last executing test programs: 132.547027ms ago: executing program 1 (id=2): renameat2(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, 0x0, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x2) sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf0667000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240), 0x50) setsockopt$sock_int(r1, 0x1, 0x0, &(0x7f0000000040)=0x3ff, 0x4) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x12, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000071180a000000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @cgroup_sock_addr=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r4 = syz_clone3(&(0x7f0000001880)={0x100000200, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) rt_sigqueueinfo(r4, 0x21, 0x0) r5 = fsmount(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000240)={r3, r5, 0xb, 0x0, @val=@netkit={@void, @value=r5}}, 0x1c) 124.092787ms ago: executing program 4 (id=5): munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) syz_usb_disconnect(r0) syz_usb_connect$printer(0x4, 0x2d, &(0x7f0000002d80)=ANY=[], 0x0) ioctl$EVIOCRMFF(r0, 0x40085507, 0x0) 77.312198ms ago: executing program 2 (id=3): mkdir(&(0x7f0000000080)='./file1\x00', 0x8) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f00000000c0)='./file1\x00') r0 = open(&(0x7f00000001c0)='./file0\x00', 0x143142, 0x80) ftruncate(r0, 0x2007ffc) sendfile(r0, r0, 0x0, 0x1000000201005) creat(&(0x7f00000002c0)='./file0\x00', 0x1) 73.575378ms ago: executing program 3 (id=4): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x161140, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000015c0)={0x1, 0x0, [{0x1, 0x9, 0x8000, 0x14, 0xfffffffd}]}) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f00000000c0)=0x3) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000880)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1000700000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34cf2645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd673c1eeda4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d06c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235eaa92143ce4bb5c5acb290e8976dcac779ff0000f5620000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05be23dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe656c9c46bffbe9dd03970800000000000000d372bdd6f89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 0s ago: executing program 0 (id=1): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0xfffffffe}}, 0x2e) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000200)={'wlan1\x00'}) kernel console output (not intermixed with test programs): [ 14.601633][ T28] audit: type=1400 audit(1783226905.712:62): avc: denied { rlimitinh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.604375][ T28] audit: type=1400 audit(1783226905.712:63): avc: denied { siginh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.610701][ T222] sshd-session (222) used greatest stack depth: 22632 bytes left Warning: Permanently added '10.128.0.244' (ED25519) to the list of known hosts. [ 21.191723][ T28] audit: type=1400 audit(1783226912.312:64): avc: denied { mounton } for pid=279 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.192815][ T279] cgroup: Unknown subsys name 'net' [ 21.214434][ T28] audit: type=1400 audit(1783226912.312:65): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.241714][ T28] audit: type=1400 audit(1783226912.342:66): avc: denied { unmount } for pid=279 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.241904][ T279] cgroup: Unknown subsys name 'devices' [ 21.385669][ T279] cgroup: Unknown subsys name 'hugetlb' [ 21.391336][ T279] cgroup: Unknown subsys name 'rlimit' [ 21.493300][ T28] audit: type=1400 audit(1783226912.612:67): avc: denied { setattr } for pid=279 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.516488][ T28] audit: type=1400 audit(1783226912.612:68): avc: denied { mounton } for pid=279 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 21.527626][ T281] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 21.541460][ T28] audit: type=1400 audit(1783226912.612:69): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.573110][ T28] audit: type=1400 audit(1783226912.672:70): avc: denied { relabelto } for pid=281 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.576090][ T279] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.598831][ T28] audit: type=1400 audit(1783226912.672:71): avc: denied { write } for pid=281 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.633296][ T28] audit: type=1400 audit(1783226912.692:72): avc: denied { read } for pid=279 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.659016][ T28] audit: type=1400 audit(1783226912.692:73): avc: denied { open } for pid=279 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.454731][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.461799][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.469362][ T287] device bridge_slave_0 entered promiscuous mode [ 22.476890][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.484094][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.491475][ T287] device bridge_slave_1 entered promiscuous mode [ 22.531010][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.538135][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.545599][ T291] device bridge_slave_0 entered promiscuous mode [ 22.561332][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.568451][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.575897][ T291] device bridge_slave_1 entered promiscuous mode [ 22.610134][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.617302][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.624786][ T289] device bridge_slave_0 entered promiscuous mode [ 22.631517][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.638614][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.646155][ T290] device bridge_slave_0 entered promiscuous mode [ 22.661435][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.668615][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.676023][ T289] device bridge_slave_1 entered promiscuous mode [ 22.682626][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.689732][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.697215][ T290] device bridge_slave_1 entered promiscuous mode [ 22.744378][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.751430][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.759153][ T288] device bridge_slave_0 entered promiscuous mode [ 22.766269][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.773579][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.781311][ T288] device bridge_slave_1 entered promiscuous mode [ 22.920231][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.927312][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.934611][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.941639][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.970876][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.977969][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.985429][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.992712][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.018332][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.025417][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.033022][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.040077][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.050513][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.057587][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.064868][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.071896][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.103290][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.111135][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.119226][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.126688][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.133966][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.142091][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.149430][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.156707][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.164205][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.172098][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.179718][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.211449][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.219881][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.226938][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.235248][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.243382][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.250504][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.257921][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.266158][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.273172][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.280577][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.288875][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.295925][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.303267][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.316886][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.327356][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.348457][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.356952][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.365364][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.372408][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.379824][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.388202][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.395337][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.402929][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.411346][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.418387][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.426062][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.434221][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.441347][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.448940][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.457017][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.470266][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.477852][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.503767][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.512285][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.520943][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.529152][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.537779][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.546229][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.554358][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.562402][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.570686][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.579345][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.589284][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.597745][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.605983][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.612993][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.621883][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 23.636416][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.644933][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.653268][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.661270][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.669696][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.677829][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.696230][ T289] device veth0_vlan entered promiscuous mode [ 23.703066][ T290] device veth0_vlan entered promiscuous mode [ 23.709744][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.717341][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.725143][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.732824][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.740635][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.749580][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.758255][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.766826][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.775336][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.784156][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.792317][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.799371][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.807020][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.815101][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.825356][ T287] device veth0_vlan entered promiscuous mode [ 23.842082][ T289] device veth1_macvtap entered promiscuous mode [ 23.849868][ T291] device veth0_vlan entered promiscuous mode [ 23.859206][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.867266][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.875277][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.883114][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.891694][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.900037][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.908248][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.916540][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.924691][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.932957][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.941331][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.949066][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.956716][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.972253][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.980740][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.989255][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.998583][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.007227][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.015552][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.027434][ T287] device veth1_macvtap entered promiscuous mode [ 24.041323][ T290] device veth1_macvtap entered promiscuous mode [ 24.048807][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.056913][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.064392][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.071846][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.081293][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.089812][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.097603][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.105919][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.114315][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.127921][ T291] device veth1_macvtap entered promiscuous mode [ 24.137190][ T288] device veth0_vlan entered promiscuous mode [ 24.147490][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.156019][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.164681][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.172284][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.180874][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.189486][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.197929][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.209265][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.217576][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.243602][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.244581][ T287] request_module fs-gadgetfs succeeded, but still no fs? [ 24.252145][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.267889][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.277262][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.285714][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.294119][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.302306][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.319344][ T288] device veth1_macvtap entered promiscuous mode [ 24.343551][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.361599][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.400226][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.410562][ T318] tmpfs: Unknown parameter 'usrquota' [ 24.416990][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.424053][ T317] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 24.470118][ T320] ================================================================== [ 24.478275][ T320] BUG: KASAN: use-after-free in rcu_segcblist_enqueue+0x9c/0xb0 [ 24.485975][ T320] Write of size 8 at addr ffff888132c5d590 by task syz.0.1/320 [ 24.493620][ T320] [ 24.495967][ T320] CPU: 1 PID: 320 Comm: syz.0.1 Not tainted syzkaller #0 [ 24.502999][ T320] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 24.513087][ T320] Call Trace: [ 24.516381][ T320] [ 24.519338][ T320] __dump_stack+0x21/0x24 [ 24.523683][ T320] dump_stack_lvl+0x110/0x170 [ 24.528377][ T320] ? __cfi_dump_stack_lvl+0x8/0x8 [ 24.533429][ T320] ? rcu_segcblist_enqueue+0x9c/0xb0 [ 24.538733][ T320] print_address_description+0x71/0x200 [ 24.544394][ T320] print_report+0x4a/0x60 [ 24.548745][ T320] kasan_report+0x122/0x150 [ 24.553281][ T320] ? rcu_segcblist_enqueue+0x9c/0xb0 [ 24.558586][ T320] __asan_report_store8_noabort+0x17/0x20 [ 24.564321][ T320] rcu_segcblist_enqueue+0x9c/0xb0 [ 24.569479][ T320] call_rcu+0x554/0xf50 [ 24.573666][ T320] ? __cfi_call_rcu+0x10/0x10 [ 24.578363][ T320] ? __kasan_check_write+0x14/0x20 [ 24.583478][ T320] ? selinux_inode_free_security+0x21f/0x230 [ 24.589466][ T320] security_inode_free+0xc5/0xe0 [ 24.594419][ T320] __destroy_inode+0x175/0x500 [ 24.599190][ T320] evict+0x777/0x8c0 [ 24.603097][ T320] ? proc_nr_inodes+0x2f0/0x2f0 [ 24.607953][ T320] ? _raw_spin_lock+0x94/0xf0 [ 24.612630][ T320] ? __cfi__raw_spin_lock+0x10/0x10 [ 24.617843][ T320] ? __kasan_check_write+0x14/0x20 [ 24.622973][ T320] iput+0x633/0x690 [ 24.626788][ T320] dentry_unlink_inode+0x346/0x3f0 [ 24.631904][ T320] __dentry_kill+0x46c/0x680 [ 24.636508][ T320] dentry_kill+0xc0/0x2a0 [ 24.640844][ T320] dput+0x42/0x80 [ 24.644481][ T320] __fput+0x5c0/0x8f0 [ 24.648474][ T320] ____fput+0x15/0x20 [ 24.652482][ T320] task_work_run+0x1e1/0x250 [ 24.657095][ T320] ? __cfi_task_work_run+0x10/0x10 [ 24.662271][ T320] ? __cfi___close_range+0x10/0x10 [ 24.667381][ T320] exit_to_user_mode_loop+0x9b/0xb0 [ 24.672586][ T320] exit_to_user_mode_prepare+0x87/0xd0 [ 24.678109][ T320] syscall_exit_to_user_mode+0x1a/0x30 [ 24.683574][ T320] do_syscall_64+0x58/0xa0 [ 24.687985][ T320] ? clear_bhb_loop+0x30/0x80 [ 24.692655][ T320] ? clear_bhb_loop+0x30/0x80 [ 24.697427][ T320] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 24.703334][ T320] RIP: 0033:0x7f6f9c19de59 [ 24.707769][ T320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 24.727548][ T320] RSP: 002b:00007ffdc8014998 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 24.735993][ T320] RAX: 0000000000000000 RBX: 00007ffdc8014a80 RCX: 00007f6f9c19de59 [ 24.743986][ T320] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 24.751954][ T320] RBP: 0000000000005f7b R08: 0000000000000001 R09: 0000000000000000 [ 24.759937][ T320] R10: 0000001b2da20000 R11: 0000000000000246 R12: 00007ffdc8014ac0 [ 24.767929][ T320] R13: 00007f6f9c425fac R14: 0000000000005fb0 R15: 00007f6f9c425fa0 [ 24.775912][ T320] [ 24.778926][ T320] [ 24.781232][ T320] Allocated by task 321: [ 24.785538][ T320] kasan_set_track+0x4b/0x70 [ 24.790122][ T320] kasan_save_alloc_info+0x1f/0x30 [ 24.795456][ T320] __kasan_kmalloc+0x95/0xb0 [ 24.800044][ T320] __kmalloc+0xb4/0x1e0 [ 24.804194][ T320] l2tp_session_create+0x38/0xbd0 [ 24.809205][ T320] pppol2tp_connect+0xbf5/0x1640 [ 24.814132][ T320] __sys_connect+0x3da/0x460 [ 24.818746][ T320] __x64_sys_connect+0x7a/0x90 [ 24.823502][ T320] x64_sys_call+0x88d/0x9a0 [ 24.828007][ T320] do_syscall_64+0x4c/0xa0 [ 24.832507][ T320] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 24.838388][ T320] [ 24.840800][ T320] Freed by task 8: [ 24.844498][ T320] kasan_set_track+0x4b/0x70 [ 24.849075][ T320] kasan_save_free_info+0x2b/0x40 [ 24.854084][ T320] ____kasan_slab_free+0x132/0x180 [ 24.859198][ T320] __kasan_slab_free+0x11/0x20 [ 24.863980][ T320] slab_free_freelist_hook+0xc2/0x190 [ 24.869351][ T320] __kmem_cache_free+0xb7/0x1b0 [ 24.874189][ T320] kfree+0x6f/0xf0 [ 24.877895][ T320] l2tp_session_put+0xaf/0x1a0 [ 24.882826][ T320] l2tp_session_delete+0x3df/0x4d0 [ 24.888008][ T320] l2tp_tunnel_del_work+0x199/0x410 [ 24.893194][ T320] process_one_work+0x717/0xc30 [ 24.898035][ T320] worker_thread+0xa4d/0x11d0 [ 24.902698][ T320] kthread+0x281/0x320 [ 24.906750][ T320] ret_from_fork+0x1f/0x30 [ 24.911151][ T320] [ 24.913462][ T320] Last potentially related work creation: [ 24.919245][ T320] kasan_save_stack+0x3a/0x60 [ 24.924022][ T320] __kasan_record_aux_stack+0xb6/0xc0 [ 24.929412][ T320] kasan_record_aux_stack_noalloc+0xb/0x10 [ 24.935220][ T320] call_rcu+0xcf/0xf50 [ 24.939276][ T320] pppol2tp_release+0x1e3/0x2b0 [ 24.944111][ T320] sock_close+0xc9/0x220 [ 24.948342][ T320] __fput+0x1fd/0x8f0 [ 24.952313][ T320] ____fput+0x15/0x20 [ 24.956286][ T320] task_work_run+0x1e1/0x250 [ 24.960861][ T320] exit_to_user_mode_loop+0x9b/0xb0 [ 24.966050][ T320] exit_to_user_mode_prepare+0x87/0xd0 [ 24.971512][ T320] syscall_exit_to_user_mode+0x1a/0x30 [ 24.976980][ T320] do_syscall_64+0x58/0xa0 [ 24.981390][ T320] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 24.987304][ T320] [ 24.989608][ T320] The buggy address belongs to the object at ffff888132c5d400 [ 24.989608][ T320] which belongs to the cache kmalloc-512 of size 512 [ 25.003645][ T320] The buggy address is located 400 bytes inside of [ 25.003645][ T320] 512-byte region [ffff888132c5d400, ffff888132c5d600) [ 25.017123][ T320] [ 25.019436][ T320] The buggy address belongs to the physical page: [ 25.025848][ T320] page:ffffea0004cb1700 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x132c5c [ 25.036099][ T320] head:ffffea0004cb1700 order:2 compound_mapcount:0 compound_pincount:0 [ 25.044402][ T320] flags: 0x4000000000010200(slab|head|zone=1) [ 25.050487][ T320] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 [ 25.059053][ T320] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 25.067613][ T320] page dumped because: kasan: bad access detected [ 25.074003][ T320] page_owner tracks the page as allocated [ 25.079700][ T320] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 24, tgid 24 (kworker/1:0), ts 24449743773, free_ts 0 [ 25.100528][ T320] post_alloc_hook+0x1f5/0x210 [ 25.105387][ T320] prep_new_page+0x1c/0x110 [ 25.109884][ T320] get_page_from_freelist+0x2ca9/0x2d20 [ 25.115418][ T320] __alloc_pages+0x1fa/0x610 [ 25.119997][ T320] alloc_slab_page+0x6e/0xf0 [ 25.124567][ T320] new_slab+0x98/0x3e0 [ 25.128617][ T320] ___slab_alloc+0x70f/0xb70 [ 25.133200][ T320] __slab_alloc+0x5e/0xa0 [ 25.137516][ T320] __kmem_cache_alloc_node+0x204/0x2d0 [ 25.142991][ T320] __kmalloc_node_track_caller+0xa1/0x1e0 [ 25.148695][ T320] __alloc_skb+0x226/0x4a0 [ 25.153097][ T320] ndisc_ns_create+0x26e/0x920 [ 25.157852][ T320] ndisc_send_ns+0xb7/0x160 [ 25.162346][ T320] addrconf_dad_work+0x9d6/0x14a0 [ 25.167380][ T320] process_one_work+0x717/0xc30 [ 25.172232][ T320] worker_thread+0xa4d/0x11d0 [ 25.176927][ T320] page_owner free stack trace missing [ 25.182387][ T320] [ 25.184698][ T320] Memory state around the buggy address: [ 25.190329][ T320] ffff888132c5d480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.198374][ T320] ffff888132c5d500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.206424][ T320] >ffff888132c5d580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.214465][ T320] ^ [ 25.219041][ T320] ffff888132c5d600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.227102][ T320] ffff888132c5d680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.235144][ T320] ================================================================== [ 25.243240][ T320] Disabling lock debugging due to kernel taint [ 25.278404][ T317] kvm: vcpu 0: requested 128 ns lapic timer period limited to 200000 ns [ 25.288442][ T317] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer.