last executing test programs: 4m20.390400841s ago: executing program 32 (id=380): r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x530, 0x1d8, 0xffffffff, 0xffffffff, 0x1d8, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1d8, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x590) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1, 0x2}) r1 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x3, 0xc, @dev={0xfe, 0x80, '\x00', 0xd}, 0x9}, 0x1c) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) sendmsg(r1, &(0x7f00000000c0)={0x0, 0x33, &(0x7f0000000100)=[{&(0x7f0000000000)=',', 0x584}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 3m25.165138267s ago: executing program 33 (id=991): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x14, 0x27, 0x9, 0x70bd25, 0x25dfdbfd, {0x12}}, 0x14}}, 0x4000080) mount(&(0x7f0000000080)=@loop={'/dev/loop', 0x0}, &(0x7f00000001c0)='./cgroup\x00', &(0x7f0000000180)='ufs\x00', 0x1a0c099, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c000180060001"], 0xa4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="500000000001010400000000141a000002000010240001801400018008000100e000000108000200e00000010c00028005000100000000001800028014000180080001"], 0x50}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000080900010073797a30000000005c000000030a1b000000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140004"], 0xa4}}, 0x0) 3m8.355330104s ago: executing program 34 (id=1176): r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) io_setup(0x8, &(0x7f0000004200)=0x0) io_submit(r3, 0x1, &(0x7f0000000000)=[&(0x7f0000000040)={0x0, 0x0, 0x20, 0x1, 0x7, r2, 0x0, 0x0, 0x3}]) 2m42.522746367s ago: executing program 7 (id=1499): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000e00)=@newtfilter={0x50, 0x2c, 0xd3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xb, 0xfff3}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x20, 0x2, [@TCA_BASIC_EMATCHES={0x1c, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x100}}, @TCA_EMATCH_TREE_LIST={0x10, 0x2, 0x0, 0x1, [@TCF_EM_META={0xc, 0x1, 0x0, 0x0, {{0x9, 0x4, 0x27}}}]}]}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000814}, 0x800) 2m42.371176536s ago: executing program 7 (id=1503): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x428a4, 0x4000}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'dummy0\x00'}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8004) 2m42.244344878s ago: executing program 7 (id=1504): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='ramfs\x00', 0x10, 0x0) 2m42.156306423s ago: executing program 7 (id=1505): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) syz_usb_connect$cdc_ncm(0x0, 0x6e, 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x4) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) 2m39.296841551s ago: executing program 7 (id=1539): rseq(&(0x7f0000000400), 0x20, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x9, 0x7, 0x7ffc0001}]}) r0 = getpgrp(0x0) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) kcmp(r0, r1, 0x5, 0xffffffffffffffff, 0xffffffffffffffff) 2m39.136001901s ago: executing program 7 (id=1542): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000240)='tcp 2', 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0) write(r1, 0x0, 0x0) 2m34.641238408s ago: executing program 5 (id=1603): r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000000030020f003176c400000000001090224725100000000090400001207010300090501020000000000090582020002"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000100)=ANY=[], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r2, 0x60b, 0x0) 2m32.155465185s ago: executing program 5 (id=1636): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x7f, @ipv4={'\x00', '\xff\xff', @multicast1}, 0xffffffff}, 0x20) listen(r0, 0x2) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e22, 0x7f, @ipv4={'\x00', '\xff\xff', @multicast1}, 0xffffffff}, 0x20) listen(r1, 0x2) 2m32.058501618s ago: executing program 5 (id=1638): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@updpolicy={0xc0, 0x19, 0xfd3649826d894c67, 0x0, 0x0, {{@in6=@mcast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x7fffffffffffffff, 0x0, 0x0, 0x2}}, [@XFRMA_IF_ID={0x8, 0x1f, 0x2}]}, 0xc0}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@newspdinfo={0x1c, 0x24, 0x21, 0x70bd2d, 0x0, 0x0, [@XFRMA_SPD_IPV6_HTHRESH={0x6}]}, 0x1c}}, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)={0x2, 0xd, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @private1}}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x4e22, @multicast1}}]}, 0x50}}, 0x0) sendmsg$nl_xfrm(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b800000014000100"], 0xb8}}, 0x987a3a9f32358a4c) 2m32.05449051s ago: executing program 5 (id=1639): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x8008662c, 0x0) 2m32.000068297s ago: executing program 5 (id=1640): r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) mknod$loop(&(0x7f00000002c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x100, 0x0) r1 = open(&(0x7f0000000100)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x11) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r1, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x6, 0xfffe}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r1, 0xa9525000) link(&(0x7f0000000600)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f00000004c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') close_range(r0, 0xffffffffffffffff, 0x0) 2m31.679516098s ago: executing program 5 (id=1644): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0) write(r1, &(0x7f0000000180)='-2 -3\n', 0x6) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f00000002c0)='1\n', 0x2) 2m27.293291792s ago: executing program 35 (id=1502): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = socket(0x2, 0x1, 0x0) bind(r0, &(0x7f0000000300), 0x10) listen(r0, 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000140)='3\n\x00', 0x2) 2m24.023538928s ago: executing program 36 (id=1542): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000240)='tcp 2', 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0) write(r1, 0x0, 0x0) 2m16.580512686s ago: executing program 37 (id=1644): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0) write(r1, &(0x7f0000000180)='-2 -3\n', 0x6) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f00000002c0)='1\n', 0x2) 2m2.203337721s ago: executing program 8 (id=1934): r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f00000006c0)={0x14, 0x0, &(0x7f0000000680)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000100)={0x0, 0x6, 0x3, &(0x7f0000000080)={0x2, "1a9c66bf2f615e4200000000e200"}}) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x40004) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4000080) syz_usb_control_io$uac1(r0, 0x0, 0x0) 2m0.414659944s ago: executing program 8 (id=1959): r0 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) mount$9p_unix(&(0x7f0000000240)='./file0\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x12d7498, 0x0) 1m59.760690361s ago: executing program 8 (id=1971): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB="0a00000004000000080000000a"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{r0}, &(0x7f0000000340), &(0x7f00000005c0)}, 0x20) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x6, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=@framed={{}, [@generic={0x61, 0x8, 0x1, 0x8}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0x1d, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r2}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x3}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc) 1m59.688758747s ago: executing program 8 (id=1973): mkdir(&(0x7f0000001a80)='./file0\x00', 0x1cb) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000200)='.\x00', 0x0, 0x8b7840, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x84000, 0x0) mkdir(&(0x7f0000000140)='./file0/../file0\x00', 0x190) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x200000000000, &(0x7f0000000100)='./file0/../file0\x00', 0x0, 0x6000, 0x0) 1m59.642717464s ago: executing program 8 (id=1974): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xfffffffffffffcc1, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="500000001000810400c51c000000000000000000", @ANYRES32=r2, @ANYBLOB="01000000000000002800128009000100766c616e000000001800028006000100000000000c0002000c0000000d00000008000500", @ANYRES64=r0], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r3, 0x0, 0x0, 0x4044014, &(0x7f0000000180)={0x11, 0x1, r2, 0x1, 0x12, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x35}}, 0x14) 1m59.139246892s ago: executing program 8 (id=1976): r0 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, 0x0, 0x0) setsockopt$SO_J1939_FILTER(r0, 0x6b, 0x1, &(0x7f00000009c0)=[{0x0, 0x1, {0x0, 0x0, 0x3}, {0x0, 0xf0, 0x1}, 0x2, 0x2}], 0x20) setns(0xc9, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x801, 0xfdff, 0x0, {0x0, 0x0, 0x0, 0x0, 0x14080, 0x10000}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) 1m58.748087849s ago: executing program 38 (id=1976): r0 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, 0x0, 0x0) setsockopt$SO_J1939_FILTER(r0, 0x6b, 0x1, &(0x7f00000009c0)=[{0x0, 0x1, {0x0, 0x0, 0x3}, {0x0, 0xf0, 0x1}, 0x2, 0x2}], 0x20) setns(0xc9, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x801, 0xfdff, 0x0, {0x0, 0x0, 0x0, 0x0, 0x14080, 0x10000}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) 1m8.427620306s ago: executing program 9 (id=2516): r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f00000000c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x2, 0x4, 0x404, 0x9}, 0x50) listen(r1, 0x0) connect$unix(r0, &(0x7f0000fce000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x37) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) accept(r1, &(0x7f0000000040)=@generic, &(0x7f0000000140)=0x80) 1m8.352201913s ago: executing program 9 (id=2517): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x2, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f00000001c0)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000180)=0x1, r1, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f00000002c0)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e23, 0xfffffffd, @empty, 0x5}, r1}}, 0x30) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r2, &(0x7f00000002c0)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000280)=0x1, r3, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, &(0x7f0000000180)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0xe, @empty, 0x2}, {0xa, 0x4e23, 0x7, @remote, 0x3}, r3, 0x7}}, 0x48) 1m8.260140189s ago: executing program 9 (id=2519): timer_create(0x2, 0x0, 0x0) mkdir(&(0x7f0000000640)='./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x12) chdir(&(0x7f0000001640)='./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') write(0xffffffffffffffff, 0x0, 0x0) timer_settime(0x0, 0x236bd4336e4642df, 0x0, 0x0) mkdir(&(0x7f0000001a80)='./file0\x00', 0x1cb) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) 1m8.100303567s ago: executing program 9 (id=2521): r0 = socket$alg(0x26, 0x5, 0x0) close(0x3) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000180)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000000)="b7f2288d3aaea2bc0000def1260a00"/32, 0x20) r2 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926", 0x20}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/99, 0x63}], 0x1}, 0x0) 1m8.059838981s ago: executing program 9 (id=2522): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000240), 0x40, 0x0) ioctl$RTC_PIE_ON(r0, 0x7005) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0xc, &(0x7f0000000040)={0x0, 0x51f2, 0xdb00, 0x10000008, 0x29}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) 1m7.927061984s ago: executing program 9 (id=2524): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/versions\x00', 0x1, 0x0) write(r0, &(0x7f00000001c0)='-2 -3\n', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='tcp 2049\n', 0x9) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x1, 0x0) write(r2, &(0x7f00000002c0)='0\n', 0x2) 52.399523191s ago: executing program 39 (id=2524): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/versions\x00', 0x1, 0x0) write(r0, &(0x7f00000001c0)='-2 -3\n', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='tcp 2049\n', 0x9) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x1, 0x0) write(r2, &(0x7f00000002c0)='0\n', 0x2) 45.79085497s ago: executing program 6 (id=2597): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(r1, 0x4068aea3, &(0x7f0000000000)={0xa8, 0x0, 0x3}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x200000, &(0x7f0000200000/0x200000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r2, 0xc040aed5, &(0x7f0000000200)={0x0, 0x210000}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x1, 0x0, 0x200000, &(0x7f0000200000/0x200000)=nil}) ioctl$KVM_CLEAR_DIRTY_LOG(r1, 0xc018aec0, &(0x7f00000001c0)={0x0, 0x200, 0x0, &(0x7f0000000400)=[0xffffffffffffffff, 0xffffffffffffffff, 0x100000003, 0xffffffffffffffff, 0x7fff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x8000, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x6, 0xffffffffffffffff, 0xffffffffffffffff, 0xfffffffffffff801, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x6000000000, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffdfffffffff, 0xffffffffffffffff, 0x4, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xfffffffffffffffb, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x10001, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xfffffffffffffffb, 0xffffffffffffffff, 0x2, 0x30f3, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffdffffffffe, 0xffffffffffffffff, 0xffffffffffffffff, 0xffbfffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xfffffffffffffff3, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xfffffffffffffffc, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0x3, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x8, 0xffffffffffffffff, 0xffffffffffffffff, 0x400, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}) 45.425431579s ago: executing program 6 (id=2600): connect$unix(0xffffffffffffffff, 0x0, 0x0) r0 = socket(0x1e, 0x5, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) listen(r0, 0x9) accept4$inet6(r0, 0x0, 0x0, 0x0) 44.101220377s ago: executing program 6 (id=2609): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x1c, 0x1, 0x4, 0x1, 0x0, 0x0, {0x2}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x1c}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r2, 0x0, 0x0, 0x0, &(0x7f0000000700)={0x2, 0x1234, @loopback}, 0x10) close_range(r0, 0xffffffffffffffff, 0x0) 43.910226412s ago: executing program 6 (id=2612): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x16f0d8, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101097, 0x0) mount$bind(&(0x7f0000000100)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x9a100a, 0x0) mount$bind(0x0, &(0x7f0000000180)='./file0/../file0\x00', 0x0, 0x80000, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') read$FUSE(r0, &(0x7f0000003480)={0x2020}, 0x2020) 43.665035081s ago: executing program 6 (id=2615): r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000240)={0x42, 0x1}, 0x10) write(r1, 0x0, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r1, 0x10f, 0x81, &(0x7f0000000040), 0x4) write$P9_RVERSION(r1, 0x0, 0x0) sendmsg$tipc(r1, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4004014}, 0x8020) 42.887596021s ago: executing program 6 (id=2621): socket$kcm(0x11, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000000), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="05"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000005c0)=ANY=[@ANYRES16=r0], 0x48}}, 0x40800) 42.443927067s ago: executing program 40 (id=2621): socket$kcm(0x11, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000000), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="05"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000005c0)=ANY=[@ANYRES16=r0], 0x48}}, 0x40800) 4.853271057s ago: executing program 3 (id=2930): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea80000000000109022400010000000009040000010300000009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000000c0)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB="ad5a97"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000000)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="200103"], 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000100)={0x2c, &(0x7f00000001c0)=ANY=[@ANYBLOB="ac184d"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000200)={0x1, 0x87, 0x5, &(0x7f00000000c0)={0x10, "8105d6c721100f00000000400000a8267d87000200"}}) 3.485265484s ago: executing program 4 (id=2963): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424d", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1d19cb307b3472ab9cdb042d2", "643fcbb2c5a57df67d074af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x5, 0x0, 0x0, 0x60ff78ce1cb3c070}, 0x94) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) clock_gettime(0x0, &(0x7f0000000240)) ppoll(&(0x7f0000000200)=[{r0, 0x50}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 2.687564554s ago: executing program 1 (id=2961): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @multicast1}, 0x10) setuid(0xee00) setsockopt$sock_int(r0, 0x1, 0x800000000f, &(0x7f0000000080)=0x7, 0x4) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) 2.68206481s ago: executing program 4 (id=2962): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') chdir(&(0x7f00000003c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x42, 0x0) 2.629509375s ago: executing program 1 (id=2964): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = gettid() wait4(0x0, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = fsopen(&(0x7f0000000000)='bfs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r1, 0x5, 0x0, 0x0, 0xffffffffffffffff) 2.507032705s ago: executing program 3 (id=2965): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000200)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d79706f00"/308) ioctl(r0, 0xc138fd09, &(0x7f0000000400)="0400000000000000000000008001000038010000010000000000000000000000000000000000000000000000000000006d79706f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000063616368650000000000000000000000313a3020313a3120313a32203634203020736d71203000"/372) ioctl(r0, 0xc138fd06, &(0x7f0000000200)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d79706f00"/308) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/dm-0\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)='\x00\x00\x00\x00', 0x4) 2.506747734s ago: executing program 4 (id=2966): r0 = open(&(0x7f0000000080)='./file1\x00', 0x66842, 0x90) r1 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r1}, &(0x7f0000000000)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r2, 0x1, &(0x7f0000000040), 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) pwritev2(r0, 0x0, 0x0, 0x7800, 0x0, 0x3) 2.454644757s ago: executing program 2 (id=2967): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000640), 0xc0000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r1, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, r2, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x334e8b}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000180)={0x48, 0x7, r2, 0x0, 0x10000, 0x0, 0x6, 0x455e9, 0x1f97e6}) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000240)={0x48, 0x7, r2, 0x0, 0x10000, 0x0, 0x8, 0x2ea473, 0x2eb80b, 0xf4}) 2.375411126s ago: executing program 2 (id=2968): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3, 0x204031, 0xffffffffffffffff, 0xfc778000) rseq(&(0x7f0000000040)={0x0, 0x0, 0x0, 0x5}, 0x20, 0x0, 0x0) r1 = timerfd_create(0x0, 0x0) read(r1, &(0x7f0000002180)=""/262, 0x106) 2.362995529s ago: executing program 4 (id=2969): r0 = landlock_create_ruleset(&(0x7f0000000080)={0xc0d8, 0x1, 0x3}, 0x18, 0x0) landlock_restrict_self(r0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeeb, 0x8031, 0xffffffffffffffff, 0xc36e5000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) connect$unix(r2, &(0x7f0000000040)=@file={0x0, './file0\x00'}, 0x6e) 2.338293789s ago: executing program 1 (id=2970): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x2001c0d4}, 0x20000810) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0xed) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=@newsa={0x138, 0x1a, 0x713, 0x0, 0x0, {{@in6=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x2}, {@in=@local, 0x0, 0x33}, @in=@dev, {0x0, 0x0, 0x0, 0x0, 0xb4, 0x0, 0x0, 0x20000000}, {0x0, 0x0, 0xffffffffffffffff}, {}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x60}, [@algo_auth={0x48, 0x1, {{'sha1\x00'}}}]}, 0x138}}, 0x0) 2.276783228s ago: executing program 3 (id=2972): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r0 = socket(0x2000000000000021, 0x2, 0x10000000000002) sendmmsg(r0, &(0x7f0000000180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, '$'}], 0x18, 0xe000}, 0x5}, {{0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[], 0x18, 0x500}}], 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), 0xffffffffffffffff) r3 = socket$l2tp(0x2, 0x2, 0x73) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="230900000000000000000100000005000700000000000800090000000000060002000100000008000a000000000008001700", @ANYRES32=r3], 0x3c}}, 0x0) close(r3) 2.132664029s ago: executing program 3 (id=2973): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1ff, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f0000000080)="c4417d290ddada01ca48b8a9884315c2c245040f23c00f21f835000002000f23f8c4a2e0f3db0f07d2c74424001e09000000442402e4000000654c0fc72ef3410fc777d365420fc7700066b8502466ef", 0x50}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r2, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x72, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 2.129864901s ago: executing program 1 (id=2974): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x40) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1fd) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) ioctl$BLKZEROOUT(r0, 0x127f, 0x0) r1 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) 1.509662563s ago: executing program 1 (id=2976): r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x1000, 0x240002, 0x1e8}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000180)={0x2e, 0x10, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@any_dev={0x4, 0x90f, 0x0, 0x0, 0x1000, 0x4, 0x0, 0x0, 0x1a4}}}, &(0x7f0000000280)=0x0) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="37031c00", 0x4, 0x4000800, 0x0, 0x47) syz_ublk_setup_queues(r0, r5, &(0x7f0000000200)={0x0, 0x14e1, 0x10, 0x3, 0x400b2}, &(0x7f00000005c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4481, 0x440d, 0x1, 0x31c, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9406, 0x1000, 0xfffffffe, 0x2000004, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x2, 0x1, 0x35a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf6ad, 0x1000, 0x1, 0x5b, 0x0, r0}}], 0x4, &(0x7f0000000540)={0x2e, 0x18, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x72ccfb459c83c565, {0x6}, 0x0, r4, '\x00', {0x3, 0xc8b, 0x0, 0x0}}, 0x0) socket$packet(0x11, 0x3, 0x300) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='fd=', @ANYRESOCT, @ANYBLOB, @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=0x0]) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) 1.505299582s ago: executing program 0 (id=2986): r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000440), 0x10) listen(r0, 0xff) r1 = socket$vsock_stream(0x28, 0x1, 0x0) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000000180)={0x2, 0x5}, 0x8) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x4, 0x4, 0x7fff0000}]}) close_range(r2, 0xffffffffffffffff, 0x0) 1.39558588s ago: executing program 0 (id=2977): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fd7000/0x18000)=nil, &(0x7f0000005700)=[@text32={0x20, 0x0}], 0x1, 0xc, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000003680)=@vmx={0x0, 0x0, 0x2080, {0x0, 0x8000000}}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000002c0)=[@text32={0x20, &(0x7f0000000040)="b91a080000bd0f01c8653e0fc7b90e0000000f7967ac66b808008ec066ba2000b02bee66baf80cb826f68189ef66bafc0cecc4c3f908954f4b00000066ba4300b000ee66b810000f00d8", 0x4a}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.205614255s ago: executing program 0 (id=2978): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) syz_clone(0x22000211, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0xa0402, 0x0) io_setup(0x3, &(0x7f0000002500)=0x0) io_submit(r2, 0x2, &(0x7f00000011c0)=[&(0x7f0000000140)={0x600, 0x0, 0x0, 0x0, 0x5, r1, &(0x7f00000000c0)=' ', 0x1, 0xe3}, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x1, 0x40, r1, 0x0, 0x0, 0x1}]) write(r0, &(0x7f0000000200)='2', 0x1) 1.20521724s ago: executing program 3 (id=2979): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000100)={0x6, {{0x2, 0x4e20, @multicast2}}}, 0x88) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000000)=0x100000b3, 0x4) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000000)=0x100000b3, 0x4) bind$inet(r1, &(0x7f0000000300)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x2e, &(0x7f00000000c0)={@random="c5a500429b3a", @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0xe, 0x20, 0x66, 0x0, 0x3, 0x11, 0x0, @empty, @empty=0xe0000001}, {0x4e1f, 0x4e20, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x6, 0x100, @void}}}}}}}, 0x0) 1.057943063s ago: executing program 2 (id=2980): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newtfilter={0x3c, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {0x0, 0xfff3}, {0x1}, {0x7, 0x1}}, [@filter_kind_options=@f_bpf={{0x8}, {0x10, 0x2, [@TCA_BPF_OPS={{0x6}, {0x4}}]}}]}, 0x3c}}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=ANY=[@ANYBLOB="4c00000010000104fcfffffffbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="431f07000b02000008000a00", @ANYRES32=r1, @ANYBLOB="080005", @ANYRES32=r1], 0x4c}, 0x1, 0x0, 0x0, 0x2004d808}, 0x240408d4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="e8000000190001002dbd7000fbdbdf2502202000ff02ff020018000008000100ac1414aac100098026"], 0xe8}, 0x1, 0x0, 0x0, 0x44050}, 0x1000) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x4000, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x20040040) 870.200228ms ago: executing program 2 (id=2981): r0 = landlock_create_ruleset(&(0x7f0000000040)={0x4000, 0x3}, 0x18, 0x0) landlock_restrict_self(r0, 0x0) socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(0xffffffffffffffff, 0x0, 0xc8, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4}, &(0x7f0000000000)) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000f, 0x204031, 0xffffffffffffffff, 0xec776000) mq_open(&(0x7f0000000480)='!sel\x00\x00\x00\x10\x00\x00\x00\x00\xd7\\P\xc1\xde.O\xcb]0y\x00\x00\x00\x00\x00\x00\x00\x00', 0x6e93ebbbcc0884f2, 0x196, 0x0) 869.463028ms ago: executing program 3 (id=2982): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0xff, 0x7, 0x7fc00002}]}) membarrier(0x10, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f00000003c0)) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000080)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) 716.290914ms ago: executing program 2 (id=2983): r0 = socket(0x1e, 0x4, 0x0) r1 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0xfffffffc, 0x2}, 0x10) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x3514}], 0x1}}], 0x400000000000181, 0x9200000000000000) r2 = dup3(r1, r0, 0x0) recvmmsg(r2, &(0x7f0000008840)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000480)=""/4096, 0x1000}], 0x1}, 0x1}], 0x1, 0x40000001, 0x0) read$FUSE(r2, 0x0, 0x0) 714.51315ms ago: executing program 0 (id=2994): getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x16, 0x10, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000001000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002008000850000008200000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r2, 0x0, 0x10, 0x38, &(0x7f00000006c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000700)=""/8, 0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 462.770128ms ago: executing program 0 (id=2984): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x0, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000002c0)="dc", 0x1}], 0x1}, 0x48043) r2 = dup(r0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) shutdown(r1, 0x1) write$binfmt_script(r2, &(0x7f0000000840)={'#! ', './file0', [], 0xa, "5775ebb77549afc496bc5cc558c52be63e203db628daa190b16cc7216b9bfb1b0bd22d03f5e1cd7a3da150be3434e1d6c83af706cea87fffe560d236a8c26a760289f80eaa398ae77b0d26197822dd25b01733bd602efae482eced2ed31ee6ce67c841c25dfefcd739990462ff3626423e0e3ba7a4d4a86469f8cf3ac3d81d4f63be7d17a6caf4a8b071298bc35fdea671ea0025460ccfed3040fe1945a0d089bba38204ca6631e158a7717cf420623fad22082e3ae1b8e38748772095513a3f5028fb76790ef01caab610421c1ae48ffd68b5aefd4f399b8d28edddd9dde0d8afa1fd2df0d8c6ebbcf9493daea96589ee90969516953c83d70124dc91b26e3287986fdc096eda61a819b88e28facf71a064600e69747ab08f0379afde05c2b558f6058e2ef5c3a36ab3171bd99960ebb980380b7f76f8fce6987cf5eafb1384cefd64e1d214b14cff8f9ae739db32fb1e54d01856a3b277c3f02aeebe7f58f0708f4487afe3674a0a412461a9de083979f9c380a9336893f77c19f740aed24764a0165a52fa2d8152bb55f49fe1c1a52977f9244fdf648ef55acdbaab7827a33e5c66592b97b2b4ccf4d642d75a23a0bf43cb9dd6d4156cc58636f4d68d0370d827d0c6a0b0a3fb818e36d6716a49ec3bac8da32f9a8bd74c499768a4c62822d018ef9f7982ddf15e655670f9cec0162460e4b9a83a5f1cfd99dcb5dfe680039d9b9ee28132545ce12ff1f32c6ecf9181688260da9d4d610567eacf0c399e85c974fc752333c7d0ac1ba8e0213f07884fc77b0ba82aa058e596f04b7d44b409cd4a1fab3b3c0d4217493196f62e2cf9e4d9834e7f966ca42b76100ef5f6fa89700a0b4661056849331fb583b3e9659711ae466c61507319b7d1638ffca5f9130ca7fdb86276ada534473b4d2c21859a825ba6e502d2f912e224f1fdb70a57c42e2185a45edac6e09c1c7446dc889dd8ba711ac687257b35a1b923a960be298b680106299cd3ac4e06cae9352bfdd0427e13ce759b48140df351c8f9ae8fb9acabb9c3346e23433c4875d45ac7836d990cd13d35ac48700e315d7e9b11ca587cb9a764af1fda1bb8c36f15d1d642252e26a5c9d9c33a16dca4584f864467ad20b97ddffc6fcbbaf71716aa07e9f0c99bee7e22fac55dcf54f99af981bd0217b72a4cf46ce46f165d512fd49ff4e3cea29a63e0354177bfe5433b25c3496461b39153b68cbc5af714bde4043909c4679aedd01875badbb6f74cadcf9488769ebe8e173c746225f3decccfed3d295d90b29444b27c2e5a72943eb03d254940a65398e63d78f9b41ef8a17c0c2bd8e9057619ff39dc47105189d0c70a32c535790e68fff9c9a9ef708576c51bcc8868f8a2842b82af5c0466a3cb1fc229e3fd4434e2956d206fc8ca66c8494567db7034e223a4dd1313d3b2399616307fd3ef27acf6732a69cc5f"}, 0xffe0) 310.316487ms ago: executing program 1 (id=2985): r0 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) truncate(&(0x7f0000000180)='./file0\x00', 0x8fff5) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f0000000280)=[0x8000, 0x8], 0x0, 0x0, 0x2, 0x1}}, 0x40) mmap(&(0x7f00001f8000/0x4000)=nil, 0x4000, 0x0, 0x12012, r1, 0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x12, r3, 0xfffff000) 252.356455ms ago: executing program 4 (id=2987): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000140)='.\x00', &(0x7f0000000280)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 207.127259ms ago: executing program 0 (id=2988): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01040000130000001300020000000900010073797a300000000058000000120a01040000000000000000020000000900010073797a30000000000900020073797a30000000000800030000000004240004800c00010000000000000000010c00020400000000000000010800040000000001"], 0xbc}, 0x1, 0x0, 0x0, 0x40000811}, 0x0) r1 = syz_usb_connect(0x2, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000400605014600010000000109022700010100a0320904000003ffffff00070581024000000705020240000007058303"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000001000)={0x84, &(0x7f0000001100)={0x0, 0x0, 0x1, "04"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000240)={0x84, &(0x7f0000000040)={0x0, 0xc, 0x7d, "0411fc5dbc730861538005fb631edcd7f902479af0f94713f0c9e6bd173c74a2e7abcf4fb187763ffe7c6e2afb7cf1effc2d8467753d1ec6e5b8a67014b60aa98d15954b55180f564ab4ba53c0c54cb4959d248fe46522f24a8204016b028a28d2a0a564da2fe8bc16e0deccfa5e2e11e2da3891f39699e3b81c8b2841"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 155.614592ms ago: executing program 2 (id=2989): r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x24020000) r2 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x24020000) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mount_setattr(r4, &(0x7f0000000100)='.