last executing test programs: 748.496442ms ago: executing program 0 (id=1): r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000280)="390000001300090468fe0700000000001000ff3f04000000480100100000000004002b000a00010014a4ee1ee438d2fd000000000000007208", 0x39}], 0x1) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="000900006440000008001b00000000000500100004"], 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=@newqdisc={0x54, 0x10, 0x1, 0x70bd25, 0x25dfdbfc, {0x6, 0x0, 0x8100, 0x0, {0x1, 0x10}, {0xfff1}, {0xe, 0x10}}, [@TCA_RATE={0x6, 0x5, {0xfc}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x11, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x400c800}, 0x0) 422.94595ms ago: executing program 0 (id=6): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0b00000005000000020000000400000005"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x5, 0x5, 0x2, 0x7, 0x0, 0x1, 0x10000}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000d00)={0x6, 0x15, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000047b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000100850000000100000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000010000850000008200000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000a80)={r2, 0x0, 0x0}, 0x10) 330.902842ms ago: executing program 3 (id=4): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1f7) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000001600)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)={0x6000000d}) 316.093472ms ago: executing program 1 (id=2): socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='memory.events\x00', 0x26e1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000280)=ANY=[@ANYBLOB="400000000101010100000000000000000a001c002000018006000340000000001400018008c301007f000001080002007f0000010c00198008000100", @ANYRES32=r0], 0x40}, 0x1, 0x0, 0x0, 0x40}, 0x0) 306.853813ms ago: executing program 4 (id=5): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r1, 0xffffffffffffffff, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/timer_list\x00', 0x0, 0x0) ioctl$FICLONE(r2, 0x40049409, r0) 255.012514ms ago: executing program 3 (id=7): syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x16, 0x0, 0x0) r1 = socket(0x2, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000080)=[{0x30, 0x5, 0x1, 0xfffff034}, {0x6, 0x1, 0x6, 0xa0000}]}, 0x10) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaa7effffffffdd00000800452400280067000039f1216ca77fb7edac1414aa00004e", @ANYRES32=0x41424344, @ANYRES32, @ANYBLOB="5404000690780000"], 0x0) 241.023354ms ago: executing program 4 (id=8): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000000c0)={0x5, 0x2, 0x9000, 0x2000, &(0x7f0000ff8000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x52, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 223.268835ms ago: executing program 2 (id=3): bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{}, 0x0, &(0x7f0000000180)}, 0xffffffffffffff6e) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x101200, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r0, 0x40047451, &(0x7f0000000180)) 194.705105ms ago: executing program 1 (id=9): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x8008662c, 0x0) 174.090876ms ago: executing program 1 (id=10): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r0, &(0x7f00000022c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001b80)=""/102, 0x66}}], 0x1, 0x10022, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) 160.368106ms ago: executing program 3 (id=11): r0 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000000)={0x0, &(0x7f0000000040)=[@nested_amd_vmcb_write_mask={0x17c, 0x38, {0x2, @control_area=0x53, 0x1, 0x8000000000000000, 0x8}}], 0x38}) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f00000001c0)={0x1, 0x0, [{0xa, 0x401, 0x4, 0x3, 0x1b1, 0x5, 0x7}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 155.312956ms ago: executing program 2 (id=12): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x2501, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000580)='./file1\x00', 0x10217, &(0x7f00000000c0), 0x1, 0x479, &(0x7f00000005c0)="$eJzs3M1vFOUfAPDv7G55h/bHD19AVBSNxJeWFlQOXjQx8aCJiR7wWEshSKGG1sSSRooheDFRDHdj4sXEv8CTJ6KeTLzi3ZAQwwX0tGa6M8t2u9tut9tuYT+fZOg8O8/M83xnnmfnmRlmA+hZB9J/kogdEXEjIvojolCbYSAitlby3b09O/bP7dmxJMrl9/5O0tXizu3ZsTxrkv3dXkmU0g0VLifzm6g3NXPhzOjExPj5LD00ffbjoamZCy+dPjt6avzU+LmRY8eOHhl+9ZWRlzsSZ1qnO/s+m9y/960Prr4zdvzqh7/+WKlvuXzt+uEFcXRGX0TMVvdJvWc7W1jX7ayZT0pdrAgrsjkiSllrvRH9Uby8q7qsP978vKuVA9ZUuVwujzRfPFcGHmBJdLsGQHfkJ/r0+jef1mnosSHcer1yAZTGfTebKktKcSnL01d3fdtJByLi+Ny/36ZT1N1PAQBYCz+n458XG4z/BiIersm3K3s2NBAR/4uI3RHx/4jYExEPRSXvIxHx6ArLP1CXXjz+KdxsL7LWpOO/17JnWwvHf9WnYAPFLLVzPv6+5OTpifHD2T45FH2b0/Rww60nEXPp3z++alZ+7fgvndLy87FgVo+bpc0L1zkxOj266sAzty5F7Cs1ij+J0r0oYm9E7GuzjNPP/7B/4SfF6tzy8S+hA8+Zyt9FPFc5/nNRF38uWfr55NCWmBg/PJS3isV++/3Ku83KX1X8HZAe/20N2381/oGk9nnt1KJNbFqujCt/ftH0mqbd9r8peX9B4Z+OTk+fH47YlLy9+POaG9x5Os+fxn/oYOP+vzvu7YnHIiJtxI9HxBMR8WRW96ci4umIOLhE/L+88cxH7ce/ttL4L67o+M/kC+59ssxM8cz1n5qV39rxP5on5stu5fuvlXo1bM0AAADwACpExI5ICoPV+UJhcLDy/+X3xLbCxOTU9AsnJz85d6LyjsBA9BXyO139NfdDh7N7w3l6pJL+JrL0key+8bXi1vn04NjkxIluBw89bnuT/p/6q9jt2gFrzvta0Lv0f+hd7fd/3xxwv1umFxfWqx7A+nMWh97VqP9f7EI9gPXn/A+9q9r/v168bNEPWNa87lX/8iZw/3H+h96l/0NPaukl+Y08E99HLJ0n2ShVXdHMl6tZvbTCtba00RKisDF21DrOjBQjuliNUqu/ahEz5YurLrTb30wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACd8V8AAAD//wUb4wk=") r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_XCRS(r2, 0x4188aea7, &(0x7f0000000480)={0x10, 0x0, [{0x8, 0x0, 0x6}, {0xf, 0x0, 0x9}, {0x4, 0x0, 0x3}, {0x0, 0x0, 0x1}, {0xfffffffc, 0x0, 0x8228}, {0x1, 0x0, 0x9}, {0x8, 0x0, 0x100000001}, {0x18000, 0x0, 0x6}, {0x7fffffff, 0x0, 0xcb}, {0x1ff, 0x0, 0x2}, {0x4, 0x0, 0x8}, {0xf, 0x0, 0x4}, {0x3, 0x0, 0x3}, {0xff, 0x0, 0x86a}, {0x81, 0x0, 0x8}, {0x0, 0x0, 0xe9}]}) 68.969998ms ago: executing program 4 (id=13): mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x1d2) unshare(0x2040400) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000140), 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8c) r1 = openat$incfs(r0, &(0x7f00000001c0)='.log\x00', 0x0, 0x130) poll(&(0x7f00000000c0)=[{r1, 0x8}], 0x1, 0x2) 59.192319ms ago: executing program 1 (id=14): r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) r1 = socket(0xa, 0x3, 0x87) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 51.303599ms ago: executing program 4 (id=15): syz_mount_image$exfat(&(0x7f0000000100), &(0x7f0000000880)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, &(0x7f0000000000)={[{@utf8}, {@utf8}, {@uid={'uid', 0x3d, 0xee00}}, {@iocharset={'iocharset', 0x3d, 'iso8859-15'}}, {@dmask={'dmask', 0x3d, 0x7e6f}}, {@namecase}, {@iocharset={'iocharset', 0x3d, 'macgreek'}}, {@namecase}, {@fmask={'fmask', 0x3d, 0x4}}, {@errors_continue}]}, 0x1, 0x1533, &(0x7f0000006800)="$eJzs3AucTtX6OPDnWWvtMSS9TXIZ1lrP5k0uiyTJJUkuSZIkSW4JSZIjCYkht6QhCcllSC5DSC4Tk8b9fr8kJEmTJCG5Jev/mZi/OnX+55xfnfz+Z57v5/N+Zj2z3mftZ88z73733vPyTZehNRrVrNqAiOAPwYtfEgAgFgAGAsA1ABAAQNm4snEZ89klJvyxjbA/10PJV7oCdiVx/7M27n/Wxv3P2rj/WRv3P2vj/mdt3P+sjfvPWFa2eXr+a/mRdR98/z8r4/f//yLpJcd+sbbk9V0BYv7VFO7////wD+Ry//9rBf/Kk7j/WRv3P6uKvdIFsP8F+PWfFWT7hzPc/6yN+89YVvbLe8GxcOXvR//VD4j8J/8G4ntd/Clf+f38h/vPGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4z9Bc74yxQAZI6vdF2MMcYYY4wxxhj78/hsV7oCxhhjjDHGGGOM/echCJCgIIAYyAaxkB1ygACIyZy/FuLgOsgN10MeyAv5ID/EQwEoCBoMWCAIoRAUhijcAEXgRigKxaA4lAAHJaEU3ASl4WYoA7dAWbgVysFtUB4qQEWoBLdDZbgDqsCdUBXugmpQHWpATbgbasE9UBvuhTpwH9SF+6EePAD14UFoAA9BQ3gYGsEj0BgehSbQFJpBc2jxP8p/AXrAi9ATekEC9IY+8BL0hX7QHwbAQHgZBsErMBhehUQYAkPhNRgGr8NweANGwEgYBW/CaHgLxsBYGAfjIQkmwER4GybBOzAZpsBUmAbJMB1mwLswE2bBbHgP5sD7MBfmwXxYACnwASyERZAKH8Ji+AjSYAkshWWwHFbASlgFq2ENrIV1sB42wEbYBJthC2yFbbAddsBO+Bh2wSewG/bAXvgU9sFn/2b+6b/L74qAgAIFKlQYgzEYi7GYA3NgTsyJuTAXRjCCcRiHuTE35sE8mA/zYTzGY0EsiAYNEhIWwkIYxSgWwSJYFIticSyODh2WwlJYGm/GMlgGy2JZLIflsDxWwApYCSthZayMVbAKVsWqWA2rYQ2sgXfj3dgba2NtrIN1sC7Wzbw9hQ2wATbEhtgIG2FjbIxNsAk2w2bYAltgS2yJrbAVtsE22BbbYjtsh+2xPXbADtgRO2In7ISdsTN2wS7YFbtht/QXsgG+iC9iL6wmemMf7IN9MTFbfxyAA/BlHISv4Cv4KibiEByKr+Fr+DoOx1M44sJIHIWjsLJ4C8fgWCQxHpMwCSfiRJyEk3AyTsEpOA2TcTrOwBk4E2fhLHwP5+D7+D7Ow3m4AFMwBRfiIkzFVFyMpzENl+BSXIbLcQUux1W4GlfhWlyHa3EDbsBNuAm34BbchttwB+7Aj1EB4Ce4B/dgIu7Dfbgf9+MBPIAH8SCmYzoewkN4GA/jETyCR/EoHsPjeAKP40k8iafwNJ7BM3gOz+F5fC7+q4YfF1uTCCKDEkrEiBgRK2JFDpFD5BQ5RS6RS0RERMSJOJFb5BZ5RB6RT+QT8SJeFBQFhRFGkAgzjhQiKqKiiCgiioqiorgoLpxwopQoJUqL0qKMKCPKiltFOXGbKC8qiNaukqgkKos2roq4U1QVVUU1UV3UEDVFTVFL1BK1RW1RR9QRdUVdUU88IOqL3tgfHxIZnWkkhmBjMRSbiKZCXjpCtRTDsZVoLdqIJ8RIHIHtREvXXjwtOogx2FH8TYzFZ0VnMR67iOdFV9FNdBcviB6ilespeonJ2Fv0EdOwr+gn+osBYiZWF+/hnOw1xKsiUQwRQ8VrYgG+LoaLN8QIMVKMEm+K0eItMUaMFePEeJEkJoiJ4m0xSbwjJospYqqYJpLFdDFDvCtmillitnhPzBHvi7linpgvFogU8YFYKBaJVPGhWCw+EmliiVgqlonlYoVYKVaJ1WKNWCvWifVig9goNonNYovYKraJ7WKH2Ck+FrvEJ2K32CP2ik/FPvGZ2C8+FwfEF+Kg+FKki6/EIfG1OCy+EUfEt+Ko+E4cE8fFCfG9OCl+EKfEaXFGnBXnxI/ivPhJXBBegEQppJRKBjJGZpOxMrvMIa+SOWWQefyXcfI6mVteL/PIvDKfzC/jZQFZUGpppJUkQ1lIFpZReYMsIm+URWUxWVyWkE6WlKXkTbK0vFmWkbfIsvJWWU7eJsvLCrKirCRvl5XlHRIiF7dRTVaXNWRNebdMgHtkbXmvrCPvk3Xl/bKefEDWlw/KBvIh2VA+LBvJR2Rj+ahsIpvKZrK5bCEfky3l47KVbC3byCdkW/mkbCefku3l07KD9Jd+RZ6VneVzsot8XnaV3WR3+ZO8IL3sKXtJ6A2yj3xJ9pX9ZH85QA6UL8tB8hU5WL4qE+UQOVS+JofJ1+Vw+YYcIUfKUfJNOVq+JcfIsXKcHC+T5AQ5Ub4tJ8l35GQ5RU6V02SynC77X1pptpT/NP/t38kf/PPWN8nNcovcKrfJ7XKH3Ck/lrvkLrlb7pZ75V65T+6T++V+eUAekAflQZku0+UheUgeloflEXlEHpVH5TF5XJ6V38uT8gd5Sp6Wp+VZeU6ek+cv/QxAoRJKKqUCFaOyqViVXeVQV6mc6mqVS12jIupaFaeuU7nV9SqPyqvyqfwqXhVQBZVWRllFKlSFVGEVVTfgpV8YVVyVUE6VVKXUTf9OviqiblRFVbFf5WfWl/AP6muhWqiWqqVqpVqpNqqNaqvaqnaqnWqv2qsOqoPqqDqqTqqT6qw6qy6qi+qquqruqrvqoXqonqqnSlAJqo96SfVV/VR/NUANVC+LjH0YrAarRJWohqqhapgapoar4WqEGqFGqVFqtBqtxqgxapwap5JUkpqoJqpJapKarCarqWqqSlbJaoaaoWaqmWq2mq3mqDlqrpqr5qv5KkWlqIVqoUpVqWqxWqzS1BK1RC1Ty9QKtUKtUqvUGrVGrVPr1Aa1QaWpzWqz2qq2qu1qu9qpdqpdapfarXarvWqv2qf2qf1qvzqgDqiD6qBKV+nqkDqkDqvD6og6oo6qo+qYOqZOqBPqpDqpTqlT6ow6o86pc+q8Oq8uqAsZp32BCESgAhXEBDFBbBAb5AhyBDmDnEGuIFcQCSJBXBAX5A6uD/IEeYN8Qf4gPigQFAx0YAIbiEtNjwY3BEWCG4OiQbGgeFAicEHJoFRwU1A6uDkoE9wSlA1uDcoFtwXlgwpBxaBScHtQObgjqBLcGVQN7gqqBdWDGkHN4O6gVnBPUDu4N6gT3BfUDe4P6gUPBPWDB4MGwUNBw+DhoFHwSNA4eDRoEjQNmgXNgxZ/6vren8r7uOupe+kE3Vv30S/pvrqf7q8H6IH6ZT1Iv6IH61d1oh6ih+rX9DD9uh6u39Aj9Eg9Sr+pR+u39Bg9Vo/T43WSnqAn6rf1JP2Onqyn6Kl6mk7W0/UM/a6eqWfp2fo9PUe/r+fqeXq+XqBT9Ad6oV6kU/WHerH+SKfpJXqpXqaX6xV6pV6lV+s1eq1ep9frDXqj3qQ36y16q96mt+sdeqf+WO/Sn+jdeo/eqz/V+/Rner/+XB/QX+iD+kudrr/Sh/TX+rD+Rh/R3+qj+jt9TB/XZfT3+qT+QZ/Sp/UZfVaf0z/q8/onfUH7jJP7jLd3o4wyMSbGxJpYk8PkMDlNTpPL5DIREzFxJs7kNrlNHpPH5DP5TLyJNwVNQZOBDJlCppCJmqgpYoqYoqaoKW6KG2ecKWVKmdKmtCljypiypqwpZ8qZ8qa8qWgqmtvN7eYOc4e509xp7jJ3meqmuqlpappappapbWqbOqaOqWvqmnqmnqlv6psGpoFpaBqaRqaRaWwamyamiWlmmpkWpoVpaVqaVqaVaWPamLamrWln2pn2pr3pYDqYjqaj6WQ6mc6ms+liupiupqvpbrqbHqaH6Wl6mgSTYPqYPqav6Wv6m/5moBloBplBZrAZbBJNohlqhpphZpgZboabEWakGZVxomreMmPMWDPOjDdJJslMNBPNJDPJTDaTzVQz1SSbZDPDzDAzzUwz28w2c8wcM9fMNfPNfJNiUsxCs9CkmlSz2Cw2aSbNLDVLzXKz3Kw0K81qs9qsNWvNelhvNpqNZrPZbLaarWa72W52mp1ml9lldpvdZq/Za/aZfWa/2W8OmAPmoDlo0k26OWQOmcPmsDlijpij5qg5Zo6ZE+aEOWlOmlPmlDljzphzJu+l90tvYm12m8NeZXPaq20ue439+zifzW/jbQFb0Gqbx+b9VWystUVtMVvclrDOlrSl7E2/icvbCrairWRvt5XtHbbKb+Ja9h5b295r69j7bE1796/iuvZ+W88+YusjAtimtqFtbhvZR2xj+6htYpvaZra5bWuftO3sU7a9fdp2sM/8Jl5oF9nVdo1da9fZ3XaPPWPP2sP2G3vO/mh72l52oH3ZDrKv2MH2VZtoh/wmHmXftKPtW3aMHWvH2fG/iafaaTbZTrcz7Lt2pp31mzjFfmDn2FQ7186z8+2Cn+OMmlLth3ax/cim2QCW2mV2uV1hV9pV/7fWZXaD3Wg32V32E7vVbrPb7Q67M/NE2O6xe+2ndp/9zB6yX9sD9gt70B6x6farn+OM/Ttiv7VH7Xf2mD1uT9jv7Un7g8rMztj37+1P9oL1FggJSJKigGIoG8VSdspBV1FOuppy0TUUoWspjq6j3HQ95aG8lI/yUzwVoIKkyZAlopAKUWGK0g2UWV5xKkGOSlIpuolK081Uhm6hsnQrlaPbqDxVoIpUiW6nynQHVaE7qSrdRdWoOtWgmnQ31aJ7qDbdS3XoPqpL91M9eoDq04PUgB6ihvQwNaJHqDE9Sk2oKTWj5tSCHqOW9Di1otbUhp6gtvQktaOnqD09TR3oGepIf6NO9Cx1pueoCz1PXakbdacXqAe9SD2pFyVQb+pDL1Ff6kf9aQANpJdpEL1Cg+lVSqQhNJReo2H0Og2nN2gEjaRR9CaNprdoDI2lcTSekmgCTaS3aRK9Q5NpCk2laZRM02kGvUszaRbNpvdoDr1Pc2kezacFlEIf0EJaRKn0IS2mjyiNltBSWkbLaQWtpFW0mtbQWlpH62kDbaRNtJm20FbaRttpB+2kj2kXfUK7aQ/tpU9pH31G++lzOkBf0EH6ktLpKzpEX9Nh+oaO0Le+F31Hx+g4naDv6ST9QKfoNJ2hs3SOfqTz9BNdIE8QYihCGaowCGPCbGFsmD3MEV4V5gyvDnOF14SR8NowLrwuzB1eH+YJ84b5wvxhfFggLBjq0IQ2pDAMC4WFw2h4Q1gkvDEsGhYLi4clQheWDEuFN4Wlw5vDMuEtYdnw1rBceFtYPqwQPnJfpfD2sHJ4R1glvDOsGt4VVgurhzXCmuHdYa3wnrB2eG9YJ7wvLBPeH9YLHwjrhw+GDcKHwobhw2Gj8JGwcfho2CRsGjYLm4ctwsfCluHjYauwddgmvCpsGz4ZtgufCtuHT4cdwmd+nr9/Ueb8E7+ZTwh7h33Cl8KXQu/vlfOjC6Ip0Q+iC6OLoqnRD6OLox9F06JLokujy6LLoyuiK6Oroquja6Jro+ui66Mbohujm6Le18wGDp1w0ikXuBiXzcW67C6Hu8rldFe7XO4aF3HXujh3ncvtrnd5XF6Xz+V38a6AK+i0M846cqEr5Aq7qLvBFXE3uqKumCvuSjjnSrpSrrlr4Vq4lu5x18q1dm3cE+4J96R70j3lnnJPuw7uGdfR/c11cs+6zu4595x73nV13Vx394Lr4SbkuviaTHB9XB/X1/V1/V1/N9ANdIPcIDfYDXaJLtENdUPdMDfMDXfD3Qg3wo1yo9xoN9qNcWPcODfOJbkkN9FNdJPcJDfZTXZT3VSX7JLdDDfDzXQzXeVZF7cy18118918l+JS3EKXcc6Y6ha7xS7Npbmlbqlb7pa7lW6lW+1Wu7VurVvv1ruNbqPb7Da7rW6r2+62u51up9vldrnd/pqLi7p9br/b7w64A+6g+9Klu6/cIfe1O+y+cUfct+6o+84dc8fdCfe9O+l+cKfcaXfGnXXn3I/uvPvJXXDeJUUmRCZG3o5MirwTmRyZEpkamRZJjkyPzIi8G5kZmRWZHXkvMifyfmRuZF5kfmRBJCXyQWRhZFEkNfJhZHHko0haZElkaWRZZHlkRcT7AltDX8gX9lF/gy/ib/RFfTFf3Jfwzpf0pfxNvvTFutO8v9WX87f58r6Cr+gf9U18U9/MN/ct/GO+pX/ct/KtfRv/hG/rn/Tt/FO+vX/ad/DP+I7+b76Tf9Z39s/5Lv5539V38939C76Hf9H39L18gu/t+/iXfF/fz/f3A/xA/7If5F/xg/2rPtEP8UP9a36Yf90P92/4EX6kHxXzph+deYkM432Sn+An+rf9JP+On+yn+Kl+mk/20/0M/66f6Wf52f49P8e/7+f6eX6+X+BT/Ad+oV/kU/2HfrH/yKf5JZk3jf1Kv8qv9mv8Wr/Or/cb/Ea/yW/2W/xWv81v9zv8Tv+x3+U/8bv9Hr/Xf+r3+c/8fv+5P+C/8Af9lz7df+UP+a/9Yf+NP+K/9Uf9d/6YP+5P+O/9Sf+DP+VP+zP+rD/nf/Tn/U/+Av+bNcYYY4yxf8mEy0Px65mLt/N7/06O+MWT+wDA1dvyp/9yPuOMcn2ei+N+Ij424+vTvbo8lPmoVi0hIeHSc9MkBIXnAWT+JSjDzx89uBQvgTbwJLSH1lD6d+vvJ7qdo3+yfvRWgBy/yMkoKDO+vP7nAJjwO+s/9sSoheXCM3H/j/XnARQtfDknO1yOl0Cbn++vtIYy/6D+vC3/Sf3Zv0gCaPWLnJxwOb5cfyl4HJ6B9r96JmOMMcYYY4wxdlE/UbFT5vVn5ic+f+/6PF5dzskGl+N/dn3OGGOMMcYYY4yxK+/Zbt2feqx9+9ad/v1Blf9R1r88aAz/qZV58LsD7wEyv6MA4A8uCJAxkH/lXmz5S7aVeOml8/dTy8/6AP53tPLPGFzhAxNjjDHGGGPsT3f5pP/X31dXqiDGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYYywL+iv+O7ErvY+MMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcbYlfZ/AgAA//+1tfsI") bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb01001800000000000000280000"], 0x0, 0x46}, 0x28) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454d1, 0x0) sendmsg$NL802154_CMD_GET_WPAN_PHY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x48891}, 0x880) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42040, 0x0) 44.102779ms ago: executing program 3 (id=16): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x11, 0xffffffffffffffff, 0xb7030000) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/platform/devices/pcspkr/uevent\x00', 0x1, 0x0) write(r0, &(0x7f0000001080)='a', 0x1) 0s ago: executing program 0 (id=17): signalfd4(0xffffffffffffffff, &(0x7f0000000040)={[0x9]}, 0x8, 0x80800) setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, &(0x7f00000000c0)={0x1, {{0x2, 0x4e23, @local}}}, 0x88) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x3e, &(0x7f00000000c0)=0x8, 0x4) write(r0, &(0x7f0000000040)="a9", 0x1) kernel console output (not intermixed with test programs): rocess permissive=1 [ 12.173294][ T24] audit: type=1400 audit(1785850806.209:63): avc: denied { siginh } for pid=217 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.141' (ED25519) to the list of known hosts. [ 19.078461][ T24] audit: type=1400 audit(1785850813.129:64): avc: denied { mounton } for pid=271 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 19.079501][ T271] cgroup: Unknown subsys name 'net' [ 19.101121][ T24] audit: type=1400 audit(1785850813.129:65): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.128376][ T24] audit: type=1400 audit(1785850813.159:66): avc: denied { unmount } for pid=271 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.128565][ T271] cgroup: Unknown subsys name 'devices' [ 19.244417][ T271] cgroup: Unknown subsys name 'hugetlb' [ 19.250016][ T271] cgroup: Unknown subsys name 'rlimit' [ 19.387083][ T24] audit: type=1400 audit(1785850813.439:67): avc: denied { setattr } for pid=271 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 19.410287][ T24] audit: type=1400 audit(1785850813.439:68): avc: denied { mounton } for pid=271 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 19.434969][ T24] audit: type=1400 audit(1785850813.439:69): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 19.483280][ T273] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 19.492025][ T24] audit: type=1400 audit(1785850813.539:70): avc: denied { relabelto } for pid=273 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.517509][ T24] audit: type=1400 audit(1785850813.539:71): avc: denied { write } for pid=273 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.543185][ T24] audit: type=1400 audit(1785850813.579:72): avc: denied { read } for pid=271 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.543365][ T271] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 19.568645][ T24] audit: type=1400 audit(1785850813.579:73): avc: denied { open } for pid=271 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.015634][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.022688][ T279] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.030260][ T279] device bridge_slave_0 entered promiscuous mode [ 20.038430][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.045492][ T279] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.052882][ T279] device bridge_slave_1 entered promiscuous mode [ 20.091052][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.098138][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.105603][ T285] device bridge_slave_0 entered promiscuous mode [ 20.120163][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.127298][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.134629][ T285] device bridge_slave_1 entered promiscuous mode [ 20.158562][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.165650][ T280] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.173167][ T280] device bridge_slave_0 entered promiscuous mode [ 20.188863][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.195957][ T280] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.203378][ T280] device bridge_slave_1 entered promiscuous mode [ 20.233139][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.240179][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.247568][ T281] device bridge_slave_0 entered promiscuous mode [ 20.257318][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.264487][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.271829][ T281] device bridge_slave_1 entered promiscuous mode [ 20.291720][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.298785][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.306157][ T283] device bridge_slave_0 entered promiscuous mode [ 20.315223][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.322256][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.329611][ T283] device bridge_slave_1 entered promiscuous mode [ 20.456515][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.463565][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.470818][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.477843][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.489868][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.496932][ T279] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.504253][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.511267][ T279] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.526028][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.533089][ T283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.540329][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.547364][ T283] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.558607][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.565769][ T281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.573026][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.580046][ T281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.599462][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.606521][ T280] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.613777][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.620782][ T280] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.640753][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.649159][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.657668][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.665829][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.673370][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.680473][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.687796][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.694961][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.702144][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.709369][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.716956][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 20.724613][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.746048][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.753796][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.761893][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.768932][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.786098][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.793994][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.801398][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.809596][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.816640][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.824249][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.846930][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.855216][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.863463][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.870464][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.878279][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.886912][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.893948][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.901340][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.909494][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.916523][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.923851][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.931710][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.939667][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.947763][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.954785][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.962071][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.970004][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.978100][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.985126][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.992500][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.009966][ T281] device veth0_vlan entered promiscuous mode [ 21.020633][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 21.029266][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.038198][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.045242][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.052758][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.061152][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.069587][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 21.077594][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.085604][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.093498][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.101353][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.108904][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.126390][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.134861][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.143308][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.151097][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.159741][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.168074][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.176307][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.183808][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.192057][ T279] device veth0_vlan entered promiscuous mode [ 21.200479][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.208828][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.219380][ T281] device veth1_macvtap entered promiscuous mode [ 21.228638][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.236347][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 21.244390][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.257728][ T279] device veth1_macvtap entered promiscuous mode [ 21.271449][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 21.279464][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.287626][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 21.295836][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.303828][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.311843][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.320101][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.327813][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.336016][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.344343][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 21.352285][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.360311][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.368563][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.383336][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.391227][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.399235][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.407519][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.420565][ T280] device veth0_vlan entered promiscuous mode [ 21.429761][ T281] request_module fs-gadgetfs succeeded, but still no fs? [ 21.432330][ T285] device veth0_vlan entered promiscuous mode [ 21.444113][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.451616][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.459441][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.467960][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.476566][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.484497][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.492350][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.499871][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.514335][ T281] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 21.525156][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.533769][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.542146][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.550962][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.559555][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.567871][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.576310][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.583867][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.596107][ T280] device veth1_macvtap entered promiscuous mode [ 21.603981][ T283] device veth0_vlan entered promiscuous mode [ 21.612408][ T301] netlink: 9 bytes leftover after parsing attributes in process `syz.0.1'. [ 21.621865][ T301] device gretap0 entered promiscuous mode [ 21.628889][ T285] device veth1_macvtap entered promiscuous mode [ 21.635765][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.643893][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.651969][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.660338][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.670060][ T303] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.677507][ T303] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.693368][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.701675][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.710095][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.718564][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.727088][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.735328][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.746345][ T301] netlink: 'syz.0.1': attribute type 16 has an invalid length. [ 21.754048][ T301] netlink: 'syz.0.1': attribute type 17 has an invalid length. [ 21.762159][ T301] device gretap0 left promiscuous mode [ 21.768115][ T301] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 21.779192][ T301] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.786274][ T301] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.794197][ T301] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.801214][ T301] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.821194][ T283] device veth1_macvtap entered promiscuous mode [ 21.833433][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.841380][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 21.849741][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 21.858976][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 21.867311][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 21.875704][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 21.884128][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 21.892326][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 21.900594][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 21.909278][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.917918][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.926700][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.936135][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.980402][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.984312][ T311] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2'. [ 22.020576][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.031151][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.041400][ T311] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2'. [ 22.047043][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.065603][ T320] syz.3.7 uses obsolete (PF_INET,SOCK_PACKET) [ 22.072707][ T318] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 22.179260][ T329] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (57259!=33349) [ 22.191432][ T329] EXT4-fs (loop2): orphan cleanup on readonly fs [ 22.198794][ T329] EXT4-fs error (device loop2): ext4_read_block_bitmap_nowait:510: comm syz.2.12: Block bitmap for bg 0 marked uninitialized [ 22.257868][ T329] EXT4-fs error (device loop2) in ext4_mb_clear_bb:5650: Corrupt filesystem [ 22.268222][ T329] EXT4-fs (loop2): 1 orphan inode deleted [ 22.274178][ T329] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 22.284784][ T347] exfat: Deprecated parameter 'utf8' [ 22.287944][ T345] synth uevent: /devices/platform/pcspkr: unknown uevent action string [ 22.290106][ T347] exfat: Deprecated parameter 'utf8' [ 22.302390][ T325] ================================================================== [ 22.311720][ T325] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 [ 22.318370][ T325] Write of size 8 at addr ffff88810f3aad50 by task syz.1.9/325 [ 22.325879][ T325] [ 22.328198][ T325] CPU: 0 PID: 325 Comm: syz.1.9 Not tainted syzkaller #0 [ 22.335194][ T325] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 22.345224][ T325] Call Trace: [ 22.348495][ T325] __dump_stack+0x21/0x24 [ 22.352800][ T325] dump_stack_lvl+0x1a7/0x208 [ 22.357453][ T325] ? show_regs_print_info+0x18/0x18 [ 22.362624][ T325] ? thaw_kernel_threads+0x220/0x220 [ 22.367882][ T325] print_address_description+0x7f/0x2c0 [ 22.373400][ T325] ? mutex_lock+0x85/0xf0 [ 22.377706][ T325] kasan_report+0x100/0x140 [ 22.382180][ T325] ? mutex_lock+0x85/0xf0 [ 22.386495][ T325] kasan_check_range+0x249/0x2a0 [ 22.391406][ T325] __kasan_check_write+0x14/0x20 [ 22.396319][ T325] mutex_lock+0x85/0xf0 [ 22.400452][ T325] ? mutex_trylock+0xb0/0xb0 [ 22.405022][ T325] ? l2tp_session_put+0xb2/0x1a0 [ 22.409932][ T325] ? l2tp_session_delete+0x3a9/0x4a0 [ 22.415193][ T325] pppol2tp_release+0x178/0x2b0 [ 22.420018][ T325] sock_close+0xb8/0x200 [ 22.424236][ T325] ? sock_mmap+0xa0/0xa0 [ 22.428451][ T325] __fput+0x2dc/0x730 [ 22.432405][ T325] ____fput+0x15/0x20 [ 22.436378][ T325] task_work_run+0x127/0x190 [ 22.440942][ T325] do_exit+0xa7c/0x24e0 [ 22.445077][ T325] ? __kasan_check_write+0x14/0x20 [ 22.450162][ T325] ? switch_fpu_return+0x19c/0x330 [ 22.455249][ T325] ? put_task_struct+0x90/0x90 [ 22.459985][ T325] ? fpu__clear_all+0x20/0x20 [ 22.464636][ T325] ? __kasan_check_read+0x11/0x20 [ 22.469661][ T325] __x64_sys_exit+0x40/0x40 [ 22.474141][ T325] do_syscall_64+0x31/0x40 [ 22.478534][ T325] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 22.484398][ T325] RIP: 0033:0x7f37cf060019 [ 22.488784][ T325] Code: Unable to access opcode bytes at RIP 