last executing test programs: 465.103248ms ago: executing program 1 (id=2): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x400d032, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x300000b, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000900)={'vcan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f0000000940)={0x1d, r1}, 0x10) sendmsg$can_bcm(r0, &(0x7f0000000980)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="f80e7350316da547e20dede14ac00100003318add0002b080000000000000cb9a58f9230b91b0491d44cac29d747f7bcae4ad35d415f3405ee9110980040dcc83a14c1ea86a63c29d72f9bf4ce91f0d0ceb00b982a61381ec25773c926090030773f8b4c0d7e73d660cd43d191d8183d2e7441a457756e50eec0c9c1a33ca741f97c28aa9801fb3208e13042bff18800"/159, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYBLOB="00000000010000000000000012000000ef1d62ee7e923b0ad9cda5b28dd4753620a2f0271768f8124c18a4e2b5e44dc77098b18fd964df81213608ec503db52d42f1a78c97322f4ae4c8dc89cf2b1440"], 0x80}}, 0x0) 431.042409ms ago: executing program 2 (id=3): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = syz_usb_connect$uac3(0x3, 0x97, &(0x7f0000000080)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x10, 0x103d, 0x100, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x85, 0x3, 0x1, 0xd8, 0x10, 0xc, {0x8, 0xb, 0x1, 0x2, 0x1, 0x1, 0x30, 0x2}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x7}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0xe, 0x0, 0x3, {0xa, 0x25, 0x25, 0x7fffffff, 0xc, 0x180}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@as_header={0x17, 0x24, 0x1, 0x6, 0x8000, 0x7, 0x2, 0x6, 0x4a, 0x9, 0x10}]}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x7f, 0x4, 0x0, {0xa, 0x25, 0x25, 0x400, 0x8f, 0x2}}}}}}}}]}}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r1, &(0x7f0000000180)={0x14, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0003021100000203"]}, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380), 0x40101, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_open_dev$ttys(0xc, 0x2, 0x1) r4 = openat2(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', &(0x7f00000004c0)={0x40040, 0xc, 0x21}, 0x18) r5 = dup(r4) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r3, 0x4008ae48, 0x0) syz_usb_connect$uac1(0x4, 0x0, 0x0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0xc07}}]}) syz_usb_control_io$uac3(r1, &(0x7f00000002c0)={0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="000e06000000068ac39aed3cedd7481b173f2adbe28503a1215238299f06d91dae52d13409fa3ebb11af080f4ad988dc4e88fa0d5764dc69e84db17b2b4a247766f71e0795a264293aeb09aebbe0c6740e3ca4b24e9d5d751c80464778142a964e41058b6d89dd5842b79424ef4161a822bbe95b07b8e6e7483ab9f868009029a2a52802c97353fa1c2f4c5327c42852d2"], 0x0}, 0x0) syz_usb_control_io$uac3(r1, &(0x7f0000000340)={0x14, &(0x7f0000000380)=ANY=[], 0x0}, 0x0) r6 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r7 = syz_kvm_setup_syzos_vm$x86(r6, &(0x7f0000c00000/0x400000)=nil) r8 = syz_kvm_add_vcpu$x86(r7, &(0x7f0000000280)={0x0, &(0x7f0000000040)=[@cpuid={0x64, 0x18, {0xffffffdc, 0x8000}}], 0x18}) ioctl$KVM_RUN(r8, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0xc4400, 0x0) 388.2255ms ago: executing program 0 (id=1): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB="b0000008", @ANYRES16=r1, @ANYBLOB="08002abd7000fddbdf250b0000001c00038006000400e15000000800010001000000080005000000000078000380140002006272696467655f736c6176655f3100000500080004000000060007004e230000080005007f00000114000600fe8000000000000000000000000000bb060007004e24000006000400050000000800010000000000140002007866726d300000000000000000000000050008000500000008000600852b0000"], 0xb0}, 0x1, 0x0, 0x0, 0x4080}, 0x40000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) prlimit64(0x0, 0x2, &(0x7f0000000380)={0x633, 0xffffffffffffffff}, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='memory.swap.current\x00', 0x275a, 0x0) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000440), r3) write(r2, &(0x7f0000000000)='3', 