last executing test programs: 1.236923123s ago: executing program 0 (id=1): unshare(0x64000600) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000080)=ANY=[@ANYBLOB="6d404e7433616e676c650000000000000000000000000079855dc03f9d"], &(0x7f0000000180)=0x2c) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, 0x0) ioctl$PPPIOCSMAXCID(r1, 0x40047451, &(0x7f0000000080)=0x4) pwritev(r1, &(0x7f0000000400)=[{&(0x7f0000000380)="00214717a70700000000030600710a5eeb9d0471200000000500000000000000ffff0342844d50e77d0dc450de49c204a80316", 0x33}], 0x1, 0x4, 0x0) 1.218747564s ago: executing program 4 (id=5): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x48241, 0x0) socket(0x8000000010, 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f0000000240)={@val={0x70}, @void, @eth={@broadcast, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x4000, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, {0x2000, 0x86dd, 0x48, 0x0, @wg=@cookie={0x3, 0x0, "cfc1707ba44e26688d65bca96f07d825161428d746f0905b", "2ac75add02d025e46ca1d440a793e6e44c2c0c3d65c9e8734d6da89adfb0e80b"}}}}}}}, 0x6e) 1.161829036s ago: executing program 2 (id=6): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$sock_int(r0, 0x1, 0x21, &(0x7f0000000040)=0x3, 0x4) sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, 0x7, 0x1, 0x701, 0x0, 0x0, {0x0, 0x0, 0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x44800}, 0x80) sendmsg$IPCTNL_MSG_CT_GET_STATS(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)={0x14, 0x5, 0x1, 0x101, 0x0, 0x0, {0xa, 0x0, 0xa}}, 0x14}, 0x1, 0x0, 0x0, 0x240488d0}, 0x8000) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x21}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x1, &(0x7f0000000600)=0x0) io_submit(r2, 0x1, &(0x7f00000008c0)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x7fff, r1, &(0x7f0000000140)="b7", 0x1, 0x0, 0x0, 0x2}]) 1.149214226s ago: executing program 3 (id=4): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x757, 0xa00, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xff, 0x70, 0x8, "", [{{0x9, 0x4, 0x0, 0xd, 0x41, 0x3, 0x1, 0x0, 0x7, {0x9, 0x21, 0xff7f, 0x77, 0x1, {0x22, 0xfb1}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x3, 0x1, 0x2}}}}}]}}]}}, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_connect$printer(0x3, 0x0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f0000000100)={0x20, 0x23, 0xe, {0xe, 0x30, "0000000000000000000000b5"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 1.146477016s ago: executing program 1 (id=2): openat(0xffffffffffffff9c, 0x0, 0x1438c2, 0x6721a808a82eee20) socket$nl_xfrm(0x10, 0x3, 0x6) syz_emit_ethernet(0x4a, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0xffffd000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e25}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) unshare(0x64000600) socket$unix(0x1, 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f00000002c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x4, [@func={0x2, 0x0, 0x0, 0xc, 0x2}, @func_proto]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x34}, 0x28) 1.108100187s ago: executing program 0 (id=7): r0 = socket(0x10, 0x803, 0x0) pipe2(&(0x7f0000000100), 0x0) r1 = socket(0x1, 0x803, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)=@ipv6_newaddr={0x2c, 0x14, 0x9535393fea6295b5, 0x0, 0x20000, {0xa, 0x40, 0x22, 0x0, r2}, [@IFA_LOCAL={0x14, 0x2, @ipv4}]}, 0x2c}}, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=@ipv6_newaddr={0x2c, 0x14, 0x9535393fea6295b5, 0xfffffffe, 0x0, {0xa, 0x426efe909b2b1400, 0x46, 0xfd, r2}, [@IFA_ADDRESS={0x14, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}]}, 0x2c}}, 0x0) 1.053802459s ago: executing program 2 (id=8): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000480)=@newlink={0x38, 0x10, 0x439, 0x0, 0x60000, {0x0, 0x0, 0x0, r3, 0x9801}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @remote}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_route(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000001240)={&(0x7f0000000180)=@bridge_delneigh={0x3c, 0x1c, 0xc07, 0x70bd2e, 0x25dfdbfe, {0x2, 0x0, 0x0, r3, 0x2, 0x10, 0x72748f52b8af0932}, [@NDA_DST_IPV6={0x14, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}}, @NDA_LLADDR={0xa, 0x2, @broadcast}]}, 0x3c}}, 0x20024090) 1.053644279s ago: executing program 0 (id=9): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newlink={0x34, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x6}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x10, 0x2, 0xb6, '\x00', 0x2}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000480)={0x1, 0x0, [{0x40000070, 0x0, 0x400006}]}) 1.051789349s ago: executing program 2 (id=10): rt_sigprocmask(0x0, &(0x7f0000001480)={[0xffffffffffffffff]}, 0x0, 0x8) r0 = getpgrp(0x0) r1 = gettid() bpf$BPF_LINK_UPDATE(0x1d, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) rt_tgsigqueueinfo(r0, r1, 0x1f, &(0x7f00000000c0)={0x3f, 0x8000006, 0x1}) r2 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xfffffffffffffff7]}, 0x8, 0x80000) read$FUSE(r2, &(0x7f0000002bc0)={0x2020}, 0x2020) 1.039321049s ago: executing program 4 (id=11): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1342, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r0, &(0x7f0000000180)=[{&(0x7f00000003c0)="0900ee0c7cda99b4b47380c988ca", 0xe}, {&(0x7f0000000500)="2d266fdcb52fdddba4539b074180ef5a", 0x10}], 0x2) 827.291625ms ago: executing program 2 (id=12): syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r0 = socket(0x10, 0x803, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=@getchain={0x24, 0x66, 0x0, 0x0, 0x2000}, 0x24}}, 0x0) getsockname$packet(r0, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000900)=0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@newlink={0x48, 0x10, 0x401, 0x0, 0x3, {0x0, 0x0, 0x0, r2}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LOCAL={0x14, 0x2, @mcast1}]}}}]}, 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x38, 0x10, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r2, 0x2, 0xac}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x8, 0x2, 0x0, 0x1, [@IFLA_IPTUN_COLLECT_METADATA={0x4}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x240440c0}, 0xd4) setsockopt$sock_linger(r1, 0x1, 0xd, 0x0, 0x0) 753.880557ms ago: executing program 0 (id=13): bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_mount_image$vfat(&(0x7f0000000100), &(0x7f0000000000)='./file0\x00', 0x80c8d0, &(0x7f0000000140)=ANY=[], 0x9, 0x34f, &(0x7f00000004c0)="$eJzs3M1vG0UYx/FfjO04qZr1AYE4oD4SF7isknDigrBQKyEiUYUa8SIhts0GrCx25LWCjBBpT1w4IP4IDlWPvVWC/gO5cOOAuHDLBYkDPSAWed+8bpzEdes2L9+PVO00M8/ubGazemalmf0Pf/hyazN0N72eSjXTnCQ9kOoqKTOXHktxuaq6hm7qtQt///by+x99/G5jbe3yutmVxrXXV81s6dLPX32zkDa7N6+9+qf7f63+uffC3kv7/137ohVaK7R2p2eeXe/80fOuB75ttMIt1+xq4Huhb6126HeT+mhXCnzbDDrb233z2gsXF7e7fhia1+7blt+3Xsd63b55n3uttrmuaxcXdbz5CdqcZc3b6+teI/3PG889WvCNWfQIjyca80h3uw1vMLYLB2qat59OrwAAwEmS5v95tl8apPTH5P9Fef5fTvL/3yUV8v879fu9Cx/cXUrz/3vVQf4vFfL/z/JT1WQbpTz/r0ka5v+dZH6Q5/8bTyb/P5gRnW7fjw6OoigvVse1H8n/cUYN8v/F9O83duuTO8txgfwfAAAAAAAAAAAAAAAAAAAAAIDT4EEUOVEUOckxWwEeOfPxghwpSusPCX/EJeM4aUbHf/hvwvHHKTfcuKO8JAXf7TR3mskxbXBfUiBfy3L0b/w8pAbl6k0rrqL7JdhN43d3msmrobGpVhy/Ikf1h+Oj6Mo7a5dXzLJdCwrxFS0W41fl6Hlpfkz8qiXy61cGx6pefaUQ78rRrzfUUaCNdGVcFv/titnb763ZaP8X4nYAAAAAAJwFruXq2fy3uIWg6x6sT+bHSX0yvy5r/PeBZH69/PD8PI4vq1R+VncNAAAAAMD5Eva/3vKCwO/OqHBL0lFtyprN1YffMCaNyjbIPaTNnOaefFdrkuJCdvHpzjPo2xRXr4ytqkz0GytN1dVL1ckHpXpoVfbZ6LBwXZ1mLCInHYvHGNMXf/zpn6PbJF/GpElO+Obd2jF3esQjUT6qTfW4O62MvCRKs30HAQAAAHg6hkl/9pO3pMqz7RMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOfNrPf/K+4sAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJx3/wcAAP//QOD4ig==") syz_mount_image$fuse(0x0, 0x0, 0x210a055, 0x0, 0x0, 0x0, 0x0) statfs(0x0, 0x0) syz_emit_ethernet(0x21d, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.throttle.io_serviced\x00', 0x275a, 0x0) ftruncate(r0, 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) 401.455288ms ago: executing program 2 (id=14): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) syz_mount_image$vfat(&(0x7f0000000c00), &(0x7f00000004c0)='./file2\x00', 0x8410, &(0x7f0000000800)=ANY=[@ANYBLOB="7379735f696d6d757461626c652c666d61736b3d30313737373737373737373737373737373737373737332c73686f72746e616d653d6c6f7765722c636865636b3d7374726963742c2c756e695f786c6174653d302c726f6469722c726f6469722c73686f72746e616d653d6c6f7765722c73686f72746e616d653d6c6f7765722c6e6f6e756d7461696c3d302c756e695f786c6174653d312c756e695f786c6174653d312c6572726f72733d636f6e74696e75652c74696d655f6f66667365743d3078303030303030303030303030303465302c757466383d302c0077b5b28056fc4549d277ed7fab6b0be29df17f888ccab55cccc917ad315c8ea56f5a89c104f92d058b92f5881e69e06002f5914c03fefbeb09121733eaf5ded73df976fbd4cfcb8b70b0bf44da1b46bc0800000000000000f9e4ebbf71c77fc9a810ce726b8c6d6295a5f2e2b069b95ba8ecce52ded99b82923228c37d5e1ec11cdbcabb8a89cbf2cf2771d69e3cf0e6760094145e542e426bceaab9b2cd261046247bce0565db3ac5888b74efd48bc9f455e60f49496ca8137aba85fe39756814fda1f0624b33a2025792a2d47aff43355f9d23a606e1a477ccfff09befb1d0cf1599d272628028b9786e1fbfb3d637c2561421488c9d0000000094bf13ac582f6b67de0cad9336316e70794271b2259fe5d73a74ad7da615c31505c7c0c168052d38e5b64c4bb7d0599e5dcf0000000000000000000000000000002790cf17418aa278cfc0c9d1c81c63e58b877706a808e9a51cc0d73e298db2939adc0efdab4745ab0e09ef8beaaf04e5374c2e7e4672e47fe5a25502919954242f8d779d84091f20646210edf871d3f20ad66fcf4b816323b8abb307381d4ada887dcc71e35f364baa1b93fd5ee36c02aa4628511442992ced893ab946472440b53fc08cc41403e167b1f2605e04d5f0c16ed49969b59d650d88642b10c7893fe9b664421a40f4822ffcc284dfe9aea76e4a04293c970f2dae776decf07b085e16511b0bd365b0f86c7fcd8df00a87f4dbbf8e623667e3b65e4c487055a2e5cd64402a4de537bf113fc7370099e4faebe6ea9d4f155f8f5f4c5f9b205ce1bbb16e002a19457e05a210d9e9820bc7f318ebfdfcc22f831505", @ANYBLOB="d23c17f6ec01b3b820b1fdfffa233394c6e77c8285b061be4d1d842e4a63ec47a083470f375b81080001cf3df73c16fd31622d37a921bdbff76ef2fed6da828ab4e0f87928c18c0380050249fb6ab8cdc85b032f67dc95a947e63e3667ac2b1c953f5017b3cf2ce986800b84dcc3b33bfe950832606c010ac9f8a252454548986e9b7a88529e53efe01210aad5b2300137f1a62cd7a4a17b307956"], 0xff, 0x2b4, &(0x7f0000000500)="$eJzs3U9rY1UUAPDzkjfpUxcp4kYRfKALV2Xq1k2ijCB2pURQFxqcDkgSBmYgYAXjrOYTuPR7+BHcuPEbKG4Fd9NF5cnLe69J2/QPNqYw/f1Wp/fec+/JuyVZ5eSr1yej+w+TePLs98iyJFq96MVhEtvRisYPkQYA8Pw4LIr4u/gvmWlr/dUAAJtQff5XbroWAGAzPvns84/6e3v3Ps7zLF7tPp0OkoiYPJ0Oqvn+g/gmxrEfd6MbRxHFsSr+4MO9e5Hmpe14azKbDsrMyZe/1vv3/4qY5+9GN7ZX5+/mleP8F5vq8ug/uNP80Y1XVue/czo/JrMYdOLtN5fq34lu/PZ1PIxx3I8yd5H//W6ev1/8+Oy7L8pjyvykFYOt+bqFor2hKwEAAAAAAAAAAAAAAAAAAAAA4BbYyfOkat8z799TDs3750wH7aP5/E7eWO7vM2v6AyXNRlV/oCLqFj2zIn5q+uvczfO8qBcu8tN4LfXDAgAAAAAAAAAAAAAAAAAAAFB6/O3BaDge7z9aS9B0A2i+1n/19D+y5ZHe0tQbcTAats/fcOvqZy13GyhrvXBxpGms6bFcFrxQ1rP2nbcWl/tpVEFzMWs96+X3qk0PRsO8nmoe8miYXHZW1lzcz8tTnbhmYZ26guLknWbHpZ7M6qzpaXReWjn1T1EUV9vn3T+rO6pHknmLjfF+evH/6jy4UwcrX2AZZGfv4pfFSHbqiHPfMtrXftMBAAAAAAAAAAAAAAAAAABWWnwfeMXkk3PT0oho/a+FAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAGLX7/vwmyiDg5ciaY1cmr1/SWRzrx6PENv0QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABugX8DAAD//40uSRo=") socket$inet6(0xa, 0x3, 0xff) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x1298c2, 0x0) ftruncate(r0, 0x200004) 124.249106ms ago: executing program 0 (id=15): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x14, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r3, r1, 0x25, 0x0, @val=@perf_event={0x200}}, 0x18) syz_emit_ethernet(0x3a, &(0x7f0000001c00)=ANY=[], 0x0) 112.631876ms ago: executing program 2 (id=16): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x2501, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x2, 0x8, 0x1, 0x41, 0xc3d, 0x0, 0x2004cb, 0xffffffffffffffff, 0xa1d, 0x8, 0x5, 0x79, 0x3, 0x2, 0x475], 0x3332d000, 0x80206}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_GET_CLOCK(r1, 0x8030ae7c, 0x0) ioctl$KVM_GET_REGS(r2, 0x8090ae81, &(0x7f0000000540)) 111.597286ms ago: executing program 4 (id=17): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120141014813442024040075ee69010203010902240001000010000904b8070259d1ca000905060200020d0006090582020002"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000140)={0x40, 0x15, 0x4, "84bd00a9"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000080)={0x44, &(0x7f0000000200)={0x0, 0xc, 0x4, "da9483aa"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000740)={0x44, &(0x7f0000000000)=ANY=[@ANYBLOB="601004"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000800)={0x44, &(0x7f0000000380)={0x0, 0xf, 0x6, "0cfd053a573b"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 0s ago: executing program 1 (id=18): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) close(r0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r0, &(0x7f0000000140)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x0, 0x6, 0x1, {0xa, 0x4e23, 0x1, @mcast2, 0x9}}}, 0x3a) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) ioctl$PPPIOCGFLAGS(r2, 0x8004745a, &(0x7f0000000200)) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.35' (ED25519) to the list of known hosts. [ 22.547265][ T24] audit: type=1400 audit(1782157278.370:64): avc: denied { mounton } for pid=271 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.551992][ T271] cgroup: Unknown subsys name 'net' [ 22.570485][ T24] audit: type=1400 audit(1782157278.370:65): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.598695][ T24] audit: type=1400 audit(1782157278.410:66): avc: denied { unmount } for pid=271 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.599425][ T271] cgroup: Unknown subsys name 'devices' [ 22.742562][ T271] cgroup: Unknown subsys name 'hugetlb' [ 22.748412][ T271] cgroup: Unknown subsys name 'rlimit' [ 22.864294][ T24] audit: type=1400 audit(1782157278.690:67): avc: denied { setattr } for pid=271 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.887713][ T24] audit: type=1400 audit(1782157278.690:68): avc: denied { mounton } for pid=271 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.912646][ T24] audit: type=1400 audit(1782157278.690:69): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.935328][ T273] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 22.944848][ T24] audit: type=1400 audit(1782157278.780:70): avc: denied { relabelto } for pid=273 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.970775][ T24] audit: type=1400 audit(1782157278.780:71): avc: denied { write } for pid=273 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.996973][ T24] audit: type=1400 audit(1782157278.800:72): avc: denied { read } for pid=271 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.997487][ T271] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.023334][ T24] audit: type=1400 audit(1782157278.800:73): avc: denied { open } for pid=271 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.539188][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.546699][ T279] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.554390][ T279] device bridge_slave_0 entered promiscuous mode [ 23.562710][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.569787][ T279] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.577423][ T279] device bridge_slave_1 entered promiscuous mode [ 23.644570][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.651672][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.659368][ T281] device bridge_slave_0 entered promiscuous mode [ 23.679948][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.687176][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.694975][ T281] device bridge_slave_1 entered promiscuous mode [ 23.730653][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.738648][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.746311][ T282] device bridge_slave_0 entered promiscuous mode [ 23.753528][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.760859][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.768266][ T282] device bridge_slave_1 entered promiscuous mode [ 23.816676][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.824094][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.831813][ T283] device bridge_slave_0 entered promiscuous mode [ 23.839074][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.846214][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.853664][ T283] device bridge_slave_1 entered promiscuous mode [ 23.890810][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.897969][ T280] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.905751][ T280] device bridge_slave_0 entered promiscuous mode [ 23.932786][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.940462][ T280] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.947933][ T280] device bridge_slave_1 entered promiscuous mode [ 24.015645][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.022871][ T279] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.051226][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.058616][ T282] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.066169][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.073786][ T282] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.101645][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.108907][ T283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.116576][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.123823][ T283] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.140658][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.148013][ T280] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.155494][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.162556][ T280] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.188348][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.195490][ T281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.203077][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.210133][ T281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.227435][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.234799][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.242606][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.250180][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.258445][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.267167][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.274640][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.282159][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.289939][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.297614][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.323808][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.331690][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.340104][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.347301][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.355982][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.364667][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.372233][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.379989][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.387839][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.405254][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.413707][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.421128][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.428653][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.437341][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.445697][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.471708][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.480514][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.488971][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.496578][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.504562][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.512933][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.521420][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.528800][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.536277][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.544380][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.553450][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.562040][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.569330][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.576877][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.585217][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.592635][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.600075][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.608497][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.615577][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.623535][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.632214][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.639233][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.656454][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.665110][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.673539][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.682596][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.691882][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.700045][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.712822][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.721475][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.735312][ T282] device veth0_vlan entered promiscuous mode [ 24.748086][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.756344][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.765515][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.774100][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.782425][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.792964][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.802168][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.810304][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.818427][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.826315][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.845035][ T280] device veth0_vlan entered promiscuous mode [ 24.855199][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.863763][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.872113][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.881068][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.889384][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.898584][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.907426][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.914940][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.922767][ T282] device veth1_macvtap entered promiscuous mode [ 24.938324][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.946211][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.955050][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.964887][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.974843][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.983127][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.990813][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.004917][ T279] device veth0_vlan entered promiscuous mode [ 25.019339][ T281] device veth0_vlan entered promiscuous mode [ 25.025765][ T283] device veth0_vlan entered promiscuous mode [ 25.033650][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.043470][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.052049][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.060071][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.068451][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.077892][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.087252][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.097176][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.106319][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.114706][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.124252][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.131914][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.140788][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.148471][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.158569][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.172228][ T280] device veth1_macvtap entered promiscuous mode [ 25.181293][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.189782][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.212818][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.221321][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.221891][ T282] request_module fs-gadgetfs succeeded, but still no fs? [ 25.233345][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.247097][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.255897][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.264743][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.274733][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.283667][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.293490][ T279] device veth1_macvtap entered promiscuous mode [ 25.300747][ T283] device veth1_macvtap entered promiscuous mode [ 25.308723][ T281] device veth1_macvtap entered promiscuous mode [ 25.316173][ T282] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 25.328581][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.337077][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.345916][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.358406][ T301] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.385506][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.394900][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.405458][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.414431][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.423535][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.432789][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.441492][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.449846][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.516317][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.535984][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.545244][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.554512][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.140443][ T330] device syzkaller0 entered promiscuous mode [ 26.153084][ T336] ====================================================== [ 26.153084][ T336] WARNING: the mand mount option is being deprecated and [ 26.153084][ T336] will be removed in v5.15! [ 26.153084][ T336] ====================================================== [ 26.790677][ C1] ================================================================== [ 26.799241][ C1] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x6c/0xb0 [ 26.808140][ C1] Read of size 8 at addr ffff88811111ad90 by task ksoftirqd/1/19 [ 26.815884][ C1] [ 26.818697][ C1] CPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted syzkaller #0 [ 26.826097][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 26.836293][ C1] Call Trace: [ 26.839618][ C1] __dump_stack+0x21/0x24 [ 26.843982][ C1] dump_stack_lvl+0x1a7/0x208 [ 26.849219][ C1] ? show_regs_print_info+0x18/0x18 [ 26.854443][ C1] ? thaw_kernel_threads+0x220/0x220 [ 26.859758][ C1] print_address_description+0x7f/0x2c0 [ 26.865419][ C1] ? rcu_cblist_dequeue+0x6c/0xb0 [ 26.870551][ T304] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 26.870563][ C1] kasan_report+0x100/0x140 [ 26.870610][ C1] ? rcu_cblist_dequeue+0x6c/0xb0 [ 26.887584][ C1] __asan_report_load8_noabort+0x14/0x20 [ 26.893331][ C1] rcu_cblist_dequeue+0x6c/0xb0 [ 26.898293][ C1] rcu_do_batch+0x448/0xaf0 [ 26.902822][ C1] ? local_bh_enable+0x20/0x20 [ 26.907703][ C1] rcu_core+0x50a/0xca0 [ 26.911882][ C1] ? __kfree_skb_flush+0xc5/0x120 [ 26.917062][ C1] ? net_rx_action+0xe1f/0xed0 [ 26.921977][ C1] ? rcu_cpu_kthread_park+0x90/0x90 [ 26.927193][ C1] ? __this_cpu_preempt_check+0x13/0x20 [ 26.932762][ C1] ? rcu_softirq_qs+0xd5/0x1d0 [ 26.937638][ C1] ? rcu_get_gp_kthreads_prio+0x10/0x10 [ 26.943321][ C1] rcu_core_si+0x9/0x10 [ 26.947615][ C1] __do_softirq+0x255/0x563 [ 26.952203][ C1] ? ksoftirqd_should_run+0x20/0x20 [ 26.957538][ C1] run_ksoftirqd+0x23/0x30 [ 26.961980][ C1] smpboot_thread_fn+0x464/0x820 [ 26.966948][ C1] kthread+0x324/0x3b0 [ 26.971045][ C1] ? cpu_report_death+0x1b0/0x1b0 [ 26.976202][ C1] ? kthread_blkcg+0xd0/0xd0 [ 26.981150][ C1] ret_from_fork+0x1f/0x30 [ 26.985673][ C1] [ 26.988027][ C1] Allocated by task 352: [ 26.992297][ C1] __kasan_kmalloc+0xd4/0x100 [ 26.996998][ C1] __kmalloc+0x19f/0x330 [ 27.001265][ C1] l2tp_session_create+0x39/0xb60 [ 27.006304][ C1] pppol2tp_connect+0xbf5/0x1640 [ 27.011256][ C1] __sys_connect+0x3ce/0x450 [ 27.016076][ C1] __x64_sys_connect+0x7a/0x90 [ 27.020858][ C1] do_syscall_64+0x31/0x40 [ 27.025869][ C1] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 27.032961][ C1] [ 27.035404][ C1] Freed by task 313: [ 27.039516][ C1] kasan_set_track+0x4a/0x70 [ 27.044311][ C1] kasan_set_free_info+0x23/0x40 [ 27.049290][ C1] ____kasan_slab_free+0x125/0x160 [ 27.054437][ C1] __kasan_slab_free+0x11/0x20 [ 27.059232][ C1] slab_free_freelist_hook+0xc5/0x190 [ 27.064716][ C1] kfree+0xc0/0x270 [ 27.068564][ C1] l2tp_session_put+0xb2/0x1a0 [ 27.073540][ C1] l2tp_session_delete+0x3a9/0x4a0 [ 27.078698][ C1] l2tp_tunnel_del_work+0x180/0x3d0 [ 27.083961][ C1] process_one_work+0x6fd/0xbc0 [ 27.088925][ C1] worker_thread+0xa8e/0x13c0 [ 27.093610][ C1] kthread+0x324/0x3b0 [ 27.097719][ C1] ret_from_fork+0x1f/0x30 [ 27.102133][ C1] [ 27.104464][ C1] Last potentially related work creation: [ 27.110194][ C1] kasan_save_stack+0x3a/0x60 [ 27.115098][ C1] __kasan_record_aux_stack+0xd2/0x100 [ 27.120649][ C1] kasan_record_aux_stack_noalloc+0xb/0x10 [ 27.126469][ C1] call_rcu+0x11a/0x1090 [ 27.130817][ C1] pppol2tp_release+0x1e3/0x2b0 [ 27.135700][ C1] sock_close+0xb8/0x200 [ 27.139945][ C1] __fput+0x2dc/0x730 [ 27.143938][ C1] ____fput+0x15/0x20 [ 27.147932][ C1] task_work_run+0x127/0x190 [ 27.152703][ C1] exit_to_user_mode_loop+0xcb/0xe0 [ 27.157997][ C1] exit_to_user_mode_prepare+0x76/0xa0 [ 27.163468][ C1] syscall_exit_to_user_mode+0x1d/0x40 [ 27.169220][ C1] do_syscall_64+0x3d/0x40 [ 27.173656][ C1] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 27.179551][ C1] [ 27.181895][ C1] The buggy address belongs to the object at ffff88811111ac00 [ 27.181895][ C1] which belongs to the cache kmalloc-512 of size 512 [ 27.196717][ C1] The buggy address is located 400 bytes inside of [ 27.196717][ C1] 512-byte region [ffff88811111ac00, ffff88811111ae00) [ 27.210309][ C1] The buggy address belongs to the page: [ 27.216079][ C1] page:ffffea0004444600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x111118 [ 27.226484][ C1] head:ffffea0004444600 order:2 compound_mapcount:0 compound_pincount:0 [ 27.234851][ C1] flags: 0x4000000000010200(slab|head) [ 27.240532][ C1] raw: 4000000000010200 ffffea000443e800 0000000400000004 ffff888100043080 [ 27.250334][ C1] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 27.259061][ C1] page dumped because: kasan: bad access detected [ 27.265978][ C1] page_owner tracks the page as allocated [ 27.271823][ C1] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 101, ts 6771431717, free_ts 0 [ 27.290076][ C1] prep_new_page+0x176/0x190 [ 27.295101][ C1] get_page_from_freelist+0x225f/0x23f0 [ 27.300875][ C1] __alloc_pages_nodemask+0x29a/0x640 [ 27.306284][ C1] new_slab+0x84/0x3f0 [ 27.310368][ C1] ___slab_alloc+0x2f8/0x4c0 [ 27.314965][ C1] __slab_alloc+0x63/0xa0 [ 27.319299][ C1] __kmalloc_track_caller+0x1e4/0x310 [ 27.324679][ C1] __alloc_skb+0xdc/0x520 [ 27.329120][ C1] alloc_skb_with_frags+0xa3/0x560 [ 27.334233][ C1] sock_alloc_send_pskb+0x87f/0x9a0 [ 27.339712][ C1] unix_dgram_sendmsg+0x6f3/0x18f0 [ 27.345107][ C1] sock_write_iter+0x2a6/0x3a0 [ 27.350226][ C1] vfs_write+0x770/0xd70 [ 27.355534][ C1] ksys_write+0x14a/0x260 [ 27.360213][ C1] __x64_sys_write+0x7b/0x90 [ 27.364835][ C1] do_syscall_64+0x31/0x40 [ 27.369358][ C1] page_owner free stack trace missing [ 27.375354][ C1] [ 27.377693][ C1] Memory state around the buggy address: [ 27.383574][ C1] ffff88811111ac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.392341][ C1] ffff88811111ad00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.400862][ C1] >ffff88811111ad80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.409018][ C1] ^ [ 27.413875][ C1] ffff88811111ae00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.422114][ C1] ffff88811111ae80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.430428][ C1] ================================================================== [ 27.438665][ C1] Disabling lock debugging due to kernel taint [ 27.560620][ T304] usb 4-1: too many endpoints for config 1 interface 0 altsetting 13: 65, using maximum allowed: 30 [ 27.572312][ T304] usb 4-1: config 1 interface 0 altsetting 13 has 1 endpoint descriptor, different from the interface descriptor's value: 65 [ 27.587625][ T304] usb 4-1: config 1 interface 0 has no altsetting 0 [ 27.630538][ T305] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 27.830479][ T304] usb 4-1: string descriptor 0 read error: -22 [ 27.836973][ T304] usb 4-1: New USB device found, idVendor=0757, idProduct=0a00, bcdDevice= 0.40 [ 27.846466][ T304] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.870469][ T305] usb 5-1: Using ep0 maxpacket: 32 [ 27.990586][ T305] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 27.999365][ T305] usb 5-1: config 0 has no interface number 0 [ 28.005659][ T305] usb 5-1: config 0 interface 184 has no altsetting 0 [ 28.170553][ T305] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 28.179839][ T305] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.187940][ T305] usb 5-1: Product: syz [ 28.192196][ T305] usb 5-1: Manufacturer: syz [ 28.196870][ T305] usb 5-1: SerialNumber: syz [ 28.202295][ T305] usb 5-1: config 0 descriptor?? [ 28.241020][ T305] smsc75xx v1.0.0 [ 28.451559][ T304] nti 0003:0757:0A00.0001: unknown main item tag 0x0 [ 28.458371][ T304] nti 0003:0757:0A00.0001: unknown main item tag 0x0 [ 28.465926][ T304] nti 0003:0757:0A00.0001: unknown main item tag 0x0 [ 28.473281][ T304] nti 0003:0757:0A00.0001: unknown main item tag 0x0 [ 28.480165][ T304] nti 0003:0757:0A00.0001: unknown main item tag 0x0 [ 28.487072][ T304] nti 0003:0757:0A00.0001: unknown main item tag 0x0 [ 28.494084][ T304] nti 0003:0757:0A00.0001: unknown main item tag 0x0 [ 28.501334][ T304] nti 0003:0757:0A00.0001: unknown main item tag 0x0 [ 28.508596][ T304] nti 0003:0757:0A00.0001: unknown main item tag 0x0 [ 28.515388][ T304] nti 0003:0757:0A00.0001: unknown main item tag 0x0 [ 28.522665][ T304] nti 0003:0757:0A00.0001: global environment stack underflow [ 28.531239][ T304] nti 0003:0757:0A00.0001: item 0 1 1 11 parsing failed [ 28.538542][ T304] nti: probe of 0003:0757:0A00.0001 failed with error -22 [ 28.652374][ T304] usb 4-1: USB disconnect, device number 2 [ 28.890565][ T305] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 28.901931][ T305] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 29.820510][ T305] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 29.831633][ T305] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 29.841464][ T305] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 29.852177][ T305] smsc75xx: probe of 5-1:0.184 failed with error -71 [ 29.860392][ T305] usb 5-1: USB disconnect, device number 2