last executing test programs: 0s ago: executing program 1 (id=2): mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x9a5eb000) socketpair$unix(0x1, 0x2, 0x0, 0x0) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) connect$pppl2tp(r0, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x2, 0x1, 0x4, 0x2}}, 0x26) connect$unix(0xffffffffffffffff, 0x0, 0x0) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000000840)={0x0, "405a845ce24d4121e5c83213c5104d3e"}) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f0000001840)={r2, 0x3, 0x117f34eed0894b00, [0x8001, 0x100, 0x2, 0x6, 0x1], [0x3, 0x5, 0xa, 0x0, 0x800, 0xff, 0x400, 0x6, 0x6, 0x8, 0xbf9a1f3, 0xfffffffffffffffa, 0x5, 0x4, 0xb, 0x2000000000, 0x64d7, 0xf, 0x3, 0x100000001, 0x7fffffffffffffff, 0x0, 0x4, 0x1, 0xec, 0x1, 0x5, 0x7, 0x4, 0x0, 0x2, 0x1, 0x8, 0x81, 0x9, 0x7, 0xffffffffffffffff, 0x3, 0xff, 0x102, 0x6, 0x8, 0x0, 0xffffffffffffffff, 0x2, 0x7fffffff, 0x5, 0xfff, 0x10000, 0x5, 0xda44, 0x1, 0x5, 0x51b9, 0x0, 0x8, 0x6, 0x40000000000000, 0x5, 0x10, 0x3b, 0x3, 0x8000, 0x5, 0xfffffffffffffff9, 0x9, 0x9, 0xe0bc, 0x8, 0x5dc5, 0x5, 0x7, 0x3, 0xb4, 0x4, 0x5800000000000000, 0x3, 0x2cc7, 0x2, 0x7fffffff, 0x5, 0x8, 0x1, 0x11, 0x3, 0x2, 0x8, 0x7, 0x4, 0x400, 0x2, 0x5, 0x4, 0x0, 0x0, 0x4f, 0x7c54, 0x400, 0x8, 0x6, 0x1e540000000000, 0x5, 0x733, 0x5, 0x8, 0x7f, 0x6, 0x0, 0x7, 0xffffffffffffffff, 0x5000000000000000, 0x72, 0x800, 0x200000, 0x100000000, 0x10, 0x1000, 0xfff, 0x5313e1cd, 0x7ff, 0x8]}) r3 = syz_mount_image$vfat(&(0x7f0000000140), &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='nfs,dos1xfloppy,sys_immutable,nonumtail=0,utf8=1,nonumtail=0,uni_xlate=1,uni_xlate=1,utf8=0,iocharset=cp869,rodir,uid=', @ANYRES8=r0, @ANYRESOCT=r0], 0x1, 0x38c, &(0x7f0000000380)="$eJzs3U+IW8UfAPBv+pLdTeHX3cMPioISvQm69A8eFA9byhaKuaiEVg9isFuUzVrYYHB7aLpexKPgUUHwIh704KFnERTx5sGrVbQqHrS3gsWRJC/Ja5PdrtRtXfx8DuWb78y8mXmdTd6+R2ZfuJ5Wz1Ti7NWrV2JurhTlpeNLca0UC5HF0MWYNDMlBwDsDddSit/TwCiZTYnGSndoaADALul9/qduMfP659vVTz79AWDPy3//r25XZ24y9eMTvX/P7d64AIDdM3H//8Fx2f2Dx/yFR/3lqQ8EAIC95Zlnn3vyWD3i6WptLmLtjU6j04jHx+XHzsbL0YqVOBTzcT1icKGQUjr9ff/FiZP15UO1Wq0bPy1EIyLe6zQi1rqdxuBK4VjWbz8bh2M+FvL2+dVGSik78Ul9+XCtLyIudvv9x1qp06jE/rz/b/fHShyJWvx/on3EyfrykVp+gMbasH03YnN836I3/sWYj69fjHPRijPVU5HS8LKmvnzhcK12PNVvaN9pzMaZ0VmYcgcEAAAAAAAAAAAAAAAAAAAAAABuw2JtZGG0/00a79+zuDilvL8/zqB9vj/Q5mB/oDSbIqXfXnuk8WY22KtnuD/QzfvzdBrl2Hd3pw4AAAAAAAAAAAAAAAAAAAD/Gu2NmWi2Wivr7Y3zq8Wgu97e2BcRvcwrX370WTUm69wiKOd9FIpqeer8ajNlw8opu6FOHmS9zoeZDy+NRlysMzuaxdRh9IrbM1vU+d8DP7wzztyXDY/857hOFtMnmN00jGFQiYi1AxFRjRgVVcZT3vKMHc2DI7c4q5dTSlsd58Lzk62iFFH++/9x2wepF3xx5aV7jrYPPtrPfJoGHnp4/tTlt9//ZbXZ6vXc0/pgZr19Pa0289fTF9tKqbxFp1lh/ZTyc1gqroTydkPdvDHTzL759fS9b321s5mmYubVKXWywXQ+Xm9vlPKflH7RzCDo5W5qVW2dzCLOL0XxOJUpi//2gqmL7eC7S81LF777eafHKbxJjDfqqP7T7z8AAAAAAAAAAAAAAAAAAMBY4bviufzLvpXtWj32VB7M7e7oAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAODOGP/9/0KwOZHZSfBHNyaLZlfW2xEH7vY0AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4j/srAAD//x9pY8c=") r4 = syz_open_dev$vcsu(&(0x7f0000000080), 0x6, 0x101080) sendto(r4, &(0x7f0000000240)="ecfc1229f9b0d5c7c18ad48a899ffeb12a7cfc77e3a487d2c1e05643977f5677f10205d4487af08ca7f9769d80b1bb19c43ef926726aac55c9eff100b53dc0c49d5523f5190d22c62388f9797d93ecf894198284fc92455bc74c01cb0fb9612fa5b7f7b4b8a50d71da1b2ddda59e376896c2c2c490b7c57a35f06e46f5aa7e3977bf58c2a895f3a75471e8d782704110bb202f18d61bcce6743bd95c466af6c0bd5d2454300573b06d4928a56da787", 0xaf, 0x24040882, &(0x7f00000007c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x1, 0x3, 0x3, 0x4, {0xa, 0x4e24, 0x7, @private0={0xfc, 0x0, '\x00', 0x1}, 0x100}}}, 0x80) setxattr$trusted_overlay_opaque(&(0x7f0000000100)='./bus\x00', &(0x7f0000000340), &(0x7f0000000740), 0x2, 0x2) bpf$OBJ_GET_PROG(0x7, &(0x7f00000000c0)=@o_path={&(0x7f0000000780)='./file0\x00', 0x0, 0x742603be37aeb2cc, r3}, 0x18) open(&(0x7f0000000040)='./bus\x00', 0x1c1242, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.240' (ED25519) to the list of known hosts. [ 22.102416][ T24] audit: type=1400 audit(1791551000.870:64): avc: denied { mounton } for pid=271 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.105965][ T271] cgroup: Unknown subsys name 'net' [ 22.125222][ T24] audit: type=1400 audit(1791551000.870:65): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.152556][ T24] audit: type=1400 audit(1791551000.900:66): avc: denied { unmount } for pid=271 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.153118][ T271] cgroup: Unknown subsys name 'devices' [ 22.295807][ T271] cgroup: Unknown subsys name 'hugetlb' [ 22.301466][ T271] cgroup: Unknown subsys name 'rlimit' [ 22.442206][ T24] audit: type=1400 audit(1791551001.210:67): avc: denied { setattr } for pid=271 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.465436][ T24] audit: type=1400 audit(1791551001.210:68): avc: denied { mounton } for pid=271 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.490147][ T24] audit: type=1400 audit(1791551001.210:69): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.514472][ T273] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 22.523275][ T24] audit: type=1400 audit(1791551001.290:70): avc: denied { relabelto } for pid=273 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.548699][ T24] audit: type=1400 audit(1791551001.290:71): avc: denied { write } for pid=273 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.574445][ T24] audit: type=1400 audit(1791551001.330:72): avc: denied { read } for pid=271 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.574919][ T271] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.599939][ T24] audit: type=1400 audit(1791551001.330:73): avc: denied { open } for pid=271 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.148998][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.156177][ T279] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.163641][ T279] device bridge_slave_0 entered promiscuous mode [ 23.171768][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.178883][ T279] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.186429][ T279] device bridge_slave_1 entered promiscuous mode [ 23.284771][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.291829][ T280] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.299299][ T280] device bridge_slave_0 entered promiscuous mode [ 23.307482][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.314605][ T280] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.321956][ T280] device bridge_slave_1 entered promiscuous mode [ 23.334055][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.341127][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.348738][ T283] device bridge_slave_0 entered promiscuous mode [ 23.355478][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.362525][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.370009][ T281] device bridge_slave_0 entered promiscuous mode [ 23.376921][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.384002][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.391412][ T281] device bridge_slave_1 entered promiscuous mode [ 23.406071][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.413143][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.420762][ T283] device bridge_slave_1 entered promiscuous mode [ 23.450904][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.458017][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.465499][ T282] device bridge_slave_0 entered promiscuous mode [ 23.472379][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.479530][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.486959][ T282] device bridge_slave_1 entered promiscuous mode [ 23.596248][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.603321][ T279] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.610650][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.617695][ T279] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.674508][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.681581][ T281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.688890][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.695955][ T281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.716301][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.723462][ T282] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.730863][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.737940][ T282] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.747089][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.754170][ T280] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.761476][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.768568][ T280] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.777365][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.784463][ T283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.791733][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.798829][ T283] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.829459][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.837053][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.844660][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.851840][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.860142][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.867406][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.874707][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.881900][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.889347][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.896546][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.904399][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.911795][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.935891][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.944192][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.951220][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.959017][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.967961][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.975047][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.007280][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.014865][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.022812][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.031423][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.040278][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.048579][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.055689][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.063432][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.071508][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.079759][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.086826][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.094228][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.102381][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.109455][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.116832][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.125122][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.132158][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.139549][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.149174][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.157671][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.167038][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.174118][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.196125][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.205189][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.213152][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.221746][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.230351][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.238814][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.247063][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.254127][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.261622][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.270032][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.278229][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.285395][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.292764][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.300939][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.308952][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.316997][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.325071][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.333320][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.341668][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.348740][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.370162][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.378427][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.386920][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.395524][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.403469][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.411775][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.419951][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.428144][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.438935][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.447508][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.466745][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.475208][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.483492][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.495197][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.503119][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.515732][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.523233][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.530884][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.539693][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.553346][ T280] device veth0_vlan entered promiscuous mode [ 24.560098][ T282] device veth0_vlan entered promiscuous mode [ 24.567535][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.575766][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.583153][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.590819][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.599205][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.607319][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.614823][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.623112][ T283] device veth0_vlan entered promiscuous mode [ 24.638201][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.647069][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.655569][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.663460][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.671995][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.679555][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.687772][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.696055][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.708126][ T280] device veth1_macvtap entered promiscuous mode [ 24.716975][ T279] device veth0_vlan entered promiscuous mode [ 24.724567][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.732873][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.740506][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.748562][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.756817][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.765801][ T282] device veth1_macvtap entered promiscuous mode [ 24.777531][ T281] device veth0_vlan entered promiscuous mode [ 24.785468][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.793419][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.801847][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.812988][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.821461][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.833940][ T283] device veth1_macvtap entered promiscuous mode [ 24.843507][ T279] device veth1_macvtap entered promiscuous mode [ 24.850670][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.859217][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.867261][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.875507][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.884374][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.892592][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.904362][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.912690][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.931232][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.939655][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.948201][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.956609][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.965545][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.973728][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.982350][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.990639][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.999063][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.007293][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.020743][ T281] device veth1_macvtap entered promiscuous mode [ 25.035582][ T283] request_module fs-gadgetfs succeeded, but still no fs? [ 25.048911][ T283] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 25.071899][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.083170][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.091819][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.105651][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.114476][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.123843][ T302] FAT-fs (loop1): Unrecognized mount option "uid=00000000000000000000003" or missing value [ 25.139258][ T300] ================================================================== [ 25.139759][ T301] ------------[ cut here ]------------ [ 25.147382][ T300] BUG: KASAN: use-after-free in l2tp_tunnel_del_work+0xcd/0x3d0 [ 25.147393][ T300] Read of size 8 at addr ffff88810e817880 by task kworker/u4:3/300 [ 25.147395][ T300] [ 25.147413][ T300] CPU: 1 PID: 300 Comm: kworker/u4:3 Not tainted syzkaller #0 [ 25.147428][ T300] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 25.153837][ T301] WARNING: CPU: 0 PID: 301 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 25.160531][ T300] Workqueue: l2tp l2tp_tunnel_del_work [ 25.160557][ T300] Call Trace: [ 25.169644][ T301] Modules linked in: [ 25.170866][ T300] __dump_stack+0x21/0x24 [ 25.178728][ T301] [ 25.188342][ T300] dump_stack_lvl+0x1a7/0x208 [ 25.188353][ T300] ? show_regs_print_info+0x18/0x18 [ 25.188367][ T300] ? thaw_kernel_threads+0x220/0x220 [ 25.188379][ T300] print_address_description+0x7f/0x2c0 [ 25.188391][ T300] ? l2tp_tunnel_del_work+0xcd/0x3d0 [ 25.188402][ T300] kasan_report+0x100/0x140 [ 25.188412][ T300] ? __switch_to_asm+0x3a/0x60 [ 25.188422][ T300] ? l2tp_tunnel_del_work+0xcd/0x3d0 [ 25.188434][ T300] __asan_report_load8_noabort+0x14/0x20 [ 25.188443][ T300] l2tp_tunnel_del_work+0xcd/0x3d0 [ 25.188455][ T300] process_one_work+0x6fd/0xbc0 [ 25.188468][ T300] worker_thread+0xa8e/0x13c0 [ 25.188482][ T300] ? __kthread_parkme+0xb3/0x1b0 [ 25.188493][ T300] kthread+0x324/0x3b0 [ 25.188503][ T300] ? worker_clr_flags+0x190/0x190 [ 25.188514][ T300] ? kthread_blkcg+0xd0/0xd0 [ 25.188525][ T300] ret_from_fork+0x1f/0x30 [ 25.188531][ T300] [ 25.188536][ T300] Allocated by task 302: [ 25.188547][ T300] __kasan_kmalloc+0xd4/0x100 [ 25.188558][ T300] __kmalloc+0x19f/0x330 [ 25.188565][ T300] l2tp_session_create+0x39/0xb60 [ 25.188605][ T300] pppol2tp_connect+0xbf5/0x1640 [ 25.201692][ T301] CPU: 0 PID: 301 Comm: syz.1.2 Not tainted syzkaller #0 [ 25.204025][ T300] __sys_connect+0x3ce/0x450 [ 25.204034][ T300] __x64_sys_connect+0x7a/0x90 [ 25.204045][ T300] do_syscall_64+0x31/0x40 [ 25.204085][ T300] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.208223][ T301] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 25.211329][ T300] [ 25.216033][ T301] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 25.217996][ T300] Freed by task 302: [ 25.222698][ T301] Code: 5d c3 e8 ec 36 35 fd be 02 00 00 00 eb 0a e8 e0 36 35 fd be 01 00 00 00 4c 89 f7 e8 63 a6 0e fe e9 0f ff ff ff e8 c9 36 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 b8 36 35 fd 4c 89 f7 be 03 [ 25.227860][ T300] kasan_set_track+0x4a/0x70 [ 25.227870][ T300] kasan_set_free_info+0x23/0x40 [ 25.227879][ T300] ____kasan_slab_free+0x125/0x160 [ 25.227913][ T300] __kasan_slab_free+0x11/0x20 [ 25.235066][ T301] RSP: 0018:ffffc90007987d68 EFLAGS: 00010293 [ 25.238764][ T300] slab_free_freelist_hook+0xc5/0x190 [ 25.244949][ T301] [ 25.248539][ T300] kfree+0xc0/0x270 [ 25.253286][ T301] RAX: ffffffff842f81c7 RBX: ffff88810e827000 RCX: ffff888125de6400 [ 25.258536][ T300] l2tp_session_put+0xb2/0x1a0 [ 25.258545][ T300] pppol2tp_ioctl+0x748/0x960 [ 25.258557][ T300] pppox_ioctl+0x1e4/0x320 [ 25.258597][ T300] sock_do_ioctl+0xda/0x380 [ 25.265120][ T301] RDX: 0000000000000000 RSI: 000000000afc0ec0 RDI: 000000000c04eb7d [ 25.269339][ T300] sock_ioctl+0x472/0x740 [ 25.274685][ T301] RBP: ffffc90007987d88 R08: ffff88810e827083 R09: 1ffff11021d04e10 [ 25.278881][ T300] __se_sys_ioctl+0x121/0x1a0 [ 25.283834][ T301] R10: dffffc0000000000 R11: ffffed1021d04e11 R12: dffffc0000000000 [ 25.287879][ T300] __x64_sys_ioctl+0x7b/0x90 [ 25.287890][ T300] do_syscall_64+0x31/0x40 [ 25.287900][ T300] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.287903][ T300] [ 25.287912][ T300] The buggy address belongs to the object at ffff88810e817800 [ 25.287912][ T300] which belongs to the cache kmalloc-512 of size 512 [ 25.287923][ T300] The buggy address is located 128 bytes inside of [ 25.287923][ T300] 512-byte region [ffff88810e817800, ffff88810e817a00) [ 25.287927][ T300] The buggy address belongs to the page: [ 25.287963][ T300] page:ffffea00043a0500 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10e814 [ 25.287972][ T300] head:ffffea00043a0500 order:2 compound_mapcount:0 compound_pincount:0 [ 25.287985][ T300] flags: 0x4000000000010200(slab|head) [ 25.288000][ T300] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 [ 25.288013][ T300] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 25.288017][ T300] page dumped because: kasan: bad access detected [ 25.288022][ T300] page_owner tracks the page as allocated [ 25.288038][ T300] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 302, ts 25093869820, free_ts 25070270038 [ 25.288049][ T300] prep_new_page+0x176/0x190 [ 25.288085][ T300] get_page_from_freelist+0x225f/0x23f0 [ 25.302086][ T301] R13: dffffc0000000000 R14: 000000000afc0ec0 R15: ffff88810e817800 [ 25.302125][ T301] FS: 000055558b2ef500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 25.304426][ T300] __alloc_pages_nodemask+0x29a/0x640 [ 25.304435][ T300] new_slab+0x84/0x3f0 [ 25.304446][ T300] ___slab_alloc+0x2f8/0x4c0 [ 25.304475][ T300] __slab_alloc+0x63/0xa0 [ 25.308728][ T301] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.313416][ T300] __kmalloc+0x1f9/0x330 [ 25.322846][ T301] CR2: 000000110c2d68a6 CR3: 000000010dcea000 CR4: 00000000003506b0 [ 25.327637][ T300] l2tp_session_create+0x39/0xb60 [ 25.327647][ T300] pppol2tp_connect+0xbf5/0x1640 [ 25.327656][ T300] __sys_connect+0x3ce/0x450 [ 25.327686][ T300] __x64_sys_connect+0x7a/0x90 [ 25.336522][ T301] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 25.339330][ T300] do_syscall_64+0x31/0x40 [ 25.344568][ T301] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 25.348595][ T300] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.348601][ T300] page last free stack trace: [ 25.348614][ T300] __free_pages_ok+0x80b/0x830 [ 25.348624][ T300] __free_pages+0xd8/0x390 [ 25.348633][ T300] __free_slab+0xcf/0x190 [ 25.348641][ T300] unfreeze_partials+0x150/0x180 [ 25.348649][ T300] put_cpu_partial+0xc1/0x180 [ 25.348657][ T300] __slab_free+0x2c9/0x3a0 [ 25.348668][ T300] ___cache_free+0x10e/0x130 [ 25.348678][ T300] qlink_free+0x50/0x90 [ 25.348688][ T300] qlist_free_all+0x5f/0xb0 [ 25.348698][ T300] kasan_quarantine_reduce+0x14a/0x160 [ 25.348707][ T300] __kasan_slab_alloc+0x2f/0xe0 [ 25.348718][ T300] slab_post_alloc_hook+0x5d/0x2f0 [ 25.348759][ T300] kmem_cache_alloc+0x15a/0x2d0 [ 25.356930][ T301] Call Trace: [ 25.364709][ T300] getname_kernel+0x59/0x2e0 [ 25.364719][ T300] kern_path+0x1f/0x40 [ 25.364730][ T300] do_loopback+0xcc/0x490 [ 25.364741][ T300] [ 25.368047][ T301] pppol2tp_release+0x150/0x2b0 [ 25.373413][ T300] Memory state around the buggy address: [ 25.377720][ T301] sock_close+0xb8/0x200 [ 25.396898][ T300] ffff88810e817780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.396907][ T300] ffff88810e817800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.396916][ T300] >ffff88810e817880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.396920][ T300] ^ [ 25.396929][ T300] ffff88810e817900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.396937][ T300] ffff88810e817980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.396941][ T300] ================================================================== [ 25.396945][ T300] Disabling lock debugging due to kernel taint [ 25.887147][ T301] ? sock_mmap+0xa0/0xa0 [ 25.891444][ T301] __fput+0x2dc/0x730 [ 25.895990][ T301] ____fput+0x15/0x20 [ 25.902524][ T300] ------------[ cut here ]------------ [ 25.910997][ T301] task_work_run+0x127/0x190 [ 25.915852][ T301] exit_to_user_mode_loop+0xcb/0xe0 [ 25.921084][ T301] exit_to_user_mode_prepare+0x76/0xa0 [ 25.928285][ T301] syscall_exit_to_user_mode+0x1d/0x40 [ 25.933787][ T301] do_syscall_64+0x3d/0x40 [ 25.937520][ T300] refcount_t: underflow; use-after-free. [ 25.940549][ T301] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.949828][ T301] RIP: 0033:0x7f10e92b51d9 [ 25.954296][ T301] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 25.957992][ T300] WARNING: CPU: 1 PID: 300 at lib/refcount.c:28 refcount_warn_saturate+0x120/0x1a0 [ 25.974280][ T301] RSP: 002b:00007ffd7420b7b8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 25.992096][ T301] RAX: 0000000000000000 RBX: 00007ffd7420b8a0 RCX: 00007f10e92b51d9 [ 26.000134][ T301] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 26.002770][ T300] Modules linked in: [ 26.008559][ T301] RBP: 00000000000061e0 R08: 0000000000000001 R09: 0000000000000000 [ 26.008966][ T300] [ 26.012508][ T301] R10: 0000001b2d320000 R11: 0000000000000246 R12: 00007ffd7420b8e0 [ 26.012516][ T301] R13: 00007f10e953cfac R14: 000000000000624d R15: 00007f10e953cfa0 [ 26.012530][ T301] ---[ end trace f9ce9ee0abbb0322 ]--- [ 26.021488][ T300] CPU: 1 PID: 300 Comm: kworker/u4:3 Tainted: G B syzkaller #0 [ 26.053763][ T300] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 26.064064][ T300] Workqueue: l2tp l2tp_tunnel_del_work [ 26.069568][ T300] RIP: 0010:refcount_warn_saturate+0x120/0x1a0 [ 26.075790][ T300] Code: 04 01 48 c7 c7 40 55 40 85 e8 bc 84 3b 02 0f 0b eb c3 e8 63 8f 26 ff c6 05 f2 6f 82 04 01 48 c7 c7 a0 55 40 85 e8 a0 84 3b 02 <0f> 0b eb a7 e8 47 8f 26 ff c6 05 d3 6f 82 04 01 48 c7 c7 c0 54 40 [ 26.095839][ T300] RSP: 0018:ffffc90007977c58 EFLAGS: 00010246 [ 26.102062][ T300] RAX: 99d1d8ae47772300 RBX: 0000000000000003 RCX: ffff888101b81400 [ 26.110320][ T300] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 26.118498][ T300] RBP: ffffc90007977c68 R08: ffff8881f7152fff R09: 1ffff1103ee2a5ff [ 26.126687][ T300] R10: dffffc0000000000 R11: ffffed103ee2a600 R12: ffff888126952020 [ 26.134824][ T300] R13: dffffc0000000000 R14: 0000000000000003 R15: 0000000000000000 [ 26.142845][ T300] FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 26.152167][ T300] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 26.158835][ T300] CR2: 00007f10e95082f8 CR3: 000000010d6e8000 CR4: 00000000003506b0 [ 26.167062][ T300] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 26.175117][ T300] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 26.183094][ T300] Call Trace: [ 26.186444][ T300] l2tp_session_put+0xcb/0x1a0 [ 26.191221][ T300] l2tp_session_delete+0x3a9/0x4a0 [ 26.196394][ T300] l2tp_tunnel_del_work+0x180/0x3d0 [ 26.201599][ T300] process_one_work+0x6fd/0xbc0 [ 26.206675][ T300] worker_thread+0xa8e/0x13c0 [ 26.211355][ T300] ? __kthread_parkme+0xb3/0x1b0 [ 26.216342][ T300] kthread+0x324/0x3b0 [ 26.220429][ T300] ? worker_clr_flags+0x190/0x190 [ 26.225517][ T300] ? kthread_blkcg+0xd0/0xd0 [ 26.230122][ T300] ret_from_fork+0x1f/0x30 [ 26.234567][ T300] ---[ end trace f9ce9ee0abbb0323 ]---