last executing test programs: 662.238203ms ago: executing program 3 (id=4): symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') syz_usb_connect$uac1(0x0, 0x72, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010003000000081e0405004000010203010902600003010c20070904000000010100000a240106000a000201020904010000010200000904010101010200000905010900020504042525010c9a018009040200000102000009040201010102000009058209000203984007250104050c6d8de5e9baf64135ec024ba31627d7ed"], &(0x7f0000000400)={0x0, 0x0, 0x5, &(0x7f0000000240)={0x5, 0xf, 0x5}}) symlinkat(&(0x7f0000000000)='.\x00', 0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00') r0 = inotify_init1(0x80800) inotify_add_watch(r0, &(0x7f0000000180)='./file0\x00', 0x10000000) inotify_add_watch(r0, &(0x7f0000000040)='./file1\x00', 0x80000308) 431.094318ms ago: executing program 2 (id=3): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {}, {0x0, 0xffff}}}, 0x24}}, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2b, 0x0, {{@in6=@loopback, @in6=@dev={0xfe, 0x80, '\x00', 0xf}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x200000000000}, {0x0, 0xa00, 0x407ffffffffffe, 0x800000000000002}, 0x1, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in=@empty, 0x0, 0x3c}, 0x2, @in=@broadcast, 0x6, 0x4, 0x1}]}]}, 0xfc}}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f00000002c0)={0xa, 0x4e23, 0x1, @mcast1, 0x6}, 0x1c) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0xfdff) 415.608279ms ago: executing program 2 (id=6): setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) userfaultfd(0x800) r0 = syz_usb_connect$uac1(0x0, 0x84, &(0x7f0000001c00)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x10, 0x47f, 0xc010, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x72, 0x3, 0x1, 0x0, 0x20, 0x5, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x0, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x6a4c, 0x6, 0x4}]}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0xc, 0x2, 0xf5, {0x7, 0x25, 0x1, 0x8, 0xd, 0x6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0xf2, 0x7d, 0x9, 0x3, 0xc}]}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x7, 0x9, 0x0, {0x7, 0x25, 0x1, 0x4, 0xff, 0x5}}}}}}}}]}}, &(0x7f0000001f40)={0xa, &(0x7f0000001d40)={0xa, 0x6, 0x250, 0x81, 0x8, 0x7, 0xff, 0x6}, 0x76, &(0x7f0000001d80)={0x5, 0xf, 0x76, 0x1, [@generic={0x71, 0x10, 0x4, "564394bedd26806130fffe690bf06c58cc19ff0c9dc0c61c62b72fdae0f44c1a5309cf1ce028e81fec0ecd9da472a189df581c2562938c814e49327b96aa57c11c153ac352a16490fab4e7e6dec7d33eaaa732eaefb7ebc361bada35280ca98fe433b02b9f32989d7090f9bd3975"}]}, 0x1, [{0x0, 0x0}]}) syz_usb_control_io$uac1(r0, 0x0, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) 292.339602ms ago: executing program 4 (id=5): bpf$MAP_CREATE(0x0, 0x0, 0x50) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340), 0x2000, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000000)) r1 = ioctl$TIOCGPTPEER(r0, 0x5441, 0x9) ioctl$TCSETSF2(r1, 0x402c542d, &(0x7f0000000100)={0x4, 0xffffffff, 0x1000002, 0x5, 0x7, "d0993d0554caddbd3a00", 0x5, 0x9}) write(r1, &(0x7f0000000180)="a788b9a48d1de6603c475fe3cfa8a27d7c8425073f756d1cefddc08a6dd4c4c0a5323f8f93d65682bc4974397001a396624e1bd23560952dee5736311e3d06e60f168e59f8a3125595ff42643b55d9addf2ea3fa011611a8c539558baf2581e9a8b722f2108f58cb3d552779ea51ba9462992a9156243c50c162d06280d116e26d280aacfb494b66c66bb4df665381440690afc4854f4a19db6357a3e57802de79c221ae7c5171faa19b3dc84934b452b1c81e98bf2eaeedca4e6cce792c6e01c592688acaefe150f0ffd163d3d54d4318b5df03be5916dd0fc3cbb297cc1cda81fbc3cc8c552216b48289eb4065a84e76d035c469ed7f879f1d522715f615d3d9b4e7b270b25837894d7609819a02fd202762975b2bf49910e57aea28e3632353f29711d460d5e85c5881f265e2372722654532bfb30b7ee54d40cafe09c96e65a6304a570ea8069fa0649f1bd6cbe5b2d8e42fa0ab835b4eae46e983df2fefa0b5e5bec1594ba024b6acef03fc561a86959e3b928c552b39845621b549746ea4157b0d", 0x184) 273.856883ms ago: executing program 0 (id=1): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x101800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x6) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe7000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000000)="dc622866b9800000c00f326635000100000f300f236cf2a4f20f320fd14dbe0f00996f00660f6eb28c00d8fb99", 0x2d}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f00000002c0)={0x1, 0x0, [{0x80000001, 0x0, 0x5, 0x19, 0x1000, 0x5, 0xfffffffd}]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 260.657343ms ago: executing program 4 (id=7): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0) 211.049564ms ago: executing program 4 (id=8): syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000280)='./file0\x00', 0x280440e, &(0x7f0000000540)={[{@debug}, {@test_dummy_encryption_v1}, {@inlinecrypt}, {@delalloc}, {@noinit_itable}, {@resgid}, {@minixdf}, {@stripe={'stripe', 0x3d, 0x5}}, {@nomblk_io_submit}, {@jqfmt_vfsv0}, {@noload}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x8}}]}, 0x1, 0xbdb, &(0x7f0000001000)="$eJzs3M1rHOcZAPBnRqsP23JXLqXUvVilFBtK17KLTG0KtYtLLz0U2mvBQl4ZofUHkoorWdBV8g+EJP9ALjkkJsGH+OxLArnmkjjXmBwCJihWAiEkCrMfkiztSpa1q1Hk3w9ezfsxM+/zaKSdeWF3A3hhDWc/0ojjEXEliSg2+tOI6KvVBiKq9f2WlxbGv1laGE9iZeVfXyaRRMSTpYXx5rmSxvZIozEQER/9NYmfv7x53pm5+amxSqU83Wifnr1+6/TM3PwfJq+PXStfK984c+5Po2dHz42cH+1Yrt9+dvH+17/5++fV7976/u5Xr72ZxMUYbIytz6OR9a4Nx/Dq72S9QkSMdeD8+0FPI5/1eSaFbQ5KuxwUAABtpeue4X4ZxeiJtYe3Yrz/ca7BAQAAAB2x0hOxAgAAABxwifU/AAAAHHDN9wE8WVoYb5Z835Gwtx5fioihev7LjVIfKUS1th2I3og4/CSJ9R9rTeqH7dpwRDz69Py7WYkWn0PutupiRPyq1fVPavkPNT4JvTH/NCJGOjD/8Ib2Tyn/ix2YP+/8AXgxPbhUv5Ftvv+lq88/0eL+V2hx73oeed//ms9/y5ue/9by72nz/PfPZ5zjTiFutxvL8v/z/b+90yzZ/Nl2V0ntwOPFiF8XWuWfrOaftMn/yjbnTqJ+iuIPt8vt9sk7/5U3Ik5G6/ybkq2/n+j0xGSlPFL/2XKOxQ9H3243f975Z9f/cJv8t7j+A1nfrafO1P5Lff5z+fK9TZ2N3bfPP/2iL/l3rdbX6Pnf2Ozs9JmIvuQfm/vPbp1vc5/mObL8T/126///Vn//2WtCtfG3kaWy2Nhm7Zc2zPmXu3feaxdPc/2X5/W/uvPrX+t75Rnn+N0Hr57a2Nf8fq3169+sZPM/SuprYQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABoSiNiMJK0FBFJrZ6mpVLEkYj4RRxOKzdnZn8/cfO/N65mYxFD0ZtOTFbKIxFRrLeTrH2mVl9rn93Q/mNEHIuI14uHau3S+M3K1byTBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYNWRiBiMJC1FRBoRy8U0LZXyjgoAAADouKG8AwAAAAC6zvofAAAADj7rfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALrs2IkHD5OIqF44VCuZvsZYb66RAd2W5h0AkJuevAMAclPIOwAgNztc43tcgAMo2WZ8oGVv9urR35V4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANifTh5/8DCJiOqFQ7WS6WuM9bY84sQeRgd0U5p3AEBuerYaLOxdHMDee+5/8aOdjQPYe63X+MCLJNlmfGBtn+rTI/1diwkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA/WewVpK0FBFprZ6mpVLE0YgYit5kYrJSHomIn0XEJ8Xe/qzdn3fQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdNzM3PzUWKVSnn6eSrK7w1VU2lX+vz/C2NtKUqsM5B1GvZL3KxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHmYmZufGqtUytMzeUcCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA5G1mbn5qrFIpTz9D5d5Odl5XyTtHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADy82MAAAD//1sCDDY=") syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x1860, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f0000000300)='./file0\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) fadvise64(r0, 0x2, 0xf4, 0x4) 210.598044ms ago: executing program 1 (id=9): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./debug\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)='1', 0x1) close(r0) 206.482214ms ago: executing program 1 (id=10): setsockopt$inet_mreq(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) madvise(&(0x7f000042f000/0x800000)=nil, 0x80fd00, 0x15) 115.777737ms ago: executing program 1 (id=11): rt_sigprocmask(0x0, &(0x7f000078b000)={[0xfffffffffffffffd]}, 0x0, 0x8) r0 = getpid() r1 = gettid() rt_tgsigqueueinfo(r0, r1, 0x1f, &(0x7f0000000080)={0x0, 0x10, 0x2}) r2 = signalfd(0xffffffffffffffff, &(0x7f00007aeff8)={[0xfffffffffffffffc]}, 0x8) read(r2, &(0x7f0000000740)=""/377, 0x179) 100.910257ms ago: executing program 1 (id=12): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000700000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r0, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f0000000200)=r1}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r2}, &(0x7f0000000180)=0x20000, &(0x7f00000001c0)=r1}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000580)={{r2}, &(0x7f0000000500)=0x2000000, &(0x7f0000000540)=r1}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000900)={{r0}, &(0x7f0000000800), &(0x7f0000000840)=r1}, 0x20) 64.882478ms ago: executing program 1 (id=13): r0 = socket$inet6(0xa, 0x3, 0x87) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x4) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2b, 0x0, {{@in6=@loopback, @in6=@dev={0xfe, 0x80, '\x00', 0xf}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x0, 0x0, 0x3c, 0xffffffffffffffff, 0x200000000000}, {0x0, 0xa00, 0x407ffffffffffe, 0x800000000000002}, 0x1, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@ipv4={'\x00', '\xff\xff', @loopback}, 0x0, 0x3c}, 0x2, @in=@broadcast, 0x6, 0x4, 0x1}]}]}, 0xfc}}, 0x0) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4e21, 0x7, @empty, 0x80000000}, 0x1c) 44.142359ms ago: executing program 0 (id=14): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f0000000180), 0x0, 0x0, {0x28}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) r1 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) sendfile(r1, r0, 0x0, 0x3a) 0s ago: executing program 1 (id=15): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./myconfig\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./myconfig\x00', &(0x7f0000000300)='configfs\x00', 0x2000000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./myconfig/usb_gadget/g1/functions/SourceSink.0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./myconfig/usb_gadget/g1/functions/SourceSink.0/pattern\x00', 0x1, 0x0) write$binfmt_misc(r0, &(0x7f0000000140)="5dfc96424a", 0x5) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 12.942859][ T28] kauditd_printk_skb: 16 callbacks suppressed [ 12.942870][ T28] audit: type=1400 audit(1786164939.383:59): avc: denied { transition } for pid=224 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.947007][ T28] audit: type=1400 audit(1786164939.383:60): avc: denied { noatsecure } for pid=224 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.949894][ T28] audit: type=1400 audit(1786164939.383:61): avc: denied { write } for pid=224 comm="sh" path="pipe:[14258]" dev="pipefs" ino=14258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 12.953024][ T28] audit: type=1400 audit(1786164939.383:62): avc: denied { rlimitinh } for pid=224 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.955702][ T28] audit: type=1400 audit(1786164939.383:63): avc: denied { siginh } for pid=224 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.921126][ T233] scp (233) used greatest stack depth: 22216 bytes left Warning: Permanently added '10.128.1.139' (ED25519) to the list of known hosts. [ 20.098484][ T28] audit: type=1400 audit(1786164946.543:64): avc: denied { mounton } for pid=280 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 20.099900][ T280] cgroup: Unknown subsys name 'net' [ 20.121161][ T28] audit: type=1400 audit(1786164946.543:65): avc: denied { mount } for pid=280 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.148450][ T28] audit: type=1400 audit(1786164946.573:66): avc: denied { unmount } for pid=280 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.148601][ T280] cgroup: Unknown subsys name 'devices' [ 20.289017][ T280] cgroup: Unknown subsys name 'hugetlb' [ 20.294635][ T280] cgroup: Unknown subsys name 'rlimit' [ 20.397159][ T28] audit: type=1400 audit(1786164946.833:67): avc: denied { setattr } for pid=280 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 20.420442][ T28] audit: type=1400 audit(1786164946.843:68): avc: denied { mounton } for pid=280 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 20.445255][ T28] audit: type=1400 audit(1786164946.843:69): avc: denied { mount } for pid=280 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 20.454053][ T282] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 20.477833][ T28] audit: type=1400 audit(1786164946.923:70): avc: denied { relabelto } for pid=282 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.503332][ T28] audit: type=1400 audit(1786164946.923:71): avc: denied { write } for pid=282 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.529312][ T280] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 20.529440][ T28] audit: type=1400 audit(1786164946.973:72): avc: denied { read } for pid=280 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.563508][ T28] audit: type=1400 audit(1786164946.973:73): avc: denied { open } for pid=280 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.537588][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.544666][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.552234][ T288] device bridge_slave_0 entered promiscuous mode [ 21.569603][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.576648][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.584047][ T288] device bridge_slave_1 entered promiscuous mode [ 21.625516][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.632713][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.640324][ T289] device bridge_slave_0 entered promiscuous mode [ 21.660262][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.667364][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.674792][ T289] device bridge_slave_1 entered promiscuous mode [ 21.757974][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.765023][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.772440][ T293] device bridge_slave_0 entered promiscuous mode [ 21.789237][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.796288][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.803778][ T293] device bridge_slave_1 entered promiscuous mode [ 21.824101][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.831361][ T292] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.838838][ T292] device bridge_slave_0 entered promiscuous mode [ 21.849228][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.856266][ T292] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.863721][ T292] device bridge_slave_1 entered promiscuous mode [ 21.879760][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.886818][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.894112][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.901144][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.918491][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.925550][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.933034][ T290] device bridge_slave_0 entered promiscuous mode [ 21.943350][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.950616][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.958148][ T290] device bridge_slave_1 entered promiscuous mode [ 22.081941][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.089027][ T292] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.096561][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.103786][ T292] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.122987][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.130090][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.137389][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.144497][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.162322][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.171937][ T201] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.180446][ T201] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.189254][ T201] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.196981][ T201] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.204378][ T201] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.212205][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 22.219790][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.237844][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.246136][ T201] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.253187][ T201] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.266433][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.295540][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.305529][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.313872][ T201] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.320969][ T201] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.349828][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.358328][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 22.365726][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.373256][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.381767][ T201] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.388811][ T201] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.396575][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.404867][ T201] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.411919][ T201] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.419607][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.427971][ T201] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.435337][ T201] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.457541][ T288] device veth0_vlan entered promiscuous mode [ 22.469894][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.478292][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.486202][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.494161][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.502562][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.510177][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.517902][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.525854][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.533982][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.545471][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 22.554151][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.562391][ T201] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.569427][ T201] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.577605][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 22.586007][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.594409][ T201] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.601496][ T201] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.620086][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 22.627923][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 22.636320][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.644936][ T201] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.652058][ T201] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.659578][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 22.668237][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.676373][ T201] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.683537][ T201] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.690918][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 22.699087][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.707031][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 22.715410][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.723673][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 22.736020][ T288] device veth1_macvtap entered promiscuous mode [ 22.745228][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 22.752916][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 22.761433][ T201] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.777591][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 22.785653][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.793974][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 22.802571][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.810694][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 22.818886][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.826783][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 22.834950][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.852380][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 22.860357][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.868379][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 22.876589][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.885070][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.893523][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.903798][ T289] device veth0_vlan entered promiscuous mode [ 22.915375][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.922903][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.936684][ T292] device veth0_vlan entered promiscuous mode [ 22.950426][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 22.959208][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.959345][ T288] request_module fs-gadgetfs succeeded, but still no fs? [ 22.968012][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 22.983391][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.992207][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.000378][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.008491][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.016765][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.025172][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.033176][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.041293][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.049609][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.058018][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.065468][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.072964][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.080408][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.092348][ T290] device veth0_vlan entered promiscuous mode [ 23.102580][ T289] device veth1_macvtap entered promiscuous mode [ 23.114638][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.123075][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.131273][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.139543][ T293] device veth0_vlan entered promiscuous mode [ 23.150141][ T292] device veth1_macvtap entered promiscuous mode [ 23.156846][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.164419][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.171983][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.180308][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.188712][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.202887][ T293] device veth1_macvtap entered promiscuous mode [ 23.210186][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.218419][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.226495][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.236329][ T290] device veth1_macvtap entered promiscuous mode [ 23.250668][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.258964][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.267027][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.275527][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.284004][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.292451][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.302939][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.311327][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.344220][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.356806][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.365262][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.373741][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.382344][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.390731][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.398893][ T39] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 23.399332][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.414884][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.423687][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.432192][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.507054][ T332] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 23.560742][ T338] loop4: detected capacity change from 0 to 4096 [ 23.569432][ T338] EXT4-fs: Ignoring removed nomblk_io_submit option [ 23.587138][ T39] usb 4-1: Using ep0 maxpacket: 8 [ 23.596346][ T338] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 23.597313][ T39] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 23.615787][ T39] usb 4-1: config 1 interface 1 altsetting 1 has an invalid endpoint descriptor of length 4, skipping [ 23.616281][ T338] EXT4-fs (loop4): Test dummy encryption mode enabled [ 23.630495][ T308] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 23.634985][ T39] usb 4-1: config 1 interface 1 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 23.662189][ T338] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=2842c198, mo2=0003] [ 23.666816][ T39] usb 4-1: New USB device found, idVendor=041e, idProduct=0005, bcdDevice= 0.40 [ 23.673043][ T338] System zones: 0-5 [ 23.680763][ T39] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 23.691632][ T39] usb 4-1: Product: syz [ 23.695798][ T39] usb 4-1: Manufacturer: syz [ 23.702090][ T39] usb 4-1: SerialNumber: syz [ 23.710367][ T335] ================================================================== [ 23.718442][ T335] BUG: KASAN: use-after-free in rcu_segcblist_enqueue+0x9c/0xb0 [ 23.726111][ T335] Write of size 8 at addr ffff888111ce0d90 by task syz.4.7/335 [ 23.732536][ T338] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 23.733840][ T335] [ 23.733856][ T335] CPU: 1 PID: 335 Comm: syz.4.7 Not tainted syzkaller #0 [ 23.752018][ T335] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 23.762094][ T335] Call Trace: [ 23.765374][ T335] [ 23.768312][ T335] __dump_stack+0x21/0x24 [ 23.772657][ T335] dump_stack_lvl+0x110/0x170 [ 23.777346][ T335] ? __cfi_dump_stack_lvl+0x8/0x8 [ 23.782386][ T335] ? rcu_segcblist_enqueue+0x9c/0xb0 [ 23.787680][ T335] print_address_description+0x71/0x200 [ 23.793224][ T335] print_report+0x4a/0x60 [ 23.797547][ T335] kasan_report+0x122/0x150 [ 23.802055][ T335] ? rcu_segcblist_enqueue+0x9c/0xb0 [ 23.807353][ T335] __asan_report_store8_noabort+0x17/0x20 [ 23.813062][ T335] rcu_segcblist_enqueue+0x9c/0xb0 [ 23.818171][ T335] call_rcu+0x554/0xf50 [ 23.822342][ T335] ? __cfi_call_rcu+0x10/0x10 [ 23.827011][ T335] ? __kasan_check_write+0x14/0x20 [ 23.832112][ T335] ? selinux_inode_free_security+0x21f/0x230 [ 23.838082][ T335] security_inode_free+0xc5/0xe0 [ 23.843007][ T335] __destroy_inode+0x175/0x500 [ 23.847755][ T335] evict+0x777/0x8c0 [ 23.851641][ T335] ? proc_nr_inodes+0x2f0/0x2f0 [ 23.856480][ T335] ? _raw_spin_lock+0x94/0xf0 [ 23.861146][ T335] ? __cfi__raw_spin_lock+0x10/0x10 [ 23.866341][ T335] ? __kasan_check_write+0x14/0x20 [ 23.871645][ T335] iput+0x633/0x690 [ 23.875453][ T335] dentry_unlink_inode+0x346/0x3f0 [ 23.880554][ T335] __dentry_kill+0x46c/0x680 [ 23.885134][ T335] dentry_kill+0xc0/0x2a0 [ 23.889453][ T335] dput+0x42/0x80 [ 23.893075][ T335] __fput+0x5c0/0x8f0 [ 23.897572][ T335] ____fput+0x15/0x20 [ 23.901545][ T335] task_work_run+0x1e1/0x250 [ 23.906120][ T335] ? __cfi_task_work_run+0x10/0x10 [ 23.911217][ T335] ? free_nsproxy+0x21f/0x270 [ 23.915910][ T335] do_exit+0xaf2/0x2850 [ 23.920057][ T335] ? __cfi_do_exit+0x10/0x10 [ 23.924653][ T335] ? xfd_validate_state+0x70/0x150 [ 23.929758][ T335] ? __kasan_check_write+0x14/0x20 [ 23.934869][ T335] __x64_sys_exit+0x40/0x40 [ 23.939362][ T335] x64_sys_call+0x67/0x9a0 [ 23.943764][ T335] do_syscall_64+0x4c/0xa0 [ 23.948169][ T335] ? clear_bhb_loop+0x30/0x80 [ 23.952828][ T335] ? clear_bhb_loop+0x30/0x80 [ 23.957485][ T335] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 23.963368][ T335] RIP: 0033:0x7faf3ad9e0d9 [ 23.967869][ T335] Code: Unable to access opcode bytes at 0x7faf3ad9e0af. [ 23.974864][ T335] RSP: 002b:00007faf3bd4aef8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 23.983258][ T335] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007faf3ad9e0d9 [ 23.991217][ T335] RDX: 00007faf3bd4b9c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 23.999290][ T335] RBP: 00007faf3ae35024 R08: 0000000000000000 R09: 0000000000000058 [ 24.007246][ T335] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 24.015297][ T335] R13: 00007faf3b026038 R14: 00007faf3b025fa0 R15: 00007ffd83e9fa98 [ 24.023264][ T335] [ 24.026353][ T335] [ 24.028664][ T335] Allocated by task 334: [ 24.032894][ T335] kasan_set_track+0x4b/0x70 [ 24.037500][ T335] kasan_save_alloc_info+0x1f/0x30 [ 24.042598][ T335] __kasan_kmalloc+0x95/0xb0 [ 24.047178][ T335] __kmalloc+0xb4/0x1e0 [ 24.051324][ T335] l2tp_session_create+0x38/0xbd0 [ 24.056338][ T335] pppol2tp_connect+0xbf5/0x1640 [ 24.061261][ T335] __sys_connect+0x3da/0x460 [ 24.065834][ T335] __x64_sys_connect+0x7a/0x90 [ 24.070617][ T335] x64_sys_call+0x88d/0x9a0 [ 24.075109][ T335] do_syscall_64+0x4c/0xa0 [ 24.079537][ T335] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 24.085418][ T335] [ 24.087724][ T335] Freed by task 8: [ 24.091429][ T335] kasan_set_track+0x4b/0x70 [ 24.096103][ T335] kasan_save_free_info+0x2b/0x40 [ 24.101127][ T335] ____kasan_slab_free+0x132/0x180 [ 24.106227][ T335] __kasan_slab_free+0x11/0x20 [ 24.110984][ T335] slab_free_freelist_hook+0xc2/0x190 [ 24.116350][ T335] __kmem_cache_free+0xb7/0x1b0 [ 24.121278][ T335] kfree+0x6f/0xf0 [ 24.124986][ T335] l2tp_session_put+0xaf/0x1a0 [ 24.129735][ T335] l2tp_session_delete+0x3df/0x4d0 [ 24.134828][ T335] l2tp_tunnel_del_work+0x199/0x410 [ 24.140010][ T335] process_one_work+0x717/0xc30 [ 24.144844][ T335] worker_thread+0xa4d/0x11d0 [ 24.149507][ T335] kthread+0x281/0x320 [ 24.153559][ T335] ret_from_fork+0x1f/0x30 [ 24.157958][ T335] [ 24.160266][ T335] Last potentially related work creation: [ 24.166044][ T335] kasan_save_stack+0x3a/0x60 [ 24.170708][ T335] __kasan_record_aux_stack+0xb6/0xc0 [ 24.176069][ T335] kasan_record_aux_stack_noalloc+0xb/0x10 [ 24.181859][ T335] call_rcu+0xcf/0xf50 [ 24.185913][ T335] pppol2tp_release+0x1e3/0x2b0 [ 24.190747][ T335] sock_close+0xc9/0x220 [ 24.194979][ T335] __fput+0x1fd/0x8f0 [ 24.198945][ T335] ____fput+0x15/0x20 [ 24.202911][ T335] task_work_run+0x1e1/0x250 [ 24.207486][ T335] do_exit+0xaf2/0x2850 [ 24.211630][ T335] __cfi___ia32_sys_exit+0x0/0x10 [ 24.216727][ T335] x64_sys_call+0x67/0x9a0 [ 24.221129][ T335] do_syscall_64+0x4c/0xa0 [ 24.225540][ T335] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 24.231424][ T335] [ 24.233734][ T335] The buggy address belongs to the object at ffff888111ce0c00 [ 24.233734][ T335] which belongs to the cache kmalloc-512 of size 512 [ 24.247797][ T335] The buggy address is located 400 bytes inside of [ 24.247797][ T335] 512-byte region [ffff888111ce0c00, ffff888111ce0e00) [ 24.261061][ T335] [ 24.263372][ T335] The buggy address belongs to the physical page: [ 24.269776][ T335] page:ffffea0004473800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x111ce0 [ 24.280004][ T335] head:ffffea0004473800 order:2 compound_mapcount:0 compound_pincount:0 [ 24.288306][ T335] flags: 0x4000000000010200(slab|head|zone=1) [ 24.294370][ T335] raw: 4000000000010200 0000000000000000 dead000000000001 ffff888100042f00 [ 24.302936][ T335] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 24.311496][ T335] page dumped because: kasan: bad access detected [ 24.317889][ T335] page_owner tracks the page as allocated [ 24.323592][ T335] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 104, tgid 104 (udevadm), ts 4994555795, free_ts 0 [ 24.343368][ T335] post_alloc_hook+0x1f5/0x210 [ 24.348125][ T335] prep_new_page+0x1c/0x110 [ 24.352614][ T335] get_page_from_freelist+0x2ca9/0x2d20 [ 24.358144][ T335] __alloc_pages+0x1fa/0x610 [ 24.362718][ T335] alloc_slab_page+0x6e/0xf0 [ 24.367308][ T335] new_slab+0x98/0x3e0 [ 24.371500][ T335] ___slab_alloc+0x70f/0xb70 [ 24.376074][ T335] __slab_alloc+0x5e/0xa0 [ 24.380388][ T335] __kmem_cache_alloc_node+0x204/0x2d0 [ 24.385830][ T335] __kmalloc_node_track_caller+0xa1/0x1e0 [ 24.391529][ T335] __alloc_skb+0x226/0x4a0 [ 24.395927][ T335] alloc_uevent_skb+0x85/0x240 [ 24.400670][ T335] kobject_uevent_net_broadcast+0x343/0x5b0 [ 24.406553][ T335] kobject_uevent_env+0x541/0x720 [ 24.411563][ T335] kobject_synth_uevent+0x457/0x940 [ 24.416751][ T335] uevent_store+0x4b/0x70 [ 24.421090][ T335] page_owner free stack trace missing [ 24.426532][ T335] [ 24.428837][ T335] Memory state around the buggy address: [ 24.434443][ T335] ffff888111ce0c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.442484][ T335] ffff888111ce0d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.450528][ T335] >ffff888111ce0d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.458562][ T335] ^ [ 24.463132][ T335] ffff888111ce0e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.471174][ T335] ffff888111ce0e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 24.479213][ T335] ================================================================== [ 24.487249][ T335] Disabling lock debugging due to kernel taint [ 24.517509][ T308] usb 3-1: Using ep0 maxpacket: 16 [ 24.527601][ T308] usb 3-1: string descriptor 0 read error: -22 [ 24.536438][ T308] usb 3-1: New USB device found, idVendor=047f, idProduct=c010, bcdDevice= 0.40 [ 24.546445][ T308] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 24.581384][ T338] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 24.594824][ T338] fscrypt: AES-256-XTS using blk-crypto-fallback [ 24.632854][ T293] EXT4-fs (loop4): unmounting filesystem. [ 24.707696][ T39] usb 4-1: USB disconnect, device number 2 [ 24.759084][ T308] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 24.917545][ T312] udevd[312]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.1/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 24.967529][ T308] usb 3-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 24.976886][ T308] usb 3-1: USB disconnect, device number 2 [ 24.985911][ T313] udevd[313]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory