last executing test programs: 2.500784069s ago: executing program 0 (id=125): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, 0x0) r1 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) keyctl$chown(0x4, r1, 0xee01, 0x0) r2 = openat(0xffffffffffffff9c, 0x0, 0x10042, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x2) truncate(&(0x7f00000000c0)='./file1\x00', 0x5) pwrite64(r2, &(0x7f0000000000)="4b98", 0x2, 0x2) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) inotify_init1(0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x143042, 0x80) pwritev2(r3, &(0x7f0000000100), 0x0, 0x5405, 0x0, 0x0) copy_file_range(r4, &(0x7f0000000040)=0x8, r4, 0x0, 0x6, 0x0) read$msr(r3, &(0x7f0000032680)=""/102392, 0x18ff8) ioctl$F2FS_IOC_RELEASE_COMPRESS_BLOCKS(0xffffffffffffffff, 0x8008f512, 0x0) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_int(r5, 0x29, 0x50, 0x0, &(0x7f0000000680)) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x80) 2.500537639s ago: executing program 4 (id=126): ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'vlan1\x00'}) sendto$packet(r1, &(0x7f0000000180)="02030e00d3fc02000000ab5d71b9edd7c9560385dc", 0x15, 0x800, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000cd03000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0xedf0e51957efc755, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r0}, &(0x7f0000000240), &(0x7f0000000380)=r2}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={r2, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000040)="7638300c000400000000e900f377", 0x0, 0x2f000000, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) 2.251475915s ago: executing program 2 (id=128): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x34, r1, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x20, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffff}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x48c05}, 0x4040140) 2.201541006s ago: executing program 0 (id=129): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./mysys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x2a5b091, 0x0) mount$bind(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x84000, 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x145091, 0x0) umount2(&(0x7f00000000c0)='./file0/../file0\x00', 0x2) 2.201097856s ago: executing program 2 (id=130): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000005cc0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x38, 0x3, 0x1, 0x301, 0x0, 0x0, {0xa, 0x0, 0x2}, [@CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x409}]}, @CTA_TUPLE_ORIG={0x18, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @loopback}}}]}]}, 0x38}}, 0x4000) 2.187173416s ago: executing program 0 (id=133): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$inet6(0xffffffffffffffff, 0x0, 0x54) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000580)={'veth0_to_team\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[], 0x48) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000004c0)={r0, r2, 0x25, 0x0, @void}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r3 = socket(0x10, 0x803, 0x0) socket(0x2, 0xa, 0x300) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000140)={'veth0_to_team\x00', &(0x7f0000000280)=@ethtool_channels={0x3d, 0x0, 0x0, 0x0, 0x4, 0x2, 0x1}}) unshare(0x62040200) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000040)={'veth0_to_team\x00', 0x800}) 1.899015773s ago: executing program 3 (id=134): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000780), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x1c, r1, 0x5, 0x0, 0x1fffe, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}}, 0x0) 1.785666776s ago: executing program 2 (id=135): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000a40)={&(0x7f0000000880)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x64, 0x64, 0x2, [@float={0x8, 0x0, 0x0, 0x10, 0x8}, @enum={0xb, 0x2, 0x0, 0x6, 0x4, [{0xa, 0xb}, {0x3, 0x1}]}, @func={0xb, 0x0, 0x0, 0xc, 0x2}, @enum64={0xf, 0x3, 0x0, 0x13, 0x1, 0x4, [{0xb, 0x6}, {0xa, 0xc69, 0x8}, {0xc, 0xa53, 0x9}]}]}}, &(0x7f0000000940)=""/211, 0x7e, 0xd3, 0x1, 0xc8ee}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="190000000400000004000000"], 0x50) 1.785311776s ago: executing program 2 (id=136): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000140)={'team0\x00', @multicast}) recvmmsg(r0, &(0x7f00000004c0), 0xf02, 0xf0, 0x0) 1.105562542s ago: executing program 1 (id=137): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x8e40, 0x0) close(r1) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r6, {0x4}, {0xffff}, {0x2, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x5, [0xc, 0x9, 0x0, 0xf, 0x10, 0x2, 0x6, 0x2, 0x8, 0x2, 0x0, 0x1, 0x8, 0x1, 0x10, 0x4], 0x3, [0xc, 0x101, 0x7fff, 0x2002, 0x1, 0x4, 0x6, 0xd03, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0xfffd, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x7, 0x2a, 0x401, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x4]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x810}, 0x0) r7 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r7, 0x0, 0x0, 0x48040, &(0x7f00000001c0)={0x11, 0x7, r6, 0x1, 0x6, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r8) sendmsg$TIPC_CMD_ENABLE_BEARER(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) 1.092939783s ago: executing program 3 (id=138): fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x174}}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./trace/events/dwc3/dwc3_ctrl_req/inject\x00', 0x2, 0x0) write(r3, &(0x7f0000000100), 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/trace\x00', 0x0, 0x0) 1.029336694s ago: executing program 2 (id=139): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, 0x0) r1 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) keyctl$chown(0x4, r1, 0xee01, 0x0) r2 = openat(0xffffffffffffff9c, 0x0, 0x10042, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x2) truncate(&(0x7f00000000c0)='./file1\x00', 0x5) pwrite64(r2, &(0x7f0000000000)="4b98", 0x2, 0x2) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r4, 0x0, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f00000006c0)='.\x00', 0xaa) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x143042, 0x80) pwritev2(r3, &(0x7f0000000100), 0x0, 0x5405, 0x0, 0x0) copy_file_range(r5, &(0x7f0000000040)=0x8, r5, 0x0, 0x6, 0x0) read$msr(r3, &(0x7f0000032680)=""/102392, 0x18ff8) ioctl$F2FS_IOC_RELEASE_COMPRESS_BLOCKS(0xffffffffffffffff, 0x8008f512, 0x0) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_int(r6, 0x29, 0x50, 0x0, &(0x7f0000000680)) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x80) 1.028815954s ago: executing program 4 (id=140): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, 0x0) r1 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) keyctl$chown(0x4, r1, 0xee01, 0x0) r2 = openat(0xffffffffffffff9c, 0x0, 0x10042, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x2) truncate(&(0x7f00000000c0)='./file1\x00', 0x5) pwrite64(r2, &(0x7f0000000000)="4b98", 0x2, 0x2) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) bind$bt_l2cap(0xffffffffffffffff, 0x0, 0x0) inotify_init1(0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x143042, 0x80) pwritev2(r3, &(0x7f0000000100), 0x0, 0x5405, 0x0, 0x0) copy_file_range(r4, &(0x7f0000000040)=0x8, r4, 0x0, 0x6, 0x0) read$msr(r3, &(0x7f0000032680)=""/102392, 0x18ff8) ioctl$F2FS_IOC_RELEASE_COMPRESS_BLOCKS(0xffffffffffffffff, 0x8008f512, 0x0) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_int(r5, 0x29, 0x50, 0x0, &(0x7f0000000680)) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x80) 680.481993ms ago: executing program 2 (id=141): fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x174}}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./trace/events/dwc3/dwc3_ctrl_req/inject\x00', 0x2, 0x0) write(r3, &(0x7f0000000100), 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/trace\x00', 0x0, 0x0) 628.080454ms ago: executing program 1 (id=142): socket$nl_generic(0x10, 0x3, 0x10) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000340)=0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x108}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) syz_io_uring_setup(0x867, &(0x7f0000000140)={0x0, 0x9164, 0x1000, 0x1, 0x359}, &(0x7f00000002c0), &(0x7f0000ff4000), &(0x7f0000000000)) syz_clone(0x500, 0x0, 0x0, 0x0, 0x0, 0x0) close_range(r1, r1, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000001, &(0x7f0000000300)={0xa, 0x4e20, 0x5, @mcast1}, 0x1c) 585.550155ms ago: executing program 0 (id=143): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r0) socket$inet_icmp(0x2, 0x2, 0x1) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x10) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x9}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40480c0}, 0x20040084) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=@newtfilter={0x44, 0x2c, 0xd27, 0x170bd2c, 0x2, {0x0, 0x0, 0x0, 0x0, {0x2, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1a2a1}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4894}, 0x2) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r6, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r6, &(0x7f00000002c0)="05031c00d1fd140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r7, 0x1, 0x0, 0x6, @multicast}, 0x14) 304.554672ms ago: executing program 1 (id=144): bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r0) socket$inet_icmp(0x2, 0x2, 0x1) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x9}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40480c0}, 0x20040084) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=@newtfilter={0x44, 0x2c, 0xd27, 0x170bd2c, 0x2, {0x0, 0x0, 0x0, r6, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x114c6}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4894}, 0x2) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r7, &(0x7f00000002c0)="05031c00d1fd140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r8, 0x1, 0x0, 0x6, @multicast}, 0x14) 289.378432ms ago: executing program 4 (id=145): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x5, 0xb, &(0x7f0000000a00)=ANY=[@ANYBLOB="1804000000000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000ae00000095"], &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94) 261.283443ms ago: executing program 4 (id=146): r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000080)="441f1f01000000e8c94ef56491ee54be0e1c2074ed27c1c6fe76cef3e2", 0x1d) 260.896483ms ago: executing program 4 (id=147): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x8031, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff4000/0xa000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000002000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x20044185) io_uring_setup(0x27, &(0x7f0000000040)={0x0, 0x400c8a1, 0xc000, 0x8, 0x3a8}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) 260.183833ms ago: executing program 0 (id=148): sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0x1, 0xb}, {0xffff, 0xfffd}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x240448a4}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r4, &(0x7f00000002c0)="05031c00d3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 221.679024ms ago: executing program 3 (id=149): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x6, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="18020000fdffffff0000000000000000850000002c00000095"], &(0x7f0000000040)='GPL\x00', 0x5}, 0x94) mount(0x0, 0x0, &(0x7f0000000300)='configfs\x00', 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000500)={r1, r2, 0x25, 0x0, @val=@iter={0x0}}, 0x20) syz_emit_ethernet(0xfdef, &(0x7f0000000300)=ANY=[], 0x0) 161.821716ms ago: executing program 1 (id=150): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f0000000900)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9135a01c95d4a128ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080), 0xffffffffffffffa9, 0xc9100120, 0x0, 0x1500) shutdown(r0, 0x1) 161.481785ms ago: executing program 3 (id=151): r0 = memfd_create(&(0x7f0000000440)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x9a\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00uKs\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x141<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\xb7>j0S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ\x00'/1136, 0xc) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, &(0x7f00000000c0)="f31fbd0d660f2a630066b8000000000f23d80f21f86635000000000f23f8b80d008ed82e667c75f364b646660fc735b800008ee866b9ff03000066ba000000000f3066b9bb0800000f32", 0x4a}], 0x1, 0x55, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00'}) ioctl$KVM_RUN(r3, 0xae80, 0x0) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x2000003, 0x97052, r0, 0x0) 102.876217ms ago: executing program 0 (id=152): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0x7fffffffffffffff, 0x0, 0x1000, 0xc, 0x215}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) close(0xffffffffffffffff) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdc01, {0x0, 0x0, 0x0, r7, {0x0, 0x1}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_codel={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000004}, 0x4890) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 95.023177ms ago: executing program 4 (id=153): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x40, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x5, 0x7, 0xb3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4008004}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)=@newqdisc={0x58, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xffffbddc, {0x0, 0x0, 0x0, r5, {0x10}, {}, {0xe, 0x1}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x200000, 0xe, 0x7, 0x7, 0x9, 0x40, 0xffffffff, 0x2}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4040098}, 0x4000) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r7, &(0x7f0000000140)="bad330fbc9b5544972e7a5ea0756", 0x36, 0x40, &(0x7f00000001c0)={0x11, 0x1a, r6, 0x1, 0xd8, 0x6, @random="98c8ca7122df"}, 0x14) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendto$packet(r7, &(0x7f0000000540)="f4efe0430444425a1a9942a2f606", 0xe, 0x0, &(0x7f0000000640)={0x11, 0x4, r10, 0x1, 0xff, 0x6, @remote}, 0x14) sendmsg$nl_route_sched(r8, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000002980)=@newqdisc={0x434, 0x29, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r10, {0x10}, {0x0, 0xfff1}, {0x2, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x7, 0x3, 0x6, 0x5, 0xa8e, 0x5, 0x407c, 0x80, 0x9, 0x3, 0x8000, 0x8, 0x3, 0x8, 0x5, 0xbc0, 0x7, 0x9c09, 0xffff, 0x3, 0x0, 0xc, 0xcfa, 0x5, 0xa, 0x6407, 0x80, 0x849, 0x8b, 0xffffffff, 0x4, 0x2, 0xa4c, 0x0, 0x9, 0x5, 0x200, 0x1ff, 0x4d76, 0x4, 0xb32, 0x3ff, 0x8, 0x0, 0x71, 0x5, 0x1, 0x8, 0x0, 0x7, 0xeb, 0x6, 0x87, 0x8, 0x0, 0x9, 0x3ff, 0xb, 0xfffffff8, 0xb6d, 0x81, 0x1, 0x8, 0xa, 0x0, 0x9, 0x81, 0x8, 0x26b, 0x8, 0x85b4, 0x9, 0x7, 0xfffffffe, 0x6, 0x8, 0xffffffc0, 0x3, 0x3, 0x4, 0x4, 0x80000001, 0xc8ee, 0xbacb161, 0x3ff, 0xffff12d0, 0x2, 0xffff8000, 0x10, 0x1ff, 0x2, 0x5, 0x2, 0x8, 0x7, 0x4, 0x2, 0x0, 0x1, 0x5, 0xfffffffd, 0x6, 0x0, 0x9, 0x8, 0x5, 0x6, 0xfffffffe, 0x2, 0x834f, 0x9, 0x1ff, 0x2, 0x62cd, 0xf98, 0xd8, 0x6, 0x6, 0x9, 0x3, 0xfffff000, 0x40000000, 0x7, 0x81, 0x0, 0x5, 0x10, 0x100, 0x40, 0xc, 0x400, 0x9151, 0x6, 0x7, 0x2, 0xb, 0x7, 0x4, 0x4, 0x64, 0x9, 0x400, 0x2, 0x6, 0x7, 0x971, 0x0, 0x6, 0x3, 0xa46a, 0x8, 0x23, 0x2, 0x8, 0x7fff, 0x8, 0x1, 0x557, 0x2, 0x3ff, 0x3ff, 0x2, 0x1, 0x1, 0x5c, 0x6, 0x1ff, 0x9, 0xb, 0x6, 0x0, 0x7ff, 0x868f, 0x9, 0xffffffff, 0x0, 0xfffffffe, 0x100, 0x40, 0x6c8, 0x8, 0x4, 0x4, 0x4, 0x81, 0xdf, 0x8, 0x4, 0x6, 0x4, 0xc59e, 0x9, 0x891a, 0x4, 0x1, 0x67a, 0x5, 0xaa, 0x2, 0x8000, 0x4, 0x5, 0x2, 0xfff, 0x9, 0x4533afbb, 0xd, 0x0, 0x593c, 0x1, 0xd99b, 0x55aa77c9, 0x56a, 0x9, 0x8, 0x200, 0x10001, 0x5, 0x6, 0x1000, 0xa, 0x5, 0x6, 0x4, 0x1ff, 0x40, 0x2, 0x5dff, 0xfffffffe, 0x8, 0x1, 0x4, 0x4, 0x1ff, 0x101, 0xffff, 0x12, 0x5, 0xfffffffc, 0x7e94, 0x6, 0xca55, 0x2, 0x5, 0x401, 0x8, 0x4, 0x80000000, 0x3, 0x1, 0x7, 0x4, 0x2, 0x8, 0x16, 0x1]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0xb3538085985bb3d6}, 0x0) 1.175259ms ago: executing program 3 (id=154): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000700)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a20000000000a01030000000000000000010000000900010073797a310000000054000000030a0101fffffff900000000010000000900030073797a32000000002800048008000240752fafd908000140000000051400030076657468315f6d6163767461700000000900010073797a31000000004c000000050a01020000000000000000010020000c00024000000000000000010900010073797a310000000020000480140003"], 0xfc}}, 0x0) 819.36µs ago: executing program 1 (id=155): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x2}}, 0x2e) ioctl$PPPIOCGL2TPSTATS(r0, 0x80047453, 0x0) 336.829µs ago: executing program 3 (id=156): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x8e40, 0x0) close(r1) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r6, {0x4}, {0xffff}, {0x2, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x5, [0xc, 0x9, 0x0, 0xf, 0x10, 0x2, 0x6, 0x2, 0x8, 0x2, 0x0, 0x1, 0x8, 0x1, 0x10, 0x4], 0x3, [0xc, 0x101, 0x7fff, 0x2002, 0x1, 0x4, 0x6, 0xd03, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0xfffd, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x7, 0x2a, 0x401, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x4]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x810}, 0x0) r7 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r7, 0x0, 0x0, 0x48040, &(0x7f00000001c0)={0x11, 0x7, r6, 0x1, 0x6, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r8) sendmsg$TIPC_CMD_ENABLE_BEARER(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) 0s ago: executing program 1 (id=157): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, 0x0) r1 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) keyctl$chown(0x4, r1, 0xee01, 0x0) r2 = openat(0xffffffffffffff9c, 0x0, 0x10042, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x2) truncate(&(0x7f00000000c0)='./file1\x00', 0x5) pwrite64(r2, &(0x7f0000000000)="4b98", 0x2, 0x2) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r4, 0x0, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f00000006c0)='.\x00', 0xaa) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x143042, 0x80) pwritev2(r3, &(0x7f0000000100), 0x0, 0x5405, 0x0, 0x0) copy_file_range(r5, &(0x7f0000000040)=0x8, r5, 0x0, 0x6, 0x0) read$msr(r3, &(0x7f0000032680)=""/102392, 0x18ff8) ioctl$F2FS_IOC_RELEASE_COMPRESS_BLOCKS(0xffffffffffffffff, 0x8008f512, 0x0) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_int(r6, 0x29, 0x50, 0x0, &(0x7f0000000680)) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x80) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.64' (ED25519) to the list of known hosts. [ 21.272420][ T30] audit: type=1400 audit(1786650488.026:64): avc: denied { mounton } for pid=277 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.273582][ T277] cgroup: Unknown subsys name 'net' [ 21.295383][ T30] audit: type=1400 audit(1786650488.026:65): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.322999][ T30] audit: type=1400 audit(1786650488.056:66): avc: denied { unmount } for pid=277 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.323224][ T277] cgroup: Unknown subsys name 'devices' [ 21.499602][ T277] cgroup: Unknown subsys name 'hugetlb' [ 21.505258][ T277] cgroup: Unknown subsys name 'rlimit' [ 21.642637][ T30] audit: type=1400 audit(1786650488.396:67): avc: denied { setattr } for pid=277 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.666631][ T30] audit: type=1400 audit(1786650488.396:68): avc: denied { mounton } for pid=277 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 21.691507][ T30] audit: type=1400 audit(1786650488.396:69): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.700650][ T279] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 21.723856][ T30] audit: type=1400 audit(1786650488.476:70): avc: denied { relabelto } for pid=279 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.740982][ T277] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.749497][ T30] audit: type=1400 audit(1786650488.476:71): avc: denied { write } for pid=279 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.784045][ T30] audit: type=1400 audit(1786650488.496:72): avc: denied { read } for pid=277 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.809972][ T30] audit: type=1400 audit(1786650488.496:73): avc: denied { open } for pid=277 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.608810][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.616044][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.623862][ T285] device bridge_slave_0 entered promiscuous mode [ 22.643953][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.651027][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.658396][ T285] device bridge_slave_1 entered promiscuous mode [ 22.672585][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.679666][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.687233][ T287] device bridge_slave_0 entered promiscuous mode [ 22.695457][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.702562][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.709974][ T287] device bridge_slave_1 entered promiscuous mode [ 22.757190][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.764266][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.771927][ T288] device bridge_slave_0 entered promiscuous mode [ 22.780343][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.787380][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.794988][ T288] device bridge_slave_1 entered promiscuous mode [ 22.835482][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.842723][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.850125][ T286] device bridge_slave_0 entered promiscuous mode [ 22.856938][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.864062][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.871580][ T286] device bridge_slave_1 entered promiscuous mode [ 22.910795][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.918011][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.925615][ T289] device bridge_slave_0 entered promiscuous mode [ 22.935172][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.942485][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.950391][ T289] device bridge_slave_1 entered promiscuous mode [ 23.086160][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.093384][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.100691][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.107742][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.120223][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.127404][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.134779][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.141990][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.160329][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.167510][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.174792][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.181849][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.208110][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.215239][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.223051][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.230174][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.245678][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.252833][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.260295][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.267526][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.282799][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.290121][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.297608][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.304956][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.312367][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.319702][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.326886][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.334329][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.341839][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.349088][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.356772][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.364530][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.391099][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.399609][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.407901][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.414928][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.422580][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.431140][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.438578][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.446186][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.454467][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.461956][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.469467][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.477972][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.484993][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.507179][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.514918][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.523319][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.530603][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.538244][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.546732][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.553764][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.567771][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.575767][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.583854][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.604912][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.613370][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.621596][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.630303][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.638815][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.646731][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.654948][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.661974][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.686743][ T288] device veth0_vlan entered promiscuous mode [ 23.693094][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.701650][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.710198][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.717338][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.725227][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.733641][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.741960][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.749318][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.756904][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.765878][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.774384][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.782550][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.790826][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.798898][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.807109][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.815789][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.824019][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.831511][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.839012][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.847813][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.856634][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.864827][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.872802][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.881189][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.889330][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.896852][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.907763][ T285] device veth0_vlan entered promiscuous mode [ 23.920305][ T287] device veth0_vlan entered promiscuous mode [ 23.928365][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.936316][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.945031][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.954640][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.963870][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.972693][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.981234][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.988980][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.996648][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.004473][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.020722][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.029055][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.041954][ T288] device veth1_macvtap entered promiscuous mode [ 24.052307][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.060770][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.069127][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.078062][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.086685][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.096653][ T285] device veth1_macvtap entered promiscuous mode [ 24.106291][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.114717][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.127741][ T286] device veth0_vlan entered promiscuous mode [ 24.144602][ T287] device veth1_macvtap entered promiscuous mode [ 24.152107][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.160728][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.169500][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.178132][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.186474][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.194745][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.202920][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.212525][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.221321][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.229689][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.237917][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.245494][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.254222][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.262931][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.270645][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.280229][ T289] device veth0_vlan entered promiscuous mode [ 24.293710][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.302030][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.310610][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.319345][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.328103][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.335667][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.348487][ T286] device veth1_macvtap entered promiscuous mode [ 24.359316][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.368066][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.376638][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.388194][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.403575][ T288] request_module fs-gadgetfs succeeded, but still no fs? [ 24.417265][ T289] device veth1_macvtap entered promiscuous mode [ 24.437729][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.458525][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.471596][ T307] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.480580][ T307] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.489544][ T307] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.498366][ T307] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.538786][ T317] syz.0.1 (317) used greatest stack depth: 21736 bytes left [ 24.564328][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.573976][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.631591][ T324] netlink: 68 bytes leftover after parsing attributes in process `syz.3.4'. [ 25.044476][ T357] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.051925][ T357] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.204099][ T368] netlink: 'syz.3.23': attribute type 9 has an invalid length. [ 25.285024][ T370] tipc: Started in network mode [ 25.293740][ T370] tipc: Node identity 96f6cc27275, cluster identity 4711 [ 25.301172][ T370] tipc: Enabled bearer , priority 0 [ 25.307868][ T6] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 25.313996][ T372] netlink: 40 bytes leftover after parsing attributes in process `syz.3.25'. [ 25.332317][ T370] device syzkaller0 entered promiscuous mode [ 25.354552][ T369] tipc: Resetting bearer [ 25.366162][ T369] tipc: Disabling bearer [ 25.462554][ T389] device syzkaller0 entered promiscuous mode [ 25.492049][ T393] 9pnet_virtio: no channels available for device syz [ 25.520717][ T399] 9pnet_virtio: no channels available for device syz [ 25.549715][ T403] device syzkaller0 entered promiscuous mode [ 25.565712][ T403] tipc: Enabled bearer , priority 0 [ 25.574523][ T401] tipc: Resetting bearer [ 25.585809][ T401] tipc: Disabling bearer [ 25.698799][ T6] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 221 [ 25.751365][ T6] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 26.532274][ T30] kauditd_printk_skb: 108 callbacks suppressed [ 26.532336][ T30] audit: type=1400 audit(1786650493.266:182): avc: denied { mount } for pid=411 comm="syz.0.43" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 26.733415][ T424] device syzkaller0 entered promiscuous mode [ 26.744274][ T427] netlink: 12 bytes leftover after parsing attributes in process `syz.2.47'. [ 26.760323][ T30] audit: type=1400 audit(1786650493.266:183): avc: denied { search } for pid=411 comm="syz.0.43" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 26.787609][ T6] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 26.800534][ T6] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 26.807376][ T30] audit: type=1400 audit(1786650493.266:184): avc: denied { read } for pid=411 comm="syz.0.43" name="trace" dev="tracefs" ino=13068 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 26.808789][ T6] usb 2-1: Product: syz [ 26.808804][ T6] usb 2-1: Manufacturer: syz [ 26.808815][ T6] usb 2-1: SerialNumber: syz [ 26.867858][ T358] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 26.877162][ T30] audit: type=1400 audit(1786650493.276:185): avc: denied { open } for pid=411 comm="syz.0.43" path="/6/trace/trace" dev="tracefs" ino=13068 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 26.917121][ T30] audit: type=1400 audit(1786650493.456:186): avc: denied { unmount } for pid=288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 26.938356][ T442] device syzkaller0 entered promiscuous mode [ 26.938817][ T30] audit: type=1400 audit(1786650493.476:187): avc: denied { read } for pid=421 comm="syz.0.46" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 26.966075][ T30] audit: type=1400 audit(1786650493.526:188): avc: denied { read } for pid=429 comm="syz.3.48" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 26.966861][ T442] tipc: Started in network mode [ 26.986107][ T30] audit: type=1400 audit(1786650493.536:189): avc: denied { write } for pid=421 comm="syz.0.46" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 26.994252][ T442] tipc: Node identity 36cae9165191, cluster identity 4711 [ 27.010400][ T30] audit: type=1400 audit(1786650493.606:190): avc: denied { setopt } for pid=429 comm="syz.3.48" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 27.018795][ T442] tipc: Enabled bearer , priority 0 [ 27.036718][ T30] audit: type=1400 audit(1786650493.626:191): avc: denied { setopt } for pid=421 comm="syz.0.46" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 27.075756][ T440] tipc: Resetting bearer [ 27.086174][ T440] tipc: Disabling bearer [ 27.121919][ T6] usblp 2-1:1.0: usblp0: USB Unidirectional printer dev 2 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 28.120878][ T6] usb 2-1: USB disconnect, device number 2 [ 28.129098][ T6] usblp0: removed [ 28.361867][ T474] tipc: Started in network mode [ 28.378083][ T474] tipc: Node identity 9a3a6f6dd39d, cluster identity 4711 [ 28.395972][ T474] tipc: Enabled bearer , priority 0 [ 28.412940][ T473] tipc: Disabling bearer [ 28.427341][ T477] device syzkaller0 entered promiscuous mode [ 28.452404][ T485] device syzkaller0 entered promiscuous mode [ 28.473713][ T485] tipc: Enabled bearer , priority 0 [ 28.481388][ T484] tipc: Resetting bearer [ 28.488546][ T484] tipc: Disabling bearer [ 29.533573][ T508] netlink: 'syz.4.77': attribute type 3 has an invalid length. [ 29.663096][ T519] netlink: 8 bytes leftover after parsing attributes in process `syz.3.81'. [ 29.676504][ T517] device syzkaller0 entered promiscuous mode [ 29.684357][ T519] netlink: 8 bytes leftover after parsing attributes in process `syz.3.81'. [ 29.699536][ T522] device syzkaller0 entered promiscuous mode [ 29.711271][ T522] tipc: Started in network mode [ 29.716398][ T522] tipc: Node identity 9a461ee2804e, cluster identity 4711 [ 29.726810][ T522] tipc: Enabled bearer , priority 0 [ 29.739511][ T521] tipc: Resetting bearer [ 29.749716][ T521] tipc: Disabling bearer [ 29.759414][ T530] device syzkaller0 entered promiscuous mode [ 30.701024][ T541] netlink: 'syz.3.93': attribute type 16 has an invalid length. [ 30.768827][ T547] xt_hashlimit: size too large, truncated to 1048576 [ 30.919376][ T556] device syzkaller0 entered promiscuous mode [ 30.938331][ T560] device syzkaller0 entered promiscuous mode [ 30.965605][ T560] tipc: Enabled bearer , priority 0 [ 30.974257][ T564] device syzkaller0 entered promiscuous mode [ 31.000034][ T559] tipc: Resetting bearer [ 31.015064][ T559] tipc: Disabling bearer [ 31.944990][ T30] kauditd_printk_skb: 7 callbacks suppressed [ 31.945004][ T30] audit: type=1400 audit(1786650498.696:199): avc: denied { bind } for pid=572 comm="syz.3.105" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 31.952794][ T579] netlink: 8 bytes leftover after parsing attributes in process `syz.2.104'. [ 31.970850][ T30] audit: type=1400 audit(1786650498.696:200): avc: denied { connect } for pid=574 comm="syz.4.106" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 32.000465][ T30] audit: type=1400 audit(1786650498.736:201): avc: denied { ioctl } for pid=574 comm="syz.4.106" path="socket:[16083]" dev="sockfs" ino=16083 ioctlcmd=0x48c8 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 32.032153][ T584] netlink: 8 bytes leftover after parsing attributes in process `syz.2.104'. [ 32.238297][ T596] device syzkaller0 entered promiscuous mode [ 32.253482][ T30] audit: type=1400 audit(1786650498.986:202): avc: denied { getopt } for pid=578 comm="syz.2.104" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 32.276676][ T598] device syzkaller0 entered promiscuous mode [ 32.290777][ T30] audit: type=1400 audit(1786650498.986:203): avc: denied { read } for pid=578 comm="syz.2.104" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 32.324108][ T598] tipc: Enabled bearer , priority 0 [ 32.331638][ T600] device syzkaller0 entered promiscuous mode [ 32.339756][ T597] tipc: Resetting bearer [ 32.347259][ T597] tipc: Disabling bearer [ 33.327602][ T30] audit: type=1400 audit(1786650500.076:204): avc: denied { getopt } for pid=611 comm="syz.3.118" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 33.573945][ T30] audit: type=1400 audit(1786650500.326:205): avc: denied { mount } for pid=636 comm="syz.0.129" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 33.625020][ T30] audit: type=1400 audit(1786650500.366:206): avc: denied { unmount } for pid=636 comm="syz.0.129" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 34.384257][ T30] audit: type=1400 audit(1786650500.376:207): avc: denied { unmount } for pid=285 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 34.697436][ C0] sched: RT throttling activated [ 34.720200][ T651] device syzkaller0 entered promiscuous mode [ 34.746578][ T651] tipc: Enabled bearer , priority 0 [ 34.906120][ T657] syz.0.133 uses obsolete (PF_INET,SOCK_PACKET) [ 34.923949][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 35.048655][ T650] tipc: Resetting bearer [ 35.117824][ T650] tipc: Disabling bearer [ 35.322298][ T670] device syzkaller0 entered promiscuous mode [ 35.509435][ T677] device syzkaller0 entered promiscuous mode [ 35.566383][ T685] device syzkaller0 entered promiscuous mode [ 35.617351][ T30] audit: type=1400 audit(1786650502.366:208): avc: denied { read } for pid=690 comm="syz.3.151" name="kvm" dev="devtmpfs" ino=82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 35.636020][ T691] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 35.738612][ T699] device syzkaller0 entered promiscuous mode [ 35.750675][ T696] device syzkaller0 entered promiscuous mode [ 35.765747][ T696] tipc: Started in network mode [ 35.780907][ T696] tipc: Node identity c2f41d05e7bd, cluster identity 4711 [ 35.792655][ T696] tipc: Enabled bearer , priority 0 [ 35.810713][ C0] ================================================================== [ 35.818796][ C0] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x6c/0xb0 [ 35.826168][ C0] Read of size 8 at addr ffff88811ab43590 by task syz.2.141/665 [ 35.833890][ C0] [ 35.836312][ C0] CPU: 0 PID: 665 Comm: syz.2.141 Not tainted syzkaller #0 [ 35.843496][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 35.853551][ C0] Call Trace: [ 35.857070][ C0] [ 35.859918][ C0] __dump_stack+0x21/0x30 [ 35.864406][ C0] dump_stack_lvl+0x110/0x170 [ 35.869074][ C0] ? show_regs_print_info+0x20/0x20 [ 35.874269][ C0] ? load_image+0x3f0/0x3f0 [ 35.878762][ C0] print_address_description+0x7f/0x2c0 [ 35.884503][ C0] ? rcu_cblist_dequeue+0x6c/0xb0 [ 35.889629][ C0] kasan_report+0x10f/0x150 [ 35.894570][ C0] ? rcu_cblist_dequeue+0x6c/0xb0 [ 35.899593][ C0] __asan_report_load8_noabort+0x14/0x20 [ 35.905312][ C0] rcu_cblist_dequeue+0x6c/0xb0 [ 35.910332][ C0] rcu_do_batch+0x47d/0xbf0 [ 35.915024][ C0] ? local_bh_enable+0x20/0x20 [ 35.919777][ C0] ? __kasan_check_write+0x14/0x20 [ 35.925140][ C0] ? _raw_spin_lock+0xf0/0xf0 [ 35.929832][ C0] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 35.935630][ C0] ? rcu_report_qs_rnp+0x2bc/0x390 [ 35.941475][ C0] rcu_core+0x4a3/0xef0 [ 35.945657][ C0] ? rcu_cpu_kthread_park+0x90/0x90 [ 35.950847][ C0] ? sched_clock_cpu+0x18/0x3d0 [ 35.955841][ C0] ? irqtime_account_irq+0x76/0x390 [ 35.961390][ C0] rcu_core_si+0x9/0x10 [ 35.965624][ C0] handle_softirqs+0x250/0x560 [ 35.970733][ C0] ? irqtime_account_irq+0xbe/0x390 [ 35.976177][ C0] __irq_exit_rcu+0x52/0xf0 [ 35.980917][ C0] irq_exit_rcu+0x9/0x10 [ 35.985343][ C0] sysvec_call_function_single+0xa6/0xc0 [ 35.990973][ C0] [ 35.993897][ C0] [ 35.996809][ C0] asm_sysvec_call_function_single+0x1b/0x20 [ 36.002867][ C0] RIP: 0010:__schedule+0xbd7/0x14a0 [ 36.008054][ C0] Code: 42 0f b6 04 20 84 c0 0f 85 d3 02 00 00 48 8b 44 24 28 80 20 fc 4c 89 ef 48 8b 74 24 18 e8 31 be 4d fc 48 89 c7 e8 d9 05 96 fc <48> 8b 44 24 50 42 c6 44 20 04 f8 48 c7 44 24 60 0e 36 e0 45 4a c7 [ 36.027656][ C0] RSP: 0018:ffffc90000c17aa0 EFLAGS: 00000282 [ 36.033986][ C0] RAX: 0000000080000001 RBX: 0000000000000000 RCX: 0000000000000000 [ 36.042138][ C0] RDX: 0000000000000001 RSI: 0000000000000008 RDI: 00000000ffffffff [ 36.050583][ C0] RBP: ffffc90000c17ba0 R08: ffff888119970007 R09: 1ffff1102332e000 [ 36.058755][ C0] R10: dffffc0000000000 R11: ffffed102332e001 R12: dffffc0000000000 [ 36.066804][ C0] R13: ffff888119970000 R14: ffff8881f7038408 R15: 1ffff1103ee07081 [ 36.075117][ C0] ? release_firmware_map_entry+0x190/0x190 [ 36.081005][ C0] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 36.086819][ C0] ? hrtimer_start_range_ns+0xa65/0xb80 [ 36.092476][ C0] schedule+0x11e/0x1e0 [ 36.096638][ C0] do_nanosleep+0x19f/0x630 [ 36.101156][ C0] ? usleep_range_state+0x130/0x130 [ 36.106808][ C0] ? memset+0x35/0x40 [ 36.110874][ C0] ? hrtimer_init_sleeper+0x10c/0x370 [ 36.116334][ C0] hrtimer_nanosleep+0x1b6/0x3d0 [ 36.121255][ C0] ? nanosleep_copyout+0x120/0x120 [ 36.126348][ C0] ? __remove_hrtimer+0x3d0/0x3d0 [ 36.131364][ C0] ? get_timespec64+0x116/0x1b0 [ 36.136374][ C0] ? timespec64_add_safe+0x1f0/0x1f0 [ 36.141817][ C0] ? kvm_sched_clock_read+0x18/0x40 [ 36.147180][ C0] common_nsleep+0x8f/0xb0 [ 36.151878][ C0] __se_sys_clock_nanosleep+0x30b/0x3a0 [ 36.157452][ C0] ? irqtime_account_irq+0x1e9/0x390 [ 36.162817][ C0] ? __x64_sys_clock_nanosleep+0xb0/0xb0 [ 36.168443][ C0] ? __kasan_check_write+0x14/0x20 [ 36.173538][ C0] ? switch_fpu_return+0x15d/0x2c0 [ 36.178754][ C0] __x64_sys_clock_nanosleep+0x9b/0xb0 [ 36.184576][ C0] x64_sys_call+0x824/0x9a0 [ 36.189092][ C0] do_syscall_64+0x4c/0xa0 [ 36.193526][ C0] ? clear_bhb_loop+0x50/0xa0 [ 36.198191][ C0] ? clear_bhb_loop+0x50/0xa0 [ 36.202861][ C0] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 36.209364][ C0] RIP: 0033:0x7f0c044e090e [ 36.213787][ C0] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 36.233473][ C0] RSP: 002b:00007ffe07fef0f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 [ 36.242143][ C0] RAX: ffffffffffffffda RBX: 000055555fcdf500 RCX: 00007f0c044e090e [ 36.250374][ C0] RDX: 00007ffe07fef150 RSI: 0000000000000000 RDI: 0000000000000000 [ 36.258345][ C0] RBP: 00007f0c047a9da0 R08: 0000000000000000 R09: 0000000000000000 [ 36.266392][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000008c6f [ 36.274447][ C0] R13: 00007f0c047a818c R14: 00000000000089cd R15: 00007f0c047a8180 [ 36.282562][ C0] [ 36.285575][ C0] [ 36.287930][ C0] Allocated by task 703: [ 36.292155][ C0] __kasan_kmalloc+0xd4/0x100 [ 36.296910][ C0] __kmalloc+0x13d/0x2c0 [ 36.301135][ C0] l2tp_session_create+0x39/0xb60 [ 36.306150][ C0] pppol2tp_connect+0xbf5/0x1640 [ 36.311185][ C0] __sys_connect+0x3cb/0x450 [ 36.315765][ C0] __x64_sys_connect+0x7a/0x90 [ 36.320521][ C0] x64_sys_call+0x7c/0x9a0 [ 36.324923][ C0] do_syscall_64+0x4c/0xa0 [ 36.329628][ C0] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 36.335600][ C0] [ 36.337921][ C0] Freed by task 10: [ 36.341711][ C0] kasan_set_track+0x4a/0x70 [ 36.346303][ C0] kasan_set_free_info+0x23/0x40 [ 36.351329][ C0] ____kasan_slab_free+0x125/0x160 [ 36.356789][ C0] __kasan_slab_free+0x11/0x20 [ 36.361817][ C0] slab_free_freelist_hook+0xc2/0x190 [ 36.367394][ C0] kfree+0xc4/0x270 [ 36.371312][ C0] l2tp_session_put+0xaf/0x1a0 [ 36.376062][ C0] l2tp_session_delete+0x3a9/0x4a0 [ 36.381161][ C0] l2tp_tunnel_del_work+0x180/0x3d0 [ 36.386526][ C0] process_one_work+0x6c8/0xbb0 [ 36.391393][ C0] worker_thread+0xaa0/0x1250 [ 36.396070][ C0] kthread+0x3f5/0x4f0 [ 36.400208][ C0] ret_from_fork+0x1f/0x30 [ 36.404668][ C0] [ 36.406983][ C0] Last potentially related work creation: [ 36.412764][ C0] kasan_save_stack+0x3a/0x60 [ 36.417596][ C0] __kasan_record_aux_stack+0xd2/0x100 [ 36.423217][ C0] kasan_record_aux_stack_noalloc+0xb/0x10 [ 36.429007][ C0] call_rcu+0x10b/0xf60 [ 36.433679][ C0] pppol2tp_release+0x1e3/0x2b0 [ 36.438685][ C0] sock_close+0xb8/0x200 [ 36.443114][ C0] __fput+0x22b/0x900 [ 36.447276][ C0] ____fput+0x15/0x20 [ 36.451241][ C0] task_work_run+0x127/0x190 [ 36.455828][ C0] exit_to_user_mode_loop+0xd0/0xe0 [ 36.461005][ C0] exit_to_user_mode_prepare+0x87/0xd0 [ 36.466447][ C0] syscall_exit_to_user_mode+0x1a/0x30 [ 36.471888][ C0] do_syscall_64+0x58/0xa0 [ 36.476286][ C0] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 36.482167][ C0] [ 36.484583][ C0] The buggy address belongs to the object at ffff88811ab43400 [ 36.484583][ C0] which belongs to the cache kmalloc-512 of size 512 [ 36.498701][ C0] The buggy address is located 400 bytes inside of [ 36.498701][ C0] 512-byte region [ffff88811ab43400, ffff88811ab43600) [ 36.512653][ C0] The buggy address belongs to the page: [ 36.518358][ C0] page:ffffea00046ad000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11ab40 [ 36.528576][ C0] head:ffffea00046ad000 order:2 compound_mapcount:0 compound_pincount:0 [ 36.536888][ C0] flags: 0x4000000000010200(slab|head|zone=1) [ 36.542952][ C0] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100042f00 [ 36.551528][ C0] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 36.561164][ C0] page dumped because: kasan: bad access detected [ 36.567647][ C0] page_owner tracks the page as allocated [ 36.573446][ C0] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 140, ts 5724321538, free_ts 0 [ 36.591583][ C0] post_alloc_hook+0x192/0x1b0 [ 36.596428][ C0] prep_new_page+0x1c/0x110 [ 36.600913][ C0] get_page_from_freelist+0x2c3a/0x2cd0 [ 36.606442][ C0] __alloc_pages+0x1a2/0x460 [ 36.611014][ C0] new_slab+0xa0/0x4d0 [ 36.615061][ C0] ___slab_alloc+0x3ac/0x840 [ 36.619636][ C0] __slab_alloc+0x49/0x90 [ 36.624044][ C0] kmem_cache_alloc_trace+0x146/0x270 [ 36.629404][ C0] rtnl_newlink+0x17f/0x1900 [ 36.633980][ C0] rtnetlink_rcv_msg+0x9fd/0xcb0 [ 36.638899][ C0] netlink_rcv_skb+0x1e9/0x430 [ 36.643648][ C0] rtnetlink_rcv+0x1c/0x20 [ 36.648041][ C0] netlink_unicast+0x86c/0xa30 [ 36.652789][ C0] netlink_sendmsg+0x879/0xb80 [ 36.657894][ C0] ____sys_sendmsg+0x5be/0x8f0 [ 36.662822][ C0] ___sys_sendmsg+0x236/0x2e0 [ 36.667480][ C0] page_owner free stack trace missing [ 36.672826][ C0] [ 36.675129][ C0] Memory state around the buggy address: [ 36.680740][ C0] ffff88811ab43480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.688781][ C0] ffff88811ab43500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.696908][ C0] >ffff88811ab43580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.704959][ C0] ^ [ 36.709543][ C0] ffff88811ab43600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.717851][ C0] ffff88811ab43680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.725908][ C0] ================================================================== [ 36.733949][ C0] Disabling lock debugging due to kernel taint [ 36.806520][ T709] device syzkaller0 entered promiscuous mode [ 36.816106][ T711] tipc: Enabled bearer , priority 0 [ 36.823121][ T704] tipc: Resetting bearer [ 36.838678][ T704] tipc: Disabling bearer [ 36.854215][ T695] tipc: Resetting bearer [ 36.879621][ T695] tipc: Disabling bearer [ 36.887774][ T456] tipc: Node number set to 625548549