last executing test programs: 282.667061ms ago: executing program 3 (id=4): r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000040)="1400000052004f030e789e7ee2ce2fa4ff612d27", 0x14) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, 0x0}}], 0x344, 0x10122, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'batadv0\x00'}) syz_emit_ethernet(0x3a, &(0x7f0000000240)=ANY=[@ANYBLOB="ffffffffffff0200000000024305000f32000000000102000000000202000000000200ff0014040100100001"], 0x0) 163.754393ms ago: executing program 3 (id=6): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config\x00', 0x1c0) mount(0x0, &(0x7f0000000540)='./config\x00', &(0x7f0000000580)='configfs\x00', 0x0, 0x0) symlinkat(&(0x7f0000000680)='./config/usb_gadget/g1\x00', 0xffffffffffffff9c, &(0x7f00000006c0)='./config/usb_gadget/g1/configs/c.1/ncm.usb0\x00') 134.410686ms ago: executing program 3 (id=7): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000d40)=ANY=[@ANYBLOB="2c0000007800010402000000000000000700000064000000140001800800010064000000080002"], 0x2c}}, 0x0) 110.066909ms ago: executing program 4 (id=5): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x19, &(0x7f0000000900)=0x400030, 0x4) 80.680542ms ago: executing program 1 (id=2): r0 = socket$netlink(0x10, 0x3, 0x0) write(r0, &(0x7f00000005c0)="500000002c0001060200000000000000000000000100000000000000f1ffffff100301000c000100666c6f7765720000200002801c0054801800058005000100010000000c00020c4eea050000000001", 0x50) 282.47µs ago: executing program 4 (id=8): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="7800000010000304000000000000000000007400", @ANYRES32=0x0, @ANYBLOB="00000000600000005800128008000100677470004c00028008000100", @ANYRES32], 0x78}, 0x1, 0x0, 0x0, 0x24008040}, 0x0) 0s ago: executing program 1 (id=9): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x0, 0x1}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000280)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f0000000380)=[@increfs]}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000003c0)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000400)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000480)=[@acquire]}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000004c0)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0}}]}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000580)={0x0, 0x1000000, 0x0, 0x1, 0xa00, &(0x7f00000005c0)}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.87' (ED25519) to the list of known hosts. [ 22.566827][ T30] audit: type=1400 audit(1793620520.755:64): avc: denied { mounton } for pid=277 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.570288][ T277] cgroup: Unknown subsys name 'net' [ 22.589525][ T30] audit: type=1400 audit(1793620520.755:65): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.617042][ T30] audit: type=1400 audit(1793620520.785:66): avc: denied { unmount } for pid=277 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.637158][ T277] cgroup: Unknown subsys name 'devices' [ 22.787675][ T277] cgroup: Unknown subsys name 'hugetlb' [ 22.793618][ T277] cgroup: Unknown subsys name 'rlimit' [ 22.933668][ T30] audit: type=1400 audit(1793620521.115:67): avc: denied { setattr } for pid=277 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.956924][ T30] audit: type=1400 audit(1793620521.115:68): avc: denied { mounton } for pid=277 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.981779][ T30] audit: type=1400 audit(1793620521.115:69): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.000619][ T279] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 23.013912][ T30] audit: type=1400 audit(1793620521.195:70): avc: denied { relabelto } for pid=279 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.039435][ T30] audit: type=1400 audit(1793620521.195:71): avc: denied { write } for pid=279 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.072844][ T30] audit: type=1400 audit(1793620521.255:72): avc: denied { read } for pid=277 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.098541][ T277] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.098549][ T30] audit: type=1400 audit(1793620521.255:73): avc: denied { open } for pid=277 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.959898][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.967144][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.974650][ T287] device bridge_slave_0 entered promiscuous mode [ 23.982758][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.989863][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.997348][ T287] device bridge_slave_1 entered promiscuous mode [ 24.080523][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.087638][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.094995][ T285] device bridge_slave_0 entered promiscuous mode [ 24.102480][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.109569][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.117113][ T285] device bridge_slave_1 entered promiscuous mode [ 24.149853][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.157331][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.164713][ T286] device bridge_slave_0 entered promiscuous mode [ 24.171601][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.178687][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.186184][ T289] device bridge_slave_0 entered promiscuous mode [ 24.196421][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.203799][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.211454][ T286] device bridge_slave_1 entered promiscuous mode [ 24.218190][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.225242][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.232734][ T289] device bridge_slave_1 entered promiscuous mode [ 24.270523][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.277634][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.284989][ T288] device bridge_slave_0 entered promiscuous mode [ 24.294627][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.301801][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.309310][ T288] device bridge_slave_1 entered promiscuous mode [ 24.422406][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.429511][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.436875][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.443925][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.483142][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.490254][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.497586][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.504653][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.537541][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.544616][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.551966][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.559108][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.579264][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.586363][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.593666][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.600739][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.610776][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.618334][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.625651][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.632689][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.641676][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.649048][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.656327][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.663519][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.671573][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.678923][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.686327][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.693583][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.701142][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.708457][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.716900][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.724363][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.749654][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.757903][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.764931][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.772503][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.781176][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.788262][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.812114][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.819888][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.828093][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.843707][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.851414][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.859800][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.867003][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.874792][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.883184][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.890307][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.910557][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.918350][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.926886][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.933962][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.941440][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.949833][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.956966][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.964609][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.973040][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.981352][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.988425][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.008831][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.017450][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.025997][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.033105][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.040675][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.049096][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.057259][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.065304][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.073782][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.082057][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.090261][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.102778][ T287] device veth0_vlan entered promiscuous mode [ 25.116935][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.124947][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.133172][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 25.141250][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.149052][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.157638][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.166002][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.173036][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.180525][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.188975][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.197425][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.204464][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.212171][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.219747][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.230101][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.238326][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.251780][ T287] device veth1_macvtap entered promiscuous mode [ 25.263351][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.271657][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.280104][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.310968][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.319544][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.328161][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.336921][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.345215][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.353825][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.362149][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.370361][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.378642][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.386948][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.394953][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.403104][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.411713][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.420144][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.428497][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.446285][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.454157][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.464197][ T288] device veth0_vlan entered promiscuous mode [ 25.473722][ T285] device veth0_vlan entered promiscuous mode [ 25.480561][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.488345][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.496069][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.504138][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.512439][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.520844][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.529272][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.537585][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.545080][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.552859][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.560591][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.571885][ T286] device veth0_vlan entered promiscuous mode [ 25.585188][ T289] device veth0_vlan entered promiscuous mode [ 25.592794][ T287] request_module fs-gadgetfs succeeded, but still no fs? [ 25.600412][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.609161][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.618127][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.626040][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.637671][ T288] device veth1_macvtap entered promiscuous mode [ 25.648740][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.663041][ T286] device veth1_macvtap entered promiscuous mode [ 25.676561][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.686225][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.694544][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.703202][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.711720][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.719928][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.728425][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.738496][ T285] device veth1_macvtap entered promiscuous mode [ 25.754431][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.762263][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.770909][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.779850][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.788657][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.798008][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.806635][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.822543][ T289] device veth1_macvtap entered promiscuous mode [ 25.837907][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.846588][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.854966][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.884167][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.897743][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.907109][ T317] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=120 sclass=netlink_route_socket pid=317 comm=syz.3.7 [ 25.919659][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.929473][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.938543][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.945900][ T321] ------------[ cut here ]------------ [ 25.948632][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.952097][ T321] kernel BUG at drivers/android/binder.c:1330! [ 25.952145][ T321] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 25.952167][ T321] CPU: 1 PID: 321 Comm: syz.1.9 Not tainted syzkaller #0 [ 25.952187][ T321] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 25.952199][ T321] RIP: 0010:binder_inc_ref_for_node+0x10b3/0x11c0 [ 25.996044][ T321] Code: ff ff 48 89 df 41 89 f5 41 89 d7 41 89 ce e8 f4 aa 10 fe 44 89 f1 4c 8b 75 c8 44 89 fa 44 89 ee e9 a3 fe ff ff e8 7d 10 d1 fd <0f> 0b 65 8b 05 bc 4a 69 7c 41 89 c5 c1 e8 06 48 8d 3c c5 a8 6a e9 [ 26.015693][ T321] RSP: 0018:ffffc90007817370 EFLAGS: 00010283 [ 26.021854][ T321] RAX: ffffffff8398c683 RBX: 0000000000000000 RCX: 0000000000080000 [ 26.030124][ T321] RDX: ffffc9000134b000 RSI: 0000000000000036 RDI: 0000000000000037 [ 26.038151][ T321] RBP: ffffc90007817410 R08: ffff88810b68ef3f R09: ffff88810b68ef30 [ 26.046153][ T321] R10: dffffc0000000000 R11: ffffed10216d1de8 R12: dffffc0000000000 [ 26.054154][ T321] R13: ffff88810b68e128 R14: ffff88810b68e110 R15: 0000000000000000 [ 26.062158][ T321] FS: 00007f8b382816c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 26.071188][ T321] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 26.077785][ T321] CR2: 0000001b2e923ffc CR3: 0000000129bd3000 CR4: 00000000003506a0 [ 26.085797][ T321] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 26.093824][ T321] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 26.101845][ T321] Call Trace: [ 26.105130][ T321] [ 26.108076][ T321] binder_thread_write+0x1497/0x6fe0 [ 26.113471][ T321] ? __kasan_check_write+0x14/0x20 [ 26.118607][ T321] ? binder_ioctl_get_freezer_info+0x470/0x470 [ 26.124780][ T321] ? finish_task_switch+0x16b/0x790 [ 26.130003][ T321] ? switch_mm_irqs_off+0x2fb/0x960 [ 26.135208][ T321] ? __schedule+0xbd7/0x14a0 [ 26.139906][ T321] ? release_firmware_map_entry+0x190/0x190 [ 26.145824][ T321] ? check_preempt_wakeup+0x725/0xbb0 [ 26.151233][ T321] ? __kasan_check_write+0x14/0x20 [ 26.156378][ T321] ? _copy_from_user+0x95/0xd0 [ 26.161241][ T321] binder_ioctl_write_read+0x203/0x6700 [ 26.166799][ T321] ? schedule_preempt_disabled+0x20/0x20 [ 26.172441][ T321] ? ttwu_do_wakeup+0x100/0x470 [ 26.177307][ T321] ? preempt_schedule_thunk+0x16/0x18 [ 26.182713][ T321] ? try_to_wake_up+0x632/0x1150 [ 26.187748][ T321] ? __kasan_check_write+0x14/0x20 [ 26.192952][ T321] ? wake_up_q+0x106/0x1b0 [ 26.197382][ T321] ? futex_wake+0x64b/0x8f0 [ 26.201898][ T321] ? binder_has_work_ilocked+0x3e0/0x3e0 [ 26.207540][ T321] ? avc_has_extended_perms+0x869/0xed0 [ 26.213120][ T321] ? memcpy+0x56/0x70 [ 26.217154][ T321] ? avc_has_extended_perms+0x9d5/0xed0 [ 26.222736][ T321] ? __kasan_check_write+0x14/0x20 [ 26.227867][ T321] ? avc_flush+0x2b0/0x2b0 [ 26.232296][ T321] ? do_futex+0xdd3/0x2800 [ 26.236727][ T321] ? __kasan_check_write+0x14/0x20 [ 26.241852][ T321] ? _raw_spin_lock+0x94/0xf0 [ 26.246536][ T321] ? _raw_spin_trylock_bh+0x150/0x150 [ 26.251916][ T321] ? _raw_spin_unlock+0x4d/0x70 [ 26.256779][ T321] binder_ioctl+0x36c/0x1df0 [ 26.261491][ T321] ? vma_link+0x1a0/0x1f0 [ 26.265842][ T321] ? ioctl_has_perm+0x1b8/0x4f0 [ 26.270734][ T321] ? binder_poll+0x2d0/0x2d0 [ 26.275352][ T321] ? has_cap_mac_admin+0x370/0x370 [ 26.280489][ T321] ? selinux_file_ioctl+0x3ad/0x4c0 [ 26.285798][ T321] ? selinux_file_alloc_security+0x120/0x120 [ 26.291959][ T321] ? __fget_files+0x2e1/0x340 [ 26.296654][ T321] ? security_file_ioctl+0x84/0xa0 [ 26.301788][ T321] ? binder_poll+0x2d0/0x2d0 [ 26.306390][ T321] __se_sys_ioctl+0x121/0x1a0 [ 26.311266][ T321] __x64_sys_ioctl+0x7b/0x90 [ 26.315871][ T321] x64_sys_call+0x2f/0x9a0 [ 26.320305][ T321] do_syscall_64+0x4c/0xa0 [ 26.324743][ T321] ? clear_bhb_loop+0x50/0xa0 [ 26.329442][ T321] ? clear_bhb_loop+0x50/0xa0 [ 26.334145][ T321] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 26.340060][ T321] RIP: 0033:0x7f8b39829b19 [ 26.344498][ T321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 26.364119][ T321] RSP: 002b:00007f8b38281028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 26.372558][ T321] RAX: ffffffffffffffda RBX: 00007f8b39aaffa0 RCX: 00007f8b39829b19 [ 26.380545][ T321] RDX: 0000200000000440 RSI: 00000000c0306201 RDI: 0000000000000003 [ 26.388532][ T321] RBP: 00007f8b398c1af8 R08: 0000000000000000 R09: 0000000000000000 [ 26.396522][ T321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 26.404509][ T321] R13: 00007f8b39ab0038 R14: 00007f8b39aaffa0 R15: 00007ffe6bd3d0e8 [ 26.412503][ T321] [ 26.415540][ T321] Modules linked in: [ 26.419938][ T321] ---[ end trace daca986d3c7c96a0 ]--- [ 26.425504][ T321] RIP: 0010:binder_inc_ref_for_node+0x10b3/0x11c0 [ 26.431974][ T321] Code: ff ff 48 89 df 41 89 f5 41 89 d7 41 89 ce e8 f4 aa 10 fe 44 89 f1 4c 8b 75 c8 44 89 fa 44 89 ee e9 a3 fe ff ff e8 7d 10 d1 fd <0f> 0b 65 8b 05 bc 4a 69 7c 41 89 c5 c1 e8 06 48 8d 3c c5 a8 6a e9 [ 26.451716][ T321] RSP: 0018:ffffc90007817370 EFLAGS: 00010283 [ 26.457815][ T321] RAX: ffffffff8398c683 RBX: 0000000000000000 RCX: 0000000000080000 [ 26.465829][ T321] RDX: ffffc9000134b000 RSI: 0000000000000036 RDI: 0000000000000037 [ 26.473818][ T321] RBP: ffffc90007817410 R08: ffff88810b68ef3f R09: ffff88810b68ef30 [ 26.481829][ T321] R10: dffffc0000000000 R11: ffffed10216d1de8 R12: dffffc0000000000 [ 26.489826][ T321] R13: ffff88810b68e128 R14: ffff88810b68e110 R15: 0000000000000000 [ 26.497842][ T321] FS: 00007f8b382816c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 26.507137][ T321] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 26.513753][ T321] CR2: 0000001b2e923ffc CR3: 0000000129bd3000 CR4: 00000000003506a0 [ 26.521761][ T321] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 26.529769][ T321] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 26.537793][ T321] Kernel panic - not syncing: Fatal exception [ 26.544135][ T321] Kernel Offset: disabled [ 26.548470][ T321] Rebooting in 86400 seconds..