last executing test programs: 117.280897ms ago: executing program 0 (id=1): r0 = socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) listen(r0, 0x8) connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x1, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r2 = fsopen(0x0, 0x0) r3 = fsmount(r2, 0x0, 0xa) fchdir(r3) chdir(0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x20000040) r4 = accept$inet(r0, 0x0, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f0000000080)=@raw={'raw\x00', 0x9, 0x3, 0x1d0, 0x0, 0xffffffff, 0xffffffff, 0x98, 0xffffffff, 0x0, 0xffffffff, 0xffffffff, 0x138, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x1, 0xffffffff, 0xffffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x230) socket$inet_icmp_raw(0x2, 0x3, 0x1) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='.\x00', 0x0, 0x0) getdents64(r6, 0x0, 0x0) sendto(r4, &(0x7f0000000300)='ab', 0xfffffcf4, 0x11, 0x0, 0x0) syz_usb_connect(0x0, 0x6b, &(0x7f0000000940)=ANY=[@ANYBLOB="1201000385010008f2044600008e01020301090259000104e9000909049300000e0100ff0a0a0102000502010209240703040001a53011240606190508000400050006000100050924030506030501f909240702020005cbad0924030603fb"], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) 54.026884ms ago: executing program 2 (id=3): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x5, &(0x7f0000000880)=ANY=[@ANYBLOB="bf16000000000000b707000000fcf0ff5070000000000000480000002c41000095000000000000002ba7e1d30c04aa8b3382022ce2a1d97411a0f6b599e83f24a3aa81d36bb7019c13bd23212fb56f040026fbfefc4a056bdc17487902317142fac7e7be168c1886d0d4d94f2f4eb45c652fbc1626cca2a28d67893547db51ee988e6e06c8cedf7ceb9fc40400ae5e4aa74c92c6a51cbf9b0a4def23d410f6accd3641130bfc4e90a6341865c3f5ab3e89cf6c662ed4148d3b3e22278d00031e5388ee5c867de2c6211d6ececb0c18ce7400dae15cb7947c491b8bea3fd2f73902ebcfcf4982277d9800011b405bbf7b02433a9bcd715f5888b2007f000000001c000000010000000000000600000000309329170ee5b567e70f000006a10f58fa64533500000000000000000000000031000000000000001208e75a89faffbfb11b7dc6ea31001e846c12423a169f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d617de7a6520655a80d0900f4d433623c850af895abba14f6fbd7fbad1f98e26ad4deaf1a4f294b2a431ab9142f3a06d54740a4bc5e3abd378af7c9676a08e774c48785f895b4ec8d1141d5e8744d7f09ab4df6027bf48cabecead649f96ea24d32872c494160cb7f46ce680eeb80157eb23f9902519ac655fa73103170cbc496d7122034b85e7e87a2db762cbb253fbd76b9117c1a11d18aa2040c5f0c289906000000000000005ffe94ff010011d9b219c00c369a12bf8685b862d0dbdd956cbda1bae489bcef5ae59136aaadc59609f4d42617c0e6066938b521a0f2e2467a6c435ad5b800262a5da053ced5e95394e500000072737638ac44fb61310e2df511c60b3c88113996a81fb64bce5eb95ce91738640ff7ae6ed6b62086e699955926934389cdf9bcebc7586186fe9ce05268bf8a3958f2206cdc7095682c14f10be1075832956762b2dcc6251e7b74cb1da627e332765511c58215bf84d263e8778e6e8ffe4ea50b076446f35eff00006b340658342d2d9e1ef68c6ef3e98407d2fcefb34a0000000000000000895ddbb76122b1222e4da37177fe833e4fcaa67997e92a206ebd085bd9f90008d3fdd528efe6c1dca17f45ba5e8bd311a40030f9ffce75ffff996a80153a0077bb43f8a63dd390d18f0239b41da1a52383a4c6768ca1bb66b8fb3c5000f6f246fd20356a60769b461b6cdf133de073b1df08ae09268b0073bb97d88d741a5546e76caf4b6b1387ff37ec13d262dae0260be74cdf7bb6d3107597430ef5bbd476bb9d69b2aef9f3cb644b4bf01ccf16d40720939daf2af469bdfb361b9c015dd026fd0fffe3c66f5c343afb78a7cfd852f3e05c089887d7df2ff4f9982030019421af6b78ff9c444a17091875cfe4eab0e7f50eb69c860b1613a6b4f5af04f9c635d8d646c89f8b85f820ce7464c731deba39f9ff7b815f7b0acba754c01ed8bf1bba0010a8c6a2b966d861f9dd547abf2e9b23e5607f00f80b58fd76e4bc46c84799aa792cdaeb6cfb858e577dacff607ba513250e13ae696cd6ed7d318190a93b9ee07927efca6b8d1f5980994690bbe002db5146439d906a0d4aef065214b15666cdca81091b69acee2c7ce0821fc19e0891f0b53469f935c5ac420100010000000000fb53faf4420638489e6a1c696d8c414a87b60000000000080000b6be1557951854c01dbc2d061827ae6349a045b780893771524a424335b9fc34616ee9f09141057262530b7c2f7c9b969938779736ece7b470078ac0b1b4b528000000009866e9994ca9096672ec9f3800c2fc35ba6516e542624c47bdba76a816c3a3dd6c3fa87a3ec91df199a9af91a7babf2b8d0e7b77e6dfb4bbc9817847b705000000a1000000000000ab8353f3800f045b90b0eaab6d731199c9447eabbc8c740183aff5389742e47de5000000826a570d14310700cf2ae3366ebdb7f1000000000000333c00e6addbf4c71ffad6bfb5babb49109f92a5a52042c425190a6e3f1a8a3abfe6059da9c952cf35c98ce7616355493d280f2d0be99e18fd0900c769e7eb4edc1c03a33676590bd2047229e0237c1e34641848531712ff09e89fb062a3e66f4fced0ae679733830039cb61ea0691f0b4e0b33194404e643243c3841e1e7fe301f7f47a7f89512d92e83624e3de705bdfbfd0e5e381398e9d5428a00cc8a6d097d97e6ac8bd09b1a5577920a650114a522c1e2dcdc4f606fcbcee91770a9fada34d38cd7976a9228a0a0dd8661be8162e966aac26bea4c11458cd6ce22ddf7054cdd0a60ef3ec000000000000000000425cb75dc7ec92e9a5d29f9c99697d2a98ae0a9f35e4196c3faeb7a60a0290bf897846f6f0f1c163d6075119169d55d10da9ad0e4b2c636d200000009baaf94e2b2c48e70d8453f832eecfb1de2a3f38a5c986de9e37737dac74db251d5e9ea2b8ed39e91a7a17d01b49f7aaff7c4c73c3484bdcab362838ed940035b239a3646ef55b9f070ae14466b3acef9f8b28fb938a237e2e068ae4a6bce4407b54cc14614c2cdf877f000000000000000000000000bdcf23144e6c16b9235552aed83b6428f34d88c258a9ad16386bba51b60838fb11bc193a206b5a25b7233b222e4e68e0d1e88f26b9a45b6c29469530a37ea92aaf421cdcc1f594ecfaff9a79b56f8b38038002d29b3193cea9cd0a0ef4f58fa48f61071f548d411353965615c24c1860fd0dfae0f4cdf8c8f8645a289a79f9b919b674f0325d81eacaa8399324a304885da01733bb7917ec5e52718eb05f9c1ffd69f834150e9100c215968e8fb31c83526e6f66897569e28d01ca6135a2acca398c1415e0f9b58b63ee9dc33608ba7e5c4bdf3f37d8e4f4f424be263d9c2a5204f41e9b0ee01ad4cc0519395b69c310c98d3c8edc7d07b30617f3535634257f5472d9f3263a6f04778a920c12000721bb82f9884780ac294b8bb07ebf6e3f16584e95607e319b2ea9778289c19fb775514246159bbfa9dc0fdf711d3efa316a3323c915a40e6d7c8f8d7daf98824fd0bc955dc9731cc8c7a600d94b8049af764688c7ffdd26a741b03b065ba9c586914d8beb94c8a265ace34172ed003357ddd400557230b2caba17a647a171c2fc73a8c7541c7ffaafba62195fce77382ae962f30d4a377d760040975a44aa73a4e687d06f96f0987b980f6f883534dfc71ace539eeeb08cff54e0e05d5e0563660a3664c67d0eb9cdf4eab93ab4bf1972a2acc5c5d43dc2f2b66d7493c390d042d896a1ad772f6d4c2cf38ba0"], &(0x7f00000011c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000001200), 0x57, 0x10, &(0x7f0000001240), 0xffffffffffffffc9}, 0x48) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001280)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f00000012c0)=r0, 0x4) sendmsg$inet(r2, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000001340)=[{&(0x7f0000001380)="fa82", 0xfdef}], 0x1}, 0x20000000) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x800714, &(0x7f00000000c0), 0x1, 0x4cf, &(0x7f0000000380)="$eJzs3M9rHFUcAPDvbH40bdMm1lptbTVaxeKPpEl/2IMHFQVBBUEP9RiTtNZuG2kitCVoFKnngngVj4JHT968iHoQ/wAFj1IoGoSmghCZnZl0s9lNN7+aJvl8yGbem3kz772Zebtv5+1MAJtWT/ovieiMiN8ioiuLzk3Qk02mpyaGbk5NDCUxM/PmX0kl3Y2piaEiabHe9jxyqBRR+jSJ55P5+Y5dunx2sFweuZDH+8bPvd83dunyM2fODZ4eOT1yfuDEiaNH+p89PnBsznp1NjXP1jrz0nrd2Pfh6P69r7x99fWhk1ff+embdFt7DmTLq+txWzfnleLVesl60r3290xF7bLHm85sfdhRFU5a17AgLEpLRKSHq6PS/ruiJW4dvK54+ZM1LRywqtLPpi2NF0/OABtYEukfsPkUH/Tp99/iFf/doc7HXeD6CxHteXh6amJoevY6QGuU8vltq5h/T0ScnPz3y/QVi70OAQCwBJW+zdM1/b+KUuypTLOxjp35GEp3RNwTEbsi4t6I2B0R90VU0t4fEQ9kK890NZl/T018fv+ndK1umVdI2v97rqrvN11V/3zS3ZLHdlTq35acOlMeOZzvk0PRtiWN9y+Qx/cvtTdcVt3/S19p/kVfMC/AtdbsAt3sRoYHxwdXaidc/zhiX2u9+iezIwHpGbA3IvYtbtM7i8CZJ7/e3yjR7eu/gBUYZ5r5KuKJ7PhPRk39C0mD8cn0HD8+cKyvI8ojh/uKs2K+n3+98kaj/JdV/xWQHv9tc8//mhRd/yTZeG1blMsjF8aa2GjN8OiV3z9r+J1mEed/6ott2XSwPXmrMmb9y7vZjIuD4+MX+iPak9cq8byxdEQ6f+DW1i7m8SJ9Wv9DB+u3/11V1XkwItKT+EDEzoci4uG87I9ExKMRcXCB3fHji4+9t0D9k0hiTY//cN33v9mD2J1Uj9cvIdBy9ofvGo3bN3f8j8Zk5b02U3n/u41mC7jM3QcAAADrQikiOiMp9Wbhns4olXp7s9/w745tpfLo2PhTp0Y/OD+c3SPQHW2l4kpXV9X10P5kMt9iFh/IrxUXy4/k140/b9laifcOjZaH17jusNltn9v+o2j/qT9b1rp0wKprPI62wK0BwIZQ2/5La1QO4M5r5nc0vgvAxlSn/dd7hkYzy4B1xvNaYPOq1/4/qonP6//rBcCGML/9/1HnkXXARqT/D5vXYtu/vgFsHD7/YVNazn39Sw8UNwssmLgoYt00HU3f4b9ZAsXjYVYzr61xa06UKoHOuAvqvpRAVzOJI+LbZefVsuTVk4h896Yt5s7un6oHDgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKxj/wcAAP//fHDdSQ==") 46.623555ms ago: executing program 4 (id=5): r0 = socket(0x8, 0x6, 0x2) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@gettaction={0x30, 0x32, 0xbd5139864f3acfa7, 0x70bd2a, 0x25dfdbfd, {}, [@action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x7ff}, @action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x8050}, 0x24000094) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) syz_mount_image$msdos(&(0x7f00000000c0), &(0x7f0000000200)='./file0\x00', 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB='dots,allow_utime=00000000000000000000007,nodots,flush,dots,dots,codepage=861oppy,\x00'/97], 0x0, 0x237, &(0x7f00000002c0)="$eJzs3E1rK1UYB/CTNrfpzaUlK0E3HupGN0G7dlGRCmJAsUZ8AWFKUw2JSclkkYhg1q78DC5FdONOKH6BfgrdFaF0Y1eO5KW26ZtVmwZ6f79Nnsl/zuQ5zGEgJ5DDV7/5vLGblneTblgo5MLCRhj8kWVZKSyEU4Pw0o8fHH+9tRSmxBhXn9//+Mvv137pPnn/p9WfC+Gg9Mnh0fpvB88cPHv453uf1dNYT2Or3Y1J3G63u8l2sxZ36mmjHOM7zVqS1mK9ldY6U/lus723149Ja2eluNeppWlMWv3YqPVjtx27nX5MPk3qrVgul+NKMfB/VL87yXKDbKgwCFmWhXDuvvPwnWRZOJq6/zxNtj786K3XKpXNd2NcDuH3Qa/aq45fR3H+jTcrmy/HkdLZqONer7o4qob5K+M8nrtsr1d9FIqTfP1SPhy/FF58YZwPs9ffrlzIH4ed2U8fAAAAAAAepHL82+X9/dzkcDr/tTja3x8fnPt9YLx//+3+ZHw+PJe/58kAAAAAV0r7XzSSZrPWuaFYDCH80zl3XuTD9ecMG89d1/yjyczur9Xri9yk0bN3lkMIU+csT9q97ZWzQgjzm9fSafOP/8X6mU2RfXV3F3xytrRKtxu1+N8/dOPK6Icw57V6sbjhobE222cSAAAwG9NfqgEAAAAAAAAAAAAAAAAAAIB5uI+/E5v3HAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbvJXAAAA//8bq1aL") socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x3, 0x13, &(0x7f00000005c0)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020786c0000000000002020207b1af8ff00000000bfa100000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000600)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000640)=0x7) r2 = getpid() mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x2) sched_setscheduler(r2, 0x2, &(0x7f00000006c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000740)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000007c0), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f0000000e40)=[{{&(0x7f00000007c0)=@rc, 0x80, &(0x7f0000000d00)=[{&(0x7f00000008c0)=""/234, 0xea}, {&(0x7f0000000c00)=""/253, 0xfd}], 0x2, &(0x7f0000000d40)=""/205, 0xcd}, 0x3}], 0x1, 0x2, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000840)='smaps\x00') madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) r6 = socket$nl_sock_diag(0x10, 0x3, 0x4) r7 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r7, 0x11b, 0x2, &(0x7f0000000880)=0x800, 0x4) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x6, 0x8012, r7, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r4, 0x0, 0x482, &(0x7f0000000b00)=""/226, &(0x7f00000009c0)=0xe2) sendmsg$TCPDIAG_GETSOCK(r6, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000a80)=ANY=[@ANYBLOB="4c0000001200070928bd7000fedbdf2521090b090000000000000600000001040000070000000300000002000000000000", @ANYRES32=0x0, @ANYBLOB="00000100052000003100000009000000"], 0x4c}, 0x1, 0x0, 0x0, 0x4000}, 0x20000000) bpf$PROG_LOAD(0x5, 0x0, 0x0) lseek(r5, 0x289e0cb5, 0x0) write$binfmt_elf64(r1, &(0x7f0000000180)=ANY=[@ANYBLOB="7f454c4601040000000000000000000003003e00ebffffff940200000200000040001700000000000000000000000000000000002d8f38000100feff02000300030000"], 0x78) close(r1) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) 0s ago: executing program 3 (id=4): r0 = socket$inet6(0xa, 0x3, 0x7) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./proc\x00', &(0x7f0000000380)='proc\x00', 0x1000004, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000400)='100', 0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000480)='./config\x00', &(0x7f00000004c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) setsockopt$inet6_int(r0, 0x29, 0x4b, &(0x7f0000000000)=0x2, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x8, @private1, 0x8000}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x10, 0x4) syz_emit_ethernet(0x86, &(0x7f0000000280)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaaaa88a82f00810028000004fc02b86716967961435dabd940a2a642e7211e4316ec5b784cdbc32f418ab738f884f61fcbabc8231cd203d43db76136e3b017edb5c441f8c803bbecda0b06635db312cc9a7323396b6ac76bcf0a3c1204c37114df0c2d3af80fb1d82f3499ea434d23d9602df6d6f5c5e2ad3fd48be08736e92cf40ade9668c9e856487317908876ad4d51269c85b5902136ae647319f65738f96208505d552d48e9ba1ae7263ba55b84f357092b4d27e0cc50506d"], 0x0) sendmmsg$inet6(r0, &(0x7f00000000c0)=[{{&(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='$'], 0x28}}], 0x1, 0x0) recvfrom$inet6(r0, 0x0, 0x0, 0x10000, &(0x7f0000000180)={0xa, 0x4e21, 0x9, @private0, 0x23}, 0x1c) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.182' (ED25519) to the list of known hosts. [ 19.048179][ T24] audit: type=1400 audit(1794256405.939:64): avc: denied { mounton } for pid=271 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 19.049199][ T271] cgroup: Unknown subsys name 'net' [ 19.053545][ T24] audit: type=1400 audit(1794256405.939:65): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.058652][ T24] audit: type=1400 audit(1794256405.949:66): avc: denied { unmount } for pid=271 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.058782][ T271] cgroup: Unknown subsys name 'devices' [ 19.153714][ T271] cgroup: Unknown subsys name 'hugetlb' [ 19.159326][ T271] cgroup: Unknown subsys name 'rlimit' [ 19.266452][ T24] audit: type=1400 audit(1794256406.159:67): avc: denied { setattr } for pid=271 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 19.289690][ T24] audit: type=1400 audit(1794256406.159:68): avc: denied { mounton } for pid=271 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 19.294980][ T273] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 19.314436][ T24] audit: type=1400 audit(1794256406.159:69): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 19.346135][ T24] audit: type=1400 audit(1794256406.219:70): avc: denied { relabelto } for pid=273 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.371640][ T24] audit: type=1400 audit(1794256406.219:71): avc: denied { write } for pid=273 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.399606][ T24] audit: type=1400 audit(1794256406.299:72): avc: denied { read } for pid=271 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.425225][ T24] audit: type=1400 audit(1794256406.299:73): avc: denied { open } for pid=271 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.451430][ T271] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 19.956258][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.963622][ T279] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.970930][ T279] device bridge_slave_0 entered promiscuous mode [ 19.978842][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.985937][ T279] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.993255][ T279] device bridge_slave_1 entered promiscuous mode [ 20.081643][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.088741][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.096162][ T281] device bridge_slave_0 entered promiscuous mode [ 20.117956][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.125029][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.132556][ T281] device bridge_slave_1 entered promiscuous mode [ 20.142044][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.149246][ T280] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.156530][ T280] device bridge_slave_0 entered promiscuous mode [ 20.164612][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.171636][ T280] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.179482][ T280] device bridge_slave_1 entered promiscuous mode [ 20.237987][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.245271][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.252617][ T283] device bridge_slave_0 entered promiscuous mode [ 20.259350][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.266409][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.273773][ T283] device bridge_slave_1 entered promiscuous mode [ 20.297715][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.304878][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.312341][ T282] device bridge_slave_0 entered promiscuous mode [ 20.319224][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.326350][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.333665][ T282] device bridge_slave_1 entered promiscuous mode [ 20.371542][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.378613][ T279] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.385906][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.392932][ T279] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.473891][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.480939][ T281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.488225][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.495250][ T281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.503477][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.510490][ T283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.517748][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.524770][ T283] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.542486][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.549645][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.556827][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.564289][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.571564][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.578775][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.586537][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 20.593911][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.625518][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.633944][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.640989][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.648899][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.657649][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.664721][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.672048][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.680089][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.698656][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.706039][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.714385][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.721410][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.729609][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.740949][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.748460][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.756636][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.763653][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.781794][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.789961][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.797017][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.804608][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.813063][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.820066][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.827403][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.835643][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.842668][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.849996][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 20.864159][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.872444][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.879464][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.897461][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.905674][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.913685][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.921543][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.929764][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 20.941296][ T279] device veth0_vlan entered promiscuous mode [ 20.955065][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 20.963087][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 20.970621][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 20.978781][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.986721][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.995042][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.002047][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.009758][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.017948][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.025011][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.042633][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 21.050257][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 21.058351][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.066271][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 21.074574][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.082578][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 21.090537][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.098595][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 21.106729][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.114727][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.122986][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.135760][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.144075][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.155158][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.163312][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.177269][ T281] device veth0_vlan entered promiscuous mode [ 21.183612][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.191994][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.200663][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.208773][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.218936][ T282] device veth0_vlan entered promiscuous mode [ 21.226292][ T279] device veth1_macvtap entered promiscuous mode [ 21.234383][ T283] device veth0_vlan entered promiscuous mode [ 21.241337][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.249217][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.256643][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.264202][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.271982][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.280051][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.288157][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.296301][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.304298][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.311633][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.319124][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.327095][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.335617][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.349842][ T282] device veth1_macvtap entered promiscuous mode [ 21.359108][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.367369][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.375629][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.383850][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.392845][ T283] device veth1_macvtap entered promiscuous mode [ 21.406418][ T280] device veth0_vlan entered promiscuous mode [ 21.416201][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.423963][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.432125][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.440640][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.448707][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.456693][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.464931][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.473342][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.481442][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.489834][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.498390][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.506704][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.515007][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.523369][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.530792][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.545748][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.553884][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.561933][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.570321][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.585304][ T281] device veth1_macvtap entered promiscuous mode [ 21.599617][ T282] request_module fs-gadgetfs succeeded, but still no fs? [ 21.608324][ T279] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 21.623792][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.631581][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.640221][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.644079][ T304] ip_tables: iptables: counters copy to user failed while replacing table [ 21.649086][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.665944][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.677922][ T280] device veth1_macvtap entered promiscuous mode [ 21.695086][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.703656][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.711868][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.723205][ T308] FAT-fs (loop4): Unrecognized mount option "codepage=861oppy" or missing value [ 21.740797][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.756864][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.763586][ T314] FAULT_INJECTION: forcing a failure. [ 21.763586][ T314] name failslab, interval 1, probability 0, space 0, times 1 [ 21.766637][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.792627][ T314] CPU: 0 PID: 314 Comm: syz.3.4 Not tainted syzkaller #0 [ 21.799676][ T314] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 21.809745][ T314] Call Trace: [ 21.813051][ T314] __dump_stack+0x21/0x24 [ 21.817371][ T314] dump_stack_lvl+0x1a7/0x208 [ 21.822045][ T314] ? show_regs_print_info+0x18/0x18 [ 21.827237][ T314] dump_stack+0x15/0x1c [ 21.831384][ T314] should_fail+0x3ab/0x500 [ 21.835803][ T314] ? new_inode_pseudo+0x7a/0x210 [ 21.840743][ T314] __should_failslab+0xa4/0xe0 [ 21.845504][ T314] should_failslab+0x9/0x20 [ 21.850010][ T314] kmem_cache_alloc+0x3d/0x2d0 [ 21.854792][ T314] new_inode_pseudo+0x7a/0x210 [ 21.859555][ T314] new_inode+0x28/0x1e0 [ 21.863712][ T314] ? configfs_new_dirent+0x5c/0x370 [ 21.868904][ T314] configfs_create+0xae/0x4e0 [ 21.873573][ T314] configfs_attach_item+0x2b9/0x8d0 [ 21.878768][ T314] configfs_attach_group+0x2d/0x250 [ 21.883978][ T314] configfs_mkdir+0x7c3/0xd90 [ 21.888651][ T314] ? configfs_lookup+0x500/0x500 [ 21.893586][ T314] ? __lookup_hash+0x122/0x250 [ 21.898346][ T314] ? security_inode_mkdir+0xbd/0x110 [ 21.903632][ T314] vfs_mkdir+0x42c/0x600 [ 21.907877][ T314] do_mkdirat+0x14c/0x340 [ 21.912205][ T314] __x64_sys_mkdirat+0x7b/0x90 [ 21.916965][ T314] do_syscall_64+0x31/0x40 [ 21.921473][ T314] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 21.927359][ T314] RIP: 0033:0x7f0df08d4b19 [ 21.931770][ T314] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 21.951372][ T314] RSP: 002b:00007f0def32c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 21.959789][ T314] RAX: ffffffffffffffda RBX: 00007f0df0b5afa0 RCX: 00007f0df08d4b19 [ 21.967746][ T314] RDX: 00000000000001ff RSI: 0000200000000500 RDI: ffffffffffffff9c [ 21.975700][ T314] RBP: 00007f0df096cb70 R08: 0000000000000000 R09: 0000000000000000 [ 21.983677][ T314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 21.991627][ T314] R13: 00007f0df0b5b038 R14: 00007f0df0b5afa0 R15: 00007ffe318f5f38 [ 21.999675][ T302] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 22.009794][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.010712][ T314] ================================================================== [ 22.025927][ T314] BUG: KASAN: use-after-free in gadgets_drop+0x40/0xd0 [ 22.032761][ T314] Read of size 8 at addr ffff88810edcd550 by task syz.3.4/314 [ 22.040197][ T314] [ 22.042518][ T314] CPU: 0 PID: 314 Comm: syz.3.4 Not tainted syzkaller #0 [ 22.049512][ T314] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 22.059546][ T314] Call Trace: [ 22.062821][ T314] __dump_stack+0x21/0x24 [ 22.067148][ T314] dump_stack_lvl+0x1a7/0x208 [ 22.071804][ T314] ? show_regs_print_info+0x18/0x18 [ 22.077005][ T314] ? thaw_kernel_threads+0x220/0x220 [ 22.082273][ T314] print_address_description+0x7f/0x2c0 [ 22.087798][ T314] ? gadgets_drop+0x40/0xd0 [ 22.092282][ T314] kasan_report+0x100/0x140 [ 22.096868][ T314] ? gadgets_drop+0x40/0xd0 [ 22.101346][ T314] __asan_report_load8_noabort+0x14/0x20 [ 22.106957][ T314] gadgets_drop+0x40/0xd0 [ 22.111261][ T314] ? gadgets_make+0xa70/0xa70 [ 22.115914][ T314] client_drop_item+0x94/0xc0 [ 22.120567][ T314] configfs_mkdir+0xaca/0xd90 [ 22.125222][ T314] ? configfs_lookup+0x500/0x500 [ 22.130146][ T314] ? __lookup_hash+0x122/0x250 [ 22.134890][ T314] ? security_inode_mkdir+0xbd/0x110 [ 22.140153][ T314] vfs_mkdir+0x42c/0x600 [ 22.144396][ T314] do_mkdirat+0x14c/0x340 [ 22.148707][ T314] __x64_sys_mkdirat+0x7b/0x90 [ 22.153448][ T314] do_syscall_64+0x31/0x40 [ 22.157850][ T314] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 22.163738][ T314] RIP: 0033:0x7f0df08d4b19 [ 22.168133][ T314] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 22.187720][ T314] RSP: 002b:00007f0def32c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 22.196111][ T314] RAX: ffffffffffffffda RBX: 00007f0df0b5afa0 RCX: 00007f0df08d4b19 [ 22.204084][ T314] RDX: 00000000000001ff RSI: 0000200000000500 RDI: ffffffffffffff9c [ 22.212041][ T314] RBP: 00007f0df096cb70 R08: 0000000000000000 R09: 0000000000000000 [ 22.220026][ T314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 22.227981][ T314] R13: 00007f0df0b5b038 R14: 00007f0df0b5afa0 R15: 00007ffe318f5f38 [ 22.235931][ T314] [ 22.238240][ T314] Allocated by task 314: [ 22.242462][ T314] __kasan_kmalloc+0xd4/0x100 [ 22.247117][ T314] kmem_cache_alloc_trace+0x179/0x2e0 [ 22.252470][ T314] gadgets_make+0x57/0xa70 [ 22.256864][ T314] configfs_mkdir+0x5d2/0xd90 [ 22.261519][ T314] vfs_mkdir+0x42c/0x600 [ 22.265736][ T314] do_mkdirat+0x14c/0x340 [ 22.270040][ T314] __x64_sys_mkdirat+0x7b/0x90 [ 22.274781][ T314] do_syscall_64+0x31/0x40 [ 22.279180][ T314] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 22.285042][ T314] [ 22.287347][ T314] Freed by task 314: [ 22.291222][ T314] kasan_set_track+0x4a/0x70 [ 22.295801][ T314] kasan_set_free_info+0x23/0x40 [ 22.300717][ T314] ____kasan_slab_free+0x125/0x160 [ 22.305820][ T314] __kasan_slab_free+0x11/0x20 [ 22.310653][ T314] slab_free_freelist_hook+0xc5/0x190 [ 22.316008][ T314] kfree+0xc0/0x270 [ 22.319812][ T314] gadget_info_attr_release+0xcb/0xf0 [ 22.325180][ T314] config_item_put+0x158/0x210 [ 22.329922][ T314] gadgets_drop+0x23/0xd0 [ 22.334226][ T314] client_drop_item+0x94/0xc0 [ 22.338880][ T314] configfs_mkdir+0xaca/0xd90 [ 22.343535][ T314] vfs_mkdir+0x42c/0x600 [ 22.347752][ T314] do_mkdirat+0x14c/0x340 [ 22.352064][ T314] __x64_sys_mkdirat+0x7b/0x90 [ 22.356983][ T314] do_syscall_64+0x31/0x40 [ 22.361378][ T314] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 22.367239][ T314] [ 22.369550][ T314] The buggy address belongs to the object at ffff88810edcd000 [ 22.369550][ T314] which belongs to the cache kmalloc-2k of size 2048 [ 22.383582][ T314] The buggy address is located 1360 bytes inside of [ 22.383582][ T314] 2048-byte region [ffff88810edcd000, ffff88810edcd800) [ 22.397002][ T314] The buggy address belongs to the page: [ 22.402650][ T314] page:ffffea00043b7200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10edc8 [ 22.412856][ T314] head:ffffea00043b7200 order:3 compound_mapcount:0 compound_pincount:0 [ 22.421171][ T314] flags: 0x4000000000010200(slab|head) [ 22.426610][ T314] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100042d80 [ 22.435169][ T314] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000 [ 22.443746][ T314] page dumped because: kasan: bad access detected [ 22.450153][ T314] page_owner tracks the page as allocated [ 22.455867][ T314] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 314, ts 21763338418, free_ts 21752726409 [ 22.476242][ T314] prep_new_page+0x176/0x190 [ 22.480810][ T314] get_page_from_freelist+0x225f/0x23f0 [ 22.486330][ T314] __alloc_pages_nodemask+0x29a/0x640 [ 22.491706][ T314] new_slab+0x84/0x3f0 [ 22.495757][ T314] ___slab_alloc+0x2f8/0x4c0 [ 22.500345][ T314] __slab_alloc+0x63/0xa0 [ 22.504648][ T314] kmem_cache_alloc_trace+0x1a8/0x2e0 [ 22.509998][ T314] gadgets_make+0x57/0xa70 [ 22.514391][ T314] configfs_mkdir+0x5d2/0xd90 [ 22.519059][ T314] vfs_mkdir+0x42c/0x600 [ 22.523279][ T314] do_mkdirat+0x14c/0x340 [ 22.527584][ T314] __x64_sys_mkdirat+0x7b/0x90 [ 22.532329][ T314] do_syscall_64+0x31/0x40 [ 22.536732][ T314] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 22.542605][ T314] page last free stack trace: [ 22.547269][ T314] __free_pages_ok+0x80b/0x830 [ 22.552006][ T314] __free_pages+0xd8/0x390 [ 22.556417][ T314] __free_slab+0xcf/0x190 [ 22.560722][ T314] unfreeze_partials+0x150/0x180 [ 22.565642][ T314] put_cpu_partial+0xc1/0x180 [ 22.570295][ T314] __slab_free+0x2c9/0x3a0 [ 22.574689][ T314] ___cache_free+0x10e/0x130 [ 22.579255][ T314] qlink_free+0x50/0x90 [ 22.583388][ T314] qlist_free_all+0x5f/0xb0 [ 22.587868][ T314] kasan_quarantine_reduce+0x14a/0x160 [ 22.593299][ T314] __kasan_slab_alloc+0x2f/0xe0 [ 22.598128][ T314] slab_post_alloc_hook+0x5d/0x2f0 [ 22.603214][ T314] kmem_cache_alloc+0x15a/0x2d0 [ 22.608043][ T314] getname_flags+0xba/0x510 [ 22.612521][ T314] getname+0x19/0x20 [ 22.616392][ T314] do_sys_openat2+0xde/0x750 [ 22.620973][ T314] [ 22.623280][ T314] Memory state around the buggy address: [ 22.628908][ T314] ffff88810edcd400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.636949][ T314] ffff88810edcd480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.645008][ T314] >ffff88810edcd500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.653058][ T314] ^ [ 22.659716][ T314] ffff88810edcd580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.667759][ T314] ffff88810edcd600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 22.675803][ T314] ================================================================== [ 22.683856][ T314] Disabling lock debugging due to kernel taint [ 22.702105][ T318] process 'syz.4.5' launched './file1' with NULL argv: empty string added [ 22.747684][ T315] EXT4-fs (loop2): corrupt root inode, run e2fsck [ 22.754229][ T315] EXT4-fs (loop2): mount failed [ 22.902262][ T302] usb 1-1: Using ep0 maxpacket: 8 [ 23.062307][ T302] usb 1-1: unable to get BOS descriptor or descriptor too short [ 23.142408][ T302] usb 1-1: config 4 has an invalid interface number: 147 but max is 0 [ 23.150592][ T302] usb 1-1: config 4 contains an unexpected descriptor of type 0x2, skipping [ 23.159351][ T302] usb 1-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 23.169579][ T302] usb 1-1: config 4 has no interface number 0 [ 23.332326][ T302] usb 1-1: New USB device found, idVendor=04f2, idProduct=0046, bcdDevice=8e.00 [ 23.341361][ T302] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 23.349390][ T302] usb 1-1: Product: syz [ 23.353573][ T302] usb 1-1: Manufacturer: syz [ 23.358164][ T302] usb 1-1: SerialNumber: syz [ 24.752314][ T302] uvcvideo: Found UVC 0.00 device syz (04f2:0046) [ 24.758787][ T302] uvcvideo: No valid video chain found. [ 24.766600][ T302] usb 1-1: USB disconnect, device number 2