last executing test programs: 231.014204ms ago: executing program 4 (id=5): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, 0x0, 0x20000000) mkdir(&(0x7f0000001180)='./trace\x00', 0x1ff) mount(0x0, &(0x7f00000011c0)='./trace\x00', &(0x7f0000001200)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffff9c, &(0x7f0000001240)='./trace/events/mac80211/enable\x00', 0x40000, 0x1) readv(r0, &(0x7f0000001280)=[{&(0x7f00000012c0)=""/4096, 0x1000}], 0x1) 165.984986ms ago: executing program 4 (id=6): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_HEADER(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x44}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0xc, 0x6, 0x801, 0x0, 0x0, {0xa, 0x0, 0x7}}, 0x14}, 0x1, 0x0, 0x0, 0x4044004}, 0x20000001) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000640)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x42, 0x98) write$P9_RREADLINK(r1, &(0x7f0000000180)={0xffffffffffffff23, 0x17, 0x2, {0x7, './file0'}}, 0xfffffdab) openat(0xffffffffffffff9c, 0x0, 0x1, 0x10c) r2 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x1, 0x0) ptrace$setregset(0x4205, 0x0, 0x1, &(0x7f00000002c0)={&(0x7f0000000240)="bdceb9ddc2e3d2158b9524b7a1ab8fa1ffadb75b071e4f9bb61a5934e5c2e67c6379737295cc81f268e9c8d408bcae6ad5462202f6ce6fdfae9600e9bf8f22bfa05f629aa80f", 0x46}) r4 = openat$cgroup_ro(r3, &(0x7f0000000200)='cgroup.freeze\x00', 0x275a, 0x0) ftruncate(r4, 0x8008976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, r4, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) munlockall() 153.607656ms ago: executing program 0 (id=1): mkdir(&(0x7f0000000100)='./my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./my_sys\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_sys/bus/pci/devices/0000:00:01.0/config\x00', 0x2, 0x0) write$binfmt_script(r0, &(0x7f0000000200)={'#! ', './my_sys/bus/pci/devices/0000:00:01.0/config', [], 0xa, "e24c8abc1a"}, 0x35) sendfile(r0, r0, 0x0, 0x6) 121.313387ms ago: executing program 0 (id=7): syz_mount_image$vfat(&(0x7f00000000c0), &(0x7f0000000240)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x10, &(0x7f0000000340)=ANY=[@ANYRES64=0x0], 0x1, 0x270, &(0x7f0000001c80)="$eJzs2s9rHGUYB/BnYyWblHQj/qK9+KIH9TI0OXtokQhiQFFXqIJ0aja6ZtwNmSWwIiYnvfoneBaP3gTp0Usu/gUevOWSYw/iyGSTuBsKrW2TtOHzOSQPM/Pdfed9h5dnl91944ev1lbLbDUfxFSjEVPXYjvuNGI+puLQdrz+6o3fq60bH79zfXm5eXB0MaV06aXfPvnm55dvDy5+9MulX6djZ/7T3b3Fv3Ze2Lm8+8+HX3TL1C1Trz9IebrV7w/yW0UnrXTLtSyl94pOXnZSt1d2NibOrxb99fVhynsrc7PrG52yTHlvmNY6wzTop8HGMOWf591eyrIszc0GD6P9052qir3q6ZtRVdXMj3Hxdsz9Ga1oPJMaz15rPH+z8eJ24/JeVbWOR2fOZsQ8Wg+8/pwLH4w29aX3U2pGFN9vtjfbo//12WZcX41uFNGJqzETf0f9mBwY1W+9vbx0Ne2bj++KrYP81mb7qf3XP8ovRCvm755fGOXTYX46Iuq/s+P5xWjFc3fPLx7L1w911W7Ga6+M5bNoxR+fRT+KWIk6G1sHU7D07UJKb767nCbHf2X/OgCA8yZLR+r+rW7aJvq3LJs4P9YfjfJj/WHrHv3hsf7qQly5cLb3TkQ5/HotL4rORv0Bb784OnIixXSc+Fs8bDEzPi33Uxx+FXJyA5uaWLPHZaKetKLek+L/Lu6jKraftIWL+PL0tyNO2X+Lfs9Lm6cyIAAAAAAAAAAAAO7Lafyc8KzvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeLz9GwAA//+WD8CW") r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000009c0)='.\x00', 0x101000, 0x108) getdents64(r0, &(0x7f0000000a00)=""/4077, 0xfed) 42.957879ms ago: executing program 0 (id=8): syz_read_part_table(0x60d, &(0x7f0000000500)="$eJzs3D9olHcYB/DvJbmcUTAdnFxqHDoJRXE0Q5XkqlgIp1IIDvYfIs0UIXDSw5Q4tBkUM0jHLlK4DhonYwYnRaFzEQeLkMGlYBepHXLl7l6SOyjF0oRS/HyGe353PDzf94F3/V34XxtIuTi1Kp3y/qd/298a3TzP50xzYvJ4q9VqnU5KOZtyxsq7l5MMpX9q9icZ7plz8/udq9/+9mG5+fTUq/fOPVgc2JhZyTtJdvU2Z+SvHqXyzzZlO9wafzi6cGW2erX9pdpYW/84uf1yorZycnFp+UT52Oft3y8nj4r+7osxkoup51K+zCdDbxz19eax1Jc/386vj194Um2sfdd8fnB9b3Xw7vkjr/etXrt/KJlrR0yl87JvGv6Xi/fkL/Tkz41dn15qHD1wZ8+Nw/V7j2svBn9vdRWR5a3JBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABge9xqf1yZrV6tj194Um2sffPzTx/dfjlRWzm5uLR8YvjYs6LvUVGHinox9VxKOclMZvJFZt88crrUmz/+cHRhI/+Pncnzg+t7q82754+8nly9dv9Qp6uUqXYZ2IqN+/XnN9bmxq5PLzWOHriz58bh+r3HtReD3b6ZSj7rrJuksvWPAQAAAAAAAAAAAAAAAAAAwFtuYvL4vqkPaqeTUs7uSPLrV51b9q3KyI/p3Lzv2l/UZ5Vkd5KbO7r/BdB8eurV8LkHi78Ul+LnU8l8kl0/rJxJ3t3IudwfW96czH/pzwAAAP//gTiR5w==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000b40)='./file1\x00', 0x185042, 0x1fb) write$P9_RUNLINKAT(r0, &(0x7f0000000c00)={0xfffffffffffffecb, 0x4d, 0x1}, 0xffffffd7) 0s ago: executing program 1 (id=2): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000200)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x3, @dev}, 0x2}}, 0x2e) ioctl$PPPIOCGFLAGS(r0, 0x8004745a, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.34' (ED25519) to the list of known hosts. [ 23.301107][ T28] audit: type=1400 audit(1792377774.975:64): avc: denied { mounton } for pid=280 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.305850][ T280] cgroup: Unknown subsys name 'net' [ 23.324022][ T28] audit: type=1400 audit(1792377774.975:65): avc: denied { mount } for pid=280 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.351480][ T28] audit: type=1400 audit(1792377775.015:66): avc: denied { unmount } for pid=280 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.351860][ T280] cgroup: Unknown subsys name 'devices' [ 23.497023][ T280] cgroup: Unknown subsys name 'hugetlb' [ 23.502662][ T280] cgroup: Unknown subsys name 'rlimit' [ 23.608687][ T28] audit: type=1400 audit(1792377775.285:67): avc: denied { setattr } for pid=280 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.632254][ T28] audit: type=1400 audit(1792377775.285:68): avc: denied { mounton } for pid=280 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 23.657059][ T28] audit: type=1400 audit(1792377775.285:69): avc: denied { mount } for pid=280 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.685537][ T282] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 23.694350][ T28] audit: type=1400 audit(1792377775.365:70): avc: denied { relabelto } for pid=282 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.714229][ T280] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.720192][ T28] audit: type=1400 audit(1792377775.365:71): avc: denied { write } for pid=282 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.754057][ T28] audit: type=1400 audit(1792377775.385:72): avc: denied { read } for pid=280 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.779592][ T28] audit: type=1400 audit(1792377775.385:73): avc: denied { open } for pid=280 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.646766][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.653852][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.661469][ T290] device bridge_slave_0 entered promiscuous mode [ 24.668538][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.675843][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.683246][ T289] device bridge_slave_0 entered promiscuous mode [ 24.690600][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.697723][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.705304][ T289] device bridge_slave_1 entered promiscuous mode [ 24.721023][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.728114][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.735626][ T290] device bridge_slave_1 entered promiscuous mode [ 24.750612][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.757753][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.765304][ T288] device bridge_slave_0 entered promiscuous mode [ 24.774359][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.781499][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.789069][ T288] device bridge_slave_1 entered promiscuous mode [ 24.823089][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.830187][ T292] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.837712][ T292] device bridge_slave_0 entered promiscuous mode [ 24.847689][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.854802][ T292] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.862299][ T292] device bridge_slave_1 entered promiscuous mode [ 24.907709][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.914895][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.922356][ T291] device bridge_slave_0 entered promiscuous mode [ 24.929523][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.936649][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.944119][ T291] device bridge_slave_1 entered promiscuous mode [ 25.106661][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.113735][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.121078][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.128166][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.142404][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.149486][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.156972][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.164010][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.210616][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.217702][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.225025][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.232077][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.262433][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.269529][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.276852][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.283901][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.292278][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.299356][ T292] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.306700][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.313748][ T292] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.339377][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.347634][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.355260][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.362487][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.369846][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.377673][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.385120][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.392316][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.399674][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.407103][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.414349][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.450269][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.458099][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.466785][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.475278][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.482306][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.489749][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.498057][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.505126][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.512561][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.520736][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.527818][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.536236][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.544486][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.551547][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.560563][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.568892][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.575933][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.591099][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.613473][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.621781][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.628862][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.637096][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.646048][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.654115][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.662303][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 25.669819][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.678755][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.686942][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.695555][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.703985][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.712502][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.719606][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.733423][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.741516][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.757822][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.766235][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.774401][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.781473][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.803939][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.812431][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.820963][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.829109][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.837475][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 25.845257][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.852721][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.861260][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.869841][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.878182][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.886644][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.894139][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.902419][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.910719][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.919346][ T289] device veth0_vlan entered promiscuous mode [ 25.936633][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.945244][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.953273][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.961021][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.968693][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.976846][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.985138][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.993424][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.001765][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.008809][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.016363][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 26.024913][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.033104][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.040193][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.047670][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.055351][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.070695][ T289] device veth1_macvtap entered promiscuous mode [ 26.078116][ T288] device veth0_vlan entered promiscuous mode [ 26.085266][ T292] device veth0_vlan entered promiscuous mode [ 26.091829][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.100301][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.108684][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.126375][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.135196][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.143701][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.152417][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.162138][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 26.170292][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.185694][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 26.193871][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.208204][ T288] device veth1_macvtap entered promiscuous mode [ 26.219091][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.227681][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 26.236440][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.245066][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.253214][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.261710][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.273345][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.281865][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.293449][ T292] device veth1_macvtap entered promiscuous mode [ 26.306463][ T290] device veth0_vlan entered promiscuous mode [ 26.319786][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.328567][ T289] request_module fs-gadgetfs succeeded, but still no fs? [ 26.328573][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.329478][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 26.352646][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.361160][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 26.369325][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.377561][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.385309][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.408610][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.418567][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.428038][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.436776][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.445776][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.459390][ T291] device veth0_vlan entered promiscuous mode [ 26.471471][ T290] device veth1_macvtap entered promiscuous mode [ 26.485089][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.494019][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.514980][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.525069][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.534142][ T317] loop0: detected capacity change from 0 to 128 [ 26.561112][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.570466][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.613643][ T291] device veth1_macvtap entered promiscuous mode [ 26.619708][ T322] loop0: detected capacity change from 0 to 2048 [ 26.628374][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.641091][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.651450][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.660095][ T322] loop0: p1 < > p4 [ 26.665158][ T322] loop0: p4 size 8388608 extends beyond EOD, truncated [ 26.681827][ T324] ================================================================== [ 26.690106][ T324] BUG: KASAN: use-after-free in rcu_segcblist_enqueue+0x9c/0xb0 [ 26.697786][ T324] Write of size 8 at addr ffff88813286e590 by task syz.1.2/324 [ 26.705337][ T324] [ 26.707672][ T324] CPU: 1 PID: 324 Comm: syz.1.2 Not tainted syzkaller #0 [ 26.714709][ T324] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 26.724792][ T324] Call Trace: [ 26.728112][ T324] [ 26.731060][ T324] __dump_stack+0x21/0x24 [ 26.735409][ T324] dump_stack_lvl+0x110/0x170 [ 26.740110][ T324] ? __cfi_dump_stack_lvl+0x8/0x8 [ 26.745156][ T324] ? rcu_segcblist_enqueue+0x9c/0xb0 [ 26.750454][ T324] print_address_description+0x71/0x200 [ 26.756019][ T324] print_report+0x4a/0x60 [ 26.760367][ T324] kasan_report+0x122/0x150 [ 26.764886][ T324] ? rcu_segcblist_enqueue+0x9c/0xb0 [ 26.770192][ T324] __asan_report_store8_noabort+0x17/0x20 [ 26.775936][ T324] rcu_segcblist_enqueue+0x9c/0xb0 [ 26.781063][ T324] call_rcu+0x554/0xf50 [ 26.785237][ T324] ? __cfi_call_rcu+0x10/0x10 [ 26.789929][ T324] ? __kasan_check_write+0x14/0x20 [ 26.795058][ T324] ? selinux_inode_free_security+0x21f/0x230 [ 26.801054][ T324] security_inode_free+0xc5/0xe0 [ 26.806009][ T324] __destroy_inode+0x175/0x500 [ 26.810786][ T324] evict+0x777/0x8c0 [ 26.814702][ T324] ? proc_nr_inodes+0x2f0/0x2f0 [ 26.819571][ T324] ? _raw_spin_lock+0x94/0xf0 [ 26.824447][ T324] ? __cfi__raw_spin_lock+0x10/0x10 [ 26.829667][ T324] ? __kasan_check_write+0x14/0x20 [ 26.834798][ T324] iput+0x633/0x690 [ 26.838633][ T324] dentry_unlink_inode+0x346/0x3f0 [ 26.843761][ T324] __dentry_kill+0x46c/0x680 [ 26.848368][ T324] dentry_kill+0xc0/0x2a0 [ 26.852719][ T324] dput+0x42/0x80 [ 26.856368][ T324] __fput+0x5c0/0x8f0 [ 26.860364][ T324] ____fput+0x15/0x20 [ 26.864382][ T324] task_work_run+0x1e1/0x250 [ 26.868990][ T324] ? __cfi_task_work_run+0x10/0x10 [ 26.874118][ T324] ? __cfi___close_range+0x10/0x10 [ 26.879244][ T324] ? do_user_addr_fault+0x9a5/0x1030 [ 26.884551][ T324] exit_to_user_mode_loop+0x9b/0xb0 [ 26.889783][ T324] exit_to_user_mode_prepare+0x87/0xd0 [ 26.895262][ T324] syscall_exit_to_user_mode+0x1a/0x30 [ 26.900737][ T324] do_syscall_64+0x58/0xa0 [ 26.905186][ T324] ? clear_bhb_loop+0x30/0x80 [ 26.909882][ T324] ? clear_bhb_loop+0x30/0x80 [ 26.914594][ T324] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 26.920506][ T324] RIP: 0033:0x7f5015b9e559 [ 26.924950][ T324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 26.944578][ T324] RSP: 002b:00007ffd115206a8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 26.953016][ T324] RAX: 0000000000000000 RBX: 00007ffd11520790 RCX: 00007f5015b9e559 [ 26.961000][ T324] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 26.969004][ T324] RBP: 00000000000067f9 R08: 0000000000000001 R09: 0000000000000000 [ 26.976983][ T324] R10: 0000001b2dc20000 R11: 0000000000000246 R12: 00007ffd115207d0 [ 26.984961][ T324] R13: 00007f5015e25fac R14: 0000000000006851 R15: 00007f5015e25fa0 [ 26.992951][ T324] [ 26.995982][ T324] [ 26.998310][ T324] Allocated by task 325: [ 27.002559][ T324] kasan_set_track+0x4b/0x70 [ 27.007172][ T324] kasan_save_alloc_info+0x1f/0x30 [ 27.012328][ T324] __kasan_kmalloc+0x95/0xb0 [ 27.016951][ T324] __kmalloc+0xb4/0x1e0 [ 27.021125][ T324] l2tp_session_create+0x38/0xbd0 [ 27.026177][ T324] pppol2tp_connect+0xbf5/0x1640 [ 27.031139][ T324] __sys_connect+0x3da/0x460 [ 27.035750][ T324] __x64_sys_connect+0x7a/0x90 [ 27.040539][ T324] x64_sys_call+0x88d/0x9a0 [ 27.045061][ T324] do_syscall_64+0x4c/0xa0 [ 27.049491][ T324] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 27.055400][ T324] [ 27.057736][ T324] Freed by task 320: [ 27.061635][ T324] kasan_set_track+0x4b/0x70 [ 27.066246][ T324] kasan_save_free_info+0x2b/0x40 [ 27.071310][ T324] ____kasan_slab_free+0x132/0x180 [ 27.076450][ T324] __kasan_slab_free+0x11/0x20 [ 27.081250][ T324] slab_free_freelist_hook+0xc2/0x190 [ 27.086633][ T324] __kmem_cache_free+0xb7/0x1b0 [ 27.091507][ T324] kfree+0x6f/0xf0 [ 27.095239][ T324] l2tp_session_put+0xaf/0x1a0 [ 27.100023][ T324] l2tp_session_delete+0x3df/0x4d0 [ 27.105153][ T324] l2tp_tunnel_del_work+0x199/0x410 [ 27.110368][ T324] process_one_work+0x717/0xc30 [ 27.115230][ T324] worker_thread+0xa4d/0x11d0 [ 27.119920][ T324] kthread+0x281/0x320 [ 27.124015][ T324] ret_from_fork+0x1f/0x30 [ 27.128446][ T324] [ 27.130799][ T324] Last potentially related work creation: [ 27.136521][ T324] kasan_save_stack+0x3a/0x60 [ 27.141225][ T324] __kasan_record_aux_stack+0xb6/0xc0 [ 27.146608][ T324] kasan_record_aux_stack_noalloc+0xb/0x10 [ 27.152422][ T324] call_rcu+0xcf/0xf50 [ 27.156513][ T324] pppol2tp_release+0x1e3/0x2b0 [ 27.161382][ T324] sock_close+0xc9/0x220 [ 27.165638][ T324] __fput+0x1fd/0x8f0 [ 27.169659][ T324] ____fput+0x15/0x20 [ 27.173660][ T324] task_work_run+0x1e1/0x250 [ 27.178272][ T324] exit_to_user_mode_loop+0x9b/0xb0 [ 27.183486][ T324] exit_to_user_mode_prepare+0x87/0xd0 [ 27.188970][ T324] syscall_exit_to_user_mode+0x1a/0x30 [ 27.194445][ T324] do_syscall_64+0x58/0xa0 [ 27.198872][ T324] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 27.204799][ T324] [ 27.207137][ T324] The buggy address belongs to the object at ffff88813286e400 [ 27.207137][ T324] which belongs to the cache kmalloc-512 of size 512 [ 27.221283][ T324] The buggy address is located 400 bytes inside of [ 27.221283][ T324] 512-byte region [ffff88813286e400, ffff88813286e600) [ 27.234567][ T324] [ 27.236905][ T324] The buggy address belongs to the physical page: [ 27.243321][ T324] page:ffffea0004ca1b00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13286c [ 27.253582][ T324] head:ffffea0004ca1b00 order:2 compound_mapcount:0 compound_pincount:0 [ 27.261918][ T324] flags: 0x4000000000010200(slab|head|zone=1) [ 27.268022][ T324] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 [ 27.276636][ T324] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 27.285238][ T324] page dumped because: kasan: bad access detected [ 27.291686][ T324] page_owner tracks the page as allocated [ 27.297435][ T324] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 291, tgid 291 (syz-executor), ts 26677083878, free_ts 0 [ 27.319177][ T324] post_alloc_hook+0x1f5/0x210 [ 27.323975][ T324] prep_new_page+0x1c/0x110 [ 27.328504][ T324] get_page_from_freelist+0x2ca9/0x2d20 [ 27.334100][ T324] __alloc_pages+0x1fa/0x610 [ 27.338746][ T324] alloc_slab_page+0x6e/0xf0 [ 27.343366][ T324] new_slab+0x98/0x3e0 [ 27.347468][ T324] ___slab_alloc+0x70f/0xb70 [ 27.352092][ T324] __slab_alloc+0x5e/0xa0 [ 27.356464][ T324] __kmem_cache_alloc_node+0x204/0x2d0 [ 27.362074][ T324] __kmalloc+0xa4/0x1e0 [ 27.366258][ T324] fib6_info_alloc+0x34/0xe0 [ 27.370881][ T324] ip6_route_info_create+0x51b/0x14d0 [ 27.376267][ T324] ip6_route_add+0x27/0x130 [ 27.380782][ T324] addrconf_prefix_route+0x233/0x310 [ 27.386078][ T324] inet6_addr_add+0x527/0x9c0 [ 27.390768][ T324] inet6_rtm_newaddr+0x74a/0xa10 [ 27.395730][ T324] page_owner free stack trace missing [ 27.401115][ T324] [ 27.403452][ T324] Memory state around the buggy address: [ 27.409092][ T324] ffff88813286e480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.417165][ T324] ffff88813286e500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.425239][ T324] >ffff88813286e580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.433305][ T324] ^ [ 27.437918][ T324] ffff88813286e600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.445991][ T324] ffff88813286e680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.454055][ T324] ================================================================== [ 27.462118][ T324] Disabling lock debugging due to kernel taint [ 27.479004][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 27.494362][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.547672][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 27.570250][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready