last executing test programs: 1.646461654s ago: executing program 1 (id=11): syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) 1.29077235s ago: executing program 2 (id=38): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000700)={0x2, 'hsr0\x00', 0x2}, 0x18) 1.29058206s ago: executing program 2 (id=40): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) bpf$PROG_LOAD(0x5, &(0x7f0000000c40)={0x1, 0x0, 0x0, 0x0, 0x4}, 0x94) madvise(&(0x7f0000000000/0x400000)=nil, 0x40001e, 0x15) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) 1.29040513s ago: executing program 2 (id=42): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000740)={0x0, &(0x7f0000000480)=[@nested_set_state_pages={0x140, 0x28, {0x3, 0x14, @arbitrary=0x1}}, @nested_amd_set_intercept={0x181, 0x30, {0x1, 0x8000000000000001, 0x1, 0x1}}, @nested_set_state_pages={0x140, 0x28, {0x2, 0x32, @gpa=0x8080000}}, @rdmsr={0x66, 0x18, {0xbca}}, @cpuid={0x64, 0x18, {0x0, 0x6}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x1, @save_area=0x54b, 0x4, 0x8f, 0x5}}], 0xe8}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000280)={[0x8, 0x4, 0x7, 0x7, 0x5, 0x80000000, 0x1, 0x8001, 0xc646, 0x1, 0x3, 0x3, 0x4, 0x0, 0x8, 0x8000000000000], 0x3000, 0xa402}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.241164665s ago: executing program 2 (id=45): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000980)={&(0x7f00000009c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @queue={{0xa}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_QUEUE_NUM={0x6}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x74}}, 0x0) 1.228049446s ago: executing program 0 (id=47): pselect6(0x40, &(0x7f00000008c0)={0x2, 0x0, 0x8, 0x3fc4, 0xffffffffffffffe8, 0x9, 0xffffffff}, 0x0, 0x0, &(0x7f0000000940)={0x0, 0x3938700}, 0x0) syz_clone(0x40900100, 0x0, 0x0, 0x0, 0x0, 0x0) 1.170678372s ago: executing program 2 (id=49): r0 = socket$igmp(0x2, 0x3, 0x2) sendmsg$inet(r0, &(0x7f00000007c0)={&(0x7f0000000a80)={0x2, 0x4e24, @multicast1}, 0x10, 0x0}, 0x40000) 1.170562922s ago: executing program 2 (id=51): r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000100)=ANY=[@ANYBLOB="c1010000000000407f04ffff00000000000109022d0001000000000904000002030000000921000000012218000905810300"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000140)={0x14, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="002218"], 0x0}, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) writev(r1, &(0x7f0000000040)=[{&(0x7f0000000080)='A', 0x1}, {0x0}], 0x2) 1.128594936s ago: executing program 0 (id=54): bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000001bc0)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB='&\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='!'], 0x20) 1.08664222s ago: executing program 0 (id=57): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newqdisc={0x2c, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x2c}}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000001400)={[0x60000000004, 0x1000000000, 0x1, 0x3e, 0x2000000, 0x0, 0x2004cc, 0x0, 0xa1b, 0x8, 0x5, 0x0, 0x3, 0x2, 0x1], 0x10000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f00000014c0)={{0x70000, 0x30000, 0x0, 0x2, 0x2, 0x10, 0x3, 0x7, 0x0, 0x8, 0x9}, {0xe000, 0x10000, 0xc, 0x0, 0x22, 0x0, 0xfd, 0x0, 0x7, 0xff}, {0xb000, 0x8080000, 0xc, 0x0, 0x27, 0xc4, 0x0, 0x0, 0x8, 0xfd, 0x44, 0x3}, {0x4000, 0x33331000, 0x18592cbc7c573fc6, 0x9, 0x1, 0x9, 0x9, 0x7, 0x8, 0xf, 0x4}, {0x80a0000, 0xeeee8000, 0xb, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3f, 0x6}, {0xb000, 0x0, 0x9, 0x76, 0x9, 0x1, 0x2, 0x80, 0x0, 0xff, 0x6, 0x3}, {0xeeee8000, 0xeeee0000, 0x3, 0x4, 0x6, 0x0, 0xa1, 0x2, 0x0, 0x0, 0x4}, {0xc002, 0x50000, 0xc, 0x3, 0x9, 0x7, 0x9, 0x40, 0x26, 0x0, 0x0, 0xf}, {0x80a0000, 0x8cc}, {0x60000, 0xfffc}, 0xddf8ffd3, 0x0, 0x0, 0x118, 0xe, 0x1, 0xb000, [0x80000004, 0x0, 0x10000, 0xfffffffffffdffff]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 991.63969ms ago: executing program 0 (id=65): r0 = syz_open_procfs(0x0, &(0x7f0000000200)='attr\x00') io_setup(0x1, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f0000000140)=[&(0x7f0000000200)={0x0, 0x0, 0x2, 0x0, 0x0, r0, 0x0}]) 920.073908ms ago: executing program 3 (id=67): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000c80)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000d00)={0x6, 0x17, &(0x7f0000000dc0)=ANY=[@ANYBLOB="18000000000000000000000000000002181100", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000000010000850000001700000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7020000000000008500000086000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f0000000e80)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000ec0)={r1, 0xfca804a0, 0xe, 0x0, &(0x7f0000000f40)="b8000005000000005baf2312bbc2", 0x0, 0x12000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 919.877568ms ago: executing program 3 (id=69): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)={0x30, 0x1, 0x1, 0x101, 0x0, 0x0, {0x2, 0x0, 0x1}, [@CTA_TUPLE_ORIG={0x18, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @multicast2=0xe0000001}}}]}, @CTA_FILTER={0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x20048000) 896.88121ms ago: executing program 3 (id=72): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) llistxattr(0x0, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x4) unlink(0x0) 838.550876ms ago: executing program 0 (id=74): r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xfffffffffffffff5]}, 0x8, 0x80000) ppoll(&(0x7f0000000040)=[{r0, 0x80cb}, {r0, 0x8500}], 0x2, 0x0, 0x0, 0x0) signalfd(r0, &(0x7f0000000080)={[0x400]}, 0x8) 838.477226ms ago: executing program 3 (id=75): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)={0x30, 0x7, 0x6, 0x201, 0x0, 0x0, {0x1, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x5}]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x48004) 834.837346ms ago: executing program 3 (id=77): r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x42, 0xca) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r3 = inotify_init1(0x80000) inotify_add_watch(r3, &(0x7f0000000140)='./file1\x00', 0x60000726) write$binfmt_misc(r2, &(0x7f0000000180), 0x91) splice(r1, 0x0, r0, 0x0, 0x9, 0x7) 822.684377ms ago: executing program 3 (id=78): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000780)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f00000007c0)={0x1c, &(0x7f0000000800)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r2, 0x5b02, 0x0) ioctl$HIDIOCGUSAGE(r1, 0x80015b11, 0x0) syz_usb_disconnect(r0) 362.366954ms ago: executing program 4 (id=92): openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) socket$packet(0x11, 0x3, 0x300) socket$packet(0x11, 0x2, 0x300) fsopen(&(0x7f0000000000)='debugfs\x00', 0x1) socket$igmp(0x2, 0x3, 0x2) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000004a80)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000004ac0)={0x0, 0x0, &(0x7f0000004b00)={&(0x7f0000004ec0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c0002001c0000001f000000060001000700000008000500", @ANYRES32=r0, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a000100000070"], 0x64}, 0x1, 0x0, 0x0, 0x8811}, 0x10) 346.844965ms ago: executing program 4 (id=93): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)={0x20, 0x1, 0x1, 0x101, 0x0, 0x0, {0x2, 0x0, 0x1}, [@CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x20048000) 337.677296ms ago: executing program 4 (id=94): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x1022002, 0x0) r1 = dup(r0) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) 286.660282ms ago: executing program 4 (id=95): r0 = socket$unix(0x1, 0x5, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000005c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000080)=@newqdisc={0x28, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xc, 0xfffc}}, [@TCA_STAB={0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x240080c1}, 0x0) 286.557582ms ago: executing program 4 (id=96): r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x4c, 0x10, 0x1, 0x470bd27, 0x25dfd402, {0x0, 0x0, 0x0, r2, 0x6cec1, 0x16ac1}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @bridge_slave={{0x11}, {0x14, 0x5, 0x0, 0x1, [@IFLA_BRPORT_ISOLATED={0x5, 0x21, 0x1}, @IFLA_BRPORT_NEIGH_SUPPRESS={0x5, 0x20, 0x1}]}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c080}, 0x20048882) 286.438922ms ago: executing program 4 (id=97): lsetxattr$system_posix_acl(&(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x1c, 0x2) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) mmap(&(0x7f0000001000/0x10000)=nil, 0x10000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x1) ioctl$UFFDIO_API(r2, 0xc018aa3f, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0xe000, 0x2000, &(0x7f000012e000/0x2000)=nil}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/locks\x00', 0x0, 0x0) pread64(r3, &(0x7f0000000280)=""/126, 0x7e, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000300)={0x38, 0x0, 0x1000000a, 0x5, 0x0, 0xd, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) timer_delete(0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x7542d000) timer_create(0x1, 0x0, 0x0) r4 = userfaultfd(0x80001) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000340)) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f00000067c0)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa04, &(0x7f0000006800)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1, 0x2}) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x9) syz_usb_connect$uac3(0x3, 0x0, 0x0, 0x0) timer_getoverrun(0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) 157.099325ms ago: executing program 1 (id=98): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) ioctl$TIOCMIWAIT(r0, 0x545c, 0x7cb7562f2d67) ioctl$TIOCMSET(r0, 0x5418, &(0x7f0000000040)=0xfff7bdff) 71.165814ms ago: executing program 1 (id=99): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f0000001880)=@generic={0x1, 0x9, 0x9}) 18.704068ms ago: executing program 1 (id=100): syz_mount_image$fuse(0x0, 0x0, 0x18010, &(0x7f0000000300)=ANY=[@ANYRES64, @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id', @ANYRESDEC, @ANYBLOB=',allow_other,max_read=0x0000000000000001,default_permissions,allow_other,maz_read=0x000000000000afc9,default_permissions,dsfions,fsmagic=0x0000000000000006,'], 0x1, 0x0, &(0x7f0000000240)="95f90a86617dffea6df4c32d0e5af0d27ec6eec685f437f9e051780d7630b8309136b0f6a1e018877e525e9b76c946777460d17261de3a9df25e877523431552e477847e2f3cf37d4898d423e11c0b87216142fc6b68f0d5fddc919c38e581588c4e") r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000200)=@x86={0x6, 0x8, 0xc3, 0x0, 0x6, 0xca, 0x4, 0x6, 0x8, 0xd8, 0x0, 0x2, 0x0, 0x3, 0xfffffffc, 0x9, 0x33, 0x4, 0xfe, '\x00', 0x4, 0x4}) 18.596739ms ago: executing program 1 (id=101): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=ANY=[@ANYBLOB="38000000090601000000000000000000000080000900020073797a30000000000500010007000000100007800c00018008000140e0"], 0x38}}, 0x0) 18.491648ms ago: executing program 1 (id=102): r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000100)=0x80000004, 0x4) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x33, &(0x7f0000000180)={0x1, &(0x7f00000001c0)=[{0x6, 0x5, 0x0, 0x2}]}, 0x8) bind$inet6(r0, &(0x7f0000000240)={0xa, 0x4e23, 0xfffffffc, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) listen(r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40e41, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'syzkaller1\x00', 0xc201}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r6, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r5) r7 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r5, &(0x7f0000000040)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x2, 0x0, 0x4, 0x1, {0xa, 0x4e21, 0x3, @dev={0xfe, 0x80, '\x00', 0x3b}}}}, 0x32) ioctl$PPPIOCGL2TPSTATS(r7, 0x40047459, 0x0) getsockopt$inet_pktinfo(r4, 0x3a, 0x8, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r8 = syz_open_procfs(0x0, &(0x7f0000000280)='net/rt_acct\x00') getdents(r8, &(0x7f0000000040)=""/31, 0x1f) socket$igmp6(0xa, 0x3, 0x2) r9 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r9, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r9, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x2, 0x9, 0x1}, 0x1c) r10 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000001100)={'gre0\x00', 0x0}) sendto$packet(r10, &(0x7f0000000480)="cd", 0x1, 0x20044090, &(0x7f0000000200)={0x11, 0x88a8, r11, 0x1, 0x0, 0x6, @link_local}, 0x14) munmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000) write$tun(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000001400000060ec97000fc83c00fe8000000000000000000000000000aaff02000000000000000000000000000111"], 0xffe) 0s ago: executing program 0 (id=103): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) syz_emit_ethernet(0x87, &(0x7f0000000080)={@random="e2eaa3b448e3", @remote, @val={@val={0x88a8, 0x1, 0x1, 0x4}, {0x8100, 0x7}}, {@x25={0x805, {0x0, 0x1, 0x27, "713079e2326cdd3cadd6c3cfdff2d059c0fce005a328adb51c24cb1ffd51c7506b47a7365bcbbccf35add7c3c8589c164f6e05186df2eec235e775d8ff5e0af2c70b0cb01a7bac2b2e3bd94ba17040e55658a8b7ee8d9a743375e0e84aa5fda7c4ebe2bea2e84ac2b210e4e2ec72"}}}}, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000140)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000180)=0x2, 0x4) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000200)=[@sack_perm, @mss={0x2, 0xb}, @mss, @sack_perm, @window={0x3, 0x2, 0x7}, @timestamp, @sack_perm, @window={0x3, 0x800, 0x5}], 0x8) socketpair$nbd(0x1, 0x1, 0x0, 0x0) sendto$inet(r0, &(0x7f00000002c0)="b8", 0x1, 0x2400a044, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000300), 0x4) sendto$inet(r0, &(0x7f0000000340)='x', 0x1, 0x480c1, 0x0, 0x0) r1 = socket$inet6(0x10, 0x2, 0x4) sendto$inet6(r1, &(0x7f00000003c0)="4c00000012001f15b9409b849ac00a00a5784002000000000000030038c88cc055c5ac27a6c5b068d0bf46d323452536005ad94a461cdbfee9bdb942352359a351d1ec0cffc8792cd8000080", 0x4c, 0x810, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.80' (ED25519) to the list of known hosts. [ 22.678481][ T24] audit: type=1400 audit(1793085750.410:64): avc: denied { mounton } for pid=271 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.682086][ T271] cgroup: Unknown subsys name 'net' [ 22.701281][ T24] audit: type=1400 audit(1793085750.410:65): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.728574][ T24] audit: type=1400 audit(1793085750.440:66): avc: denied { unmount } for pid=271 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.728933][ T271] cgroup: Unknown subsys name 'devices' [ 22.839664][ T271] cgroup: Unknown subsys name 'hugetlb' [ 22.845486][ T271] cgroup: Unknown subsys name 'rlimit' [ 22.986547][ T24] audit: type=1400 audit(1793085750.710:67): avc: denied { setattr } for pid=271 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.009748][ T24] audit: type=1400 audit(1793085750.710:68): avc: denied { mounton } for pid=271 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 23.034723][ T24] audit: type=1400 audit(1793085750.720:69): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.043198][ T273] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 23.066831][ T24] audit: type=1400 audit(1793085750.790:70): avc: denied { relabelto } for pid=273 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.092332][ T24] audit: type=1400 audit(1793085750.790:71): avc: denied { write } for pid=273 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.092701][ T271] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.117937][ T24] audit: type=1400 audit(1793085750.820:72): avc: denied { read } for pid=271 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.117956][ T24] audit: type=1400 audit(1793085750.820:73): avc: denied { open } for pid=271 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.758282][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.765402][ T279] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.773002][ T279] device bridge_slave_0 entered promiscuous mode [ 23.788374][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.795446][ T280] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.803049][ T280] device bridge_slave_0 entered promiscuous mode [ 23.811035][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.818224][ T280] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.825598][ T280] device bridge_slave_1 entered promiscuous mode [ 23.837822][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.844881][ T279] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.852335][ T279] device bridge_slave_1 entered promiscuous mode [ 23.893426][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.900555][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.908023][ T281] device bridge_slave_0 entered promiscuous mode [ 23.939255][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.946313][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.953874][ T281] device bridge_slave_1 entered promiscuous mode [ 23.977949][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.985019][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.992483][ T282] device bridge_slave_0 entered promiscuous mode [ 24.028189][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.035338][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.042913][ T282] device bridge_slave_1 entered promiscuous mode [ 24.097867][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.104934][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.112471][ T283] device bridge_slave_0 entered promiscuous mode [ 24.142398][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.149522][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.156864][ T283] device bridge_slave_1 entered promiscuous mode [ 24.221317][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.228518][ T279] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.235830][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.243002][ T279] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.258909][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.265969][ T282] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.273272][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.280325][ T282] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.309416][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.316476][ T280] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.323784][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.330888][ T280] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.343774][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.350855][ T281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.358176][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.365207][ T281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.373962][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.381037][ T283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.388413][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.395549][ T283] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.412167][ T112] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.419570][ T112] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.426732][ T112] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.434214][ T112] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.441847][ T112] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.449074][ T112] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.456241][ T112] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.463680][ T112] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.471470][ T112] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.478698][ T112] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.486070][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.493587][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.519744][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.528041][ T112] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.535074][ T112] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.542549][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.551258][ T112] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.558372][ T112] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.580159][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.588201][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.595696][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.603449][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.612004][ T112] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.619110][ T112] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.642094][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.649825][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.658098][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.666064][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.674518][ T112] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.681602][ T112] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.689499][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.697925][ T112] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.704949][ T112] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.712506][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.721034][ T112] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.728111][ T112] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.735479][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.743716][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.751880][ T112] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.758935][ T112] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.783718][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.792389][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.800889][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.809977][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.818085][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.826117][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.834150][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.842342][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.850521][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.859012][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.867133][ T112] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.874224][ T112] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.884709][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.892928][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.902405][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.911050][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.919435][ T112] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.926463][ T112] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.944149][ T279] device veth0_vlan entered promiscuous mode [ 24.953016][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.961510][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.970020][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.978789][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.987154][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.996164][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.004415][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.012966][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.021321][ T112] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.028396][ T112] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.035916][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.043582][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.053554][ T280] device veth0_vlan entered promiscuous mode [ 25.062098][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.070523][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.078628][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.087923][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.096293][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.103947][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.116650][ T281] device veth0_vlan entered promiscuous mode [ 25.123309][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.131416][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.140009][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.147710][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.170180][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.178718][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.186751][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.195074][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.203770][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.211864][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.220218][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.228496][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.236624][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.245623][ T280] device veth1_macvtap entered promiscuous mode [ 25.254717][ T279] device veth1_macvtap entered promiscuous mode [ 25.263178][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.271364][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.280125][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.288375][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.299321][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.307727][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.321169][ T283] device veth0_vlan entered promiscuous mode [ 25.328582][ T281] device veth1_macvtap entered promiscuous mode [ 25.337757][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.346053][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.353834][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.361947][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.370710][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.380376][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.388807][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.397950][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.406290][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.421141][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.429900][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.450321][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.459042][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.467506][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.477142][ T283] device veth1_macvtap entered promiscuous mode [ 25.490285][ T280] request_module fs-gadgetfs succeeded, but still no fs? [ 25.502324][ T279] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 25.515166][ T282] device veth0_vlan entered promiscuous mode [ 25.524557][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.533042][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.542295][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.551236][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.576754][ T282] device veth1_macvtap entered promiscuous mode [ 25.602323][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.613442][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.623444][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.632370][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.641257][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.649775][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.658424][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.671817][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.693262][ T316] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.712787][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.723394][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.824466][ T336] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=137 sclass=netlink_audit_socket pid=336 comm=syz.3.15 [ 26.037363][ T317] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 26.299385][ T317] usb 2-1: Using ep0 maxpacket: 32 [ 26.337733][ T429] bridge: RTM_NEWNEIGH with invalid state 0x20 [ 26.374353][ T426] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 26.427348][ T317] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 26.440095][ T317] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 26.451366][ T317] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 26.461579][ T317] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.484524][ T317] usb 2-1: config 0 descriptor?? [ 26.517276][ T25] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 26.537962][ T317] hub 2-1:0.0: USB hub found [ 26.702671][ T479] netlink: 'syz.4.79': attribute type 4 has an invalid length. [ 26.751469][ T483] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 26.807300][ T317] hub 2-1:0.0: config failed, can't read hub descriptor (err -22) [ 26.877496][ T25] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 26.879320][ T52] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 26.890194][ T25] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 26.906481][ T25] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 26.916701][ T25] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 26.929798][ T25] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 26.937756][ T317] usbhid 2-1:0.0: can't add hid device: -71 [ 26.939460][ T25] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.946000][ T317] usbhid: probe of 2-1:0.0 failed with error -71 [ 26.961745][ T25] usb 3-1: config 0 descriptor?? [ 26.998101][ T317] usb 2-1: USB disconnect, device number 2 [ 27.051905][ T511] 8021q: VLANs not supported on ip6gre0 [ 27.147400][ T52] usb 4-1: Using ep0 maxpacket: 8 [ 27.267316][ T52] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 27.275827][ T52] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 27.285886][ T52] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 27.295683][ T52] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 27.305642][ T52] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 27.318845][ T52] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 27.328772][ T52] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.395648][ T534] tpacket_rcv: packet too big, clamped from 4080 to 3936. macoff=96 [ 27.409385][ T112] ================================================================== [ 27.417524][ T112] BUG: KASAN: use-after-free in rcu_segcblist_enqueue+0x85/0xa0 [ 27.425298][ T112] Write of size 8 at addr ffff88810fb8fd90 by task kworker/u4:2/112 [ 27.433331][ T112] [ 27.435701][ T112] CPU: 1 PID: 112 Comm: kworker/u4:2 Not tainted syzkaller #0 [ 27.443178][ T112] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 27.453263][ T112] Workqueue: l2tp l2tp_tunnel_del_work [ 27.458757][ T112] Call Trace: [ 27.462083][ T112] __dump_stack+0x21/0x24 [ 27.466434][ T112] dump_stack_lvl+0x1a7/0x208 [ 27.471145][ T112] ? show_regs_print_info+0x18/0x18 [ 27.476376][ T112] ? thaw_kernel_threads+0x220/0x220 [ 27.481689][ T112] print_address_description+0x7f/0x2c0 [ 27.487267][ T112] ? rcu_segcblist_enqueue+0x85/0xa0 [ 27.492607][ T112] kasan_report+0x100/0x140 [ 27.497137][ T112] ? rcu_segcblist_enqueue+0x85/0xa0 [ 27.502439][ T112] __asan_report_store8_noabort+0x17/0x20 [ 27.508163][ T112] rcu_segcblist_enqueue+0x85/0xa0 [ 27.513298][ T112] call_rcu+0x4df/0x1090 [ 27.517582][ T112] ? rcu_gp_kthread_wake+0x90/0x90 [ 27.522723][ T112] ? debug_smp_processor_id+0x17/0x20 [ 27.528099][ T112] delete_node+0x1c0/0xa60 [ 27.532534][ T112] ? __kasan_slab_free+0x11/0x20 [ 27.537506][ T112] __radix_tree_delete+0x258/0x3c0 [ 27.542634][ T112] radix_tree_delete_item+0x257/0x360 [ 27.548005][ T112] idr_remove+0x43/0x60 [ 27.552319][ T112] l2tp_tunnel_del_work+0x34f/0x3d0 [ 27.557515][ T112] process_one_work+0x6fd/0xbc0 [ 27.562364][ T112] worker_thread+0xa8e/0x13c0 [ 27.567047][ T112] kthread+0x324/0x3b0 [ 27.571107][ T112] ? worker_clr_flags+0x190/0x190 [ 27.576145][ T112] ? kthread_blkcg+0xd0/0xd0 [ 27.580732][ T112] ret_from_fork+0x1f/0x30 [ 27.585140][ T112] [ 27.587461][ T112] Allocated by task 534: [ 27.591718][ T112] __kasan_kmalloc+0xd4/0x100 [ 27.596393][ T112] __kmalloc+0x19f/0x330 [ 27.600796][ T112] l2tp_session_create+0x39/0xb60 [ 27.605928][ T112] pppol2tp_connect+0xbf5/0x1640 [ 27.610884][ T112] __sys_connect+0x3ce/0x450 [ 27.615485][ T112] __x64_sys_connect+0x7a/0x90 [ 27.620259][ T112] do_syscall_64+0x31/0x40 [ 27.624703][ T112] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 27.630606][ T112] [ 27.632933][ T112] Freed by task 112: [ 27.636822][ T112] kasan_set_track+0x4a/0x70 [ 27.641417][ T112] kasan_set_free_info+0x23/0x40 [ 27.646368][ T112] ____kasan_slab_free+0x125/0x160 [ 27.651484][ T112] __kasan_slab_free+0x11/0x20 [ 27.656275][ T112] slab_free_freelist_hook+0xc5/0x190 [ 27.661645][ T112] kfree+0xc0/0x270 [ 27.665471][ T112] l2tp_session_put+0xb2/0x1a0 [ 27.670231][ T112] l2tp_session_delete+0x3a9/0x4a0 [ 27.675346][ T112] l2tp_tunnel_del_work+0x180/0x3d0 [ 27.680570][ T112] process_one_work+0x6fd/0xbc0 [ 27.685413][ T112] worker_thread+0xa8e/0x13c0 [ 27.690086][ T112] kthread+0x324/0x3b0 [ 27.694164][ T112] ret_from_fork+0x1f/0x30 [ 27.698601][ T112] [ 27.700924][ T112] Last potentially related work creation: [ 27.706669][ T112] kasan_save_stack+0x3a/0x60 [ 27.711350][ T112] __kasan_record_aux_stack+0xd2/0x100 [ 27.716824][ T112] kasan_record_aux_stack_noalloc+0xb/0x10 [ 27.722627][ T112] call_rcu+0x11a/0x1090 [ 27.726870][ T112] pppol2tp_release+0x1e3/0x2b0 [ 27.731717][ T112] sock_close+0xb8/0x200 [ 27.735954][ T112] __fput+0x2dc/0x730 [ 27.739959][ T112] ____fput+0x15/0x20 [ 27.743964][ T112] task_work_run+0x127/0x190 [ 27.748570][ T112] exit_to_user_mode_loop+0xcb/0xe0 [ 27.753787][ T112] exit_to_user_mode_prepare+0x76/0xa0 [ 27.759270][ T112] syscall_exit_to_user_mode+0x1d/0x40 [ 27.764750][ T112] do_syscall_64+0x3d/0x40 [ 27.769181][ T112] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 27.775080][ T112] [ 27.777436][ T112] The buggy address belongs to the object at ffff88810fb8fc00 [ 27.777436][ T112] which belongs to the cache kmalloc-512 of size 512 [ 27.791505][ T112] The buggy address is located 400 bytes inside of [ 27.791505][ T112] 512-byte region [ffff88810fb8fc00, ffff88810fb8fe00) [ 27.804771][ T112] The buggy address belongs to the page: [ 27.810438][ T112] page:ffffea00043ee300 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10fb8c [ 27.820674][ T112] head:ffffea00043ee300 order:2 compound_mapcount:0 compound_pincount:0 [ 27.828990][ T112] flags: 0x4000000000010200(slab|head) [ 27.834444][ T112] raw: 4000000000010200 ffffea0004450b00 0000000500000005 ffff888100043080 [ 27.843029][ T112] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 27.851604][ T112] page dumped because: kasan: bad access detected [ 27.858028][ T112] page_owner tracks the page as allocated [ 27.863774][ T112] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 95, ts 5466708184, free_ts 0 [ 27.881731][ T112] prep_new_page+0x176/0x190 [ 27.886342][ T112] get_page_from_freelist+0x225f/0x23f0 [ 27.891894][ T112] __alloc_pages_nodemask+0x29a/0x640 [ 27.897288][ T112] new_slab+0x84/0x3f0 [ 27.901361][ T112] ___slab_alloc+0x2f8/0x4c0 [ 27.905943][ T112] __slab_alloc+0x63/0xa0 [ 27.910265][ T112] __kmalloc_track_caller+0x1e4/0x310 [ 27.915629][ T112] __alloc_skb+0xdc/0x520 [ 27.919969][ T112] alloc_uevent_skb+0x85/0x240 [ 27.924736][ T112] kobject_uevent_net_broadcast+0x335/0x5a0 [ 27.930629][ T112] kobject_uevent_env+0x52b/0x700 [ 27.935667][ T112] kobject_synth_uevent+0x452/0x940 [ 27.940874][ T112] store_uevent+0x16/0x30 [ 27.945194][ T112] module_attr_store+0x5f/0x80 [ 27.949951][ T112] sysfs_kf_write+0x129/0x150 [ 27.954641][ T112] kernfs_fop_write_iter+0x2bd/0x400 [ 27.959913][ T112] page_owner free stack trace missing [ 27.965270][ T112] [ 27.967607][ T112] Memory state around the buggy address: [ 27.973262][ T112] ffff88810fb8fc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.981346][ T112] ffff88810fb8fd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.989407][ T112] >ffff88810fb8fd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.997483][ T112] ^ [ 28.002100][ T112] ffff88810fb8fe00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.010159][ T112] ffff88810fb8fe80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.018225][ T112] ================================================================== [ 28.026276][ T112] Disabling lock debugging due to kernel taint [ 28.039148][ T24] kauditd_printk_skb: 78 callbacks suppressed [ 28.039161][ T24] audit: type=1400 audit(1793085755.770:152): avc: denied { read } for pid=76 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 28.067123][ T24] audit: type=1400 audit(1793085755.770:153): avc: denied { search } for pid=76 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 28.088619][ T24] audit: type=1400 audit(1793085755.770:154): avc: denied { write } for pid=76 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 28.110115][ T24] audit: type=1400 audit(1793085755.770:155): avc: denied { add_name } for pid=76 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 28.130817][ T25] usbhid 3-1:0.0: can't add hid device: -71 [ 28.136817][ T25] usbhid: probe of 3-1:0.0 failed with error -71 [ 28.143306][ T24] audit: type=1400 audit(1793085755.770:156): avc: denied { create } for pid=76 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 28.164891][ T25] usb 3-1: USB disconnect, device number 2 [ 28.170722][ T24] audit: type=1400 audit(1793085755.770:157): avc: denied { append open } for pid=76 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 28.170740][ T24] audit: type=1400 audit(1793085755.770:158): avc: denied { getattr } for pid=76 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 29.600267][ T15] usb 4-1: USB disconnect, device number 2