last executing test programs: 405.243254ms ago: executing program 1 (id=6): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing/synthetic_events\x00', 0x101000, 0x0) write(r0, 0x0, 0x0) 397.025935ms ago: executing program 1 (id=7): r0 = timerfd_create(0x7, 0x80000) timerfd_settime(r0, 0x3, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, 0x0) timerfd_gettime(r0, 0x0) readv(r0, &(0x7f0000000180)=[{&(0x7f00000000c0)=""/173, 0xad}], 0x1) 380.198139ms ago: executing program 1 (id=8): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x28) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f00000005c0)=ANY=[@ANYBLOB="180000000000000000000000000000009500000000000000c319b2afffba969b38cf4de343a00d1d011b97d0cb91b70fcb0f374ca29506a7ba68bbd0fc635434ec92e2e725028fc0e886fd8b49765629039740b70ff58edde9d0bd920be2648b33a3a53724d7a4fd1cc896f8a7bbfe55dd39e358d4401e4a86d266abfb74bce739b919bac0c87dce1bdc5cb5ff3881ced037b6cc0f0d9b5bc650b6b03f86dfc3e3e87b94abf06de190ee6800b18be11eaa2caa8d693f4850697195a482277f4702ed368f320c72c8d29385b526efc0763aae61c145cd34289cdfddd2deddbc77de3c1372787d82a2bb00df746fccb1b01fd85815abc4b2cd3d8a3e0ce5c932be454104e9a4e84d867c11d790012d548598251be2be276972b599b391b32ca8ecfecec3dc429112d207a2b02eaee36b66e383968b2b764d4d308414626504bd95f131d3c3fb146a1339588d49be4a5de97f35ec3d4385957603637ce90275b9088ff97ffaed13121b2bca31bf489b47a81d2f9bf01a593d2c031fa7674f1fa75d13bdc3b512a43d962cd3bb52e56db77dd19f55acd55170b872324d985982db8d3c39c70c9b99bd2671d4d7a58ea69754e8b69055c2f2a7f70dd0768d5b05a769904e393bf95afe35261fbd358719fd01e86aebfd96a770a7bcc0e611cf173c4f1c6b6a50731d872d9afa7eb32aa59dae737d86c1fdd25a9e022376a3921132c5560a"], &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @sock_ops, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1}, 0x6d) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000002040)={0x0, 0x0, 0x0, 0x0, 0x2248}, 0x38) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000000)={r1, 0xe0, &(0x7f0000001a40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000021c0), 0x8, 0x0, 0x8, 0x0, 0x0}}, 0x10) 208.332716ms ago: executing program 2 (id=3): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newqdisc={0x40, 0x24, 0xf0b, 0x10000, 0x0, {0x60, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_LIMIT={0x8}]}}]}, 0x40}}, 0x0) 192.099469ms ago: executing program 0 (id=1): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newqdisc={0x30, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000140)=@newtfilter={0x48, 0x2c, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x7}, {0xfff1, 0xffff}, {0x3, 0x1}}, [@filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x8, 0x3}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x1}]}}]}, 0x48}}, 0x40000) sendmsg$nl_route_sched(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)=@deltfilter={0x24, 0x2d, 0x5, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x1}, {0xfff1, 0xffff}, {0x3, 0x1}}}, 0x24}}, 0x0) 129.921322ms ago: executing program 2 (id=9): timer_create(0x2, 0x0, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{}, {0x0, 0x989680}}, 0x0) clock_nanosleep(0x2, 0x0, &(0x7f0000000040)={0x0, 0x989680}, 0x0) syz_clone(0x40842300, 0x0, 0x0, 0x0, 0x0, 0x0) 105.419008ms ago: executing program 1 (id=10): bpf$ENABLE_STATS(0x20, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f0000000140)=[{0x20, 0xfe, 0x0, 0xfffff024}, {0x30, 0x0, 0x0, 0x8}, {0x6, 0x0, 0x4}]}, 0x10) sendmmsg(r0, &(0x7f0000001c00), 0x400000000000159, 0x40840) 58.647728ms ago: executing program 1 (id=11): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/vtconsole/vtcon0/bind\x00', 0x2, 0x0) read(r0, &(0x7f0000000000)=""/17, 0x11) 50.493759ms ago: executing program 4 (id=5): syz_mount_image$vfat(&(0x7f0000001040), &(0x7f0000000240)='./file1\x00', 0x804, &(0x7f0000002380)={[{@iocharset={'iocharset', 0x3d, 'cp949'}}, {@shortname_winnt}, {@utf8}, {@shortname_mixed}, {@uni_xlateno}, {@fat=@flush}, {@rodir}, {@utf8}, {@rodir}, {@fat=@codepage={'codepage', 0x3d, '936'}}, {@shortname_mixed}, {@rodir}, {@iocharset={'iocharset', 0x3d, 'macgreek'}}, {@utf8no}, {@rodir}, {@rodir}]}, 0x1, 0x28e, &(0x7f0000001500)="$eJzs3c1qO1UUAPAz+c6/i2ThSoQO6MJVaX2CFqkgFgQlC3WhxaYgTSi0EKiKsSufwCdw48u4EV/AB1Dc2YU4kk4+yyS2kjbF/++3upxzT+fcm9t0NbefvdY/Ozm/PL3++tdoNJIo7cd+3CTRjlJMfBuFfvm9OA4APHM3WRZ/ZLl6HrpanFFdUlkpPXpzAMCjmP/7v+leAICn8eFHH793cHR0+EGaNiL63w06SURjlj84jS+iF93YjVb8FZFN5eN33j06jEo60o43+sNBZ9CJ6H/606T+t4jb+r1oRbu4fi/NzdUPB51qvBg/f78X3fd/iFa8Ulz/VkF9dGrx5utz/e9EK37+PM6jFyfj3ib13+yl6dvZ939+9ckoOqpPhoNOfTpvPLv8ZB8KAAAAAAAAAAAAAAAAAAAAAAD/ezvpVHvx/p3Jxf8r8ivuBxrO3c+zm6ZpluTzZ/WVeLUSlU2uHQAAAAAAAAAAAAAAAAAAAJ6Ly6svz457ve7FWgeT1/oLUvH3YqQeEff5yfXC1Pb9G8v7ifK4tV4S8bB1VaN+W/nvk8sP3LHmqJ/uRVKJ9X0EyTTSnE9tR/6sUaSZD+Yi937Ej1v5Lt5NNfLI5HSdHSfRLa3csUbRIVnDICs4fuWlVbW7kWYUL3CUWvH02tZ/6jlrLUklEVGdbubinNtfshezA1ld7x4Wfl3UHuErCAAAAAAAAAAAAAAAAAAAGJu99FuQvN5AQwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwAbP///+AwXBcvGxOVh4NKjGObHiJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvAT+CQAA///Zl1yY") write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000000)={0xc, {"a2e3ad214fc752f91b25060987f70e06d038e7ff7fc6e5539b325d078b089b3b08386e090890e0878f0e1ac6e7049b334d959b429a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31303b305d0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c0428918246d9e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff13d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1ccab2689bee59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae23034202210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ecdf5e08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000a40)='memory.swap.current\x00', 0x275a, 0x0) 39.029692ms ago: executing program 0 (id=12): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) ioctl$PPPIOCGFLAGS(r0, 0x8004745a, 0x0) 12.925767ms ago: executing program 1 (id=13): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000740)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x10000, {{@in=@multicast2, @in=@empty, 0x0, 0x10, 0x4e24, 0x0, 0xa, 0x20, 0x0, 0x62}, {0x7, 0x10, 0x100000002, 0x0, 0xfff, 0xffffffffffffb473, 0xffffffffffffffff}, {0x1000000000, 0x2000000000000003, 0x2, 0xffffffffffffffff}, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0xb8}}, 0x4004) sendmsg$nl_xfrm(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000800)=@updpolicy={0xc4, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0xfffffffffffffff7, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000}, 0x3a, 0x6e6bc0}, [@mark={0xc, 0x15, {0x35075b, 0xff}}]}, 0xc4}}, 0x2c000010) sendmsg$nl_xfrm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x800, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x800, 0x1000, 0x0, 0xa, 0x20}, {}, {0x1, 0x6, 0x0, 0xfffffffffffffffe}, 0x0, 0x6e6bbc}}, 0xb8}, 0x1, 0x0, 0x0, 0x404c830}, 0x0) 0s ago: executing program 0 (id=14): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.10.3' (ED25519) to the list of known hosts. [ 22.124117][ T24] audit: type=1400 audit(1790612104.250:64): avc: denied { mounton } for pid=271 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.125156][ T271] cgroup: Unknown subsys name 'net' [ 22.146784][ T24] audit: type=1400 audit(1790612104.250:65): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.174103][ T24] audit: type=1400 audit(1790612104.280:66): avc: denied { unmount } for pid=271 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.174298][ T271] cgroup: Unknown subsys name 'devices' [ 22.290853][ T271] cgroup: Unknown subsys name 'hugetlb' [ 22.296518][ T271] cgroup: Unknown subsys name 'rlimit' [ 22.433641][ T24] audit: type=1400 audit(1790612104.560:67): avc: denied { setattr } for pid=271 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.447582][ T273] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.456992][ T24] audit: type=1400 audit(1790612104.560:68): avc: denied { mounton } for pid=271 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.490211][ T24] audit: type=1400 audit(1790612104.560:69): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 22.513377][ T24] audit: type=1400 audit(1790612104.600:70): avc: denied { relabelto } for pid=273 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.538848][ T24] audit: type=1400 audit(1790612104.600:71): avc: denied { write } for pid=273 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.564595][ T24] audit: type=1400 audit(1790612104.670:72): avc: denied { read } for pid=271 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.564639][ T271] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.590083][ T24] audit: type=1400 audit(1790612104.670:73): avc: denied { open } for pid=271 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.190677][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.197726][ T279] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.205181][ T279] device bridge_slave_0 entered promiscuous mode [ 23.212882][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.219922][ T279] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.227261][ T279] device bridge_slave_1 entered promiscuous mode [ 23.313606][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.320764][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.328357][ T281] device bridge_slave_0 entered promiscuous mode [ 23.337551][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.344740][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.352123][ T281] device bridge_slave_1 entered promiscuous mode [ 23.358589][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.365790][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.373125][ T282] device bridge_slave_0 entered promiscuous mode [ 23.380691][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.387726][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.395125][ T282] device bridge_slave_1 entered promiscuous mode [ 23.425700][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.432818][ T280] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.440204][ T280] device bridge_slave_0 entered promiscuous mode [ 23.448332][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.455407][ T280] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.462725][ T280] device bridge_slave_1 entered promiscuous mode [ 23.525674][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.532749][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.540124][ T285] device bridge_slave_0 entered promiscuous mode [ 23.546962][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.554158][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.561585][ T285] device bridge_slave_1 entered promiscuous mode [ 23.613041][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.620102][ T279] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.627357][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.634396][ T279] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.679247][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.686312][ T281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.693568][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.700592][ T281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.717558][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.724610][ T282] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.731867][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.738873][ T282] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.752840][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.759900][ T280] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.767144][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.774203][ T280] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.830086][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.838369][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.847027][ T192] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.854665][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.862756][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.870806][ T192] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.877937][ T192] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.885213][ T192] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.892318][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.899835][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.907957][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.916687][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.924034][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.946145][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.953726][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.962267][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.971262][ T192] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.978284][ T192] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.985696][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.994124][ T192] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.001159][ T192] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.025827][ T279] device veth0_vlan entered promiscuous mode [ 24.032340][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.040217][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.048337][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.055840][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.064433][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.072416][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.080338][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.088395][ T192] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.095449][ T192] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.102951][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.111057][ T192] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.118054][ T192] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.125427][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.133327][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.150068][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.158027][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.166082][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.174235][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.182878][ T192] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.189921][ T192] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.197282][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.205524][ T192] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.212588][ T192] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.223220][ T281] device veth0_vlan entered promiscuous mode [ 24.234733][ T279] device veth1_macvtap entered promiscuous mode [ 24.243278][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.251123][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.260108][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.268312][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.276522][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.284514][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.292764][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.301015][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.308507][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.316796][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.325164][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.332711][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.343341][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.351551][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.368386][ T282] device veth0_vlan entered promiscuous mode [ 24.379975][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.388175][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.397207][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.405657][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.413990][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.422602][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.430972][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.438721][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.446699][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.454789][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.462829][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.471024][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.479071][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.486573][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.502467][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.510903][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.520679][ T279] request_module fs-gadgetfs succeeded, but still no fs? [ 24.526941][ T285] device veth0_vlan entered promiscuous mode [ 24.535726][ T280] device veth0_vlan entered promiscuous mode [ 24.542906][ T279] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 24.542959][ T281] device veth1_macvtap entered promiscuous mode [ 24.560800][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.573195][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.581705][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.591083][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.599312][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.607750][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.616058][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.624367][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.632141][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.639776][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.647725][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.662081][ T285] device veth1_macvtap entered promiscuous mode [ 24.669945][ T282] device veth1_macvtap entered promiscuous mode [ 24.691823][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.699649][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.708041][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.716674][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.724668][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.733478][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.742150][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.750777][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.759145][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.767895][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.812531][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.821254][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.830052][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.838313][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.849174][ T280] device veth1_macvtap entered promiscuous mode [ 24.891104][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.899503][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.907716][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.915488][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.924783][ T192] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.959741][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.968002][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.985874][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.994506][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.013639][ C0] ================================================================== [ 25.021752][ C0] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x6c/0xb0 [ 25.029123][ C0] Read of size 8 at addr ffff88810f382990 by task ksoftirqd/0/12 [ 25.036830][ C0] [ 25.039175][ C0] CPU: 0 PID: 12 Comm: ksoftirqd/0 Not tainted syzkaller #0 [ 25.046445][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 25.056490][ C0] Call Trace: [ 25.059770][ C0] __dump_stack+0x21/0x24 [ 25.064080][ C0] dump_stack_lvl+0x1a7/0x208 [ 25.068774][ C0] ? show_regs_print_info+0x18/0x18 [ 25.073969][ C0] ? thaw_kernel_threads+0x220/0x220 [ 25.079252][ C0] print_address_description+0x7f/0x2c0 [ 25.084790][ C0] ? rcu_cblist_dequeue+0x6c/0xb0 [ 25.089797][ C0] kasan_report+0x100/0x140 [ 25.094283][ C0] ? rcu_cblist_dequeue+0x6c/0xb0 [ 25.099288][ C0] __asan_report_load8_noabort+0x14/0x20 [ 25.104900][ C0] rcu_cblist_dequeue+0x6c/0xb0 [ 25.109732][ C0] rcu_do_batch+0x448/0xaf0 [ 25.114217][ C0] ? local_bh_enable+0x20/0x20 [ 25.118961][ C0] ? __kasan_check_write+0x14/0x20 [ 25.124049][ C0] ? rcu_report_qs_rnp+0x2bc/0x390 [ 25.129139][ C0] rcu_core+0x50a/0xca0 [ 25.133274][ C0] ? rcu_cpu_kthread_park+0x90/0x90 [ 25.138454][ C0] ? __this_cpu_preempt_check+0x13/0x20 [ 25.143980][ C0] ? rcu_softirq_qs+0xd5/0x1d0 [ 25.148724][ C0] ? rcu_get_gp_kthreads_prio+0x10/0x10 [ 25.154259][ C0] rcu_core_si+0x9/0x10 [ 25.158392][ C0] __do_softirq+0x255/0x563 [ 25.162875][ C0] ? ksoftirqd_should_run+0x20/0x20 [ 25.168051][ C0] run_ksoftirqd+0x23/0x30 [ 25.172452][ C0] smpboot_thread_fn+0x464/0x820 [ 25.177367][ C0] kthread+0x324/0x3b0 [ 25.181681][ C0] ? cpu_report_death+0x1b0/0x1b0 [ 25.186683][ C0] ? kthread_blkcg+0xd0/0xd0 [ 25.191252][ C0] ret_from_fork+0x1f/0x30 [ 25.195643][ C0] [ 25.197950][ C0] Allocated by task 330: [ 25.202187][ C0] __kasan_kmalloc+0xd4/0x100 [ 25.206841][ C0] __kmalloc+0x19f/0x330 [ 25.211060][ C0] l2tp_session_create+0x39/0xb60 [ 25.216063][ C0] pppol2tp_connect+0xbf5/0x1640 [ 25.220986][ C0] __sys_connect+0x3ce/0x450 [ 25.225662][ C0] __x64_sys_connect+0x7a/0x90 [ 25.230405][ C0] do_syscall_64+0x31/0x40 [ 25.234820][ C0] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.240685][ C0] [ 25.242998][ C0] Freed by task 192: [ 25.246869][ C0] kasan_set_track+0x4a/0x70 [ 25.251442][ C0] kasan_set_free_info+0x23/0x40 [ 25.256353][ C0] ____kasan_slab_free+0x125/0x160 [ 25.261442][ C0] __kasan_slab_free+0x11/0x20 [ 25.266185][ C0] slab_free_freelist_hook+0xc5/0x190 [ 25.271534][ C0] kfree+0xc0/0x270 [ 25.275316][ C0] l2tp_session_put+0xb2/0x1a0 [ 25.280056][ C0] l2tp_session_delete+0x3a9/0x4a0 [ 25.285144][ C0] l2tp_tunnel_del_work+0x180/0x3d0 [ 25.290327][ C0] process_one_work+0x6fd/0xbc0 [ 25.295152][ C0] worker_thread+0xa8e/0x13c0 [ 25.299804][ C0] kthread+0x324/0x3b0 [ 25.303851][ C0] ret_from_fork+0x1f/0x30 [ 25.308236][ C0] [ 25.310538][ C0] Last potentially related work creation: [ 25.316232][ C0] kasan_save_stack+0x3a/0x60 [ 25.320887][ C0] __kasan_record_aux_stack+0xd2/0x100 [ 25.326322][ C0] kasan_record_aux_stack_noalloc+0xb/0x10 [ 25.332105][ C0] call_rcu+0x11a/0x1090 [ 25.336324][ C0] pppol2tp_release+0x1e3/0x2b0 [ 25.341149][ C0] sock_close+0xb8/0x200 [ 25.345369][ C0] __fput+0x2dc/0x730 [ 25.349333][ C0] ____fput+0x15/0x20 [ 25.353297][ C0] task_work_run+0x127/0x190 [ 25.357863][ C0] exit_to_user_mode_loop+0xcb/0xe0 [ 25.363034][ C0] exit_to_user_mode_prepare+0x76/0xa0 [ 25.368468][ C0] syscall_exit_to_user_mode+0x1d/0x40 [ 25.373907][ C0] do_syscall_64+0x3d/0x40 [ 25.378302][ C0] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.384162][ C0] [ 25.386474][ C0] The buggy address belongs to the object at ffff88810f382800 [ 25.386474][ C0] which belongs to the cache kmalloc-512 of size 512 [ 25.400519][ C0] The buggy address is located 400 bytes inside of [ 25.400519][ C0] 512-byte region [ffff88810f382800, ffff88810f382a00) [ 25.413765][ C0] The buggy address belongs to the page: [ 25.419394][ C0] page:ffffea00043ce000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10f380 [ 25.429601][ C0] head:ffffea00043ce000 order:2 compound_mapcount:0 compound_pincount:0 [ 25.437900][ C0] flags: 0x4000000000010200(slab|head) [ 25.443340][ C0] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 [ 25.451902][ C0] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 25.460459][ C0] page dumped because: kasan: bad access detected [ 25.466849][ C0] page_owner tracks the page as allocated [ 25.472565][ C0] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 285, ts 24943362564, free_ts 24941452617 [ 25.492938][ C0] prep_new_page+0x176/0x190 [ 25.497504][ C0] get_page_from_freelist+0x225f/0x23f0 [ 25.503024][ C0] __alloc_pages_nodemask+0x29a/0x640 [ 25.508372][ C0] new_slab+0x84/0x3f0 [ 25.512440][ C0] ___slab_alloc+0x2f8/0x4c0 [ 25.517015][ C0] __slab_alloc+0x63/0xa0 [ 25.521322][ C0] kmem_cache_alloc_trace+0x1a8/0x2e0 [ 25.526670][ C0] blkcg_css_alloc+0x65/0xb90 [ 25.531325][ C0] cgroup_apply_control_enable+0x338/0x12b0 [ 25.537198][ C0] cgroup_mkdir+0x143c/0x16d0 [ 25.541856][ C0] kernfs_iop_mkdir+0x1a3/0x2b0 [ 25.546684][ C0] vfs_mkdir+0x42c/0x600 [ 25.550906][ C0] do_mkdirat+0x14c/0x340 [ 25.555233][ C0] __x64_sys_mkdirat+0x7b/0x90 [ 25.559981][ C0] do_syscall_64+0x31/0x40 [ 25.564379][ C0] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.570246][ C0] page last free stack trace: [ 25.574912][ C0] __free_pages_ok+0x80b/0x830 [ 25.579855][ C0] __free_pages+0xd8/0x390 [ 25.584339][ C0] __free_slab+0xcf/0x190 [ 25.588663][ C0] unfreeze_partials+0x150/0x180 [ 25.593589][ C0] put_cpu_partial+0xc1/0x180 [ 25.598253][ C0] __slab_free+0x2c9/0x3a0 [ 25.602655][ C0] ___cache_free+0x10e/0x130 [ 25.607228][ C0] qlink_free+0x50/0x90 [ 25.611361][ C0] qlist_free_all+0x5f/0xb0 [ 25.615844][ C0] kasan_quarantine_reduce+0x14a/0x160 [ 25.621281][ C0] __kasan_slab_alloc+0x2f/0xe0 [ 25.626146][ C0] slab_post_alloc_hook+0x5d/0x2f0 [ 25.631234][ C0] kmem_cache_alloc+0x15a/0x2d0 [ 25.636066][ C0] security_inode_alloc+0x33/0x110 [ 25.641179][ C0] inode_init_always+0x725/0x9c0 [ 25.646093][ C0] new_inode_pseudo+0x91/0x210 [ 25.650828][ C0] [ 25.653135][ C0] Memory state around the buggy address: [ 25.658759][ C0] ffff88810f382880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.666800][ C0] ffff88810f382900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.674844][ C0] >ffff88810f382980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.683310][ C0] ^ [ 25.687873][ C0] ffff88810f382a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.695913][ C0] ffff88810f382a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.703950][ C0] ================================================================== [ 25.711983][ C0] Disabling lock debugging due to kernel taint [ 25.740923][ T334] netlink: 104 bytes leftover after parsing attributes in process `syz.1.13'. [ 26.019654][ T25] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 26.269381][ T25] usb 1-1: Using ep0 maxpacket: 32 [ 26.409631][ T25] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 26.421886][ T25] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 26.431642][ T25] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 26.440682][ T25] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.449852][ T25] usb 1-1: config 0 descriptor?? [ 26.490179][ T25] hub 1-1:0.0: USB hub found [ 26.709401][ T25] hub 1-1:0.0: 1 port detected [ 26.959397][ T25] hub 1-1:0.0: hub_hub_status failed (err = -71) [ 26.965754][ T25] hub 1-1:0.0: config failed, can't get hub status (err -71) [ 27.069623][ T25] usbhid 1-1:0.0: can't add hid device: -71 [ 27.075646][ T25] usbhid: probe of 1-1:0.0 failed with error -71 [ 27.109755][ T25] usb 1-1: USB disconnect, device number 2