last executing test programs: 3.568448131s ago: executing program 3 (id=884): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x3, 0x1, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000480)={'netdevsim0\x00', &(0x7f00000004c0)=@ethtool_sfeatures={0x3b, 0x2, [{0xfe, 0x8000ffa1}, {0xfffffff9, 0x80500}]}}) 3.561603602s ago: executing program 3 (id=887): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000180)=0x100000001, 0x4) bind$inet(r0, 0x0, 0x0) connect$inet(r0, &(0x7f0000000200)={0x2, 0x4e21, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000280)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000002c0), 0x4) sendto$inet(r0, &(0x7f0000000300), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000000)=""/94, 0x5e, 0x101, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) recvfrom$inet(r0, &(0x7f0000000340)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 2.791994072s ago: executing program 1 (id=900): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000980)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000001b80)={0x1e0a0c3d, &(0x7f00000009c0)=[{0x1, 0x6, 0x2, 0x2}, {0xb, 0xc, 0x7, 0x14d5}]}) 2.784191332s ago: executing program 1 (id=902): r0 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'netdevsim0\x00', &(0x7f0000000140)=@ethtool_link_settings={0x4c, 0xff3, 0x40, 0x7, 0x5, 0x82, 0x4b, 0xf, 0xfb, 0x5, [0xead, 0xfffffffc, 0xa8ac37af, 0x9, 0xffffffff, 0x8, 0x2, 0xffffffff]}}) 2.7117157s ago: executing program 1 (id=904): r0 = socket$inet6(0xa, 0x3, 0xfa) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r2, 0x4068aea3, &(0x7f00000006c0)={0x79, 0x0, 0xc}) ioctl$KVM_IRQ_LINE_STATUS(r2, 0xc008ae67, &(0x7f0000000740)={0x0, 0x3fe}) ioctl$sock_inet6_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f00000001c0)) getrandom(&(0x7f0000000000)=""/286, 0xffffff9a, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) pipe(&(0x7f0000000200)) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) recvmsg$unix(r3, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}], 0x30}, 0x80) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=0x0) syz_ublk_setup_queues(0xffffffffffffffff, r4, &(0x7f0000000580)={0x0, 0xfffffffe, 0x10, 0xfffffffd, 0x7f}, 0x0, 0x1, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x4) write(r5, &(0x7f0000000180)='0', 0x1) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, r5, 0x745) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) 2.699975631s ago: executing program 3 (id=906): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000005c0)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000640)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f0000001840)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9135a01c95d4a128ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000001a00)='nv', 0x2) recvfrom$inet(r0, &(0x7f0000001a40), 0xffffffffffffffa9, 0xc9100120, 0x0, 0x1500) shutdown(r0, 0x1) 2.699333671s ago: executing program 4 (id=907): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x100}) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x18, 0x0, &(0x7f0000000200)=[@increfs, @request_freeze={0x400c6313, 0x0, 0x1}], 0x100, 0x0, &(0x7f0000000240)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000340)={0x1c, 0x0, &(0x7f0000000380)=[@freeze_done={0x40086315, 0x1}, @clear_freeze={0x400c6314, 0x0, 0x1}], 0x100, 0x0, &(0x7f00000003c0)}) 2.624268718s ago: executing program 4 (id=908): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) bpf$PROG_BIND_MAP(0x23, 0x0, 0x0) 2.624078609s ago: executing program 4 (id=909): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x18, 0x0, 0x0, &(0x7f0000000080)='syzkaller\x00', 0x8, 0x0, 0x0, 0x41100, 0x21, '\x00', 0x0, 0xd}, 0x94) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x480c5}, 0x41) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000400), 0x109102, 0x0) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000480)='5', 0x1}], 0x1) connect$bt_sco(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0x8b}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)) writev(0xffffffffffffffff, &(0x7f0000000300)=[{&(0x7f0000000340)="390000001300090468fe0700000000000000ff3f04000000484100100000000004e438d2fd00000000004a7b72000000000000000000f90000", 0x39}], 0x1) writev(r0, &(0x7f0000000380)=[{&(0x7f00000003c0)="4dff000013001118680907070000000f0000ff3f04000000170a001700000000040014001000030001302564aa58b9a64411f6bbf44dc48f57", 0x39}], 0x1) r2 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x0) r4 = openat$cgroup_subtree(r3, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r4, &(0x7f0000000080)=ANY=[@ANYBLOB='+io '], 0x10) 2.596249292s ago: executing program 4 (id=910): socketpair$unix(0x1, 0x2, 0x0, 0x0) unshare(0x600) syz_io_uring_setup(0x3c5f, &(0x7f0000000240)={0x0, 0xa612, 0x27, 0x2}, &(0x7f00000002c0), &(0x7f0000000300), &(0x7f0000000000)) 2.565681265s ago: executing program 4 (id=911): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./sys_sec\x00', 0x1ff) mount(0x0, &(0x7f0000000380)='./sys_sec\x00', &(0x7f00000003c0)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x0) read(r0, &(0x7f0000000440)=""/9, 0xfffffd87) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000001140)={0x0, 0x0, 0x0}, 0x0) write$tun(r0, &(0x7f0000000ac0)=ANY=[], 0xffe) 2.488260663s ago: executing program 4 (id=912): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x9a5eb000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000240)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000002c0), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000300), 0x4000087, 0x2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000740)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a03000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000180003801400020000007468305f746f5f68737200000000080002"], 0xe8}}, 0x0) 1.850347538s ago: executing program 3 (id=914): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000100)=0xf42, 0x4) 1.768314087s ago: executing program 1 (id=915): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000200)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000340)="190000000800aaaaaa81db11010b", 0xe) 1.768168757s ago: executing program 3 (id=916): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000180)=0x100000001, 0x4) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r0, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000280)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000002c0), 0x4) sendto$inet(r0, &(0x7f0000000300), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000000)=""/94, 0x5e, 0x101, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) recvfrom$inet(r0, &(0x7f0000000340)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 1.73666675s ago: executing program 3 (id=918): socket(0x2, 0x3, 0x6) r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000002ac0)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007f9, &(0x7f0000002b00)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10) sendto$inet(r0, &(0x7f0000002b40)="02", 0x1, 0x14, 0x0, 0x0) shutdown(r0, 0x1) pipe2(&(0x7f0000002b80)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) splice(r0, 0x0, r1, 0x0, 0x5, 0x0) 1.73652901s ago: executing program 1 (id=919): r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x72f, 0x100, 0x8, 0x3b5}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f00000004c0)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000540)={0x34, 0x0, 0x0, &(0x7f0000000440)={0x0, 0x8, 0x1, 0x6}, 0x0, 0x0, 0x0}) r6 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x63) close(0x3) syz_ublk_setup_queues(r6, r5, &(0x7f0000000340)={0x0, 0x0, 0x10, 0x1, 0x257}, &(0x7f0000000580)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x880000, 0x20, 0x1000000, 0x4004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x0, 0x0, 0x22a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f6d, 0x8c, 0x1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb4ac, 0x20, 0x8, 0x9d7c}}], 0x1, &(0x7f00000014c0)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, r4, '\x00', {0x1, 0x105, 0x0, 0x0}}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) 1.633719221s ago: executing program 2 (id=920): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000080)='./file0\x00', 0xc41a, &(0x7f00000000c0)={[], [], 0x2c}, 0x1, 0x47c, &(0x7f0000100700)="$eJzs28tvFdUfAPDvTCnv/tof4gNErRK18dFCfYSFGxJN2JiY6AKXtRRCuFBDayKESHWBS8PKlVGXJv4FrmRj1JXGre6NCTFsRBPJmLl35nLpfXDb23IL9/NJpnfOzJk558yZ03vmnLkBDKzx/E8SsTMifo2I0YgYWh5hvPZx/dqF2b+vXZhNIsve/DPJD4u/rl2YLaMmxeeOIjCR1jc1WTh3/tRMpTJ3tghPLZ5+d2rh3PnnT56eOTF3Yu7M9KFNa1nOkTyvez+Y37fnyNuXX589evmdH77OM7ez2N9YjpqxntMcj/G2F+DJns++sYwUn20rnA0pb+t5Qxuutv/RGIqbzW40Xvuor5kD1lWWZdmWpq31HsBSBtzDkuh3DoD+KL/o8+ffcrmD3Y++u3q49gCUl/t6sdT2bIq0iDPc8Hx7q7Tn9Mcj4ujSP5/nS7QchwAAWFvf5v2f51r1/9J4oCHe/4q5obGI+H9E7IqI+yJid0TcH1GN+2BEPLTC9MeXhW+mf6MYhPp52+pLd3tXD0fySjG3dWv/r963GxsqQiPV8g8nx09W5g4U12Qihrfk4YMd0rjy6i+ftNvX2P/Llzz9si9Y5OOPTcsG6I7NLM70UuZGVz+sjgFebC5/Up8JSCJiT0TsXcX5t0bEyWe+2lffsLnhpIXO5e9gDWYIsy8jnq7V/1IsK380ZLXF/OShfN/L0y9NbY3K3IGp8q5o9uNPl95ol/7t63995fW/veX9Xy//WNI4X7uw8jQu/fZx22ea1d7/m5O3quvl7fT+zOLi2YMRm5Ol5u3TN48tw2X8vPwT+1u3/10RN74ojns4IvKb+JGIeDQiHivy/nhEPBER+zuU//vh9vs2Qv0fW1H9r3xl6NR337RLv7v6f7G6NlFs6eb/X7cZ7OXaAQAAwN0irb4Dn6ST9fU0nZysvcO/O7anlfmFxWePz7935ljtXfmxGE7Lka7RhvHQg8WYSxmeLsaKy/AL1XHjLMuybdXw5Ox8pfWcOnCn7GjT/nO/D/U7d8C6q86jHfq0u8h+4QX3lFvm0TtMVgL3njX9pT1wV9H+YXBp/zC4WrX/ixHX+5AV4A7z/Q+DS/uHwaX9w+DS/mEg9fK7/k4ru4407/psdH3S2vgrVyKiXZyhVZ95S0T0msOndqz28Ej7fVW7XynfaatvSVtE/rdfOczrsdvIF2MFZx7pJWN9/scEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwRv4LAAD//2zl4zU=") bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x4, [@func_proto={0x0, 0x0, 0x0, 0x2, 0x3}, @fwd={0x2}, @ptr={0x0, 0x0, 0x0, 0x2, 0x2}]}, {0x0, [0x0, 0x51]}}, 0x0, 0x40}, 0x20) prlimit64(0x0, 0xe, &(0x7f0000100b80)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000100bc0)=0x7) sched_setscheduler(0x0, 0x1, &(0x7f0000100c00)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000100c40)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000100c80)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000100d00), 0x651, 0x0) recvmmsg(r0, &(0x7f0000100d40), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000100d80)=0x6) socket$inet6(0xa, 0x2, 0x3a) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000100dc0), 0x28642, 0x0) timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000100e00)) timer_settime(0x0, 0x1, &(0x7f0000100e40)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) syz_mount_image$ext4(&(0x7f0000100e80)='ext4\x00', &(0x7f0000100ec0)='./file0\x00', 0x800, &(0x7f0000100f00), 0x0, 