last executing test programs: 127.390174ms ago: executing program 0 (id=1): r0 = syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='./mnt\x00', 0x0, &(0x7f00000002c0), 0x0, 0x236, &(0x7f0000000300)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=") r1 = add_key$fscrypt_v1(&(0x7f00000001c0), &(0x7f00000005c0)={'fscrypt:', @auto=[0x3c, 0x36, 0x63, 0x33, 0x32, 0x35, 0x38, 0x39, 0xd26859756d1c7f84, 0x61, 0x64, 0x63, 0x38, 0x61, 0x35, 0x3]}, &(0x7f0000000540)={0x0, "f684e5422e09c560273ab72b5c5b8c11c76b97555bcf5412e414643bf41279359079eb8990fbe67d24a75d3646dda0d4bba7d7b7a308627fd0ce36ae94d6fb89", 0x19}, 0x48, 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0) lseek(r2, 0xffffffffffffffff, 0x2) getdents64(r2, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000000)={@local, 0x7ff, 0x0, 0x1, 0x0, 0x7, 0x9}, 0x20) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f00000000c0)={@desc={0x1, 0x0, @desc2}, 0x0, r1}) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cfg\x00', 0x1ff) r5 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) mkdirat(r5, &(0x7f0000000340)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r6 = open(&(0x7f0000000300)='.\x00', 0x8000, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file7\x00', 0x4) renameat2(r6, &(0x7f0000000040)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', r6, &(0x7f0000000900)='./cfg\x00', 0x2) ioctl$PPPIOCGL2TPSTATS(r3, 0x80487436, &(0x7f0000000100)="814d55") socket$nl_route(0x10, 0x3, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x789842, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) r9 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r8, r9, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000f36d666666440f38826b410f786b42d1d107b8010000000f01d98fe9d89afd", 0x3d}], 0x1, 0x21, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) ioctl$KVM_SET_VAPIC_ADDR(r9, 0x4008ae93, &(0x7f0000000040)=0x1000) ioctl$KVM_SET_VCPU_EVENTS(r9, 0x4400ae8f, &(0x7f0000000140)=@x86={0x3f, 0x1, 0x10, 0x0, 0x8, 0x0, 0x10, 0x0, 0x0, 0x80, 0x2, 0x7, 0x0, 0x0, 0xfffffff8, 0x0, 0xff, 0x9, 0x1}) ioctl$KVM_RUN(r9, 0xae80, 0x0) r10 = socket$packet(0x11, 0x2, 0x300) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f0000000080)={@rand_addr, 0x0}, &(0x7f00000000c0)=0x14) recvfrom$packet(r10, &(0x7f0000000040)=""/9, 0x9, 0x40011123, &(0x7f0000000140)={0x11, 0xd, r11, 0x1, 0x8}, 0x14) 79.102566ms ago: executing program 3 (id=4): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/drivers\x00', 0x0, 0x0) read$rfkill(r0, &(0x7f0000000040), 0x8) syz_emit_ethernet(0x36, &(0x7f0000000180)=ANY=[@ANYRES16=r0], 0x0) syz_extract_tcp_res$synack(&(0x7f0000000000)={0x41424344}, 0x1, 0x0) syz_emit_ethernet(0xcb, &(0x7f0000000040)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x1a}, @multicast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "b1ce85", 0x95, 0x6, 0xff, @loopback, @mcast2, {[@dstopts={0x0, 0x0, '\x00', [@ra={0x5, 0x2, 0x8}]}], {{0x4e21, 0x4e20, 0x41424344, r1, 0x0, 0x0, 0x13, 0x4, 0x80, 0x0, 0x7, {[@sack={0x5, 0x6, [0x4]}, @nop, @mss={0x2, 0x4, 0x400}, @sack_perm={0x4, 0x2}, @mptcp=@generic={0x44, 0xd, "661412aa541ccbc2d1a44b"}, @md5sig={0x13, 0x12, "8697dc3ffc535d7e9a44d24b33b7f1b1"}, @timestamp={0x8, 0xa, 0x7}, @nop]}}, {"65d7760ba893e6da6f24f25f4cc28960daaa88f183fa4e5ac9b27a5491393cb296831e50f273bbe982aca048ff22750b2337e0ff35f5cdd43f"}}}}}}}, &(0x7f0000000140)={0x1, 0x2, [0xb5b, 0xdfe, 0x1f8, 0xac3]}) unshare(0x2c020400) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000100)={&(0x7f000018e000/0x3000)=nil, &(0x7f00000da000/0x4000)=nil, 0x3000, 0x2000000}) capset(&(0x7f0000000500)={0x20071026}, &(0x7f0000000200)={0x200002, 0x200003, 0x801, 0x4, 0x7}) r3 = getpid() write$binfmt_register(0xffffffffffffffff, 0x0, 0x0) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) r5 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/mcfilter6\x00') read(r5, &(0x7f0000001180)=""/4083, 0xff3) pread64(r5, &(0x7f0000000080)=""/220, 0xdc, 0x4009) syz_usb_control_io$hid(r4, &(0x7f0000000640)={0x24, 0x0, 0x0, &(0x7f00000005c0)={0x0, 0x22, 0x2, {[@global=@item_012={0x0, 0x1, 0x1}, @local=@item_012={0x0, 0x2, 0x9}]}}, &(0x7f0000000600)={0x0, 0x21, 0x9, {0x9, 0x21, 0x2, 0xc, 0x1, {0x22, 0x3b2}}}}, 0x0) getpgid(r3) 0s ago: executing program 4 (id=5): openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.25' (ED25519) to the list of known hosts. [ 19.158415][ T24] audit: type=1400 audit(1790042328.320:64): avc: denied { mounton } for pid=271 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 19.159411][ T271] cgroup: Unknown subsys name 'net' [ 19.181090][ T24] audit: type=1400 audit(1790042328.320:65): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.208281][ T24] audit: type=1400 audit(1790042328.350:66): avc: denied { unmount } for pid=271 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.208418][ T271] cgroup: Unknown subsys name 'devices' [ 19.321585][ T271] cgroup: Unknown subsys name 'hugetlb' [ 19.327159][ T271] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 19.493221][ T24] audit: type=1400 audit(1790042328.660:67): avc: denied { setattr } for pid=271 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 19.504637][ T273] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 19.516487][ T24] audit: type=1400 audit(1790042328.660:68): avc: denied { mounton } for pid=271 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 19.549682][ T24] audit: type=1400 audit(1790042328.660:69): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 19.549705][ T271] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 19.572796][ T24] audit: type=1400 audit(1790042328.690:70): avc: denied { relabelto } for pid=273 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.606813][ T24] audit: type=1400 audit(1790042328.690:71): avc: denied { write } for pid=273 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.632398][ T24] audit: type=1400 audit(1790042328.690:72): avc: denied { read } for pid=271 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.657859][ T24] audit: type=1400 audit(1790042328.690:73): avc: denied { open } for pid=271 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.229007][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.236069][ T280] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.243431][ T280] device bridge_slave_0 entered promiscuous mode [ 20.260312][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.267335][ T280] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.274705][ T280] device bridge_slave_1 entered promiscuous mode [ 20.286904][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.293958][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.301192][ T281] device bridge_slave_0 entered promiscuous mode [ 20.307916][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.314956][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.322317][ T281] device bridge_slave_1 entered promiscuous mode [ 20.364598][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.371730][ T279] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.378924][ T279] device bridge_slave_0 entered promiscuous mode [ 20.401269][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.408298][ T279] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.415598][ T279] device bridge_slave_1 entered promiscuous mode [ 20.447309][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.454353][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.461686][ T282] device bridge_slave_0 entered promiscuous mode [ 20.472877][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.479904][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.487420][ T282] device bridge_slave_1 entered promiscuous mode [ 20.505337][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.512394][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.519707][ T283] device bridge_slave_0 entered promiscuous mode [ 20.529030][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.536120][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.543462][ T283] device bridge_slave_1 entered promiscuous mode [ 20.625053][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.632108][ T281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.639362][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.646389][ T281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.676829][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.683881][ T280] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.691130][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.698138][ T280] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.724233][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.731282][ T283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.738511][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.745537][ T283] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.760202][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.767763][ T112] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.774933][ T112] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.782207][ T112] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.789288][ T112] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.796988][ T112] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.804273][ T112] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.830661][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.838830][ T112] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.845860][ T112] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.853334][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.861781][ T112] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.868803][ T112] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.901038][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.908562][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.916446][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.924703][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.932686][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.940941][ T112] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.947940][ T112] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.955253][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.963381][ T112] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.970395][ T112] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.989162][ T281] device veth0_vlan entered promiscuous mode [ 20.996858][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.005183][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.013329][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.021174][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.028472][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 21.035979][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.043441][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.051609][ T112] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.058607][ T112] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.066098][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.074028][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.082250][ T112] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.089274][ T112] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.096571][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.104646][ T112] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.111665][ T112] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.119008][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 21.144666][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.153720][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.161705][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.169751][ T112] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.176771][ T112] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.184430][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.192422][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.200859][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.208688][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.223095][ T280] device veth0_vlan entered promiscuous mode [ 21.230190][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.238508][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.246865][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.255169][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.263300][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.270801][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.279639][ T282] device veth0_vlan entered promiscuous mode [ 21.294484][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.302625][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.310673][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.318695][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.327257][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 21.334695][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.342163][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.350370][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.358402][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.365932][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.381542][ T280] device veth1_macvtap entered promiscuous mode [ 21.388245][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.395893][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 21.404233][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.412627][ T112] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.419654][ T112] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.427422][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 21.435661][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.443891][ T112] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.450921][ T112] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.458241][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.466522][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.474773][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.482667][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.490977][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 21.498519][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.505967][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.513780][ T283] device veth0_vlan entered promiscuous mode [ 21.522576][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 21.530675][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.539441][ T281] device veth1_macvtap entered promiscuous mode [ 21.548773][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.556502][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.564736][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.576858][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 21.585124][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.601220][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.609643][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.618083][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.626445][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.634839][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.643035][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.652033][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.660381][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.669144][ T282] device veth1_macvtap entered promiscuous mode [ 21.677040][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.684683][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.692920][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.705496][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.713868][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.725796][ T281] request_module fs-gadgetfs succeeded, but still no fs? [ 21.739585][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.747857][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.756269][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.764898][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.776144][ T281] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 21.779420][ T279] device veth0_vlan entered promiscuous mode [ 21.794663][ T283] device veth1_macvtap entered promiscuous mode [ 21.802798][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.813519][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.821449][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.829313][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.837086][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.857524][ T279] device veth1_macvtap entered promiscuous mode [ 21.869982][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.878259][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.886605][ T302] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 21.886881][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.896896][ T309] capability: warning: `syz.3.4' uses deprecated v2 capabilities in a way that may be insecure [ 21.907285][ T302] ext4 filesystem being mounted at /0/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 21.938608][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.947083][ T301] ================================================================== [ 21.947271][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.955171][ T301] BUG: KASAN: use-after-free in rcu_segcblist_enqueue+0x85/0xa0 [ 21.955182][ T301] Write of size 8 at addr ffff88810dde4590 by task syz.0.1/301 [ 21.955184][ T301] [ 21.955199][ T301] CPU: 0 PID: 301 Comm: syz.0.1 Not tainted syzkaller #0 [ 21.955205][ T301] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 21.955208][ T301] Call Trace: [ 21.955220][ T301] __dump_stack+0x21/0x24 [ 21.955228][ T301] dump_stack_lvl+0x1a7/0x208 [ 21.955237][ T301] ? show_regs_print_info+0x18/0x18 [ 21.955248][ T301] ? thaw_kernel_threads+0x220/0x220 [ 21.955258][ T301] print_address_description+0x7f/0x2c0 [ 21.955267][ T301] ? rcu_segcblist_enqueue+0x85/0xa0 [ 21.955276][ T301] kasan_report+0x100/0x140 [ 21.955285][ T301] ? rcu_segcblist_enqueue+0x85/0xa0 [ 21.955295][ T301] __asan_report_store8_noabort+0x17/0x20 [ 21.955311][ T301] rcu_segcblist_enqueue+0x85/0xa0 [ 21.964227][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.970957][ T301] call_rcu+0x4df/0x1090 [ 21.970968][ T301] ? rcu_gp_kthread_wake+0x90/0x90 [ 21.970978][ T301] ? __kasan_check_write+0x14/0x20 [ 21.970987][ T301] ? __wake_up_bit+0x120/0x120 [ 21.970997][ T301] security_inode_free+0xb4/0xd0 [ 21.971007][ T301] __destroy_inode+0x175/0x4f0 [ 21.971015][ T301] evict+0x7e8/0x940 [ 21.971023][ T301] ? mode_strip_sgid+0x150/0x150 [ 21.971031][ T301] ? _raw_spin_lock+0x94/0xf0 [ 21.971039][ T301] ? _raw_spin_trylock_bh+0x150/0x150 [ 21.971047][ T301] ? __kasan_check_read+0x11/0x20 [ 21.971056][ T301] ? __kasan_check_write+0x14/0x20 [ 21.971065][ T301] iput+0x654/0x7e0 [ 21.971075][ T301] dentry_unlink_inode+0x2d5/0x390 [ 21.971084][ T301] __dentry_kill+0x45b/0x660 [ 21.971092][ T301] dentry_kill+0xc0/0x2a0 [ 21.971100][ T301] dput+0x42/0x80 [ 21.971116][ T301] __fput+0x4bd/0x730 [ 21.979348][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.980946][ T301] ____fput+0x15/0x20 [ 21.980955][ T301] task_work_run+0x127/0x190 [ 21.980965][ T301] exit_to_user_mode_loop+0xcb/0xe0 [ 21.980979][ T301] exit_to_user_mode_prepare+0x76/0xa0 [ 21.988485][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.998274][ T301] syscall_exit_to_user_mode+0x1d/0x40 [ 21.998282][ T301] do_syscall_64+0x3d/0x40 [ 21.998291][ T301] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 21.998299][ T301] RIP: 0033:0x7faecd424159 [ 21.998309][ T301] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 21.998315][ T301] RSP: 002b:00007ffef756a148 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 21.998326][ T301] RAX: 0000000000000000 RBX: 00007ffef756a230 RCX: 00007faecd424159 [ 21.998331][ T301] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 21.998337][ T301] RBP: 000000000000551f R08: 0000000000000001 R09: 0000000000000000 [ 21.998343][ T301] R10: 0000001b2d220000 R11: 0000000000000246 R12: 00007ffef756a270 [ 21.998348][ T301] R13: 00007faecd6abfac R14: 00000000000055d2 R15: 00007faecd6abfa0 [ 21.998353][ T301] [ 21.998358][ T301] Allocated by task 302: [ 21.998381][ T301] __kasan_kmalloc+0xd4/0x100 [ 21.998390][ T301] __kmalloc+0x19f/0x330 [ 21.998398][ T301] l2tp_session_create+0x39/0xb60 [ 21.998406][ T301] pppol2tp_connect+0xbf5/0x1640 [ 21.998413][ T301] __sys_connect+0x3ce/0x450 [ 21.998427][ T301] __x64_sys_connect+0x7a/0x90 [ 22.004236][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.006010][ T301] do_syscall_64+0x31/0x40 [ 22.011163][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.015837][ T301] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 22.015840][ T301] [ 22.015844][ T301] Freed by task 310: [ 22.015852][ T301] kasan_set_track+0x4a/0x70 [ 22.015867][ T301] kasan_set_free_info+0x23/0x40 [ 22.021708][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.026647][ T301] ____kasan_slab_free+0x125/0x160 [ 22.355739][ T301] __kasan_slab_free+0x11/0x20 [ 22.360474][ T301] slab_free_freelist_hook+0xc5/0x190 [ 22.365823][ T301] kfree+0xc0/0x270 [ 22.369606][ T301] l2tp_session_put+0xb2/0x1a0 [ 22.374340][ T301] l2tp_session_delete+0x3a9/0x4a0 [ 22.379424][ T301] l2tp_tunnel_del_work+0x180/0x3d0 [ 22.384599][ T301] process_one_work+0x6fd/0xbc0 [ 22.389422][ T301] worker_thread+0xa8e/0x13c0 [ 22.394071][ T301] kthread+0x324/0x3b0 [ 22.398111][ T301] ret_from_fork+0x1f/0x30 [ 22.402495][ T301] [ 22.404882][ T301] Last potentially related work creation: [ 22.410577][ T301] kasan_save_stack+0x3a/0x60 [ 22.415226][ T301] __kasan_record_aux_stack+0xd2/0x100 [ 22.420656][ T301] kasan_record_aux_stack_noalloc+0xb/0x10 [ 22.426434][ T301] call_rcu+0x11a/0x1090 [ 22.430649][ T301] pppol2tp_release+0x1e3/0x2b0 [ 22.435469][ T301] sock_close+0xb8/0x200 [ 22.439682][ T301] __fput+0x2dc/0x730 [ 22.443656][ T301] ____fput+0x15/0x20 [ 22.447613][ T301] task_work_run+0x127/0x190 [ 22.452178][ T301] exit_to_user_mode_loop+0xcb/0xe0 [ 22.457347][ T301] exit_to_user_mode_prepare+0x76/0xa0 [ 22.462780][ T301] syscall_exit_to_user_mode+0x1d/0x40 [ 22.468218][ T301] do_syscall_64+0x3d/0x40 [ 22.472608][ T301] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 22.478470][ T301] [ 22.480782][ T301] The buggy address belongs to the object at ffff88810dde4400 [ 22.480782][ T301] which belongs to the cache kmalloc-512 of size 512 [ 22.494830][ T301] The buggy address is located 400 bytes inside of [ 22.494830][ T301] 512-byte region [ffff88810dde4400, ffff88810dde4600) [ 22.508068][ T301] The buggy address belongs to the page: [ 22.513691][ T301] page:ffffea0004377900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10dde4 [ 22.523926][ T301] head:ffffea0004377900 order:2 compound_mapcount:0 compound_pincount:0 [ 22.532232][ T301] flags: 0x4000000000010200(slab|head) [ 22.537669][ T301] raw: 4000000000010200 0000000000000000 0000000100000001 ffff888100043080 [ 22.546245][ T301] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 22.554796][ T301] page dumped because: kasan: bad access detected [ 22.561188][ T301] page_owner tracks the page as allocated [ 22.566888][ T301] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 83, ts 3146880162, free_ts 0 [ 22.584846][ T301] prep_new_page+0x176/0x190 [ 22.589411][ T301] get_page_from_freelist+0x225f/0x23f0 [ 22.594924][ T301] __alloc_pages_nodemask+0x29a/0x640 [ 22.600267][ T301] new_slab+0x84/0x3f0 [ 22.604326][ T301] ___slab_alloc+0x2f8/0x4c0 [ 22.608887][ T301] __slab_alloc+0x63/0xa0 [ 22.613186][ T301] __kmalloc_track_caller+0x1e4/0x310 [ 22.618528][ T301] __alloc_skb+0xdc/0x520 [ 22.622829][ T301] alloc_skb_with_frags+0xa3/0x560 [ 22.627913][ T301] sock_alloc_send_pskb+0x87f/0x9a0 [ 22.633082][ T301] unix_dgram_sendmsg+0x6f3/0x18f0 [ 22.638174][ T301] __sys_sendto+0x467/0x620 [ 22.642654][ T301] __x64_sys_sendto+0xe5/0x100 [ 22.647392][ T301] do_syscall_64+0x31/0x40 [ 22.651784][ T301] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 22.657642][ T301] page_owner free stack trace missing [ 22.662980][ T301] [ 22.665283][ T301] Memory state around the buggy address: [ 22.670885][ T301] ffff88810dde4480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.678936][ T301] ffff88810dde4500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.686969][ T301] >ffff88810dde4580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.694999][ T301] ^ [ 22.699559][ T301] ffff88810dde4600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.707612][ T301] ffff88810dde4680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.715656][ T301] ================================================================== [ 22.723694][ T301] Disabling lock debugging due to kernel taint [ 22.890253][ T307] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 23.140108][ T307] usb 4-1: Using ep0 maxpacket: 32 [ 23.260172][ T307] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 23.271220][ T307] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 23.281089][ T307] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 23.290234][ T307] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 23.299132][ T307] usb 4-1: config 0 descriptor?? [ 23.340705][ T307] hub 4-1:0.0: USB hub found [ 23.640145][ T307] hub 4-1:0.0: config failed, can't read hub descriptor (err -22) [ 23.901906][ T307] hid-generic 0003:046D:C31C.0001: hidraw0: USB HID v8.00 Device [HID 046d:c31c] on usb-dummy_hcd.3-1/input0 [ 24.220149][ T315] usb 4-1: USB disconnect, device number 2