last executing test programs: 226.756034ms ago: executing program 1 (id=2): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x58) copy_file_range(r0, 0x0, r0, &(0x7f00000000c0)=0xae8, 0xfffffffffffffdef, 0x0) 194.045615ms ago: executing program 1 (id=6): bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000ed07449e00000000eb15000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x45, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000180100002020692500000000002060207b1a"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0xc, &(0x7f0000000180)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r0}, 0xc) 140.031687ms ago: executing program 1 (id=7): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=@newqdisc={0x68, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x3c, 0x2, [@TCA_TBF_PBURST={0x8, 0x7, 0xb86}, @TCA_TBF_PARMS={0x28, 0x1, {{0xa, 0x2, 0xffff, 0x7, 0xcc, 0x3}, {0x0, 0x2, 0x7, 0x8, 0x7f, 0x9}, 0xa6, 0x4, 0x1bb6}}, @TCA_TBF_BURST={0x8, 0x6, 0x7f}]}}]}, 0x68}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) 115.918797ms ago: executing program 3 (id=4): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0) 80.902208ms ago: executing program 3 (id=8): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.stat\x00', 0x275a, 0x0) write$cgroup_subtree(r0, 0x0, 0x32600) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x84022, &(0x7f0000000340)=ANY=[@ANYBLOB='nr_inodes=5,size=4']) 63.037118ms ago: executing program 0 (id=1): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) bind$vsock_stream(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x140) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000080)={0x3a, 0x0, [{0x1, 0x81, 0xbccba358a7e175dd, 0x0, 0xafe, 0x6, 0xffff8d14}]}) 62.465478ms ago: executing program 2 (id=3): r0 = syz_clone(0x2008400, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000b40)='task\x00') fchdir(r1) mount(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000080)='proc\x00', 0x189, 0x0) capset(&(0x7f0000000080)={0x20080522}, &(0x7f0000000180)={0x200000, 0x200000, 0x0, 0x0, 0xd33, 0x7}) syz_open_procfs(r0, &(0x7f0000000100)='auxv\x00') 55.333139ms ago: executing program 4 (id=5): mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000800)='./sys\x00', &(0x7f0000000840)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/nd/drivers/nd_pmem/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='namespace0.0', 0xc) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/nd/drivers/nd_pmem/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000340)='namespace0.0', 0xc) 25.062599ms ago: executing program 3 (id=9): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xd53}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000100)={0x1, 0x0, [{0x1, 0x2, 0x3, 0x6, 0x4, 0x8000, 0x2c0000}]}) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f00000000c0)={0x6, 0x4, 0xf}) 14.88931ms ago: executing program 1 (id=10): syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000240)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x10452, &(0x7f00000002c0)={[{@rodir}, {@numtail}, {@fat=@nfs_stale_rw}, {@utf8}, {@fat=@nfs}, {@shortname_winnt}, {@numtail}, {@rodir}, {@shortname_lower}, {@fat=@codepage={'codepage', 0x3d, '1251'}}, {@iocharset={'iocharset', 0x3d, 'maccroatian'}}, {@shortname_win95}, {@shortname_win95}, {@utf8no}, {@shortname_mixed}, {@uni_xlate}]}, 0x3, 0x27b, &(0x7f0000000640)="$eJzs3cFqK1UYAOB/mqRJdJEsXInQAV24Kq1P0CIVxIKgZKEutNgUpAmFFgJVMXblE/gEPo8b8QV8AC93d7u43LmkM0nTyyQlvWlT7v2+TQ//+f85/5kZ2tWc/vBB//jw5Ozo4tf/otFIYm0nduIyiXasxdjvUerfJ+VxAOCRu8yyeJrl6nno/GZGbUZlde3emwMA7sX03/9V9wIAPIyvv/n2i939/b2v0rQR0f9j0Eki/5nP7x7FT9GLbmxFK55HZBP5+LPP9/eimo6046P+cNAZVfa//7u4/u7/EVf129GKdnn9dpqbqh8OOrV4p1h/pxfdL/+KVrxXXv9JSX101uPjD6f634xW/PNjnEQvDovexvW/bafpp9mfz375bhQd1SfDQac+ySuyKw/6YAAAAAAAAAAAAAAAAAAAAAAAeKNtphPtm+fvjA/+nzM/53yg4dT5PFtpmmZJnn9dX433q1Fd5d4BAAAAAAAAAAAAAAAAAADgsTg7//n4oNfrni51MP6sv2QqXtyM1CPi7mttLFoVlaK1XhKx2Fq1qF9V3p5cWXAXzVE/3dOkGst7BMkk0pye2oh8rVGkmQ+mIq+9eiOuBuO36/ggue3hNspekiUMspLXrzKzav3VSLPYQUlyc87q6+/eqeesNWMqiYja5GbOv05tuffw4X4HAQAAAAAAAAAAAAAAAAAAueuPfksmL1bQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACswPX//19gMCyKZ+VkldGgGkVkxVsEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgLfAyAAD//0MUZ+o=") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000f00)='.\x00', 0x184a438, &(0x7f0000000080)=ANY=[@ANYRES32, @ANYRES32], 0x9, 0x0, &(0x7f0000000180)) write$UHID_INPUT(r0, &(0x7f0000010140)={0x8, {"7f9654d636ab18b7938a2804505c72e9994ca22404fc203334cc21ed3d6a776fd12d13f9602b2980f983c31a5d1e431db778099ce3af3fb20e1ee1f4fdb77cbb36154982a93c19825d6fd273ab1eb5bcd47adad50de8a6791486e482e29ecc94284921f33b941cfc1000c9781d9a828c5ec7a2c77b4e624a5aa0e9e39782bad733eda81ba47e1c6116e4170e6587dd6210a57abe91f1f80c4e31139d8b73fe35ac1f99ea82dd6aa9c9aa67de88ae3e141020e1a876bbc449d2d843aa7e6d90b948b7e28770e6ac71010c63f17e90fd20806a9f8d9f418ee3af74aac64b04a27c4f5e3626ca2da546c79d24acadd11e8d272a22fc54078fd5e64475993668980a9f95aff964dee674356af492b8377a759d8ccf1accb9a18ef7ad16f438dde69cd020d71552b0810688c882a26a22b23f4b35471b08b379193db1cd7934a4049ff1b00d9795cda6e73951641d5e2365c24facd5afd09ed1d096d758b4fef66fe1aa22395d67b7e1db623d4a60a7dc93893d6c4a91df79535a855868c5dc0033d5c428cd25b85c5deb6e81068553bc84cead4d1eba8aa57e2b354a6899e44acbd3834491219b3e231cd55d82f161774a689efe197cc193ac0124c67738a0a1d5f16a6768c2c2ba7386c8c95ca08c55117f344f5a2bca0d09e79ea3fc49491f2c7adc513c2779c1bf62b1a8643d23e9e8b2ae41d4a59f1b82b82e092b36eb851b8456da871b4057aec325a9d4cccafde61f2abc85e3cabeabb856f6ffbfe23d69219ec8fae6beb54abe7870dbae823d49806a967a1c7f252999804f106745f20490bb3347b59321dc69765567abcbd89de04d89622170005df5871ed0fb72345a11da074060d7d4ee2e437f71a45723fb6b02de56067e54f54c52d10f7874a13cbfb3bd65ce54f9d6719ea210e0cf79e4e2157736ec07ac5915682ab81bced665c1e72fab8d8cfe509de0f21fe374b957b379fd5918061e21c2e96985cc1354b2de859b0f1a463ab04683b1253eda671c2353b5c208aca652f5419ffc4949a7fa909b95653f42d97390c400b4a1c308b11e73e9a06d3b164d3361e75584d70e6bc61d570a7e0c7da330f643194c1893fcd6489fac605eead61b53dff18caf526ecccc9bbd9146bc3c3bb67677695e6fddaab081786e9084014e60f5c03ae5a9087726b05e17402cd2fbb80d773b8a41470b1f901a8c2b2d57450181f4fc5bc53c7cb3dc032b84567492607cb08832eca9f79da9210d197863e5db5a74a9823dc0cc8bd9f3a9b6ff5a7d15d4747a9b26e088f4fad96d81cd1214226b1c4585d418d593220fcbb9ad949266cc48163e3498b46ebcdf7b2b5ecfe67539a61ed9e39b02d5b35ac0d0e7fa830034ca2da8a7ddf04bcf2cee939994369feb77023e0e3de04b21db7a640a92c17748245005cd75a7deba4ff0e4c104a9db2d9a98ec8edb3562050a3bac5f322290e3d8b6fb21770ac436d4cb12b97fc8f76d7bb9eeed85663eb0626f1ad1719ee4b07f7de2c1d1a31c27c6879f4fa3dbdfb2bfc0898beabafbeca9f13050e6b2f6c432e423cd5cb6b8fa56fe32c3e50104e44462c0a5c69de6a7ac5ae3d9f07ceed64dbffa42e4663838bfcde92f0fcb895f3b93c59b0e48c09890dfc36436db56b708f6e7cbbd2a6305f573cee099dbcd263cb96d9fb69cbc3cb06d8f5e3789698a17e71d22b4665ff5447fcc17a31bb136c8bb4b984573bcaf1cb650198c1266e6ddfd42d44f9de02cb9d915c5334c550fac3fcee56790aeb09d81e7690a32d8b0cc477b23f15257820de227be1ffaec2f63f3266b8f5dd78947dcee355fe59bfb100e5244425532bb1d115acd211b8c16b0ec0aae00fca5d4511a05c3ff027a1cac56210a10d81c01b90e156cc7b33de0fac825dc516d398166096013e068db935483c93ba95da39b5ae4087d84479a4c4809f28f93790dc279637bd6f3dc441d315cf6bd7b0e3d92070a45baf4445ce063fd12690eb002f5ca068a256bc54100c99a02a346beca39072163c4b297d117f1ed9fef42e3dbc11d36a0a0db52e84461c6fbb4aad62cd6c8dc9ae6a3390a5e8773ac599e67436220c8d541a9039762bffaa7f490e31dddbc362fb4ff686cda905f3b02a1db76d4d570d970434921ca8a4765af6d5c8b881e1f4ffa7e2d9ef5f5511b94f88474674ec790bb5186c73446a227bf1ffd19b605733abd1bd41e421aeaf2ed4617088c7ceef85451225056435993e89e4bccd2c2e4b39af99feef11fea645eeb5cf9f77b1e19a72d3efb613100969b84302789714bca65bcbc96762b4012a5700c62aed706433b9f142b7302442b6a9958b0e28e8b1cfa9eeb4ac0d71f497b23babf9f0221dcb658d9f4db5d45bee30d2ad7c97d6a562e014a7701c15325ec5d42ab732b37714a77a95c03fb15bbfba6fade32bf50f985a1df362ca7216cc152907dd931acb58a63920f581e82b590c0d6a0033009f8e50c3263d3f58596b63d507cadbc809a6690561f74d0772bf92d04e06c47a350724b106f5e83f7e71c4b2a983bf5ad7d8684e7b8b5dc1273d0fa5879b8e61bde33d602bc8ff0913b6d32dcac366d568dc7cf82bbfc405cbe418a2644c26592b32ca1a632fc95123efb784cfb6953a94ebeccd24fba389a0e56b043df07d9a2dd38a1196e5e55576b25f85cb96f6560802a4a58b7a6857e8454faa2c880bf32d464562b2bdc5f0df22b663f2c01fc944f1cfd1908f617f8295a5440bb79ae178ea46a95baeea48322105146ac3ed2de7d3796ddddcc848a8ecf4a00dd055733b4f59211f5a40deea44e74b3bc57953b26ed61e6fd67889edfe8d0902385e37666aacec072735630ecc441c3cc6b09bb2f63aa4e332c6df728dc74078a83ce20454dfd616d116270666ddc09c5fea2e8442bc43455d0257fac92f3780061178f9420bf8e463f29896c12383dbb9a81bc5c87376e647c8a7986cb514fb9696d9c0a8d303c5c4b5b7c5f601c01fa19323e02f675c371bc44fbc1ac5704d41a89a2a4ccec6ac8440c532f07da25aa2dce6a5d2ebe694eb4017d178b221213bfe2a01d9cfe689bd190776bca6c032f446eb8862587a7826e35f3f691763212eee6af2e49bbeb0a27e07c5714b74e373798c7bebce265f7ebef3a1ea64078cf1e8a9d433af32c53090c972ffedbadafb50b9a6e540abd84f8e938583ea725954be3b236c5d8aca7d486d21902a2902f25a7c02dbe83c39bd0b81513f9ef198c49d560e930ae224ff47f92e4851e1f7ab5bb406abcf6596569261e6b0c67bb3b854e9c6de60bfb60fcf29241ff237151310ecd19f8b2cfe764c1df1a2de9d840eca47aa169ba9a415901204ec31ccdfd76e908029ae34fb12dc286758c64fd6d42bc82b14e07e421f4b42b180cd6ef40cac8062928b4a420a4577f24295f54de9048ac9d34307bf93e463cea4967cf4880166f68ed1eb965db2e4fb9f5f0b1c695d621e427ccb9a3188073ee6fde729c6698346efa1c0ba643c1efd20858965511da750060d551c44c435a5f1603fae7357e0bc78e92aad3d88790ec2aa1a42d6fe7e0ffc57f3599e406db63be7dd32692df32ce33dee0a2becdb02d6e435e09de3d356497543db23f53da25643f9c585e275297800d8beed47f0e622f86fc25d2e87036fdceebfe7257cb6de0c02412d1c0758acfcd0862e99ad17a118f46f635a87477e8b825423d94ada35bf0b5444aa7d3de4bb7eec7ae5129fcc2cba651cc972f5500fc5161149d29f452962afb102a01ae76825cb4477460be0b85d75058595c27e9b7fae3492ec3925c671bee5f4ca534d5a294f783d6cc073c992139b61d21fd98297b04c0578dafd5f7ebcaf8d4d9185aea3d76e813421f4573b38c25093c015a65e44fb297f0f6ac2d02c4237b37a3bfca2406c5c95ae5812816bacad59ba7c6f72d7c644ff25b592ed1e89b276e05866c01a4ced7fc6dd9f190c20d420d7c8a1fe908833a24c5e5bd7a95a2a6fbf147fc4b29a179718166dd0fbae2fc6b8c8aac6194fa6baf0d3edc36b2316c56c441ba53e3e7aaaf0a1405566ff584f73a637b74dde9bcb4d41da2be6c9df5d533fbac54f5fb52a8a793757cfe19aa90048c6d07e3474136ae1be2455b0d0d02eb4b5961ba883209355c0dd2af4aad98e7b971e358a7d9b55fe17cd6095f257355d9b99e5ea52848f17b35a80792d9ed0fef6fe3eef9a324902409969823be20bbe0e8dba9c747cd1a14d3642d877b86271f3f0c322a142c4ff635b37d542c3265b5fe8589a732bb1a55010b930dd0196cd43ac3634c01b4a44c517197d03a3d89c67f5c09aab409e84c0af466bfbd0c96d240101a2542c66b4b4b8ef65b41b0079995c52cc9720d2c1d7c128c6f17a65cc798c1986cfbd8888460c54438edc4f91f3580391c8b57d9aee209a59a116c1c44775437e9c30e6d87e82ce84e28532b19441e32ab9aea22177bac9daad25a6c88395e9348d6780de630cddb266c411011175bdb6255a36535180818447d43ffba3758d311539fe9f6811fa470bf3767b4c2d4cdf37854c7ee28730bb1d39d5c0dfffcdbf353cca3e13079f3ae66b839c7dd36914022a0e75bca5b622f521420b73249ef47f03c1fb03ecf7557882afcaa7cf454a68ad237d4ce860bd6b1531c1cafe2cfb76bc4188271ef6bdfb304ee0e6932463a1909f03d6e8a27b5f137d6b342841d613863dfdf37d5ec3a98d667810fb6f82d67620bdefed8b3ff98420a6c7ee577c3ba68b95a20403608a7ba6526ec9e8662c6e15ab09b1a9019d4958af04cb2e4890ee6b1077fcaa5cc0817f388461b230fe631e75f18ab392a5ca5de4a024ca16dd05fcfdf92114e43a5c4a169d462ff0dba57deeaf5eaafd892f8ccbd72ac56471162e1416bca39859b4184ba0d1b3f7ec05db4ef4cf0142867fa9be328a0be8aa74c716aad9411008607980861f4f72e9bfa60195e2f939d3f6a44a6cec07dd376d1bccaa126686f313d5f7918ecd1215026982c82ed1922ef70e36e8ed59b2d5ceab3b4aad7e53049062dd5ba0e87f7005c3f4d2b788245cdc2f35ef2572bea5ea92dfad406ade6d5ad18be8eeb4c652e5277b244645c68c0c0f5a68d42e00d59b75941917b2cdf31fdf809f2078ca97fd5beba65b34e0621138ea0e94feb87166b2dac2232ebca575e5c0a4d565d9992f733bbfbe68a63d99ee93398604065d5517c33ed0e067bdb643e73102f16137afd7d4bf21e8065ea028c392a6dcefbe642dc3fb03a239d9c8b17023eacc8e19fea11c34a10644af1b786fc0f4504038c2ee59c1b353f3d7b9313df025b4b5874ca63ec164a3fe35bf390d266f53dcda6a8e190e63a56ffdf4f7c5c02aa22d376db06d4d2b96be5b331f897d1ecfd25c13a1c194c265dd95a5724a6435bc8138224d9db28b689b9cea5132cd19601dbc4a43e70c71e27e8fd0689d09484974e8a4605f8553735fffaf5654a087e323ca14e02b681b9bbe592bd6b719ae2e86bdf918b27c79d52dd334d1aa7ebc1bff76e97572faad092010a1022f7d33089049107a89c364ae7dd022d119e8f6ab795fd71d76a90e8202339401ff9e9918ea8c8e12f7b0ba10d9ebde5d1bc5988f2d07b34579d8c282628204f2978d8b0cf95dc41f3775a4053f833267c64b42336d7c850f2918ef0dd6d62e43fcc173254eb34748efd4754609ce25afd648ee5a8fc5c64346603f8258592d67b9613e8f7ac0def0958f13436581d729e0b3e062738eb06b2116abe837529690a614fc5d3f53b4d4602e5706000", 0x1000}}, 0x1006) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000280)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x824851, 0x0, 0x0, 0x0, &(0x7f0000000d40)) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpu.stat\x00', 0x275a, 0x0) 13.67021ms ago: executing program 2 (id=11): syz_mount_image$vfat(&(0x7f0000001800), &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x8c, &(0x7f0000000140)=ANY=[@ANYBLOB="00631dda01aef2b0bad477a11d13ec0c19456795dd9b2620df1c0f624854ea3dd5a00bd6df44035f5c3ae796fec6d633a0ffad0569794acfef7da01767fd4175f2cd82df769aa2ee7bfe3640554507d24c60c9f9e222a72e1e3e71145c480657d2864e5e276f028d64701ae31cde0ceaf408fdb05c0f4142da00e9000001001d0149e6d308cbe315789f4baffe39bbced9b1d4db174c6121d2e290e9fc561a62225f002ee310e1fa7321000000000000d6231001a4b2d467825f3abb0c167e129cf1fa0e7854103f4bf2d3a0194983bc86cbd3d75ccef3c8ac4516dac10222664bbc980b4e99027c53ae2c6cc05d3be246e5837cbf286225d43e8c1d2e3fda86b86906b79fdedae7f3bbe362e8ad7f2b3704420139e1788be93a3d553c2e1f5b559393d964df51bf393f52ecbe6f832b222231fbb9fee9e0343c2d3d567f7cff6d0b25303bcbcc99c879d3bc622b336c622a91291a63f9644964e5a67dea1b5005b9d987d6094ed4e1af157499d5fb2850161224a441240ea52dda516bc06ff3ade3c08c653108720c3e34727b0ae3db5da52511edb4325a2dd02b05f06a9e39764a8fbe0eb4eee5b51895703128cade291bc5c1acfae9ec5d34e71f75d8b5046aafd108b487be169a7bd49de322163858ae595e084074253c72d65f402752618d636a30c7800d77cbe196c326ca4d210f12f442868cba3ea9a0cbca8f59b1054675e2b1e898305a7245aae76525aaf2460152e5647f7d29dbbde6f73d17256ad11e971e0a1f1f4aa6b132968dcd830a981c6a9c3c64047fb84ffe84c78431942b450c61ae91187e1241ef438019"], 0x1, 0x2aa, &(0x7f0000000c80)="$eJzs3c9OE10Yx/EfpS/wgjBVFAVjPNGNbiZQr6AhkBibaJAa/yQmg0y16dCSToOpMcLOrWsvgbh0Z2K8ATZegQt3bFyyMI7pdIACQ4IEmYLfz+Y8nTNPc06eM81p0pmuP3y3UC76dtGpK9VllJYGtCFllFK3WrqiNhXGPWq3opvD+W9X7j96fCeXz0/NGDOdm72VNcYMXf388vWHa1/qAw8+Dn3q1Vrm6fqP7Pe1kbXR9V+zL0q+KfmmUq0bx8xVq3VnznPNfMkv28bc81zHd02p4ru1Hf1Fr7q42DBOZX6wf7Hm+r5xKg1TdhumXjX1WsM4z51Sxdi2bQb7haa+/btSxzkOJKVWyzmTksb29BRWExkQAABIVMz+f+Uw+/909Jr9/0lSWJ2ZcXJJjwJHyNp7qLn/fxL7dY/9PwAAAAAAAAAAAAAAAAAAAAAAJ8FGEFhBEFjNdvP+gB5JQXT8f0n9kgYknZE0KGkous0gI+mspHOShiWdl3RB0oiki5IuSRpte6+Ep4oY7fVvtv9F9e+m/v+E/eq/6/oPHyJB/U+fA9af6/+UantwT5+08HapsFRota3+XFEleXI1Lks/w1pGWvH07fzUuAlldHlhOcpfXip078yfkNVcMHH5E618szO/N1x3W/lZWc0FFpefjc3v043rbfm2LH19pqo8zYdrcjv/zYQxk3fzu/LHwvN26zne8vx1ttkSWz/b3q+/lX+A9RGMx9YnrbF0snOH5DdelR3Pc2sEBJ0XjHTGMA4dvO+MYRwmSPqTCcdhu+hJjwQAAAAAAAAAAAAAAAAA8CeO5jeDm/8UFn9OwlMEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGCP3wEAAP//t8JUVA==") syz_genetlink_get_family_id$ieee802154(0x0, 0xffffffffffffffff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x8042, 0x40) pwrite64(r0, &(0x7f0000000040)='\x00', 0x1, 0x8081000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0xc4042, 0x1ff) sendfile(r1, r0, 0x0, 0xfffe80) 0s ago: executing program 4 (id=12): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f00003ef000/0x3000)=nil, 0x3000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.240' (ED25519) to the list of known hosts. [ 22.906817][ T28] audit: type=1400 audit(1786102483.021:64): avc: denied { mounton } for pid=279 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.907972][ T279] cgroup: Unknown subsys name 'net' [ 22.929543][ T28] audit: type=1400 audit(1786102483.021:65): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.956780][ T28] audit: type=1400 audit(1786102483.051:66): avc: denied { unmount } for pid=279 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.956926][ T279] cgroup: Unknown subsys name 'devices' [ 23.099848][ T279] cgroup: Unknown subsys name 'hugetlb' [ 23.105474][ T279] cgroup: Unknown subsys name 'rlimit' [ 23.207535][ T28] audit: type=1400 audit(1786102483.321:67): avc: denied { setattr } for pid=279 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.230779][ T28] audit: type=1400 audit(1786102483.321:68): avc: denied { mounton } for pid=279 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.238989][ T281] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 23.255662][ T28] audit: type=1400 audit(1786102483.321:69): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 23.287203][ T28] audit: type=1400 audit(1786102483.391:70): avc: denied { relabelto } for pid=281 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.312691][ T28] audit: type=1400 audit(1786102483.391:71): avc: denied { write } for pid=281 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.344738][ T28] audit: type=1400 audit(1786102483.461:72): avc: denied { read } for pid=279 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.370300][ T28] audit: type=1400 audit(1786102483.461:73): avc: denied { open } for pid=279 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.370512][ T279] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 24.580347][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.587406][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.594925][ T288] device bridge_slave_0 entered promiscuous mode [ 24.601991][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.609129][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.616486][ T288] device bridge_slave_1 entered promiscuous mode [ 24.696695][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.703862][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.711300][ T287] device bridge_slave_0 entered promiscuous mode [ 24.737549][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.744652][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.752086][ T289] device bridge_slave_0 entered promiscuous mode [ 24.759528][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.766558][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.773982][ T287] device bridge_slave_1 entered promiscuous mode [ 24.804589][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.811669][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.819062][ T289] device bridge_slave_1 entered promiscuous mode [ 24.852808][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.859908][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.867315][ T290] device bridge_slave_0 entered promiscuous mode [ 24.877032][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.884099][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.891601][ T290] device bridge_slave_1 entered promiscuous mode [ 24.901649][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.908707][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.915974][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.923012][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.937709][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.944790][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.952102][ T291] device bridge_slave_0 entered promiscuous mode [ 24.961716][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.968779][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.976069][ T291] device bridge_slave_1 entered promiscuous mode [ 25.124125][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.131186][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.138474][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.145484][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.153716][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.160981][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.168494][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.175608][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.183629][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 25.191036][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.216458][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.224648][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.231681][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.239226][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.247337][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.254393][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.267528][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.298793][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.319348][ T288] device veth0_vlan entered promiscuous mode [ 25.326128][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.333700][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.342462][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.350548][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.357894][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.365489][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.383378][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.391566][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.398608][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.406057][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.414411][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.421465][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.428917][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.437031][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.444090][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.451449][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.459724][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.466729][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.474226][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 25.493913][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.501941][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.510144][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.531830][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.540386][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.547764][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.556050][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.563084][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.570568][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.578837][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.585867][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.593318][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.601462][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.608487][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.615821][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.624003][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.631034][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.638484][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.646397][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.654806][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 25.662465][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 25.687033][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.695485][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.703884][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.713010][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.721475][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.729592][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.737453][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.746139][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.765714][ T291] device veth0_vlan entered promiscuous mode [ 25.772864][ T288] device veth1_macvtap entered promiscuous mode [ 25.782175][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.790540][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.798942][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.806933][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.814940][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.823452][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.831918][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.839820][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.847731][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.855287][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.864435][ T289] device veth0_vlan entered promiscuous mode [ 25.876363][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.884478][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.892549][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.900525][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.908681][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.916961][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.925525][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.933170][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.940862][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.948374][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.956620][ T287] device veth0_vlan entered promiscuous mode [ 25.970189][ T289] device veth1_macvtap entered promiscuous mode [ 25.982510][ T291] device veth1_macvtap entered promiscuous mode [ 25.989496][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.997790][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.007271][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.015606][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.024048][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.032430][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.040928][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.048636][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.056744][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.065087][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.078788][ T290] device veth0_vlan entered promiscuous mode [ 26.091916][ T287] device veth1_macvtap entered promiscuous mode [ 26.098912][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.107270][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.116108][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 26.124246][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.132445][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.140689][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.149081][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.157125][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.165497][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.174676][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.182421][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.198604][ T288] request_module fs-gadgetfs succeeded, but still no fs? [ 26.211062][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.220190][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.228702][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.237013][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.245539][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.254019][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.262428][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.270673][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.280750][ T290] device veth1_macvtap entered promiscuous mode [ 26.306593][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.318518][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.327094][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.339592][ T315] syz.1.6[315] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 26.339735][ T315] syz.1.6[315] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 26.340420][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.370454][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.381456][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.389834][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.423826][ T317] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 26.446150][ T322] tmpfs: Too few inodes for current use [ 26.479998][ T328] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 26.511953][ T334] loop1: detected capacity change from 0 to 256 [ 26.523609][ T334] ======================================================= [ 26.523609][ T334] WARNING: The mand mount option has been deprecated and [ 26.523609][ T334] and is ignored by this kernel. Remove the mand [ 26.523609][ T334] option from the mount to silence this warning. [ 26.523609][ T334] ======================================================= [ 26.560793][ T338] loop2: detected capacity change from 0 to 128 [ 26.578707][ T338] FAT-fs (loop2): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 26.593894][ T320] ================================================================== [ 26.601992][ T320] BUG: KASAN: use-after-free in rcu_segcblist_enqueue+0x9c/0xb0 [ 26.609646][ T320] Write of size 8 at addr ffff88810dbba590 by task syz.3.4/320 [ 26.617227][ T320] [ 26.619560][ T320] CPU: 0 PID: 320 Comm: syz.3.4 Not tainted syzkaller #0 [ 26.620989][ T338] syz.2.11: attempt to access beyond end of device [ 26.620989][ T338] loop2: rw=34817, sector=61, nr_sectors = 94 limit=128 [ 26.626580][ T320] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.626604][ T320] Call Trace: [ 26.653226][ T320] [ 26.656240][ T320] __dump_stack+0x21/0x24 [ 26.660603][ T320] dump_stack_lvl+0x110/0x170 [ 26.665380][ T320] ? __cfi_dump_stack_lvl+0x8/0x8 [ 26.670446][ T320] ? rcu_segcblist_enqueue+0x9c/0xb0 [ 26.675739][ T320] print_address_description+0x71/0x200 [ 26.681305][ T320] print_report+0x4a/0x60 [ 26.685651][ T320] kasan_report+0x122/0x150 [ 26.690172][ T320] ? rcu_segcblist_enqueue+0x9c/0xb0 [ 26.695471][ T320] __asan_report_store8_noabort+0x17/0x20 [ 26.701199][ T320] rcu_segcblist_enqueue+0x9c/0xb0 [ 26.706319][ T320] call_rcu+0x554/0xf50 [ 26.710487][ T320] ? __cfi_call_rcu+0x10/0x10 [ 26.715167][ T320] ? __kasan_check_write+0x14/0x20 [ 26.720279][ T320] ? selinux_inode_free_security+0x21f/0x230 [ 26.726267][ T320] security_inode_free+0xc5/0xe0 [ 26.731208][ T320] __destroy_inode+0x175/0x500 [ 26.735975][ T320] evict+0x777/0x8c0 [ 26.739891][ T320] ? proc_nr_inodes+0x2f0/0x2f0 [ 26.744750][ T320] ? _raw_spin_lock+0x94/0xf0 [ 26.749434][ T320] ? __cfi__raw_spin_lock+0x10/0x10 [ 26.754645][ T320] ? __kasan_check_write+0x14/0x20 [ 26.759778][ T320] iput+0x633/0x690 [ 26.763607][ T320] dentry_unlink_inode+0x346/0x3f0 [ 26.768745][ T320] __dentry_kill+0x46c/0x680 [ 26.773350][ T320] dentry_kill+0xc0/0x2a0 [ 26.777698][ T320] dput+0x42/0x80 [ 26.781347][ T320] __fput+0x5c0/0x8f0 [ 26.784454][ T339] syz.4.12 (339) used greatest stack depth: 21096 bytes left [ 26.785335][ T320] ____fput+0x15/0x20 [ 26.796634][ T320] task_work_run+0x1e1/0x250 [ 26.801237][ T320] ? __cfi_task_work_run+0x10/0x10 [ 26.806348][ T320] ? free_nsproxy+0x21f/0x270 [ 26.811024][ T320] do_exit+0xaf2/0x2850 [ 26.815195][ T320] ? __cfi_do_exit+0x10/0x10 [ 26.819830][ T320] ? xfd_validate_state+0x70/0x150 [ 26.824950][ T320] ? __kasan_check_write+0x14/0x20 [ 26.830056][ T320] __x64_sys_exit+0x40/0x40 [ 26.834553][ T320] x64_sys_call+0x67/0x9a0 [ 26.838956][ T320] do_syscall_64+0x4c/0xa0 [ 26.843357][ T320] ? clear_bhb_loop+0x30/0x80 [ 26.848028][ T320] ? clear_bhb_loop+0x30/0x80 [ 26.852695][ T320] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 26.858576][ T320] RIP: 0033:0x7ff43b39e0d9 [ 26.862992][ T320] Code: Unable to access opcode bytes at 0x7ff43b39e0af. [ 26.869988][ T320] RSP: 002b:00007ff43c237ef8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 26.878387][ T320] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007ff43b39e0d9 [ 26.886340][ T320] RDX: 00007ff43c2389c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 26.894290][ T320] RBP: 00007ff43b435024 R08: 0000000000000000 R09: 0000000000000058 [ 26.902250][ T320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 26.910202][ T320] R13: 00007ff43b626038 R14: 00007ff43b625fa0 R15: 00007ffca1c37ff8 [ 26.918165][ T320] [ 26.921164][ T320] [ 26.923465][ T320] Allocated by task 319: [ 26.927680][ T320] kasan_set_track+0x4b/0x70 [ 26.932254][ T320] kasan_save_alloc_info+0x1f/0x30 [ 26.937349][ T320] __kasan_kmalloc+0x95/0xb0 [ 26.941925][ T320] __kmalloc+0xb4/0x1e0 [ 26.946061][ T320] l2tp_session_create+0x38/0xbd0 [ 26.951065][ T320] pppol2tp_connect+0xbf5/0x1640 [ 26.955981][ T320] __sys_connect+0x3da/0x460 [ 26.960638][ T320] __x64_sys_connect+0x7a/0x90 [ 26.965386][ T320] x64_sys_call+0x88d/0x9a0 [ 26.969875][ T320] do_syscall_64+0x4c/0xa0 [ 26.974273][ T320] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 26.980151][ T320] [ 26.982635][ T320] Freed by task 8: [ 26.986350][ T320] kasan_set_track+0x4b/0x70 [ 26.990936][ T320] kasan_save_free_info+0x2b/0x40 [ 26.995947][ T320] ____kasan_slab_free+0x132/0x180 [ 27.001043][ T320] __kasan_slab_free+0x11/0x20 [ 27.005796][ T320] slab_free_freelist_hook+0xc2/0x190 [ 27.011166][ T320] __kmem_cache_free+0xb7/0x1b0 [ 27.016010][ T320] kfree+0x6f/0xf0 [ 27.019714][ T320] l2tp_session_put+0xaf/0x1a0 [ 27.024463][ T320] l2tp_session_delete+0x3df/0x4d0 [ 27.029558][ T320] l2tp_tunnel_del_work+0x199/0x410 [ 27.034735][ T320] process_one_work+0x717/0xc30 [ 27.039564][ T320] worker_thread+0xa4d/0x11d0 [ 27.044219][ T320] kthread+0x281/0x320 [ 27.048270][ T320] ret_from_fork+0x1f/0x30 [ 27.052667][ T320] [ 27.054966][ T320] Last potentially related work creation: [ 27.060665][ T320] kasan_save_stack+0x3a/0x60 [ 27.065325][ T320] __kasan_record_aux_stack+0xb6/0xc0 [ 27.070676][ T320] kasan_record_aux_stack_noalloc+0xb/0x10 [ 27.076465][ T320] call_rcu+0xcf/0xf50 [ 27.080535][ T320] pppol2tp_release+0x1e3/0x2b0 [ 27.085380][ T320] sock_close+0xc9/0x220 [ 27.089613][ T320] __fput+0x1fd/0x8f0 [ 27.093584][ T320] ____fput+0x15/0x20 [ 27.097551][ T320] task_work_run+0x1e1/0x250 [ 27.102126][ T320] do_exit+0xaf2/0x2850 [ 27.106267][ T320] __cfi___ia32_sys_exit+0x0/0x10 [ 27.111276][ T320] x64_sys_call+0x67/0x9a0 [ 27.115676][ T320] do_syscall_64+0x4c/0xa0 [ 27.120072][ T320] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 27.125957][ T320] [ 27.128264][ T320] The buggy address belongs to the object at ffff88810dbba400 [ 27.128264][ T320] which belongs to the cache kmalloc-512 of size 512 [ 27.142292][ T320] The buggy address is located 400 bytes inside of [ 27.142292][ T320] 512-byte region [ffff88810dbba400, ffff88810dbba600) [ 27.155544][ T320] [ 27.157848][ T320] The buggy address belongs to the physical page: [ 27.164251][ T320] page:ffffea000436ee00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10dbb8 [ 27.174485][ T320] head:ffffea000436ee00 order:2 compound_mapcount:0 compound_pincount:0 [ 27.182790][ T320] flags: 0x4000000000010200(slab|head|zone=1) [ 27.188850][ T320] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 [ 27.197415][ T320] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 27.205973][ T320] page dumped because: kasan: bad access detected [ 27.212361][ T320] page_owner tracks the page as allocated [ 27.218068][ T320] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 291, tgid 291 (syz-executor), ts 26400617075, free_ts 26351213493 [ 27.240622][ T320] post_alloc_hook+0x1f5/0x210 [ 27.245378][ T320] prep_new_page+0x1c/0x110 [ 27.249868][ T320] get_page_from_freelist+0x2ca9/0x2d20 [ 27.255399][ T320] __alloc_pages+0x1fa/0x610 [ 27.259979][ T320] alloc_slab_page+0x6e/0xf0 [ 27.264548][ T320] new_slab+0x98/0x3e0 [ 27.268600][ T320] ___slab_alloc+0x70f/0xb70 [ 27.273196][ T320] __slab_alloc+0x5e/0xa0 [ 27.277521][ T320] __kmem_cache_alloc_node+0x204/0x2d0 [ 27.282968][ T320] __kmalloc_node+0xa2/0x1e0 [ 27.287543][ T320] qdisc_alloc+0x82/0x750 [ 27.291853][ T320] qdisc_create_dflt+0x6b/0x3a0 [ 27.296685][ T320] dev_activate+0x30e/0x1110 [ 27.301278][ T320] __dev_open+0x40d/0x520 [ 27.305591][ T320] __dev_change_flags+0x1f2/0x6b0 [ 27.310596][ T320] dev_change_flags+0x80/0x1a0 [ 27.315341][ T320] page last free stack trace: [ 27.320076][ T320] free_unref_page_prepare+0x80c/0x820 [ 27.325524][ T320] free_unref_page+0x93/0x530 [ 27.330182][ T320] __free_pages+0x67/0x100 [ 27.334581][ T320] free_pages+0x82/0x90 [ 27.338808][ T320] __stack_depot_save+0x45f/0x490 [ 27.343815][ T320] kasan_set_track+0x60/0x70 [ 27.348399][ T320] kasan_save_free_info+0x2b/0x40 [ 27.353403][ T320] ____kasan_slab_free+0x132/0x180 [ 27.358497][ T320] __kasan_slab_free+0x11/0x20 [ 27.363242][ T320] slab_free_freelist_hook+0xc2/0x190 [ 27.368592][ T320] kmem_cache_free+0x12d/0x300 [ 27.373339][ T320] __put_task_struct+0x1e0/0x3e0 [ 27.378259][ T320] delayed_put_task_struct+0x6c/0x1c0 [ 27.383613][ T320] rcu_do_batch+0x52b/0xc30 [ 27.388097][ T320] rcu_core+0x486/0xf00 [ 27.392236][ T320] rcu_core_si+0x9/0x10 [ 27.396374][ T320] [ 27.398677][ T320] Memory state around the buggy address: [ 27.404285][ T320] ffff88810dbba480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.412322][ T320] ffff88810dbba500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.420361][ T320] >ffff88810dbba580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.428418][ T320] ^ [ 27.433083][ T320] ffff88810dbba600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.441121][ T320] ffff88810dbba680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.449509][ T320] ================================================================== [ 27.457546][ T320] Disabling lock debugging due to kernel taint [ 27.471553][ T10] FAT-fs (loop2): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 27.765040][ T346] loop4: detected capacity change from 0 to 131072 [ 27.774351][ T346] F2FS-fs (loop4): Invalid log sectorsize (0) [ 27.780714][ T346] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 27.790308][ T346] F2FS-fs (loop4): invalid crc value [ 27.803104][ T346] F2FS-fs (loop4): Found nat_bits in checkpoint [ 27.825412][ T346] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 27.832525][ T346] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5