last executing test programs: 981.031236ms ago: executing program 1 (id=2): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_CLOCK(r1, 0x4030ae7b, &(0x7f00000001c0)={0x1b, 0xe, 0x5, 0x9a7cbce263ebc418, 0x1}) timer_create(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mlock(&(0x7f0000fff000/0x1000)=nil, 0x1000) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='cdg', 0x3) write$binfmt_script(r2, &(0x7f0000000200), 0xfffffd9d) 977.973426ms ago: executing program 3 (id=4): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000000)={0xb, {'syz0\x00', 'syz1\x00', 'syz0\x00', 0x27, 0x5, 0x46d, 0xb012, 0x0, 0x0, "0600ff0901a1018510150026ff00750895068100910085119513810091008512953f81009100c0"}}, 0x13f) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r1, 0xffffffffffffffff, 0x200000000000000) 935.187307ms ago: executing program 0 (id=1): r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0xcc) r1 = syz_io_uring_setup(0x574b, &(0x7f00000000c0)={0x0, 0x3b40, 0x13080, 0xffffffff, 0x2b7, 0x0, r0}, &(0x7f0000000040), &(0x7f0000000180), &(0x7f0000000000)) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) r3 = socket(0xa, 0x3, 0x3a) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000003c0)={'bridge0\x00', 0x0}) setsockopt$MRT6_ADD_MIF(r3, 0x29, 0xca, &(0x7f0000000000)={0x4, 0x0, 0x0, r5}, 0xc) setsockopt$MRT6_ADD_MIF(r3, 0x29, 0xca, &(0x7f0000000040)={0x1, 0x0, 0x5, r5, 0xffffff8f}, 0xc) setsockopt$MRT6_ADD_MFC_PROXY(r3, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0xd, @remote}, {0xa, 0x4e22, 0x0, @mcast1}, 0x0, {[0x7b6, 0xc, 0xd, 0x4, 0x10000, 0x0, 0x4, 0x4]}}, 0x5c) pread64(r2, &(0x7f0000000000)=""/4, 0x4, 0x7) mount$9p_fd(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f0000000480), 0x84, &(0x7f0000000540)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB="2c0070b550d2e8c829e881860d1c14257dc1ffbebafd9849201463c955071736b618a5f0455e50a39285f3e464736e2a081bd988fc1d00f91c1bf241183ffe5ff67eb5fe2e5fc5c47ddb8e1f44600fd00c3a896ca2615ad477fa51ef7208bd27a59f041f880157267948bc4a3a61f51905609c7f94b7774770d9e490f1d324a3a15ba197bc9b5ee8c0f9c066fecf4c48d35c1225000062a9f41ee5fd872cf8eec20aa430990ff4c5d16ff8b567b05d626b7076b22de3b3582b7f6df7c59f4ab7dc80f26cc81bd276ea9b5cc9cfc6f40c99e531cfdf7e25f7fa3f00630184ff8a7c913ae0bb71fb4461f48c7da542ca2565fe1e7dc16b2f00abbb8c6ccbc3d2c8e3feee443bdea6212eddf90fb49f19812303941911efd40b6f8505afa39ad968c754b580d617eea4298947542bdc"]) 923.032117ms ago: executing program 4 (id=5): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7}, [@call={0x85, 0x0, 0x0, 0x20}]}, &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, &(0x7f0000000800)='rp_size=0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/urandom\x00', 0x0, 0x0) sendfile(r2, r3, 0x0, 0x10000) close(r2) unlinkat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) sendfile(r4, r3, 0x0, 0x20000) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r5, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) shutdown(r5, 0x1) recvfrom(r5, &(0x7f0000000480)=""/110, 0x168f6f3d, 0x734, 0x0, 0xfffffffffffffecb) ioctl$sock_SIOCINQ(r5, 0x541b, &(0x7f0000000080)) sendfile(r4, r3, 0x0, 0x20000) sendfile(r4, r3, 0x0, 0x20000) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r6, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) listen(r6, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000180)={@local, @multicast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0x0, @remote, @local, {[], {{0x4e23, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) syz_emit_ethernet(0x56, &(0x7f00000005c0)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a84d0", 0x20, 0x6, 0x1, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0x2, 0x98ca}, @sack_perm={0x4, 0x2}]}}}}}}}}, 0x0) sendfile(r4, r3, 0x0, 0x20000) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) 895.496948ms ago: executing program 2 (id=3): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x80, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x0, 0x0) io_setup(0x8, &(0x7f0000004200)=0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') io_submit(r0, 0x1, &(0x7f0000000100)=[&(0x7f0000004280)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) 860.616239ms ago: executing program 3 (id=6): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r1, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={&(0x7f00000007c0)={0x14, 0x0, 0x300, 0x70bd26, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0xc000}, 0x4008000) getsockname$packet(r1, &(0x7f00000005c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000580)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="4c000000100039042abd70000000000000000000", @ANYRES32=r2, @ANYBLOB="01180200031100002c0012800e00010069703665727370616e0000001800028008001500a8bc0d00040012"], 