last executing test programs: 3.940721412s ago: executing program 4 (id=80): r0 = io_uring_setup(0x2a90, &(0x7f0000000240)={0x0, 0x86a1, 0x2, 0x3, 0x277}) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000cc1ef420890b070064ef000000010902120001000000000904"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(r1) madvise(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x65) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x181) close_range(r0, 0xffffffffffffffff, 0x0) 2.680411543s ago: executing program 1 (id=123): socket$inet6(0xa, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/kvm/parameters/nx_huge_pages\x00', 0x2, 0x0) write(r0, &(0x7f00000000c0)='1', 0x1) socket$tipc(0x1e, 0x5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000000002) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='rpc_pipefs\x00', 0x12b6c3, 0x108) r4 = fsopen(&(0x7f0000000300)='nfs4\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000400)='source\x00', &(0x7f0000000500)='127.0.0.1:/\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000600)='addr\x00', &(0x7f0000000700)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000800)='clientaddr\x00', 0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000a00)='vers\x00', &(0x7f0000000b00)='4.0\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000c00)='sec\x00', &(0x7f0000000d00)='krb5\x00', 0x0) r5 = fsopen(&(0x7f0000000e00)='nfs4\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000c00)='sec\x00', &(0x7f0000000d00)='krb5\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) (async) nanosleep(&(0x7f0000000e00)={0x0, 0x186a0}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) 2.652729594s ago: executing program 0 (id=126): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r1, &(0x7f0000000140)="ed", 0x1, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @empty, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x304}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001480)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$tun(r2, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r2, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) recvfrom(r0, &(0x7f0000003800)=""/4085, 0xffffffb6, 0x100, 0x0, 0x0) writev(r0, &(0x7f0000001400)=[{&(0x7f0000000140)="58ddb007a47a8b1f458ab677d557ca50def8e5bc61dbc50bca64f7e76268cd64007095adfef77465b69ec03139854d6f03d5f9bd019fe046035ef7049f48fcc7321c34faca94ff08f59edaf2ab55eedcc278df823564618627217a527b971bdfa0afd948a6cdb9e05ccaef35c22047246a7b97a8e1b645e51c47b296c759c8dfd56beb8fa15c800ad060ab378a269557bc053d9be903", 0x96}, {&(0x7f0000000300)="2ea63d218bc1023b2e6eceeb92d548803a43d4dddc2433c76650030c188f490311ff86da69fab1539139f6dda31739c2bb4412dd471137e2a53496c5f7707e01ccfb826f2eb96895230862e11d56c19af139de912ac5e68a99080e428443fcfba8b0460290c6275affe9953a97260b0304fd7ef159c9cd30cae1bcc75d568d353575ec3b5293fb80de85c7562804230489274831b2c17dccccc523ada66a46", 0x9f}, {&(0x7f0000000440)="63e73686513c53aec098be4b2dfc27b5be1f5f85f54c24efb8fc94ccaac29f1378e04daa49f8dcbda8b0faff57761a0ce8a311802e5dd07a159721cac7d2250f4359e04727386cc7d1a3e8bf93339f3df1340041f71046f2b1d9a80af70fb8246258d09c310af3bef017fde1fd8ce505cd4858549192a95e512257b6c676a7ebb41230e4e4fb23e9666bfdc8bc2ca77bbd11810836df4a6f3dbe3ee75c34b07c64e1af6d62d54fccb9f281eac16eca7129aa4355fd53", 0xb6}, {&(0x7f0000000500)="de21cff472aa580c2ee9f858", 0xfc96}, {&(0x7f00000014c0)="8fa68a274cab49b9c806172798e6a829701bb4eefee6919e0a30fa83a50170b6a3b499361f95ab6ff05f9001332b3a463b64282a924b0dcf6499c8c9b23d7290ab896ed6e2c7280dcda0336864e06d9570ea2cc78330859fa73080f5ddd3fd2b943287b312357816e9cfaa9e8941dd981f837506cabc6e016e507076819ff37d790c0b868166925649c9a74f4afc322ac971832fc3f12ba4dd3931c773134441bd46d9b10095eaabcfb846ac5fa9ea76f3547884091f073880656438f4406cf2051edb37139066dcaed45a544f5f92cccb1db0e2e503de3d4216d961dea1cbd9119a3f49b8bcdfe7078a7706296712eab5bd91b189f0140892b56c46912cc16dbe9fb469502eb67f36e8531dbfbed70615a836d32b5dabcf933201c97b29209e071433edb1b92ba47b514232654a36067c9b241737eb902ede1e18f99757339d2858bbe9c48484ec608e5fae534c4580d22fcd6ad28a786e0f5e675bc264ca03cf081038cb872e039100f94d25a7b5b9f2f18815e948aa65513c63a61e68c6a4ef4888980b54e3b7332112ee424e65172b2076528cd11cf63d7f4ff88c9eabf2c388bcb02beaa7e9c33cbe26149703fd3d511283739fa9638b1d6290a53b679227ee54d0fb232befdc92e59396c5bb818926e8a30a38a0aa358e1c818dbc27646fb4dc43168540cf724358d07124937cb3baa5365970e14240d727a8111d250202b39e8e3d6ff5e250eb09fdd83b8a129015567ae0f71a6b9166cd3718e3a83e711271f2ffd2d968e1153a38a8c5995e5c46fb8f22613690852bbea407b417eff9fd86e685025cbad82174164c3529407c4a27af5c6fdd911a4a87b7365655d5275c5719151b4440752785ff416a8e3a1f83f70e1f5d2538348b839f4e965e586e8b28a8aa94b79bc4e23d97d159af010918721be419234850fbeac52bb5de10a199f6591ab4deea9670e8b3d9f9341cddef4f3fe1b08a4f1943329cfa12c3972fc50525b8ebb5923235bbecd182d486169cf51e8c69259a404c0867328943358e95ad690a9c8eea73ddde677ebfe6f0d5f2e3a03541291e09a30bcce4b66550c28c6ba6cc431bb0fa87848652fb9319577a38a8ad45a87647b523fe3e452d90306c4c690b47d3c840ebbb1d96abb0735b21f557f5de101b7fbb7618d9739fabf89b8fb34c02493d1bfc31e80b1a9fcdac8aaf0fd69a0aee6f456705420ea3e7df30b478dd12ee137a6d6747750e5d6a7e5d308276c0ebd77377f000296108954f5371a9c84a01a18a76bee8ea849ddaf492a35f943ac395b9dddbd5ee05f6d75ac40237a0690584d7afaa3e117135b1406e03c9e49223ee48feccab18a3fd0325ed281bc70fb41b4f13905744afcbb588b8daee6d635007cf96dbd9549726c4cf9e350072702058bb533a4bb598a06e5505e8393b2793cc6ac2d66a0529b2aa7991a30f8bdd2bec5ac7ca2064e7b3a2a2d510de4675a7a6ce5d1729c2b98dbb08ab4a33cbd83484092d48b9c4fac7b7b6191057a2acf109565c6d49d9be0f1f2838650cdc36ad835fd78be83c6df052659ed1e8242d45891442a54205311da1814b18ed7fcc7c5bd979434040cd2133fd35ab946ff87e807a48a4802a1e4cce7cef4f2f555029cdecadaf99c5c3bf65db4be3940bfedb87cc491ac59d027496d87a792961f1f59cb72df3280b1845722282745fa77dfa1fce5e67e09466475c0e988719e528d39815cdfe0d16a6de1d871cfc4778ed47e8a7d3b2dfeea2083a41b061848324fe15e90c2dac3303992fdc42ba1a1995b87154a618660094a942074c5e02ed1a11293c5276b06439468f99c9d184c0152c44308c64c432277fe367a7fac9c9fb08d9dc8949e8ab9740a357fdc9d69df07375d011947b43072f554d63831af4319664e735c3eb08c0afe5120bd89b4d0654b6266aa4709ea2beb3dfd0449d2c3fde3f1098c9f73d994a741bb9f3c5322743c310fd7881856e5d529f4a9eb7dc43c0be6c36653b2cda92a7f07247450d666ca88863c6880d656eb8006bfe2f96543bf683fe3126e03ccf2120878a4fc46bdf64e11e323637ae0024a3d6fa52729591758c36a5ddeff1d1c5ba3e1bfedad1ff460f05ce276f1f3c2d70f9c6c5927a8fd15e65bc9c648b7dfccde510f5bf46bab8f2c5e21cb129dbf3f4df7a5a831f198f21fee429d73646eab00b1542941108592708fe8f53613d6b7dc1e4999374317b57c1e4a974fedd089c4295682d1a03d770b7639e80d25b0f428dfd3c46be492fc80b5c4913e476845a359dbe4187fd0027bd9fc814ba6a2877b61b637878f2af7ef18a0858fe5c7e75ecf92e735452456089efae8a13d3e6ac9d28c18cb1ca54522066edbf9e67ab4cf158b63c7b4d25146bafa14163cd4d171ad97f3ef93cfabae0557e237bbbe9cb80144b03f6fdb7d357d253235ddbde503829403657fdde516d3974091c40c6b9dd245f730458e1fd594f6b694af0150cbd31b6d0fb3bc04eb5096e704e039eecf4be9e93eb2f841878538ed1c46d015b1a792b599ed9225577460f72e6b4e271e5e6eeed34f69cfd76683e21d87e3ee8ed88df79901f9354823824fa6b67a91e2626161436327fc58879085d87db5dd94e09a0d24c7c381fb8fdc7198d2c2fece49e6496a119023852fca717d2ff2f9ed5e0715ddebd267ed0b8378ad852b03a539e6d03025b4a04f2483bdb79a4bd233ce3b6bd30d736ad0784b978861badc236e7106d23f26eac50e93d8ab012dc7c5d85d4f944aaa27378efc99572f932344cddc488ffa9210dc6b8f0cc29d07110362485eaa5b4b196a49c7080633c1befe802207ed0a172fa0b61fea6305f04d7b755a6e5e162aa8047f80647ad0bae8143226ce3aa8de3b0c0fc4e7cd6baab274fba47abf95ae88584778325250063855a4b9f0c966efa43dc0196d3dec619c490181c259b341b3fd370bab0b66af3cb1e9365cf6b62e44d939d36ffcc6badb924f44e86337360efbf4e3f9bd716adbc3f0ba6055ec9790504c9f3865f47e422b1c6ba16c07d0df618cc572b36ec8e519db90a499424a7d689e6fbcc9be1abd843512ec16540c6c7c6d6e2cf50ab2014e4208