last executing test programs: 403.51718ms ago: executing program 3 (id=4): r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) pwritev2(r0, &(0x7f0000000200)=[{&(0x7f0000000140)="0854b0", 0x3}], 0x1, 0x8, 0x2, 0x0) ioctl$F2FS_IOC_GET_FEATURES(r0, 0x8004f50c, &(0x7f0000000080)) ioctl$USBDEVFS_ALLOC_STREAMS(r0, 0x8008551c, &(0x7f0000000000)={0xa14, 0x4, [{0x2}, {0x1, 0x1}, {0x0, 0x1}, {0x9}]}) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000180), r0) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r0, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x44, r1, 0xb4b97feafcf06ff6, 0x70bd2c, 0x25dfdbff, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x44}, 0x1, 0x0, 0x0, 0x80}, 0x40c0) syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f0000000bc0)='./file0\x00', 0x3018840, &(0x7f0000000040)={[{@usrquota}, {@test_dummy_encryption_v1}, {@i_version}, {@nolazytime}]}, 0x1, 0xbca, &(0x7f0000000c00)="$eJzs3M9rHNcdAPDvjFa/VUsupa1NoYLitrR0LVvGBZ/snktbaA89WpFWRmhtK5ICkfBBdu5JDiEEYgj+EwK5x5ecAjk4h8T5C0yICSa52D5smP3ljVe7FvLujiR/PvB23pv3dt/3u6PdeQM7CuCVNZs9pBEnIuJyEjFd3582R4xF7NTGPXl0YzErSVQq//0+iSQiHj+6sdgYmdS3k/XGWETc+0cSv3yrfd6Nre3VhXK5tF5vn968unZ6Y2v7bytXF66UrpSunZv/+7n58/PzPcz1wdprH/zuy3/98dadt+f+/f6xz5O4GFP1vtY8emU2ZpvvSatCRCz0erKcDNXzac0zKeQYEAAAXaUta7hfx3QMxbPF23R89lWuwQEAAAA9URmKqAAAAABHXOL6HwAAAI64xu8AHj+6sdgo+f4iYbAeXoqImVr+jfubaz2F2Klux2I4IiZ+SKL1ttak9rSXNpvN9MkXpaxEn+5D7mbnZkT8drfjn1Tzn6nexd2efxoRcz2Yf/a59gHPv3mbc5b/xR7Mn3f+ALya7l6qncjaz39pc/0TzfPfaPN5hV3OXfuR9/mvsf570rb+e5b/UIf133+6vvKxZu3k07/c6zSqdf33/3e+Wcrmz7YvndgePbwZcbKwW/5JM/+kQ/6X9zjH5OKD2536svyzfBtl0PlX7kScqq7m2vNvSLr9f6LTyyvl0lztcZfX3zrfff7W45+VbP7GtcAgZMd/IvZ3/Nf2OMfMb7470anvxfmn344k/6vWRup73lzY3Fw/EzGS/LN9/9nusTTGNF4jy//Pf+j++d8t/+w7Yaf+PmR/PTfr26x967k5J0+d/Xj/+fdXlv/SPo//u3uc46NPb7/eqS/v/AEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4HNKImIokLTbraVosRkxGxK9iIi1f39j86/L1N64tZX0RMzGcLq+US3MRMV1rJ1n7TLX+rH32ufZ8RByPiPemx6vt4uL18lLeyQMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANA0GRFTkaTFiEgj4sfpNC0W844KAAAA6LmZvAMAAAAA+s71PwAAABx9bdf/hZ+1xgYZCwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEfS8d/fvZ/ETOxcGK+WzEi9bzjXyIB+S/c2bKLfcQCDN5R3AEBuCi31SqVSyTEUYMBc4wPJC/rHOvaM9jwWAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6uP524ez+JiJ0L49WSGan3DecaGdBv6R7HfTjR50CAgRvq1pm8cAdwiBXyDgDIjWt8oLayf1qpae8f6/jM0ZeeFQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDDY6pakrQYEWm1nqbFYsQvImImhpPllXJpLiKORcTX08OjWftM3kEDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQcxtb26sL5XJp/bBVKgcjjCNYibWIAxDGYa+Mx8DmGq9/mDuMGe3c1aWS8xcTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC52NjaXl0ol0vrG3lHAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAORtY2t7daFcLq33sZJ3jgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA5OenAAAA//9JzQmp") 389.822931ms ago: executing program 0 (id=1): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000080)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x1, 0x3}, 0x50) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000001c0)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=@delqdisc={0x24, 0x26, 0x1, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, r5, {0x0, 0xf}, {0xffff, 0xffff}, {0xfff2, 0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x20008085}, 0x2400c800) r6 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000001c0), 0x4) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)={0x2, 0x4, 0x8, 0x1, 0x80, r3, 0x7, '\x00', r5, r6, 0x0, 0x0, 0x3}, 0x50) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000100)={[0xef6, 0x28000000000, 0x200, 0x1000000003, 0x1000, 0x8, 0x1002, 0x2, 0x0, 0xa, 0x0, 0x0, 0x2bda, 0x1ff, 0x40000, 0x20], 0x57000, 0x296151}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$F2FS_IOC_GET_PIN_FILE(r0, 0x8004f50e, &(0x7f0000000040)) 378.816441ms ago: executing program 4 (id=5): r0 = socket$inet(0x2, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000a00)={'veth0\x00'}) sendmsg$nl_route(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c0000001c00050601000000000000000a000000", @ANYRES8=r0, @ANYBLOB="80000001140001"], 0x3c}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) socket$key(0xf, 0x3, 0x2) r2 = open(0x0, 0x80202, 0x0) sendfile(r2, r2, 0x0, 0x2000000000006) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r2, 0xc0406618, &(0x7f0000000000)={@id={0x2, 0x0, @b}}) getgid() timer_create(0x5, &(0x7f0000000080)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) r4 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000f40)={0x0, &(0x7f0000000fc0)=[@nested_amd_vmcb_write_mask={0x17c, 0x38, {0x2, @save_area=0x65d, 0x53, 0x1, 0x6}}, @rdmsr={0x66, 0x18, {0x1de}}, @set_irq_handler={0xc8, 0x20, {0x27}}, @nested_create_vm={0x12d, 0x18, 0x2}, @rdmsr={0x66, 0x18, {0x933}}, @uexit={0x0, 0x18, 0x7ff}, @nested_amd_invlpga={0x17d, 0x20, {0x4, 0xd917}}, @cpuid={0x64, 0x18, {0x8, 0x1f9}}, @nested_create_vm={0x12d, 0x18, 0x3}, @nested_amd_invlpga={0x17d, 0x20, {0xfec00000, 0x67ca}}, @in_dx={0x69, 0x20, {0xdbc0, 0x2}}, @code={0xa, 0x64, {"66ba420066b8000066ef470f3809881800000066baf80cb82402c489ef66bafc0cec400f01c5c744240039000000c74424027a85cf20ff2c2466440f3800ce0f22c366bad104b0aeee3e0f01c366430f38f509"}}, @nested_load_syzos={0x136, 0x80, {0x2, 0x4, [@nested_load_code={0x12e, 0x60, {0x0, "c7442400af000000c74424021b6c0000ff2c24440f011e0f0fab3be394af97470f01ca0fc72e266466440f38291d79105560460f01d126f3420f1c82bd0000000f01c266baa100ed"}}]}}, @nested_create_vm={0x12d, 0x18}, @nested_amd_vmsave={0x183, 0x18, 0x1}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @guest16=0x80a, 0x3, 0x0, 0x8343}}, @set_irq_handler={0xc8, 0x20, {0xb, 0x2}}, @nested_vmresume={0x130, 0x18, 0x2}, @nested_amd_clgi={0x17f, 0x10}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @guest16=0x80c, 0x9, 0x3, 0xef2b}}, @nested_vmlaunch={0x12f, 0x18, 0x2}, @out_dx={0x6a, 0x28, {0x5b31, 0x4, 0x40}}, @set_irq_handler={0xc8, 0x20, {0x5a, 0x1}}, @nested_amd_invlpga={0x17d, 0x20, {0xa000, 0x39b1}}, @nested_create_vm={0x12d, 0x18, 0x1}, @nested_vmresume={0x130, 0x18, 0x3}, @nested_load_syzos={0x136, 0x38, {0x0, 0x4579, [@nested_amd_vmload={0x182, 0x18, 0x3}]}}, @set_irq_handler={0xc8, 0x20, {0x84}}, @nested_load_code={0x12e, 0x5d, {0x0, "66ba410066b8000066ef2ef3470f5fe8c462999c57110f20c035000000200f22c0c42115f3bcd486900000f20f3066420f763f642e3e0f01ca0f01be84000000c4016dd41a"}}, @wrmsr={0x65, 0x20, {0x310, 0x6}}], 0x499}) ioctl$KVM_TDX_INIT_VCPU(r4, 0xc008aeba, &(0x7f0000000f80)={0x2, 0x0, 0xffffffff}) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r3, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) r5 = socket$tipc(0x1e, 0x5, 0x0) listen(r5, 0x0) socket$tipc(0x1e, 0x5, 0x0) accept4(r5, 0x0, 0x0, 0x0) 374.017161ms ago: executing program 2 (id=3): r0 = syz_open_procfs(0x0, &(0x7f0000000100)='fdinfo\x00') syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0), 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0)=0xffffffffffffffff, 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x10000, &(0x7f0000000080), 0x1, 0x50a, &(0x7f0000001f40)="$eJzs3M9vVNUeAPDvnXZoC49HH49HQh/vvQLP2JjYQkFh4QYTExeaGHEhy6YdSGUAQ7sQ0siQGFyTuDcujTtN3OrSuPIPwIULE0NClA1gYjLmztw7nc6PzrTW1rafTzJwzp17z7nfuefMnHtP7w1g1xpP/0ki/hYR9yPiQD27coXx+n9PHi3NPn20NBuVavXCz0ltvcdpPpNvty/LTBQiCh8kLQXWLdy8dWWmXC7diEotP7V49d2phZu3np+/OnO5dLl0bfrcuTOnT519cfqFFWVHxHDPoDrUl8b1eOz960ePvHrx3uuzg62FNcfRVb7VL5Weq0b+2XbxTHN5O8D+pnTSHtftTd0Z+jacNcNi2v+XyscvbvUOAZumWq1Wh7q/Xam2utO2BNi2ktjqPQC2Rv5Dn57/5q/6kuJmDD+23MPz9ROgx4+WqrdjcPZJI/7BKGTrFFvOb1OrjJnWZDwi3q78+nH6itWuQ/ywQRUCALve1+ezYWASLeO/QhxuWu/v2RzKaET8IyIORsQ/I+JQRPwrYsW6KyQR1VXqP9S6oFH/F9ksQuHBemPrRzr+eymb28pfWb35KqMDWW5/RD5gLp3MPpOJKA5dmi+XTnUpf0+P+pvHf+krrT8fC2b78WCwZbA5N7M4s75o2z28EzE22Bp/MpgeuHwaJ4mIIxExtoZyR5vS8899erSRaTmt6B1/TbXDlN6GzJ9VP4l4tn78K9GIf2TFJGLSPD9ZaJufnBqOcunkVNoKTnbcyW+/u/tGt/p7xv/lj62bvHL2qwt/PPBMevz3NrX/yOdvl+MfTSKSxnztQkR1YG113P3+w1q54yfa31tv+9+TvFVL5/3rvZnFxRunIvYkr7Uvn17eNs/n66fxT5zo3P8PZtukn8S/IyJtxP+JiP9GDOT7fiwijkdEh9Aavnn5/+90e6/P9v+nSeOf6/j9l2TtoHb8l+fr+0zk5adLBq4cu/90rPPEfRb/gdWP/5laaiJb0vn7L1nxFdHvnm7ARwgAAAB/eYWo/e1/YbKRLhQmJ+vXgA7F3kL5+sLi/yLi2lz9HoHRKBYuzZdL+QW50Sgm+fXP0ab8dEv+dHbd+KOBkVp+cvZ6eW6rg4ddbl+tzydt/T/10xqv8wLb0A66Dw1Yo179//C9TdoRYNP5/Yfdq6n/d3uyRcVfysDO5Pcfdq9O/f92fLbqvQu+M2D7q+rLsKut3v97P28T2L4G481Gunbbc8e7bYGdqPvvvzMD2MF63yQ/tOZ7/5cT1aHObw1HhycGDK+rip6JkQ51bUkiHVltYIHFiOhv5ZH1VJEPAbs/4aGwtgKHov2tgVhtq6TzcxwiotJ1q/RT6bk/lw/32/hLN5Kn9Qdl9ggwfybKRjebz5f7abHPw90l8Vu/zc/5PgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsKP8HgAA//87jdA6") mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x84, &(0x7f0000000000)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000180)=0xffffffffffffffff, 0x4) (async) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000180)=0xffffffffffffffff, 0x4) openat(r0, &(0x7f0000000000)='./cgroup\x00', 0x440, 0x94) 346.939472ms ago: executing program 1 (id=2): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x8, &(0x7f0000000580), 0x5, 0x504, &(0x7f0000002580)="$eJzs3c9rXFsdAPDvzCR5SZtn33uKvFfBFirUHzSTH0gTFcSVuiiIBTcKNSbTWDPphMykNqFgqrsuXIiiIC7c+xe4sStLQVwrbl1Ji9YIVSpcmTtz00kyk041mfHlfj4wnXvnTOd7ziTfkzPnnjs3gNy62PynEDEZEb+PiHOt3f1PuNi62312b6l5K0SSXP9rIX1ecz97avb/zkbETkSMR8RXvxjxrcLhuPWt7dXFarWy0d4vN9bWy/Wt7Su31hZXKiuV2zPzVxcW5qfnZheOra0PfvidB9d+/eWxXz3/wZNHP/rtb5rVmmyXdbbjOLWaPhpvdzw2EhGfO4lgQ1Bqt2di2BXhv9L8+X0wIi6l+X8uSulPsz8vTrRmwElLkiT5d/JGr+KdBDi1iukYuFCciojWdrE4NdUaw38ozhSrtXrjUzdrm7eXW2Plt2K0ePNWtTLd/qzwVowWmvsz6fbL/dkD+3MR6Rj4x6WJdH9qqVZdHmxXBxxw9kD+/6PUyn8gJ/r/yA+cNvIf8kv+Q37Jf8gv+Q/5Jf8hv+Q/5Jf8h/yS/5Bfnfmfncj15pDqAgzWUX//xwZYD2CgvnLtWvOWZOe/L9/Z2lyt3bmyXKmvTq1tLk0t1TbWp1ZqtZX0nJ21V71etVZbn/l0bN4tNyr1Rrm+tX1jrbZ5u3EjPa//RmV0IK0C+vH2hYd/LETEzmcm0lt0/MmXq3C6JUkhhn0OMjAcpWF3QMDQOPQH+fUan/F7fkkY8P7W5St694yf7Vn0+Vg/keoAA1A8qvDF48FVBBi4y+85/gd5Zf4f8sv8P+TXK8b4hgeQA0fN/0f7Wn5d9Tv///z16gOcvCPn/4FTbbLL9b+SJPnemx3X7pqOiA9ExB9Ko29k1/oCToPiXwrt8f/lcx+bPFg6VvhnOgcwFhHf/fn1n95dbDQ2ZpqP/23v8cbP2o/PDqP+QG/7Z/iyPM3yGADIr91n95ay2yDjPv1CaxHC4fgj7bnJ8XQEc2a3sG+tQuGY1i7s3I+Id7vFL7Svd9468nFmt3Qo/jvt+0LrJdL6jqTXTR9M/Pc64n+0I/75//ldgXx42Ox/prvlXzHN6djLv/39z+QxrY/O+r9szXVn/Kz/K/Xo/y70GePbv/h+t8O76WLvp/cjznftf7N442msg/GbdbvcZ/wn3/jah3uVJb9svU63+JnmVrmxtl6ub21fuZXVYv7qwsL89NzsQjmdoy5nM9WHffbd3z3qFb/Z/rYe7f/TofZPtOv0iT7b/6+PPP76xSPif/xS99+/d9L7A+9/kuzV4ZN9xv/77J+/2ausGX+5x/tf7BY/stKIuT7j13/yJecOA8D/kfrW9upitVrZ6LIx2rvIhg0bg94YiQEGfVXPsTOYDgo4MS+Tftg1AQAAAAAAAAAAAPrVa/Xvw2NcTjzsNgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAnAb/CQAA//9AntRF") rmdir(&(0x7f0000000040)='./file0\x00') r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x8c00, 0x0) r2 = userfaultfd(0x801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000040)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000779000/0x1000)=nil, 0x400000, 0x3, 0x2}) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, 0x0) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f00005cf000/0x400000)=nil) ioctl$TUNSETCARRIER(r0, 0x400454e2, &(0x7f0000000100)) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r3) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) ioctl$TUNSETCARRIER(r0, 0x400454e2, &(0x7f0000000300)=0x1) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random='\x00\a\x00'}) openat(0xffffffffffffff9c, &(0x7f0000001740)='.\x00', 0x511001, 0x488) syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f00000007c0)='./file0\x00', 0x10, &(0x7f00000014c0), 0x1, 0x793, &(0x7f0000000c00)="$eJzs3c1rXFUbAPDnTpKmb9r3TV4QbF0FBA2UTkyNrYKLigsRLBR0bTtMpqFmkimZSWlCoBYR3AhaXAi66dqPunPrx1b/Bd2ISEvVtFhxISN3PjqTZiadtvloze8Htz3n3jM595l77zln5h7mBrBjjab/ZCL2R8R7ScRwY30SEQO1VH/E0Xq5myvL+XRJolp99bekVubGynI+2l6T2tPI7IuIb96OOJBZW295cWkmVywW5hv58crsmfHy4tLB07O56cJ0Ye7wxOTkoSPPHBncuFj/+H5p79X3X3ry86N/vfXo5Xe/TeJo7G1sa49jo4zGaOM9GUjfwlVe3OjKtlmy3TvAPUkvzb76VR77Yzj6aqne9F4SAHiQnI+IKgCwwyT6fwDYYZrfA9xYWc6nS/X89n4fsdWuvRARu+vxN+9v1rf0N+7Z7a7dBx26kay635FExMgG1D8aER9/+fqn6RKbdB8SoJM3L0TEyZHRZvvfan+SNXMW6nqfkPFUD2VGb8tr/2DrfJWOf55tjf9a11/m1vgnOox/Bjtcu/diNGJXe37t9Z+5sgHVdJWO/54faM1tu9kWf8NIXyP339qYbyA5dbpYSNu2/0XEWAwMpvmJdeoYu/739VUr+lrJ9vHf7xff+CStP/2/VSJzpf+2JncqV8ndb9xN1y5EPNbfKf7k1vFPuox/j/dYx8vPvfNRt21p/Gm8zWV1/Js/q6x6KeKJ6Bx/U7Le/MTD47XTYbx5UnTwxU8fDnWrv/34p0taf/OzwFZIj//Q+vGPJO3zNct3X8d3l4a/7rbtzvF3Pv93Ja/V0s3G41yuUpmfiNiVvLJ2/aHWa5v5Zvk0/rHHO1//653/6WfCkz3G33/118/uPf7NlcY/dVfH/+4Tl2/O9HWrv7fjP1lLjTXW9NL+9bqD9/PeAQAAAAAAAAAAAAAAAAAAAAAAAECvMhGxN5JM9lY6k8lm68/wfiSGMsVSuXLgVGlhbipqz8oeiYFM86cuh9t+D3Wi8Xv4zfyh2/JPR8T/I+KDwf/U8tl8qTi13cEDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQMOeLs//T/0yuN17BwBsmt13LHG9sCU7AgBsmTv3/wDAv43+HwB2Hv0/AOw8+n8A2Hn0/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGyy48eOpUv1z5XlfJqfOru4MFM6e3CqUJ7Jzi7ks/nS/JnsdKk0XSxk86XZtpf+0OnvFUulM5Mxt3BuvFIoV8bLi0snZksLc5UTp2dz04UThYEtiwwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeldeXJrJFYuFeYmHJVEdrh+6B2V/Nj/x88Ef961X5qLTeOMT290yAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwc/gkAAP//skMoxA==") chdir(&(0x7f0000000240)='./file0\x00') quotactl$Q_QUOTAON(0xffffffff80000200, &(0x7f0000000180)=@loop={'/dev/loop', 0x0}, 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r4, 0x0) syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000040)='./file1\x00', 0x0, &(0x7f0000000000)={[{@quota}, {@noload}, {@init_itable}]}, 0x4, 0x4d1, &(0x7f0000000500)="$eJzs3c9vI1cdAPDvTH5umjYpVOKHgC6lsKBV7cTbRlVP5QJCVSVExYnDNiTeKIodR7FTmrCH9H9AohIn+BM4IHFA6ok7N7ghpHJAKrACbZA4GM14nM0PO0TdrGcVfz7SyPPmxfP9vjjz3uQ58QtgbN2MiMOImI6IdyNioTieFFu82duyr3v44P7a0YP7a0l0u+/8I8nrs2Nx4jmZZ4pzzkbED74b8ePkfNz2/sHWaqNR3y3K1U5zp9reP/jLZnN1o75R367VVpZXll6/81rtytr6YvPXn3xn860f/u63X/74D4ff+mmW1nxRd7IdV6nX9KnjOJnJiHjrSQQrwUTRnumyE+FTSSPiMxHxUnb9d8vOBgAYhW53IboLJ8sAwHWX5nNgSVop5gLmI00rld4c3gsxlzZa7c7te6297fXeXNliTKX3Nhv1pWKucDGmkqy8nO8/KtfOlO9ExPMR8bOZG3m5stZqrJd54wMAY+yZM+P/v2d64z8AcM3Nlp0AADByxn8AGD/GfwAYP8Z/ABg/xn8AGD/GfwAYP8Z/ABgr33/77WzrHhWff73+3v7eVuu9V9br7a1Kc2+tstba3alstFob+Wf2NP/f+Rqt1s7yq7H3frVTb3eq7f2Du83W3nbnbv653nfrUyNpFQBwkedf/OhPSUQcvnEj3+LEWg7Garje0rITAEozUXYCQGkmy04AKI3f8YEBS/Se0v8TofmzFR8OfYquBZ5yt75g/h/Glfl/GF/m/2F8mf+H8dXtJtb8B4AxY44fuOz7/6dMX/j+PwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFx78/mWpJViLfD5SNNKJeLZiFiMqeTeZqO+FBHPRcQfZ6ZmsvJy2UkDAI8p/VtSrP91a+Hl+bO108l/ZqJY6usnv3jn5++vdjq7y9nxfx4f73xYHK9dGMhSgwBQkv443R/H+x4+uL/W30aZzyff7i0umsU9KrZezWRM5o+z+Y3D3L+SotyT3a9MXEH8ww8i4vOD2p/kcyOLxcqnZ+NnsZ8dafz0VPw0r+s9Zt+Lz15BLjBuPsr6nzcHXX9p3MwfB1//s3kP9fj6/d/Ruf4vPe7/Job0fzcvG+PV339vaN0HEV+cHBQ/OY6fDIn/8iXj//lLX3lpWF33lxG3ooifxKn4J2NVO82danv/4JXN5upGfaO+XautLK8svX7ntVo1n6Ou9meqz/v7G7efu6j9czG4/bPD2z+bHfv6Jdv/q/+++6OvXhD/m18b/Pq/MDx+PiZ+45LxV+d+M3D57n789cHtL54z/PW/fe5sNwbG+PivB+uXTBUAGIH2/sHWaqNR37Uzsp3s3u0pSMNOaTvZT8BVnOdzTzDVsnsm4El7dNGXnQkAAAAAAAAAAAAAADDMKP7hqew2AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcH39LwAA//94utYi") 223.284984ms ago: executing program 0 (id=6): syz_emit_ethernet(0x2a, &(0x7f0000000200)={@random="331801007f31", @broadcast, @void, {@arp={0x806, @generic={0x6, 0x888e, 0x6, 0x4, 0x8, @remote, "90e9c491", @local, "af4d949e"}}}}, 0x0) (async) syz_emit_ethernet(0x2a, &(0x7f0000000200)={@random="331801007f31", @broadcast, @void, {@arp={0x806, @generic={0x6, 0x888e, 0x6, 0x4, 0x8, @remote, "90e9c491", @local, "af4d949e"}}}}, 0x0) r0 = syz_open_dev$usbmon(&(0x7f0000000000), 0x0, 0x2083) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x2000000000000108, &(0x7f0000004540)=[&(0x7f0000004280)={0x0, 0x0, 0x0, 0x5, 0xfffc, r0, 0x0}]) (async) io_submit(r1, 0x2000000000000108, &(0x7f0000004540)=[&(0x7f0000004280)={0x0, 0x0, 0x0, 0x5, 0xfffc, r0, 0x0}]) r2 = syz_usb_connect(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="120141014813442024040075ee69010203010902240001000010000904b8070259d1ca000905060200020d000609058202", @ANYRES8], 0x0) capset(0x0, 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x40, 0xa, 0x4, "a0e763a8"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r2, 0x0, &(0x7f0000000640)={0x44, &(0x7f0000000200)=ANY=[@ANYBLOB="7a0f9e"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$uac1(r2, 0x0, &(0x7f0000000640)={0x44, &(0x7f0000000200)=ANY=[@ANYBLOB="7a0f9e"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r2, 0x0, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x2000001, 0x6031, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x2000001, 0x6031, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1, 0x0) (async) r3 = socket$inet6(0xa, 0x1, 0x0) r4 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000002bc0)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) bind$inet6(r4, 0x0, 0x0) syz_emit_ethernet(0x8e, &(0x7f0000000140)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000086dd608a842200580601fe8000000000000000000000000000bbfe8000000000000000000000000000aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="600200"], 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, 0x0, 0x0) (async) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f0000000140)='./file0\x00', 0x8000d0, &(0x7f0000000040), 0x1, 0x586, &(0x7f0000000600)="$eJzs3U9sHFcZAPBvdx0ncd2mCY3UlIMDqUj/KLbblZwaDoQDHCjqpUioUjlYycYOXsfGdkVtLu6NE0UCBKiiasQBCSRiiQNwqChIHJAIEgIhLNRKIA78aQHhHigBjGZ31t54Z51Ftndbz+8nbfbNm7G/93bzvd19b9YTQG6dTv4pRAxGxI2IOFbfvPWA0/W775RXp66XV6cKsbHx5N8KteOulVenGoc2fu6OiFiJiHsj4seXIy4eao27sLQ8PVGtVubT7ZHFmbmRhaXlc1dmJiYrk5Wr5fJj42Nj4+fHRv+P3hR23PuJuddP/GbqicmXhv791PmZb/y1EBdq/Y5t/dhLWS3qK0Rc2I9gPVBK+hMRAx0ef7Ly/Mv73CQ69KUTayPJc3dPRNxfy/9jUao9mxEffPHpfxyLD9xs97M31l78UzfbCgDsnY3E4Z13AwdTMZLP/oXicETUy8Xi8HD9M/w9MVCszi4sPnx59pmrl+pzBHfHoeLlK9XKaDpXcHccKiTbj9TKW9uPbtsuR8TxiPhc6Whte/jibPVSV0c6oGEw4rXvfvpi/x3b8v+PpXr+AwdXkv+/+sn3f5iU3yz1ujVANyX5/603Zx4P+Q+5c/v8P9L1NgHd4fUf8kv+Q3615v/O584CB4fXf8gv+Q/5Jf8hv+Q/5Jf8h/xqzn/pD/l0fOiVtUJErLz/aO2W6E/3ZfzZHuAA2bjTt/whr7z3h/zq2yoe7WU7gO7zGR+43dn/bb8NPLf3bQG6o9jrBgA9c/aU9T/IK/P/kF99vW4A0DPe4wPm/yF/zP9Dfg22uf7XnU3X7hqNiLsi4melQ4cb1/oC3rkGI1574cb3no4o/rmQvv9PxoKJ11/9UfNx/YV/1pYI+iPiMy88+ZVnJxYX5x9J6v++Wb/41bT+0V71BuhEI08beQzk18LS8vREtVqZV1DYVoh4WzRDYR8LjXHgWnl1qnHr1tjz/EMRb3yofhJCEvd6eqvv7UvnJo/U1igH1gu3nKtQ2IO1y8+fi1h5LiLuzep/Ib3eeX3lY2C91BL/Xel9cjuVzp8kx5zsMH7prt3Fv68p/lBT/Hd3GH/t4x0euE+Of7u38V/67eayV1/W49+3y6/EnrjN/se/uatfv2t/+H1v498/1Nv4X56NeCUZf0az8q+YpOXmymfz+PPFL9TnSvp3Gf+zZ7fGv+st419xc/wrtRn/TncY56dPVT6ZVV/6ecQbz0Xclxm/Ee9ILdbAerEl/pmm8eeBHeL/5WO/nM6qv/BqxMa1iLORHb851sjizNzIwtLyuSszE5OVycrVcvmx8bGx8fNjoyO1OeqRxkx1qydunvxwVv2Zr9f7P9AmfqP/7R7/jR363Gz5a58afE9G/S9O1eM/cCb7+T+Rxq8//n0t8d+b3if/T/6TnsubHPNWRBxO6x+MiB+8fPyhrHZ99GY9/qU2/S/eEr+1/w932P/43X+fyap+9iOd/gIAYC+1nxrodcsAAIC91o2Vxl73Ecg2sN4fzcvAhZWmdYWVrXWFpP6tdH2htBLxr3SNIal/MF0lS8qZCw3A287J5ff9utdtAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMi7haXl6YlqtTK/0OuWAN32vwAAAP//mSj9Tw==") (async) syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f0000000140)='./file0\x00', 0x8000d0, &(0x7f0000000040), 0x1, 0x586, &(0x7f0000000600)="$eJzs3U9sHFcZAPBvdx0ncd2mCY3UlIMDqUj/KLbblZwaDoQDHCjqpUioUjlYycYOXsfGdkVtLu6NE0UCBKiiasQBCSRiiQNwqChIHJAIEgIhLNRKIA78aQHhHigBjGZ31t54Z51Ftndbz+8nbfbNm7G/93bzvd19b9YTQG6dTv4pRAxGxI2IOFbfvPWA0/W775RXp66XV6cKsbHx5N8KteOulVenGoc2fu6OiFiJiHsj4seXIy4eao27sLQ8PVGtVubT7ZHFmbmRhaXlc1dmJiYrk5Wr5fJj42Nj4+fHRv+P3hR23PuJuddP/GbqicmXhv791PmZb/y1EBdq/Y5t/dhLWS3qK0Rc2I9gPVBK+hMRAx0ef7Ly/Mv73CQ69KUTayPJc3dPRNxfy/9jUao9mxEffPHpfxyLD9xs97M31l78UzfbCgDsnY3E4Z13AwdTMZLP/oXicETUy8Xi8HD9M/w9MVCszi4sPnx59pmrl+pzBHfHoeLlK9XKaDpXcHccKiTbj9TKW9uPbtsuR8TxiPhc6Whte/jibPVSV0c6oGEw4rXvfvpi/x3b8v+PpXr+AwdXkv+/+sn3f5iU3yz1ujVANyX5/603Zx4P+Q+5c/v8P9L1NgHd4fUf8kv+Q3615v/O584CB4fXf8gv+Q/5Jf8hv+Q/5Jf8h/xqzn/pD/l0fOiVtUJErLz/aO2W6E/3ZfzZHuAA2bjTt/whr7z3h/zq2yoe7WU7gO7zGR+43dn/bb8NPLf3bQG6o9jrBgA9c/aU9T/IK/P/kF99vW4A0DPe4wPm/yF/zP9Dfg22uf7XnU3X7hqNiLsi4melQ4cb1/oC3rkGI1574cb3no4o/rmQvv9PxoKJ11/9UfNx/YV/1pYI+iPiMy88+ZVnJxYX5x9J6v++Wb/41bT+0V71BuhEI08beQzk18LS8vREtVqZV1DYVoh4WzRDYR8LjXHgWnl1qnHr1tjz/EMRb3yofhJCEvd6eqvv7UvnJo/U1igH1gu3nKtQ2IO1y8+fi1h5LiLuzep/Ib3eeX3lY2C91BL/Xel9cjuVzp8kx5zsMH7prt3Fv68p/lBT/Hd3GH/t4x0euE+Of7u38V/67eayV1/W49+3y6/EnrjN/se/uatfv2t/+H1v498/1Nv4X56NeCUZf0az8q+YpOXmymfz+PPFL9TnSvp3Gf+zZ7fGv+st419xc/wrtRn/TncY56dPVT6ZVV/6ecQbz0Xclxm/Ee9ILdbAerEl/pmm8eeBHeL/5WO/nM6qv/BqxMa1iLORHb851sjizNzIwtLyuSszE5OVycrVcvmx8bGx8fNjoyO1OeqRxkx1qydunvxwVv2Zr9f7P9AmfqP/7R7/jR363Gz5a58afE9G/S9O1eM/cCb7+T+Rxq8//n0t8d+b3if/T/6TnsubHPNWRBxO6x+MiB+8fPyhrHZ99GY9/qU2/S/eEr+1/w932P/43X+fyap+9iOd/gIAYC+1nxrodcsAAIC91o2Vxl73Ecg2sN4fzcvAhZWmdYWVrXWFpP6tdH2htBLxr3SNIal/MF0lS8qZCw3A287J5ff9utdtAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMi7haXl6YlqtTK/0OuWAN32vwAAAP//mSj9Tw==") chdir(&(0x7f0000000000)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.bfq.io_queued_recursive\x00', 0x275a, 0x0) unlink(&(0x7f0000000140)='./file0\x00') mremap(&(0x7f0000ceb000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) msync(&(0x7f00007fe000/0x4000)=nil, 0x4000, 0x4) (async) msync(&(0x7f00007fe000/0x4000)=nil, 0x4000, 0x4) syz_usb_control_io$printer(r2, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000280)={0x0, 0x18, 0x81, "b63b109ce9fc0664c80e7cab19906382381006ea7baa6671ade86e292f6273e27837014cc4063c5109f43baff7a57e0878f32b07f7b698a00c760bf5d6190d9f7b24defe496ce733d238d89aefb3a7e2e16ca3e42ba44db5a5d81515f89ce079459a949d8a782458957f11cc49de6a0b47ccbb0904f06df3fe1e9742c005aced4a"}, 0x0, &(0x7f0000000700)={0x0, 0x8, 0x1, 0x1}, 0x0, 0x0, &(0x7f00000007c0)={0x20, 0x0, 0x1}}) 0s ago: executing program 3 (id=7): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x18}}, 0x2, 0x1}}, 0x2e) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r4, 0x0, 0x40000) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0x64, r5, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @c}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x5}, @WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e20}]}, 0x64}, 0x1, 0x0, 0x0, 0x20004000}, 0x40501d8) getsockopt(r2, 0x111, 0x3, 0x0, &(0x7f00000000c0)=0xff12) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000100)) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async) socket$pppl2tp(0x18, 0x1, 0x1) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) (async) socket$pppl2tp(0x18, 0x1, 0x1) (async) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x18}}, 0x2, 0x1}}, 0x2e) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff) (async) sendmsg$WG_CMD_SET_DEVICE(r4, 0x0, 0x40000) (async) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0x64, r5, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @c}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x5}, @WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e20}]}, 0x64}, 0x1, 0x0, 0x0, 0x20004000}, 0x40501d8) (async) getsockopt(r2, 0x111, 0x3, 0x0, &(0x7f00000000c0)=0xff12) (async) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000100)) (async) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.32' (ED25519) to the list of known hosts. [ 18.079016][ T24] audit: type=1400 audit(1787075809.209:64): avc: denied { mounton } for pid=272 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 18.080092][ T272] cgroup: Unknown subsys name 'net' [ 18.082307][ T24] audit: type=1400 audit(1787075809.219:65): avc: denied { mount } for pid=272 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 18.086132][ T24] audit: type=1400 audit(1787075809.219:66): avc: denied { unmount } for pid=272 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 18.086266][ T272] cgroup: Unknown subsys name 'devices' [ 18.180703][ T272] cgroup: Unknown subsys name 'hugetlb' [ 18.186313][ T272] cgroup: Unknown subsys name 'rlimit' [ 18.292526][ T24] audit: type=1400 audit(1787075809.429:67): avc: denied { setattr } for pid=272 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 18.315749][ T24] audit: type=1400 audit(1787075809.429:68): avc: denied { mounton } for pid=272 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 18.320878][ T274] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 18.340631][ T24] audit: type=1400 audit(1787075809.429:69): avc: denied { mount } for pid=272 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 18.372150][ T24] audit: type=1400 audit(1787075809.479:70): avc: denied { relabelto } for pid=274 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 18.397815][ T24] audit: type=1400 audit(1787075809.479:71): avc: denied { write } for pid=274 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 18.433002][ T24] audit: type=1400 audit(1787075809.569:72): avc: denied { read } for pid=272 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 18.458506][ T24] audit: type=1400 audit(1787075809.569:73): avc: denied { open } for pid=272 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 18.484607][ T272] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 19.410591][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.417626][ T280] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.425027][ T280] device bridge_slave_0 entered promiscuous mode [ 19.432616][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.439769][ T280] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.447094][ T280] device bridge_slave_1 entered promiscuous mode [ 19.483497][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.490631][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.497835][ T281] device bridge_slave_0 entered promiscuous mode [ 19.504699][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.511778][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.519274][ T281] device bridge_slave_1 entered promiscuous mode [ 19.543330][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.550394][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.557724][ T283] device bridge_slave_0 entered promiscuous mode [ 19.566697][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.573752][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.581107][ T283] device bridge_slave_1 entered promiscuous mode [ 19.651094][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.658126][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.665432][ T282] device bridge_slave_0 entered promiscuous mode [ 19.672297][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.679350][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.686682][ T282] device bridge_slave_1 entered promiscuous mode [ 19.702805][ T284] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.709856][ T284] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.717171][ T284] device bridge_slave_0 entered promiscuous mode [ 19.726145][ T284] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.733176][ T284] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.740511][ T284] device bridge_slave_1 entered promiscuous mode [ 19.815121][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.822165][ T280] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.829433][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.836436][ T280] bridge0: port 1(bridge_slave_0) entered forwarding state [ 19.867771][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.874814][ T283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.882067][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.889096][ T283] bridge0: port 1(bridge_slave_0) entered forwarding state [ 19.908519][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.915567][ T281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.922817][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.929845][ T281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 19.949974][ T284] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.957000][ T284] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.964255][ T284] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.971278][ T284] bridge0: port 1(bridge_slave_0) entered forwarding state [ 19.982081][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.989124][ T282] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.996382][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.003415][ T282] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.032212][ T50] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.040019][ T50] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.047101][ T50] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.054587][ T50] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.062020][ T50] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.069189][ T50] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.076387][ T50] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.083524][ T50] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.090755][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.098102][ T50] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.105523][ T50] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.133420][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.141079][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 20.148402][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.156012][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.164619][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.171648][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.179368][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.187436][ T50] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.194455][ T50] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.201795][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.209988][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.216990][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.224349][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.232419][ T50] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.239433][ T50] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.246736][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 20.254113][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.261530][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.269658][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.276655][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.284024][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.292176][ T50] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.299192][ T50] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.307541][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.315706][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.322717][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.351121][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.359505][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.367462][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.375507][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.383547][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.391451][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.399444][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.407286][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.415517][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.422545][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.429837][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.437901][ T50] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.444921][ T50] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.452213][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.460501][ T50] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.467497][ T50] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.479160][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 20.491114][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 20.499475][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.510390][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 20.518763][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 20.527582][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 20.536089][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 20.551761][ T280] device veth0_vlan entered promiscuous mode [ 20.558168][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 20.565530][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 20.573048][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 20.581667][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.589786][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 20.597714][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.605615][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 20.613932][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 20.622284][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 20.630304][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.638136][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 20.646079][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 20.654145][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 20.661632][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 20.674460][ T283] device veth0_vlan entered promiscuous mode [ 20.687531][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 20.695882][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 20.704582][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 20.712550][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 20.720591][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 20.727939][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 20.736329][ T281] device veth0_vlan entered promiscuous mode [ 20.744580][ T282] device veth0_vlan entered promiscuous mode [ 20.751844][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 20.759720][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 20.774797][ T284] device veth0_vlan entered promiscuous mode [ 20.781084][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 20.788493][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 20.796371][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 20.804770][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 20.813080][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 20.821480][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 20.829733][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 20.837723][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 20.845883][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 20.853711][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 20.861952][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 20.869402][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 20.877696][ T280] device veth1_macvtap entered promiscuous mode [ 20.887351][ T281] device veth1_macvtap entered promiscuous mode [ 20.898018][ T282] device veth1_macvtap entered promiscuous mode [ 20.907038][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 20.915063][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 20.922766][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 20.931167][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 20.939238][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 20.946696][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 20.954905][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 20.965724][ T284] device veth1_macvtap entered promiscuous mode [ 20.975995][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 20.984291][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 20.992363][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.000399][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.008562][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.016852][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.025478][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.038527][ T283] device veth1_macvtap entered promiscuous mode [ 21.050176][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.058376][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.067036][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.075395][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.083711][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.092010][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.100182][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.107651][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.115877][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.124336][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.132576][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.141006][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.149305][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.167703][ T280] request_module fs-gadgetfs succeeded, but still no fs? [ 21.175701][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.184562][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.192917][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.201365][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.216581][ T280] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 21.266963][ T308] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5'. [ 21.280725][ T306] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 21.299515][ T304] ====================================================== [ 21.299515][ T304] WARNING: the mand mount option is being deprecated and [ 21.299515][ T304] will be removed in v5.15! [ 21.299515][ T304] ====================================================== [ 21.391630][ T304] EXT4-fs (loop3): Test dummy encryption mode enabled [ 21.398890][ T304] EXT4-fs (loop3): cluster size (1024) smaller than block size (4096) [ 21.398952][ T310] EXT4-fs error (device loop2): ext4_orphan_get:1401: inode #15: comm syz.2.3: iget: bad i_size value: 38620345925642 [ 21.419969][ T310] EXT4-fs error (device loop2): ext4_orphan_get:1406: comm syz.2.3: couldn't read orphan inode 15 (err -117) [ 21.431789][ T310] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 21.460596][ T318] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 21.469721][ T318] ext4 filesystem being mounted at /0/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 21.603335][ T318] EXT4-fs warning (device loop1): ext4_empty_dir:3094: inode #12: comm syz.1.2: directory missing '..' [ 21.646002][ T332] Zero length message leads to an empty skb [ 21.656141][ T7] ================================================================== [ 21.656258][ T331] ------------[ cut here ]------------ [ 21.664233][ T7] BUG: KASAN: use-after-free in l2tp_tunnel_del_work+0xcd/0x3d0 [ 21.664241][ T7] Read of size 8 at addr ffff88810f0e9880 by task kworker/u4:0/7 [ 21.664244][ T7] [ 21.664257][ T7] CPU: 1 PID: 7 Comm: kworker/u4:0 Not tainted syzkaller #0 [ 21.664263][ T7] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 21.664271][ T7] Workqueue: l2tp l2tp_tunnel_del_work [ 21.664281][ T7] Call Trace: [ 21.664293][ T7] __dump_stack+0x21/0x24 [ 21.664301][ T7] dump_stack_lvl+0x1a7/0x208 [ 21.664309][ T7] ? show_regs_print_info+0x18/0x18 [ 21.664317][ T7] ? thaw_kernel_threads+0x220/0x220 [ 21.664327][ T7] print_address_description+0x7f/0x2c0 [ 21.664335][ T7] ? l2tp_tunnel_del_work+0xcd/0x3d0 [ 21.664351][ T7] kasan_report+0x100/0x140 [ 21.670064][ T331] WARNING: CPU: 0 PID: 331 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 21.677394][ T7] ? __switch_to_asm+0x3a/0x60 [ 21.685096][ T331] Modules linked in: [ 21.687383][ T7] ? l2tp_tunnel_del_work+0xcd/0x3d0 [ 21.694757][ T331] [ 21.704787][ T7] __asan_report_load8_noabort+0x14/0x20 [ 21.704799][ T7] l2tp_tunnel_del_work+0xcd/0x3d0 [ 21.704814][ T7] process_one_work+0x6fd/0xbc0 [ 21.710873][ T331] CPU: 0 PID: 331 Comm: syz.3.7 Not tainted syzkaller #0 [ 21.713521][ T7] worker_thread+0xa8e/0x13c0 [ 21.717814][ T331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 21.722462][ T7] kthread+0x324/0x3b0 [ 21.722469][ T7] ? worker_clr_flags+0x190/0x190 [ 21.722477][ T7] ? kthread_blkcg+0xd0/0xd0 [ 21.722492][ T7] ret_from_fork+0x1f/0x30 [ 21.727662][ T331] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 21.732904][ T7] [ 21.732909][ T7] Allocated by task 332: [ 21.732919][ T7] __kasan_kmalloc+0xd4/0x100 [ 21.732933][ T7] __kmalloc+0x19f/0x330 [ 21.738446][ T331] Code: 5d c3 e8 9c bc 35 fd be 02 00 00 00 eb 0a e8 90 bc 35 fd be 01 00 00 00 4c 89 f7 e8 13 13 0f fe e9 0f ff ff ff e8 79 bc 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 68 bc 35 fd 4c 89 f7 be 03 [ 21.743693][ T7] l2tp_session_create+0x39/0xb60 [ 21.743700][ T7] pppol2tp_connect+0xbf5/0x1640 [ 21.743713][ T7] __sys_connect+0x3ce/0x450 [ 21.748183][ T331] RSP: 0018:ffffc9000830fd68 EFLAGS: 00010293 [ 21.758123][ T7] __x64_sys_connect+0x7a/0x90 [ 21.758136][ T7] do_syscall_64+0x31/0x40 [ 21.758151][ T7] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 21.763233][ T5] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 21.766747][ T7] [ 21.773546][ T331] [ 21.774328][ T7] Freed by task 342: [ 21.779946][ T331] RAX: ffffffff842ef547 RBX: ffff888128ca5800 RCX: ffff88810ce54f00 [ 21.785105][ T7] kasan_set_track+0x4a/0x70 [ 21.789931][ T331] RDX: 0000000000000000 RSI: 000000000dd2ff80 RDI: 000000000c04eb7d [ 21.796930][ T7] kasan_set_free_info+0x23/0x40 [ 21.801602][ T331] RBP: ffffc9000830fd88 R08: ffff888128ca5883 R09: 1ffff11025194b10 [ 21.811603][ T7] ____kasan_slab_free+0x125/0x160 [ 21.811610][ T7] __kasan_slab_free+0x11/0x20 [ 21.811617][ T7] slab_free_freelist_hook+0xc5/0x190 [ 21.811625][ T7] kfree+0xc0/0x270 [ 21.811633][ T7] l2tp_session_put+0xb2/0x1a0 [ 21.811640][ T7] pppol2tp_ioctl+0x748/0x960 [ 21.811648][ T7] pppox_ioctl+0x1e4/0x320 [ 21.811656][ T7] sock_do_ioctl+0xda/0x380 [ 21.811661][ T7] sock_ioctl+0x472/0x740 [ 21.811668][ T7] __se_sys_ioctl+0x121/0x1a0 [ 21.811674][ T7] __x64_sys_ioctl+0x7b/0x90 [ 21.811682][ T7] do_syscall_64+0x31/0x40 [ 21.811696][ T7] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 21.811699][ T7] [ 21.811707][ T7] The buggy address belongs to the object at ffff88810f0e9800 [ 21.811707][ T7] which belongs to the cache kmalloc-512 of size 512 [ 21.811715][ T7] The buggy address is located 128 bytes inside of [ 21.811715][ T7] 512-byte region [ffff88810f0e9800, ffff88810f0e9a00) [ 21.811719][ T7] The buggy address belongs to the page: [ 21.811740][ T7] page:ffffea00043c3a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10f0e8 [ 21.811746][ T7] head:ffffea00043c3a00 order:2 compound_mapcount:0 compound_pincount:0 [ 21.811757][ T7] flags: 0x4000000000010200(slab|head) [ 21.811769][ T7] raw: 4000000000010200 ffffea000437a600 0000000200000002 ffff888100043080 [ 21.811780][ T7] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 21.811783][ T7] page dumped because: kasan: bad access detected [ 21.811790][ T7] page_owner tracks the page as allocated [ 21.811802][ T7] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 97, ts 3495413870, free_ts 0 [ 21.811810][ T7] prep_new_page+0x176/0x190 [ 21.811817][ T7] get_page_from_freelist+0x225f/0x23f0 [ 21.811824][ T7] __alloc_pages_nodemask+0x29a/0x640 [ 21.811836][ T7] new_slab+0x84/0x3f0 [ 21.816972][ T331] R10: dffffc0000000000 R11: ffffed1025194b11 R12: dffffc0000000000 [ 21.820914][ T7] ___slab_alloc+0x2f8/0x4c0 [ 21.820920][ T7] __slab_alloc+0x63/0xa0 [ 21.820927][ T7] __kmalloc_track_caller+0x1e4/0x310 [ 21.820936][ T7] __alloc_skb+0xdc/0x520 [ 21.820945][ T7] alloc_uevent_skb+0x85/0x240 [ 21.820953][ T7] kobject_uevent_net_broadcast+0x335/0x5a0 [ 21.820960][ T7] kobject_uevent_env+0x52b/0x700 [ 21.820968][ T7] kobject_synth_uevent+0x452/0x940 [ 21.820976][ T7] uevent_store+0x4b/0x70 [ 21.820984][ T7] drv_attr_store+0x79/0xa0 [ 21.820993][ T7] sysfs_kf_write+0x129/0x150 [ 21.821000][ T7] kernfs_fop_write_iter+0x2bd/0x400 [ 21.821003][ T7] page_owner free stack trace missing [ 21.821013][ T7] [ 21.826117][ T331] R13: dffffc0000000000 R14: 000000000dd2ff80 R15: ffff88810f0e9800 [ 21.829963][ T7] Memory state around the buggy address: [ 21.829973][ T7] ffff88810f0e9780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 21.829979][ T7] ffff88810f0e9800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.829991][ T7] >ffff88810f0e9880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.836343][ T331] FS: 000055558f209500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 21.838597][ T7] ^ [ 21.842972][ T331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 21.847462][ T7] ffff88810f0e9900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.847475][ T7] ffff88810f0e9980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 21.851846][ T331] CR2: 00007f0666f1bd58 CR3: 000000010f6b9000 CR4: 00000000003506b0 [ 21.871270][ T7] ================================================================== [ 21.871274][ T7] Disabling lock debugging due to kernel taint [ 22.315621][ T7] ------------[ cut here ]------------ [ 22.319060][ T331] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 22.321530][ T7] refcount_t: underflow; use-after-free. [ 22.329126][ T331] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 22.329130][ T331] Call Trace: [ 22.329145][ T331] pppol2tp_release+0x150/0x2b0 [ 22.329155][ T331] sock_close+0xb8/0x200 [ 22.329163][ T331] ? sock_mmap+0xa0/0xa0 [ 22.329173][ T331] __fput+0x2dc/0x730 [ 22.329183][ T331] ____fput+0x15/0x20 [ 22.329192][ T331] task_work_run+0x127/0x190 [ 22.329201][ T331] exit_to_user_mode_loop+0xcb/0xe0 [ 22.329215][ T331] exit_to_user_mode_prepare+0x76/0xa0 [ 22.335967][ T7] WARNING: CPU: 1 PID: 7 at lib/refcount.c:28 refcount_warn_saturate+0x120/0x1a0 [ 22.347300][ T331] syscall_exit_to_user_mode+0x1d/0x40 [ 22.356408][ T7] Modules linked in: [ 22.359590][ T331] do_syscall_64+0x3d/0x40 [ 22.365338][ T7] [ 22.367469][ T331] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 22.373341][ T7] CPU: 1 PID: 7 Comm: kworker/u4:0 Tainted: G B syzkaller #0 [ 22.377250][ T331] RIP: 0033:0x7f6be9b900d9 [ 22.377265][ T331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 22.394572][ T7] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 22.403287][ T331] RSP: 002b:00007ffe42f44dd8 EFLAGS: 00000246 [ 22.407492][ T7] Workqueue: l2tp l2tp_tunnel_del_work [ 22.408168][ T331] ORIG_RAX: 00000000000001b4 [ 22.414532][ T7] [ 22.423843][ T331] RAX: 0000000000000000 RBX: 00007f6be9e19da0 RCX: 00007f6be9b900d9 [ 22.427602][ T7] RIP: 0010:refcount_warn_saturate+0x120/0x1a0 [ 22.446991][ T331] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 22.446997][ T331] RBP: 00007f6be9e19da0 R08: 0000000000000006 R09: 0000000000000000 [ 22.447002][ T331] R10: 000000000003fcf0 R11: 0000000000000246 R12: 00000000000057b9 [ 22.447009][ T331] R13: 00007f6be9e1890c R14: 00007f6be9e18908 R15: 00007f6be9e18900 [ 22.447017][ T331] ---[ end trace 97fff7f5d47452ba ]--- [ 22.522217][ T5] usb 1-1: Using ep0 maxpacket: 32 [ 22.534410][ T7] Code: 04 01 48 c7 c7 40 4d 40 85 e8 ec 0e 3b 02 0f 0b eb c3 e8 63 a8 26 ff c6 05 81 8b 82 04 01 48 c7 c7 a0 4d 40 85 e8 d0 0e 3b 02 <0f> 0b eb a7 e8 47 a8 26 ff c6 05 62 8b 82 04 01 48 c7 c7 c0 4c 40 [ 22.554135][ T7] RSP: 0018:ffffc90000077c58 EFLAGS: 00010246 [ 22.560411][ T7] RAX: 042a4cdbc38cc400 RBX: 0000000000000003 RCX: ffff888100248000 [ 22.568401][ T7] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 22.577123][ T7] RBP: ffffc90000077c68 R08: ffff8881f7152fbf R09: 1ffff1103ee2a5f7 [ 22.585271][ T7] R10: dffffc0000000000 R11: ffffed103ee2a5f8 R12: ffff888125402020 [ 22.593414][ T7] R13: dffffc0000000000 R14: 0000000000000003 R15: 0000000000000000 [ 22.601572][ T7] FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 22.610740][ T7] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 22.617307][ T7] CR2: 00005555895fb908 CR3: 000000010d610000 CR4: 00000000003506b0 [ 22.625293][ T7] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 22.633348][ T7] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 22.641426][ T7] Call Trace: [ 22.644788][ T7] l2tp_session_put+0xcb/0x1a0 [ 22.649593][ T7] l2tp_session_delete+0x3a9/0x4a0 [ 22.654713][ T7] l2tp_tunnel_del_work+0x180/0x3d0 [ 22.660017][ T5] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 22.660042][ T7] process_one_work+0x6fd/0xbc0 [ 22.668177][ T5] usb 1-1: config 0 has no interface number 0 [ 22.668199][ T5] usb 1-1: config 0 interface 184 altsetting 7 bulk endpoint 0x82 has invalid maxpacket 255 [ 22.673178][ T7] worker_thread+0xa8e/0x13c0 [ 22.679260][ T5] usb 1-1: config 0 interface 184 has no altsetting 0 [ 22.689508][ T7] kthread+0x324/0x3b0 [ 22.704680][ T7] ? worker_clr_flags+0x190/0x190 [ 22.709789][ T7] ? kthread_blkcg+0xd0/0xd0 [ 22.714364][ T7] ret_from_fork+0x1f/0x30 [ 22.718751][ T7] ---[ end trace 97fff7f5d47452bb ]--- [ 22.869229][ T5] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 22.878303][ T5] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 22.886310][ T5] usb 1-1: Product: syz [ 22.890546][ T5] usb 1-1: Manufacturer: syz [ 22.895112][ T5] usb 1-1: SerialNumber: syz [ 22.900568][ T5] usb 1-1: config 0 descriptor?? [ 22.919067][ T324] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 22.939418][ T5] smsc75xx v1.0.0 [ 23.139425][ T324] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 23.599106][ T5] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -61 [ 23.610056][ T5] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 23.659084][ T5] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 23.669850][ T5] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -61 [ 23.679477][ T5] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 23.689705][ T5] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -61 [ 23.699176][ T5] smsc75xx: probe of 1-1:0.184 failed with error -61 [ 24.269420][ T24] kauditd_printk_skb: 59 callbacks suppressed [ 24.269429][ T24] audit: type=1400 audit(1787075815.409:133): avc: denied { create } for pid=323 comm="syz.0.6" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 24.270705][ T325] xt_hashlimit: size too large, truncated to 1048576 [ 24.275594][ T24] audit: type=1400 audit(1787075815.409:134): avc: denied { setopt } for pid=323 comm="syz.0.6" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 24.321437][ T24] audit: type=1400 audit(1787075815.459:135): avc: denied { bind } for pid=323 comm="syz.0.6" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 24.488430][ T15] usb 1-1: USB disconnect, device number 2