last executing test programs: 720.210873ms ago: executing program 0 (id=1): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x1d, &(0x7f0000000200)=0x9, 0x4) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x1, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000180)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7fe, 0xf83, 0x8}, 0x1c) syz_emit_ethernet(0x32, &(0x7f0000000040)={@link_local, @dev, @val={@val={0x88a8, 0x4, 0x1}, {0x8100, 0x6, 0x0, 0x2}}, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @private, @broadcast}, @address_reply={0x2a}}}}}, 0x0) 598.619098ms ago: executing program 0 (id=6): close(0x3) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xf, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x2}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0x6, 0x4, 0x2003, 0x2}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x15, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffffdffd, 0x0, 0x0, 0x0, 0x800}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x1e00, 0x4a, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r1, 0x2000300, 0xe, 0x0, &(0x7f0000000000)="63eced8e46dc3f0adf3389f7b986", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 559.024516ms ago: executing program 0 (id=8): r0 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) chroot(0x0) 527.247012ms ago: executing program 1 (id=9): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='huge=always,huge=within_size,nr_blocks=5']) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) ftruncate(r0, 0x8008976) fstat(r0, &(0x7f0000000580)) 505.941847ms ago: executing program 1 (id=10): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0x0, 0x0, 0x0, 0x0, 0xd01, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f00000000c0)={0x1d, r1}, 0x10) sendmsg$can_bcm(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="01000000220900"/16, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYBLOB="0000000001"], 0x80}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000640)=ANY=[], 0x48}, 0x1, 0x0, 0x0, 0x2000a041}, 0x800) 482.078292ms ago: executing program 0 (id=11): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1a7) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) r0 = open$dir(&(0x7f0000000040)='./mnt\x00', 0x0, 0x2) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0x4008662c, &(0x7f00000003c0)={@desc={0x1, 0x0, @desc3}, 0x10, 0x0, '\x00', @d}) 457.862136ms ago: executing program 1 (id=12): capset(&(0x7f0000000400)={0x19980330}, &(0x7f0000000040)={0x200000, 0x200000, 0x8000000, 0x0, 0x0, 0x1003}) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001200)={{{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e23, 0x8000, 0x4e1d, 0x3, 0x2, 0x120, 0x20, 0x33, 0x0, 0xffffffffffffffff}, {0x80000000, 0x6, 0x8, 0x3, 0xc, 0x81, 0xff, 0x408}, {0x7, 0x4d, 0x3, 0x4}, 0x85, 0x0, 0x1, 0x0, 0x3}, {{@in=@local, 0x4d6, 0x3c}, 0x2, @in6=@mcast1, 0x0, 0x5, 0x0, 0x0, 0x5, 0x8, 0x1000000}}, 0xe8) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000001280), 0x6) syz_mount_image$fuse(0x0, 0x0, 0x1040022, 0x0, 0x0, 0x0, 0x0) 416.337355ms ago: executing program 0 (id=13): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x8) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @local}, 0x1c) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @remote}, 0x1c) syz_emit_ethernet(0x56, &(0x7f0000000200)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x20, 0x6, 0x40, @remote, @local, {[], {{0x4e22, 0x4e22, 0x0, 0x41424344, 0x0, 0x0, 0x8, 0x18, 0x1001, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0x2800}]}}}}}}}}, 0x0) setxattr$trusted_overlay_redirect(0x0, 0x0, 0x0, 0x0, 0x2) 410.016076ms ago: executing program 1 (id=14): syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000040)='./file1\x00', 0x0, &(0x7f0000000000)=ANY=[@ANYRES8=0x0], 0x1, 0x1c2, &(0x7f00000002c0)="$eJzslb+v0lAUx7+3hZIaE1x10UQScLC/UCODA3F00ESjcYNIIWgRAx2ACf4KZ2cHZ+JC4p+hgzqZKG5OJq8vt719va/hQeD1kZe88xluv+09HM45XL4FQRAXlp8//n3/VC7pXF9GCQXx/JeaxChS/Lz4/9bX7uPP762/3+aLR7VUOm3b788BWNRV+OI+CIJA3i+J6zMosc6jkey/AIMhdAMKngvtguGl0K8l3efxhtHueq7xqu+1uLD4YvPF4Us1Xd9yxtCS6mPS/nA8edP0PHdwevGQl71qa9P8lnUFD6T65N8rno2VzA82FNhCV8HwVOj7KMSziUYi9X8tl+RXz6b/DMTvzBIyYMr7O7alY4eEV4sbYvI4D6PLXMT/kiwS6omz7LML0cJ0q0+x8JD80fdbalbio5468zuLxJ+CDwxlyZ9ykn+Yfu+dORxPbnd7zY7bcd86TvWedcey7jpmaERm+8t6/9NDf7ok5c+fEKsxDaOm7w/saD26d0YF+ANnleNqof8pqNyMqmYrXnLhMbnCbvBLRQUOgoh1dRMEQRAEQRAEQRAEQRAEQWzPdbBZkKaG9BPnSRh9GAAA///djGbI") r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x40) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3000004, 0x10012, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x20, 0x0, 0x5, 0x1, 0x21dfdbfc, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x20004044}, 0x0) 365.853475ms ago: executing program 2 (id=3): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.effective_mems\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.effective_mems\x00', 0x275a, 0x0) fcntl$lock(r1, 0x26, &(0x7f0000000100)={0x0, 0x1, 0x80000000000036, 0xc1b2}) fcntl$lock(r0, 0x6, &(0x7f0000000140)={0x1, 0x1, 0x0, 0x8000000000000}) r2 = syz_open_procfs(0x0, &(0x7f0000000540)='fdinfo/4\x00') read$FUSE(r2, &(0x7f00000040c0)={0x2020}, 0x2020) 279.090423ms ago: executing program 4 (id=5): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x35, &(0x7f0000000000)=0x8000, 0x4) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f0000000040)=0x100008, 0x4) recvmmsg(r0, &(0x7f0000000500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=""/16, 0x10}, 0x68000}], 0x1, 0x10002, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) 254.028268ms ago: executing program 2 (id=15): r0 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x0, 0x3938700}}, 0x0) symlinkat(0x0, 0xffffffffffffff9c, 0x0) 218.065985ms ago: executing program 3 (id=4): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x80487436, 0x0) 173.789314ms ago: executing program 2 (id=16): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000bff000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@in_dx={0x69, 0x20, {0x21e4, 0x4}}], 0x20}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 167.648676ms ago: executing program 4 (id=17): prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = creat(&(0x7f0000000040)='./bus\x00', 0x104) io_setup(0x3, &(0x7f0000000280)=0x0) io_submit(r1, 0x1, &(0x7f0000000540)=[&(0x7f0000000180)={0x25, 0x0, 0x1f, 0x1, 0x0, r0, 0x0, 0x0, 0xa00, 0x0, 0x0, r0}]) 151.840859ms ago: executing program 3 (id=18): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x6, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="18020000fdffffff0000000000000000850000002c00000095"], &(0x7f0000000040)='GPL\x00', 0x5, 0xbf, &(0x7f00000020c0)=""/191}, 0x80) bpf$ENABLE_STATS(0x20, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000500)={r1, r2, 0x25, 0x0, @val=@iter={0x0}}, 0x20) syz_emit_ethernet(0x2a, &(0x7f0000000680)=ANY=[], 0x0) 146.84705ms ago: executing program 1 (id=19): setns(0xc9, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000001040)='ns/net\x00') sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002340)=@newlink={0x3c, 0x10, 0xffffffffffffffff, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x50a32, 0x823}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_NET_NS_FD={0x8, 0x1c, r1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4004080}, 0x8ae257a062cc3564) 110.077238ms ago: executing program 3 (id=20): syz_mount_image$fuse(0x0, &(0x7f0000000080)='./file0\x00', 0x234a0c7, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x10) syz_mount_image$fuse(0x0, &(0x7f0000000000)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@index_on}]}) chdir(&(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(&(0x7f0000000200)='./file1\x00', &(0x7f0000000240), 0x0, 0x0, 0x1) 97.01282ms ago: executing program 1 (id=21): syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x2080, 0x0, 0x0, 0x0, 0x0) pipe2$9p(&(0x7f0000001900), 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000080)="390000001300090600000000000000000000ff3f08000000480100100000000019002b000a0001000500000000000072080003000500000000", 0x39}], 0x1) 80.113634ms ago: executing program 3 (id=22): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuset.memory_pressure\x00', 0x26e1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x4, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x41100, 0x70, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000480)=[r0, r0, 0xffffffffffffffff, r0, r0], 0x0, 0x10, 0x9}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x2c, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xe}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r2, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000d80)=@newtaction={0x68, 0x30, 0xffff, 0x4000, 0x0, {0x0, 0x0, 0x1300}, [{0x54, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x7f, 0x29b9, 0xc0000000, 0x3, 0x7}, 0x3, r3}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x24004080}, 0x0) 67.536866ms ago: executing program 4 (id=23): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/net/ipv6/fib_multipath_hash_policy\x00', 0x1, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs_dir/buffer_subbuf_size_kb\x00', 0x0, 0x0) read$FUSE(r0, 0x0, 0x0) 31.458584ms ago: executing program 4 (id=24): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r0, &(0x7f0000000340)='dummy_udc.0', 0xb) 16.646186ms ago: executing program 2 (id=25): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/net/ipv4/ip_forward\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='1', 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/sys/net/ipv4/conf/all/forwarding\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='0', 0x1) 0s ago: executing program 3 (id=26): syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="00ea2eb34e7ea51c9446c55a2d1e0be39af9faf44ad59cb6ad1c94490d970e811439edddc71c9b18946b559ce53bee0a1abe562fc3f3898e5826eda1962cf6e3c4c0ade52151923a70b46eacfc1aaaebcf156e549e884bcabc1333f344f31cd30cd93cb2814e0dbc24a7a107e295e86e09283c825fe177c89c6385f68f2c843cffffffff15539bab6142ceed9265ba989d1a283fc4ffc83f3a7a6c746823e656ad78f3b5a336cdbd83dad59e0debb36b4ea5e658e253f01637cc03f704a08019f95b92fffffffff8dd21552d6967ab1b01e5d52a5793eb179deee4572770a5197127b090287bca2a4eaa1705b42c16968d0201d3ba3cc8000000657ea095f152b1b6a1e6ad8d24ad17f649ccc23d4ecbcdb5620cc48f95f563c2230f859d196e6c4f00b8e3a7b01fcb1d79dcc09b7a854ec8c31dd27ff9b4a2864e1dcaf719d20b56769d51228ecc1915fb8c8b598c11b3c296b05f9c5355fc6f19a7b28f5ae9a0d0804ccc5716cfac0246ddffa2f12077a02a959aa1b74373c38b2bcc90743b80666eae25dea73e127263b8fdbc64fe862b994ca8473d0000000000000000"], 0x1, 0x1b0, &(0x7f0000000640)="$eJzslDGPEkEUx/8zC7tuYoRWKxNJxMJld1EjhQW1hSYajZ1EVoIuYmALoPNTWPsxiA3fQwu96hquu+qKuczsLAzk7uAuB1vc+xVv/rP7dubN28kfBEHcWA7+H//jqLhS30YFjn5+aC1zuJE/LZ08+tN99funf/R3OnvZWF+PARBi+/0LAGZNC4meC7H6dUWPb8EzXTTfvweDp/VHcLzTOgLDB62/GLov8z3vczeOvE/9uC2FL0MgQyhDfb2++Q+GdipVicx4PxxPvrbiOBrsUGzq37zJ8cLon/m/st744FbWywAcgdZ1MLzR+jmcrDdpS4zz3yss17eudn55k3bfrC3EHV37fja9W9qQU0Su3di/kFdp7CLvMi4UtzIfufTnDOqqK/I+RZ5i6U/iF8NDw58Khn/Ukt732nA8edzttTpRJ/oWhvVn/hPffxrWlBGlccXz7BX/c5U/wVi/eI5X2szGqJUkgyCNi3k4cpAMwrMc11b+x1F9kFbN1vbPnqHM7suhauk5QRAEQRAEQRAEQRAEQRDEtVLWo1C4CyUamRDCSYfwtco8DQAA//8J4Fqh") r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r0, 0x1000) read(r0, &(0x7f0000000200)=""/189, 0xbd) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) syz_mount_image$ext4(&(0x7f00000001c0)='ext2\x00', &(0x7f0000000140)='./file2\x00', 0x1881e, &(0x7f0000000100)={[{@i_version}, {@nogrpid}, {@quota}]}, 0xff, 0x51d, &(0x7f0000001000)="$eJzs3c9vI1cdAPDveDeJdzdttqUHQNBd2sKCVutsvG1U9QDlhBCqhOgRpG1IvFEUO45ipzRhD+kRcUWiEic48gdw7ok7FwQ3LuWAxI8I1CBxGDTjSdbJ2l0rP+zI/nyk0byZZ/v7np15b/312i+AiXU7IvYiYjoi3ouIueJ8UmzxdmfLbvfp/uPlg/3Hy0mk6bv/TPL67Fx03Sdzo3jMckT84DsRP06ejtva2V1fqtdrW8XxfLuxOd/a2b231lhara3WNqrVxYXF+28+eKN6bn291ZguSl/+5A973/hp1qzZ4kx3P85Tp+tTR3EyVyPiexcRbASuFP2ZHnVDOJVSRLwYEa/k1/9cXMlfTQBgnKXpXKRz3ccAwLgr5TmwpFQpcgGzUSpVKp0c3ktxvVRvttp3HzW3N1Y6ubKbMVV6tFav3S9yhTdjKsmOF/Lyk+PqieMHEfFCRPxi5lp+XFlu1ldG+Q8fAJhgN07M//+Z6cz/AMCYK/etmRpqOwCA4ek//wMA48r8DwCTx/wPAJOnM/9fG3UzAIAh8v4fACaP+R8AJsr333kn29KD4vevV97f2V5vvn9vpdZarzS2lyvLza3NymqzuZr/Zk/jWY9XbzY3F16P7Q9ufnOz1Z5v7ew+bDS3N9oP89/1fljrfKFwbwg9AwD6eeHWx39Oshn5rWv5Fl1rOfjyP4y30qgbAIzMlVPcxwpBMB5cyzC5zvAeX3oAxkSPJXqPKff6glCapunFNQm4YHe+IP8Pk6or/+9/AcOEOU3+HxgP8v8wudI0GXTN/xj0hgDA5SbHD/T5/P/FYv/b4sOBH62cvMVHF9kqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAuNwO1/+tFGuBz0apVKlEPBcRN2MqebRWr92PiOcj4k8zUzPZ8cKI2wwAnFXpb0mx/teduddmj1W9fOOoOB0RP/nVu7/8YKnd3vpjxHTyr5nD8+2PivPV4bceAHi2w3k633e9kf90//Hy4TbM9vz92xFR7sQ/2J+Og6P4V+Nqvi/HVERc/3dSHHckXbmLs9j7MCI+36v/SczmOZDOyqcn42exnxtq/NKx+KW8rrPPnovPnUNbYNJ8nI0/b/e6/kpxO9/3vv7L+Qh1dsX4lz3U8kE+Bj6Jfzj+Xekz/t0eNMbrv/9up3Tt6boPI754NeIw9kHX+HMYP+kT/7UB4//lSy+/0q8u/XXEnegdvzvWfLuxOd/a2b231lhara3WNqrVxYXF+28+eKM6n+eo5/vPBv946+7z/eqy/l/vE7+cv7vt6NX/rw7Y/9/8770ffuUz4n/91U789MTr/1K+7/38Z3Pi1waMv3T9d+V+dVn8lT79f9brf3fA+J/8dffksuEzA94VALgArZ3d9aV6vbZVFG4lEcfPKChcmkL2J9uz6mel3n/PQyx8a1ixpqN31c9f7TwHJ6rS9FSx+o0Y55F1Ay6Do4s+Iv57vOrpZBEAAAAAAAAAAAAAADASw/jG0qj7CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwPj6fwAAAP//fdHKuw==") kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.43' (ED25519) to the list of known hosts. [ 22.332161][ T28] audit: type=1400 audit(1790268580.284:64): avc: denied { mounton } for pid=278 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.335635][ T278] cgroup: Unknown subsys name 'net' [ 22.354925][ T28] audit: type=1400 audit(1790268580.284:65): avc: denied { mount } for pid=278 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.382202][ T28] audit: type=1400 audit(1790268580.324:66): avc: denied { unmount } for pid=278 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.382689][ T278] cgroup: Unknown subsys name 'devices' [ 22.528909][ T278] cgroup: Unknown subsys name 'hugetlb' [ 22.534622][ T278] cgroup: Unknown subsys name 'rlimit' [ 22.640091][ T28] audit: type=1400 audit(1790268580.594:67): avc: denied { setattr } for pid=278 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.663333][ T28] audit: type=1400 audit(1790268580.594:68): avc: denied { mounton } for pid=278 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.688159][ T28] audit: type=1400 audit(1790268580.594:69): avc: denied { mount } for pid=278 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.716316][ T280] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 22.725268][ T28] audit: type=1400 audit(1790268580.684:70): avc: denied { relabelto } for pid=280 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.751138][ T28] audit: type=1400 audit(1790268580.684:71): avc: denied { write } for pid=280 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.765362][ T278] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.777707][ T28] audit: type=1400 audit(1790268580.714:72): avc: denied { read } for pid=278 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.810943][ T28] audit: type=1400 audit(1790268580.714:73): avc: denied { open } for pid=278 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.064666][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.071866][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.079402][ T286] device bridge_slave_0 entered promiscuous mode [ 24.105985][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.113091][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.120716][ T286] device bridge_slave_1 entered promiscuous mode [ 24.167701][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.174782][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.182304][ T287] device bridge_slave_0 entered promiscuous mode [ 24.189197][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.196253][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.203847][ T290] device bridge_slave_0 entered promiscuous mode [ 24.210662][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.217773][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.225190][ T289] device bridge_slave_0 entered promiscuous mode [ 24.235543][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.242617][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.250166][ T289] device bridge_slave_1 entered promiscuous mode [ 24.259324][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.266373][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.273877][ T287] device bridge_slave_1 entered promiscuous mode [ 24.280510][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.287605][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.294963][ T290] device bridge_slave_1 entered promiscuous mode [ 24.350350][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.357467][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.364833][ T288] device bridge_slave_0 entered promiscuous mode [ 24.373764][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.380916][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.388375][ T288] device bridge_slave_1 entered promiscuous mode [ 24.556185][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.563298][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.570655][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.577728][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.601364][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.608574][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.615862][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.622952][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.641181][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.648276][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.655577][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.662647][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.673274][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.680358][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.687663][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.694716][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.712821][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.719924][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.727259][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.734304][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.754679][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.762135][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.769537][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.777287][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.784531][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.791817][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.799527][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.806699][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.814016][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.821293][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.829414][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.836928][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.879242][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.887242][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.894910][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.903313][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.910406][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.918969][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.927213][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.934255][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.941684][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.949913][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.957055][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.972660][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.981046][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.988119][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.995586][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.004695][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.011787][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.019205][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.027443][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.034470][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.057362][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 25.064957][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.072449][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.082035][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.090380][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.097455][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.104954][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 25.112541][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.120061][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.128154][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.154281][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.162729][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.170880][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.179524][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.188331][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.196369][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.204499][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.212877][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.221226][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.228293][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.235806][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.244390][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.252915][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.261413][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.269842][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.276912][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.284267][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.292471][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.316193][ T286] device veth0_vlan entered promiscuous mode [ 25.324159][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.332763][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.341902][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.348983][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.356445][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.365271][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.373437][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.381911][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.390637][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.398767][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.407005][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.414586][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.428879][ T287] device veth0_vlan entered promiscuous mode [ 25.437091][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.445778][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.454268][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.462532][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.470658][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.478778][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.486670][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.497521][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.505079][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.519106][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.527465][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.535483][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.544999][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.562057][ T286] device veth1_macvtap entered promiscuous mode [ 25.569749][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.578091][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.586265][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.594584][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.602918][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.613130][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.624923][ T287] device veth1_macvtap entered promiscuous mode [ 25.632742][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.640435][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.648455][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.662368][ T289] device veth0_vlan entered promiscuous mode [ 25.677471][ T288] device veth0_vlan entered promiscuous mode [ 25.687510][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.695577][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.703281][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.711061][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.719534][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.728045][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.736271][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.745697][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.754153][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.762636][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.771176][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.797749][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.806641][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.806975][ T287] request_module fs-gadgetfs succeeded, but still no fs? [ 25.815803][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.835870][ T290] device veth0_vlan entered promiscuous mode [ 25.856627][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.876999][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.885142][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.893778][ T312] ======================================================= [ 25.893778][ T312] WARNING: The mand mount option has been deprecated and [ 25.893778][ T312] and is ignored by this kernel. Remove the mand [ 25.893778][ T312] option from the mount to silence this warning. [ 25.893778][ T312] ======================================================= [ 25.910238][ T289] device veth1_macvtap entered promiscuous mode [ 25.941266][ T288] device veth1_macvtap entered promiscuous mode [ 25.955308][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.982354][ T318] Illegal XDP return value 4294967274 on prog (id 1) dev N/A, expect packet loss! [ 25.984487][ T290] device veth1_macvtap entered promiscuous mode [ 26.007700][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.043952][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.064055][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.075384][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.089552][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.098162][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.112863][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.115751][ T332] capability: warning: `syz.1.12' uses 32-bit capabilities (legacy support in use) [ 26.125024][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.146306][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.173069][ T336] loop1: detected capacity change from 0 to 16 [ 26.180710][ T336] erofs: (device loop1): mounted with root inode @ nid 36. [ 26.192336][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.209951][ T336] erofs: (device loop1): z_erofs_readahead: readahead error at page 4 @ nid 89 [ 26.220920][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.229786][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.235420][ T336] erofs: (device loop1): z_erofs_readahead: readahead error at page 3 @ nid 89 [ 26.240339][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.248579][ T336] syz.1.14: attempt to access beyond end of device [ 26.248579][ T336] loop1: rw=524288, sector=34359738360, nr_sectors = 8 limit=16 [ 26.271539][ T336] syz.1.14: attempt to access beyond end of device [ 26.271539][ T336] loop1: rw=524288, sector=104, nr_sectors = 32 limit=16 [ 26.293281][ T336] syz.1.14: attempt to access beyond end of device [ 26.293281][ T336] loop1: rw=524288, sector=8, nr_sectors = 96 limit=16 [ 26.311212][ T336] syz.1.14: attempt to access beyond end of device [ 26.311212][ T336] loop1: rw=0, sector=34359738360, nr_sectors = 8 limit=16 [ 26.333171][ T336] syz.1.14: attempt to access beyond end of device [ 26.333171][ T336] loop1: rw=0, sector=34359738360, nr_sectors = 8 limit=16 [ 26.347927][ T336] syz.1.14: attempt to access beyond end of device [ 26.347927][ T336] loop1: rw=0, sector=34359738360, nr_sectors = 8 limit=16 [ 26.362311][ T336] syz.1.14: attempt to access beyond end of device [ 26.362311][ T336] loop1: rw=0, sector=34359738360, nr_sectors = 8 limit=16 [ 26.428038][ T350] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 26.508306][ T363] device sit0 entered promiscuous mode [ 26.515409][ T363] netlink: 'syz.1.21': attribute type 1 has an invalid length. [ 26.523328][ T363] netlink: 1 bytes leftover after parsing attributes in process `syz.1.21'. [ 26.556429][ T368] Config c/1 of g1 needs at least one function. [ 26.570833][ T368] udc dummy_udc.0: failed to start g1: -22 [ 26.577128][ C1] ================================================================== [ 26.585246][ C1] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x6c/0xb0 [ 26.592692][ C1] Read of size 8 at addr ffff888133356990 by task syz.0.13/333 [ 26.600264][ C1] [ 26.602614][ C1] CPU: 1 PID: 333 Comm: syz.0.13 Not tainted syzkaller #0 [ 26.609762][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 26.619878][ C1] Call Trace: [ 26.623219][ C1] [ 26.626218][ C1] __dump_stack+0x21/0x24 [ 26.630610][ C1] dump_stack_lvl+0x110/0x170 [ 26.635334][ C1] ? __cfi_dump_stack_lvl+0x8/0x8 [ 26.640412][ C1] ? debug_smp_processor_id+0x17/0x20 [ 26.645886][ C1] ? rcu_cblist_dequeue+0x6c/0xb0 [ 26.650957][ C1] print_address_description+0x71/0x200 [ 26.651298][ T372] loop3: detected capacity change from 0 to 16 [ 26.656549][ C1] print_report+0x4a/0x60 [ 26.656577][ C1] kasan_report+0x122/0x150 [ 26.671608][ C1] ? rcu_cblist_dequeue+0x6c/0xb0 [ 26.674310][ T372] erofs: (device loop3): mounted with root inode @ nid 36. [ 26.676701][ C1] __asan_report_load8_noabort+0x14/0x20 [ 26.689623][ C1] rcu_cblist_dequeue+0x6c/0xb0 [ 26.694517][ C1] rcu_do_batch+0x4bc/0xc30 [ 26.699054][ C1] ? rcu_core+0xf00/0xf00 [ 26.703401][ C1] rcu_core+0x486/0xf00 [ 26.707570][ C1] ? kvm_sched_clock_read+0x18/0x40 [ 26.712806][ C1] ? sched_clock+0x9/0x10 [ 26.717166][ C1] ? rcu_cpu_kthread_park+0x90/0x90 [ 26.722377][ C1] ? kvm_sched_clock_read+0x18/0x40 [ 26.727612][ C1] ? irqtime_account_irq+0x75/0x240 [ 26.732836][ C1] rcu_core_si+0x9/0x10 [ 26.737020][ C1] handle_softirqs+0x1d7/0x600 [ 26.741806][ C1] __irq_exit_rcu+0x52/0xf0 [ 26.746325][ C1] irq_exit_rcu+0x9/0x10 [ 26.750583][ C1] sysvec_apic_timer_interrupt+0x58/0xc0 [ 26.756234][ C1] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 26.762261][ C1] RIP: 0033:0x7f8629f592b8 [ 26.766701][ C1] Code: 75 40 a8 10 75 3c 41 51 4c 8d 9b 08 03 00 00 49 89 c9 48 89 f1 41 50 48 8b 74 24 20 49 89 d0 48 89 fa 4c 89 df e8 a8 56 00 00 <8b> 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 [ 26.786319][ C1] RSP: 002b:00007fff146d7090 EFLAGS: 00000246 [ 26.792398][ C1] RAX: 0000000000000000 RBX: 0000555567f17500 RCX: 00007f8629f5e98e [ 26.800383][ C1] RDX: 00007fff146d70e0 RSI: 0000000000000000 RDI: 0000000000000000 [ 26.808368][ C1] RBP: 00007f862a227da0 R08: 0000000000000000 R09: 0000000000000000 [ 26.816362][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000006957 [ 26.824346][ C1] R13: 00007f862a22609c R14: 00000000000066b6 R15: 00007f862a226090 [ 26.832335][ C1] [ 26.835371][ C1] [ 26.837711][ C1] Allocated by task 346: [ 26.841956][ C1] kasan_set_track+0x4b/0x70 [ 26.846565][ C1] kasan_save_alloc_info+0x1f/0x30 [ 26.851694][ C1] __kasan_kmalloc+0x95/0xb0 [ 26.856315][ C1] __kmalloc+0xb4/0x1e0 [ 26.860488][ C1] l2tp_session_create+0x38/0xbd0 [ 26.865536][ C1] pppol2tp_connect+0xbf5/0x1640 [ 26.870498][ C1] __sys_connect+0x3da/0x460 [ 26.875105][ C1] __x64_sys_connect+0x7a/0x90 [ 26.879890][ C1] x64_sys_call+0x88d/0x9a0 [ 26.884423][ C1] do_syscall_64+0x4c/0xa0 [ 26.888860][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 26.894763][ C1] [ 26.897091][ C1] Freed by task 10: [ 26.900913][ C1] kasan_set_track+0x4b/0x70 [ 26.905520][ C1] kasan_save_free_info+0x2b/0x40 [ 26.910571][ C1] ____kasan_slab_free+0x132/0x180 [ 26.915708][ C1] __kasan_slab_free+0x11/0x20 [ 26.920495][ C1] slab_free_freelist_hook+0xc2/0x190 [ 26.925876][ C1] __kmem_cache_free+0xb7/0x1b0 [ 26.930742][ C1] kfree+0x6f/0xf0 [ 26.934494][ C1] l2tp_session_put+0xaf/0x1a0 [ 