last executing test programs: 1.003379181s ago: executing program 3 (id=237): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x28, 0x2, 0x3, 0x101, 0x0, 0x0, {0x7, 0x0, 0x5}, [@NFQA_CFG_PARAMS={0x9, 0x2, {0x9}}, @NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x1a}}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x4000) write(r0, &(0x7f0000000000)="2400000011005f0414f9f40700090400810000000d0000000000000008000f0001000000", 0x24) 728.621804ms ago: executing program 3 (id=251): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000000)=0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001440)={0x50, 0x0, &(0x7f0000000340)=[@register_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x51, 0x0, &(0x7f0000000440)="0cf8f7c9918fdaf5b181f23e22a10eb008ef589894efcf6effd2c1ec287bb5ff20fabfd5f8a47c80da6b89bce00a0f656d0709b36ad0a039788796d1caafe19793612ee7c251f1e1926791d50f40f95c5e"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000005c0)={0x50, 0x0, &(0x7f00000004c0)=[@register_looper, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) 683.665106ms ago: executing program 3 (id=256): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x40000001, 0x0, 0x7}]}) 561.652182ms ago: executing program 2 (id=263): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x101000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_GET_XSAVE2(r2, 0x9000aecf, &(0x7f0000ffd000/0x2000)=nil) 523.887545ms ago: executing program 3 (id=265): r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x24020000) mount_setattr(0xffffffffffffff9c, &(0x7f0000000180)='.\x00', 0x8000, &(0x7f0000001dc0)={0xf}, 0x20) 480.925346ms ago: executing program 3 (id=268): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x40980, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r0, 0x400455c8, 0x4) ioctl$TIOCSTI(r0, 0x5412, &(0x7f00000001c0)=0x31) 430.811099ms ago: executing program 2 (id=271): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r0 = socket(0xa, 0x3, 0x3a) ioctl$SIOCGETSGCNT(r0, 0x89e1, 0x0) 428.473959ms ago: executing program 1 (id=272): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CLOCK(r1, 0x4030ae7b, &(0x7f0000000040)={0x9, 0xe, 0x8000, 0x9, 0xfcc}) 410.79383ms ago: executing program 2 (id=273): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000140)=0x1, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x1f6, 0x4) sendmmsg$inet(r0, &(0x7f0000003240)=[{{&(0x7f0000000100)={0x2, 0x4e23, @empty}, 0x10, 0x0}}], 0x1, 0x26000000) 377.043842ms ago: executing program 3 (id=274): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='mounts\x00') mount$tmpfs(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000400), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='huge=always']) read$FUSE(r0, &(0x7f0000004180)={0x2020}, 0xfd09) 371.015452ms ago: executing program 2 (id=276): ioprio_set$pid(0x2, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RELOAD_REGDB(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x14, r1, 0x421, 0x70bd2c, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0xc35d4f6d52288271}, 0x200048c4) 304.418295ms ago: executing program 0 (id=277): r0 = creat(&(0x7f0000000000)='./file0\x00', 0x1af) bind$netlink(r0, &(0x7f00000000c0)={0x10, 0x0, 0x25dfdbfe, 0x20000}, 0xc) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c020000190001000000000000000000fc0200000000000000000000000000000000000000000000000000000000000000000006000000000a00000008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000001d000000000000007f0000000000000000000000000000000000000000000000dd020000000000000000000000000000000100020000000084010500ac14143b000000000000000000000000000004d32b00000000000000ac14140c000000000000000000000000000000000000ff00000000000000000000000000fc020000000000000000000000000000000000003200000000000000ac1414aa000000000000000000000000000000000100000000000000ffffffff0000000000000000000000000000000000000001000000003c00000002000000fc0000000000000000000000000000010000000001030000000000000600000000000000ff020000000000000000000000000001000000003c00000002000000fe8000000000000000000000000000aa00000000020000000000000003000000286a8b2700000000000000000000000000000000000000003c0000000200000000000000000000000000000000000000ffffffff00000000000000000000000000004000200100000000000000000000000000010000b102e4cda34d3c890000ffffffff000000000000000000000000000000000100000000"], 0x23c}}, 0x0) 304.086855ms ago: executing program 1 (id=278): ioprio_set$pid(0x3, 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x3ff, &(0x7f0000000500)=0x0) io_submit(r2, 