last executing test programs: 1.158721287s ago: executing program 4 (id=5): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r1, 0x8983, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) r4 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$DCCPDIAG_GETSOCK(r4, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000010}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r5 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r5, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r6 = socket$netlink(0x10, 0x3, 0x0) writev(r6, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r6, &(0x7f0000000040)=[{&(0x7f0000000400)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad0002000000001f0006040000000000f93132", 0x39}], 0x1) setsockopt$inet_msfilter(r5, 0x0, 0x29, &(0x7f0000000080)={@multicast2, @loopback, 0x0, 0x1, [@empty]}, 0x14) 1.047318167s ago: executing program 1 (id=2): ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r0 = getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000280)=0x0) prlimit64(r1, 0x0, &(0x7f0000000300)={0x5, 0x8001}, &(0x7f00000003c0)) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f00000021c0)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb703000008000000b703000000000020850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./bus/file0\x00', 0x10) 439.321µs ago: executing program 1 (id=6): ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r0 = getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000280)=0x0) prlimit64(r1, 0x0, &(0x7f0000000300)={0x5, 0x8001}, &(0x7f00000003c0)) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f00000021c0)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb703000008000000b703000000000020850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x2000000000000022, 0x0, 0x0) sendto$inet6(r5, 0x0, 0x0, 0x20000045, 0x0, 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./bus/file0\x00', 0x10) 0s ago: executing program 2 (id=3): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x208, 0x1}, 0x50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file3\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x1, 0x6, 0x8, 0x8, 0x40}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000600b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040), &(0x7f00000004c0), 0xce, r3}, 0x38) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r4, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) read$FUSE(r2, &(0x7f0000003880)={0x2020}, 0xffffffe4) syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000140)='./file0\x00', 0x1520c1b, &(0x7f0000000000)=ANY=[@ANYRES16=0x0], 0x0, 0x1e1, &(0x7f0000000540)="$eJzsmb2LE0EYxp+Z3XzcIYKNhY2CB55wt9ndqFxjcfaCcBc/OoNZQ3STSLJFErAINjb+Gf4LFqks7AQLWy1UECxMab0yu292x2TzBYkgvj/I7DMf77wzb5KnSMAwzH/Lt6+/vry6dXR6AOAM9lCg8R9GukZq6z8XSXx6/a519vloej8BIAxXz28CeHtsIKB+GP4ZvUfPU8hEVyBxlfQ9CFikH0LiLmkPAg9IP9F0e4eE71mP2n7tccP3bNU4qnFVU54+33goUANQpPMJbb7bHzyt+r7XmRa5cJJnZmpdsaR+5vhY4qZWP/V+3X/5Yqj6k9rYWv0cSDikyxA4IX2EAizLSkui3f+Cme5vrHL/tYWBzeyjiXOHi9YcbDTXcnE7jPmrSf85kcPWUwhtZEcJ9YVORs6PR+9no75v8+6XtntlkGfPTH3cXRJe+ZARlYo8mUBmeOqfynKvaP5kwkz8oxQ0n5W6/cFho1mte3Wv5brlG/Y1277uliIjitsF/leM/GlX2z83Z21e5NGrBkHH6QFBx0n6btxqjnvypv0zipGR/0nsX473UB+V6NqF7ByCXjJ6KrVvzD08wzAMwzAMwzAMwzAMwzDMWlyEAP3TIOgH0SzcO9Hq3wEAAP//IXFmNQ==") sendmsg$inet(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000000300)={0x2, 0x4e23, @private=0xa010101}, 0x10, 0x0, 0x0, &(0x7f00000004c0)=[@ip_tos_int={{0x14, 0x0, 0x34, 0x4}}], 0x18}, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) syslog(0x9, 0x0, 0x0) syz_io_uring_setup(0x4832, &(0x7f0000001380)={0x0, 0x1d25, 0x400, 0x0, 0x15d, 0x0, r2}, &(0x7f0000001400), &(0x7f0000001440)) io_uring_setup(0x34bd, &(0x7f0000001480)={0x0, 0x132, 0x1, 0x1, 0x13e}) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x1d, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x13, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000ba20702500000000002003007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009b00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmmsg$inet(0xffffffffffffffff, &(0x7f00000011c0)=[{{0x0, 0x0, &(0x7f0000000cc0)}}], 0x1, 0x800) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r5, 0x0, 0x10, 0x10, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\b\x00\x00', &(0x7f0000000300)=""/8, 0x6c00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000021000000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r6}, 0x18) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.142' (ED25519) to the list of known hosts. [ 22.382567][ T28] audit: type=1400 audit(1756390263.879:64): avc: denied { mounton } for pid=275 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.383698][ T275] cgroup: Unknown subsys name 'net' [ 22.406005][ T28] audit: type=1400 audit(1756390263.879:65): avc: denied { mount } for pid=275 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.438748][ T28] audit: type=1400 audit(1756390263.919:66): avc: denied { unmount } for pid=275 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.438973][ T275] cgroup: Unknown subsys name 'devices' [ 22.582240][ T275] cgroup: Unknown subsys name 'hugetlb' [ 22.587980][ T275] cgroup: Unknown subsys name 'rlimit' [ 22.690795][ T28] audit: type=1400 audit(1756390264.189:67): avc: denied { setattr } for pid=275 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.714356][ T28] audit: type=1400 audit(1756390264.189:68): avc: denied { mounton } for pid=275 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.739574][ T28] audit: type=1400 audit(1756390264.189:69): avc: denied { mount } for pid=275 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.741775][ T277] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 22.772733][ T28] audit: type=1400 audit(1756390264.269:70): avc: denied { relabelto } for pid=277 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.798631][ T28] audit: type=1400 audit(1756390264.269:71): avc: denied { write } for pid=277 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.841931][ T28] audit: type=1400 audit(1756390264.339:72): avc: denied { read } for pid=275 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.842457][ T275] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.868165][ T28] audit: type=1400 audit(1756390264.339:73): avc: denied { open } for pid=275 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.458607][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.466012][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.473749][ T283] device bridge_slave_0 entered promiscuous mode [ 25.482156][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.489210][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.496995][ T283] device bridge_slave_1 entered promiscuous mode [ 25.582235][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.589464][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.597118][ T285] device bridge_slave_0 entered promiscuous mode [ 25.604424][ T284] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.611510][ T284] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.618988][ T284] device bridge_slave_0 entered promiscuous mode [ 25.639484][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.646610][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.654036][ T285] device bridge_slave_1 entered promiscuous mode [ 25.660706][ T284] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.667735][ T284] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.675171][ T284] device bridge_slave_1 entered promiscuous mode [ 25.703078][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.710315][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.717850][ T286] device bridge_slave_0 entered promiscuous mode [ 25.736643][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.743747][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.751242][ T286] device bridge_slave_1 entered promiscuous mode [ 25.782583][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.789679][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.797386][ T287] device bridge_slave_0 entered promiscuous mode [ 25.810042][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.817349][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.825126][ T287] device bridge_slave_1 entered promiscuous mode [ 25.955293][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.962457][ T283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.970114][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.977270][ T283] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.010370][ T284] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.017698][ T284] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.025117][ T284] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.032358][ T284] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.054551][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.061722][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.068988][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.076210][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.108961][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.116621][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.124278][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.132996][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.140316][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.147638][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.155434][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.176249][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 26.184329][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.191865][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.201223][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.208304][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.216193][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.224946][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.232310][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.239958][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.248460][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.255686][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.293547][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.302918][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.311372][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.319743][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.327434][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.335308][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.344763][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.351963][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.359523][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.368657][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.375908][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.383941][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.392299][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.400789][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.409368][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.417783][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.439500][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 26.447446][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.456182][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 26.465345][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.478864][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 26.487905][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.515906][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 26.525324][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.533634][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.540673][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.548318][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 26.557038][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.565740][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.572853][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.580429][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 26.589088][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.597611][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 26.605252][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.612774][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 26.622198][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.630450][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.637948][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.645996][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 26.654059][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 26.664192][ T283] device veth0_vlan entered promiscuous mode [ 26.672803][ T284] device veth0_vlan entered promiscuous mode [ 26.685002][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 26.693355][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.701716][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 26.710008][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.719084][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 26.727497][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.735631][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 26.744491][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.752861][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.760327][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.768233][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.776475][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.784800][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.792978][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.804664][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.813057][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.822958][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 26.831090][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.846455][ T283] device veth1_macvtap entered promiscuous mode [ 26.855343][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.863776][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.872649][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.880366][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 26.888871][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.897644][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 26.906394][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.917578][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 26.926229][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.935997][ T284] device veth1_macvtap entered promiscuous mode [ 26.950958][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.958823][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.967492][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.976812][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.985541][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.010304][ T283] request_module fs-gadgetfs succeeded, but still no fs? [ 27.017835][ T287] device veth0_vlan entered promiscuous mode [ 27.025265][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.034122][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.042162][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.049703][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 27.059199][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.068186][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 27.077418][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.086224][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 27.094886][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 27.103370][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 27.111799][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.120059][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.127989][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.136986][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 27.145316][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 27.158985][ T285] device veth0_vlan entered promiscuous mode [ 27.174492][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 27.187265][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 27.207251][ T286] device veth0_vlan entered promiscuous mode [ 27.221561][ T286] device veth1_macvtap entered promiscuous mode [ 27.247817][ T287] device veth1_macvtap entered promiscuous mode [ 27.280665][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.292732][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 27.301675][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 27.311536][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 27.320182][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 27.957956][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 27.968372][ T28] kauditd_printk_skb: 24 callbacks suppressed [ 27.968385][ T28] audit: type=1400 audit(1756390269.459:98): avc: denied { bpf } for pid=335 comm="syz.4.5" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 27.971248][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 27.976730][ T28] audit: type=1400 audit(1756390269.459:99): avc: denied { map_create } for pid=335 comm="syz.4.5" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 27.997732][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 28.036785][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 28.046786][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 28.062021][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 28.071143][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 28.185605][ T28] audit: type=1400 audit(1756390269.579:100): avc: denied { prog_load } for pid=339 comm="syz.1.2" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 28.206506][ T28] audit: type=1400 audit(1756390269.579:101): avc: denied { perfmon } for pid=339 comm="syz.1.2" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 28.227588][ T28] audit: type=1400 audit(1756390269.589:102): avc: denied { prog_run } for pid=339 comm="syz.1.2" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 28.235027][ T285] device veth1_macvtap entered promiscuous mode [ 28.259330][ T28] audit: type=1400 audit(1756390269.629:103): avc: denied { write } for pid=339 comm="syz.1.2" name="/" dev="incremental-fs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 28.282607][ T28] audit: type=1400 audit(1756390269.629:104): avc: denied { add_name } for pid=339 comm="syz.1.2" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 28.303775][ T28] audit: type=1400 audit(1756390269.629:105): avc: denied { create } for pid=339 comm="syz.1.2" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 28.324240][ T28] audit: type=1400 audit(1756390269.629:106): avc: denied { associate } for pid=339 comm="syz.1.2" name="file0" scontext=root:object_r:unlabeled_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 28.331310][ T284] ------------[ cut here ]------------ [ 28.351624][ T284] WARNING: CPU: 1 PID: 284 at fs/inode.c:332 drop_nlink+0xc5/0x110 [ 28.359557][ T284] Modules linked in: [ 28.363589][ T284] CPU: 1 PID: 284 Comm: syz-executor Not tainted syzkaller #0 [ 28.371156][ T284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 28.381642][ T284] RIP: 0010:drop_nlink+0xc5/0x110 [ 28.383644][ T28] audit: type=1400 audit(1756390269.809:107): avc: denied { unmount } for pid=284 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 28.387072][ T284] Code: 1b 48 8d bb b8 04 00 00 be 08 00 00 00 e8 03 ea f0 ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 eb 8b ac ff <0f> 0b eb 86 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 5e ff ff ff 4c [ 28.427615][ T284] RSP: 0018:ffffc9000d25fc38 EFLAGS: 00010293 [ 28.433744][ T284] RAX: ffffffff81c37b75 RBX: ffff888132a4e650 RCX: ffff888105fe9440 [ 28.441765][ T284] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 28.449760][ T284] RBP: ffffc9000d25fc60 R08: 0000000000000004 R09: 0000000000000003 [ 28.457813][ T284] R10: fffff52001a4bf78 R11: 1ffff92001a4bf78 R12: dffffc0000000000 [ 28.465825][ T284] R13: 1ffff11026549cd3 R14: ffff888132a4e698 R15: 0000000000000000 [ 28.474029][ T284] FS: 000055557e6fd500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 28.483190][ T284] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 28.489770][ T284] CR2: 0000001b2e424008 CR3: 000000012ece2000 CR4: 00000000003506a0 [ 28.497903][ T284] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 28.506115][ T284] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 28.514707][ T284] Call Trace: [ 28.518177][ T284] [ 28.521255][ T284] shmem_rmdir+0x5b/0x90 [ 28.525631][ T284] vfs_rmdir+0x393/0x500 [ 28.529935][ T284] incfs_kill_sb+0x105/0x220 [ 28.534615][ T284] deactivate_locked_super+0xb5/0x120 [ 28.540436][ T284] deactivate_super+0xaf/0xe0 [ 28.542425][ T349] loop2: detected capacity change from 0 to 16 [ 28.545208][ T284] cleanup_mnt+0x45f/0x4e0 [ 28.545239][ T284] __cleanup_mnt+0x19/0x20 [ 28.560677][ T284] task_work_run+0x1db/0x240 [ 28.565312][ T284] ? __cfi_task_work_run+0x10/0x10 [ 28.570661][ T284] ? __x64_sys_umount+0x125/0x160 [ 28.575964][ T284] ? __cfi___x64_sys_umount+0x10/0x10 [ 28.581418][ T284] exit_to_user_mode_loop+0x9b/0xb0 [ 28.586691][ T284] exit_to_user_mode_prepare+0x5a/0xa0 [ 28.592407][ T284] syscall_exit_to_user_mode+0x1a/0x30 [ 28.597886][ T284] do_syscall_64+0x58/0xa0 [ 28.602358][ T284] ? clear_bhb_loop+0x30/0x80 [ 28.607044][ T284] ? clear_bhb_loop+0x30/0x80 [ 28.611791][ T284] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 28.617687][ T284] RIP: 0033:0x7fd14bb8ff17 [ 28.622256][ T284] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 28.641988][ T284] RSP: 002b:00007ffed40d2fb8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 28.650632][ T284] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fd14bb8ff17 [ 28.658694][ T284] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffed40d3070 [ 28.666897][ T284] RBP: 00007ffed40d3070 R08: 0000000000000000 R09: 0000000000000000 [ 28.675065][ T284] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffed40d4100 [ 28.683330][ T284] R13: 00007fd14bc11c05 R14: 0000000000006e3f R15: 00007ffed40d4140 [ 28.691434][ T284] [ 28.694453][ T284] ---[ end trace 0000000000000000 ]--- [ 28.700659][ T343] netlink: 'syz.4.5': attribute type 4 has an invalid length. [ 28.701759][ T284] ================================================================== [ 28.716386][ T284] BUG: KASAN: null-ptr-deref in ihold+0x20/0x60 [ 28.722740][ T284] Write of size 4 at addr 0000000000000170 by task syz-executor/284 [ 28.730788][ T284] [ 28.733100][ T284] CPU: 1 PID: 284 Comm: syz-executor Tainted: G W syzkaller #0 [ 28.742171][ T284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 28.752303][ T284] Call Trace: [ 28.755632][ T284] [ 28.758627][ T284] __dump_stack+0x21/0x24 [ 28.762956][ T284] dump_stack_lvl+0xee/0x150 [ 28.767784][ T284] ? __cfi_dump_stack_lvl+0x8/0x8 [ 28.772819][ T284] ? ihold+0x20/0x60 [ 28.776864][ T284] ? ihold+0x20/0x60 [ 28.780875][ T284] print_report+0x3d/0x60 [ 28.785488][ T284] kasan_report+0x122/0x150 [ 28.790079][ T284] ? ihold+0x20/0x60 [ 28.794066][ T284] kasan_check_range+0x280/0x290 [ 28.799305][ T284] __kasan_check_write+0x14/0x20 [ 28.804457][ T284] ihold+0x20/0x60 [ 28.808272][ T284] vfs_rmdir+0x25f/0x500 [ 28.812509][ T284] incfs_kill_sb+0x105/0x220 [ 28.817300][ T284] deactivate_locked_super+0xb5/0x120 [ 28.822771][ T284] deactivate_super+0xaf/0xe0 [ 28.827610][ T284] cleanup_mnt+0x45f/0x4e0 [ 28.832039][ T284] __cleanup_mnt+0x19/0x20 [ 28.836607][ T284] task_work_run+0x1db/0x240 [ 28.841216][ T284] ? __cfi_task_work_run+0x10/0x10 [ 28.846570][ T284] ? __x64_sys_umount+0x125/0x160 [ 28.851866][ T284] ? __cfi___x64_sys_umount+0x10/0x10 [ 28.857375][ T284] exit_to_user_mode_loop+0x9b/0xb0 [ 28.863008][ T284] exit_to_user_mode_prepare+0x5a/0xa0 [ 28.868563][ T284] syscall_exit_to_user_mode+0x1a/0x30 [ 28.874170][ T284] do_syscall_64+0x58/0xa0 [ 28.878686][ T284] ? clear_bhb_loop+0x30/0x80 [ 28.883551][ T284] ? clear_bhb_loop+0x30/0x80 [ 28.888235][ T284] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 28.894214][ T284] RIP: 0033:0x7fd14bb8ff17 [ 28.898751][ T284] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 28.918613][ T284] RSP: 002b:00007ffed40d2fb8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 28.927461][ T284] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fd14bb8ff17 [ 28.935426][ T284] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffed40d3070 [ 28.943823][ T284] RBP: 00007ffed40d3070 R08: 0000000000000000 R09: 0000000000000000 [ 28.952419][ T284] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffed40d4100 [ 28.960771][ T284] R13: 00007fd14bc11c05 R14: 0000000000006e3f R15: 00007ffed40d4140 [ 28.968759][ T284] [ 28.971940][ T284] ================================================================== [ 28.981199][ T284] Disabling lock debugging due to kernel taint [ 28.987392][ T345] netlink: 'syz.4.5': attribute type 4 has an invalid length. [ 28.996435][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 28.997064][ T284] BUG: kernel NULL pointer dereference, address: 0000000000000170 [ 29.004699][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 29.011807][ T284] #PF: supervisor write access in kernel mode [ 29.011821][ T284] #PF: error_code(0x0002) - not-present page [ 29.011830][ T284] PGD 132cb2067 P4D 132cb2067 PUD 0 [ 29.011851][ T284] Oops: 0002 [#1] PREEMPT SMP KASAN [ 29.011864][ T284] CPU: 0 PID: 284 Comm: syz-executor Tainted: G B W syzkaller #0 [ 29.011879][ T284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 29.011887][ T284] RIP: 0010:ihold+0x26/0x60 [ 29.011905][ T284] Code: 33 36 7c df 55 48 89 e5 41 56 53 48 89 fb e8 51 83 ac ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 40 e1 f0 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 41 [ 29.011917][ T284] RSP: 0018:ffffc9000d25fc78 EFLAGS: 00010246 [ 29.011929][ T284] RAX: ffff888105fe9400 RBX: 0000000000000000 RCX: ffff888105fe9440 [ 29.011939][ T284] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 29.020938][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 29.026150][ T284] RBP: ffffc9000d25fc88 R08: dffffc0000000000 R09: fffffbfff0f2d4fd [ 29.041964][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 29.043154][ T284] R10: fffffbfff0f2d4fd R11: 1ffffffff0f2d4fc R12: ffff888132a4e65c [ 29.148088][ T284] R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000 [ 29.156243][ T284] FS: 000055557e6fd500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 29.165517][ T284] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.172263][ T284] CR2: 0000000000000170 CR3: 000000012ece2000 CR4: 00000000003506b0 [ 29.180250][ T284] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 29.188574][ T284] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 29.196580][ T284] Call Trace: [ 29.199845][ T284] [ 29.202940][ T284] vfs_rmdir+0x25f/0x500 [ 29.207214][ T284] incfs_kill_sb+0x105/0x220 [ 29.211991][ T284] deactivate_locked_super+0xb5/0x120 [ 29.217378][ T284] deactivate_super+0xaf/0xe0 [ 29.222137][ T284] cleanup_mnt+0x45f/0x4e0 [ 29.226799][ T284] __cleanup_mnt+0x19/0x20 [ 29.231390][ T284] task_work_run+0x1db/0x240 [ 29.236168][ T284] ? __cfi_task_work_run+0x10/0x10 [ 29.241548][ T284] ? __x64_sys_umount+0x125/0x160 [ 29.246615][ T284] ? __cfi___x64_sys_umount+0x10/0x10 [ 29.252026][ T284] exit_to_user_mode_loop+0x9b/0xb0 [ 29.257639][ T284] exit_to_user_mode_prepare+0x5a/0xa0 [ 29.263175][ T284] syscall_exit_to_user_mode+0x1a/0x30 [ 29.268622][ T284] do_syscall_64+0x58/0xa0 [ 29.273287][ T284] ? clear_bhb_loop+0x30/0x80 [ 29.277946][ T284] ? clear_bhb_loop+0x30/0x80 [ 29.282610][ T284] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 29.288745][ T284] RIP: 0033:0x7fd14bb8ff17 [ 29.293322][ T284] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 29.313093][ T284] RSP: 002b:00007ffed40d2fb8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 29.321586][ T284] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fd14bb8ff17 [ 29.330434][ T284] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffed40d3070 [ 29.338672][ T284] RBP: 00007ffed40d3070 R08: 0000000000000000 R09: 0000000000000000 [ 29.347088][ T284] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffed40d4100 [ 29.355241][ T284] R13: 00007fd14bc11c05 R14: 0000000000006e3f R15: 00007ffed40d4140 [ 29.363554][ T284] [ 29.366656][ T284] Modules linked in: [ 29.370561][ T284] CR2: 0000000000000170 [ 29.374730][ T284] ---[ end trace 0000000000000000 ]--- [ 29.380183][ T284] RIP: 0010:ihold+0x26/0x60 [ 29.384861][ T284] Code: 33 36 7c df 55 48 89 e5 41 56 53 48 89 fb e8 51 83 ac ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 40 e1 f0 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 41 [ 29.404838][ T284] RSP: 0018:ffffc9000d25fc78 EFLAGS: 00010246 [ 29.410996][ T284] RAX: ffff888105fe9400 RBX: 0000000000000000 RCX: ffff888105fe9440 [ 29.419158][ T284] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 29.427115][ T284] RBP: ffffc9000d25fc88 R08: dffffc0000000000 R09: fffffbfff0f2d4fd [ 29.435343][ T284] R10: fffffbfff0f2d4fd R11: 1ffffffff0f2d4fc R12: ffff888132a4e65c [ 29.443316][ T284] R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000 [ 29.451472][ T284] FS: 000055557e6fd500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 29.460664][ T284] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.467333][ T284] CR2: 0000000000000170 CR3: 000000012ece2000 CR4: 00000000003506b0 [ 29.475711][ T284] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 29.483764][ T284] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 29.492010][ T284] Kernel panic - not syncing: Fatal exception [ 29.498471][ T284] Kernel Offset: disabled [ 29.502800][ T284] Rebooting in 86400 seconds..