last executing test programs: 1.097787848s ago: executing program 3 (id=46): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x98, 0x40, 0x200, 0x10000000, 0x3, {0x2}, [@typed={0x8, 0x2, 0x0, 0x0, @u32=0x4}, @generic="71992354bf4d683286184125c29cd781886a78870c4d6ac927f1a2425226f737a871a02c6549", @generic="7c7024628b2ceb0d134dae15b545b89886bec99056d72f58ea27266074be466051bc8b216f24dfd86d78f17efc597db44652c8add6e652a92ef1ab26291dad0344d206249a7b3b7ddb5c1e51868cb4931b96440b94ff"]}, 0x98}}, 0x48840) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000300)={'batadv_slave_1\x00'}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f00000003c0)={'syztnl2\x00', &(0x7f0000000340)={'ip6gre0\x00', 0x0, 0x29, 0x8, 0x1, 0x61, 0x4, @loopback, @mcast1, 0x10, 0x40, 0x5, 0x1}}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000400)) socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000180)={0x5c, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xd, 0x3, 'list:set\x00'}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8}, @IPSET_ATTR_SIZE={0x8}]}]}, 0x5c}}, 0x0) 1.088165689s ago: executing program 4 (id=47): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x4008032, 0xffffffffffffffff, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x27, 0x0, 0x0) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) rt_sigprocmask(0x0, &(0x7f0000000200)={[0xffffffff]}, 0x0, 0x8) prlimit64(0x0, 0xb, &(0x7f0000000140), 0x0) r0 = gettid() tkill(r0, 0x11) rt_sigaction(0x11, &(0x7f0000000480)={0x0, 0x0, 0x0, {[0x8000000000000001]}}, 0x0, 0x8, &(0x7f0000000000)) 875.963443ms ago: executing program 3 (id=51): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$rtl8150(0xffffffffffffffff, 0x0, &(0x7f00000006c0)={0x18, &(0x7f0000000280)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, &(0x7f0000000880)={0x34, &(0x7f0000000f80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file4/file6\x00', 0x1c0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = eventfd2(0x8, 0x0) preadv(0xffffffffffffffff, &(0x7f00000005c0), 0x0, 0x2, 0x7ff) write$eventfd(r0, &(0x7f0000000140)=0xfffffffffffffffc, 0x8) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0, 0xf4}}, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x10) sendmsg$NL80211_CMD_JOIN_OCB(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040008}, 0x24008805) syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = dup(r0) write$UHID_INPUT(r2, 0x0, 0x0) 859.807573ms ago: executing program 0 (id=52): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) r0 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet6(r0, &(0x7f0000007240)=[{{&(0x7f0000000100)={0xa, 0x4e22, 0x6, @mcast2, 0x7}, 0x1c, 0x0}}, {{0x0, 0x0, &(0x7f0000001380)=[{&(0x7f00000012c0)="1ce02c7a", 0xfe60}], 0x1}}, {{0x0, 0x0, &(0x7f0000000000), 0x1}}], 0x3, 0x1c000) 840.788323ms ago: executing program 1 (id=53): r0 = openat$binfmt_format(0xffffff9c, &(0x7f0000000000)='/proc/sys/fs/binfmt_misc/syz3\x00', 0x2, 0x0) readv(r0, &(0x7f00000010c0)=[{&(0x7f0000000080)=""/74, 0x4a}], 0x1) 787.137824ms ago: executing program 0 (id=56): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_MSG_GETSETELEM(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000680)=ANY=[@ANYBLOB="980200000d0a010800000000000000000a0000010900020073797a31000000000900010073797a31000000006c0203806802008008000340000000005c0201801800028008000180fffffffc0900020073797a31000000002c00028008000340000000000900020073797a300000000008000340000000010900020073797a3100000000690001"], 0x298}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) 787.078624ms ago: executing program 1 (id=57): r0 = socket(0x10, 0x3, 0x4) ioctl$SIOCSIFMTU(r0, 0x8923, &(0x7f0000000100)={'netdevsim0\x00', 0x80004}) 769.192735ms ago: executing program 0 (id=58): connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r0, 0x80045505, &(0x7f0000000040)=@usbdevfs_connect) ioctl$USBDEVFS_SETCONFIGURATION(r0, 0x80045505, &(0x7f0000000000)=0x1) 752.721585ms ago: executing program 1 (id=59): r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r1, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x1, 0x0, 0x3}}, 0x2e) ioctl$PPPIOCSFLAGS(r1, 0x40047459, 0x0) 681.597177ms ago: executing program 1 (id=60): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x10) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x88, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x5c, 0x4, 0x0, 0x1, [{0x58, 0x1, 0x0, 0x1, @inner={{0xa}, @val={0x48, 0x2, 0x0, 0x1, [@NFTA_INNER_FLAGS={0x8, 0x3, 0x1, 0x0, 0x7}, @NFTA_INNER_NUM={0x8}, @NFTA_INNER_EXPR={0x34, 0x5, 0x0, 0x1, @payload={{0xc}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_LEN={0x8, 0x4, 0x1, 0x0, 0x56}, @NFTA_PAYLOAD_OFFSET={0x8, 0x3, 0x1, 0x0, 0xb9}, @NFTA_PAYLOAD_DREG={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_PAYLOAD_BASE={0x8}]}}}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0xb0}, 0x1, 0x0, 0x0, 0x4}, 0x0) 681.488926ms ago: executing program 4 (id=61): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_TSINFO_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="31830000060000000000190000000c0001800800030005"], 0x20}, 0x1, 0x0, 0x0, 0x4000850}, 0x0) 681.330137ms ago: executing program 3 (id=62): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x400000000003, 0x7ffff, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) recvmsg(0xffffffffffffffff, 0x0, 0x40000100) 681.208147ms ago: executing program 4 (id=63): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) syz_open_procfs(0x0, &(0x7f0000000100)='syscall\x00') socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) r0 = socket$packet(0x11, 0x2, 0x300) socketpair(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) bind$packet(r0, &(0x7f00000000c0)={0x11, 0x18, r2, 0x1, 0x81}, 0x14) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x0, 0x0, 0x27}, 0x1c) 619.827378ms ago: executing program 1 (id=65): openat$ptmx(0xffffffffffffff9c, 0x0, 0x100, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xa, 0x8000, 0x0, 0x41d, 0x1, 0xfffffdffffffffff, 0xfa0f, 0xffffffff}, 0x0) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB], 0x48) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x40082, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000140)) ioctl$PPPIOCSACTIVE(r2, 0x40087446, &(0x7f00000007c0)={0x1, &(0x7f0000000080)=[{0x34, 0xd, 0x1}]}) 619.685738ms ago: executing program 0 (id=66): sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x50) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x1b, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0) 619.565178ms ago: executing program 4 (id=67): r0 = socket$pppl2tp(0x18, 0x1, 0x1) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bind$inet6(r0, 0x0, 0x0) 610.520548ms ago: executing program 0 (id=68): r0 = socket$packet(0x11, 0x3, 0x300) r1 = gettid() prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r4, &(0x7f0000000100)={0x20000014}) epoll_wait(r2, &(0x7f0000000040)=[{}], 0x1, 0x400) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_SIOCGIFINDEX(r0, 0x89a0, 0x0) io_setup(0x20, &(0x7f0000001140)) 602.735198ms ago: executing program 4 (id=70): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f0000001480)="3b5250dd", 0x4, 0x20000080, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='bbr', 0x3) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) 531.954589ms ago: executing program 4 (id=71): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket(0x1, 0x2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000000c0)=@tcp6=r2}, 0x20) bind$unix(r2, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e24}, 0x6e) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r3 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') r4 = openat$binfmt(0xffffffffffffff9c, r3, 0x42, 0x1ff) close(r4) execveat$binfmt(0xffffffffffffff9c, r3, 0x0, 0x0, 0x0) r5 = openat$binfmt(0xffffffffffffff9c, r3, 0x2, 0x0) close(r5) execveat$binfmt(0xffffffffffffff9c, r3, 0x0, 0x0, 0x0) execveat$binfmt(0xffffffffffffff9c, r3, 0x0, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="9feb0100180000000000000047021e8531e6748505e35eb8000000b800000008000000060000000000000c050000000000000000000003000000000100000003000000000000800000000001000085000000000d0000000000000003ffffff0b000000000000010000000034001b00040000000000000c040000000200000002000093050000000700000001010000000800000900000002000000050000000d00000004000013010000000d00000075040000050000000a000000ff0f00000300000007000000ff7f0000080000001000000001000000810000000061305f2e5f615f5f0000"], &(0x7f00000003c0)=""/94, 0xdb, 0x5e, 0x0, 0x2}, 0x28) r6 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r8 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0xffa1, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r7, @ANYBLOB="00000000100000001c001a80080002802d00ff0008000200", @ANYBLOB="35874207"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) 526.1607ms ago: executing program 2 (id=72): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040)) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x0) 437.046021ms ago: executing program 2 (id=73): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) io_setup(0x1, &(0x7f0000002500)=0x0) close(r0) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'dummy0\x00', 0x0}) setsockopt$XDP_TX_RING(r2, 0x11b, 0x3, &(0x7f00000001c0)=0x2, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000180)=0x20, 0x4) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4) bind$xdp(r2, &(0x7f0000000100)={0x2c, 0x0, r4}, 0x10) io_submit(r1, 0x1, &(0x7f0000000000)=[&(0x7f0000002640)={0x4000000, 0x0, 0x0, 0x8, 0x1000, r0, 0x0, 0x0, 0x0, 0x0, 0x2}]) 348.021633ms ago: executing program 3 (id=74): timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x66) 347.927133ms ago: executing program 3 (id=75): socket$packet(0x11, 0xa, 0x300) openat$binder_debug(0xffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x1f, 0x0, 0x1, 0x8000000000000, 0xfffffffffffffffe, 0x6, 0xfffffffffffffffe}, 0x0, 0x0, 0x0, 0x0) 328.077993ms ago: executing program 3 (id=76): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) readv(r2, &(0x7f0000000000)=[{&(0x7f0000001200)=""/150, 0x96}], 0x1) ioctl$TCSETS(r2, 0x5402, &(0x7f00000014c0)={0xfffffffd, 0xffffffcb, 0x1c02, 0x2, 0x7f, "cc33101d3f0000002000"}) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x9, 0x0, "000080f100df000000a7d9de16c708db7200"}) r3 = syz_open_pts(r2, 0x42) timer_create(0x0, 0x0, 0x0) mremap(&(0x7f0000be4000/0x3000)=nil, 0x3000, 0x2000, 0x3, &(0x7f00005f0000/0x2000)=nil) r4 = dup3(r3, r2, 0x0) write$UHID_INPUT(r4, &(0x7f00000001c0)={0xd, {"08c39ee52f329f1698b1c4865f8b0a0a5eee9f496a0809c3d21c25867b6edda88489ab4c09fe0a7f1e8640aa8e344f412df0d69475a5d6570e21f31fac7dfb4aa7ade0e851582d5c1abdd809580cb34c9e48576b1c73ed76013256fca058ada3db47d86cc75b33cf762b67fe61f152618c49a40858f68794a4fc484ab73ccd254ba3d147f5feddaf91dacc238c0a8096f79597ca1e6da781fcf37a0141a335c6a7577d2d53c6e552a7be208381bb31d1d3e0e92ea651655217535734b286d3f19780a4c720075a36a734151f8c00e651cb3a6bbe30e3f6aee48750436da6471e965e81f38134674fcb697108fb7345010bb8fa15fba9b33355d7858327171ab9c68f6c21b2ffbff4eb061dab80bc77a4a7769e7ff73bcd98790e09415bfc5978cf5af45c3ec9ef9c1a39f766c59d59590281038dbcb765580ba2b3f141d5bbfc40910a0894cd1f22d2a8b6d4e4778debef99438b54d44b4b7568de2777431a5b2f3e8d1a45a60a468f5e33e8ef534f803dfb6798c270f52edf031ecd996bb78c4e92961c63c079676d77412ebc6074e5f235417785e7a14b14ce7626b015071c154cc2bf8f4499b93293e9997c23df4c7a1498cf12414fb31eb873728e4f613b540d22e7ca718f18da5b82ed24995e4309c3af4a2e1097465bf09728082d09e71ea365522035eb9772b8e072f8454777ee304dacd59d3eb9f933f151fa14f8c38eadbeba04810a2dea7a66824f09235c13a45f07870210d0d310ce3ae6284577bd4e65f32700f6723727926cb52e4f27776a1dab0f6668327ab5cf1893879a635261f2e0d9923ccecbf5b80f10a8275c1515f47930d614e787f14c105d3a4f8faf8e7f738cf4eae4fc39ef3db3cb87794ace87f7239b69dc4ab4e5ae57cdfbd309e847d99600ef14b51faead01e8ade57d24270bc13a1787896096eeacb8ab1c93d31d93cfb244bb09ecfecf336362a5656db7df327cbb9aeb898f8af229c7bb9452805f2b4510c5df86b6d564e01f000000167ade5205331523a6392af2bea9e6db0ba5480cbf1b202714233289c4017cb66e83c0c8b6e88bedb922162d0ceecf6c5da173bbefe6781ab7720d2be6cca378db650c69d4228141ae190922fbbaddb86c7f0fe138b704e8305b3bcc7910b2280d96d71dafdbfa876b0013fc4de586f85d9ee077b6349becbdca8bd989a51c4c76ed8a8cc691a65078e0272a62edec8236a779f0cbffeda49dcdccd4def7064e0d77ae5a8c64f3057b4a3a0d4457d33f2bc6c112378315411baa4bb126fe540d750491fc58fbb66911ef82bce5ed76872dbcd8e05dea2f3f347a653aa39ab5d75e71671bfeb924e71476134dbf91e3f287fd853cc34bf81e717edd41aa04b6fbeb43cf2074f0c8fe5350401b6cff801c147a3b58b972aa5652629a9fd8b1df2852708ce958d4e9974ec4383aa5da4e3f75fdc85981e97b75863546f67a8703673b6fe2c26f0e9eeb8c45c26f673adac55fa5d69b82ae7d032fd3b26866047e8c029b90a62794a89c11398944b398b4177b2dcc5a743c16d4a5333b1e30af678d3db8df849c1753db067a6f94bab00c0dd3c7e94a8675924c89bda98ac09e10bcdf83f5114b9b466c413477a5cdc48c857230798934bcc1f0eb3a2d2944b139e459af32e515785f46ed4e97cdcb23c7e4dc7c4f91b5b5ca5228344aeb6652fffaf31325c7429bc70a5f6beaaa98ef190dffdeccc94bd814b3edfdd48243bf34291076ab5438ee00e924a827d5b453df42d24144fe1a45bb6c84fcbb2143d0a561c1e867c1279bdf0a47061ea77a84f36c720aff785f0db10eda84c767b5f3874f9455c0f026735ded32f0403ef7dbcf97d2233d59c670114ddf89314ba74fc248bcbdbf43c24e46304e229b3cf583aa410f4dfd119152495da8737518ee2a05a8ca1f004be3c551408f2e4013e444b63bf2bb26ddeae505642dffcc989ee241c48741181b506e22fdc4530319522780c74bf786852dc66ebbb51f8ecbb1e35de09ef7afe589bb8a31c5d63477db5d5e7174694ea04cfa98057d39127a4e5eedb4897a491c6693acd0a036abf846f3b6f3006e5e5fd586f29a4a8a31abbccf732e4f1b88187a72d669c16302657e9cbbeb9322662e111edc7771526400b6123d0f8207bcaa38bee07043e36e223d418ac948d65e7acfe72cc3fdcf03a3e43ecfec8ae489ddba09126709c5c7968829e3504de8a5010c9372de09476a7b96b04d7aed2486d8f89f21f075321abe350024abe00a81f87df3dc372fc3206496776c26b6958243070bda4cace3e358da5d39a3945765c2ba4b002b06efd416af66f3343f218ed84550ea83f02f9a5c3fc677ea60987aa25f0406d6154081cfdc074814a2465accdfa102858f5a52c9eae293c56ddcaf8f6926d3dd0ccb51a30c960d6b7e473038ebd3702b5106f6bc040efdfd7169fd3f2dc42ff23de26a239e13b74278729fd7e843b38a35c55fd50181ac13a9cbbbfd8feb36afaeb