last executing test programs: 390.5218ms ago: executing program 4 (id=5): r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000001c0), 0x80042, 0x0) write$vga_arbiter(r0, &(0x7f00000002c0)=@other={'trylock', ' ', 'mem'}, 0xc) 374.03341ms ago: executing program 4 (id=6): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/sys/kernel/printk_devkmsg\x00', 0x2, 0x0) sendfile(r0, r0, 0x0, 0x1) 359.345361ms ago: executing program 4 (id=7): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file0\x00', 0x22000011, &(0x7f0000000200)={[{@commit}, {@noblock_validity}, {@user_xattr}]}, 0x86, 0x48e, &(0x7f0000000400)="$eJzs3EtvVFUcAPD/nXaKFUoLPnkoo0hsRFtaUFmYGI0mbExMdKHLWipBChioiRAiaAwujZ9AXZr4CVzpxqgrjVvdGxNi2IguzJj7KlM6rdPpTKcyv18y7Tn3dc7/nnt6H+dOA+hbtfRHErEtIn6JiNE8u3SBWv7rxvVLs39dvzSbRL3+yh9Jttyf1y/NlotuK35vLbY5XomofJjEniblnr9w8dTM/PzcuSI/uXD67cnzFy4+cfL0zIm5E3Nnpo8ePXJ46umnpp/sSJwjaV13v3d2765jr3/y0mw93vj+y7T+A8X8xjhyY+susxa1GI56vbJk6lD288C6t765jDSkk8EeVoQ1SY//tLmqWf8fjYG42Xij8eIHPa0c0FX1er2+Y9nU/KxYOZBk84HblT4O/ao846f3v+VnY69Aeuvac/kNUBr3jeKTzxmM9L49Gcvv2Ae6VP62iHjtyt+fpp9o+hwCAKCzvk6vfx5vdv1XiXsblttejA2NRcTBiNgZEXdFxN0RcU9Etux9EXH/Gsuv3ZLPy682TPlpuN3YWpFe/z1TjG0tvf5bHLUZGyhyI1n81eTNk/Nzh4p9Mh7VLWl+apUyvnnh54+zRJNIag3Xf+knLb+8Fizq8fvglqXrHJ9ZmFlv3KVr70fsHny2SfzJ4khAEhG7ImJ3G9tP99nJx77Ym6a3b10+/7/jX0UHxpnqn0c8mrf/lbgl/lKSl7TS+OTkHTE/d2iyPCqW++HHqy835huP7loWRpvxd0Da/nc2Pf6L+MtuUI7Xnl97GVd//WjFe5p2j/+h5NUsPVRMe3dmYeHcVMRQMWHJ9Omb65b5cvk0/vH9zfv/zoh/PivW2xMR6UH8QEQ8GBH7iro/FBEPR8T+VeL/7vlH3lp9D/W2/Y+v1v4RY0kRf+rc4sB964mBU99+tVL5rbX/kSw1Xkxp5e9fqxVsd78BAADA/0klG4NOKhOL6UplYiJ/h7987HKwFu+cOZ6PVY9FtVI+6RpteB46VTwbLvPTt+QPR8SO7E2j4Sw/MXt2fqTHsUO/27pC/0/91q2XXoDNY03jaEn36gFsPN/XhP7VvP939b0rYJNw/of+pf9D/2rW/y9H3OhBVYAN5vwP/av1/u+NALjdOP9D/9L/oS8t/0r8cPGvE9r5pv/NxM5j61p9rYnqBpbV4cRAl7Ycjf+0owuJqPR817WfqGyGauwrElsiotW1Lje0aXna7kYNq/M9/KMEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQQf8GAAD//4F+194=") socket(0x10, 0x80002, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) 224.038624ms ago: executing program 0 (id=1): bind$inet6(0xffffffffffffffff, &(0x7f0000000400)={0xa, 0xe1e, 0xe, @mcast2}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000440)={0xa, 0x4e20, 0x4, @remote, 0xb}, 0x1c) syz_emit_ethernet(0x7e, &(0x7f0000000480)={@local, @local, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x48, 0x11, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, @local, {[], {0x4e20, 0xe22, 0x48, 0x0, @wg=@cookie={0x3, 0x2, "88c73b21f267636d01dbe5712c1c941e1cdafbbb43f09c28", "e13808ca72381f41e5fff9620915b6f78670dfaf9a2038083179cf6b7931c9b4"}}}}}}}, 0x0) syz_mount_image$vfat(&(0x7f0000000500), &(0x7f0000000540)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x1884000, &(0x7f0000000640)=ANY=[@ANYRES32, @ANYRES8=0x0], 0x4, 0x2a7, &(0x7f0000000680)="$eJzs3M1OE10cx/EfpfDw8sD0eVAUjPFEN7qZQL0BGgKJsYkGqfElMRlkqk2HlnQaTI0Rdm69DuLSnYnxBth4BS7csXHJwjiG6QAtDgSIdoR8P5s55MxvONP/mclZ9HTzwdulctG3i05dqS6jtNSrLSmjlLrV1BUdU2G7V63WdGMk/+XyvYePbufy+Zk5Y2Zz8zezxpjhKx9fvHp39VN98P774Q//aCPzZPNb9uvG6MbY5o/55yXflHxTqdaNYxaq1bqz4LlmseSXbWPueq7ju6ZU8d1aW3/Rqy4vN4xTWRwaWK65vm+cSsOU3YapV0291jDOM6dUMbZtm6EB4XA9SQ8AHVGr5ZxpSeO/9BTWExkQAABIVMz6fy2R9f9UdEHW/x1UWJ+bc3JJjwJ/1vb6/3H0/LZj/Q8AAAAAAAAAAAAAAAAAAAAAwGmwFQRWEATWzrFHCnf4BNHf/ZIGJK1G5w9JGpZkScpI+k/S/5JGJJ2TdF7SqKQLktKSxlqulfCtIsZB9e/eV/9BSf8es/4Xqf9fbyvY2c93+PNP/c+mo77/qf/Z1LJxt09aerNSWCk0j83+XFEleXI1IUvfw1pGmu3ZW/mZCRPK6NLSapRfXSl0t+cnZW1PmLj8ZDNv2vOpcN7t5rOytidYXD4bm+/T9WsteVuWPj9VVZ4Wwzm5l389acz0nfy+/Hh43llnm12x9bPtg/qb+SPMj2Aitj5pjaeTvXdIfuNl2fE8t9bBRn8S//Q0NXZ+eOH3XjlzsriS/jRoJNJI+MWEjtgretIjAQAAAAAAAAAAAAAAAAAcx0m+ITgl6TippO8RAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID9fgYAAP//QHNOwQ==") prlimit64(0x0, 0xe, &(0x7f0000000940)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000980)=0x7) r0 = getpid() connect$can_bcm(0xffffffffffffffff, &(0x7f00000009c0), 0x10) sendmsg$can_bcm(0xffffffffffffffff, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000a00)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000a40)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, 0x0, &(0x7f0000000a80)) ioctl$sock_TIOCOUTQ(r1, 0x5411, &(0x7f0000000ac0)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000b00)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000b40)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000bc0), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000c00)=0x2) recvmmsg(r2, &(0x7f0000000c40), 0x10106, 0x2, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000c80)={@mcast1, 0x800, 0x0, 0x103, 0x9, 0x5, 0xfffa}, 0x20) r5 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_FILTER(r5, 0x65, 0x1, 0x0, &(0x7f0000000cc0)=0x5f) openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r3, 0x8983, &(0x7f0000000d00)={0x0, 'veth0_vlan\x00', {0x7}, 0x26}) syz_clone3(&(0x7f0000000d80)={0x40000, &(0x7f0000000e00), &(0x7f0000000e40), 0x0, {0x31}, &(0x7f0000000ec0)=""/207, 0xcf, &(0x7f0000000fc0)=""/12, &(0x7f0000001000)=[r0, r0, r0, r0], 0x4}, 0x58) socket$packet(0x11, 0x3, 0x300) 173.621256ms ago: executing program 4 (id=8): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000000000)) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000080)='./file0\x00', 0x208205, &(0x7f00000000c0)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000}}, {@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x800000}}, {@lazytime}]}, 0x81, 0x63d, &(0x7f0000000b40)="$eJzs3c9rHNcdAPDvzGplyVYruxRTm5YKerChWD9cU7c92b7UB0Nd6kMpPVi1JFd4ZQtLhto1RIYcHEgghFxD8CX/QO7B5OpbCCS55RxwQnDIwQneMLM78rI/pEXW7srezwdGevNmdt/77tPbebOjtxPA0JrKfqQRRyLichIx2bBtImobp+r7Pfn27pVsSaJa/cc3SST1vGL/Z/XfB7IfScRYRHxyLuIXpdZy127fuTZfqda8FjGzvrI6s3b7zonllfmri1cXr8+d/NOp07N/njs1tytxFnGdv/C3X7/1+n//uPRp5UQSZ+JS+f8L0RTHbpmKqXhWD7ExfyQiTmeJNq/Ly6YIIRlwPdiZUv3vsRwRh2MySrFvc9tkLL850MoBPVUtRVSBIZVs9v/yYCsC9FkxDijO7XtxHryXjZyNiKePIlriH6l9NhJj+bnR/idJfp5UyM53D+5C+VkZP949+l62RIfPIUZ2oZxONu5FxK/atX+S1+1g/ilOFn8aacPjsvRsRIzWX4t0h+VPNa33+++vOf6/j3SOv7EdsnjP1H9n+ee2L+p+u8xBxw/AcHp4tn4g38jWnh//s5FhMf6JNuOfiTbHrp0Y9PHv8dnaAbx1/FMc78fyz8jTpnFYNua52P4py80ZX75x/p1O5TeO/7IlK78YC/bD43sRR5viv58P5pLN9k/atH+2y+Uuy/jrZ1+f77Rt0PFXH0Qca3v+8/yKVpaaWV9ZLfKark/OLC1XFmdrP9uW8dGjf3/QqfxBx5+1f3SIf6v2z/JWuyzjw4sPVjptm9g2/vSr0eRSnhqt5/xvfn395lzEaHKhvktD/snNB7Z9eyr2KZ4ji//479r3/y3izxt6o8v4V/957Ukt1XqVtOv2b3lXyT2rdlmHTrL4F3bY/m93Wcb3/7r1m6as8SKxVfzjrU+VdPuaAwAAAAAAwDBK82uwSTq9mU7T6enaHN5fxv60cmNt/fdLN25dX4g4nv8/ZDktrnRP1taTbH2u/v+wxfrJpvU/RMShiHi3NJ6vT1+5UVkYdPAAAAAAAAAAAAAAAAAAAACwRxyoz/8v7lP9Xak2/78r64d7XDug53p5gzlgb9P/YXjl/b+bO7j+p/d1AfrL8R+Gl/4Pw0v/h+Gl/8Pwau7/3g9geOjvMLz0fxhe+j8AAAAAvJIO/fbhF0lEbPxlPF8yo/Vt5YHWDOi1xj4+1tUjpnpWF6C/uuvzLUq7XQ+g/zYv/Xcz/R94pXR1jv+0/uWAva8OMABJu8x8cFDduvM/bPtIAAAAAAAAAAAAAKAHjh0x/x+GVRofD7oKwIC8wER+3wEALzlf/Q/Dyzk+sN0s/o7fE2b+PwAAAAAAAAAAAAD0zUS+JOl0/RagE5Gm09MRP4uIg1FOlpYri7MR8fOI+LxU3petzw260gAAAAAAAAAAAAAAAAAAAPCKWbt959p8pbJ4szHxQ0tOjxPF3cW62blDnV8kUdwFtZ8hd5uIpP+FjkfEXoi9N4mRhpwkYiNr+T1RsZtrsSeqkebVGOCbEgAAAAAAAAAAAAAAAAAADKmGucftHX2/zzUCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgP57fv//nSeSbZ5n0DECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC+nnwIAAP///jAzVw==") syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000001180)='./proc_mnt\x00', 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000011c0)='./proc_mnt/kcore\x00', 0x0, 0x0) 151.235636ms ago: executing program 3 (id=4): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./tracing/events/sched/filter\x00', 0x1, 0x15d) write(r0, 0x0, 0x0) 66.826448ms ago: executing program 3 (id=9): r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x120) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) write(r0, &(0x7f0000000280)='0', 0x1) 10.35027ms ago: executing program 1 (id=2): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x65dfdc00, {0x0, 0x0, 0x0, r6, {0xf49c1a6d801e715d, 0xfff7}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0xfffffffd, 0x400, 0x1, 0x6, 0x7}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x10}, 0x0) 0s ago: executing program 2 (id=3): mkdir(&(0x7f0000000180)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/serio/devices/serio0/drvctl\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)='r', 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/bus/serio/devices/serio1/drvctl\x00', 0x1, 0x0) write(r1, &(0x7f0000000300)='r', 0xfffc) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.42' (ED25519) to the list of known hosts. [ 17.882603][ T24] audit: type=1400 audit(1792039317.830:64): avc: denied { mounton } for pid=271 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 17.883536][ T271] cgroup: Unknown subsys name 'net' [ 17.889840][ T24] audit: type=1400 audit(1792039317.830:65): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 17.895233][ T24] audit: type=1400 audit(1792039317.850:66): avc: denied { unmount } for pid=271 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 17.895377][ T271] cgroup: Unknown subsys name 'devices' [ 17.969938][ T271] cgroup: Unknown subsys name 'hugetlb' [ 17.975530][ T271] cgroup: Unknown subsys name 'rlimit' [ 18.141307][ T24] audit: type=1400 audit(1792039318.090:67): avc: denied { setattr } for pid=271 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 18.164495][ T24] audit: type=1400 audit(1792039318.090:68): avc: denied { mounton } for pid=271 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 18.189180][ T24] audit: type=1400 audit(1792039318.090:69): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 18.213458][ T273] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 18.222305][ T24] audit: type=1400 audit(1792039318.170:70): avc: denied { relabelto } for pid=273 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 18.247712][ T24] audit: type=1400 audit(1792039318.170:71): avc: denied { write } for pid=273 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 18.247723][ T271] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 18.282102][ T24] audit: type=1400 audit(1792039318.170:72): avc: denied { read } for pid=271 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 18.307732][ T24] audit: type=1400 audit(1792039318.170:73): avc: denied { open } for pid=271 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.117983][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.125372][ T279] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.132837][ T279] device bridge_slave_0 entered promiscuous mode [ 19.140937][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.147971][ T279] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.155357][ T279] device bridge_slave_1 entered promiscuous mode [ 19.261566][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.268763][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.276002][ T281] device bridge_slave_0 entered promiscuous mode [ 19.284123][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.291175][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.298690][ T281] device bridge_slave_1 entered promiscuous mode [ 19.317628][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.324719][ T280] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.332091][ T280] device bridge_slave_0 entered promiscuous mode [ 19.341213][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.348315][ T280] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.355544][ T280] device bridge_slave_1 entered promiscuous mode [ 19.375988][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.383041][ T279] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.390321][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.397347][ T279] bridge0: port 1(bridge_slave_0) entered forwarding state [ 19.441003][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.448148][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.455567][ T282] device bridge_slave_0 entered promiscuous mode [ 19.463040][ T284] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.470119][ T284] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.477348][ T284] device bridge_slave_0 entered promiscuous mode [ 19.484142][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.491277][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.498585][ T282] device bridge_slave_1 entered promiscuous mode [ 19.521728][ T284] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.528790][ T284] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.536029][ T284] device bridge_slave_1 entered promiscuous mode [ 19.609790][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.616839][ T281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.624110][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.631144][ T281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 19.639982][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.647013][ T280] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.654286][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.661323][ T280] bridge0: port 1(bridge_slave_0) entered forwarding state [ 19.694010][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.701512][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.709325][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.716416][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.723894][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.731033][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.738650][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 19.745990][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 19.772919][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 19.781307][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.788348][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 19.802066][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 19.810391][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.817414][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.846749][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 19.854287][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 19.862169][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 19.870912][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.877921][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 19.885272][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 19.893146][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 19.901290][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.908308][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.915632][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 19.932674][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 19.940854][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.947861][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 19.955941][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 19.964859][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.971897][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.993271][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.001249][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.019657][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 20.029014][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.036853][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.060690][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 20.069217][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 20.077112][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 20.084701][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 20.092538][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 20.100847][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.108257][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.116322][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.123346][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.130697][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.138817][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.145831][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.153170][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.161014][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.169238][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 20.177072][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 20.184654][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 20.192557][ T279] device veth0_vlan entered promiscuous mode [ 20.200943][ T281] device veth0_vlan entered promiscuous mode [ 20.220205][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 20.229094][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 20.237310][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 20.245458][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.253015][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 20.261682][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.269783][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.276784][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.284374][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 20.292661][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.300828][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.307847][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.315245][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 20.323167][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 20.331072][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 20.338770][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 20.346099][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 20.354410][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 20.362669][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 20.376529][ T282] device veth0_vlan entered promiscuous mode [ 20.386963][ T279] device veth1_macvtap entered promiscuous mode [ 20.393790][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 20.401545][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 20.410482][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 20.418873][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 20.426631][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 20.434745][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 20.442229][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 20.450169][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 20.458346][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.466346][ T280] device veth0_vlan entered promiscuous mode [ 20.476341][ T281] device veth1_macvtap entered promiscuous mode [ 20.489363][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 20.497479][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 20.505674][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 20.513600][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 20.522069][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.530011][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 20.538108][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 20.546432][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 20.554615][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 20.567165][ T282] device veth1_macvtap entered promiscuous mode [ 20.577351][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 20.585585][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 20.593895][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 20.601777][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 20.609927][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 20.618873][ T280] device veth1_macvtap entered promiscuous mode [ 20.632197][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 20.641030][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 20.649592][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 20.649738][ T279] request_module fs-gadgetfs succeeded, but still no fs? [ 20.657876][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 20.673277][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 20.681818][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 20.690106][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 20.705403][ T279] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 20.705684][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 20.723754][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 20.732386][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 20.742179][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 20.755817][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 20.765333][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 20.782269][ T284] device veth0_vlan entered promiscuous mode [ 20.790965][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 20.799467][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 20.807755][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 20.812826][ T307] EXT4-fs (loop4): revision level too high, forcing read-only mode [ 20.817681][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 20.824133][ T307] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=8802c01c, mo2=0002] [ 20.840517][ T307] EXT4-fs (loop4): orphan cleanup on readonly fs [ 20.846914][ T307] EXT4-fs error (device loop4): ext4_orphan_get:1405: inode #13: comm syz.4.7: iget: bad i_size value: 12154761577498 [ 20.859631][ T307] EXT4-fs error (device loop4): ext4_orphan_get:1410: comm syz.4.7: couldn't read orphan inode 13 (err -117) [ 20.873091][ T307] EXT4-fs (loop4): mounted filesystem without journal. Opts: commit=0x0000000000000000,noblock_validity,user_xattr,,errors=continue [ 20.880745][ T284] device veth1_macvtap entered promiscuous mode [ 20.904982][ T307] EXT4-fs warning (device loop4): dx_probe:860: inode #2: comm syz.4.7: dx entry: limit 65535 != root limit 120 [ 20.909529][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 20.917774][ T307] EXT4-fs warning (device loop4): dx_probe:946: inode #2: comm syz.4.7: Corrupt directory, running e2fsck is recommended [ 20.924491][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 20.944944][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 20.953313][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 20.961510][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 20.975001][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 20.983770][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 20.993634][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.002508][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.088945][ T319] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (32298!=35945) [ 21.106145][ T319] EXT4-fs (loop4): revision level too high, forcing read-only mode [ 21.115362][ T319] EXT4-fs (loop4): orphan cleanup on readonly fs [ 21.129477][ T319] EXT4-fs error (device loop4): ext4_read_inode_bitmap:168: comm syz.4.8: Inode bitmap for bg 0 marked uninitialized [ 21.133909][ T325] ================================================================== [ 21.149901][ T325] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0x88e/0x3160 [ 21.155194][ T319] EXT4-fs (loop4): Remounting filesystem read-only [ 21.158047][ T325] Read of size 8 at addr ffff88810df6acd8 by task syz.1.2/325 [ 21.158050][ T325] [ 21.158061][ T325] CPU: 0 PID: 325 Comm: syz.1.2 Not tainted syzkaller #0 [ 21.158067][ T325] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 21.158071][ T325] Call Trace: [ 21.158084][ T325] __dump_stack+0x21/0x24 [ 21.158100][ T325] dump_stack_lvl+0x1a7/0x208 [ 21.169023][ T319] EXT4-fs (loop4): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000000008000,errors=remount-ro,inode_readahead_blks=0x0000000000800000,lazytime, [ 21.172043][ T325] ? show_regs_print_info+0x18/0x18 [ 21.172055][ T325] ? thaw_kernel_threads+0x220/0x220 [ 21.172068][ T325] print_address_description+0x7f/0x2c0 [ 21.172079][ T325] ? tc_setup_flow_action+0x88e/0x3160 [ 21.172091][ T325] kasan_report+0x100/0x140 [ 21.172102][ T325] ? flow_action_cookie_create+0x28/0x90 [ 21.172113][ T325] ? tc_setup_flow_action+0x88e/0x3160 [ 21.172126][ T325] __asan_report_load8_noabort+0x14/0x20 [ 21.172136][ T325] tc_setup_flow_action+0x88e/0x3160 [ 21.172150][ T325] mall_replace_hw_filter+0x2db/0x8c0 [ 21.172162][ T325] ? pcpu_block_update_hint_alloc+0x8b7/0xc50 [ 21.172175][ T325] ? mall_set_parms+0x450/0x450 [ 21.172186][ T325] ? tcf_exts_destroy+0xb0/0xb0 [ 21.172198][ T325] ? pcpu_alloc+0xf8d/0x16c0 [ 21.172211][ T325] ? mall_set_parms+0x1a0/0x450 [ 21.172223][ T325] mall_change+0x546/0x770 [ 21.172234][ T325] ? __kasan_check_write+0x14/0x20 [ 21.172246][ T325] ? mall_get+0xa0/0xa0 [ 21.172255][ T325] ? tcf_chain_tp_insert_unique+0x946/0xa70 [ 21.172273][ T325] tc_new_tfilter+0x1487/0x1ab0 [ 21.323248][ T325] ? mall_get+0xa0/0xa0 [ 21.327398][ T325] ? tcf_gate_entry_destructor+0x20/0x20 [ 21.333031][ T325] ? security_capable+0x87/0xb0 [ 21.337880][ T325] ? ns_capable+0x8c/0xf0 [ 21.342200][ T325] ? netlink_net_capable+0x125/0x160 [ 21.347472][ T325] ? tcf_gate_entry_destructor+0x20/0x20 [ 21.353093][ T325] rtnetlink_rcv_msg+0x811/0xca0 [ 21.358023][ T325] ? unwind_get_return_address+0x4d/0x90 [ 21.363648][ T325] ? rtnetlink_bind+0x80/0x80 [ 21.368320][ T325] ? stack_trace_save+0xa6/0xf0 [ 21.373175][ T325] ? stack_trace_snprint+0xe0/0xe0 [ 21.378280][ T325] ? avc_has_perm+0x168/0x3d0 [ 21.382954][ T325] ? memcpy+0x56/0x70 [ 21.386932][ T325] ? avc_has_perm+0x27f/0x3d0 [ 21.391601][ T325] ? __kasan_slab_alloc+0xc9/0xe0 [ 21.396616][ T325] ? avc_has_perm_noaudit+0x260/0x260 [ 21.401976][ T325] ? entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 21.408118][ T325] ? selinux_nlmsg_lookup+0x398/0x430 [ 21.413481][ T325] netlink_rcv_skb+0x1e9/0x430 [ 21.418237][ T325] ? rtnetlink_bind+0x80/0x80 [ 21.422903][ T325] ? netlink_ack+0xb30/0xb30 [ 21.427482][ T325] ? __netlink_lookup+0x387/0x3b0 [ 21.432497][ T325] rtnetlink_rcv+0x1c/0x20 [ 21.436904][ T325] netlink_unicast+0x86c/0xa30 [ 21.441656][ T325] netlink_sendmsg+0x949/0xb70 [ 21.446408][ T325] ? netlink_getsockopt+0x530/0x530 [ 21.451595][ T325] ? security_socket_sendmsg+0x82/0xa0 [ 21.457061][ T325] ? netlink_getsockopt+0x530/0x530 [ 21.462250][ T325] ____sys_sendmsg+0x5be/0x8f0 [ 21.467003][ T325] ? __sys_sendmsg_sock+0x40/0x40 [ 21.472023][ T325] ? import_iovec+0x7c/0xb0 [ 21.476529][ T325] ___sys_sendmsg+0x236/0x2e0 [ 21.481197][ T325] ? __sys_sendmsg+0x280/0x280 [ 21.485954][ T325] ? alloc_file+0x82/0x580 [ 21.490364][ T325] ? __fdget+0x1a1/0x230 [ 21.494596][ T325] __x64_sys_sendmsg+0x201/0x2d0 [ 21.499523][ T325] ? __kasan_check_write+0x14/0x20 [ 21.504624][ T325] ? ___sys_sendmsg+0x2e0/0x2e0 [ 21.509466][ T325] ? __kasan_check_read+0x11/0x20 [ 21.514480][ T325] ? exit_to_user_mode_prepare+0x9a/0xa0 [ 21.520105][ T325] do_syscall_64+0x31/0x40 [ 21.524513][ T325] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 21.530392][ T325] RIP: 0033:0x7f146abaa559 [ 21.534801][ T325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 21.554397][ T325] RSP: 002b:00007f1469603028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 21.562802][ T325] RAX: ffffffffffffffda RBX: 00007f146ae31fa0 RCX: 00007f146abaa559 [ 21.570768][ T325] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 0000000000000006 [ 21.578733][ T325] RBP: 00007f146ac418b0 R08: 0000000000000000 R09: 0000000000000000 [ 21.586696][ T325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 21.594659][ T325] R13: 00007f146ae32038 R14: 00007f146ae31fa0 R15: 00007fff30d17968 [ 21.602625][ T325] [ 21.604944][ T325] Allocated by task 325: [ 21.609180][ T325] __kasan_kmalloc+0xd4/0x100 [ 21.613862][ T325] __kmalloc+0x19f/0x330 [ 21.618094][ T325] tcf_idr_create+0x5f/0x790 [ 21.622672][ T325] tcf_idr_create_from_flags+0x61/0x70 [ 21.628120][ T325] tcf_gact_init+0x2e6/0x560 [ 21.632702][ T325] tcf_action_init_1+0x443/0x6d0 [ 21.637626][ T325] tcf_action_init+0x227/0x780 [ 21.642381][ T325] tcf_exts_validate+0x23c/0x540 [ 21.647306][ T325] mall_set_parms+0x4a/0x450 [ 21.651885][ T325] mall_change+0x47a/0x770 [ 21.656287][ T325] tc_new_tfilter+0x1487/0x1ab0 [ 21.661125][ T325] rtnetlink_rcv_msg+0x811/0xca0 [ 21.666049][ T325] netlink_rcv_skb+0x1e9/0x430 [ 21.670805][ T325] rtnetlink_rcv+0x1c/0x20 [ 21.675208][ T325] netlink_unicast+0x86c/0xa30 [ 21.679968][ T325] netlink_sendmsg+0x949/0xb70 [ 21.684738][ T325] ____sys_sendmsg+0x5be/0x8f0 [ 21.689492][ T325] ___sys_sendmsg+0x236/0x2e0 [ 21.694155][ T325] __x64_sys_sendmsg+0x201/0x2d0 [ 21.699085][ T325] do_syscall_64+0x31/0x40 [ 21.703490][ T325] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 21.709363][ T325] [ 21.711684][ T325] The buggy address belongs to the object at ffff88810df6ac00 [ 21.711684][ T325] which belongs to the cache kmalloc-256 of size 256 [ 21.725726][ T325] The buggy address is located 216 bytes inside of [ 21.725726][ T325] 256-byte region [ffff88810df6ac00, ffff88810df6ad00) [ 21.738979][ T325] The buggy address belongs to the page: [ 21.744606][ T325] page:ffffea000437da80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10df6a [ 21.754828][ T325] head:ffffea000437da80 order:1 compound_mapcount:0 [ 21.761400][ T325] flags: 0x4000000000010200(slab|head) [ 21.766852][ T325] raw: 4000000000010200 ffffea00043ce500 0000000400000004 ffff888100043200 [ 21.775426][ T325] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 21.784002][ T325] page dumped because: kasan: bad access detected [ 21.790399][ T325] page_owner tracks the page as allocated [ 21.796112][ T325] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 94, ts 3709856992, free_ts 0 [ 21.813293][ T325] prep_new_page+0x176/0x190 [ 21.817875][ T325] get_page_from_freelist+0x225f/0x23f0 [ 21.823407][ T325] __alloc_pages_nodemask+0x29a/0x640 [ 21.828764][ T325] new_slab+0x84/0x3f0 [ 21.832837][ T325] ___slab_alloc+0x2f8/0x4c0 [ 21.837416][ T325] __slab_alloc+0x63/0xa0 [ 21.841734][ T325] kmem_cache_alloc_trace+0x1a8/0x2e0 [ 21.847094][ T325] inode_doinit_use_xattr+0x5d/0x400 [ 21.852368][ T325] inode_doinit_with_dentry+0x82c/0xd70 [ 21.857899][ T325] selinux_d_instantiate+0x27/0x40 [ 21.862997][ T325] security_d_instantiate+0x9e/0xf0 [ 21.868187][ T325] d_splice_alias+0x6d/0x390 [ 21.872769][ T325] ext4_lookup+0x4aa/0x8c0 [ 21.877173][ T325] path_openat+0x145d/0x3040 [ 21.881755][ T325] do_filp_open+0x1df/0x400 [ 21.886247][ T325] do_sys_openat2+0x19f/0x750 [ 21.890905][ T325] page_owner free stack trace missing [ 21.896261][ T325] [ 21.898578][ T325] Memory state around the buggy address: [ 21.904219][ T325] ffff88810df6ab80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.912268][ T325] ffff88810df6ac00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 21.920318][ T325] >ffff88810df6ac80: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc [ 21.928368][ T325] ^ [ 21.935286][ T325] ffff88810df6ad00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.943336][ T325] ffff88810df6ad80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.951386][ T325] ================================================================== [ 21.959451][ T325] Disabling lock debugging due to kernel taint [ 22.347987][ T279] EXT4-fs error (device loop4): ext4_readdir:263: inode #2: block 16: comm syz-executor: path /3/file0: bad entry in directory: inode out of bounds - offset=44, inode=40, rec_len=16, size=1024 fake=0 [ 22.373970][ T279] EXT4-fs error (device loop4): ext4_lookup:1834: inode #2: comm syz-executor: deleted inode referenced: 11 [ 22.387453][ T279] EXT4-fs error (device loop4): ext4_lookup:1834: inode #2: comm syz-executor: deleted inode referenced: 11 [ 22.958784][ T311] device bridge_slave_1 left promiscuous mode [ 22.964962][ T311] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.972692][ T311] device bridge_slave_0 left promiscuous mode [ 22.980652][ T311] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.988931][ T311] device veth1_macvtap left promiscuous mode [ 22.994953][ T311] device veth0_vlan left promiscuous mode