last executing test programs: 297.539231ms ago: executing program 3 (id=4): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev, @in6=@mcast2, 0x0, 0x0, 0xffff, 0x0, 0x2}, {0x0, 0x28c, 0x1, 0x0, 0x0, 0x0, 0x2}, {0x7}, 0x0, 0x0, 0x1}, {{@in=@rand_addr=0x64010102, 0x2000000, 0x33}, 0x0, @in6=@loopback, 0x0, 0x3, 0x3, 0xb7, 0x0, 0x8000000}}, 0xe8) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x0) 224.673643ms ago: executing program 4 (id=5): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast2, @in6=@loopback, 0x0, 0x8, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000002}}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x2, 0x4, 0x3}]}]}, 0xfc}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000001100)=@migrate={0xa0, 0x21, 0x1, 0x0, 0x0, {{@in6=@private2={0xfc, 0x2, '\x00', 0x1}, @in6=@dev={0xfe, 0x80, '\x00', 0x20}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0, 0x2e}}, [@migrate={0x50, 0x11, [{@in=@loopback=0xac1414aa, @in6=@dev={0xfe, 0x80, '\x00', 0x26}, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, @in6=@rand_addr=' \x01\x00', 0x3c, 0x4, 0x0, 0x0, 0x8, 0xa}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000001100)=@migrate={0xa0, 0x21, 0x1, 0x0, 0x0, {{@in6=@private2={0xfc, 0x2, '\x00', 0x1}, @in6=@dev={0xfe, 0x80, '\x00', 0x20}, 0x0, 0x0, 0x2, 0x0, 0xa, 0x0, 0xa0, 0x2e}}, [@migrate={0x50, 0x11, [{@in=@loopback=0xac1414aa, @in=@broadcast, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, @in6=@mcast2, 0x3c, 0x4, 0x0, 0x0, 0xa, 0xa}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) 185.146694ms ago: executing program 0 (id=1): r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89ff, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000400)=@ethtool_ringparam={0x11, 0x0, 0x20042001, 0x0, 0x7, 0x4, 0x0, 0x2dc}}) 116.451176ms ago: executing program 4 (id=6): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='nv', 0x2) 90.161237ms ago: executing program 0 (id=7): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000010c0)={0x1f, 0x1}, 0x6) write$bt_hci(r0, &(0x7f0000001500)={0x1, @remote_name_req_cancel={{0x41a, 0x6}}}, 0xa) 73.822818ms ago: executing program 3 (id=8): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=@newqdisc={0x24, 0x24, 0x3fe3aa0262d8c383, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r1, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xed27c9fa5277b9b7}}}, 0x24}}, 0x20008000) 50.636909ms ago: executing program 1 (id=2): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) gettid() r3 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x14b040, 0x0) ioctl$ASHMEM_SET_SIZE(r3, 0x40087703, 0xfffffff3) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x12, r3, 0xcc840000) ioctl$ASHMEM_SET_NAME(r3, 0x40087707, 0x0) pread64(r3, &(0x7f0000000340)=""/249, 0xf9, 0x10001) timer_create(0x1, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x6, 0x0) mount(&(0x7f0000000300), &(0x7f0000000080)='.\x00', 0x0, 0x320081a, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000042c0)='mounts\x00') pread64(r4, &(0x7f0000002240)=""/237, 0xed, 0x4eb) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) 0s ago: executing program 0 (id=9): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x8c, 0x2c, 0xd27, 0x70bd2a, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0x0, 0xfff3}, {}, {0xb}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x5, 0x8ba4, 0x3, 0x100000a, 0x8}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x10}, 0x2000c8d4) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 9.376501][ T110] udevd (110) used greatest stack depth: 22888 bytes left [ 14.542695][ T30] kauditd_printk_skb: 31 callbacks suppressed [ 14.542711][ T30] audit: type=1400 audit(1781793897.891:59): avc: denied { transition } for pid=223 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.555330][ T30] audit: type=1400 audit(1781793897.891:60): avc: denied { noatsecure } for pid=223 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.565398][ T30] audit: type=1400 audit(1781793897.901:61): avc: denied { write } for pid=223 comm="sh" path="pipe:[14751]" dev="pipefs" ino=14751 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 14.596787][ T30] audit: type=1400 audit(1781793897.901:62): avc: denied { rlimitinh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.615606][ T30] audit: type=1400 audit(1781793897.901:63): avc: denied { siginh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.128' (ED25519) to the list of known hosts. [ 22.196830][ T30] audit: type=1400 audit(1781793905.551:64): avc: denied { mounton } for pid=277 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.200494][ T277] cgroup: Unknown subsys name 'net' [ 22.219508][ T30] audit: type=1400 audit(1781793905.551:65): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.246973][ T30] audit: type=1400 audit(1781793905.571:66): avc: denied { unmount } for pid=277 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.247470][ T277] cgroup: Unknown subsys name 'devices' [ 22.418553][ T277] cgroup: Unknown subsys name 'hugetlb' [ 22.424344][ T277] cgroup: Unknown subsys name 'rlimit' [ 22.564716][ T30] audit: type=1400 audit(1781793905.911:67): avc: denied { setattr } for pid=277 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.587901][ T30] audit: type=1400 audit(1781793905.911:68): avc: denied { mounton } for pid=277 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.612686][ T30] audit: type=1400 audit(1781793905.911:69): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.631227][ T279] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 22.644666][ T30] audit: type=1400 audit(1781793905.991:70): avc: denied { relabelto } for pid=279 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.670491][ T30] audit: type=1400 audit(1781793905.991:71): avc: denied { write } for pid=279 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.708492][ T30] audit: type=1400 audit(1781793906.061:72): avc: denied { read } for pid=277 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.709732][ T277] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.734529][ T30] audit: type=1400 audit(1781793906.061:73): avc: denied { open } for pid=277 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.302991][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.310086][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.317753][ T285] device bridge_slave_0 entered promiscuous mode [ 23.326236][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.333458][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.341044][ T285] device bridge_slave_1 entered promiscuous mode [ 23.402547][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.409652][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.417182][ T288] device bridge_slave_0 entered promiscuous mode [ 23.424142][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.431255][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.438801][ T288] device bridge_slave_1 entered promiscuous mode [ 23.452973][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.460117][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.467620][ T286] device bridge_slave_0 entered promiscuous mode [ 23.487166][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.494225][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.501695][ T286] device bridge_slave_1 entered promiscuous mode [ 23.546718][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.553793][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.561452][ T289] device bridge_slave_0 entered promiscuous mode [ 23.570979][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.578182][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.585605][ T289] device bridge_slave_1 entered promiscuous mode [ 23.598000][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.605061][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.612607][ T287] device bridge_slave_0 entered promiscuous mode [ 23.622273][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.629595][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.637066][ T287] device bridge_slave_1 entered promiscuous mode [ 23.789478][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.796578][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.803900][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.811045][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.827092][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.834163][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.841495][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.848557][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.858974][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.866115][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.873512][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.880579][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.900204][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.907297][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.914582][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.921651][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.939066][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.946137][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.953454][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.960526][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.982051][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.989579][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.996899][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.004125][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.011475][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.018925][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.026253][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.033686][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.040902][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.048232][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.056807][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.064314][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.091405][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.099480][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.107750][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.114781][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.122297][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.130644][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.137735][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.157221][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.165824][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.174062][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.181124][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.188832][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.197057][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.204082][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.211519][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.219713][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.226778][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.234320][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.242527][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.249591][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.256963][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.264861][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.278146][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.310719][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.318956][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.327917][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.335949][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.344165][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.351803][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.359453][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.367679][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.375604][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.383751][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.391827][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.400307][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.408696][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.417167][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.425337][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.432414][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.444013][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.452165][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.462562][ T285] device veth0_vlan entered promiscuous mode [ 24.470160][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.477834][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.485299][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.493755][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.501953][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.509015][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.517898][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.526435][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.534613][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.541688][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.558418][ T286] device veth0_vlan entered promiscuous mode [ 24.565756][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.574295][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.582828][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.591300][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.599429][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.607440][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.615560][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.623132][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.632304][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.640539][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.652746][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.661429][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.669790][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.676864][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.692452][ T287] device veth0_vlan entered promiscuous mode [ 24.703147][ T286] device veth1_macvtap entered promiscuous mode [ 24.710543][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.718781][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.727764][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.736174][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.744455][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.752739][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.760326][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.768524][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.776817][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.793833][ T287] device veth1_macvtap entered promiscuous mode [ 24.800881][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.809518][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.827968][ T285] device veth1_macvtap entered promiscuous mode [ 24.839899][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.847722][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.855802][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.864102][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.872451][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.880577][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.888869][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.897250][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.905508][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.925590][ T286] request_module fs-gadgetfs succeeded, but still no fs? [ 24.926846][ T288] device veth0_vlan entered promiscuous mode [ 24.939187][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.948572][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.956941][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.965205][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.973727][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.982329][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.990916][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.999349][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.006987][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.015426][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.023925][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.035834][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.044254][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.076215][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.089315][ T289] device veth0_vlan entered promiscuous mode [ 25.100400][ T288] device veth1_macvtap entered promiscuous mode [ 25.108643][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.116676][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.125678][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.144018][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.172460][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.201777][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.211203][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.221531][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.230944][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.239679][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.250210][ T289] device veth1_macvtap entered promiscuous mode [ 25.290236][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.298799][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.317573][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.332117][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.351499][ T345] ================================================================== [ 25.359618][ T345] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0x88e/0x3200 [ 25.367836][ T345] Read of size 8 at addr ffff88810df156c0 by task syz.0.9/345 [ 25.375320][ T345] [ 25.377686][ T345] CPU: 0 PID: 345 Comm: syz.0.9 Not tainted syzkaller #0 [ 25.384735][ T345] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 25.394830][ T345] Call Trace: [ 25.398132][ T345] [ 25.401091][ T345] __dump_stack+0x21/0x30 [ 25.405460][ T345] dump_stack_lvl+0x110/0x170 [ 25.410174][ T345] ? show_regs_print_info+0x20/0x20 [ 25.415421][ T345] ? load_image+0x3f0/0x3f0 [ 25.420046][ T345] print_address_description+0x7f/0x2c0 [ 25.425622][ T345] ? tc_setup_flow_action+0x88e/0x3200 [ 25.431114][ T345] kasan_report+0x10f/0x150 [ 25.435645][ T345] ? tc_setup_flow_action+0x88e/0x3200 [ 25.441160][ T345] __asan_report_load8_noabort+0x14/0x20 [ 25.446826][ T345] tc_setup_flow_action+0x88e/0x3200 [ 25.452141][ T345] mall_replace_hw_filter+0x2db/0x8d0 [ 25.457538][ T345] ? pcpu_block_update_hint_alloc+0x8bc/0xc50 [ 25.463632][ T345] ? mall_set_parms+0x520/0x520 [ 25.468515][ T345] ? tcf_exts_destroy+0xb0/0xb0 [ 25.473409][ T345] ? pcpu_alloc+0x1118/0x16f0 [ 25.478114][ T345] ? mall_set_parms+0x1e4/0x520 [ 25.483007][ T345] mall_change+0x544/0x760 [ 25.487450][ T345] ? __kasan_check_write+0x14/0x20 [ 25.492585][ T345] ? mall_get+0xa0/0xa0 [ 25.496774][ T345] ? tcf_chain_tp_insert_unique+0x946/0xa70 [ 25.502696][ T345] ? mall_get+0xa0/0xa0 [ 25.506875][ T345] tc_new_tfilter+0x13df/0x1990 [ 25.511782][ T345] ? tcf_gate_entry_destructor+0x20/0x20 [ 25.517442][ T345] ? security_capable+0x87/0xb0 [ 25.522314][ T345] ? ns_capable+0x8c/0xf0 [ 25.526669][ T345] ? netlink_net_capable+0x125/0x160 [ 25.531981][ T345] ? tcf_gate_entry_destructor+0x20/0x20 [ 25.537641][ T345] rtnetlink_rcv_msg+0x83c/0xcb0 [ 25.542611][ T345] ? rtnetlink_bind+0x80/0x80 [ 25.547317][ T345] ? avc_has_perm_noaudit+0x390/0x490 [ 25.552710][ T345] ? memcpy+0x56/0x70 [ 25.556713][ T345] ? avc_has_perm_noaudit+0x30a/0x490 [ 25.562111][ T345] ? arch_stack_walk+0xee/0x140 [ 25.566993][ T345] ? avc_denied+0x1b0/0x1b0 [ 25.571512][ T345] ? stack_trace_save+0xa6/0xf0 [ 25.576388][ T345] ? avc_has_perm+0x163/0x250 [ 25.581089][ T345] ? avc_has_perm_noaudit+0x490/0x490 [ 25.586514][ T345] ? x64_sys_call+0x4b/0x9a0 [ 25.591123][ T345] ? selinux_nlmsg_lookup+0x39d/0x440 [ 25.596514][ T345] netlink_rcv_skb+0x1e9/0x430 [ 25.601301][ T345] ? rtnetlink_bind+0x80/0x80 [ 25.606002][ T345] ? netlink_ack+0xb10/0xb10 [ 25.610614][ T345] ? _copy_from_iter+0x4a4/0x10a0 [ 25.615675][ T345] ? __netlink_lookup+0x387/0x3b0 [ 25.620731][ T345] rtnetlink_rcv+0x1c/0x20 [ 25.625169][ T345] netlink_unicast+0x86c/0xa30 [ 25.629955][ T345] netlink_sendmsg+0x879/0xb80 [ 25.634744][ T345] ? netlink_getsockopt+0x530/0x530 [ 25.639958][ T345] ? security_socket_sendmsg+0x82/0xa0 [ 25.645444][ T345] ? netlink_getsockopt+0x530/0x530 [ 25.650666][ T345] ____sys_sendmsg+0x5be/0x8f0 [ 25.655458][ T345] ? __sys_sendmsg_sock+0x40/0x40 [ 25.660506][ T345] ? import_iovec+0x7c/0xb0 [ 25.665027][ T345] ___sys_sendmsg+0x236/0x2e0 [ 25.669727][ T345] ? __sys_sendmsg+0x280/0x280 [ 25.674513][ T345] ? sock_show_fdinfo+0xa0/0xa0 [ 25.679385][ T345] ? __fdget+0x1a1/0x230 [ 25.683655][ T345] __x64_sys_sendmsg+0x201/0x2d0 [ 25.688614][ T345] ? ___sys_sendmsg+0x2e0/0x2e0 [ 25.693487][ T345] ? __kasan_check_write+0x14/0x20 [ 25.698620][ T345] ? switch_fpu_return+0x15d/0x2c0 [ 25.703764][ T345] x64_sys_call+0x4b/0x9a0 [ 25.708209][ T345] do_syscall_64+0x4c/0xa0 [ 25.712681][ T345] ? clear_bhb_loop+0x50/0xa0 [ 25.717377][ T345] ? clear_bhb_loop+0x50/0xa0 [ 25.722077][ T345] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 25.727993][ T345] RIP: 0033:0x7f874c57fe59 [ 25.732428][ T345] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 25.752082][ T345] RSP: 002b:00007f874afda028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 25.760644][ T345] RAX: ffffffffffffffda RBX: 00007f874c7f8fa0 RCX: 00007f874c57fe59 [ 25.768637][ T345] RDX: 000000002000c8d4 RSI: 0000200000000180 RDI: 0000000000000004 [ 25.776631][ T345] RBP: 00007f874c615e6f R08: 0000000000000000 R09: 0000000000000000 [ 25.784644][ T345] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 25.792635][ T345] R13: 00007f874c7f9038 R14: 00007f874c7f8fa0 R15: 00007ffd85bdbd58 [ 25.800638][ T345] [ 25.803677][ T345] [ 25.806019][ T345] Allocated by task 345: [ 25.810277][ T345] __kasan_kmalloc+0xd4/0x100 [ 25.815001][ T345] __kmalloc+0x13d/0x2c0 [ 25.819271][ T345] tcf_idr_create+0x5f/0x790 [ 25.823881][ T345] tcf_idr_create_from_flags+0x61/0x70 [ 25.829447][ T345] tcf_gact_init+0x342/0x570 [ 25.834060][ T345] tcf_action_init_1+0x3fd/0x6b0 [ 25.839071][ T345] tcf_action_init+0x233/0x7a0 [ 25.843864][ T345] tcf_exts_validate+0x24a/0x580 [ 25.848817][ T345] mall_set_parms+0x48/0x520 [ 25.853439][ T345] mall_change+0x478/0x760 [ 25.857871][ T345] tc_new_tfilter+0x13df/0x1990 [ 25.862778][ T345] rtnetlink_rcv_msg+0x83c/0xcb0 [ 25.867738][ T345] netlink_rcv_skb+0x1e9/0x430 [ 25.872527][ T345] rtnetlink_rcv+0x1c/0x20 [ 25.876985][ T345] netlink_unicast+0x86c/0xa30 [ 25.881778][ T345] netlink_sendmsg+0x879/0xb80 [ 25.886559][ T345] ____sys_sendmsg+0x5be/0x8f0 [ 25.891333][ T345] ___sys_sendmsg+0x236/0x2e0 [ 25.896023][ T345] __x64_sys_sendmsg+0x201/0x2d0 [ 25.900991][ T345] x64_sys_call+0x4b/0x9a0 [ 25.905422][ T345] do_syscall_64+0x4c/0xa0 [ 25.909861][ T345] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 25.915790][ T345] [ 25.918126][ T345] The buggy address belongs to the object at ffff88810df15600 [ 25.918126][ T345] which belongs to the cache kmalloc-192 of size 192 [ 25.932197][ T345] The buggy address is located 0 bytes to the right of [ 25.932197][ T345] 192-byte region [ffff88810df15600, ffff88810df156c0) [ 25.945873][ T345] The buggy address belongs to the page: [ 25.951509][ T345] page:ffffea000437c540 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10df15 [ 25.961790][ T345] flags: 0x4000000000000200(slab|zone=1) [ 25.967453][ T345] raw: 4000000000000200 ffffea000437c3c0 0000000c00000007 ffff888100042c00 [ 25.976056][ T345] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 25.984656][ T345] page dumped because: kasan: bad access detected [ 25.991080][ T345] page_owner tracks the page as allocated [ 25.996825][ T345] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 102, ts 5507927414, free_ts 5507907438 [ 26.012642][ T345] post_alloc_hook+0x192/0x1b0 [ 26.017432][ T345] prep_new_page+0x1c/0x110 [ 26.021950][ T345] get_page_from_freelist+0x2c3a/0x2cd0 [ 26.027512][ T345] __alloc_pages+0x1a2/0x460 [ 26.032203][ T345] new_slab+0xa0/0x4d0 [ 26.036288][ T345] ___slab_alloc+0x3ac/0x840 [ 26.040898][ T345] __slab_alloc+0x49/0x90 [ 26.045242][ T345] kmem_cache_alloc_trace+0x146/0x270 [ 26.050631][ T345] kernfs_fop_open+0x375/0xbb0 [ 26.055494][ T345] do_dentry_open+0x82a/0x1010 [ 26.060293][ T345] vfs_open+0x73/0x80 [ 26.064296][ T345] path_openat+0x26e6/0x2f80 [ 26.068933][ T345] do_filp_open+0x1df/0x400 [ 26.073452][ T345] do_sys_openat2+0x15e/0x7f0 [ 26.078177][ T345] __x64_sys_openat+0x136/0x160 [ 26.083038][ T345] x64_sys_call+0x219/0x9a0 [ 26.087563][ T345] page last free stack trace: [ 26.092247][ T345] free_unref_page_prepare+0x542/0x550 [ 26.097723][ T345] free_unref_page+0xae/0x540 [ 26.102426][ T345] __free_pages+0x6c/0x100 [ 26.106857][ T345] free_pages+0x82/0x90 [ 26.111032][ T345] selinux_genfs_get_sid+0x20b/0x250 [ 26.116340][ T345] inode_doinit_with_dentry+0x884/0xd90 [ 26.121930][ T345] selinux_d_instantiate+0x27/0x40 [ 26.127067][ T345] security_d_instantiate+0x9e/0xf0 [ 26.132288][ T345] d_splice_alias+0x6d/0x390 [ 26.136917][ T345] kernfs_iop_lookup+0x2c2/0x310 [ 26.141871][ T345] path_openat+0x1436/0x2f80 [ 26.146479][ T345] do_filp_open+0x1df/0x400 [ 26.150998][ T345] do_sys_openat2+0x15e/0x7f0 [ 26.155702][ T345] __x64_sys_openat+0x136/0x160 [ 26.160581][ T345] x64_sys_call+0x219/0x9a0 [ 26.165106][ T345] do_syscall_64+0x4c/0xa0 [ 26.169539][ T345] [ 26.171886][ T345] Memory state around the buggy address: [ 26.177522][ T345] ffff88810df15580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 26.185593][ T345] ffff88810df15600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.193663][ T345] >ffff88810df15680: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 26.201731][ T345] ^ [ 26.207887][ T345] ffff88810df15700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.215984][ T345] ffff88810df15780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 26.224059][ T345] ================================================================== [ 26.232130][ T345] Disabling lock debugging due to kernel taint