last executing test programs: 2.510059692s ago: executing program 1 (id=2): sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000440)=[{{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000b80)="83556f524e5b4275202de9e9190a4e45413b785e52d04218ff14259285fc60a04bc6b2219b8c6853a6622cf43ff12c6e70030000009d24e78c3e9315e114c8a7316f4fe07425a43afc3f2146fd5b3fa9944ac1fff9e40cb9d497259e2f8443386550fc0255f733c2c4592534f4c24aa04090941068f785925c29c444a6887d4a23cffdd0da78bccb1ee094cc21d79dddfd1ee274ec69d98e4ce1efdf416ca3948f3e2d92e348b88fd9387473855b1fdcd7493d01f0453924af3a79bc5d40b7e5ab2c6bd87501389f038abd8f0b2c59445502d726c974e0e57eab107a6ad6f2a998529e4bdafb9ed3a4c3482682f5369b1ca77c8dae495685a16821fd0da5b3b17b58909c93344ff6b6908a5de6530ebb79b7096253ed28f981b117f1af480914519ce90117ffc37d83297da593ce451f464a6b272b35442e3bc42881092cc92420590b6230a6af3817a7b4ca4d7a46e0c5d814ee1f6d9a20a255c54b88476ac582e3e4d99ba105b0f4dfb48d666aa23f70fbe69249f33f75fb4e5cbf27f1ecd1f47bfa745d508d3c599de413ab6b7f00ae14e2ed3c83da269536787bf4ff3f0d117b8415df306504b3020bfa61450bd88b8c73362f2ccd2217a49b8948f0ead1cac7c3f8da62ecc2219826bde12cf42eb9f9378909858d000000006316d96e2735850218ae8f89dfb2459ebc25571077a7602a55d51b2582a5d5e322e5816bc464beace66726fa5a8b0b84be74b85dd81115bf7dc16d2a45db14e6b52e05ab8f54b7d775d90db2ea7a63d7a84812ed5a56346fcbd1ef7b0f8f3f6833a99270f678ec85e3ce2ce718531e898016f81dec1c2702e7e0b04539cdc298c00cd464ca36342b634a61e2ba4e8c3ede56d78cac00fb4137aaddba05c519713989c60aed06231c821eb247e6d7a55989e4a672b5", 0x290}], 0x1}}], 0x1, 0x60c5895) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x202, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_GET_MSRS_cpu(r2, 0xc008ae88, &(0x7f0000000380)={0x21, 0x0, [{0x298, 0x0, 0x100}]}) 2.372334345s ago: executing program 1 (id=7): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) exit(0x2) tkill(r0, 0x12) waitid(0x0, r0, 0x0, 0x1000009, 0x0) 2.354988405s ago: executing program 3 (id=4): r0 = syz_usb_connect$uac1(0x0, 0xac, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000000000106b1d010140000102030109029a0003010000000904000000010100000a24010000000201020c24020000000000000800000524050000082407000000009e0c240700000000a3e82f07070d240701060000fd80000000e80924030000000001"], 0x0) syz_usb_control_io(r0, &(0x7f0000000140)={0x2c, 0x0, &(0x7f00000002c0)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac1(r0, &(0x7f0000001840)={0x14, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x41f}}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c40)={0x84, &(0x7f0000000740)={0x20, 0x3, 0x2, "b23b"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f00000000c0)={0x44, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x20, 0x82, 0x2, "c9a7"}, 0x0, 0x0, 0x0}) 2.277230757s ago: executing program 0 (id=1): syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x4008, &(0x7f0000000440)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) setxattr$security_capability(&(0x7f0000000240)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0) 2.246957637s ago: executing program 0 (id=9): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581", @ANYRES8], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000b00)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00000f0000"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000580)={0x3, 0x2, 0xa}) 2.141317669s ago: executing program 2 (id=3): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) r2 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) write$selinux_access(r2, &(0x7f00000004c0)=ANY=[@ANYBLOB="73797374656d5f683a6f626a6563745f723a7570647077645f657865635f742073797374656d5f753a73797374656d5f723afaffffffffffffff3a73302030"], 0x56) 2.12486914s ago: executing program 2 (id=10): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000000000207d1e5a2d00000000000109022400010000000009040000010300000009210000000122080009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000140)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002208000000a20100c3"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f00000000c0)={0x1, 0x200, 0xe, 0x800, 0x6, 0x3}) 1.504408811s ago: executing program 1 (id=11): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r0) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000004c0)={'syz_tun\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)={0x30, r1, 0x1, 0x70bd26, 0x25dfdbff, {}, [@ETHTOOL_A_LINKMODES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}, @ETHTOOL_A_LINKMODES_OURS={0x10, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x8, 0x3, 0x0, 0x1, [{0x4}]}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x2400c054}, 0x4044014) 1.485921992s ago: executing program 1 (id=12): sendmsg$inet(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f00000002c0)="beaa38543627a7", 0x7}], 0x1}, 0x20048050) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000050000106a05310300000000000109022400010000800009040002090300010009210000000122000509058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x40, 0x5, 0x5, {0x5, 0x1, "99abb7"}}, 0x0}, &(0x7f00000005c0)={0x44, &(0x7f0000000180)={0x20, 0x7, 0x95, "54ebcb59a8c44278a4564e5aacebc77913187d50adc3e39f70206f13c22423a212b59f0b14d4e45600709f1b0346efa31d031d4673091364c533f6d087311625624d392875e10ab0d998db2be6dd42b9314c1a1b40dd4acf4a27376862e47025fdb1d1583cfa76adc0721aaabda9f2aafd9dce61a8f50b76f87e1ea42db6421946cb7ccc38b13358633a68441aa48ac4657badda3a"}, &(0x7f0000000100)={0x0, 0xa, 0x1, 0x4}, &(0x7f0000000280)={0x0, 0x8, 0x1, 0x6}, 0x0, &(0x7f0000000380)={0x20, 0x85, 0x4, 0x8}, &(0x7f00000003c0)={0x20, 0x83, 0x2}, &(0x7f0000000400)={0x20, 0x87, 0x2, 0x81}, &(0x7f0000000440)={0x20, 0x89, 0x2}}) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) 697.974677ms ago: executing program 4 (id=19): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x11, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d000000850000009e00000095"], &(0x7f00000000c0)='GPL\x00', 0x4, 0xad, &(0x7f00000003c0)=""/173}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000000)='kfree\x00', r0}, 0x10) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0xe, 0x7fff0000}]}) close_range(r1, 0xffffffffffffffff, 0x0) 680.669367ms ago: executing program 4 (id=20): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0xc}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000e00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) mkdir(&(0x7f0000000580)='./file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000400)='./file0\x00', &(0x7f00000003c0), &(0x7f0000000280)='system_u:object_r:fsadm_exec_t:s0\x00', 0x22, 0x0) 652.321717ms ago: executing program 4 (id=21): r0 = socket(0x10, 0x803, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="a000000010003b0e2a1a86eb2636037f00000000", @ANYRES32=r1, @ANYBLOB="0200000000008000800012000800010076746936"], 0xa0}}, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f0000000000), 0x400000000000235, 0x0) 615.251708ms ago: executing program 4 (id=22): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x210000, &(0x7f0000000280)={[{@user_xattr}, {@noquota}, {@dioread_nolock}, {@jqfmt_vfsv1}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x70}}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x7b1}}, {@stripe={'stripe', 0x3d, 0x20}}, {@bsdgroups}, {@max_batch_time={'max_batch_time', 0x3d, 0x3fe}}, {@user_xattr}, {@noinit_itable}]}, 0x3, 0x583, &(0x7f0000000800)="$eJzs3c9rHGUfAPDvbHb7+32bQilvX15eCj1Yqd00iT8qeKhH0WJBPdclmYaSTbdkN6WJBduDvXiRIohYEO969+ChePHoX1HQQpES9OBlZTazybbZJJt0Y2L384Fpn2dmNs8888z34Zl9dpgABtaJ7J9CxPGI+CyJONyxrRj5xhNL+y0+vjmRLUk0m+/9lkSSr2vvn+T/H8wz/4mIHz+JOF1YXW59fmG6Uq2ms3l+pDFzbaQ+v3DmykxlKp1Kr46Nj597ZXzs9dde7VtdX7z4x5fv3n/r3KcnF7/47uGRu0mcj0P5ts56PINbnZkTzWZ+Tkpx/qkdR/tQ2G6S7PQBsCVDeZyXIuJ46XCpHfXA8+/jiGgCAyrZZPzv1V/Ac6I9Dmjf2/fpPvgf49GbSzdAq+tfXPpuJPa17o0OLCZP3Bll97vDfSg/K+P7X+/dzZbo3/cQABu6dTsizhaLq/u/JO//tu5sD/s8XYb+D/4+97Pxz0vdxj+F5fFPdBn/HOwSu1uxcfwXHvahmDVl4783uo5/lyethofy3L9aY75ScvlKNc36tn9HxKko7c3y683nnFt80FxrW+f4L1uy8ttjwfw4Hhb3PvmZyUqj8ix17vTodsR/u45/k+X2T7q0f3Y+PuixjGPpvf+vtW3j+m+v5jcRL3Rt/5UZrWT9+cmR1vUw0r4qVvv9zrGf1yq/e/1/+mEbqtpV1v4H1q//cNI5X1vffBlf7/szXWvbVq//Pcn7rfSefN2NSqMxOxqxJ3ln9fqxlc+28+39s/qfOrl+/9ft+t8fER/2WP87R7/939brv72y+k9uqv03n3jw9kdfrVV+b+3/cit1Kl/TS//X6wE+y7kDAAAAAACA3aYQEYciKZRjX54uFMrlpd93HI0DhWqt3jh9uTZ3dTJaz8oOR6nQnuk+3PF7iNH897Dt/NhT+fGIOBIRnw/tb+XLE7Xq5E5XHgAAAAAAAAAAAAAAAAAAAHaJg8vP/8cTz/9nfhna6aMDtl1x6f3fwADa8JX//XjTE7ArbRj/wHNL/MPgEv8wuMQ/DKTWFJ/4h8El/mFwiX8YXOIfAAAAAAAAAAAAAAAAAAAAAAAAAAAA+urihQvZ0lx8fHMiy09en5+brl0/M5nWp8szcxPlidrstfJUrTZVTcsTtZmN/l61Vrs2OhZzN0Yaab0xUp9fuDRTm7vauHRlpjKVXkq9ZxwAAAAAAAAAAAAAAAAAAABWq88vTFeq1XS2D4lStZoWIqKXnSP6VOgAJrJ2u1Xs7TxvTyKJlTXF3XJaJPqa2OmeCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABW/BUAAP//2SsyHQ==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x105042, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x2, 0x11, r0, 0x0) r1 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) getdents(r1, &(0x7f0000001fc0)=""/184, 0xb8) 525.71822ms ago: executing program 4 (id=23): mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') mkdir(&(0x7f0000000140)='./control\x00', 0x5) rmdir(&(0x7f0000000100)='./control\x00') 500.92015ms ago: executing program 4 (id=24): socket(0xa, 0x3, 0x3a) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/raw6\x00') preadv(r0, &(0x7f0000000000)=[{&(0x7f0000000440)=""/192, 0xc0}, {&(0x7f00000000c0)=""/254, 0xfe}], 0x2, 0xda, 0x3) 440.620581ms ago: executing program 2 (id=25): r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000300)={0x18, 0x2, {0xffff, @local}}, 0x1e) r1 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r1, &(0x7f0000000000)={0x18, 0x2, {0x0, @dev={0xac, 0x14, 0x14, 0x42}}}, 0x1e) connect$pptp(r1, &(0x7f0000000080)={0x18, 0x2, {0x1, @rand_addr=0x64010100}}, 0x1e) 424.670872ms ago: executing program 0 (id=26): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xd}}, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) sendto$inet6(r0, &(0x7f0000000400)="25eed0aee8c79f49b53c108367401019c41e56367aa3f23916ddf42df6a5ca47adc0f14939ee362a401f6425b5933ed45ac2e4089f33e87ea4fa53cb6f37fa25746f5805cefb6f78a3d525962f72cff39e3fd9074e3260c84fdfced1c00ba3c8cfcd6220a22b568b9ea6d0e366394ae3490b19d046c22e484b0aa11954836b45d4047ab5007b7b758a16f51f05661f02e1cc365db0bf3b54c3c468a8b5462008bc5ffb9db10bed599639774620b78184ada2301d9d494c2c7622d859213c2d7cc96412661b8f8afb818669f98776b43d6f8c598c00e43ade1e0808a35608882523edf4820dc6b1de1a71cb3dcec7265acaaeab264a1082660423eaf763e3d5e6756b9d2e4115906f4284e5e11388dae00c59c49d5bdc02592fbd96f69a586c8e6f36af50d6de76993809225f4a7dfbd1e7feee4438420c40ee1587ef9279cba9847f32d185f2405d680fd8776df5edc7c149279dc808c693dab77ec90071fff6b0b63f5eaadf5e2118dbeebbeb235b90b8b1b871af2ebc579d404578310950526b7be662a9d89be66d6a02522e7352357c02c3a56f8ff816331bd070041ba511613602956381e6d78b645d02dbc77a188168b6312a0998fe17cfd2940c8e5d39e5a95c50f8b0cee4a9c145b23997f830c08fe2e8af162363f4e14d78fd1275af0192483de50d521d85ed5dd21e51e9fba69d7c208ae998c914f5a2393f0594abb1228eb6df78d022707d2e705854e20338e898482ced2d8b853d8cd972bf7d2df97c7fbc2fffb60e9ec9335bf4e98c6d53244dabe2d1d038c75476b620b9263bda96ec2c61f3306dfcfb9f023c3c9678e0ef245b8c3de356f4c4dfe2d791e213b592f8106467517bd0eb3be609108ac41507edb9029c1975fe0c08e461b66b0850a9faf160e658fd770266fa0c70deab155084869592563fe0c136728a2999c6a5d40891a0de089cec58b1ffe2d40e44513b3d51c8c34935b75a351d0d7f9049e6e488585c819437a4e7b338cd5772a744fe79a21327f919ef4bdb9936a5dccd353a45e2642b8cad7aea0152de1d15577c37eff9fc206115e1ed9612183f5aa55ba23b2e2b77432f038b3cc3f0c189414de1402b002ba4464448d74fac86d1ab674a4eb3d8b6e8af11ee37145026fdedb952097fa069ddd516a76c8a647c0faf5a47a75a7294b0eba99291457e4614f0e985bd363de3593590e6f303e511220ce37e1e66711dac26dadaa5f26ab172ef6c7a2f53ed66c0813867e1d53e769efafac557c3977836517f216c53625d8752073fed32346d274613fef1f874d71a632a48220978d6efbf4fb938a46777f05b10cc71d1996772e2536a22b171e2cabffb9099e73026e56210a6162140681048fa9e55388619d83278ea60e5421eaade222b61237aae0d6684f19e090d88da58d0f8e0b4725c41bfc94a5a066d842f768d7ecc527ae2f8ed793ef072da9258db0d11d36637c4765afed52049524efb6feaaa3239dcce104e0889fb10e6a4b7923b4932fecafb1add915f673426c5d6fe7f0290ee8df38763c3737a8bdb4e78b64dd66831440a5dc4e14ccbd14a13f1c513773b9daf0e06cab2bf564b57c8145af47cc64a539fa8326467b318b2e8df6b6cec365f53a3745f4a6cc3d5bfcbe3f11f48713a9568b0fda6f5d88c0d889862e9f36c4f2664da2341b2002d340a4ffb524fa4ae475c2de3842e9c10354a8aa5ee08dcd538ebe243cd8f502cc2fca6dfc7e84a9c844a9be36e198b78d7ab7161f2f590b61fdf175035dee46c5620c9c02ea6b2f7b5d1edee27ba642832a64f7f2dd88a80937bf92d187a4a3dda7cc981b1cbd09416c418af48af5cfef16adb3ebf966a2fe7cbfb1a42b20eeea1c5f5406e644c4561d6e7009ae32331b5c372eccd802c962a56a994c793b145523b1c52356ffc8d0eef096851598692ca35f3d458890493a9883a61501d0fbc92d4543fa753a33bc954544a128a0e02d229737ca4432f9e013b4eba209b7b043eafd698bd756bd6c931798b07b7f62852ce7b3e38c6a3e3ce45535a8f383b57d3217881e7a62aa933809a6b0934b5e63f5617337971b515ccf38208be292107c1a83af71f1d5cc93cf96c1baaae648fa360f7a1a51eace114ba9b1a05db6dedd55ffe78a0e028c42346252a4e27d659447083f30850b02acda5903ca7605fcc9f22015f4c9ea924e7055d4d983a2cbb20a53cc4124bb300bbfb2628565fd09c6702b2d6dd15cff149c0fe7404a297500c4ca3186ccf88c7f46e3d6bf138ec31ba901c42e5ad349ff36c1572df219a1fca81b2aad102c2767006dd82a741cb6024231101e52bef3c581fe339377167620a8e443fead98c800ad9a25dd40e9af5a789bbafc6d742fa9a1b18e01a87cfa2c914ae559b4e63f9ca50943cfe8143d276ca84c814a0f8e8ee2c0a34a65b09856ac5e78bf92344d9b8394a4c2a60800dae54b10caf40bb09b47526e6707141d4f0a013a6e3567daf6db158b7886d84245b865216e916584149c5b84110dd677a756dc1e76c0d2f4e29fe6a67dd4f550b64936cd642adfff786fb89146b447195162ac8ef682874e20fca482bdce967eeb8c68503ad5ce7374b57df9541e1d7a848d863a5cc6dcbeed060103352e90eed71d60cd2be1ec63d98e25d652656601fd70910491b6f2ec81bec992eed2a5e749c93026375a197d93b88b626320340bdca0061d097505bd608543a25eb455f082700ceb2a4361eed56f1d93c40f84050b91a768830f36e6c5044b0df74cccd22dee667e4c597db72e9d3b9e59684130e07699edc511934a270288d5b52b6179c5abf048ede9d5e0d2d0d845dd63962523622d0564fdfdebd4503304681ec758083c639d11b4e2d47e0e63c5f6e7e96d6f2d6c58bdd8df926879c2047794b343b9ceeefa88e96b762cfc469739c933594627bc7e547f8c3cbeb0903473e8d4b323d5021e80dc4f2b0db7ce6f3da41790a4faf682a21593dfcf2e672e471aeceac0746510485f432ef35f68b5e5b2942525ef5c915236f4893e2281f05c586220041d9685ce8c59315cd783932691ae67e1ad85814af28a253d562b00c8503a0a7bf7dd73ee66641a59606c83fc783966c54cb183a812cfd135c945dcb752c29fae0d55c5b35659361d866b790010eeb98a4909038e6870e4b79c756612761e53831186b840840558dc25361c5ccb919222a9effef676b1e68e7d06a596b712e0adcf2d1972d92d979d95ee44ace518e3f95311cd51f7e48f79775233ae1b2500ca1779ed92cd575e85391d1c7a283d19e008379e9ccd2706f9c191094d31ca0e4e8148776250302774111ef74b980613bd350f6043e8b745f6134336e615e65d491a2c552407a9b87c2aa2883c2d829441ac92ebd11b4425ced9f5d68aeb034a7e6cacb0cc22267cf8f6b3d8a49371b392b0ac9d1845ca7a3e016a3161cd0099e459fdb05719660edaab4f7f2ee5cabe8802222a3acb2551106a63a1b29d5700742619dd758476a95f5b9f98422d54b0104f01f78ca632dae4e7294a4ba6083882ca7f406d97e6049d32fed8864671fb03992e902d463175de1fc784d0b2bc14023f850a3258658755ac00daa52abc1e824527a028b", 0xa01, 0x4000, 0x0, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f00000000c0)={&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, 0x0, 0x1001, 0x1, 0x0}, &(0x7f00000001c0)=0x40) 392.057683ms ago: executing program 0 (id=27): bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="1804000000000000000000000000000018010000b98bc2c900000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b100000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000002c0)='module_request\x00', r0}, 0x18) socketpair$unix(0x2, 0x5, 0x106, &(0x7f0000000040)) 218.110726ms ago: executing program 3 (id=28): sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000440)=[{{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000b80)="83556f524e5b4275202de9e9190a4e45413b785e52d04218ff14259285fc60a04bc6b2219b8c6853a6622cf43ff12c6e70030000009d24e78c3e9315e114c8a7316f4fe07425a43afc3f2146fd5b3fa9944ac1fff9e40cb9d497259e2f8443386550fc0255f733c2c4592534f4c24aa04090941068f785925c29c444a6887d4a23cffdd0da78bccb1ee094cc21d79dddfd1ee274ec69d98e4ce1efdf416ca3948f3e2d92e348b88fd9387473855b1fdcd7493d01f0453924af3a79bc5d40b7e5ab2c6bd87501389f038abd8f0b2c59445502d726c974e0e57eab107a6ad6f2a998529e4bdafb9ed3a4c3482682f5369b1ca77c8dae495685a16821fd0da5b3b17b58909c93344ff6b6908a5de6530ebb79b7096253ed28f981b117f1af480914519ce90117ffc37d83297da593ce451f464a6b272b35442e3bc42881092cc92420590b6230a6af3817a7b4ca4d7a46e0c5d814ee1f6d9a20a255c54b88476ac582e3e4d99ba105b0f4dfb48d666aa23f70fbe69249f33f75fb4e5cbf27f1ecd1f47bfa745d508d3c599de413ab6b7f00ae14e2ed3c83da269536787bf4ff3f0d117b8415df306504b3020bfa61450bd88b8c73362f2ccd2217a49b8948f0ead1cac7c3f8da62ecc2219826bde12cf42eb9f9378909858d000000006316d96e2735850218ae8f89dfb2459ebc25571077a7602a55d51b2582a5d5e322e5816bc464beace66726fa5a8b0b84be74b85dd81115bf7dc16d2a45db14e6b52e05ab8f54b7d775d90db2ea7a63d7a84812ed5a56346fcbd1ef7b0f8f3f6833a99270f678ec85e3ce2ce718531e898016f81dec1c2702e7e0b04539cdc298c00cd464ca36342b634a61e2ba4e8c3ede56d78cac00fb4137aaddba05c519713989c60aed06231c821eb247e6d7a55989e4a672b5d24cdc", 0x293}], 0x1}}], 0x1, 0x60c5895) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x202, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_GET_MSRS_cpu(r2, 0xc008ae88, &(0x7f0000000380)={0x21, 0x0, [{0x298, 0x0, 0x100}]}) 0s ago: executing program 2 (id=29): r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = dup(r0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11000000040000000400000001"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000940)={{r2, 0xffffffffffffffff}, &(0x7f0000000880), &(0x7f00000008c0)=r1}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r3}, &(0x7f0000000200), &(0x7f0000000280)=r1}, 0x20) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.250' (ED25519) to the list of known hosts. [ 21.544308][ T28] audit: type=1400 audit(1757064556.233:64): avc: denied { mounton } for pid=274 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.545692][ T274] cgroup: Unknown subsys name 'net' [ 21.567372][ T28] audit: type=1400 audit(1757064556.233:65): avc: denied { mount } for pid=274 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.594879][ T28] audit: type=1400 audit(1757064556.263:66): avc: denied { unmount } for pid=274 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.614926][ T274] cgroup: Unknown subsys name 'devices' [ 21.704850][ T274] cgroup: Unknown subsys name 'hugetlb' [ 21.710495][ T274] cgroup: Unknown subsys name 'rlimit' [ 21.845732][ T28] audit: type=1400 audit(1757064556.533:67): avc: denied { setattr } for pid=274 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.868968][ T28] audit: type=1400 audit(1757064556.533:68): avc: denied { mounton } for pid=274 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 21.894257][ T28] audit: type=1400 audit(1757064556.533:69): avc: denied { mount } for pid=274 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.905762][ T276] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 21.927024][ T28] audit: type=1400 audit(1757064556.613:70): avc: denied { relabelto } for pid=276 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.952472][ T28] audit: type=1400 audit(1757064556.613:71): avc: denied { write } for pid=276 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.984319][ T28] audit: type=1400 audit(1757064556.673:72): avc: denied { read } for pid=274 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.009873][ T28] audit: type=1400 audit(1757064556.673:73): avc: denied { open } for pid=274 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.009933][ T274] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.695478][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.702673][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.710369][ T282] device bridge_slave_0 entered promiscuous mode [ 22.718489][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.726273][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.733951][ T282] device bridge_slave_1 entered promiscuous mode [ 22.916103][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.923497][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.930901][ T287] device bridge_slave_0 entered promiscuous mode [ 22.947445][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.954569][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.962162][ T288] device bridge_slave_0 entered promiscuous mode [ 22.968960][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.976061][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.983642][ T287] device bridge_slave_1 entered promiscuous mode [ 22.999683][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.006883][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.014661][ T288] device bridge_slave_1 entered promiscuous mode [ 23.031816][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.038939][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.046476][ T286] device bridge_slave_0 entered promiscuous mode [ 23.056978][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.064060][ T282] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.071345][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.078411][ T282] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.093472][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.100524][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.108273][ T286] device bridge_slave_1 entered promiscuous mode [ 23.136987][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.144083][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.151668][ T289] device bridge_slave_0 entered promiscuous mode [ 23.158736][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.165941][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.173465][ T289] device bridge_slave_1 entered promiscuous mode [ 23.311253][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.318370][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.325976][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.333158][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.373272][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.381863][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.390537][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.398538][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.407638][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.415734][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.447791][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.456088][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.463176][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.479497][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.513850][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.521994][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.530773][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.537886][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.545706][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.554226][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.561258][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.568641][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.576919][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.584087][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.591721][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.599972][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.607020][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.615474][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 23.656627][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.664935][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.673954][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.682159][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.690609][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.699431][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.725561][ T288] device veth0_vlan entered promiscuous mode [ 23.733382][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.742008][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.750662][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.759581][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.768511][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.776492][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.784707][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.792092][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.799753][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.807348][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.829456][ T288] device veth1_macvtap entered promiscuous mode [ 23.842858][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.851443][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.859995][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.868531][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.877206][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.885822][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.892887][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.900367][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.909014][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.917234][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.924470][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.931802][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.939975][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.949498][ T282] device veth0_vlan entered promiscuous mode [ 23.962897][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 23.970621][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.978636][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.987216][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.995648][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.003855][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.012114][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.020614][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.028951][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.037453][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.044975][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.060243][ T282] device veth1_macvtap entered promiscuous mode [ 24.070219][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.078560][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.086997][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.109266][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.117964][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.126711][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.135176][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.143692][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.151145][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.158876][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.167597][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.177455][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.185944][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.200766][ T286] device veth0_vlan entered promiscuous mode [ 24.212357][ T287] device veth0_vlan entered promiscuous mode [ 24.221161][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.229836][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.237785][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.245491][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.254079][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.262352][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.269454][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.276961][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.285527][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.294018][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.301062][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.308549][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.316535][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.324721][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.332420][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.340010][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.354906][ T286] device veth1_macvtap entered promiscuous mode [ 24.369610][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.369642][ T288] request_module fs-gadgetfs succeeded, but still no fs? [ 24.414663][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.434234][ T339] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 24.437251][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.460071][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.468778][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.482046][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.503417][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.511798][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.531416][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.540152][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.556702][ T287] device veth1_macvtap entered promiscuous mode [ 24.575406][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.589284][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.598715][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.607319][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.621856][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.637343][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.657273][ T289] device veth0_vlan entered promiscuous mode [ 24.667950][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.676675][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.684829][ T345] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.705960][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.714391][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.724237][ T289] device veth1_macvtap entered promiscuous mode [ 24.735571][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.743354][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.751611][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.767557][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.778982][ T344] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.872646][ T19] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 24.942626][ T351] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 24.982731][ T361] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 25.052696][ T19] usb 4-1: Using ep0 maxpacket: 16 [ 25.058957][ T19] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 25.067910][ T19] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 25.078109][ T19] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 25.087203][ T356] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 25.098182][ T19] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 25.107362][ T19] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.115459][ T19] usb 4-1: Product: syz [ 25.119628][ T19] usb 4-1: Manufacturer: syz [ 25.124292][ T351] usb 5-1: Using ep0 maxpacket: 32 [ 25.129482][ T19] usb 4-1: SerialNumber: syz [ 25.136499][ T351] usb 5-1: config 216 has an invalid interface number: 164 but max is 0 [ 25.145207][ T351] usb 5-1: config 216 has an invalid descriptor of length 10, skipping remainder of the config [ 25.155714][ T351] usb 5-1: config 216 has no interface number 0 [ 25.162929][ T351] usb 5-1: config 216 interface 164 has no altsetting 0 [ 25.171963][ T351] usb 5-1: New USB device found, idVendor=0781, idProduct=55e8, bcdDevice=36.bb [ 25.181387][ T351] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.184116][ T361] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 25.189630][ T351] usb 5-1: Product: syz [ 25.204766][ T361] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 25.204955][ T351] usb 5-1: Manufacturer: syz [ 25.219321][ T361] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 25.219524][ T351] usb 5-1: SerialNumber: syz [ 25.232576][ T361] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 25.246197][ T361] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.257402][ T361] usb 1-1: config 0 descriptor?? [ 25.272628][ T356] usb 3-1: Using ep0 maxpacket: 32 [ 25.279047][ T356] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 25.290685][ T356] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 25.300712][ T356] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 25.309974][ T356] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.322326][ T356] usb 3-1: config 0 descriptor?? [ 25.448082][ T351] usb-storage 5-1:216.164: USB Mass Storage device detected [ 25.463770][ T351] usb-storage 5-1:216.164: Quirks match for vid 0781 pid 55e8: 800000 [ 25.497739][ T351] usb 5-1: USB disconnect, device number 2 [ 25.566790][ T19] usb 4-1: 0:2 : does not exist [ 25.665669][ T361] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 25.673286][ T361] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 25.681212][ T361] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 25.688722][ T361] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 25.696452][ T361] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 25.703921][ T361] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 25.711339][ T361] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 25.718792][ T361] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 25.726449][ T361] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 25.733932][ T361] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 25.739084][ T356] savu 0003:1E7D:2D5A.0002: hiddev96,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.2-1/input0 [ 25.741857][ T361] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 25.760663][ T24] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 25.768439][ T361] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 25.784627][ T361] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 25.792203][ T361] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 25.799847][ T361] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 25.807609][ T361] plantronics 0003:047F:FFFF.0001: No inputs registered, leaving [ 25.820069][ T361] plantronics 0003:047F:FFFF.0001: hiddev97,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 25.953397][ T361] usb 3-1: USB disconnect, device number 2 [ 25.956571][ T356] usb 1-1: USB disconnect, device number 2 [ 25.973347][ T24] usb 2-1: Using ep0 maxpacket: 16 [ 25.980147][ T24] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 25.991720][ T24] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 26.002234][ T24] usb 2-1: config 0 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 26.016507][ T24] usb 2-1: config 0 interface 0 has no altsetting 0 [ 26.023256][ T24] usb 2-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 26.032321][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.041218][ T24] usb 2-1: config 0 descriptor?? [ 26.185982][ T19] usb 4-1: 1:0: failed to get current value for ch 0 (-22) [ 26.202302][ T19] usb 4-1: USB disconnect, device number 2 [ 26.209720][ T392] process 'syz.4.18' launched '/dev/fd/4' with NULL argv: empty string added [ 26.212014][ T367] udevd[367]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 26.263601][ T397] SELinux: Context system_u:object_r:fsadm_exec_t:s0 is not valid (left unmapped). [ 26.296226][ T399] netlink: 116 bytes leftover after parsing attributes in process `syz.4.21'. [ 26.305365][ T399] Zero length message leads to an empty skb [ 26.327026][ T401] loop4: detected capacity change from 0 to 1024 [ 26.335228][ T401] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 26.354301][ T401] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 26.370779][ T401] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1102: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 26.385500][ T401] EXT4-fs warning (device loop4): ext4_expand_extra_isize_ea:2818: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 26.407522][ T288] EXT4-fs (loop4): unmounting filesystem. [ 26.432220][ T288] ------------[ cut here ]------------ [ 26.437856][ T288] WARNING: CPU: 0 PID: 288 at fs/inode.c:332 drop_nlink+0xc5/0x110 [ 26.445975][ T288] Modules linked in: [ 26.450141][ T288] CPU: 0 PID: 288 Comm: syz-executor Not tainted syzkaller #0 [ 26.457758][ T288] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 26.467962][ T288] RIP: 0010:drop_nlink+0xc5/0x110 [ 26.473159][ T288] Code: 1b 48 8d bb b8 04 00 00 be 08 00 00 00 e8 03 ea f0 ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 5b 81 ac ff <0f> 0b eb 86 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 5e ff ff ff 4c [ 26.493004][ T288] RSP: 0018:ffffc9000dab7c38 EFLAGS: 00010293 [ 26.499197][ T288] RAX: ffffffff81c38805 RBX: ffff8881345f6de0 RCX: ffff88811175d100 [ 26.507771][ T288] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 26.516128][ T288] RBP: ffffc9000dab7c60 R08: 0000000000000004 R09: 0000000000000003 [ 26.524230][ T288] R10: fffff52001b56f78 R11: 1ffff92001b56f78 R12: dffffc0000000000 [ 26.532235][ T288] R13: 1ffff110268bedc5 R14: ffff8881345f6e28 R15: 0000000000000000 [ 26.540673][ T288] FS: 000055558095f500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 26.549825][ T288] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 26.556521][ T288] CR2: 00007f1deb3f5aa0 CR3: 000000012fafb000 CR4: 00000000003506b0 [ 26.564642][ T288] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 26.572661][ T288] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 26.580653][ T288] Call Trace: [ 26.583986][ T288] [ 26.587014][ T288] shmem_rmdir+0x5b/0x90 [ 26.591304][ T288] vfs_rmdir+0x393/0x500 [ 26.595583][ T28] kauditd_printk_skb: 68 callbacks suppressed [ 26.595596][ T28] audit: type=1400 audit(1757064561.213:142): avc: denied { name_bind } for pid=407 comm="syz.0.26" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 26.595624][ T28] audit: type=1400 audit(1757064561.213:143): avc: denied { node_bind } for pid=407 comm="syz.0.26" saddr=::ffff:172.20.20.13 src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 26.595647][ T28] audit: type=1400 audit(1757064561.213:144): avc: denied { create } for pid=408 comm="syz.2.25" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 26.595669][ T28] audit: type=1400 audit(1757064561.213:145): avc: denied { bind } for pid=408 comm="syz.2.25" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 26.595691][ T28] audit: type=1400 audit(1757064561.213:146): avc: denied { connect } for pid=408 comm="syz.2.25" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 26.601874][ T288] incfs_kill_sb+0x105/0x220 [ 26.675484][ T291] usb 2-1: USB disconnect, device number 2 [ 26.684684][ T288] deactivate_locked_super+0xb5/0x120 [ 26.720080][ T288] deactivate_super+0xaf/0xe0 [ 26.724903][ T288] cleanup_mnt+0x45f/0x4e0 [ 26.729409][ T288] __cleanup_mnt+0x19/0x20 [ 26.733916][ T288] task_work_run+0x1db/0x240 [ 26.738547][ T288] ? __cfi_task_work_run+0x10/0x10 [ 26.743721][ T288] ? __x64_sys_umount+0x125/0x160 [ 26.748774][ T288] ? __cfi___x64_sys_umount+0x10/0x10 [ 26.754242][ T288] exit_to_user_mode_loop+0x9b/0xb0 [ 26.759466][ T288] exit_to_user_mode_prepare+0x5a/0xa0 [ 26.765004][ T288] syscall_exit_to_user_mode+0x1a/0x30 [ 26.770494][ T288] do_syscall_64+0x58/0xa0 [ 26.775039][ T288] ? clear_bhb_loop+0x30/0x80 [ 26.779763][ T288] ? clear_bhb_loop+0x30/0x80 [ 26.784517][ T288] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 26.790446][ T288] RIP: 0033:0x7ff373b8ff17 [ 26.794917][ T288] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 26.814570][ T288] RSP: 002b:00007ffe409bbfd8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 26.823140][ T288] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007ff373b8ff17 [ 26.831138][ T288] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe409bc090 [ 26.839191][ T288] RBP: 00007ffe409bc090 R08: 0000000000000000 R09: 0000000000000000 [ 26.847277][ T288] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffe409bd120 [ 26.855311][ T288] R13: 00007ff373c11c05 R14: 000000000000671e R15: 00007ffe409bd160 [ 26.863345][ T288] [ 26.866471][ T288] ---[ end trace 0000000000000000 ]--- [ 26.874989][ T288] ================================================================== [ 26.883095][ T288] BUG: KASAN: null-ptr-deref in ihold+0x20/0x60 [ 26.889349][ T288] Write of size 4 at addr 0000000000000170 by task syz-executor/288 [ 26.897326][ T288] [ 26.899652][ T288] CPU: 0 PID: 288 Comm: syz-executor Tainted: G W syzkaller #0 [ 26.908586][ T288] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 26.918643][ T288] Call Trace: [ 26.921925][ T288] [ 26.924859][ T288] __dump_stack+0x21/0x24 [ 26.929280][ T288] dump_stack_lvl+0xee/0x150 [ 26.933876][ T288] ? __cfi_dump_stack_lvl+0x8/0x8 [ 26.938907][ T288] ? ihold+0x20/0x60 [ 26.942802][ T288] ? ihold+0x20/0x60 [ 26.946700][ T288] print_report+0x3d/0x60 [ 26.951042][ T288] kasan_report+0x122/0x150 [ 26.955559][ T288] ? ihold+0x20/0x60 [ 26.959453][ T288] kasan_check_range+0x280/0x290 [ 26.964479][ T288] __kasan_check_write+0x14/0x20 [ 26.969422][ T288] ihold+0x20/0x60 [ 26.973151][ T288] vfs_rmdir+0x25f/0x500 [ 26.977401][ T288] incfs_kill_sb+0x105/0x220 [ 26.982006][ T288] deactivate_locked_super+0xb5/0x120 [ 26.987412][ T288] deactivate_super+0xaf/0xe0 [ 26.992095][ T288] cleanup_mnt+0x45f/0x4e0 [ 26.996519][ T288] __cleanup_mnt+0x19/0x20 [ 27.001223][ T288] task_work_run+0x1db/0x240 [ 27.005821][ T288] ? __cfi_task_work_run+0x10/0x10 [ 27.010940][ T288] ? __x64_sys_umount+0x125/0x160 [ 27.015970][ T288] ? __cfi___x64_sys_umount+0x10/0x10 [ 27.021348][ T288] exit_to_user_mode_loop+0x9b/0xb0 [ 27.026553][ T288] exit_to_user_mode_prepare+0x5a/0xa0 [ 27.032016][ T288] syscall_exit_to_user_mode+0x1a/0x30 [ 27.037485][ T288] do_syscall_64+0x58/0xa0 [ 27.041903][ T288] ? clear_bhb_loop+0x30/0x80 [ 27.046682][ T288] ? clear_bhb_loop+0x30/0x80 [ 27.051372][ T288] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 27.057267][ T288] RIP: 0033:0x7ff373b8ff17 [ 27.061690][ T288] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 27.081296][ T288] RSP: 002b:00007ffe409bbfd8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 27.089712][ T288] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007ff373b8ff17 [ 27.097800][ T288] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe409bc090 [ 27.105778][ T288] RBP: 00007ffe409bc090 R08: 0000000000000000 R09: 0000000000000000 [ 27.113756][ T288] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffe409bd120 [ 27.121817][ T288] R13: 00007ff373c11c05 R14: 000000000000671e R15: 00007ffe409bd160 [ 27.129807][ T288] [ 27.132825][ T288] ================================================================== [ 27.148794][ T28] audit: type=1400 audit(1757064561.833:147): avc: denied { create } for pid=417 comm="syz.2.29" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 27.150548][ T288] Disabling lock debugging due to kernel taint [ 27.182245][ T288] BUG: kernel NULL pointer dereference, address: 0000000000000170 [ 27.190090][ T288] #PF: supervisor write access in kernel mode [ 27.196167][ T288] #PF: error_code(0x0002) - not-present page [ 27.197743][ T28] audit: type=1400 audit(1757064561.863:148): avc: denied { read } for pid=84 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 27.202152][ T288] PGD 131d88067 P4D 131d88067 PUD 0 [ 27.223899][ T28] audit: type=1400 audit(1757064561.863:149): avc: denied { search } for pid=84 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 27.229161][ T288] Oops: 0002 [#1] PREEMPT SMP KASAN [ 27.250887][ T28] audit: type=1400 audit(1757064561.863:150): avc: denied { write } for pid=84 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 27.255599][ T288] CPU: 0 PID: 288 Comm: syz-executor Tainted: G B W syzkaller #0 [ 27.255620][ T288] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 27.286015][ T28] audit: type=1400 audit(1757064561.863:151): avc: denied { add_name } for pid=84 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 27.296099][ T288] RIP: 0010:ihold+0x26/0x60 [ 27.296129][ T288] Code: 33 36 7c df 55 48 89 e5 41 56 53 48 89 fb e8 c1 78 ac ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 40 e1 f0 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 b1 [ 27.296146][ T288] RSP: 0018:ffffc9000dab7c78 EFLAGS: 00010246 [ 27.346818][ T288] RAX: ffff88811175d100 RBX: 0000000000000000 RCX: ffff88811175d100 [ 27.354981][ T288] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 27.362981][ T288] RBP: ffffc9000dab7c88 R08: dffffc0000000000 R09: fffffbfff0f2d6fd [ 27.371002][ T288] R10: fffffbfff0f2d6fd R11: 1ffffffff0f2d6fc R12: ffff8881345f6dec [ 27.378982][ T288] R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000 [ 27.386956][ T288] FS: 000055558095f500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 27.395910][ T288] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.402510][ T288] CR2: 0000000000000170 CR3: 000000012fafb000 CR4: 00000000003526b0 [ 27.410491][ T288] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 27.418468][ T288] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 27.426613][ T288] Call Trace: [ 27.429896][ T288] [ 27.432864][ T288] vfs_rmdir+0x25f/0x500 [ 27.437126][ T288] incfs_kill_sb+0x105/0x220 [ 27.441726][ T288] deactivate_locked_super+0xb5/0x120 [ 27.447107][ T288] deactivate_super+0xaf/0xe0 [ 27.451806][ T288] cleanup_mnt+0x45f/0x4e0 [ 27.456273][ T288] __cleanup_mnt+0x19/0x20 [ 27.460727][ T288] task_work_run+0x1db/0x240 [ 27.465338][ T288] ? __cfi_task_work_run+0x10/0x10 [ 27.470482][ T288] ? __x64_sys_umount+0x125/0x160 [ 27.475614][ T288] ? __cfi___x64_sys_umount+0x10/0x10 [ 27.481010][ T288] exit_to_user_mode_loop+0x9b/0xb0 [ 27.486252][ T288] exit_to_user_mode_prepare+0x5a/0xa0 [ 27.491730][ T288] syscall_exit_to_user_mode+0x1a/0x30 [ 27.497201][ T288] do_syscall_64+0x58/0xa0 [ 27.501711][ T288] ? clear_bhb_loop+0x30/0x80 [ 27.506404][ T288] ? clear_bhb_loop+0x30/0x80 [ 27.511090][ T288] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 27.517043][ T288] RIP: 0033:0x7ff373b8ff17 [ 27.521471][ T288] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 27.541200][ T288] RSP: 002b:00007ffe409bbfd8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 27.549631][ T288] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007ff373b8ff17 [ 27.557614][ T288] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe409bc090 [ 27.565678][ T288] RBP: 00007ffe409bc090 R08: 0000000000000000 R09: 0000000000000000 [ 27.573745][ T288] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffe409bd120 [ 27.581722][ T288] R13: 00007ff373c11c05 R14: 000000000000671e R15: 00007ffe409bd160 [ 27.589711][ T288] [ 27.592736][ T288] Modules linked in: [ 27.596743][ T288] CR2: 0000000000000170 [ 27.600893][ T288] ---[ end trace 0000000000000000 ]--- [ 27.606492][ T288] RIP: 0010:ihold+0x26/0x60 [ 27.611012][ T288] Code: 33 36 7c df 55 48 89 e5 41 56 53 48 89 fb e8 c1 78 ac ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 40 e1 f0 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 b1 [ 27.630713][ T288] RSP: 0018:ffffc9000dab7c78 EFLAGS: 00010246 [ 27.636786][ T288] RAX: ffff88811175d100 RBX: 0000000000000000 RCX: ffff88811175d100 [ 27.644852][ T288] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 27.652831][ T288] RBP: ffffc9000dab7c88 R08: dffffc0000000000 R09: fffffbfff0f2d6fd [ 27.660812][ T288] R10: fffffbfff0f2d6fd R11: 1ffffffff0f2d6fc R12: ffff8881345f6dec [ 27.668874][ T288] R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000 [ 27.676883][ T288] FS: 000055558095f500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 27.685834][ T288] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.692423][ T288] CR2: 0000000000000170 CR3: 000000012fafb000 CR4: 00000000003526b0 [ 27.700497][ T288] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 27.708481][ T288] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 27.716469][ T288] Kernel panic - not syncing: Fatal exception [ 27.722923][ T288] Kernel Offset: disabled [ 27.727526][ T288] Rebooting in 86400 seconds..