last executing test programs: 566.888648ms ago: executing program 3 (id=4): syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f0000000200)='./bus\x00', 0x1400c, &(0x7f0000000040)={[{@test_dummy_encryption}, {@data_journal}, {@norecovery}]}, 0x3, 0x481, &(0x7f00000004c0)="$eJzs3M1vG0UbAPBnN3Hy5m0hoZSvlo9AQVQIkqYt0AMHQCBxKAIJDnC0klCVpgU1QaJVJFIO5YQQEnfEkX+BE1wQ4oTEFe6oUoVyacvJaL27ie04bt3acYt/P8n1zH5k5vHu2M/u2A1gaE1n/yQRuyPij4iYzKvNG0znT1fXV+evra/OJ1GrvfN3Ut/uyvrqfLlpud+uxkoksb9Nu8vnzp+qLi0tni3qsyunP55dPnf+uZOnqycWTyyeOXzs2NEjcy++cPj5W4xwz1v5c1rU33j/6zePf9kUf0scPTLdaeVTtVqPmxusuxrKowPsB90ZKY5XpT7+J2Ok4ehNxuufb1Q+G1AHgb6p1Wq1XduvXqsB/2FJNNcNeRgW5Qd9ef1bPI83JgEv9zUDGazLr+QXQFncV4tHvmZ0445BpeX6tpemI+K9tX++zR7R8T5E0qceAADD5scs/3k2y3ZW57PcYzP/SOP+hu3uLuaGpiLinojYExH3xpnYGxH3RdS3fSAiHuyy/YZJknqaeWV9rCX/SS/ddHA3IMv/XirmtprzvzL7i6mReu1cXolK8sHJpcVDxWtyMCrjWX2uQxs/vfb7V9uta8z/skfWfpkLFv24NDrevM9CdaV68xE3u3whYt9ou/iTjZmALPN8KCL2tfsD6fXbOPnM9w9vt+768XfQg4mm2ncRT+fHfy1a4i8lnecnZ/8XS4uHZsuzYqtff7v49nbt31L8PZAd//+3Pf834p9KGudrl7tv4+KfX2w7tzpdKQpdnP9r1ZXqWPJuvTxWLPu0urJydi5iLDmed7px+eHNfct6uX0W/8ED7cf/nth8JfZHRHYSPxIRj0bEY8WxezwinoiIAx3i/+XVJz9sXTZRxn8bHP+Fro7/ZmEsmpekbbbJCiOnfv6hqdGpzWIR/7XO739H66WDxZIbef/b2ov2hVt9/QAAAOBOkEbE7kjSmY1yms7M5N/h35tPfWc+ObOQ/0ZgKippeadrsuF+6FxxWZ/XL0RE/tWCcv2RSOv3jb8ZmajXZ+Y/WloYaOTArm3Gf+avkUH3Dug7P9iC4WX8w/DqOP4rO9cPYOdtGf8dx/x4X/sC7Kw2n/8Tg+gHsPPa5f/+vx8YDi3j37QfDBH3/2F4Gf8wvIx/GErLE3H9H8lvFCoR0bqq/Es3sPvNFCYjuunh7VOIym3Rjb4VIu17E2P9PbX6VkjuwD5vKQzuPQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKCX/g0AAP//uvzMag==") syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./bus\x00', 0xd01ce0, 0x0, 0x82, 0x0, &(0x7f0000000080)) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x9, 0x4, &(0x7f0000000980)=ANY=[@ANYBLOB="1800835393eeba26c763d1eebc3a0bac000000000000000000000000000071123e000000000095000000000000004c803d5272e95c60684b03915fe81bf532aa8743cc4f73fff9cb6e8d0780ae755fd9c11f7373989675a05cab9567a9bb545c368654dc5a0ef53e414f5f7b2190d49b52586eb65d92b9ff237dcbcad9312b2558d5b52b17dfa7a1b7bcc9f09e5ebeb2119a13d7897b67ad3821facda9ecbfc99c2f0810a03e19a0b68c9f34ad4c3fb854e4c1376d61345c7d93523a121e0fef2bb88a33b0656079373e7c44e2bb47e18ff5ada4cda3278370a3e7ada6d13190f5fefea7bd1f31ea0622e6499fd3f0a87bbb31e237020dcf845325df8278981a55f75a851e9b75bc87be9f773f07d91cb13460"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x80) chdir(&(0x7f00000003c0)='./bus\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x109342, 0x0) pwrite64(r1, &(0x7f0000000300)='2', 0x1, 0x8080c60) fallocate(r1, 0x3, 0x8000c65, 0x8000c62) mknodat(r0, &(0x7f0000000000)='./bus\x00', 0x8000, 0x7) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000000)={'team_slave_0\x00', &(0x7f0000002fc0)=@ethtool_stats={0x21}}) ioctl$sock_inet_SIOCSARP(r1, 0x8955, &(0x7f0000000080)={{0x2, 0x4e20, @remote}, {0x1, @local}, 0x10, {0x2, 0x4e21, @broadcast}, 'erspan0\x00'}) 231.539876ms ago: executing program 1 (id=2): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="6000000009060300f100100000000000050000400900020073797a3100000000050001000700000038000780060004404e21000005000700ff0000000c0001c008000140e00040000c00028008000140e00000020c00148008000140ff"], 0x60}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r3 = syz_usb_connect$hid(0x1, 0x36, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201000000000008700cb6f000000000000109022400010000000009040000010300020009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io(r3, &(0x7f0000000e80)={0x18, &(0x7f0000000400)={0x0, 0x23, 0x8, {0x8, 0x5, "d87252c9544c"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r4 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) r5 = syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x80842) write$evdev(r5, &(0x7f0000000000)=[{{0x0, 0xea60}, 0x0, 0x1, 0x2}], 0xfe72) read(r5, &(0x7f00000000c0)=""/36, 0x24) fcntl$notify(r4, 0x402, 0x8000003d) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) 171.401937ms ago: executing program 0 (id=1): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) pipe(&(0x7f0000000640)) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)={0x6c, r1, 0x1, 0x0, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e26, 0x44, @loopback={0x5f0000000000002d, 0x2e}, 0x7f2a}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0xfffffffc, @mcast2, 0x5}}}}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40}, 0x0) 160.603817ms ago: executing program 2 (id=3): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80102, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r1, 0xae03, 0x42) 113.037758ms ago: executing program 2 (id=6): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, 0x0, 0x8) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r0, &(0x7f00000010c0)=[{{0x0, 0x0, 0x0}, 0x7f}], 0x400015f, 0x4000002b, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) 97.739788ms ago: executing program 0 (id=7): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_io_uring_setup(0x5b5b, &(0x7f0000000040)={0x0, 0xaddb, 0x100, 0x1, 0x16c}, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)) r2 = io_uring_setup(0x3871, &(0x7f0000000680)={0x0, 0x39e5, 0x100, 0x3, 0x3c6}) remap_file_pages(&(0x7f000028f000/0x3000)=nil, 0x3000, 0xc, 0x400, 0x10000) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.current\x00', 0x275a, 0x0) lseek(r3, 0x7fffffffffffffff, 0x300) io_uring_register$IORING_REGISTER_BUFFERS2(r1, 0xf, &(0x7f0000001340)={0x1, 0x0, 0x0, &(0x7f0000001280)=[{0x0}], 0x0}, 0x20) io_uring_register$IORING_REGISTER_CLONE_BUFFERS(r1, 0x1e, &(0x7f0000001380)={r2, 0x2, 0x6, 0x7, 0x7f}, 0x1) close_range(r0, r1, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect$uac1(0x2, 0x72, &(0x7f0000001cc0)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x41e, 0x5, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x60, 0x3, 0x1, 0x2, 0x0, 0x2, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x5, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0x2, 0x81, 0xf8, {0x7, 0x25, 0x1, 0x8, 0x2, 0x3}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x3, 0xf9, 0x81, {0x7, 0x25, 0x1, 0xc, 0x8, 0x200}}}}}}}}]}}, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8810}, 0x8000) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=@newtfilter={0x58, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x9, 0x4}, {}, {0x7, 0x6}}, [@filter_kind_options=@f_basic={{0xa}, {0x28, 0x2, [@TCA_BASIC_EMATCHES={0x24, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x18, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0xceb, 0x7, 0x8001}, {{0x0, 0x0, 0x1, 0x1}, {0x0, 0x0, 0x1}}}}]}]}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r8, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r8, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000240)=@o_path={&(0x7f0000000200)='./file0\x00', 0x0, 0x8, r8}, 0x14) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=@mpls_delroute={0xc4, 0x19, 0x1, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1, 0x100}, [@RTA_OIF={0x8, 0x4, r7}, @RTA_VIA={0x14, 0x12, {0x15, "9bf43efe16f6ea035c80ce859722"}}, @RTA_TTL_PROPAGATE={0x5, 0x1a, 0xff}, @RTA_NEWDST={0x84, 0x13, [{0x28000}, {0x40}, {0x100}, {0xfa5, 0x0, 0x1}, {0x4, 0x0, 0x1}, {0x1000, 0x0, 0x1}, {0x0, 0x0, 0x1}, {0xffff8}, {0x0, 0x0, 0x1}, {0x6, 0x0, 0x1}, {0x80, 0x0, 0x1}, {0x4, 0x0, 0x1}, {0x4}, {0xceb3, 0x0, 0x1}, {}, {0x7}, {0x72b0, 0x0, 0x1}, {0x1e, 0x0, 0x1}, {0x9, 0x0, 0x1}, {0x1}, {0xcde4}, {0x5}, {0x6}, {0x3ff}, {0x80}, {0x24, 0x0, 0x1}, {0x269a}, {0x8, 0x0, 0x1}, {0x8001, 0x0, 0x1}, {0xd, 0x0, 0x1}, {}, {0x916c8, 0x0, 0x1}]}]}, 0xc4}}, 0x0) 3.21426ms ago: executing program 4 (id=5): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000740)=@newlink={0x4c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x215}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6}]}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x4c}, 0x1, 0xba01}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x3, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1206"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x65, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000100)=@bpf_ext={0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41100, 0x50, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1313f, 0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)}, 0x94) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x42000, 0x0) close(r4) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r5, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r4, 0x4010744d, &(0x7f0000000180)) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, 0x0, 0x0) 0s ago: executing program 3 (id=8): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @multicast1}, 0x2, 0x0, 0x0, 0x4}}, 0x2e) ioctl$PPPIOCGL2TPSTATS(r2, 0x80487436, &(0x7f0000000040)) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.225' (ED25519) to the list of known hosts. [ 18.423962][ T30] audit: type=1400 audit(1782720890.487:64): avc: denied { mounton } for pid=277 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 18.425074][ T277] cgroup: Unknown subsys name 'net' [ 18.427178][ T30] audit: type=1400 audit(1782720890.487:65): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 18.431295][ T30] audit: type=1400 audit(1782720890.497:66): avc: denied { unmount } for pid=277 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 18.431486][ T277] cgroup: Unknown subsys name 'devices' [ 18.518959][ T277] cgroup: Unknown subsys name 'hugetlb' [ 18.524534][ T277] cgroup: Unknown subsys name 'rlimit' [ 18.641241][ T30] audit: type=1400 audit(1782720890.707:67): avc: denied { setattr } for pid=277 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 18.664368][ T30] audit: type=1400 audit(1782720890.707:68): avc: denied { mounton } for pid=277 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 18.689067][ T30] audit: type=1400 audit(1782720890.707:69): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 18.694416][ T279] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 18.720898][ T30] audit: type=1400 audit(1782720890.797:70): avc: denied { relabelto } for pid=279 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 18.746368][ T30] audit: type=1400 audit(1782720890.797:71): avc: denied { write } for pid=279 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 18.774513][ T30] audit: type=1400 audit(1782720890.837:72): avc: denied { read } for pid=277 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 18.799997][ T30] audit: type=1400 audit(1782720890.837:73): avc: denied { open } for pid=277 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 18.800105][ T277] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 19.799894][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.806936][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.814303][ T285] device bridge_slave_0 entered promiscuous mode [ 19.821164][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.828213][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.835554][ T285] device bridge_slave_1 entered promiscuous mode [ 19.888975][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.896007][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.903356][ T286] device bridge_slave_0 entered promiscuous mode [ 19.912711][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.919763][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.927101][ T286] device bridge_slave_1 entered promiscuous mode [ 19.970240][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.977260][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.984598][ T289] device bridge_slave_0 entered promiscuous mode [ 19.992788][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.999844][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.007070][ T289] device bridge_slave_1 entered promiscuous mode [ 20.042416][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.049602][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.056952][ T288] device bridge_slave_0 entered promiscuous mode [ 20.068686][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.075706][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.083074][ T287] device bridge_slave_0 entered promiscuous mode [ 20.090003][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.097024][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.104389][ T287] device bridge_slave_1 entered promiscuous mode [ 20.110865][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.117956][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.125170][ T288] device bridge_slave_1 entered promiscuous mode [ 20.182398][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.189446][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.196703][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.203726][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.234895][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.241936][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.249200][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.256209][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.328925][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.337242][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.345651][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.353307][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.360891][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.369722][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 20.377015][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.408924][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.416992][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.424009][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.431575][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.439801][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.446816][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.454231][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.462114][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.470033][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.477865][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.506434][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 20.522442][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.529980][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.537291][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.545574][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.552594][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.560154][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 20.581169][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.588859][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 20.596692][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 20.604220][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 20.612077][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.620132][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.627125][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.634473][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.642536][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.649544][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.656816][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.664728][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.672918][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.679944][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.687220][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.695129][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 20.702693][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 20.712530][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.720709][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.727727][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.736493][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.744670][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.751690][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.760848][ T286] device veth0_vlan entered promiscuous mode [ 20.771513][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 20.790264][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 20.798845][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.806647][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 20.814660][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.822668][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 20.830533][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 20.838429][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 20.846330][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.854280][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 20.861675][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 20.872976][ T286] device veth1_macvtap entered promiscuous mode [ 20.882743][ T285] device veth0_vlan entered promiscuous mode [ 20.890140][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 20.898238][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.906044][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 20.914194][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 20.922385][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 20.930028][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 20.938387][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 20.959954][ T289] device veth0_vlan entered promiscuous mode [ 20.972069][ T287] device veth0_vlan entered promiscuous mode [ 20.978634][ T286] request_module fs-gadgetfs succeeded, but still no fs? [ 20.979343][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 20.994569][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.002896][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.011267][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.019577][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.027939][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.036120][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.043947][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.051849][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.060016][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.068165][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.075902][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.083917][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.091397][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.098817][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.106100][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.118469][ T285] device veth1_macvtap entered promiscuous mode [ 21.132669][ T289] device veth1_macvtap entered promiscuous mode [ 21.140573][ T310] loop3: detected capacity change from 0 to 512 [ 21.147283][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.156853][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.165533][ T310] EXT4-fs (loop3): Test dummy encryption mode enabled [ 21.165682][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.172844][ T310] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 21.181581][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.193738][ T310] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 21.202146][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.219631][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.224971][ T310] EXT4-fs error (device loop3): ext4_orphan_get:1432: comm syz.3.4: bad orphan inode 131072 [ 21.229878][ T287] device veth1_macvtap entered promiscuous mode [ 21.247748][ T310] EXT4-fs (loop3): mounted filesystem without journal. Opts: test_dummy_encryption,data=journal,norecovery,,errors=continue. Quota mode: none. [ 21.248326][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.270824][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.278998][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.286612][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.294966][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.300861][ T310] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 21.303069][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.319134][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.327452][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.334981][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.346462][ T288] device veth0_vlan entered promiscuous mode [ 21.362126][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.370489][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.378916][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.387174][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.396162][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.404498][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.413573][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.421895][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.430383][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.438724][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.479317][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.489318][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.490193][ T317] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 21.498730][ T288] device veth1_macvtap entered promiscuous mode [ 21.530479][ T319] tipc: Started in network mode [ 21.541883][ T319] tipc: Node identity _, cluster identity 4711 [ 21.557597][ T319] tipc: Enabling of bearer rejected, failed to enable media [ 21.593637][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.603037][ T327] mmap: syz.0.7 (327) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 21.607770][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.624019][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.650506][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.658450][ T310] fscrypt: AES-256-XTS using implementation "xts-aes-aesni" [ 21.670744][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.703199][ T332] bridge0: port 3(vlan2) entered blocking state [ 21.710340][ T332] bridge0: port 3(vlan2) entered disabled state [ 21.716996][ T332] device vlan2 entered promiscuous mode [ 21.722935][ T332] bridge0: port 3(vlan2) entered blocking state [ 21.729198][ T332] bridge0: port 3(vlan2) entered forwarding state [ 21.757039][ T333] ================================================================== [ 21.765101][ T333] BUG: KASAN: use-after-free in rcu_segcblist_enqueue+0x9c/0xb0 [ 21.772738][ T333] Write of size 8 at addr ffff88810dffc190 by task syz.3.8/333 [ 21.780273][ T333] [ 21.782594][ T333] CPU: 1 PID: 333 Comm: syz.3.8 Not tainted syzkaller #0 [ 21.789605][ T333] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 21.799653][ T333] Call Trace: [ 21.802922][ T333] [ 21.805841][ T333] __dump_stack+0x21/0x30 [ 21.810165][ T333] dump_stack_lvl+0x110/0x170 [ 21.814835][ T333] ? show_regs_print_info+0x20/0x20 [ 21.820023][ T333] ? load_image+0x3f0/0x3f0 [ 21.824520][ T333] print_address_description+0x7f/0x2c0 [ 21.830060][ T333] ? rcu_segcblist_enqueue+0x9c/0xb0 [ 21.835340][ T333] kasan_report+0x10f/0x150 [ 21.839836][ T333] ? rcu_segcblist_enqueue+0x9c/0xb0 [ 21.845116][ T333] __asan_report_store8_noabort+0x17/0x20 [ 21.850831][ T333] rcu_segcblist_enqueue+0x9c/0xb0 [ 21.855933][ T333] call_rcu+0x549/0xf60 [ 21.857560][ T296] usb 2-1: new low-speed USB device number 2 using dummy_hcd [ 21.860079][ T333] ? rcu_gp_kthread_wake+0x90/0x90 [ 21.860099][ T333] ? __kasan_check_write+0x14/0x20 [ 21.877607][ T333] ? selinux_inode_free_security+0x21f/0x230 [ 21.883586][ T333] ? __wake_up_bit+0x120/0x120 [ 21.888346][ T333] security_inode_free+0xb4/0xd0 [ 21.893267][ T333] __destroy_inode+0x175/0x4f0 [ 21.898011][ T333] evict+0x769/0x8b0 [ 21.901888][ T333] ? proc_nr_inodes+0x310/0x310 [ 21.906716][ T333] ? _raw_spin_lock+0x94/0xf0 [ 21.911371][ T333] ? _raw_spin_trylock_bh+0x150/0x150 [ 21.916724][ T333] ? __kasan_check_write+0x14/0x20 [ 21.921815][ T333] iput+0x651/0x7e0 [ 21.925603][ T333] dentry_unlink_inode+0x338/0x3e0 [ 21.930692][ T333] __dentry_kill+0x45b/0x660 [ 21.935260][ T333] dentry_kill+0xc0/0x2a0 [ 21.939566][ T333] dput+0x47/0x90 [ 21.943181][ T333] __fput+0x5c7/0x900 [ 21.947141][ T333] ____fput+0x15/0x20 [ 21.951099][ T333] task_work_run+0x127/0x190 [ 21.955668][ T333] exit_to_user_mode_loop+0xd0/0xe0 [ 21.960846][ T333] exit_to_user_mode_prepare+0x87/0xd0 [ 21.966281][ T333] syscall_exit_to_user_mode+0x1a/0x30 [ 21.971718][ T333] do_syscall_64+0x58/0xa0 [ 21.976118][ T333] ? clear_bhb_loop+0x50/0xa0 [ 21.980773][ T333] ? clear_bhb_loop+0x50/0xa0 [ 21.985428][ T333] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 21.991300][ T333] RIP: 0033:0x7feed8f08e59 [ 21.995698][ T333] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 22.015278][ T333] RSP: 002b:00007ffec16bf7d8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 22.023673][ T333] RAX: 0000000000000000 RBX: 00007ffec16bf8c0 RCX: 00007feed8f08e59 [ 22.031623][ T333] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 22.039573][ T333] RBP: 00000000000054e6 R08: 0000000000000001 R09: 0000000000000000 [ 22.047522][ T333] R10: 0000001b2db20000 R11: 0000000000000246 R12: 00007ffec16bf900 [ 22.055476][ T333] R13: 00007feed9181fac R14: 000000000000551d R15: 00007feed9181fa0 [ 22.063436][ T333] [ 22.066435][ T333] [ 22.068737][ T333] Allocated by task 334: [ 22.072948][ T333] __kasan_kmalloc+0xd4/0x100 [ 22.077603][ T333] __kmalloc+0x13d/0x2c0 [ 22.081823][ T333] l2tp_session_create+0x39/0xb60 [ 22.086826][ T333] pppol2tp_connect+0xbf5/0x1640 [ 22.091740][ T333] __sys_connect+0x3cb/0x450 [ 22.096309][ T333] __x64_sys_connect+0x7a/0x90 [ 22.101050][ T333] x64_sys_call+0x7c/0x9a0 [ 22.105446][ T333] do_syscall_64+0x4c/0xa0 [ 22.109845][ T333] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 22.115716][ T333] [ 22.118017][ T333] Freed by task 43: [ 22.121796][ T333] kasan_set_track+0x4a/0x70 [ 22.126369][ T333] kasan_set_free_info+0x23/0x40 [ 22.131297][ T333] ____kasan_slab_free+0x125/0x160 [ 22.136395][ T333] __kasan_slab_free+0x11/0x20 [ 22.141139][ T333] slab_free_freelist_hook+0xc2/0x190 [ 22.146491][ T333] kfree+0xc4/0x270 [ 22.150278][ T333] l2tp_session_put+0xaf/0x1a0 [ 22.155020][ T333] l2tp_session_delete+0x3a9/0x4a0 [ 22.160110][ T333] l2tp_tunnel_del_work+0x180/0x3d0 [ 22.165287][ T333] process_one_work+0x6c8/0xbb0 [ 22.170116][ T333] worker_thread+0xaa0/0x1250 [ 22.174773][ T333] kthread+0x3f5/0x4f0 [ 22.178821][ T333] ret_from_fork+0x1f/0x30 [ 22.183217][ T333] [ 22.185533][ T333] Last potentially related work creation: [ 22.191223][ T333] kasan_save_stack+0x3a/0x60 [ 22.195881][ T333] __kasan_record_aux_stack+0xd2/0x100 [ 22.201321][ T333] kasan_record_aux_stack_noalloc+0xb/0x10 [ 22.207113][ T333] call_rcu+0x10b/0xf60 [ 22.211257][ T333] pppol2tp_release+0x1e3/0x2b0 [ 22.216093][ T333] sock_close+0xb8/0x200 [ 22.220316][ T333] __fput+0x22b/0x900 [ 22.224280][ T333] ____fput+0x15/0x20 [ 22.228237][ T333] task_work_run+0x127/0x190 [ 22.232805][ T333] exit_to_user_mode_loop+0xd0/0xe0 [ 22.237983][ T333] exit_to_user_mode_prepare+0x87/0xd0 [ 22.243421][ T333] syscall_exit_to_user_mode+0x1a/0x30 [ 22.248864][ T333] do_syscall_64+0x58/0xa0 [ 22.253259][ T333] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 22.259133][ T333] [ 22.261439][ T333] The buggy address belongs to the object at ffff88810dffc000 [ 22.261439][ T333] which belongs to the cache kmalloc-512 of size 512 [ 22.275479][ T333] The buggy address is located 400 bytes inside of [ 22.275479][ T333] 512-byte region [ffff88810dffc000, ffff88810dffc200) [ 22.288729][ T333] The buggy address belongs to the page: [ 22.294344][ T333] page:ffffea000437ff00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10dffc [ 22.304561][ T333] head:ffffea000437ff00 order:2 compound_mapcount:0 compound_pincount:0 [ 22.312863][ T333] flags: 0x4000000000010200(slab|head|zone=1) [ 22.318913][ T333] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100042f00 [ 22.327480][ T333] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 22.336034][ T333] page dumped because: kasan: bad access detected [ 22.342418][ T333] page_owner tracks the page as allocated [ 22.348111][ T333] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 102, ts 3343955046, free_ts 0 [ 22.366145][ T333] post_alloc_hook+0x192/0x1b0 [ 22.370892][ T333] prep_new_page+0x1c/0x110 [ 22.375373][ T333] get_page_from_freelist+0x2c3a/0x2cd0 [ 22.380897][ T333] __alloc_pages+0x1a2/0x460 [ 22.385470][ T333] new_slab+0xa0/0x4d0 [ 22.389516][ T333] ___slab_alloc+0x3ac/0x840 [ 22.394085][ T333] __slab_alloc+0x49/0x90 [ 22.398390][ T333] __kmalloc_track_caller+0x169/0x2c0 [ 22.403741][ T333] __alloc_skb+0x210/0x730 [ 22.408135][ T333] alloc_uevent_skb+0x85/0x240 [ 22.412877][ T333] kobject_uevent_net_broadcast+0x335/0x5a0 [ 22.418745][ T333] kobject_uevent_env+0x52b/0x700 [ 22.423747][ T333] kobject_synth_uevent+0x457/0x940 [ 22.428922][ T333] uevent_store+0x4b/0x70 [ 22.433225][ T333] drv_attr_store+0x79/0xa0 [ 22.437705][ T333] sysfs_kf_write+0x129/0x150 [ 22.442362][ T333] page_owner free stack trace missing [ 22.447702][ T333] [ 22.450004][ T333] Memory state around the buggy address: [ 22.455609][ T333] ffff88810dffc080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.463645][ T333] ffff88810dffc100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.471682][ T333] >ffff88810dffc180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.479713][ T333] ^ [ 22.484276][ T333] ffff88810dffc200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.492309][ T333] ffff88810dffc280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 22.500343][ T333] ================================================================== [ 22.508376][ T333] Disabling lock debugging due to kernel taint [ 22.583069][ T324] syz.2.6 (324) used greatest stack depth: 21216 bytes left [ 22.597632][ T307] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 22.828121][ T296] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 72, setting to 8 [ 22.838806][ T296] usb 2-1: New USB device found, idVendor=0c70, idProduct=f0b6, bcdDevice= 0.00 [ 22.847869][ T296] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 22.856679][ T296] usb 2-1: config 0 descriptor?? [ 22.877597][ T317] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 23.027602][ T307] usb 1-1: unable to get BOS descriptor or descriptor too short [ 23.067609][ T307] usb 1-1: not running at top speed; connect to a high speed hub [ 23.348623][ T296] hid-generic 0003:0C70:F0B6.0001: unknown main item tag 0x7 [ 23.356494][ T296] hid-generic 0003:0C70:F0B6.0001: hidraw0: USB HID v0.00 Device [HID 0c70:f0b6] on usb-dummy_hcd.1-1/input0 [ 23.367597][ T307] usb 1-1: New USB device found, idVendor=041e, idProduct=0005, bcdDevice= 0.40 [ 23.377064][ T307] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 23.385081][ T307] usb 1-1: Product: syz [ 23.389257][ T307] usb 1-1: Manufacturer: syz [ 23.393835][ T307] usb 1-1: SerialNumber: syz [ 23.555613][ T30] kauditd_printk_skb: 63 callbacks suppressed [ 23.555626][ T30] audit: type=1400 audit(1782720895.617:137): avc: denied { read write } for pid=316 comm="syz.1.2" name="event1" dev="devtmpfs" ino=257 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 23.585253][ T296] usb 2-1: USB disconnect, device number 2 [ 23.589322][ T30] audit: type=1400 audit(1782720895.617:138): avc: denied { open } for pid=316 comm="syz.1.2" path="/dev/input/event1" dev="devtmpfs" ino=257 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 24.869802][ T307] usb 1-1: USB disconnect, device number 2 [ 25.077879][ T338] udevd[338]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.1/sound/card0/controlC0/../uevent} for writing: No such file or directory