last executing test programs: 552.782244ms ago: executing program 0 (id=1): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x200000, &(0x7f0000000b80)={[{@nombcache}, {@abort}, {@dioread_lock}, {@norecovery}, {@discard}, {@lazytime}, {@noload}, {@usrquota}, {@noauto_da_alloc}]}, 0xfe, 0x558, &(0x7f0000000c00)="$eJzs3U1rG0cfAPD/ynbenOeJAyG0PRRDDk1JI8d2X1LoIT2WNjTQ3lNhb0ywHAVLDrEbaHJoLr2UUCilgdIP0HuPoV+gnyLQBkIJpj30orLyylFsyZZtpVaq3w82mdldaXY0+x/PaCQUwMAaz/4pRLwcEV8nEcdajg1HfnB87bzVJ7dmsi2Jev2TP5JI8n3N85P8/9E881JE/PJlxJnC5nKryyvzpXI5XczzE7WF6xPV5ZWzVxdKc+lcem1qevr8W9NT777zds/q+vqlv777+MEH5786tfrtT4+O30viQhzNj7XWYw9ut2bGYzx/TUbiwoYTJ3tQWD9J9vsC2JWhPM5HIusDjsVQHvXAf98XEVEHBlQi/mFANccBzbl9j+bBL4zH769NgDbXf3jtvZE41JgbHVlNnpkZZfPdsR6Un5Xx8+/372Vb9O59CIBt3b4TEeeGhzf3f0ne/+3euS7O2VjGDvu/+g4vCWjxIBv/vNFu/FNYH/9Em/HPaJvY3Y3t47/wqAfFdJSN/95rO/5dX7QaG8pz/2uM+UaSK1fLada3/T8iTsfIwSy/1XrO+dWHHfup1vFftmXlN8eC+XU8Gj747GNmS7XSXurc6vGdiFfajn+T9fZP2rR/9npc6rKMk+n9Vzsd277+z1f9x4jX2rb/0xWtZOv1yYnG/TDRvCs2+/PuyV87lb/f9c/a/8jW9R9LWtdrqzsv44dDf6edju32/j+QfNpIH8j33SzVaouTEQeSjzbvn3r62Ga+eX5W/9Ontu7/2t3/hyPisy7rf/fE3Y6n9kP7z+6o/XeeePjh5993Kr+79n+zkTqd7+mm/+v2Avfy2gEAAAAAAEC/KUTE0UgKxfV0oVAsrn2+40QcKZQr1dqZK5Wla7PR+K7sWIwUmivdoy2fh5jMPw/bzE9tyE9HxPGI+GbocCNfnKmUZ/e78gAAAAAAAAAAAAAAAAAAANAnRjt8/z/z29B+Xx3w3PnJbxhc28Z/L37pCehL/v7D4BL/MLjEPwwu8Q+DS/zD4BL/MLjEPwwu8Q8AAAAAAAAAAAAAAAAAAAAAAAAAAAA9denixWyrrz65NZPlZ28sL81XbpydTavzxYWlmeJMZfF6ca5SmSunxZnKwnbPV65Urk9OxdLNiVparU1Ul1cuL1SWrtUuX10ozaWX05F/pVYAAAAAAAAAAAAAAAAAAADwYqkur8yXyuV0UUJiV4nh/rgMibVEM7D3/IT72y8BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQKt/AgAA//+jgjYy") lsetxattr$trusted_overlay_upper(&(0x7f0000000040)='./file1\x00', &(0x7f00000000c0), &(0x7f0000000980)=ANY=[], 0x381, 0x0) 452.401799ms ago: executing program 0 (id=6): creat(&(0x7f00000001c0)='./file0\x00', 0x11f) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) futex(&(0x7f0000000140)=0x2, 0x5, 0x100, 0x0, 0x0, 0x0) 371.754933ms ago: executing program 0 (id=7): syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x2000000, &(0x7f0000000180)=ANY=[@ANYBLOB="6572726f72733d636f6e74696e75652c636865636b3d72656c617865642c646d61736b3d30303030303030303030303030303030303030303036322c666c7573682c00ed65503ccec9beef4e3a71579390a78893cf794eabe67967531177a5a8a723cb36529bc238be0bc2df664dee9ab34c2269c61c143e0c11a83b8a7214e0a160bcc29b3c030bf99ccb18520651f6cb1a99bbe9b6f8235a156c38c8cb2a8312538163a9da8fb380c7caa6475b7003c0e3003e88bd4ef6abe8b7c2dad0d8e397576687df8ae41502420d0aba004f5b98e9a286"], 0x1, 0x29b, &(0x7f0000000340)="$eJzs3c9LFG0AB/DHVfHFF8XTy1uXHurUZVDPHZRQkBaKcoMKghHHWnbalZ097EoHO3cJOvYfRMduQfQP+F90k0A8ecqw8dcKXdI08PO5zJf5zjM8zww8c5zNW29eNFaKZCXthMrMQKjMhFDZGQgToRIOrIebb1+9e/3g0eM7s9Xq3P0Y52cXp6ZjjOPXPj95+eH6l86/Dz+OfxoJGxNPN7emv278t3Fl8/vi83oR60VstjoxjUutViddyrO4XC8aSYz38iwtslhvFlm7r1/JW6urvZg2l8dGV9tZUcS02YuNrBc7rdhp92L6LK03Y5IkcWw0cBq19zu7u2Frt3TRs+H8ef+X27FN/Z8Qtte7tW6tPJb9/EJ1bjL+NHw0arvbrQ0e9lNlH/v74TC630+f7A8+LTfKfq+7fbd6YvxIWP7DawcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAODySuKhiaOz291ubbDsk1/1ZZpfqM5N7l/Q3w+Fq0PntgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOJWit9ZI8zxrC78f9h7kXzANQTi7cNE7EwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJy//p/YAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcFkVvbVGmudZ+6zCt//LGx+rLnqNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHBaPwIAAP//P3honA==") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x11, 0x0, 0x0, &(0x7f00000000c0)='GPL\x00', 0x9, 0x0, 0x0, 0x41000, 0x10, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) ftruncate(r0, 0x4a8e) 217.81688ms ago: executing program 2 (id=3): syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000040)='./file1\x00', 0x400, &(0x7f0000000180), 0x2, 0x790, &(0x7f0000006a80)="$eJzs3c1rHOUfAPDvbPPSX9qfjSBoPQUEDZRuTI2tgoeKBxEsFPRsGzbbULPJhuymNCGgRQQvgooHQS89W603r75c9Q/w7kFaqqbFiAeJzL6k22Y33aTZbMt+PjDJ88zM5jvfeWbmebIz7AbQs0bSH5mIwxHxURJxqDY/iYj+Sqkv4mR1vbXVlVw6JbG+/sYfSWWdW6sruWh4TepArfJERPzwfsSRzOa4paXlmclCIb9Qq4+VZ+fHSkvLR8/PTk7np/Nzx8cnJo6deP7E8d3L9a+flw9e//jVZ74++c97j1/98MckTsbB2rLGPHbLSIzU9kl/ugvv8Eq8s9vhuirp9gawI+mpua96lsfhJC33dXuTAIAOS0eh6wBAj0n0/wDQY+rvA9xaXcnVp+6+I7G3brwcEfur+dfvb1aX9NXu2e2v3AcdupXccWckiYjhXYg/EhFffPvWlXSKDt2HBGjm3UsRcXZ4ZPP1P9n0zMJ2PdvGOiN31Tfi/9J/n9GBe/kuHf+80Gz8l9kY/0ST8c9gk3N3J1qe/xsy13YhTEvp+O+lhmfb1hryrxneV6v9vzLm60/OnS/k02vbIxExGv2DaX18ixijN/+92WpZ4/jvz0/e/jKNn/6+vUbmWt/gna+ZmixP3k/OjW5ciniyr57/pYYlyUb7Jy3Gv6fbjPHaix983mpZmn+ab33anH9nrV+OeLpp+99+oi3Z8vnEscrhMFY/KJr45tfPhlrFb2z/dFpbXVlPIq7sfqbNpe0/tHX+w0nj85ql7cf46fKh71sta5J/rv6/UFXz438gebNSHqjNuzhZLi+MRwwkr2+ef+z2a+v1+vpp/qNPNT//tzr+09HJ2Tbz77v++1c7z7+z0vynttX+2y9cXZvZ1yp+e+0/USmN1uZsff2rXrfb3cD73X8AAAAAAAAAAAAAAAAAAAAAAAAA0I5MRByMJJPdKGcy2Wz1O7wfi6FMoVgqHzlXXJybisp3ZQ9Hf6b+UZeHGj4Pdbz2efj1+rG76s9FxKMR8eng/yr1bK5YmOp28gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQc6DF9/+nfhvs9tYBAB2zv9sbAADsOf0/APQe/T8A9B79PwD0Hv0/APQe/T8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAddvrUqXRa/3t1JZfWpy4sLc4ULxydypdmsrOLuWyuuDCfnS4Wpwv5bK44e6+/VygW5ydibvHiWDlfKo+VlpbPzBYX58pnzs9OTufP5Pv3JCsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2J7S0vLMZKGQX1B4CAp9tVZ7ULZnR4VMPYm9CjrQxjrr8zdPbTuLB2Bndq7QxYsSAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwEPkvwAAAP//vI8fOA==") setxattr$trusted_overlay_upper(&(0x7f0000000300)='./file0/file0\x00', &(0x7f00000001c0), &(0x7f0000001380)=ANY=[], 