last executing test programs: 2.576146145s ago: executing program 0 (id=1): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001540)={0x24, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="00220f00000003a8407a730b93bf0280b3"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000002140), 0x0, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r2, 0x40184810, 0x0) ioctl$HIDIOCGREPORT(r1, 0x400c4807, &(0x7f00000000c0)={0x3}) 1.871818576s ago: executing program 1 (id=2): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001400)={'batadv0\x00', 0x0}) sendto$packet(r0, &(0x7f00000000c0)="feffffffffffffff000000008100", 0xe, 0x8001, &(0x7f0000000300)={0x11, 0x10, r2, 0x1, 0xfd, 0x6, @random="7295f3d401b2"}, 0x14) 1.489803966s ago: executing program 1 (id=3): r0 = fanotify_init(0x0, 0x0) r1 = epoll_create1(0x0) r2 = fcntl$dupfd(r0, 0x0, r1) fanotify_mark(r2, 0x21, 0x8000012, r2, 0x0) fanotify_mark(r0, 0x22, 0x40000038, r2, 0x0) 1.37060198s ago: executing program 1 (id=4): setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x4000000000000, 0x40, &(0x7f0000000180)=@raw={'raw\x00', 0x4001, 0x3, 0x240, 0xd0, 0xb, 0x148, 0x0, 0x148, 0x1a8, 0x242, 0x240, 0x1a8, 0x215, 0x3, 0x0, {[{{@ip={@broadcast, @remote, 0x0, 0x0, 'ip6gretap0\x00', 'veth0\x00'}, 0x0, 0x70, 0xd0, 0x0, {0xff0f000000000000}}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x0, 0x0, 0x6]}}}}, {{@uncond, 0xec010000, 0x70, 0xd8}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'syz1\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2a0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0x3, &(0x7f0000004240)=0x40000006, 0x4) recvmmsg(r0, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f00000000c0)=ANY=[], 0x8) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) 766.100948ms ago: executing program 1 (id=5): r0 = socket(0x2a, 0x2, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x38, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r1, {0xffe0}, {}, {0x5, 0xffe0}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) 573.770803ms ago: executing program 1 (id=6): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="034886dd010000000000140000006000000001002f00fe88a43de1a400000000000000007d01ff0200000000000000000000000000010000883e"], 0xfdef) 379.756479ms ago: executing program 1 (id=7): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x40, 0x40, 0x4, [@const={0x0, 0x0, 0x0, 0x2, 0x4}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x4}}, @func_proto={0x2, 0x0, 0x0, 0x4, 0x2}, @var={0x2, 0x0, 0x0, 0x11}]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) uname(0x0) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r2 = socket$can_j1939(0x1d, 0x2, 0x7) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000140)={'vxcan1\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000300)={0x1d, r4, 0x0, {0x0, 0xff, 0x2}, 0x2}, 0x18) sendmsg$can_j1939(r2, &(0x7f0000000180)={&(0x7f0000000040), 0x18, &(0x7f0000000100)={&(0x7f00000000c0)="d45dac54b098953bd2", 0x9}}, 0x0) dup3(r3, r2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000280)=@ipv6_newnexthop={0x28, 0x68, 0x1, 0x0, 0x0, {}, [@NHA_OIF={0x8, 0x5, r5}, @NHA_ENCAP_TYPE={0x6}]}, 0x28}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000400)={'gretap0\x00', &(0x7f0000000340)={'gretap0\x00', 0x0, 0x7800, 0x700, 0x0, 0x800, {{0xb, 0x4, 0x1, 0x3f, 0x2c, 0x64, 0x0, 0x1, 0x4, 0x0, @multicast2, @rand_addr=0x64010101, {[@timestamp_addr={0x44, 0x4, 0x6f, 0x1, 0x2}, @noop, @ra={0x94, 0x4, 0x1}, @rr={0x7, 0xf, 0xac, [@private=0xa010100, @loopback, @multicast2]}]}}}}}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x14, 0x0, &(0x7f0000000480)) sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4080801}, 0xc00e) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) 281.859362ms ago: executing program 0 (id=8): r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000}) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000001c0)=0x10) 175.011495ms ago: executing program 0 (id=9): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_DELFLOWTABLE={0x2c, 0x18, 0xa, 0x5, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}]}], {0x14}}, 0x54}}, 0x40040) 98.714348ms ago: executing program 0 (id=10): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=@newlink={0x3c, 0x10, 0x44b, 0x70bd29, 0x0, {0x7a, 0x0, 0x0, 0x0, 0x18}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_TTL_INHERIT={0x5}]}}}]}, 0x3c}}, 0x20004004) 0s ago: executing program 0 (id=11): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000006980c70000000001000000940001000000fcffc50000000f00000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='netlink_extack\x00', r0}, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) bind$packet(r2, &(0x7f0000000180)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @multicast}, 0x14) getsockname$packet(r2, &(0x7f00000015c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="3800000054000147880000000000000007008209", @ANYRES32=r4, @ANYBLOB="20000100", @ANYRES32, @ANYBLOB="00001000e000030000010001000000000000000008"], 0x38}}, 0x0) kernel console output (not intermixed with test programs): [ 48.102882][ T31] audit: type=1400 audit(48.020:68): avc: denied { read write } for pid=3079 comm="sftp-server" name="null" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 48.104267][ T31] audit: type=1400 audit(48.030:69): avc: denied { open } for pid=3079 comm="sftp-server" path="/dev/null" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 Warning: Permanently added '[localhost]:39539' (ED25519) to the list of known hosts. [ 59.606414][ T31] audit: type=1400 audit(59.530:70): avc: denied { name_bind } for pid=3081 comm="sshd" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 61.257576][ T31] audit: type=1400 audit(61.170:71): avc: denied { execute } for pid=3083 comm="sh" name="syz-executor" dev="vda" ino=680 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 61.277970][ T31] audit: type=1400 audit(61.190:72): avc: denied { execute_no_trans } for pid=3083 comm="sh" path="/syz-executor" dev="vda" ino=680 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 65.870266][ T31] audit: type=1400 audit(65.790:73): avc: denied { mounton } for pid=3083 comm="syz-executor" path="/syzcgroup/unified" dev="vda" ino=681 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 65.873567][ T31] audit: type=1400 audit(65.800:74): avc: denied { mount } for pid=3083 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 65.888311][ T3083] cgroup: Unknown subsys name 'net' [ 65.898248][ T31] audit: type=1400 audit(65.820:75): avc: denied { unmount } for pid=3083 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 66.100732][ T3083] cgroup: Unknown subsys name 'cpuset' [ 66.108599][ T3083] cgroup: Unknown subsys name 'hugetlb' [ 66.109556][ T3083] cgroup: Unknown subsys name 'rlimit' [ 66.331448][ T31] audit: type=1400 audit(66.250:76): avc: denied { setattr } for pid=3083 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=693 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 66.333646][ T31] audit: type=1400 audit(66.260:77): avc: denied { mounton } for pid=3083 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 66.334664][ T31] audit: type=1400 audit(66.260:78): avc: denied { mount } for pid=3083 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 66.585902][ T3085] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 66.588002][ T31] audit: type=1400 audit(66.510:79): avc: denied { relabelto } for pid=3085 comm="mkswap" name="swap-file" dev="vda" ino=684 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 66.591400][ T31] audit: type=1400 audit(66.510:80): avc: denied { write } for pid=3085 comm="mkswap" path="/swap-file" dev="vda" ino=684 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 66.624080][ T31] audit: type=1400 audit(66.550:81): avc: denied { read } for pid=3083 comm="syz-executor" name="swap-file" dev="vda" ino=684 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 66.624743][ T31] audit: type=1400 audit(66.550:82): avc: denied { open } for pid=3083 comm="syz-executor" path="/swap-file" dev="vda" ino=684 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 74.372657][ T3083] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 76.310700][ T31] audit: type=1400 audit(76.230:83): avc: denied { execmem } for pid=3086 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 76.380789][ T31] audit: type=1400 audit(76.300:84): avc: denied { read } for pid=3088 comm="syz-executor" dev="nsfs" ino=4026531840 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 76.385937][ T31] audit: type=1400 audit(76.310:85): avc: denied { open } for pid=3088 comm="syz-executor" path="net:[4026531840]" dev="nsfs" ino=4026531840 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 76.391277][ T31] audit: type=1400 audit(76.310:86): avc: denied { mounton } for pid=3088 comm="syz-executor" path="/" dev="vda" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 76.416621][ T31] audit: type=1400 audit(76.340:87): avc: denied { module_request } for pid=3089 comm="syz-executor" kmod="netdev-nr1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 76.417639][ T31] audit: type=1400 audit(76.340:88): avc: denied { module_request } for pid=3088 comm="syz-executor" kmod="netdev-nr0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 76.535635][ T31] audit: type=1400 audit(76.460:89): avc: denied { sys_module } for pid=3088 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 77.427826][ T31] audit: type=1400 audit(77.350:90): avc: denied { ioctl } for pid=3089 comm="syz-executor" path="/dev/net/tun" dev="devtmpfs" ino=677 ioctlcmd=0x54ca scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 78.625074][ T3088] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.628948][ T3088] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.891317][ T3089] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.901119][ T3089] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.637588][ T3088] hsr_slave_0: entered promiscuous mode [ 79.641180][ T3088] hsr_slave_1: entered promiscuous mode [ 79.998390][ T3089] hsr_slave_0: entered promiscuous mode [ 80.001395][ T3089] hsr_slave_1: entered promiscuous mode [ 80.006373][ T3089] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 80.006980][ T3089] Cannot create hsr debugfs directory [ 80.126285][ T31] audit: type=1400 audit(80.050:91): avc: denied { create } for pid=3088 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 80.127296][ T31] audit: type=1400 audit(80.050:92): avc: denied { write } for pid=3088 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 80.135722][ T3088] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 80.149708][ T3088] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 80.159123][ T3088] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 80.170555][ T3088] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 80.409809][ T3089] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 80.429245][ T3089] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 80.439572][ T3089] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 80.447771][ T3089] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 80.786463][ T3088] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.324451][ T3089] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.030326][ T3088] veth0_vlan: entered promiscuous mode [ 84.056813][ T3088] veth1_vlan: entered promiscuous mode [ 84.129419][ T3088] veth0_macvtap: entered promiscuous mode [ 84.140924][ T3088] veth1_macvtap: entered promiscuous mode [ 84.211252][ T3088] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.218207][ T3088] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.218711][ T3088] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.219250][ T3088] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.421254][ T31] kauditd_printk_skb: 1 callbacks suppressed [ 84.421371][ T31] audit: type=1400 audit(84.330:94): avc: denied { mount } for pid=3088 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 84.433246][ T31] audit: type=1400 audit(84.350:95): avc: denied { mounton } for pid=3088 comm="syz-executor" path="/syzkaller.wiVQqq/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 84.436622][ T31] audit: type=1400 audit(84.360:96): avc: denied { mount } for pid=3088 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 84.452607][ T31] audit: type=1400 audit(84.360:97): avc: denied { mounton } for pid=3088 comm="syz-executor" path="/syzkaller.wiVQqq/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 84.453596][ T31] audit: type=1400 audit(84.370:98): avc: denied { mounton } for pid=3088 comm="syz-executor" path="/syzkaller.wiVQqq/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=1876 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 84.458667][ T31] audit: type=1400 audit(84.380:99): avc: denied { unmount } for pid=3088 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 84.473939][ T31] audit: type=1400 audit(84.390:100): avc: denied { mounton } for pid=3088 comm="syz-executor" path="/dev/binderfs" dev="devtmpfs" ino=765 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 84.474546][ T31] audit: type=1400 audit(84.390:101): avc: denied { mount } for pid=3088 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 84.475058][ T31] audit: type=1400 audit(84.390:102): avc: denied { mounton } for pid=3088 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 84.475537][ T31] audit: type=1400 audit(84.390:103): avc: denied { mount } for pid=3088 comm="syz-executor" name="/" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 84.535899][ T3088] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 84.957822][ T3089] veth0_vlan: entered promiscuous mode [ 84.976055][ T3089] veth1_vlan: entered promiscuous mode [ 84.983043][ T47] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 85.039172][ T3089] veth0_macvtap: entered promiscuous mode [ 85.048466][ T3089] veth1_macvtap: entered promiscuous mode [ 85.096130][ T3089] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.096669][ T3089] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.097023][ T3089] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.097386][ T3089] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.138203][ T47] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 85.138931][ T47] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 85.139384][ T47] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 85.140013][ T47] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 85.140367][ T47] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 85.153429][ T47] usb 1-1: config 0 descriptor?? [ 85.642378][ T47] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 85.649343][ T47] plantronics 0003:047F:FFFF.0001: No inputs registered, leaving [ 85.683788][ T47] plantronics 0003:047F:FFFF.0001: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 86.557303][ T3791] Zero length message leads to an empty skb [ 86.654082][ T3794] syz.1.6 uses obsolete (PF_INET,SOCK_PACKET) [ 86.945408][ T3805] capability: warning: `syz.0.8' uses deprecated v2 capabilities in a way that may be insecure [ 87.376879][ T3800] ------------[ cut here ]------------ [ 87.377519][ T3800] WARNING: CPU: 1 PID: 3800 at lib/refcount.c:28 refcount_warn_saturate+0x13c/0x174 [ 87.378836][ T3800] refcount_t: underflow; use-after-free. [ 87.379363][ T3800] Modules linked in: [ 87.380158][ T3800] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 87.381692][ T3800] CPU: 1 UID: 0 PID: 3800 Comm: syz.1.7 Not tainted 6.12.0-rc6-syzkaller #0 [ 87.382774][ T3800] Hardware name: ARM-Versatile Express [ 87.383629][ T3800] Call trace: [ 87.384378][ T3800] [<8199c7b8>] (dump_backtrace) from [<8199c8b4>] (show_stack+0x18/0x1c) [ 87.385276][ T3800] r7:00000000 r6:82622f44 r5:00000000 r4:8203db2c [ 87.385731][ T3800] [<8199c89c>] (show_stack) from [<819bad50>] (dump_stack_lvl+0x54/0x7c) [ 87.386253][ T3800] [<819bacfc>] (dump_stack_lvl) from [<819bad90>] (dump_stack+0x18/0x1c) [ 87.386779][ T3800] r5:00000000 r4:82870d18 [ 87.387070][ T3800] [<819bad78>] (dump_stack) from [<8199d3e0>] (panic+0x120/0x374) [ 87.387609][ T3800] [<8199d2c0>] (panic) from [<80242118>] (get_taint+0x0/0x1c) [ 87.388132][ T3800] r3:8260c5c4 r2:00000001 r1:82025f00 r0:8202d968 [ 87.388570][ T3800] r7:80840670 [ 87.388834][ T3800] [<802420a4>] (check_panic_on_warn) from [<8024227c>] (__warn+0x80/0x188) [ 87.389311][ T3800] [<802421fc>] (__warn) from [<8024256c>] (warn_slowpath_fmt+0x1e8/0x1f4) [ 87.389790][ T3800] r8:00000009 r7:8208c328 r6:dfe1dd6c r5:83728000 r4:00000000 [ 87.390146][ T3800] [<80242388>] (warn_slowpath_fmt) from [<80840670>] (refcount_warn_saturate+0x13c/0x174) [ 87.390794][ T3800] r10:00000166 r9:84a4ba80 r8:0000006c r7:00000000 r6:81829e84 r5:00000002 [ 87.391187][ T3800] r4:84b04cc0 [ 87.391380][ T3800] [<80840534>] (refcount_warn_saturate) from [<8149b940>] (sk_skb_reason_drop+0x1d8/0x248) [ 87.392005][ T3800] [<8149b768>] (sk_skb_reason_drop) from [<81829e84>] (j1939_session_destroy+0x78/0x200) [ 87.392601][ T3800] r9:84a4ba80 r8:0000006c r7:84a4ba84 r6:84b09250 r5:84b09200 r4:84b04cc0 [ 87.393048][ T3800] [<81829e0c>] (j1939_session_destroy) from [<8182b1a0>] (j1939_session_put+0x54/0x58) [ 87.393517][ T3800] r6:84a4ba78 r5:84a4ba78 r4:84a4ba78 [ 87.393948][ T3800] [<8182b14c>] (j1939_session_put) from [<81828260>] (j1939_sk_queue_drop_all+0x7c/0xc4) [ 87.394887][ T3800] [<818281e4>] (j1939_sk_queue_drop_all) from [<818284a0>] (j1939_sk_release+0x1f8/0x200) [ 87.395780][ T3800] r9:83728000 r8:82e9d190 r7:84a4ba74 r6:848bc000 r5:83230f00 r4:84a4b800 [ 87.396279][ T3800] [<818282a8>] (j1939_sk_release) from [<81484f6c>] (__sock_release+0x44/0xbc) [ 87.396831][ T3800] r8:82e9d190 r7:00000000 r6:81c7e7d4 r5:83231000 r4:83230f00 [ 87.397162][ T3800] [<81484f28>] (__sock_release) from [<81484ffc>] (sock_close+0x18/0x20) [ 87.397611][ T3800] r7:83230f80 r6:84c014c8 r5:082e0003 r4:8456cd80 [ 87.398083][ T3800] [<81484fe4>] (sock_close) from [<80518b40>] (__fput+0xdc/0x2e4) [ 87.398553][ T3800] [<80518a64>] (__fput) from [<80518dd0>] (____fput+0x14/0x18) [ 87.399073][ T3800] r9:83728000 r8:82871694 r7:83728000 r6:83728884 r5:83728854 r4:00000000 [ 87.399423][ T3800] [<80518dbc>] (____fput) from [<8026c678>] (task_work_run+0x90/0xb8) [ 87.399921][ T3800] [<8026c5e8>] (task_work_run) from [<8020bde0>] (do_work_pending+0x448/0x4f8) [ 87.400463][ T3800] r9:83728000 r8:8020029c r7:00000166 r6:8020029c r5:dfe1dfb0 r4:83728000 [ 87.400761][ T3800] [<8020b998>] (do_work_pending) from [<80200088>] (slow_work_pending+0xc/0x24) [ 87.401290][ T3800] Exception stack(0xdfe1dfb0 to 0xdfe1dff8) [ 87.401772][ T3800] dfa0: 00000003 00000003 00000000 00000000 [ 87.402607][ T3800] dfc0: 00000000 00000000 002862f0 00000166 00000000 00006364 003d0f00 76b1b0bc [ 87.402979][ T3800] dfe0: 76b1aec0 76b1aeb0 00018b10 00133470 60000010 00000004 [ 87.403339][ T3800] r10:00000166 r9:83728000 r8:8020029c r7:00000166 r6:002862f0 r5:00000000 [ 87.403736][ T3800] r4:00000000 [ 87.407462][ T3800] Rebooting in 86400 seconds.. VM DIAGNOSIS: 10:25:39 Registers: info registers vcpu 0 CPU#0 R00=00000001 R01=00000000 R02=00000000 R03=df801ea0 R04=00000000 R05=82ee8808 R06=ffffacec R07=0000012b R08=df801ea0 R09=dddd1300 R10=dddd10c0 R11=df801f34 R12=00000000 R13=df801e78 R14=814bdb44 R15=814be438 PSR=60000193 -ZC- A S svc32 s00=00000000 s01=00000000 d00=0000000000000000 s02=00000000 s03=00000000 d01=0000000000000000 s04=00000000 s05=00000000 d02=0000000000000000 s06=00000000 s07=00000000 d03=0000000000000000 s08=00000000 s09=00000000 d04=0000000000000000 s10=00000000 s11=00000000 d05=0000000000000000 s12=00000000 s13=00000000 d06=0000000000000000 s14=00000000 s15=00000000 d07=0000000000000000 s16=7eca315d s17=76f056b0 d08=76f056b07eca315d s18=0043031f s19=00000000 d09=000000000043031f s20=00000000 s21=00000000 d10=0000000000000000 s22=00000000 s23=00000000 d11=0000000000000000 s24=00000000 s25=00000000 d12=0000000000000000 s26=00000000 s27=00000000 d13=0000000000000000 s28=00000000 s29=00000000 d14=0000000000000000 s30=00000000 s31=00000000 d15=0000000000000000 s32=00000000 s33=00000000 d16=0000000000000000 s34=00000000 s35=00000000 d17=0000000000000000 s36=00000000 s37=00000000 d18=0000000000000000 s38=00000000 s39=00000000 d19=0000000000000000 s40=00000000 s41=00000000 d20=0000000000000000 s42=00000000 s43=00000000 d21=0000000000000000 s44=00000000 s45=00000000 d22=0000000000000000 s46=00000000 s47=00000000 d23=0000000000000000 s48=00000000 s49=00000000 d24=0000000000000000 s50=00000000 s51=00000000 d25=0000000000000000 s52=00000000 s53=00000000 d26=0000000000000000 s54=00000000 s55=00000000 d27=0000000000000000 s56=00000000 s57=00000000 d28=0000000000000000 s58=00000000 s59=00000000 d29=0000000000000000 s60=00000000 s61=00000000 d30=0000000000000000 s62=00000000 s63=00000000 d31=0000000000000000 FPSCR: 00000000 info registers vcpu 1 CPU#1 R00=00000001 R01=00000000 R02=00000000 R03=0000003c R04=827584d8 R05=00000000 R06=60000093 R07=00000001 R08=00000001 R09=dfe1db88 R10=00000001 R11=dfe1db74 R12=00000020 R13=dfe1daf8 R14=30383354 R15=802bf7a8 PSR=60000093 -ZC- A S svc32 s00=00000000 s01=00000000 d00=0000000000000000 s02=00000000 s03=00000000 d01=0000000000000000 s04=00000000 s05=00000000 d02=0000000000000000 s06=00000000 s07=00000000 d03=0000000000000000 s08=00000000 s09=00000000 d04=0000000000000000 s10=00000000 s11=00000000 d05=0000000000000000 s12=00000000 s13=00000000 d06=0000000000000000 s14=00000000 s15=00000000 d07=0000000000000000 s16=00000000 s17=00000000 d08=0000000000000000 s18=00000000 s19=00000000 d09=0000000000000000 s20=00000000 s21=00000000 d10=0000000000000000 s22=00000000 s23=00000000 d11=0000000000000000 s24=00000000 s25=00000000 d12=0000000000000000 s26=00000000 s27=00000000 d13=0000000000000000 s28=00000000 s29=00000000 d14=0000000000000000 s30=00000000 s31=00000000 d15=0000000000000000 s32=00000000 s33=00000000 d16=0000000000000000 s34=00000000 s35=00000000 d17=0000000000000000 s36=00000000 s37=00000000 d18=0000000000000000 s38=00000000 s39=00000000 d19=0000000000000000 s40=00000000 s41=00000000 d20=0000000000000000 s42=00000000 s43=00000000 d21=0000000000000000 s44=00000000 s45=00000000 d22=0000000000000000 s46=00000000 s47=00000000 d23=0000000000000000 s48=00000000 s49=00000000 d24=0000000000000000 s50=00000000 s51=00000000 d25=0000000000000000 s52=00000000 s53=00000000 d26=0000000000000000 s54=00000000 s55=00000000 d27=0000000000000000 s56=00000000 s57=00000000 d28=0000000000000000 s58=00000000 s59=00000000 d29=0000000000000000 s60=00000000 s61=00000000 d30=0000000000000000 s62=00000000 s63=00000000 d31=0000000000000000 FPSCR: 00000000