last executing test programs: 172.256305ms ago: executing program 4 (id=5): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x80047453, 0x0) 162.347526ms ago: executing program 1 (id=2): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1/file4\x00', 0x1c0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)=0x20) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1/file4\x00', 0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x4) 103.567487ms ago: executing program 1 (id=6): syz_mount_image$exfat(&(0x7f0000002bc0), &(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x10202, &(0x7f00000008c0)=ANY=[@ANYBLOB='fmask=00000000000000000000016,dmask=00000000000000000000020,uid=', @ANYRESHEX=0x0, @ANYBLOB="2c696f636861727365743d6d616363656c74adc23e3c1cbd69632c696f636861727365743d63703836392c6e616d65636173653d312c6769643d", @ANYRESHEX=0x0, @ANYBLOB=',namecase=1,uid=', @ANYRESHEX=0x0, @ANYBLOB=',errors=continue,namecase=1,\x00'], 0x1, 0x1535, &(0x7f0000001380)="$eJzs3AucjdX6OPDnWWu9Y0jaTXIZ1lrPy04uiyTJJUkuSZIkSW4JSZIjCYkht6QhCcllSC5DSC4Tk8b9fr8kJEmTJCG5Jev/mZi/OnX+55xfnfz+Z57v57M/s55Z+1nvs+aZvfe739l802VojUY1qzYgIvhD8OKXBACIBYCBAHANAAQAUDaubFzGfHaJCX/sIOzP9VDyla6AXUnc/6yN+5+1cf+zNu5/1sb9z9q4/1kb9z9r4/4zlpVtnp7/Wr5l3Rtf/8/K+PX/v0h6ybFfrC15fVeAmH81hfv//z/8A7nc//9awb9yJ+5/1sb9z6pir3QB7H8BfvxnBdn+4Qz3P2vj/jOWlf3yWnAsXPnr0X/1DSL/yb+B+F4Xf8pXfp//cP+MMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxthf4Iy/TAFA5vhK18UYY4wxxhhjjLE/j892pStgjDHGGGOMMcbYfx6CAAkKAoiBbBAL2SEHCICYzPlrIQ6ug9xwPeSBvJAP8kM8FICCoMGABYIQCkFhiMINUARuhKJQDIpDCXBQEkrBTVAaboYycAuUhVuhHNwG5aECVIRKcDtUhjugCtwJVeEuqAbVoQbUhLuhFtwDteFeqAP3QV24H+rBA1AfHoQG8BA0hIehETwCjeFRaAJNoRk0hxb/o/wXoAe8CD2hFyRAb+gDL0Ff6Af9YQAMhJdhELwCg+FVSIQhMBReg2HwOgyHN2AEjIRR8CaMhrdgDIyFcTAekmACTIS3YRK8A5NhCkyFaZAM02EGvAszYRbMhvdgDrwPc2EezIcFkAIfwEJYBKnwISyGjyANlsBSWAbLYQWshFWwGtbAWlgH62EDbIRNsBm2wFbYBtthB+yEj2EXfAK7YQ/shU9hH3z2b+af/rv8rggIKFCgQoUxGIOxGIs5MAfmxJyYC3NhBCMYh3GYG3NjHsyD+TAfxmM8FsSCaNAgIWEhLIRRjGIRLIJFsSgWx+Lo0GEpLIWl8WYsg2WwLJbFclgOy2MFrICVsBJWxspYBatgVayK1bAa1sAaeDfejb2xNtbGOlgH62LdzMtT2AAbYENsiI2wETbGxtgEm2AzbIYtsAW2xJbYClthG2yDbbEttsN22B7bYwfsgB2xI3bCTtgZO2MX7IJdsRt2S38hG+CL+CL2wmqiN/bBPtgXE7P1xwE4AF/GQfgKvoKvYiIOwaH4Gr6Gr+NwPIUjLozEUTgKK4u3cAyORRLjMQmTcCJOxEk4CSfjFJyC0zAZp+MMnIEzcRbOwvdwDr6P7+M8nIcLMAVTcCEuwlRMxcV4GtNwCS7FZbgcV+ByXIWrcRWuxXW4FjfgBtyEm3ALbsFtuA134A78GBUAfoJ7cA8m4j7ch/txPx7AA3gQD2I6puMhPISH8TAewSN4FI/iMTyOJ/A4nsSTeApP4xk8g+fwHJ7H5+K/avhxsTWJIDIooUSMiBGxIlbkEDlETpFT5BK5RERERJyIE7lFbpFH5BH5RD4RL+JFQVFQGGEEiTDjmUJERVQUEUVEUVFUFBfFhRNOlBKlRGlRWpQRZURZcasoJ24T5UUF0dpVEpVEZdHGVRF3iqqiqqgmqosaoqaoKWqJWqK2qC3qiDqirqgr6okHRH3RG/vjQyKjM43EEGwshmIT0VTIS89QLcVwbCVaizbiCTESR2A70dK1F0+LDmIMdhR/E2PxWdFZjMcu4nnRVXQT3cULoodo5XqKXmIy9hZ9xDTsK/qJ/mKAmInVxXs4J3sN8apIFEPEUPGaWICvi+HiKjFCjBSjxJtitHhLjBFjxTgxXiSJCWKieFtMEu+IyWKKmCqmiWQxXcwQ74qZYpaYLd4Tc8T7Yq6YJ+aLBSJFfCAWikUiVXwoFouPRJpYIpaKZWK5WCFWilVitVgj1op1Yr3YIDaKTWKz2CK2im1iu9ghdoqPxS7xidgt9oi94lOxT3wm9ovPxQHxhTgovhTp4itxSHwtDotvxBHxrTgqvhPHxHFxQnwvToofxClxWpwRZ8U58aM4L34SF4QXIFEKKaWSgYyR2WSszC5zyKtkThlkPv/LOHmdzC2vl3lkXplP5pfxsoAsKLU00kqSoSwkC8uovEEWkTfKorKYLC5LSCdLylLyJlla3izLyFtkWXmrLCdvk+VlBVlRVpK3y8ryDgmRi8eoJqvLGrKmvFsmwD2ytrxX1pH3ybryfllPPiDrywdlA/mQbCgflo3kI7KxfFQ2kU1lM9lctpCPyZbycdlKtpZt5BOyrXxStpNPyfbyadlB+ku/Is/KzvI52UU+L7vKbrK7/ElekF72lL0k9AbZR74k+8p+sr8cIAfKl+Ug+YocLF+ViXKIHCpfk8Pk63K4fEOOkCPlKPmmHC3fkmPkWDlOjpdJcoKcKN+Wk+Q7crKcIqfKaTJZTpf9L600W8p/mv/27+QP/vnom+RmuUVuldvkdrlD7pQfy11yl9wtd8u9cq/cJ/fJ/XK/PCAPyIPyoEyX6fKQPCQPy8PyiDwij8qj8pg8Ls/K7+VJ+YM8JU/L0/KsPCfPyfOXfgagUAkllVKBilHZVKzKrnKoq1ROdbXKpa5REXWtilPXqdzqepVH5VX5VH4Vrwqogkoro6wiFapCqrCKqhvw0i+MKq5KKKdKqlLqpn8nXxVRN6qiqtiv8jPrS/gH9bVQLVRL1VK1Uq1UG9VGtVVtVTvVTrVX7VUH1UF1VB1VJ9VJdVadVRfVRXVVXVV31V31UD1UT9VTJagE1Ue9pPqqfqq/GqAGqpdFxh4Gq8EqUSWqoWqoGqaGqeFquBqhRqhRapQarUarMWqMGqfGqSSVpCaqiWqSmqQmq8lqqpqqklWymqFmqJlqppqtZqs5ao6aq+aq+Wq+SlEpaqFaqFJVqlqsFqs0tUQtUcvUMrVCrVCr1Cq1Rq1R69Q6tUFtUGlqs9qstqqtarvarnaqnWqX2qV2q91qr9qr9ql9ar/arw6oA+qgOqjSVbo6pA6pw+qwOqKOqKPqqDqmjqkT6oQ6qU6qU+qUOqPOqHPqnDqvzqsL6kLGaV8gAhGoQAUxQUwQG8QGOYIcQc4gZ5AryBVEgkgQF8QFuYPrgzxB3iBfkD+IDwoEBQMdmMAG4lLTo8ENQZHgxqBoUCwoHpQIXFAyKBXcFJQObg7KBLcEZYNbg3LBbUH5oEJQMagU3B5UDu4IqgR3BlWDu4JqQfWgRlAzuDuoFdwT1A7uDeoE9wV1g/uDesEDQf3gwaBB8FDQMHg4aBQ8EjQOHg2aBE2DZkHzoMWfur73p/I+7nrqXjpB99Z99Eu6r+6n++sBeqB+WQ/Sr+jB+lWdqIfoofo1PUy/rofrN/QIPVKP0m/q0fotPUaP1eP0eJ2kJ+iJ+m09Sb+jJ+speqqeppP1dD1Dv6tn6ll6tn5Pz9Hv67l6np6vF+gU/YFeqBfpVP2hXqw/0ml6iV6ql+nleoVeqVfp1XqNXqvX6fV6g96oN+nNeoveqrfp7XqH3qk/1rv0J3q33qP36k/1Pv2Z3q8/1wf0F/qg/lKn66/0If21Pqy/0Uf0t/qo/k4f08d1Gf29Pql/0Kf0aX1Gn9Xn9I/6vP5JX9A+4+Q+4+XdKKNMjIkxsSbW5DA5TE6T0+QyuUzEREyciTO5TW6Tx+Qx+Uw+E2/iTUFT0GQgQ6aQKWSiJmqKmCKmqClqipvixhlnSplSprQpbcqYMqasKWvKmXKmvClvKpqK5nZzu7nD3GHuNHeau8xdprqpbmqamqaWqWVqm9qmjqlj6pq6pp6pZ+qb+qaBaWAamoamkWlkGpvGpolpYpqZZqaFaWFampamlWll2pg2pq1pa9qZdqa9aW86mA6mo+loOplOprPpbLqYLqar6Wq6m+6mh+lhepqeJsEkmD6mj+lr+pr+pr8ZaAaaQWaQGWwGm0STaIaaoWaYGWaGm+FmhBlpRmWcqJq3zBgz1owz402SSTITzUQzyUwyk81kM9VMNckm2cwwM8xMM9PMNrPNHDPHzDVzzXwz36SYFLPQLDSpJtUsNotNmkkzS81Ss9wsNyvNSrParDZrzVqzHtabjWaj2Ww2m61mq9lutpudZqfZZXaZ3Wa32Wv2mn1mn9lv9psD5oA5aA6adJNuDplD5rA5bI6YI+aoOWqOmWPmhDlhTpqT5pQ5Zc6YM+acyXvp9dKbWJvd5rBX2Zz2apvLXmP/Ps5n89t4W8AWtNrmsXl/FRtrbVFbzBa3JayzJW0pe9Nv4vK2gq1oK9nbbWV7h63ym7iWvcfWtvfaOvY+W9Pe/au4rr3f1rOP2PqIALapbWib20b2EdvYPmqb2Ka2mW1u29onbTv7lG1vn7Yd7DO/iRfaRXa1XWPX2nV2t91jz9iz9rD9xp6zP9qetpcdaF+2g+wrdrB91SbaIb+JR9k37Wj7lh1jx9pxdvxv4ql2mk220+0M+66daWf9Jk6xH9g5NtXOtfPsfLvg5zijplT7oV1sP7JpNoCldpldblfYlXbV/611md1gN9pNdpf9xG612+x2u8PuzDwRtnvsXvup3Wc/s4fs1/aA/cIetEdsuv3q5zhjf0fst/ao/c4es8ftCfu9PWl/UJnZGXv/3v5kL1hvgZCAJCkKKIayUSxlpxx0FeWkqykXXUMRupbi6DrKTddTHspL+Sg/xVMBKkiaDFkiCqkQFaYo3UCZ5RWnEuSoJJWim6g03Uxl6BYqS7dSObqNylMFqkiV6HaqTHdQFbqTqtJdVI2qUw2qSXdTLbqHatO9VIfuo7p0P9WjB6g+PUgN6CFqSA9TI3qEGtOj1ISaUjNqTi3oMWpJj1Mrak1t6AlqS09SO3qK2tPT1IGeoY70N+pEz1Jneo660PPUlbpRd3qBetCL1JN6UQL1pj70EvWlftSfBtBAepkG0Ss0mF6lRBpCQ+k1Gkav03B6g0bQSBpFb9JoeovG0FgaR+MpiSbQRHqbJtE7NJmm0FSaRsk0nWbQuzSTZtFseo/m0Ps0l+bRfFpAKfQBLaRFlEof0mL6iNJoCS2lZbScVtBKWkWraQ2tpXW0njbQRtpEm2kLbaVttJ120E76mHbRJ7Sb9tBe+pT20We0nz6nA/QFHaQvKZ2+okP0NR2mb+gIfet70Xd0jI7TCfqeTtIPdIpO0xk6S+foRzpPP9EF8gQhhiKUoQqDMCbMFsaG2cMc4VVhzvDqMFd4TRgJrw3jwuvC3OH1YZ4wb5gvzB/GhwXCgqEOTWhDCsOwUFg4jIY3hEXCG8OiYbGweFgidGHJsFR4U1g6vDksE94Slg1vDcuFt4XlwwrhI/dVCm8PK4d3hFXCO8Oq4V1htbB6WCOsGd4d1grvCWuH94Z1wvvCMuH9Yb3wgbB++GDYIHwobBg+HDYKHwkbh4+GTcKmYbOwedgifCxsGT4etgpbh23Cq8K24ZNhu/CpsH34dNghfObn+fsXZc4/8Zv5hLB32Cd8KXwp9P5eOT+6IJoS/SC6MLoomhr9MLo4+lE0LbokujS6LLo8uiK6Mroqujq6Jro2ui66ProhujG6Kep9zWzg0AknnXKBi3HZXKzL7nK4q1xOd7XL5a5xEXeti3PXudzuepfH5XX5XH4X7wq4gk4746wjF7pCrrCLuhtcEXejK+qKueKuhHOupCvlmrsWroVr6R53rVxr18Y94Z5wT7on3VPuKfe06+CecR3d31wn96zr7J5zz7nnXVfXzXV3L7gebkKui4/JBNfH9XF9XV/X3/V3A91AN8gNcoPdYJfoEt1QN9QNc8PccDfcjXAj3Cg3yo12o90YN8aNc+NckktyE91EN8lNcpPdZDfVTXXJLtnNcDPcTDfTVZ518Shz3Vw33813KS7FLXQZ54ypbrFb7NJcmlvqlrrlbrlb6Va61W61W+vWuvVuvdvoNrrNbrPb6ra67W672+l2ul1ul9vtr7m4qNvn9rv97oA74A66L126+8odcl+7w+4bd8R9646679wxd9ydcN+7k+4Hd8qddmfcWXfO/ejOu5/cBeddUmRCZGLk7cikyDuRyZEpkamRaZHkyPTIjMi7kZmRWZHZkfcicyLvR+ZG5kXmRxZEUiIfRBZGFkVSIx9GFkc+iqRFlkSWRpZFlkdWRLwvsDX0hXxhH/U3+CL+Rl/UF/PFfQnvfElfyt/kS1+sO837W305f5sv7yv4iv5R38Q39c18c9/CP+Zb+sd9K9/at/FP+Lb+Sd/OP+Xb+6d9B/+M7+j/5jv5Z31n/5zv4p/3XX03392/4Hv4F31P38sn+N6+j3/J9/X9fH8/wA/0L/tB/hU/2L/qE/0QP9S/5of51/1w/4Yf4Uf6UTFv+tGZb5FhvE/yE/xE/7af5N/xk/0UP9VP88l+up/h3/Uz/Sw/27/n5/j3/Vw/z8/3C3yK/8Av9It8qv/QL/Yf+TS/JPOisV/pV/nVfo1f69f59X6D3+g3+c1+i9/qt/ntfoff6T/2u/wnfrff4/f6T/0+/5nf7z/3B/wX/qD/0qf7r/wh/7U/7L/xR/y3/qj/zh/zx/0J/70/6X/wp/xpf8af9ef8j/68/8lf4H+zxhhjjDH2L5lweSh+PXPxcn7v38kRv7hzHwC4elv+9F/OZ5xRrs9zcdxPxMdmfH26V5eHMm/VqiUkJFy6b5qEoPA8gMy/BGX4+aMHl+Il0AaehPbQGkr/bv39RLdz9E/Wj94KkOMXORkFZcaX1/8cABN+s99+4rEnRi0sF56J+3+sPw+gaOHLOdnhcrwE2vx8faU1lPkH9edt+U/qz/5FEkCrX+TkhMvx5fpLwePwDLT/1T0ZY4wxxhhjjLGL+omKnTLff2Z+4vP33p/Hq8s52eBy/M/enzPGGGOMMcYYY+zKe7Zb96cea9++dad/f1Dlf5T1Lw8aw39qZR787sB7gMzvKAD4gwsCZAzkX7mLLX/JsRIvPXT+fmr5WR/A/45W/hmDK/zExBhjjDHGGPvTXT7p//X31ZUqiDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYy4L+iv9O7ErvkTHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGLvS/k8AAAD///P/+v8=") ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x20, 0x1) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40242, 0x1) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) 84.789027ms ago: executing program 4 (id=7): bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000040000008500000010000000850000005000000095"], 0x0, 0x0, 0x0, 0x0, 0x136e54520700452d, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb7030000000000008500000059"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x28}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000780850000002d"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 26.523669ms ago: executing program 4 (id=8): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000540)=0x189d, 0x1a) setsockopt$sock_int(r0, 0x1, 0x29, &(0x7f0000000040)=0x4, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendto$packet(r0, 0x0, 0x0, 0x4004000, &(0x7f00000016c0)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @random="9047eacbfd81"}, 0x14) 0s ago: executing program 4 (id=9): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x2c42, 0x4c) r1 = inotify_init1(0x80000) inotify_add_watch(r1, &(0x7f0000000400)='.\x00', 0x8) r2 = inotify_init() inotify_add_watch(r2, &(0x7f00000003c0)='.\x00', 0x5db) writev(r0, &(0x7f0000001fc0)=[{&(0x7f00000001c0)="be9e", 0x2}], 0x1) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.155' (ED25519) to the list of known hosts. [ 22.678360][ T28] audit: type=1400 audit(1785548625.425:64): avc: denied { mounton } for pid=278 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.681936][ T278] cgroup: Unknown subsys name 'net' [ 22.701057][ T28] audit: type=1400 audit(1785548625.425:65): avc: denied { mount } for pid=278 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.728468][ T28] audit: type=1400 audit(1785548625.455:66): avc: denied { unmount } for pid=278 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.728926][ T278] cgroup: Unknown subsys name 'devices' [ 22.846384][ T278] cgroup: Unknown subsys name 'hugetlb' [ 22.852024][ T278] cgroup: Unknown subsys name 'rlimit' [ 22.957253][ T28] audit: type=1400 audit(1785548625.705:67): avc: denied { setattr } for pid=278 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.980517][ T28] audit: type=1400 audit(1785548625.705:68): avc: denied { mounton } for pid=278 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.005428][ T28] audit: type=1400 audit(1785548625.705:69): avc: denied { mount } for pid=278 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.035687][ T280] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 23.045014][ T28] audit: type=1400 audit(1785548625.795:70): avc: denied { relabelto } for pid=280 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.070473][ T28] audit: type=1400 audit(1785548625.795:71): avc: denied { write } for pid=280 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.135636][ T28] audit: type=1400 audit(1785548625.885:72): avc: denied { read } for pid=278 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.161213][ T28] audit: type=1400 audit(1785548625.885:73): avc: denied { open } for pid=278 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.161253][ T278] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.959233][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.966364][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.973928][ T287] device bridge_slave_0 entered promiscuous mode [ 23.985642][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.992711][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.000322][ T287] device bridge_slave_1 entered promiscuous mode [ 24.019581][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.026676][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.034187][ T286] device bridge_slave_0 entered promiscuous mode [ 24.041348][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.048507][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.056022][ T286] device bridge_slave_1 entered promiscuous mode [ 24.096003][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.103057][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.110548][ T289] device bridge_slave_0 entered promiscuous mode [ 24.127630][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.134729][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.142188][ T289] device bridge_slave_1 entered promiscuous mode [ 24.188249][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.195405][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.202794][ T290] device bridge_slave_0 entered promiscuous mode [ 24.212786][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.219896][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.227585][ T290] device bridge_slave_1 entered promiscuous mode [ 24.236838][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.243893][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.251375][ T288] device bridge_slave_0 entered promiscuous mode [ 24.261700][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.268810][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.276292][ T288] device bridge_slave_1 entered promiscuous mode [ 24.435656][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.442737][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.450056][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.457109][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.480381][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.487481][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.494813][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.501854][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.538276][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.545470][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.552763][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.559836][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.568400][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.575478][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.582754][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.589812][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.599080][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.606162][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.613445][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.620559][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.648348][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.656506][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.663711][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.671351][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.678960][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.686435][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.693619][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.701019][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.708256][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.715627][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.722840][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.755728][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.763853][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.772143][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.779201][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.786682][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.795567][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.802614][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.810179][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.818235][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.826276][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.834480][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.841519][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.864684][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.872632][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.881085][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.888178][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.896880][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.905166][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.912219][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.919638][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.928094][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.936442][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.943470][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.955440][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.963585][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.978197][ T287] device veth0_vlan entered promiscuous mode [ 24.996221][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.004345][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.012434][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 25.020024][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.027701][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.035981][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.043947][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.052335][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.060591][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.067669][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.075075][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.083221][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.091386][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.099565][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.107546][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.115959][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.124094][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.131158][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.140915][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.148609][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.156306][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 25.163724][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.195292][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.203729][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.212098][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.220674][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.229066][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.236161][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.243640][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.252230][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.260487][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.267645][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.275118][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.283039][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.291759][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.300231][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.312023][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.320144][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.332091][ T288] device veth0_vlan entered promiscuous mode [ 25.340355][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.348225][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.365806][ T287] device veth1_macvtap entered promiscuous mode [ 25.376315][ T289] device veth0_vlan entered promiscuous mode [ 25.383044][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.391765][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.399938][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.408481][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.416650][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.424895][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.433056][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.440911][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.449083][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.457405][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.464978][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.479055][ T288] device veth1_macvtap entered promiscuous mode [ 25.489521][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.497942][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.506987][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.516231][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.524779][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.539686][ T290] device veth0_vlan entered promiscuous mode [ 25.554029][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.562277][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.569950][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.577618][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.586302][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.594768][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.603086][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.611703][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.620099][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.628630][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.643509][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.651689][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.668039][ T287] request_module fs-gadgetfs succeeded, but still no fs? [ 25.674664][ T286] device veth0_vlan entered promiscuous mode [ 25.684174][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.692745][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.700550][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.708274][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.716838][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.727369][ T289] device veth1_macvtap entered promiscuous mode [ 25.757136][ T290] device veth1_macvtap entered promiscuous mode [ 25.778186][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.787507][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.799632][ T286] device veth1_macvtap entered promiscuous mode [ 25.819984][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.829661][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.839315][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.849105][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.858455][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.867212][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.875739][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.884108][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.920575][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.930608][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.943213][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.954345][ C1] ================================================================== [ 25.954718][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.962455][ C1] BUG: KASAN: use-after-free in rcu_segcblist_accelerate+0x1e7/0x420 [ 25.978809][ C1] Read of size 8 at addr ffff888132906190 by task syz-executor/282 [ 25.986723][ C1] [ 25.989055][ C1] CPU: 1 PID: 282 Comm: syz-executor Not tainted syzkaller #0 [ 25.996506][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.006576][ C1] Call Trace: [ 26.009853][ C1] [ 26.012696][ C1] __dump_stack+0x21/0x24 [ 26.017030][ C1] dump_stack_lvl+0x110/0x170 [ 26.021706][ C1] ? __cfi_dump_stack_lvl+0x8/0x8 [ 26.026732][ C1] ? rcu_segcblist_accelerate+0x1e7/0x420 [ 26.032452][ C1] print_address_description+0x71/0x200 [ 26.037995][ C1] print_report+0x4a/0x60 [ 26.042321][ C1] kasan_report+0x122/0x150 [ 26.046844][ C1] ? rcu_segcblist_accelerate+0x1e7/0x420 [ 26.052562][ C1] ? __cfi__raw_spin_lock_irqsave+0x10/0x10 [ 26.058467][ C1] __asan_report_load8_noabort+0x14/0x20 [ 26.064110][ C1] rcu_segcblist_accelerate+0x1e7/0x420 [ 26.069659][ C1] rcu_core+0x7b5/0xf00 [ 26.073806][ C1] ? rcu_cpu_kthread_park+0x90/0x90 [ 26.078997][ C1] ? kvm_sched_clock_read+0x18/0x40 [ 26.084194][ C1] ? run_rebalance_domains+0xf7/0x1c0 [ 26.089576][ C1] rcu_core_si+0x9/0x10 [ 26.093746][ C1] handle_softirqs+0x1d7/0x600 [ 26.098506][ C1] __irq_exit_rcu+0x52/0xf0 [ 26.103029][ C1] irq_exit_rcu+0x9/0x10 [ 26.107266][ C1] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 26.112917][ C1] [ 26.115844][ C1] [ 26.118786][ C1] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 26.124770][ C1] RIP: 0010:kasan_check_range+0x1c4/0x2a0 [ 26.130492][ C1] Code: f3 49 89 dc 49 8d 5c 24 07 4d 85 e4 49 0f 49 dc 48 83 e3 f8 49 29 dc 74 0e 41 80 3b 00 75 6b 49 ff c3 49 ff cc 75 f2 5b 41 5c <41> 5d 41 5e 41 5f 5d c3 45 84 ff 0f 85 91 00 00 00 41 f7 c7 00 ff [ 26.150093][ C1] RSP: 0018:ffffc900011e76a8 EFLAGS: 00000256 [ 26.156164][ C1] RAX: ffffffff819fbc01 RBX: ffffea0004b903c0 RCX: ffffffff819fbc5b [ 26.164131][ C1] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffea0004b903c0 [ 26.172114][ C1] RBP: ffffc900011e76c0 R08: ffffea0004b903c7 R09: 1ffffd4000972078 [ 26.180100][ C1] R10: dffffc0000000000 R11: fffff94000972079 R12: 1ffffd4000972078 [ 26.188073][ C1] R13: dffffc0000000001 R14: 1ffffd4000972078 R15: dffffc0000000000 [ 26.196057][ C1] ? folio_mark_accessed+0xb1/0x4d0 [ 26.201277][ C1] ? folio_mark_accessed+0x10b/0x4d0 [ 26.206583][ C1] __kasan_check_write+0x14/0x20 [ 26.211521][ C1] folio_mark_accessed+0x10b/0x4d0 [ 26.216638][ C1] ? __cfi_folio_mark_accessed+0x10/0x10 [ 26.222273][ C1] ? unlock_page_memcg+0x114/0x130 [ 26.227383][ C1] mark_page_accessed+0x55/0x70 [ 26.232238][ C1] unmap_page_range+0x19d2/0x2360 [ 26.237265][ C1] ? __cfi_unmap_page_range+0x10/0x10 [ 26.242642][ C1] ? mas_find+0xdf/0x380 [ 26.246883][ C1] unmap_vmas+0x34c/0x480 [ 26.251220][ C1] ? __cfi_unmap_vmas+0x10/0x10 [ 26.256073][ C1] ? __cfi_lru_add_drain_cpu+0x10/0x10 [ 26.261550][ C1] ? __kasan_check_write+0x14/0x20 [ 26.266655][ C1] exit_mmap+0x2a4/0xc10 [ 26.270905][ C1] ? perf_event_exit_event+0x530/0x530 [ 26.276360][ C1] ? __cfi_exit_mmap+0x10/0x10 [ 26.281130][ C1] ? __cfi_exit_aio+0x10/0x10 [ 26.285805][ C1] ? uprobe_clear_state+0x2c6/0x320 [ 26.290998][ C1] __mmput+0x92/0x340 [ 26.294980][ C1] mmput+0x4b/0x150 [ 26.298784][ C1] do_exit+0xa51/0x2850 [ 26.302938][ C1] ? lock_vma_under_rcu+0x3f8/0x4f0 [ 26.308154][ C1] ? __cfi_do_exit+0x10/0x10 [ 26.312743][ C1] ? __kasan_check_write+0x14/0x20 [ 26.317850][ C1] ? _raw_spin_lock_irq+0x95/0xf0 [ 26.322880][ C1] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 26.328423][ C1] ? ksys_write+0x1eb/0x260 [ 26.332920][ C1] ? zap_other_threads+0x2c1/0x2f0 [ 26.338045][ C1] do_group_exit+0x21b/0x2e0 [ 26.342810][ C1] __x64_sys_exit_group+0x3f/0x40 [ 26.347839][ C1] x64_sys_call+0x7b4/0x9a0 [ 26.352342][ C1] do_syscall_64+0x4c/0xa0 [ 26.356754][ C1] ? clear_bhb_loop+0x30/0x80 [ 26.361434][ C1] ? clear_bhb_loop+0x30/0x80 [ 26.366105][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 26.371998][ C1] RIP: 0033:0x7f1bd199e019 [ 26.376415][ C1] Code: Unable to access opcode bytes at 0x7f1bd199dfef. [ 26.383424][ C1] RSP: 002b:00007ffd4e36a9d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 26.391834][ C1] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f1bd199e019 [ 26.399805][ C1] RDX: 00007f1bd19cb397 RSI: 0000000000000004 RDI: 0000000000000001 [ 26.407770][ C1] RBP: 00007f1bd1c267b8 R08: 0000000000000000 R09: 0000000000000003 [ 26.415737][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008 [ 26.423705][ C1] R13: 0000000000000003 R14: 00007ffd4e36ac38 R15: 0000000000000000 [ 26.431687][ C1] [ 26.434699][ C1] [ 26.437016][ C1] Allocated by task 311: [ 26.441247][ C1] kasan_set_track+0x4b/0x70 [ 26.445835][ C1] kasan_save_alloc_info+0x1f/0x30 [ 26.450937][ C1] __kasan_kmalloc+0x95/0xb0 [ 26.455524][ C1] __kmalloc+0xb4/0x1e0 [ 26.459675][ C1] l2tp_session_create+0x38/0xbd0 [ 26.464691][ C1] pppol2tp_connect+0xbf5/0x1640 [ 26.469626][ C1] __sys_connect+0x3da/0x460 [ 26.474206][ C1] __x64_sys_connect+0x7a/0x90 [ 26.478964][ C1] x64_sys_call+0x88d/0x9a0 [ 26.483466][ C1] do_syscall_64+0x4c/0xa0 [ 26.487880][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 26.493774][ C1] [ 26.496106][ C1] Freed by task 43: [ 26.499899][ C1] kasan_set_track+0x4b/0x70 [ 26.504481][ C1] kasan_save_free_info+0x2b/0x40 [ 26.509496][ C1] ____kasan_slab_free+0x132/0x180 [ 26.514606][ C1] __kasan_slab_free+0x11/0x20 [ 26.519373][ C1] slab_free_freelist_hook+0xc2/0x190 [ 26.524741][ C1] __kmem_cache_free+0xb7/0x1b0 [ 26.529635][ C1] kfree+0x6f/0xf0 [ 26.533360][ C1] l2tp_session_put+0xaf/0x1a0 [ 26.538124][ C1] l2tp_session_delete+0x3df/0x4d0 [ 26.543237][ C1] l2tp_tunnel_del_work+0x199/0x410 [ 26.548437][ C1] process_one_work+0x717/0xc30 [ 26.553298][ C1] worker_thread+0xa4d/0x11d0 [ 26.557973][ C1] kthread+0x281/0x320 [ 26.562035][ C1] ret_from_fork+0x1f/0x30 [ 26.566450][ C1] [ 26.568766][ C1] Last potentially related work creation: [ 26.574482][ C1] kasan_save_stack+0x3a/0x60 [ 26.579159][ C1] __kasan_record_aux_stack+0xb6/0xc0 [ 26.584522][ C1] kasan_record_aux_stack_noalloc+0xb/0x10 [ 26.590318][ C1] call_rcu+0xcf/0xf50 [ 26.594386][ C1] pppol2tp_release+0x1e3/0x2b0 [ 26.599245][ C1] sock_close+0xc9/0x220 [ 26.603490][ C1] __fput+0x1fd/0x8f0 [ 26.607481][ C1] ____fput+0x15/0x20 [ 26.611475][ C1] task_work_run+0x1e1/0x250 [ 26.616062][ C1] do_exit+0xaf2/0x2850 [ 26.620221][ C1] __cfi___ia32_sys_exit+0x0/0x10 [ 26.625250][ C1] x64_sys_call+0x67/0x9a0 [ 26.629675][ C1] do_syscall_64+0x4c/0xa0 [ 26.634089][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 26.639982][ C1] [ 26.642299][ C1] The buggy address belongs to the object at ffff888132906000 [ 26.642299][ C1] which belongs to the cache kmalloc-512 of size 512 [ 26.656344][ C1] The buggy address is located 400 bytes inside of [ 26.656344][ C1] 512-byte region [ffff888132906000, ffff888132906200) [ 26.669637][ C1] [ 26.671982][ C1] The buggy address belongs to the physical page: [ 26.678403][ C1] page:ffffea0004ca4100 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x132904 [ 26.688654][ C1] head:ffffea0004ca4100 order:2 compound_mapcount:0 compound_pincount:0 [ 26.696986][ C1] flags: 0x4000000000010200(slab|head|zone=1) [ 26.703064][ C1] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 [ 26.711642][ C1] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 26.720226][ C1] page dumped because: kasan: bad access detected [ 26.726625][ C1] page_owner tracks the page as allocated [ 26.732334][ C1] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x152a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 19, tgid 19 (kworker/0:1), ts 25764858029, free_ts 25745249821 [ 26.752551][ C1] post_alloc_hook+0x1f5/0x210 [ 26.757320][ C1] prep_new_page+0x1c/0x110 [ 26.761822][ C1] get_page_from_freelist+0x2ca9/0x2d20 [ 26.767455][ C1] __alloc_pages+0x1fa/0x610 [ 26.772042][ C1] alloc_slab_page+0x6e/0xf0 [ 26.776621][ C1] new_slab+0x98/0x3e0 [ 26.780682][ C1] ___slab_alloc+0x70f/0xb70 [ 26.785271][ C1] __slab_alloc+0x5e/0xa0 [ 26.789605][ C1] __kmem_cache_alloc_node+0x204/0x2d0 [ 26.795062][ C1] __kmalloc+0xa4/0x1e0 [ 26.799212][ C1] ___neigh_create+0x6e3/0x1db0 [ 26.804073][ C1] __neigh_create+0x31/0x40 [ 26.808574][ C1] ip6_finish_output2+0xaaf/0x18b0 [ 26.813683][ C1] ip6_finish_output+0x60b/0xbe0 [ 26.818633][ C1] ip6_output+0x1fa/0x410 [ 26.822957][ C1] mld_sendpack+0x7ce/0xda0 [ 26.827457][ C1] page last free stack trace: [ 26.832117][ C1] free_unref_page_prepare+0x80c/0x820 [ 26.837577][ C1] free_unref_page+0x93/0x530 [ 26.842252][ C1] __free_pages+0x67/0x100 [ 26.846673][ C1] free_pages+0x82/0x90 [ 26.850839][ C1] __stack_depot_save+0x45f/0x490 [ 26.855862][ C1] kasan_set_track+0x60/0x70 [ 26.860455][ C1] kasan_save_free_info+0x2b/0x40 [ 26.865478][ C1] ____kasan_slab_free+0x132/0x180 [ 26.870591][ C1] __kasan_slab_free+0x11/0x20 [ 26.875353][ C1] slab_free_freelist_hook+0xc2/0x190 [ 26.880721][ C1] __kmem_cache_free+0xb7/0x1b0 [ 26.885570][ C1] kfree+0x6f/0xf0 [ 26.889283][ C1] kvfree+0x35/0x40 [ 26.893084][ C1] xt_free_table_info+0x6d/0x180 [ 26.898014][ C1] __do_replace+0x7bd/0x960 [ 26.902516][ C1] do_ip6t_set_ctl+0xb2c/0xe00 [ 26.907279][ C1] [ 26.909596][ C1] Memory state around the buggy address: [ 26.915218][ C1] ffff888132906080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.923271][ C1] ffff888132906100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.931322][ C1] >ffff888132906180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.939369][ C1] ^ [ 26.943945][ C1] ffff888132906200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.951992][ C1] ffff888132906280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.960151][ C1] ================================================================== [ 26.968208][ C1] Disabling lock debugging due to kernel taint [ 27.454955][ T43] device bridge_slave_1 left promiscuous mode [ 27.461094][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.468645][ T43] device bridge_slave_0 left promiscuous mode [ 27.474853][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.482689][ T43] device veth1_macvtap left promiscuous mode [ 27.489046][ T43] device veth0_vlan left promiscuous mode