0x75c, &(0x7f0000100f40)="$eJzs3M1rHGUYAPBnJtmmH9GNIPhxEKGFFkonSXNpT40Xb4VCwWsNySSETLIhu6ndWLD1LNTmoiCIevboVSj1D/AmPQjeBdEaD+JlZTYfpTGbbpukK+nvB5N93vl63iczvNmBvBPAC+vt8kcSMRgRVyKiurE+jYgj7ehoxK31/dYe3pwslyRarau/J+Vhsdaqbp0r2fg8Ee1D4vWIuF+JOPvxf/PWmytzE0WRL220hxvzi8P15sq52fmJmXwmXxgduzhyYWzswsjYE2t4rctaT7138djdH99dXf3pu8adt/rPJTHerjs2auvyNE9l/XdSifFt6xcOIlkPJb3uAAAAXSm/5/dFRH/7W2o1+toRAAAAcJi0BloAAADAoZdEr3sAAAAAHKzN/wPYnNt7UPNgO/ntnYgY2il/f3sOccTRqETE8bXksZkJyfphsCe3bkfEvfHt99835R12a4/nHtnWfnyO9JE9np39cK8cf8Z3Gn/SrfEndhh/+jffnbBHnce/R/n7Oox/V7rM8f2Xb1Q65r8d8Wb/TvmTrfxJh/zvd5n/zuondztta30dcXrHvz/JY7l2eT/E+PRssevrB+7/c+bBbvUf75Q/2b3+xS7r/3Dtz7lOY0mZ/8zJ3a//TvnLe+LTjX6kEXF347Nsr27LcXI+/WG3+qciWs9y/b/qsv5fvh240eWuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0JZGxGAkabYVp2mWRZyIiFfjeFrU6o2z07XlhalyW8RQVNLp2SIfiYjqejsp26Pt+FH7/Lb2WES88vOx9aSzRZ5N1oqpXhcPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAlhMRMRhJmkVEGhF/VdM0yyL6uzh24Dn0DwAAANgnQ73uAAAAAHDgPP8DAADA4fesz//JPvcDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAONSuXL5cLq21hzcny3bf9ebyXO36uam8PpfNL09mk7WlxWymVpsp8myyNv+k8xW12uLoxVi+MdzI643henPl2nxteaFxbXZ+Yia/lleeS1UAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8rcH2kqRZRKTtOE2zLOKliBiKSjI9W+QjEfFyRDyoVgbK9mivOw0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMC+qzdX5iaKIl8S/P+C/uhu56MHkX3QvXGAwUcRXV7cXgW9HpkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOiFenNlbqIo8qV6r3sCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAb6W/JhFRLqerpwa3bz2S/F1tf0bEB19c/ezGRKOxNFqu/2NrfePzjfXne9F/AAAAeCFcepqdN5/TN5/jAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAulVvrsxNFEW+tLfgUjRXWkmHfXpdIwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gz+DQAA//+HK8Pv") 1.562546818s ago: executing program 0 (id=921): r0 = socket$igmp6(0xa, 0x3, 0x2) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000140)={@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, 0x80, r2}) ioctl$sock_inet6_SIOCDIFADDR(r0, 0x8936, &(0x7f0000000180)={@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, 0x80, r2}) 1.528124802s ago: executing program 0 (id=922): prlimit64(0x0, 0xe, &(0x7f0000000640)={0x86, 0x100000403}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000700)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000740)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000780)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r1, &(0x7f0000000800)=""/102392, 0x18ff8) fsopen(&(0x7f0000000300)='ramfs\x00', 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000280)='./sys\x00', &(0x7f00000002c0)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/firmware/acpi/interrupts/gpe00\x00', 0x2002, 0x0) read$FUSE(r2, &(0x7f000001cdc0)={0x2020}, 0x2020) 1.34834409s ago: executing program 0 (id=923): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="380000000100be", 0x7) 1.266207999s ago: executing program 0 (id=924): prlimit64(0x0, 0xe, &(0x7f0000000300)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000340)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000380)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f00000003c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000400), 0x0, 0x0) read$msr(r3, &(0x7f0000000440)=""/102392, 0x18ff8) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f000001a600), 0x0, 0x0) read$FUSE(r4, &(0x7f000001a640)={0x2020}, 0xfffffe0c) 684.471839ms ago: executing program 0 (id=925): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000040)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x4, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0xffff, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x32) ioctl$PPPIOCSFLAGS(r0, 0x40047459, 0x0) 593.923059ms ago: executing program 2 (id=926): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380), 0x482, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00000003c0)={0x0, 0x258cc74d, 0x4000, 0x0, 0x40, "00000000000000000000ffff00"}) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000800)={0x1, 0x2, 0xf1, 0x31f, 0x9, "d206000094f3ffffd51930f9000100"}) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000840)=0x6) 580.85947ms ago: executing program 1 (id=927): r0 = socket$inet6(0xa, 0x3, 0xff) sendto$inet6(r0, &(0x7f0000000240)="a9bc9278779e589dc560aba1c76e28c00d743c41bab2bf700383d664b0", 0x1d, 0x24000800, 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = dup(r1) ioctl$F2FS_IOC_PRECACHE_EXTENTS(r2, 0xf50f, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000004c0)=0x2) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f0000000500)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000580)=@file={0x0, './tracefs\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000600), 0x318, 0x0) recvmmsg(r4, &(0x7f0000000640), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x2) openat$pidfd(0xffffffffffffff9c, &(0x7f00000006c0), 0x8000, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000780)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/dynamic_events\x00', 0x2, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000007c0), 0xa0c02, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000800)={'caif0\x00', 0x1}) ioctl$TUNSETDEBUG(r6, 0x400454c9, 0xffffffffffffffff) ioctl$TUNGETFILTER(r6, 0x801054db, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000840)={&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000000880)=""/4096, 0x1000, 0x0, 0x0}, &(0x7f0000001880)=0x40) write$UHID_INPUT(r2, &(0x7f00000018c0)={0xe, {"a2e3ad099b0d09f91b5f2f0987f70e06d038e7ff7fc6e5539b0d3d0e8b089b3f323063090810e0879b0f0a75e70a9b334d959b669a240d5b0af3988f7ef31952010afde8d178708c523c921b1b5b07070d075b0936cd3b78130daa61d8e81a3f00005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397273ce1766769f0c91c00305d3f46635eb016d5b1dda98e2d739be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b7638354a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc3609aa24b7d520c829d095083bba2987a67399eac430d145d546a40b9f6ff14ac488ec130bb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b2860d1b3cff57d8b6d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a4f0492d48604675fde2b34cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827955e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb9754fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94e7475cb74642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd72ea4998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5ff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c58b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b50517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864af090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d885b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1a85ae7e69fd1a47a284f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cef8473b53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b344340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cccf8a97406bb5a68a1f0c4549820a73c8859dde0712ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcb7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c2e14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ec00000000000000b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a52830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec685f068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000e00f96f06817fb903729a7fb6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x942}}, 0x1006) 528.178955ms ago: executing program 2 (id=928): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000180)=0x100000001, 0x4) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r0, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000280)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000002c0), 0x4) sendto$inet(r0, &(0x7f0000000300), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000000)=""/94, 0x5e, 0x101, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) recvfrom$inet(r0, &(0x7f0000000340)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 527.902025ms ago: executing program 2 (id=929): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000500)='./bus\x00', 0x1000c40, &(0x7f00000002c0), 0x5, 0x51c, &(0x7f0000000700)="$eJzs3cFvI1cZAPBvZjebNE2bFCoVENClFBa0WjvxtlHVU7mAUFUJUXHikIbEG0Vx4ih2ShNWavI/IFGJA4ITZyQQHCr1xBHBDW69lANSgRWoQeJgNONx1t3YG3c3awv795NGM29mMt97Y8178RfHL4CJdTUijiLiSkS8ERHzxf6kWOKV9pKd99Gd22snd26vJdFqvf6PJD+e7Yuun8k8XlxzJiK++62IHyRn4zYODrdWa7XqXlEuN7d3y42Dwxub26sb1Y3qTqWyvLS8+NLNFysDtWNmgHOe3f7Vh9/cfPV77/7uCx/86ejrP8qqNVcc627HRWo3feo0TuZyRLz6KIKNwKWiPVdGXREeSBoRn4qI5/Lnfz4u5a/mYHo81gDA/4FWaz5a891lAGDcpXkOLElLRS5gLtK0VGrn8J6O2bRWbzSv36rv76y3c2ULMZXe2qxVF4tc4UJMJVl56e1s+265Eh8v34yIpyLix9OP5eXS2uB5BgDgYj1+z/j/7+n2+A8AjLmeH57pfn++Mry6AADDMciHZwGA8WL8B4DJc3f8nx1pPQCA4fH+HwAmj/EfACbN+53x/9KoawIADMV3XnstW1onxfdfr795sL9Vf/PGerWxVdreXyut1fd2Sxv1+katWlqrb593vVq9vrv0Quy/VW5WG81y4+BwZbu+v9Ncyb/Xe6U6NZRWAQD389Sz7/0liYijlx/Ll+iay8FYDeMtHXUFgJGR84fJ5Vu4YXJ5jw+T69fFf/yeN5dn348Iv/MAQVtvP8APARft2mfl/2FSyf/D5JL/h8kl/w+Tq9VK+s35n56eAgCMlU+Y4/cnARhDQ/37PwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIyJuXxZ6CqnaakU8URELMRUcmuzVl2MiCcj4s/TU9NZeWmkNQYAHl76t6SY/+va/PNz9x69kvxnOl9HxA9/+vpP3lptNveWsv3/PN3ffKfYXxlF/QGA83TG6c443vHRndtrnWWY9fnwG+3JRbO4J8XSPnI5LmerP87kkw7P/itplwvZ7yuXLiD+0XFEfKZX+5M8N7JQzHx6b/ws9hNDjZ9+LH6aH2uvs3vx6TNXnu4b87y5XmFSvJf1P6/0ev7SuJqvZ3pOfjyT91APr9P/nZzp/zrP+0ze1/Tq/64OGuOF33+777HjiM9d7hU/OY2f9In//IDx3//8F5/rd6z184hr0Tt+d6xyc3u33Dg4vJHd+OpGdadSWV5aXnzp5ouVcp6jLncy1d3aI8TfX77+ZN/2//K3RUd5Nv7MOe3/yn1b3TrtgH/x3ze+/6V+8Y8jvvbl3q//0/eJn42JXy22+/f0bauzv+k7fXcWf719/48/6et//Zy4HR/89XB9wFMBgCFoHBxurdZq1b0L3ZiKC75g10byiOpsYwQbMcRY2a/JD3udZ4qU2Wrn+ek+5w8/e/eZbN/I7+qFbIyuTwKG4+5DP+qaAAAAAAAAAAAAAAAA/TzyfydKR91CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxtn/AgAA//8LKMVX") setxattr$trusted_overlay_upper(&(0x7f0000000380)='./file1\x00', &(0x7f00000001c0), &(0x7f0000001400)=ANY=[], 0x835, 0x0) setxattr$trusted_overlay_upper(&(0x7f0000001300)='./file0/file0\x00', &(0x7f00000001c0), &(0x7f0000000000)=ANY=[], 0x835, 0x0) setxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0/file0\x00', &(0x7f0000000080), &(0x7f0000001400)=ANY=[], 0x835, 0x2) 443.603494ms ago: executing program 2 (id=930): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000480)=@ipv6_newaddr={0x48, 0x14, 0x211, 0x70bd2a, 0x25dfdbff, {0xa, 0x3f, 0x8, 0xc8}, [@IFA_LOCAL={0x14, 0x2, @private0}, @IFA_CACHEINFO={0x14, 0x6, {0x7fff, 0xca, 0xfffffffa, 0x401}}, @IFA_FLAGS={0x8, 0x8, 0x40}]}, 0x48}, 0x1, 0x0, 0x0, 0x8880}, 0x40) 221.911837ms ago: executing program 2 (id=931): r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000380)=0x5, 0x4) connect$inet6(r0, &(0x7f0000000400)={0xa, 0x0, 0x380000, @loopback}, 0x1c) 0s ago: executing program 0 (id=932): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a78000000060a1d0400000000000000000a0000010900010073797a31000000004c000480480001800b000100746172676574000038000280240003000739f2f10455afb9fdd672bad09dfb78c7699c74e891a0c700000000000000000800024000000000080001004c4f47000900020073797a32"], 0xa0}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 21.474795][ T28] kauditd_printk_skb: 47 callbacks suppressed [ 21.474851][ T28] audit: type=1400 audit(1793190599.425:59): avc: denied { transition } for pid=266 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 21.481946][ T28] audit: type=1400 audit(1793190599.425:60): avc: denied { noatsecure } for pid=266 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 21.488761][ T28] audit: type=1400 audit(1793190599.435:61): avc: denied { write } for pid=266 comm="sh" path="pipe:[14982]" dev="pipefs" ino=14982 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 21.498543][ T28] audit: type=1400 audit(1793190599.435:62): avc: denied { rlimitinh } for pid=266 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 21.521523][ T28] audit: type=1400 audit(1793190599.435:63): avc: denied { siginh } for pid=266 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 21.553624][ T259] sshd-session (259) used greatest stack depth: 22216 bytes left Warning: Permanently added '10.128.0.254' (ED25519) to the list of known hosts. [ 29.744123][ T28] audit: type=1400 audit(1793190607.695:64): avc: denied { mounton } for pid=278 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 29.772045][ T28] audit: type=1400 audit(1793190607.725:65): avc: denied { mount } for pid=278 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.775063][ T278] cgroup: Unknown subsys name 'net' [ 29.806865][ T28] audit: type=1400 audit(1793190607.755:66): avc: denied { unmount } for pid=278 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.807213][ T278] cgroup: Unknown subsys name 'devices' [ 29.933055][ T278] cgroup: Unknown subsys name 'hugetlb' [ 29.941892][ T278] cgroup: Unknown subsys name 'rlimit' [ 30.085143][ T28] audit: type=1400 audit(1793190608.035:67): avc: denied { setattr } for pid=278 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 30.113063][ T28] audit: type=1400 audit(1793190608.035:68): avc: denied { mounton } for pid=278 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 30.143315][ T28] audit: type=1400 audit(1793190608.035:69): avc: denied { mount } for pid=278 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 30.173722][ T280] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 30.183572][ T28] audit: type=1400 audit(1793190608.135:70): avc: denied { relabelto } for pid=280 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 30.215155][ T28] audit: type=1400 audit(1793190608.135:71): avc: denied { write } for pid=280 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.256234][ T28] audit: type=1400 audit(1793190608.205:72): avc: denied { read } for pid=278 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.258244][ T278] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 30.287383][ T28] audit: type=1400 audit(1793190608.205:73): avc: denied { open } for pid=278 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 31.293613][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.302451][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.311259][ T286] device bridge_slave_0 entered promiscuous mode [ 31.321999][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.332596][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.341277][ T286] device bridge_slave_1 entered promiscuous mode [ 31.407958][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.416187][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.426028][ T288] device bridge_slave_0 entered promiscuous mode [ 31.440490][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.448184][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.458073][ T288] device bridge_slave_1 entered promiscuous mode [ 31.490476][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.498364][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.508283][ T289] device bridge_slave_0 entered promiscuous mode [ 31.519686][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.527603][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.536415][ T289] device bridge_slave_1 entered promiscuous mode [ 31.596298][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.605000][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.613518][ T287] device bridge_slave_0 entered promiscuous mode [ 31.625588][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.633935][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.642971][ T287] device bridge_slave_1 entered promiscuous mode [ 31.673369][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.680956][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.690345][ T290] device bridge_slave_0 entered promiscuous mode [ 31.699350][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.708464][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.716443][ T290] device bridge_slave_1 entered promiscuous mode [ 31.918225][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.926324][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.936589][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.945010][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.971787][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.979897][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.988094][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.997484][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.016250][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.023971][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.032373][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.041763][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.065600][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.073264][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.082596][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.091258][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.134206][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.143458][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.152659][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.160728][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.181419][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.189487][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.198488][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.208198][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 32.217636][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.227489][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.236832][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.245212][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.254265][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.264659][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.273027][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.311186][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 32.322681][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 32.334974][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.342861][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.353626][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 32.366402][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 32.376257][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.384565][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.393246][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 32.402860][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 32.411882][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 32.422480][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 32.434494][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.444354][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.452859][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 32.462204][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 32.471415][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.480116][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.511134][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 32.521370][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 32.531097][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 32.541433][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 32.550251][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 32.561015][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 32.571713][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.581175][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.590455][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 32.599301][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 32.608816][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.617125][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.626537][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 32.635561][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 32.646268][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.653816][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.662572][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 32.672079][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 32.681651][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.689500][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.698144][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 32.707924][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 32.716745][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 32.725172][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 32.735212][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 32.745115][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 32.754153][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 32.766608][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 32.806261][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 32.815255][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 32.826791][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 32.837304][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 32.847077][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 32.856313][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 32.870590][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 32.883010][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 32.893318][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 32.909632][ T289] device veth0_vlan entered promiscuous mode [ 32.920657][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 32.930982][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 32.939167][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 32.948798][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 32.959498][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 32.975503][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 32.984431][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 32.993597][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 33.003839][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 33.019061][ T286] device veth0_vlan entered promiscuous mode [ 33.026977][ T288] device veth0_vlan entered promiscuous mode [ 33.036394][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 33.044909][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 33.052996][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 33.062267][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 33.073483][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 33.082290][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 33.106305][ T289] device veth1_macvtap entered promiscuous mode [ 33.116637][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 33.126539][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 33.136819][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 33.147188][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 33.156872][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 33.166180][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 33.174970][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 33.184811][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 33.193795][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.202276][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.211606][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 33.220601][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 33.229494][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.239081][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.249179][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 33.273746][ T288] device veth1_macvtap entered promiscuous mode [ 33.282226][ T290] device veth0_vlan entered promiscuous mode [ 33.293692][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 33.303380][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 33.312855][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 33.340390][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 33.350972][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 33.361057][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 33.374138][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 33.382944][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 33.392790][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 33.403691][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 33.414397][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 33.424242][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 33.434076][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 33.454534][ T290] device veth1_macvtap entered promiscuous mode [ 33.466006][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 33.475373][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 33.486393][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 33.497593][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 33.507358][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 33.518559][ T287] device veth0_vlan entered promiscuous mode [ 33.530005][ T286] device veth1_macvtap entered promiscuous mode [ 33.547008][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 33.555653][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 33.556394][ T288] request_module fs-gadgetfs succeeded, but still no fs? [ 33.565935][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 33.580373][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 33.590252][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 33.615229][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 33.624422][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 33.644854][ T287] device veth1_macvtap entered promiscuous mode [ 33.664381][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 33.678300][ T312] zram0: detected capacity change from 0 to 8 [ 33.681913][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 33.697737][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 33.708464][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 33.718396][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 33.728032][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 33.736952][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 33.749126][ T314] loop2: detected capacity change from 0 to 256 [ 33.756837][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 33.766886][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 33.778484][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 33.789263][ T314] FAT-fs (loop2): error, clusters badly computed (0 != 128) [ 33.797933][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 33.807247][ T314] FAT-fs (loop2): Filesystem has been set read-only [ 33.828035][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 33.838965][ T314] FAT-fs (loop2): error, fat_bmap_cluster: request beyond EOF (i_pos 196) [ 33.849604][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 34.331220][ T328] loop4: detected capacity change from 0 to 4096 [ 34.367798][ T328] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 34.568250][ T290] EXT4-fs (loop4): unmounting filesystem. [ 35.170315][ T28] kauditd_printk_skb: 60 callbacks suppressed [ 35.170331][ T28] audit: type=1400 audit(1793190613.125:134): avc: denied { read write } for pid=344 comm="syz.2.12" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 35.213205][ T28] audit: type=1400 audit(1793190613.165:135): avc: denied { open } for pid=344 comm="syz.2.12" path="/dev/raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 35.240628][ T28] audit: type=1400 audit(1793190613.165:136): avc: denied { ioctl } for pid=344 comm="syz.2.12" path="/dev/raw-gadget" dev="devtmpfs" ino=258 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 35.305203][ T351] loop0: detected capacity change from 0 to 256 [ 35.326787][ T351] exFAT-fs (loop0): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 35.376912][ T28] audit: type=1400 audit(1793190613.325:137): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 35.466766][ T355] overlayfs: failed to create directory ./bus/work (errno: 22); mounting read-only [ 35.476872][ T28] audit: type=1400 audit(1793190613.415:138): avc: denied { mounton } for pid=354 comm="syz.1.15" path="" dev="cgroup2" ino=152 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 35.923914][ T28] audit: type=1400 audit(1793190613.505:139): avc: denied { read } for pid=352 comm="syz.0.14" name="msr" dev="devtmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 35.952519][ T364] loop1: detected capacity change from 0 to 256 [ 36.533325][ T366] caif0: tun_chr_ioctl cmd 2148553947 [ 36.674304][ T364] exfat: Deprecated parameter 'namecase' [ 36.694094][ T368] zram: Cannot change disksize for initialized device [ 36.704305][ T364] exFAT-fs (loop1): Medium has reported failures. Some data may be lost. [ 36.705369][ T28] audit: type=1400 audit(1793190613.505:140): avc: denied { open } for pid=352 comm="syz.0.14" path="/dev/cpu/0/msr" dev="devtmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 36.770745][ T364] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0x7f1fc68d, utbl_chksum : 0xe619d30d) [ 36.783871][ T28] audit: type=1400 audit(1793190613.805:141): avc: denied { mounton } for pid=354 comm="syz.1.15" path="" dev="cgroup2" ino=191 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 36.807685][ T28] audit: type=1400 audit(1793190613.805:142): avc: denied { mount } for pid=354 comm="syz.1.15" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 36.861452][ T28] audit: type=1400 audit(1793190614.455:143): avc: denied { mount } for pid=360 comm="syz.4.17" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 36.914823][ T376] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 36.931244][ T379] loop2: detected capacity change from 0 to 512 [ 36.953193][ T379] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 36.992521][ T379] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 37.016536][ T374] loop4: detected capacity change from 0 to 512 [ 37.023776][ T379] EXT4-fs (loop2): 1 truncate cleaned up [ 37.031655][ T379] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 37.070981][ T374] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 37.092388][ T374] System zones: 1-12 [ 37.347141][ T374] EXT4-fs error (device loop4): ext4_xattr_inode_iget:401: inode #12: comm syz.4.23: missing EA_INODE flag [ 37.507567][ T288] EXT4-fs (loop2): unmounting filesystem. [ 37.520006][ T374] EXT4-fs error (device loop4): ext4_xattr_inode_iget:406: comm syz.4.23: error while reading EA inode 12 err=-117 [ 37.572258][ T374] EXT4-fs (loop4): 1 orphan inode deleted [ 37.599429][ T374] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 37.704631][ T398] loop0: detected capacity change from 0 to 512 [ 37.768286][ T398] EXT4-fs error (device loop0): __ext4_iget:5104: inode #2: block 131072: comm syz.0.27: invalid block [ 37.812714][ T398] EXT4-fs (loop0): get root inode failed [ 37.837265][ T398] EXT4-fs (loop0): mount failed [ 38.020239][ T290] EXT4-fs (loop4): unmounting filesystem. [ 38.089544][ T410] loop4: detected capacity change from 0 to 256 [ 38.114219][ T410] exFAT-fs (loop4): failed to load upcase table (idx : 0x0000fd4f, chksum : 0xdd63664a, utbl_chksum : 0xe619d30d) [ 38.250388][ T411] loop0: detected capacity change from 0 to 2048 [ 38.267672][ T412] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 38.399885][ T412] EXT4-fs (loop3): can't mount with data=, fs mounted w/o journal [ 38.462576][ T19] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 38.473092][ T411] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 38.483818][ T411] ext4 filesystem being mounted at /4/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 38.568042][ T391] syz.1.22 (391) used greatest stack depth: 18984 bytes left [ 38.674076][ T287] EXT4-fs (loop0): unmounting filesystem. [ 38.682536][ T19] usb 3-1: config 0 interface 0 has no altsetting 0 [ 38.693744][ T19] usb 3-1: New USB device found, idVendor=06cb, idProduct=81a7, bcdDevice= 0.00 [ 38.718164][ T19] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 38.732321][ T19] usb 3-1: config 0 descriptor?? [ 38.971896][ T291] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 38.975102][ T430] set_capacity_and_notify: 1 callbacks suppressed [ 38.975129][ T430] loop0: detected capacity change from 0 to 512 [ 38.996997][ T430] FAT-fs (loop0): Unrecognized mount option "ÿÿÿÿÿÿÿÿÿÿÿÿÿ" or missing value [ 39.115642][ T317] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 39.289986][ T291] usb 2-1: Using ep0 maxpacket: 16 [ 39.299262][ T291] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 39.309936][ T291] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 39.330178][ T291] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 39.339976][ T6] usb 5-1: new low-speed USB device number 2 using dummy_hcd [ 39.347986][ T291] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.356264][ T291] usb 2-1: Product: syz [ 39.361150][ T291] usb 2-1: Manufacturer: syz [ 39.361180][ T291] usb 2-1: SerialNumber: syz [ 39.398587][ T450] loop3: detected capacity change from 0 to 512 [ 39.409950][ T450] EXT4-fs error (device loop3): ext4_orphan_get:1405: inode #15: comm syz.3.42: iget: bad i_size value: 38620345925642 [ 39.423490][ T450] EXT4-fs error (device loop3): ext4_orphan_get:1410: comm syz.3.42: couldn't read orphan inode 15 (err -117) [ 39.436184][ T450] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 39.453527][ T450] netlink: 4 bytes leftover after parsing attributes in process `syz.3.42'. [ 39.531617][ T6] usb 5-1: unable to get BOS descriptor or descriptor too short [ 39.541392][ T6] usb 5-1: config 205 has an invalid interface number: 21 but max is 0 [ 39.550445][ T6] usb 5-1: config 205 has no interface number 0 [ 39.557165][ T6] usb 5-1: config 205 interface 21 has no altsetting 0 [ 39.567053][ T6] usb 5-1: string descriptor 0 read error: -22 [ 39.575914][ T6] usb 5-1: New USB device found, idVendor=0421, idProduct=04f0, bcdDevice=4e.57 [ 39.582297][ T291] usb 2-1: 0:2 : does not exist [ 39.587330][ T6] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.602635][ T291] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 39.602662][ T6] usb 5-1: bad CDC descriptors [ 39.631810][ T291] usb 2-1: USB disconnect, device number 2 [ 39.642604][ T450] EXT4-fs error (device loop3): ext4_validate_block_bitmap:429: comm syz.3.42: bg 0: block 5: invalid block bitmap [ 39.658497][ T450] EXT4-fs (loop3): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 2048 with error 28 [ 39.671372][ T450] EXT4-fs (loop3): This should not happen!! Data will be lost [ 39.671372][ T450] [ 39.681818][ T450] EXT4-fs (loop3): Total free blocks count 0 [ 39.688617][ T450] EXT4-fs (loop3): Free/Dirty block details [ 39.708866][ T450] EXT4-fs (loop3): free_blocks=0 [ 39.720009][ T450] EXT4-fs (loop3): dirty_blocks=2296 [ 39.725794][ T450] EXT4-fs (loop3): Block reservation details [ 39.732288][ T450] EXT4-fs (loop3): i_reserved_data_blocks=2296 [ 39.739253][ T454] loop0: detected capacity change from 0 to 512 [ 39.760374][ T454] EXT4-fs error (device loop0): __ext4_iget:5104: inode #2: block 131072: comm syz.0.43: invalid block [ 39.772467][ T454] EXT4-fs (loop0): get root inode failed [ 39.778199][ T454] EXT4-fs (loop0): mount failed [ 39.841360][ T320] EXT4-fs (loop3): Delayed block allocation failed for inode 18 at logical offset 2052 with max blocks 244 with error 28 [ 39.873645][ T457] loop4: detected capacity change from 0 to 256 [ 39.887743][ T459] loop3: detected capacity change from 0 to 512 [ 39.898352][ T459] EXT4-fs error (device loop3): __ext4_iget:5104: inode #2: block 131072: comm syz.3.44: invalid block [ 39.919076][ T459] EXT4-fs (loop3): get root inode failed [ 39.926082][ T459] EXT4-fs (loop3): mount failed [ 39.990178][ T461] loop0: detected capacity change from 0 to 2048 [ 40.032717][ T461] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 40.042843][ T461] ext4 filesystem being mounted at /8/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 40.082793][ T424] usb 5-1: USB disconnect, device number 2 [ 40.272895][ T471] loop1: detected capacity change from 0 to 512 [ 40.282932][ T471] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 40.292126][ T471] EXT4-fs (loop1): can't mount with data=, fs mounted w/o journal [ 40.379786][ T39] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 40.397432][ T28] kauditd_printk_skb: 42 callbacks suppressed [ 40.397448][ T28] audit: type=1400 audit(1793190618.345:186): avc: denied { create } for pid=480 comm="syz.1.53" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 40.422964][ T28] audit: type=1400 audit(1793190618.345:187): avc: denied { connect } for pid=480 comm="syz.1.53" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 40.442291][ T28] audit: type=1400 audit(1793190618.345:188): avc: denied { write } for pid=480 comm="syz.1.53" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 40.579899][ T485] loop1: detected capacity change from 0 to 512 [ 40.587806][ T485] FAT-fs (loop1): Unrecognized mount option "ÿÿÿÿÿÿÿÿÿÿÿÿÿ" or missing value [ 40.650168][ T287] EXT4-fs (loop0): unmounting filesystem. [ 40.661454][ T39] usb 4-1: unable to get BOS descriptor or descriptor too short [ 40.671519][ T39] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 40.682301][ T39] usb 4-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 40.693146][ T39] usb 4-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 40.744074][ T39] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.804142][ T39] usb 4-1: Product: syz [ 40.808557][ T39] usb 4-1: Manufacturer: syz [ 40.814817][ T39] usb 4-1: SerialNumber: syz [ 41.042083][ T433] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 41.088894][ T19] usbhid 3-1:0.0: can't add hid device: -71 [ 41.097195][ T19] usbhid: probe of 3-1:0.0 failed with error -71 [ 41.107131][ T19] usb 3-1: USB disconnect, device number 2 [ 41.130364][ T496] loop2: detected capacity change from 0 to 512 [ 41.143611][ T28] audit: type=1400 audit(1793190619.095:189): avc: denied { write } for pid=492 comm="syz.0.58" name="kvm" dev="devtmpfs" ino=83 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 41.179359][ T496] EXT4-fs error (device loop2): ext4_orphan_get:1405: inode #15: comm syz.2.57: iget: bad i_size value: 38620345925642 [ 41.192278][ T496] EXT4-fs error (device loop2): ext4_orphan_get:1410: comm syz.2.57: couldn't read orphan inode 15 (err -117) [ 41.205166][ T496] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 41.217497][ T496] netlink: 4 bytes leftover after parsing attributes in process `syz.2.57'. [ 41.329190][ T500] loop1: detected capacity change from 0 to 512 [ 41.354561][ T500] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 41.378450][ T500] EXT4-fs (loop1): can't mount with data=, fs mounted w/o journal [ 41.389825][ T28] audit: type=1400 audit(1793190619.335:190): avc: denied { name_bind } for pid=503 comm="syz.0.61" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 41.459909][ T416] EXT4-fs error (device loop2): ext4_validate_block_bitmap:429: comm ext4lazyinit: bg 0: block 5: invalid block bitmap [ 41.793313][ T320] EXT4-fs (loop2): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 2048 with error 28 [ 41.843467][ T519] EXT4-fs error (device loop0): __ext4_iget:5104: inode #2: block 131072: comm syz.0.66: invalid block [ 41.857134][ T320] EXT4-fs (loop2): This should not happen!! Data will be lost [ 41.857134][ T320] [ 41.885189][ T28] audit: type=1400 audit(1793190619.835:191): avc: denied { append } for pid=521 comm="syz.4.68" name="kvm" dev="devtmpfs" ino=83 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 41.921039][ T524] EXT4-fs: Ignoring removed oldalloc option [ 41.928584][ T519] EXT4-fs (loop0): get root inode failed [ 41.935520][ T320] EXT4-fs (loop2): Total free blocks count 0 [ 41.950565][ T519] EXT4-fs (loop0): mount failed [ 41.957460][ T320] EXT4-fs (loop2): Free/Dirty block details [ 41.974028][ T524] EXT4-fs (loop4): 1 orphan inode deleted [ 41.983490][ T320] EXT4-fs (loop2): free_blocks=0 [ 41.989572][ T524] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 41.999831][ T320] EXT4-fs (loop2): dirty_blocks=10304 [ 42.005601][ T320] EXT4-fs (loop2): Block reservation details [ 42.012330][ T320] EXT4-fs (loop2): i_reserved_data_blocks=10304 [ 42.029242][ T524] ext4 filesystem being mounted at /9/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 42.042832][ T524] SELinux: Context system_u:object_r:hwdata_t:s0 is not valid (left unmapped). [ 42.353477][ T531] FAT-fs (loop1): Unrecognized mount option "ÿÿÿÿÿÿÿÿÿÿÿÿÿ" or missing value [ 42.368534][ T28] audit: type=1400 audit(1793190620.315:192): avc: denied { relabelto } for pid=521 comm="syz.4.68" name="/" dev="loop4" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:hwdata_t:s0" [ 42.398335][ T28] audit: type=1400 audit(1793190620.345:193): avc: denied { unmount } for pid=521 comm="syz.4.68" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 42.510284][ T524] EXT4-fs (loop4): unmounting filesystem. [ 42.517096][ T43] EXT4-fs (loop2): Delayed block allocation failed for inode 18 at logical offset 2052 with max blocks 2048 with error 28 [ 42.528630][ T433] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 42.594468][ T519] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 42.605653][ T519] ext4 filesystem being mounted at /15/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 42.625307][ T287] EXT4-fs (loop0): unmounting filesystem. [ 42.698302][ T28] audit: type=1400 audit(1793190620.645:194): avc: denied { mount } for pid=535 comm="syz.4.71" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 43.085004][ T28] audit: type=1400 audit(1793190621.035:195): avc: denied { ioctl } for pid=543 comm="syz.1.74" path="/dev/mapper/control" dev="devtmpfs" ino=266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 43.131083][ T546] device-mapper: table: 252:0: crypt: Bad cipher specification (-EINVAL) [ 43.158272][ T546] device-mapper: ioctl: error adding target to table [ 43.231374][ T39] usb 4-1: USB disconnect, device number 2 [ 43.412030][ T557] EXT4-fs (loop2): mounting ext3 file system using the ext4 subsystem [ 43.438100][ T557] EXT4-fs (loop2): can't mount with data=, fs mounted w/o journal [ 43.717870][ T563] EXT4-fs error (device loop3): ext4_orphan_get:1405: inode #15: comm syz.3.78: iget: bad i_size value: 38620345925642 [ 44.365478][ T563] EXT4-fs error (device loop3): ext4_orphan_get:1410: comm syz.3.78: couldn't read orphan inode 15 (err -117) [ 44.389281][ T563] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 44.401026][ T563] netlink: 4 bytes leftover after parsing attributes in process `syz.3.78'. [ 44.412611][ T574] set_capacity_and_notify: 6 callbacks suppressed [ 44.412631][ T574] loop2: detected capacity change from 0 to 512 [ 44.434049][ T574] EXT4-fs: Ignoring removed oldalloc option [ 44.475280][ T578] loop0: detected capacity change from 0 to 512 [ 44.478284][ T574] EXT4-fs (loop2): 1 orphan inode deleted [ 44.491632][ T10] EXT4-fs error (device loop2): ext4_release_dquot:6864: comm kworker/u4:1: Failed to release dquot type 1 [ 44.495250][ T574] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 44.516798][ T574] ext4 filesystem being mounted at /13/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 44.517168][ T578] EXT4-fs error (device loop0): __ext4_iget:5104: inode #2: block 131072: comm syz.0.82: invalid block [ 44.557605][ T578] EXT4-fs (loop0): get root inode failed [ 44.564539][ T578] EXT4-fs (loop0): mount failed [ 44.595737][ T10] EXT4-fs error (device loop3): ext4_validate_block_bitmap:429: comm kworker/u4:1: bg 0: block 5: invalid block bitmap [ 44.611559][ T574] EXT4-fs (loop2): unmounting filesystem. [ 44.621608][ T10] EXT4-fs (loop3): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 2048 with error 28 [ 44.637208][ T10] EXT4-fs (loop3): This should not happen!! Data will be lost [ 44.637208][ T10] [ 44.649418][ T10] EXT4-fs (loop3): Total free blocks count 0 [ 44.655514][ T10] EXT4-fs (loop3): Free/Dirty block details [ 44.661801][ T10] EXT4-fs (loop3): free_blocks=0 [ 44.671873][ T10] EXT4-fs (loop3): dirty_blocks=4152 [ 44.677213][ T10] EXT4-fs (loop3): Block reservation details [ 44.686659][ T578] loop0: detected capacity change from 0 to 2048 [ 44.709417][ T10] EXT4-fs (loop3): i_reserved_data_blocks=4152 [ 44.729447][ T10] EXT4-fs (loop3): Delayed block allocation failed for inode 18 at logical offset 2052 with max blocks 2048 with error 28 [ 44.743587][ T578] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 44.763292][ T578] ext4 filesystem being mounted at /19/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 45.204730][ T287] EXT4-fs (loop0): unmounting filesystem. [ 46.553483][ T621] loop3: detected capacity change from 0 to 512 [ 46.560341][ T621] FAT-fs (loop3): Unrecognized mount option "ÿÿÿÿÿÿÿÿÿÿÿÿÿ" or missing value [ 46.666119][ T28] kauditd_printk_skb: 6 callbacks suppressed [ 46.666135][ T28] audit: type=1400 audit(1793190624.615:201): avc: denied { associate } for pid=624 comm="syz.4.97" name="19" dev="tmpfs" ino=120 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:hwdata_t:s0" [ 46.702276][ T627] loop0: detected capacity change from 0 to 512 [ 46.734778][ T627] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 46.767236][ T627] EXT4-fs (loop0): can't mount with data=, fs mounted w/o journal [ 47.003191][ T349] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 47.053079][ T28] audit: type=1400 audit(1793190625.005:202): avc: denied { unmount } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 47.199711][ C0] sched: RT throttling activated [ 47.756392][ T660] caif0: tun_chr_ioctl cmd 2148553947 [ 47.811897][ T664] loop0: detected capacity change from 0 to 512 [ 47.833349][ T664] EXT4-fs: Ignoring removed oldalloc option [ 47.875154][ T664] EXT4-fs (loop0): 1 orphan inode deleted [ 47.883192][ T664] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 47.892714][ T10] Quota error (device loop0): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 47.908076][ T10] EXT4-fs error (device loop0): ext4_release_dquot:6864: comm kworker/u4:1: Failed to release dquot type 1 [ 47.949887][ T664] ext4 filesystem being mounted at /22/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 48.000312][ T664] EXT4-fs (loop0): unmounting filesystem. [ 48.575791][ T687] loop1: detected capacity change from 0 to 512 [ 48.604449][ T687] FAT-fs (loop1): Unrecognized mount option "ÿÿÿÿÿÿÿÿÿÿÿÿÿ" or missing value [ 48.751442][ T694] loop1: detected capacity change from 0 to 512 [ 48.775853][ T694] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 48.803946][ T694] EXT4-fs (loop1): can't mount with data=, fs mounted w/o journal [ 49.944242][ T728] loop1: detected capacity change from 0 to 512 [ 49.991389][ T728] EXT4-fs: Ignoring removed oldalloc option [ 50.042990][ T728] EXT4-fs (loop1): 1 orphan inode deleted [ 50.048827][ T728] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 50.068252][ T10] Quota error (device loop1): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 50.078381][ T728] ext4 filesystem being mounted at /28/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 50.096101][ T10] EXT4-fs error (device loop1): ext4_release_dquot:6864: comm kworker/u4:1: Failed to release dquot type 1 [ 50.129256][ T728] EXT4-fs (loop1): unmounting filesystem. [ 51.907119][ T28] audit: type=1400 audit(1793190629.855:203): avc: denied { audit_read } for pid=795 comm="syz.1.157" capability=37 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 53.127291][ T831] 9pnet_fd: Insufficient options for proto=fd [ 53.170282][ T28] audit: type=1400 audit(1793190631.105:204): avc: denied { create } for pid=829 comm="syz.3.168" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 54.618677][ T28] audit: type=1400 audit(1793190632.565:205): avc: denied { block_suspend } for pid=867 comm="syz.2.181" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 54.754876][ T888] loop3: detected capacity change from 0 to 512 [ 54.840714][ T888] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 54.860467][ T888] EXT4-fs (loop3): can't mount with data=, fs mounted w/o journal [ 55.179352][ T893] 9pnet_fd: Insufficient options for proto=fd [ 56.113265][ T917] loop3: detected capacity change from 0 to 512 [ 56.122156][ T917] EXT4-fs: Ignoring removed oldalloc option [ 56.133297][ T917] EXT4-fs (loop3): 1 orphan inode deleted [ 56.140382][ T917] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 56.336951][ T917] ext4 filesystem being mounted at /35/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 56.490740][ T10] Quota error (device loop3): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 56.510973][ T10] EXT4-fs error (device loop3): ext4_release_dquot:6864: comm kworker/u4:1: Failed to release dquot type 1 [ 56.529151][ T917] EXT4-fs (loop3): unmounting filesystem. [ 56.553625][ T28] audit: type=1400 audit(1793190634.505:206): avc: denied { bind } for pid=933 comm="syz.3.202" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 57.161368][ T947] 9pnet_fd: Insufficient options for proto=fd [ 57.790844][ T28] audit: type=1400 audit(1793190635.745:207): avc: denied { write } for pid=967 comm="syz.3.214" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 58.633734][ T1001] overlayfs: failed to clone upperpath [ 58.652395][ T1003] ./dev/sda1: Can't open blockdev [ 58.658788][ T1003] SELinux: Context system_u:object_r:inetd_exec_t:s0 is not valid (left unmapped). [ 58.680087][ T28] audit: type=1400 audit(1793190636.615:208): avc: denied { relabelto } for pid=1002 comm="syz.1.227" name="mnt" dev="tmpfs" ino=282 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:inetd_exec_t:s0" [ 58.945822][ T28] audit: type=1400 audit(1793190636.625:209): avc: denied { associate } for pid=1002 comm="syz.1.227" name="mnt" dev="tmpfs" ino=282 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:inetd_exec_t:s0" [ 59.057073][ T28] audit: type=1400 audit(1793190636.815:210): avc: denied { rmdir } for pid=289 comm="syz-executor" name="mnt" dev="tmpfs" ino=282 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:inetd_exec_t:s0" [ 60.503826][ T1053] netlink: 4 bytes leftover after parsing attributes in process `syz.3.243'. [ 60.551086][ T1055] Zero length message leads to an empty skb [ 61.142369][ T28] audit: type=1400 audit(1793190639.095:211): avc: denied { map } for pid=1084 comm="syz.3.251" path="pipe:[13883]" dev="pipefs" ino=13883 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 61.810557][ T1108] netlink: 4 bytes leftover after parsing attributes in process `syz.1.262'. [ 62.268364][ T28] audit: type=1400 audit(1793190640.215:212): avc: denied { bind } for pid=1119 comm="syz.3.268" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 62.295388][ T1120] netlink: 48 bytes leftover after parsing attributes in process `syz.3.268'. [ 62.303638][ T28] audit: type=1400 audit(1793190640.245:213): avc: denied { setopt } for pid=1119 comm="syz.3.268" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 62.360158][ T28] audit: type=1400 audit(1793190640.245:214): avc: denied { write } for pid=1119 comm="syz.3.268" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 63.388693][ T1159] overlayfs: failed to clone upperpath [ 63.410419][ T1161] netlink: 4 bytes leftover after parsing attributes in process `syz.2.282'. [ 63.784246][ T28] audit: type=1400 audit(1793190641.735:215): avc: denied { bind } for pid=1195 comm="syz.4.298" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 63.823931][ T28] audit: type=1400 audit(1793190641.755:216): avc: denied { name_bind } for pid=1195 comm="syz.4.298" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 63.847637][ T1201] netlink: 4 bytes leftover after parsing attributes in process `syz.2.299'. [ 63.857037][ T28] audit: type=1400 audit(1793190641.755:217): avc: denied { node_bind } for pid=1195 comm="syz.4.298" saddr=::ffff:0.0.0.0 src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 63.943072][ T1199] fuse: Bad value for 'fd' [ 63.951695][ T28] audit: type=1400 audit(1793190641.895:218): avc: denied { mounton } for pid=1198 comm="syz.4.301" path="/52/file0" dev="tmpfs" ino=310 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 64.589260][ T1237] 9pnet_fd: Insufficient options for proto=fd [ 64.615020][ T1241] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=1241 comm=syz.0.315 [ 64.674411][ T1243] netlink: 4 bytes leftover after parsing attributes in process `syz.3.316'. [ 64.973531][ T1272] ./dev/sda1: Can't open blockdev [ 65.015555][ T1277] netlink: 4 bytes leftover after parsing attributes in process `syz.1.329'. [ 65.711458][ T28] audit: type=1400 audit(1793190643.665:219): avc: denied { associate } for pid=1306 comm="syz.1.340" name="85" dev="tmpfs" ino=485 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:hwdata_t:s0" [ 65.776397][ T1311] netlink: 4 bytes leftover after parsing attributes in process `syz.1.342'. [ 65.967188][ T1322] 9pnet_fd: Insufficient options for proto=fd [ 66.007245][ T1325] netlink: 'syz.1.346': attribute type 3 has an invalid length. [ 66.110934][ T1337] capability: warning: `syz.2.352' uses deprecated v2 capabilities in a way that may be insecure [ 66.625938][ T1345] netlink: 4 bytes leftover after parsing attributes in process `syz.4.356'. [ 67.133420][ T28] audit: type=1400 audit(1793190645.085:220): avc: denied { bind } for pid=1359 comm="syz.0.361" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 67.522488][ T1379] 9pnet_fd: Insufficient options for proto=fd [ 67.766936][ T1386] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 67.776395][ T1386] ip_tables: iptables: counters copy to user failed while replacing table [ 67.801637][ T28] audit: type=1326 audit(1793190645.755:221): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1387 comm="syz.1.372" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f102ed9f559 code=0x7ffc0000 [ 67.829887][ T28] audit: type=1326 audit(1793190645.755:222): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1387 comm="syz.1.372" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f102ed9f559 code=0x7ffc0000 [ 67.855383][ T28] audit: type=1326 audit(1793190645.755:223): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1387 comm="syz.1.372" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f102ed9f559 code=0x7ffc0000 [ 67.880548][ T28] audit: type=1326 audit(1793190645.755:224): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1387 comm="syz.1.372" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f102ed9f559 code=0x7ffc0000 [ 67.924974][ T1390] netlink: 20 bytes leftover after parsing attributes in process `syz.1.373'. [ 67.953407][ T1392] netlink: 4 bytes leftover after parsing attributes in process `syz.1.374'. [ 68.956773][ T28] kauditd_printk_skb: 86 callbacks suppressed [ 68.956797][ T28] audit: type=1400 audit(1793190646.905:311): avc: denied { connect } for pid=1421 comm="syz.0.385" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 69.129131][ T28] audit: type=1400 audit(1793190646.935:312): avc: denied { read } for pid=1421 comm="syz.0.385" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 69.869750][ T1446] netlink: 4 bytes leftover after parsing attributes in process `syz.3.392'. [ 70.008662][ T28] audit: type=1400 audit(1793190647.955:313): avc: denied { create } for pid=1453 comm="syz.0.395" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 71.312941][ T28] audit: type=1400 audit(1793190649.265:314): avc: denied { remount } for pid=1482 comm="syz.0.404" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=filesystem permissive=1 [ 71.501184][ T1495] netlink: 4 bytes leftover after parsing attributes in process `syz.0.410'. [ 71.789771][ T28] audit: type=1400 audit(1793190649.725:315): avc: denied { mounton } for pid=1508 comm="syz.4.413" path="/71/file0" dev="tmpfs" ino=416 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 72.217038][ T1521] process 'syz.4.418' launched './file0' with NULL argv: empty string added [ 72.227002][ T28] audit: type=1400 audit(1793190650.175:316): avc: denied { execute } for pid=1520 comm="syz.4.418" name="file0" dev="tmpfs" ino=434 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 72.280262][ T28] audit: type=1400 audit(1793190650.175:317): avc: denied { execute_no_trans } for pid=1520 comm="syz.4.418" path="/74/file0" dev="tmpfs" ino=434 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 73.691243][ T1560] capability: warning: `syz.2.428' uses 32-bit capabilities (legacy support in use) [ 73.702692][ T1560] ./dev/sda1: Can't open blockdev [ 74.566236][ T28] audit: type=1400 audit(1793190652.435:318): avc: denied { sqpoll } for pid=1574 comm="syz.4.436" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 75.810525][ T1635] fuse: Bad value for 'fd' [ 77.078008][ T1673] netlink: 4 bytes leftover after parsing attributes in process `syz.2.472'. [ 77.530433][ T28] audit: type=1400 audit(1793190655.485:319): avc: denied { name_bind } for pid=1678 comm="syz.3.473" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 78.683098][ T1730] netlink: 4 bytes leftover after parsing attributes in process `syz.4.491'. [ 78.909982][ T28] audit: type=1400 audit(1793190656.865:320): avc: denied { create } for pid=1749 comm="syz.4.499" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 79.311362][ T1737] fuse: Bad value for 'fd' [ 79.445469][ T28] audit: type=1400 audit(1793190657.395:321): avc: denied { watch } for pid=1754 comm="syz.4.500" path="/94/bus" dev="tmpfs" ino=542 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 79.908017][ T1777] netlink: 4 bytes leftover after parsing attributes in process `syz.2.505'. [ 80.105315][ T1792] netlink: 12 bytes leftover after parsing attributes in process `syz.2.510'. [ 80.214758][ T1798] netlink: 136 bytes leftover after parsing attributes in process `syz.2.511'. [ 80.299750][ T28] audit: type=1400 audit(1793190658.235:322): avc: denied { mount } for pid=1804 comm="syz.2.516" name="/" dev="configfs" ino=14732 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 80.323703][ T1807] Illegal XDP return value 4294967274 on prog (id 25) dev N/A, expect packet loss! [ 80.663679][ T1839] netlink: 4 bytes leftover after parsing attributes in process `syz.4.520'. [ 80.996570][ T28] audit: type=1326 audit(1793190658.945:323): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1850 comm="syz.1.533" exe="/root/ci2-android-6-1/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f102ed9f559 code=0x0 [ 81.783451][ T1864] netlink: 25 bytes leftover after parsing attributes in process `syz.4.542'. [ 81.792760][ T1864] device ifb1 entered promiscuous mode [ 81.829213][ T1871] ======================================================= [ 81.829213][ T1871] WARNING: The mand mount option has been deprecated and [ 81.829213][ T1871] and is ignored by this kernel. Remove the mand [ 81.829213][ T1871] option from the mount to silence this warning. [ 81.829213][ T1871] ======================================================= [ 81.864598][ T1867] netlink: 4 bytes leftover after parsing attributes in process `syz.2.541'. [ 81.880037][ T28] audit: type=1400 audit(1793190659.835:324): avc: denied { search } for pid=1865 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 81.917841][ T28] audit: type=1400 audit(1793190659.865:325): avc: denied { read } for pid=1874 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=494 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 81.974889][ T28] audit: type=1400 audit(1793190659.865:326): avc: denied { open } for pid=1874 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=494 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 82.015032][ T1871] 9pnet_fd: Insufficient options for proto=fd [ 82.041531][ T28] audit: type=1400 audit(1793190659.865:327): avc: denied { getattr } for pid=1874 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=494 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 82.119889][ T28] audit: type=1400 audit(1793190659.865:328): avc: denied { getattr } for pid=1874 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf/eth0.dhcp" dev="tmpfs" ino=503 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 82.260060][ T28] audit: type=1400 audit(1793190659.915:329): avc: denied { read } for pid=1880 comm="sed" name="eth0.dhcp" dev="tmpfs" ino=503 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 82.331018][ T28] audit: type=1400 audit(1793190659.915:330): avc: denied { open } for pid=1880 comm="sed" path="/run/dhcpcd/hook-state/resolv.conf/eth0.dhcp" dev="tmpfs" ino=503 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 82.535224][ T28] audit: type=1400 audit(1793190660.105:331): avc: denied { write } for pid=1865 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=493 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 85.113920][ T2020] netlink: 'syz.3.576': attribute type 4 has an invalid length. [ 85.121674][ T2020] netlink: 17 bytes leftover after parsing attributes in process `syz.3.576'. [ 86.109457][ T28] kauditd_printk_skb: 6 callbacks suppressed [ 86.109473][ T28] audit: type=1400 audit(1793190664.055:338): avc: denied { getopt } for pid=2046 comm="syz.0.594" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 87.170951][ T2090] device bridge1 entered promiscuous mode [ 87.193019][ T2092] netlink: 8 bytes leftover after parsing attributes in process `syz.4.611'. [ 87.229170][ T2100] netlink: 8 bytes leftover after parsing attributes in process `syz.0.614'. [ 87.242842][ T2100] netlink: 8 bytes leftover after parsing attributes in process `syz.0.614'. [ 87.849742][ T28] audit: type=1400 audit(1793190665.755:339): avc: denied { setopt } for pid=2115 comm="syz.0.620" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 88.563903][ T2124] netlink: 25 bytes leftover after parsing attributes in process `syz.3.622'. [ 89.158067][ T28] audit: type=1400 audit(1793190667.105:340): avc: denied { write } for pid=2144 comm="syz.1.631" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 90.294258][ T2161] netlink: 4 bytes leftover after parsing attributes in process `syz.4.636'. [ 90.527928][ T2172] device batadv_slave_0 entered promiscuous mode [ 91.136316][ T28] audit: type=1326 audit(1793190668.975:341): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2177 comm="syz.3.637" exe="/root/ci2-android-6-1/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fe603b9f559 code=0x0 [ 91.787845][ T28] audit: type=1326 audit(1793190669.735:342): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2208 comm="syz.4.655" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f06b4b9f559 code=0x7ffc0000 [ 91.876589][ T28] audit: type=1326 audit(1793190669.765:343): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2208 comm="syz.4.655" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f06b4b9f559 code=0x7ffc0000 [ 91.902359][ T28] audit: type=1326 audit(1793190669.765:344): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2208 comm="syz.4.655" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f06b4b9f559 code=0x7ffc0000 [ 91.927618][ T28] audit: type=1326 audit(1793190669.765:345): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2208 comm="syz.4.655" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f06b4b9f559 code=0x7ffc0000 [ 91.960760][ T28] audit: type=1326 audit(1793190669.765:346): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2208 comm="syz.4.655" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f06b4b9f559 code=0x7ffc0000 [ 92.010583][ T28] audit: type=1326 audit(1793190669.885:347): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2208 comm="syz.4.655" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f06b4b5fd8e code=0x7ffc0000 [ 92.061218][ T28] audit: type=1326 audit(1793190669.885:348): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2208 comm="syz.4.655" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f06b4b9f559 code=0x7ffc0000 [ 92.112133][ T28] audit: type=1326 audit(1793190669.885:349): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2208 comm="syz.4.655" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f06b4b9f559 code=0x7ffc0000 [ 92.162693][ T28] audit: type=1326 audit(1793190669.905:350): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2208 comm="syz.4.655" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f06b4b9f559 code=0x7ffc0000 [ 93.233025][ T2250] fuse: Bad value for 'fd' [ 94.049018][ T2279] netem: incorrect gi model size [ 94.059647][ T2279] netem: change failed [ 94.680618][ T2318] netlink: 4 bytes leftover after parsing attributes in process `syz.0.700'. [ 96.190294][ T2327] fuse: Bad value for 'fd' [ 97.255072][ T2336] 9pnet_fd: Insufficient options for proto=fd [ 97.889307][ T28] kauditd_printk_skb: 12 callbacks suppressed [ 97.889325][ T28] audit: type=1400 audit(1793190675.835:363): avc: denied { getopt } for pid=2366 comm="syz.3.720" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 97.954851][ T2369] netlink: 4 bytes leftover after parsing attributes in process `syz.1.721'. [ 98.000692][ T28] audit: type=1400 audit(1793190675.955:364): avc: denied { setopt } for pid=2370 comm="syz.3.722" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 98.738298][ T2407] syz.1.736 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 99.251767][ T2418] netlink: 4 bytes leftover after parsing attributes in process `syz.4.740'. [ 99.384966][ T2423] netlink: 16 bytes leftover after parsing attributes in process `syz.2.742'. [ 99.394692][ T2423] netlink: 16 bytes leftover after parsing attributes in process `syz.2.742'. [ 99.420614][ T2427] netlink: 4 bytes leftover after parsing attributes in process `syz.2.744'. [ 99.506170][ T2442] netlink: 4 bytes leftover after parsing attributes in process `syz.0.751'. [ 100.038695][ T2474] netlink: 4 bytes leftover after parsing attributes in process `syz.2.764'. [ 100.443452][ T2480] netlink: 12 bytes leftover after parsing attributes in process `syz.4.766'. [ 101.096883][ T28] audit: type=1326 audit(1793190679.045:365): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2503 comm="syz.1.776" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f102ed9f559 code=0x7ffc0000 [ 101.173174][ T28] audit: type=1326 audit(1793190679.075:366): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2503 comm="syz.1.776" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f102ed9f559 code=0x7ffc0000 [ 101.201667][ T28] audit: type=1326 audit(1793190679.085:367): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2503 comm="syz.1.776" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f102ed9f559 code=0x7ffc0000 [ 101.263764][ T28] audit: type=1326 audit(1793190679.085:368): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2503 comm="syz.1.776" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=53 compat=0 ip=0x7f102ed9f559 code=0x7ffc0000 [ 101.301294][ T28] audit: type=1326 audit(1793190679.085:369): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2503 comm="syz.1.776" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f102ed9f559 code=0x7ffc0000 [ 101.327133][ T28] audit: type=1326 audit(1793190679.085:370): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2503 comm="syz.1.776" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f102ed9f559 code=0x7ffc0000 [ 101.353702][ T28] audit: type=1326 audit(1793190679.085:371): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2503 comm="syz.1.776" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f102ed9f559 code=0x7ffc0000 [ 101.378965][ T28] audit: type=1326 audit(1793190679.085:372): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2503 comm="syz.1.776" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f102ed9f559 code=0x7ffc0000 [ 101.553059][ T2515] netlink: 4 bytes leftover after parsing attributes in process `syz.2.781'. [ 101.652233][ T2523] netlink: 25 bytes leftover after parsing attributes in process `syz.3.772'. [ 104.049726][ T2601] __nla_validate_parse: 1 callbacks suppressed [ 104.049742][ T2601] netlink: 4 bytes leftover after parsing attributes in process `syz.4.814'. [ 104.172154][ T2604] overlayfs: failed to clone upperpath [ 106.436595][ T28] kauditd_printk_skb: 182 callbacks suppressed [ 106.436611][ T28] audit: type=1400 audit(1793190684.385:555): avc: denied { connect } for pid=2695 comm="syz.0.852" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 107.363485][ T2781] tipc: Enabling of bearer rejected, failed to enable media [ 107.470993][ T2785] overlayfs: failed to clone lowerpath [ 107.582647][ T2793] overlayfs: failed to clone upperpath [ 107.867825][ T28] audit: type=1400 audit(1793190685.815:556): avc: denied { mount } for pid=2823 comm="syz.4.911" name="/" dev="securityfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 108.697700][ T2845] tipc: Enabling of bearer rejected, failed to enable media [ 110.348118][ T28] audit: type=1400 audit(1793190688.295:557): avc: denied { create } for pid=2882 comm="syz.0.925" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 110.373372][ T28] audit: type=1400 audit(1793190688.305:558): avc: denied { connect } for pid=2882 comm="syz.0.925" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 110.393365][ T28] audit: type=1400 audit(1793190688.305:559): avc: denied { ioctl } for pid=2882 comm="syz.0.925" path="socket:[22186]" dev="sockfs" ino=22186 ioctlcmd=0x7459 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 110.418393][ C1] ================================================================== [ 110.426584][ C1] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x6c/0xb0 [ 110.434033][ C1] Read of size 8 at addr ffff88813382b590 by task syz.0.932/2885 [ 110.441785][ C1] [ 110.444140][ C1] CPU: 1 PID: 2885 Comm: syz.0.932 Not tainted syzkaller #0 [ 110.451458][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 110.461561][ C1] Call Trace: [ 110.464869][ C1] [ 110.467762][ C1] __dump_stack+0x21/0x24 [ 110.472131][ C1] dump_stack_lvl+0x110/0x170 [ 110.476900][ C1] ? __cfi_dump_stack_lvl+0x8/0x8 [ 110.482000][ C1] ? debug_smp_processor_id+0x17/0x20 [ 110.487434][ C1] ? rcu_cblist_dequeue+0x6c/0xb0 [ 110.492493][ C1] print_address_description+0x71/0x200 [ 110.498084][ C1] print_report+0x4a/0x60 [ 110.502455][ C1] kasan_report+0x122/0x150 [ 110.507033][ C1] ? rcu_cblist_dequeue+0x6c/0xb0 [ 110.512111][ C1] __asan_report_load8_noabort+0x14/0x20 [ 110.517778][ C1] rcu_cblist_dequeue+0x6c/0xb0 [ 110.522662][ C1] rcu_do_batch+0x4bc/0xc30 [ 110.527354][ C1] ? rcu_core+0xf00/0xf00 [ 110.531736][ C1] ? swake_up_one_online+0x66/0x110 [ 110.536982][ C1] ? rcu_report_qs_rnp+0x37b/0x390 [ 110.542224][ C1] rcu_core+0x486/0xf00 [ 110.546419][ C1] ? rcu_cpu_kthread_park+0x90/0x90 [ 110.551684][ C1] rcu_core_si+0x9/0x10 [ 110.555890][ C1] handle_softirqs+0x1dd/0x5f0 [ 110.560775][ C1] __do_softirq+0xb/0xd [ 110.564971][ C1] do_softirq+0xdc/0x130 [ 110.569255][ C1] [ 110.572209][ C1] [ 110.575342][ C1] ? __cfi_do_softirq+0x10/0x10 [ 110.580227][ C1] ? _raw_spin_lock_bh+0x94/0xf0 [ 110.585191][ C1] ? __cfi__raw_spin_lock_bh+0x10/0x10 [ 110.590718][ C1] __local_bh_enable_ip+0x75/0x80 [ 110.595805][ C1] _raw_spin_unlock_bh+0x50/0x60 [ 110.600805][ C1] lock_sock_nested+0x212/0x290 [ 110.605720][ C1] ? __cfi_lock_sock_nested+0x10/0x10 [ 110.611177][ C1] netlink_insert+0xbf/0xe10 [ 110.615811][ C1] ? selinux_socket_getpeersec_dgram+0x237/0x320 [ 110.622177][ C1] ? netlink_data_ready+0x10/0x10 [ 110.627240][ C1] ? __netlink_lookup+0x387/0x3b0 [ 110.632334][ C1] netlink_autobind+0xd4/0x1a0 [ 110.637141][ C1] netlink_sendmsg+0x4fc/0xbd0 [ 110.641943][ C1] ? __cfi_netlink_sendmsg+0x10/0x10 [ 110.647276][ C1] ? security_socket_sendmsg+0x93/0xb0 [ 110.652775][ C1] ? __cfi_netlink_sendmsg+0x10/0x10 [ 110.658113][ C1] ____sys_sendmsg+0x5fb/0x9c0 [ 110.662912][ C1] ? __sys_sendmsg_sock+0x40/0x40 [ 110.667968][ C1] ? import_iovec+0x7c/0xb0 [ 110.672513][ C1] ___sys_sendmsg+0x2a2/0x360 [ 110.677219][ C1] ? __sys_sendmsg+0x290/0x290 [ 110.682006][ C1] ? security_file_alloc+0x33/0x130 [ 110.687311][ C1] ? percpu_counter_add_batch+0x13c/0x160 [ 110.693060][ C1] ? __fdget+0x19c/0x220 [ 110.697337][ C1] __x64_sys_sendmsg+0x20d/0x2e0 [ 110.702304][ C1] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 110.707796][ C1] ? __kasan_check_write+0x14/0x20 [ 110.712943][ C1] ? fpregs_restore_userregs+0x128/0x260 [ 110.718611][ C1] ? switch_fpu_return+0xe/0x10 [ 110.723496][ C1] x64_sys_call+0x171/0x9a0 [ 110.728034][ C1] do_syscall_64+0x4c/0xa0 [ 110.732481][ C1] ? clear_bhb_loop+0x30/0x80 [ 110.737189][ C1] ? clear_bhb_loop+0x30/0x80 [ 110.741919][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 110.747881][ C1] RIP: 0033:0x7f487e79f559 [ 110.752338][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 110.771984][ C1] RSP: 002b:00007f487f654028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 110.780407][ C1] RAX: ffffffffffffffda RBX: 00007f487ea25fa0 RCX: 00007f487e79f559 [ 110.788390][ C1] RDX: 0000000004000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 110.796376][ C1] RBP: 00007f487e836b20 R08: 0000000000000000 R09: 0000000000000000 [ 110.804358][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 110.812364][ C1] R13: 00007f487ea26038 R14: 00007f487ea25fa0 R15: 00007ffe5e217208 [ 110.820386][ C1] [ 110.823446][ C1] [ 110.825770][ C1] Allocated by task 2883: [ 110.830092][ C1] kasan_set_track+0x4b/0x70 [ 110.834689][ C1] kasan_save_alloc_info+0x1f/0x30 [ 110.839810][ C1] __kasan_kmalloc+0x95/0xb0 [ 110.844441][ C1] __kmalloc+0xb4/0x1e0 [ 110.848594][ C1] l2tp_session_create+0x38/0xbd0 [ 110.853645][ C1] pppol2tp_connect+0xbf5/0x1640 [ 110.858626][ C1] __sys_connect+0x3da/0x460 [ 110.863227][ C1] __x64_sys_connect+0x7a/0x90 [ 110.868026][ C1] x64_sys_call+0x88d/0x9a0 [ 110.872533][ C1] do_syscall_64+0x4c/0xa0 [ 110.876952][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 110.882850][ C1] [ 110.885169][ C1] Freed by task 2872: [ 110.889141][ C1] kasan_set_track+0x4b/0x70 [ 110.893731][ C1] kasan_save_free_info+0x2b/0x40 [ 110.898772][ C1] ____kasan_slab_free+0x132/0x180 [ 110.903891][ C1] __kasan_slab_free+0x11/0x20 [ 110.908686][ C1] slab_free_freelist_hook+0xc2/0x190 [ 110.914069][ C1] __kmem_cache_free+0xb7/0x1b0 [ 110.918928][ C1] kfree+0x6f/0xf0 [ 110.922654][ C1] l2tp_session_put+0xaf/0x1a0 [ 110.927456][ C1] l2tp_session_delete+0x3df/0x4d0 [ 110.932597][ C1] l2tp_tunnel_del_work+0x199/0x410 [ 110.937819][ C1] process_one_work+0x717/0xc30 [ 110.942701][ C1] worker_thread+0xa4d/0x11d0 [ 110.947394][ C1] kthread+0x281/0x320 [ 110.951467][ C1] ret_from_fork+0x1f/0x30 [ 110.955895][ C1] [ 110.958408][ C1] Last potentially related work creation: [ 110.964117][ C1] kasan_save_stack+0x3a/0x60 [ 110.968802][ C1] __kasan_record_aux_stack+0xb6/0xc0 [ 110.974275][ C1] kasan_record_aux_stack_noalloc+0xb/0x10 [ 110.980098][ C1] call_rcu+0xcf/0xf50 [ 110.984193][ C1] pppol2tp_release+0x1e3/0x2b0 [ 110.989057][ C1] sock_close+0xc9/0x220 [ 110.993341][ C1] __fput+0x1fd/0x8f0 [ 110.997373][ C1] ____fput+0x15/0x20 [ 111.001390][ C1] task_work_run+0x1e1/0x250 [ 111.006013][ C1] exit_to_user_mode_loop+0x9b/0xb0 [ 111.011281][ C1] exit_to_user_mode_prepare+0x87/0xd0 [ 111.016782][ C1] syscall_exit_to_user_mode+0x1a/0x30 [ 111.022272][ C1] do_syscall_64+0x58/0xa0 [ 111.026689][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 111.032614][ C1] [ 111.034936][ C1] The buggy address belongs to the object at ffff88813382b400 [ 111.034936][ C1] which belongs to the cache kmalloc-512 of size 512 [ 111.049018][ C1] The buggy address is located 400 bytes inside of [ 111.049018][ C1] 512-byte region [ffff88813382b400, ffff88813382b600) [ 111.062322][ C1] [ 111.064648][ C1] The buggy address belongs to the physical page: [ 111.071168][ C1] page:ffffea0004ce0a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x133828 [ 111.081441][ C1] head:ffffea0004ce0a00 order:2 compound_mapcount:0 compound_pincount:0 [ 111.089782][ C1] flags: 0x4000000000010200(slab|head|zone=1) [ 111.095879][ C1] raw: 4000000000010200 ffffea0004d23e00 dead000000000002 ffff888100042f00 [ 111.104483][ C1] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 111.113067][ C1] page dumped because: kasan: bad access detected [ 111.119491][ C1] page_owner tracks the page as allocated [ 111.125249][ C1] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 19, tgid 19 (kworker/0:1), ts 35453225128, free_ts 35420113195 [ 111.146963][ C1] post_alloc_hook+0x1f5/0x210 [ 111.151744][ C1] prep_new_page+0x1c/0x110 [ 111.156258][ C1] get_page_from_freelist+0x2ca9/0x2d20 [ 111.161815][ C1] __alloc_pages+0x1fa/0x610 [ 111.166420][ C1] alloc_slab_page+0x6e/0xf0 [ 111.171013][ C1] new_slab+0x98/0x3e0 [ 111.175112][ C1] ___slab_alloc+0x70f/0xb70 [ 111.179785][ C1] __slab_alloc+0x5e/0xa0 [ 111.184131][ C1] __kmem_cache_alloc_node+0x204/0x2d0 [ 111.189624][ C1] __kmalloc_node_track_caller+0xa1/0x1e0 [ 111.195365][ C1] __alloc_skb+0x226/0x4a0 [ 111.199793][ C1] __ipv6_ifa_notify+0x200/0xe80 [ 111.204738][ C1] addrconf_dad_completed+0x192/0xe80 [ 111.210130][ C1] addrconf_dad_work+0xc1b/0x14a0 [ 111.215194][ C1] process_one_work+0x717/0xc30 [ 111.220075][ C1] worker_thread+0xa4d/0x11d0 [ 111.224776][ C1] page last free stack trace: [ 111.229449][ C1] free_unref_page_prepare+0x81b/0x820 [ 111.234917][ C1] free_unref_page+0x93/0x530 [ 111.239607][ C1] __free_pages+0x67/0x100 [ 111.244070][ C1] free_pages+0x82/0x90 [ 111.248242][ C1] __stack_depot_save+0x45f/0x490 [ 111.253364][ C1] kasan_set_track+0x60/0x70 [ 111.257992][ C1] kasan_save_free_info+0x2b/0x40 [ 111.263027][ C1] ____kasan_slab_free+0x132/0x180 [ 111.268161][ C1] __kasan_slab_free+0x11/0x20 [ 111.272938][ C1] slab_free_freelist_hook+0xc2/0x190 [ 111.278329][ C1] __kmem_cache_free+0xb7/0x1b0 [ 111.283186][ C1] kfree+0x6f/0xf0 [ 111.286905][ C1] selinux_sk_free_security+0x42/0x50 [ 111.292312][ C1] security_sk_free+0x56/0x90 [ 111.296997][ C1] __sk_destruct+0x495/0x5e0 [ 111.301613][ C1] __sk_free+0x30a/0x400 [ 111.305866][ C1] [ 111.308186][ C1] Memory state around the buggy address: [ 111.313950][ C1] ffff88813382b480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 111.322143][ C1] ffff88813382b500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 111.330369][ C1] >ffff88813382b580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 111.338455][ C1] ^ [ 111.343092][ C1] ffff88813382b600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 111.351339][ C1] ffff88813382b680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 111.359506][ C1] ================================================================== [ 111.367774][ C1] Disabling lock debugging due to kernel taint [ 111.375377][ T28] audit: type=1400 audit(1793190689.325:560): avc: denied { read } for pid=84 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 111.409264][ T28] audit: type=1400 audit(1793190689.345:561): avc: denied { search } for pid=84 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 111.430854][ T28] audit: type=1400 audit(1793190689.345:562): avc: denied { write } for pid=84 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 111.452296][ T28] audit: type=1400 audit(1793190689.345:563): avc: denied { add_name } for pid=84 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 111.472900][ T28] audit: type=1400 audit(1793190689.345:564): avc: denied { create } for pid=84 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 111.493555][ T28] audit: type=1400 audit(1793190689.345:565): avc: denied { append open } for pid=84 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 111.516519][ T28] audit: type=1400 audit(1793190689.345:566): avc: denied { getattr } for pid=84 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1