0x4e) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000000c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) sendmsg$DEVLINK_CMD_SB_POOL_SET(r3, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x50, r4, 0x10, 0x70bd2d, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x200}, {0x6, 0x11, 0xff}, {0x8, 0x13, 0x7fff}, {0x5, 0x14, 0x1}}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) 378.168561ms ago: executing program 3 (id=4): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) setsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000000000)=0x30, 0x4) getsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000000080), &(0x7f00000000c0)=0x9) 341.144661ms ago: executing program 3 (id=5): r0 = socket$igmp6(0xa, 0x3, 0x2) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'lo\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000180)={@mcast2, 0x1a, r2}) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000000)={@private1={0xfc, 0x1, '\x00', 0x1}, 0x77, r2}) 47.726278ms ago: executing program 3 (id=6): r0 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) fallocate(0xffffffffffffffff, 0x10, 0x0, 0x10000003) write$binfmt_script(r1, &(0x7f0000000080), 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$UFFDIO_WRITEPROTECT(0xffffffffffffffff, 0xc018aa06, &(0x7f0000000100)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010025bd7000fcffffff8900000008000300", @ANYRES32, @ANYBLOB="18009d"], 0x34}, 0x1, 0x0, 0x0, 0x25e2906596869c9d}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.controllers\x00', 0x275a, 0x0) r4 = getpid() r5 = syz_pidfd_open(r4, 0x0) copy_file_range(r5, 0x0, r5, 0x0, 0x22b1, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x0, 0x2010, 0xffffffffffffffff, 0x0) close(r5) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r6 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_msfilter(r6, 0x0, 0x29, 0x0, 0xdab1f63843b39bd0) r7 = fsmount(r0, 0x0, 0x88) openat$cgroup_int(r7, &(0x7f0000000380)='cgroup.max.depth\x00', 0x2, 0x0) r8 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340), 0x41, 0x0) r9 = dup(r8) ioctl$TCSETS(r8, 0x40045431, &(0x7f0000000400)={0x0, 0xade, 0x0, 0x0, 0x1b, "0062ba7d820700000001000000000000096304"}) r10 = syz_open_pts(r8, 0x80) dup3(r10, r8, 0x80000) write$tun(r9, &(0x7f0000000440)=ANY=[@ANYBLOB="0080600004"], 0x138) syz_open_procfs(0x0, &(0x7f0000000480)='fd/3\x00') read(r8, &(0x7f00000004c0)=""/228, 0xe4) 0s ago: executing program 0 (id=7): syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') syz_open_procfs(0x0, &(0x7f0000000080)='net/nf_conntrack\x00') mkdir(&(0x7f00000000c0)='my_sys\x00', 0x1fd) mount(0x0, &(0x7f0000000100)='my_sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x24, 0x1e, 0x21, 0x0, 0x0, {0xa}, [@typed={0x5, 0x0, 0x0, 0x0, @str='\x00'}, @typed={0x8, 0xf, 0x0, 0x0, @pid}]}, 0x24}}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xff, 0x0, 0x12, r1, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, &(0x7f0000000200)='mem\x00\xffEev\xf2r\xf1\x18\x1d\xb9\x00y_hug$\bo-\x03Q`]o\x8cr\x9d_etl\xf9\xdd\a\xad\\H\xe94\b,H\xbf', 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000240)) lsm_get_self_attr(0x68, 0x0, &(0x7f0000000340), 0x1) read$FUSE(r2, &(0x7f0000000840)={0x2020}, 0x2020) r3 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_elf32(r3, &(0x7f0000000440)=ANY=[], 0x58) mkdir(&(0x7f00000001c0)='./bus\x00', 0x57) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') execve(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.47' (ED25519) to the list of known hosts. [ 21.393898][ T36] audit: type=1400 audit(1791890237.519:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.395114][ T286] cgroup: Unknown subsys name 'net' [ 21.416651][ T36] audit: type=1400 audit(1791890237.519:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.443957][ T36] audit: type=1400 audit(1791890237.549:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.444146][ T286] cgroup: Unknown subsys name 'devices' [ 21.562829][ T286] cgroup: Unknown subsys name 'hugetlb' [ 21.568452][ T286] cgroup: Unknown subsys name 'rlimit' [ 21.680697][ T36] audit: type=1400 audit(1791890237.799:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.703914][ T36] audit: type=1400 audit(1791890237.799:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 21.728760][ T36] audit: type=1400 audit(1791890237.809:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.754578][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 21.763354][ T36] audit: type=1400 audit(1791890237.889:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.788774][ T36] audit: type=1400 audit(1791890237.889:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.808928][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.814488][ T36] audit: type=1400 audit(1791890237.939:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.848549][ T36] audit: type=1400 audit(1791890237.939:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.185592][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.192696][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.199779][ T296] bridge_slave_0: entered allmulticast mode [ 23.206083][ T296] bridge_slave_0: entered promiscuous mode [ 23.212519][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.219555][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.226801][ T295] bridge_slave_0: entered allmulticast mode [ 23.233000][ T295] bridge_slave_0: entered promiscuous mode [ 23.243222][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.250259][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.257401][ T296] bridge_slave_1: entered allmulticast mode [ 23.263625][ T296] bridge_slave_1: entered promiscuous mode [ 23.269658][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.276737][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.283857][ T295] bridge_slave_1: entered allmulticast mode [ 23.289987][ T295] bridge_slave_1: entered promiscuous mode [ 23.326359][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.333436][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.340486][ T294] bridge_slave_0: entered allmulticast mode [ 23.346775][ T294] bridge_slave_0: entered promiscuous mode [ 23.361863][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.368916][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.376034][ T294] bridge_slave_1: entered allmulticast mode [ 23.382217][ T294] bridge_slave_1: entered promiscuous mode [ 23.402253][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.409313][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.416455][ T293] bridge_slave_0: entered allmulticast mode [ 23.422853][ T293] bridge_slave_0: entered promiscuous mode [ 23.431975][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.439021][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.446131][ T293] bridge_slave_1: entered allmulticast mode [ 23.452401][ T293] bridge_slave_1: entered promiscuous mode [ 23.577252][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.584339][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.591678][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.598707][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.609297][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.616404][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.623684][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.630708][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.639444][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.646561][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.653889][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.660933][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.689738][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.696824][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.704238][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.711312][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.730862][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.738229][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.745728][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.752959][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.760648][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.768003][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.775326][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.782638][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.804171][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.811246][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.818716][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.825782][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.833364][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.843905][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.851788][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.858988][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.898989][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.906079][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.914355][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.921500][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.934595][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.941693][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.959287][ T295] veth0_vlan: entered promiscuous mode [ 23.966849][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.973942][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.986879][ T294] veth0_vlan: entered promiscuous mode [ 24.010864][ T294] veth1_macvtap: entered promiscuous mode [ 24.018853][ T295] veth1_macvtap: entered promiscuous mode [ 24.048286][ T293] veth0_vlan: entered promiscuous mode [ 24.060771][ T296] veth0_vlan: entered promiscuous mode [ 24.070902][ T294] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 24.100428][ T293] veth1_macvtap: entered promiscuous mode [ 24.115892][ T296] veth1_macvtap: entered promiscuous mode [ 24.203326][ T321] FAULT_INJECTION: forcing a failure. [ 24.203326][ T321] name failslab, interval 1, probability 0, space 0, times 1 [ 24.221093][ T321] CPU: 1 UID: 0 PID: 321 Comm: syz.0.1 Not tainted syzkaller #0 4bc62a9bdafb808e3133dbe6927c9cb60f98f7d5 [ 24.221129][ T321] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 24.221151][ T321] Call Trace: [ 24.221157][ T321] [ 24.221164][ T321] __dump_stack+0x21/0x30 [ 24.221196][ T321] dump_stack_lvl+0x140/0x1c0 [ 24.221221][ T321] ? __cfi_dump_stack_lvl+0x10/0x10 [ 24.221245][ T321] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 24.221262][ T321] dump_stack+0x19/0x20 [ 24.221285][ T321] should_fail_ex+0x3c2/0x510 [ 24.221304][ T321] should_failslab+0xac/0x100 [ 24.221322][ T321] kmem_cache_alloc_noprof+0x42/0x410 [ 24.221349][ T321] ? ovl_get_tree+0x20/0x30 [ 24.221377][ T321] ? vfs_get_tree+0x9e/0x290 [ 24.221402][ T321] ? prepare_creds+0x47/0x6b0 [ 24.221422][ T321] ? xas_create+0xe23/0xf80 [ 24.221439][ T321] ? x64_sys_call+0x2021/0x2ee0 [ 24.221459][ T321] prepare_creds+0x47/0x6b0 [ 24.221479][ T321] ovl_fill_super+0x1d1/0x3c10 [ 24.221494][ T321] ? xas_store+0xb6e/0x17f0 [ 24.221510][ T321] ? xas_nomem+0x71/0x2c0 [ 24.221527][ T321] ? __kmalloc_cache_noprof+0x23c/0x470 [ 24.221564][ T321] ? __cfi_ovl_fill_super+0x10/0x10 [ 24.221584][ T321] ? __kasan_check_write+0x18/0x20 [ 24.221609][ T321] ? mutex_unlock+0x90/0x240 [ 24.221630][ T321] ? __cfi_mutex_unlock+0x10/0x10 [ 24.221650][ T321] ? __kasan_check_write+0x18/0x20 [ 24.221672][ T321] ? _raw_spin_lock+0x92/0x120 [ 24.221696][ T321] ? __kasan_check_write+0x18/0x20 [ 24.221715][ T321] ? shrinker_register+0x162/0x220 [ 24.221737][ T321] ? sget_fc+0x97e/0xa70 [ 24.221756][ T321] ? __cfi_set_anon_super_fc+0x10/0x10 [ 24.221777][ T321] get_tree_nodev+0xcb/0x170 [ 24.221798][ T321] ? __cfi_ovl_fill_super+0x10/0x10 [ 24.221815][ T321] ovl_get_tree+0x20/0x30 [ 24.221840][ T321] vfs_get_tree+0x9e/0x290 [ 24.221863][ T321] do_new_mount+0x251/0xb40 [ 24.221887][ T321] ? security_capable+0x44/0x130 [ 24.221912][ T321] path_mount+0x66a/0xff0 [ 24.221931][ T321] ? putname+0x113/0x150 [ 24.221954][ T321] __se_sys_mount+0x2bf/0x480 [ 24.221991][ T321] ? __x64_sys_mount+0xf0/0xf0 [ 24.222019][ T321] ? __kasan_check_write+0x18/0x20 [ 24.222044][ T321] ? fpregs_restore_userregs+0x11c/0x260 [ 24.222072][ T321] __x64_sys_mount+0xc3/0xf0 [ 24.222097][ T321] x64_sys_call+0x2021/0x2ee0 [ 24.222117][ T321] do_syscall_64+0x57/0xf0 [ 24.222135][ T321] ? clear_bhb_loop+0x50/0xa0 [ 24.222157][ T321] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 24.222179][ T321] RIP: 0033:0x7fd8bdb9e2d9 [ 24.222206][ T321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 24.222223][ T321] RSP: 002b:00007fd8bea91028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 24.222252][ T321] RAX: ffffffffffffffda RBX: 00007fd8bde25fa0 RCX: 00007fd8bdb9e2d9 [ 24.222268][ T321] RDX: 0000200000000180 RSI: 0000200000000140 RDI: 0000000000000000 [ 24.222281][ T321] RBP: 00007fd8bdc35888 R08: 00002000000000c0 R09: 0000000000000000 [ 24.222295][ T321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 24.222307][ T321] R13: 00007fd8bde26038 R14: 00007fd8bde25fa0 R15: 00007ffe4a3100c8 [ 24.222323][ T321] [ 24.498143][ T10] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 24.669829][ T293] ------------[ cut here ]------------ [ 24.675401][ T293] WARNING: CPU: 0 PID: 293 at fs/inode.c:340 drop_nlink+0xce/0x110 [ 24.683373][ T293] Modules linked in: [ 24.687293][ T293] CPU: 0 UID: 0 PID: 293 Comm: syz-executor Not tainted syzkaller #0 4bc62a9bdafb808e3133dbe6927c9cb60f98f7d5 [ 24.698999][ T293] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 24.709106][ T293] RIP: 0010:drop_nlink+0xce/0x110 [ 24.714189][ T293] Code: 04 00 00 be 08 00 00 00 e8 ff 0b ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d e9 88 db b5 03 cc e8 62 93 94 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c [ 24.733982][ T293] RSP: 0018:ffffc9000b68fc88 EFLAGS: 00010293 [ 24.740066][ T293] RAX: ffffffff81f4b95e RBX: ffff88810fba4428 RCX: ffff888104f362c0 [ 24.748083][ T293] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 24.756104][ T293] RBP: ffffc9000b68fcb0 R08: 0000000000000003 R09: 0000000000000004 [ 24.764523][ T293] R10: dffffc0000000000 R11: fffff520016d1f80 R12: dffffc0000000000 [ 24.767746][ T327] netlink: 'syz.3.6': attribute type 11 has an invalid length. [ 24.772600][ T293] R13: 1ffff11021f7488e R14: ffff88810fba4470 R15: 0000000000000000 [ 24.788135][ T293] FS: 0000555563f4e500(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 [ 24.797260][ T293] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 24.803976][ T293] CR2: 0000555563f71958 CR3: 0000000122e2a000 CR4: 00000000003526b0 [ 24.811988][ T293] Call Trace: [ 24.815283][ T293] [ 24.818227][ T293] shmem_rmdir+0x5f/0x90 [ 24.822561][ T293] vfs_rmdir+0x3de/0x560 [ 24.826830][ T293] incfs_kill_sb+0x102/0x220 [ 24.831563][ T293] deactivate_locked_super+0xd5/0x270 [ 24.836965][ T293] deactivate_super+0xb8/0xe0 [ 24.841699][ T293] cleanup_mnt+0x438/0x4d0 [ 24.846144][ T293] __cleanup_mnt+0x1d/0x40 [ 24.850588][ T293] task_work_run+0x1e8/0x260 [ 24.855230][ T293] ? __cfi_task_work_run+0x10/0x10 [ 24.860367][ T293] ? __x64_sys_umount+0x12e/0x180 [ 24.865442][ T293] ? __cfi___x64_sys_umount+0x10/0x10 [ 24.871333][ T293] ? __kasan_check_read+0x15/0x20 [ 24.876510][ T293] resume_user_mode_work+0x35/0x50 [ 24.881774][ T293] syscall_exit_to_user_mode+0x63/0xb0 [ 24.887424][ T293] do_syscall_64+0x63/0xf0 [ 24.891982][ T293] ? clear_bhb_loop+0x50/0xa0 [ 24.897118][ T293] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 24.903099][ T293] RIP: 0033:0x7fd8bdb9f517 [ 24.907518][ T293] Code: a2 c7 05 dc 61 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 24.927157][ T293] RSP: 002b:00007ffe4a30f338 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 24.935689][ T293] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fd8bdb9f517 [ 24.943707][ T293] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe4a30f3f0 [ 24.951898][ T293] RBP: 00007ffe4a30f3f0 R08: 00007ffe4a3103f0 R09: 00000000ffffffff [ 24.959880][ T293] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe4a310480 [ 24.967988][ T293] R13: 00007fd8bdc34ccb R14: 000000000000603a R15: 00007ffe4a3104c0 [ 24.976020][ T293] [ 24.979060][ T293] ---[ end trace 0000000000000000 ]--- [ 24.984853][ T293] ================================================================== [ 24.992942][ T293] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 [ 24.999196][ T293] Write of size 4 at addr 0000000000000168 by task syz-executor/293 [ 25.000832][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 25.007159][ T293] [ 25.007173][ T293] CPU: 1 UID: 0 PID: 293 Comm: syz-executor Tainted: G W syzkaller #0 4bc62a9bdafb808e3133dbe6927c9cb60f98f7d5 [ 25.007201][ T293] Tainted: [W]=WARN [ 25.007207][ T293] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 25.007219][ T293] Call Trace: [ 25.007227][ T293] [ 25.007236][ T293] __dump_stack+0x21/0x30 [ 25.007266][ T293] dump_stack_lvl+0x140/0x1c0 [ 25.007292][ T293] ? __cfi_dump_stack_lvl+0x10/0x10 [ 25.007317][ T293] print_report+0x3d/0x70 [ 25.007342][ T293] kasan_report+0x162/0x1a0 [ 25.007359][ T293] ? ihold+0x24/0x70 [ 25.007376][ T293] ? ihold+0x24/0x70 [ 25.007392][ T293] kasan_check_range+0x25a/0x2b0 [ 25.007411][ T293] __kasan_check_write+0x18/0x20 [ 25.007433][ T293] ihold+0x24/0x70 [ 25.007449][ T293] vfs_rmdir+0x25c/0x560 [ 25.007469][ T293] incfs_kill_sb+0x102/0x220 [ 25.007501][ T293] deactivate_locked_super+0xd5/0x270 [ 25.007521][ T293] deactivate_super+0xb8/0xe0 [ 25.007541][ T293] cleanup_mnt+0x438/0x4d0 [ 25.007559][ T293] __cleanup_mnt+0x1d/0x40 [ 25.007575][ T293] task_work_run+0x1e8/0x260 [ 25.007598][ T293] ? __cfi_task_work_run+0x10/0x10 [ 25.007621][ T293] ? __x64_sys_umount+0x12e/0x180 [ 25.007643][ T293] ? __cfi___x64_sys_umount+0x10/0x10 [ 25.007665][ T293] ? __kasan_check_read+0x15/0x20 [ 25.007687][ T293] resume_user_mode_work+0x35/0x50 [ 25.007708][ T293] syscall_exit_to_user_mode+0x63/0xb0 [ 25.007732][ T293] do_syscall_64+0x63/0xf0 [ 25.007747][ T293] ? clear_bhb_loop+0x50/0xa0 [ 25.007768][ T293] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 25.007788][ T293] RIP: 0033:0x7fd8bdb9f517 [ 25.007804][ T293] Code: a2 c7 05 dc 61 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 25.007819][ T293] RSP: 002b:00007ffe4a30f338 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 25.007839][ T293] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fd8bdb9f517 [ 25.007851][ T293] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe4a30f3f0 [ 25.007863][ T293] RBP: 00007ffe4a30f3f0 R08: 00007ffe4a3103f0 R09: 00000000ffffffff [ 25.007876][ T293] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe4a310480 [ 25.007888][ T293] R13: 00007fd8bdc34ccb R14: 000000000000603a R15: 00007ffe4a3104c0 [ 25.007902][ T293] [ 25.007909][ T293] ================================================================== [ 25.013719][ T10] usb 3-1: unable to get BOS descriptor or descriptor too short [ 25.015167][ T293] Disabling lock debugging due to kernel taint [ 25.032315][ T10] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 25.042006][ T293] BUG: kernel NULL pointer dereference, address: 0000000000000168 [ 25.042022][ T293] #PF: supervisor write access in kernel mode [ 25.042032][ T293] #PF: error_code(0x0002) - not-present page [ 25.042053][ T293] PGD 800000010f773067 P4D 800000010f773067 PUD 0 [ 25.042077][ T293] Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI [ 25.042129][ T293] CPU: 1 UID: 0 PID: 293 Comm: syz-executor Tainted: G B W syzkaller #0 4bc62a9bdafb808e3133dbe6927c9cb60f98f7d5 [ 25.042159][ T293] Tainted: [B]=BAD_PAGE, [W]=WARN [ 25.042165][ T293] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 25.042177][ T293] RIP: 0010:ihold+0x2a/0x70 [ 25.048673][ T10] usb 3-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 25.052728][ T293] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 4d 8a 94 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 bc 02 ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 5d [ 25.052749][ T293] RSP: 0018:ffffc9000b68fcc8 EFLAGS: 00010246 [ 25.052766][ T293] RAX: ffff888104f36200 RBX: 0000000000000000 RCX: ffff888104f362c0 [ 25.052779][ T293] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 25.052789][ T293] RBP: ffffc9000b68fcd8 R08: ffffffff893c8947 R09: 1ffffffff1279128 [ 25.064519][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.066956][ T293] R10: dffffc0000000000 R11: fffffbfff1279129 R12: 0000000000000000 [ 25.066975][ T293] R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 [ 25.073774][ T10] usb 3-1: Product: syz [ 25.075396][ T293] FS: 0000555563f4e500(0000) GS:ffff8881f6d00000(0000) knlGS:0000000000000000 [ 25.075417][ T293] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.079343][ T10] usb 3-1: Manufacturer: syz [ 25.084213][ T293] CR2: 0000000000000168 CR3: 0000000122e2a000 CR4: 00000000003526b0 [ 25.084233][ T293] Call Trace: [ 25.084239][ T293] [ 25.084247][ T293] vfs_rmdir+0x25c/0x560 [ 25.084271][ T293] incfs_kill_sb+0x102/0x220 [ 25.089696][ T10] usb 3-1: SerialNumber: syz [ 25.092902][ T293] deactivate_locked_super+0xd5/0x270 [ 25.092927][ T293] deactivate_super+0xb8/0xe0 [ 25.092947][ T293] cleanup_mnt+0x438/0x4d0 [ 25.494052][ T293] __cleanup_mnt+0x1d/0x40 [ 25.498481][ T293] task_work_run+0x1e8/0x260 [ 25.502622][ T314] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.503078][ T293] ? __cfi_task_work_run+0x10/0x10 [ 25.525298][ T293] ? __x64_sys_umount+0x12e/0x180 [ 25.530350][ T293] ? __cfi___x64_sys_umount+0x10/0x10 [ 25.535739][ T293] ? __kasan_check_read+0x15/0x20 [ 25.540789][ T293] resume_user_mode_work+0x35/0x50 [ 25.545932][ T293] syscall_exit_to_user_mode+0x63/0xb0 [ 25.551412][ T293] do_syscall_64+0x63/0xf0 [ 25.555832][ T293] ? clear_bhb_loop+0x50/0xa0 [ 25.560510][ T293] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 25.566401][ T293] RIP: 0033:0x7fd8bdb9f517 [ 25.570824][ T293] Code: a2 c7 05 dc 61 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 25.590468][ T293] RSP: 002b:00007ffe4a30f338 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 25.598900][ T293] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fd8bdb9f517 [ 25.606877][ T293] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe4a30f3f0 [ 25.614860][ T293] RBP: 00007ffe4a30f3f0 R08: 00007ffe4a3103f0 R09: 00000000ffffffff [ 25.622843][ T293] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe4a310480 [ 25.630915][ T293] R13: 00007fd8bdc34ccb R14: 000000000000603a R15: 00007ffe4a3104c0 [ 25.638892][ T293] [ 25.642042][ T293] Modules linked in: [ 25.645943][ T293] CR2: 0000000000000168 [ 25.650084][ T293] ---[ end trace 0000000000000000 ]--- [ 25.655529][ T293] RIP: 0010:ihold+0x2a/0x70 [ 25.660037][ T293] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 4d 8a 94 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 bc 02 ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 5d [ 25.679633][ T293] RSP: 0018:ffffc9000b68fcc8 EFLAGS: 00010246 [ 25.685700][ T293] RAX: ffff888104f36200 RBX: 0000000000000000 RCX: ffff888104f362c0 [ 25.693676][ T293] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 25.701727][ T293] RBP: ffffc9000b68fcd8 R08: ffffffff893c8947 R09: 1ffffffff1279128 [ 25.709693][ T293] R10: dffffc0000000000 R11: fffffbfff1279129 R12: 0000000000000000 [ 25.717664][ T293] R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 [ 25.725634][ T293] FS: 0000555563f4e500(0000) GS:ffff8881f6d00000(0000) knlGS:0000000000000000 [ 25.734568][ T293] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.741161][ T293] CR2: 0000000000000168 CR3: 0000000122e2a000 CR4: 00000000003526b0 [ 25.749155][ T293] Kernel panic - not syncing: Fatal exception [ 25.755378][ T293] Kernel Offset: disabled [ 25.759729][ T293] Rebooting in 86400 seconds..