26.939276][ C1] l2tp_session_delete+0x3df/0x4d0 [ 26.944405][ C1] l2tp_tunnel_del_work+0x199/0x410 [ 26.949621][ C1] process_one_work+0x717/0xc30 [ 26.954481][ C1] worker_thread+0xa4d/0x11d0 [ 26.959167][ C1] kthread+0x281/0x320 [ 26.963259][ C1] ret_from_fork+0x1f/0x30 [ 26.967697][ C1] [ 26.970043][ C1] Last potentially related work creation: [ 26.975810][ C1] kasan_save_stack+0x3a/0x60 [ 26.980529][ C1] __kasan_record_aux_stack+0xb6/0xc0 [ 26.985926][ C1] kasan_record_aux_stack_noalloc+0xb/0x10 [ 26.991748][ C1] call_rcu+0xcf/0xf50 [ 26.995845][ C1] pppol2tp_release+0x1e3/0x2b0 [ 27.000714][ C1] sock_close+0xc9/0x220 [ 27.004987][ C1] __fput+0x1fd/0x8f0 [ 27.008989][ C1] ____fput+0x15/0x20 [ 27.013002][ C1] task_work_run+0x1e1/0x250 [ 27.017628][ C1] do_exit+0xb0d/0x29f0 [ 27.021804][ C1] __cfi___ia32_sys_exit+0x0/0x10 [ 27.026871][ C1] x64_sys_call+0x67/0x9a0 [ 27.031324][ C1] do_syscall_64+0x4c/0xa0 [ 27.035760][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 27.041667][ C1] [ 27.044004][ C1] The buggy address belongs to the object at ffff888133356800 [ 27.044004][ C1] which belongs to the cache kmalloc-512 of size 512 [ 27.058068][ C1] The buggy address is located 400 bytes inside of [ 27.058068][ C1] 512-byte region [ffff888133356800, ffff888133356a00) [ 27.071374][ C1] [ 27.073706][ C1] The buggy address belongs to the physical page: [ 27.080125][ C1] page:ffffea0004ccd500 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x133354 [ 27.090390][ C1] head:ffffea0004ccd500 order:2 compound_mapcount:0 compound_pincount:0 [ 27.098718][ C1] flags: 0x4000000000010200(slab|head|zone=1) [ 27.104813][ C1] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 [ 27.113413][ C1] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 27.122002][ C1] page dumped because: kasan: bad access detected [ 27.128426][ C1] page_owner tracks the page as allocated [ 27.134162][ C1] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x152a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 19, tgid 19 (kworker/0:1), ts 26375314596, free_ts 0 [ 27.153536][ C1] post_alloc_hook+0x1f5/0x210 [ 27.158328][ C1] prep_new_page+0x1c/0x110 [ 27.162863][ C1] get_page_from_freelist+0x2ca9/0x2d20 [ 27.168443][ C1] __alloc_pages+0x1fa/0x610 [ 27.173059][ C1] alloc_slab_page+0x6e/0xf0 [ 27.177663][ C1] new_slab+0x98/0x3e0 [ 27.181745][ C1] ___slab_alloc+0x70f/0xb70 [ 27.186353][ C1] __slab_alloc+0x5e/0xa0 [ 27.190704][ C1] __kmem_cache_alloc_node+0x204/0x2d0 [ 27.196179][ C1] __kmalloc+0xa4/0x1e0 [ 27.200342][ C1] ___neigh_create+0x6e3/0x1db0 [ 27.205218][ C1] __neigh_create+0x31/0x40 [ 27.209741][ C1] ip6_finish_output2+0xaaf/0x18b0 [ 27.214859][ C1] ip6_finish_output+0x60b/0xbe0 [ 27.219817][ C1] ip6_output+0x1fa/0x410 [ 27.224178][ C1] ndisc_send_skb+0x7c8/0xcd0 [ 27.228878][ C1] page_owner free stack trace missing [ 27.234287][ C1] [ 27.236623][ C1] Memory state around the buggy address: [ 27.242260][ C1] ffff888133356880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.250346][ C1] ffff888133356900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.258418][ C1] >ffff888133356980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.266478][ C1] ^ [ 27.271089][ C1] ffff888133356a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.279161][ C1] ffff888133356a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.287228][ C1] ================================================================== [ 27.295357][ C1] Disabling lock debugging due to kernel taint [ 27.317498][ T368] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 27.325503][ T368] UDC core: g1: couldn't find an available UDC or it's busy [ 27.344078][ T28] kauditd_printk_skb: 72 callbacks suppressed [ 27.344093][ T28] audit: type=1400 audit(1790268585.294:146): avc: denied { unmount } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 27.392284][ T372] syz.3.26: attempt to access beyond end of device [ 27.392284][ T372] loop3: rw=524288, sector=8, nr_sectors = 24 limit=16 [ 27.405918][ T372] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -11 in[50, 4046] out[4096] [ 27.420415][ T372] syz.3.26: attempt to access beyond end of device [ 27.420415][ T372] loop3: rw=0, sector=16, nr_sectors = 8 limit=16 [ 27.434393][ T372] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -11 in[50, 4046] out[9000] [ 27.445552][ T372] syz.3.26: attempt to access beyond end of device [ 27.445552][ T372] loop3: rw=0, sector=16, nr_sectors = 8 limit=16 [ 27.458759][ T372] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -11 in[50, 4046] out[9000] [ 27.471050][ T372] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -11 in[50, 4046] out[9000]