0x7f37cf05ffef. [ 22.496127][ T325] RSP: 002b:00007f37cdab8ef8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 22.504512][ T325] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007f37cf060019 [ 22.512464][ T325] RDX: 00007f37cdab99c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 22.520413][ T325] RBP: 00007f37cf0f700c R08: 0000000000000000 R09: 0000000000000058 [ 22.528358][ T325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 22.536321][ T325] R13: 00007f37cf2e8038 R14: 00007f37cf2e7fa0 R15: 00007fffcc9ab8e8 [ 22.544440][ T325] [ 22.546758][ T325] Allocated by task 324: [ 22.550986][ T325] __kasan_kmalloc+0xd4/0x100 [ 22.555642][ T325] __kmalloc+0x19f/0x330 [ 22.559861][ T325] l2tp_session_create+0x39/0xb60 [ 22.564875][ T325] pppol2tp_connect+0xbf5/0x1640 [ 22.569789][ T325] __sys_connect+0x3ce/0x450 [ 22.574473][ T325] __x64_sys_connect+0x7a/0x90 [ 22.579225][ T325] do_syscall_64+0x31/0x40 [ 22.583619][ T325] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 22.589480][ T325] [ 22.591781][ T325] Freed by task 325: [ 22.595650][ T325] kasan_set_track+0x4a/0x70 [ 22.600228][ T325] kasan_set_free_info+0x23/0x40 [ 22.605152][ T325] ____kasan_slab_free+0x125/0x160 [ 22.610242][ T325] __kasan_slab_free+0x11/0x20 [ 22.614981][ T325] slab_free_freelist_hook+0xc5/0x190 [ 22.620324][ T325] kfree+0xc0/0x270 [ 22.624117][ T325] l2tp_session_put+0xb2/0x1a0 [ 22.628852][ T325] l2tp_session_delete+0x3a9/0x4a0 [ 22.633934][ T325] pppol2tp_release+0x169/0x2b0 [ 22.638757][ T325] sock_close+0xb8/0x200 [ 22.642977][ T325] __fput+0x2dc/0x730 [ 22.646932][ T325] ____fput+0x15/0x20 [ 22.650889][ T325] task_work_run+0x127/0x190 [ 22.655466][ T325] do_exit+0xa7c/0x24e0 [ 22.659595][ T325] __ia32_sys_exit+0x0/0x40 [ 22.664079][ T325] do_syscall_64+0x31/0x40 [ 22.668470][ T325] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 22.674331][ T325] [ 22.676762][ T325] The buggy address belongs to the object at ffff88810f3aac00 [ 22.676762][ T325] which belongs to the cache kmalloc-512 of size 512 [ 22.690803][ T325] The buggy address is located 336 bytes inside of [ 22.690803][ T325] 512-byte region [ffff88810f3aac00, ffff88810f3aae00) [ 22.704046][ T325] The buggy address belongs to the page: [ 22.709698][ T325] page:ffffea00043cea00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10f3a8 [ 22.719908][ T325] head:ffffea00043cea00 order:2 compound_mapcount:0 compound_pincount:0 [ 22.728228][ T325] flags: 0x4000000000010200(slab|head) [ 22.733665][ T325] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 [ 22.742227][ T325] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 22.750783][ T325] page dumped because: kasan: bad access detected [ 22.757179][ T325] page_owner tracks the page as allocated [ 22.762911][ T325] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 97, ts 3877694874, free_ts 0 [ 22.780854][ T325] prep_new_page+0x176/0x190 [ 22.785420][ T325] get_page_from_freelist+0x225f/0x23f0 [ 22.790941][ T325] __alloc_pages_nodemask+0x29a/0x640 [ 22.796299][ T325] new_slab+0x84/0x3f0 [ 22.800360][ T325] ___slab_alloc+0x2f8/0x4c0 [ 22.804930][ T325] __slab_alloc+0x63/0xa0 [ 22.809231][ T325] __kmalloc_track_caller+0x1e4/0x310 [ 22.814578][ T325] __alloc_skb+0xdc/0x520 [ 22.818885][ T325] alloc_skb_with_frags+0xa3/0x560 [ 22.823972][ T325] sock_alloc_send_pskb+0x87f/0x9a0 [ 22.829145][ T325] unix_dgram_sendmsg+0x6f3/0x18f0 [ 22.834228][ T325] sock_write_iter+0x2a6/0x3a0 [ 22.838968][ T325] vfs_write+0x770/0xd70 [ 22.843182][ T325] ksys_write+0x14a/0x260 [ 22.847485][ T325] __x64_sys_write+0x7b/0x90 [ 22.852048][ T325] do_syscall_64+0x31/0x40 [ 22.856438][ T325] page_owner free stack trace missing [ 22.861777][ T325] [ 22.864077][ T325] Memory state around the buggy address: [ 22.869681][ T325] ffff88810f3aac00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.877720][ T325] ffff88810f3aac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.885761][ T325] >ffff88810f3aad00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.893795][ T325] ^ [ 22.900445][ T325] ffff88810f3aad80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.908594][ T325] ffff88810f3aae00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.916642][ T325] ================================================================== [ 22.924682][ T325] Disabling lock debugging due to kernel taint [ 22.931120][ T345] platform pcspkr: uevent: failed to send synthetic uevent [ 22.940157][ T347] exfat: Deprecated parameter 'namecase' [ 22.946943][ T347] exfat: Deprecated parameter 'namecase' [ 22.987275][ T347] exFAT-fs (loop4): failed to load upcase table (idx : 0x0001fe89, chksum : 0xc374f927, utbl_chksum : 0xe619d30d)