last executing test programs: 389.61742ms ago: executing program 1 (id=6): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x8ab43, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000640)={0x79}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) close(0x4) close(0x5) 268.914953ms ago: executing program 3 (id=4): mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000300)='./file0/../file0\x00', 0x0, 0x2151090, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000040)='./file0\x00', &(0x7f0000000180)='./file0/../file0\x00', 0x0, 0x8b501a, 0x0) mount$bind(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) umount2(&(0x7f0000000000)='./file0\x00', 0x0) 221.002454ms ago: executing program 2 (id=3): bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180200000800000000000000000000001801000000646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000800000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b000000000000000000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000700850000002d"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 200.788705ms ago: executing program 1 (id=7): r0 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x9, 0x2, 0x56d, 0x8000, 0x0, 0xffffffffffffffff, 0x2}, 0x50) 189.068535ms ago: executing program 3 (id=8): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0) 188.920505ms ago: executing program 4 (id=5): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000300)='cgroup2\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000000c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5) r1 = openat$cgroup_ro(r0, &(0x7f0000000040)='cpu.stat\x00', 0x0, 0x0) read$FUSE(r1, &(0x7f0000000340)={0x2020}, 0x2020) 180.612065ms ago: executing program 0 (id=1): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000500)={0x2c, &(0x7f00000001c0)={0x40, 0x22, 0x2, {0x2, 0x30}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000080)='./bus\x00', 0x4000, &(0x7f00000002c0)={[{@sysvgroups}, {@auto_da_alloc_val={'auto_da_alloc', 0x3d, 0x46}}]}, 0x21, 0x4bd, &(0x7f0000000b80)="$eJzs3c9vVFsdAPDvvf1JKbQoCzUqiCgawkw7QENY4UZjCImRuHIBtR2apjOdpjNFWlmU/8FEElf6J7gwcWHCyr073bnBhQkq0Udf8hbzcu9MS1+Zgb7QN0M6n09ycu+5p8z3nLm55wxf6JwABtb5iNiOiNGIuB8RU+3rSbvErVbJfu7Vy8cLOy8fLyTRbN79T5K3Z9di35/JnGy/5nhE/PRHEb9I3oxb39xama9UyuvterFRXSvWN7euLFfnl8pL5dVSaW52bubG1eulIxvrueofXvxw+fbP/vynbzz/6/b3f5V1a7Ldtn8cR6k19JG9OJnhiLj9RQTrg6H2eEYPXO9wy/kApRHxpYi4kD//UzGU300A4DhrNqeiObW/DgAcd2meA0vSQjsXMBlpWii0cnhnYyKt1OqNyw9qG6uLrVzZdIykD5Yr5Zl2rnA6RpKsPpufv66XDtSvRsSZiPj12Im8XlioVRb7+cEHAAbYyQPr///HWus/AHDMjfe7AwBAz1n/AWDwWP8BYPBY/wFg8Fj/AWDwWP8BYPBY/wFgoPzkzp2sNHfa33+9+HBzY6X28Mpiub5SqG4sFBZq62uFpVptKf/Onuq7Xq9Sq63NXouNR8VGud4o1je37lVrG6uNe/n3et8rj/RkVADA25w59+zvSURs3zyRl9i3l4O1Go63tN8dAPpmqN8dAPrGbl8wuPwdH3jXfq1d/4vQ06PvC9Abl74q/w+DSv4fBpf8Pwwu+X8YXM1mYs9/ABgwcvyAf/8HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAz28yL0laaO8FPhlpWihEnIqI6RhJHixXyjMRcToi/jY2MpbVZ/vdaQDgPaX/SuKj9jaAFycPto4mH4/lx4j45W/v/ubRfKOxPptd/+/e9cbT9vVSzzsPABzC7jq9u47vevXy8cJu6WV/XvygtbloFnenXVotwzGcH8cj+3Ay8b+kXW9JImLoCOJvP4mIr3Qaf5LnRqbbO58ejJ/FPtXT+Oln4qd5W+uYvRdfPoK+wKB5ls0/tzo9f2mcz4+dn//xfIZ6f7vz384b81+6N/8NdZn/zh82xrW//Hi0W9uTiK8Nd4qf7MVPusS/eMj4//j6Ny90a2v+LuJSdI6/P1axUV0r1je3rixX55fKS+XVUmludm7mxtXrpWKeoy7uZqrf9O+bl093i5+Nf6JL/PzO35nsOv7vHHL8v//k/s+/9Zb43/t25/t/Nj92fv+zNfG7h4w/P/HHrtt3Z/EXu4z/Xff/8iHjP//n1uIhfxQA6IH65tbKfKVSXnfiZO9k95Peh9Kf7ifNqVZPP5T+HJ+Tfs5KQC+8fuj73RMAAAAAAAAAAAAAAKCbXvw6Ub/HCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwPH1aQAAAP//sHnUnw==") bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0xffffff75, &(0x7f00000002c0)="b9425b44651dd23241963599000000110000004a16941ff5f4b4f1f0add7fcf2b877fceafffffffffff1ffdf4cd9f5d3969890522c77157d88010000003a5bd5531d459dffff03000000000091ff000000e8f5b3371da3635b8b4fa637135800001f65e4b436aa9e50bc0f19b7d3372ff9ebcede1fb5e9428f54d5d1f0cc752cf246a5d2da34a5aa97dc14a469c3dd3e26b41c356484e46fd66e3f2c7807e8773eed7b94fa099ab84feadec2ea95f65bba452eae5b0900f98a979a88c517a2dc360a00237723e2f467af706ea17226296b3a10a351cb47aba2c6b836c90679b4dd859ddc9e4800448aab0000000000000d75f34bb50d8d7084") 162.576326ms ago: executing program 2 (id=9): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0xb, &(0x7f0000000000)=0xfffffffd, 0x4) sendto$inet(r0, 0x0, 0xffef, 0x20000000, &(0x7f0000000240)={0x2, 0x4e22, @remote}, 0x10) recvfrom$inet(r0, 0x0, 0x0, 0x2042, 0x0, 0x0) ioctl$SIOCGSTAMP(r0, 0x8906, 0x0) ioctl$SIOCGSTAMP(r0, 0x8906, &(0x7f0000000040)) 129.273696ms ago: executing program 4 (id=10): r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r1) getsockname$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="500000001000370427bd70000000000000000000", @ANYRES32=r2, @ANYBLOB="6105050000000000300012800b00010067726574617000002000028008000700ac1414aa04001a00050013000000000005000a0000000000b2e2cf802cfbc365641d983700451d3bfd93"], 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmmsg(r0, &(0x7f0000000340)=[{{&(0x7f00000002c0)=@xdp={0x2c, 0xa888, r2, 0x7, 0x2000000}, 0x14, 0x0}}], 0x1, 0x80) 129.116327ms ago: executing program 1 (id=11): r0 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000400)={{0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x8}, 0x809}, {0xa, 0x8, 0x0, @empty}, 0x2, {[0x0, 0x1, 0xfffffffe, 0x0, 0xffffffff, 0x8, 0x40]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000280)={{0xa, 0x0, 0x3, @private0}, {0xa, 0x0, 0x0, @mcast2}, 0x0, {[0x1, 0x0, 0xfffffffa, 0x0, 0x800, 0x6]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f00000001c0)={{0xa, 0x0, 0x0, @local}, {0xa, 0x4e22, 0x800, @empty}, 0x0, {[0x0, 0x8000, 0x0, 0xfffffffc]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}, {0xa, 0x0, 0x4, @empty}, 0x0, {[0x3, 0x0, 0x0, 0x1, 0x89f, 0x8, 0x1]}}, 0x5c) setsockopt$MRT6_FLUSH(r0, 0x29, 0xd4, &(0x7f0000000340)=0x6, 0x4) 118.415067ms ago: executing program 2 (id=12): r0 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setgroups(0x0, 0x0) setregid(0xffffffffffffffff, r1) syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f0000000040)='./file1\x00', 0x21081e, &(0x7f0000000480)={[{@grpquota}, {@bsdgroups}, {@quota}]}, 0x1, 0x506, &(0x7f0000001d00)="$eJzs3c9vI1cdAPCvnThxsmmTlh4AQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZE/gHNP3LkguHFZDkj8iEAbJA5TzXiS9WbtTbRJ7Cj+fKTRzJvnne97a817mW9ivwBG1s2I2I+IiYj4MCJm8/OFfIv3Olv6ukcHD1YODx6sFCJJPvhXIatPz0XXv0ndyK9ZjogffS/ip4Wn47Z29zaW6/Xadl6ebze25lu7e3fWG8trtbXaZrW6tLi08M7dt6sX1tfXGhP50Vcf/nH/Wz9PmzWTn+nux0XqdL10HCc1HhE/uIxgQzCW92di2A3huRQj4uWIeD27/2djLHs3AYDrLElmI5ntLgMA110xy4EVipU8FzATxWKl0snhvRLTxXqz1b59v7mzudrJlc1FqXh/vV5byHOFc1EqpOXF7PhxuXqifDciXoqIX05OZeXKSrO+OswffABghN04Mf//d7Iz/wMA11x52A0AAAbO/A8Ao8f8DwCjx/wPAKOnM/9PDbsZAMAAef4HgNFj/geAkfLD999Pt+Qw//7r1Y92dzaaH91ZrbU2Ko2dlcpKc3urstZsrmXf2dM47Xr1ZnNr8a3Y+Xju21ut9nxrd+9eo7mz2b6Xfa/3vVope9X+AHoGAPTz0muf/aWQzsjvTmVbdK3lUBpqy4DLVhx2A4ChGRt2A4ChsdoXjK5zPONLD8A10WOJ3ieUe31AKEmS5PKaBFyyW1+S/4dR1ZX/91fAMGLk/2F0yf/D6EqSwlnX/I+zvhAAuNrk+IE+v/9/Od//Lv/lwE9WT77i09Ov7TMGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXFdH6/9W8nU6ZqJYrFQiXoiIuSgV7q/XawsR8WJE/HmyNJmWF4fcZgDgvIp/L+Trf92afXPmiapXbxwfTkTEz379wa8+Xm63t/8UMVH49+TR+fan+fnq4FsPAJzuaJ7O9l0P8o8OHqwcbYNszz++GxHlTvzDg4k4PI4/HuPZvhyliJj+TyEvdxS6chfnsf9JRHyxV/8LMZPlQDorn56Mn8Z+YaDxi0/EL2Z1nX36f/GFC2gLjJrP0vHnvV73XzFuZvve9385G6HOLx//0kutHGZj4OP4R+PfWJ/x7+ZZY7z1h+93jqaervsk4svjEUexD7vGn6P4hT7x3zxj/L9+5dXX+9Ulv4m4Fb3jd8eabze25lu7e3fWG8trtbXaZrW6tLi08M7dt6vzWY56vjMbJD0mhX++e/vFfvHT/k/3iV8+pf9fP2P/f/v/D3/8tWfE/+YbveIX45VnxE+fzL9xxvjL078v96tL46/26f9p7//tM8RO56eHf9t7atlwAGB4Wrt7G8v1em37Gh+kP6tcgWY4OP9BXOG38juDijURvat+8Ubnnj5RlSTPFavfiHERWTfgKji+6SPif8NuDAAAAAAAAAAAAAAA0NMgPrE07D4CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwfX0eAAD//yjlzow=") openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x800c4, 0x0) 104.263457ms ago: executing program 3 (id=13): pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$can_bcm(0x1d, 0x2, 0x2) write$cgroup_subtree(r1, &(0x7f0000000240)=ANY=[], 0x48) splice(r0, 0x0, r2, 0x0, 0x3000, 0x100000000000000d) 82.713468ms ago: executing program 1 (id=14): r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_int(r0, 0x29, 0x19, &(0x7f0000000000)=0x84, 0xfde1) sendto$inet6(r0, 0x0, 0x0, 0x200cc0c5, &(0x7f0000000080)={0xa, 0x4c20, 0x0, @mcast2}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0xc5, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) sendto$inet6(r0, &(0x7f0000001cc0)="2501d77b330b7e73d6b1d1b8a473ff7420b4b43ce0861f000000714fa228ee1f5b48", 0xfffffffffffffe57, 0x8000, 0x0, 0x0) recvmmsg(r0, &(0x7f0000002480)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40002003, 0x0) 82.407978ms ago: executing program 4 (id=15): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f0000000200)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000300)='1', 0x1}], 0x1, 0x0, 0x0, 0x40044}}], 0x1, 0x4) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r0, 0x1, 0x10, &(0x7f00000002c0)=0x8001, 0x4) write$binfmt_elf64(r1, &(0x7f0000000500)=ANY=[], 0x78) splice(r0, 0x0, r2, 0x0, 0x39000, 0x0) 61.293698ms ago: executing program 1 (id=16): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x4}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0xf, "0000000000000000000100000e00"}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='net/arp\x00') sendmmsg$inet(r0, &(0x7f0000005200)=[{{0x0, 0x4b, &(0x7f0000000000), 0x1}}], 0x1, 0x0) 54.083878ms ago: executing program 3 (id=17): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) listen(r1, 0x0) accept4(r1, 0x0, 0x0, 0x0) 18.382629ms ago: executing program 4 (id=18): r0 = creat(&(0x7f0000000080)='./file0\x00', 0xc7) close(r0) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r1, &(0x7f0000000c80)={&(0x7f0000000980)=@id, 0x10, 0x0}, 0x0) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0x4440, &(0x7f0000000700)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 0s ago: executing program 1 (id=19): bpf$ENABLE_STATS(0x20, 0x0, 0x0) syz_emit_ethernet(0x4a, 0x0, 0x0) syz_open_dev$loop(0x0, 0xb, 0x325967a866143452) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f0000000440)=[{0x20, 0x2, 0x81, 0xfffff034}, {0x20, 0x0, 0x7, 0x80000000}, {0x6, 0x0, 0x4}]}, 0x10) syz_emit_ethernet(0x3e, &(0x7f0000000500)=ANY=[@ANYBLOB="aaaaaaaaaaf7ffffffffffff080045000030ac1e0001ac"], 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.38' (ED25519) to the list of known hosts. [ 21.954162][ T28] audit: type=1400 audit(1785548567.201:64): avc: denied { mounton } for pid=278 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.976850][ T28] audit: type=1400 audit(1785548567.201:65): avc: denied { mount } for pid=278 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.977854][ T278] cgroup: Unknown subsys name 'net' [ 22.004621][ T28] audit: type=1400 audit(1785548567.251:66): avc: denied { unmount } for pid=278 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.005132][ T278] cgroup: Unknown subsys name 'devices' [ 22.148878][ T278] cgroup: Unknown subsys name 'hugetlb' [ 22.154510][ T278] cgroup: Unknown subsys name 'rlimit' [ 22.259694][ T28] audit: type=1400 audit(1785548567.511:67): avc: denied { setattr } for pid=278 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.282910][ T28] audit: type=1400 audit(1785548567.511:68): avc: denied { mounton } for pid=278 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.307789][ T28] audit: type=1400 audit(1785548567.511:69): avc: denied { mount } for pid=278 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.324062][ T280] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 22.339744][ T28] audit: type=1400 audit(1785548567.591:70): avc: denied { relabelto } for pid=280 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.365168][ T28] audit: type=1400 audit(1785548567.591:71): avc: denied { write } for pid=280 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.391650][ T278] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.391689][ T28] audit: type=1400 audit(1785548567.641:72): avc: denied { read } for pid=278 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.425947][ T28] audit: type=1400 audit(1785548567.641:73): avc: denied { open } for pid=278 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.123172][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.130317][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.138018][ T286] device bridge_slave_0 entered promiscuous mode [ 23.145169][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.152245][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.159807][ T286] device bridge_slave_1 entered promiscuous mode [ 23.257509][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.264593][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.272125][ T287] device bridge_slave_0 entered promiscuous mode [ 23.313187][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.320326][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.327848][ T287] device bridge_slave_1 entered promiscuous mode [ 23.355738][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.362830][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.370516][ T288] device bridge_slave_0 entered promiscuous mode [ 23.384009][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.391084][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.398398][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.405437][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.417598][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.424719][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.432236][ T288] device bridge_slave_1 entered promiscuous mode [ 23.453520][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.460714][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.468235][ T291] device bridge_slave_0 entered promiscuous mode [ 23.477506][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.484563][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.492106][ T291] device bridge_slave_1 entered promiscuous mode [ 23.597503][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.604651][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.612413][ T290] device bridge_slave_0 entered promiscuous mode [ 23.621687][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.629025][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.636467][ T290] device bridge_slave_1 entered promiscuous mode [ 23.715984][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.723096][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.730438][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.737496][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.755609][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.762712][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.770016][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.777081][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.794880][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.802368][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.809922][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.817714][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.825189][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.832735][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.841258][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.848819][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.883318][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.891877][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.898957][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.930001][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.938111][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.946366][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.953442][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.961367][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.969776][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.976872][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.986684][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.994744][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.022026][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.030268][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.038573][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.045611][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.053313][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.061654][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.068761][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.076203][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.084496][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.091559][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.099159][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.107217][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.115946][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.134638][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.142294][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.149896][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.159166][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.167425][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.174450][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.181935][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.190662][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.199054][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.206090][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.213518][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.221865][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.232925][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.240947][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.257337][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.264875][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.272448][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.280626][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.288859][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.297131][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.320748][ T287] device veth0_vlan entered promiscuous mode [ 24.327183][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.335346][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.343508][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.352048][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.360324][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.368765][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.377275][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.385112][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.393239][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.400782][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.410521][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.418955][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.432389][ T291] device veth0_vlan entered promiscuous mode [ 24.440139][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.447891][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.455428][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.464121][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.482385][ T286] device veth0_vlan entered promiscuous mode [ 24.494610][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.503032][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.511480][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.518576][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.526403][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.534822][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.543011][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.550093][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.557760][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.565614][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.573937][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.582104][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.590377][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.598199][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.605660][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.614867][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.623129][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.635353][ T290] device veth0_vlan entered promiscuous mode [ 24.642863][ T287] device veth1_macvtap entered promiscuous mode [ 24.653493][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.661617][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.669307][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.677003][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.684665][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.693034][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.701424][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.709735][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.718248][ T286] device veth1_macvtap entered promiscuous mode [ 24.739096][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.746894][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.755108][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.763687][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.772757][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.781261][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.789574][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.799713][ T291] device veth1_macvtap entered promiscuous mode [ 24.809762][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.817640][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.826036][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.836718][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.845029][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.853779][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.862177][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.881193][ T287] request_module fs-gadgetfs succeeded, but still no fs? [ 24.896717][ T288] device veth0_vlan entered promiscuous mode [ 24.910672][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.919475][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.928226][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.937196][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.945547][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.954278][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.963010][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.979541][ T290] device veth1_macvtap entered promiscuous mode [ 24.986508][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.998003][ T313] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.013824][ T288] device veth1_macvtap entered promiscuous mode [ 25.035862][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.044257][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.052720][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.061195][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.069866][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.084507][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.098767][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.113579][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.122163][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.255151][ T335] loop2: detected capacity change from 0 to 512 [ 25.324030][ T335] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 25.333750][ T335] ext4 filesystem being mounted at /2/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 25.362879][ T353] ======================================================= [ 25.362879][ T353] WARNING: The mand mount option has been deprecated and [ 25.362879][ T353] and is ignored by this kernel. Remove the mand [ 25.362879][ T353] option from the mount to silence this warning. [ 25.362879][ T353] ======================================================= [ 25.401643][ T330] ================================================================== [ 25.409751][ T330] BUG: KASAN: use-after-free in pppol2tp_sock_to_session+0x1a0/0x1b0 [ 25.417862][ T330] Read of size 4 at addr ffff888112489c00 by task syz.3.8/330 [ 25.425344][ T330] [ 25.427713][ T330] CPU: 0 PID: 330 Comm: syz.3.8 Not tainted syzkaller #0 [ 25.434768][ T330] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 25.444853][ T330] Call Trace: [ 25.448141][ T330] [ 25.451089][ T330] __dump_stack+0x21/0x24 [ 25.455423][ T330] dump_stack_lvl+0x110/0x170 [ 25.460099][ T330] ? __cfi_dump_stack_lvl+0x8/0x8 [ 25.465133][ T330] ? _raw_spin_lock_bh+0x94/0xf0 [ 25.470091][ T330] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 25.475810][ T330] print_address_description+0x71/0x200 [ 25.481367][ T330] print_report+0x4a/0x60 [ 25.485708][ T330] kasan_report+0x122/0x150 [ 25.490211][ T330] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 25.495950][ T330] __asan_report_load4_noabort+0x14/0x20 [ 25.501588][ T330] pppol2tp_sock_to_session+0x1a0/0x1b0 [ 25.507177][ T330] pppol2tp_release+0x150/0x2b0 [ 25.512051][ T330] sock_close+0xc9/0x220 [ 25.516310][ T330] ? __cfi_sock_close+0x10/0x10 [ 25.521184][ T330] __fput+0x1fd/0x8f0 [ 25.525181][ T330] ____fput+0x15/0x20 [ 25.529191][ T330] task_work_run+0x1e1/0x250 [ 25.533805][ T330] ? __cfi_task_work_run+0x10/0x10 [ 25.538942][ T330] ? free_nsproxy+0x21f/0x270 [ 25.543663][ T330] do_exit+0xaf2/0x2850 [ 25.547828][ T330] ? __cfi_do_exit+0x10/0x10 [ 25.552433][ T330] ? xfd_validate_state+0x70/0x150 [ 25.557551][ T330] ? __kasan_check_write+0x14/0x20 [ 25.562697][ T330] __x64_sys_exit+0x40/0x40 [ 25.567216][ T330] x64_sys_call+0x67/0x9a0 [ 25.571679][ T330] do_syscall_64+0x4c/0xa0 [ 25.576103][ T330] ? clear_bhb_loop+0x30/0x80 [ 25.580775][ T330] ? clear_bhb_loop+0x30/0x80 [ 25.585451][ T330] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 25.591397][ T330] RIP: 0033:0x7f37fc99e019 [ 25.595825][ T330] Code: Unable to access opcode bytes at 0x7f37fc99dfef. [ 25.602840][ T330] RSP: 002b:00007f37fb3f6ef8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 25.611273][ T330] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007f37fc99e019 [ 25.619262][ T330] RDX: 00007f37fb3f79c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 25.627342][ T330] RBP: 00007f37fca3500c R08: 0000000000000000 R09: 0000000000000058 [ 25.635318][ T330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 25.643292][ T330] R13: 00007f37fcc26038 R14: 00007f37fcc25fa0 R15: 00007ffd340dee68 [ 25.651288][ T330] [ 25.654302][ T330] [ 25.656618][ T330] Allocated by task 327: [ 25.660863][ T330] kasan_set_track+0x4b/0x70 [ 25.665459][ T330] kasan_save_alloc_info+0x1f/0x30 [ 25.670575][ T330] __kasan_kmalloc+0x95/0xb0 [ 25.675175][ T330] __kmalloc+0xb4/0x1e0 [ 25.679362][ T330] l2tp_session_create+0x38/0xbd0 [ 25.684391][ T330] pppol2tp_connect+0xbf5/0x1640 [ 25.689392][ T330] __sys_connect+0x3da/0x460 [ 25.694008][ T330] __x64_sys_connect+0x7a/0x90 [ 25.698803][ T330] x64_sys_call+0x88d/0x9a0 [ 25.703329][ T330] do_syscall_64+0x4c/0xa0 [ 25.707749][ T330] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 25.713647][ T330] [ 25.715996][ T330] Freed by task 8: [ 25.719729][ T330] kasan_set_track+0x4b/0x70 [ 25.724326][ T330] kasan_save_free_info+0x2b/0x40 [ 25.729363][ T330] ____kasan_slab_free+0x132/0x180 [ 25.734513][ T330] __kasan_slab_free+0x11/0x20 [ 25.739310][ T330] slab_free_freelist_hook+0xc2/0x190 [ 25.744753][ T330] __kmem_cache_free+0xb7/0x1b0 [ 25.749630][ T330] kfree+0x6f/0xf0 [ 25.753373][ T330] l2tp_session_put+0xaf/0x1a0 [ 25.758141][ T330] l2tp_session_delete+0x3df/0x4d0 [ 25.763252][ T330] l2tp_tunnel_del_work+0x199/0x410 [ 25.768464][ T330] process_one_work+0x717/0xc30 [ 25.773392][ T330] worker_thread+0xa4d/0x11d0 [ 25.778080][ T330] kthread+0x281/0x320 [ 25.782154][ T330] ret_from_fork+0x1f/0x30 [ 25.786571][ T330] [ 25.788905][ T330] The buggy address belongs to the object at ffff888112489c00 [ 25.788905][ T330] which belongs to the cache kmalloc-512 of size 512 [ 25.802956][ T330] The buggy address is located 0 bytes inside of [ 25.802956][ T330] 512-byte region [ffff888112489c00, ffff888112489e00) [ 25.816056][ T330] [ 25.818383][ T330] The buggy address belongs to the physical page: [ 25.824802][ T330] page:ffffea0004492200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112488 [ 25.835046][ T330] head:ffffea0004492200 order:2 compound_mapcount:0 compound_pincount:0 [ 25.843394][ T330] flags: 0x4000000000010200(slab|head|zone=1) [ 25.849497][ T330] raw: 4000000000010200 ffffea000447d300 dead000000000002 ffff888100042f00 [ 25.858104][ T330] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 25.866679][ T330] page dumped because: kasan: bad access detected [ 25.873098][ T330] page_owner tracks the page as allocated [ 25.878823][ T330] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 109, tgid 109 (udevd), ts 5634869911, free_ts 0 [ 25.898472][ T330] post_alloc_hook+0x1f5/0x210 [ 25.903259][ T330] prep_new_page+0x1c/0x110 [ 25.907764][ T330] get_page_from_freelist+0x2ca9/0x2d20 [ 25.913332][ T330] __alloc_pages+0x1fa/0x610 [ 25.917929][ T330] alloc_slab_page+0x6e/0xf0 [ 25.922525][ T330] new_slab+0x98/0x3e0 [ 25.926627][ T330] ___slab_alloc+0x70f/0xb70 [ 25.931262][ T330] __slab_alloc+0x5e/0xa0 [ 25.935645][ T330] __kmem_cache_alloc_node+0x204/0x2d0 [ 25.941105][ T330] __kmalloc_node_track_caller+0xa1/0x1e0 [ 25.946821][ T330] __alloc_skb+0x226/0x4a0 [ 25.951249][ T330] alloc_skb_with_frags+0xa8/0x620 [ 25.956352][ T330] sock_alloc_send_pskb+0x87f/0x9a0 [ 25.961558][ T330] unix_dgram_sendmsg+0x5c1/0x1710 [ 25.966786][ T330] sock_write_iter+0x2ea/0x3f0 [ 25.971666][ T330] vfs_write+0x5ef/0xd00 [ 25.975912][ T330] page_owner free stack trace missing [ 25.981268][ T330] [ 25.983588][ T330] Memory state around the buggy address: [ 25.989299][ T330] ffff888112489b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.997367][ T330] ffff888112489b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.005468][ T330] >ffff888112489c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.013610][ T330] ^ [ 26.017688][ T330] ffff888112489c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.025754][ T330] ffff888112489d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.033806][ T330] ================================================================== [ 26.049470][ T291] EXT4-fs (loop2): unmounting filesystem. [ 26.060246][ T330] Disabling lock debugging due to kernel taint [ 26.069204][ T330] ------------[ cut here ]------------ [ 26.074793][ T330] WARNING: CPU: 0 PID: 330 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 26.085048][ T330] Modules linked in: [ 26.089216][ T330] CPU: 0 PID: 330 Comm: syz.3.8 Tainted: G B syzkaller #0 [ 26.097887][ T330] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.107991][ T330] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 26.114369][ T330] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 26.134089][ T330] RSP: 0018:ffffc9000dc27b90 EFLAGS: 00010293 [ 26.140212][ T330] RAX: ffffffff849bb307 RBX: ffff88811385d000 RCX: ffff88811377bcc0 [ 26.148291][ T330] RDX: 0000000000000000 RSI: 000000001055cdc0 RDI: 000000000c04eb7d [ 26.156294][ T330] RBP: ffffc9000dc27bb0 R08: ffffffff87b757e7 R09: 1ffffffff0f6eafc [ 26.156326][ T357] syz.2.20 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 26.164343][ T330] R10: dffffc0000000000 R11: fffffbfff0f6eafd R12: dffffc0000000000 [ 26.164361][ T330] R13: dffffc0000000000 R14: 000000001055cdc0 R15: ffff888112489c00 [ 26.190697][ T330] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 26.199682][ T330] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 26.206301][ T330] CR2: 00007f25edbeb700 CR3: 000000012c9fd000 CR4: 00000000003506b0 [ 26.214362][ T330] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 26.222389][ T330] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 26.230423][ T330] Call Trace: [ 26.233731][ T330] [ 26.236722][ T330] pppol2tp_release+0x150/0x2b0 [ 26.241604][ T330] sock_close+0xc9/0x220 [ 26.245895][ T330] ? __cfi_sock_close+0x10/0x10 [ 26.250890][ T330] __fput+0x1fd/0x8f0 [ 26.254917][ T330] ____fput+0x15/0x20 [ 26.258988][ T330] task_work_run+0x1e1/0x250 [ 26.263617][ T330] ? __cfi_task_work_run+0x10/0x10 [ 26.268844][ T330] ? free_nsproxy+0x21f/0x270 [ 26.273586][ T330] do_exit+0xaf2/0x2850 [ 26.277837][ T330] ? __cfi_do_exit+0x10/0x10 [ 26.282465][ T330] ? xfd_validate_state+0x70/0x150 [ 26.287658][ T330] ? __kasan_check_write+0x14/0x20 [ 26.292799][ T330] __x64_sys_exit+0x40/0x40 [ 26.297386][ T330] x64_sys_call+0x67/0x9a0 [ 26.301852][ T330] do_syscall_64+0x4c/0xa0 [ 26.306306][ T330] ? clear_bhb_loop+0x30/0x80 [ 26.311027][ T330] ? clear_bhb_loop+0x30/0x80 [ 26.315737][ T330] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 26.321727][ T330] RIP: 0033:0x7f37fc99e019 [ 26.326178][ T330] Code: Unable to access opcode bytes at 0x7f37fc99dfef. [ 26.333386][ T330] RSP: 002b:00007f37fb3f6ef8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 26.341875][ T330] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007f37fc99e019 [ 26.349907][ T330] RDX: 00007f37fb3f79c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 26.357967][ T330] RBP: 00007f37fca3500c R08: 0000000000000000 R09: 0000000000000058 [ 26.366134][ T330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 26.374190][ T330] R13: 00007f37fcc26038 R14: 00007f37fcc25fa0 R15: 00007ffd340dee68 [ 26.382233][ T330] [ 26.385256][ T330] ---[ end trace 0000000000000000 ]--- [ 26.390834][ T19] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 26.577853][ T19] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 26.588921][ T19] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 26.598026][ T19] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.607256][ T19] usb 1-1: config 0 descriptor?? [ 27.015969][ T19] keytouch 0003:0926:3333.0001: fixing up Keytouch IEC report descriptor [ 27.025968][ T19] input: HID 0926:3333 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0926:3333.0001/input/input4 [ 27.109393][ T19] keytouch 0003:0926:3333.0001: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.0-1/input0 [ 27.225422][ T326] loop0: detected capacity change from 0 to 512 [ 27.243004][ T326] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 27.252270][ T326] ext4 filesystem being mounted at /0/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 27.373088][ T28] kauditd_printk_skb: 68 callbacks suppressed [ 27.373103][ T28] audit: type=1400 audit(1785548572.621:142): avc: denied { read } for pid=365 comm="poweroff" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 27.608365][ T297] usb 1-1: USB disconnect, device number 2 Stopping sshd: stopped /usr/sbin/sshd (pid 195) OK Stopping crond: stopped /usr/sbin/crond (pid 186) OK Stopping dhcpcd... stopped /sbin/dhcpcd (pid 140) [ 27.729380][ T28] audit: type=1400 audit(1785548572.981:143): avc: denied { search } for pid=376 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Stopping network: [ 27.822382][ T28] audit: type=1400 audit(1785548573.071:144): avc: denied { write } for pid=141 comm="dhcpcd" name="dhcpcd" dev="tmpfs" ino=489 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 27.856982][ T28] audit: type=1400 audit(1785548573.071:145): avc: denied { remove_name } for pid=141 comm="dhcpcd" name="sock" dev="tmpfs" ino=491 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 27.881059][ T28] audit: type=1400 audit(1785548573.071:146): avc: denied { unlink } for pid=141 comm="dhcpcd" name="sock" dev="tmpfs" ino=491 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=sock_file permissive=1 [ 27.903535][ T28] audit: type=1400 audit(1785548573.101:147): avc: denied { unlink } for pid=141 comm="dhcpcd" name="pid" dev="tmpfs" ino=490 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 OK Stopping iptables: [ 27.962305][ T28] audit: type=1400 audit(1785548573.211:148): avc: denied { search } for pid=390 comm="iptables" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 OK [ 27.986202][ T28] audit: type=1400 audit(1785548573.211:149): avc: denied { write } for pid=390 comm="iptables" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 28.007991][ T28] audit: type=1400 audit(1785548573.211:150): avc: denied { add_name } for pid=390 comm="iptables" name="xtables.lock" scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Stopping system [ 28.029649][ T28] audit: type=1400 audit(1785548573.211:151): avc: denied { create } for pid=390 comm="iptables" name="xtables.lock" scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 message bus: done [ 28.136492][ T288] EXT4-fs (loop0): unmounting filesystem. Stopping klogd: OK Stopping acpid: OK Stopping syslogd: stopped /sbin/syslogd (pid 84) OK umount: can't remount debugfs read-only Connection to 10.128.0.38 closed by remote host. umount: sysfs busy - remounted read-only umount: devtmpfs busy - remounted read-only umount: can't remount /dev/root read-only The system is going down NOW! Sent SIGTERM to all processes [ 30.067186][ T8] device bridge_slave_1 left promiscuous mode [ 30.073325][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.080902][ T8] device bridge_slave_0 left promiscuous mode [ 30.087480][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.095293][ T8] device veth1_macvtap left promiscuous mode [ 30.101341][ T8] device veth0_vlan left promiscuous mode Sent SIGKILL to all processes Requesting system poweroff [ 30.917595][ T8] device bridge_slave_1 left promiscuous mode [ 30.923728][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.931331][ T8] device bridge_slave_0 left promiscuous mode [ 30.937544][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.945715][ T8] device bridge_slave_1 left promiscuous mode [ 30.951949][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.959489][ T8] device bridge_slave_0 left promiscuous mode [ 30.965613][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.973560][ T8] device bridge_slave_1 left promiscuous mode [ 30.979739][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.987299][ T8] device bridge_slave_0 left promiscuous mode [ 30.993423][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.001661][ T8] device veth1_macvtap left promiscuous mode [ 31.007758][ T8] device veth0_vlan left promiscuous mode [ 31.013668][ T8] device veth1_macvtap left promiscuous mode [ 31.019753][ T8] device veth0_vlan left promiscuous mode [ 31.025656][ T8] device veth1_macvtap left promiscuous mode [ 31.031704][ T8] device veth0_vlan left promiscuous mode [ 31.519465][ T411] kvm: exiting hardware virtualization [ 31.525718][ T411] sd 0:0:1:0: [sda] Synchronizing SCSI cache [ 31.532566][ T411] ACPI: PM: Preparing to enter system sleep state S5 [ 31.542219][ T411] reboot: Power down serialport: VM disconnected.