x0)
r0 = socket(0x40000000015, 0x5, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback={0xfec0ffffffffffff}, 0x90}, 0x1c)
16.456068ms ago: executing program 3 (id=6):
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e)
ioctl$PPPIOCGL2TPSTATS(r0, 0x80487436, &(0x7f00000000c0))
0s ago: executing program 3 (id=7):
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000040)="1b000000080011aaaaaaaaaa0140", 0xe)
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.0.70' (ED25519) to the list of known hosts.
[ 18.718178][ T30] audit: type=1400 audit(1791025406.670:64): avc: denied { mounton } for pid=277 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 18.719369][ T277] cgroup: Unknown subsys name 'net'
[ 18.722263][ T30] audit: type=1400 audit(1791025406.670:65): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 18.726958][ T30] audit: type=1400 audit(1791025406.680:66): avc: denied { unmount } for pid=277 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 18.727106][ T277] cgroup: Unknown subsys name 'devices'
[ 18.822981][ T277] cgroup: Unknown subsys name 'hugetlb'
[ 18.828580][ T277] cgroup: Unknown subsys name 'rlimit'
[ 19.025256][ T30] audit: type=1400 audit(1791025406.980:67): avc: denied { setattr } for pid=277 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 19.048444][ T30] audit: type=1400 audit(1791025406.980:68): avc: denied { mounton } for pid=277 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1
[ 19.073254][ T30] audit: type=1400 audit(1791025406.980:69): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1
[ 19.078973][ T279] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped).
Setting up swapspace version 1, size = 127995904 bytes
[ 19.105251][ T30] audit: type=1400 audit(1791025407.060:70): avc: denied { relabelto } for pid=279 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t"
[ 19.130712][ T30] audit: type=1400 audit(1791025407.060:71): avc: denied { write } for pid=279 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t"
[ 19.162286][ T30] audit: type=1400 audit(1791025407.120:72): avc: denied { read } for pid=277 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t"
[ 19.187875][ T30] audit: type=1400 audit(1791025407.120:73): avc: denied { open } for pid=277 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t"
[ 19.187951][ T277] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 19.733098][ T285] bridge0: port 1(bridge_slave_0) entered blocking state
[ 19.740171][ T285] bridge0: port 1(bridge_slave_0) entered disabled state
[ 19.747678][ T285] device bridge_slave_0 entered promiscuous mode
[ 19.755529][ T285] bridge0: port 2(bridge_slave_1) entered blocking state
[ 19.762587][ T285] bridge0: port 2(bridge_slave_1) entered disabled state
[ 19.769997][ T285] device bridge_slave_1 entered promiscuous mode
[ 19.876050][ T286] bridge0: port 1(bridge_slave_0) entered blocking state
[ 19.883160][ T286] bridge0: port 1(bridge_slave_0) entered disabled state
[ 19.890453][ T286] device bridge_slave_0 entered promiscuous mode
[ 19.897190][ T292] bridge0: port 1(bridge_slave_0) entered blocking state
[ 19.904275][ T292] bridge0: port 1(bridge_slave_0) entered disabled state
[ 19.911698][ T292] device bridge_slave_0 entered promiscuous mode
[ 19.921117][ T292] bridge0: port 2(bridge_slave_1) entered blocking state
[ 19.928189][ T292] bridge0: port 2(bridge_slave_1) entered disabled state
[ 19.935638][ T292] device bridge_slave_1 entered promiscuous mode
[ 19.942275][ T287] bridge0: port 1(bridge_slave_0) entered blocking state
[ 19.949302][ T287] bridge0: port 1(bridge_slave_0) entered disabled state
[ 19.956840][ T287] device bridge_slave_0 entered promiscuous mode
[ 19.965342][ T287] bridge0: port 2(bridge_slave_1) entered blocking state
[ 19.972464][ T287] bridge0: port 2(bridge_slave_1) entered disabled state
[ 19.979800][ T287] device bridge_slave_1 entered promiscuous mode
[ 19.986609][ T286] bridge0: port 2(bridge_slave_1) entered blocking state
[ 19.993678][ T286] bridge0: port 2(bridge_slave_1) entered disabled state
[ 20.001114][ T286] device bridge_slave_1 entered promiscuous mode
[ 20.024070][ T290] bridge0: port 1(bridge_slave_0) entered blocking state
[ 20.031124][ T290] bridge0: port 1(bridge_slave_0) entered disabled state
[ 20.038627][ T290] device bridge_slave_0 entered promiscuous mode
[ 20.046043][ T290] bridge0: port 2(bridge_slave_1) entered blocking state
[ 20.053122][ T290] bridge0: port 2(bridge_slave_1) entered disabled state
[ 20.060554][ T290] device bridge_slave_1 entered promiscuous mode
[ 20.133956][ T285] bridge0: port 2(bridge_slave_1) entered blocking state
[ 20.141010][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 20.148310][ T285] bridge0: port 1(bridge_slave_0) entered blocking state
[ 20.155345][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 20.206856][ T287] bridge0: port 2(bridge_slave_1) entered blocking state
[ 20.213928][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 20.221178][ T287] bridge0: port 1(bridge_slave_0) entered blocking state
[ 20.228242][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 20.258507][ T286] bridge0: port 2(bridge_slave_1) entered blocking state
[ 20.265578][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 20.272858][ T286] bridge0: port 1(bridge_slave_0) entered blocking state
[ 20.279888][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 20.312838][ T45] bridge0: port 1(bridge_slave_0) entered disabled state
[ 20.320063][ T45] bridge0: port 2(bridge_slave_1) entered disabled state
[ 20.327528][ T45] bridge0: port 1(bridge_slave_0) entered disabled state
[ 20.334910][ T45] bridge0: port 1(bridge_slave_0) entered disabled state
[ 20.342156][ T45] bridge0: port 2(bridge_slave_1) entered disabled state
[ 20.349431][ T45] bridge0: port 2(bridge_slave_1) entered disabled state
[ 20.357625][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 20.365013][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 20.373700][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 20.381886][ T45] bridge0: port 1(bridge_slave_0) entered blocking state
[ 20.388903][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 20.413015][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 20.421219][ T45] bridge0: port 2(bridge_slave_1) entered blocking state
[ 20.428270][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 20.455847][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 20.463424][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 20.472426][ T45] bridge0: port 1(bridge_slave_0) entered blocking state
[ 20.479465][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 20.487103][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 20.495249][ T45] bridge0: port 2(bridge_slave_1) entered blocking state
[ 20.502312][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 20.515021][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 20.538529][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 20.546566][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 20.554753][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 20.562850][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 20.570962][ T45] bridge0: port 1(bridge_slave_0) entered blocking state
[ 20.577994][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 20.585964][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 20.594304][ T45] bridge0: port 2(bridge_slave_1) entered blocking state
[ 20.601350][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 20.609373][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 20.635177][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 20.643032][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 20.653117][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 20.661219][ T45] bridge0: port 1(bridge_slave_0) entered blocking state
[ 20.668253][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 20.676025][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 20.684370][ T45] bridge0: port 1(bridge_slave_0) entered blocking state
[ 20.691447][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 20.698869][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 20.706989][ T45] bridge0: port 2(bridge_slave_1) entered blocking state
[ 20.714015][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 20.721586][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 20.729451][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 20.737575][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 20.745567][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 20.753535][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 20.765370][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 20.773363][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 20.781185][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 20.789436][ T45] bridge0: port 2(bridge_slave_1) entered blocking state
[ 20.796469][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 20.805565][ T285] device veth0_vlan entered promiscuous mode
[ 20.812098][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 20.820035][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 20.832586][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 20.840135][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 20.849241][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 20.857713][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 20.870000][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 20.878287][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 20.886369][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 20.894471][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 20.906498][ T287] device veth0_vlan entered promiscuous mode
[ 20.917519][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 20.925510][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 20.933533][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 20.942009][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 20.950086][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 20.957761][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 20.966098][ T285] device veth1_macvtap entered promiscuous mode
[ 20.981370][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 20.989061][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 20.997498][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 21.006030][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 21.014399][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 21.022866][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 21.031192][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 21.043733][ T286] device veth0_vlan entered promiscuous mode
[ 21.053058][ T290] device veth0_vlan entered promiscuous mode
[ 21.059682][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 21.067697][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 21.076214][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 21.084590][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 21.092984][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 21.100816][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 21.108933][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 21.116461][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 21.123919][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 21.131242][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 21.152795][ T287] device veth1_macvtap entered promiscuous mode
[ 21.159369][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 21.168426][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 21.177172][ T285] request_module fs-gadgetfs succeeded, but still no fs?
[ 21.177276][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 21.192908][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 21.201052][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 21.209303][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 21.217808][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 21.226746][ T286] device veth1_macvtap entered promiscuous mode
[ 21.241824][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 21.249583][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 21.258315][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 21.266911][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 21.275275][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 21.286115][ T292] device veth0_vlan entered promiscuous mode
[ 21.292609][ C0] ==================================================================
[ 21.300678][ C0] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x6c/0xb0
[ 21.308079][ C0] Read of size 8 at addr ffff88812a44f590 by task ksoftirqd/0/13
[ 21.310576][ T292] device veth1_macvtap entered promiscuous mode
[ 21.315803][ C0]
[ 21.315821][ C0] CPU: 0 PID: 13 Comm: ksoftirqd/0 Not tainted syzkaller #0
[ 21.315841][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[ 21.341706][ C0] Call Trace:
[ 21.344996][ C0]
[ 21.347936][ C0] __dump_stack+0x21/0x30
[ 21.351573][ T317] 9pnet_virtio: no channels available for device syz
[ 21.352280][ C0] dump_stack_lvl+0x110/0x170
[ 21.363601][ C0] ? show_regs_print_info+0x20/0x20
[ 21.368816][ C0] ? load_image+0x3f0/0x3f0
[ 21.371247][ T319] FAULT_INJECTION: forcing a failure.
[ 21.371247][ T319] name failslab, interval 1, probability 0, space 0, times 1
[ 21.373323][ C0] print_address_description+0x7f/0x2c0
[ 21.373347][ C0] ? rcu_cblist_dequeue+0x6c/0xb0
[ 21.373365][ C0] kasan_report+0x10f/0x150
[ 21.400961][ C0] ? rcu_cblist_dequeue+0x6c/0xb0
[ 21.405997][ C0] __asan_report_load8_noabort+0x14/0x20
[ 21.411633][ C0] rcu_cblist_dequeue+0x6c/0xb0
[ 21.416483][ C0] rcu_do_batch+0x47d/0xbf0
[ 21.420983][ C0] ? local_bh_enable+0x20/0x20
[ 21.425739][ C0] ? __kasan_check_write+0x14/0x20
[ 21.430844][ C0] ? _raw_spin_lock+0xf0/0xf0
[ 21.435513][ C0] ? _raw_spin_unlock_irqrestore+0x5b/0x80
[ 21.441318][ C0] ? rcu_report_qs_rnp+0x2bc/0x390
[ 21.446424][ C0] rcu_core+0x4a3/0xef0
[ 21.450574][ C0] ? rcu_cpu_kthread_park+0x90/0x90
[ 21.455770][ C0] ? __this_cpu_preempt_check+0x13/0x20
[ 21.461331][ C0] ? rcu_softirq_qs+0xd7/0x2f0
[ 21.466087][ C0] ? rcu_get_gp_kthreads_prio+0x10/0x10
[ 21.471631][ C0] ? irqtime_account_irq+0x76/0x390
[ 21.476822][ C0] rcu_core_si+0x9/0x10
[ 21.480972][ C0] handle_softirqs+0x250/0x560
[ 21.485735][ C0] ? ksoftirqd_should_run+0x20/0x20
[ 21.490933][ C0] run_ksoftirqd+0x28/0x40
[ 21.495389][ C0] smpboot_thread_fn+0x446/0x880
[ 21.500332][ C0] kthread+0x3f5/0x4f0
[ 21.504393][ C0] ? cpu_report_death+0x1b0/0x1b0
[ 21.509412][ C0] ? kthread_blkcg+0xd0/0xd0
[ 21.513998][ C0] ret_from_fork+0x1f/0x30
[ 21.518409][ C0]
[ 21.521419][ C0]
[ 21.521421][ T319] CPU: 1 PID: 319 Comm: syz.3.11 Not tainted syzkaller #0
[ 21.523733][ C0] Allocated by task 309:
[ 21.530825][ T319] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[ 21.535043][ C0] __kasan_kmalloc+0xd4/0x100
[ 21.545087][ T319] Call Trace:
[ 21.545094][ T319]
[ 21.549749][ C0] __kmalloc+0x13d/0x2c0
[ 21.553014][ T319] __dump_stack+0x21/0x30
[ 21.555927][ C0] l2tp_session_create+0x39/0xb60
[ 21.560144][ T319] dump_stack_lvl+0x110/0x170
[ 21.564448][ C0] pppol2tp_connect+0xbf5/0x1640
[ 21.569445][ T319] ? show_regs_print_info+0x20/0x20
[ 21.574095][ C0] __sys_connect+0x3cb/0x450
[ 21.579009][ T319] ? avc_has_perm_noaudit+0x490/0x490
[ 21.584180][ C0] __x64_sys_connect+0x7a/0x90
[ 21.588746][ T319] dump_stack+0x15/0x20
[ 21.594090][ C0] x64_sys_call+0x7c/0x9a0
[ 21.598827][ T319] should_fail+0x3ab/0x500
[ 21.602956][ C0] do_syscall_64+0x4c/0xa0
[ 21.607346][ T319] __should_failslab+0xa4/0xe0
[ 21.611738][ C0] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 21.616132][ T319] should_failslab+0x9/0x20
[ 21.620884][ C0]
[ 21.620891][ C0] Freed by task 8:
[ 21.626757][ T319] slab_pre_alloc_hook+0x39/0xd0
[ 21.631244][ C0] kasan_set_track+0x4a/0x70
[ 21.633552][ T319] kmem_cache_alloc_trace+0x48/0x270
[ 21.637245][ C0] kasan_set_free_info+0x23/0x40
[ 21.642265][ T319] ? __request_module+0x2a7/0x920
[ 21.646831][ C0] ____kasan_slab_free+0x125/0x160
[ 21.652090][ T319] ? nfnetlink_rcv+0x695/0x22d0
[ 21.657000][ C0] __kasan_slab_free+0x11/0x20
[ 21.661997][ T319] __request_module+0x2a7/0x920
[ 21.667453][ C0] slab_free_freelist_hook+0xc2/0x190
[ 21.672303][ T319] ? _trace_android_vh_delayacct_thrashing_end+0x110/0x110
[ 21.677055][ C0] kfree+0xc4/0x270
[ 21.681889][ T319] ? __copy_skb_header+0x3f1/0x5b0
[ 21.687237][ C0] l2tp_session_put+0xaf/0x1a0
[ 21.694405][ T319] ? memcpy+0x56/0x70
[ 21.698187][ C0] l2tp_session_delete+0x3a9/0x4a0
[ 21.703274][ T319] ? __kasan_check_write+0x14/0x20
[ 21.708013][ C0] l2tp_tunnel_del_work+0x180/0x3d0
[ 21.711973][ T319] ? mutex_unlock+0x8f/0x230
[ 21.717082][ C0] process_one_work+0x6c8/0xbb0
[ 21.722173][ T319] ? __mutex_lock_slowpath+0x10/0x10
[ 21.727346][ C0] worker_thread+0xaa0/0x1250
[ 21.731910][ T319] ? skb_clone+0x1fb/0x370
[ 21.736734][ C0] kthread+0x3f5/0x4f0
[ 21.741995][ T319] nfnetlink_rcv+0x695/0x22d0
[ 21.746649][ C0] ret_from_fork+0x1f/0x30
[ 21.751045][ T319] ? unwind_get_return_address+0x4d/0x90
[ 21.755089][ C0]
[ 21.755095][ C0] Last potentially related work creation:
[ 21.759741][ T319] ? stack_trace_save+0xf0/0xf0
[ 21.764133][ C0] kasan_save_stack+0x3a/0x60
[ 21.769738][ T319] ? arch_stack_walk+0xee/0x140
[ 21.772046][ C0] __kasan_record_aux_stack+0xd2/0x100
[ 21.777741][ T319] ? stack_trace_save+0xa6/0xf0
[ 21.782567][ C0] kasan_record_aux_stack_noalloc+0xb/0x10
[ 21.787218][ T319] ? nfnetlink_net_exit_batch+0xf0/0xf0
[ 21.792041][ C0] call_rcu+0x10b/0xf60
[ 21.797474][ T319] ? __kasan_slab_alloc+0xc9/0xe0
[ 21.802301][ C0] pppol2tp_release+0x1e3/0x2b0
[ 21.808087][ T319] ? __kasan_kmalloc+0xd4/0x100
[ 21.813619][ C0] sock_close+0xb8/0x200
[ 21.817760][ T319] ? __kmalloc_track_caller+0x13c/0x2c0
[ 21.822762][ C0] __fput+0x22b/0x900
[ 21.827589][ T319] ? __alloc_skb+0x210/0x730
[ 21.832414][ C0] ____fput+0x15/0x20
[ 21.836635][ T319] ? netlink_sendmsg+0x611/0xb80
[ 21.842153][ C0] task_work_run+0x127/0x190
[ 21.846113][ T319] ? ____sys_sendmsg+0x5be/0x8f0
[ 21.850676][ C0] exit_to_user_mode_loop+0xd0/0xe0
[ 21.854631][ T319] ? ___sys_sendmsg+0x236/0x2e0
[ 21.859543][ C0] exit_to_user_mode_prepare+0x87/0xd0
[ 21.864107][ T319] ? __x64_sys_sendmsg+0x201/0x2d0
[ 21.869021][ C0] syscall_exit_to_user_mode+0x1a/0x30
[ 21.874192][ T319] ? x64_sys_call+0x4b/0x9a0
[ 21.879015][ C0] do_syscall_64+0x58/0xa0
[ 21.884446][ T319] ? do_syscall_64+0x4c/0xa0
[ 21.889532][ C0] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 21.894962][ T319] ? entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 21.899530][ C0]
[ 21.899536][ C0] The buggy address belongs to the object at ffff88812a44f400
[ 21.899536][ C0] which belongs to the cache kmalloc-512 of size 512
[ 21.903919][ T319] ? selinux_nlmsg_lookup+0x2f9/0x440
[ 21.908482][ C0] The buggy address is located 400 bytes inside of
[ 21.908482][ C0] 512-byte region [ffff88812a44f400, ffff88812a44f600)
[ 21.914350][ T319] ? selinux_netlink_send+0x75f/0x830
[ 21.920390][ C0] The buggy address belongs to the page:
[ 21.920413][ C0] page:ffffea0004a91300 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12a44c
[ 21.922699][ T319] ? selinux_vm_enough_memory+0x190/0x190
[ 21.936728][ C0] head:ffffea0004a91300 order:2 compound_mapcount:0 compound_pincount:0
[ 21.942088][ T319] ? _copy_from_iter+0x4a4/0x10a0
[ 21.955341][ C0] flags: 0x4000000000010200(slab|head|zone=1)
[ 21.960693][ T319] ? __netlink_lookup+0x387/0x3b0
[ 21.966314][ C0] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00
[ 21.976510][ T319] netlink_unicast+0x86c/0xa30
[ 21.982210][ C0] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
[ 21.990504][ T319] netlink_sendmsg+0x879/0xb80
[ 21.995634][ C0] page dumped because: kasan: bad access detected
[ 22.001691][ T319] ? netlink_getsockopt+0x530/0x530
[ 22.006691][ C0] page_owner tracks the page as allocated
[ 22.015247][ T319] ? alloc_file+0x59/0x580
[ 22.020001][ C0] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 309, ts 21277598786, free_ts 0
[ 22.028561][ T319] ? security_socket_sendmsg+0x82/0xa0
[ 22.033303][ C0] post_alloc_hook+0x192/0x1b0
[ 22.039688][ T319] ? netlink_getsockopt+0x530/0x530
[ 22.044864][ C0] prep_new_page+0x1c/0x110
[ 22.050561][ T319] ____sys_sendmsg+0x5be/0x8f0
[ 22.054953][ C0] get_page_from_freelist+0x2c3a/0x2cd0
[ 22.074451][ T319] ? __sys_sendmsg_sock+0x40/0x40
[ 22.079885][ C0] __alloc_pages+0x1a2/0x460
[ 22.084629][ T319] ? import_iovec+0x7c/0xb0
[ 22.089798][ C0] new_slab+0xa0/0x4d0
[ 22.094279][ T319] ___sys_sendmsg+0x236/0x2e0
[ 22.099039][ C0] ___slab_alloc+0x3ac/0x840
[ 22.104562][ T319] ? __sys_sendmsg+0x280/0x280
[ 22.109558][ C0] __slab_alloc+0x49/0x90
[ 22.114123][ T319] ? percpu_counter_add_batch+0x13c/0x160
[ 22.118600][ C0] __kmalloc+0x16a/0x2c0
[ 22.122654][ T319] ? __fdget+0x1a1/0x230
[ 22.127298][ C0] l2tp_session_create+0x39/0xb60
[ 22.131864][ T319] __x64_sys_sendmsg+0x201/0x2d0
[ 22.136624][ C0] pppol2tp_connect+0xbf5/0x1640
[ 22.140934][ T319] ? ___sys_sendmsg+0x2e0/0x2e0
[ 22.146627][ C0] __sys_connect+0x3cb/0x450
[ 22.150848][ T319] ? __kasan_check_write+0x14/0x20
[ 22.155156][ C0] __x64_sys_connect+0x7a/0x90
[ 22.160154][ T319] ? switch_fpu_return+0x15d/0x2c0
[ 22.165065][ C0] x64_sys_call+0x7c/0x9a0
[ 22.169980][ T319] x64_sys_call+0x4b/0x9a0
[ 22.174805][ C0] do_syscall_64+0x4c/0xa0
[ 22.179373][ T319] do_syscall_64+0x4c/0xa0
[ 22.184457][ C0] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 22.189194][ T319] ? clear_bhb_loop+0x50/0xa0
[ 22.194287][ C0] page_owner free stack trace missing
[ 22.198674][ T319] ? clear_bhb_loop+0x50/0xa0
[ 22.203068][ C0]
[ 22.203072][ C0] Memory state around the buggy address:
[ 22.207458][ T319] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 22.211857][ C0] ffff88812a44f480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 22.217726][ T319] RIP: 0033:0x7feefc954159
[ 22.222406][ C0] ffff88812a44f500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 22.227749][ T319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 22.232401][ C0] >ffff88812a44f580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 22.234707][ T319] RSP: 002b:00007feefb3ad028 EFLAGS: 00000246
[ 22.240312][ C0] ^
[ 22.246176][ T319] ORIG_RAX: 000000000000002e
[ 22.254224][ C0] ffff88812a44f600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 22.258609][ T319] RAX: ffffffffffffffda RBX: 00007feefcbdbfa0 RCX: 00007feefc954159
[ 22.266649][ C0] ffff88812a44f680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 22.286225][ T319] RDX: 0000000004040850 RSI: 00002000000000c0 RDI: 0000000000000004
[ 22.294267][ C0] ==================================================================
[ 22.300313][ T319] RBP: 00007feefc9eb06b R08: 0000000000000000 R09: 0000000000000000
[ 22.304879][ C0] Disabling lock debugging due to kernel taint
[ 22.363593][ T319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 22.371556][ T319] R13: 00007feefcbdc038 R14: 00007feefcbdbfa0 R15: 00007ffee43217b8
[ 22.379519][ T319]
[ 22.391645][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 22.399850][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 22.408160][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 22.416632][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 22.424962][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 22.433225][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 22.441460][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 22.449039][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 22.457379][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 22.465703][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 22.473879][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 22.482200][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 22.490384][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 22.498747][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 22.507073][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 22.515419][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 22.522927][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 22.531404][ T290] device veth1_macvtap entered promiscuous mode
[ 22.541171][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 22.549442][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 22.596096][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 22.604838][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready