last executing test programs: 7.891488077s ago: executing program 1 (id=19): syz_open_dev$usbfs(0x0, 0x77, 0x101301) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) close(r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000500)) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) write$cgroup_devices(r2, &(0x7f0000000280)=ANY=[@ANYBLOB="1e030600bc5cb60128876360864666702c1ffe80000000000000", @ANYRESDEC], 0xffdd) 7.269463659s ago: executing program 1 (id=20): r0 = gettid() futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x256c, 0x6d, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) futex(&(0x7f000000cffc), 0x1, 0x0, 0x0, 0x0, 0x0) 5.890447146s ago: executing program 1 (id=21): r0 = openat$sequencer(0xffffff9c, &(0x7f00000006c0), 0x60000, 0x0) ioctl$SNDCTL_SEQ_GETINCOUNT(r0, 0x80045105, &(0x7f0000000700)) 5.770977769s ago: executing program 1 (id=22): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@empty, @in6=@remote, 0x0, 0x400, 0x0, 0x4, 0x2, 0x20}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000}, {}, 0x0, 0x0, 0x0, 0x1}, {{@in=@broadcast, 0x0, 0x6c}, 0x0, @in=@local, 0x0, 0x0, 0x0, 0xfc, 0x0, 0x1e02}}, 0xe8) listen(r0, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000080)={@local, @broadcast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @empty, @empty}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0) 5.680985537s ago: executing program 1 (id=23): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000000c0)="e4e32dd2b696733552eca3e954943a18709f72fbd259a936c67ebe806ab21823f4a0c47bff45323c2b30982dfc67b46cc9a5a07c33fc", 0xff6d}, {&(0x7f0000000100)="3a10bd003aba0c7026336b", 0xb}], 0x2, &(0x7f0000000740)=ANY=[@ANYBLOB="300000000000000017e2ffff010000001800000045f43a7ce45002bdb85e47ab3e39597e422ffab456dd963a00000000180000000000000017010000040000000602000000400000180000000000000017010000030000000100000000000079240809000000ac87448793609bd8299d6dfc465829b711ce28eb8f568438917ebd0699be96bd1485f6aaa8486e00000000e301f2e09aebda6eeb1c61f96b6d3f91c0f8c1ffbb85cfdd5b8b437a3720ba4cdfb681516c3a240207b6bbdfb37747cc7411886fdba55bcbfa68226644556e8117f9f9fc5be3b7095b2ab7c19b0c6fada03a7f9b9172f0cc960ee263e82e3232edea82b9736d65309e0ad2922ecbb7cde9ce78555fabb941d114e83b37255d6b43b2927696e4f4cf3b23086021fe4e33d049de5318ef3803ceacddc02734c96a9765486a9bf8d65791b000000000000000000000000000000000000000009d97cea3f950d55b265e480ff02c27bda4848c64ca7dcbcd060b9c0dea483c6069d2cdc473cfacc9052cc2c9e3ee037042fd329173c5e7c9ef8800a51332df5a08602a72a553035711cb9159757303a5e7d389786df44441dc82a9d32c56db8a8b3578cd0faabfa23fb46e22b45a464e35315d8c2dd3fae8b530cf8eb0d8dcb682772bed766be5208e61eab965c6c9a217a4e13f0085626c0408f381205251c18a8f6a44"], 0x60}], 0x1, 0x8001) recvmmsg(r1, &(0x7f0000001440)=[{{0x0, 0x0, &(0x7f0000000940)=[{&(0x7f00000001c0)=""/156, 0x9c}], 0x1}}], 0x1, 0x0, 0x0) 4.420331811s ago: executing program 1 (id=24): r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x7f) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) close(r0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) execveat(r0, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x0) 1.760416827s ago: executing program 0 (id=33): socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r0 = openat$sequencer(0xffffff9c, &(0x7f00000000c0), 0x40, 0x0) ioctl$SNDCTL_FM_4OP_ENABLE(r0, 0x4004510f, &(0x7f0000000280)=0x7) 1.580104793s ago: executing program 0 (id=34): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000740)=ANY=[@ANYBLOB="50000000100003040000000000000000f2000000", @ANYRES32=0x0, @ANYBLOB="00000000000000002800128009000100766c616e000000001800028006000100010000000c000200540a00001800000008000500", @ANYRES32=r2], 0x50}, 0x1, 0xba01}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, 0x0, 0x80) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480d0000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) 970.135421ms ago: executing program 0 (id=35): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_NEW(r0, 0x0, 0x0) sendmsg$NFNL_MSG_ACCT_DEL(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)={0x20, 0x3, 0x7, 0x301, 0x0, 0x0, {}, [@NFACCT_NAME={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x0) 819.82709ms ago: executing program 0 (id=36): r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$unix(0x1, 0x2, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0x44, r1, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@void, @val={0x8}, @val={0xc, 0x99, {0x7ff, 0x70}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'syzkaller0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}]}, 0x44}, 0x1, 0x0, 0x0, 0x81}, 0x24044884) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) socket$inet_sctp(0x2, 0x1, 0x84) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) 100.43029ms ago: executing program 0 (id=37): listen(0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r0 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r0, &(0x7f0000000000)={0x28, 0x0, 0x0, @local}, 0x10) 0s ago: executing program 0 (id=38): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = io_uring_setup(0x3eae, &(0x7f0000000080)) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000080)={&(0x7f0000c15000/0x1000)=nil, &(0x7f0000508000/0x4000)=nil, 0x1000}) kernel console output (not intermixed with test programs): [ 50.872547][ T31] audit: type=1400 audit(50.780:68): avc: denied { read write } for pid=3106 comm="sftp-server" name="null" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 50.875404][ T31] audit: type=1400 audit(50.790:69): avc: denied { open } for pid=3106 comm="sftp-server" path="/dev/null" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 Warning: Permanently added '[localhost]:55944' (ED25519) to the list of known hosts. [ 61.384874][ T31] audit: type=1400 audit(61.300:70): avc: denied { name_bind } for pid=3107 comm="sshd" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 62.933935][ T31] audit: type=1400 audit(62.840:71): avc: denied { execute } for pid=3109 comm="sh" name="syz-executor" dev="vda" ino=680 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 62.955741][ T31] audit: type=1400 audit(62.870:72): avc: denied { execute_no_trans } for pid=3109 comm="sh" path="/syz-executor" dev="vda" ino=680 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 66.618167][ T31] audit: type=1400 audit(66.530:73): avc: denied { mounton } for pid=3109 comm="syz-executor" path="/syzcgroup/unified" dev="vda" ino=681 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 66.622034][ T31] audit: type=1400 audit(66.530:74): avc: denied { mount } for pid=3109 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 66.638820][ T3109] cgroup: Unknown subsys name 'net' [ 66.647301][ T31] audit: type=1400 audit(66.560:75): avc: denied { unmount } for pid=3109 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 66.869783][ T3109] cgroup: Unknown subsys name 'cpuset' [ 66.876460][ T3109] cgroup: Unknown subsys name 'hugetlb' [ 66.877446][ T3109] cgroup: Unknown subsys name 'rlimit' [ 67.126821][ T31] audit: type=1400 audit(67.040:76): avc: denied { setattr } for pid=3109 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=707 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 67.129586][ T31] audit: type=1400 audit(67.040:77): avc: denied { mounton } for pid=3109 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 67.131435][ T31] audit: type=1400 audit(67.040:78): avc: denied { mount } for pid=3109 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 67.286360][ T3111] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 67.287598][ T31] audit: type=1400 audit(67.200:79): avc: denied { relabelto } for pid=3111 comm="mkswap" name="swap-file" dev="vda" ino=684 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 67.290129][ T31] audit: type=1400 audit(67.200:80): avc: denied { write } for pid=3111 comm="mkswap" path="/swap-file" dev="vda" ino=684 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 67.314658][ T31] audit: type=1400 audit(67.230:81): avc: denied { read } for pid=3109 comm="syz-executor" name="swap-file" dev="vda" ino=684 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 67.323123][ T31] audit: type=1400 audit(67.230:82): avc: denied { open } for pid=3109 comm="syz-executor" path="/swap-file" dev="vda" ino=684 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 73.627508][ T3109] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 75.573680][ T31] audit: type=1400 audit(75.490:83): avc: denied { execmem } for pid=3112 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 75.636662][ T31] audit: type=1400 audit(75.550:84): avc: denied { read } for pid=3114 comm="syz-executor" dev="nsfs" ino=4026531840 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 75.638376][ T31] audit: type=1400 audit(75.550:85): avc: denied { open } for pid=3114 comm="syz-executor" path="net:[4026531840]" dev="nsfs" ino=4026531840 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 75.647365][ T31] audit: type=1400 audit(75.560:86): avc: denied { mounton } for pid=3114 comm="syz-executor" path="/" dev="vda" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 75.673606][ T31] audit: type=1400 audit(75.580:88): avc: denied { module_request } for pid=3115 comm="syz-executor" kmod="netdev-nr1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 75.675852][ T31] audit: type=1400 audit(75.580:87): avc: denied { module_request } for pid=3114 comm="syz-executor" kmod="netdev-nr0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 75.755692][ T31] audit: type=1400 audit(75.670:89): avc: denied { sys_module } for pid=3115 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 76.475715][ T31] audit: type=1400 audit(76.380:90): avc: denied { ioctl } for pid=3114 comm="syz-executor" path="/dev/net/tun" dev="devtmpfs" ino=691 ioctlcmd=0x54ca scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 77.688164][ T3114] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.692156][ T3114] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.947697][ T3115] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.957522][ T3115] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.709757][ T3114] hsr_slave_0: entered promiscuous mode [ 78.714369][ T3114] hsr_slave_1: entered promiscuous mode [ 78.829828][ T3115] hsr_slave_0: entered promiscuous mode [ 78.832485][ T3115] hsr_slave_1: entered promiscuous mode [ 78.835538][ T3115] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 78.835979][ T3115] Cannot create hsr debugfs directory [ 79.258328][ T31] audit: type=1400 audit(79.170:91): avc: denied { create } for pid=3114 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 79.260494][ T31] audit: type=1400 audit(79.170:92): avc: denied { write } for pid=3114 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 79.268462][ T3114] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 79.281515][ T3114] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 79.290257][ T3114] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 79.297915][ T3114] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 79.382447][ T3115] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 79.391543][ T3115] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 79.401380][ T3115] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 79.416818][ T3115] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 79.995611][ T3114] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.202154][ T3115] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.190503][ T3114] veth0_vlan: entered promiscuous mode [ 83.225893][ T3114] veth1_vlan: entered promiscuous mode [ 83.290759][ T3114] veth0_macvtap: entered promiscuous mode [ 83.305210][ T3114] veth1_macvtap: entered promiscuous mode [ 83.362004][ T3114] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.363838][ T3114] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.364282][ T3114] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.364609][ T3114] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.511386][ T31] kauditd_printk_skb: 1 callbacks suppressed [ 83.511444][ T31] audit: type=1400 audit(83.420:94): avc: denied { mount } for pid=3114 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 83.530766][ T31] audit: type=1400 audit(83.440:95): avc: denied { mounton } for pid=3114 comm="syz-executor" path="/syzkaller.Uqjm98/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 83.536027][ T31] audit: type=1400 audit(83.450:96): avc: denied { mount } for pid=3114 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 83.540550][ T31] audit: type=1400 audit(83.450:97): avc: denied { mounton } for pid=3114 comm="syz-executor" path="/syzkaller.Uqjm98/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 83.549916][ T31] audit: type=1400 audit(83.460:98): avc: denied { mounton } for pid=3114 comm="syz-executor" path="/syzkaller.Uqjm98/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=2118 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 83.571862][ T31] audit: type=1400 audit(83.480:99): avc: denied { unmount } for pid=3114 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 83.580680][ T31] audit: type=1400 audit(83.490:100): avc: denied { mounton } for pid=3114 comm="syz-executor" path="/dev/binderfs" dev="devtmpfs" ino=779 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 83.582380][ T31] audit: type=1400 audit(83.490:101): avc: denied { mount } for pid=3114 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 83.587348][ T31] audit: type=1400 audit(83.500:102): avc: denied { mounton } for pid=3114 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 83.588748][ T31] audit: type=1400 audit(83.500:103): avc: denied { mount } for pid=3114 comm="syz-executor" name="/" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 83.598056][ T3115] veth0_vlan: entered promiscuous mode [ 83.618545][ T3115] veth1_vlan: entered promiscuous mode [ 83.665401][ T3115] veth0_macvtap: entered promiscuous mode [ 83.670357][ T3115] veth1_macvtap: entered promiscuous mode [ 83.670362][ T3114] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 83.705615][ T3115] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.705879][ T3115] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.706072][ T3115] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.706281][ T3115] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.114843][ T105] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 84.293424][ T105] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 84.294024][ T105] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 84.294618][ T105] usb 1-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 84.294999][ T105] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 84.306049][ T105] usb 1-1: config 0 descriptor?? [ 84.542111][ T8] usb 1-1: USB disconnect, device number 2 [ 92.008052][ T3824] netlink: 172 bytes leftover after parsing attributes in process `syz.1.6'. [ 92.139703][ T31] kauditd_printk_skb: 18 callbacks suppressed [ 92.139787][ T31] audit: type=1400 audit(92.050:122): avc: denied { prog_run } for pid=3825 comm="syz.1.7" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 93.353143][ T31] audit: type=1400 audit(93.260:123): avc: denied { append } for pid=3833 comm="syz.1.11" name="audio" dev="devtmpfs" ino=733 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 94.783822][ T31] audit: type=1400 audit(94.690:124): avc: denied { bind } for pid=3837 comm="syz.0.13" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 94.815126][ T31] audit: type=1400 audit(94.720:125): avc: denied { write } for pid=3837 comm="syz.0.13" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 95.120772][ T31] audit: type=1400 audit(95.030:126): avc: denied { create } for pid=3839 comm="syz.0.14" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 95.155221][ T31] audit: type=1400 audit(95.070:127): avc: denied { create } for pid=3839 comm="syz.0.14" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 95.191562][ T31] audit: type=1400 audit(95.100:128): avc: denied { bind } for pid=3839 comm="syz.0.14" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 95.219602][ T31] audit: type=1400 audit(95.120:129): avc: denied { listen } for pid=3839 comm="syz.0.14" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 95.263388][ T31] audit: type=1400 audit(95.160:130): avc: denied { connect } for pid=3839 comm="syz.0.14" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 95.288463][ T31] audit: type=1400 audit(95.190:131): avc: denied { setopt } for pid=3839 comm="syz.0.14" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 97.153623][ T31] kauditd_printk_skb: 2 callbacks suppressed [ 97.155938][ T31] audit: type=1400 audit(97.060:134): avc: denied { map_create } for pid=3848 comm="syz.1.18" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 97.183537][ T31] audit: type=1400 audit(97.080:135): avc: denied { map_read map_write } for pid=3848 comm="syz.1.18" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 97.676304][ T3851] syzkaller0: entered promiscuous mode [ 97.676935][ T3851] syzkaller0: entered allmulticast mode [ 97.697975][ T31] audit: type=1400 audit(97.610:136): avc: denied { relabelfrom } for pid=3850 comm="syz.1.19" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 97.700486][ T31] audit: type=1400 audit(97.610:137): avc: denied { relabelto } for pid=3850 comm="syz.1.19" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 98.983309][ T8] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 99.155550][ T8] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 99.156181][ T8] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 99.156649][ T8] usb 2-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 99.156951][ T8] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 99.161957][ T8] usb 2-1: config 0 descriptor?? [ 99.306218][ T31] audit: type=1400 audit(99.220:138): avc: denied { map } for pid=3841 comm="syz.0.15" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=2228 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 99.307909][ T31] audit: type=1400 audit(99.220:139): avc: denied { read write } for pid=3841 comm="syz.0.15" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=2228 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 99.395066][ T8] usbhid 2-1:0.0: can't add hid device: -71 [ 99.395904][ T8] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 99.411734][ T8] usb 2-1: USB disconnect, device number 2 [ 99.592119][ T31] audit: type=1400 audit(99.500:140): avc: denied { name_bind } for pid=3878 comm="syz.1.22" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 99.599113][ T31] audit: type=1400 audit(99.500:141): avc: denied { node_bind } for pid=3878 comm="syz.1.22" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 99.687289][ T31] audit: type=1400 audit(99.600:142): avc: denied { create } for pid=3880 comm="syz.1.23" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 99.692014][ T31] audit: type=1400 audit(99.600:143): avc: denied { bind } for pid=3880 comm="syz.1.23" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 102.077604][ T3901] capability: warning: `syz.0.26' uses 32-bit capabilities (legacy support in use) [ 102.837557][ T31] kauditd_printk_skb: 3 callbacks suppressed [ 102.837670][ T31] audit: type=1400 audit(102.750:147): avc: denied { create } for pid=3918 comm="syz.0.32" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dccp_socket permissive=1 [ 103.244778][ T31] audit: type=1400 audit(103.160:148): avc: denied { execute } for pid=3896 comm="syz.1.24" name="file1" dev="tmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 103.246695][ T3923] process 'syz.1.24' launched '/dev/fd/3/./file1' with NULL argv: empty string added [ 103.248860][ T31] audit: type=1400 audit(103.160:149): avc: denied { execute_no_trans } for pid=3896 comm="syz.1.24" path="/file1" dev="tmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 103.818235][ T31] audit: type=1400 audit(103.730:150): avc: denied { ioctl } for pid=3928 comm="syz.0.34" path="socket:[3301]" dev="sockfs" ino=3301 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 104.280460][ T3929] netlink: 'syz.0.34': attribute type 10 has an invalid length. [ 104.433020][ C1] hrtimer: interrupt took 436944 ns [ 104.904929][ T31] audit: type=1400 audit(104.810:151): avc: denied { ioctl } for pid=3934 comm="syz.0.36" path="socket:[3313]" dev="sockfs" ino=3313 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 105.395700][ T31] audit: type=1400 audit(105.310:152): avc: denied { ioctl } for pid=3942 comm="syz.0.38" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=3327 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 105.859851][ T3943] ------------[ cut here ]------------ [ 105.861209][ T3943] WARNING: CPU: 0 PID: 3943 at mm/highmem.c:622 kunmap_local_indexed+0x20c/0x224 [ 105.867159][ T3943] Modules linked in: [ 105.868937][ T3943] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 105.872292][ T3943] CPU: 0 UID: 0 PID: 3943 Comm: syz.0.38 Not tainted 6.12.0-rc2-syzkaller #0 [ 105.874476][ T3943] Hardware name: ARM-Versatile Express [ 105.875334][ T3943] Call trace: [ 105.875909][ T3943] [<81998e58>] (dump_backtrace) from [<81998f54>] (show_stack+0x18/0x1c) [ 105.876732][ T3943] r7:00000000 r6:826228c4 r5:00000000 r4:8203d394 [ 105.877203][ T3943] [<81998f3c>] (show_stack) from [<819b73e4>] (dump_stack_lvl+0x54/0x7c) [ 105.878474][ T3943] [<819b7390>] (dump_stack_lvl) from [<819b7424>] (dump_stack+0x18/0x1c) [ 105.879099][ T3943] r5:00000000 r4:82870d18 [ 105.879534][ T3943] [<819b740c>] (dump_stack) from [<81999a80>] (panic+0x120/0x374) [ 105.879977][ T3943] [<81999960>] (panic) from [<802420e0>] (get_taint+0x0/0x1c) [ 105.880460][ T3943] r3:8260c5c4 r2:00000001 r1:82025774 r0:8202d1dc [ 105.880842][ T3943] r7:8048c684 [ 105.881072][ T3943] [<8024206c>] (check_panic_on_warn) from [<80242244>] (__warn+0x80/0x188) [ 105.882834][ T3943] [<802421c4>] (__warn) from [<802424c4>] (warn_slowpath_fmt+0x178/0x1f4) [ 105.883691][ T3943] r8:00000009 r7:82054dd8 r6:dfa1dd24 r5:841f8000 r4:00000000 [ 105.884180][ T3943] [<80242350>] (warn_slowpath_fmt) from [<8048c684>] (kunmap_local_indexed+0x20c/0x224) [ 105.884763][ T3943] r10:ffefd0a8 r9:83eb2700 r8:20508000 r7:fffffffe r6:00000003 r5:841f8000 [ 105.885254][ T3943] r4:ffefd000 [ 105.885505][ T3943] [<8048c478>] (kunmap_local_indexed) from [<80505ab8>] (move_pages+0x7e8/0x149c) [ 105.886031][ T3943] r7:fffffffe r6:00000000 r5:85013810 r4:ffefb840 [ 105.886419][ T3943] [<805052d0>] (move_pages) from [<80581ce0>] (userfaultfd_ioctl+0x114c/0x2080) [ 105.886932][ T3943] r10:83eb2700 r9:dfa1de98 r8:00000001 r7:20c16000 r6:00000000 r5:20000080 [ 105.887398][ T3943] r4:85011000 [ 105.887602][ T3943] [<80580b94>] (userfaultfd_ioctl) from [<8052f6c4>] (sys_ioctl+0x134/0xda8) [ 105.888136][ T3943] r10:841f8000 r9:850a2b40 r8:00000003 r7:20000080 r6:850a2b41 r5:00000000 [ 105.888515][ T3943] r4:c028aa05 [ 105.888715][ T3943] [<8052f590>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c) [ 105.889246][ T3943] Exception stack(0xdfa1dfa8 to 0xdfa1dff0) [ 105.889765][ T3943] dfa0: 00000000 00000000 00000003 c028aa05 20000080 00000000 [ 105.890292][ T3943] dfc0: 00000000 00000000 002862f0 00000036 00000000 00006364 003d0f00 76b470bc [ 105.890657][ T3943] dfe0: 76b46ec0 76b46eb0 00018af8 00132ec0 [ 105.890981][ T3943] r10:00000036 r9:841f8000 r8:8020029c r7:00000036 r6:002862f0 r5:00000000 [ 105.891451][ T3943] r4:00000000 [ 105.893504][ T3943] Rebooting in 86400 seconds.. VM DIAGNOSIS: 18:00:31 Registers: info registers vcpu 0 CPU#0 R00=821dee1c R01=8203d394 R02=0000192f R03=00000004 R04=841f8000 R05=824bcdc0 R06=841f8000 R07=8260c5d0 R08=8286094c R09=841f8000 R10=5b914000 R11=df801eec R12=df801ef0 R13=df801ed8 R14=802dac18 R15=819b8a00 PSR=60000193 -ZC- A S svc32 s00=00000000 s01=00000000 d00=0000000000000000 s02=00000000 s03=00000000 d01=0000000000000000 s04=00000000 s05=00000000 d02=0000000000000000 s06=00000000 s07=00000000 d03=0000000000000000 s08=00000000 s09=00000000 d04=0000000000000000 s10=00000000 s11=00000000 d05=0000000000000000 s12=00000000 s13=00000000 d06=0000000000000000 s14=00000000 s15=00000000 d07=0000000000000000 s16=00000000 s17=00000000 d08=0000000000000000 s18=00000000 s19=00000000 d09=0000000000000000 s20=00000000 s21=00000000 d10=0000000000000000 s22=00000000 s23=00000000 d11=0000000000000000 s24=00000000 s25=00000000 d12=0000000000000000 s26=00000000 s27=00000000 d13=0000000000000000 s28=00000000 s29=00000000 d14=0000000000000000 s30=00000000 s31=00000000 d15=0000000000000000 s32=00000000 s33=00000000 d16=0000000000000000 s34=00000000 s35=00000000 d17=0000000000000000 s36=00000000 s37=00000000 d18=0000000000000000 s38=00000000 s39=00000000 d19=0000000000000000 s40=00000000 s41=00000000 d20=0000000000000000 s42=00000000 s43=00000000 d21=0000000000000000 s44=00000000 s45=00000000 d22=0000000000000000 s46=00000000 s47=00000000 d23=0000000000000000 s48=00000000 s49=00000000 d24=0000000000000000 s50=00000000 s51=00000000 d25=0000000000000000 s52=00000000 s53=00000000 d26=0000000000000000 s54=00000000 s55=00000000 d27=0000000000000000 s56=00000000 s57=00000000 d28=0000000000000000 s58=00000000 s59=00000000 d29=0000000000000000 s60=00000000 s61=00000000 d30=0000000000000000 s62=00000000 s63=00000000 d31=0000000000000000 FPSCR: 00000000 info registers vcpu 1 CPU#1 R00=00000000 R01=00000000 R02=00000a10 R03=00000000 R04=ffedc000 R05=836b1800 R06=00000001 R07=00cbe4d0 R08=ffedce36 R09=00000068 R10=00000e36 R11=ec545dc4 R12=ec545d98 R13=ec545da8 R14=8048c548 R15=8048c59c PSR=60000013 -ZC- A S svc32 s00=00000000 s01=00000000 d00=0000000000000000 s02=00000000 s03=00000000 d01=0000000000000000 s04=00000000 s05=00000000 d02=0000000000000000 s06=00000000 s07=00000000 d03=0000000000000000 s08=00000000 s09=00000000 d04=0000000000000000 s10=00000000 s11=00000000 d05=0000000000000000 s12=00000000 s13=00000000 d06=0000000000000000 s14=00000000 s15=00000000 d07=0000000000000000 s16=00000000 s17=00000000 d08=0000000000000000 s18=00000000 s19=00000000 d09=0000000000000000 s20=00000000 s21=00000000 d10=0000000000000000 s22=00000000 s23=00000000 d11=0000000000000000 s24=00000000 s25=00000000 d12=0000000000000000 s26=00000000 s27=00000000 d13=0000000000000000 s28=00000000 s29=00000000 d14=0000000000000000 s30=00000000 s31=00000000 d15=0000000000000000 s32=00000000 s33=00000000 d16=0000000000000000 s34=00000000 s35=00000000 d17=0000000000000000 s36=00000000 s37=00000000 d18=0000000000000000 s38=00000000 s39=00000000 d19=0000000000000000 s40=00000000 s41=00000000 d20=0000000000000000 s42=00000000 s43=00000000 d21=0000000000000000 s44=00000000 s45=00000000 d22=0000000000000000 s46=00000000 s47=00000000 d23=0000000000000000 s48=00000000 s49=00000000 d24=0000000000000000 s50=00000000 s51=00000000 d25=0000000000000000 s52=00000000 s53=00000000 d26=0000000000000000 s54=00000000 s55=00000000 d27=0000000000000000 s56=00000000 s57=00000000 d28=0000000000000000 s58=00000000 s59=00000000 d29=0000000000000000 s60=00000000 s61=00000000 d30=0000000000000000 s62=00000000 s63=00000000 d31=0000000000000000 FPSCR: 00000000