0x4c}}, 0x0) sendto$packet(r0, &(0x7f0000000600)="7eeb99b6f78c67515ea2f0d01d76", 0xe, 0x24008895, &(0x7f0000000140)={0x11, 0x2, r2, 0x1, 0x6, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) 820.5951ms ago: executing program 1 (id=7): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./dev\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev/sda\x00', 0x2, 0x0) ioctl$BLKDISCARD(r0, 0x1277, &(0x7f0000000300)=0x9) 820.26716ms ago: executing program 3 (id=8): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r1, 0xae03, 0xf4) openat$sndtimer(0xffffffffffffff9c, 0x0, 0x101040) fsetxattr$trusted_overlay_upper(0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x0, 0xfb, 0x107, 0x1, 0x1, "1d00000c00", "0902935665a27c78c8d23d45f15c43cf03be7c3f9e5c1c9a108f3cfe97bdceba6eb860837cf964f1a40a0dfe429918a3c16e713966aef513ac9a2d7a804f79f99baa4e2de682cd3471308f680bba63ae00cd6eb7286d50bb0dcc5635983202a01ed1945cd59d70f9f1cea6ff6e9c1402093af700fe3871ad38f5c5f8df90974e54ec83f85730dbdcfb9c070816b79f030fe9801b492d19e69f5ad153977e9e549980b982fca4c898545f1433b1f69a09e5dfede50754ce31d40d4038caa306ee486f4f651edfff757fc3124b573a316c8183de6194ffde82251403cd85689ba3447ee3c5615f0b7f882e5e2fdf6060f84efb"}, 0x107, 0x1) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f0000000400)=0x79) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) sendmsg$NL80211_CMD_JOIN_IBSS(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={0x0}, 0x1, 0x0, 0x0, 0x40040e0}, 0x20004800) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$WG_CMD_GET_DEVICE(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x28, r6, 0x301, 0x70bd2c, 0x25dfdbfe, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x2004c001}, 0x20040000) 795.225891ms ago: executing program 2 (id=9): r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="0d01000009000008250592d20700006a3b010902241700fa0074980904e4ff11070103000905010200ffe0000009058202"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000200)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB=' '], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(r0) syz_usb_connect(0x3, 0x9f, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) 709.127963ms ago: executing program 1 (id=10): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/sys/net/ipv6/conf/syz_tun/disable_ipv6\x00', 0x1, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)=ANY=[@ANYBLOB="20000000110001000000000000000000100000e60b"], 0x20}], 0x1}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) close(0x3) 691.173704ms ago: executing program 4 (id=11): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r0, &(0x7f00000021c0)={0x1f, 0xd3, @any, 0x3}, 0xe) write$binfmt_format(0xffffffffffffffff, 0x0, 0x0) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, 0x0, 0x0) 671.822824ms ago: executing program 4 (id=12): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r0 = openat$kvm(0xffffff9c, &(0x7f0000000140), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f00000000c0)={[{0x4, 0x200, 0x8, 0x84, 0x0, 0x7, 0xc4, 0x1, 0x0, 0x9, 0xf, 0x8, 0x9}, {0x8, 0xaff3, 0xa, 0x5, 0xc, 0x2, 0x9, 0x3, 0x4, 0x13, 0x1, 0x6, 0x12005}, {0x2, 0x7, 0xa, 0xf, 0x1, 0x14, 0x0, 0x3, 0x7, 0xfb, 0x1, 0x3, 0x2}], 0x8}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000b40)={[0x9, 0x400000000006, 0xfffffffffffffffd, 0x5, 0x1, 0xfffffffffffffffd, 0x4002004c3, 0xffe, 0xc, 0x26, 0x14, 0xffff, 0x4, 0x0, 0x8, 0x6], 0xeeee8000, 0x2011c0}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 474.951409ms ago: executing program 1 (id=13): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x11, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000340)='syzkaller\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setscheduler(r0, 0x0, &(0x7f0000000280)=0x5) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$VHOST_SET_VRING_NUM(0xffffffffffffffff, 0x4008af10, &(0x7f0000000500)={0x0, 0x80000001}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) r3 = add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f0000000080)={'fscrypt:', @desc2}, &(0x7f00000000c0)={0x0, "f1a1173fb9462d3589e67197f90be6e423ceb0ab4912f9f6a31854ec98e950cfed21fcad7ff0fbcb566a0982f8938caa52dd8d39af14c31ed56ad59300"}, 0x52ba, 0xffffffffffffffff) keyctl$KEYCTL_MOVE(0x4, r3, r3, r3, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r4 = fsopen(&(0x7f0000000000)='f2fs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f00000000c0)='test_dummy_encryption', &(0x7f0000000180)='v2to_da_alloc', 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x3, &(0x7f0000000440)=[{0xc, 0x0, 0x5, 0x7fff7ffc}, {0x5, 0x64, 0x9, 0x6}, {0x0, 0xfd, 0x11, 