last executing test programs:
380.979913ms ago: executing program 0 (id=1):
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000001780), 0x161801, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f00000017c0)='schedstat\x00')
close(0x4)
bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1f, 0x0, 0x0, 0x1000, 0x0, 0x1}, 0x48)
mount$9p_fd(0x0, &(0x7f0000001800)='.\x00', &(0x7f0000001840), 0x11, &(0x7f0000001980)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}})
217.374439ms ago: executing program 3 (id=4):
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000a80)={0x0, 0xffffffffffffffff, 0x0, 0x2c, &(0x7f0000000000)='/proc/sys/net/\x00\x00v4\x00\x00s/\x92ync_\x00le\xf44.\xab%nN\xd4\xa2\x88\x00\xd1l,'}, 0x30)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
fchdir(r0)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0)
getdents(r1, 0x0, 0x58)
210.93218ms ago: executing program 1 (id=2):
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000940)={&(0x7f0000000040)='sys_enter\x00', r1}, 0x10)
unlink(&(0x7f0000000200)='./cgroup\x00')
176.214663ms ago: executing program 4 (id=5):
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
chdir(&(0x7f00000001c0)='./bus\x00')
mkdir(&(0x7f0000000140)='./control\x00', 0x5)
rmdir(&(0x7f0000000100)='./control\x00')
163.373625ms ago: executing program 3 (id=6):
bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, 0x0, 0x0}, 0x94)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r1 = openat$cgroup_int(r0, &(0x7f0000000080)='blkio.throttle.write_bps_device\x00', 0x2, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000200)=ANY=[], 0x31)
137.883447ms ago: executing program 1 (id=7):
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000007b00000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000280)='netlink_extack\x00', r0}, 0x10)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_WOL_GET(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)={0x14, r2, 0x1, 0x0, 0x0, {0x1b}}, 0x14}}, 0x0)
131.421008ms ago: executing program 4 (id=8):
ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, 0x0)
r0 = syz_usb_connect$hid(0x0, 0x6c, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000000000040b827ed0100000000000109022400010000000009040000010300000009210000200122050009058103"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x5, {[@main=@item_4={0x3, 0x0, 0x8, "9c21ae2a"}]}}, 0x0}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
0s ago: executing program 1 (id=9):
r0 = socket$inet6(0xa, 0x3, 0x5)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000014c0)=@raw={'raw\x00', 0x8, 0x3, 0x528, 0x0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x458, 0xffffffff, 0xffffffff, 0x458, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [0x0, 0x62], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x388, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_to_hsr\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x588)
r1 = socket$inet6(0xa, 0x3, 0x3c)
connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback, 0x7}, 0x1c)
writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000100)="88", 0xfdef}], 0x1)
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.0.228' (ED25519) to the list of known hosts.
[ 23.238120][ T28] audit: type=1400 audit(1760693650.369:64): avc: denied { mounton } for pid=274 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 23.239561][ T274] cgroup: Unknown subsys name 'net'
[ 23.260845][ T28] audit: type=1400 audit(1760693650.369:65): avc: denied { mount } for pid=274 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 23.288095][ T28] audit: type=1400 audit(1760693650.409:66): avc: denied { unmount } for pid=274 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 23.288309][ T274] cgroup: Unknown subsys name 'devices'
[ 23.430907][ T274] cgroup: Unknown subsys name 'hugetlb'
[ 23.436745][ T274] cgroup: Unknown subsys name 'rlimit'
[ 23.571395][ T28] audit: type=1400 audit(1760693650.709:67): avc: denied { setattr } for pid=274 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 23.594581][ T28] audit: type=1400 audit(1760693650.709:68): avc: denied { mounton } for pid=274 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1
[ 23.619346][ T28] audit: type=1400 audit(1760693650.709:69): avc: denied { mount } for pid=274 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1
[ 23.630509][ T276] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped).
Setting up swapspace version 1, size = 127995904 bytes
[ 23.651974][ T28] audit: type=1400 audit(1760693650.799:70): avc: denied { relabelto } for pid=276 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t"
[ 23.677415][ T28] audit: type=1400 audit(1760693650.799:71): avc: denied { write } for pid=276 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t"
[ 23.712703][ T28] audit: type=1400 audit(1760693650.849:72): avc: denied { read } for pid=274 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t"
[ 23.713259][ T274] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 23.738387][ T28] audit: type=1400 audit(1760693650.849:73): avc: denied { open } for pid=274 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t"
[ 24.545077][ T283] bridge0: port 1(bridge_slave_0) entered blocking state
[ 24.552496][ T283] bridge0: port 1(bridge_slave_0) entered disabled state
[ 24.560122][ T283] device bridge_slave_0 entered promiscuous mode
[ 24.568044][ T283] bridge0: port 2(bridge_slave_1) entered blocking state
[ 24.575155][ T283] bridge0: port 2(bridge_slave_1) entered disabled state
[ 24.582630][ T283] device bridge_slave_1 entered promiscuous mode
[ 24.634770][ T286] bridge0: port 1(bridge_slave_0) entered blocking state
[ 24.641952][ T286] bridge0: port 1(bridge_slave_0) entered disabled state
[ 24.649543][ T286] device bridge_slave_0 entered promiscuous mode
[ 24.666694][ T286] bridge0: port 2(bridge_slave_1) entered blocking state
[ 24.673807][ T286] bridge0: port 2(bridge_slave_1) entered disabled state
[ 24.681334][ T286] device bridge_slave_1 entered promiscuous mode
[ 24.694858][ T284] bridge0: port 1(bridge_slave_0) entered blocking state
[ 24.701975][ T284] bridge0: port 1(bridge_slave_0) entered disabled state
[ 24.709447][ T284] device bridge_slave_0 entered promiscuous mode
[ 24.724240][ T282] bridge0: port 1(bridge_slave_0) entered blocking state
[ 24.731336][ T282] bridge0: port 1(bridge_slave_0) entered disabled state
[ 24.738856][ T282] device bridge_slave_0 entered promiscuous mode
[ 24.745556][ T284] bridge0: port 2(bridge_slave_1) entered blocking state
[ 24.752686][ T284] bridge0: port 2(bridge_slave_1) entered disabled state
[ 24.760111][ T284] device bridge_slave_1 entered promiscuous mode
[ 24.779338][ T282] bridge0: port 2(bridge_slave_1) entered blocking state
[ 24.786394][ T282] bridge0: port 2(bridge_slave_1) entered disabled state
[ 24.794151][ T282] device bridge_slave_1 entered promiscuous mode
[ 24.821514][ T285] bridge0: port 1(bridge_slave_0) entered blocking state
[ 24.828578][ T285] bridge0: port 1(bridge_slave_0) entered disabled state
[ 24.836243][ T285] device bridge_slave_0 entered promiscuous mode
[ 24.851374][ T285] bridge0: port 2(bridge_slave_1) entered blocking state
[ 24.858432][ T285] bridge0: port 2(bridge_slave_1) entered disabled state
[ 24.866107][ T285] device bridge_slave_1 entered promiscuous mode
[ 25.012560][ T283] bridge0: port 2(bridge_slave_1) entered blocking state
[ 25.019634][ T283] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 25.026936][ T283] bridge0: port 1(bridge_slave_0) entered blocking state
[ 25.034074][ T283] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 25.090394][ T286] bridge0: port 2(bridge_slave_1) entered blocking state
[ 25.097727][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 25.105106][ T286] bridge0: port 1(bridge_slave_0) entered blocking state
[ 25.112149][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 25.131490][ T282] bridge0: port 2(bridge_slave_1) entered blocking state
[ 25.138553][ T282] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 25.145841][ T282] bridge0: port 1(bridge_slave_0) entered blocking state
[ 25.152899][ T282] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 25.168606][ T284] bridge0: port 2(bridge_slave_1) entered blocking state
[ 25.175682][ T284] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 25.182969][ T284] bridge0: port 1(bridge_slave_0) entered blocking state
[ 25.190017][ T284] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 25.212999][ T285] bridge0: port 2(bridge_slave_1) entered blocking state
[ 25.220156][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 25.227416][ T285] bridge0: port 1(bridge_slave_0) entered blocking state
[ 25.234461][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 25.252859][ T8] bridge0: port 1(bridge_slave_0) entered disabled state
[ 25.260629][ T8] bridge0: port 2(bridge_slave_1) entered disabled state
[ 25.267730][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 25.275683][ T8] bridge0: port 1(bridge_slave_0) entered disabled state
[ 25.283317][ T8] bridge0: port 2(bridge_slave_1) entered disabled state
[ 25.290737][ T8] bridge0: port 1(bridge_slave_0) entered disabled state
[ 25.297979][ T8] bridge0: port 2(bridge_slave_1) entered disabled state
[ 25.305609][ T8] bridge0: port 1(bridge_slave_0) entered disabled state
[ 25.313197][ T8] bridge0: port 2(bridge_slave_1) entered disabled state
[ 25.320474][ T8] bridge0: port 1(bridge_slave_0) entered disabled state
[ 25.327636][ T8] bridge0: port 2(bridge_slave_1) entered disabled state
[ 25.351074][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 25.359419][ T8] bridge0: port 1(bridge_slave_0) entered blocking state
[ 25.366480][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 25.387354][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 25.395208][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 25.402897][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 25.410908][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 25.418306][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 25.426506][ T8] bridge0: port 2(bridge_slave_1) entered blocking state
[ 25.433540][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 25.461764][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 25.470742][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 25.479092][ T8] bridge0: port 1(bridge_slave_0) entered blocking state
[ 25.486116][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 25.494640][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 25.503243][ T8] bridge0: port 2(bridge_slave_1) entered blocking state
[ 25.510333][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 25.517828][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 25.526180][ T8] bridge0: port 1(bridge_slave_0) entered blocking state
[ 25.533310][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 25.540857][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 25.549205][ T8] bridge0: port 2(bridge_slave_1) entered blocking state
[ 25.556227][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 25.563651][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 25.571653][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 25.579670][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 25.587798][ T8] bridge0: port 1(bridge_slave_0) entered blocking state
[ 25.594850][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 25.613479][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 25.621872][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 25.630333][ T8] bridge0: port 2(bridge_slave_1) entered blocking state
[ 25.637383][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 25.644939][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 25.654051][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 25.662126][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 25.670286][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 25.678207][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 25.686440][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 25.706700][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 25.714939][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 25.723174][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 25.731386][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 25.739537][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 25.747823][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 25.756071][ T8] bridge0: port 1(bridge_slave_0) entered blocking state
[ 25.763114][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 25.770569][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 25.779078][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 25.787648][ T8] bridge0: port 2(bridge_slave_1) entered blocking state
[ 25.794699][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 25.802189][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 25.810396][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 25.820267][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 25.828379][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 25.846106][ T286] device veth0_vlan entered promiscuous mode
[ 25.854301][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 25.862999][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 25.872715][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 25.880725][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 25.889801][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 25.897320][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 25.909156][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 25.917541][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 25.933046][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 25.941511][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 25.950095][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 25.958132][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 25.968585][ T282] device veth0_vlan entered promiscuous mode
[ 25.975932][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 25.984097][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 25.997092][ T286] device veth1_macvtap entered promiscuous mode
[ 26.007663][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 26.015315][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 26.023058][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 26.031731][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 26.040126][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 26.047700][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 26.056328][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 26.064857][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 26.073188][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 26.081420][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 26.088979][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 26.099492][ T283] device veth0_vlan entered promiscuous mode
[ 26.109064][ T284] device veth0_vlan entered promiscuous mode
[ 26.118943][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 26.127298][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 26.134974][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 26.157423][ T284] device veth1_macvtap entered promiscuous mode
[ 26.164878][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 26.173432][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 26.181861][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 26.190453][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 26.198622][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 26.207078][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 26.215378][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 26.223712][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 26.231943][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 26.241852][ T282] device veth1_macvtap entered promiscuous mode
[ 26.258270][ T283] device veth1_macvtap entered promiscuous mode
[ 26.265307][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 26.273074][ T286] request_module fs-gadgetfs succeeded, but still no fs?
[ 26.273497][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 26.290390][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 26.300219][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 26.308487][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 26.333825][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 26.342212][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 26.350629][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 26.359177][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 26.376714][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 26.385173][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 26.393746][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 26.402626][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 26.411109][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 26.419597][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 26.441289][ T285] device veth0_vlan entered promiscuous mode
[ 26.451054][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 26.459351][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 26.468270][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 26.475986][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 26.507837][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 26.521897][ T285] device veth1_macvtap entered promiscuous mode
[ 26.537281][ T341] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 26.554183][ T341] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 26.574084][ T284] ------------[ cut here ]------------
[ 26.579648][ T284] WARNING: CPU: 0 PID: 284 at fs/inode.c:335 drop_nlink+0xc5/0x110
[ 26.587586][ T284] Modules linked in:
[ 26.591652][ T284] CPU: 0 PID: 284 Comm: syz-executor Not tainted syzkaller #0
[ 26.599202][ T284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
[ 26.609305][ T284] RIP: 0010:drop_nlink+0xc5/0x110
[ 26.614400][ T284] Code: 1b 48 8d bb b8 04 00 00 be 08 00 00 00 e8 a3 e4 f0 ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 9b 72 ac ff <0f> 0b eb 86 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 5e ff ff ff 4c
[ 26.634199][ T284] RSP: 0018:ffffc9000da6fc38 EFLAGS: 00010293
[ 26.640337][ T284] RAX: ffffffff81c3ab65 RBX: ffff888132b0f1a8 RCX: ffff888109073cc0
[ 26.648349][ T284] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 26.656372][ T284] RBP: ffffc9000da6fc60 R08: 0000000000000004 R09: 0000000000000003
[ 26.664517][ T284] R10: fffff52001b4df78 R11: 1ffff92001b4df78 R12: dffffc0000000000
[ 26.672579][ T284] R13: 1ffff11026561e3e R14: ffff888132b0f1f0 R15: 0000000000000000
[ 26.680603][ T284] FS: 000055558054f500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
[ 26.689689][ T284] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 26.696291][ T284] CR2: 00005555805724e8 CR3: 0000000130166000 CR4: 00000000003506b0
[ 26.704523][ T284] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 26.712651][ T284] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 26.713281][ T353] xt_hashlimit: size too large, truncated to 1048576
[ 26.720681][ T284] Call Trace:
[ 26.720689][ T284]
[ 26.720697][ T284] shmem_rmdir+0x5b/0x90
[ 26.737929][ T284] vfs_rmdir+0x393/0x500
[ 26.742268][ T284] incfs_kill_sb+0x105/0x220
[ 26.746885][ T284] deactivate_locked_super+0xb5/0x120
[ 26.752341][ T284] deactivate_super+0xaf/0xe0
[ 26.757044][ T284] cleanup_mnt+0x45f/0x4e0
[ 26.761596][ T284] __cleanup_mnt+0x19/0x20
[ 26.766078][ T284] task_work_run+0x1db/0x240
[ 26.770795][ T284] ? __cfi_task_work_run+0x10/0x10
[ 26.775939][ T284] ? __x64_sys_umount+0x125/0x160
[ 26.781019][ T284] ? __cfi___x64_sys_umount+0x10/0x10
[ 26.786416][ T284] exit_to_user_mode_loop+0x9b/0xb0
[ 26.791686][ T284] exit_to_user_mode_prepare+0x5a/0xa0
[ 26.797164][ T284] syscall_exit_to_user_mode+0x1a/0x30
[ 26.802688][ T284] do_syscall_64+0x58/0xa0
[ 26.807120][ T284] ? clear_bhb_loop+0x30/0x80
[ 26.811879][ T284] ? clear_bhb_loop+0x30/0x80
[ 26.816580][ T284] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 26.822551][ T284] RIP: 0033:0x7f3234f902f7
[ 26.827006][ T284] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8
[ 26.846673][ T284] RSP: 002b:00007ffd860569a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[ 26.855211][ T284] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f3234f902f7
[ 26.863254][ T284] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd86056a60
[ 26.871297][ T284] RBP: 00007ffd86056a60 R08: 0000000000000000 R09: 0000000000000000
[ 26.879331][ T284] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd86057af0
[ 26.887321][ T284] R13: 00007f3235011d7d R14: 00000000000067aa R15: 00007ffd86057b30
[ 26.895352][ T284]
[ 26.898385][ T284] ---[ end trace 0000000000000000 ]---
[ 26.908919][ T284] ==================================================================
[ 26.909117][ T341] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 26.917012][ T284] BUG: KASAN: null-ptr-deref in ihold+0x20/0x60
[ 26.917039][ T284] Write of size 4 at addr 0000000000000170 by task syz-executor/284
[ 26.939237][ T284]
[ 26.941583][ T284] CPU: 0 PID: 284 Comm: syz-executor Tainted: G W syzkaller #0
[ 26.950542][ T284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
[ 26.960619][ T284] Call Trace:
[ 26.961924][ T341] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 26.963916][ T284]
[ 26.963925][ T284] __dump_stack+0x21/0x24
[ 26.979268][ T284] dump_stack_lvl+0xee/0x150
[ 26.983880][ T284] ? __cfi_dump_stack_lvl+0x8/0x8
[ 26.988928][ T284] ? ihold+0x20/0x60
[ 26.992838][ T284] ? ihold+0x20/0x60
[ 26.996746][ T284] print_report+0x3d/0x60
[ 27.001107][ T284] kasan_report+0x122/0x150
[ 27.005633][ T284] ? ihold+0x20/0x60
[ 27.009549][ T284] kasan_check_range+0x280/0x290
[ 27.014507][ T284] __kasan_check_write+0x14/0x20
[ 27.019456][ T284] ihold+0x20/0x60
[ 27.023194][ T284] vfs_rmdir+0x25f/0x500
[ 27.027455][ T284] incfs_kill_sb+0x105/0x220
[ 27.032064][ T284] deactivate_locked_super+0xb5/0x120
[ 27.037456][ T284] deactivate_super+0xaf/0xe0
[ 27.042165][ T284] cleanup_mnt+0x45f/0x4e0
[ 27.046597][ T284] __cleanup_mnt+0x19/0x20
[ 27.051028][ T284] task_work_run+0x1db/0x240
[ 27.055642][ T284] ? __cfi_task_work_run+0x10/0x10
[ 27.060793][ T284] ? __x64_sys_umount+0x125/0x160
[ 27.065852][ T284] ? __cfi___x64_sys_umount+0x10/0x10
[ 27.071252][ T284] exit_to_user_mode_loop+0x9b/0xb0
[ 27.076471][ T284] exit_to_user_mode_prepare+0x5a/0xa0
[ 27.081971][ T284] syscall_exit_to_user_mode+0x1a/0x30
[ 27.087465][ T284] do_syscall_64+0x58/0xa0
[ 27.091907][ T284] ? clear_bhb_loop+0x30/0x80
[ 27.096621][ T284] ? clear_bhb_loop+0x30/0x80
[ 27.101338][ T284] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 27.107261][ T284] RIP: 0033:0x7f3234f902f7
[ 27.111701][ T284] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8
[ 27.131330][ T284] RSP: 002b:00007ffd860569a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[ 27.139766][ T284] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f3234f902f7
[ 27.147741][ T284] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd86056a60
[ 27.155708][ T284] RBP: 00007ffd86056a60 R08: 0000000000000000 R09: 0000000000000000
[ 27.163682][ T284] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd86057af0
[ 27.171680][ T284] R13: 00007f3235011d7d R14: 00000000000067aa R15: 00007ffd86057b30
[ 27.179678][ T284]
[ 27.182718][ T284] ==================================================================
[ 27.192913][ T284] Disabling lock debugging due to kernel taint
[ 27.199123][ T284] BUG: kernel NULL pointer dereference, address: 0000000000000170
[ 27.206935][ T284] #PF: supervisor write access in kernel mode
[ 27.213002][ T284] #PF: error_code(0x0002) - not-present page
[ 27.218979][ T284] PGD 132a55067 P4D 132a55067 PUD 0
[ 27.224274][ T284] Oops: 0002 [#1] PREEMPT SMP KASAN
[ 27.229517][ T284] CPU: 0 PID: 284 Comm: syz-executor Tainted: G B W syzkaller #0
[ 27.238462][ T284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
[ 27.248526][ T284] RIP: 0010:ihold+0x26/0x60
[ 27.253045][ T284] Code: 33 36 7c df 55 48 89 e5 41 56 53 48 89 fb e8 01 6a ac ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 e0 db f0 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 f1
[ 27.272656][ T284] RSP: 0018:ffffc9000da6fc78 EFLAGS: 00010246
[ 27.278734][ T284] RAX: ffff888109073c00 RBX: 0000000000000000 RCX: ffff888109073cc0
[ 27.286733][ T284] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 27.294708][ T284] RBP: ffffc9000da6fc88 R08: dffffc0000000000 R09: fffffbfff0f2d8fd
[ 27.302681][ T284] R10: fffffbfff0f2d8fd R11: 1ffffffff0f2d8fc R12: ffff888132b0f1b4
[ 27.310660][ T284] R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000
[ 27.318633][ T284] FS: 000055558054f500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
[ 27.327566][ T284] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 27.334161][ T284] CR2: 0000000000000170 CR3: 0000000130166000 CR4: 00000000003506b0
[ 27.342129][ T284] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 27.350095][ T284] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 27.358065][ T284] Call Trace:
[ 27.361348][ T284]
[ 27.364291][ T284] vfs_rmdir+0x25f/0x500
[ 27.368549][ T284] incfs_kill_sb+0x105/0x220
[ 27.373148][ T284] deactivate_locked_super+0xb5/0x120
[ 27.378533][ T284] deactivate_super+0xaf/0xe0
[ 27.383227][ T284] cleanup_mnt+0x45f/0x4e0
[ 27.387657][ T284] __cleanup_mnt+0x19/0x20
[ 27.392080][ T284] task_work_run+0x1db/0x240
[ 27.396681][ T284] ? __cfi_task_work_run+0x10/0x10
[ 27.401806][ T284] ? __x64_sys_umount+0x125/0x160
[ 27.406866][ T284] ? __cfi___x64_sys_umount+0x10/0x10
[ 27.412249][ T284] exit_to_user_mode_loop+0x9b/0xb0
[ 27.417460][ T284] exit_to_user_mode_prepare+0x5a/0xa0
[ 27.422960][ T284] syscall_exit_to_user_mode+0x1a/0x30
[ 27.428440][ T284] do_syscall_64+0x58/0xa0
[ 27.432874][ T284] ? clear_bhb_loop+0x30/0x80
[ 27.437566][ T284] ? clear_bhb_loop+0x30/0x80
[ 27.442273][ T284] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 27.448192][ T284] RIP: 0033:0x7f3234f902f7
[ 27.452611][ T284] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8
[ 27.472218][ T284] RSP: 002b:00007ffd860569a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[ 27.480644][ T284] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f3234f902f7
[ 27.488620][ T284] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd86056a60
[ 27.496597][ T284] RBP: 00007ffd86056a60 R08: 0000000000000000 R09: 0000000000000000
[ 27.504568][ T284] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd86057af0
[ 27.512553][ T284] R13: 00007f3235011d7d R14: 00000000000067aa R15: 00007ffd86057b30
[ 27.520533][ T284]
[ 27.523551][ T284] Modules linked in:
[ 27.527458][ T284] CR2: 0000000000000170
[ 27.531614][ T284] ---[ end trace 0000000000000000 ]---
[ 27.537501][ T284] RIP: 0010:ihold+0x26/0x60
[ 27.542010][ T284] Code: 33 36 7c df 55 48 89 e5 41 56 53 48 89 fb e8 01 6a ac ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 e0 db f0 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 f1
[ 27.561619][ T284] RSP: 0018:ffffc9000da6fc78 EFLAGS: 00010246
[ 27.567691][ T284] RAX: ffff888109073c00 RBX: 0000000000000000 RCX: ffff888109073cc0
[ 27.575747][ T284] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 27.583719][ T284] RBP: ffffc9000da6fc88 R08: dffffc0000000000 R09: fffffbfff0f2d8fd
[ 27.591692][ T284] R10: fffffbfff0f2d8fd R11: 1ffffffff0f2d8fc R12: ffff888132b0f1b4
[ 27.599668][ T284] R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000
[ 27.607638][ T284] FS: 000055558054f500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
[ 27.616565][ T284] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 27.623148][ T284] CR2: 0000000000000170 CR3: 0000000130166000 CR4: 00000000003506b0
[ 27.631124][ T284] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 27.639105][ T284] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 27.647100][ T284] Kernel panic - not syncing: Fatal exception
[ 27.653425][ T284] Kernel Offset: disabled
[ 27.657835][ T284] Rebooting in 86400 seconds..