last executing test programs: 437.322179ms ago: executing program 3 (id=4): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x51) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x81899, 0x0) chdir(&(0x7f0000000200)='./file0/file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0/../file0\x00', &(0x7f0000000000)='sysfs\x00', 0x1214040, 0x0) mknod(&(0x7f0000000040)='./file0/../file0\x00', 0x1, 0x12) 422.24103ms ago: executing program 4 (id=5): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_X2APIC_API(r1, 0x4068aea3, &(0x7f0000000080)={0x81, 0x0, 0x3}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SIGNAL_MSI(r1, 0x4020aea5, &(0x7f0000000000)={0x38003, 0x20f000, 0x2, 0x0, 0x7}) 421.19994ms ago: executing program 0 (id=1): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x24000045, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='reno', 0x4) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc3400000000001090224"], 0x0) sendto$inet6(r0, &(0x7f0000000380)="b3", 0x1, 0x20060000, 0x0, 0x0) 299.521512ms ago: executing program 3 (id=6): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/62, 0x328000, 0x800, 0x9, 0x3}, 0x20) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f0000000200)=0x100000, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00', 0x0}) bind$xdp(r1, &(0x7f0000000100)={0x2c, 0x1, r2}, 0x10) 168.723836ms ago: executing program 3 (id=7): r0 = epoll_create1(0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) pselect6(0x40, &(0x7f0000000040)={0x9, 0xffffffff00000000, 0xbec, 0x3, 0x920, 0x3ff, 0x100000001, 0x1}, 0x0, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000100)={0x8}) shutdown(r1, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000000140)={0x2000200b, 0x700}) 168.598056ms ago: executing program 1 (id=2): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x80487436, 0x0) 132.568067ms ago: executing program 32 (id=7): r0 = epoll_create1(0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) pselect6(0x40, &(0x7f0000000040)={0x9, 0xffffffff00000000, 0xbec, 0x3, 0x920, 0x3ff, 0x100000001, 0x1}, 0x0, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000100)={0x8}) shutdown(r1, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000000140)={0x2000200b, 0x700}) 130.556536ms ago: executing program 1 (id=9): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x14b040, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, &(0x7f0000000040)={0x0, 0x0, "d607f8f9951e76c13f64323723e7eecdf40c362023eb3d259266ec9c37865c6c1a4640ce1b1d34c09f39c3539e4f8d3ee0878ae95bc7f52363c468b257ff3e24852548deb01efd54f11ed2c41d078b9cf1fc8f72566153c97e4af37017ea6b16b694bb4a6e4606c3fb19d1d2bd3c8c4e97da2213f9d5c3b90400000000000000c279f03558083906666827d61dcc3a633bffff250b5a294ce72c5e341c7535c9a0d39225720a170e7f5670e419dc44febf7ddc73fd4a5a0b6c28665f7f46c7084e17c809268103a2584ab40a68e528329d97afc3612e325c1eb4020000006a97444800", "0615e456c196e819a321fdb3690bfab19538829a732a01781564ef7738cb5b82a704b3952f81c68bb4ceeaad63206f88201638e87c4981cbf9332cbc9c4d69e392bd33237ece7ad91e44edac0da8dacad81adf2e08c21ad6b44ce1f90bd618c255ca40cdb411485fb48a51d329c816b3488c7d032ef69c502c6e1236bd381efd410165988847c1dcb98a18ca2b853910e52044fa3b3026cb88de269537c8f26ffc3b15cbf279832bfc90bd95939043182e88050dfd2a4784a5d1453610fb1f1c2bac36c3ecd3e6fb756ef8880debeef3636afd981d8af4ab119928448f90351aec113335eacf52a18c87738d9679d3acc032a16fbefc64776f363610a15b37bcd36e6a7cba931151b9c9ba5779d550e9ab21603a43a25f3b4895d8dc4f3ce0e7d5e964e888169ea79a0848e9338b3d34d62e963fbf98834f4455419907f0ffdb76373af77a34edee7789f56e7f01bdab9614a0d460f791a06e6cf5243bf2b3a1624a80ec7e1116f1c81f5ef4b895be74bf67eea9193428b58a8b62b7976d3d2e59796c46ec918c83cd49c3f43dbd2967586966c19ace7b0bef5f94eb333b362649f1bfa114f8b1f126e97ec672cff77e2130823fa7a1df6760c6a8917815e9f0a409ed32b133df7dc9afceffcd472b35145c83c9167764d25ce214133c6170adeb6653b30b226a3b6ff1363ac862a540c7fab584cd051ce7ee951e0f121d43cff75afbdec6bc6f6e8f7db58c8086751320d22ee8582e915cabc536e3767e9a9230c9ae8b92398f0ca2a7141ea4588af7afde10e5ec2a6fe85ba5712e126629d4e3998fc4721cb638f2ef8356049e3448466e2c400d5e8baf843fa399907cb526b791c5350ce29204cb6fe50b892a69ec6dbecc28f032a745738faa12c2a34222942fef0ec0511da5fe0b565ceac429da7cc25cfe0320b40a514723e2392a6a361032343edb79fd83cd0a354837153542fd61b3156b54c566036e493250c3a3214738e3cacc24a50d5dfd17d5008b4ca629c3062f3417cb69c48b8b888ae51256bb4e6c68e95a71a00383ad9df263f6a775ded64fef20ed5cb5f31c33cb86f839d00a12e40cd31219113619c4e0585454cb1776278bfd7f5c4275792afb790e83ff0fc6925355c7aee7a070477d9ec2292366e39b9dc66f7adcf449a1a718e5217183faf0f679efc5cef20bcdcf2d12ea0684084ec0d693256e280025b23b5a08b7b1ebe7d41fb045793f971d6ee066604818cb09d86c1eda99a44c35476a113fd5d1a7543f8f99424ebb78dd9e00d719502a6eafa743a061fa3fa55e4deaa0a011b6b9d633f10e0c9446b5a2e3f6d6014ab00695366c1a6bf0c32f703aebb7988c7d4d322681458e85626302c70f37628835e1fcfff1da3099c0b4af433eb9a51f9609f2c0c09a98b18880c846b34d6ac0210f073765666100976ee1d928893f983580ea47a012144633b98e02c3e81869534ab985eb3a73e0bac892dac949f85db949285a6a7a490b1075467226af23df82d8dd09b7282490fbb3ada9ed4cae8f761aefbe0701de6b132f12044c58ac1c2607c8f51361de5bed021dea13fd0a440263cf0b304522a324b581ab274e7bdae5994316657b5c0ab0220d9b08739729f7a35d436878c182aec4f08dd161c11ee5b7937fae7835e8bfe98a44c8d4bbb2e0eee0cb5d7c93517e96a9fc8132e60f3ef7c735bea1934b37df451f981c8d9210e61278c871e6dad6ceb89aa4d7245658a63e65cec7b81d307426a60a31cc917844a14e1d9ad83bef1c9f736d1836687c950d1275caece0d46ab9f3b0e95d9cf560eb8134e8346b35e0a6f60e6a87a14c4aeb3e0d06158390660a52a6e44b524c1e16de2bf99870f78fc81d267072bc63e97d3f26d23fd59799ff2c847d6a724cebc2377a582ba73d99a610a095c28d66c60910ac64b7d18847fa98fd8528b72e0a149b082c731575b2e2763e67c821ba29eecd8b8c87981c4fb1fbbaaa4e8aa077ec98de1362fc7af7a0ac5e3297fd0d924124b2e255b5cc4f6b0873f3d34418d5ae0d6f734628f38cb9b856b2db3fbb2fafb76983eabc51a348e55789e997fa25cbe6e5031bd2e33d4e2686f964a65d1abf7f96a20a8b270b1522ace4adf6fdade5cd3f101574960d13267e2382f70027ebe5ef7f9418e14e6a8a130d2aec2253c8fe21825e3295774db0c9b1340ea28a96589ba0d9f79aa61b92aea6f704ef7f716d849b8c77e6922e198a086d8133491d0bb85b925825a6d307d7cc8f09c655aa3edabf84c75560dfb279ee3e8b825323279edc58c3161e72cf9ae02ef80d500da922c0abeb8b164abd9c17ef7c02e89000d67b0c2ddd078cacbf37c4826be3845948d598980d63c1d7aade89d0637d80a4c102a35eb027a08ef90cc20d17fc514926914e68e5de54b861200ffa4ce1cbc16e4ecf342a1176cdb561f7dea38b3ae0fd81260f72d34e6f33d364cf313d3b3161410dcbf5f0f0579a1d235b49bb5d27f85825b94f1899e7846d0292ad912d934574f9d55d2152dbfb39d662e6e0f2496182d012af8b4bebbdfa1d68e3e988869fb5cd9612db97e6cc574444f4b5025ec9827bafc55341bf6ad3fd4fab2ee43f343cb9bcec0c38384b5699e5c6d5973ba591978275c51a40200d340b9ed3681f08c69f58320f538f9cd78a34eb6ed55710d2478ea4bd15813921817b42f88f1bb038033b519668f0a2e8693b9a19c7bcf96eec04bda625b31c32f4286be922ab2c87aa30310c8f46551450d5bc26b5fbfdedaae0f756384023bb9a28d3200cfeaedd63d6afe076513e8ad73d16607cd4ede16344e60d8707357e82b1089258c56d851a435e23ce0919825e04471dd61a44c43e87c2959d4e89311a30ee8be010094d0ef109bb210dda58b21b685b9e9c078c9ded6117d9a88dd7799291969851cd4c3f22b5f870a275a692188dafcf6e89ba87b0eb61011de031fda25fb3349901d40da2bbdb76eda417c9fafd90fb23504ab150ca0033ea1d00000000000086ba3aaa79d0df4f2e4e4afa565e66d28aa167f835d080bf1d41d0e52dbf81c671f8eacae234bf4fc328302671fab46613b73daf2ace80aff2f80f6a9d84b82480178cc612aa90adfc80ab3bba7d1527fc6ab04f009011bf093494a0d329df4e53d855b1c0ff6a25d22052b3a778e1ca2fbe59c9eeedf99e13682d06da269560524ffa0f404b73b946edf900ee958ceba09a051e27a620fb78e7a352c182c8c2981ce822eeaf6323965b4b3f322d40d406a158b6f3cf5d74822de952fefc341d0dead6c1c8fed8e48e0a85b51c1dcc7796d3f45bb1f50467a475da76c356c9e031b096867da1dbb89c3a038d475dbcdb2df1278d5dba55c2fb5ba6a9778c2a244198491f0f711cdb2ef0332f347afffb1b098b4c59041ccb0c286bb2dd40e7ec713f6ffe0b1067678c748615dae3c1e090f3739a9035767fb9972580d19fdef49a5071f99c3706b8fa4991f430721cf3ca11af0e3bd7c4d0cd0ab5b7d98ee66730c20a098110e4a15ce0bfc88c41fe375f261fe3557e14eb5ff4a2cdf6a008fd7b6702951b8456e940fbd269a0f3ed515ac03cfecce67027d579e1226bd7b7381827453550343566508d38790ee838c3bf85c6c91a45e7a44752f57313533a3e82e4042e65d346afb20c0527575f79080aef4e1aa8d5868d190c8d37bdae7592e41bed37b9d4c30d8126d3debde02dff25f5ef1e48133e2a41cd55347bd23dcce57a00189619db629c530dc112d22ac72bce353681264b5175be40b3ba84408d0f56762cc720e96c128447be7128748e185be2640115556bac64d060207e629b0144e501c1c49c6abd15c7982b01e22da2ad04bb28df1a27f31e18040c16406071d798bb40d901d001e22cc5ed870d08702f49f0021814cdd814901a13c7ab061bb4b8172c639b3449e24f656fee58186e69e6874ea95d946da781b49ca080ffb4a3c87746c661f43e9be52d0ba2ee368b9c143687c8846abac599069decf41e69fddcadf31c5f715917df12df4eedbfcc5805fe8e661b8fcd7b130d7bcc4a9a152de93a15dddacf3cf52479956185a3c5000d18ddce0236d5858c0d8761bca7446e3d30f3e8f48d5e8f86a60cbe46f038b1028ffd35590bdacfeebb86e28d42a923bdc3f9a307b919341a2a7dda096d41070db245c2c424aedd4a4bb9863169454d09f25fd0aa2da7bfc97ad7aca886dd998e041133e07899ad48f7cda600de48ac3951152dfbe6331b8acae24cfd2dd2b14696c75040685c756942a0d049ee9863a2e480388f93876f3910ecb3a59fa16c25b2b3636a542f92744495e10a4ce37f19f5c2256e2d61775d388e2a86b52f76add2f956aa02501f5badb94da12595b2bbf88b05dc70caae6766fd3df4f299d0ff71c8787249b255ea49b3d33b3f1a8c9403cb75d64264465c3578538382b23d721f8a49134020ca2d9e887d9949624ac6d63322b6507e277a0020db9bfa2928736b96c72fa3406a95adfe6b374ffa27001d37d3bbe725e75c257834572026c511f57dce67153a4008f9e75e07ed9237f600005800ee667c137fc78bc4fd4ebf4d228979ab0ccafbcd8b8daad76fb2abcfc585377ea6e19f170db898b950a7b0f4e75466a2ba26e7d60e0a6f5c54a3fe78677f3362c5b01ae791b62ee8a5d0fd65b739ece4f3b758d05a8e4e4ea7e4866ee67750ce2769f72a9f45780eadfae73b42d4dd4c614c797c694ece8af88cc732edabfa26ace57de54835c7551154dfa3be11a0d3b5845ac97b2da84410a652e72cd563acbb2b02bb59370cebaaa80014e3ad280944eae6fbf8d5f85237257bb5b8e5ec3e52dc06f8394176b325a577804e9eb78d7015172d17ed15f905f705d56687f53988bb207c74fbeb2b03a700258e835362886239f4d8f1c2cf6d4d10ff26d2579ea40a5fb99e5b6d01cdeda050d3faa78ed674f2899be08332086c8bf0410a7d06099c50a2d949d49a0f21b43bcdfbdf435875cf5a9def46db63746574ee8a5b1fbcef411154e914dd9e5bb1b1bd2944581083fb66a017e7972df3daefc487e4198cb281d3a80637d52b41738b7f1a57c867d5b2ee5d72465657593339506fd0c3807cd6445eb54cfb5ca9d35ef93eec6383224ebf85197eb6ed75f6c324f6a0345a25be6bb52ed347e57ccb059b903fb7db4e9f46513a4158ce29c1f5d6081b556bbc471e89225cad81aed34dae0f90ee8e7237b3b286e29b49d7a1700c537b28571f7d7e2a55e10792d6f7779ddefa3febdea5693048372a45903c04f1035a96c6cfbe6f6c2b754581aac02f8a70e698be6e37fd411cf4b76317b47683f6b0f80dfdeef3a9767c7e5c30dff786093a21477431fea0458023953700"}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x39bc) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x1000002, 0x12, r0, 0xc96c1000) ioctl$ASHMEM_SET_NAME(r0, 0x40087708, &(0x7f0000000c80)='\x00\x00\x03\x01\x00\x00\x00\x1f\x00x\x92\x12\xac\x06^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x02\x00g\x00\x00\x00\x80\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-\xac\x99\xb8\xd2\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc4\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b^:4\xeb\xd37\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\xa9\x96\xf8/0HdO\xb9\xa2\x1d\x13\x8fCha\xb3\x95wl},\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xf6<\xbfB\xe7\x80Z\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\xa0\xa9\x13f=\xbd\x03\xe8\xbex:\xceY\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\x13\xba\x00|g]7\xdc\xe9=\"\xe4\xb3\x0f\xc6\x8f\x85fGGV&\x1d\xa3\xc4\xc3\xd2\xfd\xad\xa35o\xe8\xcd^/\xd8\xf4[n\x9fJ\xf4\n\x92c\xaa\xddT&L<+\x19R\a\xfc\xf2\x17\xb8$\xa9]\xc2\\\xda<\xd0d.w\x9c\xaf4\xbb\xe8Co\xb3\xd8\x82\x92\xba+\x99PXB\xdc\xbay\xa0s<\x92k\vJTRW\xc26\x06\x10\x92\xc7\xa55\x9fZ\xff*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146\'Z\x83H\xabF\x18<\x86h\x01=\x03\\\xc4\t\x8e/\x12\a\xdf\xe7zU\xcc\x02\x0e\xc1?\xeau\xb4\x84\x1b\xdaR-\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&@\x00\x00\x00rT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\xd7c\t(\xf2\x93\x8d\\\x91\xef\xab(Jck\xdf\xa3 \x16\x9bH=\x01\x7f\x02\x1dF3\x7f\xd15\xa8\xd2\x94\xa7\xe9\xbd\xdc\x16\xe1Z\x9c\xe3\xeb9\x8f\xfdC\x0e\xd3]\xb5\xfdB\\\xd2\xfe\xf6H\x8ai}kDM\xbd\xfcJ{T{@i/\xb7x\xef\x1f\xf0t\xf5\xaf\xb21F\x01\xe0\x86\xde\x88\xb8\x8f \xfc\xcd\xba\xea\x16\xc1J\xb7\xe3\x04m\x0e\xaf\xd6X\xba\x8a\xdb\xeda\x83.H\xe3\x86\x03\t\xcb\xdc\x80\xee\x0ec\x12\x8a\x92\x11\xb6\xcc#\x10\xec\xfd\xbb\xd3\\\xc8\x88\x04,\'\x14\xbf\x84\x16\xb3\x8f,6\xc6D\xae\xa1\xf9\xe7@\xac\xaa\x104\x8b\x8eQ8\x11\xa7|\x87\xe2\xccrj%\xc4r&\r\a\xa7\xda\xf5\'V\x89\xe6\xa4\x05\xde\xf5\xaa@\xec\xe2\xf6\xb5x\xa1w\n\xda\xf2\xd67\xc6%\x0f[sF\xb6\xaeS>\xe9^\xd4\xf03\xe9.\xc4\xd5\xe0\r\xa1Q\xa8\xf2\xa2`zs\'k\xd4pV\xab&%\xf8\x8a\x80\x9d\"\xf3\xcc\xd2i\xc8\xd8\xc6\xbeD\xda\x86?\xf9\x13\xe5L`R\xe8Vq\xa3\nD\x9f\xe4M\xe6\xab\xdd!=%\x06z$\x99\';O\xfc\xf0u\x83\v\x83\a8\xfe<\x9e\xa8\xfe\xca`D\x91\x81!QT$\x05T\x85\xd6\xe9!\xb9wfL\x12\xa8\xb0\xb0\x86\xc2\xa1\xf7\x05i\xf5\xf0\r\xe7h\xdaD\xcb\xd4\x87\x84\xe5\xc7r;.\xf0\xed\x17\x83Nn\xb7\x0f!u}J)\xa1\xa1\x16\xc5`Z,\xa3\xcf\xfdy\aH\x06\x14l\x92x\xdbB=\xcc\xcdf\xe5\x04=HQ\xeaE-v\x02\x0eY\x8e\xbf\xec\x16\xc4G\xea\x8bS\x8e\xd5f\xdcj\xe1\x86\xf9s\x90\xe5\xf9\x89\xc0\xf3\xcd;r4j]\x9b\xdf\xf5\xe9\x82\xe1\xdb\x11\xb3\b\xa2Y\xdb\\\xc1H\xc3\xcf\xb1W\xe9(\xee\x18\xca\xda\xf5p,\x16\xbc\x17\xfe\xd8\n\xe1\xa1&=+)\xf9Vd\x11\xf6hX\xbe\x85O=\xe2\x9f~I\xc4\"\xa9\xd9\x19\xa2\\\xb8>f\xe2Jh+u\x90\x13\x94\x12\xc8X\xd7\xb4\xf1JS0FN\xa0\xda\xb6ez`\x9a\xea\xcf^\xa5\x17{\v\xe8n\xe9 \xc0/D\t\x7f\xd8\xad\xf2e\xff\x8b\x16p\x0f\xe4\x1a/\xe1\x96\xd2\xae\x94\x0e5\xb0b+\xac\x14\xaa\xb0\xb7\xa5.\x15\x8a\xca\xb5~=D-\x90\xc1\xbf\x05\xb9\xd5\x86\xeb\xd2#\xda\xc132\'\xfc!%\x94\x1f\xbfL)\xc2c\xa8\xef\x152\x8d\xef\xde\xbe\xab\xf5g\x80\x02G>\xf5\x04a-\xff\x06X+\xc1\xd3\xb1\xcdn\x15p\xdf\xd8.\x89\x95{\xb6+:`\x9c\xcf2\x01\x1d1\xf7\xe6\x7f\x1f\xf5\xb0\xb9\t2\x14\x81\x99\xb8@7y\xb4\xce\xf1]\a\x03y\xc5F\xfa\xae\xd1Ov7\xa7\xc1\xb2.~B\xe8@G\xd1\xd9R~\x1b\xf7\xa8\x86\xa7\xc1\b\x9ej\x01\xf4\xb7\xd2\x0e\xc2\x15S\x19\xd7\xd4\xe6\xaf!\xf8_\x8aEOp@>4\xd7\xcf\x11\xe0;\x99}QmE\xdd\xa69)Q\x9e\xb9\'\x97\x9b\xe7\xa4?Ed\x9c\x7fE\xba5\x90\xc07\x96S\x9d\xe1\x84\xfa\x1a\xd6\x9a\x15\xd1o \xc0\xd28\x01\xa7\x99\x85q\xbd\x80\x00\x00\x00\x00\x00\x00\x00H\x0f\xbbT\xd5\xb3\xf4\xcd<\x8a\x01\x19\xd0|B\f0\xf8i\xd3\x1bJke\t\x8b7Q\x1dQ&\x96H\x05\xec\x80\xf0\xab\x8f\x94{\x9d+\xefs\x1c\xfck\xf7q\x10\xf6\x16\xbc\xe7\x93\x0f\x7f\xcd\xa7b\xbe\x88\xcc\xb6^\x93\xa9P\xf3\xa3\xe4Az=\xe0+Q\x9e\xb5\x01\xb3\xc1\xa8P0+\xc9\xa1\xdbU~J$\xa4\x03\x11\x1aa~\x9du\x8f\x8d\xbcI\x85k\xa0\xae\xf6\xa0\x94r\xfb\xe3\xaa\xd4\xf0\x99\x06\xe1i\x1f\xfa\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\\\xb2/R\xedI2e5\x88(\xc0+^\xe7G\x17\x03^\xd7g\xb9n\x8c2\xb3\x12\x91\x86b\t\xd0R\x01\xda$Y\x85\x02&\x95FC\xc8\xd9\x00\x00\x00\xb6u\xbb\n{\x90\xfd>\xd0-\xfa\xa9\xfd{\x95E\r\x81j\x12\xb7\xd0k\xc2\xdc\xcdK\xc1\xe6\xf7\xb8@\xe0D') 130.452387ms ago: executing program 2 (id=3): madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) io_uring_setup(0x4d91, &(0x7f0000000000)={0x0, 0x4a47, 0x8, 0x0, 0x351}) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) process_vm_readv(r0, &(0x7f0000000280)=[{&(0x7f0000000140)=""/255, 0xff}], 0x1, &(0x7f0000000240)=[{&(0x7f0000001600)=""/4096, 0x1000}], 0x1, 0x0) 129.394347ms ago: executing program 4 (id=10): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f0000000780)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000000000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007044f16c01b1fbfd000000000000008af65f0df9928941994cc8c173fac5688671085a86d143c59fed0e57feb97f422c51d8e63b4ed9e295df3ccd1a55752dfc2f32f14b6c8f0e7413c3e9caaad30dcb412d0f54623f388bb2c63d2b1f7d83cd0cc021867bb4aee9967a6ee83e1b18fd8beca7d7eddcd96634"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r0, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x80) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000002c0)={0x0, 0x0}, 0x8) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1a, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x19, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r1, 0x4}, 0x80) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000002c0)={0x0, 0x0}, 0x8) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1a, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x19, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r2, 0x4}, 0x80) 91.321997ms ago: executing program 1 (id=11): socket(0x840000000002, 0x3, 0x100) recvmsg(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x2022) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000940)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "122d92", 0x10, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x19, 0x40000000}}}}}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)=ANY=[@ANYBLOB="300000001800dd8d0000000000003f000a00000000000006"], 0x30}}, 0x4004890) 86.800398ms ago: executing program 4 (id=12): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x19, 0x4, 0x8, 0x5}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000bd03000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r3, r1}, 0x14) syz_emit_ethernet(0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="00000000000000e0ffffffff85dd600000000000000000000000000000000000ffffac14140dfe8000800000000000001a5f4bd64acd3c16a0a09e7f14ecc8becc0dc95af7bcd187c23576879bd89de6342f48afd5990cb0785b2549392f2395c3ab4bbda0bea2dd788699312efb69de"], 0x0) 54.938358ms ago: executing program 2 (id=13): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='ramfs\x00', 0x10, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000400)='mountinfo\x00') r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000300)={0x40002000}) umount2(&(0x7f0000000000)='./file0\x00', 0x1) 31.519789ms ago: executing program 4 (id=14): r0 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x9, 0x2, 0x56d, 0x8000, 0x0, 0xffffffffffffffff, 0x2}, 0x50) 8.115039ms ago: executing program 4 (id=15): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet_udp(0x2, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f0000000600)=[{{&(0x7f0000000080)={0x2, 0x4e20, @local}, 0x10, 0x0}}], 0x1, 0x2000c844) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f00000003c0)=[{&(0x7f0000000280)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) sendto$inet(r0, 0x0, 0x0, 0x6000000000000000, 0x0, 0x0) 0s ago: executing program 2 (id=16): r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0xc6982, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_mount_image$ext4(&(0x7f0000000740)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x1810714, &(0x7f0000000080)={[{@test_dummy_encryption}, {@init_itable_val}, {@dioread_nolock}, {@jqfmt_vfsv1}, {@nojournal_checksum}, {@minixdf}, {@barrier_val={'barrier', 0x3d, 0xa18}}, {@errors_remount}, {@lazytime}, {@test_dummy_encryption}, {@min_batch_time={'min_batch_time', 0x3d, 0x4}}]}, 0xdf, 0x475, &(0x7f0000000780)="$eJzs289vFFUcAPDvTLeAgGxFREGQKpo0/mhpQeVgYjSaeNDERA94rG0hyEINrYmQRqsxeDQk3o1HE/8CT56MejLxikcTQ0KUmIheXDO7M6VddssubNna/XySoe/NvHk/dubNvn2PCaBvDWf/JBHbI+JSRJTr0ZUJhut/rl1dmPr76sJUEtXqG78ntXR/XV2YquaK87bleY6kEeknSV5IDC7Pdu7c+VOTlcrM2Tw+Nn/63bG5c+efOnl68sTMiZkzE0ePHjk8/uwzE083qfWvFztq5ED+d+8Hs/v2vPLWxdemjl18+4evs/ru3l8/lLWjozzbMJw1/I/6Z9N47LFuF9Zj/1avtzMp9bo2tCvrGqW8c16KcgzE9YtXjpc/7mnlgDWVPbM3tz68WAU2sCR6XQOgN4ov+uz3b7HdoaHHunDlhfoPoKzd1/KtfqQUaZ5mcA3LH46IY4v/fJFt0TAPUW0ybwAAcLu+zcY/TzYb/6Wxe1m6Hfna0FBE3BMROyPi3ojYFRH3RdTS3h8RD3RY/nBD/MbxZ3r5lhrWpmz891y+trVy/FeM/mJoII/dXWv/YHL8ZGXmUP6ZjMTg5iw+3izzIouXfv6sVfnLx3/ZlpVfjAXzTC6X6hN0W4o905Pzk90alF75KGJvqVn7k6WVgCQi9kTE3s6y3lEETj7+1b5WiW7e/lV0YZ2p+mWRycJiNLS/kKy+Pjm2JSozh8aKu+JGP/504fVW5d9W+7sgu/5bV97/DSnKfybL12vnlg48324ZF375tOVvylL79/+S7P7flLxZW7PelO97f3J+/ux4xKbk1Vp8xf6J6+cW8SJ91v6Rg837/878nKz9D0ZEdhPvj4iHIuJAfu0ejohHIuLgKu3//sVH32l1bD1c/+mmz7+l+39o5fXvPDBw6rtvWpXf3vPvSC00ku+pPf9uonV1isdotufY3K1+bgAAAPB/kkbE9kjS0aVwmo6O1v8P/67YmlZm5+afOD773pnp+jsCQzGYFjNd5WXzoePJYp5jPT6RzxUXxw/n88afD9xVi49OzVame9x26HfbWvT/zG8Dva4dsOa8rwX9q7H/pz2qB3Dn+f6H/qX/Q/+6of97IEDfaNbdP2yIWwuAjaha7vgUE4SwYRjuQ//S/6F/6f/Ql27nvf61CpRWeXtfoMeBrRFRC0S6LuqzbgIH1lFvKnWhd/f4wQQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANAl/wUAAP//xgL2dQ==") r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x100, 0x52) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r1, 0x8004587d, &(0x7f0000000080)={@id={0x2, 0x0, @d}}) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r1, 0x40106614, 0x0) kernel console output (not intermixed with test programs): rocess permissive=1 [ 15.008770][ T28] audit: type=1400 audit(1786393458.611:63): avc: denied { siginh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.56' (ED25519) to the list of known hosts. [ 22.827170][ T28] audit: type=1400 audit(1786393466.431:64): avc: denied { mounton } for pid=279 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.830353][ T279] cgroup: Unknown subsys name 'net' [ 22.855108][ T28] audit: type=1400 audit(1786393466.431:65): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.877282][ T28] audit: type=1400 audit(1786393466.461:66): avc: denied { unmount } for pid=279 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.877579][ T279] cgroup: Unknown subsys name 'devices' [ 23.018041][ T279] cgroup: Unknown subsys name 'hugetlb' [ 23.023685][ T279] cgroup: Unknown subsys name 'rlimit' [ 23.128448][ T28] audit: type=1400 audit(1786393466.731:67): avc: denied { setattr } for pid=279 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.151677][ T28] audit: type=1400 audit(1786393466.731:68): avc: denied { mounton } for pid=279 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.176556][ T28] audit: type=1400 audit(1786393466.731:69): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.205426][ T281] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 23.214455][ T28] audit: type=1400 audit(1786393466.811:70): avc: denied { relabelto } for pid=281 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.240045][ T28] audit: type=1400 audit(1786393466.811:71): avc: denied { write } for pid=281 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.265540][ T279] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.274369][ T28] audit: type=1400 audit(1786393466.851:72): avc: denied { read } for pid=279 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.299929][ T28] audit: type=1400 audit(1786393466.851:73): avc: denied { open } for pid=279 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.058711][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.065920][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.073430][ T290] device bridge_slave_0 entered promiscuous mode [ 24.083505][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.090614][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.098176][ T290] device bridge_slave_1 entered promiscuous mode [ 24.110962][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.118076][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.125466][ T287] device bridge_slave_0 entered promiscuous mode [ 24.144730][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.151896][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.159432][ T287] device bridge_slave_1 entered promiscuous mode [ 24.203932][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.211054][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.218587][ T288] device bridge_slave_0 entered promiscuous mode [ 24.231116][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.238359][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.245901][ T289] device bridge_slave_0 entered promiscuous mode [ 24.262964][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.270075][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.277534][ T288] device bridge_slave_1 entered promiscuous mode [ 24.287761][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.294796][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.302441][ T289] device bridge_slave_1 entered promiscuous mode [ 24.332237][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.339355][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.346791][ T291] device bridge_slave_0 entered promiscuous mode [ 24.375031][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.382567][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.390024][ T291] device bridge_slave_1 entered promiscuous mode [ 24.504182][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.511280][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.518613][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.525697][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.572436][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.579511][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.586816][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.593849][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.616834][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.623911][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.631230][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.638293][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.659944][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.667027][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.674330][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.681395][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.709628][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.716927][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.724056][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.732689][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.740027][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.747682][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.756284][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.763512][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.770852][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.804610][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.813930][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.835445][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.843569][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.851151][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.858783][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.867014][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.874039][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.881597][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.889936][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.896974][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.904352][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.912698][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.919777][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.942516][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.950720][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.957804][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.965186][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.973664][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.980855][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.988441][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.996518][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.004639][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.011719][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.019102][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.050301][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.059041][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.067558][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.075624][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.083894][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.092321][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.100477][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.108912][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.120667][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.129297][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.149627][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 25.157226][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.164670][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.173321][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.181778][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.188879][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.197039][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.205343][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.213801][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.222113][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.230469][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.237543][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.244965][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.253004][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.261218][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 25.268966][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.276554][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.288766][ T290] device veth0_vlan entered promiscuous mode [ 25.295162][ T289] device veth0_vlan entered promiscuous mode [ 25.305825][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.313808][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.321987][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.330137][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.338391][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.346752][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.354784][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.362415][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.375621][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.383853][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.394583][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.402945][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.414610][ T287] device veth0_vlan entered promiscuous mode [ 25.422303][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.430366][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.438978][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.447547][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.456744][ T290] device veth1_macvtap entered promiscuous mode [ 25.475960][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.483533][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.491042][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.499534][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.508244][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.516564][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.524748][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.533235][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.542747][ T289] device veth1_macvtap entered promiscuous mode [ 25.551945][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.559692][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.568120][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.577472][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.586245][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.596050][ T287] device veth1_macvtap entered promiscuous mode [ 25.614416][ T288] device veth0_vlan entered promiscuous mode [ 25.622638][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.631239][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.639203][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.647383][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.655477][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.664047][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.672687][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.680310][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.703831][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.712011][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.720090][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.728072][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.737340][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.745779][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.754032][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.762478][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.770945][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.786462][ T291] device veth0_vlan entered promiscuous mode [ 25.798251][ T287] request_module fs-gadgetfs succeeded, but still no fs? [ 25.809362][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.818802][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.828945][ T288] device veth1_macvtap entered promiscuous mode [ 25.856243][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.877793][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.894867][ T316] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.911454][ T313] ======================================================= [ 25.911454][ T313] WARNING: The mand mount option has been deprecated and [ 25.911454][ T313] and is ignored by this kernel. Remove the mand [ 25.911454][ T313] option from the mount to silence this warning. [ 25.911454][ T313] ======================================================= [ 25.920870][ T291] device veth1_macvtap entered promiscuous mode [ 25.969624][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.980900][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.999358][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.028046][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.039720][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.051072][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.060362][ T287] syz-executor (287) used greatest stack depth: 21280 bytes left [ 26.068625][ T320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.185789][ T39] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 26.244825][ T340] netlink: 20 bytes leftover after parsing attributes in process `syz.1.11'. [ 26.295873][ T328] ================================================================== [ 26.304002][ T328] BUG: KASAN: use-after-free in pppol2tp_sock_to_session+0x1a0/0x1b0 [ 26.312116][ T328] Read of size 4 at addr ffff888133b0dc00 by task syz.1.2/328 [ 26.319605][ T328] [ 26.321968][ T328] CPU: 0 PID: 328 Comm: syz.1.2 Not tainted syzkaller #0 [ 26.329019][ T328] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.339207][ T328] Call Trace: [ 26.342523][ T328] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 26.345486][ T328] __dump_stack+0x21/0x24 [ 26.349855][ T328] dump_stack_lvl+0x110/0x170 [ 26.354564][ T328] ? __cfi_dump_stack_lvl+0x8/0x8 [ 26.359623][ T328] ? _raw_spin_lock_bh+0x94/0xf0 [ 26.364603][ T328] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 26.370358][ T328] print_address_description+0x71/0x200 [ 26.375936][ T328] print_report+0x4a/0x60 [ 26.380296][ T328] kasan_report+0x122/0x150 [ 26.380332][ T347] loop2: detected capacity change from 0 to 512 [ 26.384835][ T328] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 26.396835][ T328] __asan_report_load4_noabort+0x14/0x20 [ 26.402516][ T328] pppol2tp_sock_to_session+0x1a0/0x1b0 [ 26.408112][ T328] pppol2tp_release+0x150/0x2b0 [ 26.410137][ T39] usb 1-1: Using ep0 maxpacket: 32 [ 26.413024][ T328] sock_close+0xc9/0x220 [ 26.413058][ T328] ? __cfi_sock_close+0x10/0x10 [ 26.427283][ T328] __fput+0x1fd/0x8f0 [ 26.431312][ T328] ____fput+0x15/0x20 [ 26.435332][ T328] task_work_run+0x1e1/0x250 [ 26.439969][ T328] ? __cfi_task_work_run+0x10/0x10 [ 26.440371][ T39] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 26.445121][ T328] ? free_nsproxy+0x21f/0x270 [ 26.459897][ T328] do_exit+0xaf2/0x2850 [ 26.464104][ T328] ? __cfi_do_exit+0x10/0x10 [ 26.468731][ T328] ? xfd_validate_state+0x70/0x150 [ 26.473881][ T328] ? __kasan_check_write+0x14/0x20 [ 26.479023][ T328] __x64_sys_exit+0x40/0x40 [ 26.483574][ T328] x64_sys_call+0x67/0x9a0 [ 26.488022][ T328] do_syscall_64+0x4c/0xa0 [ 26.492474][ T328] ? clear_bhb_loop+0x30/0x80 [ 26.497177][ T328] ? clear_bhb_loop+0x30/0x80 [ 26.501886][ T328] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 26.507818][ T328] RIP: 0033:0x7ff58559e0d9 [ 26.512265][ T328] Code: Unable to access opcode bytes at 0x7ff58559e0af. [ 26.519304][ T328] RSP: 002b:00007ff58648def8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 26.527770][ T328] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007ff58559e0d9 [ 26.535768][ T328] RDX: 00007ff58648e9c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 26.543760][ T328] RBP: 00007ff585635024 R08: 0000000000000000 R09: 0000000000000058 [ 26.551760][ T328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 26.559783][ T328] R13: 00007ff585826038 R14: 00007ff585825fa0 R15: 00007fffba0fba58 [ 26.565768][ T39] usb 1-1: config 1 has no interfaces? [ 26.567793][ T328] [ 26.567802][ T328] [ 26.567806][ T328] Allocated by task 327: [ 26.567816][ T328] kasan_set_track+0x4b/0x70 [ 26.573441][ T39] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 26.576328][ T328] kasan_save_alloc_info+0x1f/0x30 [ 26.576346][ T328] __kasan_kmalloc+0x95/0xb0 [ 26.595399][ T39] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.596557][ T328] __kmalloc+0xb4/0x1e0 [ 26.596580][ T328] l2tp_session_create+0x38/0xbd0 [ 26.596601][ T328] pppol2tp_connect+0xbf5/0x1640 [ 26.628454][ T328] __sys_connect+0x3da/0x460 [ 26.633158][ T328] __x64_sys_connect+0x7a/0x90 [ 26.637964][ T328] x64_sys_call+0x88d/0x9a0 [ 26.642502][ T328] do_syscall_64+0x4c/0xa0 [ 26.646955][ T328] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 26.652894][ T328] [ 26.655247][ T328] Freed by task 320: [ 26.659164][ T328] kasan_set_track+0x4b/0x70 [ 26.663786][ T328] kasan_save_free_info+0x2b/0x40 [ 26.668903][ T328] ____kasan_slab_free+0x132/0x180 [ 26.673030][ T347] fscrypt: Error allocating hmac(sha512): -2 [ 26.674045][ T328] __kasan_slab_free+0x11/0x20 [ 26.684856][ T328] slab_free_freelist_hook+0xc2/0x190 [ 26.690244][ T328] __kmem_cache_free+0xb7/0x1b0 [ 26.695121][ T328] kfree+0x6f/0xf0 [ 26.698855][ T328] l2tp_session_put+0xaf/0x1a0 [ 26.703631][ T328] l2tp_session_delete+0x3df/0x4d0 [ 26.708751][ T328] l2tp_tunnel_del_work+0x199/0x410 [ 26.713954][ T328] process_one_work+0x717/0xc30 [ 26.718828][ T328] worker_thread+0xa4d/0x11d0 [ 26.723524][ T328] kthread+0x281/0x320 [ 26.727635][ T328] ret_from_fork+0x1f/0x30 [ 26.732072][ T328] [ 26.734407][ T328] The buggy address belongs to the object at ffff888133b0dc00 [ 26.734407][ T328] which belongs to the cache kmalloc-512 of size 512 [ 26.748469][ T328] The buggy address is located 0 bytes inside of [ 26.748469][ T328] 512-byte region [ffff888133b0dc00, ffff888133b0de00) [ 26.761580][ T328] [ 26.763919][ T328] The buggy address belongs to the physical page: [ 26.770347][ T328] page:ffffea0004cec300 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x133b0c [ 26.780594][ T328] head:ffffea0004cec300 order:2 compound_mapcount:0 compound_pincount:0 [ 26.788931][ T328] flags: 0x4000000000010200(slab|head|zone=1) [ 26.795030][ T328] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 [ 26.803627][ T328] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 26.812214][ T328] page dumped because: kasan: bad access detected [ 26.818651][ T328] page_owner tracks the page as allocated [ 26.824391][ T328] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 291, tgid 291 (syz-executor), ts 26104814909, free_ts 0 [ 26.846110][ T328] post_alloc_hook+0x1f5/0x210 [ 26.850898][ T328] prep_new_page+0x1c/0x110 [ 26.855414][ T328] get_page_from_freelist+0x2ca9/0x2d20 [ 26.860975][ T328] __alloc_pages+0x1fa/0x610 [ 26.865596][ T328] alloc_slab_page+0x6e/0xf0 [ 26.870200][ T328] new_slab+0x98/0x3e0 [ 26.874297][ T328] ___slab_alloc+0x70f/0xb70 [ 26.878910][ T328] __slab_alloc+0x5e/0xa0 [ 26.883258][ T328] __kmem_cache_alloc_node+0x204/0x2d0 [ 26.888737][ T328] kmalloc_node_trace+0x26/0xb0 [ 26.893599][ T328] alloc_fair_sched_group+0x218/0x6f0 [ 26.898996][ T328] sched_create_group+0x42/0x230 [ 26.903956][ T328] cpu_cgroup_css_alloc+0x18/0x1c0 [ 26.909077][ T328] cgroup_apply_control_enable+0x38d/0xdd0 [ 26.914894][ T328] cgroup_mkdir+0x12f6/0x1550 [ 26.919585][ T328] kernfs_iop_mkdir+0x1b1/0x2b0 [ 26.924449][ T328] page_owner free stack trace missing [ 26.929815][ T328] [ 26.932154][ T328] Memory state around the buggy address: [ 26.937787][ T328] ffff888133b0db00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.945853][ T328] ffff888133b0db80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.953923][ T328] >ffff888133b0dc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.961981][ T328] ^ [ 26.966055][ T328] ffff888133b0dc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.974143][ T328] ffff888133b0dd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.982229][ T328] ================================================================== [ 27.087186][ T328] Disabling lock debugging due to kernel taint [ 27.094491][ T328] ------------[ cut here ]------------ [ 27.100190][ T328] WARNING: CPU: 0 PID: 328 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 27.110362][ T328] Modules linked in: [ 27.114273][ T328] CPU: 0 PID: 328 Comm: syz.1.2 Tainted: G B syzkaller #0 [ 27.122876][ T328] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 27.133143][ T328] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 27.139618][ T328] Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 [ 27.159352][ T328] RSP: 0018:ffffc9000dbdfb90 EFLAGS: 00010293 [ 27.165442][ T328] RAX: ffffffff849bb307 RBX: ffff888113c0b000 RCX: ffff88810f7e8000 [ 27.173577][ T328] RDX: 0000000000000000 RSI: 00000000326e30c0 RDI: 000000000c04eb7d [ 27.181683][ T328] RBP: ffffc9000dbdfbb0 R08: ffffffff87b757e7 R09: 1ffffffff0f6eafc [ 27.189807][ T328] R10: dffffc0000000000 R11: fffffbfff0f6eafd R12: dffffc0000000000 [ 27.197940][ T328] R13: dffffc0000000000 R14: 00000000326e30c0 R15: ffff888133b0dc00 [ 27.206183][ T328] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 27.215146][ T328] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.221861][ T328] CR2: 00007fd867e04130 CR3: 0000000110348000 CR4: 00000000003506b0 [ 27.229942][ T328] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 27.238066][ T328] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 27.246108][ T328] Call Trace: [ 27.249407][ T328] [ 27.252362][ T328] pppol2tp_release+0x150/0x2b0 [ 27.257316][ T328] sock_close+0xc9/0x220 [ 27.261608][ T328] ? __cfi_sock_close+0x10/0x10 [ 27.266526][ T328] __fput+0x1fd/0x8f0 [ 27.270560][ T328] ____fput+0x15/0x20 [ 27.274575][ T328] task_work_run+0x1e1/0x250 [ 27.279216][ T328] ? __cfi_task_work_run+0x10/0x10 [ 27.284352][ T328] ? free_nsproxy+0x21f/0x270 [ 27.289186][ T328] do_exit+0xaf2/0x2850 [ 27.293401][ T328] ? __cfi_do_exit+0x10/0x10 [ 27.298044][ T328] ? xfd_validate_state+0x70/0x150 [ 27.303198][ T328] ? __kasan_check_write+0x14/0x20 [ 27.308371][ T328] __x64_sys_exit+0x40/0x40 [ 27.312907][ T328] x64_sys_call+0x67/0x9a0 [ 27.317390][ T328] do_syscall_64+0x4c/0xa0 [ 27.321834][ T328] ? clear_bhb_loop+0x30/0x80 [ 27.326607][ T328] ? clear_bhb_loop+0x30/0x80 [ 27.331314][ T328] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 27.337262][ T328] RIP: 0033:0x7ff58559e0d9 [ 27.341705][ T328] Code: Unable to access opcode bytes at 0x7ff58559e0af. [ 27.348782][ T328] RSP: 002b:00007ff58648def8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 27.357232][ T328] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007ff58559e0d9 [ 27.365217][ T328] RDX: 00007ff58648e9c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 27.373339][ T328] RBP: 00007ff585635024 R08: 0000000000000000 R09: 0000000000000058 [ 27.381377][ T328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 27.389385][ T328] R13: 00007ff585826038 R14: 00007ff585825fa0 R15: 00007fffba0fba58 [ 27.397403][ T328] [ 27.400436][ T328] ---[ end trace 0000000000000000 ]--- [ 27.456899][ T39] usb 1-1: can't set config #1, error -71 [ 27.469791][ T39] usb 1-1: USB disconnect, device number 2 [ 27.646535][ T10] device bridge_slave_1 left promiscuous mode [ 27.652697][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.660361][ T10] device bridge_slave_0 left promiscuous mode [ 27.666599][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.674657][ T10] device veth1_macvtap left promiscuous mode [ 27.680962][ T10] device veth0_vlan left promiscuous mode [ 28.596703][ T10] device bridge_slave_1 left promiscuous mode [ 28.602840][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.610377][ T10] device bridge_slave_0 left promiscuous mode [ 28.616533][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.624423][ T10] device bridge_slave_1 left promiscuous mode [ 28.630728][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.638155][ T10] device bridge_slave_0 left promiscuous mode [ 28.644273][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.652480][ T10] device bridge_slave_1 left promiscuous mode [ 28.658647][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.666182][ T10] device bridge_slave_0 left promiscuous mode [ 28.672303][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.680860][ T10] device veth1_macvtap left promiscuous mode [ 28.686994][ T10] device veth0_vlan left promiscuous mode [ 28.693085][ T10] device veth1_macvtap left promiscuous mode [ 28.699163][ T10] device veth0_vlan left promiscuous mode [ 28.705226][ T10] device veth1_macvtap left promiscuous mode [ 28.711302][ T10] device veth0_vlan left promiscuous mode