1993349c0ac5a0c44ffd92919dfe272b0f8ed7df7198cd299715f021109a58dced4753d3c7ddd6e9ea01596f18b2fe7000000004ccfca57aed5b5cebdff65de480a56bd53f4c7f83ddef00d7c9686311d1fce76f320bb3222a11db30ba6ed31535d8fda61e694478ca9935d72719b8d6b9be88ae3df30b60ee251b919b4d1734b994c62accdf855488b351738331b462eccf27efdc5577d7a5548579dc90d227a42ac010f33a720dc3cf0a63454f8b07c775287495761a058ec1e28e6aaf8057241f4ef8b5de56e279355bb66630c4ddf35e7c2cfff26a4241b1df0379d2a1e9f959e46d3843f89844ead50aff44640fcbc4a1edb033afff7cc9e57c4f8d31900764233e11fa4c28e547788c1b00de4268df692ba3415a9ad90fa712f9618f5ecff57da32809380eeff040cd3b23f508614c72b303cec3bcd732708303b166193366a062b9cea536f28478c387e626744c6a611a8e7162d274efccc84eee8eb31d3310c86752777dd5b5ffe234e895c54909f19a4aabcf3c15b90c02170409e314fd90e766ec4ba93c8ec6321237a980ad3c32fb2fab69e57541ea7f5427a85c2c57d40f9ebe9de5572f46a4713fb28e0af42d0adef3e29195aa41a3ba318181512eebfadffede4e35ff7f975928edc5d4d9f2d931fb44b30e1df55e66c52e1648e9cdaf71221b57c6a6b087428ccc57ade5b1531341cba2be452b426c434c70fd8c493337d4995cbd76ea1dd545226e3eb59d5f94ffb5352f87a4a66cd7c5e88322404fd397c46e198646a9c819d0eb1f10e54d8a3ea912f1cb134ff1095aa7325287f6ea9af8c13b67d6abcbb70dbc06838ecb33e45b60f6cb832c3e72d1401770f66bd02f35a2d007815ab676099e31f5102000000c0e83d5e7107c8dc5830c9cddb9781185b94d7f2814c5058ba3ac54c268741c5728f4997a9628602c2a36090162379f3f37c47619b3e7c7397a5913b7060b51e0c7f7226ff1135444f866f89a4b74136cbd3acb7178bd63183b3fd9cd19fdeb6fcc6341910ad4605da76a9af4bfb8b75fcd666f8188902b380ae560d9aa04f8f9b0ac5c109d1824a470726e06a49d955f8f71c8a86081e75b13f62600deb941da181eaff544cd559c467d8dae432debd22e7a7b3e1ad731a5b9470f5f60423dda061ff899c07c79f3da34f38e1d8182d6ee0c36c602945509167be440382a8a8a759b20e41638fd57152029b190b5701d30a86f579e2d0cc53a2f809ca9bd3aba1eb2772a7acc35c4d983afa83a9baea35c0ed4931234719636cf8f5fe1884bde6cebbdf23bd62b1ebf0a5cb78c27295349bd7d5cf28c4ee4689497238fd3aa71a417914e6892667a56bd69dc2e5882cfb67df71494e9a9199e025892e4e7435f727636cd988cc7563d28db5133f649849c5b3973a3428de10ad39d96146b22acc50f50eee5a038876452b960686892de40efe30081ccdaa2bf64af78d5988026e529b36c62a21378ac42d220d0dd878010178e374e6dbb2b61206066d04e729ed03c6fd9a4e00547fe9304aec0925d85a0acd07fdc5d48c1a1cff656916f5d25952327792255e0d606a32517781cc3d737ec753eb95b5b5b95dabd8946907ab54cc85d05b475e2e5486c6fc070417198d3a50910e2949d20d3fa68fd327934cff5171224942b8f18d88947763a7c710d09c4b269bdf2d3e715329917fb70728a4a0530999b755ba8fc04deabf4bc4bcffc4d62d491538c65078122bf2c263ae0020af67cfc9cf19e5b929e086af281fb43d5504d728935c5cfac136eb81703d50fddb39a5a713b2914c6acd9b2d07819cf7bba495ac5734fe423e611d309b80eeafcf9053d51b0ab3c29d5ca5eb8861ffc1ebc4d53f361b8991baecb52860c15202f979e34054fcde869d018103ccd6d914a70f1840fc6aaf426beec975ddb980b19b0f4cc2ca393c0b9e6ebe5e7d1c9fc1ef7a1c91378f0b73262993fb80667ecf62bac3c47cbd002ae1b87b8dc3ec99d5c987765d778868eb55022cc3bed14b8f934a584bcc98fa0b4f6e6982ab8d8a2bb49f9074ef429dd7b8db332a96ccec6983a97be7c8634c02e7937ffc8d613b83aa375886bf40a87ec062090382f874bf2c8e5fbb58ac18a46c4d9e85af3ca21bdacb7755f49776b0eb3972ff682c84beb07d74cbe2764e378253e72128991b73d2730704a5448280e8a0fd8cc87d4cddcffbfe5525ae3d2304877a3988e33c8e12bf77793e753f25840e9af2ce56bdb999fc62623a2298b4244534f662eb398a2577c72f6cfd5174697dcee151d4f3a7293b11de3889c43744da4165aca4e4a1e926d37ae4d7471584a06f3641f2037a74a58c2397a594f29d142d59f91bb57e24e1a3f30f68c626033cc34895c1b16d62e3a375c3e09f5dbd9338cd3a500643143cd404b57019c648c3ec31d696233fe16efc3c4c84aca0830ca8b9fbf1144b98d82f41e4cf67631c74cdcf8d9c8b8556b876ff1592683ccac0b47a26cb3a2cb1b917f433bb54e0b53deae9ac4b1cd0594c1fa0e6744e7ed88fdac60901e3da989f3b0d7c12b140cc576fa1b0e8e705321d37c303691aafc9fed9c3dc419078d0925ead56455ea5f3cd57941e410c1c14c2e8972d7cca44fcaca1f64fc817f4a41b6d9fb237fed159cb09e788ae560726537f49cb64b9f60915d402e0931355c55ad792cde758548b1af54b196e414046d4af3579a6c30ceac3d68bbfd2adef309c064e759a9f0dd69d682a3880b8ff27b69abffaa45ee7e65d8f1f6e40c188f6249fdf72220b4c87243217ba0292b9e9b67ebeda4fb83406216a4d765812bafeff34cc57f7d2cd1608282079c076055b9cabffe5fa491b970291bc2672540ccc15ed877d7dbe3ef683724c715ace770905e48c2dc6a44e1fc095773676d070eac00ee3834b07590cba7093f56b678313870471c81599d34c53fc03ec6c913d8ba3f604ace8da12d2025cbb5000bc062f4db65a6feacaf3915206d1c15ce7e78c17dc2ea32cb57d6fab0a22d487c77118e75016006f812541ec8180a321287a2d57248d4ee4a19706a19d802c70e250c3b0fc400a0b5cdc06537d2f55fd5300be4eeeaab8cc481a84b6a5e17d8c47ec92fe40710d4ec3530a94ca16710ade2ec7562398106e0ddbb6c8af6412166afd99d45d29a3a967e58decd0d6fc5bebb98d639b5606efd358a43d635d50f0ccb8472197da604994e7fb700243d5f7e45700", 0x1000}}, 0xffffff5c) 298.574864ms ago: executing program 2 (id=77): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000005a40)=ANY=[@ANYBLOB="b400000010000904000000000000000000002200", @ANYRES32=0x0, @ANYBLOB="fffffffed9526cfd8400128009000100766c616e000000007400028006000100000600000c000200d981b0ef76"], 0xb4}}, 0xc0) 147.978916ms ago: executing program 2 (id=78): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000001900010000000000000000001c14", @ANYRES64], 0x24}}, 0x4000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1, 0x4, &(0x7f0000000100)=ANY=[@ANYBLOB="183f0000000000000000000003000000950000000000000095"], &(0x7f00000003c0)='GPL\x00', 0x2, 0x1007, &(0x7f00000005c0)=""/4103, 0x40f00, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0xc0) 146.931917ms ago: executing program 2 (id=79): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) clock_gettime(0x0, 0x0) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) process_mrelease(0xffffffffffffffff, 0x0) 107.015898ms ago: executing program 2 (id=80): r0 = socket$packet(0x11, 0x3, 0x300) r1 = gettid() prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r4, &(0x7f0000000100)={0x20000014}) epoll_wait(r2, &(0x7f0000000040)=[{}], 0x1, 0x400) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_SIOCGIFINDEX(r0, 0x89a0, &(0x7f0000000040)={'syzkaller0\x00'}) r5 = socket$packet(0x11, 0x3, 0x300) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000640)='/sys/kernel/fscaps', 0x42, 0x0) io_setup(0x20, &(0x7f0000001140)=0x0) io_submit(r7, 0x1, &(0x7f00000001c0)=[&(0x7f0000002040)={0xf, 0x400000000000, 0x0, 0x1, 0x0, r6, &(0x7f0000000080)="0d32818e", 0x4, 0x300000000000000}]) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'veth1_to_bond\x00', 0x0}) setsockopt$packet_add_memb(r5, 0x107, 0x1, &(0x7f0000000100)={r8, 0x2, 0x6}, 0x10) r9 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r9, 0x89a1, &(0x7f0000000040)={'syzkaller0\x00'}) setsockopt$packet_drop_memb(r5, 0x107, 0x2, &(0x7f00000003c0)={0x0, 0x1, 0x6, @remote}, 0x10) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4000c}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_AGEING_TIME={0x8, 0x9, 0x8}]}}}]}, 0x3c}}, 0x4000) 89.436668ms ago: executing program 1 (id=81): sched_setaffinity(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, 0x0, 0x0, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000380)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x7, 0x7}, {}, {0x8, 0x2}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0xfffffffd, 0x400, 0x7, 0x6, 0x7}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0x0, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x10}, 0x0) getsockopt$inet6_buf(r3, 0x29, 0x2c, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, 0x0, 0x0) 0s ago: executing program 0 (id=82): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000400)=0x1, 0xa) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x36}}, 0x10) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) sendto(r0, &(0x7f0000000140)='A', 0xfffff, 0x40008c1, 0x0, 0x0) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 9.176936][ T109] udevd (109) used greatest stack depth: 22912 bytes left [ 12.001296][ T30] kauditd_printk_skb: 25 callbacks suppressed [ 12.001313][ T30] audit: type=1400 audit(1759427170.448:59): avc: denied { transition } for pid=220 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.012647][ T30] audit: type=1400 audit(1759427170.448:60): avc: denied { noatsecure } for pid=220 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.020348][ T30] audit: type=1400 audit(1759427170.458:61): avc: denied { write } for pid=220 comm="sh" path="pipe:[14489]" dev="pipefs" ino=14489 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 12.028577][ T30] audit: type=1400 audit(1759427170.458:62): avc: denied { rlimitinh } for pid=220 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.035348][ T30] audit: type=1400 audit(1759427170.458:63): avc: denied { siginh } for pid=220 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 12.036814][ T219] sshd-session (219) used greatest stack depth: 22848 bytes left Warning: Permanently added '10.128.0.72' (ED25519) to the list of known hosts. [ 19.296946][ T30] audit: type=1400 audit(1759427177.748:64): avc: denied { mounton } for pid=273 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 19.298457][ T273] cgroup: Unknown subsys name 'net' [ 19.306989][ T30] audit: type=1400 audit(1759427177.748:65): avc: denied { mount } for pid=273 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.316966][ T30] audit: type=1400 audit(1759427177.758:66): avc: denied { unmount } for pid=273 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.317185][ T273] cgroup: Unknown subsys name 'devices' [ 19.456661][ T273] cgroup: Unknown subsys name 'hugetlb' [ 19.462287][ T273] cgroup: Unknown subsys name 'rlimit' [ 19.663348][ T30] audit: type=1400 audit(1759427178.108:67): avc: denied { setattr } for pid=273 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 19.686853][ T30] audit: type=1400 audit(1759427178.108:68): avc: denied { mounton } for pid=273 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 19.696007][ T275] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 19.712099][ T30] audit: type=1400 audit(1759427178.108:69): avc: denied { mount } for pid=273 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 19.740884][ T273] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 19.743583][ T30] audit: type=1400 audit(1759427178.168:70): avc: denied { relabelto } for pid=275 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.777899][ T30] audit: type=1400 audit(1759427178.168:71): avc: denied { write } for pid=275 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.803655][ T30] audit: type=1400 audit(1759427178.188:72): avc: denied { read } for pid=273 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.829172][ T30] audit: type=1400 audit(1759427178.188:73): avc: denied { open } for pid=273 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.586446][ T284] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.593513][ T284] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.601153][ T284] device bridge_slave_0 entered promiscuous mode [ 20.608408][ T284] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.615503][ T284] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.622905][ T284] device bridge_slave_1 entered promiscuous mode [ 20.640045][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.647153][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.654702][ T281] device bridge_slave_0 entered promiscuous mode [ 20.668235][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.675318][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.682674][ T281] device bridge_slave_1 entered promiscuous mode [ 20.736458][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.743585][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.751124][ T282] device bridge_slave_0 entered promiscuous mode [ 20.767848][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.774943][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.782447][ T282] device bridge_slave_1 entered promiscuous mode [ 20.810651][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.817752][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.825348][ T283] device bridge_slave_0 entered promiscuous mode [ 20.844668][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.851733][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.859404][ T283] device bridge_slave_1 entered promiscuous mode [ 20.885094][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.892151][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.899784][ T285] device bridge_slave_0 entered promiscuous mode [ 20.919717][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.926820][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.934193][ T285] device bridge_slave_1 entered promiscuous mode [ 21.068778][ T284] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.076047][ T284] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.083364][ T284] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.090437][ T284] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.127176][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.134330][ T281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.141645][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.148689][ T281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.168965][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.176303][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.184066][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.191608][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.200057][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 21.207619][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.236816][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.245477][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.252726][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.260568][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.269008][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.276107][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.297724][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.311797][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.336253][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 21.343784][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.374324][ T284] device veth0_vlan entered promiscuous mode [ 21.386037][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.394715][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.403130][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.411198][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.418726][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.427055][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.434171][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.441667][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.449158][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.457473][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.464609][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.471944][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.480212][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.487357][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.494888][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.503050][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.510225][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.517742][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.525807][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.533864][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.541404][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.549667][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.556737][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.564165][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.572543][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.579605][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.594532][ T284] device veth1_macvtap entered promiscuous mode [ 21.605857][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 21.613521][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 21.622070][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.630680][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.638929][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.669778][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.678428][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.686961][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 21.695853][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.703814][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 21.712039][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.720819][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.729364][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.737858][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.746250][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.754682][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.762897][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.771309][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.779330][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.787566][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.795113][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.803093][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.811575][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.824821][ T281] device veth0_vlan entered promiscuous mode [ 21.838844][ T283] device veth0_vlan entered promiscuous mode [ 21.847404][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.855839][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.863926][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.872136][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.880439][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.888163][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.895872][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.903536][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.911776][ T282] device veth0_vlan entered promiscuous mode [ 21.928298][ T281] device veth1_macvtap entered promiscuous mode [ 21.940160][ T283] device veth1_macvtap entered promiscuous mode [ 21.947989][ T284] request_module fs-gadgetfs succeeded, but still no fs? [ 21.955325][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 21.962969][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.971910][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.980770][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.989268][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.997285][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 22.005822][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 22.013983][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.021065][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.028912][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 22.037692][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 22.046264][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.053589][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.061093][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 22.069331][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.077699][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 22.085571][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 22.093614][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 22.101965][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 22.118129][ T282] device veth1_macvtap entered promiscuous mode [ 22.133591][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 22.144984][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 22.153260][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 22.163544][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.172094][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 22.180309][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 22.188969][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.198034][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.207134][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.232242][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 22.241211][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 22.250047][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 22.260391][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.269096][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.277662][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.294775][ T285] device veth0_vlan entered promiscuous mode [ 22.302043][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 22.310948][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.323680][ T340] loop1: detected capacity change from 0 to 512 [ 22.331499][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 22.339891][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 22.349952][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.362441][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.380023][ T285] device veth1_macvtap entered promiscuous mode [ 22.386037][ T340] EXT4-fs (loop1): Ignoring removed mblk_io_submit option [ 22.393530][ T340] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 22.413985][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.428112][ T340] EXT4-fs (loop1): mounting ext2 file system using the ext4 subsystem [ 22.441635][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.450761][ T340] EXT4-fs (loop1): warning: checktime reached, running e2fsck is recommended [ 22.460579][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 22.460872][ T340] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=a043c01c, mo2=0102] [ 22.476954][ T340] System zones: 0-2, 18-18, 34-34 [ 22.479599][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.491205][ T340] EXT4-fs error (device loop1): ext4_orphan_get:1401: inode #15: comm syz.1.2: iget: bad i_size value: 360287970189639680 [ 22.504761][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 22.606602][ T340] EXT4-fs error (device loop1): ext4_orphan_get:1406: comm syz.1.2: couldn't read orphan inode 15 (err -117) [ 22.639042][ T340] EXT4-fs (loop1): mounted filesystem without journal. Opts: nolazytime,abort,lazytime,mblk_io_submit,noauto_da_alloc,,errors=continue. Quota mode: none. [ 22.766011][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 22.895171][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.966688][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.006439][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.485597][ T30] kauditd_printk_skb: 35 callbacks suppressed [ 24.485615][ T30] audit: type=1400 audit(1759427182.928:109): avc: denied { unmount } for pid=283 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 24.610756][ T357] syz.3.6 (357) used greatest stack depth: 22720 bytes left [ 26.304421][ C0] sched: RT throttling activated [ 26.496819][ T376] loop0: detected capacity change from 0 to 2048 [ 26.818738][ T30] audit: type=1400 audit(1759427182.998:110): avc: denied { write } for pid=339 comm="syz.1.2" name="file0" dev="loop1" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 26.849032][ T30] audit: type=1400 audit(1759427184.968:111): avc: denied { create } for pid=365 comm="syz.4.5" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 27.932685][ T376] EXT4-fs: error -4 creating inode table initialization thread [ 27.940455][ T376] EXT4-fs (loop0): mount failed [ 29.410504][ T30] audit: type=1400 audit(1759427184.988:112): avc: denied { write } for pid=365 comm="syz.4.5" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 30.204895][ T410] syz.4.15 (410) used greatest stack depth: 22656 bytes left [ 30.299427][ T30] audit: type=1326 audit(1759427184.988:113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=339 comm="syz.1.2" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdb42de7ec9 code=0x7ffc0000 [ 30.421013][ T30] audit: type=1326 audit(1759427184.988:114): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=339 comm="syz.1.2" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdb42de7ec9 code=0x7ffc0000 [ 30.449742][ T30] audit: type=1400 audit(1759427188.018:115): avc: denied { read write } for pid=408 comm="syz.2.16" name="kvm" dev="devtmpfs" ino=82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 30.472590][ T30] audit: type=1400 audit(1759427188.018:116): avc: denied { open } for pid=408 comm="syz.2.16" path="/dev/kvm" dev="devtmpfs" ino=82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 30.514941][ T30] audit: type=1400 audit(1759427188.028:117): avc: denied { read write } for pid=408 comm="syz.2.16" name="uhid" dev="devtmpfs" ino=263 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 30.554044][ T30] audit: type=1400 audit(1759427188.028:118): avc: denied { open } for pid=408 comm="syz.2.16" path="/dev/uhid" dev="devtmpfs" ino=263 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 30.597132][ T30] audit: type=1400 audit(1759427188.998:119): avc: denied { unmount } for pid=284 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 36.217289][ T454] loop4: detected capacity change from 0 to 512 [ 36.232433][ T30] audit: type=1400 audit(1759427194.678:120): avc: denied { create } for pid=456 comm="syz.2.29" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 36.260809][ T454] EXT4-fs (loop4): Ignoring removed mblk_io_submit option [ 36.377041][ T459] syz.1.26[459] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 36.377128][ T459] syz.1.26[459] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 39.502113][ T459] syz.1.26 (459) used greatest stack depth: 22360 bytes left [ 39.527361][ T468] loop0: detected capacity change from 0 to 512 [ 39.547616][ T454] EXT4-fs (loop4): feature flags set on rev 0 fs, running e2fsck is recommended [ 40.267610][ T30] audit: type=1400 audit(1759427195.268:121): avc: denied { write } for pid=456 comm="syz.2.29" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 40.294523][ T454] EXT4-fs (loop4): mounting ext2 file system using the ext4 subsystem [ 40.304957][ T454] EXT4-fs: failed to create workqueue [ 40.310564][ T454] EXT4-fs (loop4): mount failed [ 40.450547][ T30] audit: type=1400 audit(1759427198.898:122): avc: denied { read write } for pid=478 comm="syz.0.33" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 40.505062][ T30] audit: type=1400 audit(1759427198.928:123): avc: denied { open } for pid=478 comm="syz.0.33" path="/dev/raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 40.538352][ T30] audit: type=1400 audit(1759427198.928:124): avc: denied { ioctl } for pid=478 comm="syz.0.33" path="/dev/raw-gadget" dev="devtmpfs" ino=254 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 40.580297][ T480] SELinux: policydb string does not match my string SE Linux [ 40.590127][ T30] audit: type=1400 audit(1759427199.028:125): avc: denied { load_policy } for pid=469 comm="syz.2.31" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 40.618025][ T480] SELinux: failed to load policy [ 40.634510][ T30] audit: type=1400 audit(1759427199.078:126): avc: denied { create } for pid=481 comm="syz.1.34" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 40.758853][ T483] Zero length message leads to an empty skb [ 40.781946][ T483] loop3: detected capacity change from 0 to 2048 [ 40.794613][ T465] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 40.841842][ T30] audit: type=1400 audit(1759427199.288:127): avc: denied { map } for pid=481 comm="syz.1.34" path="/dev/ashmem" dev="devtmpfs" ino=265 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 40.868572][ T30] audit: type=1400 audit(1759427199.288:128): avc: denied { create } for pid=481 comm="syz.1.34" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 40.888672][ T30] audit: type=1400 audit(1759427199.318:129): avc: denied { setopt } for pid=481 comm="syz.1.34" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 40.924138][ T483] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 40.947550][ T483] ext4 filesystem being mounted at /7/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 41.124448][ T6] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 41.174518][ T465] usb 1-1: config 127 has an invalid interface number: 32 but max is 0 [ 41.193455][ T465] usb 1-1: config 127 has no interface number 0 [ 41.204461][ T465] usb 1-1: New USB device found, idVendor=07ab, idProduct=fc01, bcdDevice=64.06 [ 41.222390][ T465] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 41.284989][ T465] ums-freecom 1-1:127.32: USB Mass Storage device detected [ 41.494496][ T6] usb 3-1: config 127 has an invalid interface number: 32 but max is 0 [ 41.506321][ T6] usb 3-1: config 127 has no interface number 0 [ 41.519947][ T6] usb 3-1: New USB device found, idVendor=07ab, idProduct=fc01, bcdDevice=64.06 [ 41.537934][ T6] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 41.602598][ T498] loop1: detected capacity change from 0 to 512 [ 41.605106][ T6] ums-freecom 3-1:127.32: USB Mass Storage device detected [ 41.662491][ T498] EXT4-fs (loop1): Ignoring removed mblk_io_submit option [ 41.682331][ T499] netlink: 8 bytes leftover after parsing attributes in process `syz.0.33'. [ 41.697885][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 41.697936][ T30] audit: type=1400 audit(1759427200.128:133): avc: denied { create } for pid=478 comm="syz.0.33" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 42.289664][ T498] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 42.658674][ T501] syz.2.36[501] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 42.658767][ T501] syz.2.36[501] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 42.672369][ T501] netlink: 8 bytes leftover after parsing attributes in process `syz.2.36'. [ 42.770351][ T498] EXT4-fs (loop1): mounting ext2 file system using the ext4 subsystem [ 43.124715][ T487] syz.4.35 (487) used greatest stack depth: 21216 bytes left [ 43.141034][ T498] EXT4-fs (loop1): warning: checktime reached, running e2fsck is recommended [ 43.264926][ T30] audit: type=1400 audit(1759427200.128:134): avc: denied { write } for pid=478 comm="syz.0.33" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 43.290456][ T498] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=a043c01c, mo2=0102] [ 43.304283][ T505] fuse: Unknown parameter 'use00000000000000000000' [ 43.348011][ T498] System zones: 0-2, 18-18, 34-34 [ 43.410688][ T498] EXT4-fs error (device loop1): ext4_orphan_get:1401: inode #15: comm syz.1.37: iget: bad i_size value: 360287970189639680 [ 43.468976][ T30] audit: type=1400 audit(1759427200.128:135): avc: denied { read } for pid=478 comm="syz.0.33" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 43.613557][ T498] EXT4-fs error (device loop1): ext4_orphan_get:1406: comm syz.1.37: couldn't read orphan inode 15 (err -117) [ 43.694190][ T498] EXT4-fs (loop1): mounted filesystem without journal. Opts: nolazytime,abort,lazytime,mblk_io_submit,noauto_da_alloc,,errors=continue. Quota mode: none. [ 43.947442][ T499] syz.0.33 (499) used greatest stack depth: 21176 bytes left [ 43.996753][ T502] usb 1-1: USB disconnect, device number 2 [ 44.051945][ T30] audit: type=1326 audit(1759427202.488:136): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=497 comm="syz.1.37" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdb42de7ec9 code=0x7ffc0000 [ 44.076317][ T30] audit: type=1326 audit(1759427202.488:137): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=497 comm="syz.1.37" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdb42de7ec9 code=0x7ffc0000 [ 44.099749][ T30] audit: type=1326 audit(1759427202.488:138): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=497 comm="syz.1.37" exe="/root/syz-executor" sig=0 arch=c000003e syscall=132 compat=0 ip=0x7fdb42de7ec9 code=0x7ffc0000 [ 44.123632][ T30] audit: type=1326 audit(1759427202.488:139): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=497 comm="syz.1.37" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdb42de7ec9 code=0x7ffc0000 [ 44.147064][ T30] audit: type=1326 audit(1759427202.488:140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=497 comm="syz.1.37" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdb42de7ec9 code=0x7ffc0000 [ 44.168797][ T515] netlink: 'syz.3.42': attribute type 12 has an invalid length. [ 44.185535][ T515] netlink: 'syz.3.42': attribute type 29 has an invalid length. [ 44.193537][ T515] netlink: 148 bytes leftover after parsing attributes in process `syz.3.42'. [ 44.458812][ T30] audit: type=1400 audit(1759427202.598:141): avc: denied { create } for pid=514 comm="syz.3.42" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 45.057990][ T502] usb 3-1: USB disconnect, device number 2 [ 45.064462][ T30] audit: type=1400 audit(1759427202.598:142): avc: denied { ioctl } for pid=514 comm="syz.3.42" path="socket:[16489]" dev="sockfs" ino=16489 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 45.255525][ T547] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 45.318656][ T553] hub 1-0:1.0: USB hub found [ 45.332119][ T553] hub 1-0:1.0: 1 port detected [ 45.405439][ T568] device vlan0 entered promiscuous mode [ 45.604603][ T593] process 'syz.4.71' launched './file1' with NULL argv: empty string added [ 45.775339][ T606] netlink: 16 bytes leftover after parsing attributes in process `syz.2.77'. [ 45.814522][ T606] netlink: 92 bytes leftover after parsing attributes in process `syz.2.77'. [ 45.982907][ T617] netlink: 12 bytes leftover after parsing attributes in process `syz.1.81'. [ 46.002154][ T617] netlink: 12 bytes leftover after parsing attributes in process `syz.1.81'. [ 46.026179][ T617] ================================================================== [ 46.034288][ T617] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0x870/0x3240 [ 46.042490][ T617] Read of size 8 at addr ffff8881134d0bc0 by task syz.1.81/617 [ 46.050053][ T617] [ 46.052404][ T617] CPU: 0 PID: 617 Comm: syz.1.81 Not tainted syzkaller #0 [ 46.059532][ T617] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 46.069624][ T617] Call Trace: [ 46.072922][ T617] [ 46.075865][ T617] __dump_stack+0x21/0x30 [ 46.080225][ T617] dump_stack_lvl+0xee/0x150 [ 46.084861][ T617] ? show_regs_print_info+0x20/0x20 [ 46.090097][ T617] ? load_image+0x3a0/0x3a0 [ 46.094642][ T617] print_address_description+0x7f/0x2c0 [ 46.100231][ T617] ? tc_setup_flow_action+0x870/0x3240 [ 46.105805][ T617] kasan_report+0xf1/0x140 [ 46.110272][ T617] ? tc_setup_flow_action+0x870/0x3240 [ 46.115846][ T617] __asan_report_load8_noabort+0x14/0x20 [ 46.121511][ T617] tc_setup_flow_action+0x870/0x3240 [ 46.126824][ T617] mall_replace_hw_filter+0x293/0x820 [ 46.132245][ T617] ? pcpu_block_update_hint_alloc+0x8c1/0xc50 [ 46.138343][ T617] ? mall_set_parms+0x520/0x520 [ 46.143249][ T617] ? tcf_exts_destroy+0xb0/0xb0 [ 46.148177][ T617] ? mall_set_parms+0x1e8/0x520 [ 46.153066][ T617] mall_change+0x526/0x740 [ 46.157513][ T617] ? __kasan_check_write+0x14/0x20 [ 46.162674][ T617] ? mall_get+0xa0/0xa0 [ 46.166866][ T617] ? tcf_chain_tp_insert_unique+0xac1/0xc10 [ 46.172793][ T617] tc_new_tfilter+0x12a2/0x1870 [ 46.177675][ T617] ? tcf_gate_entry_destructor+0x20/0x20 [ 46.183348][ T617] ? security_capable+0x87/0xb0 [ 46.188253][ T617] ? ns_capable+0x8c/0xf0 [ 46.192742][ T617] ? netlink_net_capable+0x125/0x160 [ 46.198071][ T617] ? tcf_gate_entry_destructor+0x20/0x20 [ 46.203742][ T617] rtnetlink_rcv_msg+0x81b/0xb90 [ 46.208732][ T617] ? rtnetlink_bind+0x80/0x80 [ 46.213457][ T617] ? memcpy+0x56/0x70 [ 46.217590][ T617] ? avc_has_perm_noaudit+0x2f4/0x460 [ 46.222994][ T617] ? arch_stack_walk+0xee/0x140 [ 46.227883][ T617] ? avc_denied+0x1b0/0x1b0 [ 46.232421][ T617] ? stack_trace_save+0x98/0xe0 [ 46.237358][ T617] ? avc_has_perm+0x158/0x240 [ 46.242070][ T617] ? avc_has_perm_noaudit+0x460/0x460 [ 46.247509][ T617] ? x64_sys_call+0x4b/0x9a0 [ 46.252142][ T617] ? selinux_nlmsg_lookup+0x416/0x4c0 [ 46.257557][ T617] netlink_rcv_skb+0x1e0/0x430 [ 46.262350][ T617] ? rtnetlink_bind+0x80/0x80 [ 46.267055][ T617] ? netlink_ack+0xb60/0xb60 [ 46.271671][ T617] ? __netlink_lookup+0x387/0x3b0 [ 46.276743][ T617] rtnetlink_rcv+0x1c/0x20 [ 46.281206][ T617] netlink_unicast+0x876/0xa40 [ 46.286004][ T617] netlink_sendmsg+0x86a/0xb70 [ 46.290794][ T617] ? netlink_getsockopt+0x530/0x530 [ 46.296015][ T617] ? security_socket_sendmsg+0x82/0xa0 [ 46.301530][ T617] ? netlink_getsockopt+0x530/0x530 [ 46.306761][ T617] ____sys_sendmsg+0x5a2/0x8c0 [ 46.311555][ T617] ? __sys_sendmsg_sock+0x40/0x40 [ 46.316634][ T617] ? import_iovec+0x7c/0xb0 [ 46.321185][ T617] ___sys_sendmsg+0x1f0/0x260 [ 46.325899][ T617] ? __sys_sendmsg+0x250/0x250 [ 46.330717][ T617] ? sock_show_fdinfo+0xa0/0xa0 [ 46.335597][ T617] ? __fdget+0x1a1/0x230 [ 46.339874][ T617] __x64_sys_sendmsg+0x1e2/0x2a0 [ 46.344839][ T617] ? ___sys_sendmsg+0x260/0x260 [ 46.349726][ T617] ? __kasan_check_write+0x14/0x20 [ 46.354877][ T617] ? switch_fpu_return+0x15d/0x2c0 [ 46.360023][ T617] x64_sys_call+0x4b/0x9a0 [ 46.364468][ T617] do_syscall_64+0x4c/0xa0 [ 46.368909][ T617] ? clear_bhb_loop+0x50/0xa0 [ 46.373614][ T617] ? clear_bhb_loop+0x50/0xa0 [ 46.378317][ T617] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 46.384260][ T617] RIP: 0033:0x7fdb42de7ec9 [ 46.388704][ T617] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 46.408341][ T617] RSP: 002b:00007fdb41850038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 46.416788][ T617] RAX: ffffffffffffffda RBX: 00007fdb4303efa0 RCX: 00007fdb42de7ec9 [ 46.424787][ T617] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 0000000000000007 [ 46.432782][ T617] RBP: 00007fdb42e6af91 R08: 0000000000000000 R09: 0000000000000000 [ 46.440782][ T617] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 46.448774][ T617] R13: 00007fdb4303f038 R14: 00007fdb4303efa0 R15: 00007ffd69177218 [ 46.456890][ T617] [ 46.459914][ T617] [ 46.462239][ T617] Allocated by task 617: [ 46.466470][ T617] __kasan_kmalloc+0xda/0x110 [ 46.471163][ T617] __kmalloc+0x13d/0x2c0 [ 46.475591][ T617] tcf_idr_create+0x5f/0x790 [ 46.480185][ T617] tcf_idr_create_from_flags+0x61/0x70 [ 46.485648][ T617] tcf_gact_init+0x346/0x580 [ 46.490244][ T617] tcf_action_init_1+0x3f7/0x6a0 [ 46.495181][ T617] tcf_action_init+0x1e9/0x710 [ 46.500070][ T617] tcf_exts_validate+0x217/0x520 [ 46.505007][ T617] mall_set_parms+0x48/0x520 [ 46.509739][ T617] mall_change+0x45a/0x740 [ 46.514171][ T617] tc_new_tfilter+0x12a2/0x1870 [ 46.519036][ T617] rtnetlink_rcv_msg+0x81b/0xb90 [ 46.524145][ T617] netlink_rcv_skb+0x1e0/0x430 [ 46.528916][ T617] rtnetlink_rcv+0x1c/0x20 [ 46.533338][ T617] netlink_unicast+0x876/0xa40 [ 46.538218][ T617] netlink_sendmsg+0x86a/0xb70 [ 46.543120][ T617] ____sys_sendmsg+0x5a2/0x8c0 [ 46.547993][ T617] ___sys_sendmsg+0x1f0/0x260 [ 46.552684][ T617] __x64_sys_sendmsg+0x1e2/0x2a0 [ 46.557653][ T617] x64_sys_call+0x4b/0x9a0 [ 46.562066][ T617] do_syscall_64+0x4c/0xa0 [ 46.566479][ T617] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 46.572619][ T617] [ 46.574943][ T617] The buggy address belongs to the object at ffff8881134d0b00 [ 46.574943][ T617] which belongs to the cache kmalloc-192 of size 192 [ 46.589026][ T617] The buggy address is located 0 bytes to the right of [ 46.589026][ T617] 192-byte region [ffff8881134d0b00, ffff8881134d0bc0) [ 46.602691][ T617] The buggy address belongs to the page: [ 46.608427][ T617] page:ffffea00044d3400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1134d0 [ 46.618721][ T617] flags: 0x4000000000000200(slab|zone=1) [ 46.624371][ T617] raw: 4000000000000200 ffffea00043e5f80 0000000a0000000a ffff888100042c00 [ 46.632962][ T617] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 46.641544][ T617] page dumped because: kasan: bad access detected [ 46.647955][ T617] page_owner tracks the page as allocated [ 46.653685][ T617] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 109, ts 5680601462, free_ts 0 [ 46.668697][ T617] post_alloc_hook+0x192/0x1b0 [ 46.673474][ T617] prep_new_page+0x1c/0x110 [ 46.677987][ T617] get_page_from_freelist+0x2cc5/0x2d50 [ 46.683546][ T617] __alloc_pages+0x18f/0x440 [ 46.688132][ T617] new_slab+0xa1/0x4d0 [ 46.692205][ T617] ___slab_alloc+0x381/0x810 [ 46.696817][ T617] __slab_alloc+0x49/0x90 [ 46.701145][ T617] kmem_cache_alloc_trace+0x146/0x270 [ 46.706520][ T617] kernfs_fop_open+0x343/0xb30 [ 46.711284][ T617] do_dentry_open+0x834/0x1010 [ 46.716048][ T617] vfs_open+0x73/0x80 [ 46.720185][ T617] path_openat+0x2646/0x2f10 [ 46.724786][ T617] do_filp_open+0x1b3/0x3e0 [ 46.729337][ T617] do_sys_openat2+0x14c/0x7b0 [ 46.734018][ T617] __x64_sys_openat+0x136/0x160 [ 46.739026][ T617] x64_sys_call+0x219/0x9a0 [ 46.743572][ T617] page_owner free stack trace missing [ 46.748952][ T617] [ 46.751289][ T617] Memory state around the buggy address: [ 46.757029][ T617] ffff8881134d0a80: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc [ 46.765214][ T617] ffff8881134d0b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 46.773282][ T617] >ffff8881134d0b80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 46.781358][ T617] ^ [ 46.787546][ T617] ffff8881134d0c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 46.795626][ T617] ffff8881134d0c80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 46.803680][ T617] ================================================================== [ 46.811740][ T617] Disabling lock debugging due to kernel taint [ 46.829767][ T30] kauditd_printk_skb: 25 callbacks suppressed [ 46.829783][ T30] audit: type=1400 audit(1759427205.278:168): avc: denied { read } for pid=83 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 46.857809][ T30] audit: type=1400 audit(1759427205.278:169): avc: denied { search } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 46.879190][ T30] audit: type=1400 audit(1759427205.278:170): avc: denied { write } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 46.900993][ T30] audit: type=1400 audit(1759427205.278:171): avc: denied { add_name } for pid=83 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 46.921553][ T30] audit: type=1400 audit(1759427205.278:172): avc: denied { create } for pid=83 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 46.942280][ T30] audit: type=1400 audit(1759427205.278:173): avc: denied { append open } for pid=83 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 46.965598][ T30] audit: type=1400 audit(1759427205.278:174): avc: denied { getattr } for pid=83 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1