Warning: Permanently added '10.128.0.144' (ED25519) to the list of known hosts. 2026/08/08 20:15:06 parsed 1 programs 2026/08/08 20:15:06 serving rpc on tcp://39659 [ 23.839268][ T24] audit: type=1400 audit(1786220106.009:64): avc: denied { node_bind } for pid=288 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 23.859976][ T24] audit: type=1400 audit(1786220106.009:65): avc: denied { create } for pid=288 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 23.879489][ T24] audit: type=1400 audit(1786220106.009:66): avc: denied { module_request } for pid=288 comm="syz-execprog" kmod="net-pf-2-proto-262-type-1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 24.487919][ T24] audit: type=1400 audit(1786220106.659:67): avc: denied { mounton } for pid=294 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2024 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 24.488929][ T294] cgroup: Unknown subsys name 'net' [ 24.510548][ T24] audit: type=1400 audit(1786220106.659:68): avc: denied { mount } for pid=294 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.537780][ T24] audit: type=1400 audit(1786220106.679:69): avc: denied { unmount } for pid=294 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.537919][ T294] cgroup: Unknown subsys name 'devices' [ 24.647603][ T294] cgroup: Unknown subsys name 'hugetlb' [ 24.653179][ T294] cgroup: Unknown subsys name 'rlimit' [ 24.794720][ T24] audit: type=1400 audit(1786220106.959:70): avc: denied { setattr } for pid=294 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 24.817937][ T24] audit: type=1400 audit(1786220106.959:71): avc: denied { create } for pid=294 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 24.822957][ T298] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 24.838418][ T24] audit: type=1400 audit(1786220106.959:72): avc: denied { write } for pid=294 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 24.867051][ T24] audit: type=1400 audit(1786220106.959:73): avc: denied { read } for pid=294 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 24.892694][ T294] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 25.263373][ T300] request_module fs-gadgetfs succeeded, but still no fs? [ 25.273584][ T300] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 25.713180][ T334] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.720712][ T334] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.728116][ T334] device bridge_slave_0 entered promiscuous mode [ 25.735547][ T334] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.742673][ T334] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.749921][ T334] device bridge_slave_1 entered promiscuous mode [ 25.779467][ T334] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.786514][ T334] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.793730][ T334] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.800741][ T334] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.816030][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.823577][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.830875][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.850012][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.858168][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.865177][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.872522][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.880847][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.887873][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.897810][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.909659][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.921620][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.932607][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.940728][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.948235][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.955997][ T334] device veth0_vlan entered promiscuous mode [ 25.964912][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.973764][ T334] device veth1_macvtap entered promiscuous mode [ 25.982381][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.991736][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/08/08 20:15:08 executed programs: 0 [ 26.334695][ T364] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.341831][ T364] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.349158][ T364] device bridge_slave_0 entered promiscuous mode [ 26.359050][ T364] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.366066][ T364] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.373452][ T364] device bridge_slave_1 entered promiscuous mode [ 26.409593][ T364] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.416629][ T364] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.423827][ T364] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.430848][ T364] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.450766][ T341] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.458212][ T341] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.465293][ T341] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.478900][ T341] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.487041][ T341] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.494037][ T341] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.502636][ T341] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.510740][ T341] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.517752][ T341] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.529750][ T341] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.546903][ T341] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.555262][ T341] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.563295][ T341] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.571010][ T341] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.578461][ T341] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.586893][ T364] device veth0_vlan entered promiscuous mode [ 26.597758][ T341] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.606742][ T364] device veth1_macvtap entered promiscuous mode [ 26.615308][ T341] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.624863][ T341] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.647529][ T396] ================================================================== [ 26.655611][ T396] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 [ 26.662262][ T396] Write of size 8 at addr ffff8881119a5950 by task syz.2.17/396 [ 26.669884][ T396] [ 26.672191][ T396] CPU: 0 PID: 396 Comm: syz.2.17 Not tainted syzkaller #0 [ 26.679288][ T396] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.689319][ T396] Call Trace: [ 26.692585][ T396] __dump_stack+0x21/0x24 [ 26.696907][ T396] dump_stack_lvl+0x1a7/0x208 [ 26.701563][ T396] ? show_regs_print_info+0x18/0x18 [ 26.706731][ T396] ? thaw_kernel_threads+0x220/0x220 [ 26.711988][ T396] ? debug_smp_processor_id+0x17/0x20 [ 26.717330][ T396] print_address_description+0x7f/0x2c0 [ 26.722855][ T396] ? mutex_lock+0x85/0xf0 [ 26.727157][ T396] kasan_report+0x100/0x140 [ 26.731625][ T396] ? mutex_lock+0x85/0xf0 [ 26.735921][ T396] kasan_check_range+0x249/0x2a0 [ 26.740827][ T396] __kasan_check_write+0x14/0x20 [ 26.745732][ T396] mutex_lock+0x85/0xf0 [ 26.749854][ T396] ? mutex_trylock+0xb0/0xb0 [ 26.754416][ T396] ? l2tp_session_put+0xb2/0x1a0 [ 26.759319][ T396] ? l2tp_session_delete+0x3a9/0x4a0 [ 26.764569][ T396] pppol2tp_release+0x178/0x2b0 [ 26.769393][ T396] sock_close+0xb8/0x200 [ 26.773604][ T396] ? sock_mmap+0xa0/0xa0 [ 26.777818][ T396] __fput+0x2dc/0x730 [ 26.781860][ T396] ____fput+0x15/0x20 [ 26.785824][ T396] task_work_run+0x127/0x190 [ 26.790397][ T396] exit_to_user_mode_loop+0xcb/0xe0 [ 26.795564][ T396] exit_to_user_mode_prepare+0x76/0xa0 [ 26.800996][ T396] syscall_exit_to_user_mode+0x1d/0x40 [ 26.806427][ T396] do_syscall_64+0x3d/0x40 [ 26.810816][ T396] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.816680][ T396] RIP: 0033:0x7f68b53520d9 [ 26.821066][ T396] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 26.840645][ T396] RSP: 002b:00007ffccb5f1808 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 26.849027][ T396] RAX: 0000000000000000 RBX: 00007ffccb5f18f0 RCX: 00007f68b53520d9 [ 26.856974][ T396] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 26.864930][ T396] RBP: 0000000000006805 R08: 0000000000000001 R09: 0000000000000000 [ 26.872882][ T396] R10: 0000001b32b20000 R11: 0000000000000246 R12: 0000000000000000 [ 26.880830][ T396] R13: 00007f68b55d9fac R14: 00007f68b55d9fa8 R15: 00007f68b55d9fa0 [ 26.889036][ T396] [ 26.891336][ T396] Allocated by task 396: [ 26.895566][ T396] __kasan_kmalloc+0xd4/0x100 [ 26.900384][ T396] __kmalloc+0x19f/0x330 [ 26.904603][ T396] l2tp_session_create+0x39/0xb60 [ 26.909612][ T396] pppol2tp_connect+0xbf5/0x1640 [ 26.914518][ T396] __sys_connect+0x3ce/0x450 [ 26.919078][ T396] __x64_sys_connect+0x7a/0x90 [ 26.923811][ T396] do_syscall_64+0x31/0x40 [ 26.928196][ T396] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.934052][ T396] [ 26.936355][ T396] Freed by task 396: [ 26.940235][ T396] kasan_set_track+0x4a/0x70 [ 26.944794][ T396] kasan_set_free_info+0x23/0x40 [ 26.949696][ T396] ____kasan_slab_free+0x125/0x160 [ 26.954773][ T396] __kasan_slab_free+0x11/0x20 [ 26.959505][ T396] slab_free_freelist_hook+0xc5/0x190 [ 26.964842][ T396] kfree+0xc0/0x270 [ 26.968623][ T396] l2tp_session_put+0xb2/0x1a0 [ 26.973365][ T396] l2tp_session_delete+0x3a9/0x4a0 [ 26.978457][ T396] pppol2tp_release+0x169/0x2b0 [ 26.983285][ T396] sock_close+0xb8/0x200 [ 26.987505][ T396] __fput+0x2dc/0x730 [ 26.991463][ T396] ____fput+0x15/0x20 [ 26.995425][ T396] task_work_run+0x127/0x190 [ 26.999990][ T396] exit_to_user_mode_loop+0xcb/0xe0 [ 27.005162][ T396] exit_to_user_mode_prepare+0x76/0xa0 [ 27.010617][ T396] syscall_exit_to_user_mode+0x1d/0x40 [ 27.016052][ T396] do_syscall_64+0x3d/0x40 [ 27.020442][ T396] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 27.026322][ T396] [ 27.028634][ T396] The buggy address belongs to the object at ffff8881119a5800 [ 27.028634][ T396] which belongs to the cache kmalloc-512 of size 512 [ 27.042666][ T396] The buggy address is located 336 bytes inside of [ 27.042666][ T396] 512-byte region [ffff8881119a5800, ffff8881119a5a00) [ 27.055908][ T396] The buggy address belongs to the page: [ 27.061527][ T396] page:ffffea0004466900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1119a4 [ 27.071729][ T396] head:ffffea0004466900 order:2 compound_mapcount:0 compound_pincount:0 [ 27.080025][ T396] flags: 0x4000000000010200(slab|head) [ 27.085462][ T396] raw: 4000000000010200 ffffea00043f1b00 0000000500000005 ffff888100043080 [ 27.094020][ T396] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 27.102570][ T396] page dumped because: kasan: bad access detected [ 27.108950][ T396] page_owner tracks the page as allocated [ 27.114646][ T396] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 99, ts 3724280949, free_ts 0 [ 27.132578][ T396] prep_new_page+0x176/0x190 [ 27.137146][ T396] get_page_from_freelist+0x225f/0x23f0 [ 27.142663][ T396] __alloc_pages_nodemask+0x29a/0x640 [ 27.148003][ T396] new_slab+0x84/0x3f0 [ 27.152042][ T396] ___slab_alloc+0x2f8/0x4c0 [ 27.156602][ T396] __slab_alloc+0x63/0xa0 [ 27.160900][ T396] __kmalloc_track_caller+0x1e4/0x310 [ 27.166241][ T396] __alloc_skb+0xdc/0x520 [ 27.170541][ T396] alloc_skb_with_frags+0xa3/0x560 [ 27.175628][ T396] sock_alloc_send_pskb+0x87f/0x9a0 [ 27.180799][ T396] unix_dgram_sendmsg+0x6f3/0x18f0 [ 27.185882][ T396] sock_write_iter+0x2a6/0x3a0 [ 27.190632][ T396] vfs_write+0x770/0xd70 [ 27.194853][ T396] ksys_write+0x14a/0x260 [ 27.199157][ T396] __x64_sys_write+0x7b/0x90 [ 27.203724][ T396] do_syscall_64+0x31/0x40 [ 27.208113][ T396] page_owner free stack trace missing [ 27.213450][ T396] [ 27.215753][ T396] Memory state around the buggy address: [ 27.221358][ T396] ffff8881119a5800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.229390][ T396] ffff8881119a5880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.237426][ T396] >ffff8881119a5900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.245455][ T396] ^ [ 27.252097][ T396] ffff8881119a5980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.260131][ T396] ffff8881119a5a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.268160][ T396] ================================================================== [ 27.276188][ T396] Disabling lock debugging due to kernel taint