c2abb0ddfd2ef9dece79389f21d7a9985903f7f01b0394d268349fa41a487bacfe8deba2ffca815ad0b1c6ffa5af2eba6d9436ad298c4e11b68451c7ff001c02ddd3ceb153a865327845349e8b817aa8ed24924f49260f8209d0ddcacf5306d9222320776162fe8396914fa22c85bc261661fa547c3063e20ca37c0862c3b9abd3da9b02e3f58d89be00003509bae9b82f60975c0687c500bb213a580f6e9f08b207d7c31748e3fda05a0cc76b1fdd563610a2bb09a57020d85026a57a178c38839b5b88cd8434d1f0308d872c7356a6445de801ff14c133bda3b42b9ca099fb3ee0d5c7a835f56ed30aa75d47cd97c329b682879290faee167334500d2fe596564f3e4064f41cf3469aaae846f1e84f3d8a7f42d98d0b6b67913c376d6bbde3027aa41b753ace165f88379981685f918ada5043800b5e0a0865dcda94df85fefa9348d6ec4e1ffbd940d023fbbd3b77d5db572981dbe40cbae9f010c1ea02718b1c4b7d0447c9d83d1afea58097a0467d6cdd47aef05f97dab63462f6ea61f4b611040b30e7cf60a499aa9d0bc50c08463f25a47d2dbc958fe1d1cf2399dcf1952987b6fcbc97bf73b12177c374c8fd56c8228fc796c958687104f4eb9d46ab80eeeeedb7096a67ee440ae92a65cbf6f81939e3d1050c67245036b5dcc13d577fbb4d9c3fbf2e2e61aa154074ae225c54e23289c4ef41a07a49a9d40f3103f4c9dfd4d750cc646adadd2e1fe24c74ce099d753d4c59d806a0b7f576ac37ac58a51a120f93162c43d16c1f7e5289c75f5f0a5b838d020040c9ce512ca35d08f42acd24cdbc2e6b1ac3c6809a5ed9e272155e9fa55349bc3ce0e3f2d1624dc60e2396b954587bbab275f38911e86b826b85730c6670a92a221cdcbf18ee0c44aec4591fcd12204b3049a1b5da1215a4cf88ecbe2d877ef975f4f661999d17d7d9ec14e0895ce25034dac4705d50ae42ca162778d0dcfc4e9180517be0daca5deb10773f93e2c61a5fe9b823218a97c35d0d7b436b2e1afb670b5a4c6dacd401afd1832c1dd96e8eba7734954070c6796cc80707441404cfe95fabf214bf03a6e4643ca559c2b8dcf1fa871114f3dc973a056c9aee7cd0ed4cbaf18298377e750869551632c1713bd8372e3f11fa02edf0a68d2c01245459d9e78597ac1eec75064024c1f3c98260d34b611ba8fa4b2022babd44b76ea70c718df8268dba447038b1539f0499603cf2d79bcc49c35a8cf38892d982d153d72253a22ae68da65e84d6399e81a14ebf89ba446630814d9dcf8914acafc8603a5396167c5aa99814af62c1c39a6ba76ad2c6c51a6d56d89fbda5334e626540ef1b1ecad53247531fcdd661a48d28a6d48bac8ef70c888b00db57edceee94425df5161e1b1a1bec9c897e01867442ed8ba000b5f75832a8ec57ef0737994b95f40eac48f3c8da5db80e965fcdf3f0bbb4439a7123b59987f0fdac96bc7ce09c013562ff7c0cb23a882828e45a51f7e748db90c5eaacfdf3657d11a348f747ddd860387de41be3376a5dabf4296bc05282cb73fcd60c4a4148d9e872ae86e30b22db1ce5452ad9fe3fea029f94a583d301e74eac1818da3f1279c63690db6e7166ddaacd1278716fa3221daaa27c98fd97b88e63208d604505ad8f31bd2b83a19f89480b71198d8a31c89cadd258ce338afe1a26b0db248c1a39fe027716e417e45bb6c9a68cab1cd6c3445e9796ee1003650e97eccdadc9bea540e2c8253652c8f1586ba7e508cd29d53467bad11eef729796dbe83d3fc0bc15762c2f1de34c6380a6725f94600a82d87ccf80948babcadec31ca654671d17de360f20aaf04f4d44951661fe8fe7731174ec3aaf330aebeaed9620f694859785a36c5f787ce35e4425ed3387710fa346f04db11255c6985fa4cdbe54d25c942264b3383d60903bd2677611850fe125b", 0xdf3}], 0x5) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) 2.496560908s ago: executing program 0 (id=127): r0 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e23, 0x8001, @empty, 0xffffff5d}, 0x1c) listen(r0, 0x50) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000fee000)=0x3fa, 0x4) bind$inet6(r1, &(0x7f0000000140)={0xa, 0xe23, 0x5, @empty, 0x4}, 0x1c) listen(r1, 0x50) close(0x4) 2.496379648s ago: executing program 0 (id=128): r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/ip_vs_stats_percpu\x00') read$eventfd(r0, &(0x7f0000000380), 0x8) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) bpf$PROG_LOAD(0x5, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = userfaultfd(0x80001) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x100}) readv(r2, &(0x7f00000042c0)=[{&(0x7f0000000000)=""/16, 0x10}, {&(0x7f00000000c0)=""/184, 0xb8}, {&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000001400)=""/86, 0x56}, {&(0x7f0000001480)=""/244, 0xf4}, {&(0x7f0000001580)=""/227, 0xe3}, {&(0x7f0000002100)=""/4096, 0x1000}, {&(0x7f0000000180)=""/250, 0xfa}, {&(0x7f0000003200)=""/147, 0x93}, {&(0x7f00000032c0)=""/4096, 0x1000}], 0xa) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000000000/0x400000)=nil, 0x400000}, 0x1}) syz_genetlink_get_family_id$tipc2(&(0x7f00000020c0), 0xffffffffffffffff) syz_genetlink_get_family_id$ethtool(&(0x7f0000001b00), 0xffffffffffffffff) ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f00000003c0)={&(0x7f0000000000/0x800000)=nil, 0x800000}) 2.451258089s ago: executing program 4 (id=130): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/config\x00', 0x2, 0x0) pread64(r0, &(0x7f0000000500)=""/100, 0x6a, 0x0) 2.332560932s ago: executing program 4 (id=132): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000580)=ANY=[], 0x8) connect$inet6(r0, &(0x7f00000004c0)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) sendto$inet6(r0, &(0x7f00000000c0)="8a35a8199ca79a51", 0x8, 0x3b00, 0x0, 0x0) 2.332201841s ago: executing program 4 (id=134): capset(&(0x7f0000000100)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200003, 0x0, 0x0, 0x3}) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='oom_adj\x00') writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000140)='3', 0x1}], 0x1) 2.280253923s ago: executing program 4 (id=136): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x48, r1, 0x5eae78d9c54e9d3f, 0x2, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_SEC_KEY={0x2c, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_BYTES={0x14, 0x4, "acc8ef65b6c1020aa28bf8fad4a69fd9"}, @NL802154_KEY_ATTR_ID={0xc, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x1}]}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x4}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x40}, 0xc002) 2.247067104s ago: executing program 4 (id=137): timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000180)='./tracefs/instances/foo/events/mygroup/myevent/enable\x00', 0x2, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x200) 1.727132917s ago: executing program 1 (id=139): r0 = syz_open_dev$loop(&(0x7f0000000200), 0x5, 0x86100) r1 = syz_open_dev$loop(&(0x7f0000000300), 0x8f, 0x40240) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000001280)={r0, 0x0, {0x2a12, 0x80010000, 0x0, 0x0, 0x4, 0x0, 0x0, 0xe, 0x14, "fee8a2ab78fc179fd1f809000000aca7ca64c6a4b4e00d9683dda1af01000000deff1200100000000000000000000000000800", "2809e8dbe1b22d0000b420a1a93c7540f476779e0117613dd4070000ebff08000000000000000000020000000800000000faffffff00", "2e0000000000008bd028000000000000000000ec00", [0xe0]}}) 1.699907137s ago: executing program 1 (id=141): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'vlan0\x00', 0x0}) 1.608508s ago: executing program 1 (id=142): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) io_setup(0x9, &(0x7f0000000340)=0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) io_submit(r0, 0x2000000000000211, &(0x7f0000000840)=[&(0x7f00000004c0)={0x0, 0x0, 0x0, 0x8, 0x9, r1, 0x0}]) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0xc008045}, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000280), 0xa0201, 0x0) fcntl$setstatus(r6, 0x4, 0x800) openat$vcsu(0xffffffffffffff9c, &(0x7f0000000180), 0x241, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e22, 0x4, @loopback, 0x81}, 0x1c) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f00000002c0)) mkdir(&(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000180)={@loopback={0xfec0ffff00000000}, 0x8000000, 0x0, 0x1, 0x1, 0x9, 0x5}, 0x20) r7 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0) write(r7, &(0x7f0000000400)='dummy_udc.0', 0xb) close(r7) r8 = socket(0x2, 0x2, 0x0) unshare(0x20400) bind$inet6(r8, &(0x7f0000000480)={0xa, 0x3, 0xfffffffc, @private2}, 0x1c) r9 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/dummy_udc/bind\x00', 0x1, 0x0) write(r9, &(0x7f0000000400)='dummy_udc.0', 0xb) 1.59304904s ago: executing program 3 (id=144): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=@ipv6_newnexthop={0x20, 0x68, 0x1, 0x0, 0x0, {0x2}, [@NHA_OIF={0x8, 0x5, r1}]}, 0x20}}, 0x0) 1.565786481s ago: executing program 3 (id=145): r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000000)={@private0, 0x40, 0x1}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @private0}, 0x1c) listen(r1, 0x5) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000180)={0xa, 0x4e23, 0x0, @private0}, 0x1c) connect$inet6(r2, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @private0}, 0x1c) close(r2) syz_emit_ethernet(0x4e, &(0x7f0000000200)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0x0, @private0, @private0, {[], {{0x4e22, 0x4e23, 0x7fffffff, 0x0, 0x0, 0x0, 0x6, 0x2, 0x1000, 0x0, 0x0, {[@nop, @nop]}}}}}}}}, 0x0) 1.511352652s ago: executing program 0 (id=146): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb0100180000000000000034000000340000000600000004000000000000010400000020040000000000000000000d040000000000000000000010040000000400000000000008030000000000000061"], 0x0, 0x52}, 0x28) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 1.511150152s ago: executing program 0 (id=147): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x4b564d02, 0xec000000, 0x4}]}) 1.511019062s ago: executing program 1 (id=148): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IRQ_LINE_STATUS(r1, 0xc008ae67, &(0x7f0000000140)={0xa, 0x6}) 1.510891222s ago: executing program 3 (id=149): openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) rmdir(&(0x7f0000000200)='./config/usb_gadget/g1/functions/uvc.usb0\x00') 1.386735965s ago: executing program 3 (id=150): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x11, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000340)='syzkaller\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setscheduler(r0, 0x0, &(0x7f0000000280)=0x5) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$VHOST_SET_VRING_NUM(0xffffffffffffffff, 0x4008af10, &(0x7f0000000500)={0x0, 0x80000001}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) r3 = add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f0000000080)={'fscrypt:', @desc2}, &(0x7f00000000c0)={0x0, "f1a1173fb9462d3589e67197f90be6e423ceb0ab4912f9f6a31854ec98e950cfed21fcad7ff0fbcb566a0982f8938caa52dd8d39af14c31ed56ad59300"}, 0x52ba, 0xffffffffffffffff) keyctl$KEYCTL_MOVE(0x4, r3, r3, r3, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r4 = fsopen(&(0x7f0000000000)='f2fs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f00000000c0)='test_dummy_encryption', &(0x7f0000000180)='v2to_da_alloc', 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x3, &(0x7f0000000440)=[{0xc, 0x0, 0x5, 0x7fff7ffc}, {0x5, 0x64, 0x9, 0x6}, {0x0, 0xfd, 0x11, 0x7fffffff}]}) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x1) r5 = syz_open_procfs(r0, &(0x7f0000000040)='stat\x00') pread64(r5, &(0x7f0000000140)=""/15, 0xf, 0x4) 1.386533875s ago: executing program 0 (id=151): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r1, 0xae03, 0xf4) openat$sndtimer(0xffffffffffffff9c, 0x0, 0x101040) fsetxattr$trusted_overlay_upper(0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x0, 0xfb, 0x107, 0x1, 0x1, "1d00000c00", "0902935665a27c78c8d23d45f15c43cf03be7c3f9e5c1c9a108f3cfe97bdceba6eb860837cf964f1a40a0dfe429918a3c16e713966aef513ac9a2d7a804f79f99baa4e2de682cd3471308f680bba63ae00cd6eb7286d50bb0dcc5635983202a01ed1945cd59d70f9f1cea6ff6e9c1402093af700fe3871ad38f5c5f8df90974e54ec83f85730dbdcfb9c070816b79f030fe9801b492d19e69f5ad153977e9e549980b982fca4c898545f1433b1f69a09e5dfede50754ce31d40d4038caa306ee486f4f651edfff757fc3124b573a316c8183de6194ffde82251403cd85689ba3447ee3c5615f0b7f882e5e2fdf6060f84efb"}, 0x107, 0x1) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f0000000400)=0x79) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) sendmsg$NL80211_CMD_JOIN_IBSS(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={0x0}, 0x1, 0x0, 0x0, 0x40040e0}, 0x20004800) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$WG_CMD_GET_DEVICE(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x28, r6, 0x301, 0x70bd2c, 0x25dfdbfe, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x2004c001}, 0x20040000) 1.346967726s ago: executing program 1 (id=152): r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="0d01000009000008250592d20700006a3b010902241700fa0074980904e4ff11070103000905010200ffe0000009058202"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000200)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB=' '], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(r0) syz_usb_connect(0x3, 0x9f, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) 1.044226434s ago: executing program 2 (id=154): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000200)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000700000014000180050002000100"], 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x8) 540.299297ms ago: executing program 2 (id=155): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000800)='./ram0\x00', 0x8000, 0x100) r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./ram0\x00', 0x2, 0x0) dup2(r0, 0x64) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/cluster/mycluster/heartbeat/myregion/dev\x00', 0x2, 0x0) write(r1, &(0x7f0000000640)='100', 0x3) 509.648087ms ago: executing program 2 (id=156): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000480)={0x2c, r1, 0x1, 0x0, 0x1, {}, [@ETHTOOL_A_DEBUG_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x4048086) 78.602758ms ago: executing program 3 (id=157): mkdirat(0xffffffffffffff9c, &(0x7f00000000a0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000000a0)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x80000) mount(0x0, &(0x7f0000000040)='./config\x00', 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000800)='./dev/ttyGS0\x00', 0x2, 0x0) 78.346658ms ago: executing program 2 (id=158): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x3, 0xc, &(0x7f00000019c0)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002e00000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x0, 0xe, 0x0, &(0x7f0000000180)="0000ffffff8d00f03f0100000001", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) 312.91µs ago: executing program 3 (id=159): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) ioctl$PPPIOCGL2TPSTATS(r0, 0x80487436, &(0x7f00000001c0)="e65387") 187.43µs ago: executing program 2 (id=160): r0 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x380000, @loopback}, 0x1c) sendmmsg(r0, &(0x7f0000001d00)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000180)=@l2={0x1f, 0xc}, 0x80, 0x0}}], 0x2, 0x4000000) 0s ago: executing program 2 (id=161): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000000)=0x4, 0x4) r1 = socket(0x10, 0x803, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x24c01, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) getpeername(0xffffffffffffffff, 0x0, &(0x7f0000000400)) syz_usb_connect(0x4, 0x24, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) syz_emit_ethernet(0x0, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x40024, 0x2081}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @xfrm={{0x9}, {0x4}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x54}, 0x40) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r3, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000240), 0x4) r4 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$nl_route(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x437, 0x70bd27, 0x0, {0x0, 0x0, 0x0, 0x0, 0x50561}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @gretap={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @local}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) kernel console output (not intermixed with test programs): [ 21.437605][ T28] audit: type=1400 audit(1785937984.797:62): avc: denied { rlimitinh } for pid=252 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 21.456694][ T28] audit: type=1400 audit(1785937984.797:63): avc: denied { siginh } for pid=252 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 22.920047][ T273] sshd-session (273) used greatest stack depth: 21024 bytes left Warning: Permanently added '10.128.10.15' (ED25519) to the list of known hosts. [ 29.584059][ T28] audit: type=1400 audit(1785937993.007:64): avc: denied { mounton } for pid=278 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 29.587966][ T278] cgroup: Unknown subsys name 'net' [ 29.607027][ T28] audit: type=1400 audit(1785937993.007:65): avc: denied { mount } for pid=278 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.634680][ T28] audit: type=1400 audit(1785937993.047:66): avc: denied { unmount } for pid=278 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.635109][ T278] cgroup: Unknown subsys name 'devices' [ 29.780606][ T278] cgroup: Unknown subsys name 'hugetlb' [ 29.787152][ T278] cgroup: Unknown subsys name 'rlimit' [ 29.891012][ T28] audit: type=1400 audit(1785937993.317:67): avc: denied { setattr } for pid=278 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 29.914534][ T28] audit: type=1400 audit(1785937993.317:68): avc: denied { mounton } for pid=278 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 29.940308][ T28] audit: type=1400 audit(1785937993.317:69): avc: denied { mount } for pid=278 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 29.955640][ T280] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 29.973130][ T28] audit: type=1400 audit(1785937993.397:70): avc: denied { relabelto } for pid=280 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.999731][ T28] audit: type=1400 audit(1785937993.397:71): avc: denied { write } for pid=280 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.059060][ T28] audit: type=1400 audit(1785937993.487:72): avc: denied { read } for pid=278 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.060259][ T278] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 30.084735][ T28] audit: type=1400 audit(1785937993.487:73): avc: denied { open } for pid=278 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.979259][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.986549][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.996967][ T287] device bridge_slave_0 entered promiscuous mode [ 31.004861][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.012832][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.021272][ T286] device bridge_slave_0 entered promiscuous mode [ 31.030918][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.038772][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.046306][ T286] device bridge_slave_1 entered promiscuous mode [ 31.070423][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.077516][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.085120][ T287] device bridge_slave_1 entered promiscuous mode [ 31.223480][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.231658][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.239433][ T289] device bridge_slave_0 entered promiscuous mode [ 31.250995][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.258352][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.266052][ T289] device bridge_slave_1 entered promiscuous mode [ 31.349221][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.357619][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.365691][ T288] device bridge_slave_0 entered promiscuous mode [ 31.372631][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.381306][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.389139][ T290] device bridge_slave_0 entered promiscuous mode [ 31.403743][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.411219][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.419051][ T288] device bridge_slave_1 entered promiscuous mode [ 31.429407][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.437026][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.445550][ T290] device bridge_slave_1 entered promiscuous mode [ 31.492743][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.500156][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.507517][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.514633][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.544890][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.552003][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.559316][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.567620][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.662029][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.669154][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.676442][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.684491][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.693795][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.701150][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.708753][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.715893][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.729804][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.737029][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.744556][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.751809][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.764815][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.772877][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.781049][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.789478][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.798828][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.806658][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.815337][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.822970][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.831557][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.839709][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.847896][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 31.856684][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 31.889073][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 31.896979][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 31.905546][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.912650][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.939194][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 31.949489][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 31.958161][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.965258][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.973078][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 31.982008][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.989126][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.996833][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 32.005753][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 32.016998][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.024371][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.056754][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 32.065875][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 32.074579][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.081753][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.090691][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 32.099951][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 32.108879][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.116025][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.123920][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 32.132702][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 32.141881][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 32.150283][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 32.158624][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 32.167267][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 32.175704][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 32.184217][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 32.192535][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 32.200632][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 32.216308][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 32.243735][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 32.252173][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 32.260107][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 32.270299][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 32.278949][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.286367][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.294723][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 32.303607][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 32.313905][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.322121][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.330986][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 32.341824][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 32.350625][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.358490][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.366819][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 32.376198][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 32.385225][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.392765][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.401250][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 32.410045][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 32.436053][ T286] device veth0_vlan entered promiscuous mode [ 32.448502][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 32.456819][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 32.465305][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 32.474505][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 32.483232][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 32.491851][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 32.500424][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 32.508687][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 32.518302][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 32.526918][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 32.535485][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 32.543188][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 32.556813][ T289] device veth0_vlan entered promiscuous mode [ 32.568771][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 32.580200][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 32.590311][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 32.611585][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 32.620203][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 32.629053][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 32.640584][ T286] device veth1_macvtap entered promiscuous mode [ 32.651243][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 32.660947][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 32.682571][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 32.691827][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 32.700921][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 32.712198][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 32.721377][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 32.731859][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 32.742853][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 32.752083][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 32.761328][ T288] device veth0_vlan entered promiscuous mode [ 32.777422][ T289] device veth1_macvtap entered promiscuous mode [ 32.789429][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 32.798429][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 32.806572][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 32.817061][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 32.826831][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 32.849794][ T290] device veth0_vlan entered promiscuous mode [ 32.858778][ T286] request_module fs-gadgetfs succeeded, but still no fs? [ 32.867110][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 32.878079][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 32.886796][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 32.896845][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 32.905500][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 32.913566][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 32.928847][ T287] device veth0_vlan entered promiscuous mode [ 32.943177][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 32.960651][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 32.974733][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 32.983653][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 32.996602][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 33.010690][ T288] device veth1_macvtap entered promiscuous mode [ 33.022351][ T313] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 33.033738][ T287] device veth1_macvtap entered promiscuous mode [ 33.081615][ T317] loop5: detected capacity change from 0 to 7 [ 33.091309][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 33.099566][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 33.110086][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 33.115564][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 33.129515][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 33.134300][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 33.145233][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 33.154971][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 33.167875][ T317] loop5: unable to read partition table [ 33.174382][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 33.186549][ T317] loop_reread_partitions: partition scan of loop5 (Wý* %4FLQk݊5) failed (rc=-5) [ 33.196887][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 33.205807][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 33.208314][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 33.226201][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 33.235829][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 33.245011][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 33.254428][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 33.260690][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 33.271114][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 33.273602][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 33.280424][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 33.297447][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 33.307229][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 33.322865][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 33.338231][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 33.357484][ T290] device veth1_macvtap entered promiscuous mode [ 33.391162][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 33.408145][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 33.418788][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 33.453572][ T332] loop5: detected capacity change from 0 to 7 [ 33.455476][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 33.478417][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 33.597458][ T346] IPv6: NLM_F_CREATE should be specified when creating new route [ 33.605626][ T346] IPv6: Can't replace route, no match found [ 33.612878][ T346] mmap: syz.1.13 (346) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 33.657855][ T6] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 33.666745][ T350] 9pnet_fd: Insufficient options for proto=fd [ 33.787759][ T328] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 33.837750][ T6] usb 1-1: Using ep0 maxpacket: 32 [ 33.844300][ T6] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 33.857803][ T298] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 33.866399][ T6] usb 1-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 33.876270][ T6] usb 1-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 33.884843][ T6] usb 1-1: Product: syz [ 33.889443][ T6] usb 1-1: Manufacturer: syz [ 33.894208][ T6] usb 1-1: SerialNumber: syz [ 33.900386][ T6] usb 1-1: config 0 descriptor?? [ 33.905934][ T325] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 33.914188][ T6] hub 1-1:0.0: bad descriptor, ignoring hub [ 33.920389][ T6] hub: probe of 1-1:0.0 failed with error -5 [ 33.977766][ T328] usb 4-1: Using ep0 maxpacket: 8 [ 33.984565][ T328] usb 4-1: config index 0 descriptor too short (expected 5924, got 36) [ 33.993211][ T328] usb 4-1: config 250 has an invalid interface number: 228 but max is -1 [ 34.002164][ T328] usb 4-1: config 250 has 1 interface, different from the descriptor's value: 0 [ 34.012310][ T328] usb 4-1: config 250 has no interface number 0 [ 34.020110][ T328] usb 4-1: config 250 interface 228 altsetting 255 endpoint 0x1 has invalid maxpacket 65280, setting to 1024 [ 34.032859][ T328] usb 4-1: config 250 interface 228 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 1024 [ 34.043817][ T328] usb 4-1: config 250 interface 228 altsetting 255 endpoint 0x82 has invalid wMaxPacketSize 0 [ 34.055899][ T298] usb 3-1: Using ep0 maxpacket: 8 [ 34.061932][ T328] usb 4-1: config 250 interface 228 altsetting 255 bulk endpoint 0x82 has invalid maxpacket 0 [ 34.073307][ T328] usb 4-1: config 250 interface 228 altsetting 255 has 2 endpoint descriptors, different from the interface descriptor's value: 17 [ 34.088074][ T328] usb 4-1: config 250 interface 228 has no altsetting 0 [ 34.098559][ T298] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 34.109934][ T298] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 34.120146][ T298] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 34.130454][ T298] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 34.143764][ T328] usb 4-1: New USB device found, idVendor=0525, idProduct=d292, bcdDevice= 0.07 [ 34.153384][ T298] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 34.162592][ T328] usb 4-1: New USB device strings: Mfr=0, Product=106, SerialNumber=59 [ 34.171122][ T298] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.179192][ T328] usb 4-1: Product: syz [ 34.183382][ T328] usb 4-1: SerialNumber: syz [ 34.195692][ T328] hub 4-1:250.228: bad descriptor, ignoring hub [ 34.202101][ T328] hub: probe of 4-1:250.228 failed with error -5 [ 34.397816][ T328] usblp 4-1:250.228: usblp0: USB Bidirectional printer dev 2 if 228 alt 255 proto 3 vid 0x0525 pid 0xD292 [ 34.553480][ T325] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 34.563034][ T325] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 34.620603][ T28] kauditd_printk_skb: 65 callbacks suppressed [ 34.620618][ T28] audit: type=1400 audit(1785937998.047:139): avc: denied { mount } for pid=367 comm="syz.4.21" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 34.652874][ T28] audit: type=1400 audit(1785937998.077:140): avc: denied { ioctl } for pid=324 comm="syz.0.9" path="/dev/input/event0" dev="devtmpfs" ino=260 ioctlcmd=0x550d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 34.679269][ T328] usb 4-1: USB disconnect, device number 2 [ 34.681970][ T325] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 34.695160][ T28] audit: type=1400 audit(1785937998.117:141): avc: denied { unmount } for pid=290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 34.700165][ T325] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 34.732121][ T328] usblp0: removed [ 34.746795][ T28] audit: type=1400 audit(1785937998.167:142): avc: denied { create } for pid=373 comm="syz.4.22" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 34.769041][ T374] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=374 comm=syz.4.22 [ 34.798817][ T374] netlink: 8 bytes leftover after parsing attributes in process `syz.4.22'. [ 34.809469][ T28] audit: type=1400 audit(1785937998.197:143): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 34.844589][ T28] audit: type=1400 audit(1785937998.217:144): avc: denied { create } for pid=375 comm="syz.1.23" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 34.867153][ T28] audit: type=1400 audit(1785937998.217:145): avc: denied { mount } for pid=375 comm="syz.1.23" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 34.915655][ T28] audit: type=1400 audit(1785937998.267:146): avc: denied { name_bind } for pid=375 comm="syz.1.23" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 34.942048][ T298] logitech-hidpp-device 0005:046D:B012.0001: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz1 [ 34.961006][ T28] audit: type=1400 audit(1785937998.267:147): avc: denied { node_bind } for pid=375 comm="syz.1.23" saddr=255.255.255.255 src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 34.995126][ T325] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 35.007983][ T325] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 35.022809][ T28] audit: type=1400 audit(1785937998.277:148): avc: denied { write } for pid=373 comm="syz.4.22" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 35.052843][ T381] fido_id[381]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 35.247794][ T328] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 35.333416][ T404] netlink: 28 bytes leftover after parsing attributes in process `syz.1.35'. [ 35.427789][ T328] usb 4-1: Using ep0 maxpacket: 8 [ 35.434276][ T328] usb 4-1: config index 0 descriptor too short (expected 5924, got 36) [ 35.443460][ T328] usb 4-1: config 250 has an invalid interface number: 228 but max is -1 [ 35.452634][ T328] usb 4-1: config 250 has 1 interface, different from the descriptor's value: 0 [ 35.462554][ T328] usb 4-1: config 250 has no interface number 0 [ 35.469773][ T328] usb 4-1: config 250 interface 228 altsetting 255 endpoint 0x1 has invalid maxpacket 65280, setting to 1024 [ 35.483545][ T328] usb 4-1: config 250 interface 228 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 1024 [ 35.495087][ T328] usb 4-1: config 250 interface 228 altsetting 255 endpoint 0x82 has invalid wMaxPacketSize 0 [ 35.505812][ T328] usb 4-1: config 250 interface 228 altsetting 255 bulk endpoint 0x82 has invalid maxpacket 0 [ 35.523484][ T328] usb 4-1: config 250 interface 228 altsetting 255 has 2 endpoint descriptors, different from the interface descriptor's value: 17 [ 35.538823][ T328] usb 4-1: config 250 interface 228 has no altsetting 0 [ 35.549540][ T328] usb 4-1: New USB device found, idVendor=0525, idProduct=d292, bcdDevice= 0.07 [ 35.563474][ T328] usb 4-1: New USB device strings: Mfr=0, Product=106, SerialNumber=59 [ 35.572362][ T328] usb 4-1: Product: syz [ 35.576839][ T328] usb 4-1: SerialNumber: syz [ 35.589506][ T328] hub 4-1:250.228: bad descriptor, ignoring hub [ 35.595992][ T328] hub: probe of 4-1:250.228 failed with error -5 [ 35.779329][ T39] usb 1-1: USB disconnect, device number 2 [ 35.792074][ T328] usblp 4-1:250.228: usblp0: USB Bidirectional printer dev 3 if 228 alt 255 proto 3 vid 0x0525 pid 0xD292 [ 35.849120][ T328] usb 4-1: USB disconnect, device number 3 [ 35.867359][ T328] usblp0: removed [ 36.127868][ T39] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 37.240678][ T15] sched: RT throttling activated [ 39.220073][ T333] usb 3-1: USB disconnect, device number 2 [ 39.274427][ T39] usb 1-1: device descriptor read/all, error -71 [ 39.682421][ T506] 9pnet_virtio: no channels available for device syz [ 39.706285][ T28] kauditd_printk_skb: 46 callbacks suppressed [ 39.706303][ T28] audit: type=1400 audit(1785938003.127:195): avc: denied { write } for pid=459 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=493 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 39.787791][ T28] audit: type=1400 audit(1785938003.127:196): avc: denied { add_name } for pid=459 comm="dhcpcd-run-hook" name="resolv.conf.syzkaller0.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 39.850403][ T28] audit: type=1400 audit(1785938003.127:197): avc: denied { create } for pid=459 comm="dhcpcd-run-hook" name="resolv.conf.syzkaller0.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 39.896256][ T28] audit: type=1400 audit(1785938003.127:198): avc: denied { write } for pid=459 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf.syzkaller0.link" dev="tmpfs" ino=874 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 39.957773][ T39] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 39.965939][ T28] audit: type=1400 audit(1785938003.127:199): avc: denied { append } for pid=459 comm="dhcpcd-run-hook" name="resolv.conf.syzkaller0.link" dev="tmpfs" ino=874 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 39.965980][ T28] audit: type=1400 audit(1785938003.307:200): avc: denied { remove_name } for pid=513 comm="rm" name="resolv.conf.syzkaller0.link" dev="tmpfs" ino=874 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 40.031723][ T28] audit: type=1400 audit(1785938003.307:201): avc: denied { unlink } for pid=513 comm="rm" name="resolv.conf.syzkaller0.link" dev="tmpfs" ino=874 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 40.072185][ T28] audit: type=1400 audit(1785938003.357:202): avc: denied { sqpoll } for pid=522 comm="syz.4.80" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 40.130913][ T28] audit: type=1400 audit(1785938003.557:203): avc: denied { create } for pid=535 comm="syz.1.83" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 40.174627][ T28] audit: type=1400 audit(1785938003.577:204): avc: denied { connect } for pid=535 comm="syz.1.83" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 40.217813][ T298] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 40.222754][ T39] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 40.254787][ T39] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 41552, setting to 1024 [ 40.277877][ T39] usb 1-1: New USB device found, idVendor=05e0, idProduct=0600, bcdDevice= 1.00 [ 40.314110][ T39] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.335518][ T39] usb 1-1: Product: syz [ 40.351946][ T39] usb 1-1: Manufacturer: syz [ 40.361031][ T39] usb 1-1: SerialNumber: syz [ 40.407750][ T298] usb 5-1: Using ep0 maxpacket: 32 [ 40.414281][ T298] usb 5-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 40.436129][ T298] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 40.464336][ T298] usb 5-1: config 0 descriptor?? [ 40.510838][ T575] Zero length message leads to an empty skb [ 40.584015][ T39] usb 1-1: USB disconnect, device number 4 [ 40.614793][ T582] netlink: 80 bytes leftover after parsing attributes in process `syz.3.99'. [ 40.695315][ T297] usb 5-1: USB disconnect, device number 2 [ 40.793791][ T587] netlink: 8 bytes leftover after parsing attributes in process `syz.3.101'. [ 40.816994][ T589] loop5: detected capacity change from 0 to 7 [ 41.104609][ T622] netlink: 4 bytes leftover after parsing attributes in process `syz.1.117'. [ 41.550939][ T661] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 41.560303][ T663] capability: warning: `syz.4.134' uses deprecated v2 capabilities in a way that may be insecure [ 41.564198][ T661] device bridge_slave_0 left promiscuous mode [ 41.577909][ T661] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.590111][ T661] device bridge_slave_1 left promiscuous mode [ 41.596773][ T661] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.173316][ T677] netlink: 8 bytes leftover after parsing attributes in process `syz.3.140'. [ 42.188482][ T677] netlink: 'syz.3.140': attribute type 1 has an invalid length. [ 43.797945][ T298] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 43.856824][ T725] ================================================================== [ 43.865008][ T728] device gretap1 entered promiscuous mode [ 43.864993][ T725] BUG: KASAN: use-after-free in pppol2tp_sock_to_session+0x1a0/0x1b0 [ 43.879036][ T725] Read of size 4 at addr ffff88811f056400 by task syz.3.159/725 [ 43.886710][ T725] [ 43.889186][ T725] CPU: 0 PID: 725 Comm: syz.3.159 Not tainted syzkaller #0 [ 43.896438][ T725] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 43.906689][ T725] Call Trace: [ 43.910020][ T725] [ 43.913060][ T725] __dump_stack+0x21/0x24 [ 43.917461][ T725] dump_stack_lvl+0x110/0x170 [ 43.922402][ T725] ? __cfi_dump_stack_lvl+0x8/0x8 [ 43.927515][ T725] ? _raw_spin_lock_bh+0x94/0xf0 [ 43.932540][ T725] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 43.938607][ T725] print_address_description+0x71/0x200 [ 43.944882][ T725] print_report+0x4a/0x60 [ 43.949291][ T725] kasan_report+0x122/0x150 [ 43.953863][ T725] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 43.959839][ T725] __asan_report_load4_noabort+0x14/0x20 [ 43.965639][ T725] pppol2tp_sock_to_session+0x1a0/0x1b0 [ 43.971444][ T725] pppol2tp_release+0x150/0x2b0 [ 43.976563][ T725] sock_close+0xc9/0x220 [ 43.980931][ T725] ? __cfi_sock_close+0x10/0x10 [ 43.986119][ T725] __fput+0x1fd/0x8f0 [ 43.990251][ T725] ____fput+0x15/0x20 [ 43.994298][ T725] task_work_run+0x1e1/0x250 [ 43.999028][ T725] ? __cfi_task_work_run+0x10/0x10 [ 44.004388][ T725] ? __cfi___close_range+0x10/0x10 [ 44.010160][ T725] ? do_user_addr_fault+0x9a5/0x1030 [ 44.015610][ T725] exit_to_user_mode_loop+0x9b/0xb0 [ 44.020867][ T725] exit_to_user_mode_prepare+0x87/0xd0 [ 44.026655][ T725] syscall_exit_to_user_mode+0x1a/0x30 [ 44.032475][ T725] do_syscall_64+0x58/0xa0 [ 44.036964][ T725] ? clear_bhb_loop+0x30/0x80 [ 44.041877][ T725] ? clear_bhb_loop+0x30/0x80 [ 44.046694][ T725] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 44.053274][ T725] RIP: 0033:0x7fc0c119e019 [ 44.058192][ T725] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 44.078634][ T725] RSP: 002b:00007ffeba134d08 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 44.087115][ T725] RAX: 0000000000000000 RBX: 00007ffeba134df0 RCX: 00007fc0c119e019 [ 44.095671][ T725] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 44.104218][ T725] RBP: 000000000000ab1e R08: 0000000000000001 R09: 0000000000000000 [ 44.112435][ T725] R10: 0000001b2dc20000 R11: 0000000000000246 R12: 00007ffeba134e30 [ 44.121649][ T725] R13: 00007fc0c1425fac R14: 000000000000ab5b R15: 00007fc0c1425fa0 [ 44.129888][ T725] [ 44.132975][ T725] [ 44.135337][ T725] Allocated by task 726: [ 44.139606][ T725] kasan_set_track+0x4b/0x70 [ 44.144247][ T725] kasan_save_alloc_info+0x1f/0x30 [ 44.149665][ T725] __kasan_kmalloc+0x95/0xb0 [ 44.154305][ T725] __kmalloc+0xb4/0x1e0 [ 44.158509][ T725] l2tp_session_create+0x38/0xbd0 [ 44.163584][ T725] pppol2tp_connect+0xbf5/0x1640 [ 44.168786][ T725] __sys_connect+0x3da/0x460 [ 44.173635][ T725] __x64_sys_connect+0x7a/0x90 [ 44.178451][ T725] x64_sys_call+0x88d/0x9a0 [ 44.183171][ T725] do_syscall_64+0x4c/0xa0 [ 44.187648][ T725] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 44.194043][ T725] [ 44.196411][ T725] Freed by task 312: [ 44.200347][ T725] kasan_set_track+0x4b/0x70 [ 44.205002][ T725] kasan_save_free_info+0x2b/0x40 [ 44.210134][ T725] ____kasan_slab_free+0x132/0x180 [ 44.215291][ T725] __kasan_slab_free+0x11/0x20 [ 44.220104][ T725] slab_free_freelist_hook+0xc2/0x190 [ 44.225648][ T725] __kmem_cache_free+0xb7/0x1b0 [ 44.230731][ T725] kfree+0x6f/0xf0 [ 44.234494][ T725] l2tp_session_put+0xaf/0x1a0 [ 44.239474][ T725] l2tp_session_delete+0x3df/0x4d0 [ 44.245442][ T725] l2tp_tunnel_del_work+0x199/0x410 [ 44.252408][ T725] process_one_work+0x717/0xc30 [ 44.257426][ T725] worker_thread+0xa4d/0x11d0 [ 44.262715][ T725] kthread+0x281/0x320 [ 44.267164][ T725] ret_from_fork+0x1f/0x30 [ 44.272332][ T725] [ 44.274671][ T725] The buggy address belongs to the object at ffff88811f056400 [ 44.274671][ T725] which belongs to the cache kmalloc-512 of size 512 [ 44.288987][ T725] The buggy address is located 0 bytes inside of [ 44.288987][ T725] 512-byte region [ffff88811f056400, ffff88811f056600) [ 44.302302][ T725] [ 44.304719][ T725] The buggy address belongs to the physical page: [ 44.311262][ T725] page:ffffea00047c1500 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11f054 [ 44.321932][ T725] head:ffffea00047c1500 order:2 compound_mapcount:0 compound_pincount:0 [ 44.330460][ T725] flags: 0x4000000000010200(slab|head|zone=1) [ 44.336812][ T725] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100042f00 [ 44.345929][ T725] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 44.355057][ T725] page dumped because: kasan: bad access detected [ 44.361820][ T725] page_owner tracks the page as allocated [ 44.367817][ T725] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 141, tgid 141 (dhcpcd), ts 9351360346, free_ts 0 [ 44.387862][ T725] post_alloc_hook+0x1f5/0x210 [ 44.392825][ T725] prep_new_page+0x1c/0x110 [ 44.397422][ T725] get_page_from_freelist+0x2ca9/0x2d20 [ 44.403273][ T725] __alloc_pages+0x1fa/0x610 [ 44.408025][ T725] alloc_slab_page+0x6e/0xf0 [ 44.413018][ T725] new_slab+0x98/0x3e0 [ 44.417178][ T725] ___slab_alloc+0x70f/0xb70 [ 44.421817][ T725] __slab_alloc+0x5e/0xa0 [ 44.426481][ T725] __kmem_cache_alloc_node+0x204/0x2d0 [ 44.432089][ T725] __kmalloc_node_track_caller+0xa1/0x1e0 [ 44.437859][ T725] __alloc_skb+0x226/0x4a0 [ 44.442336][ T725] alloc_skb_with_frags+0xa8/0x620 [ 44.447670][ T725] sock_alloc_send_pskb+0x87f/0x9a0 [ 44.453351][ T725] unix_dgram_sendmsg+0x5c1/0x1710 [ 44.459569][ T725] unix_seqpacket_sendmsg+0x118/0x1e0 [ 44.465085][ T725] sock_write_iter+0x2ea/0x3f0 [ 44.469978][ T725] page_owner free stack trace missing [ 44.475891][ T725] [ 44.478432][ T725] Memory state around the buggy address: [ 44.484378][ T725] ffff88811f056300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.492643][ T725] ffff88811f056380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.500924][ T725] >ffff88811f056400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 44.509705][ T725] ^ [ 44.514065][ T725] ffff88811f056480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 44.522434][ T725] ffff88811f056500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 44.531235][ T725] ================================================================== [ 44.540873][ T725] Disabling lock debugging due to kernel taint [ 44.556082][ T725] ------------[ cut here ]------------ [ 44.561903][ T725] WARNING: CPU: 0 PID: 725 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 44.572966][ T725] Modules linked in: [ 44.576934][ T725] CPU: 0 PID: 725 Comm: syz.3.159 Tainted: G B syzkaller #0 [ 44.586338][ T725] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 44.596821][ T725] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 44.603448][ T725] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 44.623503][ T725] RSP: 0018:ffffc900102bfcb0 EFLAGS: 00010293 [ 44.629681][ T725] RAX: ffffffff849bb307 RBX: ffff88810ff44000 RCX: ffff888112191440 [ 44.637737][ T725] RDX: 0000000000000000 RSI: 00000000328b1340 RDI: 000000000c04eb7d [ 44.645771][ T725] RBP: ffffc900102bfcd0 R08: ffffffff87b757e7 R09: 1ffffffff0f6eafc [ 44.654929][ T725] R10: dffffc0000000000 R11: fffffbfff0f6eafd R12: dffffc0000000000 [ 44.663474][ T725] R13: dffffc0000000000 R14: 00000000328b1340 R15: ffff88811f056400 [ 44.671526][ T725] FS: 0000555592330500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 44.681161][ T725] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 44.688609][ T725] CR2: 000000110c2b7549 CR3: 000000013d1ac000 CR4: 00000000003526b0 [ 44.697592][ T725] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 44.705917][ T725] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 44.714172][ T725] Call Trace: [ 44.717547][ T725] [ 44.720671][ T725] pppol2tp_release+0x150/0x2b0 [ 44.725765][ T725] sock_close+0xc9/0x220 [ 44.730357][ T725] ? __cfi_sock_close+0x10/0x10 [ 44.735547][ T725] __fput+0x1fd/0x8f0 [ 44.740418][ T725] ____fput+0x15/0x20 [ 44.744813][ T725] task_work_run+0x1e1/0x250 [ 44.749700][ T725] ? __cfi_task_work_run+0x10/0x10 [ 44.755343][ T725] ? __cfi___close_range+0x10/0x10 [ 44.761179][ T725] ? do_user_addr_fault+0x9a5/0x1030 [ 44.766617][ T725] exit_to_user_mode_loop+0x9b/0xb0 [ 44.772172][ T725] exit_to_user_mode_prepare+0x87/0xd0 [ 44.777982][ T725] syscall_exit_to_user_mode+0x1a/0x30 [ 44.783584][ T725] do_syscall_64+0x58/0xa0 [ 44.790680][ T725] ? clear_bhb_loop+0x30/0x80 [ 44.795579][ T725] ? clear_bhb_loop+0x30/0x80 [ 44.800453][ T725] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 44.806577][ T725] RIP: 0033:0x7fc0c119e019 [ 44.811384][ T725] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 44.831273][ T725] RSP: 002b:00007ffeba134d08 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 44.840116][ T725] RAX: 0000000000000000 RBX: 00007ffeba134df0 RCX: 00007fc0c119e019 [ 44.848170][ T725] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 44.856295][ T725] RBP: 000000000000ab1e R08: 0000000000000001 R09: 0000000000000000 [ 44.864416][ T725] R10: 0000001b2dc20000 R11: 0000000000000246 R12: 00007ffeba134e30 [ 44.873090][ T725] R13: 00007fc0c1425fac R14: 000000000000ab5b R15: 00007fc0c1425fa0 [ 44.881610][ T725] [ 44.884675][ T725] ---[ end trace 0000000000000000 ]--- [ 44.917976][ T298] usb 2-1: Using ep0 maxpacket: 8 [ 44.938877][ T298] usb 2-1: config index 0 descriptor too short (expected 5924, got 36) [ 44.947424][ T298] usb 2-1: config 250 has an invalid interface number: 228 but max is -1 [ 44.977780][ T298] usb 2-1: config 250 has 1 interface, different from the descriptor's value: 0 [ 44.987599][ T298] usb 2-1: config 250 has no interface number 0 [ 45.009350][ T298] usb 2-1: config 250 interface 228 altsetting 255 endpoint 0x1 has invalid maxpacket 65280, setting to 1024 [ 45.034762][ T298] usb 2-1: config 250 interface 228 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 1024 [ 45.066727][ T298] usb 2-1: config 250 interface 228 altsetting 255 endpoint 0x82 has invalid wMaxPacketSize 0 [ 45.086033][ T298] usb 2-1: config 250 interface 228 altsetting 255 bulk endpoint 0x82 has invalid maxpacket 0 [ 45.121908][ T298] usb 2-1: config 250 interface 228 altsetting 255 has 2 endpoint descriptors, different from the interface descriptor's value: 17 [ 45.149074][ T298] usb 2-1: config 250 interface 228 has no altsetting 0 [ 45.168725][ T298] usb 2-1: New USB device found, idVendor=0525, idProduct=d292, bcdDevice= 0.07 [ 45.187777][ T298] usb 2-1: New USB device strings: Mfr=0, Product=106, SerialNumber=59 [ 45.196217][ T298] usb 2-1: Product: syz [ 45.211623][ T298] usb 2-1: SerialNumber: syz [ 45.235816][ T298] hub 2-1:250.228: bad descriptor, ignoring hub [ 45.242729][ T298] hub: probe of 2-1:250.228 failed with error -5 [ 45.434509][ T298] usblp 2-1:250.228: usblp0: USB Bidirectional printer dev 2 if 228 alt 255 proto 3 vid 0x0525 pid 0xD292 [ 46.078078][ T707] usb 2-1: reset high-speed USB device number 2 using dummy_hcd [ 46.778114][ T328] usb 2-1: USB disconnect, device number 2 [ 46.786104][ T328] usblp0: removed