last executing test programs: 796.822479ms ago: executing program 0 (id=1): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$inet6_tcp(0xa, 0x1, 0x0) socket$pptp(0x18, 0x1, 0x2) r3 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000000)={0x2, {0xc, 0xa00, 0xffff, 0x181, 0x100}}) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x50, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r4, 0x6, 0x0, 0x0, 0x0) fsmount(r4, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) prctl$PR_SET_SECUREBITS(0x1c, 0x2c) setuid(0x0) setresuid(0x0, 0x0, 0xee00) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) 559.847925ms ago: executing program 1 (id=2): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) read(r0, &(0x7f0000000080)=""/41, 0x29) 390.98933ms ago: executing program 2 (id=3): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'syz_tun\x00', &(0x7f0000002fc0)=@ethtool_modinfo={0x42, 0x3, 0x3}}) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = syz_open_procfs(0x0, 0x0) read$FUSE(r2, 0x0, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r3, 0x0, 0x0) personality(0x8) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000002100)={0xffffffffffffffff, 0xffffffffffffffff}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r5, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='smaps\x00') madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) lseek(r7, 0x289e0cb5, 0x100000000000000) 142.610096ms ago: executing program 4 (id=5): r0 = socket(0x40000000015, 0x5, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x80003, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, 0xffff7fff}, 0x1c) 51.016208ms ago: executing program 4 (id=6): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000020c0)={r0, 0x0, 0x3, 0x0, &(0x7f0000000100)="e0b954", 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8000}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) writev(0xffffffffffffffff, &(0x7f00000027c0)=[{&(0x7f00000001c0)}], 0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x16, 0x3, &(0x7f00000000c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="180000000300000000000000"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x20000000}, 0x94) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000010}, 0x8041) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = syz_open_procfs(0x0, &(0x7f0000002040)='net/snmp6\x00') read$FUSE(r4, &(0x7f0000000000)={0x2020}, 0xfffffc7a) 0s ago: executing program 3 (id=4): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) kernel console output (not intermixed with test programs): tclass=process permissive=1 [ 15.089208][ T30] audit: type=1400 audit(1785978715.630:63): avc: denied { siginh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.6' (ED25519) to the list of known hosts. [ 22.369107][ T30] audit: type=1400 audit(1785978722.950:64): avc: denied { mounton } for pid=277 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.372276][ T277] cgroup: Unknown subsys name 'net' [ 22.391845][ T30] audit: type=1400 audit(1785978722.950:65): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.419159][ T30] audit: type=1400 audit(1785978722.980:66): avc: denied { unmount } for pid=277 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.419600][ T277] cgroup: Unknown subsys name 'devices' [ 22.595721][ T277] cgroup: Unknown subsys name 'hugetlb' [ 22.601347][ T277] cgroup: Unknown subsys name 'rlimit' [ 22.710293][ T30] audit: type=1400 audit(1785978723.290:67): avc: denied { setattr } for pid=277 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.733483][ T30] audit: type=1400 audit(1785978723.290:68): avc: denied { mounton } for pid=277 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.758293][ T30] audit: type=1400 audit(1785978723.290:69): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.776719][ T279] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 22.790221][ T30] audit: type=1400 audit(1785978723.370:70): avc: denied { relabelto } for pid=279 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.815859][ T30] audit: type=1400 audit(1785978723.370:71): avc: denied { write } for pid=279 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.848409][ T30] audit: type=1400 audit(1785978723.430:72): avc: denied { read } for pid=277 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.874060][ T30] audit: type=1400 audit(1785978723.430:73): avc: denied { open } for pid=277 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.874093][ T277] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.622772][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.629959][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.637637][ T285] device bridge_slave_0 entered promiscuous mode [ 23.645767][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.652819][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.660300][ T285] device bridge_slave_1 entered promiscuous mode [ 23.745197][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.752304][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.759745][ T289] device bridge_slave_0 entered promiscuous mode [ 23.772667][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.779764][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.787137][ T289] device bridge_slave_1 entered promiscuous mode [ 23.813543][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.820678][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.828150][ T288] device bridge_slave_0 entered promiscuous mode [ 23.837567][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.844659][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.851981][ T288] device bridge_slave_1 entered promiscuous mode [ 23.884130][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.891197][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.898640][ T286] device bridge_slave_0 entered promiscuous mode [ 23.905380][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.912434][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.919870][ T287] device bridge_slave_0 entered promiscuous mode [ 23.926946][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.934129][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.941538][ T287] device bridge_slave_1 entered promiscuous mode [ 23.948072][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.955250][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.962769][ T286] device bridge_slave_1 entered promiscuous mode [ 24.096029][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.103099][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.110429][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.117481][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.155257][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.162572][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.171649][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.179278][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.186831][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.195149][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.203291][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.210347][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.217948][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.226407][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.234609][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.241627][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.249068][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.268717][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.276713][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.305220][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.319374][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.327581][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.334642][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.342102][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.350411][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.357450][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.388526][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.396308][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.404727][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.434031][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.442197][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.450002][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.460000][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.468224][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.475314][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.482748][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.491208][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.498303][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.505696][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.513956][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.520991][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.528477][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.536618][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.543637][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.551120][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.559148][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.567204][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.575215][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.583155][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.590872][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.598704][ T285] device veth0_vlan entered promiscuous mode [ 24.614253][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.625026][ T285] device veth1_macvtap entered promiscuous mode [ 24.633423][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.649700][ T287] device veth0_vlan entered promiscuous mode [ 24.665549][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.673482][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.682226][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.690997][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.698761][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.706616][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.714708][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.722120][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.729822][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.738373][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.746561][ T289] device veth0_vlan entered promiscuous mode [ 24.766981][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.775329][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.783632][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.792153][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.800688][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.809112][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.817358][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.824435][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.831850][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.840348][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.848588][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.855625][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.862971][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.871491][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.879905][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.888411][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.896542][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.904371][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.911761][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.921881][ T288] device veth0_vlan entered promiscuous mode [ 24.932478][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.941029][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.951746][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.959986][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.968866][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.977151][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.989780][ T287] device veth1_macvtap entered promiscuous mode [ 24.997909][ T289] device veth1_macvtap entered promiscuous mode [ 25.005275][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.013029][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.014008][ T285] request_module fs-gadgetfs succeeded, but still no fs? [ 25.022058][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.036345][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.069771][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.078977][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.087803][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.096214][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.105068][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.113335][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.164847][ T286] device veth0_vlan entered promiscuous mode [ 25.334563][ T286] device veth1_macvtap entered promiscuous mode [ 25.466060][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.482840][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.491590][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.500187][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.508931][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.517281][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.525636][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.537965][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.551710][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.564275][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.579625][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.593413][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.607975][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.623783][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.632154][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.649534][ T288] device veth1_macvtap entered promiscuous mode [ 25.662145][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.681092][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.694746][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.728636][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.738266][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.747585][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.768367][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.963892][ C1] ================================================================== [ 25.972010][ C1] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x6c/0xb0 [ 25.979424][ C1] Read of size 8 at addr ffff88810e16d990 by task syz.4.6/326 [ 25.986901][ C1] [ 25.989263][ C1] CPU: 1 PID: 326 Comm: syz.4.6 Not tainted syzkaller #0 [ 25.996306][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.006399][ C1] Call Trace: [ 26.009710][ C1] [ 26.012574][ C1] __dump_stack+0x21/0x30 [ 26.016944][ C1] dump_stack_lvl+0x110/0x170 [ 26.021652][ C1] ? show_regs_print_info+0x20/0x20 [ 26.026873][ C1] ? load_image+0x3f0/0x3f0 [ 26.031416][ C1] print_address_description+0x7f/0x2c0 [ 26.036989][ C1] ? rcu_cblist_dequeue+0x6c/0xb0 [ 26.042037][ C1] kasan_report+0x10f/0x150 [ 26.046591][ C1] ? rcu_cblist_dequeue+0x6c/0xb0 [ 26.051732][ C1] __asan_report_load8_noabort+0x14/0x20 [ 26.057477][ C1] rcu_cblist_dequeue+0x6c/0xb0 [ 26.062351][ C1] rcu_do_batch+0x47d/0xbf0 [ 26.066885][ C1] ? local_bh_enable+0x20/0x20 [ 26.071702][ C1] ? __kasan_check_write+0x14/0x20 [ 26.076867][ C1] ? _raw_spin_lock_irqsave+0xc2/0x130 [ 26.082371][ C1] ? _raw_spin_lock+0xf0/0xf0 [ 26.087086][ C1] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 26.092930][ C1] ? rcu_report_qs_rnp+0x2bc/0x390 [ 26.098072][ C1] rcu_core+0x4a3/0xef0 [ 26.102245][ C1] ? rcu_cpu_kthread_park+0x90/0x90 [ 26.107488][ C1] ? run_rebalance_domains+0xf7/0x1c0 [ 26.112895][ C1] rcu_core_si+0x9/0x10 [ 26.117115][ C1] handle_softirqs+0x250/0x560 [ 26.121918][ C1] ? irqtime_account_irq+0xbe/0x390 [ 26.127148][ C1] __irq_exit_rcu+0x52/0xf0 [ 26.131667][ C1] irq_exit_rcu+0x9/0x10 [ 26.135924][ C1] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 26.141579][ C1] [ 26.144526][ C1] [ 26.147473][ C1] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 26.153484][ C1] RIP: 0010:x2apic_send_IPI+0x74/0xc0 [ 26.158894][ C1] Code: f0 48 c1 e8 03 42 0f b6 04 20 84 c0 75 38 41 0f b7 16 0f ae f0 0f ae e8 83 fb 02 b8 00 04 00 00 0f 45 c3 b9 30 08 00 00 0f 30 <66> 90 5b 41 5c 41 5e 41 5f 5d c3 48 c7 c7 a0 0f 6d 86 4c 89 f6 e8 [ 26.178525][ C1] RSP: 0018:ffffc900078f7918 EFLAGS: 00000206 [ 26.184628][ C1] RAX: 00000000000000fb RBX: 00000000000000fb RCX: 0000000000000830 [ 26.192616][ C1] RDX: 0000000000000000 RSI: 00000000000000fb RDI: 0000000000000000 [ 26.200616][ C1] RBP: ffffc900078f7938 R08: ffff8881f7038ec7 R09: 1ffff1103ee071d8 [ 26.208696][ C1] R10: dffffc0000000000 R11: ffffed103ee071d9 R12: dffffc0000000000 [ 26.216694][ C1] R13: 1ffff92000f1ef38 R14: ffff8881f7021158 R15: ffffffff85e9a840 [ 26.224694][ C1] native_send_call_func_single_ipi+0x5e/0x70 [ 26.230808][ C1] send_call_function_single_ipi+0xdd/0x180 [ 26.236737][ C1] generic_exec_single+0x236/0x3a0 [ 26.241880][ C1] ? smp_call_function_single+0x490/0x490 [ 26.247633][ C1] smp_call_function_single_async+0x81/0x110 [ 26.253639][ C1] rdmsr_safe_on_cpu+0x12e/0x260 [ 26.258607][ C1] ? wrmsr_on_cpus+0x40/0x40 [ 26.263210][ C1] ? rdmsr_safe_on_cpu+0x260/0x260 [ 26.268358][ C1] ? __kasan_check_read+0x11/0x20 [ 26.273441][ C1] ? _copy_to_user+0x78/0x90 [ 26.278079][ C1] msr_read+0x108/0x1b0 [ 26.282285][ C1] ? msr_device_destroy+0x20/0x20 [ 26.287356][ C1] ? security_file_permission+0x83/0xa0 [ 26.292931][ C1] ? msr_device_destroy+0x20/0x20 [ 26.297993][ C1] vfs_read+0x28c/0xc20 [ 26.302173][ C1] ? kernel_read+0x1f0/0x1f0 [ 26.306793][ C1] ? __fget_files+0x2e1/0x340 [ 26.311525][ C1] ? __fdget_pos+0x1f7/0x380 [ 26.316202][ C1] ? ksys_read+0x70/0x260 [ 26.320572][ C1] ksys_read+0x14a/0x260 [ 26.324947][ C1] ? vfs_write+0xfd0/0xfd0 [ 26.329388][ C1] ? __kasan_check_write+0x14/0x20 [ 26.334610][ C1] ? switch_fpu_return+0x15d/0x2c0 [ 26.339742][ C1] __x64_sys_read+0x7b/0x90 [ 26.344287][ C1] x64_sys_call+0x96d/0x9a0 [ 26.348819][ C1] do_syscall_64+0x4c/0xa0 [ 26.353260][ C1] ? clear_bhb_loop+0x50/0xa0 [ 26.357974][ C1] ? clear_bhb_loop+0x50/0xa0 [ 26.362677][ C1] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 26.368606][ C1] RIP: 0033:0x7fcb550dd0d9 [ 26.373062][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 26.392705][ C1] RSP: 002b:00007fcb53b36028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 26.401147][ C1] RAX: ffffffffffffffda RBX: 00007fcb55364fa0 RCX: 00007fcb550dd0d9 [ 26.409133][ C1] RDX: 0000000000018ff8 RSI: 0000200000019680 RDI: 0000000000000003 [ 26.417151][ C1] RBP: 00007fcb55174024 R08: 0000000000000000 R09: 0000000000000000 [ 26.425191][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 26.433188][ C1] R13: 00007fcb55365038 R14: 00007fcb55364fa0 R15: 00007fff507bbcc8 [ 26.441190][ C1] [ 26.444246][ C1] [ 26.446593][ C1] Allocated by task 330: [ 26.450951][ C1] __kasan_kmalloc+0xd4/0x100 [ 26.455657][ C1] __kmalloc+0x13d/0x2c0 [ 26.459928][ C1] l2tp_session_create+0x39/0xb60 [ 26.464977][ C1] pppol2tp_connect+0xbf5/0x1640 [ 26.469943][ C1] __sys_connect+0x3cb/0x450 [ 26.474560][ C1] __x64_sys_connect+0x7a/0x90 [ 26.479353][ C1] x64_sys_call+0x7c/0x9a0 [ 26.483804][ C1] do_syscall_64+0x4c/0xa0 [ 26.488255][ C1] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 26.494186][ C1] [ 26.496529][ C1] Freed by task 306: [ 26.500437][ C1] kasan_set_track+0x4a/0x70 [ 26.505052][ C1] kasan_set_free_info+0x23/0x40 [ 26.510152][ C1] ____kasan_slab_free+0x125/0x160 [ 26.515295][ C1] __kasan_slab_free+0x11/0x20 [ 26.520072][ C1] slab_free_freelist_hook+0xc2/0x190 [ 26.525463][ C1] kfree+0xc4/0x270 [ 26.529296][ C1] l2tp_session_put+0xaf/0x1a0 [ 26.534093][ C1] l2tp_session_delete+0x3a9/0x4a0 [ 26.539226][ C1] l2tp_tunnel_del_work+0x180/0x3d0 [ 26.544452][ C1] process_one_work+0x6c8/0xbb0 [ 26.549320][ C1] worker_thread+0xaa0/0x1250 [ 26.554063][ C1] kthread+0x3f5/0x4f0 [ 26.558173][ C1] ret_from_fork+0x1f/0x30 [ 26.562614][ C1] [ 26.564977][ C1] Last potentially related work creation: [ 26.570818][ C1] kasan_save_stack+0x3a/0x60 [ 26.575544][ C1] __kasan_record_aux_stack+0xd2/0x100 [ 26.581033][ C1] kasan_record_aux_stack_noalloc+0xb/0x10 [ 26.586868][ C1] call_rcu+0x10b/0xf60 [ 26.591039][ C1] pppol2tp_release+0x1e3/0x2b0 [ 26.595905][ C1] sock_close+0xb8/0x200 [ 26.600169][ C1] __fput+0x22b/0x900 [ 26.604175][ C1] ____fput+0x15/0x20 [ 26.608184][ C1] task_work_run+0x127/0x190 [ 26.612795][ C1] exit_to_user_mode_loop+0xd0/0xe0 [ 26.618039][ C1] exit_to_user_mode_prepare+0x87/0xd0 [ 26.623520][ C1] syscall_exit_to_user_mode+0x1a/0x30 [ 26.629051][ C1] do_syscall_64+0x58/0xa0 [ 26.633489][ C1] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 26.639403][ C1] [ 26.641759][ C1] The buggy address belongs to the object at ffff88810e16d800 [ 26.641759][ C1] which belongs to the cache kmalloc-512 of size 512 [ 26.655837][ C1] The buggy address is located 400 bytes inside of [ 26.655837][ C1] 512-byte region [ffff88810e16d800, ffff88810e16da00) [ 26.669292][ C1] The buggy address belongs to the page: [ 26.674949][ C1] page:ffffea0004385b00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10e16c [ 26.685214][ C1] head:ffffea0004385b00 order:2 compound_mapcount:0 compound_pincount:0 [ 26.693572][ C1] flags: 0x4000000000010200(slab|head|zone=1) [ 26.699669][ C1] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100042f00 [ 26.708269][ C1] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 26.716877][ C1] page dumped because: kasan: bad access detected [ 26.723306][ C1] page_owner tracks the page as allocated [ 26.729050][ C1] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 102, ts 4870906704, free_ts 0 [ 26.747142][ C1] post_alloc_hook+0x192/0x1b0 [ 26.751931][ C1] prep_new_page+0x1c/0x110 [ 26.756454][ C1] get_page_from_freelist+0x2c3a/0x2cd0 [ 26.762029][ C1] __alloc_pages+0x1a2/0x460 [ 26.766649][ C1] new_slab+0xa0/0x4d0 [ 26.770738][ C1] ___slab_alloc+0x3ac/0x840 [ 26.775350][ C1] __slab_alloc+0x49/0x90 [ 26.779705][ C1] __kmalloc_track_caller+0x169/0x2c0 [ 26.785096][ C1] __alloc_skb+0x210/0x730 [ 26.789543][ C1] alloc_uevent_skb+0x85/0x240 [ 26.794333][ C1] kobject_uevent_net_broadcast+0x335/0x5a0 [ 26.800256][ C1] kobject_uevent_env+0x52b/0x700 [ 26.805304][ C1] kobject_synth_uevent+0x457/0x940 [ 26.810529][ C1] bus_uevent_store+0x4f/0x70 [ 26.815249][ C1] bus_attr_store+0x79/0xa0 [ 26.819763][ C1] sysfs_kf_write+0x129/0x150 [ 26.824485][ C1] page_owner free stack trace missing [ 26.829845][ C1] [ 26.832162][ C1] Memory state around the buggy address: [ 26.837772][ C1] ffff88810e16d880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.845871][ C1] ffff88810e16d900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.853945][ C1] >ffff88810e16d980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.862009][ C1] ^ [ 26.866606][ C1] ffff88810e16da00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.874669][ C1] ffff88810e16da80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.882740][ C1] ================================================================== [ 26.890789][ C1] Disabling lock debugging due to kernel taint [ 26.896972][ C1] sched: RT throttling activated