0x7fffffff}]}) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x1) r5 = syz_open_procfs(r0, &(0x7f0000000040)='stat\x00') pread64(r5, &(0x7f0000000140)=""/15, 0xf, 0x4) 350.078932ms ago: executing program 4 (id=14): inotify_init1(0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/configs/c.1/bmAttributes\x00', 0x1, 0x0) write(r0, &(0x7f0000000340)='0x8', 0x3) 340.168632ms ago: executing program 4 (id=15): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/tracing/events/kvm/enable\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='1', 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x1000003, 0x13, 0xffffffffffffffff, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/tracing/trace_pipe\x00', 0x800, 0x0) read(r2, &(0x7f0000001000)=""/8192, 0x2000) 71.732519ms ago: executing program 0 (id=16): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1ff) r0 = openat$tun(0xffffff9c, &(0x7f0000000000), 0x100, 0x0) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x1f, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r4, &(0x7f0000000200)='1-1\x00', 0x4) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc01cf509, &(0x7f00000002c0)={r3, 0x8, 0x5, 0x1}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0xe, 0xffde}, {0xfff2, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x4891) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000040)={'vlan0\x00', &(0x7f0000000000)=@ethtool_cmd={0x17, 0x0, 0xffff, 0xff, 0x0, 0x0, 0x0, 0x0, 0x3, 0x6, 0x0, 0x7, 0x78, 0xfb, 0xff, 0x30000, [0x2, 0x4]}}) lsetxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=@known='trusted.overlay.origin\x00', &(0x7f0000000280)='/dev/net/tun\x00', 0xd, 0x3) 39.736819ms ago: executing program 4 (id=17): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000080)=0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x32, '\x00', 0x0, @fallback=0x22}, 0x94) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x801a01, 0x0) ioctl$EVIOCGPROP(r3, 0x40047438, &(0x7f0000000180)=""/246) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000280)="c021", 0x2000}], 0x1) 0s ago: executing program 0 (id=18): r0 = syz_usb_connect_ath9k(0x3, 0xb7, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x45}}]}}, 0x0) syz_usb_disconnect(r0) syz_usb_disconnect(0xffffffffffffffff) syz_usb_connect(0x5, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000094ba78084e080110aeed010203010902220001000000000904000001437b6a00090500000000000000070594ef"], 0x0) syz_open_dev$hiddev(0x0, 0x7, 0x80140) syz_open_dev$hidraw(0x0, 0x100000000, 0x420082) r1 = syz_open_dev$evdev(&(0x7f0000005bc0), 0x4, 0x100) ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, 0x0) kernel console output (not intermixed with test programs): rocess permissive=1 [ 14.611552][ T28] audit: type=1400 audit(1785937983.450:63): avc: denied { siginh } for pid=224 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.68' (ED25519) to the list of known hosts. [ 22.153751][ T28] audit: type=1400 audit(1785937991.000:64): avc: denied { mounton } for pid=278 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.156849][ T278] cgroup: Unknown subsys name 'net' [ 22.176472][ T28] audit: type=1400 audit(1785937991.000:65): avc: denied { mount } for pid=278 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.203706][ T28] audit: type=1400 audit(1785937991.030:66): avc: denied { unmount } for pid=278 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.204063][ T278] cgroup: Unknown subsys name 'devices' [ 22.320205][ T278] cgroup: Unknown subsys name 'hugetlb' [ 22.325812][ T278] cgroup: Unknown subsys name 'rlimit' [ 22.459537][ T28] audit: type=1400 audit(1785937991.310:67): avc: denied { setattr } for pid=278 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.482723][ T28] audit: type=1400 audit(1785937991.310:68): avc: denied { mounton } for pid=278 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.507454][ T28] audit: type=1400 audit(1785937991.310:69): avc: denied { mount } for pid=278 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 22.551700][ T280] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.560563][ T28] audit: type=1400 audit(1785937991.410:70): avc: denied { relabelto } for pid=280 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.585986][ T28] audit: type=1400 audit(1785937991.410:71): avc: denied { write } for pid=280 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.596772][ T278] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.612153][ T28] audit: type=1400 audit(1785937991.430:72): avc: denied { read } for pid=278 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.646209][ T28] audit: type=1400 audit(1785937991.430:73): avc: denied { open } for pid=278 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.470559][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.477632][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.485040][ T287] device bridge_slave_0 entered promiscuous mode [ 23.491980][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.499057][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.506428][ T287] device bridge_slave_1 entered promiscuous mode [ 23.543933][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.551000][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.558388][ T286] device bridge_slave_0 entered promiscuous mode [ 23.565933][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.573014][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.580419][ T286] device bridge_slave_1 entered promiscuous mode [ 23.652666][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.659758][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.667096][ T288] device bridge_slave_0 entered promiscuous mode [ 23.676696][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.683764][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.691189][ T288] device bridge_slave_1 entered promiscuous mode [ 23.709490][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.716531][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.723977][ T290] device bridge_slave_0 entered promiscuous mode [ 23.740143][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.747176][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.754635][ T290] device bridge_slave_1 entered promiscuous mode [ 23.772280][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.779349][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.786706][ T289] device bridge_slave_0 entered promiscuous mode [ 23.796012][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.803076][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.810451][ T289] device bridge_slave_1 entered promiscuous mode [ 23.928508][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.935665][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.942973][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.950027][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.961924][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.968976][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.976226][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.983350][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.011513][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.018602][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.025860][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.032917][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.058717][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.065771][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.073038][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.080070][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.101574][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.108896][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.115974][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.123722][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.132223][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.139765][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.147056][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.154352][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.161577][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.190656][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.198044][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.206357][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.213423][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.220933][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.229846][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.236880][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.244221][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.252399][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.259439][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.281135][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.288646][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.296763][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.303807][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.311660][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.319681][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.327785][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.334825][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.342245][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.366188][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.374101][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.382096][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.391144][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.398594][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.406714][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.413747][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.421067][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.429464][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.436508][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.443887][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.457482][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.487517][ T286] device veth0_vlan entered promiscuous mode [ 24.495385][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.504070][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.512187][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.520453][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.528356][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.535965][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.543511][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.551881][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.560067][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.567093][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.574549][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.582818][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.590990][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.598024][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.605431][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.613539][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.621543][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.629806][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.638027][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.646485][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.654887][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.662777][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.670951][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.678670][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.686065][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.697454][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.706045][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.724735][ T286] device veth1_macvtap entered promiscuous mode [ 24.733200][ T288] device veth0_vlan entered promiscuous mode [ 24.739541][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.747562][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.755584][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.763876][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.772058][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.780201][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.788260][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.795943][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.804305][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.812680][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.820178][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.833289][ T289] device veth0_vlan entered promiscuous mode [ 24.843128][ T290] device veth0_vlan entered promiscuous mode [ 24.850696][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.859085][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.867353][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.875423][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.883565][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.891524][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.899588][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.906963][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.914444][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.921930][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.932682][ T287] device veth0_vlan entered promiscuous mode [ 24.943121][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.951067][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.959790][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.967240][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.978833][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.987068][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.998223][ T290] device veth1_macvtap entered promiscuous mode [ 25.009623][ T287] device veth1_macvtap entered promiscuous mode [ 25.018670][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.026822][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.035902][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.044538][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.052771][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.060988][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.069455][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.077676][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.091287][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.099634][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.107905][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.116837][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.129431][ T289] device veth1_macvtap entered promiscuous mode [ 25.142463][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.150937][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.159467][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.167545][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.175803][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.184226][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.198023][ T288] device veth1_macvtap entered promiscuous mode [ 25.209750][ T286] request_module fs-gadgetfs succeeded, but still no fs? [ 25.226583][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.234830][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.243505][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.251878][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.260440][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.268962][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.277149][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.285603][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.293968][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.333698][ T313] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.376084][ T310] logitech-hidpp-device 0005:046D:B012.0001: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz1 [ 25.437993][ T327] 9pnet_fd: Insufficient options for proto=fd [ 25.442091][ T328] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=328 comm=syz.3.6 [ 25.457046][ T328] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6'. [ 25.515127][ T322] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Dropping request. Check SNMP counters. [ 25.562684][ T322] syz.4.5 (322) used greatest stack depth: 21920 bytes left [ 26.202252][ T298] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 26.378929][ C0] ================================================================== [ 26.387039][ C0] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x6c/0xb0 [ 26.394458][ C0] Read of size 8 at addr ffff888134432d90 by task kworker/0:1/19 [ 26.402185][ C0] [ 26.404532][ C0] CPU: 0 PID: 19 Comm: kworker/0:1 Not tainted syzkaller #0 [ 26.411809][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.421857][ C0] Workqueue: mld mld_dad_work [ 26.426553][ C0] Call Trace: [ 26.429839][ C0] [ 26.432734][ C0] __dump_stack+0x21/0x24 [ 26.437083][ C0] dump_stack_lvl+0x110/0x170 [ 26.441819][ C0] ? __cfi_dump_stack_lvl+0x8/0x8 [ 26.446874][ C0] ? debug_smp_processor_id+0x17/0x20 [ 26.452263][ C0] ? rcu_cblist_dequeue+0x6c/0xb0 [ 26.457302][ C0] print_address_description+0x71/0x200 [ 26.462882][ C0] print_report+0x4a/0x60 [ 26.467240][ C0] kasan_report+0x122/0x150 [ 26.471771][ C0] ? rcu_cblist_dequeue+0x6c/0xb0 [ 26.476809][ C0] __asan_report_load8_noabort+0x14/0x20 [ 26.482456][ C0] rcu_cblist_dequeue+0x6c/0xb0 [ 26.487316][ C0] rcu_do_batch+0x4bc/0xc30 [ 26.491827][ C0] ? rcu_core+0xf00/0xf00 [ 26.496166][ C0] rcu_core+0x486/0xf00 [ 26.500328][ C0] ? kvm_sched_clock_read+0x18/0x40 [ 26.505551][ C0] ? sched_clock+0x9/0x10 [ 26.509902][ C0] ? rcu_cpu_kthread_park+0x90/0x90 [ 26.515113][ C0] ? kvm_sched_clock_read+0x18/0x40 [ 26.520325][ C0] ? sched_clock+0x9/0x10 [ 26.524669][ C0] ? irqtime_account_irq+0x75/0x240 [ 26.529879][ C0] rcu_core_si+0x9/0x10 [ 26.534050][ C0] handle_softirqs+0x1d7/0x600 [ 26.538829][ C0] __do_softirq+0xb/0xd [ 26.542989][ C0] do_softirq+0xdc/0x130 [ 26.547244][ C0] [ 26.550186][ C0] [ 26.553124][ C0] ? __cfi_do_softirq+0x10/0x10 [ 26.557983][ C0] ? _raw_spin_lock_bh+0x94/0xf0 [ 26.562931][ C0] ? __cfi__raw_spin_lock_bh+0x10/0x10 [ 26.568401][ C0] __local_bh_enable_ip+0x75/0x80 [ 26.573437][ C0] _raw_spin_unlock_bh+0x50/0x60 [ 26.578382][ C0] icmp6_dst_alloc+0x489/0x510 [ 26.583156][ C0] mld_sendpack+0x623/0xda0 [ 26.587665][ C0] ? add_grec+0x13f0/0x13f0 [ 26.592173][ C0] ? add_grec+0xfae/0x13f0 [ 26.596592][ C0] ? memcpy+0x56/0x70 [ 26.600575][ C0] ? __cfi_mutex_lock+0x10/0x10 [ 26.605428][ C0] mld_dad_work+0x244/0x670 [ 26.609927][ C0] process_one_work+0x717/0xc30 [ 26.614779][ C0] worker_thread+0xa4d/0x11d0 [ 26.619454][ C0] kthread+0x281/0x320 [ 26.623519][ C0] ? __cfi_worker_thread+0x10/0x10 [ 26.628625][ C0] ? __cfi_kthread+0x10/0x10 [ 26.633210][ C0] ret_from_fork+0x1f/0x30 [ 26.637627][ C0] [ 26.640669][ C0] [ 26.643000][ C0] Allocated by task 369: [ 26.647229][ C0] kasan_set_track+0x4b/0x70 [ 26.651821][ C0] kasan_save_alloc_info+0x1f/0x30 [ 26.656921][ C0] __kasan_kmalloc+0x95/0xb0 [ 26.661506][ C0] __kmalloc+0xb4/0x1e0 [ 26.665656][ C0] l2tp_session_create+0x38/0xbd0 [ 26.670674][ C0] pppol2tp_connect+0xbf5/0x1640 [ 26.675604][ C0] __sys_connect+0x3da/0x460 [ 26.680274][ C0] __x64_sys_connect+0x7a/0x90 [ 26.685030][ C0] x64_sys_call+0x88d/0x9a0 [ 26.689531][ C0] do_syscall_64+0x4c/0xa0 [ 26.693944][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 26.699837][ C0] [ 26.702160][ C0] Freed by task 8: [ 26.705868][ C0] kasan_set_track+0x4b/0x70 [ 26.710454][ C0] kasan_save_free_info+0x2b/0x40 [ 26.715468][ C0] ____kasan_slab_free+0x132/0x180 [ 26.720573][ C0] __kasan_slab_free+0x11/0x20 [ 26.725335][ C0] slab_free_freelist_hook+0xc2/0x190 [ 26.730703][ C0] __kmem_cache_free+0xb7/0x1b0 [ 26.735554][ C0] kfree+0x6f/0xf0 [ 26.739365][ C0] l2tp_session_put+0xaf/0x1a0 [ 26.744138][ C0] l2tp_session_delete+0x3df/0x4d0 [ 26.749245][ C0] l2tp_tunnel_del_work+0x199/0x410 [ 26.754440][ C0] process_one_work+0x717/0xc30 [ 26.759298][ C0] worker_thread+0xa4d/0x11d0 [ 26.763973][ C0] kthread+0x281/0x320 [ 26.768039][ C0] ret_from_fork+0x1f/0x30 [ 26.772452][ C0] [ 26.774770][ C0] Last potentially related work creation: [ 26.780472][ C0] kasan_save_stack+0x3a/0x60 [ 26.785146][ C0] __kasan_record_aux_stack+0xb6/0xc0 [ 26.790517][ C0] kasan_record_aux_stack_noalloc+0xb/0x10 [ 26.796319][ C0] call_rcu+0xcf/0xf50 [ 26.800392][ C0] pppol2tp_release+0x1e3/0x2b0 [ 26.805237][ C0] sock_close+0xc9/0x220 [ 26.809485][ C0] __fput+0x1fd/0x8f0 [ 26.813474][ C0] ____fput+0x15/0x20 [ 26.817451][ C0] task_work_run+0x1e1/0x250 [ 26.822040][ C0] exit_to_user_mode_loop+0x9b/0xb0 [ 26.827248][ C0] exit_to_user_mode_prepare+0x87/0xd0 [ 26.832705][ C0] syscall_exit_to_user_mode+0x1a/0x30 [ 26.838162][ C0] do_syscall_64+0x58/0xa0 [ 26.842581][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 26.848478][ C0] [ 26.850802][ C0] The buggy address belongs to the object at ffff888134432c00 [ 26.850802][ C0] which belongs to the cache kmalloc-512 of size 512 [ 26.864846][ C0] The buggy address is located 400 bytes inside of [ 26.864846][ C0] 512-byte region [ffff888134432c00, ffff888134432e00) [ 26.878113][ C0] [ 26.880441][ C0] The buggy address belongs to the physical page: [ 26.886867][ C0] page:ffffea0004d10c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x134430 [ 26.897117][ C0] head:ffffea0004d10c00 order:2 compound_mapcount:0 compound_pincount:0 [ 26.905438][ C0] flags: 0x4000000000010200(slab|head|zone=1) [ 26.911513][ C0] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 [ 26.920094][ C0] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 26.928663][ C0] page dumped because: kasan: bad access detected [ 26.935064][ C0] page_owner tracks the page as allocated [ 26.940772][ C0] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 359, tgid 359 (syz.0.16), ts 26236338994, free_ts 26236272648 [ 26.962990][ C0] post_alloc_hook+0x1f5/0x210 [ 26.967762][ C0] prep_new_page+0x1c/0x110 [ 26.972267][ C0] get_page_from_freelist+0x2ca9/0x2d20 [ 26.977814][ C0] __alloc_pages+0x1fa/0x610 [ 26.982407][ C0] alloc_slab_page+0x6e/0xf0 [ 26.986998][ C0] new_slab+0x98/0x3e0 [ 26.991057][ C0] ___slab_alloc+0x70f/0xb70 [ 26.995653][ C0] __slab_alloc+0x5e/0xa0 [ 26.999985][ C0] __kmem_cache_alloc_node+0x204/0x2d0 [ 27.005444][ C0] __kmalloc_node_track_caller+0xa1/0x1e0 [ 27.011171][ C0] __alloc_skb+0x226/0x4a0 [ 27.015583][ C0] inet6_netconf_notify_devconf+0x107/0x1c0 [ 27.021481][ C0] addrconf_ifdown+0x163e/0x1950 [ 27.026442][ C0] addrconf_notify+0x39f/0xe30 [ 27.031209][ C0] raw_notifier_call_chain+0xa1/0x110 [ 27.036578][ C0] unregister_netdevice_many+0x104a/0x1910 [ 27.042397][ C0] page last free stack trace: [ 27.047089][ C0] free_unref_page_prepare+0x80c/0x820 [ 27.052552][ C0] free_unref_page+0x93/0x530 [ 27.057227][ C0] __free_pages+0x67/0x100 [ 27.061653][ C0] free_pages+0x82/0x90 [ 27.065826][ C0] __stack_depot_save+0x45f/0x490 [ 27.070854][ C0] kasan_set_track+0x60/0x70 [ 27.075458][ C0] kasan_save_free_info+0x2b/0x40 [ 27.080489][ C0] ____kasan_slab_free+0x132/0x180 [ 27.085597][ C0] __kasan_slab_free+0x11/0x20 [ 27.090358][ C0] slab_free_freelist_hook+0xc2/0x190 [ 27.095739][ C0] kmem_cache_free+0x12d/0x300 [ 27.100501][ C0] pde_put+0x14e/0x1a0 [ 27.104570][ C0] remove_proc_subtree+0x452/0x5b0 [ 27.109768][ C0] proc_remove+0x6b/0x80 [ 27.114015][ C0] snmp6_unregister_dev+0xa9/0xf0 [ 27.119033][ C0] addrconf_ifdown+0x1ef/0x1950 [ 27.123882][ C0] [ 27.126208][ C0] Memory state around the buggy address: [ 27.131825][ C0] ffff888134432c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.139880][ C0] ffff888134432d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.147932][ C0] >ffff888134432d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.155984][ C0] ^ [ 27.160566][ C0] ffff888134432e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.168623][ C0] ffff888134432e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.176676][ C0] ================================================================== [ 27.184777][ C0] Disabling lock debugging due to kernel taint [ 27.196172][ T28] kauditd_printk_skb: 76 callbacks suppressed [ 27.196183][ T28] audit: type=1400 audit(1785937996.040:150): avc: denied { read } for pid=84 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 27.225152][ T298] usb 3-1: Using ep0 maxpacket: 8 [ 27.230721][ T28] audit: type=1400 audit(1785937996.040:151): avc: denied { search } for pid=84 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 27.279626][ T28] audit: type=1400 audit(1785937996.040:152): avc: denied { write } for pid=84 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 27.304938][ T28] audit: type=1400 audit(1785937996.040:153): avc: denied { add_name } for pid=84 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 27.329670][ T28] audit: type=1400 audit(1785937996.040:154): avc: denied { create } for pid=84 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 27.337008][ T298] usb 3-1: config index 0 descriptor too short (expected 5924, got 36) [ 27.351531][ T28] audit: type=1400 audit(1785937996.040:155): avc: denied { append open } for pid=84 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 27.358369][ T298] usb 3-1: config 250 has an invalid interface number: 228 but max is -1 [ 27.385272][ T28] audit: type=1400 audit(1785937996.040:156): avc: denied { getattr } for pid=84 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 27.389813][ T298] usb 3-1: config 250 has 1 interface, different from the descriptor's value: 0 [ 27.389835][ T298] usb 3-1: config 250 has no interface number 0 [ 27.427621][ T298] usb 3-1: config 250 interface 228 altsetting 255 endpoint 0x1 has invalid maxpacket 65280, setting to 1024 [ 27.439194][ T298] usb 3-1: config 250 interface 228 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 1024 [ 27.449643][ T298] usb 3-1: config 250 interface 228 altsetting 255 endpoint 0x82 has invalid wMaxPacketSize 0 [ 27.459899][ T298] usb 3-1: config 250 interface 228 altsetting 255 bulk endpoint 0x82 has invalid maxpacket 0 [ 27.470266][ T298] usb 3-1: config 250 interface 228 altsetting 255 has 2 endpoint descriptors, different from the interface descriptor's value: 17 [ 27.483775][ T298] usb 3-1: config 250 interface 228 has no altsetting 0 [ 27.499150][ T298] usb 3-1: New USB device found, idVendor=0525, idProduct=d292, bcdDevice= 0.07 [ 27.508179][ T298] usb 3-1: New USB device strings: Mfr=0, Product=106, SerialNumber=59 [ 27.516473][ T298] usb 3-1: Product: syz [ 27.520667][ T298] usb 3-1: SerialNumber: syz [ 27.526767][ T298] hub 3-1:250.228: bad descriptor, ignoring hub [ 27.533074][ T298] hub: probe of 3-1:250.228 failed with error -5 [ 27.648450][ T356] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 27.729194][ T298] usblp 3-1:250.228: usblp0: USB Bidirectional printer dev 2 if 228 alt 255 proto 3 vid 0x0525 pid 0xD292 [ 27.829518][ T356] usb 1-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 27.839685][ T356] usb 1-1: config 1 interface 0 altsetting 0 has 5 endpoint descriptors, different from the interface descriptor's value: 6 [ 27.854429][ T356] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 27.863592][ T356] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.871608][ T356] usb 1-1: Product: syz [ 27.875772][ T356] usb 1-1: Manufacturer: syz [ 27.880411][ T356] usb 1-1: SerialNumber: syz [ 27.942378][ T28] audit: type=1400 audit(1785937996.790:157): avc: denied { read write } for pid=335 comm="syz.2.9" name="lp0" dev="devtmpfs" ino=576 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 27.965547][ T28] audit: type=1400 audit(1785937996.790:158): avc: denied { open } for pid=335 comm="syz.2.9" path="/dev/usb/lp0" dev="devtmpfs" ino=576 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 28.378922][ T338] usb 3-1: reset high-speed USB device number 2 using dummy_hcd [ 29.078526][ T298] usb 3-1: USB disconnect, device number 2 [ 29.085946][ T298] usblp0: removed [ 29.310586][ T298] usb 1-1: USB disconnect, device number 2