0x2, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x2, r1}, &(0x7f0000000100)={0x0, 0x0, 0x8, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x0, r0}]) 283.049386ms ago: executing program 0 (id=279): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CAP_X86_APIC_BUS_CYCLES_NS(r1, 0x4068aea3, &(0x7f0000000000)={0xed, 0x0, 0x2}) 187.688791ms ago: executing program 1 (id=280): ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000180)={0x3, 'netpci0\x00', {0x1}, 0x4}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), r0) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01032757c38d085641a7260000000c000180080001"], 0x20}, 0x1, 0x0, 0x0, 0x20040005}, 0x0) 167.089462ms ago: executing program 0 (id=281): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.numa_stat\x00', 0x275a, 0x0) write$tun(r0, &(0x7f0000000000)=ANY=[], 0x38) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9, 0x10012, r0, 0x0) lsm_list_modules(0x0, &(0x7f0000000040), 0x0) 135.718164ms ago: executing program 0 (id=282): read$FUSE(0xffffffffffffffff, 0x0, 0x0) r0 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff) pwritev2(r1, &(0x7f0000000940)=[{&(0x7f0000000100)="f7a9", 0x2}], 0x1, 0x8800000, 0x340f, 0x0) 128.534354ms ago: executing program 1 (id=283): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000100)={0x0, 0x2800, &(0x7f0000000080)={&(0x7f00000001c0)={0x54, r1, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}}, {0x14, 0x2, @in={0x2, 0x0, @broadcast}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010026bd7000fbdbdf2505000000280001800d0001007564703a73797a320000000014000280080003008a00000008000100b014e957"], 0x3c}, 0x1, 0x0, 0x0, 0x48c05}, 0x4040140) 104.607465ms ago: executing program 2 (id=284): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$BTRFS_IOC_TREE_SEARCH_V2(r0, 0x400448cc, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000140)={0x1f, 0xffff, 0x2}, 0x6) 71.343927ms ago: executing program 1 (id=285): mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000008300), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, &(0x7f0000002100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r0]) fchownat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0) 69.778697ms ago: executing program 0 (id=286): r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$chown(0x4, r0, 0xee01, 0x0) keyctl$setperm(0x5, r0, 0x30925) keyctl$join(0x1, &(0x7f0000000080)={'syz', 0x2}) 36.736488ms ago: executing program 2 (id=287): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) socket(0xa, 0x3, 0x3a) close_range(r0, 0xffffffffffffffff, 0x0) 27.656739ms ago: executing program 1 (id=288): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x40000085, 0x0, 0x1}]}) 0s ago: executing program 0 (id=289): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f00000003c0)={0x1, 0x0, [{0x3, 0x1, 0x0, 0x0, @irqchip={0x2, 0xaa42}}]}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.75' (ED25519) to the list of known hosts. [ 27.629356][ T36] audit: type=1400 audit(1774466984.010:64): avc: denied { mounton } for pid=283 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 27.633444][ T283] cgroup: Unknown subsys name 'net' [ 27.653702][ T36] audit: type=1400 audit(1774466984.010:65): avc: denied { mount } for pid=283 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 27.682362][ T36] audit: type=1400 audit(1774466984.040:66): avc: denied { unmount } for pid=283 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 27.682861][ T283] cgroup: Unknown subsys name 'devices' [ 27.886132][ T283] cgroup: Unknown subsys name 'hugetlb' [ 27.893096][ T283] cgroup: Unknown subsys name 'rlimit' [ 28.047703][ T36] audit: type=1400 audit(1774466984.430:67): avc: denied { setattr } for pid=283 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 28.071768][ T36] audit: type=1400 audit(1774466984.430:68): avc: denied { mounton } for pid=283 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 28.097917][ T36] audit: type=1400 audit(1774466984.430:69): avc: denied { mount } for pid=283 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 28.123196][ T285] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 28.132217][ T36] audit: type=1400 audit(1774466984.510:70): avc: denied { relabelto } for pid=285 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.159531][ T36] audit: type=1400 audit(1774466984.510:71): avc: denied { write } for pid=285 