last executing test programs: 82.670448ms ago: executing program 3 (id=4): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x102, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000000)={[{0x2000001, 0x4, 0xc4, 0x53, 0x3d, 0x2, 0x80, 0x41, 0x6b, 0x45, 0x6, 0x0, 0x800000001}, {0xb, 0xaff2, 0x8, 0x8, 0x33, 0xfd, 0x6, 0x3, 0xe, 0x7, 0x7, 0x6, 0x3}, {0x0, 0x6, 0x5, 0x10, 0x21, 0x10, 0x7, 0xbb, 0x4, 0x15, 0x0, 0x2, 0xfffffffffffffb97}], 0x9}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x8, 0x3, 0xff, 0x81, 0x57e, 0xfffffffffbfffffd, 0x4002004c4, 0xfffffffffffffffa, 0x3, 0x8, 0x9, 0x1, 0x2, 0x3, 0x8, 0xfffffffffffff001], 0x10000, 0x2100}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 76.239858ms ago: executing program 0 (id=1): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a300000001f0900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000680)={{0x14}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @hash={{0x9}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_HASH_SREG={0x8, 0x1, 0x1, 0x0, 0x12}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x74}}, 0x0) 0s ago: executing program 0 (id=6): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060"], 0xb8}}, 0x20040014) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x200, 0x0, 0x25dfdbfb, {{@in=@loopback, @in6=@local, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x80, 0x3b, 0x0, 0xee01}, {0x0, 0x4, 0x0, 0x0, 0x40, 0xfffffffffffffffd, 0x2}, {0xfffffffffffffffe}, 0x9, 0x40000000, 0x0, 0x1, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x0) r2 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) sendmsg$key(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000020000000000fc00000000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x80c0}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="b80000001300e9990500000000000000fc000000000000000000000000000000fc00000000000000000000000000000000000000000000000a0030"], 0xb8}}, 0x4000) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.18' (ED25519) to the list of known hosts. [ 21.139931][ T30] audit: type=1400 audit(1779100760.466:64): avc: denied { mounton } for pid=277 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.140938][ T277] cgroup: Unknown subsys name 'net' [ 21.162585][ T30] audit: type=1400 audit(1779100760.466:65): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.189856][ T30] audit: type=1400 audit(1779100760.496:66): avc: denied { unmount } for pid=277 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.190038][ T277] cgroup: Unknown subsys name 'devices' [ 21.305168][ T277] cgroup: Unknown subsys name 'hugetlb' [ 21.310780][ T277] cgroup: Unknown subsys name 'rlimit' [ 21.446926][ T30] audit: type=1400 audit(1779100760.776:67): avc: denied { setattr } for pid=277 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.470125][ T30] audit: type=1400 audit(1779100760.776:68): avc: denied { mounton } for pid=277 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 21.494956][ T30] audit: type=1400 audit(1779100760.776:69): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.499502][ T279] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 21.526847][ T30] audit: type=1400 audit(1779100760.856:70): avc: denied { relabelto } for pid=279 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.552382][ T30] audit: type=1400 audit(1779100760.856:71): avc: denied { write } for pid=279 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.562889][ T277] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.578176][ T30] audit: type=1400 audit(1779100760.886:72): avc: denied { read } for pid=277 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.612159][ T30] audit: type=1400 audit(1779100760.886:73): avc: denied { open } for pid=277 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.061370][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.068641][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.076129][ T285] device bridge_slave_0 entered promiscuous mode [ 22.103954][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.111007][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.118458][ T285] device bridge_slave_1 entered promiscuous mode [ 22.192618][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.199931][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.207332][ T290] device bridge_slave_0 entered promiscuous mode [ 22.214649][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.221698][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.229292][ T290] device bridge_slave_1 entered promiscuous mode [ 22.291574][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.298772][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.306183][ T286] device bridge_slave_0 entered promiscuous mode [ 22.313069][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.320259][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.327668][ T287] device bridge_slave_0 entered promiscuous mode [ 22.336210][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.343245][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.350707][ T287] device bridge_slave_1 entered promiscuous mode [ 22.360479][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.367552][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.374884][ T286] device bridge_slave_1 entered promiscuous mode [ 22.440356][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.447702][ T292] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.455131][ T292] device bridge_slave_0 entered promiscuous mode [ 22.462114][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.469291][ T292] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.476673][ T292] device bridge_slave_1 entered promiscuous mode [ 22.581720][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.588797][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.596098][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.603122][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.642038][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.649110][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.656396][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.663435][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.679118][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.686967][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.694397][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.701798][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.709897][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 22.717395][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.741254][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.748990][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.757426][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.764473][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.771910][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.780048][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.787083][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.794701][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 22.812643][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.820791][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 22.829287][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.837631][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.844694][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.852397][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 22.860713][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.868824][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.875855][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.883152][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 22.907995][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.915964][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.924129][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.932235][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.939270][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.947064][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.955250][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.962287][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.969643][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.977583][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.001986][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.009485][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.017286][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.025503][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.032517][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.039953][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.048108][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 23.068258][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.076480][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.083528][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.090850][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.099199][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.106270][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.114436][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.122512][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.129550][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.136927][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.144972][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.152826][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.168835][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.176934][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.185082][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.193088][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.201213][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.209697][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.221905][ T287] device veth0_vlan entered promiscuous mode [ 23.236516][ T290] device veth0_vlan entered promiscuous mode [ 23.246842][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.255053][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.263003][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.271589][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.280105][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.288174][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.296201][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.304594][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.312826][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.320428][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.327898][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.335337][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.352737][ T285] device veth0_vlan entered promiscuous mode [ 23.362909][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.371389][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.380144][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.388686][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.397540][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.405393][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.413269][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.421137][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.429133][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.436710][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.444278][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.451617][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.461088][ T292] device veth0_vlan entered promiscuous mode [ 23.470950][ T287] device veth1_macvtap entered promiscuous mode [ 23.478601][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.486501][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.494478][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.502515][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.510844][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.518642][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.526152][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.534192][ T286] device veth0_vlan entered promiscuous mode [ 23.542145][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.550541][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.561220][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.574997][ T290] device veth1_macvtap entered promiscuous mode [ 23.582881][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.590705][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.599131][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.610619][ T285] device veth1_macvtap entered promiscuous mode [ 23.617392][ T292] device veth1_macvtap entered promiscuous mode [ 23.626434][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.634106][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.642257][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.650764][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.659124][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.669231][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.677444][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.693953][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.702173][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.710638][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.719011][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.727508][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.735706][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.744105][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.752201][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.763309][ T286] device veth1_macvtap entered promiscuous mode [ 23.774710][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.782327][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.790802][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.799260][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.807505][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.828337][ T290] request_module fs-gadgetfs succeeded, but still no fs? [ 23.851955][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.876027][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.884983][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.896296][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.897266][ T313] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 23.910452][ T316] ================================================================== [ 23.928509][ T316] BUG: KASAN: slab-out-of-bounds in xfrm_policy_inexact_list_reinsert+0x606/0x6c0 [ 23.937721][ T316] Read of size 1 at addr ffff88810f1f63f8 by task syz.0.6/316 [ 23.945183][ T316] [ 23.947506][ T316] CPU: 0 PID: 316 Comm: syz.0.6 Not tainted syzkaller #0 [ 23.954613][ T316] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 23.964664][ T316] Call Trace: [ 23.968032][ T316] [ 23.970973][ T316] __dump_stack+0x21/0x30 [ 23.975310][ T316] dump_stack_lvl+0x110/0x170 [ 23.979981][ T316] ? show_regs_print_info+0x20/0x20 [ 23.985175][ T316] ? load_image+0x3e0/0x3e0 [ 23.989674][ T316] ? unwind_get_return_address+0x4d/0x90 [ 23.995303][ T316] print_address_description+0x7f/0x2c0 [ 24.000860][ T316] ? xfrm_policy_inexact_list_reinsert+0x606/0x6c0 [ 24.007357][ T316] kasan_report+0xf1/0x140 [ 24.011767][ T316] ? xfrm_policy_inexact_list_reinsert+0x606/0x6c0 [ 24.018271][ T316] __asan_report_load1_noabort+0x14/0x20 [ 24.023902][ T316] xfrm_policy_inexact_list_reinsert+0x606/0x6c0 [ 24.030233][ T316] xfrm_policy_inexact_insert_node+0x938/0xb50 [ 24.036403][ T316] ? xfrm_netlink_rcv+0x72/0x90 [ 24.041259][ T316] ? netlink_unicast+0x876/0xa40 [ 24.046198][ T316] ? ____sys_sendmsg+0x5b7/0x8f0 [ 24.051133][ T316] ? x64_sys_call+0x4b/0x9a0 [ 24.055724][ T316] ? entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 24.061794][ T316] xfrm_policy_inexact_alloc_chain+0x53d/0xb30 [ 24.067947][ T316] xfrm_policy_inexact_insert+0x70/0x1130 [ 24.073663][ T316] ? __kasan_check_write+0x14/0x20 [ 24.078770][ T316] ? _raw_spin_lock_bh+0x94/0xf0 [ 24.083700][ T316] ? policy_hash_bysel+0x13f/0x6f0 [ 24.088805][ T316] xfrm_policy_insert+0x126/0x9a0 [ 24.093844][ T316] ? xfrm_policy_construct+0x54f/0x1f00 [ 24.099386][ T316] xfrm_add_policy+0x4ed/0x850 [ 24.104143][ T316] ? xfrm_dump_sa_done+0xc0/0xc0 [ 24.109078][ T316] xfrm_user_rcv_msg+0x4dc/0x7b0 [ 24.114009][ T316] ? xfrm_netlink_rcv+0x90/0x90 [ 24.118863][ T316] ? avc_has_perm_noaudit+0x490/0x490 [ 24.124248][ T316] ? x64_sys_call+0x4b/0x9a0 [ 24.128842][ T316] ? selinux_nlmsg_lookup+0x237/0x4c0 [ 24.134208][ T316] netlink_rcv_skb+0x1f5/0x440 [ 24.138980][ T316] ? xfrm_netlink_rcv+0x90/0x90 [ 24.143826][ T316] ? netlink_ack+0xb50/0xb50 [ 24.148409][ T316] ? wait_for_completion_killable_timeout+0x10/0x10 [ 24.154991][ T316] ? __netlink_lookup+0x387/0x3b0 [ 24.160029][ T316] xfrm_netlink_rcv+0x72/0x90 [ 24.164732][ T316] netlink_unicast+0x876/0xa40 [ 24.169491][ T316] netlink_sendmsg+0x879/0xb80 [ 24.174258][ T316] ? netlink_getsockopt+0x530/0x530 [ 24.179452][ T316] ? do_futex+0xde8/0x2800 [ 24.183871][ T316] ? security_socket_sendmsg+0x82/0xa0 [ 24.189342][ T316] ? netlink_getsockopt+0x530/0x530 [ 24.194545][ T316] ____sys_sendmsg+0x5b7/0x8f0 [ 24.199301][ T316] ? __sys_sendmsg_sock+0x40/0x40 [ 24.204321][ T316] ? import_iovec+0x7c/0xb0 [ 24.208824][ T316] ___sys_sendmsg+0x236/0x2e0 [ 24.213495][ T316] ? __sys_sendmsg+0x280/0x280 [ 24.218257][ T316] ? __fdget+0x1a1/0x230 [ 24.222498][ T316] __x64_sys_sendmsg+0x206/0x2f0 [ 24.227438][ T316] ? ___sys_sendmsg+0x2e0/0x2e0 [ 24.232281][ T316] ? __kasan_check_write+0x14/0x20 [ 24.237386][ T316] ? switch_fpu_return+0x15d/0x2c0 [ 24.242492][ T316] x64_sys_call+0x4b/0x9a0 [ 24.246901][ T316] do_syscall_64+0x4c/0xa0 [ 24.251340][ T316] ? clear_bhb_loop+0x50/0xa0 [ 24.256010][ T316] ? clear_bhb_loop+0x50/0xa0 [ 24.260683][ T316] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 24.266576][ T316] RIP: 0033:0x7f2c6347ee59 [ 24.270989][ T316] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 24.290707][ T316] RSP: 002b:00007f2c61ed9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 24.299131][ T316] RAX: ffffffffffffffda RBX: 00007f2c636f7fa0 RCX: 00007f2c6347ee59 [ 24.307102][ T316] RDX: 0000000000004000 RSI: 0000200000000440 RDI: 0000000000000003 [ 24.315068][ T316] RBP: 00007f2c63514d6f R08: 0000000000000000 R09: 0000000000000000 [ 24.323033][ T316] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 24.330995][ T316] R13: 00007f2c636f8038 R14: 00007f2c636f7fa0 R15: 00007ffc438ddfc8 [ 24.338967][ T316] [ 24.341979][ T316] [ 24.344296][ T316] Allocated by task 316: [ 24.348524][ T316] __kasan_kmalloc+0xda/0x110 [ 24.353198][ T316] __kmalloc+0x13d/0x2c0 [ 24.357440][ T316] sk_prot_alloc+0xed/0x320 [ 24.361938][ T316] sk_alloc+0x38/0x430 [ 24.365995][ T316] pfkey_create+0x12a/0x660 [ 24.370521][ T316] __sock_create+0x38d/0x7a0 [ 24.375104][ T316] __sys_socket+0xec/0x190 [ 24.379516][ T316] __x64_sys_socket+0x7a/0x90 [ 24.384186][ T316] x64_sys_call+0x8c5/0x9a0 [ 24.388686][ T316] do_syscall_64+0x4c/0xa0 [ 24.393097][ T316] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 24.398985][ T316] [ 24.401302][ T316] The buggy address belongs to the object at ffff88810f1f6000 [ 24.401302][ T316] which belongs to the cache kmalloc-1k of size 1024 [ 24.415348][ T316] The buggy address is located 1016 bytes inside of [ 24.415348][ T316] 1024-byte region [ffff88810f1f6000, ffff88810f1f6400) [ 24.428785][ T316] The buggy address belongs to the page: [ 24.434403][ T316] page:ffffea00043c7c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10f1f0 [ 24.445244][ T316] head:ffffea00043c7c00 order:3 compound_mapcount:0 compound_pincount:0 [ 24.453562][ T316] flags: 0x4000000000010200(slab|head|zone=1) [ 24.459632][ T316] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100043080 [ 24.468210][ T316] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 24.476783][ T316] page dumped because: kasan: bad access detected [ 24.483184][ T316] page_owner tracks the page as allocated [ 24.488887][ T316] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 90, ts 23904600564, free_ts 23894077436 [ 24.509205][ T316] post_alloc_hook+0x192/0x1b0 [ 24.513971][ T316] prep_new_page+0x1c/0x110 [ 24.518468][ T316] get_page_from_freelist+0x2d3a/0x2dc0 [ 24.524012][ T316] __alloc_pages+0x1a2/0x460 [ 24.528597][ T316] new_slab+0xa1/0x4d0 [ 24.532680][ T316] ___slab_alloc+0x381/0x810 [ 24.537263][ T316] __slab_alloc+0x49/0x90 [ 24.541585][ T316] kmem_cache_alloc_trace+0x146/0x270 [ 24.546950][ T316] syslog_print+0x136/0x8d0 [ 24.551453][ T316] do_syslog+0x71a/0x7e0 [ 24.555687][ T316] __x64_sys_syslog+0x7c/0x90 [ 24.560360][ T316] x64_sys_call+0x728/0x9a0 [ 24.564854][ T316] do_syscall_64+0x4c/0xa0 [ 24.569264][ T316] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 24.575151][ T316] page last free stack trace: [ 24.579809][ T316] free_unref_page_prepare+0x542/0x550 [ 24.585264][ T316] free_unref_page+0xae/0x540 [ 24.589934][ T316] __free_pages+0x6c/0x100 [ 24.594344][ T316] __free_slab+0xe8/0x1e0 [ 24.598665][ T316] __unfreeze_partials+0x160/0x190 [ 24.603770][ T316] put_cpu_partial+0xc6/0x120 [ 24.608440][ T316] __slab_free+0x1d4/0x290 [ 24.612851][ T316] ___cache_free+0x104/0x120 [ 24.617437][ T316] qlink_free+0x4d/0x90 [ 24.622108][ T316] qlist_free_all+0x5f/0xb0 [ 24.626602][ T316] kasan_quarantine_reduce+0x14a/0x170 [ 24.632054][ T316] __kasan_slab_alloc+0x2f/0xf0 [ 24.636899][ T316] slab_post_alloc_hook+0x4f/0x2b0 [ 24.642006][ T316] kmem_cache_alloc+0xf7/0x260 [ 24.646761][ T316] getname_flags+0xb9/0x500 [ 24.651261][ T316] user_path_at_empty+0x30/0x1c0 [ 24.656192][ T316] [ 24.658510][ T316] Memory state around the buggy address: [ 24.664130][ T316] ffff88810f1f6280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.672179][ T316] ffff88810f1f6300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.680233][ T316] >ffff88810f1f6380: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 24.688279][ T316] ^ [ 24.696242][ T316] ffff88810f1f6400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.704295][ T316] ffff88810f1f6480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.712341][ T316] ================================================================== [ 24.720397][ T316] Disabling lock debugging due to kernel taint