last executing test programs: 377.002061ms ago: executing program 4 (id=5): writev(0xffffffffffffffff, 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002140), 0x0, 0x20004080) connect$inet(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000081110000bfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff0000000072030000000000001d400500000000004704000001ed000072030200030000001d440000000000006b0a02fe000000007303000000000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f1ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c107571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c1002000000843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba658934ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0ad2c1e86063d427f0688430754c02180d61542c2571f983e96735ff070000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d1abf3cb17b40ac9b10968f38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130bc01a2d61f3b39c64307f9c82b2807c9ff4a269841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67a41b9e320146ee9f566a28e4b8c222d96fb2000000000000"], &(0x7f0000002f00)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000002f40), 0x8, 0x10, &(0x7f0000002f80), 0x10}, 0x94) setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) epoll_create(0x7) socket$key(0xf, 0x3, 0x2) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0xc0142, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000003c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1200000004000000040000001200000000000000fc24034522f70da3e7c855281bd278be07fd198b090a8ab4ba05e86611cf0ea4bcb11f42b0a16731d6c6eef7c1c522e2da4a37db7760f08b781a389ddec5eda604a730577744f4b4c722e920d30343839c8f", @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) sendmsg$DEVLINK_CMD_SB_GET(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x8000) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000800)={0x0, 0x58}, 0x1, 0x0, 0x0, 0x20044000}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000980)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB], 0x24}, 0x1, 0x0, 0x0, 0x4048011}, 0x8080) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000a40)={r5, &(0x7f0000000a80), &(0x7f0000000ac0)=@tcp6=r4}, 0x20) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000dc0)={'syzkaller0\x00', @multicast}) writev(r0, &(0x7f0000000e00)=[{&(0x7f0000000e40)="89e7ee0c7cdad9b4b47380c988cafb", 0xf}, {&(0x7f00000000c0)="448b7c0acf8bc0cefe9360fcbe079c0ecdc1bd26e2903af616ec220b147127b664ce103b0b8f7732404a23adf06ea1ac7c4f7222d1dc5dbbae1618a78dcea360b80e512b84989846ea097b78fc516a46b65cdbbc36589d744aa82095b3dd3a309c4b163e04ef532b0159746e2186825a0000000000000000", 0x78}], 0x2) 363.462792ms ago: executing program 1 (id=2): r0 = socket(0x1e, 0x4, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x1a, 0x4, 0x0, &(0x7f0000000b80)='GPL\x00', 0xe, 0x0, 0x0, 0x0, 0x14, '\x00', 0x0, @tracing=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) close(0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000940), 0xffffffffffffffff) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000600)={'batadv_slave_0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f00000008c0)=ANY=[@ANYRES32=r2], 0x44}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000a40)={'wlan1\x00'}) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xe, 0x4, &(0x7f0000000100)=ANY=[], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x94) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)=[{0x0}], 0x1}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000c00)=ANY=[@ANYBLOB="3c0000001800efe000000000000000000a00000000000000000000000c00090008000000", @ANYRES32=0x0, @ANYBLOB="1400050000000000000000000000000000000002"], 0x3c}, 0x1, 0x11}, 0x24004800) 286.779053ms ago: executing program 1 (id=6): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) r2 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000200)={'vcan0\x00', 0x0}) connect$can_bcm(r2, &(0x7f0000000240)={0x1d, r3}, 0x10) sendmsg$can_bcm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x5, 0x840, 0x800, {0x0, 0x2710}, {0x77359400}, {}, 0x1, @canfd={{0x3}, 0x2c, 0x2, 0x0, 0x0, "77cdd5ec2fbc7a9ec4a453d493b56c7c14329ec7276f956b67944c3c74fa4e7197ca171b8de8de55252f560ae405bcfa7cf6dfdd4e660583b714a00b39113edb"}}, 0x80}, 0x1, 0x0, 0x0, 0x8004}, 0x0) sendmsg$can_bcm(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="05000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}, 0x1, 0x0, 0x0, 0x20000040}, 0x51) sendmsg$nl_route_sched(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)=@newtfilter={0x24, 0x11, 0x111, 0x70bd27, 0x100000, {0x0, 0x0, 0x74, r1, {0x6, 0xc}, {0x5, 0x10}, {0xd, 0x3}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4010}, 0xc4) socket$inet_icmp_raw(0x2, 0x3, 0x1) unshare(0x2c060000) close(0x4) 203.631695ms ago: executing program 1 (id=7): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x31, &(0x7f0000001180)=0x7, 0x4) bind$inet6(r0, &(0x7f00000011c0)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r0, &(0x7f0000000800)=[{{0x0, 0x0, 0x0}, 0x9}, {{&(0x7f00000002c0)=@l2tp6={0xa, 0x0, 0x0, @private0}, 0x0, &(0x7f0000000740)=[{&(0x7f0000000440)=""/81}, {&(0x7f00000004c0)=""/253}, {&(0x7f00000005c0)=""/110}, {&(0x7f0000000640)=""/31}, {&(0x7f0000000680)=""/157}], 0x0, &(0x7f00000007c0)=""/19}, 0x8}], 0x29, 0x82, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000001280)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) 174.262696ms ago: executing program 3 (id=8): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x31, &(0x7f0000001180)=0x7, 0x4) bind$inet6(r0, &(0x7f00000011c0)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r0, &(0x7f0000000800)=[{{0x0, 0x0, 0x0}, 0x9}, {{0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)=""/19, 0x13}, 0x8}], 0x2, 0x82, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000001280)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) 149.640627ms ago: executing program 0 (id=9): r0 = socket$inet6(0xa, 0x3, 0x3) connect$inet6(r0, &(0x7f0000000540)={0xa, 0x0, 0x0, @loopback, 0xfffffffc}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000380)={{{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in=@empty, 0x4f23, 0xfffc, 0x4e23, 0x2, 0xa, 0x2a11bad3d5f03f04, 0x30, 0x2f}, {0x100000000, 0x2, 0xfffffffffffffffe, 0x100000000, 0xfffffffffffffffb, 0x3, 0x8, 0x7fff}, {0x4, 0xfffffffffffffffe, 0x4, 0x9}, 0x10001, 0x0, 0x1, 0x0, 0x2, 0x3}, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x210000, 0x33}, 0xa, @in=@remote, 0xfffffffe, 0x0, 0x0, 0x17, 0x0, 0x0, 0xfffffffb}}, 0xe8) sendmmsg(r0, &(0x7f0000000480), 0x2e9, 0xffe0) 135.848987ms ago: executing program 1 (id=10): openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x40241, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000180), 0xffffffffffffffff) socket$netlink(0x10, 0x3, 0x10) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt(r0, 0xff, 0x24, &(0x7f00000009c0)="f0c46000", 0x4) syz_emit_ethernet(0x69, &(0x7f0000000000)={@multicast, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "42d1df", 0x33, 0x3a, 0x0, @initdev={0xfe, 0x88, '\x00', 0x3, 0x0}, @mcast2, {[], @param_prob={0x4, 0x0, 0x0, 0x0, {0x9, 0x6, "c76b72", 0x5, 0x11, 0x1, @ipv4={'\x00', '\xff\xff', @broadcast}, @mcast2, [], "96b24e"}}}}}}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) 126.081887ms ago: executing program 0 (id=11): r0 = socket$inet_udp(0x2, 0x2, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000140)=ANY=[@ANYBLOB="bbbbbbbbbbbbffffffffffff86dd6000000000303a0020010000000000000800000000000000ff0200000000000000000000000000010103"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x11, 0xb, &(0x7f00000001c0)=ANY=[@ANYBLOB="07000000000000000000000010000000180100"], 0x0, 0x8, 0x0, 0x0, 0x0, 0x2a, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xd}, 0x94) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x60, &(0x7f0000000080)={'filter\x00', 0x94489e87720a408, [{0xa00}, {0x0, 0x100000000000000}]}, 0xa50) 110.077088ms ago: executing program 0 (id=12): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, 0x0, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet_opts(r1, 0x0, 0xd, &(0x7f00000002c0)=';', 0x1) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000000300)=0x632a, 0x4) setsockopt$inet6_int(r1, 0x29, 0x31, &(0x7f0000000340)=0xb2, 0x4) sendmmsg$inet6(r1, &(0x7f0000000380)=[{{&(0x7f00000003c0)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c, 0x0}}], 0x1, 0x0) recvmmsg(r1, &(0x7f0000000400)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001f40)=""/4092, 0xffc}, 0x2}], 0x1, 0x40012141, 0x0) 87.498948ms ago: executing program 3 (id=13): socket$nl_route(0x10, 0x3, 0x0) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x40000, &(0x7f0000000980)={0x11, 0x6, 0x0, 0x1, 0x2, 0x6, @local}, 0x14) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f0000000a00)) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000a40)={'batadv_slave_0\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, &(0x7f0000000d40)) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000d80)) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000dc0)=0x207, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000001100)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001180)={0x0}}, 0x0) sendto$packet(r2, 0x0, 0x0, 0x4000801, &(0x7f0000001240)={0x11, 0xd, r4, 0x1, 0x0, 0x6, @local}, 0x14) 82.159348ms ago: executing program 0 (id=14): r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000000)=0x80000004, 0x4) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) 64.319658ms ago: executing program 0 (id=15): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000440)={0x1c, r1, 0x1, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4080}, 0x80) 63.276628ms ago: executing program 1 (id=16): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000780)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f00000007c0)={&(0x7f0000000800)=@hci, 0x80, &(0x7f0000000880)=[{&(0x7f00000008c0)=""/248, 0x200105d0}], 0x1}, 0x1f00) sendmsg$tipc(r1, &(0x7f0000000a00)={0x0, 0xfffffff5, &(0x7f0000000a40)=[{&(0x7f0000000a80)="a2", 0xfffffdef}], 0x1}, 0x0) sendmmsg$inet(r1, &(0x7f00000096c0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f00000065c0)=[{&(0x7f0000006580)="3423ad7c95e02c8dd1de56", 0xb}], 0x1}}, {{0x0, 0x0, &(0x7f0000008e00)=[{&(0x7f0000008c40)="59ea3472fc7304692ef73133671898a643b47bd44b30b1aa872babe5cc6f84da24f18abd8a37fd71a0f67e75f2b7ba414c963b6ad58de2c9e6111b6d21ab4da0440a88e91b946ee06af61a86997250aba800ba6fb0a3efd4e8a0", 0x5a}, {&(0x7f0000008cc0)="086d3ad58a00a30e831ec1fc4db22b040435894ce01e5f18e5eeb20746cddefc1d54b0b74bfc6b0d21beba133a5071c740c60b9e461ebcb035268daf990a13ba7aa307e5ac144e5dd00e3dd2b64c37d98491907e113809077e9a440ac1f0da3897a209bd78ee34ee15fc70d8d1a052c6ad1ff914f839607d82a9b5befb6d4cdd18dc149c0475b65ea4d988217e068824a3b5d399a62c24bc869ad43b51e5e7d87cb2ad3fc3ba275fdaf5374bdf9c876d6a0958598aea2a66e373227e1969b3304b73a269a8822ee315a1c9a28c2a8beb0c9a556d972235fa0ef2742bb825c622bf87eb1b9cafb60c", 0xe8}, {&(0x7f0000008dc0)="99e9a0cdf2a59cecc064eec37a3ec8b2d977cc643f3ac13c7441344c8f493c717fb6d7235aead64f559d1bf9c07f32fe0afba2", 0x33}], 0x3}}, {{0x0, 0x0, &(0x7f00000091c0)=[{&(0x7f0000008ec0)="682f33a0be55b5558a36d2c761473920228b767ab3dadc12b2bc0a924972e1fd080acee3edd40b272c3d7415db1565b37f", 0x31}, {&(0x7f0000008f00)="f46f6af4f9918328df49fabb12adbe82163c3647b05dee441d2f", 0x1a}, {&(0x7f0000008f40)="a2", 0x1}, {&(0x7f0000008f80)="36d5de865fd7ca9021eba1ad78582c6cbc38471bf1f3bad0f41c897f64643447b90986b52fb2f66c16ba33895e69175458972f0612b955041301b0129acecd4f8d5c40a4fb275bb1789a00f5d6f5d7eb367ea8f6a90aaa347cd8e005f1ef15807c41f4c39c2b9ba493dfc4fa40df5aa530bef0d3f488709486babead5327c2d90bcf8cb5ab934e063d5a53ef304169d2acce38041345bb8e223b335188df0c960508c44b1043d272c026dcf85f", 0xad}, {&(0x7f0000009040)="8c0404a50671ced718d0d57d484e92b9a343675cd004b1c37e9be9d76d88e288d4999726ed0c7c598a39ec9c4f298a9322fa98d6c54887d055b86c992ce10177c47ea7c6afddbb0164db8a3924e6c78994d77b52724ec87db4d16fd47a9069cec23346b658ff2a913e41e4b5a5b2b9aaee65ed06165e3f97e8d0302684d91a93eb92", 0x82}, {&(0x7f0000009100)="353a1a0fcb8ecc2f8b8dd4dbf36c6b58f7a12e81c5aef0d555f62c2982938b8397afc91b81f25980c1203dceaaa0271012bedb", 0x33}, {&(0x7f0000009140)="4aad731ef9951d0b964fc7b786b12d353291631454b422321b8b1a4e93540ea5da4902ddceedf80e259e4c6040abda4614531f04e3107480117be0aafbc9e477a792bd2b9be0427a4401e7672d5c977631967a45bd02be030ea1a940ce55798dc1d54ccd7e7c72dde03db596bd7629c1a25724a042e06eb5c35a", 0x7a}], 0x7, &(0x7f0000009240)=ANY=[], 0xc8}}, {{0x0, 0x0, &(0x7f0000009640)=[{&(0x7f0000009380)="cf1d092b0a3b61b96b291c261427d3aae96897a83da7ddd405166f9d8cfa0d2191b711f020767bf292f897123ec7881427e0e89726d84e092789748cbbd417c918f2e3c0f64d101872c8091670dea1148349f045cb90ac48d07a1e2cc1c0664e72eb06ef2376ecbe133ed8385a0b2622138c09ff7e4860a74732b6d5fd2fab9fac62822d7d19dd42fbd30f3d44d3d560d899180e1cc2884eec587201fd900d6a357cdfd9169208a5a63a00", 0xab}, {&(0x7f0000009440)="5fa0030322523b36a186751618221ac9a2026c41e18f84c45f48bf61f18de066129871d41d6b571c42631cddf15962cb82282ff5b8c975a76a93c4066f84604299cfb1e61f297e93605850823b770fa02842f5f6969f437bedbdb91fa1fdc3185acd0550de2a68d9e602e07b3cda0194174df496dcb5a1d3c5", 0x79}, {&(0x7f00000094c0)="dd27233d284254231a2645d499ad0e1d12e6a593d52eee70e3c66613d15c2fc6d5d4cd67ae5edd6c11e8a307c1902aeea8b31139c219bc16061be1abd2268cd262855a1e57dd8008654bac2534efcdb5e71807af85", 0x55}, {&(0x7f0000009540)="d9d67efaba3e8784e74c9373586d420486236f5d88930655b5cba42506977111cea3b29f47f32946a772416f099923281dc9c1d0ff400c10bdf33cab0fa35a70c8c76f7b2003389a4fc832d09e96fdb73626d42f99454b804c3b2a53a25c88f55dbcf90d31d48d96092bae6067d225079385547387f5b6f0628508760d780b3c98c1f389b70422a91f4f48a239ef931bac98cc4583f7af1d6dc9ce77d58938b7fd0c06de", 0xa4}], 0x4}}], 0x5, 0x10) 56.458419ms ago: executing program 2 (id=3): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f00000005c0)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000600)={0xa, 0x4e24, 0xfffffffc}, 0x1c) recvmmsg(r0, &(0x7f0000002700)=[{{0x0, 0x0, 0x0}, 0x344}, {{0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000440)=""/79, 0x4f}], 0x1}, 0x4}, {{0x0, 0x0, 0x0}, 0x844b}], 0x3, 0x40000022, 0x0) sendmmsg$inet6(r0, &(0x7f0000000680)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000740)="000000f5b8ac2bb992ebd4c7b3ba4f60bfed002da6280c91950619c2a0e39042e0e7800ae7b041ff132d7fb40180000014c56dc066ca", 0x36}], 0x1}}, {{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f00000007c0)="a603418c14260a2a66d792cf7e1960", 0xf}], 0x1}}], 0x2, 0x20e8086) sendmmsg(r0, &(0x7f0000000800), 0x4ff, 0x0) 50.608919ms ago: executing program 3 (id=17): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x20000000) sendmsg$nl_xfrm(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000740)=@newpolicy={0xfc, 0x13, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x1234, 0x1234, 0x0, 0x0, 0xa, 0x80, 0x80}, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@loopback, 0x4d2, 0x32}, 0xa, @in6=@loopback}]}]}, 0xfc}}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000840)={0xa, 0x1234, 0x0, @loopback}, 0x1c) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000200000ab4000000060a010400000000000000000a0000010900010073797a31000000004c000480340001800b000100746172676574000024000280080003009ac4200008000240000000000d000100434c41535349465900000000140001800b00010064796e7365740000040002800900020073797a32000000003c0005"], 0xdc}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) 394.56µs ago: executing program 0 (id=18): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000200)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x3, @dev}, 0x2}}, 0x2e) close(r0) socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @empty}, 0x2, 0x0, 0x2, 0x2}}, 0x2e) ioctl$PPPIOCGFLAGS(r0, 0x8004745a, &(0x7f00000002c0)) 316.34µs ago: executing program 3 (id=19): r0 = socket(0x1d, 0x2, 0x6) mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$pppl2tp_PPPOL2TP_SO_RECVSEQ(r0, 0x6a, 0x4, 0x0, 0x4) 94.88µs ago: executing program 3 (id=20): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000000)=@nat={'nat\x00', 0x19, 0x3, 0xc18, [0x200000001140, 0x0, 0x0, 0x200000001170, 0x200000001d28], 0x0, 0x0, &(0x7f0000001140)=[{0x0, '\x00', 0x600, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{0x3, 0x22, 0x890d, 'netpci0\x00', 'veth0_macvtap\x00', 'pim6reg0\x00', 'dummy0\x00', @multicast, [0x0, 0x0, 0xff, 0xff, 0xff], @empty, [0x0, 0xff, 0xff], 0x0, 0x9b8, 0xa40, 0xa70, [@among={{'among\x00', 0x0, 0x8b0}, {{@offset=0xc, @offset=0x480, 0x2, {[0x1, 0x7fffffff, 0x27d, 0x3, 0x9, 0x7e1, 0x8, 0x4, 0x9, 0xfffffffa, 0x3, 0x5, 0x1, 0x3, 0x3, 0x4, 0x4, 0xaa83, 0x7, 0x46a, 0x20000002, 0xfffffffb, 0x2, 0x6, 0x6, 0x3ff, 0xe9, 0x7, 0x0, 0x1, 0x1, 0x7fffffff, 0x0, 0x8, 0x7, 0xaa8e, 0xa, 0xfffffffe, 0x0, 0x2, 0x8, 0x7f, 0x3, 0x6, 0x1, 0x9a, 0x9, 0xa0c, 0x9, 0x4, 0xf6, 0x0, 0x9, 0x3, 0x7cb, 0xcd, 0x8, 0x5, 0xffffff5e, 0x4, 0x6, 0x1, 0x131, 0x4, 0x3, 0x5, 0x8, 0x2, 0x1fd4, 0x1, 0x4, 0x8, 0xc, 0xb, 0x3, 0xd, 0x7, 0x80000001, 0xfff, 0x8, 0xffff2ba4, 0xffffffff, 0x64, 0x3, 0x9, 0x0, 0xf, 0x16, 0x8, 0x40, 0x8, 0x506a, 0x63, 0x5, 0x81, 0x1ff, 0x0, 0x5, 0x9, 0x3, 0xbee2, 0x2c, 0xfffffffb, 0x0, 0x3, 0x100, 0x6, 0x81, 0x3, 0x81, 0x80, 0x8, 0xb, 0x10001, 0x400, 0xffffffff, 0x9, 0x0, 0x6, 0x7, 0x0, 0x0, 0x977, 0xfffffec0, 0x800, 0x80000, 0x8, 0x2, 0x0, 0x2, 0x3, 0xffff, 0x668b, 0x7, 0x0, 0x2, 0x10000, 0x8, 0xfffffed9, 0x8, 0x74fa0ddd, 0x7, 0x2, 0xbd, 0x800, 0xb, 0x5, 0xb7, 0x81, 0x7fff, 0xa01, 0x7, 0x1, 0x102c, 0xffff, 0x80000000, 0xfff, 0xe08, 0x1, 0x6, 0x1, 0x4, 0x7ff, 0x4, 0x8000, 0xf1135a8f, 0x7, 0x401, 0x180, 0x114, 0xc9e1, 0xc1e, 0x2, 0x77c, 0x80, 0x7ff, 0xfffffff8, 0x401, 0x6fce, 0x6, 0x9, 0x9, 0x7, 0x55a, 0x200, 0x3, 0xf0, 0x5, 0x9, 0x1a, 0x90, 0xf, 0x0, 0x1, 0x9, 0xb, 0xc49b, 0x5, 0x8000, 0x7, 0x8, 0x2, 0xc78, 0xc4, 0x7, 0xc96e, 0x6, 0xdc, 0x800, 0xdad, 0x6, 0x8, 0x7, 0x7ff, 0x9e, 0x0, 0xe3, 0x2, 0x1, 0x4, 0xffffffb3, 0x401, 0xc0000, 0x63, 0x8, 0xfff, 0x4, 0xffff, 0x401, 0x8, 0xb76, 0x1, 0x400000, 0xc8a, 0x3, 0x806, 0x1, 0x3cd, 0x9, 0x4, 0xbb, 0x6, 0x638, 0xfffffffd, 0x1, 0x8, 0x7, 0x1, 0xfe, 0x7, 0x80000001, 0x8, 0x5, 0x2, 0x6365, 0x77e2db41, 0x6], 0x9, [{[0x2, 0x81], @broadcast}, {[0x443, 0xffffffff], @empty}, {[0x4, 0x3d], @dev={0xac, 0x14, 0x14, 0x1d}}, {[0x7f, 0x7f], @multicast1}, {[0x7, 0x3], @empty}, {[0x8], @initdev={0xac, 0x1e, 0x0, 0x0}}, {[0x4, 0xa8], @multicast2}, {[0x9, 0x9], @dev={0xac, 0x14, 0x14, 0x26}}, {[0x8, 0x1], @initdev={0xac, 0x1e, 0x0, 0x0}}]}, {[0x400, 0x9, 0xe, 0x2, 0x7ff, 0x0, 0x7ff, 0x100, 0xfffffcda, 0x80000001, 0x8, 0x3, 0x900, 0x0, 0x8, 0xfffffff9, 0x0, 0x4, 0x0, 0x4, 0x400, 0x1, 0x5, 0x5, 0x218, 0x0, 0xe36, 0xffffff27, 0x2a, 0x9, 0xffffffff, 0x7ff, 0x4, 0xfffffffb, 0x4, 0xb532, 0x4, 0x5, 0x4, 0x7, 0x8, 0x5, 0x3, 0x4, 0x2, 0xa, 0x6, 0x1, 0xe, 0x4, 0x688000, 0x80, 0x2, 0x5, 0x5cd, 0x1, 0x2cbb, 0xfff, 0x7, 0x6b10, 0x5, 0x8, 0x9, 0x6, 0x7, 0x426a, 0x7, 0x28, 0x1, 0x8000, 0x5, 0x5, 0x100, 0x4, 0x7fff, 0x7e, 0x7f, 0x3ff, 0x22, 0xb, 0x0, 0xe, 0x400, 0x4, 0x2, 0x82, 0x5, 0xfaf2, 0x2, 0x4, 0x2, 0x5, 0xaec, 0xfffffff0, 0x1, 0x9e, 0x100, 0x3, 0x200, 0x1000, 0x7, 0x6, 0x6, 0x80, 0x5, 0x7, 0x9e1, 0x9, 0x2, 0x4, 0x0, 0x7ff, 0x9, 0x2, 0x3f, 0x9, 0x4, 0xcde, 0x2, 0x1, 0x7, 0x5d88711a, 0x5, 0x6, 0x8, 0x3, 0x10, 0x1, 0xb7d, 0xe, 0x6, 0x4, 0x6, 0x200, 0x0, 0x9, 0xb, 0x0, 0x10000, 0x2, 0x3, 0x2, 0x8, 0x6, 0x5, 0x4, 0x4, 0x4, 0x3, 0x9000000, 0x1ff, 0x80000000, 0x4, 0xa, 0x4, 0x9, 0x1ff, 0x0, 0x3ff, 0xe0b, 0x1, 0xa, 0x1, 0x8000, 0x9, 0xd, 0x5, 0x6, 0x6, 0x5, 0x21c, 0x1, 0xffffffff, 0x8, 0x4, 0x562, 0x3ff, 0x153d, 0x81, 0x0, 0x6, 0x54ce, 0xfffffffa, 0x5, 0x9, 0x7, 0x8d1, 0x5, 0x0, 0x5, 0x7, 0x2, 0x6, 0x3, 0xff, 0x7ff, 0xdc2f, 0x9, 0x4, 0x7, 0x2, 0xfffffffe, 0x1d57d23, 0xe2, 0x6, 0x7, 0x3, 0x7, 0x6, 0x9, 0x5, 0x7, 0x4, 0x2, 0xe26, 0x0, 0x1, 0x3, 0xd9, 0x9, 0x6, 0x3, 0x9, 0x8000, 0x0, 0x6, 0x6, 0x7, 0x1, 0xff, 0x2, 0x4, 0x5, 0xb84, 0xfffffffc, 0x80, 0x3, 0x9, 0x2, 0x80000001, 0x1, 0x2, 0x8, 0x8, 0x0, 0x0, 0x9, 0xff, 0x0, 0x0, 0x602a, 0x2, 0x5, 0x4, 0x9, 0x4], 0x3, [{[0x7, 0x9], @broadcast}, {[0x2, 0xfffffffe], @loopback}, {[0x3, 0x1], @multicast2}]}}}}, @stp={{'stp\x00', 0x0, 0x48}, {{0x5, {0x3, 0x3a6, 0x1, @broadcast, [0x0, 0xff, 0xff, 0x0, 0xff, 0xff], 0xa, 0x5, 0x9, 0x8, @empty, [0x0, 0x0, 0xff, 0x0, 0xff, 0xff], 0x4e22, 0x4e22, 0x0, 0x7, 0x3, 0x3, 0x8, 0x5, 0x8, 0x5}, 0x4a0, 0x4}}}], [@common=@log={'log\x00', 0x28, {{0x5, "c8b74bdeedad59677d4a4539c7fc8b3fb08237cf59a67067206f71d30f21", 0xc}}}, @snat={'snat\x00', 0x10, {{@multicast, 0xffffffffffffffff}}}], @common=@AUDIT={'AUDIT\x00', 0x8, {{0x2}}}}, {0x3, 0x0, 0x7, 'team_slave_1\x00', 'veth1_to_team\x00', 'wg2\x00', 'veth1_to_bridge\x00', @remote, [0x0, 0xff, 0xff, 0xff, 0x0, 0x80], @random="a3cb2decf3d6", [0x0, 0xff, 0xff, 0xff, 0xff], 0x0, 0x70, 0xe0, 0x118, [], [@snat={'snat\x00', 0x10, {{@random="c0c21274e672", 0xfffffffffffffffc}}}, @arpreply={'arpreply\x00', 0x10, {{@link_local, 0xfffffffffffffffa}}}], @snat={'snat\x00', 0x10, {{@dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0xfffffffffffffffc}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe}]}, 0xc90) 0s ago: executing program 3 (id=21): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x4, &(0x7f0000000300)=@framed={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x1}, [@call={0x85, 0x0, 0x0, 0xd1}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.39' (ED25519) to the list of known hosts. [ 21.414732][ T30] audit: type=1400 audit(1792368857.086:64): avc: denied { mounton } for pid=277 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.416266][ T277] cgroup: Unknown subsys name 'net' [ 21.442558][ T30] audit: type=1400 audit(1792368857.086:65): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.471431][ T30] audit: type=1400 audit(1792368857.116:66): avc: denied { unmount } for pid=277 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.471612][ T277] cgroup: Unknown subsys name 'devices' [ 21.556209][ T277] cgroup: Unknown subsys name 'hugetlb' [ 21.562239][ T277] cgroup: Unknown subsys name 'rlimit' [ 21.699771][ T30] audit: type=1400 audit(1792368857.366:67): avc: denied { setattr } for pid=277 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.724145][ T30] audit: type=1400 audit(1792368857.366:68): avc: denied { mounton } for pid=277 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 21.753507][ T30] audit: type=1400 audit(1792368857.366:69): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.760616][ T279] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 21.788653][ T30] audit: type=1400 audit(1792368857.456:70): avc: denied { relabelto } for pid=279 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.816883][ T30] audit: type=1400 audit(1792368857.456:71): avc: denied { write } for pid=279 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.855223][ T30] audit: type=1400 audit(1792368857.526:72): avc: denied { read } for pid=277 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.881566][ T30] audit: type=1400 audit(1792368857.526:73): avc: denied { open } for pid=277 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.881690][ T277] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.488658][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.496199][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.503791][ T285] device bridge_slave_0 entered promiscuous mode [ 22.511774][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.519339][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.527765][ T285] device bridge_slave_1 entered promiscuous mode [ 22.625509][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.632760][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.641428][ T289] device bridge_slave_0 entered promiscuous mode [ 22.651239][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.659284][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.667604][ T289] device bridge_slave_1 entered promiscuous mode [ 22.719572][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.726938][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.734551][ T287] device bridge_slave_0 entered promiscuous mode [ 22.741923][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.749170][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.757256][ T287] device bridge_slave_1 entered promiscuous mode [ 22.772663][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.780068][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.788234][ T286] device bridge_slave_0 entered promiscuous mode [ 22.796687][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.803822][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.811465][ T286] device bridge_slave_1 entered promiscuous mode [ 22.901406][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.908612][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.916023][ T288] device bridge_slave_0 entered promiscuous mode [ 22.923907][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.931020][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.938437][ T288] device bridge_slave_1 entered promiscuous mode [ 22.971545][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.978616][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.986016][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.993063][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.033824][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.043046][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.052549][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.060588][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.084421][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.091648][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.099632][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.107159][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.148130][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.155950][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.163976][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.171647][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.179088][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.186355][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.194066][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.201621][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.227032][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.234959][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.243209][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.250788][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.260055][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.268763][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.276211][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.299022][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.306849][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.314974][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.323618][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.330911][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.338775][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.346963][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.354194][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.362132][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.370509][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.377684][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.385326][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.393765][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.400956][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.408577][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.416798][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.424483][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.433680][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 23.464504][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.473248][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.482199][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.490493][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.499421][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.507488][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.516352][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.525043][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.533276][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.542782][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.550532][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.560965][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.568789][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.585238][ T285] device veth0_vlan entered promiscuous mode [ 23.594284][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.603145][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.612015][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.620602][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.631505][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.640222][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.650136][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.659634][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.668956][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.677879][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.688307][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.697437][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.708124][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.715353][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.728819][ T289] device veth0_vlan entered promiscuous mode [ 23.743089][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 23.752694][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.761908][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.772481][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.782778][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.793576][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.804033][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.815197][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.825474][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.841620][ T286] device veth0_vlan entered promiscuous mode [ 23.854651][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.864225][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.874753][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.886388][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.894862][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.904539][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.915454][ T285] device veth1_macvtap entered promiscuous mode [ 23.928520][ T289] device veth1_macvtap entered promiscuous mode [ 23.937412][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.948241][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.958813][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.967619][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.976470][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.985169][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.997606][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.024726][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.034838][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.047157][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.060021][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.071084][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.080760][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.093591][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.104317][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.114924][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.124473][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.133125][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.141974][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.150585][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.159660][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.167128][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.175978][ T287] device veth0_vlan entered promiscuous mode [ 24.189049][ T286] device veth1_macvtap entered promiscuous mode [ 24.203335][ T288] device veth0_vlan entered promiscuous mode [ 24.210367][ T289] request_module fs-gadgetfs succeeded, but still no fs? [ 24.215940][ T287] device veth1_macvtap entered promiscuous mode [ 24.228159][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.237522][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.247531][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.255529][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.264314][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.273244][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.294518][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.303037][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.310148][ T310] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=310 comm=syz.1.2 [ 24.312330][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.333126][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.348556][ T310] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 24.355959][ T310] IPv6: NLM_F_CREATE should be set when creating new route [ 24.381388][ T308] tipc: Started in network mode [ 24.387174][ T308] tipc: Node identity 069bec63e876, cluster identity 4711 [ 24.394481][ T308] tipc: Enabled bearer , priority 0 [ 24.402847][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.411402][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.426423][ T313] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6'. [ 24.450969][ T316] af_packet: tpacket_rcv: packet too big, clamped from 136 to 4294967286. macoff=82 [ 24.453109][ T308] device syzkaller0 entered promiscuous mode [ 24.470841][ T288] device veth1_macvtap entered promiscuous mode [ 24.483675][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.514522][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.526263][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.535305][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.547288][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.559565][ T307] tipc: Resetting bearer [ 24.576748][ T307] tipc: Disabling bearer [ 24.586413][ T336] Zero length message leads to an empty skb [ 24.630865][ T347] ================================================================== [ 24.641111][ T347] BUG: KASAN: use-after-free in rcu_segcblist_enqueue+0x9c/0xb0 [ 24.651721][ T347] Write of size 8 at addr ffff88810feea990 by task syz.0.18/347 [ 24.659555][ T347] [ 24.662099][ T347] CPU: 0 PID: 347 Comm: syz.0.18 Not tainted syzkaller #0 [ 24.669311][ T347] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 24.681165][ T347] Call Trace: [ 24.684454][ T347] [ 24.687394][ T347] __dump_stack+0x21/0x30 [ 24.691820][ T347] dump_stack_lvl+0x110/0x170 [ 24.696950][ T347] ? show_regs_print_info+0x20/0x20 [ 24.702860][ T347] ? load_image+0x3f0/0x3f0 [ 24.707381][ T347] print_address_description+0x7f/0x2c0 [ 24.713015][ T347] ? rcu_segcblist_enqueue+0x9c/0xb0 [ 24.718643][ T347] kasan_report+0x10f/0x150 [ 24.723140][ T347] ? rcu_segcblist_enqueue+0x9c/0xb0 [ 24.728414][ T347] __asan_report_store8_noabort+0x17/0x20 [ 24.734986][ T347] rcu_segcblist_enqueue+0x9c/0xb0 [ 24.740201][ T347] call_rcu+0x549/0xf60 [ 24.745556][ T347] ? rcu_gp_kthread_wake+0x90/0x90 [ 24.750693][ T347] ? __kasan_check_write+0x14/0x20 [ 24.757499][ T347] ? selinux_inode_free_security+0x21f/0x230 [ 24.763566][ T347] ? __wake_up_bit+0x120/0x120 [ 24.768584][ T347] security_inode_free+0xb4/0xd0 [ 24.774782][ T347] __destroy_inode+0x175/0x4f0 [ 24.779737][ T347] evict+0x769/0x8b0 [ 24.783721][ T347] ? proc_nr_inodes+0x310/0x310 [ 24.788646][ T347] ? _raw_spin_lock+0x94/0xf0 [ 24.793321][ T347] ? _raw_spin_trylock_bh+0x150/0x150 [ 24.798974][ T347] ? __kasan_check_write+0x14/0x20 [ 24.804083][ T347] iput+0x651/0x7e0 [ 24.807890][ T347] dentry_unlink_inode+0x338/0x3e0 [ 24.813558][ T347] __dentry_kill+0x45b/0x660 [ 24.818326][ T347] dentry_kill+0xc0/0x2a0 [ 24.822644][ T347] dput+0x47/0x90 [ 24.826366][ T347] __fput+0x5c7/0x900 [ 24.830331][ T347] ____fput+0x15/0x20 [ 24.834297][ T347] task_work_run+0x127/0x190 [ 24.838876][ T347] exit_to_user_mode_loop+0xd0/0xe0 [ 24.844239][ T347] exit_to_user_mode_prepare+0x87/0xd0 [ 24.849698][ T347] syscall_exit_to_user_mode+0x1a/0x30 [ 24.855208][ T347] do_syscall_64+0x58/0xa0 [ 24.859786][ T347] ? clear_bhb_loop+0x50/0xa0 [ 24.864664][ T347] ? clear_bhb_loop+0x50/0xa0 [ 24.869444][ T347] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 24.876051][ T347] RIP: 0033:0x7fa791698559 [ 24.882176][ T347] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 24.903065][ T347] RSP: 002b:00007ffe60a488d8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 24.911903][ T347] RAX: 0000000000000000 RBX: 00007ffe60a489c0 RCX: 00007fa791698559 [ 24.919952][ T347] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 24.928318][ T347] RBP: 000000000000601c R08: 0000000000000001 R09: 0000000000000000 [ 24.936282][ T347] R10: 0000001b2d820000 R11: 0000000000000246 R12: 00007ffe60a48a00 [ 24.944289][ T347] R13: 00007fa79191ffac R14: 0000000000006050 R15: 00007fa79191ffa0 [ 24.952537][ T347] [ 24.955881][ T347] [ 24.958210][ T347] Allocated by task 348: [ 24.962619][ T347] __kasan_kmalloc+0xd4/0x100 [ 24.967299][ T347] __kmalloc+0x13d/0x2c0 [ 24.971588][ T347] l2tp_session_create+0x39/0xb60 [ 24.977054][ T347] pppol2tp_connect+0xbf5/0x1640 [ 24.982166][ T347] __sys_connect+0x3cb/0x450 [ 24.987671][ T347] __x64_sys_connect+0x7a/0x90 [ 24.992690][ T347] x64_sys_call+0x7c/0x9a0 [ 24.997220][ T347] do_syscall_64+0x4c/0xa0 [ 25.002076][ T347] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 25.007967][ T347] [ 25.010287][ T347] Freed by task 306: [ 25.015028][ T347] kasan_set_track+0x4a/0x70 [ 25.019966][ T347] kasan_set_free_info+0x23/0x40 [ 25.025098][ T347] ____kasan_slab_free+0x125/0x160 [ 25.031220][ T347] __kasan_slab_free+0x11/0x20 [ 25.035991][ T347] slab_free_freelist_hook+0xc2/0x190 [ 25.042712][ T347] kfree+0xc4/0x270 [ 25.046801][ T347] l2tp_session_put+0xaf/0x1a0 [ 25.051994][ T347] l2tp_session_delete+0x3a9/0x4a0 [ 25.057361][ T347] l2tp_tunnel_del_work+0x180/0x3d0 [ 25.063260][ T347] process_one_work+0x6c8/0xbb0 [ 25.068285][ T347] worker_thread+0xaa0/0x1250 [ 25.073070][ T347] kthread+0x3f5/0x4f0 [ 25.077439][ T347] ret_from_fork+0x1f/0x30 [ 25.081860][ T347] [ 25.084431][ T347] Last potentially related work creation: [ 25.090434][ T347] kasan_save_stack+0x3a/0x60 [ 25.095196][ T347] __kasan_record_aux_stack+0xd2/0x100 [ 25.100654][ T347] kasan_record_aux_stack_noalloc+0xb/0x10 [ 25.108033][ T347] call_rcu+0x10b/0xf60 [ 25.112317][ T347] pppol2tp_release+0x1e3/0x2b0 [ 25.117684][ T347] sock_close+0xb8/0x200 [ 25.121914][ T347] __fput+0x22b/0x900 [ 25.126000][ T347] ____fput+0x15/0x20 [ 25.131415][ T347] task_work_run+0x127/0x190 [ 25.136027][ T347] exit_to_user_mode_loop+0xd0/0xe0 [ 25.141307][ T347] exit_to_user_mode_prepare+0x87/0xd0 [ 25.147132][ T347] syscall_exit_to_user_mode+0x1a/0x30 [ 25.153646][ T347] do_syscall_64+0x58/0xa0 [ 25.159190][ T347] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 25.166502][ T347] [ 25.168972][ T347] The buggy address belongs to the object at ffff88810feea800 [ 25.168972][ T347] which belongs to the cache kmalloc-512 of size 512 [ 25.187773][ T347] The buggy address is located 400 bytes inside of [ 25.187773][ T347] 512-byte region [ffff88810feea800, ffff88810feeaa00) [ 25.202415][ T347] The buggy address belongs to the page: [ 25.208471][ T347] page:ffffea00043fba00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10fee8 [ 25.218887][ T347] head:ffffea00043fba00 order:2 compound_mapcount:0 compound_pincount:0 [ 25.228545][ T347] flags: 0x4000000000010200(slab|head|zone=1) [ 25.235234][ T347] raw: 4000000000010200 0000000000000000 0000000100000001 ffff888100042f00 [ 25.244246][ T347] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 25.252985][ T347] page dumped because: kasan: bad access detected [ 25.260242][ T347] page_owner tracks the page as allocated [ 25.266494][ T347] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 106, ts 4766059831, free_ts 0 [ 25.285087][ T347] post_alloc_hook+0x192/0x1b0 [ 25.290069][ T347] prep_new_page+0x1c/0x110 [ 25.294784][ T347] get_page_from_freelist+0x2c3a/0x2cd0 [ 25.300468][ T347] __alloc_pages+0x1a2/0x460 [ 25.305214][ T347] new_slab+0xa0/0x4d0 [ 25.309283][ T347] ___slab_alloc+0x3ac/0x840 [ 25.314333][ T347] __slab_alloc+0x49/0x90 [ 25.319185][ T347] __kmalloc_track_caller+0x169/0x2c0 [ 25.324553][ T347] __alloc_skb+0x210/0x730 [ 25.329058][ T347] alloc_skb_with_frags+0xa8/0x620 [ 25.335065][ T347] sock_alloc_send_pskb+0x87f/0x9a0 [ 25.340273][ T347] unix_dgram_sendmsg+0x6f3/0x19b0 [ 25.345402][ T347] sock_write_iter+0x2a6/0x3a0 [ 25.350168][ T347] vfs_write+0x831/0xfd0 [ 25.354404][ T347] ksys_write+0x14a/0x260 [ 25.358727][ T347] __x64_sys_write+0x7b/0x90 [ 25.363308][ T347] page_owner free stack trace missing [ 25.368830][ T347] [ 25.371311][ T347] Memory state around the buggy address: [ 25.377728][ T347] ffff88810feea880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.386200][ T347] ffff88810feea900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.394279][ T347] >ffff88810feea980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.402680][ T347] ^ [ 25.408232][ T347] ffff88810feeaa00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.417614][ T347] ffff88810feeaa80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.427885][ T347] ================================================================== [ 25.437656][ T347] Disabling lock debugging due to kernel taint