last executing test programs: 358.075201ms ago: executing program 1 (id=2): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x0, 0x0, 0x8000, 0x40, 0x0, 0x0, 0x2004cb, 0x0, 0xfffffffffffffffe, 0x5, 0x7fff, 0x1000200004, 0x4, 0x2, 0x0, 0x1], 0x8080000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 314.610482ms ago: executing program 0 (id=1): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000a40)=ANY=[@ANYBLOB="12010000000000107d1e502d000000000001090224000100007001090400580903000200092181004301222c0009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000100)={0x2c, &(0x7f0000000200)=ANY=[@ANYBLOB='`$,'], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x404c4701, 0x0) syz_usb_control_io(r0, &(0x7f0000000580)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000b00)={0x84, &(0x7f00000005c0)={0x40, 0x12, 0x15, "5f59213107f38455a918dc71b6cb8825d15f6a5736"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 212.570855ms ago: executing program 1 (id=6): r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./bus\x00', 0x40942, 0x0) process_vm_writev(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuacct.usage_percpu\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000200), 0xfea7) copy_file_range(r1, 0x0, r0, 0x0, 0xffffffffa003e45c, 0x700000000000000) 168.105346ms ago: executing program 1 (id=7): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0) 136.926487ms ago: executing program 1 (id=8): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x1, 0xcccc0000, 0x1000, &(0x7f0000ffc000/0x1000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r2, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x10001, 0x0, 0x0, 0x1000, &(0x7f0000ffc000/0x1000)=nil}) 14.69167ms ago: executing program 4 (id=5): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x101800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x6) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f00009be000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000100)="0f01df0f3235004000000f30b9fa000000430f79a279a2300d76c4020a1bf7b805000000b90000c0fe0f3cae0a41d941d9000f32ba00e500000f30660fc775023a0fba600c9864660ffc76002f3166b85766baa00066ed00d0", 0x59}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000340)={0x1, 0x0, [{0x7, 0x4, 0x2, 0xfffffff8, 0x2, 0x8001, 0xb2d}]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 0s ago: executing program 1 (id=9): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x5, 0x1, 0xdddd0000, 0x2000, &(0x7f0000fe5000/0x2000)=nil}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d03, 0x0, 0x1}]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.89' (ED25519) to the list of known hosts. [ 23.590761][ T24] audit: type=1400 audit(1786092871.430:64): avc: denied { mounton } for pid=271 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.594120][ T271] cgroup: Unknown subsys name 'net' [ 23.613620][ T24] audit: type=1400 audit(1786092871.430:65): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.640983][ T24] audit: type=1400 audit(1786092871.460:66): avc: denied { unmount } for pid=271 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.641501][ T271] cgroup: Unknown subsys name 'devices' [ 23.810377][ T271] cgroup: Unknown subsys name 'hugetlb' [ 23.816003][ T271] cgroup: Unknown subsys name 'rlimit' [ 23.957338][ T24] audit: type=1400 audit(1786092871.790:67): avc: denied { setattr } for pid=271 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.980493][ T24] audit: type=1400 audit(1786092871.790:68): avc: denied { mounton } for pid=271 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 24.005900][ T24] audit: type=1400 audit(1786092871.790:69): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 24.027185][ T273] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 24.037896][ T24] audit: type=1400 audit(1786092871.870:70): avc: denied { relabelto } for pid=273 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.063402][ T24] audit: type=1400 audit(1786092871.870:71): avc: denied { write } for pid=273 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.097920][ T24] audit: type=1400 audit(1786092871.930:72): avc: denied { read } for pid=271 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.123513][ T24] audit: type=1400 audit(1786092871.930:73): avc: denied { open } for pid=271 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.149599][ T271] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 24.625199][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.632324][ T279] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.639883][ T279] device bridge_slave_0 entered promiscuous mode [ 24.647964][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.655236][ T279] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.662790][ T279] device bridge_slave_1 entered promiscuous mode [ 24.756287][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.763867][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.771391][ T282] device bridge_slave_0 entered promiscuous mode [ 24.781911][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.788999][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.796470][ T282] device bridge_slave_1 entered promiscuous mode [ 24.869513][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.876626][ T280] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.884098][ T280] device bridge_slave_0 entered promiscuous mode [ 24.906136][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.913224][ T280] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.920861][ T280] device bridge_slave_1 entered promiscuous mode [ 24.932895][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.940006][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.947446][ T281] device bridge_slave_0 entered promiscuous mode [ 24.954449][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.961595][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.969157][ T281] device bridge_slave_1 entered promiscuous mode [ 24.998824][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.005925][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.013346][ T283] device bridge_slave_0 entered promiscuous mode [ 25.022656][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.029776][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.037174][ T283] device bridge_slave_1 entered promiscuous mode [ 25.093231][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.100742][ T281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.108027][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.115083][ T281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.140940][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.148001][ T282] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.155298][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.162342][ T282] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.223826][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.231595][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.239207][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.246489][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.254457][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 25.261907][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.281916][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.289895][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.298113][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.306466][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.313546][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.321236][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 25.332169][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.340565][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.347597][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.370396][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.378770][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.386924][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.393993][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.401677][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.410025][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.417049][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.424452][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.432485][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.455522][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.463566][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.472397][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.481248][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.488308][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.495860][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.503959][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.512292][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.519356][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.534143][ T282] device veth0_vlan entered promiscuous mode [ 25.549224][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.557399][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.565137][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.573535][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.581699][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.589173][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.597038][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.605610][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.613851][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.622380][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.640310][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.649512][ T279] device veth0_vlan entered promiscuous mode [ 25.661092][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 25.669698][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.681705][ T282] device veth1_macvtap entered promiscuous mode [ 25.691402][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.699982][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.708149][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.715238][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.722881][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.731712][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.740210][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.747822][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.756345][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.764562][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.771615][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.779423][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.787695][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.796032][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.803120][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.810592][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 25.818292][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 