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.198924][ T36] audit: type=1400 audit(1774466984.580:72): avc: denied { read } for pid=283 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.225489][ T36] audit: type=1400 audit(1774466984.580:73): avc: denied { open } for pid=283 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.226242][ T283] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 29.151841][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.160179][ T292] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.167648][ T292] bridge_slave_0: entered allmulticast mode [ 29.174739][ T292] bridge_slave_0: entered promiscuous mode [ 29.188674][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.196208][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.203740][ T291] bridge_slave_0: entered allmulticast mode [ 29.210055][ T291] bridge_slave_0: entered promiscuous mode [ 29.218913][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.226432][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.233936][ T291] bridge_slave_1: entered allmulticast mode [ 29.240812][ T291] bridge_slave_1: entered promiscuous mode [ 29.247393][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.255016][ T292] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.263938][ T292] bridge_slave_1: entered allmulticast mode [ 29.270635][ T292] bridge_slave_1: entered promiscuous mode [ 29.294530][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.301911][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.309395][ T290] bridge_slave_0: entered allmulticast mode [ 29.316174][ T290] bridge_slave_0: entered promiscuous mode [ 29.338333][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.345979][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.353556][ T293] bridge_slave_0: entered allmulticast mode [ 29.360050][ T293] bridge_slave_0: entered promiscuous mode [ 29.370233][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.377704][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.385548][ T293] bridge_slave_1: entered allmulticast mode [ 29.392170][ T293] bridge_slave_1: entered promiscuous mode [ 29.400897][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.408015][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.415211][ T290] bridge_slave_1: entered allmulticast mode [ 29.421634][ T290] bridge_slave_1: entered promiscuous mode [ 29.567624][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.574738][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.582502][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.589790][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.618703][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.626183][ T292] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.633724][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.640946][ T292] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.678414][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.686111][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.693724][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.700961][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.718023][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.725314][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.732803][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.740261][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.749304][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.756929][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.765087][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.772502][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.781009][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.788826][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.797337][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.805342][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.828436][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.836188][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.846239][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.853646][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.871944][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.879418][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.894993][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.902322][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.933298][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.940825][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.958754][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.965932][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.986993][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.994219][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.002383][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.010237][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.051609][ T293] veth0_vlan: entered promiscuous mode [ 30.059466][ T292] veth0_vlan: entered promiscuous mode [ 30.088586][ T293] veth1_macvtap: entered promiscuous mode [ 30.096564][ T290] veth0_vlan: entered promiscuous mode [ 30.104526][ T292] veth1_macvtap: entered promiscuous mode [ 30.129278][ T291] veth0_vlan: entered promiscuous mode [ 30.152529][ T291] veth1_macvtap: entered promiscuous mode [ 30.161615][ T290] veth1_macvtap: entered promiscuous mode [ 30.204581][ T293] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 30.268279][ T314] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 30.275511][ T313] netlink: 'syz.1.2': attribute type 16 has an invalid length. [ 30.311384][ T313] netlink: 'syz.1.2': attribute type 2 has an invalid length. [ 30.319545][ T313] netlink: 'syz.1.2': attribute type 1 has an invalid length. [ 30.327444][ T313] netlink: 51790 bytes leftover after parsing attributes in process `syz.1.2'. [ 30.525574][ T10] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 30.674422][ T9] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 30.694134][ T10] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 30.706146][ T10] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 15730, setting to 64 [ 30.723421][ T10] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a5, bcdDevice= 0.40 [ 30.742999][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 30.751407][ T10] usb 3-1: SerialNumber: syz [ 30.761820][ T309] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 30.833041][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 30.841402][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 30.852767][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 30.866472][ T9] usb 1-1: New USB device found, idVendor=04d9, idProduct=a04a, bcdDevice= 0.00 [ 30.875930][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.900758][ T9] usb 1-1: config 0 descriptor?? [ 30.936143][ T365] netlink: 12 bytes leftover after parsing attributes in process `syz.1.24'. [ 30.949355][ T365] netlink: 64 bytes leftover after parsing attributes in process `syz.1.24'. [ 30.971961][ T309] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 30.972319][ T367] ======================================================= [ 30.972319][ T367] WARNING: The mand mount option has been deprecated and [ 30.972319][ T367] and is ignored by this kernel. Remove the mand [ 30.972319][ T367] option from the mount to silence this warning. [ 30.972319][ T367] ======================================================= [ 31.130937][ T385] netlink: 8 bytes leftover after parsing attributes in process `syz.3.33'. [ 31.217337][ T10] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -71 [ 31.230356][ T10] usb-storage 3-1:1.0: USB Mass Storage device detected [ 31.252566][ T10] usb-storage 3-1:1.0: Quirks match for vid 0525 pid a4a5: 10000 [ 31.265658][ T10] scsi host1: usb-storage 3-1:1.0 [ 31.283900][ T10] usb 3-1: USB disconnect, device number 2 [ 31.309938][ T9] holtek_mouse 0003:04D9:A04A.0001: unknown main item tag 0x0 [ 31.356025][ T9] holtek_mouse 0003:04D9:A04A.0001: unknown main item tag 0x0 [ 31.364720][ T9] holtek_mouse 0003:04D9:A04A.0001: unknown main item tag 0x0 [ 31.372442][ T9] holtek_mouse 0003:04D9:A04A.0001: unknown main item tag 0x0 [ 31.380796][ T9] holtek_mouse 0003:04D9:A04A.0001: unknown main item tag 0x0 [ 31.389741][ T9] holtek_mouse 0003:04D9:A04A.0001: unknown main item tag 0x0 [ 31.390131][ T411] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 31.405405][ T9] holtek_mouse 0003:04D9:A04A.0001: unexpected long global item [ 31.429737][ T9] holtek_mouse 0003:04D9:A04A.0001: hid parse failed: -22 [ 31.437437][ T9] holtek_mouse 0003:04D9:A04A.0001: probe with driver holtek_mouse failed with error -22 [ 31.515805][ T10] usb 1-1: USB disconnect, device number 2 [ 31.673054][ T46] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 31.742975][ T31] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 31.824430][ T46] usb 2-1: Using ep0 maxpacket: 16 [ 31.834190][ T46] usb 2-1: unable to get BOS descriptor or descriptor