last executing test programs: 63.787599ms ago: executing program 1 (id=2): mount$bind(0x0, &(0x7f00000001c0)='./cgroup\x00', &(0x7f0000000200), 0x4000, 0x0) (async) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) syz_open_dev$loop(&(0x7f00000014c0), 0x4, 0x2) (async) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x202, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000dc0)={0x0, 0x3, 0x1000002, 0x0, 0x5, "d52c2000000102000300ecffffff0100"}) syz_open_pts(r1, 0x0) (async) readv(r1, &(0x7f0000000800)=[{&(0x7f0000000540)=""/50, 0x32}], 0x1) close_range(r0, 0xffffffffffffffff, 0x0) (async) r2 = landlock_create_ruleset(&(0x7f0000000040)={0x1000, 0x2, 0x2, 0x19004, 0x0, 0x1}, 0x30, 0x1) landlock_restrict_self(r2, 0x9) (async) landlock_restrict_self(r2, 0x4) 27.50563ms ago: executing program 0 (id=1): landlock_create_ruleset(&(0x7f0000000080)={0x2832, 0x0, 0x2}, 0x18, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r0, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x0, r2}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x36}], 0x1}}], 0x1, 0x60000000) 21.05381ms ago: executing program 1 (id=5): mkdir(&(0x7f00000003c0)='./file0\x00', 0x25) r0 = syz_open_procfs(0x0, &(0x7f0000000540)='mounts\x00') mount(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000140)='ramfs\x00', 0x2008c5a, 0x0) read$FUSE(r0, &(0x7f0000002c00)={0x2020}, 0x2020) openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x42, 0x0) mount$incfs(&(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='./file1\x00', &(0x7f0000000140), 0x90, &(0x7f00000002c0)={[{@rlog_pages={'rlog_pages', 0x3d, 0xffffffffffff89d4}}]}) 18.64412ms ago: executing program 3 (id=4): r0 = getpgrp(0x0) syz_pidfd_open(r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0xf6ffffffffffffff, &(0x7f00000002c0)='.\x00', &(0x7f0000000040), 0x8000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r1}}) 0s ago: executing program 2 (id=3): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000100)={0x6000, 0x9000}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000000)={0x1000, 0x24000, 0x1}) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, &(0x7f0000000500)={0x80a0000, 0x565f87a2f4197ff0}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.101' (ED25519) to the list of known hosts. [ 29.248383][ T36] audit: type=1400 audit(1782829341.240:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 29.257739][ T286] cgroup: Unknown subsys name 'net' [ 29.282118][ T36] audit: type=1400 audit(1782829341.240:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.322049][ T36] audit: type=1400 audit(1782829341.280:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.323295][ T286] cgroup: Unknown subsys name 'devices' [ 29.477651][ T286] cgroup: Unknown subsys name 'hugetlb' [ 29.484533][ T286] cgroup: Unknown subsys name 'rlimit' [ 29.581046][ T36] audit: type=1400 audit(1782829341.570:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 29.608402][ T36] audit: type=1400 audit(1782829341.570:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 29.638615][ T36] audit: type=1400 audit(1782829341.570:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 29.666932][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 29.676676][ T36] audit: type=1400 audit(1782829341.670:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 29.706332][ T36] audit: type=1400 audit(1782829341.670:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.748050][ T36] audit: type=1400 audit(1782829341.740:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.775419][ T36] audit: type=1400 audit(1782829341.740:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.776158][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 30.678704][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.686234][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.693694][ T294] bridge_slave_0: entered allmulticast mode [ 30.700319][ T294] bridge_slave_0: entered promiscuous mode [ 30.707492][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.715127][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.722566][ T293] bridge_slave_0: entered allmulticast mode [ 30.729608][ T293] bridge_slave_0: entered promiscuous mode [ 30.738188][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.745423][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.752823][ T294] bridge_slave_1: entered allmulticast mode [ 30.759647][ T294] bridge_slave_1: entered promiscuous mode [ 30.766365][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.774647][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.782036][ T293] bridge_slave_1: entered allmulticast mode [ 30.789420][ T293] bridge_slave_1: entered promiscuous mode [ 30.814801][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.822333][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.830178][ T295] bridge_slave_0: entered allmulticast mode [ 30.837024][ T295] bridge_slave_0: entered promiscuous mode [ 30.847983][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.856289][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.864470][ T295] bridge_slave_1: entered allmulticast mode [ 30.871249][ T295] bridge_slave_1: entered promiscuous mode [ 30.924524][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.931949][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.939303][ T296] bridge_slave_0: entered allmulticast mode [ 30.945779][ T296] bridge_slave_0: entered promiscuous mode [ 30.967544][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.975103][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.983267][ T296] bridge_slave_1: entered allmulticast mode [ 30.990185][ T296] bridge_slave_1: entered promiscuous mode [ 31.114963][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.123064][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.132163][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.139812][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.157009][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.164692][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.173319][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.181025][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.200507][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.208264][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.216025][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.225252][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.245480][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.254233][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.262625][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.270529][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.307259][ T14] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.316334][ T14] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.324175][ T14] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.332426][ T14] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.340920][ T14] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.348411][ T14] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.356162][ T14] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.363545][ T14] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.386009][ T14] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.393646][ T14] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.419998][ T14] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.427398][ T14] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.437739][ T14] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.445628][ T14] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.454705][ T14] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.462875][ T14] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.472353][ T14] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.480453][ T14] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.490301][ T14] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.497979][ T14] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.541843][ T293] veth0_vlan: entered promiscuous mode [ 31.558732][ T14] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.566279][ T14] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.588493][ T309] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.598429][ T309] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.607305][ T295] veth0_vlan: entered promiscuous mode [ 31.622609][ T293] veth1_macvtap: entered promiscuous mode [ 31.640546][ T294] veth0_vlan: entered promiscuous mode [ 31.668344][ T294] veth1_macvtap: entered promiscuous mode [ 31.676000][ T296] veth0_vlan: entered promiscuous mode [ 31.698442][ T295] veth1_macvtap: entered promiscuous mode [ 31.721915][ T294] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 31.729314][ T296] veth1_macvtap: entered promiscuous mode [ 31.823820][ T322] ======================================================= [ 31.823820][ T322] WARNING: The mand mount option has been deprecated and [ 31.823820][ T322] and is ignored by this kernel. Remove the mand [ 31.823820][ T322] option from the mount to silence this warning. [ 31.823820][ T322] ======================================================= [ 31.876947][ T325] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 31.903295][ T322] ------------[ cut here ]------------ [ 31.909087][ T322] WARNING: CPU: 0 PID: 322 at mm/page_alloc.c:5285 __alloc_pages_noprof+0x109/0x7e0 [ 31.919073][ T322] Modules linked in: [ 31.923493][ T322] CPU: 0 UID: 0 PID: 322 Comm: syz.1.5 Not tainted syzkaller #0 111b2e0850fa4a367413a3971448b32f560820b7 [ 31.935224][ T322] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 31.945638][ T322] RIP: 0010:__alloc_pages_noprof+0x109/0x7e0 [ 31.952024][ T322] Code: 00 0f 1f 44 00 00 83 fb 0b 72 28 b8 00 20 00 00 23 44 24 40 75 1d 80 3d a2 db 0b 06 00 0f 85 c2 00 00 00 c6 05 95 db 0b 06 01 <0f> 0b 31 c0 e9 b4 00 00 00 83 fb 0a 0f 87 a9 00 00 00 44 8b 64 24 [ 31.957685][ T330] IPv6: NLM_F_CREATE should be specified when creating new route [ 31.972442][ T322] RSP: 0018:ffffc9000b74f880 EFLAGS: 00010246 [ 31.988035][ T322] RAX: 0000000000000000 RBX: 0000000000000020 RCX: 0000000000000000 [ 31.996679][ T322] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000b74f938 [ 32.005290][ T322] RBP: ffffc9000b74f9a8 R08: ffffc9000b74f937 R09: 0000000000000000 [ 32.014108][ T322] R10: ffffc9000b74f920 R11: fffff520016e9f27 R12: ffffc9000b74f8c0 [ 32.022857][ T322] R13: dffffc0000000000 R14: 1ffff920016e9f14 R15: 0000000000000000 [ 32.031216][ T322] FS: 00007fd0bb2946c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 32.040568][ T322] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.048311][ T322] CR2: 0000200000001000 CR3: 000000010b768000 CR4: 00000000003526b0 [ 32.056988][ T322] Call Trace: [ 32.060669][ T322] [ 32.063823][ T322] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 32.070242][ T322] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 32.076310][ T322] ? incfs_realloc_mount_info+0xa7/0x4c0 [ 32.082263][ T322] ___kmalloc_large_node+0x81/0x220 [ 32.087758][ T322] ? incfs_realloc_mount_info+0xa7/0x4c0 [ 32.093804][ T322] __kmalloc_large_node_noprof+0x1e/0xd0 [ 32.099774][ T322] ? incfs_realloc_mount_info+0xa7/0x4c0 [ 32.105622][ T322] __kmalloc_noprof+0x326/0x510 [ 32.111224][ T322] ? __cfi_lockref_get+0x10/0x10 [ 32.116577][ T322] incfs_realloc_mount_info+0xa7/0x4c0 [ 32.122092][ T322] ? incfs_add_sysfs_node+0x118/0x230 [ 32.127949][ T322] ? __kasan_check_write+0x18/0x20 [ 32.133297][ T322] incfs_alloc_mount_info+0x478/0x5f0 [ 32.139054][ T322] incfs_mount_fs+0x3ca/0x970 [ 32.143879][ T322] ? __cfi_incfs_mount_fs+0x10/0x10 [ 32.149837][ T322] ? selinux_capable+0x38/0x50 [ 32.155179][ T322] legacy_get_tree+0x103/0x1b0 [ 32.160001][ T322] ? __cfi_incfs_mount_fs+0x10/0x10 [ 32.165505][ T322] vfs_get_tree+0x9e/0x290 [ 32.170173][ T322] do_new_mount+0x251/0xb40 [ 32.175247][ T322] ? security_capable+0x44/0x130 [ 32.180497][ T322] path_mount+0x66a/0xff0 [ 32.185185][ T322] ? putname+0x113/0x150 [ 32.189491][ T322] __se_sys_mount+0x2bf/0x480 [ 32.194876][ T322] ? __x64_sys_mount+0xf0/0xf0 [ 32.200058][ T322] ? __kasan_check_write+0x18/0x20 [ 32.205628][ T322] ? fpregs_restore_userregs+0x11c/0x260 [ 32.211529][ T322] __x64_sys_mount+0xc3/0xf0 [ 32.216232][ T322] x64_sys_call+0x2021/0x2ee0 [ 32.221409][ T322] do_syscall_64+0x57/0xf0 [ 32.226441][ T322] ? clear_bhb_loop+0x50/0xa0 [ 32.231416][ T322] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 32.237780][ T322] RIP: 0033:0x7fd0ba39ce59 [ 32.242439][ T322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.262728][ T322] RSP: 002b:00007fd0bb294028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 32.272367][ T322] RAX: ffffffffffffffda RBX: 00007fd0ba615fa0 RCX: 00007fd0ba39ce59 [ 32.281588][ T322] RDX: 0000200000000140 RSI: 0000200000000100 RDI: 0000200000000000 [ 32.290173][ T322] RBP: 00007fd0ba432e6f R08: 00002000000002c0 R09: 0000000000000000 [ 32.298570][ T322] R10: 0000000000000090 R11: 0000000000000246 R12: 0000000000000000 [ 32.307316][ T322] R13: 00007fd0ba616038 R14: 00007fd0ba615fa0 R15: 00007ffd5079f7f8 [ 32.315619][ T322] [ 32.318697][ T322] ---[ end trace 0000000000000000 ]--- [ 32.325325][ T322] incfs: Error allocating mount info. -12 [ 32.344115][ T322] incfs: mount failed -12