last executing test programs: 165.884393ms ago: executing program 2 (id=3): socket(0x1e, 0x805, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) timer_create(0x8, &(0x7f0000000000)={0x0, 0x35, 0x0, @thr={&(0x7f00000000c0)="1f59c92bf04d2580490bad123731f3115e7f030f7785bb7cc9cdd262ebed7cf07c", 0x0}}, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='maps\x00') ioctl$PPPIOCSFLAGS1(r0, 0xc0686611, &(0x7f0000000280)=0x68) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x38}, 0x80) clock_gettime(0xfffffffffffffffe, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup(r4) syz_ublk_setup_queues(r5, r3, &(0x7f00000004c0)={0x0, 0x42cc, 0x10, 0x1, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe706, 0x1000, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x4, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93e9, 0x2000, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x230}}], 0x1, 0x0, 0x0) 113.663518ms ago: executing program 2 (id=5): creat(&(0x7f0000000040)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000000140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x6000}}) mount(&(0x7f00000001c0)=@filename='./file0\x00', &(0x7f0000000000)='./file0\x00', &(0x7f0000000240)='aufs\x00', 0x40, 0x0) 98.23353ms ago: executing program 3 (id=4): r0 = syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f0000000040)) ioctl$BTRFS_IOC_DEFRAG(r0, 0x50009402, 0x0) r1 = socket(0x10, 0x2, 0x0) pwrite64(r0, &(0x7f00000001c0)="3a3b79d650e4db2be2c2d0ca2a19612b67ff63c44bfd638fcda9ec443a9fccb76716de7da16379565722f654b1757d3b6b33be58bc4b6c1e9185de0363232765ad2de3b38ad9fb8fcf2c5a4f8a75", 0x4e, 0x2) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000000)={'ip6gre0\x00', &(0x7f0000000100)={'syztnl1\x00', 0x0, 0x0, 0xa, 0x4, 0x30, 0x17, @dev={0xfe, 0x80, '\x00', 0x20}, @mcast2, 0x10, 0x8000, 0xfffffffc, 0x4c51}}) (async) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000180)={'syztnl1\x00', 0x0}) syz_usb_connect(0x2, 0x4d, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x35, 0xab, 0xb4, 0x40, 0x22b8, 0x162, 0x401d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3b, 0x1, 0x7f, 0x0, 0x50, 0xf, "", [{{0x9, 0x4, 0x26, 0x0, 0x1, 0xff, 0xfb, 0xff, 0x2c, [@uac_control={{0xa, 0x24, 0x1, 0xc978, 0x20}, [@output_terminal={0x9, 0x24, 0x3, 0x2, 0x303, 0x1, 0x4, 0x1}, @processing_unit={0xd, 0x24, 0x7, 0x1, 0x0, 0xfa, '_@X\b14'}]}], [{{0x9, 0x5, 0x82, 0x1, 0x20, 0x7, 0x5, 0x2}}]}}]}}]}}, 0x0) 60.776054ms ago: executing program 0 (id=1): r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000100)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '2\x00'}}}) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000400)={0x4, 0x0, 0x0, 0x1a8, 0x138, 0x1, 0x0, 0x80210, 0x0, 0x0, @by_dev={r1}, [@snapshot={0x0, 0x2000, 0x0, 0x70, 'snapshot\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram={'/dev/ram', 0x0}, 0x20, 'PO', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]}) 54.831754ms ago: executing program 1 (id=2): open_tree(0xffffffffffffffff, 0x0, 0x5000) r0 = socket(0x11, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000400)={'gre0\x00', 0x0}) bind$packet(r0, &(0x7f0000000440)={0x11, 0x0, r2}, 0x14) getitimer(0x2, &(0x7f0000000680)) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000480)=0xe9, 0x4) syz_genetlink_get_family_id$ethtool(&(0x7f00000005c0), r1) sendmsg$netlink(r0, &(0x7f00000004c0)={0x0, 0x0, 0x0}, 0x4040095) r3 = openat$kvm(0x0, &(0x7f0000000500), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000600)='mounts\x00') prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000640)='fd/3\x00') ioctl$KVM_CAP_VM_DISABLE_NX_HUGE_PAGES(r4, 0x4068aea3, &(0x7f0000000540)) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fdinfo\x00') prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') recvfrom(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x1c0) r5 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000140), 0x2000, 0x0) ioctl$DM_LIST_DEVICES(r5, 0xc138fd02, &(0x7f00000001c0)={0x4, 0x0, 0x0, 0x1f8, 0x138, 0x0, 0x0, 0x20000, 0x0, 0x0, {}, "4aa73507b5cea6676bac087551179e88957cca258ed024270a2d91f44688b76d281e5b04665bea594904f16d720b8f395f21d0902004fe54c3f5d3ed257cb370f8a5f0a0bd8fde59a75bd0b0eebd07d7d78df089d732535d546bee8ce97bdda037a84141167e603dbd361ec9891c1f174f2b2f2d857e56006b648e14bbc5f624c0a02a032e6fe0f437683f2b186b02438a5c2df0666a65d202e9db972c116b9a1f5fe43af61ccec590787d3de230ade369fe68b4e7351cf598b5"}) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0/file1\x00', 0x1c0) mount$incfs(&(0x7f0000000100)='./file0\x00', &(0x7f0000000180)='./file0/file1\x00', &(0x7f00000003c0), 0x90, 0x0) mount(0x0, &(0x7f0000000e00)='./file0/file1\x00', 0x0, 0x800020, 0x0) 0s ago: executing program 2 (id=6): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat$binderfs_feature(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/features/transaction_report\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./proc/asound/devices\x00', 0x62c002, 0x0) r2 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl$DM_DEV_CREATE(r2, 0xc138fd03, &(0x7f0000000340)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}, @uuid={'LVM-syz', 0x0, '3\x00'}}}) ioctl$DM_TABLE_LOAD(r2, 0xc138fd09, &(0x7f0000000580)={0x4, 0x0, 0x0, 0x168, 0x138, 0x1, 0x0, 0x20000, 0x0, 0x0, @by_dev={r3}, [@error={0x0, 0xc40, 0x0, 0x30}]}) ioctl$DM_DEV_SUSPEND(r2, 0xc138fd06, &(0x7f0000000700)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}}) faccessat(r0, &(0x7f0000000140)='./proc\x00', 0x4330377940ba9fd0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000180), 0x40, 0x0) r5 = socket$key(0xf, 0x3, 0x2) ioctl$VHOST_VDPA_GET_AS_NUM(r0, 0x8004af7a, &(0x7f0000000480)) sendmsg$key(r5, &(0x7f0000000200)={0x0, 0x3, &(0x7f0000000240)={&(0x7f0000000280)={0x2, 0x3, 0x0, 0x9, 0xf, 0x0, 0x0, 0x0, [@sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x5, 0x5, 0xff, 0x0, 0x0, @in6={0xa, 0x4e20, 0x8001, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4}}, @sadb_x_nat_t_type={0x1, 0x14, 0x3}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0xe, @in6={0xa, 0x4e24, 0x7, @loopback, 0xa5d0}}]}, 0x78}}, 0x0) ioctl$PTP_EXTTS_REQUEST2(r4, 0x40103d0b, &(0x7f00000001c0)={0x1, 0x9}) read(r1, &(0x7f0000000500)=""/100, 0x100) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.187' (ED25519) to the list of known hosts. [ 29.283862][ T36] audit: type=1400 audit(1792905105.310:64): avc: denied { mounton } for pid=287 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 29.286977][ T287] cgroup: Unknown subsys name 'net' [ 29.306510][ T36] audit: type=1400 audit(1792905105.310:65): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.333871][ T36] audit: type=1400 audit(1792905105.330:66): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.334230][ T287] cgroup: Unknown subsys name 'devices' [ 29.455584][ T287] cgroup: Unknown subsys name 'hugetlb' [ 29.461217][ T287] cgroup: Unknown subsys name 'rlimit' [ 29.556231][ T36] audit: type=1400 audit(1792905105.580:67): avc: denied { setattr } for pid=287 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 29.579592][ T36] audit: type=1400 audit(1792905105.580:68): avc: denied { mounton } for pid=287 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 29.604337][ T36] audit: type=1400 audit(1792905105.580:69): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 29.629881][ T289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 29.639096][ T36] audit: type=1400 audit(1792905105.660:70): avc: denied { relabelto } for pid=289 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.664536][ T36] audit: type=1400 audit(1792905105.660:71): avc: denied { write } for pid=289 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.695288][ T36] audit: type=1400 audit(1792905105.720:72): avc: denied { read } for pid=287 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.696552][ T287] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 29.720781][ T36] audit: type=1400 audit(1792905105.720:73): avc: denied { open } for pid=287 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.566921][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.574050][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.581116][ T296] bridge_slave_0: entered allmulticast mode [ 30.587637][ T296] bridge_slave_0: entered promiscuous mode [ 30.594211][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.601264][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.608428][ T296] bridge_slave_1: entered allmulticast mode [ 30.614715][ T296] bridge_slave_1: entered promiscuous mode [ 30.639540][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.646633][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.653767][ T295] bridge_slave_0: entered allmulticast mode [ 30.659929][ T295] bridge_slave_0: entered promiscuous mode [ 30.667661][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.674741][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.681795][ T295] bridge_slave_1: entered allmulticast mode [ 30.688079][ T295] bridge_slave_1: entered promiscuous mode [ 30.735492][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.742551][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.749809][ T297] bridge_slave_0: entered allmulticast mode [ 30.756144][ T297] bridge_slave_0: entered promiscuous mode [ 30.765611][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.772664][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.779803][ T294] bridge_slave_0: entered allmulticast mode [ 30.786059][ T294] bridge_slave_0: entered promiscuous mode [ 30.795042][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.802098][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.809208][ T297] bridge_slave_1: entered allmulticast mode [ 30.815461][ T297] bridge_slave_1: entered promiscuous mode [ 30.824466][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.831529][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.838602][ T294] bridge_slave_1: entered allmulticast mode [ 30.844855][ T294] bridge_slave_1: entered promiscuous mode [ 30.969716][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.976785][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.984106][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.991170][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.015479][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.022555][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.029853][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.036892][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.047379][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.054465][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.061744][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.068799][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.078394][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.085478][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.092740][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.099793][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.138555][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.146342][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.153711][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.160857][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.168601][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.175820][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.182989][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.190374][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.200950][ T52] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.208008][ T52] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.218485][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.225537][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.250042][ T52] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.257101][ T52] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.273178][ T52] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.280280][ T52] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.305987][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.313020][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.321912][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.328965][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.336551][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.343594][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.351947][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.359010][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.371358][ T296] veth0_vlan: entered promiscuous mode [ 31.402226][ T296] veth1_macvtap: entered promiscuous mode [ 31.416994][ T295] veth0_vlan: entered promiscuous mode [ 31.437987][ T297] veth0_vlan: entered promiscuous mode [ 31.443970][ T294] veth0_vlan: entered promiscuous mode [ 31.468652][ T297] veth1_macvtap: entered promiscuous mode [ 31.476529][ T296] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 31.492741][ T295] veth1_macvtap: entered promiscuous mode [ 31.513025][ T294] veth1_macvtap: entered promiscuous mode [ 31.573196][ T319] ======================================================= [ 31.573196][ T319] WARNING: The mand mount option has been deprecated and [ 31.573196][ T319] and is ignored by this kernel. Remove the mand [ 31.573196][ T319] option from the mount to silence this warning. [ 31.573196][ T319] ======================================================= [ 31.626895][ T325] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 31.646096][ T327] ================================================================== [ 31.654201][ T327] BUG: KASAN: slab-use-after-free in snapshot_ctr+0x586/0x1350 [ 31.661789][ T327] Read of size 8 at addr ffff888104e7e418 by task syz.0.1/327 [ 31.669257][ T327] [ 31.671616][ T327] CPU: 1 UID: 0 PID: 327 Comm: syz.0.1 Not tainted syzkaller #0 790d506eeb1243e613a7e15525cb861d28cb7486 [ 31.671641][ T327] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 31.671659][ T327] Call Trace: [ 31.671665][ T327] [ 31.671672][ T327] __dump_stack+0x21/0x30 [ 31.671703][ T327] dump_stack_lvl+0x140/0x1c0 [ 31.671730][ T327] ? __cfi_dump_stack_lvl+0x10/0x10 [ 31.671759][ T327] ? __cfi__printk+0x10/0x10 [ 31.671784][ T327] print_address_description+0x71/0x210 [ 31.671811][ T327] print_report+0x4a/0x70 [ 31.671836][ T327] kasan_report+0x162/0x1a0 [ 31.671854][ T327] ? snapshot_ctr+0x586/0x1350 [ 31.671875][ T327] ? snapshot_ctr+0x586/0x1350 [ 31.671895][ T327] __asan_report_load8_noabort+0x18/0x20 [ 31.671919][ T327] snapshot_ctr+0x586/0x1350 [ 31.671939][ T327] ? dm_split_args+0xa1/0x740 [ 31.671956][ T327] ? __cfi_snapshot_ctr+0x10/0x10 [ 31.671976][ T327] ? dm_split_args+0x5d0/0x740 [ 31.671994][ T327] dm_table_add_target+0x59f/0xcb0 [ 31.672012][ T327] table_load+0x2eb/0x7d0 [ 31.672036][ T327] ? __check_object_size+0x99/0x870 [ 31.672061][ T327] ? __cfi_table_load+0x10/0x10 [ 31.672086][ T327] ? __kasan_check_write+0x18/0x20 [ 31.672109][ T327] ? __cfi_table_load+0x10/0x10 [ 31.672140][ T327] dm_ctl_ioctl+0x8f3/0xde0 [ 31.672167][ T327] ? __cfi_dm_ctl_ioctl+0x10/0x10 [ 31.672196][ T327] ? __fget_files+0x2bc/0x330 [ 31.672213][ T327] ? bpf_lsm_file_ioctl+0xd/0x20 [ 31.672231][ T327] ? security_file_ioctl+0x3e/0x110 [ 31.672255][ T327] ? __cfi_dm_ctl_ioctl+0x10/0x10 [ 31.672278][ T327] __se_sys_ioctl+0x126/0x1b0 [ 31.672296][ T327] __x64_sys_ioctl+0x7f/0xa0 [ 31.672312][ T327] x64_sys_call+0x1878/0x2ee0 [ 31.672330][ T327] do_syscall_64+0x57/0xf0 [ 31.672348][ T327] ? clear_bhb_loop+0x50/0xa0 [ 31.672371][ T327] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 31.672394][ T327] RIP: 0033:0x7f703b19f559 [ 31.672412][ T327] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 31.672426][ T327] RSP: 002b:00007f703c038028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 31.672449][ T327] RAX: ffffffffffffffda RBX: 00007f703b425fa0 RCX: 00007f703b19f559 [ 31.672463][ T327] RDX: 0000200000000400 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 31.672475][ T327] RBP: 00007f703b236b20 R08: 0000000000000000 R09: 0000000000000000 [ 31.672487][ T327] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 31.672498][ T327] R13: 00007f703b426038 R14: 00007f703b425fa0 R15: 00007ffffb2c6d48 [ 31.672513][ T327] [ 31.672519][ T327] [ 31.932794][ T327] Allocated by task 327: [ 31.937043][ T327] kasan_save_track+0x3e/0x80 [ 31.941757][ T327] kasan_save_alloc_info+0x3a/0x50 [ 31.946890][ T327] __kasan_kmalloc+0x96/0xb0 [ 31.951492][ T327] __kmalloc_cache_node_noprof+0x225/0x430 [ 31.957312][ T327] dm_get_table_device+0x1e3/0x6c0 [ 31.962455][ T327] dm_get_device+0x32b/0x7f0 [ 31.967052][ T327] snapshot_ctr+0x292/0x1350 [ 31.971653][ T327] dm_table_add_target+0x59f/0xcb0 [ 31.976778][ T327] table_load+0x2eb/0x7d0 [ 31.981124][ T327] dm_ctl_ioctl+0x8f3/0xde0 [ 31.985640][ T327] __se_sys_ioctl+0x126/0x1b0 [ 31.990324][ T327] __x64_sys_ioctl+0x7f/0xa0 [ 31.994922][ T327] x64_sys_call+0x1878/0x2ee0 [ 31.999674][ T327] do_syscall_64+0x57/0xf0 [ 32.004113][ T327] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 32.010029][ T327] [ 32.012358][ T327] Freed by task 327: [ 32.016247][ T327] kasan_save_track+0x3e/0x80 [ 32.020944][ T327] kasan_save_free_info+0x44/0x50 [ 32.026000][ T327] __kasan_slab_free+0x5f/0x80 [ 32.030791][ T327] kfree+0x158/0x440 [ 32.034704][ T327] dm_put_table_device+0x298/0x2e0 [ 32.039841][ T327] dm_get_device+0x571/0x7f0 [ 32.044443][ T327] snapshot_ctr+0x435/0x1350 [ 32.049053][ T327] dm_table_add_target+0x59f/0xcb0 [ 32.054184][ T327] table_load+0x2eb/0x7d0 [ 32.058539][ T327] dm_ctl_ioctl+0x8f3/0xde0 [ 32.063057][ T327] __se_sys_ioctl+0x126/0x1b0 [ 32.067751][ T327] __x64_sys_ioctl+0x7f/0xa0 [ 32.072362][ T327] x64_sys_call+0x1878/0x2ee0 [ 32.077053][ T327] do_syscall_64+0x57/0xf0 [ 32.081511][ T327] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 32.087427][ T327] [ 32.089764][ T327] The buggy address belongs to the object at ffff888104e7e400 [ 32.089764][ T327] which belongs to the cache kmalloc-96 of size 96 [ 32.103649][ T327] The buggy address is located 24 bytes inside of [ 32.103649][ T327] freed 96-byte region [ffff888104e7e400, ffff888104e7e460) [ 32.117323][ T327] [ 32.119668][ T327] The buggy address belongs to the physical page: [ 32.126308][ T327] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x104e7e [ 32.135184][ T327] flags: 0x4000000000000000(zone=1) [ 32.140411][ T327] page_type: f5(slab) [ 32.144403][ T327] raw: 4000000000000000 ffff888100041280 dead000000000100 dead000000000122 [ 32.153007][ T327] raw: 0000000000000000 0000000080200020 00000001f5000000 0000000000000000 [ 32.161597][ T327] page dumped because: kasan: bad access detected [ 32.168032][ T327] page_owner tracks the page as allocated [ 32.173767][ T327] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 2327909539, free_ts 0 [ 32.191327][ T327] post_alloc_hook+0x37d/0x3b0 [ 32.196119][ T327] prep_new_page+0x2d/0x180 [ 32.200648][ T327] get_page_from_freelist+0x4aea/0x4ba0 [ 32.206244][ T327] __alloc_pages_noprof+0x35a/0x7e0 [ 32.211470][ T327] alloc_slab_page+0x6b/0x1e0 [ 32.216183][ T327] allocate_slab+0x69/0x430 [ 32.220705][ T327] ___slab_alloc+0x591/0x8c0 [ 32.225311][ T327] __kmalloc_cache_noprof+0x2cd/0x470 [ 32.230729][ T327] acpi_ut_evaluate_object+0xfd/0x5b0 [ 32.236112][ T327] acpi_ut_execute_power_methods+0x9f/0x1d0 [ 32.242039][ T327] acpi_get_object_info+0x546/0xe20 [ 32.247299][ T327] acpi_init_device_object+0x77c/0x1690 [ 32.252862][ T327] acpi_add_single_object+0x10a/0x1a10 [ 32.258342][ T327] acpi_bus_check_add+0x373/0x860 [ 32.263391][ T327] acpi_bus_check_add_1+0x26/0x30 [ 32.268436][ T327] acpi_ns_walk_namespace+0x25b/0x690 [ 32.273823][ T327] page_owner free stack trace missing [ 32.279219][ T327] [ 32.281549][ T327] Memory state around the buggy address: [ 32.287189][ T327] ffff888104e7e300: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc [ 32.295260][ T327] ffff888104e7e380: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 32.303347][ T327] >ffff888104e7e400: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 32.311404][ T327] ^ [ 32.316348][ T327] ffff888104e7e480: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 32.324429][ T327] ffff888104e7e500: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 32.332500][ T327] ================================================================== [ 32.345800][ T327] Disabling lock debugging due to kernel taint [ 32.352064][ T327] device-mapper: table: 252:0: device 1:0 not in table devices list [ 32.366602][ T327] device-mapper: table: 252:0: snapshot: COW device cannot be the same as origin device (-EINVAL) [ 32.379148][ T327] device-mapper: ioctl: error adding target to table [ 32.388847][ T327] device-mapper: table: 252:0: dm_table_destroy: dm_put_device call missing for 1:0 [ 32.500392][ T294] ------------[ cut here ]------------ [ 32.505994][ T294] WARNING: CPU: 1 PID: 294 at fs/inode.c:340 drop_nlink+0xce/0x110 [ 32.513958][ T294] Modules linked in: [ 32.517868][ T294] CPU: 1 UID: 0 PID: 294 Comm: syz-executor Tainted: G B syzkaller #0 790d506eeb1243e613a7e15525cb861d28cb7486 [ 32.530991][ T294] Tainted: [B]=BAD_PAGE [ 32.535178][ T294] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 32.545297][ T294] RIP: 0010:drop_nlink+0xce/0x110 [ 32.550337][ T294] Code: 04 00 00 be 08 00 00 00 e8 ff 0b ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d e9 c8 16 b6 03 cc e8 e2 80 94 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c [ 32.570216][ T294] RSP: 0018:ffffc900011dfc88 EFLAGS: 00010293 [ 32.576666][ T294] RAX: ffffffff81f4ce1e RBX: ffff88810efa7bf0 RCX: ffff88812db43b40 [ 32.584708][ T294] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 32.592709][ T294] RBP: ffffc900011dfcb0 R08: 0000000000000003 R09: 0000000000000004 [ 32.600707][ T294] R10: dffffc0000000000 R11: fffff5200023bf80 R12: dffffc0000000000 [ 32.608735][ T294] R13: 1ffff11021df4f87 R14: ffff88810efa7c38 R15: 0000000000000000 [ 32.616738][ T294] FS: 0000555579bc5500(0000) GS:ffff8881f6d00000(0000) knlGS:0000000000000000 [ 32.625708][ T294] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.632289][ T294] CR2: 0000555579bf0998 CR3: 0000000122106000 CR4: 00000000003526b0 [ 32.640398][ T294] Call Trace: [ 32.643706][ T294] [ 32.646654][ T294] shmem_rmdir+0x5f/0x90 [ 32.650917][ T294] vfs_rmdir+0x3de/0x560 [ 32.655193][ T294] incfs_kill_sb+0x102/0x220 [ 32.659807][ T294] deactivate_locked_super+0xd5/0x270 [ 32.665223][ T294] deactivate_super+0xb8/0xe0 [ 32.669921][ T294] cleanup_mnt+0x438/0x4d0 [ 32.674465][ T294] __cleanup_mnt+0x1d/0x40 [ 32.678904][ T294] task_work_run+0x1e8/0x260 [ 32.683564][ T294] ? __cfi_task_work_run+0x10/0x10 [ 32.688697][ T294] ? __x64_sys_umount+0x12e/0x180 [ 32.693763][ T294] ? __cfi___x64_sys_umount+0x10/0x10 [ 32.699152][ T294] ? __kasan_check_read+0x15/0x20 [ 32.704242][ T294] resume_user_mode_work+0x35/0x50 [ 32.709384][ T294] syscall_exit_to_user_mode+0x63/0xb0 [ 32.714898][ T294] do_syscall_64+0x63/0xf0 [ 32.719345][ T294] ? clear_bhb_loop+0x50/0xa0 [ 32.724057][ T294] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 32.729981][ T294] RIP: 0033:0x7f67505a0797 [ 32.734429][ T294] Code: a2 c7 05 5c 9f 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 32.754078][ T294] RSP: 002b:00007ffee1327648 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 32.762491][ T294] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f67505a0797 [ 32.770494][ T294] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffee1327700 [ 32.778489][ T294] RBP: 00007ffee1327700 R08: 00007ffee1328700 R09: 00000000ffffffff [ 32.786507][ T294] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffee13287f0 [ 32.794524][ T294] R13: 00007f6750635f63 R14: 0000000000007eb5 R15: 00007ffee13298c0 [ 32.802499][ T294] [ 32.805555][ T294] ---[ end trace 0000000000000000 ]--- [ 32.811149][ T294] BUG: kernel NULL pointer dereference, address: 0000000000000168 [ 32.818962][ T294] #PF: supervisor write access in kernel mode [ 32.825029][ T294] #PF: error_code(0x0002) - not-present page [ 32.831035][ T294] PGD 800000010fb36067 P4D 800000010fb36067 PUD 0 [ 32.837550][ T294] Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI [ 32.843605][ T294] CPU: 0 UID: 0 PID: 294 Comm: syz-executor Tainted: G B W syzkaller #0 790d506eeb1243e613a7e15525cb861d28cb7486 [ 32.856804][ T294] Tainted: [B]=BAD_PAGE, [W]=WARN [ 32.861813][ T294] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 32.871856][ T294] RIP: 0010:ihold+0x2a/0x70 [ 32.873350][ T311] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 32.876354][ T294] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 cd 77 94 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 bc 02 ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 dd [ 32.903394][ T294] RSP: 0018:ffffc900011dfcc8 EFLAGS: 00010202 [ 32.909461][ T294] RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffffffff81f4d744 [ 32.917423][ T294] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000168 [ 32.925382][ T294] RBP: ffffc900011dfcd8 R08: 000000000000016c R09: 0000000000000000 [ 32.933343][ T294] R10: dffffc0000000000 R11: ffffed103ed8a209 R12: 0000000000000000 [ 32.941307][ T294] R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 [ 32.949287][ T294] FS: 0000555579bc5500(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 [ 32.958209][ T294] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.964784][ T294] CR2: 0000000000000168 CR3: 0000000122106000 CR4: 00000000003526b0 [ 32.972750][ T294] Call Trace: [ 32.976023][ T294] [ 32.978969][ T294] vfs_rmdir+0x25c/0x560 [ 32.983223][ T294] incfs_kill_sb+0x102/0x220 [ 32.987855][ T294] deactivate_locked_super+0xd5/0x270 [ 32.993248][ T294] deactivate_super+0xb8/0xe0 [ 32.997939][ T294] cleanup_mnt+0x438/0x4d0 [ 33.002347][ T294] __cleanup_mnt+0x1d/0x40 [ 33.006772][ T294] task_work_run+0x1e8/0x260 [ 33.011371][ T294] ? __cfi_task_work_run+0x10/0x10 [ 33.016481][ T294] ? __x64_sys_umount+0x12e/0x180 [ 33.021506][ T294] ? __cfi___x64_sys_umount+0x10/0x10 [ 33.026879][ T294] ? __kasan_check_read+0x15/0x20 [ 33.031903][ T294] resume_user_mode_work+0x35/0x50 [ 33.034915][ T311] usb 4-1: config 127 has an invalid interface number: 38 but max is 0 [ 33.037013][ T294] syscall_exit_to_user_mode+0x63/0xb0 [ 33.045483][ T311] usb 4-1: config 127 has no interface number 0 [ 33.050717][ T294] do_syscall_64+0x63/0xf0 [ 33.059847][ T311] usb 4-1: New USB device found, idVendor=22b8, idProduct=0162, bcdDevice=40.1d [ 33.061476][ T294] ? clear_bhb_loop+0x50/0xa0 [ 33.072935][ T311] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.075167][ T294] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 33.083329][ T311] usb 4-1: Product: syz [ 33.089039][ T294] RIP: 0033:0x7f67505a0797 [ 33.093817][ T311] usb 4-1: Manufacturer: syz [ 33.097608][ T294] Code: a2 c7 05 5c 9f 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 33.102198][ T311] usb 4-1: SerialNumber: syz [ 33.121795][ T294] RSP: 002b:00007ffee1327648 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 33.121819][ T294] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f67505a0797 [ 33.121833][ T294] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffee1327700 [ 33.121845][ T294] RBP: 00007ffee1327700 R08: 00007ffee1328700 R09: 00000000ffffffff [ 33.121860][ T294] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffee13287f0 [ 33.166728][ T294] R13: 00007f6750635f63 R14: 0000000000007eb5 R15: 00007ffee13298c0 [ 33.174734][ T294] [ 33.177763][ T294] Modules linked in: [ 33.181686][ T294] CR2: 0000000000000168 [ 33.185862][ T294] ---[ end trace 0000000000000000 ]--- [ 33.191323][ T294] RIP: 0010:ihold+0x2a/0x70 [ 33.195850][ T294] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 cd 77 94 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 bc 02 ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 dd [ 33.215468][ T294] RSP: 0018:ffffc900011dfcc8 EFLAGS: 00010202 [ 33.221591][ T294] RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffffffff81f4d744 [ 33.229582][ T294] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000168 [ 33.237567][ T294] RBP: ffffc900011dfcd8 R08: 000000000000016c R09: 0000000000000000 [ 33.245552][ T294] R10: dffffc0000000000 R11: ffffed103ed8a209 R12: 0000000000000000 [ 33.253535][ T294] R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 [ 33.261511][ T294] FS: 0000555579bc5500(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 [ 33.270443][ T294] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 33.277030][ T294] CR2: 0000000000000168 CR3: 0000000122106000 CR4: 00000000003526b0 [ 33.285012][ T294] Kernel panic - not syncing: Fatal exception [ 33.291667][ T294] Kernel Offset: disabled [ 33.295993][ T294] Rebooting in 86400 seconds..