last executing test programs: 332.431733ms ago: executing program 4 (id=143): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000003840), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME_WAIT_CANCEL(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010028bd7000fcdbdf255300000008000300", @ANYRES32=r3], 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x800) 278.362978ms ago: executing program 4 (id=148): r0 = socket(0x1a, 0x1, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) listen(0xffffffffffffffff, 0x0) ioctl$int_in(0xffffffffffffffff, 0x5421, 0x0) accept4$unix(r0, 0x0, 0x0, 0xc0800) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000440)={0xffffffffffffffff, 0x20, &(0x7f0000000400)={&(0x7f0000000380)=""/75, 0x4b, 0x0, &(0x7f00000002c0)=""/40, 0x28}}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000000000000000000000000000018150000b3a63e87351a8db282f9f8c7e442a194d54294d47443555479f07ac5eb7ed79189805312f3f03616f9351db65fe204c939797cf7feb70ee8d5637c646791b5822e6b60f3c4ecef2892cd3aaf8bf6c372d91370651b", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) pipe(&(0x7f0000000280)) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r3, 0x18000000000002a0, 0xd, 0x0, &(0x7f0000000080)="5a6e41dea43e63a3f70cff11c7", 0x0, 0x2e00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x50) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000340)=[@window={0x3, 0xfffd, 0x2}, @window={0x3, 0x6, 0x7}, @mss={0x2, 0x7}, @sack_perm, @mss={0x2, 0xffffffff}, @mss={0x2, 0x1}], 0x6) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000001c0), 0x4) close(0x3) 278.111878ms ago: executing program 3 (id=151): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001700)=ANY=[@ANYBLOB="1800000024000103000000000000000001008c000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) recvmmsg(r0, &(0x7f00000003c0)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000005740)=""/4102, 0x1006}, {&(0x7f0000000480)=""/144, 0x90}], 0x2}, 0x4}, {{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f00000001c0)=""/97, 0x61}, {&(0x7f0000000280)=""/118, 0x76}, {&(0x7f0000001740)=""/4080, 0xff0}, {&(0x7f0000004740)=""/4069, 0xfe5}], 0x4}, 0x8}], 0x3, 0x10062, 0x0) 243.862151ms ago: executing program 4 (id=155): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x2) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) listen(0xffffffffffffffff, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r5, 0x0) listen(r4, 0x0) r6 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r6, &(0x7f00000000c0)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fbc45ff810500000000000058000b480400945f6400947e570028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010002081000418e00000004fcff", 0x58}], 0x1) 243.542881ms ago: executing program 3 (id=157): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'bond_slave_1\x00'}) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, &(0x7f0000000040)=0x1040400, 0x4) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x44040) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)={0x38, r1, 0x1, 0x70bd2b, 0x0, {{0x2}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0xf4, 0x2e}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1450}]]}, 0x38}, 0x1, 0x0, 0x0, 0xd37697ff280d3c0e}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$MRT6_ADD_MIF(0xffffffffffffffff, 0x29, 0xca, 0x0, 0x0) 203.603484ms ago: executing program 3 (id=161): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000100), 0xffffffffffffffff) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendmsg$NL802154_CMD_DEL_SEC_DEVKEY(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)={0x28, r1, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [@NL802154_ATTR_SEC_DEVKEY={0x4}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_SEC_DEVKEY={0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x8040}, 0xc0) 203.323233ms ago: executing program 4 (id=163): bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x4, 0x0, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff) r3 = gettid() r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r4, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000300)={0x3c, r5, 0x1, 0xfffffffe, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r6}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xfb2e77a8993c191f}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xffff}]}, 0x3c}}, 0x20000000) sendmsg$NBD_CMD_STATUS(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, r5, 0x8, 0x70bd2d, 0x25dfdbfd, {}, [@NBD_ATTR_BACKEND_IDENTIFIER={0x5, 0xa, '+'}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x10) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x24, r2, 0x1, 0x70bd28, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_PID={0x8, 0x1c, r3}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000040}, 0x4000000) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000040)=0x8, 0x4) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x32, &(0x7f00000001c0)={@multicast, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x11, 0x0, @dev, @multicast1}, {0x0, 0x4e20, 0x10, 0x0, @gue={{0x2}}}}}}}, 0x0) 167.161227ms ago: executing program 1 (id=165): syz_emit_ethernet(0x3a, &(0x7f0000000180)={@local, @random="6cf6566994c6", @val={@void, {0x8100, 0x0, 0x0, 0x1}}, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x2d, 0x28, 0x0, 0x0, 0xa3, 0x6, 0x0, @rand_addr=0x64010100, @local}, {{0x4e22, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}, 0x0) 166.662507ms ago: executing program 3 (id=168): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x303}, "bd88818314ff7d84", "0b3ea924c47b25d7624cd362581725c7", "00f6ff00", "d5a1d50399459b68"}, 0x28) readv(r0, &(0x7f0000000200)=[{&(0x7f0000000300)=""/244, 0xf4}], 0x1) shutdown(r0, 0x0) 166.551717ms ago: executing program 4 (id=169): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'team_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000010c0)=ANY=[@ANYBLOB="3401000010000100"/20, @ANYRES32=r1, @ANYBLOB="000000000000000014011a80400002803c000180080021000000000008001800000000000800030000000000080009000000000008000c0000000000080012000000000008001f00000000006c000a801400070020"], 0x134}}, 0x0) 131.948539ms ago: executing program 3 (id=171): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xc, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f00000002c0)='GPL\x00'}, 0x94) r1 = socket$packet(0x11, 0x3, 0x300) socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) socket$tipc(0x1e, 0x2, 0x0) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getpeername$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r3, 0x10e, 0x1, 0x0, 0x0) sendmmsg(r1, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0xdd86, r4}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000080)='O', 0x28}], 0x1, 0x0, 0x0, 0x2f00}}], 0x1, 0x0) 131.813589ms ago: executing program 1 (id=172): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r3, {}, {0x2, 0xb}, {0x9, 0xb}}, [@qdisc_kind_options=@q_pfifo_fast={0xf}]}, 0x34}, 0x1, 0x0, 0x0, 0x2000c061}, 0x4008000) 131.65961ms ago: executing program 4 (id=173): r0 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x25}}}]}, 0x38}}, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000060c0)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r8, {0x0, 0xfff3}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) sendmsg$nl_route_sched(r5, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000006100)=@delchain={0x24, 0x65, 0x1, 0x70bd2b, 0x25dfdbff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff3}, {}, {0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) 131.562549ms ago: executing program 1 (id=174): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x1886c301}]}]}], {0x14}}, 0x88}, 0x1, 0x0, 0x0, 0x20004000}, 0x0) 131.478979ms ago: executing program 2 (id=175): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="310300000000000000000900000008000300", @ANYRES32=r2], 0x24}, 0x1, 0x0, 0x0, 0x4049000}, 0x4000) 89.166053ms ago: executing program 1 (id=177): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40, 0x0) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000000100)={'syzkaller0\x00'}) 88.829133ms ago: executing program 3 (id=178): mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000340)=@gcm_256={{0x304}, '\x00', "ec094e071cc80f218d360356a936a7e3971a8c35c47e580400", "cf00", "fffffffffffffffd"}, 0x38) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200)=0xffffffffffffffff, 0x4) writev(r0, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1) 88.678643ms ago: executing program 2 (id=179): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000700), r0) sendmsg$IEEE802154_LLSEC_GETPARAMS(r0, &(0x7f0000000800)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000007c0)={&(0x7f0000000740)={0x20, r1, 0x31, 0x70bd2a, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x4) 88.514813ms ago: executing program 0 (id=180): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_MPATH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x1, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}}, 0x4005080) 51.217546ms ago: executing program 2 (id=181): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="58000000020605000000000400000000000000000c00078008000640000000070500010007000000050005000a00000005000400000000000900020073797a310000000011000300686173683a69702c706f727400"], 0x58}}, 0x0) 51.065176ms ago: executing program 2 (id=182): r0 = socket$inet6(0x10, 0x2, 0x6) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x16}]}, 0x10) sendto$inet6(r0, &(0x7f00000002c0)="100000001200050f0c1000000049b23e", 0x10, 0x0, 0x0, 0x0) 50.930096ms ago: executing program 0 (id=183): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000b80)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_DELSET={0x20, 0xb, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x1}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x48}, 0x1, 0x0, 0x0, 0xf8efc43c7cfa4ba4}, 0x40000) 50.790036ms ago: executing program 1 (id=184): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) recvmmsg(r0, &(0x7f00000086c0)=[{{0x0, 0x0, 0x0}, 0x104}, {{0x0, 0x0, 0x0}, 0x80000001}, {{0x0, 0x0, 0x0}, 0x8001}, {{0x0, 0x0, &(0x7f0000002b00)=[{&(0x7f00000028c0)=""/236, 0xec}, {&(0x7f0000002b80)=""/4100, 0x1004}, {&(0x7f0000000640)=""/68, 0x44}, {&(0x7f0000000500)=""/240, 0xf0}, {&(0x7f0000000740)=""/251, 0xfb}], 0x5}, 0x9}], 0x4, 0x4022, 0x0) 50.651836ms ago: executing program 0 (id=185): r0 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000040)=@req3={0x80000000}, 0xfeda) listen(r0, 0x0) r1 = socket(0x1e, 0x805, 0x0) sendmsg$tipc(r1, &(0x7f0000000080)={&(0x7f0000000100)=@name, 0x10, 0x0}, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f00000000c0)=@req3={0x80000000, 0x0, 0x2}, 0x1c) accept4$nfc_llcp(r0, 0x0, 0x0, 0x0) sendmsg$tipc(r1, &(0x7f0000000640)={&(0x7f0000000380), 0x10, 0x0}, 0x0) 50.493036ms ago: executing program 1 (id=186): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x84, 0x2c, 0xd27, 0x70bd28, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0x0, 0x4}, {}, {0xfff2, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x2, 0x2, 0xfffffffffffffffd, 0x100000a, 0x8}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x10}, 0x0) 4.84439ms ago: executing program 0 (id=187): bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f00000001c0), r0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000004340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="310300000000000020000800000008000300", @ANYRES32=r2], 0x24}}, 0x0) 4.71638ms ago: executing program 2 (id=188): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e20, @empty}, 0x10) sendto$inet(r0, &(0x7f00000002c0)="fe5b", 0x2, 0x20008005, &(0x7f0000000280)={0x2, 0x4e20}, 0x10) close(0x3) 4.63008ms ago: executing program 0 (id=189): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={0xffffffffffffffff, 0x4000000, 0x2d, 0x72, &(0x7f0000000040)="976d9023d56482cd284a63da539706d7009be646625bd75b025352ebe557df463106baeed6c2d75549b140f143", &(0x7f0000000180)=""/114, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x50) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="3f9d00000000000000001700000008000300", @ANYRES32=r2, @ANYBLOB="60003080050002000000000014000400403a050c5bae9c544ef2b6d713459a7a1c000180050002000000000008000400050000000800010002000000240003"], 0x7c}}, 0x0) 4.30463ms ago: executing program 0 (id=190): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r0, &(0x7f0000000040), 0xe) write(r0, &(0x7f0000000940)="c18008e6923d8dd3b44a477be484fd8885f47a6b434f4360b8f8438c5b5b0a278ea9352e080938a012b845ceac26380596b97c9383f241b6a88b652dbcd4e109d23a20801d82ff999d86f6aef067ad6912f40400594c5dd7cd1ceb2a2c71ef516ea9296304e6dc14b269275eb44053204fcf", 0x72) getpeername(r0, 0x0, &(0x7f0000000000)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, 0x0, 0x0, 0x0, 0x4, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x408c4) ioctl$sock_SIOCBRDELBR(r1, 0x89a2, &(0x7f0000000000)='bridge0\x00') syz_emit_ethernet(0x2e, &(0x7f00000008c0)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa008100470008004510001c000000000002907800000000e000000111009078000000013958b2d3bd1fd6404aef203492ffdbb4452811934b6320bb1bd288410de63de8a80d33b0eb3c8f3b2920b4f23d56ebcdeb"], 0x0) syz_emit_ethernet(0x516, &(0x7f0000000240)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x4e0, 0x3a, 0x0, @remote, @mcast2, {[@fragment={0x5e, 0x0, 0x4, 0x0, 0x0, 0x5, 0x65}, @srh={0xc, 0x0, 0x4, 0x0, 0x4, 0x8a21247eaea9afb6, 0x7}, @dstopts={0x2f, 0x21, '\x00', [@ra={0x5, 0x2, 0x3}, @generic={0x0, 0x28, "09b26252d47a9b195017480c919a37bffb8737341fff2e1000ada50b9773cf43424a2bfff9cde2e3"}, @pad1, @generic={0x19, 0xd2, "4ec7bf4ce35ecf26f689e68558439aa1981a3a6f86bcb43058b51f563edca0b78d78d627b02371e02ef5ad45eac1a20e6d0f63d88d356546d28d784d2450a345f66ffda5772dcd2fea55bf09d37c59b8163851b02276b870d25502731c156876285738e498045e1085041cd2c4d103dd1b1071384e00b9e1e99c3a2406f3d6b691bd0955535b59e3c8e08361dd63eb7215e161de4df8f323a4b4af5db1fae5f5e65a6610e89fbd2e55f531297a963486fec49aa3b15254b8dbe2a94a5735d5f305a2f5be06071e02eeda589ce5bdc6863075"}, @pad1]}, @srh={0x3c, 0x8, 0x4, 0x4, 0x8, 0x50, 0x3, [@loopback, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private2={0xfc, 0x2, '\x00', 0x1}]}, @dstopts={0x89, 0x2, '\x00', [@padn={0x1, 0x1, [0x0]}, @ra={0x5, 0x2, 0x2}, @pad1, @jumbo={0xc2, 0x4, 0x7}]}, @routing={0x6, 0x2, 0x1, 0x0, 0x0, [@dev={0xfe, 0x80, '\x00', 0x20}]}, @dstopts={0x67, 0x31, '\x00', [@calipso={0x7, 0x20, {0x0, 0x6, 0x6, 0x6, [0xb, 0x6, 0x1]}}, @generic={0xd, 0x51, "3c1e968f5c1942d75011b47d64efd7f5bced71a0a45d8687a5e2451643306b11ad79c7936b9c16107a2f6f86580b196593c9cd1c6ce0de7004e31c9a602e0580f3e062b21b70a892a7d5666c27c8bede6d"}, @calipso={0x7, 0x20, {0x2, 0x6, 0x1, 0x0, [0x101, 0x5, 0x100000000]}}, @generic={0x8, 0xac, "f47ef18f6c0fe3f4018180989c59548c85103e16e7804d41cc2961a06aacf7dee02d40ea86459ae002f7e53a4d02dc319a27b73f650e94b50c862fbec2623cbd1fa8118f36acb610850fa67b9d164c36d72e7d0a0f61336154560d367e6212faeca4cdae1be20ff1466293d39666aa197fed91fac9ff6a8df5b8e83757c9a1625e5e22b9daf28b9e21336118a5a07a1e19168d5ba2675edfb666c9134646b2cef970cdfd579f3e07fe440420"}, @calipso={0x7, 0x40, {0x0, 0xe, 0x1, 0x96c8, [0x6, 0x4, 0xcf8, 0xfffffffffffff8fd, 0xd, 0x81, 0x6]}}, @enc_lim={0x4, 0x1, 0x5}, @enc_lim={0x4, 0x1, 0x9}]}, @hopopts={0x6c, 0x13, '\x00', [@jumbo={0xc2, 0x4, 0x1}, @jumbo={0xc2, 0x4, 0x6}, @calipso={0x7, 0x38, {0x2, 0xc, 0x1, 0x3ff, [0x400, 0x1, 0xec, 0xe, 0xffffffffffffffff, 0x2]}}, @ra={0x5, 0x2, 0xe44}, @ra={0x5, 0x2, 0x6}, @padn={0x1, 0x2, [0x0, 0x0]}, @padn={0x1, 0x2, [0x0, 0x0]}, @calipso={0x7, 0x38, {0xbb4eee604d6e8067, 0xc, 0xfb, 0x2b3, [0x5, 0xd5b6, 0x10001, 0xf, 0xaee, 0x7]}}, @enc_lim={0x4, 0x1, 0x5}, @jumbo]}, @srh={0x6, 0x4, 0x4, 0x2, 0x0, 0x18, 0x7fff, [@private0={0xfc, 0x0, '\x00', 0x1}, @rand_addr=' \x01\x00']}, @hopopts={0x89, 0x13, '\x00', [@hao={0xc9, 0x10, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @padn={0x1, 0x1, [0x0]}, @calipso={0x7, 0x30, {0x1, 0xa, 0x3, 0x7f, [0x5, 0x6, 0x0, 0x5, 0x7]}}, @calipso={0x7, 0x38, {0x0, 0xc, 0x5, 0x6da, [0x7fffffffffffffff, 0x0, 0x7, 0x80, 0xfffffffffffffff7, 0xd366]}}, @hao={0xc9, 0x10, @ipv4={'\x00', '\xff\xff', @empty}}, @enc_lim, @jumbo={0xc2, 0x4, 0x200}]}], @pkt_toobig={0x2, 0x0, 0x0, 0x5dc, {0x0, 0x6, "8cb02b", 0x0, 0x2f, 0x0, @loopback={0x4000000}, @local, [@srh={0x2b, 0x0, 0x4, 0x0, 0x0, 0x10}]}}}}}}}, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), r1) sendmsg$IPVS_CMD_ZERO(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000000c0)={&(0x7f0000000780)={0x108, r2, 0x1, 0x70bd28, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x2b}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@dev={0xac, 0x14, 0x14, 0x3b}}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'ovf\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x20, 0x7}}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}]}, @IPVS_CMD_ATTR_DEST={0x4c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e22}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@private0}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@dev={0xac, 0x14, 0x14, 0x12}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x400}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xe44}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8000}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x3}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@private0}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x100}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}]}, 0x108}}, 0x20000090) 0s ago: executing program 2 (id=191): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket(0x25, 0x6, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newlink={0x40, 0x10, 0x401, 0x0, 0x2, {0x0, 0x0, 0x0, 0x0, 0xe59bca127d81b0fa, 0xc574450d1af3b5bc}, [@IFLA_ADDRESS={0xa, 0x1, @remote}, @IFLA_IFNAME={0x14, 0x3, 'bridge_slave_0\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x20044010}, 0x20000000) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.29' (ED25519) to the list of known hosts. [ 29.042563][ T24] audit: type=1400 audit(1756377400.660:64): avc: denied { mounton } for pid=267 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 29.043914][ T267] cgroup: Unknown subsys name 'net' [ 29.065358][ T24] audit: type=1400 audit(1756377400.660:65): avc: denied { mount } for pid=267 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.092807][ T24] audit: type=1400 audit(1756377400.690:66): avc: denied { unmount } for pid=267 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.093012][ T267] cgroup: Unknown subsys name 'devices' [ 29.291851][ T267] cgroup: Unknown subsys name 'hugetlb' [ 29.297491][ T267] cgroup: Unknown subsys name 'rlimit' [ 29.498978][ T24] audit: type=1400 audit(1756377401.110:67): avc: denied { setattr } for pid=267 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 29.522184][ T24] audit: type=1400 audit(1756377401.110:68): avc: denied { mounton } for pid=267 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 29.546984][ T24] audit: type=1400 audit(1756377401.110:69): avc: denied { mount } for pid=267 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 29.554527][ T269] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 29.579023][ T24] audit: type=1400 audit(1756377401.190:70): avc: denied { relabelto } for pid=269 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.604531][ T267] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 29.604600][ T24] audit: type=1400 audit(1756377401.190:71): avc: denied { write } for pid=269 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.639238][ T24] audit: type=1400 audit(1756377401.210:72): avc: denied { read } for pid=267 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.664878][ T24] audit: type=1400 audit(1756377401.210:73): avc: denied { open } for pid=267 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.913338][ T275] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.920462][ T275] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.927840][ T275] device bridge_slave_0 entered promiscuous mode [ 30.936316][ T275] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.943456][ T275] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.950878][ T275] device bridge_slave_1 entered promiscuous mode [ 31.011729][ T277] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.018879][ T277] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.026477][ T277] device bridge_slave_0 entered promiscuous mode [ 31.043856][ T278] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.050982][ T278] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.058384][ T278] device bridge_slave_0 entered promiscuous mode [ 31.065396][ T278] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.072568][ T278] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.080220][ T278] device bridge_slave_1 entered promiscuous mode [ 31.091305][ T277] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.098451][ T277] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.105995][ T277] device bridge_slave_1 entered promiscuous mode [ 31.165462][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.172568][ T279] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.180117][ T279] device bridge_slave_0 entered promiscuous mode [ 31.187040][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.194357][ T279] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.201762][ T279] device bridge_slave_1 entered promiscuous mode [ 31.222382][ T276] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.229546][ T276] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.236860][ T276] device bridge_slave_0 entered promiscuous mode [ 31.252194][ T276] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.259262][ T276] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.266679][ T276] device bridge_slave_1 entered promiscuous mode [ 31.339125][ T275] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.346329][ T275] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.382605][ T277] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.389770][ T277] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.397127][ T277] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.404198][ T277] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.416598][ T278] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.423679][ T278] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.431615][ T278] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.438743][ T278] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.461620][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.468679][ T279] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.475990][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.483143][ T279] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.500069][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.507458][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.514747][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.522615][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.529864][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.537269][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.544962][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.552761][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 31.560372][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 31.592771][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 31.601192][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 31.609358][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.616510][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.624321][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 31.633198][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.640300][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.648515][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 31.675840][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 31.683576][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 31.692024][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 31.699957][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 31.708083][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.715249][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.722869][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 31.731084][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.738119][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.745585][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 31.753810][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.760900][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.768275][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 31.776601][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.783691][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.796650][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 31.805086][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.812157][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.819603][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 31.827962][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.835037][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.853147][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 31.861036][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 31.868720][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 31.877614][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 31.886640][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.893707][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.901121][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 31.909033][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 31.917273][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.924324][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.935238][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 31.943529][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 31.965851][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 31.974066][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 31.982227][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 31.991401][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 31.999900][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 32.008019][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 32.016235][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 32.024527][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 32.032679][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 32.040866][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 32.056916][ T275] device veth0_vlan entered promiscuous mode [ 32.072433][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 32.081091][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 32.090339][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 32.098639][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 32.107470][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 32.115513][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 32.123852][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 32.132142][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 32.140257][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 32.148708][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 32.157139][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 32.165225][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 32.173370][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 32.180904][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 32.188303][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 32.195989][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 32.207947][ T276] device veth0_vlan entered promiscuous mode [ 32.218462][ T278] device veth0_vlan entered promiscuous mode [ 32.225081][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 32.233049][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 32.241897][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 32.250160][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 32.258284][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 32.266269][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 32.274329][ T275] device veth1_macvtap entered promiscuous mode [ 32.288416][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 32.296179][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 32.304657][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 32.319952][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 32.328196][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 32.336729][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 32.345255][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 32.353612][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 32.361834][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 32.377412][ T276] device veth1_macvtap entered promiscuous mode [ 32.386011][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 32.393654][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 32.402146][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 32.410922][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 32.419276][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 32.428020][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 32.436435][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 32.444766][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 32.453071][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 32.460933][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 32.468942][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 32.476624][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 32.485090][ T278] device veth1_macvtap entered promiscuous mode [ 32.492284][ T279] device veth0_vlan entered promiscuous mode [ 32.499892][ T277] device veth0_vlan entered promiscuous mode [ 32.512077][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 32.519979][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 32.528418][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 32.548310][ T275] request_module fs-gadgetfs succeeded, but still no fs? [ 32.553894][ T277] device veth1_macvtap entered promiscuous mode [ 32.563957][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 32.572480][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 32.580894][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 32.589149][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 32.598357][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 32.606841][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 32.615564][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 32.624139][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 32.632510][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 32.645444][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 32.654999][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 32.664021][ T275] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 32.678178][ T279] device veth1_macvtap entered promiscuous mode [ 32.731672][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 32.740639][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 32.748934][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 32.756985][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 32.765493][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 32.774299][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 32.782690][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 32.791290][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 32.799732][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 33.074525][ T307] EXT4-fs (loop2): Ignoring removed mblk_io_submit option [ 33.158454][ T307] EXT4-fs (loop2): Quota format mount options ignored when QUOTA feature is enabled [ 33.209583][ T307] EXT4-fs (loop2): Ignoring removed orlov option [ 33.217286][ T309] ====================================================== [ 33.217286][ T309] WARNING: the mand mount option is being deprecated and [ 33.217286][ T309] will be removed in v5.15! [ 33.217286][ T309] ====================================================== [ 33.243239][ T307] EXT4-fs (loop2): Ignoring removed mblk_io_submit option [ 33.243250][ T307] EXT4-fs (loop2): Project quota feature not enabled. Cannot enable project quota enforcement. [ 33.339810][ T296] usb 2-1: new low-speed USB device number 2 using dummy_hcd [ 33.425598][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 33.436799][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 33.460093][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 33.468367][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 33.477233][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 33.485859][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 33.494763][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 33.503445][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 33.512869][ T303] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5'. [ 33.666271][ T336] netlink: 28 bytes leftover after parsing attributes in process `syz.4.11'. [ 33.679749][ T20] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 33.714127][ T347] syz.4.15[347] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 33.714186][ T347] syz.4.15[347] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 33.789907][ T296] usb 2-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 33.838678][ T296] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.959665][ T20] usb 3-1: Using ep0 maxpacket: 16 [ 33.967956][ T296] usb 2-1: config 0 descriptor?? [ 34.560959][ T24] kauditd_printk_skb: 62 callbacks suppressed [ 34.560994][ T24] audit: type=1326 audit(1756377406.160:136): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=357 comm="syz.0.18" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fab46c5cbe9 code=0x7ffc0000 [ 34.597079][ T24] audit: type=1326 audit(1756377406.160:137): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=357 comm="syz.0.18" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fab46c5cbe9 code=0x7ffc0000 [ 34.622339][ T296] asix 2-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 34.633923][ T24] audit: type=1326 audit(1756377406.160:138): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=357 comm="syz.0.18" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fab46c5cbe9 code=0x7ffc0000 [ 34.658524][ T296] asix 2-1:0.0 (unnamed net_device) (uninitialized): Error reading PHYID register: ffffffe0 [ 34.670476][ T24] audit: type=1326 audit(1756377406.160:139): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=357 comm="syz.0.18" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fab46c5cbe9 code=0x7ffc0000 [ 34.696471][ T24] audit: type=1326 audit(1756377406.160:140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=357 comm="syz.0.18" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fab46c5cbe9 code=0x7ffc0000 [ 34.721433][ T296] asix 2-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 34.731750][ T24] audit: type=1326 audit(1756377406.160:141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=357 comm="syz.0.18" exe="/root/syz-executor" sig=0 arch=c000003e syscall=10 compat=0 ip=0x7fab46c5cbe9 code=0x7ffc0000 [ 34.754891][ T24] audit: type=1326 audit(1756377406.160:142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=357 comm="syz.0.18" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fab46c5cbe9 code=0x7ffc0000 [ 34.778238][ T24] audit: type=1326 audit(1756377406.160:143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=357 comm="syz.0.18" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fab46c5cbe9 code=0x7ffc0000 [ 34.879763][ T15] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 34.909885][ T20] usb 3-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 34.919031][ T20] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.927105][ T20] usb 3-1: Product: syz [ 34.931355][ T20] usb 3-1: Manufacturer: syz [ 34.939259][ T20] usb 3-1: SerialNumber: syz [ 34.981971][ T24] audit: type=1400 audit(1756377406.600:144): avc: denied { create } for pid=362 comm="syz.3.19" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 35.084657][ T305] EXT4-fs (loop1): Mount option "nodelalloc" incompatible with ext2 [ 35.085879][ T24] audit: type=1400 audit(1756377406.700:145): avc: denied { read write } for pid=365 comm="syz.0.20" name="vga_arbiter" dev="devtmpfs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 35.279280][ T20] r8152 3-1:1.0: Unknown version 0x0000 [ 35.284958][ T296] asix 2-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 35.289604][ T15] usb 5-1: config 0 has an invalid interface number: 28 but max is 0 [ 35.296563][ T296] asix: probe of 2-1:0.0 failed with error -71 [ 35.306515][ T15] usb 5-1: config 0 has no interface number 0 [ 35.313653][ T296] usb 2-1: USB disconnect, device number 2 [ 35.324633][ T15] usb 5-1: config 0 interface 28 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 35.335746][ T15] usb 5-1: config 0 interface 28 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 35.351305][ T15] usb 5-1: New USB device found, idVendor=046d, idProduct=c534, bcdDevice= 0.00 [ 35.360421][ T15] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 35.649223][ T15] usb 5-1: config 0 descriptor?? [ 36.059354][ T5] usb 3-1: USB disconnect, device number 2 [ 36.303775][ T427] netlink: 12 bytes leftover after parsing attributes in process `syz.2.44'. [ 36.398255][ T447] syz.0.54 uses obsolete (PF_INET,SOCK_PACKET) [ 36.404846][ T15] usbhid 5-1:0.28: can't add hid device: -71 [ 36.411398][ T15] usbhid: probe of 5-1:0.28 failed with error -71 [ 36.420515][ T15] usb 5-1: USB disconnect, device number 2 [ 36.457309][ T455] Zero length message leads to an empty skb [ 36.866567][ T538] netlink: 8 bytes leftover after parsing attributes in process `syz.0.98'. [ 37.663004][ T586] netlink: 36 bytes leftover after parsing attributes in process `syz.3.122'. [ 37.692850][ T592] bridge0: port 3(syz_tun) entered blocking state [ 37.699608][ T592] bridge0: port 3(syz_tun) entered disabled state [ 37.706800][ T592] device syz_tun entered promiscuous mode [ 37.713423][ T592] bridge0: port 3(syz_tun) entered blocking state [ 37.719968][ T592] bridge0: port 3(syz_tun) entered forwarding state [ 37.753049][ T608] netlink: 28 bytes leftover after parsing attributes in process `syz.1.133'. [ 37.770637][ T608] netlink: 28 bytes leftover after parsing attributes in process `syz.1.133'. [ 37.806818][ T621] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 38.125300][ T714] ================================================================== [ 38.133454][ T714] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0x842/0x3280 [ 38.141630][ T714] Read of size 8 at addr ffff888115ded0c0 by task syz.1.186/714 [ 38.149276][ T714] [ 38.151749][ T714] CPU: 1 PID: 714 Comm: syz.1.186 Not tainted 5.10.240-syzkaller #0 [ 38.159737][ T714] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2025 [ 38.169818][ T714] Call Trace: [ 38.173245][ T714] __dump_stack+0x21/0x24 [ 38.177717][ T714] dump_stack_lvl+0x169/0x1d8 [ 38.182402][ T714] ? show_regs_print_info+0x18/0x18 [ 38.187601][ T714] ? thaw_kernel_threads+0x220/0x220 [ 38.192895][ T714] print_address_description+0x7f/0x2c0 [ 38.198442][ T714] ? tc_setup_flow_action+0x842/0x3280 [ 38.203904][ T714] kasan_report+0xe2/0x130 [ 38.208331][ T714] ? flow_action_cookie_create+0x28/0x90 [ 38.213981][ T714] ? tc_setup_flow_action+0x842/0x3280 [ 38.219437][ T714] __asan_report_load8_noabort+0x14/0x20 [ 38.225071][ T714] tc_setup_flow_action+0x842/0x3280 [ 38.230365][ T714] ? __kmalloc+0x1a7/0x330 [ 38.234811][ T714] ? flow_rule_alloc+0x32/0x2c0 [ 38.239672][ T714] mall_replace_hw_filter+0x293/0x810 [ 38.245072][ T714] ? pcpu_block_update_hint_alloc+0x8bc/0xc50 [ 38.251143][ T714] ? mall_set_parms+0x410/0x410 [ 38.256019][ T714] ? tcf_exts_destroy+0xb0/0xb0 [ 38.260868][ T714] ? pcpu_alloc+0xf8a/0x16b0 [ 38.265553][ T714] ? mall_set_parms+0x19d/0x410 [ 38.270420][ T714] mall_change+0x528/0x750 [ 38.274846][ T714] ? __kasan_check_write+0x14/0x20 [ 38.279961][ T714] ? mall_get+0xa0/0xa0 [ 38.284129][ T714] ? tcf_chain_tp_insert_unique+0xac1/0xc10 [ 38.290051][ T714] ? nla_strcmp+0xf4/0x140 [ 38.294481][ T714] tc_new_tfilter+0x13f6/0x1a10 [ 38.298965][ T726] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=726 comm=syz.0.190 [ 38.299477][ T714] ? mall_get+0xa0/0xa0 [ 38.315788][ T714] ? tcf_gate_entry_destructor+0x20/0x20 [ 38.321503][ T714] ? security_capable+0x87/0xb0 [ 38.326363][ T714] ? ns_capable+0x8c/0xf0 [ 38.330698][ T714] ? netlink_net_capable+0x125/0x160 [ 38.335987][ T714] ? tcf_gate_entry_destructor+0x20/0x20 [ 38.341633][ T714] rtnetlink_rcv_msg+0x800/0xb90 [ 38.346742][ T714] ? rtnetlink_bind+0x80/0x80 [ 38.351425][ T714] ? arch_stack_walk+0xee/0x140 [ 38.356277][ T714] ? stack_trace_save+0x98/0xe0 [ 38.361136][ T714] ? stack_trace_snprint+0xf0/0xf0 [ 38.366283][ T714] ? memcpy+0x56/0x70 [ 38.370283][ T714] ? avc_has_perm+0x234/0x360 [ 38.374973][ T714] ? __kasan_slab_alloc+0xbd/0xf0 [ 38.380024][ T714] ? slab_post_alloc_hook+0x5d/0x2f0 [ 38.385444][ T714] ? ___sys_sendmsg+0x1f0/0x260 [ 38.390304][ T714] ? avc_has_perm_noaudit+0x240/0x240 [ 38.395700][ T714] ? selinux_nlmsg_lookup+0x3fb/0x4a0 [ 38.401085][ T714] netlink_rcv_skb+0x1e0/0x430 [ 38.405852][ T714] ? rtnetlink_bind+0x80/0x80 [ 38.410528][ T714] ? netlink_ack+0xb80/0xb80 [ 38.415148][ T714] ? __netlink_lookup+0x387/0x3b0 [ 38.420176][ T714] rtnetlink_rcv+0x1c/0x20 [ 38.424611][ T714] netlink_unicast+0x876/0xa40 [ 38.429388][ T714] netlink_sendmsg+0x88d/0xb30 [ 38.434366][ T714] ? netlink_getsockopt+0x530/0x530 [ 38.439652][ T714] ? security_socket_sendmsg+0x82/0xa0 [ 38.445109][ T714] ? netlink_getsockopt+0x530/0x530 [ 38.450313][ T714] ____sys_sendmsg+0x5a2/0x8c0 [ 38.455075][ T714] ? __sys_sendmsg_sock+0x40/0x40 [ 38.460108][ T714] ? import_iovec+0x7c/0xb0 [ 38.464650][ T714] ___sys_sendmsg+0x1f0/0x260 [ 38.469354][ T714] ? __sys_sendmsg+0x250/0x250 [ 38.474132][ T714] ? __fdget+0x1a1/0x230 [ 38.478433][ T714] __x64_sys_sendmsg+0x1e2/0x2a0 [ 38.483393][ T714] ? ___sys_sendmsg+0x260/0x260 [ 38.488308][ T714] ? switch_fpu_return+0x197/0x340 [ 38.493466][ T714] do_syscall_64+0x31/0x40 [ 38.497915][ T714] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 38.503832][ T714] RIP: 0033:0x7f4c597a8be9 [ 38.508363][ T714] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 38.527972][ T714] RSP: 002b:00007f4c58211038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 38.536477][ T714] RAX: ffffffffffffffda RBX: 00007f4c599cffa0 RCX: 00007f4c597a8be9 [ 38.544453][ T714] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 0000000000000004 [ 38.552440][ T714] RBP: 00007f4c5982be19 R08: 0000000000000000 R09: 0000000000000000 [ 38.560435][ T714] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 38.568521][ T714] R13: 00007f4c599d0038 R14: 00007f4c599cffa0 R15: 00007ffc458d8408 [ 38.576497][ T714] [ 38.578820][ T714] Allocated by task 714: [ 38.583060][ T714] __kasan_kmalloc+0xda/0x110 [ 38.588168][ T714] __kmalloc+0x1a7/0x330 [ 38.592418][ T714] tcf_idr_create+0x5f/0x790 [ 38.597020][ T714] tcf_idr_create_from_flags+0x61/0x70 [ 38.602480][ T714] tcf_gact_init+0x2b4/0x520 [ 38.607609][ T714] tcf_action_init_1+0x3e1/0x670 [ 38.612549][ T714] tcf_action_init+0x1e6/0x700 [ 38.617422][ T714] tcf_exts_validate+0x215/0x510 [ 38.622405][ T714] mall_set_parms+0x4b/0x410 [ 38.627100][ T714] mall_change+0x45c/0x750 [ 38.631530][ T714] tc_new_tfilter+0x13f6/0x1a10 [ 38.636381][ T714] rtnetlink_rcv_msg+0x800/0xb90 [ 38.641322][ T714] netlink_rcv_skb+0x1e0/0x430 [ 38.646089][ T714] rtnetlink_rcv+0x1c/0x20 [ 38.650504][ T714] netlink_unicast+0x876/0xa40 [ 38.655304][ T714] netlink_sendmsg+0x88d/0xb30 [ 38.660083][ T714] ____sys_sendmsg+0x5a2/0x8c0 [ 38.664856][ T714] ___sys_sendmsg+0x1f0/0x260 [ 38.669540][ T714] __x64_sys_sendmsg+0x1e2/0x2a0 [ 38.674485][ T714] do_syscall_64+0x31/0x40 [ 38.678907][ T714] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 38.684785][ T714] [ 38.687109][ T714] The buggy address belongs to the object at ffff888115ded000 [ 38.687109][ T714] which belongs to the cache kmalloc-192 of size 192 [ 38.701380][ T714] The buggy address is located 0 bytes to the right of [ 38.701380][ T714] 192-byte region [ffff888115ded000, ffff888115ded0c0) [ 38.714997][ T714] The buggy address belongs to the page: [ 38.720649][ T714] page:ffffea0004577b40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115ded [ 38.730918][ T714] flags: 0x4000000000000200(slab) [ 38.735962][ T714] raw: 4000000000000200 ffffea0004577a40 0000000500000005 ffff888100043380 [ 38.744544][ T714] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 38.753132][ T714] page dumped because: kasan: bad access detected [ 38.759541][ T714] page_owner tracks the page as allocated [ 38.765367][ T714] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 106, ts 6646246094, free_ts 0 [ 38.780484][ T714] prep_new_page+0x179/0x180 [ 38.785084][ T714] get_page_from_freelist+0x2235/0x23d0 [ 38.790811][ T714] __alloc_pages_nodemask+0x268/0x5f0 [ 38.796224][ T714] new_slab+0x84/0x3f0 [ 38.800293][ T714] ___slab_alloc+0x2a6/0x450 [ 38.804881][ T714] __slab_alloc+0x63/0xa0 [ 38.809207][ T714] kmem_cache_alloc_trace+0x1b3/0x2e0 [ 38.814587][ T714] kernfs_fop_open+0x343/0xb30 [ 38.819352][ T714] do_dentry_open+0x793/0x1090 [ 38.824199][ T714] vfs_open+0x73/0x80 [ 38.828386][ T714] path_openat+0x27ad/0x3160 [ 38.832988][ T714] do_filp_open+0x1b3/0x3e0 [ 38.837492][ T714] do_sys_openat2+0x14c/0x6d0 [ 38.842171][ T714] __x64_sys_openat+0x136/0x160 [ 38.847176][ T714] do_syscall_64+0x31/0x40 [ 38.851629][ T714] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 38.857509][ T714] page_owner free stack trace missing [ 38.862875][ T714] [ 38.865194][ T714] Memory state around the buggy address: [ 38.870828][ T714] ffff888115decf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 38.878993][ T714] ffff888115ded000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 38.887222][ T714] >ffff888115ded080: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 38.895365][ T714] ^ [ 38.901537][ T714] ffff888115ded100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 38.909635][ T714] ffff888115ded180: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 38.917843][ T714] ================================================================== [ 38.925909][ T714] Disabling lock debugging due to kernel taint [ 38.936281][ T722] bridge0: port 3(syz_tun) entered blocking state Aug 28 10:36:50 [ 38.943443][ T722] bridge0: port 3(syz_tun) entered disabled state syzkaller kern.alert kernel: [ [ 38.952682][ T722] device syz_tun entered promiscuous mode 38.759541][ T7[ 38.959805][ T722] bridge0: port 3(syz_tun) entered blocking state 14] page_owner t[ 38.967497][ T722] bridge0: port 3(syz_tun) entered forwarding state racks the page as allocated Aug 28 10:36:50 syzkaller kern.alert kernel: [ 38.765367][ T714] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 106, ts 6646246094, free_ts 0 Aug 28 10:36:50 syzkaller kern.alert kernel: [ 38.857509][ T714] page_owner free stack trace missing