last executing test programs: 3.484197205s ago: executing program 1 (id=2): mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) mkdir(&(0x7f0000000100)='./dev\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='configfs\x00', &(0x7f0000000300)='./config\x00', &(0x7f0000000400)='configfs\x00', 0x0, 0x0) mount(&(0x7f0000000500)=@filename='devtmpfs\x00', &(0x7f0000000600)='./dev\x00', &(0x7f0000000700)='devtmpfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/os_desc/use\x00', 0x1, 0x0) write(r0, &(0x7f0000000a00)='1', 0x1) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./config/usb_gadget/g1/os_desc/b_vendor_code\x00', 0x1, 0x0) write(r1, &(0x7f0000000c00)='0x40', 0x4) close(r1) mkdir(&(0x7f0000000d00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdir(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/ncm.usb0\x00', 0x1ff) symlink(&(0x7f0000000f00)='./config/usb_gadget/g1/functions/ncm.usb0\x00', &(0x7f0000001000)='./config/usb_gadget/g1/configs/c.1/ncm.usb0\x00') symlink(&(0x7f0000001100)='./config/usb_gadget/g1/configs/c.1\x00', &(0x7f0000001200)='./config/usb_gadget/g1/os_desc/c.1\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r2, &(0x7f0000001400)='dummy_udc.0', 0xb) close(r2) chroot(&(0x7f0000001900)='.\x00') r3 = syz_open_dev$usbfs(&(0x7f0000001600), 0x15, 0x2) r4 = syz_open_dev$usbfs(&(0x7f0000001600), 0x16, 0x2) r5 = syz_open_dev$usbfs(&(0x7f0000001600), 0x17, 0x2) r6 = syz_open_dev$usbfs(&(0x7f0000001600), 0x18, 0x2) r7 = syz_open_dev$usbfs(&(0x7f0000001600), 0x19, 0x2) r8 = syz_open_dev$usbfs(&(0x7f0000001600), 0x1a, 0x2) r9 = syz_open_dev$usbfs(&(0x7f0000001600), 0x1b, 0x2) r10 = syz_open_dev$usbfs(&(0x7f0000001600), 0x1c, 0x2) r11 = syz_open_dev$usbfs(&(0x7f0000001600), 0x1d, 0x2) ioctl$USBDEVFS_CONTROL(r3, 0xc0185500, &(0x7f0000001700)={0xc0, 0x40, 0x0, 0x4, 0x20, 0x3e8, &(0x7f0000001800)='\x00'/64}) ioctl$USBDEVFS_CONTROL(r4, 0xc0185500, &(0x7f0000001700)={0xc0, 0x40, 0x0, 0x4, 0x20, 0x3e8, &(0x7f0000001800)='\x00'/64}) ioctl$USBDEVFS_CONTROL(r5, 0xc0185500, &(0x7f0000001700)={0xc0, 0x40, 0x0, 0x4, 0x20, 0x3e8, &(0x7f0000001800)='\x00'/64}) ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000001700)={0xc0, 0x40, 0x0, 0x4, 0x20, 0x3e8, &(0x7f0000001800)='\x00'/64}) ioctl$USBDEVFS_CONTROL(r7, 0xc0185500, &(0x7f0000001700)={0xc0, 0x40, 0x0, 0x4, 0x20, 0x3e8, &(0x7f0000001800)='\x00'/64}) ioctl$USBDEVFS_CONTROL(r8, 0xc0185500, &(0x7f0000001700)={0xc0, 0x40, 0x0, 0x4, 0x20, 0x3e8, &(0x7f0000001800)='\x00'/64}) ioctl$USBDEVFS_CONTROL(r9, 0xc0185500, &(0x7f0000001700)={0xc0, 0x40, 0x0, 0x4, 0x20, 0x3e8, &(0x7f0000001800)='\x00'/64}) ioctl$USBDEVFS_CONTROL(r10, 0xc0185500, &(0x7f0000001700)={0xc0, 0x40, 0x0, 0x4, 0x20, 0x3e8, &(0x7f0000001800)='\x00'/64}) ioctl$USBDEVFS_CONTROL(r11, 0xc0185500, &(0x7f0000001700)={0xc0, 0x40, 0x0, 0x4, 0x20, 0x3e8, &(0x7f0000001800)='\x00'/64}) 3.27349823s ago: executing program 1 (id=6): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r4 = socket$inet(0x2, 0x1, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000200)={'wlan0\x00', 0x1}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x68, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x1}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}]}, 0x68}}, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000400)={'wlan1\x00', 0x1}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)={0x68, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x1}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}]}, 0x68}}, 0x0) 3.136473744s ago: executing program 1 (id=7): r0 = syz_usb_connect$uac2(0x5, 0x80, &(0x7f0000000800)=ANY=[@ANYBLOB="12010002000000408205820540000102030109026e000301c0c310080b000201223061090400000001013000"], 0x0) syz_usb_disconnect(r0) 3.123119884s ago: executing program 3 (id=4): r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0xb, 0x2) ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000100)={0x23, 0x3, 0x17, 0x1, 0x0, 0x3e8, 0x0}) r1 = syz_open_dev$usbfs(&(0x7f0000000000), 0xb, 0x2) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000100)={0x23, 0x3, 0x17, 0x1, 0x0, 0x3e8, 0x0}) r2 = syz_open_dev$usbfs(&(0x7f0000000000), 0xb, 0x2) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f0000000100)={0x23, 0x3, 0x17, 0x1, 0x0, 0x3e8, 0x0}) r3 = syz_open_dev$usbfs(&(0x7f0000000000), 0xb, 0x2) ioctl$USBDEVFS_CONTROL(r3, 0xc0185500, &(0x7f0000000100)={0x23, 0x3, 0x17, 0x1, 0x0, 0x3e8, 0x0}) 3.113689314s ago: executing program 0 (id=1): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000400)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/functions/mass_storage.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/functions/mass_storage.usb0/num_buffers\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='4\x00', 0x1) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/functions/mass_storage.usb0/num_buffers\x00', 0x1, 0x0) write(r1, &(0x7f0000000300)='8\x00', 0x1) close(r1) rmdir(&(0x7f0000000100)='./config/usb_gadget/g1/functions/mass_storage.usb0\x00') 3.052366356s ago: executing program 2 (id=3): r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040000000000000000000010902200001010080fa0904000002080650000705810200020007050202000200"], 0x0) syz_usb_ep_read(r0, 0x2, 0x200, &(0x7f0000000100)=""/512) 3.030577176s ago: executing program 4 (id=5): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/ipv6/fib_multipath_hash_policy\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='3', 0x1) 3.026596976s ago: executing program 0 (id=8): r0 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000140)={0x0, &(0x7f0000000180)=[@cpuid={0x64, 0x18, {0x1}}, @wr_crn={0x67, 0x20}, @uexit={0x0, 0x18, 0xaaaa}], 0x50}) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0) ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f0000000200)) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000340)) 2.970064568s ago: executing program 4 (id=9): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/i2c/devices/i2c-0\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/i2c/devices/i2c-1\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/i2c/devices/i2c-2\x00', 0x0, 0x0) 2.969805578s ago: executing program 4 (id=10): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./lib\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./lib/firmware\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./lib/firmware/ath9k_htc\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./lib/firmware/ath9k_htc/htc_9271-1.4.0.fw\x00', 0x42, 0x1ff) write(r0, &(0x7f0000000400)='DUMMY_FIRMWARE_BYTES', 0x14) close(r0) r1 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r1, 0x83, 0x10, &(0x7f0000000500)=@ready={0x0, 0x0, 0x8, 'BBBB'}) syz_usb_ep_write$ath9k_ep2(r1, 0x83, 0x14, &(0x7f0000000a00)=@conn_svc_rsp={0x0, 0x0, 0xc, 'BBBB', {0x3, 0x100, 0x0, 0x1, 0x100}}) syz_usb_ep_write$ath9k_ep2(r1, 0x83, 0x14, &(0x7f0000000b00)=@conn_svc_rsp={0x0, 0x0, 0xc, 'BBBB', {0x3, 0x101, 0x0, 0x2, 0x100}}) syz_usb_ep_write$ath9k_ep2(r1, 0x83, 0x14, &(0x7f0000000c00)=@conn_svc_rsp={0x0, 0x0, 0xc, 'BBBB', {0x3, 0x102, 0x0, 0x3, 0x100}}) syz_usb_ep_write$ath9k_ep2(r1, 0x83, 0x14, &(0x7f0000000d00)=@conn_svc_rsp={0x0, 0x0, 0xc, 'BBBB', {0x3, 0x103, 0x0, 0x4, 0x100}}) syz_usb_ep_write$ath9k_ep2(r1, 0x83, 0x14, &(0x7f0000000e00)=@conn_svc_rsp={0x0, 0x0, 0xc, 'BBBB', {0x3, 0x104, 0x0, 0x5, 0x100}}) syz_usb_ep_write$ath9k_ep2(r1, 0x83, 0x14, &(0x7f0000000f00)=@conn_svc_rsp={0x0, 0x0, 0xc, 'BBBB', {0x3, 0x107, 0x0, 0x6, 0x100}}) syz_usb_ep_write$ath9k_ep2(r1, 0x83, 0x14, &(0x7f0000001000)=@conn_svc_rsp={0x0, 0x0, 0xc, 'BBBB', {0x3, 0x108, 0x0, 0x7, 0x100}}) syz_usb_ep_write$ath9k_ep2(r1, 0x83, 0x14, &(0x7f0000001100)=@conn_svc_rsp={0x0, 0x0, 0xc, 'BBBB', {0x3, 0x106, 0x0, 0x8, 0x100}}) syz_usb_ep_write$ath9k_ep2(r1, 0x83, 0x14, &(0x7f0000001200)=@conn_svc_rsp={0x0, 0x0, 0xc, 'BBBB', {0x3, 0x105, 0x0, 0x9, 0x100}}) syz_usb_ep_write$ath9k_ep2(r1, 0x83, 0x10, &(0x7f0000001300)=@generic={0x1, 0x0, 0x8, 'BBBB', "0003000100010004"}) nanosleep(&(0x7f0000000600)={0x0, 0x1dcd6500}, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000700)={'wlan0\x00'}) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000800)={'wlan1\x00'}) 2.88993233s ago: executing program 0 (id=11): keyctl$dh_compute(0x17, &(0x7f0000000100), &(0x7f0000000200)=""/128, 0x80, 0x0) 2.87834652s ago: executing program 0 (id=12): r0 = syz_usb_connect(0x2, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040341278560001000000010902200001010080320904000002fe0300000705810240000007050202400000"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000400)={0x84, &(0x7f00000003c0)={0x20, 0x7, 0x18, "0100"/24}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0xb0) poll(&(0x7f0000000500)=[{r1, 0x1}], 0x1, 0x3e8) 2.400720652s ago: executing program 3 (id=13): syz_usb_connect(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0x32, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}]}}]}}]}}, 0x0) r0 = epoll_create(0x1) epoll_wait(r0, &(0x7f0000000080)=[{}], 0x1, 0xbb8) 136.37µs ago: executing program 0 (id=14): syz_mount_image$tmpfs(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./debug\x00', 0x1c0) mount(0x0, &(0x7f0000000180)='./debug\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='10', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./debug/failslab/times\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1\x00', 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./debug/failslab/task-filter\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='N\x00', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config\x00', 0x1c0) openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.usb0/control/extensions/xu1/bmControls\x00', 0x1, 0x0) 0s ago: executing program 1 (id=15): r0 = syz_usb_connect(0x0, 0x3b, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000403d0f12010000010203010902270001010080320904000003ff000000070581024000000705010240000007058203200001"], 0x0) nanosleep(&(0x7f0000000100)={0x3}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) nanosleep(&(0x7f0000000100)={0x2}, 0x0) syz_usb_disconnect(r0) nanosleep(&(0x7f0000000100)={0x1}, 0x0) kernel console output (not intermixed with test programs): cess permissive=1 [ 15.300851][ T24] audit: type=1400 audit(1786955331.010:63): avc: denied { siginh } for pid=217 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.10.12' (ED25519) to the list of known hosts. [ 22.760916][ T24] audit: type=1400 audit(1786955338.510:64): avc: denied { mounton } for pid=271 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.764718][ T271] cgroup: Unknown subsys name 'net' [ 22.783682][ T24] audit: type=1400 audit(1786955338.510:65): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.810930][ T24] audit: type=1400 audit(1786955338.540:66): avc: denied { unmount } for pid=271 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.811447][ T271] cgroup: Unknown subsys name 'devices' [ 22.956287][ T271] cgroup: Unknown subsys name 'hugetlb' [ 22.961913][ T271] cgroup: Unknown subsys name 'rlimit' [ 23.102782][ T24] audit: type=1400 audit(1786955338.850:67): avc: denied { setattr } for pid=271 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.125995][ T24] audit: type=1400 audit(1786955338.850:68): avc: denied { mounton } for pid=271 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.150743][ T24] audit: type=1400 audit(1786955338.850:69): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.178391][ T273] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 23.187322][ T24] audit: type=1400 audit(1786955338.940:70): avc: denied { relabelto } for pid=273 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.212815][ T271] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.213312][ T24] audit: type=1400 audit(1786955338.940:71): avc: denied { write } for pid=273 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.247238][ T24] audit: type=1400 audit(1786955338.950:72): avc: denied { read } for pid=271 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.272724][ T24] audit: type=1400 audit(1786955338.950:73): avc: denied { open } for pid=271 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.848867][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.856174][ T280] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.863683][ T280] device bridge_slave_0 entered promiscuous mode [ 23.871572][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.878672][ T280] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.886219][ T280] device bridge_slave_1 entered promiscuous mode [ 23.975678][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.982745][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.990820][ T282] device bridge_slave_0 entered promiscuous mode [ 23.998561][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.005757][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.013106][ T282] device bridge_slave_1 entered promiscuous mode [ 24.041666][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.048742][ T279] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.056160][ T279] device bridge_slave_0 entered promiscuous mode [ 24.074774][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.081839][ T279] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.089357][ T279] device bridge_slave_1 entered promiscuous mode [ 24.115052][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.122108][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.129756][ T281] device bridge_slave_0 entered promiscuous mode [ 24.139489][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.146584][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.153998][ T281] device bridge_slave_1 entered promiscuous mode [ 24.204490][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.211554][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.219161][ T283] device bridge_slave_0 entered promiscuous mode [ 24.226215][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.233263][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.240725][ T283] device bridge_slave_1 entered promiscuous mode [ 24.287674][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.294756][ T280] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.360005][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.367083][ T279] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.374387][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.381429][ T279] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.401493][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.408571][ T281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.415864][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.422916][ T281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.440056][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.447130][ T282] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.454438][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.461467][ T282] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.485248][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.492699][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.499989][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.507582][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.515036][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.522457][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.529765][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.537600][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.545111][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.560477][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.589413][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.597922][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.606351][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.613377][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.620885][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.629034][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.636086][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.643455][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.651519][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.668903][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.677196][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.684212][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.691665][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.699886][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.706952][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.725329][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.733757][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.741295][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.749856][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.756983][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.764791][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.772929][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.779993][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.787357][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.795572][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.802595][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.814835][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.834244][ T280] device veth0_vlan entered promiscuous mode [ 24.850382][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.858908][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.867262][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.875518][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.883021][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.891965][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.900319][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.909052][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.917242][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.925416][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.945234][ T280] device veth1_macvtap entered promiscuous mode [ 24.955985][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.964340][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.972716][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.979792][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.987350][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.995794][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.006027][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.014040][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.022208][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.030559][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.038963][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.047292][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.055509][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.062522][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.069956][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.078326][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.086516][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.093539][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.100952][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 25.114166][ T279] device veth0_vlan entered promiscuous mode [ 25.128784][ T281] device veth0_vlan entered promiscuous mode [ 25.136925][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.145034][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.153077][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.161544][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.170819][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.179097][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.187559][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.195648][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.203635][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.211187][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.218723][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.226329][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.239825][ T279] device veth1_macvtap entered promiscuous mode [ 25.254033][ T280] request_module fs-gadgetfs succeeded, but still no fs? [ 25.262169][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.270911][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.279865][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.288618][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.296818][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.304502][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.312468][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.322150][ T282] device veth0_vlan entered promiscuous mode [ 25.333514][ T280] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 25.335716][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.352953][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.362084][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.369606][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.385667][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.394855][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.403021][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.413772][ T281] device veth1_macvtap entered promiscuous mode [ 25.425876][ T303] using random self ethernet address [ 25.431201][ T303] using random host ethernet address [ 25.438032][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.446201][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.454651][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.462841][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.471306][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.479916][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.488201][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.498607][ T283] device veth0_vlan entered promiscuous mode [ 25.507027][ T282] device veth1_macvtap entered promiscuous mode [ 25.516491][ T303] usb0: HOST MAC ea:fd:34:bb:f8:e6 [ 25.521636][ T303] usb0: MAC 9a:d5:e2:de:14:f6 [ 25.527218][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.535264][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.549756][ T283] device veth1_macvtap entered promiscuous mode [ 25.569836][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.578478][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.587214][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.595592][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.603992][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.614630][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.624106][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.633403][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.642109][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.650882][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.659469][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.713549][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.737999][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.749409][ T328] Mass Storage Function, version: 2009/09/11 [ 25.749641][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.764255][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.770815][ T328] LUN: removable file: (no medium) [ 25.822902][ T339] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.845223][ T300] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 25.870214][ T329] android_work: sent uevent USB_STATE=CONNECTED [ 25.906457][ T339] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 25.915811][ T344] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 25.961577][ T353] udc-core: couldn't find an available UDC or it's busy [ 25.971155][ T353] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 26.014611][ T315] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 26.084643][ T15] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 26.124518][ T300] usb 1-1: Dual-Role OTG device on HNP port [ 26.148605][ T300] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 5.10 [ 26.157858][ T300] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.184691][ T53] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 26.184697][ T329] android_work: sent uevent USB_STATE=CONFIGURED [ 26.244772][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): usb0: link becomes ready [ 26.374466][ T315] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 26.384804][ T300] cdc_ncm 1-1:1.0: MAC-Address: ea:fd:34:bb:f8:e6 [ 26.392863][ T300] cdc_ncm 1-1:1.0 usb1: register 'cdc_ncm' at usb-dummy_hcd.0-1, CDC NCM, ea:fd:34:bb:f8:e6 [ 26.403167][ T315] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 26.444476][ T15] usb 3-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 0.00 [ 26.455919][ T15] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.505127][ T15] usb-storage 3-1:1.0: USB Mass Storage device detected [ 26.513129][ T15] scsi host1: usb-storage 3-1:1.0 [ 26.564496][ T315] usb 2-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 26.573608][ T315] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.581770][ T315] usb 2-1: Product: syz [ 26.586055][ T315] usb 2-1: Manufacturer: syz [ 26.590674][ T315] usb 2-1: SerialNumber: syz [ 26.644438][ C1] cdc_ncm 1-1:1.0 usb1: 425 mbit/s downlink 425 mbit/s uplink [ 26.684411][ C1] cdc_ncm 1-1:1.0 usb1: 425 mbit/s downlink 425 mbit/s uplink [ 26.706142][ T20] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 26.713714][ T321] IPv6: ADDRCONF(NETDEV_CHANGE): usb1: link becomes ready [ 26.764978][ T53] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 26.774327][ T53] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.782434][ T53] usb 5-1: Product: syz [ 26.787110][ T53] usb 5-1: Manufacturer: syz [ 26.791734][ T53] usb 5-1: SerialNumber: syz [ 26.954616][ T315] usb 2-1: 0:1 : does not exist [ 26.959634][ T315] usb 2-1: BAAD SPEAKER p_chmask mismatch [ 26.965606][ T315] snd-usb-audio: probe of 2-1:1.0 failed with error -22 [ 26.973176][ T315] usb 2-1: USB disconnect, device number 2 [ 27.254515][ T20] usb 4-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 0.00 [ 27.263800][ T20] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.272561][ T20] usb 4-1: Product: syz [ 27.276938][ T20] usb 4-1: Manufacturer: syz [ 27.282229][ T20] usb 4-1: SerialNumber: syz [ 27.550854][ T383] FAULT_INJECTION: forcing a failure. [ 27.550854][ T383] name failslab, interval 1, probability 10, space 0, times 1 [ 27.551023][ T95] FAULT_INJECTION: forcing a failure. [ 27.551023][ T95] name failslab, interval 1, probability 10, space 0, times 1 [ 27.564174][ T383] CPU: 1 PID: 383 Comm: syz.0.14 Not tainted syzkaller #0 [ 27.583426][ T383] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 27.584843][ T84] FAULT_INJECTION: forcing a failure. [ 27.584843][ T84] name failslab, interval 1, probability 10, space 0, times 1 [ 27.593502][ T383] Call Trace: [ 27.593529][ T383] __dump_stack+0x21/0x24 [ 27.593577][ T383] dump_stack_lvl+0x1a7/0x208 [ 27.618515][ T383] ? thaw_kernel_threads+0x220/0x220 [ 27.623811][ T383] ? show_regs_print_info+0x18/0x18 [ 27.624836][ C0] FAULT_INJECTION: forcing a failure. [ 27.624836][ C0] name failslab, interval 1, probability 10, space 0, times 1 [ 27.629059][ T383] ? prandom_u32+0x24d/0x290 [ 27.646315][ T383] dump_stack+0x15/0x1c [ 27.650474][ T383] should_fail+0x3ab/0x500 [ 27.654895][ T383] ? getname_flags+0xba/0x510 [ 27.659581][ T383] __should_failslab+0xa4/0xe0 [ 27.664352][ T383] should_failslab+0x9/0x20 [ 27.668868][ T383] kmem_cache_alloc+0x3d/0x2d0 [ 27.673637][ T383] getname_flags+0xba/0x510 [ 27.678150][ T383] getname+0x19/0x20 [ 27.682047][ T383] do_sys_openat2+0xde/0x750 [ 27.686666][ T383] ? do_sys_open+0xe0/0xe0 [ 27.691091][ T383] ? __kasan_check_write+0x14/0x20 [ 27.696206][ T383] ? switch_fpu_return+0x19c/0x330 [ 27.701327][ T383] ? fpu__clear_all+0x20/0x20 [ 27.706009][ T383] __x64_sys_openat+0x136/0x160 [ 27.710866][ T383] do_syscall_64+0x31/0x40 [ 27.715312][ T383] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 27.721222][ T383] RIP: 0033:0x7f709a14e0d9 [ 27.725646][ T383] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 27.745252][ T383] RSP: 002b:00007f7098ba7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 27.753673][ T383] RAX: ffffffffffffffda RBX: 00007f709a3d5fa0 RCX: 00007f709a14e0d9 [ 27.761666][ T383] RDX: 0000000000000001 RSI: 0000200000000540 RDI: ffffffffffffff9c [ 27.769644][ T383] RBP: 00007f709a1e5024 R08: 0000000000000000 R09: 0000000000000000 [ 27.777630][ T383] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 27.785609][ T383] R13: 00007f709a3d6038 R14: 00007f709a3d5fa0 R15: 00007ffd970bace8 [ 27.793594][ C0] CPU: 0 PID: 84 Comm: klogd Not tainted syzkaller #0 [ 27.793971][ C1] FAULT_INJECTION: forcing a failure. [ 27.793971][ C1] name failslab, interval 1, probability 10, space 0, times 1 [ 27.800368][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 27.800372][ C0] Call Trace: [ 27.800377][ C0] [ 27.800392][ C0] __dump_stack+0x21/0x24 [ 27.800434][ C0] dump_stack_lvl+0x1a7/0x208 [ 27.838287][ C0] ? thaw_kernel_threads+0x220/0x220 [ 27.843583][ C0] ? show_regs_print_info+0x18/0x18 [ 27.848787][ C0] ? prandom_u32+0x24d/0x290 [ 27.853384][ C0] dump_stack+0x15/0x1c [ 27.857542][ C0] should_fail+0x3ab/0x500 [ 27.861968][ C0] ? __alloc_skb+0x9e/0x520 [ 27.866483][ C0] __should_failslab+0xa4/0xe0 [ 27.871254][ C0] should_failslab+0x9/0x20 [ 27.875762][ C0] kmem_cache_alloc+0x3d/0x2d0 [ 27.880528][ C0] __alloc_skb+0x9e/0x520 [ 27.885215][ C0] ncm_wrap_ntb+0x527/0xe40 [ 27.889742][ C0] eth_start_xmit+0x48d/0xd40 [ 27.894422][ C0] dev_hard_start_xmit+0x245/0x680 [ 27.901108][ C0] sch_direct_xmit+0x26d/0x990 [ 27.905891][ C0] ? debug_smp_processor_id+0x17/0x20 [ 27.911299][ C0] ? stp_proto_unregister+0x200/0x200 [ 27.916680][ C0] __qdisc_run+0xa3a/0x1400 [ 27.921191][ C0] qdisc_run+0x100/0x2f0 [ 27.925442][ C0] __dev_queue_xmit+0xbc6/0x2500 [ 27.930390][ C0] ? is_bpf_text_address+0x177/0x190 [ 27.935685][ C0] ? dev_queue_xmit+0x20/0x20 [ 27.940367][ C0] ? __local_bh_enable_ip+0x53/0x80 [ 27.945597][ C0] ? __local_bh_enable_ip+0x53/0x80 [ 27.950798][ C0] ? ipv6_chk_mcast_addr+0x3d1/0x3f0 [ 27.956088][ C0] ? ip6_finish_output2+0xcd0/0x1540 [ 27.961374][ C0] dev_queue_xmit+0x17/0x20 [ 27.966030][ C0] ip6_finish_output2+0xea9/0x1540 [ 27.971165][ C0] ? __ip6_finish_output+0x790/0x790 [ 27.976467][ C0] ? ip6table_mangle_hook+0x2c3/0x730 [ 27.981845][ C0] __ip6_finish_output+0x5fd/0x790 [ 27.986965][ C0] ip6_finish_output+0x33/0x1e0 [ 27.991825][ C0] ip6_output+0x1fa/0x420 [ 27.996160][ C0] ? ac6_seq_show+0xf0/0xf0 [ 28.000669][ C0] ? ip6_output+0x420/0x420 [ 28.005179][ C0] ? ip6table_filter_table_init+0xf0/0xf0 [ 28.010902][ C0] mld_sendpack+0x61e/0xb00 [ 28.015410][ C0] ? add_grec+0x1330/0x1330 [ 28.019916][ C0] ? mld_send_report+0x1f0/0x1f0 [ 28.024945][ C0] ? add_grec+0x10b/0x1330 [ 28.029371][ C0] ? _raw_spin_lock_irq+0xf0/0xf0 [ 28.034399][ C0] mld_ifc_timer_expire+0x862/0xc60 [ 28.039606][ C0] ? __next_timer_interrupt+0x21d/0x2a0 [ 28.045156][ C0] ? mld_gq_timer_expire+0xe0/0xe0 [ 28.050272][ C0] call_timer_fn+0x38/0x290 [ 28.054782][ C0] ? mld_gq_timer_expire+0xe0/0xe0 [ 28.059894][ C0] __run_timers+0x637/0x9a0 [ 28.064402][ C0] ? calc_index+0x200/0x200 [ 28.068912][ C0] ? sched_clock_cpu+0x1b/0x3d0 [ 28.073771][ C0] run_timer_softirq+0x6a/0xf0 [ 28.078541][ C0] __do_softirq+0x255/0x563 [ 28.083053][ C0] ? __this_cpu_preempt_check+0x13/0x20 [ 28.088691][ C0] asm_call_irq_on_stack+0xf/0x20 [ 28.093722][ C0] [ 28.096691][ C0] do_softirq_own_stack+0x60/0x80 [ 28.101732][ C0] __irq_exit_rcu+0x128/0x150 [ 28.106530][ C0] irq_exit_rcu+0x9/0x10 [ 28.110786][ C0] sysvec_apic_timer_interrupt+0xbf/0xe0 [ 28.116429][ C0] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 28.122419][ C0] RIP: 0010:__sanitizer_cov_trace_pc+0x36/0x60 [ 28.128586][ C0] Code: b0 bb 9d 7e 65 8b 15 b5 bb 9d 7e f7 c2 00 01 ff 00 74 11 f7 c2 00 01 00 00 74 35 83 b9 dc 0a 00 00 00 74 2c 8b 91 b8 0a 00 00 <83> fa 02 75 21 48 8b 91 c0 0a 00 00 48 8b 32 48 8d 7e 01 8b 89 bc [ 28.148346][ C0] RSP: 0018:ffffc90000b67710 EFLAGS: 00000246 [ 28.154421][ C0] RAX: ffffffff8479a412 RBX: 0000000000000293 RCX: ffff88810d590000 [ 28.162757][ C0] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff8676f740 [ 28.170751][ C0] RBP: ffffc90000b67710 R08: 0000000000000003 R09: 0000000000000004 [ 28.178733][ C0] R10: dffffc0000000000 R11: fffffbfff0cedee8 R12: 1ffff9200016cee8 [ 28.186733][ C0] R13: dffffc0000000004 R14: 0000000000000000 R15: 0000000000000001 [ 28.194743][ C0] ? dump_stack_lvl+0x11a/0x208 [ 28.199696][ C0] dump_stack_lvl+0x11a/0x208 [ 28.204384][ C0] ? show_regs_print_info+0x18/0x18 [ 28.209589][ C0] dump_stack+0x15/0x1c [ 28.213749][ C0] should_fail+0x3ab/0x500 [ 28.218172][ C0] ? __alloc_skb+0x9e/0x520 [ 28.222677][ C0] __should_failslab+0xa4/0xe0 [ 28.227445][ C0] should_failslab+0x9/0x20 [ 28.231954][ C0] kmem_cache_alloc+0x3d/0x2d0 [ 28.236729][ C0] ? autoremove_wake_function+0x37/0x110 [ 28.242366][ C0] __alloc_skb+0x9e/0x520 [ 28.246705][ C0] alloc_skb_with_frags+0xa3/0x560 [ 28.251846][ C0] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 28.257659][ C0] sock_alloc_send_pskb+0x87f/0x9a0 [ 28.262862][ C0] ? sock_kzfree_s+0x60/0x60 [ 28.267459][ C0] ? __kasan_check_write+0x14/0x20 [ 28.272573][ C0] ? _raw_spin_lock+0x94/0xf0 [ 28.277256][ C0] ? _raw_spin_trylock_bh+0x150/0x150 [ 28.282637][ C0] unix_dgram_sendmsg+0x6f3/0x18f0 [ 28.287758][ C0] ? unix_dgram_poll+0x640/0x640 [ 28.292696][ C0] ? cap_capable+0x19c/0x220 [ 28.297584][ C0] ? security_socket_sendmsg+0x82/0xa0 [ 28.303060][ C0] __sys_sendto+0x467/0x620 [ 28.307575][ C0] ? __ia32_sys_getpeername+0x90/0x90 [ 28.312956][ C0] ? fpu__clear_all+0x20/0x20 [ 28.317640][ C0] __x64_sys_sendto+0xe5/0x100 [ 28.322410][ C0] do_syscall_64+0x31/0x40 [ 28.326837][ C0] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.332734][ C0] RIP: 0033:0x7f3c87b21407 [ 28.337154][ C0] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 28.356763][ C0] RSP: 002b:00007fff295ed780 EFLAGS: 00000202 ORIG_RAX: 000000000000002c [ 28.365179][ C0] RAX: ffffffffffffffda RBX: 00007f3c879d1c80 RCX: 00007f3c87b21407 [ 28.373153][ C0] RDX: 000000000000006d RSI: 00007fff295ed8c0 RDI: 0000000000000003 [ 28.381126][ C0] RBP: 00007fff295edcf0 R08: 0000000000000000 R09: 0000000000000000 [ 28.389137][ C0] R10: 0000000000004000 R11: 0000000000000202 R12: 00007fff295edd08 [ 28.397133][ C0] R13: 00007fff295ed8c0 R14: 0000000000000052 R15: 00007fff295ed8c0 [ 28.405120][ C1] CPU: 1 PID: 383 Comm: syz.0.14 Not tainted syzkaller #0 [ 28.412245][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 28.422312][ C1] Call Trace: [ 28.425602][ C1] [ 28.428469][ C1] __dump_stack+0x21/0x24 [ 28.432819][ C1] dump_stack_lvl+0x1a7/0x208 [ 28.437510][ C1] ? thaw_kernel_threads+0x220/0x220 [ 28.442815][ C1] ? show_regs_print_info+0x18/0x18 [ 28.448020][ C1] ? prandom_u32+0x24d/0x290 [ 28.452614][ C1] dump_stack+0x15/0x1c [ 28.456771][ C1] should_fail+0x3ab/0x500 [ 28.461191][ C1] ? dst_cow_metrics_generic+0x55/0x1c0 [ 28.466743][ C1] __should_failslab+0xa4/0xe0 [ 28.471512][ C1] should_failslab+0x9/0x20 [ 28.476015][ C1] kmem_cache_alloc_trace+0x3a/0x2e0 [ 28.481304][ C1] dst_cow_metrics_generic+0x55/0x1c0 [ 28.486677][ C1] icmp6_dst_alloc+0x35f/0x520 [ 28.491440][ C1] mld_sendpack+0x4d6/0xb00 [ 28.495943][ C1] ? add_grec+0x1330/0x1330 [ 28.500442][ C1] ? add_grec+0xf67/0x1330 [ 28.504860][ C1] ? memcpy+0x56/0x70 [ 28.508846][ C1] ? __kasan_check_write+0x14/0x20 [ 28.513956][ C1] ? _raw_spin_lock_bh+0x94/0xf0 [ 28.518893][ C1] mld_send_initial_cr+0x246/0x2b0 [ 28.524012][ C1] mld_dad_timer_expire+0x2b/0x410 [ 28.529124][ C1] ? mld_ifc_timer_expire+0xc60/0xc60 [ 28.534494][ C1] call_timer_fn+0x38/0x290 [ 28.539018][ C1] ? mld_ifc_timer_expire+0xc60/0xc60 [ 28.544397][ C1] __run_timers+0x637/0x9a0 [ 28.548909][ C1] ? calc_index+0x200/0x200 [ 28.553426][ C1] run_timer_softirq+0x6a/0xf0 [ 28.558198][ C1] __do_softirq+0x255/0x563 [ 28.562711][ C1] ? __this_cpu_preempt_check+0x13/0x20 [ 28.568272][ C1] asm_call_irq_on_stack+0xf/0x20 [ 28.573291][ C1] [ 28.576237][ C1] do_softirq_own_stack+0x60/0x80 [ 28.581266][ C1] __irq_exit_rcu+0x128/0x150 [ 28.585948][ C1] irq_exit_rcu+0x9/0x10 [ 28.590195][ C1] sysvec_apic_timer_interrupt+0xbf/0xe0 [ 28.595827][ C1] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 28.601811][ C1] RIP: 0010:dump_stack_lvl+0x1cc/0x208 [ 28.607272][ C1] Code: e8 61 00 00 00 48 c7 c7 40 f7 76 86 be 04 00 00 00 e8 a0 84 25 fd c7 05 86 52 fd 01 ff ff ff ff 48 89 5c 24 10 ff 74 24 10 9d <48> c7 44 24 20 0e 36 e0 45 4b c7 04 2c 00 00 00 00 65 48 8b 04 25 [ 28.626876][ C1] RSP: 0018:ffffc90009b3fb80 EFLAGS: 00000287 [ 28.632972][ C1] RAX: a859486c2d069801 RBX: 0000000000000287 RCX: ffffffff8479a4b0 [ 28.640944][ C1] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffffff8676f740 [ 28.648914][ C1] RBP: ffffc90009b3fc30 R08: 0000000000000003 R09: 0000000000000004 [ 28.656976][ C1] R10: dffffc0000000000 R11: fffffbfff0cedee8 R12: 1ffff92001367f74 [ 28.664994][ C1] R13: dffffc0000000000 R14: 0000000000000001 R15: 00000000ffffffff [ 28.672978][ C1] ? dump_stack_lvl+0x1b8/0x208 [ 28.677852][ C1] ? show_regs_print_info+0x18/0x18 [ 28.683048][ C1] ? prandom_u32+0x24d/0x290 [ 28.687644][ C1] dump_stack+0x15/0x1c [ 28.691831][ C1] should_fail+0x3ab/0x500 [ 28.696252][ C1] ? getname_flags+0xba/0x510 [ 28.700936][ C1] __should_failslab+0xa4/0xe0 [ 28.705707][ C1] should_failslab+0x9/0x20 [ 28.710210][ C1] kmem_cache_alloc+0x3d/0x2d0 [ 28.714981][ C1] getname_flags+0xba/0x510 [ 28.719486][ C1] getname+0x19/0x20 [ 28.723388][ C1] do_sys_openat2+0xde/0x750 [ 28.727983][ C1] ? do_sys_open+0xe0/0xe0 [ 28.732425][ C1] ? __kasan_check_write+0x14/0x20 [ 28.737537][ C1] ? switch_fpu_return+0x19c/0x330 [ 28.742646][ C1] ? fpu__clear_all+0x20/0x20 [ 28.747326][ C1] __x64_sys_openat+0x136/0x160 [ 28.752180][ C1] do_syscall_64+0x31/0x40 [ 28.756599][ C1] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.762490][ C1] RIP: 0033:0x7f709a14e0d9 [ 28.766906][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 28.786516][ C1] RSP: 002b:00007f7098ba7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 28.794929][ C1] RAX: ffffffffffffffda RBX: 00007f709a3d5fa0 RCX: 00007f709a14e0d9 [ 28.802906][ C1] RDX: 0000000000000001 RSI: 0000200000000540 RDI: ffffffffffffff9c [ 28.810878][ C1] RBP: 00007f709a1e5024 R08: 0000000000000000 R09: 0000000000000000 [ 28.818851][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 28.826823][ C1] R13: 00007f709a3d6038 R14: 00007f709a3d5fa0 R15: 00007ffd970bace8 [ 28.838005][ T20] ================================================================== [ 28.846120][ T20] BUG: KASAN: use-after-free in ncm_wrap_ntb+0xcfa/0xe40 [ 28.852605][ T95] CPU: 0 PID: 95 Comm: udevd Not tainted syzkaller #0 [ 28.853186][ T20] Read of size 4 at addr ffff88811e5422f0 by task kworker/1:0/20 [ 28.859931][ T95] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 28.867633][ T20] [ 28.877689][ T95] Call Trace: [ 28.883308][ T95] __dump_stack+0x21/0x24 [ 28.887641][ T95] dump_stack_lvl+0x1a7/0x208 [ 28.892326][ T95] ? show_regs_print_info+0x18/0x18 [ 28.897529][ T95] ? prandom_u32+0x24d/0x290 [ 28.902120][ T95] dump_stack+0x15/0x1c [ 28.906281][ T95] should_fail+0x3ab/0x500 [ 28.910703][ T95] ? kernfs_fop_open+0x375/0xbb0 [ 28.915646][ T95] __should_failslab+0xa4/0xe0 [ 28.920413][ T95] should_failslab+0x9/0x20 [ 28.924926][ T95] kmem_cache_alloc_trace+0x3a/0x2e0 [ 28.930220][ T95] ? __kasan_check_write+0x14/0x20 [ 28.935339][ T95] kernfs_fop_open+0x375/0xbb0 [ 28.940103][ T95] ? kernfs_fop_mmap+0x400/0x400 [ 28.945051][ T95] do_dentry_open+0x7a5/0x10a0 [ 28.949816][ T95] vfs_open+0x73/0x80 [ 28.953809][ T95] path_openat+0x26c3/0x3040 [ 28.958406][ T95] ? __kasan_slab_alloc+0xc9/0xe0 [ 28.963430][ T95] ? getname_flags+0xba/0x510 [ 28.968123][ T95] ? getname+0x19/0x20 [ 28.972217][ T95] ? do_sys_openat2+0xde/0x750 [ 28.976997][ T95] ? do_filp_open+0x400/0x400 [ 28.981679][ T95] do_filp_open+0x1df/0x400 [ 28.986193][ T95] ? vfs_tmpfile+0x2c0/0x2c0 [ 28.990799][ T95] ? get_unused_fd_flags+0x92/0xa0 [ 28.995933][ T95] do_sys_openat2+0x19f/0x750 [ 29.000612][ T95] ? __fdget+0x15b/0x230 [ 29.004880][ T95] ? do_sys_open+0xe0/0xe0 [ 29.009323][ T95] ? __x64_sys_recvmsg+0x216/0x2d0 [ 29.014439][ T95] ? __kasan_check_write+0x14/0x20 [ 29.019556][ T95] __x64_sys_openat+0x136/0x160 [ 29.024408][ T95] do_syscall_64+0x31/0x40 [ 29.028828][ T95] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 29.034718][ T95] RIP: 0033:0x7f176d09e407 [ 29.039139][ T95] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 29.058748][ T95] RSP: 002b:00007ffce8d0dea0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 29.067171][ T95] RAX: ffffffffffffffda RBX: 00007f176cfb0880 RCX: 00007f176d09e407 [ 29.075152][ T95] RDX: 0000000000080000 RSI: 00007ffce8d0e020 RDI: ffffffffffffff9c [ 29.083124][ T95] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 [ 29.091096][ T95] R10: 0000000000000000 R11: 0000000000000202 R12: 000055ba5f15d7f5 [ 29.099073][ T95] R13: 000055ba5f15d7f5 R14: 0000000000000001 R15: 0000000000000000 [ 29.107061][ T20] CPU: 1 PID: 20 Comm: kworker/1:0 Not tainted syzkaller #0 [ 29.114360][ T20] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 29.120305][ T300] usb 3-1: USB disconnect, device number 2 [ 29.124568][ T20] Workqueue: ipv6_addrconf addrconf_dad_work [ 29.124588][ T20] Call Trace: [ 29.139707][ T20] __dump_stack+0x21/0x24 [ 29.144056][ T20] dump_stack_lvl+0x1a7/0x208 [ 29.148759][ T20] ? show_regs_print_info+0x18/0x18 [ 29.153980][ T20] ? thaw_kernel_threads+0x220/0x220 [ 29.159282][ T20] ? slab_free_freelist_hook+0xc5/0x190 [ 29.164852][ T20] print_address_description+0x7f/0x2c0 [ 29.170411][ T20] ? ncm_wrap_ntb+0xcfa/0xe40 [ 29.175101][ T20] kasan_report+0x100/0x140 [ 29.179621][ T20] ? ncm_wrap_ntb+0xcfa/0xe40 [ 29.184319][ T20] __asan_report_load4_noabort+0x14/0x20 [ 29.189971][ T20] ncm_wrap_ntb+0xcfa/0xe40 [ 29.194525][ T20] ? packet_rcv+0x16b/0x1330 [ 29.199135][ T20] eth_start_xmit+0x48d/0xd40 [ 29.203834][ T20] dev_hard_start_xmit+0x245/0x680 [ 29.208970][ T20] sch_direct_xmit+0x26d/0x990 [ 29.210154][ T24] kauditd_printk_skb: 51 callbacks suppressed [ 29.210185][ T24] audit: type=1400 audit(1786955344.950:125): avc: denied { unmount } for pid=281 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 29.213780][ T20] ? debug_smp_processor_id+0x17/0x20 [ 29.213821][ T20] ? stp_proto_unregister+0x200/0x200 [ 29.244686][ T315] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 29.245142][ T20] __qdisc_run+0xa3a/0x1400 [ 29.262452][ T20] qdisc_run+0x100/0x2f0 [ 29.266705][ T20] __dev_queue_xmit+0xbc6/0x2500 [ 29.271827][ T20] ? dev_queue_xmit+0x20/0x20 [ 29.276513][ T20] ? __local_bh_enable_ip+0x53/0x80 [ 29.281719][ T20] ? __local_bh_enable_ip+0x53/0x80 [ 29.286926][ T20] ? ipv6_chk_mcast_addr+0x3d1/0x3f0 [ 29.292214][ T20] ? ip6_finish_output2+0xcd0/0x1540 [ 29.297501][ T20] dev_queue_xmit+0x17/0x20 [ 29.302012][ T20] ip6_finish_output2+0xea9/0x1540 [ 29.307130][ T20] ? __ip6_finish_output+0x790/0x790 [ 29.312420][ T20] ? ip6table_mangle_hook+0x2c3/0x730 [ 29.317792][ T20] __ip6_finish_output+0x5fd/0x790 [ 29.322912][ T20] ip6_finish_output+0x33/0x1e0 [ 29.327789][ T20] ip6_output+0x1fa/0x420 [ 29.332122][ T20] ? ac6_seq_show+0xf0/0xf0 [ 29.336628][ T20] ? ip6_output+0x420/0x420 [ 29.341137][ T20] ? ip6table_filter_table_init+0xf0/0xf0 [ 29.346860][ T20] mld_sendpack+0x61e/0xb00 [ 29.351370][ T20] ? add_grec+0x1330/0x1330 [ 29.355875][ T20] ? add_grec+0xf67/0x1330 [ 29.360293][ T20] ? mld_send_report+0x1f0/0x1f0 [ 29.365241][ T20] ? _raw_spin_lock_irq+0xf0/0xf0 [ 29.370276][ T20] ? mod_delayed_work_on+0xd0/0xd0 [ 29.375423][ T20] mld_send_initial_cr+0x246/0x2b0 [ 29.380537][ T20] ipv6_mc_dad_complete+0x76/0x3c0 [ 29.385650][ T20] addrconf_dad_completed+0x74c/0xe30 [ 29.391026][ T20] ? addrconf_dad_stop+0x450/0x450 [ 29.396140][ T20] ? psi_group_change+0x7cb/0xe00 [ 29.401172][ T20] addrconf_dad_work+0xc5f/0x1480 [ 29.406201][ T20] ? _raw_spin_unlock_irq+0x4e/0x70 [ 29.411404][ T20] ? ipv6_get_saddr_eval+0xf70/0xf70 [ 29.416694][ T20] ? __switch_to_asm+0x3a/0x60 [ 29.421469][ T20] ? __kasan_check_read+0x11/0x20 [ 29.426500][ T20] ? read_word_at_a_time+0x12/0x20 [ 29.431616][ T20] ? strscpy+0x9b/0x290 [ 29.435772][ T20] process_one_work+0x6fd/0xbc0 [ 29.440628][ T20] worker_thread+0xa8e/0x13c0 [ 29.445312][ T20] kthread+0x324/0x3b0 [ 29.449385][ T20] ? worker_clr_flags+0x190/0x190 [ 29.454409][ T20] ? kthread_blkcg+0xd0/0xd0 [ 29.459004][ T20] ret_from_fork+0x1f/0x30 [ 29.463419][ T20] [ 29.465751][ T20] Allocated by task 84: [ 29.469913][ T20] __kasan_slab_alloc+0xb7/0xe0 [ 29.474763][ T20] slab_post_alloc_hook+0x5d/0x2f0 [ 29.479888][ T20] kmem_cache_alloc+0x15a/0x2d0 [ 29.484755][ T20] __alloc_skb+0x9e/0x520 [ 29.489117][ T20] ncm_wrap_ntb+0x3a0/0xe40 [ 29.493629][ T20] eth_start_xmit+0x48d/0xd40 [ 29.498324][ T20] dev_hard_start_xmit+0x245/0x680 [ 29.503472][ T20] sch_direct_xmit+0x26d/0x990 [ 29.508244][ T20] __qdisc_run+0xa3a/0x1400 [ 29.512751][ T20] qdisc_run+0x100/0x2f0 [ 29.517131][ T20] __dev_queue_xmit+0xbc6/0x2500 [ 29.522078][ T20] dev_queue_xmit+0x17/0x20 [ 29.526594][ T20] ip6_finish_output2+0xea9/0x1540 [ 29.531708][ T20] __ip6_finish_output+0x5fd/0x790 [ 29.536843][ T20] ip6_finish_output+0x33/0x1e0 [ 29.541706][ T20] ip6_output+0x1fa/0x420 [ 29.546044][ T20] mld_sendpack+0x61e/0xb00 [ 29.550558][ T20] mld_ifc_timer_expire+0x862/0xc60 [ 29.555785][ T20] call_timer_fn+0x38/0x290 [ 29.560293][ T20] __run_timers+0x637/0x9a0 [ 29.564803][ T20] run_timer_softirq+0x6a/0xf0 [ 29.569576][ T20] __do_softirq+0x255/0x563 [ 29.574076][ T20] [ 29.576404][ T20] Freed by task 315: [ 29.580303][ T20] kasan_set_track+0x4a/0x70 [ 29.584912][ T20] kasan_set_free_info+0x23/0x40 [ 29.589853][ T20] ____kasan_slab_free+0x125/0x160 [ 29.594977][ T20] __kasan_slab_free+0x11/0x20 [ 29.599746][ T20] slab_free_freelist_hook+0xc5/0x190 [ 29.605120][ T20] kmem_cache_free_bulk+0x4b3/0x6d0 [ 29.610317][ T20] __kfree_skb_flush+0xae/0x120 [ 29.615165][ T20] net_tx_action+0x32c/0x530 [ 29.619760][ T20] __do_softirq+0x255/0x563 [ 29.624255][ T20] [ 29.626586][ T20] The buggy address belongs to the object at ffff88811e542280 [ 29.626586][ T20] which belongs to the cache skbuff_head_cache of size 248 [ 29.641158][ T20] The buggy address is located 112 bytes inside of [ 29.641158][ T20] 248-byte region [ffff88811e542280, ffff88811e542378) [ 29.654432][ T20] The buggy address belongs to the page: [ 29.660093][ T20] page:ffffea0004795080 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11e542 [ 29.670329][ T20] flags: 0x4000000000000200(slab) [ 29.675363][ T20] raw: 4000000000000200 dead000000000100 dead000000000122 ffff888107d92a80 [ 29.683948][ T20] raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 [ 29.692529][ T20] page dumped because: kasan: bad access detected [ 29.699092][ T20] page_owner tracks the page as allocated [ 29.704821][ T20] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL), pid 84, ts 27624504248, free_ts 26740677449 [ 29.722093][ T20] prep_new_page+0x176/0x190 [ 29.726687][ T20] get_page_from_freelist+0x225f/0x23f0 [ 29.732230][ T20] __alloc_pages_nodemask+0x29a/0x640 [ 29.737602][ T20] new_slab+0x84/0x3f0 [ 29.741675][ T20] ___slab_alloc+0x2f8/0x4c0 [ 29.746265][ T20] __slab_alloc+0x63/0xa0 [ 29.750596][ T20] kmem_cache_alloc+0x1a4/0x2d0 [ 29.755453][ T20] __alloc_skb+0x9e/0x520 [ 29.759783][ T20] alloc_skb_with_frags+0xa3/0x560 [ 29.764897][ T20] sock_alloc_send_pskb+0x87f/0x9a0 [ 29.770095][ T20] sock_alloc_send_skb+0x32/0x40 [ 29.775035][ T20] mld_newpack+0x1a3/0x9c0 [ 29.779448][ T20] add_grec+0xedf/0x1330 [ 29.783691][ T20] mld_ifc_timer_expire+0x797/0xc60 [ 29.788909][ T20] call_timer_fn+0x38/0x290 [ 29.793417][ T20] __run_timers+0x637/0x9a0 [ 29.797915][ T20] page last free stack trace: [ 29.802598][ T20] free_unref_page_prepare+0x2b7/0x2d0 [ 29.808060][ T20] __free_pages+0x146/0x390 [ 29.812576][ T20] free_pages+0x82/0x90 [ 29.816732][ T20] kasan_depopulate_vmalloc_pte+0x6b/0x90 [ 29.822454][ T20] __apply_to_page_range+0x790/0xa20 [ 29.827741][ T20] apply_to_existing_page_range+0x38/0x50 [ 29.833460][ T20] kasan_release_vmalloc+0x97/0xb0 [ 29.838574][ T20] __purge_vmap_area_lazy+0x1326/0x1440 [ 29.844116][ T20] _vm_unmap_aliases+0x2ec/0x370 [ 29.849062][ T20] vm_unmap_aliases+0x19/0x20 [ 29.853743][ T20] change_page_attr_set_clr+0x317/0xc10 [ 29.859286][ T20] set_memory_ro+0x89/0xd0 [ 29.863704][ T20] bpf_int_jit_compile+0x8473/0x8930 [ 29.868996][ T20] bpf_prog_select_runtime+0x722/0x9c0 [ 29.874452][ T20] bpf_prepare_filter+0xfab/0x1150 [ 29.879564][ T20] __get_filter+0x2e2/0x410 [ 29.884263][ T20] [ 29.886595][ T20] Memory state around the buggy address: [ 29.892227][ T20] ffff88811e542180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.900286][ T20] ffff88811e542200: fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc [ 29.908371][ T20] >ffff88811e542280: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 29.916442][ T20] ^ [ 29.924163][ T20] ffff88811e542300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc [ 29.932221][ T20] ffff88811e542380: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 29.940276][ T20] ================================================================== [ 29.948333][ T20] Disabling lock debugging due to kernel taint [ 29.954536][ T20] general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN [ 29.966262][ T20] KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] [ 29.974676][ T20] CPU: 1 PID: 20 Comm: kworker/1:0 Tainted: G B syzkaller #0 [ 29.983343][ T20] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 29.993411][ T20] Workqueue: ipv6_addrconf addrconf_dad_work [ 29.999402][ T20] RIP: 0010:ncm_wrap_ntb+0x2a4/0xe40 [ 30.004688][ T20] Code: 48 c1 e8 03 80 3c 10 00 74 08 4c 89 f7 e8 34 36 90 fe 4d 8b 36 49 83 c6 70 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 73 0a 00 00 41 8b 06 48 8b 55 a8 41 8d 0c [ 30.024300][ T20] RSP: 0018:ffffc90000156f50 EFLAGS: 00010002 [ 30.030374][ T20] RAX: 000000000000000e RBX: ffff88810d788c00 RCX: dffffc0000000000 [ 30.038349][ T20] RDX: dffffc0000000000 RSI: 0000000000000001 RDI: 00000000ffffffff [ 30.046335][ T20] RBP: ffffc90000156fd0 R08: 0000000000000003 R09: 0000000000000004 [ 30.054316][ T20] R10: dffffc0000000000 R11: fffffbfff0dcf848 R12: 000000000000005a [ 30.062296][ T20] R13: ffffffff855862e0 R14: 0000000000000070 R15: 000000000000000c [ 30.070294][ T20] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 30.079345][ T20] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 30.085938][ T20] CR2: 00007fff72edfce0 CR3: 000000011dcdd000 CR4: 00000000003506a0 [ 30.093925][ T20] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 30.101907][ T20] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 30.109883][ T20] Call Trace: [ 30.113179][ T20] ? packet_rcv+0x16b/0x1330 [ 30.117771][ T20] eth_start_xmit+0x48d/0xd40 [ 30.122471][ T20] dev_hard_start_xmit+0x245/0x680 [ 30.127591][ T20] sch_direct_xmit+0x26d/0x990 [ 30.132364][ T20] ? debug_smp_processor_id+0x17/0x20 [ 30.137740][ T20] ? stp_proto_unregister+0x200/0x200 [ 30.143133][ T20] __qdisc_run+0xa3a/0x1400 [ 30.147650][ T20] qdisc_run+0x100/0x2f0 [ 30.151901][ T20] __dev_queue_xmit+0xbc6/0x2500 [ 30.156852][ T20] ? dev_queue_xmit+0x20/0x20 [ 30.161539][ T20] ? __local_bh_enable_ip+0x53/0x80 [ 30.166751][ T20] ? __local_bh_enable_ip+0x53/0x80 [ 30.171957][ T20] ? ipv6_chk_mcast_addr+0x3d1/0x3f0 [ 30.177252][ T20] ? ip6_finish_output2+0xcd0/0x1540 [ 30.182543][ T20] dev_queue_xmit+0x17/0x20 [ 30.187064][ T20] ip6_finish_output2+0xea9/0x1540 [ 30.192182][ T20] ? __ip6_finish_output+0x790/0x790 [ 30.197473][ T20] ? ip6table_mangle_hook+0x2c3/0x730 [ 30.202846][ T20] __ip6_finish_output+0x5fd/0x790 [ 30.207960][ T20] ip6_finish_output+0x33/0x1e0 [ 30.212818][ T20] ip6_output+0x1fa/0x420 [ 30.217160][ T20] ? ac6_seq_show+0xf0/0xf0 [ 30.221673][ T20] ? ip6_output+0x420/0x420 [ 30.226183][ T20] ? ip6table_filter_table_init+0xf0/0xf0 [ 30.231911][ T20] mld_sendpack+0x61e/0xb00 [ 30.236689][ T20] ? add_grec+0x1330/0x1330 [ 30.241195][ T20] ? add_grec+0xf67/0x1330 [ 30.245621][ T20] ? mld_send_report+0x1f0/0x1f0 [ 30.250568][ T20] ? _raw_spin_lock_irq+0xf0/0xf0 [ 30.255596][ T20] ? mod_delayed_work_on+0xd0/0xd0 [ 30.260711][ T20] mld_send_initial_cr+0x246/0x2b0 [ 30.265835][ T20] ipv6_mc_dad_complete+0x76/0x3c0 [ 30.270963][ T20] addrconf_dad_completed+0x74c/0xe30 [ 30.276367][ T20] ? addrconf_dad_stop+0x450/0x450 [ 30.281489][ T20] ? psi_group_change+0x7cb/0xe00 [ 30.286521][ T20] addrconf_dad_work+0xc5f/0x1480 [ 30.291560][ T20] ? _raw_spin_unlock_irq+0x4e/0x70 [ 30.296767][ T20] ? ipv6_get_saddr_eval+0xf70/0xf70 [ 30.302052][ T20] ? __switch_to_asm+0x3a/0x60 [ 30.306816][ T20] ? __kasan_check_read+0x11/0x20 [ 30.311864][ T20] ? read_word_at_a_time+0x12/0x20 [ 30.316980][ T20] ? strscpy+0x9b/0x290 [ 30.321143][ T20] process_one_work+0x6fd/0xbc0 [ 30.326009][ T20] worker_thread+0xa8e/0x13c0 [ 30.330807][ T20] kthread+0x324/0x3b0 [ 30.334885][ T20] ? worker_clr_flags+0x190/0x190 [ 30.339917][ T20] ? kthread_blkcg+0xd0/0xd0 [ 30.344522][ T20] ret_from_fork+0x1f/0x30 [ 30.348940][ T20] Modules linked in: [ 30.352863][ T20] ---[ end trace c74935929314bb66 ]--- [ 30.358336][ T20] RIP: 0010:ncm_wrap_ntb+0x2a4/0xe40 [ 30.363624][ T20] Code: 48 c1 e8 03 80 3c 10 00 74 08 4c 89 f7 e8 34 36 90 fe 4d 8b 36 49 83 c6 70 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 73 0a 00 00 41 8b 06 48 8b 55 a8 41 8d 0c [ 30.383235][ T20] RSP: 0018:ffffc90000156f50 EFLAGS: 00010002 [ 30.389306][ T20] RAX: 000000000000000e RBX: ffff88810d788c00 RCX: dffffc0000000000 [ 30.397286][ T20] RDX: dffffc0000000000 RSI: 0000000000000001 RDI: 00000000ffffffff [ 30.405263][ T20] RBP: ffffc90000156fd0 R08: 0000000000000003 R09: 0000000000000004 [ 30.413419][ T20] R10: dffffc0000000000 R11: fffffbfff0dcf848 R12: 000000000000005a [ 30.421396][ T20] R13: ffffffff855862e0 R14: 0000000000000070 R15: 000000000000000c [ 30.429370][ T20] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 30.438296][ T20] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 30.445125][ T20] CR2: 00007fff72edfce0 CR3: 000000011dcdd000 CR4: 00000000003506a0 [ 30.453119][ T20] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 30.461137][ T20] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 30.469207][ T20] Kernel panic - not syncing: Fatal exception in interrupt [ 30.476483][ T20] Kernel Offset: disabled [ 30.480812][ T20] Rebooting in 86400 seconds..