too short [ 31.843294][ T46] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 31.862519][ T46] usb 2-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 31.872433][ T46] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 31.886766][ T46] usb 2-1: Product: syz [ 31.891089][ T46] usb 2-1: Manufacturer: syz [ 31.896262][ T46] usb 2-1: SerialNumber: syz [ 31.906380][ T31] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 31.921702][ T31] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 31.932297][ T31] usb 4-1: New USB device found, idVendor=1e7d, idProduct=30d4, bcdDevice= 0.01 [ 31.942295][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.951939][ T31] usb 4-1: config 0 descriptor?? [ 31.985407][ T432] netlink: 12 bytes leftover after parsing attributes in process `syz.2.54'. [ 32.125341][ T46] usb 2-1: Audio class v2/v3 interfaces need an interface association [ 32.152348][ T46] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 32.209337][ T453] netlink: 'syz.2.63': attribute type 11 has an invalid length. [ 32.217365][ T453] netlink: 44 bytes leftover after parsing attributes in process `syz.2.63'. [ 32.370603][ T31] arvo 0003:1E7D:30D4.0002: unknown main item tag 0x0 [ 32.378440][ T31] arvo 0003:1E7D:30D4.0002: unknown main item tag 0x0 [ 32.385352][ T31] arvo 0003:1E7D:30D4.0002: unknown main item tag 0x0 [ 32.393914][ T31] arvo 0003:1E7D:30D4.0002: unknown main item tag 0x0 [ 32.400998][ T31] arvo 0003:1E7D:30D4.0002: unknown main item tag 0x0 [ 32.407895][ T31] arvo 0003:1E7D:30D4.0002: unknown main item tag 0x0 [ 32.415167][ T31] arvo 0003:1E7D:30D4.0002: unknown main item tag 0x0 [ 32.423695][ T31] arvo 0003:1E7D:30D4.0002: hidraw0: USB HID v0.00 Device [HID 1e7d:30d4] on usb-dummy_hcd.3-1/input0 [ 32.525028][ T46] usb 2-1: 2:1 : can't get Cluster Descriptor [ 32.731505][ T10] usb 2-1: USB disconnect, device number 2 [ 32.776605][ T31] usb 4-1: USB disconnect, device number 2 [ 32.966286][ T36] kauditd_printk_skb: 92 callbacks suppressed [ 32.966305][ T36] audit: type=1400 audit(1774466989.350:166): avc: denied { read } for pid=466 comm="syz.0.68" name="ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 32.995856][ T36] audit: type=1400 audit(1774466989.350:167): avc: denied { open } for pid=466 comm="syz.0.68" path="/dev/ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 33.019760][ T36] audit: type=1400 audit(1774466989.350:168): avc: denied { ioctl } for pid=466 comm="syz.0.68" path="/dev/ptp0" dev="devtmpfs" ino=196 ioctlcmd=0x3d0c scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 33.059825][ T36] audit: type=1400 audit(1774466989.440:169): avc: denied { setopt } for pid=470 comm="syz.0.70" lport=5 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 33.082281][ T36] audit: type=1400 audit(1774466989.460:170): avc: denied { connect } for pid=470 comm="syz.0.70" lport=5 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 33.103258][ T36] audit: type=1400 audit(1774466989.460:171): avc: denied { write } for pid=470 comm="syz.0.70" path="socket:[4289]" dev="sockfs" ino=4289 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 33.199701][ T36] audit: type=1400 audit(1774466989.580:172): avc: denied { set_context_mgr } for pid=476 comm="syz.2.73" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 33.203290][ T477] rust_binder: Error while translating object. [ 33.220470][ T477] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 33.222618][ T36] audit: type=1400 audit(1774466989.580:173): avc: denied { map } for pid=476 comm="syz.2.73" path="/dev/binderfs/binder1" dev="binder" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 33.227508][ T477] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:42 [ 33.237373][ T36] audit: type=1400 audit(1774466989.580:174): avc: denied { call } for pid=476 comm="syz.2.73" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 33.342295][ T36] audit: type=1400 audit(1774466989.720:175): avc: denied { write } for pid=485 comm="syz.3.78" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 33.685832][ T527] capability: warning: `syz.0.97' uses deprecated v2 capabilities in a way that may be insecure [ 33.743038][ T533] netlink: 92 bytes leftover after parsing attributes in process `syz.0.100'. [ 33.773308][ T537] rust_binder: Error while translating object. [ 33.773368][ T537] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 33.780053][ T537] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:48 [ 33.938705][ T13] tipc: Subscription rejected, illegal request [ 34.447030][ T594] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 34.547757][ T606] netlink: 104 bytes leftover after parsing attributes in process `syz.3.134'. [ 34.852986][ T31] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 35.002971][ T31] usb 4-1: Using ep0 maxpacket: 16 [ 35.009531][ T31] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 35.024269][ T31] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2ced, bcdDevice= 0.00 [ 35.034220][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 35.043981][ T31] usb 4-1: config 0 descriptor?? [ 35.455551][ T31] kone 0003:1E7D:2CED.0003: unknown main item tag 0x0 [ 35.463042][ T31] kone 0003:1E7D:2CED.0003: unknown main item tag 0x0 [ 35.470174][ T31] kone 0003:1E7D:2CED.0003: unknown main item tag 0x0 [ 35.478122][ T31] kone 0003:1E7D:2CED.0003: unknown main item tag 0x0 [ 35.485373][ T31] kone 0003:1E7D:2CED.0003: unknown main item tag 0x0 [ 35.500178][ T31] kone 0003:1E7D:2CED.0003: unknown main item tag 0x0 [ 35.512962][ T31] kone 0003:1E7D:2CED.0003: unknown main item tag 0x7 [ 35.520612][ T31] kone 0003:1E7D:2CED.0003: invalid report_size 24940 [ 35.528141][ T31] kone 0003:1E7D:2CED.0003: item 0 2 1 7 parsing failed [ 35.539041][ T31] kone 0003:1E7D:2CED.0003: parse failed [ 35.545456][ T31] kone 0003:1E7D:2CED.0003: probe with driver kone failed with error -22 [ 35.681180][ T31] usb 4-1: USB disconnect, device number 3 [ 35.773089][ T46] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 35.926102][ T46] usb 1-1: Using ep0 maxpacket: 32 [ 35.935744][ T46] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 35.947021][ T46] usb 1-1: New USB device found, idVendor=28de, idProduct=1205, bcdDevice= 0.00 [ 35.960202][ T46] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 35.981690][ T46] usb 1-1: config 0 descriptor?? [ 35.995195][ T46] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 36.035064][ T710] input: syz0 as /devices/virtual/input/input4 [ 36.076676][ T714] rust_binder: 116: no such ref 1 [ 36.179915][ T725] SELinux: ebitmap: map size 9 does not match my size 64 (high bit was 255) [ 36.189149][ T725] SELinux: failed to load policy [ 36.206561][ T46] usb 1-1: USB disconnect, device number 3 [ 36.234570][ T730] bpf: Bad value for 'uid' [ 36.444843][ T766] netlink: 8 bytes leftover after parsing attributes in process `syz.1.212'. [ 36.462969][ T766] erspan0: entered promiscuous mode [ 36.470103][ T766] netlink: 8 bytes leftover after parsing attributes in process `syz.1.212'. [ 36.577468][ T780] Zero length message leads to an empty skb [ 36.875145][ T818] netlink: 4 bytes leftover after parsing attributes in process `syz.3.237'. [ 36.885405][ T818] bridge_slave_1: left allmulticast mode [ 36.893645][ T818] bridge_slave_1: left promiscuous mode [ 36.899794][ T818] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.912436][ T818] bridge_slave_0: left allmulticast mode [ 36.941678][ T818] bridge_slave_0: left promiscuous mode [ 36.949469][ T818] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.117620][ T843] netlink: 1143 bytes leftover after parsing attributes in process `syz.2.249'. [ 37.148247][ T848] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:117 [ 37.148423][ T848] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:117 [ 37.304186][ T864] SELinux: failed to load policy [ 37.583034][ T13] veth1_macvtap: left promiscuous mode [ 37.596162][ T13] veth0_vlan: left promiscuous mode [ 37.752627][ T909] tipc: Started in network mode [ 37.760971][ T909] tipc: Node identity ac14140f, cluster identity 4711 [ 37.768853][ T909] tipc: New replicast peer: 255.255.255.255 [ 37.775675][ T909] tipc: Enabled bearer , priority 10 [ 37.854573][ T920] kvm: kvm [919]: vcpu2, guest rIP: 0xfff0 Unhandled WRMSR(0x40000085) = 0x1 [ 37.868769][ T905] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.876300][ T905] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.885461][ T905] bridge_slave_0: entered allmulticast mode [ 37.892292][ T905] bridge_slave_0: entered promiscuous mode [ 37.899100][ T905] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.899704][ T13] ------------[ cut here ]------------ [ 37.906779][ T905] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.912468][ T13] WARNING: CPU: 1 PID: 13 at net/ipv6/xfrm6_tunnel.c:341 xfrm6_tunnel_net_exit+0xc4/0x140 [ 37.919966][ T905] bridge_slave_1: entered allmulticast mode [ 37.930237][ T13] Modules linked in: [ 37.938997][ T905] bridge_slave_1: entered promiscuous mode SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 37.940201][ T13] CPU: 1 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted syzkaller #0 01ee1fe7718a1a23130276f3878b30f131ac2da4 [ 37.958628][ T13] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 37.969117][ T13] Workqueue: netns cleanup_net [ 37.974094][ T13] RIP: 0010:xfrm6_tunnel_net_exit+0xc4/0x140 [ 37.980501][ T13] Code: e8 31 86 d9 fc 4b 83 3c 3e 00 75 19 e8 55 59 81 fc 49 81 ff f8 07 00 00 74 1b e8 47 59 81 fc 49 83 c7 08 eb c9 e8 3c 59 81 fc <0f> 0b 49 81 ff f8 07 00 00 75 e5 49 8d 9e 00 08 00 00 45 31 ff 4a [ 38.000777][ T13] RSP: 0018:ffffc900000d7b90 EFLAGS: 00010293 [ 38.003865][ T36] kauditd_printk_skb: 59 callbacks suppressed [ 38.003926][ T36] audit: type=1400 audit(1774466994.370:235): avc: denied { write } for pid=283 comm="syz-executor" path="pipe:[1520]" dev="pipefs" ino=1520 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 38.007583][ T13] RAX: ffffffff85064f64 RBX: ffff88811f703540 RCX: ffff888103653900 [ 38.045889][ T13] RDX: 0000000000000000 RSI: 0000000000400000 RDI: ffff88810279c0b8 [ 38.054551][ T13] RBP: ffffc900000d7bb0 R08: ffffffff87d38087 R09: 1ffffffff0fa7010 [ 38.063114][ T13] R10: dffffc0000000000 R11: fffffbfff0fa7011 R12: dffffc0000000000 [ 38.071657][ T13] R13: dffffc0000000000 R14: ffff88810279c000 R15: 00000000000000b8 [ 38.080061][ T13] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 38.089411][ T13] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 38.096689][ T13] CR2: 0000001b2f220ff8 CR3: 000000012ea24000 CR4: 00000000003526b0 [ 38.104848][ T13] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 38.113061][ T13] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 38.121448][ T13] Call Trace: [ 38.124894][ T13] [ 38.127865][ T13] cleanup_net+0x6bd/0xc90 [ 38.132524][ T13] ? __cfi_cleanup_net+0x10/0x10 [ 38.138019][ T13] ? __schedule+0x1357/0x1ea0 [ 38.142954][ T13] ? kick_pool+0xb9/0x550 [ 38.147346][ T13] process_scheduled_works+0x7d1/0x1020 [ 38.154687][ T13] worker_thread+0xc70/0x10b0 [ 38.159534][ T13] ? __cfi_try_to_wake_up+0x10/0x10 [ 38.164914][ T13] kthread+0x2c6/0x370 [ 38.169153][ T13] ? __cfi_worker_thread+0x10/0x10 [ 38.174529][ T13] ? __cfi_kthread+0x10/0x10 [ 38.179340][ T13] ret_from_fork+0x67/0xa0 [ 38.184042][ T13] ? __cfi_kthread+0x10/0x10 [ 38.189159][ T13] ret_from_fork_asm+0x1a/0x30 [ 38.194629][ T13] [ 38.198044][ T13] ---[ end trace 0000000000000000 ]--- [ 38.206178][ T13] ------------[ cut here ]------------ [ 38.212131][ T13] WARNING: CPU: 0 PID: 13 at net/ipv6/xfrm6_tunnel.c:344 xfrm6_tunnel_net_exit+0x119/0x140 [ 38.222917][ T13] Modules linked in: [ 38.226996][ T13] CPU: 0 UID: 0 PID: 13 Comm: kworker/u8:1 Tainted: G W syzkaller #0 01ee1fe7718a1a23130276f3878b30f131ac2da4 [ 38.240459][ T13] Tainted: [W]=WARN [ 38.244582][ T13] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 38.255745][ T13] Workqueue: netns cleanup_net [ 38.260595][ T13] RIP: 0010:xfrm6_tunnel_net_exit+0x119/0x140 [ 38.266781][ T13] Code: fc 4b 83 bc 3e 00 08 00 00 00 75 19 e8 00 59 81 fc 49 81 ff f8 07 00 00 74 1b e8 f2 58 81 fc 49 83 c7 08 eb c5 e8 e7 58 81 fc <0f> 0b 49 81 ff f8 07 00 00 75 e5 e8 d7 58 81 fc 5b 41 5c 41 5e 41 [ 38.287044][ T13] RSP: 0018:ffffc900000d7b90 EFLAGS: 00010293 [ 38.293235][ T13] RAX: ffffffff85064fb9 RBX: ffff88810279c800 RCX: ffff888103653900 [ 38.301527][ T13] RDX: 0000000000000000 RSI: 0000000000400000 RDI: ffff88810279c808 [ 38.309600][ T13] RBP: ffffc900000d7bb0 R08: ffffffff87d38087 R09: 1ffffffff0fa7010 [ 38.317688][ T13] R10: dffffc0000000000 R11: fffffbfff0fa7011 R12: dffffc0000000000 [ 38.326283][ T13] R13: dffffc0000000000 R14: ffff88810279c000 R15: 0000000000000008 [ 38.334437][ T13] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 38.343734][ T13] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 38.350575][ T13] CR2: 00007ff36c832bd0 CR3: 000000010cf96000 CR4: 00000000003526b0 [ 38.359050][ T13] Call Trace: [ 38.362378][ T13] [ 38.365383][ T13] cleanup_net+0x6bd/0xc90 [ 38.369944][ T13] ? __cfi_cleanup_net+0x10/0x10 [ 38.375076][ T13] ? __schedule+0x1357/0x1ea0 [ 38.379816][ T13] ? kick_pool+0xb9/0x550 [ 38.384624][ T13] process_scheduled_works+0x7d1/0x1020 [ 38.390754][ T13] worker_thread+0xc70/0x10b0 [ 38.395971][ T13] ? __cfi_try_to_wake_up+0x10/0x10 [ 38.401561][ T13] kthread+0x2c6/0x370 [ 38.406336][ T13] ? __cfi_worker_thread+0x10/0x10 [ 38.411675][ T13] ? __cfi_kthread+0x10/0x10 [ 38.416585][ T13] ret_from_fork+0x67/0xa0 [ 38.421231][ T13] ? __cfi_kthread+0x10/0x10 [ 38.426313][ T13] ret_from_fork_asm+0x1a/0x30 [ 38.431401][ T13] [ 38.434527][ T13] ---[ end trace 0000000000000000 ]--- [ 38.473426][ T13] ------------[ cut here ]------------ [ 38.479440][ T13] WARNING: CPU: 1 PID: 13 at net/xfrm/xfrm_state.c:3216 xfrm_state_fini+0x2be/0x310 [ 38.489717][ T13] Modules linked in: [ 38.493781][ T13] CPU: 1 UID: 0 PID: 13 Comm: kworker/u8:1 Tainted: G W syzkaller #0 01ee1fe7718a1a23130276f3878b30f131ac2da4 [ 38.507841][ T13] Tainted: [W]=WARN [ 38.511730][ T13] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 38.522470][ T13] Workqueue: netns cleanup_net [ 38.527510][ T13] RIP: 0010:xfrm_state_fini+0x2be/0x310 [ 38.533305][ T13] Code: 3c 20 00 74 08 48 89 df e8 2f 50 f4 fc 48 8b 3b e8 97 78 df fc 5b 41 5c 41 5d 41 5e 41 5f 5d e9 48 cc b7 00 cc e8 42 23 9c fc <0f> 0b e9 b0 fd ff ff e8 36 23 9c fc 0f 0b e9 18 fe ff ff e8 2a 23 [ 38.553831][ T13] RSP: 0018:ffffc900000d7b70 EFLAGS: 00010293 [ 38.559958][ T13] RAX: ffffffff84eb855e RBX: ffff88811f703540 RCX: ffff888103653900 [ 38.568309][ T13] RDX: 0000000000000000 RSI: 0000000000400000 RDI: ffff888103653900 [ 38.576350][ T13] RBP: ffffc900000d7b98 R08: ffffffff87d38087 R09: 1ffffffff0fa7010 [ 38.584668][ T13] R10: dffffc0000000000 R11: fffffbfff0fa7011 R12: 1ffffffff0fa6d60 [ 38.593015][ T13] R13: dffffc0000000000 R14: ffff88811f704140 R15: dffffc0000000000 [ 38.601644][ T13] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 38.610797][ T13] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 38.617613][ T13] CR2: 0000001b2f220ff8 CR3: 000000010c3b0000 CR4: 00000000003526b0 [ 38.626372][ T13] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 38.634785][ T13] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 38.643177][ T13] Call Trace: [ 38.646736][ T13] [ 38.649886][ T13] xfrm_net_exit+0x31/0x80 [ 38.654574][ T13] cleanup_net+0x6bd/0xc90 [ 38.659695][ T13] ? __cfi_cleanup_net+0x10/0x10 [ 38.664898][ T13] ? __schedule+0x1357/0x1ea0 [ 38.669907][ T13] ? kick_pool+0xb9/0x550 [ 38.674482][ T13] process_scheduled_works+0x7d1/0x1020 [ 38.680090][ T13] worker_thread+0xc70/0x10b0 [ 38.684945][ T13] ? __cfi_try_to_wake_up+0x10/0x10 [ 38.690286][ T13] kthread+0x2c6/0x370 [ 38.694630][ T13] ? __cfi_worker_thread+0x10/0x10 [ 38.700132][ T13] ? __cfi_kthread+0x10/0x10 [ 38.704984][ T13] ret_from_fork+0x67/0xa0 [ 38.709454][ T13] ? __cfi_kthread+0x10/0x10 [ 38.714214][ T13] ret_from_fork_asm+0x1a/0x30 [ 38.719122][ T13] [ 38.722168][ T13] ---[ end trace 0000000000000000 ]--- [ 38.886615][ T13] bridge_slave_1: left allmulticast mode [ 38.892434][ T13] bridge_slave_1: left promiscuous mode [ 38.898724][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.908003][ T13] bridge_slave_0: left allmulticast mode [ 38.914002][ T13] bridge_slave_0: left promiscuous mode [ 38.919922][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.015522][ T420] tipc: Node number set to 2886997007 [ 39.156623][ T13] bridge_slave_1: left allmulticast mode [ 39.162479][ T13] bridge_slave_1: left promiscuous mode [ 39.169953][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.178187][ T13] bridge_slave_0: left allmulticast mode [ 39.184414][ T13] bridge_slave_0: left promiscuous mode [ 39.190481][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.199084][ T13] bridge_slave_1: left allmulticast mode [ 39.205000][ T13] bridge_slave_1: left promiscuous mode [ 39.210996][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.219009][ T13] bridge_slave_0: left allmulticast mode [ 39.225568][ T13] bridge_slave_0: left promiscuous mode [ 39.232006][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.240566][ T13] bridge_slave_1: left allmulticast mode [ 39.246683][ T13] bridge_slave_1: left promiscuous mode [ 39.252825][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.260782][ T13] bridge_slave_0: left allmulticast mode [ 39.266853][ T13] bridge_slave_0: left promiscuous mode [ 39.272760][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.526572][ T13] tipc: Disabling bearer [ 39.532655][ T13] tipc: Left network mode [ 39.540427][ T13] veth1_macvtap: left promiscuous mode [ 39.546383][ T13] veth0_vlan: left promiscuous mode [ 39.552776][ T13] veth1_macvtap: left promiscuous mode [ 39.558979][ T13] veth0_vlan: left promiscuous mode [ 39.565154][ T13] veth1_macvtap: left promiscuous mode [ 39.570870][ T13] veth0_vlan: left promiscuous mode