last executing test programs: 195.839207ms ago: executing program 3 (id=4): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) getsockopt$WPAN_WANTLQI(0xffffffffffffffff, 0x0, 0x3, &(0x7f0000000040), &(0x7f00000000c0)=0x4) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = syz_kvm_add_vcpu$x86(0x0, &(0x7f00000004c0)={0x0, &(0x7f0000000200)=[@nested_create_vm={0x12d, 0x18, 0x1}, @nested_create_vm={0x12d, 0x18}, @nested_vmresume={0x130, 0x18}, @uexit={0x0, 0x18, 0x101}, @wr_drn={0x68, 0x20, {0x4, 0xd2}}, @out_dx={0x6a, 0x28, {0xa13e, 0x4, 0x3}}, @enable_nested={0x12c, 0x18}, @nested_load_syzos={0x136, 0x118, {0x1, 0x100000001, [@wr_drn={0x68, 0x20, {0x0, 0x1}}, @wr_drn={0x68, 0x20, {0x5, 0x4}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x1, @ro_nat=0x6406, 0x4, 0x37d, 0x2}}, @nested_amd_vmload={0x182, 0x18, 0x2}, @nested_vmresume={0x130, 0x18, 0x2}, @out_dx={0x6a, 0x28, {0xe5cc, 0x0, 0xfffffffffffffff4}}, @out_dx={0x6a, 0x28, {0xc190, 0x7, 0x3}}]}}, @nested_vmlaunch={0x12f, 0x18, 0x3}, @nested_amd_vmsave={0x183, 0x18, 0x2}, @set_irq_handler={0xc8, 0x20, {0x43}}, @code={0xa, 0x6e, {"64660f5c0e66ba4100b802000000eff30f082e260f7948fc66baf80cb86829958fef66bafc0cb8bfb2df37efc744240026010000c744240200500000ff1c2466ba610066b8000066ef400fc71bc42179c5c2003ea00000000000800000"}}, @out_dx={0x6a, 0x28, {0xa9a3, 0x3, 0x89b}}], 0x2be}) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000500)={"23715cfecf28f0f5242730591efecd7254b8cdcf48871e4994d31f49e498f549122e57bcbeef95f2f90b42dadcb37dcb18e7408aa2fa12c2c92d6113f20615aea6928ff2f54036f58cc5501a835917103a99965cc416f2d2bb1bc624c671f8f12555ea57569085c5723fc91e077cf44f104f4acf5e2b5bd8e3d601e292d238cc7db24f30d891034f630cef7ca71c5457accce4b84f013b4b5f4bcfc13d687d737974acc47a7d28dd37a04dbb6b9809ef3aed940472eafab9b56b51d5dc962030a5bfa260f8ecba6e357129f4251e093e034186c0584b15959f7bdac5547549f8e795dc477e71b16f319cb6568ee6072a93fd7b66dfe7fd184cdd8994d981f0298a045843ba588373c3da3c81313fd42b47e614a37d5d8aec5e814461e4ee04c1deb626b5c4460428747a1522b2085906f916c567cd24b040cc6be1e12b4f836af8001ce02087f68285e05c7d33c16d3ac25b8f2804af51ef09653d85c61427e6909f35527695d8e7820cc60941607545d9c0ab79f13be46ed01492f235bc3482e026263ea9b96e84999aeab28942d6b3575f60fbbe5d98fd27e9fdb98d2820be4fa5cccdb2211be6570227c3c43f6bfb2f815e3aa15996d8f1221cefa31d46e2ae2bf9e54f41598fd7b558d4fd0d6f01e673e3a1e83ad66fd8cf4793f4d128b85bd877d00193f9437678d9093f216bc18dacbf5c6140701bc4a19f98c38d4341f2892625224aeb1f93b32b3e5b33b2b0eebcec19d8bd45abcdcf3d573aeb806794e246f9986e61ec4366fe3505b1979362df85a6adbde73491b43004e39f2b2548d28d583f0cabf99880480fbe5b03b610969e8f0c155e922d4c35f434e8fe91ab1e595f50f5a5761639bf5b8494867c9e5d6e7eda95de6cbaa156aba137a98773307d6a68872ddd7913ef6fa6b2874c6a21b1c938bc7b38b1faaeddb89ff17d45e651553cf55324c277048113a5395b57e50191e4a4f4d6021d27ee34bd3190501ad8b4ca271f0818ba40236c976c5631f8fb5710ab1a3d65d898eaa636d9ecb436a3bb33ec8a3a7bc74befaf4828d5854091c6d13ddf588e46391771bd94e4353a713ada8a1da8bb125d0b30cd7d7d2e878d98101c04a18be48907d47c635870911ce405922c7a1cf7c36375442a84a91ba29e44ae0401671d2b52ab4faa7e283e2703175e2d18d0480bbfeaeacabe22c4396c403d24f8d622152190af858ebb68da58e79089216c6acd673409134677c0c2d6bddbe203f85b9ba44989556532c51332c4debd53e7cfc408b3fb3da39d39974b8e19c7fa495af51bbe291d804d8601d1512e3e01180d77e19f26d9b3d8d50e56048de45c8a00fdca953a8bc9fa8c387826bc8c76e3c926684ea9030a51fb93caefae95f01daaad75dfa01a4d7d5836a5107f2fb3d74f8b212c7de9304c14316218cbe9b1237981d818d00777"}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000001c0)={0x0, &(0x7f0000000140)=[@rdmsr={0x66, 0x18, {0x8e4}}, @enable_nested={0x12c, 0x18}, @nested_amd_inject_event={0x180, 0x38, {0x0, 0x8f, 0x7, 0x5}}], 0x68}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='io.stat\x00', 0x0, 0x0) r3 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r3, &(0x7f0000000040), 0x10) listen(r3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r4, &(0x7f0000001900)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001940)=ANY=[@ANYBLOB="e8010000", @ANYRES16=r5, @ANYBLOB="010028bd7000ffdbdf2508000000bc010280b401038054000180110002007063626328666372797074290000000008000100000001000a000200766c616e300000000a000200282b245e72000000050002000000000008000100060000000a000200762c616e300000001400018004000300040003000800010002000000240001800800010000000400080001000900000006000200ffff00000800010001010000b8000180040003008d000200766c616830005b1183404149a5a235eb64c22b44c0d05c215c69212da6c647d1bfdbec00000000327dd2bf9eedcb660f07cc920881a141885fcba8ec421cb6137c86717225c9deb09c8c4334248728583ca4ae5e8638fa8de0986656dbde27b5c4016d892bb21634e0fc4b4687a66b6d8751fc477f2e6dfc3b4a84991f49000000000000000000000000000008000100090000000500020000000000040003000c00c3b673797a5f74756e004400018008000100ff07000008000100c07f00000800010004000000080001000600000004000300060002002f000000080001000500000004000300080001000700000008000180040003002000018008000100ad00000008000100d800000008000100090000000400030004000100180001801400020073797a5f74756e00"], 0x1e8}}, 0x10004000) r6 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r6, &(0x7f0000000080), 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r9 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0x8}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x5, 0x9}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x74, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r10, {0x3, 0xf}, {}, {0x7, 0x10}}, [@filter_kind_options=@f_flow={{0x9}, {0x44, 0x2, [@TCA_FLOW_EMATCHES={0x40, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x15, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x34, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0x5, 0x7, 0x4c2}, {{0x2}, {0xf0ffff, 0x1, 0x0, 0x1}}}}, @TCF_EM_U32={0x1c, 0x2, 0x0, 0x0, {{0x1fde, 0x3, 0x5}, {0x6, 0x2, 0x2}}}]}]}]}}]}, 0x74}, 0x1, 0x0, 0x0, 0x24000045}, 0x2008c014) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r11 = openat$random(0xffffffffffffff9c, &(0x7f0000000200), 0x80481, 0x0) pwrite64(r11, &(0x7f0000000080)="625430c10d", 0xff3c, 0x100000001) setsockopt$sock_linger(r6, 0x1, 0x3c, &(0x7f0000000180)={0x1, 0x5}, 0x8) futex(0x0, 0x5, 0x2, 0x0, 0x0, 0x3000000) syz_usb_connect$uac1(0x3, 0x8c, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0xa4e, 0x4040, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x7a, 0x3, 0x1, 0x5b, 0x10, 0xe8, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xc, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x101, 0x8, 0x0, 0xc1}, @as_header={0x7, 0x24, 0x1, 0x8, 0x82, 0x1001}]}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0x1, 0x33, 0x46, {0x7, 0x25, 0x1, 0x0, 0xf, 0x400}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x4, 0x40}]}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x8, 0xd, 0x6, {0x7, 0x25, 0x1, 0xc, 0xb, 0x4}}}}}}}}]}}, 0x0) 128.297778ms ago: executing program 1 (id=2): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x10, 0x4, &(0x7f0000001240)=ANY=[@ANYBLOB="1800000000000000000000000000000071104500000000009500000000000000c8189dd2672f10797b19b5b54ee874a250a08fcba9b33193242eafc79d9539d87f223c03be6a633c74fb2f22dd49ec90985bac00d3cde0d661f4dfebf3203ebf5fda2d9a3dddc2f1fc6a7ec8c3e548c204132861f2169a4016a02af866b622873e6ebbae0df63ca935b08c98a48cb771fe1134c5e6a22f367ddee9e1396e2e431863cb0196ff11167ea0ea06c36f73644b2329c3c0449a0bf5d57f79a65470df4af37390e65b8f59387d744bb07ca31724ef3153d91ce6376e59e84497364cf4aae3724c8ffa0d8fce0a671304e7ad87449d930f99767351"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, 0x24}, 0x94) r1 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=ANY=[@ANYBLOB="14000000040000000800000006"], 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\a\x00'], 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000011c0)=ANY=[@ANYRES32=r1, @ANYRESDEC=r1, @ANYRESDEC=0x0, @ANYBLOB="821153a10341c7660ddcb65c25e96ad3272f8c8b", @ANYBLOB="a91191", @ANYRES32=r0, @ANYRES16=r0], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r1, &(0x7f0000000280), &(0x7f0000001880)=@udp6}, 0x20) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, &(0x7f00000000c0)='/dev/input/event#\x00') prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x4000)=nil, 0x4000, &(0x7f0000000280)='\x00') bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000200)={r1, &(0x7f0000000140), 0x0}, 0x20) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_RESIZE(r3, 0x50009403, &(0x7f0000000300)=ANY=[]) write$tun(0xffffffffffffffff, &(0x7f0000002340)=ANY=[@ANYBLOB="0800080000030600cdfd2f00400047ed0fc000680000052f90780a010101e00000020144040e30000000042188"], 0xfce) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r4, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x0, @multicast2}, 0x2}}, 0x2e) connect$inet6(r5, &(0x7f0000000180)={0xa, 0x4e1d, 0x0, @empty, 0x61}, 0x1c) writev(r4, &(0x7f00000001c0)=[{&(0x7f0000000080)='s', 0x34000}], 0x1) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000002140)=ANY=[], 0x23c}, 0x1, 0x0, 0x0, 0x20000004}, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000480)={'gre0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000002500)={&(0x7f0000002580)=ANY=[@ANYBLOB="40100000", @ANYRES16=r7, @ANYBLOB="010000000000000000000c0000001410038004100400fc654c187d6eb5f0ca15095cc8787b50b96435ad3147dd10e867248d37187c2a131a62d105462ce34d5cf8ded36159aea612a3460534d8c298556e91590238f40dd2c7148d365ab6cdd5f2a7f74bac8d59f731c655a46917f18b28ed05e58b70287d26677601258a5c0ab9f679e2e520228c3a1f1aede04c6ba82cc38cc2ab6b35a24fb20e032dedf6f6caf4bfea5435f746f746fd46ca192e3744eb6908b358c10833bf484237ba654641e6186a45957c6345e61ea620fdc74383ce1df4a24e7044bae596f018736424a5bfa438865044e7026fa37a3540fadd0e89d87aecd3bc127e0cb10274991d6127224a0f2a4ef19e2c4dedbe45f2471abcc38c584ead0e3df3f9211022b2421fb6b327361e8f58f2b73134fc5444b350ede95ecef5bbbf9950e75c9f772a3ff0180d2cfac287228709726a6abbab2971982de7f1a9149d71dcbfd212e89ff17cf284b7f8ad82a469cb1c1e3d9d1d3689271c8dad0ba89dda651d4242062ac0bc5877e397236fa9476ac5fac7c2c896babca09d74720004cd0e634327de4fd87ed72ae069c095d2c70caed52e3335478c1c3719925e24f2fd7755baebd5cde385727a0f0440dd3b662248c43ff5afc4f186ff0051ba8eaa07623b79c4bb6985f14c5ac15041a6ff7584f921982e5414481d4db4c76798d70a59b5aeccb6e7882aefe70993758b55b4dc4039c2b1c98452113aaf23ccdf68cb6eff6e048f9da6f39a2def3caaf80cdcbadb83b029b8738391f02fec90c8a8b6f036aae8ceaff5dca7d3e0098472bd246c0b3004d1988f802b846d62ca59e9a63ce12814176ec4380e1cf29d27e7b2f7e7eadcaae8f182498ad32e67323fe6ef9508fec40dd38897652053ef92e44a909060c237890c196f0c26ab10248f999001f6231813a81313971bea77a5470f312d185dce689adc99e430e4010a3a341482c51fb71c23c3cdf92303c7580c73775f9a74685a61ce9849eaca52b97ee7ffe2e672dc1be5267c285a102711b1b5d81d6dbb76494f2892fd4f85244ade3cdd3809fd5fdfce5157fc1658f0bceb379489732583707c170fc6392aa4f5b94843aeb18da58e0156e029c2b722918b1b3dc7c151cb9c248ddd18423629b53cd4b0ab2693b0df29c88c04657f4eccdc41357de8186fdc0ec86f92950734975921a2fde57c3e7176b57c871d76ff8a8f36520b67e64930cf34bcde9ad92d057a359ca022b646df18e2b7202845bd8ac4be5e5ebae436dc4b93dfaaf2778a53e7e4be937e83dac7d1d481bdbd8081ab0ac08af067e62580bbdbf397cbc629db9b023734b6fad7824d1a8b3257c1c18d6ebc928140060f004ec484b183560f830a1eb0c527c8600bb2600d761e847454e677aa2948788079c1b17f8330790a066aa407a9e9a5e9dc9542de038e3e55fdfec13184cdb16716556f972eef5c56230c43d146c86a9147265c309a279db6d138647920410896c5397c5f83634fa5e92b5161f786482d84830864388b91c2c1e3e9f9f038d5fa66f7fe904e14df0a60d46066c6b1f37cec6e13c35832f512be21da21a5921b81cc452b0076c2ec10fc5481cd0e1ca917b40cb3aa839b120ce6eb9773e942b74ececac6bdcd22eb8dd6cd9f148e0ebe5ef3094f42adc39bc5ca2259e1eab5059ccf5e82bb57b97d4d13a90747299b2e6b64f962aabf222e4f287503181de3c3a68fb2b0068583f3b97e40ce06e9805a7121eccac0527b8f1b18a62762efe0a9ce4114b7d1ba942bc93533ee0b1bd7f0a607207b976dfa1fbe3ce0868e7f4e31b41a0aada0ac6b291aefe22ea5338f07e57b981b8e4e4a121f231d2f46989fd5dd09a7c1d198f5886b4f1a222eccdabff096a81fef3c9e497621128562880938fe05a1f1c4da81daba55bf326f1e3a1712d79f01fbef2ee230615d4e454be67f0ad4dc2bfffaecbb683742925738b45854ab713ae548b9709e9ea2e28224ef466bced79e3ec6c163d45db187bc01c75afa85f78003927dcd122086acc8dd1b1224de41d62b83e34083dd39fe68aa5a479ba403f5dbddf9b763ca521b7efca6234be16484f1e0112d963672a6d24cdac15e80bcb82b3b22231670c41fe7e8a0a083b6df768e7fb0d94a004f8372f5cf8b9b45cc679eb67828a94d0ffabfe09d95ad2789cb8657f7ea86a46260416a72e6fc7b44e549a2e39fe015c7647cc0bec15fa63d26894be1cc5326331e7e0b1c505934182accf049bab033b026d48fda51de740afc0666e6c891e0c5192f4b2df21493477ff45319d7d8b816f0b73ccfa12d6846362feb4b85063ca42e950eb577c630300dc52698a38ca19cbbb398404a1e8e27d0be49985e59caef03da096d1ccbeed73bd7c9588325b747ab77f4d7c1c1f18388ce1771882ee680ed737ad197ff92f1052e5e79f6ffa5b85ba3fac5db13e0d0046c9dca0ab4b74b20299ba6bdd758940e088df31e1382cee6901503299028467a864d27affae30fd9aef5a6ff948c052124511a75a46d5a316e28fb6c5bfac787be5833c63c535557235b0e09f9a78a338aa8864613fca77a7e252d1975af2c4a6bcc969d1e20e3cd4dfc1b2fe34b70fd7804dbfde4fa4d950e5fb4eb926dece9e4601b12efe322bb42ac808158fef0a26900000000726654987e7de20d1e41e82c607c33c6bae7bb234744b51dc683d5857afd6ba8246cebc734e393806ef102a6baaf04f3a7c3cb888d5830e1c6ae170c5c920e806b4f518be4416b216cdf9b1658a412d9e4eab6c9b20ce99960f27e77fdf9a2e98b35c63859f9db6bdcbef1001a19e12e41370f9358531987851ab64c250e68a8569ace4418e2118caff7d3d4caf1c87bc50a8ae75770fdae88a8490c041b39d08190d8b7c908caddd66331a508929d53dd6bc2dbc86f97115ff0a364b70f96918e6ed354c97e59ea5e2c7b149cd51d7c85a27ac658e78b99326857858df0ac0ee240cbb6ee9d9ee6c2c2ff7c29dd25fd337dc08bddeb50305ed48b9f5d89c55ffedde29ce0412ea8e2c976f961eb0c4966d2a8be0b657a5e51048a8a10005c488e1f637ce208a35b5aed0c2067465191dc42ebf6e4853cc89998bdf2ef755f38a3cd985b62df36a5ebc3b47df32423ee46857f9db9d756ff69ecd4ef2f307dcaefd4a1f399543952df972269c28200df8ebacad4eed1c00b9ce9841799bea583cafdeaa8d4a371a8ae55d8ffe4846833985975d8b234adff63eace9d2c4d1680c370827ebe1831ef311077607e8c4920506e03528861085dcfdb918f1efe91420c390fbca0a38377e1635c402ec1c34eddae986ffa8756b27f6c340907bae99f4a6b328fca8177b4dfaceea5ad3ceb901dbcefc15ded322bece4e750969e81935764ebe88749464af7e692e3d324c519b456013daae93bd63215540380a7fe08f0e050cdeb25db2a8b9b6f5720ad1e7d2c5b6d609712eccd321d6211fb642a4cdf72504aabd017a9b4827d1e0e0264435a5e1045dbe33834968d2db503972995559b1efe1b9ce475405118346b63f637b1abf8e8374e7100d6b41c9c672d2b244c7a82ffb882522efd9e903fc69db14c469685780005843856c6623591f305d383eae55a1a1d5619dfff0027413f26fa6a793a348ba8b192e1b088745a2175d55517a75d4b63cce41cc0dcaca9002cd37a1ccc6710ba2a099297b0824f976919e8abf3b1510b1305a95241fefbd036afa9d4538affc82f005d29b9f2c0e60d6c20f673b8ca28cb088e1e89efe334f25ffe1a3fb3581e5aa63b9a4a49f269b5538788aacbbc04d49902ae2af1f59d2484ab6ba7a9b477be0d92e221fc48cdbc00bef7125bfe36f9afb1cbd58fef21625ec99ffd2e35fb00767e3f22dba7d36163203cfaf1860a8b1afe0d878ea00fe08f68fd592a6395fb357acbdc2834c8ac85571527dbf1dbaaccede3d583e2b9bf076737716785f44aebc7ba917fb426d5541adff1e75836ab70fb0b43565ab5e24c5902879f31701cc006b4ee2f57be0916cf0b6cd489c4fa9129031a4af75a00048f20eb962f0c6f68cda0d7756a4e83f7d065c4a00b8263d95f6b979507b7ca01735e83a5e5ff0b76f077ef6e4c1150f9202b5311a231b76111d48a387e09075edb2448fb19d2869ae420ada8ee7577fe980ed7e057dc963c0a98db790bb5b7920220f8a55213b6530637b832abdf3c6fefdefb712a2c2c9eba8087ce39335ddabdadb86f493061e593981c6b2d70b4bac3b58885787c46f85c1022f5ff6cec16ba227aa5dac2e0be30522c08369f18d170b9cb454f3ebf86d1e923fdd65245d8e0c476bfedddcb772453f4d0e70d059e79b8811c379c9eff6e45d9bc81186930b32b24cdcb906a41fe29c147ed834b37e77800a33c15e65d121ee85a924ef6bbc1c8f4a423fbc5d14645a08178229d4c7f111fa318823a6c075ddf9e131c9bca8d56dec4a68fbab9a0c1a128880d8b4dec59b89ec33c19eb76f09f31ad730cba735b60deba54c399119949e45af4de5c758281945fe6b6a25ac1cd57a81b48f11a6575e79b82e529d4ba1b2a1175cfa03ef6d149b165195fa64736b302e28ee6444368fb395a2d89c8747348b546a07ed0306682971539f0031d88ffa020d0b3d40369e0a3d2238293a75a155eb5c0749f64ed37a9af5be26d5a4322a55a23c33d176280bd0e4c5168f2e66bca925304d0f32074f5e68d7c43f9e2e3f14a6bcf3e77e6b71737131c3e90208072e37c8a6cad1cabd756aa694e85b86256ce13b43541a26438374b6029ee461d223ed34ed1e9a3e580cec7b2b41bc9823b3729e683f079a498636d022799dd94c5e870b6aa7f3d36fb51ffb6c5e317fcde6b5ae45073f8e90ee0fc1fa0641ff6f0b789dcc6df2fe9a3b5e6ed9d2be3403f5af96e7c6019b0a0ce4f8342323638a52c121956de068069fe5c44946b5023e1db7742fec29cb749bcdc09d795b683c553dbae1298540b2cf1bc3e5e52adf252bca47ba2182c80541daf1d11b1c67675171e69c1abe3c0bc3a0f2d1a6e2165ca1647c394970a404a6002621a258cef01e2ca12a138888dace9ad06d2f0c0209f286c11b289626aa557cc201560651054a6042e84c6fc5e345e2f702d61851fed5ffa36ade652f76db815dabb7b8eee016ea0836d0086f2a2f7bd1c4a4ceb1d706817b41347a891c34b45eb06a9ecb19041d5a39f050cb0413662dc4700385fac2e1823e1ce4d08c66692fde0862a057f2aa2425d511735fff53d0e3d88bfb245e7724ba4ba8452e469862d333dad5c63bfa778809c043132db3a57e122d0495441f7a07034a3ac1024b8fc063694d8316c29639cb6605ff362a853f976c763f6d10e4e0972760e60f08acdd8a73607e7311819fe24ad8b670bbf0adede086f91bd0839ce37927f43a263e3e8369932db9ab786ba66e1bba664bfa8aa50d98ed18fc90e560933c2e8da72757a4539756740a73c41180cf97fde47cf3e9e6005302459d831eea7a03157e0c3178776e4d4add3999b9a1efca7c99b8234ff9d33492431dd9bd0814301ee49260e30b8b6afc46ce8a733bc9d7850c789e5e98cdefbfb11131a85bc24e75453a16c6780ab4229b985d1fe7a255f71cfe18398e881d493ded88300b54f6c4a5567fd84a6e1f11835433448a00420ab1b3a49fcc0e9938da52b68f9409c94a0de61f0beb69532c4f7a11fae6a9ffd10db7de01e3272448b517ad795a06f3fef8148b7196cb81a80aed42e395c1ac346dd27f9bce87661e19f957a17d54d59b68e023c1516ae9ba4d75f18d4b8fc7e9fe6f70000000000000000000008000200fd7f000004000100180001801400020064756d6d7930", @ANYRESDEC=0x0, @ANYRES64=r6], 0x1040}, 0x1, 0x0, 0x0, 0x20048090}, 0x8850) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000001340)=ANY=[@ANYBLOB="2c030000", @ANYRES16=r7, @ANYBLOB="01002abd7000ffdbdf250c000000440203800800020000800000ed000400eaf6254f4485f59416dba8c222a9fa861df97f1d7782b603666ccebe8a1a4295e626ce546c25267ccca50ba65d10117e933c5bd93638592445962828db75d480b236a517db588d19c869e08a5c416b5d25f36a55fab0fe0626294adf39b905619beb11fd6e2fda78d67aab74c9ffaa6356552352716e9ce02f18fe8595f510f126cfd4ee51dab9238406fecc4529870c3152c4a38d7dde9ca95db96e1c810be7eccd35e78cf7623ab96abad65ceb895bdf5d1c86bb09f49670b3cf046e6164840c15cd0d2465d45ef2fdbf366846570ad2bb961e30e4f2fd2d63d9bbbde646fce6e1901ea2bdd062c1000000d000040098a3cc8cd97ca72744e2a28a94bdeac2a4aaae6ec998bf7cb19c61a3f273c40e0553165988d3f8449cd847cbab2cb9c21190d4580a1be10961721bf1518d2413f94f57fece7f007448f9be92f4e316d9da96300fc30847b2d53dfb4b77114f17242041024fca0cebb14878307d1f951aeb8061f628bf5dec7201564c282826499ebc47ece4cb4e053b6cb5659e9507be0a3e84ef602f335f984aaee0c16bddb714044e31c705ec1bd0c4aefe658367b0c5adc21c6c2634ce644d35f65dfad3f209f921921c89bb2ddf18a24b2400038020000180040003000b00020025235b28282e0000080001000d00000004000300530004008534ffbb777b15191bd48937f64e4ab68f7b6a7107413dbd07400c10897c808299a0ab2c1211f37fdef658331c674b178788875b5f61a9832966805bf5c9fcf8006bb73dd37b67e0ac75d8f6bf3a2b00d4000380d00003801000018004000300060002005b00000020000180040003000800010004000000040003000c000200657468746f6f6c007c000480040003000800020047504c0048000200c42f3a2365a046d4bfa1028cf13a52271a1c37e4007f6eab766152dfcf15d6436bbb2fc58b9c5809f1cbd2e1785bc2aea7855147995d26988958a52e73d6bc373f5e6a4b0800010001000000080001009a090000040003000800010001800000080002005b5c2b0020000180080001000000000004000300040003000400030004000300040003005aa6efc5d5b91717171c253bf58d97152f17ff348df50a1f004b6433035ac31614f3efef85f7e3fccf2022ac4e8a35e14f8885d2ec7f7d242a680be2f5cf323fe457f4c2e9d9fa585ce788340fca0c4247eb3721ffc1609dc3ada9767fac70bd5b9ad4979cd424c820a8aa1e4f24f0e0ef7d1c0e4be26d146b03863bb7eae0f7b5fecea712b0c3e955617f4106d46dce834240f1c725e636e31c00b7faabc7384fe09f07415d549c1cd961c4bfd26dcaf2a4b3b2b2394296d7acedf927066b776a8d1874cf643f185c7949589c670bea2cac0b3c0a9a4fb4d8d36ed020a2fb56640b87c3591b597e3ac491746c3ed988811c81565c666d4b5e96a07aeae80c4f647eab4ef9301a0b434e5c692258f0c1da4537b03fd7"], 0x32c}}, 0x408c895) futex(&(0x7f0000000380)=0x1, 0x2, 0x0, &(0x7f00000003c0)={0x0, 0x3938700}, &(0x7f0000000400), 0x1) r8 = socket$nl_sock_diag(0x10, 0x3, 0x4) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r8, 0x8933, &(0x7f00000002c0)={'vxcan0\x00'}) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) 44.485859ms ago: executing program 0 (id=1): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_RELOAD_REGDB(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)={0x14, r1, 0x1, 0x70bd29, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x40000) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FLUSH_PMKSA(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4040000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, r1, 0x200, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0xff, 0x78}}}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x4000084) syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc)=0x1, 0x800000000006, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc)=0x40000000, 0x800000000006, 0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f00000006c0), &(0x7f0000000300)='./file0\x00', 0x0, &(0x7f0000000380)=ANY=[], 0x7e, 0x2fa, &(0x7f00000010c0)="$eJzs3bFrJFUYAPBvNrvJ5kA2hXgogiM2ViF3coXdBYkgF1A8gigWBm8Pj0wUsrCwW9xeGu0trBT/Ay1tBQu1sbCwFUHigY3XySlEJjuz2Wwyu7nDuxPz+xXZl/e+783ON4/MBDYv7zy9vXWtEdfv3NmLZjOJehKX427EUtRiLiqUA3f3hxpVgQDAf9Gf+/vxR3Ebf9TvBQB4ONz/AeDsGd3/L338ydqotz4Z9trwZfBQ3xsA8GDk9//d8Ps/AJwlV99868rq+vra62najNj+qBvdjYPXxSLgetyILNqxEq34O4onheHTQv715VfW11bS3G9LsbE96G4c5A+6G8MPCa6W+ReiFUt5zmAiP1lrREQ+w9H8RpyLyIdu/Hwu2nExWvH4yce/mA4d5C9GkT8fzz83dvzlaMWP78YHkY3Ovcy/eSFNX3p1PY16+UHGPH8hrpWBi8fr9t1SeF4CAAAAAAAAAAAAAAAAAAAAAOC+LacjJ+7fs7BcNT7MX60X/w5wJVo/vXFkf57m0f2B0rQeEYf59Xjq2DbDAAAAAAAAAAAAAAAAAAAAcDZ1ev2tzSxr70xrvP/9F99ETI/p7f2wWMxZ9jSK70cxf/W3komY6UdvRXun3CRgZvA9Nh579tdPq2N2k4r63D7sSWYcYi6JGETE8aFkWuW/fmai5+3hVgz5PM2IZFSN2lwcZiW3OldmVrVZ1HJ2feZm1PDbvfeefKFz/tLk0NUnYvx6VV24hbwxObQw9SrPz1qrjWlL6/fW2Docb+zex/pJ84uRN27lPV/+2yvznhrlWRc9SWUNz392efOrm7/cPu3M+aTJg/qxAwAAAAAAAAAAAAAAAAAAnKDT69dOF/nhi0XDHwUDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8L/T6fW3NrOsPR+9/ueRZe2dsqeykafVona64LzxqM8RAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD+CQAA//+FuWwx") 0s ago: executing program 4 (id=5): syz_mount_image$msdos(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x20cc16, &(0x7f0000000880)=ANY=[@ANYBLOB='dots,gid=', @ANYRESHEX=0xee01, @ANYBLOB="2c6e6f646f74732c646f74732c74696d655f6f66667365743d3078303030303030303030303030303264382c646f74732c646f74732c6e6f646f74732c6e6f646f74732c646f74732c646f74732c6e6f646f74732c6e6f646f74732c636865636b3d72656c617865642c666c7573682c64656275672c646f74732c73686f77657865632c6e6f646f74732c6572726f72733d636f6e74696e75652c646f74732c71756965742c003fa5bfd3e968f92d300444698c6f8d94d8b46ce3ce652bc8f6"], 0x3, 0x22e, &(0x7f0000000480)="$eJzs3cFOE08cB/DfQqGF/z+Rm4mJyRoPeiJqfACM0cRIYoLpQW8kcmLjgV5aLvAYvoLv5QMYTlzMGNwuC21dSJWWms/nwo/5ziw7O2R3L52mKH27+yU6nSyWtmIrTrPYiKWoHMeo1lgLALA4TlOK7yml9ZTS5B7PG0Z7DwCARVQ9/9Nvn//xY8anBADcsPcfPr59sd2OnTzvRJwc97v9bvmzzF+/2X71JP9loxrzX5z0+93l8/xpPvrucJavxPowf1aOz8/j1Yjorsbjh2V+lr18t51fHt+OTzc+ewAAAAAAAAAAAAAAAAAAAAAAmI/7kVc26tZ6f5/NzdF8bZiXv13YH2hk/55W3Ku2B663B0pHs5gUAAAAAAAAAAAAAAAAAAAALJje4HB/tyj2DuqiHREXW1p1lLLL0YQiGx64qc8tKpZiuuFrw2leo/PnkZZseImaR7X+8BquTV7c6xTRui2rM22R/4XjpDu7RdGulnmsTzT/A6R0VkxewWpbjEtR5PV6rUZE8xk+2pl2XqcppeLrg4PeIFJj5/oe0Z7FjQgAAAAAAAAAAAAAAAAAALjwEfHxrLM8jzMCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgNnrDQ6rb/k/3N8tir0sBmVx0LuyOIqI/+PKztXfWonO/CYKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAP+1nAAAA//8zfBSj") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x8040, 0x20) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r1, 0x40081271, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0xffffffffffffffeb, &(0x7f0000000240)=0xfe) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsopen(0x0, 0x0) setsockopt$inet6_int(r1, 0x29, 0x18, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4c0c8) r4 = openat$vcsu(0xffffffffffffff9c, 0x0, 0x600, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) read$FUSE(r4, 0x0, 0x0) epoll_pwait(0xffffffffffffffff, &(0x7f0000000040)=[{}], 0x1, 0x2, 0x0, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZEX(r5, 0x560a, &(0x7f00000006c0)={0x4, 0x0, 0x0, 0x0, 0x132, 0x3}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20048054}, 0x4000) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x173) rename(&(0x7f0000000000)='./file2\x00', &(0x7f0000000140)='./file1\x00') kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.106' (ED25519) to the list of known hosts. [ 22.503618][ T28] audit: type=1400 audit(1782596224.599:64): avc: denied { mounton } for pid=278 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.507240][ T278] cgroup: Unknown subsys name 'net' [ 22.526569][ T28] audit: type=1400 audit(1782596224.599:65): avc: denied { mount } for pid=278 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.553910][ T28] audit: type=1400 audit(1782596224.629:66): avc: denied { unmount } for pid=278 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.554399][ T278] cgroup: Unknown subsys name 'devices' [ 22.693228][ T278] cgroup: Unknown subsys name 'hugetlb' [ 22.698855][ T278] cgroup: Unknown subsys name 'rlimit' [ 22.804377][ T28] audit: type=1400 audit(1782596224.899:67): avc: denied { setattr } for pid=278 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.827673][ T28] audit: type=1400 audit(1782596224.899:68): avc: denied { mounton } for pid=278 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 22.852605][ T28] audit: type=1400 audit(1782596224.899:69): avc: denied { mount } for pid=278 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.860470][ T280] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.884855][ T28] audit: type=1400 audit(1782596224.979:70): avc: denied { relabelto } for pid=280 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.907135][ T278] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.910722][ T28] audit: type=1400 audit(1782596224.979:71): avc: denied { write } for pid=280 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.944700][ T28] audit: type=1400 audit(1782596224.979:72): avc: denied { read } for pid=278 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.970242][ T28] audit: type=1400 audit(1782596224.979:73): avc: denied { open } for pid=278 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.739227][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.746392][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.754035][ T286] device bridge_slave_0 entered promiscuous mode [ 23.768625][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.775778][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.783321][ T286] device bridge_slave_1 entered promiscuous mode [ 23.889127][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.896262][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.903787][ T288] device bridge_slave_0 entered promiscuous mode [ 23.930164][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.937259][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.944788][ T288] device bridge_slave_1 entered promiscuous mode [ 23.951364][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.958500][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.965994][ T289] device bridge_slave_0 entered promiscuous mode [ 23.973105][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.980159][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.987752][ T289] device bridge_slave_1 entered promiscuous mode [ 24.000439][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.007710][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.015213][ T287] device bridge_slave_0 entered promiscuous mode [ 24.042535][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.049625][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.057157][ T287] device bridge_slave_1 entered promiscuous mode [ 24.089380][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.096593][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.104095][ T290] device bridge_slave_0 entered promiscuous mode [ 24.111204][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.118260][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.125761][ T290] device bridge_slave_1 entered promiscuous mode [ 24.202229][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.209323][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.216712][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.223779][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.329740][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.336845][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.344214][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.351279][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.365615][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.372795][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.380088][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.387184][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.409098][ T42] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.416524][ T42] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.424023][ T42] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.432351][ T42] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.439560][ T42] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.446884][ T42] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.455683][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.463293][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.494785][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.503005][ T42] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.510026][ T42] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.517681][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.526035][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.533158][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.548876][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.581703][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.589292][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.598487][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.606902][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.615245][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.622340][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.630022][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.638285][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.645331][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.652943][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.681623][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.690294][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.698550][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.705637][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.713714][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.722587][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.730722][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.737771][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.745249][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.753539][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.760567][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.768015][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.776036][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.796481][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.804955][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.813596][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.820672][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.828266][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.836851][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.845508][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.853831][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.862179][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.869206][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.876709][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.884798][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.892978][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.903778][ T286] device veth0_vlan entered promiscuous mode [ 24.916760][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.925339][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.933633][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.940658][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.948277][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.957592][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.965722][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.973853][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.981980][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.990042][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.998231][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.006721][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.014924][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.022523][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.043785][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.052144][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.062441][ T286] device veth1_macvtap entered promiscuous mode [ 25.071929][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.079678][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.088190][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.096578][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.105006][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.124297][ T287] device veth0_vlan entered promiscuous mode [ 25.131506][ T288] device veth0_vlan entered promiscuous mode [ 25.141127][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.149613][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.158228][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.167324][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.175766][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.184258][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.192749][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.200563][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.208884][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.216888][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.224978][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.233073][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.241499][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.249091][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.256766][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.264355][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.271993][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.279498][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.299636][ T287] device veth1_macvtap entered promiscuous mode [ 25.307758][ T289] device veth0_vlan entered promiscuous mode [ 25.316118][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.324748][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.333333][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.342260][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.350491][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.359169][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.367461][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.375673][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.386558][ T288] device veth1_macvtap entered promiscuous mode [ 25.401774][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.409696][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.418157][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.427383][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.435797][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.452558][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.469956][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.474030][ T286] request_module fs-gadgetfs succeeded, but still no fs? [ 25.480261][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.494699][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.503223][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.515977][ T289] device veth1_macvtap entered promiscuous mode [ 25.531603][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.543026][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.560158][ T290] device veth0_vlan entered promiscuous mode [ 25.567683][ T311] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.591415][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.599428][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.607844][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.616786][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.629237][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.637989][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.646864][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.654702][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.688795][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.699332][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.713093][ T290] device veth1_macvtap entered promiscuous mode [ 25.732050][ T315] ================================================================== [ 25.735783][ T321] loop4: detected capacity change from 0 to 256 [ 25.740168][ T315] BUG: KASAN: use-after-free in mutex_lock+0x86/0x1b0 [ 25.753222][ T315] Write of size 8 at addr ffff888132387950 by task syz.1.2/315 [ 25.760790][ T315] [ 25.763141][ T315] CPU: 1 PID: 315 Comm: syz.1.2 Not tainted syzkaller #0 [ 25.770197][ T315] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 25.780312][ T315] Call Trace: [ 25.783609][ T315] [ 25.786553][ T315] __dump_stack+0x21/0x24 [ 25.790901][ T315] dump_stack_lvl+0x110/0x170 [ 25.795596][ T315] ? __cfi_dump_stack_lvl+0x8/0x8 [ 25.800636][ T315] ? mutex_lock+0x86/0x1b0 [ 25.805087][ T315] print_address_description+0x71/0x200 [ 25.810648][ T315] print_report+0x4a/0x60 [ 25.814988][ T315] kasan_report+0x122/0x150 [ 25.819512][ T315] ? mutex_lock+0x86/0x1b0 [ 25.823951][ T315] kasan_check_range+0x249/0x2a0 [ 25.828913][ T315] __kasan_check_write+0x14/0x20 [ 25.833862][ T315] mutex_lock+0x86/0x1b0 [ 25.838133][ T315] ? __cfi_mutex_lock+0x10/0x10 [ 25.843039][ T315] ? kfree+0x6f/0xf0 [ 25.846949][ T315] ? l2tp_session_put+0xaf/0x1a0 [ 25.851902][ T315] ? l2tp_session_delete+0x3df/0x4d0 [ 25.857210][ T315] pppol2tp_release+0x178/0x2b0 [ 25.862073][ T315] sock_close+0xc9/0x220 [ 25.866332][ T315] ? __cfi_sock_close+0x10/0x10 [ 25.871208][ T315] __fput+0x1fd/0x8f0 [ 25.875226][ T315] ____fput+0x15/0x20 [ 25.879270][ T315] task_work_run+0x1e1/0x250 [ 25.883889][ T315] ? __cfi_task_work_run+0x10/0x10 [ 25.889025][ T315] ? __cfi___close_range+0x10/0x10 [ 25.894156][ T315] ? do_user_addr_fault+0x9a5/0x1030 [ 25.899462][ T315] exit_to_user_mode_loop+0x9b/0xb0 [ 25.904686][ T315] exit_to_user_mode_prepare+0x87/0xd0 [ 25.910162][ T315] syscall_exit_to_user_mode+0x1a/0x30 [ 25.915631][ T315] do_syscall_64+0x58/0xa0 [ 25.920150][ T315] ? clear_bhb_loop+0x30/0x80 [ 25.924836][ T315] ? clear_bhb_loop+0x30/0x80 [ 25.929529][ T315] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 25.935442][ T315] RIP: 0033:0x7f496ed9ce59 [ 25.939886][ T315] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 25.959500][ T315] RSP: 002b:00007fffda85d638 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 25.967939][ T315] RAX: 0000000000000000 RBX: 00007fffda85d720 RCX: 00007f496ed9ce59 [ 25.975920][ T315] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 25.983900][ T315] RBP: 00000000000063fc R08: 0000000000000001 R09: 0000000000000000 [ 25.991904][ T315] R10: 0000001b2da20000 R11: 0000000000000246 R12: 00007fffda85d760 [ 25.999895][ T315] R13: 00007f496f015fac R14: 000000000000645b R15: 00007f496f015fa0 [ 26.008157][ T315] [ 26.011188][ T315] [ 26.013603][ T315] Allocated by task 317: [ 26.017870][ T315] kasan_set_track+0x4b/0x70 [ 26.022487][ T315] kasan_save_alloc_info+0x1f/0x30 [ 26.027613][ T315] __kasan_kmalloc+0x95/0xb0 [ 26.032241][ T315] __kmalloc+0xb4/0x1e0 [ 26.036426][ T315] l2tp_session_create+0x38/0xbd0 [ 26.041479][ T315] pppol2tp_connect+0xbf5/0x1640 [ 26.046434][ T315] __sys_connect+0x3da/0x460 [ 26.051038][ T315] __x64_sys_connect+0x7a/0x90 [ 26.055813][ T315] x64_sys_call+0x88d/0x9a0 [ 26.060447][ T315] do_syscall_64+0x4c/0xa0 [ 26.064887][ T315] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 26.070802][ T315] [ 26.073131][ T315] Freed by task 315: [ 26.077029][ T315] kasan_set_track+0x4b/0x70 [ 26.081628][ T315] kasan_save_free_info+0x2b/0x40 [ 26.086674][ T315] ____kasan_slab_free+0x132/0x180 [ 26.091797][ T315] __kasan_slab_free+0x11/0x20 [ 26.096573][ T315] slab_free_freelist_hook+0xc2/0x190 [ 26.101952][ T315] __kmem_cache_free+0xb7/0x1b0 [ 26.106817][ T315] kfree+0x6f/0xf0 [ 26.110542][ T315] l2tp_session_put+0xaf/0x1a0 [ 26.115317][ T315] l2tp_session_delete+0x3df/0x4d0 [ 26.120457][ T315] pppol2tp_release+0x169/0x2b0 [ 26.125335][ T315] sock_close+0xc9/0x220 [ 26.129600][ T315] __fput+0x1fd/0x8f0 [ 26.133603][ T315] ____fput+0x15/0x20 [ 26.137599][ T315] task_work_run+0x1e1/0x250 [ 26.142220][ T315] exit_to_user_mode_loop+0x9b/0xb0 [ 26.147434][ T315] exit_to_user_mode_prepare+0x87/0xd0 [ 26.152908][ T315] syscall_exit_to_user_mode+0x1a/0x30 [ 26.158468][ T315] do_syscall_64+0x58/0xa0 [ 26.162897][ T315] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 26.168809][ T315] [ 26.171136][ T315] The buggy address belongs to the object at ffff888132387800 [ 26.171136][ T315] which belongs to the cache kmalloc-512 of size 512 [ 26.185203][ T315] The buggy address is located 336 bytes inside of [ 26.185203][ T315] 512-byte region [ffff888132387800, ffff888132387a00) [ 26.198487][ T315] [ 26.200819][ T315] The buggy address belongs to the physical page: [ 26.207259][ T315] page:ffffea0004c8e100 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x132384 [ 26.217614][ T315] head:ffffea0004c8e100 order:2 compound_mapcount:0 compound_pincount:0 [ 26.225952][ T315] flags: 0x4000000000010200(slab|head|zone=1) [ 26.232066][ T315] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 [ 26.240670][ T315] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 26.249262][ T315] page dumped because: kasan: bad access detected [ 26.255688][ T315] page_owner tracks the page as allocated [ 26.261420][ T315] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 289, tgid 289 (syz-executor), ts 25589627871, free_ts 0 [ 26.283142][ T315] post_alloc_hook+0x1f5/0x210 [ 26.287933][ T315] prep_new_page+0x1c/0x110 [ 26.292457][ T315] get_page_from_freelist+0x2ca9/0x2d20 [ 26.298024][ T315] __alloc_pages+0x1fa/0x610 [ 26.302633][ T315] alloc_slab_page+0x6e/0xf0 [ 26.307247][ T315] new_slab+0x98/0x3e0 [ 26.311343][ T315] ___slab_alloc+0x70f/0xb70 [ 26.315968][ T315] __slab_alloc+0x5e/0xa0 [ 26.320339][ T315] __kmem_cache_alloc_node+0x204/0x2d0 [ 26.325820][ T315] __kmalloc_node+0xa2/0x1e0 [ 26.330421][ T315] qdisc_alloc+0x82/0x750 [ 26.334763][ T315] qdisc_create_dflt+0x6b/0x3a0 [ 26.339630][ T315] dev_activate+0x30e/0x1110 [ 26.344232][ T315] __dev_open+0x40d/0x520 [ 26.348579][ T315] __dev_change_flags+0x1f2/0x6b0 [ 26.353616][ T315] dev_change_flags+0x80/0x1a0 [ 26.358418][ T315] page_owner free stack trace missing [ 26.363800][ T315] [ 26.366164][ T315] Memory state around the buggy address: [ 26.371896][ T315] ffff888132387800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.379985][ T315] ffff888132387880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.388060][ T315] >ffff888132387900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.396123][ T315] ^ [ 26.402804][ T315] ffff888132387980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.410871][ T315] ffff888132387a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.418938][ T315] ================================================================== [ 26.457088][ T311] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4'. [ 26.470327][ T315] Disabling lock debugging due to kernel taint [ 26.488079][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.511651][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.520801][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.529329][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.673251][ T328] loop0: detected capacity change from 0 to 256 [ 26.682106][ T328] FAT-fs (loop0): Unrecognized mount option "À" or missing value [ 26.770959][ T48] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 26.985375][ T319] syz.0.1 (319) used greatest stack depth: 21320 bytes left [ 27.110925][ T48] usb 4-1: Using ep0 maxpacket: 16 [ 27.118732][ T48] usb 4-1: New USB device found, idVendor=0a4e, idProduct=4040, bcdDevice= 0.40 [ 27.153541][ T48] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.161673][ T48] usb 4-1: Product: syz [ 27.165861][ T48] usb 4-1: Manufacturer: syz [ 27.170479][ T48] usb 4-1: SerialNumber: syz [ 27.382543][ T48] usb 4-1: found format II with max.bitrate = 257, frame size=8 [ 27.390268][ T48] usb 4-1: 1:1 : invalid UAC_FORMAT_TYPE desc [ 27.396723][ T48] usb 4-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 27.406439][ T48] usb 4-1: USB disconnect, device number 2 [ 27.611300][ T312] udevd[312]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory