last executing test programs: 3.19138654s ago: executing program 0 (id=1): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6(0xa, 0x80002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, 0x0, 0x0) prctl$PR_SET_TIMERSLACK(0x1d, 0xc) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x6e24, 0xdc, @dev={0xfe, 0x80, '\x00', 0x27}, 0x1}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) 2.599475287s ago: executing program 2 (id=19): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_VERSION(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x24, r1, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x1}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast2}]}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x4040000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x10) r2 = syz_open_procfs(0x0, &(0x7f00000005c0)='smaps_rollup\x00') socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r3, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) sendmsg$tipc(r4, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) mremap(&(0x7f0000d62000/0xa000)=nil, 0xa000, 0x1000, 0x3, &(0x7f00001d9000/0x1000)=nil) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) lseek(r2, 0x2000, 0x0) r5 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000000c0), r0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="480000006800010400000700fcdbdf25000000000000000006000300010000000c00020001000000010000001c000c80060001"], 0x48}}, 0x0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)={0x14, r5, 0x1, 0x0, 0x25dfdbfe}, 0x14}}, 0x0) 2.343406576s ago: executing program 0 (id=26): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xc4}}, 0x0) 2.28339619s ago: executing program 0 (id=27): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000f2d07c40501d89601dd0000000010902120001000000000904"], 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001040)={0x34, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$evdev(&(0x7f0000000180), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000200)={0x0, 0x16, 0x0, 0x1000101, "0020946fc67f0000201b14700c1e0ac74f000000001600000000000900"}) syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000000000407d03000000000000000101022400010000000009040000000301000000210000000122000009058103000000800052f3ebd5a6de3edc8863a2b69a1d37ccb17d675d455c4dadba4a3cc861d0546b4c2465bc8d9ea77d307cd0f1a7b642097cf7cad1e6d088fa507158e3ef87511695a76504541df864b75b6e71dbe873cf1ede1c7283f4f9cdf3e53ae89ba1ee788fb25072354438f75a895df71c831f6782b4e0f13987f63abe045b87e5e0beaee4e7"], 0x0) r2 = syz_open_dev$evdev(&(0x7f0000000040), 0x2, 0x0) ioctl$EVIOCGKEYCODE_V2(r2, 0x80284504, &(0x7f00000000c0)=""/231) ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000080)={0x53, 0xe1, 0x7, {0xff11, 0xffff}, {0x4, 0x5}, @const={0x4, {0x4, 0x6, 0x4, 0x4}}}) r3 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) ioctl$EVIOCGMASK(r3, 0x80104592, &(0x7f0000000300)={0x0, 0xffffffffffffff36, &(0x7f0000000200)="952bb3e006ae9a4c3a"}) ioctl$EVIOCRMFF(r3, 0x40044581, &(0x7f0000000040)=0x7) syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000340)={0x1c, &(0x7f0000000180)={0x0, 0xa}, 0x0, 0x0}) r4 = syz_usb_connect(0x2, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="120100004366b408c70b0800c84f010203010902"], 0x0) syz_usb_disconnect(r4) syz_usb_connect(0x0, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d6c5552018161391"], 0x0) 1.773440858s ago: executing program 3 (id=30): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000800)=ANY=[@ANYBLOB="c8000000020201060000000000000000020000003400018014000180080001000102030408000200050607081c00028005000100060000000600020004d2000006000300001500003400028014000180080001000506070808000200010203041c00028005000100060000000600020000140000060003009c40000034000380140001"], 0xc8}}, 0x0) 1.751232204s ago: executing program 3 (id=31): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc_mnt/net/sctp/assocs\x00', 0x0, 0x0) read(r0, &(0x7f0000000200), 0x1000) 1.733785018s ago: executing program 3 (id=32): r0 = socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000fe8000/0x1000)=nil, 0x1000, 0x0, 0x10010, r0, 0x95756000) bind$netlink(r0, &(0x7f0000000040)={0x10, 0x0, 0x25dfdbfb, 0x400000}, 0xc) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000003ac0)=0x5, 0x4) 1.708731993s ago: executing program 3 (id=35): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x4008080) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2d}}, 0x6}, 0x1c) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f00000000c0)='source\x00', &(0x7f0000000100)='127.0.0.1:/export\x00', 0x0) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(r2, 0x0, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xb, 0x0, 0x0, 0x0, 0x4, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r1}, 0x94) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f00000003c0)='retrans\x00', &(0x7f0000000400)='10\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./tracing/dynamic_events\x00', 0x1, 0x0) write(r3, &(0x7f0000000100)='e:my_read_msr1 msr/read_msr', 0x1b) write(r3, &(0x7f0000000140)='e:my_read_msr2 msr/read_msr', 0x1b) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing/events/eprobes/my_read_msr1/enable\x00', 0x1, 0x0) write(r4, &(0x7f0000000240)='1', 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./tracing/events/eprobes/my_read_msr2/enable\x00', 0x1, 0x0) write(r5, &(0x7f00000002c0)='1', 0x1) 1.699857226s ago: executing program 2 (id=36): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6(0xa, 0x80002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, 0x0, 0x0) prctl$PR_SET_TIMERSLACK(0x1d, 0xc) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x6e24, 0xdc, @dev={0xfe, 0x80, '\x00', 0x27}, 0x1}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) 1.385494178s ago: executing program 3 (id=40): r0 = socket$nl_route(0x10, 0x3, 0x0) inotify_init1(0x80800) r1 = gettid() r2 = socket$inet_udp(0x2, 0x2, 0x0) recvmmsg(r2, &(0x7f0000000400)=[{{0x0, 0x0, 0x0}, 0xb}], 0x1, 0x40000021, 0x0) close(0x3) signalfd4(0xffffffffffffffff, &(0x7f0000000180)={[0x9]}, 0x8, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x3, 0x0, 0x1, 0x2, 0xfffffffffffffffd, 0x2000000000000}, 0x0, &(0x7f0000000080)={0x1f, 0x3, 0x9117, 0x0, 0x0, 0x8}, 0x0, 0x0) timer_create(0x8, &(0x7f00000000c0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0xffff, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) sendmsg$nl_route(r0, 0x0, 0x60000090) 1.056622265s ago: executing program 4 (id=47): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000002b00)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000002c00000018000180140002"], 0x2c}}, 0x0) 1.056249885s ago: executing program 4 (id=48): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000440)={0xa, 0x0, 0x0, @loopback, 0x2}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) setsockopt$inet6_tcp_int(r0, 0x11a, 0x5, 0x0, 0x0) socket(0x40000000015, 0x5, 0x0) syz_mount_image$msdos(&(0x7f00000001c0), &(0x7f0000000280)='./file0\x00', 0x84e8, &(0x7f0000000240)=ANY=[@ANYRES8, @ANYRESDEC, @ANYRES16, @ANYRES16], 0x9, 0x260, &(0x7f0000000a80)="$eJzs3b9uUmEYB+DXQgvpYmfjcBIXJ6JOrsTUxEhigmHQSZLq0hqT0wWduAyvwUvyBty72Mlj7Ielf7AOBb4DPE9Czpv8Djnvx8CB5P3g3f2Phwefjj9U379Gu11EM2JcVRF7sRWNSO5Mjltn9U5cNA4AYNX0+8Nu7h5YrLLsDrcjonUtGXzL0hAAAAAAAAAAAAC3Nmv+P07N/wPAOjP/v/7KsjvcnXx+u8z8PwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJDPaVXdrW545O4PAJi/G+7/P6vk76nTCgBYab7/A8Dmcf8HgM3z+s3bl91eb79fFO2Ik/FoMBqkY8qfv+jtPyrO7E2fdTIaDRrn+eOUF5fz7did5E9m5jvx8EHK/2TPXvWu5K04WPzyAQAAAAAAAAAAAAAAAAAAoBY6xbmZ+/s7nX/lqbrw+wBX9u83415zacsAAAAAAAAAAAAAAAAAAACAlXb8+cvh8OjofVnf4ke2q7ci4j/n1PE1jKe1aGPZRcRSL/qrBkueW9G4HuV+ZwIAAAAAAAAAAAAAAAAAgM0z3fSbuxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyGf6//+LKyJiXCW5lwsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACssd8BAAD//xg9nuE=") r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0x5, 0x0, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r2, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x3) 1.055036975s ago: executing program 4 (id=49): ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000000)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/stat\x00', 0x0, 0x0) sendfile(r4, r5, 0x0, 0x20000023896) fsconfig$FSCONFIG_SET_FLAG(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) 848.159543ms ago: executing program 2 (id=51): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) read(r0, &(0x7f0000000740)=""/384, 0x180) 718.923863ms ago: executing program 2 (id=53): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='27', 0x2) io_setup(0x5, &(0x7f0000000180)) preadv(0xffffffffffffffff, 0x0, 0x0, 0xfffffd81, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1df) mount(0x0, 0x0, &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) 355.699877ms ago: executing program 3 (id=57): prlimit64(0x0, 0xe, &(0x7f0000000040)={0xd, 0x8d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000500)=@abs, 0x6e) timer_create(0xfffffffffffffffd, 0x0, &(0x7f00000000c0)=0x0) timer_gettime(r3, &(0x7f0000000240)) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_mount_image$msdos(&(0x7f00000002c0), &(0x7f0000000280)='./file0\x00', 0x88c8, &(0x7f00000006c0)=ANY=[@ANYBLOB="6e66732c646f74732c636865636b3d7374726963742c646f74732c6572726f72733d72656d6f756e742d726f2c00f8403bb14281bbfb9b8213bd6284536d64789a24dd73b98b3e33cb47fed8a7364664b62e9e891aa832722dfc28bfa4489b3a127a503e72326b737d0f67c97be6f37ef46154dec39ef8718946ffc8cd4d735a0b101c1722477bbe2f923577ea51f7116f17c3ddf5c497fba2d0bb3272d123b31e9461d4e2d65a42e1174fa269de92e463fc1cde2367bdb50cc5b2b462e1d45fc3265f1a88561ab6afb1b73a3b340b5c73055fc6e601843a59f3cdeb36991cfa985453287d4c9d2d6e21adddc57a607369c682e821b20dc0efd51d12f386f3f8e53c05e696e50c7c3f79b1b0bd7e5cfaf3f63d8949c8dd2fd94aa0f259a4cb9412c30c45f9d4d63d267d2a43f03a47fa56b3000000f9ffffffffffffff000000"], 0x9, 0x260, &(0x7f0000000a80)="$eJzs3b9uUmEYB+DXQgvpYmfjcBIXJ6JOrsTUxEhigmHQSZLq0hqT0wWduAyvwUvyBty72Mlj7Ielf7AOBb4DPE9Czpv8Djnvx8CB5P3g3f2Phwefjj9U379Gu11EM2JcVRF7sRWNSO5Mjltn9U5cNA4AYNX0+8Nu7h5YrLLsDrcjonUtGXzL0hAAAAAAAAAAAAC3Nmv+P07N/wPAOjP/v/7KsjvcnXx+u8z8PwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJDPaVXdrW545O4PAJi/G+7/P6vk76nTCgBYab7/A8Dmcf8HgM3z+s3bl91eb79fFO2Ik/FoMBqkY8qfv+jtPyrO7E2fdTIaDRrn+eOUF5fz7did5E9m5jvx8EHK/2TPXvWu5K04WPzyAQAAAAAAAAAAAAAAAAAAoBY6xbmZ+/s7nX/lqbrw+wBX9u83415zacsAAAAAAAAAAAAAAAAAAACAlXb8+cvh8OjofVnf4ke2q7ci4j/n1PE1jKe1aGPZRcRSL/qrBkueW9G4HuV+ZwIAAAAAAAAAAAAAAAAAgM0z3fSbuxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyGf6//+LKyJiXCW5lwsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACssd8BAAD//xg9nuE=") prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000780)={0x0, 0x4, 0x0, [0x806f, 0x0, 0x2d5, 0x6, 0x6], [0x6, 0x7, 0x1, 0x9, 0x8002, 0x4, 0x5, 0x2, 0x0, 0x802, 0x9, 0x200000100, 0x3, 0xfffffffffffffff4, 0x4a, 0x1000000000005, 0x100, 0xd, 0xdd, 0x7, 0x1, 0x2a9, 0x3, 0xc39, 0x8, 0x8, 0x100000000, 0x2, 0xa51, 0x8, 0x401, 0x800000000000003, 0x7, 0xfffffffffffffffa, 0x81, 0x796, 0x5, 0x931, 0x1000101, 0x3, 0x1000000000008001, 0x8000000000000000, 0x7, 0x1, 0x8, 0x8, 0x6a7, 0x102, 0x1, 0x83, 0x538a, 0x9, 0xfffffffffffffff7, 0x4, 0x0, 0x4, 0x10001, 0x8, 0x5, 0x8000000000000000, 0x2, 0xfffffffffffffffc, 0xfffffffffffffffd, 0x5bc, 0x1, 0x1, 0x4, 0x8000, 0xc9, 0x7, 0x6, 0x9, 0x82c, 0x8000, 0xe000000000000, 0xe4, 0x11, 0x0, 0x8, 0x22, 0x3, 0xb, 0x1, 0x8000000000000000, 0x2000000009, 0x8, 0x0, 0x6, 0x6, 0x7, 0x100000002, 0xe, 0x4, 0x8, 0x7, 0x8, 0x9, 0x1, 0x16d, 0x6, 0x68d, 0xffffffffffff43b0, 0x8, 0x50000000000000, 0xe, 0x0, 0x0, 0x100000003, 0x4, 0x7, 0x406, 0x9, 0x6, 0x5, 0xfffffffffffffffd, 0x3, 0x40, 0x7fffffff, 0x8, 0x3, 0x1]}) r4 = io_uring_setup(0x899, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f5}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1c, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="dbaa7bc3184d"], 0x0, 0xb, 0x0, 0x0, 0x0, 0x6f, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0) 258.88604ms ago: executing program 1 (id=59): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000000)={0xb, {'syz0\x00', 'syz1\x00', 'syz0\x00', 0x33, 0x5, 0x46d, 0xb012, 0x0, 0x0, "0600ff0901a10185100901150026ff007508950681000901910085110901951381000901910085120901953f810009019100c0"}}, 0x14b) write$UHID_INPUT2(r0, &(0x7f0000000400)={0xc, {0x14, "11"}}, 0x7) 258.6526ms ago: executing program 1 (id=60): r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x963b01) fcntl$setstatus(r0, 0x4, 0x40000) 258.52058ms ago: executing program 1 (id=61): syz_emit_ethernet(0x52, &(0x7f0000000080)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "14d718", 0x1c, 0x6, 0x0, @local, @local, {[], {{0xfffe, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x7, 0x2, 0xfffe, 0x0, 0x1001, {[@nop, @exp_fastopen={0xfe, 0x7, 0xf989, "30d008"}]}}}}}}}}, 0x0) 247.611882ms ago: executing program 2 (id=62): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x1, 0xfffffffc, 0x0, {{@in=@empty, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1}, {@in=@local, 0x1234, 0x6c}, @in6=@rand_addr=' \x01\x00', {0xffffffffffffefff, 0x966, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x3504, 0x2, 0x1}}, 0xf0}}, 0x0) 202.895292ms ago: executing program 1 (id=63): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000100)={0x80000000, 0x0, 0xfffffffc}, 0x10) write(r0, &(0x7f0000000000)="1c0000001a005f0214f9f407000904001f000000fe20004000000000", 0x1c) 183.984587ms ago: executing program 4 (id=64): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) read(r0, &(0x7f0000000740)=""/384, 0x180) 181.564918ms ago: executing program 2 (id=74): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4008080) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2d}}, 0x6}, 0x1c) r1 = fsopen(&(0x7f0000000080)='nfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000000c0)='source\x00', &(0x7f0000000100)='127.0.0.1:/export\x00', 0x0) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(r2, 0x0, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xb, 0x0, 0x0, 0x0, 0x4, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r0}, 0x94) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000003c0)='retrans\x00', &(0x7f0000000400)='10\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./tracing/dynamic_events\x00', 0x1, 0x0) write(r3, &(0x7f0000000100)='e:my_read_msr1 msr/read_msr', 0x1b) write(r3, &(0x7f0000000140)='e:my_read_msr2 msr/read_msr', 0x1b) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing/events/eprobes/my_read_msr1/enable\x00', 0x1, 0x0) write(r4, &(0x7f0000000240)='1', 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./tracing/events/eprobes/my_read_msr2/enable\x00', 0x1, 0x0) write(r5, &(0x7f00000002c0)='1', 0x1) 89.668279ms ago: executing program 4 (id=65): fsopen(&(0x7f0000000300)='tracefs\x00', 0x0) 42.952819ms ago: executing program 1 (id=66): r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$KDGKBDIACR(r0, 0x4b4a, &(0x7f0000000180)=""/45) 31.275392ms ago: executing program 1 (id=67): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') r1 = open(&(0x7f0000000040)='./bus\x00', 0x4c27e, 0x10) fallocate(r1, 0x0, 0x0, 0x1000f4) sendfile(r1, r1, 0x0, 0x40000000800) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x80042, 0x4d) fallocate(r2, 0x100000000000011, 0x2000, 0x2f93) 0s ago: executing program 4 (id=68): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @local}, 0x2}}, 0x2e) ioctl$PPPIOCGFLAGS(r0, 0x8004745a, 0x0) kernel console output (not intermixed with test programs): sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.412442][ T30] audit: type=1400 audit(1790870942.382:63): avc: denied { siginh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.40' (ED25519) to the list of known hosts. [ 22.223583][ T30] audit: type=1400 audit(1790870949.212:64): avc: denied { mounton } for pid=277 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.224624][ T277] cgroup: Unknown subsys name 'net' [ 22.246277][ T30] audit: type=1400 audit(1790870949.212:65): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.273524][ T30] audit: type=1400 audit(1790870949.232:66): avc: denied { unmount } for pid=277 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.273662][ T277] cgroup: Unknown subsys name 'devices' [ 22.413872][ T277] cgroup: Unknown subsys name 'hugetlb' [ 22.419485][ T277] cgroup: Unknown subsys name 'rlimit' [ 22.525242][ T30] audit: type=1400 audit(1790870949.512:67): avc: denied { setattr } for pid=277 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.548433][ T30] audit: type=1400 audit(1790870949.512:68): avc: denied { mounton } for pid=277 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 22.573147][ T30] audit: type=1400 audit(1790870949.512:69): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.585752][ T279] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.605075][ T30] audit: type=1400 audit(1790870949.592:70): avc: denied { relabelto } for pid=279 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.619517][ T277] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.630482][ T30] audit: type=1400 audit(1790870949.592:71): avc: denied { write } for pid=279 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.664715][ T30] audit: type=1400 audit(1790870949.612:72): avc: denied { read } for pid=277 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.690236][ T30] audit: type=1400 audit(1790870949.612:73): avc: denied { open } for pid=277 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.400342][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.407542][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.415020][ T285] device bridge_slave_0 entered promiscuous mode [ 23.427626][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.434707][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.442081][ T285] device bridge_slave_1 entered promiscuous mode [ 23.483069][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.490118][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.497690][ T287] device bridge_slave_0 entered promiscuous mode [ 23.505300][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.512438][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.519682][ T287] device bridge_slave_1 entered promiscuous mode [ 23.555319][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.562407][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.569641][ T286] device bridge_slave_0 entered promiscuous mode [ 23.576552][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.583760][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.591006][ T286] device bridge_slave_1 entered promiscuous mode [ 23.626298][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.633424][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.640791][ T288] device bridge_slave_0 entered promiscuous mode [ 23.650063][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.657157][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.664516][ T288] device bridge_slave_1 entered promiscuous mode [ 23.741637][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.748735][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.756239][ T289] device bridge_slave_0 entered promiscuous mode [ 23.765667][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.772780][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.780035][ T289] device bridge_slave_1 entered promiscuous mode [ 23.852652][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.859706][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.866997][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.874025][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.894125][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.901332][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.909228][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.916695][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.944395][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.952789][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.960854][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.967884][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.975376][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.983841][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.991926][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.998958][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.006516][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.032811][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.040265][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.048472][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.055498][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.063168][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.095125][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.103391][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.111979][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.120137][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.127167][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.134618][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.142849][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.149880][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.157244][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.165426][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.172452][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.179742][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.187800][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.203150][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.211018][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.218990][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.227028][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.245292][ T286] device veth0_vlan entered promiscuous mode [ 24.251825][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.259438][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.267913][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.275523][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.283100][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.291185][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.298222][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.305723][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.325807][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.334003][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.342320][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.350410][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.357436][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.364848][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.380460][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.394265][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.403044][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.410902][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.419319][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.426368][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.434057][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.443031][ T286] device veth1_macvtap entered promiscuous mode [ 24.449760][ T285] device veth0_vlan entered promiscuous mode [ 24.463654][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.471518][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.479478][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.487335][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.495462][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.503831][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.511924][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.518950][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.526820][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.534319][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.541700][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.549128][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.559390][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.567481][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.579224][ T285] device veth1_macvtap entered promiscuous mode [ 24.586028][ T289] device veth0_vlan entered promiscuous mode [ 24.598693][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.606972][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.615104][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.622796][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.631040][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.639524][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.647670][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.655689][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.663899][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.671928][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.680275][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.693208][ T287] device veth0_vlan entered promiscuous mode [ 24.704460][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.712628][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.720502][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.728728][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.737151][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.744598][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.757042][ T289] device veth1_macvtap entered promiscuous mode [ 24.764157][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.771793][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.780281][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.788797][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.797317][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.805702][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.813922][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.823287][ T287] device veth1_macvtap entered promiscuous mode [ 24.842635][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.850449][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.850644][ T286] request_module fs-gadgetfs succeeded, but still no fs? [ 24.859221][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.874757][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.883329][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.892873][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.901212][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.929263][ T288] device veth0_vlan entered promiscuous mode [ 24.935628][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.944088][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.952580][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.960718][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.969184][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.977336][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.985677][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.993413][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.012106][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.021598][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.044074][ T288] device veth1_macvtap entered promiscuous mode [ 25.058543][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.070965][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.082459][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.112123][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.148334][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.264062][ T331] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10'. [ 25.343427][ T335] loop2: detected capacity change from 0 to 8192 [ 25.531880][ T360] loop3: detected capacity change from 0 to 512 [ 25.533181][ T362] netlink: 12 bytes leftover after parsing attributes in process `syz.1.22'. [ 25.560887][ T366] loop1: detected capacity change from 0 to 512 [ 25.590640][ T360] EXT4-fs (loop3): Ignoring removed bh option [ 25.602303][ T360] EXT4-fs (loop3): quotafile must be on filesystem root [ 25.602847][ T370] loop4: detected capacity change from 0 to 512 [ 25.633196][ T366] EXT4-fs (loop1): Ignoring removed bh option [ 25.642653][ T366] EXT4-fs (loop1): quotafile must be on filesystem root [ 25.686574][ T360] loop3: detected capacity change from 0 to 512 [ 25.693005][ T370] EXT4-fs (loop4): Journaled quota options ignored when QUOTA feature is enabled [ 25.707978][ T370] EXT4-fs (loop4): Quota format mount options ignored when QUOTA feature is enabled [ 25.719187][ T370] EXT4-fs error (device loop4): ext4_quota_enable:6431: comm syz.4.25: Bad quota inum: 2934046720, type: 1 [ 25.730928][ T370] EXT4-fs warning (device loop4): ext4_enable_quotas:6479: Failed to enable quota tracking (type=1, err=-117, ino=2934046720). Please run e2fsck to fix. [ 25.765700][ T366] loop1: detected capacity change from 0 to 512 [ 25.780325][ T370] EXT4-fs (loop4): mount failed [ 25.803099][ T360] EXT4-fs error (device loop3): ext4_orphan_get:1410: inode #15: comm syz.3.21: iget: bad i_size value: 38620345925642 [ 25.823723][ T360] EXT4-fs error (device loop3): ext4_orphan_get:1415: comm syz.3.21: couldn't read orphan inode 15 (err -117) [ 25.835774][ T360] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 25.847772][ T366] EXT4-fs error (device loop1): ext4_orphan_get:1410: inode #15: comm syz.1.24: iget: bad i_size value: 38620345925642 [ 25.866321][ T366] EXT4-fs error (device loop1): ext4_orphan_get:1415: comm syz.1.24: couldn't read orphan inode 15 (err -117) [ 25.878363][ T366] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 25.967982][ T384] EXT4-fs error (device loop3): ext4_validate_block_bitmap:429: comm syz.3.21: bg 0: block 5: invalid block bitmap [ 25.981944][ T382] EXT4-fs error (device loop1): ext4_validate_block_bitmap:429: comm syz.1.24: bg 0: block 5: invalid block bitmap [ 25.983479][ T384] EXT4-fs (loop3): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 2048 with error 28 [ 25.994658][ T382] EXT4-fs (loop1): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 2048 with error 28 [ 26.007055][ T384] EXT4-fs (loop3): This should not happen!! Data will be lost [ 26.007055][ T384] [ 26.028917][ T384] EXT4-fs (loop3): Total free blocks count 0 [ 26.035116][ T384] EXT4-fs (loop3): Free/Dirty block details [ 26.041034][ T384] EXT4-fs (loop3): free_blocks=0 [ 26.046371][ T384] EXT4-fs (loop3): dirty_blocks=4084 [ 26.051674][ T384] EXT4-fs (loop3): Block reservation details [ 26.087283][ T382] EXT4-fs (loop1): This should not happen!! Data will be lost [ 26.087283][ T382] [ 26.098000][ T384] EXT4-fs (loop3): i_reserved_data_blocks=4084 [ 26.179415][ T366] fuse: Unknown parameter 'ÿÿÿÿÿÿÿÿ' [ 26.206372][ T382] EXT4-fs (loop1): Total free blocks count 0 [ 26.213850][ T382] EXT4-fs (loop1): Free/Dirty block details [ 26.219776][ T382] EXT4-fs (loop1): free_blocks=0 [ 26.224761][ T382] EXT4-fs (loop1): dirty_blocks=4340 [ 26.230119][ T382] EXT4-fs (loop1): Block reservation details [ 26.233905][ T8] EXT4-fs (loop3): Delayed block allocation failed for inode 18 at logical offset 2052 with max blocks 2032 with error 28 [ 26.236238][ T382] EXT4-fs (loop1): i_reserved_data_blocks=4340 [ 26.249052][ T8] EXT4-fs (loop3): This should not happen!! Data will be lost [ 26.249052][ T8] [ 26.264576][ T10] EXT4-fs (loop1): Delayed block allocation failed for inode 18 at logical offset 2052 with max blocks 2048 with error 28 [ 26.277398][ T318] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 26.280647][ T10] EXT4-fs (loop1): This should not happen!! Data will be lost [ 26.280647][ T10] [ 26.336060][ T391] netlink: 24 bytes leftover after parsing attributes in process `syz.3.30'. [ 26.378099][ T397] raw_sendmsg: syz.1.33 forgot to set AF_INET. Fix it! [ 26.461116][ T410] FAULT_INJECTION: forcing a failure. [ 26.461116][ T410] name failslab, interval 1, probability 0, space 0, times 1 [ 26.474231][ T410] CPU: 1 PID: 410 Comm: syz.4.39 Not tainted syzkaller #0 [ 26.481366][ T410] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.491405][ T410] Call Trace: [ 26.494692][ T410] [ 26.497611][ T410] __dump_stack+0x21/0x30 [ 26.501948][ T410] dump_stack_lvl+0x110/0x170 [ 26.506605][ T410] ? show_regs_print_info+0x20/0x20 [ 26.511782][ T410] dump_stack+0x15/0x20 [ 26.515915][ T410] should_fail+0x3ab/0x500 [ 26.520320][ T410] __should_failslab+0xa4/0xe0 [ 26.525071][ T410] should_failslab+0x9/0x20 [ 26.529571][ T410] slab_pre_alloc_hook+0x39/0xd0 [ 26.534496][ T410] __kmalloc+0x6d/0x2c0 [ 26.538654][ T410] ? should_failslab+0x9/0x20 [ 26.543309][ T410] ? security_prepare_creds+0x4e/0x140 [ 26.548748][ T410] security_prepare_creds+0x4e/0x140 [ 26.554038][ T410] prepare_creds+0x428/0x610 [ 26.558623][ T410] lookup_user_key+0x330/0x11b0 [ 26.563457][ T410] ? lookup_user_key_possessed+0x40/0x40 [ 26.569071][ T410] ? search_process_keyrings_rcu+0x280/0x280 [ 26.575465][ T410] ? __kasan_check_write+0x14/0x20 [ 26.580561][ T410] ? _copy_from_user+0x95/0xd0 [ 26.585304][ T410] __se_sys_add_key+0x311/0x410 [ 26.590135][ T410] ? __x64_sys_add_key+0xd0/0xd0 [ 26.595054][ T410] ? ksys_write+0x1fa/0x260 [ 26.599538][ T410] ? __kasan_check_write+0x14/0x20 [ 26.604625][ T410] __x64_sys_add_key+0xbf/0xd0 [ 26.609370][ T410] x64_sys_call+0x713/0x9a0 [ 26.613851][ T410] do_syscall_64+0x4c/0xa0 [ 26.618251][ T410] ? clear_bhb_loop+0x50/0xa0 [ 26.622905][ T410] ? clear_bhb_loop+0x50/0xa0 [ 26.627558][ T410] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 26.633428][ T410] RIP: 0033:0x7f0900164159 [ 26.637819][ T410] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 26.642258][ T318] usb 1-1: New USB device found, idVendor=1d50, idProduct=6089, bcdDevice=d0.1d [ 26.657405][ T410] RSP: 002b:00007f08febbd028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 26.657443][ T410] RAX: ffffffffffffffda RBX: 00007f09003ebfa0 RCX: 00007f0900164159 [ 26.657454][ T410] RDX: 0000200000000300 RSI: 0000000000000000 RDI: 0000200000000100 [ 26.657470][ T410] RBP: 00007f09001fb06b R08: fffffffffffffffe R09: 0000000000000000 [ 26.657482][ T410] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 26.666622][ T318] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.674882][ T410] R13: 00007f09003ec038 R14: 00007f09003ebfa0 R15: 00007ffe04500be8 [ 26.674901][ T410] [ 26.738327][ T318] usb 1-1: config 0 descriptor?? [ 26.757842][ T422] loop4: detected capacity change from 0 to 512 [ 26.769117][ T422] EXT4-fs (loop4): Ignoring removed bh option [ 26.775480][ T422] EXT4-fs (loop4): quotafile must be on filesystem root [ 26.850296][ T422] loop4: detected capacity change from 0 to 512 [ 26.877156][ T422] EXT4-fs error (device loop4): ext4_orphan_get:1410: inode #15: comm syz.4.44: iget: bad i_size value: 38620345925642 [ 26.889891][ T422] EXT4-fs error (device loop4): ext4_orphan_get:1415: comm syz.4.44: couldn't read orphan inode 15 (err -117) [ 26.902655][ T422] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 26.916503][ T422] fuse: Unknown parameter 'ÿÿÿÿÿÿÿÿ' [ 27.290888][ T30] kauditd_printk_skb: 97 callbacks suppressed [ 27.290902][ T30] audit: type=1400 audit(1790870960.272:171): avc: denied { create } for pid=440 comm="syz.2.51" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 27.347235][ T30] audit: type=1400 audit(1790870960.332:172): avc: denied { name_bind } for pid=442 comm="syz.1.52" src=3618 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 27.369116][ T444] UDC core: couldn't find an available UDC or it's busy: -16 [ 27.379694][ T444] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 27.406650][ T30] audit: type=1400 audit(1790870960.332:173): avc: denied { read } for pid=440 comm="syz.2.51" path="socket:[16578]" dev="sockfs" ino=16578 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 27.434696][ T448] FAULT_INJECTION: forcing a failure. [ 27.434696][ T448] name failslab, interval 1, probability 0, space 0, times 0 [ 27.463604][ T448] CPU: 0 PID: 448 Comm: syz.2.53 Not tainted syzkaller #0 [ 27.470747][ T448] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 27.480803][ T448] Call Trace: [ 27.484081][ T448] [ 27.487007][ T448] __dump_stack+0x21/0x30 [ 27.491339][ T448] dump_stack_lvl+0x110/0x170 [ 27.496023][ T448] ? show_regs_print_info+0x20/0x20 [ 27.501233][ T448] dump_stack+0x15/0x20 [ 27.505391][ T448] should_fail+0x3ab/0x500 [ 27.509810][ T448] __should_failslab+0xa4/0xe0 [ 27.514580][ T448] should_failslab+0x9/0x20 [ 27.519087][ T448] slab_pre_alloc_hook+0x39/0xd0 [ 27.524072][ T448] __kmalloc+0x6d/0x2c0 [ 27.528232][ T448] ? shmem_initxattrs+0xd1/0x1f0 [ 27.531903][ T453] fuse: Unknown parameter 'ÿÿÿÿÿÿÿÿ' [ 27.533167][ T448] shmem_initxattrs+0xd1/0x1f0 [ 27.533189][ T448] security_inode_init_security+0x249/0x380 [ 27.549081][ T448] ? shmem_tmpfile+0x100/0x100 [ 27.553836][ T448] ? security_dentry_create_files_as+0xc0/0xc0 [ 27.559984][ T448] ? __kasan_check_write+0x14/0x20 [ 27.565084][ T448] ? set_cached_acl+0xdd/0x180 [ 27.569835][ T448] ? simple_acl_create+0x191/0x1c0 [ 27.574932][ T448] shmem_mknod+0xbb/0x1c0 [ 27.579244][ T448] ? selinux_inode_mkdir+0x22/0x30 [ 27.584340][ T448] shmem_mkdir+0x2f/0x60 [ 27.588562][ T448] vfs_mkdir+0x38b/0x590 [ 27.592787][ T448] do_mkdirat+0x174/0x4d0 [ 27.597101][ T448] __x64_sys_mkdirat+0x89/0xa0 [ 27.601846][ T448] x64_sys_call+0x37e/0x9a0 [ 27.606336][ T448] do_syscall_64+0x4c/0xa0 [ 27.610753][ T448] ? clear_bhb_loop+0x50/0xa0 [ 27.615427][ T448] ? clear_bhb_loop+0x50/0xa0 [ 27.620103][ T448] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 27.625986][ T448] RIP: 0033:0x7f23e300d159 [ 27.630389][ T448] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 27.649981][ T448] RSP: 002b:00007f23e1a66028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 27.658393][ T448] RAX: ffffffffffffffda RBX: 00007f23e3294fa0 RCX: 00007f23e300d159 [ 27.666346][ T448] RDX: 00000000000001df RSI: 0000200000000000 RDI: ffffffffffffff9c [ 27.674307][ T448] RBP: 00007f23e30a406b R08: 0000000000000000 R09: 0000000000000000 [ 27.682263][ T448] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 27.690214][ T448] R13: 00007f23e3295038 R14: 00007f23e3294fa0 R15: 00007fffc3cbc888 [ 27.698170][ T448] [ 27.867657][ T30] audit: type=1400 audit(1790870960.852:174): avc: denied { create } for pid=468 comm="syz.2.62" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 27.919646][ T30] audit: type=1400 audit(1790870960.852:175): avc: denied { write } for pid=468 comm="syz.2.62" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 27.939616][ T475] loop3: detected capacity change from 0 to 512 [ 27.963070][ T475] ======================================================= [ 27.963070][ T475] WARNING: The mand mount option has been deprecated and [ 27.963070][ T475] and is ignored by this kernel. Remove the mand [ 27.963070][ T475] option from the mount to silence this warning. [ 27.963070][ T475] ======================================================= [ 28.077188][ T30] audit: type=1400 audit(1790870960.852:176): avc: denied { nlmsg_write } for pid=468 comm="syz.2.62" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 28.084803][ T444] UDC core: couldn't find an available UDC or it's busy: -16 [ 28.105180][ T444] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 28.121717][ T30] audit: type=1400 audit(1790870961.012:177): avc: denied { mount } for pid=473 comm="syz.2.74" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 28.152472][ T328] ================================================================== [ 28.154554][ T30] audit: type=1400 audit(1790870961.132:178): avc: denied { create } for pid=483 comm="syz.4.68" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 28.160540][ T328] BUG: KASAN: use-after-free in rcu_segcblist_enqueue+0x9c/0xb0 [ 28.180299][ T30] audit: type=1400 audit(1790870961.132:179): avc: denied { connect } for pid=483 comm="syz.4.68" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 28.187291][ T328] Write of size 8 at addr ffff88810fdb2d90 by task kworker/u4:3/328 [ 28.187306][ T328] [ 28.187310][ T328] CPU: 1 PID: 328 Comm: kworker/u4:3 Not tainted syzkaller #0 [ 28.207347][ T30] audit: type=1400 audit(1790870961.132:180): avc: denied { ioctl } for pid=483 comm="syz.4.68" path="socket:[16621]" dev="sockfs" ino=16621 ioctlcmd=0x745a scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 28.214511][ T328] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 28.214522][ T328] Workqueue: l2tp l2tp_tunnel_del_work [ 28.214544][ T328] Call Trace: [ 28.214549][ T328] [ 28.214555][ T328] __dump_stack+0x21/0x30 [ 28.214570][ T328] dump_stack_lvl+0x110/0x170 [ 28.214583][ T328] ? show_regs_print_info+0x20/0x20 [ 28.214596][ T328] ? load_image+0x3f0/0x3f0 [ 28.214611][ T328] print_address_description+0x7f/0x2c0 [ 28.214626][ T328] ? rcu_segcblist_enqueue+0x9c/0xb0 [ 28.214643][ T328] kasan_report+0x10f/0x150 [ 28.214659][ T328] ? rcu_segcblist_enqueue+0x9c/0xb0 [ 28.309434][ T328] __asan_report_store8_noabort+0x17/0x20 [ 28.315153][ T328] rcu_segcblist_enqueue+0x9c/0xb0 [ 28.320250][ T328] call_rcu+0x549/0xf60 [ 28.324389][ T328] ? rcu_gp_kthread_wake+0x90/0x90 [ 28.329482][ T328] ? kasan_quarantine_put+0x34/0x190 [ 28.334746][ T328] delete_node+0x1c0/0xa60 [ 28.339146][ T328] __radix_tree_delete+0x258/0x3c0 [ 28.344235][ T328] radix_tree_delete_item+0x2fc/0x410 [ 28.349588][ T328] idr_remove+0x43/0x60 [ 28.353724][ T328] l2tp_tunnel_del_work+0x34f/0x3d0 [ 28.358903][ T328] process_one_work+0x6c8/0xbb0 [ 28.363736][ T328] worker_thread+0xaa0/0x1250 [ 28.368396][ T328] ? __kasan_check_read+0x11/0x20 [ 28.373400][ T328] kthread+0x3f5/0x4f0 [ 28.377448][ T328] ? worker_clr_flags+0x190/0x190 [ 28.382453][ T328] ? kthread_blkcg+0xd0/0xd0 [ 28.387021][ T328] ret_from_fork+0x1f/0x30 [ 28.391418][ T328] [ 28.394417][ T328] [ 28.396718][ T328] Allocated by task 486: [ 28.400932][ T328] __kasan_kmalloc+0xd4/0x100 [ 28.405589][ T328] __kmalloc+0x13d/0x2c0 [ 28.409813][ T328] l2tp_session_create+0x39/0xb60 [ 28.414817][ T328] pppol2tp_connect+0xbf5/0x1640 [ 28.419732][ T328] __sys_connect+0x3cb/0x450 [ 28.424297][ T328] __x64_sys_connect+0x7a/0x90 [ 28.429044][ T328] x64_sys_call+0x7c/0x9a0 [ 28.433435][ T328] do_syscall_64+0x4c/0xa0 [ 28.437831][ T328] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 28.443706][ T328] [ 28.446011][ T328] Freed by task 328: [ 28.449876][ T328] kasan_set_track+0x4a/0x70 [ 28.454446][ T328] kasan_set_free_info+0x23/0x40 [ 28.459364][ T328] ____kasan_slab_free+0x125/0x160 [ 28.464452][ T328] __kasan_slab_free+0x11/0x20 [ 28.469196][ T328] slab_free_freelist_hook+0xc2/0x190 [ 28.474546][ T328] kfree+0xc4/0x270 [ 28.478335][ T328] l2tp_session_put+0xaf/0x1a0 [ 28.483085][ T328] l2tp_session_delete+0x3a9/0x4a0 [ 28.488176][ T328] l2tp_tunnel_del_work+0x180/0x3d0 [ 28.493351][ T328] process_one_work+0x6c8/0xbb0 [ 28.498188][ T328] worker_thread+0xaa0/0x1250 [ 28.502842][ T328] kthread+0x3f5/0x4f0 [ 28.506888][ T328] ret_from_fork+0x1f/0x30 [ 28.511283][ T328] [ 28.513585][ T328] Last potentially related work creation: [ 28.519276][ T328] kasan_save_stack+0x3a/0x60 [ 28.523936][ T328] __kasan_record_aux_stack+0xd2/0x100 [ 28.529373][ T328] kasan_record_aux_stack_noalloc+0xb/0x10 [ 28.535158][ T328] call_rcu+0x10b/0xf60 [ 28.539300][ T328] pppol2tp_release+0x1e3/0x2b0 [ 28.544129][ T328] sock_close+0xb8/0x200 [ 28.548352][ T328] __fput+0x22b/0x900 [ 28.552314][ T328] ____fput+0x15/0x20 [ 28.556276][ T328] task_work_run+0x127/0x190 [ 28.560845][ T328] exit_to_user_mode_loop+0xd0/0xe0 [ 28.566026][ T328] exit_to_user_mode_prepare+0x87/0xd0 [ 28.571471][ T328] syscall_exit_to_user_mode+0x1a/0x30 [ 28.576906][ T328] do_syscall_64+0x58/0xa0 [ 28.581306][ T328] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 28.587177][ T328] [ 28.589481][ T328] The buggy address belongs to the object at ffff88810fdb2c00 [ 28.589481][ T328] which belongs to the cache kmalloc-512 of size 512 [ 28.603512][ T328] The buggy address is located 400 bytes inside of [ 28.603512][ T328] 512-byte region [ffff88810fdb2c00, ffff88810fdb2e00) [ 28.616762][ T328] The buggy address belongs to the page: [ 28.622378][ T328] page:ffffea00043f6c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10fdb0 [ 28.632595][ T328] head:ffffea00043f6c00 order:2 compound_mapcount:0 compound_pincount:0 [ 28.640892][ T328] flags: 0x4000000000010200(slab|head|zone=1) [ 28.646948][ T328] raw: 4000000000010200 ffffea0004416900 0000000500000005 ffff888100042f00 [ 28.655509][ T328] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 28.664067][ T328] page dumped because: kasan: bad access detected [ 28.670453][ T328] page_owner tracks the page as allocated [ 28.676148][ T328] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 102, ts 3997137978, free_ts 0 [ 28.694180][ T328] post_alloc_hook+0x192/0x1b0 [ 28.698928][ T328] prep_new_page+0x1c/0x110 [ 28.703409][ T328] get_page_from_freelist+0x2c3a/0x2cd0 [ 28.708933][ T328] __alloc_pages+0x1a2/0x460 [ 28.713500][ T328] new_slab+0xa0/0x4d0 [ 28.717548][ T328] ___slab_alloc+0x3ac/0x840 [ 28.722117][ T328] __slab_alloc+0x49/0x90 [ 28.726426][ T328] __kmalloc_track_caller+0x169/0x2c0 [ 28.731774][ T328] __alloc_skb+0x210/0x730 [ 28.736171][ T328] alloc_uevent_skb+0x85/0x240 [ 28.740913][ T328] kobject_uevent_net_broadcast+0x335/0x5a0 [ 28.746784][ T328] kobject_uevent_env+0x52b/0x700 [ 28.751790][ T328] kobject_synth_uevent+0x457/0x940 [ 28.756966][ T328] store_uevent+0x16/0x30 [ 28.761275][ T328] module_attr_store+0x5f/0x80 [ 28.766022][ T328] sysfs_kf_write+0x129/0x150 [ 28.770679][ T328] page_owner free stack trace missing [ 28.776019][ T328] [ 28.778326][ T328] Memory state around the buggy address: [ 28.783932][ T328] ffff88810fdb2c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.791968][ T328] ffff88810fdb2d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.800004][ T328] >ffff88810fdb2d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.808039][ T328] ^ [ 28.812602][ T328] ffff88810fdb2e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.820783][ T328] ffff88810fdb2e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.828828][ T328] ================================================================== [ 28.836872][ T328] Disabling lock debugging due to kernel taint [ 28.843220][ T450] UDC core: couldn't find an available UDC or it's busy: -16 [ 28.921451][ T450] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 29.969628][ T296] usb 1-1: USB disconnect, device number 2