0x835, 0x0) 201.63183ms ago: executing program 3 (id=4): r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) sendmsg$tipc(r1, &(0x7f0000000280)={&(0x7f0000000040), 0x10, 0x0, 0x0, 0x0, 0x0, 0x40800}, 0x0) 196.358901ms ago: executing program 4 (id=5): openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000340)={@local, @multicast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "3c0200", 0x14, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc2, 0x0, 0x0, 0x1}}}}}}}, 0x0) 193.189441ms ago: executing program 0 (id=8): syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000980)={0x8, 0xf, &(0x7f0000000200)=ANY=[@ANYBLOB="1800008080b63428e900"/20, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x47, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000007880)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)="af0ac9", 0x3}], 0x1}}], 0x1, 0x4000000) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x7f, 0x101001) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x60}, 0x1, 0x0, 0x0, 0x14}, 0x10) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) 181.418781ms ago: executing program 1 (id=2): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0900000004000000ff0f000003"], 0x48) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x2004800, &(0x7f0000000300)=ANY=[@ANYBLOB="616c6c6f775f7574696d653d30303030303030303030303030303136323134372c756e695f786c6174653d302c73686f72746e616d653d6d697865642c73686f72746e616d653d77696e6e742c696f636861727365743d6d61637475726b6973682c6e6f6e756d7461696c3d302c696f636861727365743d6b6f69382d72752c756e695f786c6174653d302c696f636861727365743d757466382c6572726f72733d636f6e74696e75652c73686f72746e616d653d6d697865642c73686f72746e616d653d77696e39352c7379735f696d6d757461626c652c757466383d302c0074c3fc52ac6365d676e1"], 0xfe, 0x3bc, &(0x7f0000003040)="$eJzs3cGLG2UUAPC32e3uttrNgiKoiB8FD17Cdv0HukgL4oJSG6kehKmb1ZA0KUlYSREtXrz6H3gvHr0J4j/Qg969eevFYw+lI8kku8k2bV3rbqj+frDMy3zfm3wzQ4a3h+Hdvfrd9cZut7Kb9aJ0IUUpIkr3ItaHUWFhtC0N4+WYdCveLF/9/bUPPvr43a3t7YuXU7q0deWtzZTS2us/f/HlD+d+6T334Y9rP63EnfVP7v65+cedl+68fPfBlc/r3VTvpqV2L2XpWrvdy641a2mn3m1UUnq/Wcu6tVRvdWudqfHdZvvGjX7KWjtnz9zo1LrdlLX6qVHrp1479db6Kfssq7dSpVJJZ88ET1K9fflytlXEq4+Zd+GkFsQx6HS2ssFveOWhkertuSwIAJirp63/l5+u/m9N1/+notuovPBGcegj1/8d9f8RTdb//FcN6v/l0e83IvKD/wPU/wAAAAAAAAAAAAAA8Cy4l+flPM/L4+3+ywGjz3NeHsfsoft/6G/e6+N4Tby4txrR/HavulcttsX41m7Uoxm12Ihy3B88FsaK+NI72xc30tB6nL3+9TD/3K8R1cXp/PNRjvXZ+eeL/LSfH4PtqTgzmb8Z5Xhxdv7mfn6+cJC/HBvfT+RXohy/fRrtaMbO8PF2kP/V+ZTefm/70PevDOcBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8P9QSWOvRtH3fq8acTr2Rv37KwcT1qf74xf5o/76pdiIctyf3Z9/Y2Z//6V4ZWm+5w4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY93+zUbWbNY6JxWMe/4P9yyPg0dnLRTTbx0aOh3Tk1eedJy/H+R5nj/I83xqqHSk45weneSMocGRv1kthos9O61/6/KuLpzorXya4FREPGZOPrqAk0OL8U++6/n96zxzzkpEHOuZrg2C0tHTyzHn23TijyIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACYu/2m34MPC/NeDQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPPS7d9sZM3mYmcU1KaDpTi8J2suxiMmPyqY9zkCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8S/4KAAD//31oB3w=") open(&(0x7f0000000200)='./file0\x00', 0x4827e, 0x10f) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fchdir(r1) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) splice(r2, 0x0, r5, 0x0, 0x6, 0xc) vmsplice(r3, &(0x7f0000000200)=[{&(0x7f0000001740)='\x00', 0x1}], 0x1, 0x6) close(r0) 156.788252ms ago: executing program 4 (id=9): add_key(0x0, 0x0, &(0x7f00000001c0)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4ab59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8", 0x13c, 0xfffffffffffffffd) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r0) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="21032cbd7000fedbdf25010000000400030004000180280002800c00018008000100060000000c00"], 0x44}, 0x1, 0x0, 0x0, 0x24044094}, 0x4) 153.773313ms ago: executing program 3 (id=10): syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000980)={0x8, 0xf, &(0x7f0000000200)=ANY=[@ANYBLOB="1800008080b63428e900"/20, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x47, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000007880)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)="af0ac9", 0x3}], 0x1}}], 0x1, 0x4000000) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x7f, 0x101001) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) 119.181884ms ago: executing program 3 (id=11): syz_mount_image$ext4(&(0x7f0000000c00)='ext4\x00', &(0x7f0000000c40)='./file0\x00', 0x0, &(0x7f0000000c80), 0x1, 0xbf6, &(0x7f0000000cc0)="$eJzs2M9ro2kdAPDv+ybpdn5ouyLietmihx3QTSbttIyrhx1EBHFhQI/CbGgzaW3SlCaFbfZglzl48dCDLIh4EAQPeigevDp48OZNhf0DBF0YPOhNJfKmSbc7baadnbQvM/184Jk+z/tN8v2+efK8875PAJfWXPZPGvFKRLydRMwMj6cRMTXoTUfsHrxub2F/NWtJ9Pvf/WcSSUT0FvZXR5+VDP9eG37AjYj4w4OIdx8cz9vZ6a3Xms361nBc6bY2K52d3utrrVqj3qhvVOdv31pcXKouLk3sXP/6wwf/+dq3v3H3/W/+7Sv/+Mvv303izbg+jB09j0mZi7nhd1KKu0eOFyPiB5NOlpPC8HwKeRcCAMCZZPf5n4mIL0bE52ImCoO7uQMz8bPf5FocAAAAMBH9QkQfAAAAeKHlvf8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMDzod9Pog8AAAC80PLefwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4PnSW9hfHbW8a+HiPLoTEbMH8783bAeRYuwO/k5HKSKu/iuJ4pH3JRFxcwL55yJi93f/+1HWYvg7nMDHcka770XE509a/8lg/mdjejB6fP7TiHh7AvnnHhub/4v1LPO/OYH85h8AAOBiPLxzsJFz/PkvPdz/iROe/woR8eYE8p/+/Jd+OIE0jPHoTsTXI2Lv2P5fOnrJbGE4+tRgP6CU3F9r1m9GxKcj4kaUXsrG1SfkeHW52BsXO7r/l7Us/2gvcFjHh8WXPv6elVq39iznzEcevRfxheJJ858crv9kzP7v7hlz/Hvul38aFzt9/jlP/V9EvHbi+k8OX5P1Kt3WZqWz03t9rVVr1Bv1jer87VuLi0vVxaXK4HpQGV0VjvvjrZ/Pj8tv/vOVrf+rT57/wfW/s9NbrzWb9a3O0+f41X+/9dNxsU96/Z9KvjcocGp47J1at7tVjZhKvnP8+Nhf3+Uz+j5G31c2/ze+dPL//0+6/me/ib0z5vz1j9+/PS5m/ecrm/+VU9Z/8rH1//Sd336/+edx+c+2/m8NirkxPOL+73RnnaC86wQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGEkj4nokafmwn6blcsS1iPhsXE2b7U73y/fb2xsrWSxiNkrp/bVm/WZEzByMk2xcHfQ/Gs8/Nl6IiJcj4iczVwbj8nK7uZL3yQMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHDoWkRcjyQtR0Q66KdpuXwQ+/tM3tUBAAAAEzObdwEAAADAufP8DwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAzuvvWW1nr7y3sr2bjjXZjbX1186vzN8ut7eXycntrs9xotxvNenm53Tr985rt9mZ1IbbfqXTrnW6ls9O712pvb3TvrbVqjfq9eukCzgkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICn9/KrDz9IImL3jSuDlpkaxkq5VgactzTvAoDcFPIuAMhNMe8CgNx4xgeSU+LTYyPuIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAuk9deefhBEhG7b1wZtMzUMFbKtTLgvKV5FwDkppB3AUBuinkXAOTGMz6QnBKfHhtxBwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwmXR2euu1ZrO+paOjo3PYyfvKBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC8aP4fAAD//zvzDkA=") r0 = open(&(0x7f00000000c0)='.\x00', 0x8000, 0x50) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000000)='7', 0x1) getdents(r0, 0x0, 0x1517f) 112.915594ms ago: executing program 0 (id=12): r0 = syz_open_dev$evdev(&(0x7f0000000240), 0x0, 0x0) ioctl$EVIOCGMASK(r0, 0x80104592, &(0x7f0000000300)={0x0, 0xffffffffffffff36, &(0x7f0000000200)="952bb3e006ae9a4c3a"}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, 0x0) 112.402754ms ago: executing program 4 (id=13): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @multicast1}, 0x2}}, 0x2e) ioctl$PPPIOCGL2TPSTATS(r2, 0x80487436, &(0x7f0000000040)="d9b604") 96.472315ms ago: executing program 2 (id=14): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000000300)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000340)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) write$UHID_DESTROY(0xffffffffffffffff, 0x0, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) connect$unix(r2, &(0x7f0000000640)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r0, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) 0s ago: executing program 0 (id=15): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000180)={0x0, &(0x7f0000000040)}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r0, 0x40104d01, &(0x7f0000000180)="000002f2ffffff00000002") kernel console output (not intermixed with test programs): rocess permissive=1 [ 13.875833][ T24] audit: type=1400 audit(1790221501.910:63): avc: denied { siginh } for pid=217 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.154' (ED25519) to the list of known hosts. [ 20.427671][ T24] audit: type=1400 audit(1790221508.480:64): avc: denied { mounton } for pid=271 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 20.428670][ T271] cgroup: Unknown subsys name 'net' [ 20.450331][ T24] audit: type=1400 audit(1790221508.480:65): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.477571][ T24] audit: type=1400 audit(1790221508.510:66): avc: denied { unmount } for pid=271 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.477709][ T271] cgroup: Unknown subsys name 'devices' [ 20.591430][ T271] cgroup: Unknown subsys name 'hugetlb' [ 20.597016][ T271] cgroup: Unknown subsys name 'rlimit' [ 20.703942][ T24] audit: type=1400 audit(1790221508.760:67): avc: denied { setattr } for pid=271 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 20.727172][ T24] audit: type=1400 audit(1790221508.760:68): avc: denied { mounton } for pid=271 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 20.736777][ T273] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 20.752042][ T24] audit: type=1400 audit(1790221508.760:69): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 20.783677][ T271] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 20.783749][ T24] audit: type=1400 audit(1790221508.820:70): avc: denied { relabelto } for pid=273 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.817751][ T24] audit: type=1400 audit(1790221508.820:71): avc: denied { write } for pid=273 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.843369][ T24] audit: type=1400 audit(1790221508.830:72): avc: denied { read } for pid=271 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.868984][ T24] audit: type=1400 audit(1790221508.830:73): avc: denied { open } for pid=271 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.336374][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.343537][ T279] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.351042][ T279] device bridge_slave_0 entered promiscuous mode [ 21.358751][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.365957][ T279] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.373255][ T279] device bridge_slave_1 entered promiscuous mode [ 21.448866][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.455967][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.463512][ T281] device bridge_slave_0 entered promiscuous mode [ 21.471396][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.478415][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.485800][ T281] device bridge_slave_1 entered promiscuous mode [ 21.516136][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.523278][ T280] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.530693][ T280] device bridge_slave_0 entered promiscuous mode [ 21.537470][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.544530][ T280] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.551893][ T280] device bridge_slave_1 entered promiscuous mode [ 21.594024][ T284] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.601158][ T284] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.608419][ T284] device bridge_slave_0 entered promiscuous mode [ 21.617550][ T284] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.624679][ T284] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.632098][ T284] device bridge_slave_1 entered promiscuous mode [ 21.653606][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.660704][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.667961][ T285] device bridge_slave_0 entered promiscuous mode [ 21.677709][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.684783][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.692153][ T285] device bridge_slave_1 entered promiscuous mode [ 21.804494][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.811565][ T279] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.818855][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.825933][ T279] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.844115][ T284] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.851169][ T284] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.858402][ T284] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.865441][ T284] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.873377][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.880447][ T281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.887702][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.894728][ T281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.916934][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.923991][ T280] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.931257][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.938272][ T280] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.970262][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.977478][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.985063][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.992273][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.999417][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.006639][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.014010][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.021319][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.028943][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 22.036374][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.062296][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.070148][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.078249][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.085307][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.092997][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.101278][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.108281][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.115949][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.124121][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.131154][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.150500][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.158647][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.165685][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.173018][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.180535][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.188614][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.195640][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.203208][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.211765][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.218787][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.226176][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.234093][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.244046][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.264893][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.272929][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.281908][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.288937][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.296399][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.304424][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.312647][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.319681][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.327125][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.346267][ T281] device veth0_vlan entered promiscuous mode [ 22.352911][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 22.360882][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.368222][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 22.377427][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.385628][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.392653][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.400119][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 22.408357][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.416577][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.423605][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.431074][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 22.439087][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.447063][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 22.455423][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.463826][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 22.471725][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.479586][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 22.487324][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.494698][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.508064][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 22.516440][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.529579][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 22.538332][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.546433][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 22.554589][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.563436][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 22.571631][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.584880][ T284] device veth0_vlan entered promiscuous mode [ 22.595424][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 22.603841][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.612357][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 22.620725][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.628663][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 22.636907][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.644923][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.652357][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.660431][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 22.668291][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.678675][ T281] device veth1_macvtap entered promiscuous mode [ 22.692120][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.699522][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.706983][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 22.715106][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.723609][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 22.731306][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 22.739438][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.747802][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.756338][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.771344][ T285] device veth0_vlan entered promiscuous mode [ 22.780053][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 22.788423][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.796817][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 22.805306][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.813352][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 22.821740][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.832437][ T279] device veth0_vlan entered promiscuous mode [ 22.838947][ T281] request_module fs-gadgetfs succeeded, but still no fs? [ 22.838973][ T284] device veth1_macvtap entered promiscuous mode [ 22.853941][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.861738][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.869052][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 22.883290][ T281] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 22.886193][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 22.902824][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.911587][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 22.919796][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.929212][ T280] device veth0_vlan entered promiscuous mode [ 22.937621][ T279] device veth1_macvtap entered promiscuous mode [ 22.949516][ T285] device veth1_macvtap entered promiscuous mode [ 22.957447][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.958072][ T305] EXT4-fs (loop0): mounted filesystem without journal. Opts: nombcache,abort,dioread_lock,norecovery,discard,lazytime,noload,usrquota,noauto_da_alloc,,errors=continue [ 22.966266][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 22.997125][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.005248][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.013587][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.021805][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.030123][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.037527][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.049941][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.058185][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.067006][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.075399][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.093868][ T280] device veth1_macvtap entered promiscuous mode [ 23.108346][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.117408][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.126232][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.140671][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.149059][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.157339][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.165526][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.173412][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.181824][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.190233][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.198381][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.208714][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.217028][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.276990][ T322] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Dropping request. Check SNMP counters. [ 23.277678][ T315] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 23.439329][ T341] ================================================================== [ 23.447458][ T341] BUG: KASAN: use-after-free in rcu_segcblist_enqueue+0x85/0xa0 [ 23.455081][ T341] Write of size 8 at addr ffff88810f8bc990 by task syz.4.13/341 [ 23.462697][ T341] [ 23.465017][ T341] CPU: 1 PID: 341 Comm: syz.4.13 Not tainted syzkaller #0 [ 23.472098][ T341] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 23.482131][ T341] Call Trace: [ 23.485401][ T341] __dump_stack+0x21/0x24 [ 23.489705][ T341] dump_stack_lvl+0x1a7/0x208 [ 23.494376][ T341] ? show_regs_print_info+0x18/0x18 [ 23.499553][ T341] ? thaw_kernel_threads+0x220/0x220 [ 23.504816][ T341] print_address_description+0x7f/0x2c0 [ 23.510348][ T341] ? rcu_segcblist_enqueue+0x85/0xa0 [ 23.515611][ T341] kasan_report+0x100/0x140 [ 23.520091][ T341] ? rcu_segcblist_enqueue+0x85/0xa0 [ 23.525354][ T341] __asan_report_store8_noabort+0x17/0x20 [ 23.531050][ T341] rcu_segcblist_enqueue+0x85/0xa0 [ 23.536139][ T341] call_rcu+0x4df/0x1090 [ 23.540449][ T341] ? rcu_gp_kthread_wake+0x90/0x90 [ 23.545539][ T341] ? __kasan_check_write+0x14/0x20 [ 23.550624][ T341] ? __wake_up_bit+0x120/0x120 [ 23.555365][ T341] security_inode_free+0xb4/0xd0 [ 23.560282][ T341] __destroy_inode+0x175/0x4f0 [ 23.565022][ T341] evict+0x7e8/0x940 [ 23.568891][ T341] ? mode_strip_sgid+0x150/0x150 [ 23.573801][ T341] ? _raw_spin_lock+0x94/0xf0 [ 23.578451][ T341] ? _raw_spin_trylock_bh+0x150/0x150 [ 23.583809][ T341] ? __kasan_check_read+0x11/0x20 [ 23.588810][ T341] ? __kasan_check_write+0x14/0x20 [ 23.593899][ T341] iput+0x654/0x7e0 [ 23.597685][ T341] dentry_unlink_inode+0x2d5/0x390 [ 23.602776][ T341] __dentry_kill+0x45b/0x660 [ 23.607344][ T341] dentry_kill+0xc0/0x2a0 [ 23.611649][ T341] dput+0x42/0x80 [ 23.615261][ T341] __fput+0x4bd/0x730 [ 23.619241][ T341] ____fput+0x15/0x20 [ 23.623199][ T341] task_work_run+0x127/0x190 [ 23.627773][ T341] exit_to_user_mode_loop+0xcb/0xe0 [ 23.632949][ T341] exit_to_user_mode_prepare+0x76/0xa0 [ 23.638387][ T341] syscall_exit_to_user_mode+0x1d/0x40 [ 23.643823][ T341] do_syscall_64+0x3d/0x40 [ 23.648304][ T341] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 23.654170][ T341] RIP: 0033:0x7f827053e159 [ 23.658665][ T341] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 23.678248][ T341] RSP: 002b:00007ffcb367eb58 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 23.686724][ T341] RAX: 0000000000000000 RBX: 00007ffcb367ec40 RCX: 00007f827053e159 [ 23.694763][ T341] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 23.702715][ T341] RBP: 0000000000005b77 R08: 0000000000000001 R09: 0000000000000000 [ 23.710691][ T341] R10: 0000001b2d620000 R11: 0000000000000246 R12: 00007ffcb367ec80 [ 23.718646][ T341] R13: 00007f82707c5fac R14: 0000000000005bad R15: 00007f82707c5fa0 [ 23.726596][ T341] [ 23.728902][ T341] Allocated by task 342: [ 23.733135][ T341] __kasan_kmalloc+0xd4/0x100 [ 23.737788][ T341] __kmalloc+0x19f/0x330 [ 23.742011][ T341] l2tp_session_create+0x39/0xb60 [ 23.747011][ T341] pppol2tp_connect+0xbf5/0x1640 [ 23.751930][ T341] __sys_connect+0x3ce/0x450 [ 23.756492][ T341] __x64_sys_connect+0x7a/0x90 [ 23.761231][ T341] do_syscall_64+0x31/0x40 [ 23.765626][ T341] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 23.771488][ T341] [ 23.773788][ T341] Freed by task 7: [ 23.777482][ T341] kasan_set_track+0x4a/0x70 [ 23.782046][ T341] kasan_set_free_info+0x23/0x40 [ 23.786958][ T341] ____kasan_slab_free+0x125/0x160 [ 23.792061][ T341] __kasan_slab_free+0x11/0x20 [ 23.796797][ T341] slab_free_freelist_hook+0xc5/0x190 [ 23.802140][ T341] kfree+0xc0/0x270 [ 23.805923][ T341] l2tp_session_put+0xb2/0x1a0 [ 23.810659][ T341] l2tp_session_delete+0x3a9/0x4a0 [ 23.815740][ T341] l2tp_tunnel_del_work+0x180/0x3d0 [ 23.820913][ T341] process_one_work+0x6fd/0xbc0 [ 23.825740][ T341] worker_thread+0xa8e/0x13c0 [ 23.830391][ T341] kthread+0x324/0x3b0 [ 23.834437][ T341] ret_from_fork+0x1f/0x30 [ 23.838822][ T341] [ 23.841147][ T341] Last potentially related work creation: [ 23.846845][ T341] kasan_save_stack+0x3a/0x60 [ 23.851501][ T341] __kasan_record_aux_stack+0xd2/0x100 [ 23.856935][ T341] kasan_record_aux_stack_noalloc+0xb/0x10 [ 23.862715][ T341] call_rcu+0x11a/0x1090 [ 23.866932][ T341] pppol2tp_release+0x1e3/0x2b0 [ 23.871805][ T341] sock_close+0xb8/0x200 [ 23.876067][ T341] __fput+0x2dc/0x730 [ 23.880041][ T341] ____fput+0x15/0x20 [ 23.884003][ T341] task_work_run+0x127/0x190 [ 23.888608][ T341] exit_to_user_mode_loop+0xcb/0xe0 [ 23.893784][ T341] exit_to_user_mode_prepare+0x76/0xa0 [ 23.899221][ T341] syscall_exit_to_user_mode+0x1d/0x40 [ 23.904660][ T341] do_syscall_64+0x3d/0x40 [ 23.909055][ T341] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 23.915013][ T341] [ 23.917319][ T341] The buggy address belongs to the object at ffff88810f8bc800 [ 23.917319][ T341] which belongs to the cache kmalloc-512 of size 512 [ 23.931351][ T341] The buggy address is located 400 bytes inside of [ 23.931351][ T341] 512-byte region [ffff88810f8bc800, ffff88810f8bca00) [ 23.944598][ T341] The buggy address belongs to the page: [ 23.950224][ T341] page:ffffea00043e2f00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10f8bc [ 23.960433][ T341] head:ffffea00043e2f00 order:2 compound_mapcount:0 compound_pincount:0 [ 23.968739][ T341] flags: 0x4000000000010200(slab|head) [ 23.974176][ T341] raw: 4000000000010200 ffffea00043b6700 0000000300000003 ffff888100043080 [ 23.982734][ T341] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 23.991289][ T341] page dumped because: kasan: bad access detected [ 23.997674][ T341] page_owner tracks the page as allocated [ 24.003390][ T341] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 101, ts 3990052965, free_ts 0 [ 24.021415][ T341] prep_new_page+0x176/0x190 [ 24.025978][ T341] get_page_from_freelist+0x225f/0x23f0 [ 24.031496][ T341] __alloc_pages_nodemask+0x29a/0x640 [ 24.036839][ T341] new_slab+0x84/0x3f0 [ 24.040883][ T341] ___slab_alloc+0x2f8/0x4c0 [ 24.045444][ T341] __slab_alloc+0x63/0xa0 [ 24.049746][ T341] __kmalloc_track_caller+0x1e4/0x310 [ 24.055088][ T341] __alloc_skb+0xdc/0x520 [ 24.059391][ T341] alloc_skb_with_frags+0xa3/0x560 [ 24.064478][ T341] sock_alloc_send_pskb+0x87f/0x9a0 [ 24.069649][ T341] unix_dgram_sendmsg+0x6f3/0x18f0 [ 24.074733][ T341] sock_write_iter+0x2a6/0x3a0 [ 24.079468][ T341] vfs_write+0x770/0xd70 [ 24.083694][ T341] ksys_write+0x14a/0x260 [ 24.087997][ T341] __x64_sys_write+0x7b/0x90 [ 24.092563][ T341] do_syscall_64+0x31/0x40 [ 24.096950][ T341] page_owner free stack trace missing [ 24.102290][ T341] [ 24.104593][ T341] Memory state around the buggy address: [ 24.110197][ T341] ffff88810f8bc880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.118228][ T341] ffff88810f8bc900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.126261][ T341] >ffff88810f8bc980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.134303][ T341] ^ [ 24.138885][ T341] ffff88810f8bca00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.146929][ T341] ffff88810f8bca80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.154969][ T341] ================================================================== [ 24.163002][ T341] Disabling lock debugging due to kernel taint [ 24.188079][ T337] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue [ 24.197550][ T331] FAT-fs (loop1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 24.218094][ T346] type: 8192 invalid [ 24.232295][ T331] FAT-fs (loop1): error, fat_get_cluster: invalid start cluster (i_pos 0, start 22000003) [ 24.245474][ T337] FAULT_INJECTION: forcing a failure. [ 24.245474][ T337] name failslab, interval 1, probability 0, space 0, times 1 [ 24.265816][ T337] CPU: 0 PID: 337 Comm: syz.3.11 Tainted: G B syzkaller #0 [ 24.274340][ T337] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 24.284404][ T337] Call Trace: [ 24.287698][ T337] __dump_stack+0x21/0x24 [ 24.292034][ T337] dump_stack_lvl+0x1a7/0x208 [ 24.296723][ T337] ? thaw_kernel_threads+0x220/0x220 [ 24.302009][ T337] ? __ext4fs_dirhash+0x6b7/0xf00 [ 24.307125][ T337] ? show_regs_print_info+0x18/0x18 [ 24.312328][ T337] ? __ext4fs_dirhash+0xf00/0xf00 [ 24.317360][ T337] dump_stack+0x15/0x1c [ 24.321523][ T337] should_fail+0x3ab/0x500 [ 24.325936][ T337] ? ext4_htree_store_dirent+0x8d/0x5c0 [ 24.331481][ T337] __should_failslab+0xa4/0xe0 [ 24.336239][ T337] should_failslab+0x9/0x20 [ 24.340746][ T337] __kmalloc+0x60/0x330 [ 24.344905][ T337] ext4_htree_store_dirent+0x8d/0x5c0 [ 24.350279][ T337] htree_dirblock_to_tree+0x838/0xe10 [ 24.355654][ T337] ? ext4_htree_fill_tree+0x10e0/0x10e0 [ 24.361201][ T337] ? ext4_readdir+0x4b5/0x3a80 [ 24.365970][ T337] ? __kasan_kmalloc+0xe6/0x100 [ 24.370824][ T337] ? __kasan_kmalloc+0xd4/0x100 [ 24.375669][ T337] ? kmem_cache_alloc_trace+0x179/0x2e0 [ 24.381207][ T337] ? ext4_readdir+0x4b5/0x3a80 [ 24.385956][ T337] ? iterate_dir+0x25c/0x560 [ 24.390545][ T337] ext4_htree_fill_tree+0x60f/0x10e0 [ 24.395826][ T337] ? ext4_handle_dirty_dirblock+0x650/0x650 [ 24.401725][ T337] ? kmem_cache_alloc_trace+0x179/0x2e0 [ 24.407276][ T337] ? ext4_readdir+0x4b5/0x3a80 [ 24.412034][ T337] ext4_readdir+0x2bcf/0x3a80 [ 24.416720][ T337] ? ext4_dir_llseek+0x480/0x480 [ 24.421656][ T337] ? rw_verify_area+0x1c0/0x360 [ 24.426503][ T337] ? vfs_write+0xae4/0xd70 [ 24.430925][ T337] ? avc_policy_seqno+0x1b/0x70 [ 24.435774][ T337] ? fsnotify_perm+0x311/0x4a0 [ 24.440535][ T337] ? __kasan_check_write+0x14/0x20 [ 24.445637][ T337] iterate_dir+0x25c/0x560 [ 24.450046][ T337] ? ext4_dir_llseek+0x480/0x480 [ 24.454984][ T337] __se_sys_getdents+0xf2/0x250 [ 24.459826][ T337] ? __x64_sys_getdents+0x90/0x90 [ 24.464872][ T337] ? switch_fpu_return+0x19c/0x330 [ 24.469984][ T337] ? fillonedir+0x430/0x430 [ 24.474480][ T337] ? fpu__clear_all+0x20/0x20 [ 24.479150][ T337] ? __kasan_check_read+0x11/0x20 [ 24.484253][ T337] __x64_sys_getdents+0x7b/0x90 [ 24.489098][ T337] do_syscall_64+0x31/0x40 [ 24.493516][ T337] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 24.499401][ T337] RIP: 0033:0x7f6fb192e159 [ 24.503818][ T337] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 24.523416][ T337] RSP: 002b:00007f6fb0387028 EFLAGS: 00000246 ORIG_RAX: 000000000000004e [ 24.531827][ T337] RAX: ffffffffffffffda RBX: 00007f6fb1bb5fa0 RCX: 00007f6fb192e159 [ 24.539789][ T337] RDX: 000000000001517f RSI: 0000000000000000 RDI: 0000000000000004 [ 24.547751][ T337] RBP: 00007f6fb19c506b R08: 0000000000000000 R09: 0000000000000000 [ 24.555715][ T337] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 24.563679][ T337] R13: 00007f6fb1bb6038 R14: 00007f6fb1bb5fa0 R15: 00007ffc37c1b6e8