25.832061][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.840494][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.848781][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.855828][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.863983][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.872639][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.893635][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.902011][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.910847][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.919837][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.928101][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.936591][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.946118][ T279] device veth1_macvtap entered promiscuous mode [ 25.957511][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.965264][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.973339][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.981846][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.989549][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.997742][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 26.006041][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.022009][ T281] device veth0_vlan entered promiscuous mode [ 26.028828][ T282] request_module fs-gadgetfs succeeded, but still no fs? [ 26.038837][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 26.046975][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.055181][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 26.063814][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.072691][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.080964][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.089742][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.097956][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.106422][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 26.114626][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.129068][ T282] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 26.143776][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 26.158860][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.170884][ T303] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 26.187245][ T281] device veth1_macvtap entered promiscuous mode [ 26.210045][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.219435][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.227710][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.236006][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.255975][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.266174][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 26.274442][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.282852][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 26.291584][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.304878][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.312914][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.322470][ T280] device veth0_vlan entered promiscuous mode [ 26.330034][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 26.338344][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.357363][ T283] device veth0_vlan entered promiscuous mode [ 26.385055][ T280] device veth1_macvtap entered promiscuous mode [ 26.393821][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.401815][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.409597][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.417945][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.426812][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.435224][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.443605][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.455927][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.464591][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.479330][ T283] device veth1_macvtap entered promiscuous mode [ 26.503609][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.514003][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.522557][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.535765][ T311] ================================================================== [ 26.538836][ T5] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 26.543889][ T311] BUG: KASAN: use-after-free in pppol2tp_sock_to_session+0x1a0/0x1b0 [ 26.543899][ T311] Read of size 4 at addr ffff88812807d800 by task syz.1.7/311 [ 26.543902][ T311] [ 26.543918][ T311] CPU: 1 PID: 311 Comm: syz.1.7 Not tainted syzkaller #0 [ 26.543924][ T311] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.543928][ T311] Call Trace: [ 26.543943][ T311] __dump_stack+0x21/0x24 [ 26.543953][ T311] dump_stack_lvl+0x1a7/0x208 [ 26.544001][ T311] ? show_regs_print_info+0x18/0x18 [ 26.604184][ T311] ? thaw_kernel_threads+0x220/0x220 [ 26.609490][ T311] ? __local_bh_enable_ip+0x53/0x80 [ 26.614709][ T311] print_address_description+0x7f/0x2c0 [ 26.620269][ T311] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 26.626004][ T311] kasan_report+0x100/0x140 [ 26.630525][ T311] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 26.636254][ T311] __asan_report_load4_noabort+0x14/0x20 [ 26.641908][ T311] pppol2tp_sock_to_session+0x1a0/0x1b0 [ 26.647476][ T311] pppol2tp_release+0x150/0x2b0 [ 26.652347][ T311] sock_close+0xb8/0x200 [ 26.656612][ T311] ? sock_mmap+0xa0/0xa0 [ 26.660957][ T311] __fput+0x2dc/0x730 [ 26.664949][ T311] ____fput+0x15/0x20 [ 26.668943][ T311] task_work_run+0x127/0x190 [ 26.673540][ T311] do_exit+0xa7c/0x24e0 [ 26.677707][ T311] ? __kasan_check_write+0x14/0x20 [ 26.682822][ T311] ? switch_fpu_return+0x19c/0x330 [ 26.687942][ T311] ? put_task_struct+0x90/0x90 [ 26.692799][ T311] ? fpu__clear_all+0x20/0x20 [ 26.697479][ T311] ? __kasan_check_read+0x11/0x20 [ 26.702520][ T311] __x64_sys_exit+0x40/0x40 [ 26.707033][ T311] do_syscall_64+0x31/0x40 [ 26.711450][ T311] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.717346][ T311] RIP: 0033:0x7fcc5d5770d9 [ 26.721760][ T311] Code: Unable to access opcode bytes at RIP 0x7fcc5d5770af. [ 26.729134][ T311] RSP: 002b:00007fcc5bfcfef8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 26.737552][ T311] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007fcc5d5770d9 [ 26.745532][ T311] RDX: 00007fcc5bfd09c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 26.753512][ T311] RBP: 00007fcc5d60e024 R08: 0000000000000000 R09: 0000000000000058 [ 26.761492][ T311] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 26.769468][ T311] R13: 00007fcc5d7ff038 R14: 00007fcc5d7fefa0 R15: 00007fffe8c1ec68 [ 26.777446][ T311] [ 26.779776][ T311] Allocated by task 310: [ 26.784021][ T311] __kasan_kmalloc+0xd4/0x100 [ 26.788703][ T311] __kmalloc+0x19f/0x330 [ 26.792959][ T311] l2tp_session_create+0x39/0xb60 [ 26.798070][ T311] pppol2tp_connect+0xbf5/0x1640 [ 26.803014][ T311] __sys_connect+0x3ce/0x450 [ 26.807609][ T311] __x64_sys_connect+0x7a/0x90 [ 26.812391][ T311] do_syscall_64+0x31/0x40 [ 26.816813][ T311] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.822701][ T311] [ 26.825043][ T311] Freed by task 49: [ 26.828857][ T311] kasan_set_track+0x4a/0x70 [ 26.833461][ T311] kasan_set_free_info+0x23/0x40 [ 26.838406][ T311] ____kasan_slab_free+0x125/0x160 [ 26.843531][ T311] __kasan_slab_free+0x11/0x20 [ 26.848322][ T311] slab_free_freelist_hook+0xc5/0x190 [ 26.853711][ T311] kfree+0xc0/0x270 [ 26.857522][ T311] l2tp_session_put+0xb2/0x1a0 [ 26.862285][ T311] l2tp_session_delete+0x3a9/0x4a0 [ 26.867401][ T311] l2tp_tunnel_del_work+0x180/0x3d0 [ 26.872600][ T311] process_one_work+0x6fd/0xbc0 [ 26.877450][ T311] worker_thread+0xa8e/0x13c0 [ 26.882130][ T311] kthread+0x324/0x3b0 [ 26.886201][ T311] ret_from_fork+0x1f/0x30 [ 26.890613][ T311] [ 26.892952][ T311] The buggy address belongs to the object at ffff88812807d800 [ 26.892952][ T311] which belongs to the cache kmalloc-512 of size 512 [ 26.907008][ T311] The buggy address is located 0 bytes inside of [ 26.907008][ T311] 512-byte region [ffff88812807d800, ffff88812807da00) [ 26.920102][ T311] The buggy address belongs to the page: [ 26.925756][ T311] page:ffffea0004a01f00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12807c [ 26.935995][ T311] head:ffffea0004a01f00 order:2 compound_mapcount:0 compound_pincount:0 [ 26.944321][ T311] flags: 0x4000000000010200(slab|head) [ 26.949785][ T311] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 [ 26.958376][ T311] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 26.966954][ T311] page dumped because: kasan: bad access detected [ 26.973371][ T311] page_owner tracks the page as allocated [ 26.979099][ T311] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 25, ts 26352501749, free_ts 0 [ 26.997934][ T311] prep_new_page+0x176/0x190 [ 27.002538][ T311] get_page_from_freelist+0x225f/0x23f0 [ 27.008083][ T311] __alloc_pages_nodemask+0x29a/0x640 [ 27.013475][ T311] new_slab+0x84/0x3f0 [ 27.017550][ T311] ___slab_alloc+0x2f8/0x4c0 [ 27.022140][ T311] __slab_alloc+0x63/0xa0 [ 27.026467][ T311] __kmalloc_track_caller+0x1e4/0x310 [ 27.031839][ T311] __alloc_skb+0xdc/0x520 [ 27.036172][ T311] ndisc_send_ns+0x347/0xb10 [ 27.040858][ T311] addrconf_dad_work+0xa40/0x1480 [ 27.045980][ T311] process_one_work+0x6fd/0xbc0 [ 27.050829][ T311] worker_thread+0xa8e/0x13c0 [ 27.055504][ T311] kthread+0x324/0x3b0 [ 27.059581][ T311] ret_from_fork+0x1f/0x30 [ 27.064008][ T311] page_owner free stack trace missing [ 27.069375][ T311] [ 27.071716][ T311] Memory state around the buggy address: [ 27.077352][ T311] ffff88812807d700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.085418][ T311] ffff88812807d780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.093486][ T311] >ffff88812807d800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.101562][ T311] ^ [ 27.105635][ T311] ffff88812807d880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.113706][ T311] ffff88812807d900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.121768][ T311] ================================================================== [ 27.129838][ T311] Disabling lock debugging due to kernel taint [ 27.139371][ T311] ------------[ cut here ]------------ [ 27.144899][ T311] WARNING: CPU: 0 PID: 311 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 27.155156][ T311] Modules linked in: [ 27.159367][ T311] CPU: 0 PID: 311 Comm: syz.1.7 Tainted: G B syzkaller #0 [ 27.168434][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 27.176631][ T311] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 27.190146][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.198342][ T311] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 27.205289][ T311] Code: 5d c3 e8 cc df 35 fd be 02 00 00 00 eb 0a e8 c0 df 35 fd be 01 00 00 00 4c 89 f7 e8 23 4c 0f fe e9 0f ff ff ff e8 a9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 98 df 35 fd 4c 89 f7 be 03 [ 27.228646][ T311] RSP: 0018:ffffc900079a7c40 EFLAGS: 00010293 [ 27.234819][ T311] RAX: ffffffff842ec397 RBX: ffff88810de6e800 RCX: ffff88810cf18000 [ 27.243051][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 27.251759][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.260685][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 27.268859][ T311] RDX: 0000000000000000 RSI: 000000000cce5680 RDI: 000000000c04eb7d [ 27.276885][ T311] RBP: ffffc900079a7c60 R08: 0000000000000003 R09: 0000000000000004 [ 27.285437][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.295092][ T311] R10: dffffc0000000000 R11: fffffbfff0dcf648 R12: dffffc0000000000 [ 27.356144][ T311] R13: dffffc0000000000 R14: 000000000cce5680 R15: ffff88812807d800 [ 27.364730][ T311] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 27.375406][ T311] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.382990][ T5] usb 1-1: Using ep0 maxpacket: 16 [ 27.390131][ T311] CR2: 00007fcc5d7c82f8 CR3: 000000010d53b000 CR4: 00000000003526a0 [ 27.399631][ T311] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 27.407689][ T311] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 27.415761][ T311] Call Trace: [ 27.419301][ T311] pppol2tp_release+0x150/0x2b0 [ 27.424225][ T311] sock_close+0xb8/0x200 [ 27.428655][ T311] ? sock_mmap+0xa0/0xa0 [ 27.432955][ T311] __fput+0x2dc/0x730 [ 27.436966][ T311] ____fput+0x15/0x20 [ 27.441205][ T311] task_work_run+0x127/0x190 [ 27.445864][ T311] do_exit+0xa7c/0x24e0 [ 27.450305][ T311] ? __kasan_check_write+0x14/0x20 [ 27.455519][ T311] ? switch_fpu_return+0x19c/0x330 [ 27.460822][ T311] ? put_task_struct+0x90/0x90 [ 27.465697][ T311] ? fpu__clear_all+0x20/0x20 [ 27.470476][ T311] ? __kasan_check_read+0x11/0x20 [ 27.475534][ T311] __x64_sys_exit+0x40/0x40 [ 27.480389][ T311] do_syscall_64+0x31/0x40 [ 27.484810][ T311] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 27.490759][ T311] RIP: 0033:0x7fcc5d5770d9 [ 27.495196][ T311] Code: Unable to access opcode bytes at RIP 0x7fcc5d5770af. [ 27.502674][ T5] usb 1-1: config 0 interface 0 altsetting 88 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 27.502894][ T311] RSP: 002b:00007fcc5bfcfef8 EFLAGS: 00000246 [ 27.513674][ T5] usb 1-1: config 0 interface 0 altsetting 88 endpoint 0x81 has invalid wMaxPacketSize 0 [ 27.514228][ T311] ORIG_RAX: 000000000000003c [ 27.520170][ T5] usb 1-1: config 0 interface 0 altsetting 88 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 27.535818][ T311] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007fcc5d5770d9 [ 27.547652][ T5] usb 1-1: config 0 interface 0 has no altsetting 0 [ 27.556232][ T311] RDX: 00007fcc5bfd09c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 27.562361][ T5] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2d50, bcdDevice= 0.00 [ 27.570731][ T311] RBP: 00007fcc5d60e024 R08: 0000000000000000 R09: 0000000000000058 [ 27.579971][ T5] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.587383][ T311] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 27.603851][ T311] R13: 00007fcc5d7ff038 R14: 00007fcc5d7fefa0 R15: 00007fffe8c1ec68 [ 27.612076][ T311] ---[ end trace ef3ea385ee2c71d4 ]--- [ 27.621416][ T5] usb 1-1: config 0 descriptor?? [ 28.089961][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.097112][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.104379][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.111540][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.118722][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.125852][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.133029][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.140189][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.147308][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.154498][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.161694][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.169309][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.176455][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.183638][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.190785][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.197907][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.205207][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.212836][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.219986][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.227108][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.234278][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.241443][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.248765][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.255887][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.263062][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.270225][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.277357][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.284519][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.291681][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.298873][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.306018][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.313232][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.320386][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.327507][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.335093][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.342270][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.349438][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.356572][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.363744][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.370897][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.378029][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.385193][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.392343][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.399689][ T5] kovaplus 0003:1E7D:2D50.0001: unknown main item tag 0x0 [ 28.413080][ T5] kovaplus 0003:1E7D:2D50.0001: hidraw0: USB HID v0.81 Device [HID 1e7d:2d50] on usb-dummy_hcd.0-1/input0 [ 28.858530][ T5] kovaplus 0003:1E7D:2D50.0001: couldn't init struct kovaplus_device [ 28.866636][ T5] kovaplus 0003:1E7D:2D50.0001: couldn't install mouse [ 28.874318][ T5] kovaplus: probe of 0003:1E7D:2D50.0001 failed with error -71 [ 28.884060][ T5] usb 1-1: USB disconnect, device number 2 [ 28.924740][ T330] fido_id[330]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory