last executing test programs: 8.396114166s ago: executing program 0 (id=1): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_control_io(r0, &(0x7f0000000500)={0x2c, &(0x7f00000001c0)={0x40, 0x22, 0x2, {0x2, 0x30}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x3) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) socket(0x10, 0x2, 0x0) syz_usb_control_io$uac2(0xffffffffffffffff, &(0x7f0000001080)={0x14, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x40a}}}, &(0x7f00000012c0)={0x44, &(0x7f00000010c0)={0x0, 0x17, 0x5, "558f3d10bd"}, &(0x7f0000001100)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000001140)={0x0, 0x8, 0x1}, &(0x7f0000001180)={0x20, 0x81, 0x2, 'az'}, &(0x7f00000011c0)={0x20, 0x82, 0x3, "fd0b55"}, &(0x7f0000001200)={0x20, 0x83, 0x1, '2'}, &(0x7f0000001240)={0x20, 0x84, 0x3, "7d2501"}, &(0x7f0000001280)={0x20, 0x85, 0x3, "7c9aa6"}}) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x307743, 0x1a1) syz_usb_ep_write(r0, 0x81, 0xffffff75, &(0x7f00000002c0)="b9425b44651dd23241963599000000110000004a16941ff5f4b4f1f0add7fcf2b877fceafffffffffff1ffdf4cd9f5d3969890522c77157d88010000003a5bd5531d459dffff03000000000091ff000000e8f5b3371da3635b8b4fa637135800001f65e4b436aa9e50bc0f19b7d3372ff9ebcede1fb5e9428f54d5d1f0cc752cf246a5d2da34a5aa97dc14a469c3dd3e26b41c356484e46fd66e3f2c7807e8773eed7b94fa099ab84feadec2ea95f65bba452eae5b0900f98a979a88c517a2dc360a00237723e2f467af706ea17226296b3a10a351cb47aba2c6b836c90679b4dd859ddc9e4800448aab0000000000000d75f34bb50d8d7084") 6.593332879s ago: executing program 0 (id=27): fsopen(&(0x7f0000000040)='afs\x00', 0x0) r0 = syz_open_dev$usbmon(&(0x7f0000000000), 0x6, 0x0) readv(r0, &(0x7f0000000ec0)=[{&(0x7f0000000700)=""/230, 0xe6}], 0x1) readv(r0, &(0x7f0000000040), 0x2000000000000213) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x46, &(0x7f0000000100)=0x5, 0x4) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r2, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) r3 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bind$netlink(0xffffffffffffffff, &(0x7f0000000140)={0x10, 0x0, 0x25dfdbff, 0x2fdfffffd}, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, &(0x7f00000000c0)=@gcm_128={{0x303}, "9913d4ab2de66f9c", "dd79ff97261d7098a0723ec49ab4cfdc", 'i}oz', "ffca69dbc7b44302"}, 0x28) syz_genetlink_get_family_id$tipc(&(0x7f0000000180), 0xffffffffffffffff) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x2) openat$cgroup_root(0xffffff9c, &(0x7f0000000200)='./cgroup.net/syz1\x00', 0x200002, 0x0) syz_open_dev$usbfs(&(0x7f0000000240), 0x10, 0x80100) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="1819e5831a8e0000000900000000000000090000006b11380004000000950000"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 4.92807013s ago: executing program 0 (id=33): r0 = socket$netlink(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0xa0, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x78, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x40, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x30, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0xd}, @NFTA_BITWISE_DATA={0xc, 0x7, 0x0, 0x1, [@NFTA_DATA_VALUE={0x8, 0x1, "1f000000"}]}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x114}}, 0x0) 4.878672611s ago: executing program 0 (id=34): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) timer_settime(0x0, 0x0, &(0x7f0000000500)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x47, 0xd, 0x7ffc0001}]}) sync_file_range(r0, 0xd81, 0x6, 0xa) 4.662432617s ago: executing program 3 (id=40): r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/netfilter\x00') fchdir(r0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[@ANYRES32, @ANYRESOCT=0x0, @ANYRESOCT=0x0], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_procfs(r1, &(0x7f0000000280)='net/ip_vs_stats\x00') init_module(&(0x7f0000000d40)=ANY=[], 0xa99, &(0x7f0000001800)='GPL\x00') sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000d00)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0xfffffffc}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000400)="b8", 0x1}], 0x1, 0x0, 0x0, 0xff000000}}], 0x1, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'bond0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x3, 0x3, 0xda8}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x44, 0x28, 0x4ee4e6a52ff56541, 0x5000, 0xfffffdfc, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {}, {0x2, 0xfff1}}, [@qdisc_kind_options=@q_red={{0x8}, {0x18, 0x2, [@TCA_RED_PARMS={0x14, 0x1, {0x0, 0x0, 0xc, 0x17, 0x19, 0x19, 0x5}}]}}]}, 0x44}}, 0x4008000) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='debugfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@redirect_dir_off, 0x3a}], [], 0x2f}) open_tree(0xffffffffffffff9c, &(0x7f0000001840)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0x81100) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/bus/input/handlers\x00', 0x0, 0x0) syz_clone3(&(0x7f0000000080)={0x2a694b000, &(0x7f0000000040), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, {r6}}, 0x58) 3.705400469s ago: executing program 3 (id=45): socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000001400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) socket$nl_netfilter(0x10, 0x3, 0xc) close(r3) 3.233218352s ago: executing program 0 (id=50): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) futex(&(0x7f000000cffc)=0x1, 0xd, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc)=0x1, 0xd, 0x0, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 2.952426288s ago: executing program 4 (id=55): r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x64) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r3, 0xffffffffffffffff, 0x0) 2.86742464s ago: executing program 4 (id=57): r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/netfilter\x00') fchdir(r0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[@ANYRES32, @ANYRESOCT=0x0, @ANYRESOCT=0x0], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_procfs(r1, &(0x7f0000000280)='net/ip_vs_stats\x00') init_module(&(0x7f0000000d40)=ANY=[], 0xa99, &(0x7f0000001800)='GPL\x00') 1.781464807s ago: executing program 4 (id=60): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000003c0), r0) sendmsg$NLBL_CALIPSO_C_LIST(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000280)={0x1c, r1, 0x1, 0x70bd28, 0x25dfd3fa, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x10000) 1.734504788s ago: executing program 2 (id=61): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000240)={0x2, 0x0, &(0x7f0000000140)={&(0x7f0000000400)={0x2, 0x18, 0x0, 0x6, 0xa, 0x0, 0x0, 0x25dfdbfd, [@sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x300, @multicast1}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x4e24, 0x5, @private0={0xfc, 0x0, '\x00', 0x1}, 0x7}}]}, 0x50}}, 0x0) 1.734357698s ago: executing program 4 (id=62): r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x641, 0x101001) write$evdev(r0, &(0x7f0000001700)=[{{0x0, 0x2710}, 0x11, 0xff, 0x1}], 0x10) 1.734290718s ago: executing program 2 (id=63): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)={0x54, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @loopback}}, {0x14, 0x2, @in={0x2, 0x0, @multicast2}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}]}, 0x54}}, 0x0) 1.722456738s ago: executing program 3 (id=64): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000440)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000540), 0x28) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304}, "5bebd250addb1b29", "0fe52ccf5ae523f0d36375dedff0d425", "5cccf758", "0002000000f3ff00"}, 0x28) setsockopt$inet6_tcp_int(r0, 0x11a, 0x4, &(0x7f0000000040)=0x5, 0x4) 1.63862588s ago: executing program 3 (id=66): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, 0x0, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000680)=@newqdisc={0x3c, 0x24, 0xd0f, 0x200000, 0x0, {0x60, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0xd, 0xb}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x4}}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x9}]}, 0x3c}}, 0x20000010) 1.63854771s ago: executing program 4 (id=67): fsopen(&(0x7f0000000040)='afs\x00', 0x0) r0 = syz_open_dev$usbmon(&(0x7f0000000000), 0x6, 0x0) readv(r0, &(0x7f0000000ec0)=[{&(0x7f0000000700)=""/230, 0xe6}], 0x1) readv(r0, &(0x7f0000000040), 0x2000000000000213) 1.63849853s ago: executing program 1 (id=68): r0 = openat$tcp_congestion(0xffffff9c, &(0x7f0000000180), 0x1, 0x0) write$tcp_congestion(r0, &(0x7f00000001c0)='cubic\x00', 0x6) 1.63390131s ago: executing program 2 (id=69): r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/pid\x00') ioctl$NS_GET_PARENT(r0, 0x8008b705, 0x0) 1.63134262s ago: executing program 3 (id=70): r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/netfilter\x00') fchdir(r0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[@ANYRES32, @ANYRESOCT=0x0, @ANYRESOCT=0x0], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_procfs(r1, &(0x7f0000000280)='net/ip_vs_stats\x00') init_module(&(0x7f0000000d40)=ANY=[], 0xa99, &(0x7f0000001800)='GPL\x00') 1.554375852s ago: executing program 1 (id=71): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x100000, 0x1, &(0x7f0000006680)) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$key(0xf, 0x3, 0x2) recvmmsg(r3, &(0x7f0000000440), 0x6f5, 0x2000000022, &(0x7f0000000480)={0x77359400}) 1.554222882s ago: executing program 2 (id=72): r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) ioctl$USBDEVFS_RELEASE_PORT(r0, 0x80045519, &(0x7f0000000000)=0x1) 1.538101973s ago: executing program 4 (id=73): setuid(0xee01) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) exit(0x100000000000035) tkill(r0, 0x3d) 203.387745ms ago: executing program 2 (id=74): mkdir(&(0x7f0000000300)='./bus\x00', 0x63) openat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x143142, 0x120) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x8, &(0x7f0000000200)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) setxattr$trusted_overlay_origin(&(0x7f0000000040)='./file0/file1\x00', &(0x7f0000000100), 0x0, 0x0, 0x2) umount2(&(0x7f00000002c0)='./file0\x00', 0x9) mount$overlay(0x0, &(0x7f0000000580)='./file0\x00', &(0x7f0000000b80), 0x1804008, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@nfs_export_on}]}) mount$overlay(0x0, &(0x7f0000000180)='./file0/file1\x00', 0x0, 0x2000000, 0x0) 153.878416ms ago: executing program 3 (id=75): mount$9p_virtio(&(0x7f0000001a80), &(0x7f0000001ac0)='.\x00', &(0x7f0000001b00), 0x10000, &(0x7f0000000740)=ANY=[@ANYBLOB="7472616e6f2c64666c746769643dee1d382683fd0ecf9eaefb0cd0c98087d2061954dc0525b4fb4fbedfc3866cf416630d2f6c5c49cedd8b5e2e9452d89062008ac30a8262f72f4720beb11b9fbf8d1d1c19d9680832457e5da3f2e091483c89b5e4b28015256fa08c22139f320fbe2ece0bb123d01dc9f9de51826b949c87a05dce55278ce74e9c8339c4499fb6d52e36fc2fdd3a31a8ba5c8dfbdf0e4bdb1bc791a93d11ae3debd2963609cd7c314264a29cb85162fc04e93773723e665bbe736a562261ce3fd9830985321f86c359d74055d7bbb9074b268490844984cb637d3ddab637c1ade82b89b855b629e32f58fc6a8dc5a845b1bb82d7e84016e227fd652864e260bc15", @ANYRESHEX=0x0, @ANYBLOB=',\x00']) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0xfff80000) openat$binderfs(0xffffff9c, &(0x7f0000000240)='./binderfs/binder0\x00', 0x3, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) write$binfmt_aout(r4, &(0x7f00000006c0)=ANY=[], 0xff2e) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x3, 0x7fff, 0x16, "b0bf2ebb48c849ac0000000003000018bfff40"}) r5 = syz_open_pts(r4, 0x0) r6 = dup3(r5, r4, 0x0) ioctl$TIOCSTI(r6, 0x5412, &(0x7f0000000140)=0x12) r7 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r7, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r3, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0xa4, 0x0, &(0x7f0000000600)="878b7cdfd4455cf49da7ba6f280ae012ce80389a2aefe4fd04084554d7015aba5330d1b817d6c08af29938b8a9bc2b83462ddadaad3a3a5c0181a0203e49b12c99ac8757fc317fe672938a06f89c133d615cf8c6e94b3ac320fa50046f5c18ac35b49243870e4e6b90c76177feda5469369b2b5a4739cc0b68c1772f1c9b9320d88426bc8f139429054c85b62f2a1dfc705453bea4cabf1f5eee5a0d301fb7c62e36dba0"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 82.627318ms ago: executing program 1 (id=76): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000080)={'team0\x00', &(0x7f0000000000)=@ethtool_coalesce={0x26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x401200}}) 82.502398ms ago: executing program 1 (id=77): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x20846, 0x12) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r1, 0x0) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f00000000c0)={0x0, 0x0}, 0x8) 66.334489ms ago: executing program 1 (id=78): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500", @ANYRES32], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 33.542019ms ago: executing program 2 (id=79): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@ipv6_newnexthop={0x24, 0x68, 0x1, 0x0, 0x25dfdbfd, {0x2}, [@NHA_ENCAP_TYPE={0x6, 0x7, 0x3}, @NHA_FDB={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x48800}, 0x20044000) 1.12708ms ago: executing program 1 (id=80): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000003b40)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x3c, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@TCA_RATE={0x6, 0x5, {0x7, 0x9}}, @qdisc_kind_options=@q_pfifo_fast={0xf}]}, 0x3c}}, 0x4014) 0s ago: executing program 0 (id=81): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000400)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f00000002c0)={0x0, 0xfb87, 0x800, 0x3, 0x32c}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x6, 0x15e, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x8, 0x0, 0x146, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90f, 0x1, 0x3, 0x125, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x82, 0xbd}}], 0x1, &(0x7f0000000340)={0x2e, 0x50, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0xd3, 0x0, 0x0}}, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000340)={{0x2, 0x3, 0xf3b, 0x2, 0x13fffffc}}) 0s ago: executing program 2 (id=82): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x4, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0xffff, @mcast2}}}, 0x32) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.102' (ED25519) to the list of known hosts. [ 22.386365][ T28] audit: type=1400 audit(1784922734.388:64): avc: denied { mounton } for pid=279 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.387346][ T279] cgroup: Unknown subsys name 'net' [ 22.409203][ T28] audit: type=1400 audit(1784922734.388:65): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.436781][ T28] audit: type=1400 audit(1784922734.428:66): avc: denied { unmount } for pid=279 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.437238][ T279] cgroup: Unknown subsys name 'devices' [ 22.562312][ T279] cgroup: Unknown subsys name 'hugetlb' [ 22.568001][ T279] cgroup: Unknown subsys name 'rlimit' [ 22.670093][ T28] audit: type=1400 audit(1784922734.668:67): avc: denied { setattr } for pid=279 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.693477][ T28] audit: type=1400 audit(1784922734.668:68): avc: denied { mounton } for pid=279 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 22.706767][ T281] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.719198][ T28] audit: type=1400 audit(1784922734.668:69): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.751045][ T28] audit: type=1400 audit(1784922734.738:70): avc: denied { relabelto } for pid=281 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.757459][ T279] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.776717][ T28] audit: type=1400 audit(1784922734.738:71): avc: denied { write } for pid=281 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.776746][ T28] audit: type=1400 audit(1784922734.758:72): avc: denied { read } for pid=279 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.837224][ T28] audit: type=1400 audit(1784922734.758:73): avc: denied { open } for pid=279 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.651471][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.658707][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.666312][ T288] device bridge_slave_0 entered promiscuous mode [ 23.674881][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.681997][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.689579][ T288] device bridge_slave_1 entered promiscuous mode [ 23.732137][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.739291][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.746991][ T291] device bridge_slave_0 entered promiscuous mode [ 23.754398][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.761671][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.769126][ T291] device bridge_slave_1 entered promiscuous mode [ 23.795871][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.803164][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.811007][ T287] device bridge_slave_0 entered promiscuous mode [ 23.837723][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.845282][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.853013][ T287] device bridge_slave_1 entered promiscuous mode [ 23.862318][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.869550][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.877135][ T289] device bridge_slave_0 entered promiscuous mode [ 23.884650][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.892086][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.899681][ T289] device bridge_slave_1 entered promiscuous mode [ 23.980301][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.987904][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.995875][ T290] device bridge_slave_0 entered promiscuous mode [ 24.003619][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.010747][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.018205][ T290] device bridge_slave_1 entered promiscuous mode [ 24.099230][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.106589][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.114181][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.121861][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.188438][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.196490][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.204599][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.211840][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.223984][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.231338][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.239501][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.247436][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.284686][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.291805][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.299120][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.306183][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.328119][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.335440][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.342885][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.351359][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.358877][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.366840][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.374546][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.382096][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.389764][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.399003][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.406571][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.422188][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.430951][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.438167][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.446055][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.454414][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.461655][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.469290][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.477403][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.501813][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.510056][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.517392][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.525861][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.534735][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.542044][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.563500][ T288] device veth0_vlan entered promiscuous mode [ 24.571020][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.579551][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.588053][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.596140][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.603910][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.613153][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.644065][ T288] device veth1_macvtap entered promiscuous mode [ 24.652573][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.661187][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.668840][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.677398][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.685834][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.695285][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.703762][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.712236][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.719547][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.741305][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.749054][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.757269][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.765842][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.774263][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.782821][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.791380][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.798497][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.806027][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.814495][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.823010][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.830302][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.837870][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.847203][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.856073][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.864142][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.872499][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.880171][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.893487][ T291] device veth0_vlan entered promiscuous mode [ 24.906642][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.915683][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.924018][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.932796][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.941081][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.948104][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.956398][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.965076][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.973416][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.980661][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.988286][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.997049][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.005405][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.012437][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.019969][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.028208][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.036243][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.044913][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.053659][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.062279][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.083085][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 25.090961][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.099241][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.107732][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.116162][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.128934][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.139723][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.148955][ T288] request_module fs-gadgetfs succeeded, but still no fs? [ 25.158007][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.166847][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.175768][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.183902][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.196326][ T291] device veth1_macvtap entered promiscuous mode [ 25.214083][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.224464][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.234591][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.243494][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.252218][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.260800][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.269103][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.285935][ T287] device veth0_vlan entered promiscuous mode [ 25.298456][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.307210][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.315531][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.323907][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.331843][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.345552][ T290] device veth0_vlan entered promiscuous mode [ 25.359362][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.372230][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.379912][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.389079][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.398417][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.408050][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.425624][ T289] device veth0_vlan entered promiscuous mode [ 25.441061][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.449270][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.458594][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.466287][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.476908][ T287] device veth1_macvtap entered promiscuous mode [ 25.485893][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.494267][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.503131][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.512990][ T290] device veth1_macvtap entered promiscuous mode [ 25.520642][ T19] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 25.534808][ T289] device veth1_macvtap entered promiscuous mode [ 25.545080][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.553134][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.562145][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.570977][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.579271][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.587799][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.596568][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.605179][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.614136][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.636393][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.646989][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.655805][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.664728][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.721942][ T19] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 25.734585][ T19] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 25.749342][ T19] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.761604][ T19] usb 1-1: config 0 descriptor?? [ 25.961964][ T327] netlink: 'syz.3.6': attribute type 6 has an invalid length. [ 25.990500][ T292] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 26.171694][ T292] usb 2-1: Using ep0 maxpacket: 32 [ 26.198218][ T292] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 26.232093][ T292] usb 2-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 26.246562][ T292] usb 2-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 26.256492][ T292] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.265265][ T292] usb 2-1: Product: syz [ 26.275256][ T292] usb 2-1: Manufacturer: syz [ 26.286454][ T292] usb 2-1: SerialNumber: syz [ 26.298083][ T292] usb 2-1: config 0 descriptor?? [ 26.303927][ T322] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 26.364044][ T19] usbhid 1-1:0.0: can't add hid device: -71 [ 26.370202][ T19] usbhid: probe of 1-1:0.0 failed with error -71 [ 26.391194][ T19] usb 1-1: USB disconnect, device number 2 [ 26.522003][ T342] 9pnet_virtio: no channels available for device syz [ 26.522004][ T292] usb 2-1: USB disconnect, device number 2 [ 26.791417][ T355] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 27.066877][ T366] netlink: 'syz.1.18': attribute type 12 has an invalid length. [ 27.081267][ T366] netlink: 'syz.1.18': attribute type 29 has an invalid length. [ 27.089762][ T366] netlink: 148 bytes leftover after parsing attributes in process `syz.1.18'. [ 27.099843][ T366] netlink: 'syz.1.18': attribute type 1 has an invalid length. [ 27.108550][ T366] netlink: 'syz.1.18': attribute type 2 has an invalid length. [ 27.116674][ T366] netlink: 11 bytes leftover after parsing attributes in process `syz.1.18'. [ 27.127256][ T366] Zero length message leads to an empty skb [ 27.397702][ T387] Invalid ELF header magic: != ELF [ 27.450517][ T28] kauditd_printk_skb: 65 callbacks suppressed [ 27.450543][ T28] audit: type=1400 audit(1784922739.398:139): avc: denied { sys_module } for pid=377 comm="syz.1.23" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 27.678879][ T28] audit: type=1400 audit(1784922739.398:140): avc: denied { module_load } for pid=377 comm="syz.1.23" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 27.952131][ T398] 9pnet_virtio: no channels available for device syz [ 28.014513][ T28] audit: type=1400 audit(1784922740.018:141): avc: denied { read } for pid=392 comm="syz.3.25" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 28.492796][ T28] audit: type=1400 audit(1784922740.498:142): avc: denied { create } for pid=404 comm="syz.1.30" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 28.517392][ T28] audit: type=1400 audit(1784922740.518:143): avc: denied { name_bind } for pid=404 comm="syz.1.30" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 28.542110][ T28] audit: type=1400 audit(1784922740.518:144): avc: denied { node_bind } for pid=404 comm="syz.1.30" saddr=224.0.0.2 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 28.669867][ T28] audit: type=1400 audit(1784922740.668:145): avc: denied { bind } for pid=409 comm="syz.0.33" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 28.732608][ T28] audit: type=1400 audit(1784922740.738:146): avc: denied { read write } for pid=415 comm="syz.3.35" name="fuse" dev="devtmpfs" ino=93 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 28.820388][ T28] audit: type=1400 audit(1784922740.768:147): avc: denied { open } for pid=415 comm="syz.3.35" path="/dev/fuse" dev="devtmpfs" ino=93 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 28.895700][ T28] audit: type=1400 audit(1784922740.768:148): avc: denied { mounton } for pid=415 comm="syz.3.35" path="/8/file0" dev="tmpfs" ino=59 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 29.223496][ T435] 9pnet_virtio: no channels available for device syz [ 29.304099][ T437] Invalid ELF header magic: != ELF [ 30.386520][ T474] binder: 473:474 ioctl c0306201 200000004a40 returned -22 [ 30.521747][ T481] loop8: detected capacity change from 0 to 7 [ 30.778764][ T495] 9pnet_virtio: no channels available for device syz [ 31.527550][ T498] Invalid ELF header magic: != ELF [ 31.886586][ T509] tipc: Started in network mode [ 31.909512][ T509] tipc: Node identity 7f000001, cluster identity 4711 [ 31.930719][ T509] tipc: Enabled bearer , priority 10 [ 32.175162][ T531] Invalid ELF header magic: != ELF [ 33.462420][ T538] 9pnet_virtio: no channels available for device syz [ 33.477735][ T19] tipc: Node number set to 2130706433 [ 33.491139][ T28] kauditd_printk_skb: 129 callbacks suppressed [ 33.491155][ T28] audit: type=1400 audit(1784922745.498:278): avc: denied { unlink } for pid=536 comm="syz.2.74" name="#3" dev="tmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 33.522693][ T28] audit: type=1400 audit(1784922745.498:279): avc: denied { mount } for pid=536 comm="syz.2.74" name="/" dev="overlay" ino=138 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 33.596776][ T28] audit: type=1400 audit(1784922745.498:280): avc: denied { unmount } for pid=536 comm="syz.2.74" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 33.630138][ T555] ================================================================== [ 33.638429][ T555] BUG: KASAN: use-after-free in rcu_segcblist_enqueue+0x62/0xb0 [ 33.643177][ T28] audit: type=1400 audit(1784922745.628:281): avc: denied { create } for pid=555 comm="syz.2.82" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 33.646698][ T555] Write of size 8 at addr ffff888119402590 by task syz.2.82/555 [ 33.646716][ T555] [ 33.646721][ T555] CPU: 1 PID: 555 Comm: syz.2.82 Not tainted syzkaller #0 [ 33.684961][ T555] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 33.685266][ T28] audit: type=1400 audit(1784922745.628:282): avc: denied { connect } for pid=555 comm="syz.2.82" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 33.695292][ T555] Call Trace: [ 33.695300][ T555] [ 33.695306][ T555] __dump_stack+0x21/0x24 [ 33.695333][ T555] dump_stack_lvl+0x110/0x170 [ 33.695353][ T555] ? __cfi_dump_stack_lvl+0x8/0x8 [ 33.736876][ T28] audit: type=1400 audit(1784922745.628:283): avc: denied { ioctl } for pid=555 comm="syz.2.82" path="socket:[16112]" dev="sockfs" ino=16112 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 33.737810][ T555] ? rcu_segcblist_enqueue+0x62/0xb0 [ 33.768472][ T555] print_address_description+0x71/0x200 [ 33.774219][ T555] print_report+0x4a/0x60 [ 33.778834][ T555] kasan_report+0x122/0x150 [ 33.783361][ T555] ? rcu_segcblist_enqueue+0x62/0xb0 [ 33.789454][ T555] __asan_report_store8_noabort+0x17/0x20 [ 33.795471][ T555] rcu_segcblist_enqueue+0x62/0xb0 [ 33.800720][ T555] call_rcu+0x554/0xf50 [ 33.804916][ T555] ? __cfi_call_rcu+0x10/0x10 [ 33.809618][ T555] ? mutex_unlock+0x8f/0x230 [ 33.814243][ T555] ? __cfi_mutex_unlock+0x10/0x10 [ 33.819317][ T555] ? __kasan_check_write+0x14/0x20 [ 33.824626][ T555] ? l2tp_session_delete+0x48/0x4d0 [ 33.829854][ T555] pppol2tp_release+0x1e3/0x2b0 [ 33.834876][ T555] sock_close+0xc9/0x220 [ 33.840391][ T555] ? __cfi_sock_close+0x10/0x10 [ 33.846422][ T555] __fput+0x1fd/0x8f0 [ 33.850816][ T555] ____fput+0x15/0x20 [ 33.855066][ T555] task_work_run+0x1e1/0x250 [ 33.860588][ T555] ? __cfi_task_work_run+0x10/0x10 [ 33.865920][ T555] ? __cfi___close_range+0x10/0x10 [ 33.871087][ T555] exit_to_user_mode_loop+0x9b/0xb0 [ 33.876393][ T555] exit_to_user_mode_prepare+0x87/0xd0 [ 33.881919][ T555] syscall_exit_to_user_mode+0x1a/0x30 [ 33.887573][ T555] do_syscall_64+0x58/0xa0 [ 33.892015][ T555] ? clear_bhb_loop+0x30/0x80 [ 33.896751][ T555] ? clear_bhb_loop+0x30/0x80 [ 33.901450][ T555] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 33.907554][ T555] RIP: 0033:0x7fb60d79de99 [ 33.912257][ T555] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 33.933317][ T555] RSP: 002b:00007ffe998c0ce8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 33.942732][ T555] RAX: 0000000000000000 RBX: 00007ffe998c0dd0 RCX: 00007fb60d79de99 [ 33.951317][ T555] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 33.960201][ T555] RBP: 0000000000008345 R08: 0000000000000001 R09: 0000000000000000 [ 33.968407][ T555] R10: 0000001b2dc20000 R11: 0000000000000246 R12: 00007ffe998c0e10 [ 33.981085][ T555] R13: 00007fb60da25fac R14: 000000000000837b R15: 00007fb60da25fa0 [ 33.992249][ T555] [ 33.995397][ T555] [ 33.997847][ T555] Allocated by task 560: [ 34.002204][ T555] kasan_set_track+0x4b/0x70 [ 34.007094][ T555] kasan_save_alloc_info+0x1f/0x30 [ 34.012998][ T555] __kasan_kmalloc+0x95/0xb0 [ 34.018057][ T555] __kmalloc+0xb4/0x1e0 [ 34.022680][ T555] l2tp_session_create+0x38/0xbd0 [ 34.027740][ T555] pppol2tp_connect+0xbf5/0x1640 [ 34.032720][ T555] __sys_connect+0x3da/0x460 [ 34.037944][ T555] __x64_sys_connect+0x7a/0x90 [ 34.042843][ T555] x64_sys_call+0x88d/0x9a0 [ 34.047546][ T555] do_syscall_64+0x4c/0xa0 [ 34.052546][ T555] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 34.059833][ T555] [ 34.062530][ T555] Freed by task 8: [ 34.066473][ T555] kasan_set_track+0x4b/0x70 [ 34.071725][ T555] kasan_save_free_info+0x2b/0x40 [ 34.077520][ T555] ____kasan_slab_free+0x132/0x180 [ 34.083117][ T555] __kasan_slab_free+0x11/0x20 [ 34.088453][ T555] slab_free_freelist_hook+0xc2/0x190 [ 34.094215][ T555] __kmem_cache_free+0xb7/0x1b0 [ 34.099806][ T555] kfree+0x6f/0xf0 [ 34.104016][ T555] l2tp_session_put+0xaf/0x1a0 [ 34.109143][ T555] l2tp_session_delete+0x3df/0x4d0 [ 34.114558][ T555] l2tp_tunnel_del_work+0x199/0x410 [ 34.120153][ T555] process_one_work+0x717/0xc30 [ 34.125298][ T555] worker_thread+0xa4d/0x11d0 [ 34.130169][ T555] kthread+0x281/0x320 [ 34.134626][ T555] ret_from_fork+0x1f/0x30 [ 34.139772][ T555] [ 34.142132][ T555] Last potentially related work creation: [ 34.148515][ T555] kasan_save_stack+0x3a/0x60 [ 34.153768][ T555] __kasan_record_aux_stack+0xb6/0xc0 [ 34.159248][ T555] kasan_record_aux_stack_noalloc+0xb/0x10 [ 34.165340][ T555] call_rcu+0xcf/0xf50 [ 34.169966][ T555] pppol2tp_release+0x1e3/0x2b0 [ 34.174846][ T555] sock_close+0xc9/0x220 [ 34.179136][ T555] __fput+0x1fd/0x8f0 [ 34.183849][ T555] ____fput+0x15/0x20 [ 34.188348][ T555] task_work_run+0x1e1/0x250 [ 34.192962][ T555] exit_to_user_mode_loop+0x9b/0xb0 [ 34.198372][ T555] exit_to_user_mode_prepare+0x87/0xd0 [ 34.203942][ T555] syscall_exit_to_user_mode+0x1a/0x30 [ 34.209522][ T555] do_syscall_64+0x58/0xa0 [ 34.216401][ T555] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 34.222346][ T555] [ 34.224698][ T555] The buggy address belongs to the object at ffff888119402400 [ 34.224698][ T555] which belongs to the cache kmalloc-512 of size 512 [ 34.239983][ T555] The buggy address is located 400 bytes inside of [ 34.239983][ T555] 512-byte region [ffff888119402400, ffff888119402600) [ 34.254603][ T555] [ 34.257349][ T555] The buggy address belongs to the physical page: [ 34.264871][ T555] page:ffffea0004650000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x119400 [ 34.276196][ T555] head:ffffea0004650000 order:2 compound_mapcount:0 compound_pincount:0 [ 34.284630][ T555] flags: 0x4000000000010200(slab|head|zone=1) [ 34.290831][ T555] raw: 4000000000010200 ffffea000460d300 dead000000000002 ffff888100042f00 [ 34.299711][ T555] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 34.308507][ T555] page dumped because: kasan: bad access detected [ 34.315589][ T555] page_owner tracks the page as allocated [ 34.321448][ T555] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 108, tgid 108 (udevd), ts 5818717594, free_ts 0 [ 34.342285][ T555] post_alloc_hook+0x1f5/0x210 [ 34.347191][ T555] prep_new_page+0x1c/0x110 [ 34.351887][ T555] get_page_from_freelist+0x2ca9/0x2d20 [ 34.357550][ T555] __alloc_pages+0x1fa/0x610 [ 34.362339][ T555] alloc_slab_page+0x6e/0xf0 [ 34.367130][ T555] new_slab+0x98/0x3e0 [ 34.371492][ T555] ___slab_alloc+0x70f/0xb70 [ 34.376222][ T555] __slab_alloc+0x5e/0xa0 [ 34.380600][ T555] __kmem_cache_alloc_node+0x204/0x2d0 [ 34.386342][ T555] __kmalloc_node_track_caller+0xa1/0x1e0 [ 34.392782][ T555] __alloc_skb+0x226/0x4a0 [ 34.397483][ T555] alloc_skb_with_frags+0xa8/0x620 [ 34.402624][ T555] sock_alloc_send_pskb+0x87f/0x9a0 [ 34.407856][ T555] unix_dgram_sendmsg+0x5c1/0x1710 [ 34.413791][ T555] sock_write_iter+0x2ea/0x3f0 [ 34.418735][ T555] vfs_write+0x5ef/0xd00 [ 34.423084][ T555] page_owner free stack trace missing [ 34.423761][ T28] audit: type=1400 audit(1784922746.428:284): avc: denied { write } for pid=568 comm="syz.1.84" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 34.428981][ T555] [ 34.428986][ T555] Memory state around the buggy address: [ 34.428997][ T555] ffff888119402480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.429009][ T555] ffff888119402500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.468665][ T28] audit: type=1400 audit(1784922746.458:285): avc: denied { read } for pid=568 comm="syz.1.84" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 34.474775][ T555] >ffff888119402580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.474786][ T555] ^ [ 34.474796][ T555] ffff888119402600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.474806][ T555] ffff888119402680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.474814][ T555] ================================================================== [ 34.474821][ T555] Disabling lock debugging due to kernel taint [ 34.550807][ T28] audit: type=1400 audit(1784922746.508:286): avc: denied { read } for pid=85 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 34.575651][ T28] audit: type=1400 audit(1784922746.508:287): avc: denied { search } for pid=85 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1