Warning: Permanently added '[localhost]:29285' (ED25519) to the list of known hosts. [ 42.973159][ T43] kauditd_printk_skb: 19 callbacks suppressed [ 42.973173][ T43] audit: type=1400 audit(1785709263.306:138): avc: denied { execute } for pid=5733 comm="sh" name="syz-execprog" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 42.982864][ T43] audit: type=1400 audit(1785709263.316:139): avc: denied { execute_no_trans } for pid=5733 comm="sh" path="/syz-execprog" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 2026/08/02 22:21:04 parsed 1 programs 2026/08/02 22:21:04 serving rpc on tcp://40063 [ 44.098342][ T43] audit: type=1400 audit(1785709264.426:140): avc: denied { node_bind } for pid=5733 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 44.106733][ T43] audit: type=1400 audit(1785709264.436:141): avc: denied { node_bind } for pid=5733 comm="syz-execprog" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 46.312427][ T43] audit: type=1400 audit(1785709266.646:142): avc: denied { mounton } for pid=5743 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 46.320617][ T43] audit: type=1400 audit(1785709266.646:143): avc: denied { mount } for pid=5743 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 46.322658][ T5743] cgroup: Unknown subsys name 'net' [ 46.330771][ T43] audit: type=1400 audit(1785709266.666:144): avc: denied { unmount } for pid=5743 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 46.504454][ T5743] cgroup: Unknown subsys name 'cpuset' [ 46.508552][ T5743] cgroup: Unknown subsys name 'rlimit' [ 46.696688][ T43] audit: type=1400 audit(1785709267.026:145): avc: denied { setattr } for pid=5743 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=850 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 46.703943][ T43] audit: type=1400 audit(1785709267.026:146): avc: denied { create } for pid=5743 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 46.710329][ T43] audit: type=1400 audit(1785709267.026:147): avc: denied { write } for pid=5743 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 46.760053][ T5746] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 47.497759][ T5743] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 49.177326][ T43] kauditd_printk_skb: 11 callbacks suppressed [ 49.177338][ T43] audit: type=1400 audit(1785709269.506:159): avc: denied { execmem } for pid=5750 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 49.186143][ T43] audit: type=1400 audit(1785709269.516:160): avc: denied { create } for pid=5751 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 49.192374][ T43] audit: type=1400 audit(1785709269.516:161): avc: denied { read write } for pid=5751 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1292 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 49.193416][ T5753] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 49.199740][ T43] audit: type=1400 audit(1785709269.516:162): avc: denied { open } for pid=5751 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1292 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 49.199780][ T43] audit: type=1400 audit(1785709269.526:163): avc: denied { ioctl } for pid=5751 comm="syz-executor" path="socket:[3051]" dev="sockfs" ino=3051 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 49.217913][ T5753] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 49.220484][ T5753] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 49.224557][ T5753] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 49.227702][ T5753] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 49.233747][ T43] audit: type=1400 audit(1785709269.566:164): avc: denied { read } for pid=5751 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 49.242068][ T43] audit: type=1400 audit(1785709269.566:165): avc: denied { open } for pid=5751 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 49.250807][ T43] audit: type=1400 audit(1785709269.566:166): avc: denied { mounton } for pid=5751 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 49.285418][ T43] audit: type=1400 audit(1785709269.616:167): avc: denied { mount } for pid=5751 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 49.294141][ T43] audit: type=1400 audit(1785709269.616:168): avc: denied { mounton } for pid=5751 comm="syz-executor" path="/syzkaller.l2I0A5/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 49.311627][ T5751] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 49.702290][ T108] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.705834][ T108] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.724747][ T1165] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.727250][ T1165] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.413051][ T5782] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.416624][ T5782] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.419487][ T5782] bridge_slave_0: entered allmulticast mode [ 50.423825][ T5782] bridge_slave_0: entered promiscuous mode [ 50.431193][ T5782] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.433321][ T5782] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.435544][ T5782] bridge_slave_1: entered allmulticast mode [ 50.438493][ T5782] bridge_slave_1: entered promiscuous mode [ 50.455008][ T5782] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 50.460279][ T5782] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 50.503465][ T5782] team0: Port device team_slave_0 added [ 50.508959][ T5782] team0: Port device team_slave_1 added [ 50.523351][ T5782] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 50.525597][ T5782] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 50.534550][ T5782] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 50.539646][ T5782] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 50.541875][ T5782] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 50.549784][ T5782] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 50.585394][ T5782] hsr_slave_0: entered promiscuous mode [ 50.588201][ T5782] hsr_slave_1: entered promiscuous mode [ 50.701778][ T5782] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 50.709561][ T5782] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 50.712812][ T5782] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 50.717800][ T5782] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 50.723412][ T5782] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 50.727994][ T5782] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 50.731368][ T5782] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 50.734920][ T5782] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 50.779455][ T5782] 8021q: adding VLAN 0 to HW filter on device bond0 [ 50.790246][ T5782] 8021q: adding VLAN 0 to HW filter on device team0 [ 50.796095][ T1165] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.798515][ T1165] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.805687][ T1165] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.807772][ T1165] bridge0: port 2(bridge_slave_1) entered forwarding state [ 51.012133][ T5782] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 51.047387][ T5782] veth0_vlan: entered promiscuous mode [ 51.053922][ T5782] veth1_vlan: entered promiscuous mode [ 51.070800][ T5782] veth0_macvtap: entered promiscuous mode [ 51.074622][ T5782] veth1_macvtap: entered promiscuous mode [ 51.085789][ T5782] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 51.091622][ T5782] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 51.130868][ T5774] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.134364][ T5774] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.137343][ T5774] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.140173][ T5774] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.207101][ T5774] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 51.282811][ T5774] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 51.377868][ T5774] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 51.454322][ T5774] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2026/08/02 22:21:12 executed programs: 0 [ 52.463427][ T64] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 52.467451][ T64] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 52.470909][ T64] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 52.474250][ T64] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 52.476775][ T64] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 52.768184][ T5864] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.770643][ T5864] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.772862][ T5864] bridge_slave_0: entered allmulticast mode [ 52.775444][ T5864] bridge_slave_0: entered promiscuous mode [ 52.780050][ T5864] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.782743][ T5864] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.784959][ T5864] bridge_slave_1: entered allmulticast mode [ 52.787581][ T5864] bridge_slave_1: entered promiscuous mode [ 52.804042][ T5864] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 52.808831][ T5864] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 52.824716][ T5864] team0: Port device team_slave_0 added [ 52.829244][ T5864] team0: Port device team_slave_1 added [ 52.847355][ T5864] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 52.850264][ T5864] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 52.860334][ T5864] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 52.867028][ T5864] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 52.869135][ T5864] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 52.876916][ T5864] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 52.900169][ T5864] hsr_slave_0: entered promiscuous mode [ 52.902707][ T5864] hsr_slave_1: entered promiscuous mode [ 52.904876][ T5864] debugfs: 'hsr0' already exists in 'hsr' [ 52.906711][ T5864] Cannot create hsr debugfs directory [ 54.531710][ T64] Bluetooth: hci0: command tx timeout [ 54.769639][ T5774] bridge_slave_1: left allmulticast mode [ 54.772081][ T5774] bridge_slave_1: left promiscuous mode [ 54.775098][ T5774] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.779948][ T5774] bridge_slave_0: left allmulticast mode [ 54.782384][ T5774] bridge_slave_0: left promiscuous mode [ 54.784245][ T5774] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.871386][ T5774] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 54.876486][ T5774] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 54.879957][ T5774] bond0 (unregistering): Released all slaves [ 54.957718][ T43] kauditd_printk_skb: 20 callbacks suppressed [ 54.957730][ T43] audit: type=1400 audit(1785709275.286:189): avc: denied { write } for pid=5884 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 54.966938][ T43] audit: type=1400 audit(1785709275.286:190): avc: denied { create } for pid=5884 comm="dhcpcd-run-hook" name="resolv.conf.eth2.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 54.973770][ T43] audit: type=1400 audit(1785709275.286:191): avc: denied { write } for pid=5884 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf.eth2.link" dev="tmpfs" ino=2033 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 54.981663][ T43] audit: type=1400 audit(1785709275.286:192): avc: denied { append } for pid=5884 comm="dhcpcd-run-hook" name="resolv.conf.eth2.link" dev="tmpfs" ino=2033 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 55.005435][ T43] audit: type=1400 audit(1785709275.336:193): avc: denied { write } for pid=5887 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 55.012460][ T43] audit: type=1400 audit(1785709275.336:194): avc: denied { unlink } for pid=5887 comm="rm" name="resolv.conf.eth2.link" dev="tmpfs" ino=2033 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 55.023264][ T5774] hsr_slave_0: left promiscuous mode [ 55.025390][ T5774] hsr_slave_1: left promiscuous mode [ 55.027389][ T5774] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 55.029730][ T5774] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 55.034793][ T5774] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 55.037129][ T5774] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 55.044988][ T5774] veth1_macvtap: left promiscuous mode [ 55.047077][ T5774] veth0_macvtap: left promiscuous mode [ 55.048808][ T5774] veth1_vlan: left promiscuous mode [ 55.050426][ T5774] veth0_vlan: left promiscuous mode [ 55.165484][ T5774] team0 (unregistering): Port device team_slave_1 removed [ 55.173073][ T5774] team0 (unregistering): Port device team_slave_0 removed [ 55.221434][ T5449] 8021q: adding VLAN 0 to HW filter on device eth2 [ 55.344324][ T43] audit: type=1400 audit(1785709275.676:195): avc: denied { write } for pid=5891 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 55.383441][ T43] audit: type=1400 audit(1785709275.716:196): avc: denied { write } for pid=5894 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 55.443224][ T43] audit: type=1400 audit(1785709275.766:197): avc: denied { write } for pid=5896 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 55.485093][ T43] audit: type=1400 audit(1785709275.816:198): avc: denied { write } for pid=5899 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 55.515673][ T5864] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 55.520989][ T5864] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 55.524402][ T5864] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 55.529116][ T5864] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 55.532658][ T5864] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 55.540819][ T5864] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 55.544535][ T5864] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 55.549490][ T5864] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 55.589042][ T5864] 8021q: adding VLAN 0 to HW filter on device bond0 [ 55.599303][ T5864] 8021q: adding VLAN 0 to HW filter on device team0 [ 55.604497][ T108] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.607027][ T108] bridge0: port 1(bridge_slave_0) entered forwarding state [ 55.616032][ T108] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.618939][ T108] bridge0: port 2(bridge_slave_1) entered forwarding state [ 56.092851][ T5864] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 56.114182][ T5864] veth0_vlan: entered promiscuous mode [ 56.119826][ T5864] veth1_vlan: entered promiscuous mode [ 56.142343][ T5864] veth0_macvtap: entered promiscuous mode [ 56.146228][ T5864] veth1_macvtap: entered promiscuous mode [ 56.156296][ T5864] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 56.163491][ T5864] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 56.205362][ T1173] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 56.207935][ T1173] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 56.223399][ T1173] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 56.225896][ T1173] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 56.240790][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.244667][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.260773][ T5774] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.265006][ T5774] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.292003][ T5917] [ 56.292832][ T5917] ============================= [ 56.294403][ T5917] WARNING: suspicious RCU usage [ 56.296193][ T5917] syzkaller #0 Not tainted [ 56.297631][ T5917] ----------------------------- [ 56.299166][ T5917] net/xfrm/xfrm_user.c:1630 suspicious rcu_dereference_check() usage! [ 56.301638][ T5917] [ 56.301638][ T5917] other info that might help us debug this: [ 56.301638][ T5917] [ 56.304691][ T5917] [ 56.304691][ T5917] rcu_scheduler_active = 2, debug_locks = 1 [ 56.307088][ T5917] 1 lock held by syz.0.17/5917: [ 56.308554][ T5917] #0: ffff88805401c390 (&net->xfrm.xfrm_cfg_mutex){+.+.}-{4:4}, at: xfrm_netlink_rcv+0x62/0x90 [ 56.311833][ T5917] [ 56.311833][ T5917] stack backtrace: [ 56.313696][ T5917] CPU: 3 UID: 0 PID: 5917 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 56.313710][ T5917] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 56.313717][ T5917] Call Trace: [ 56.313733][ T5917] [ 56.313737][ T5917] dump_stack_lvl+0x100/0x190 [ 56.313753][ T5917] lockdep_rcu_suspicious.cold+0x4f/0xb1 [ 56.313772][ T5917] xfrm_do_migrate_state+0x2463/0x2f10 [ 56.313790][ T5917] ? __pfx_xfrm_do_migrate_state+0x10/0x10 [ 56.313803][ T5917] ? __asan_memset+0x23/0x50 [ 56.313814][ T5917] ? __nla_validate_parse+0x1e7/0x28b0 [ 56.313834][ T5917] ? __nla_parse+0x40/0x60 [ 56.313844][ T5917] ? __pfx_xfrm_do_migrate_state+0x10/0x10 [ 56.313859][ T5917] ? xfrm_user_rcv_msg+0x483/0xd80 [ 56.313869][ T5917] xfrm_user_rcv_msg+0x483/0xd80 [ 56.313882][ T5917] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 56.313894][ T5917] ? kfree_skbmem+0x19f/0x210 [ 56.313904][ T5917] ? consume_skb+0xd6/0x110 [ 56.313931][ T5917] ? rcu_is_watching+0x12/0xc0 [ 56.313947][ T5917] ? trace_contention_end+0x126/0x160 [ 56.313962][ T5917] ? __mutex_lock+0x26d/0x1bd0 [ 56.313977][ T5917] netlink_rcv_skb+0x159/0x420 [ 56.313990][ T5917] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 56.314002][ T5917] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 56.314020][ T5917] xfrm_netlink_rcv+0x71/0x90 [ 56.314030][ T5917] netlink_unicast+0x585/0x850 [ 56.314043][ T5917] ? __pfx_netlink_unicast+0x10/0x10 [ 56.314054][ T5917] ? __pfx_sock_has_perm+0x10/0x10 [ 56.314072][ T5917] netlink_sendmsg+0x8b0/0xda0 [ 56.314085][ T5917] ? __pfx_netlink_sendmsg+0x10/0x10 [ 56.314097][ T5917] ? selinux_socket_sendmsg+0x198/0x2f0 [ 56.314114][ T5917] ____sys_sendmsg+0xa4d/0xbe0 [ 56.314130][ T5917] ? __pfx_netlink_sendmsg+0x10/0x10 [ 56.314142][ T5917] ? __pfx_____sys_sendmsg+0x10/0x10 [ 56.314158][ T5917] ? futex_hash+0x311/0x400 [ 56.314173][ T5917] ? futex_hash+0x31b/0x400 [ 56.314186][ T5917] ? futex_hash+0x79/0x400 [ 56.314198][ T5917] ? __pfx_get_futex_key+0x10/0x10 [ 56.314213][ T5917] ___sys_sendmsg+0x190/0x1e0 [ 56.314225][ T5917] ? __pfx____sys_sendmsg+0x10/0x10 [ 56.314235][ T5917] ? futex_wake+0x220/0x5e0 [ 56.314253][ T5917] ? __pfx___handle_mm_fault+0x10/0x10 [ 56.314276][ T5917] ? __pfx_do_futex+0x10/0x10 [ 56.314290][ T5917] ? find_held_lock+0x2b/0x80 [ 56.314299][ T5917] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 56.314314][ T5917] __sys_sendmsg+0x160/0x210 [ 56.314328][ T5917] ? __pfx___sys_sendmsg+0x10/0x10 [ 56.314347][ T5917] do_syscall_64+0x115/0x870 [ 56.314360][ T5917] ? clear_bhb_loop+0x40/0x90 [ 56.314373][ T5917] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 56.314384][ T5917] RIP: 0033:0x7f7f9e19e019 [ 56.314395][ T5917] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 56.314405][ T5917] RSP: 002b:00007ffceb177058 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 56.314423][ T5917] RAX: ffffffffffffffda RBX: 00007f7f9e425fa0 RCX: 00007f7f9e19e019 [ 56.314429][ T5917] RDX: 0000000000000000 RSI: 0000200000000500 RDI: 0000000000000003 [ 56.314436][ T5917] RBP: 00007f7f9e23500c R08: 0000000000000000 R09: 0000000000000000 [ 56.314442][ T5917] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 56.314447][ T5917] R13: 00007f7f9e425fac R14: 00007f7f9e425fa0 R15: 00007f7f9e425fa0 [ 56.314460][ T5917] [ 57.818651][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 59.112165][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 59.330500][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 59.402971][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 59.527378][ T12] bridge_slave_1: left allmulticast mode [ 59.530642][ T12] bridge_slave_1: left promiscuous mode [ 59.532538][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.536184][ T12] bridge_slave_0: left allmulticast mode [ 59.538021][ T12] bridge_slave_0: left promiscuous mode [ 59.539844][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.610122][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 59.615176][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 59.618747][ T12] bond0 (unregistering): Released all slaves [ 59.742907][ T5449] 8021q: adding VLAN 0 to HW filter on device eth2 [ 59.898263][ T5449] 8021q: adding VLAN 0 to HW filter on device eth3 [ 59.925060][ T12] hsr_slave_0: left promiscuous mode [ 59.927754][ T12] hsr_slave_1: left promiscuous mode [ 59.930387][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 59.933286][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 59.937104][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 59.939470][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 59.945990][ T12] veth1_macvtap: left promiscuous mode [ 59.947846][ T12] veth0_macvtap: left promiscuous mode [ 59.949631][ T12] veth1_vlan: left promiscuous mode [ 59.951396][ T12] veth0_vlan: left promiscuous mode [ 59.966621][ T43] kauditd_printk_skb: 7 callbacks suppressed [ 59.966632][ T43] audit: type=1400 audit(1785709280.296:206): avc: denied { write } for pid=5943 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 60.006182][ T43] audit: type=1400 audit(1785709280.336:207): avc: denied { write } for pid=5946 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 60.062789][ T12] team0 (unregistering): Port device team_slave_1 removed [ 60.070282][ T12] team0 (unregistering): Port device team_slave_0 removed [ 60.126970][ T5449] 8021q: adding VLAN 0 to HW filter on device eth4 [ 60.206807][ T43] audit: type=1400 audit(1785709280.536:208): avc: denied { write } for pid=5950 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 60.247723][ T43] audit: type=1400 audit(1785709280.576:209): avc: denied { write } for pid=5953 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 60.291985][ T5449] 8021q: adding VLAN 0 to HW filter on device eth5