last executing test programs: 401.659712ms ago: executing program 3 (id=4): r0 = socket$packet(0x11, 0x2, 0x300) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000440)=@framed, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) uname(0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) r2 = socket(0x2b, 0x5, 0x800) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000000)={'ip6tnl0\x00', 0x0}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = timerfd_create(0x9, 0x80000) timerfd_gettime(r3, &(0x7f0000000040)) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000002c0)='hrtimer_start\x00', r4}, 0x3d) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000100)={0x0, 0x0}, 0x10) 236.259358ms ago: executing program 3 (id=6): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000001b80)=ANY=[@ANYBLOB="0600000004000000080000000a"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xf, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000780)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000400)='kfree\x00', r4, 0x0, 0xfffffffffffffffe}, 0x18) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x80) 132.261798ms ago: executing program 1 (id=2): bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[], 0x48) r0 = socket(0x10, 0x3, 0x6) r1 = socket(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0900000004000000080000000b"], 0x48) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000400)='kfree\x00', r2, 0x0, 0x5}, 0x18) sendmsg$nl_route_sched(r1, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x20008010) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x100002, 0x3, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = gettid() process_vm_writev(r3, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0x7ffff000}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) 125.723718ms ago: executing program 2 (id=3): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x40000) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCMIWAIT(r2, 0x5453, 0x0) 56.930244ms ago: executing program 4 (id=5): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x40000) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b5181100", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCMIWAIT(r2, 0x5453, 0x0) 0s ago: executing program 0 (id=1): ioctl$IMADDTIMER(0xffffffffffffffff, 0x80044940, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) socket(0x80000000000000a, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000006c0)='fdinfo/3\x00') sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@newtclass={0x24, 0x28, 0x4, 0x70bd26, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x9, 0x4}, {0x7, 0xb}, {0xb, 0xf}}}, 0x24}}, 0x80000) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="64000000100001042abd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="918003000000000f300001800b00010065727370616e0000200002800400120006000f007f000000060010004e200000060011004e200000140003006e696376663000"/76], 0x64}}, 0x10) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0xb, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r3}, 0x10) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b000000e3af190000000000000000d927be7ae26395280400000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000380)=ANY=[@ANYBLOB="9aa29ab66f245d2c18000000080000e300040000b23f0000180000000800000000000000090000008d9100"/56], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x6, '\x00', 0x0, @fallback=0xc, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) chmod(0x0, 0x184) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYRESOCT=r2], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', 0xffffffffffffffff, 0x0, 0x7}, 0x18) r4 = add_key$keyring(&(0x7f00000004c0), &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) r5 = add_key$user(&(0x7f0000000ec0), &(0x7f0000000f00)={'syz', 0x1}, &(0x7f0000000240)='J', 0x1, r4) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f0000000000)='asymmetric\x00', &(0x7f0000000080)=@keyring={'key_or_keyring:', r5}) kernel console output (not intermixed with test programs): [ 23.023696][ T29] audit: type=1400 audit(1767394676.809:62): avc: denied { search } for pid=3198 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 23.045808][ T29] audit: type=1400 audit(1767394676.809:63): avc: denied { search } for pid=3198 comm="dhcpcd-run-hook" name="dhcpcd" dev="tmpfs" ino=477 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 23.068378][ T29] audit: type=1400 audit(1767394676.809:64): avc: denied { search } for pid=3198 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=482 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 23.091291][ T29] audit: type=1400 audit(1767394676.809:65): avc: denied { search } for pid=3198 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=483 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 23.114695][ T29] audit: type=1400 audit(1767394676.809:66): avc: denied { read open } for pid=3199 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=483 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '10.128.0.242' (ED25519) to the list of known hosts. [ 27.674094][ T29] kauditd_printk_skb: 3 callbacks suppressed [ 27.674111][ T29] audit: type=1400 audit(1767394681.459:70): avc: denied { mounton } for pid=3301 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 27.704587][ T29] audit: type=1400 audit(1767394681.489:71): avc: denied { mount } for pid=3301 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 27.707090][ T3301] cgroup: Unknown subsys name 'net' [ 27.733154][ T29] audit: type=1400 audit(1767394681.529:72): avc: denied { unmount } for pid=3301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 27.848904][ T3301] cgroup: Unknown subsys name 'cpuset' [ 27.855336][ T3301] cgroup: Unknown subsys name 'rlimit' [ 28.006402][ T29] audit: type=1400 audit(1767394681.789:73): avc: denied { setattr } for pid=3301 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 28.038149][ T29] audit: type=1400 audit(1767394681.799:74): avc: denied { create } for pid=3301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 28.059536][ T29] audit: type=1400 audit(1767394681.799:75): avc: denied { write } for pid=3301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 28.080724][ T29] audit: type=1400 audit(1767394681.799:76): avc: denied { read } for pid=3301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 28.100838][ T3306] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 28.102069][ T29] audit: type=1400 audit(1767394681.809:77): avc: denied { mounton } for pid=3301 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 28.135522][ T29] audit: type=1400 audit(1767394681.809:78): avc: denied { mount } for pid=3301 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 28.159311][ T29] audit: type=1400 audit(1767394681.819:79): avc: denied { read } for pid=3045 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 28.190779][ T3301] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 29.411385][ T3315] chnl_net:caif_netlink_parms(): no params data found [ 29.423284][ T3313] chnl_net:caif_netlink_parms(): no params data found [ 29.490592][ T3316] chnl_net:caif_netlink_parms(): no params data found [ 29.543678][ T3315] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.550798][ T3315] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.558027][ T3315] bridge_slave_0: entered allmulticast mode [ 29.564711][ T3315] bridge_slave_0: entered promiscuous mode [ 29.576581][ T3314] chnl_net:caif_netlink_parms(): no params data found [ 29.593636][ T3315] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.600888][ T3315] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.608194][ T3315] bridge_slave_1: entered allmulticast mode [ 29.614876][ T3315] bridge_slave_1: entered promiscuous mode [ 29.646011][ T3313] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.653423][ T3313] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.660841][ T3313] bridge_slave_0: entered allmulticast mode [ 29.667345][ T3313] bridge_slave_0: entered promiscuous mode [ 29.676294][ T3313] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.683428][ T3313] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.690726][ T3313] bridge_slave_1: entered allmulticast mode [ 29.697357][ T3313] bridge_slave_1: entered promiscuous mode [ 29.719344][ T3320] chnl_net:caif_netlink_parms(): no params data found [ 29.734784][ T3315] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.761549][ T3315] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.772996][ T3316] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.780196][ T3316] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.787395][ T3316] bridge_slave_0: entered allmulticast mode [ 29.794037][ T3316] bridge_slave_0: entered promiscuous mode [ 29.804761][ T3316] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.812014][ T3316] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.819184][ T3316] bridge_slave_1: entered allmulticast mode [ 29.825719][ T3316] bridge_slave_1: entered promiscuous mode [ 29.833341][ T3313] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.865379][ T3313] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.898578][ T3315] team0: Port device team_slave_0 added [ 29.904317][ T3314] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.911715][ T3314] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.919147][ T3314] bridge_slave_0: entered allmulticast mode [ 29.925939][ T3314] bridge_slave_0: entered promiscuous mode [ 29.936938][ T3316] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.952186][ T3315] team0: Port device team_slave_1 added [ 29.957959][ T3314] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.965043][ T3314] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.972676][ T3314] bridge_slave_1: entered allmulticast mode [ 29.979102][ T3314] bridge_slave_1: entered promiscuous mode [ 29.988934][ T3316] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.998858][ T3313] team0: Port device team_slave_0 added [ 30.024539][ T3313] team0: Port device team_slave_1 added [ 30.054941][ T3315] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.062168][ T3315] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.088989][ T3315] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.101864][ T3314] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.111431][ T3320] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.118667][ T3320] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.125919][ T3320] bridge_slave_0: entered allmulticast mode [ 30.132588][ T3320] bridge_slave_0: entered promiscuous mode [ 30.139899][ T3316] team0: Port device team_slave_0 added [ 30.151923][ T3315] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.159075][ T3315] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.185607][ T3315] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.198170][ T3314] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.207758][ T3320] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.214930][ T3320] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.222565][ T3320] bridge_slave_1: entered allmulticast mode [ 30.229210][ T3320] bridge_slave_1: entered promiscuous mode [ 30.236307][ T3316] team0: Port device team_slave_1 added [ 30.242628][ T3313] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.249735][ T3313] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.275976][ T3313] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.305267][ T3313] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.312343][ T3313] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.338839][ T3313] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.370114][ T3314] team0: Port device team_slave_0 added [ 30.376737][ T3320] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.387802][ T3320] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.402413][ T3316] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.409509][ T3316] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.436316][ T3316] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.448216][ T3314] team0: Port device team_slave_1 added [ 30.480624][ T3316] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.487728][ T3316] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.513956][ T3316] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.542851][ T3315] hsr_slave_0: entered promiscuous mode [ 30.549304][ T3315] hsr_slave_1: entered promiscuous mode [ 30.558325][ T3314] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.565649][ T3314] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.591690][ T3314] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.609021][ T3320] team0: Port device team_slave_0 added [ 30.615702][ T3320] team0: Port device team_slave_1 added [ 30.622377][ T3314] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.629357][ T3314] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.655583][ T3314] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.668900][ T3313] hsr_slave_0: entered promiscuous mode [ 30.675374][ T3313] hsr_slave_1: entered promiscuous mode [ 30.681432][ T3313] debugfs: 'hsr0' already exists in 'hsr' [ 30.687614][ T3313] Cannot create hsr debugfs directory [ 30.721636][ T3320] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.728651][ T3320] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.754786][ T3320] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.782042][ T3320] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.789835][ T3320] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.816590][ T3320] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.834693][ T3316] hsr_slave_0: entered promiscuous mode [ 30.841310][ T3316] hsr_slave_1: entered promiscuous mode [ 30.847639][ T3316] debugfs: 'hsr0' already exists in 'hsr' [ 30.853755][ T3316] Cannot create hsr debugfs directory [ 30.883188][ T3314] hsr_slave_0: entered promiscuous mode [ 30.889440][ T3314] hsr_slave_1: entered promiscuous mode [ 30.895303][ T3314] debugfs: 'hsr0' already exists in 'hsr' [ 30.901303][ T3314] Cannot create hsr debugfs directory [ 30.956282][ T3320] hsr_slave_0: entered promiscuous mode [ 30.962824][ T3320] hsr_slave_1: entered promiscuous mode [ 30.969046][ T3320] debugfs: 'hsr0' already exists in 'hsr' [ 30.974791][ T3320] Cannot create hsr debugfs directory [ 31.133939][ T3315] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 31.143233][ T3315] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 31.154847][ T3315] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 31.163993][ T3315] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 31.184956][ T3313] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 31.194220][ T3313] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 31.205321][ T3313] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 31.223274][ T3313] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 31.243582][ T3316] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 31.254542][ T3316] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 31.264053][ T3316] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 31.277852][ T3316] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 31.310398][ T3314] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 31.321215][ T3314] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 31.333220][ T3314] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 31.344559][ T3314] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 31.386297][ T3320] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 31.395743][ T3320] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 31.405605][ T3320] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 31.415287][ T3320] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 31.456811][ T3315] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.486287][ T3313] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.505671][ T3315] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.518814][ T3313] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.528777][ T3314] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.544411][ T1891] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.551542][ T1891] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.565588][ T1891] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.572720][ T1891] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.581897][ T1891] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.588981][ T1891] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.598199][ T1891] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.605255][ T1891] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.615458][ T3316] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.642672][ T3314] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.664447][ T1891] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.671743][ T1891] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.681891][ T3316] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.694166][ T1891] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.701490][ T1891] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.710540][ T1891] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.717697][ T1891] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.738155][ T1891] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.745473][ T1891] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.780943][ T3320] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.803762][ T3316] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 31.814258][ T3316] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 31.874689][ T3320] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.892420][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.899540][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.916152][ T55] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.923291][ T55] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.939068][ T3315] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.956689][ T3313] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.999684][ T3316] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 32.053136][ T3314] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 32.163114][ T3320] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 32.171900][ T3313] veth0_vlan: entered promiscuous mode [ 32.188965][ T3313] veth1_vlan: entered promiscuous mode [ 32.230870][ T3313] veth0_macvtap: entered promiscuous mode [ 32.256009][ T3315] veth0_vlan: entered promiscuous mode [ 32.262934][ T3314] veth0_vlan: entered promiscuous mode [ 32.270093][ T3313] veth1_macvtap: entered promiscuous mode [ 32.288521][ T3315] veth1_vlan: entered promiscuous mode [ 32.299378][ T3314] veth1_vlan: entered promiscuous mode [ 32.313121][ T3313] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 32.340928][ T3315] veth0_macvtap: entered promiscuous mode [ 32.349074][ T3313] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 32.368044][ T3314] veth0_macvtap: entered promiscuous mode [ 32.374857][ T3315] veth1_macvtap: entered promiscuous mode [ 32.386561][ T3316] veth0_vlan: entered promiscuous mode [ 32.393863][ T386] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.406777][ T3314] veth1_macvtap: entered promiscuous mode [ 32.413495][ T386] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.426994][ T3315] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 32.443603][ T3316] veth1_vlan: entered promiscuous mode [ 32.450968][ T386] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.460458][ T3320] veth0_vlan: entered promiscuous mode [ 32.471105][ T3315] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 32.479107][ T386] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.495300][ T3314] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 32.505201][ T3314] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 32.519422][ T3320] veth1_vlan: entered promiscuous mode [ 32.526796][ T1891] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.543794][ T55] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.555836][ T55] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.580659][ T3316] veth0_macvtap: entered promiscuous mode [ 32.591027][ T55] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.603181][ T3320] veth0_macvtap: entered promiscuous mode [ 32.610210][ T3313] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 32.621371][ T3320] veth1_macvtap: entered promiscuous mode [ 32.632698][ T55] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.642309][ T3316] veth1_macvtap: entered promiscuous mode [ 32.663444][ T55] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.693075][ T29] kauditd_printk_skb: 22 callbacks suppressed [ 32.693094][ T29] audit: type=1400 audit(1767394686.479:102): avc: denied { create } for pid=3483 comm="syz.3.4" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 32.705455][ T3320] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 32.734885][ T29] audit: type=1400 audit(1767394686.519:103): avc: denied { prog_load } for pid=3483 comm="syz.3.4" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 32.753941][ T29] audit: type=1400 audit(1767394686.519:104): avc: denied { bpf } for pid=3483 comm="syz.3.4" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 32.755987][ T3316] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 32.774265][ T29] audit: type=1400 audit(1767394686.519:105): avc: denied { perfmon } for pid=3483 comm="syz.3.4" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 32.802200][ T29] audit: type=1400 audit(1767394686.519:106): avc: denied { prog_run } for pid=3483 comm="syz.3.4" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 32.821902][ T29] audit: type=1400 audit(1767394686.519:107): avc: denied { create } for pid=3483 comm="syz.3.4" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 32.824941][ T3316] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 32.841460][ T29] audit: type=1400 audit(1767394686.519:108): avc: denied { wake_alarm } for pid=3483 comm="syz.3.4" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 32.841490][ T29] audit: type=1400 audit(1767394686.519:109): avc: denied { setopt } for pid=3483 comm="syz.3.4" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 32.893831][ T55] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.907245][ T55] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.907292][ T55] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.907329][ T55] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.907434][ T55] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.907476][ T55] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.943574][ T3320] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 32.952107][ T386] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.952288][ T386] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.952439][ T386] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.952689][ T386] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.953711][ T29] audit: type=1400 audit(1767394686.729:110): avc: denied { map_create } for pid=3490 comm="syz.1.2" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 32.973597][ T29] audit: type=1400 audit(1767394686.749:111): avc: denied { create } for pid=3490 comm="syz.1.2" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 33.005138][ C0] hrtimer: interrupt took 37188 ns [ 33.073805][ T3497] ================================================================== [ 33.073849][ T3497] BUG: KCSAN: data-race in __mod_timer / __mod_timer [ 33.073901][ T3497] [ 33.073909][ T3497] write to 0xffff88811aaaf180 of 8 bytes by task 3420 on cpu 1: [ 33.073927][ T3497] __mod_timer+0x784/0x840 [ 33.073958][ T3497] mod_timer+0x1f/0x30 [ 33.073989][ T3497] wg_timers_any_authenticated_packet_traversal+0xd0/0x100 [ 33.074027][ T3497] wg_packet_rx_poll+0x7f5/0x1160 [ 33.074045][ T3497] __napi_poll+0x5f/0x300 [ 33.074078][ T3497] napi_threaded_poll_loop+0x1ac/0x630 [ 33.074128][ T3497] napi_threaded_poll+0x164/0x200 [ 33.074164][ T3497] kthread+0x489/0x510 [ 33.074200][ T3497] ret_from_fork+0x149/0x290 [ 33.074232][ T3497] ret_from_fork_asm+0x1a/0x30 [ 33.074258][ T3497] [ 33.074263][ T3497] read to 0xffff88811aaaf180 of 8 bytes by task 3497 on cpu 0: [ 33.074282][ T3497] __mod_timer+0x69/0x840 [ 33.074313][ T3497] mod_timer+0x1f/0x30 [ 33.074346][ T3497] wg_timers_any_authenticated_packet_traversal+0xd0/0x100 [ 33.074385][ T3497] wg_packet_tx_worker+0xeb/0x330 [ 33.074403][ T3497] process_scheduled_works+0x4ce/0x9d0 [ 33.074429][ T3497] worker_thread+0x582/0x770 [ 33.074455][ T3497] kthread+0x489/0x510 [ 33.074491][ T3497] ret_from_fork+0x149/0x290 [ 33.074520][ T3497] ret_from_fork_asm+0x1a/0x30 [ 33.074551][ T3497] [ 33.074556][ T3497] value changed: 0x00000000ffff9ee2 -> 0x00000000ffff9ee8 [ 33.074570][ T3497] [ 33.074575][ T3497] Reported by Kernel Concurrency Sanitizer on: [ 33.074602][ T3497] CPU: 0 UID: 0 PID: 3497 Comm: kworker/0:6 Not tainted syzkaller #0 PREEMPT(voluntary) [ 33.074631][ T3497] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 33.074649][ T3497] Workqueue: wg-crypt-wg2 wg_packet_tx_worker [ 33.074681][ T3497] ================================================================== [ 33.096165][ T3505] Zero length message leads to an empty skb