\x00', 0x9000, &(0x7f0000001dc0)={0x5, 0x8a, 0x20000}, 0x20) 0s ago: executing program 4 (id=2990): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x748, 0x4) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) setsockopt$inet_int(r0, 0x0, 0xc, &(0x7f0000000040)=0xfffffffc, 0x4) setsockopt$inet_int(r0, 0x0, 0x12, &(0x7f0000000180)=0x101, 0x4) recvmmsg(r0, &(0x7f0000000340)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x45833af92e4b38ff, 0x0) kernel console output (not intermixed with test programs): :12822 ioctl c0306201 200000000040 returned -14 [ 281.263735][T12841] FAULT_INJECTION: forcing a failure. [ 281.263735][T12841] name failslab, interval 1, probability 0, space 0, times 0 [ 281.263770][T12841] CPU: 0 UID: 0 PID: 12841 Comm: syz.9.2354 Tainted: G L syzkaller #0 PREEMPT(full) [ 281.263797][T12841] Tainted: [L]=SOFTLOCKUP [ 281.263805][T12841] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 281.263816][T12841] Call Trace: [ 281.263823][T12841] [ 281.263831][T12841] dump_stack_lvl+0x100/0x190 [ 281.263868][T12841] should_fail_ex.cold+0x5/0xa [ 281.263897][T12841] should_failslab+0xc2/0x120 [ 281.263927][T12841] __kmalloc_cache_noprof+0x91/0x6d0 [ 281.263958][T12841] ? io_uring_alloc_task_context+0xa7/0x656 [ 281.263986][T12841] io_uring_alloc_task_context+0xa7/0x656 [ 281.264011][T12841] ? __pfx_io_uring_alloc_task_context+0x10/0x10 [ 281.264034][T12841] ? lock_acquire+0x1d1/0x380 [ 281.264055][T12841] ? __fget_files+0x34/0x3d0 [ 281.264083][T12841] __io_uring_add_tctx_node.cold+0x15/0x20a [ 281.264107][T12841] ? __pfx___io_uring_add_tctx_node+0x10/0x10 [ 281.264140][T12841] ? __fget_files+0x21f/0x3d0 [ 281.264168][T12841] __io_uring_add_tctx_node_from_submit+0x89/0x130 [ 281.264201][T12841] __do_sys_io_uring_enter+0x1626/0x1b10 [ 281.264228][T12841] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 281.264259][T12841] ? __pfx___do_sys_io_uring_enter+0x10/0x10 [ 281.264283][T12841] ? __x64_sys_futex+0x34f/0x4d0 [ 281.264307][T12841] ? __x64_sys_futex+0x358/0x4d0 [ 281.264334][T12841] ? fput+0x7c/0x100 [ 281.264357][T12841] ? __pfx___x64_sys_futex+0x10/0x10 [ 281.264382][T12841] ? ksys_write+0x1ac/0x250 [ 281.264402][T12841] ? __pfx_ksys_write+0x10/0x10 [ 281.264430][T12841] do_syscall_64+0x123/0x790 [ 281.264459][T12841] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 281.264479][T12841] RIP: 0033:0x7f043e19e159 [ 281.264496][T12841] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 281.264515][T12841] RSP: 002b:00007f043f021028 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 281.264536][T12841] RAX: ffffffffffffffda RBX: 00007f043e426090 RCX: 00007f043e19e159 [ 281.264549][T12841] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 0000000000000003 [ 281.264560][T12841] RBP: 00007f043e23506b R08: 0000000000000000 R09: 0000000000000000 [ 281.264572][T12841] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 281.264583][T12841] R13: 00007f043e426128 R14: 00007f043e426090 R15: 00007fffe17425e8 [ 281.264611][T12841] [ 281.437535][ T190] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 281.539909][T12848] fuse: Bad value for 'fd' [ 281.587064][ T190] usb 5-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice= 0.00 [ 281.587913][ T190] usb 5-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 281.587980][ T190] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 281.648973][ T190] snd-ua101 5-1:1.0: probe with driver snd-ua101 failed with error -2 [ 281.763164][ T30] audit: type=1400 audit(1789673714.214:3676): avc: denied { create } for pid=12857 comm="syz.0.2362" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 281.764868][ T30] audit: type=1400 audit(1789673714.214:3677): avc: denied { write } for pid=12857 comm="syz.0.2362" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 281.842002][ T2308] usb 5-1: USB disconnect, device number 11 [ 282.103620][T12866] grow_buffers: requested out-of-range block 18446744073709551615 for device sda1 [ 282.103647][T12866] EXT4-fs warning (device sda1): ext4_resize_fs:2018: can't read last block, resize aborted [ 282.437975][T12879] fuse: fd is not a fuse device [ 282.516942][ T30] audit: type=1400 audit(1789673714.974:3678): avc: denied { remount } for pid=12880 comm="syz.4.2373" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 282.589603][T12890] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2376'. [ 282.670563][T12893] lo speed is unknown, defaulting to 1000 [ 282.670634][T12893] lo speed is unknown, defaulting to 1000 [ 282.688029][T12893] lo speed is unknown, defaulting to 1000 [ 282.691374][T12893] smbdirect: ib_dev[syz_device_name_32_chars_1234567]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 282.691414][T12893] smbdirect: ib_dev[syz_device_name_32_chars_1234567]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 282.691456][T12893] smbdirect: ib_dev[syz_device_name_32_chars_1234567]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 282.759766][T12893] infiniband syz_device_name_32_chars_1234567: RDMA CMA: cma_listen_on_dev, error -22 [ 282.902991][ T30] audit: type=1400 audit(1789673715.354:3679): avc: denied { map } for pid=12900 comm="syz.4.2382" path="socket:[44173]" dev="sockfs" ino=44173 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 282.925927][T12893] lo speed is unknown, defaulting to 1000 [ 282.929926][T12893] lo speed is unknown, defaulting to 1000 [ 282.932552][T12893] lo speed is unknown, defaulting to 1000 [ 282.934024][T12893] lo speed is unknown, defaulting to 1000 [ 282.936258][T12893] lo speed is unknown, defaulting to 1000 [ 282.937599][T12893] lo speed is unknown, defaulting to 1000 [ 282.938873][T12893] lo speed is unknown, defaulting to 1000 [ 282.940195][T12893] lo speed is unknown, defaulting to 1000 [ 282.941435][T12893] lo speed is unknown, defaulting to 1000 [ 283.106463][ T2308] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 283.198143][ T30] audit: type=1400 audit(1789673715.654:3680): avc: denied { create } for pid=12917 comm="syz.4.2388" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 283.229502][ T30] audit: type=1400 audit(1789673715.684:3681): avc: denied { listen } for pid=12917 comm="syz.4.2388" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 283.232275][ T30] audit: type=1400 audit(1789673715.684:3682): avc: denied { accept } for pid=12917 comm="syz.4.2388" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 283.256038][ T2308] usb 4-1: Using ep0 maxpacket: 32 [ 283.256515][ T2308] usb 4-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 283.257384][ T2308] usb 4-1: config index 0 descriptor too short (expected 35577, got 27) [ 283.257408][ T2308] usb 4-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 283.257425][ T2308] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 283.257442][ T2308] usb 4-1: config 1 has no interface number 0 [ 283.257472][ T2308] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 283.257495][ T2308] usb 4-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 283.257535][ T2308] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 283.339883][ T2308] snd_usb_pod 4-1:1.1: Line 6 Pocket POD found [ 283.345343][ T190] usb 10-1: new high-speed USB device number 9 using dummy_hcd [ 283.502525][ T2308] snd_usb_pod 4-1:1.1: Line 6 Pocket POD now attached [ 283.511392][ T190] usb 10-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 283.516006][ T190] usb 10-1: config 0 has no interfaces? [ 283.516039][ T190] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 283.527509][ T190] usb 10-1: config 0 descriptor?? [ 283.743001][T12911] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 283.744055][T12911] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 283.762882][ T190] usb 10-1: USB disconnect, device number 9 [ 283.855503][ C0] net_ratelimit: 43 callbacks suppressed [ 283.855525][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 283.855622][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 283.856533][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 283.899970][ T2308] usb 4-1: USB disconnect, device number 9 [ 283.901393][ T2308] snd_usb_pod 4-1:1.1: Line 6 Pocket POD now disconnected [ 283.927232][T12121] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 283.927308][T12121] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 284.188607][T12936] syz_tun: entered allmulticast mode [ 284.205527][ T10] usb 10-1: new high-speed USB device number 10 using dummy_hcd [ 284.243349][T12939] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 284.243449][T12939] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 284.243550][T12939] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 284.356023][ T10] usb 10-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice= 0.00 [ 284.356841][ T10] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 284.358019][ T10] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 284.358036][ T10] usb 10-1: Product: syz [ 284.358051][ T10] usb 10-1: Manufacturer: syz [ 284.490705][ T30] audit: type=1400 audit(1789673716.944:3683): avc: denied { map } for pid=12944 comm="syz.4.2399" path="socket:[43789]" dev="sockfs" ino=43789 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 284.582134][ T30] audit: type=1400 audit(1789673717.034:3684): avc: denied { listen } for pid=12952 comm="syz.2.2401" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 284.655601][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 284.799296][ T10] usb 10-1: cannot create comm data receiver. [ 284.826129][ T10] snd-usb-6fire 10-1:1.0: probe with driver snd-usb-6fire failed with error -2 [ 284.895612][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 284.927634][T12958] netlink: 'syz.3.2403': attribute type 5 has an invalid length. [ 284.967322][ T190] usb 10-1: USB disconnect, device number 10 [ 285.181476][T12965] fuse: fd is not a fuse device [ 285.612896][T12981] netlink: 'syz.9.2413': attribute type 1 has an invalid length. [ 285.612916][T12981] netlink: 224 bytes leftover after parsing attributes in process `syz.9.2413'. [ 285.638924][T12979] binder: 12978:12979 ioctl c0306201 200000000040 returned -11 [ 285.643748][T12979] binder: 12978:12979 ioctl c0306201 2000000001c0 returned -14 [ 288.110951][ T30] audit: type=1400 audit(1789673720.564:3685): avc: denied { getattr } for pid=13036 comm="syz.3.2433" lport=55566 faddr=::ffff:100.1.1.0 fport=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 288.264765][T13043] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2435'. [ 288.306379][T13045] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2436'. [ 288.678026][T13056] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2439'. [ 288.807544][ T30] audit: type=1400 audit(1789673721.264:3686): avc: denied { bind } for pid=13061 comm="syz.3.2443" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 288.807862][ T30] audit: type=1400 audit(1789673721.264:3687): avc: denied { setopt } for pid=13061 comm="syz.3.2443" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 288.808795][ T30] audit: type=1400 audit(1789673721.264:3688): avc: denied { write } for pid=13061 comm="syz.3.2443" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 288.882782][T13063] l2tp_ppp: sess 2/0: no socket in recv [ 288.916534][T13066] lo: entered allmulticast mode [ 288.924812][T13066] net_ratelimit: 26 callbacks suppressed [ 288.924831][T13066] mroute: pending queue full, dropping entries [ 288.942697][T13065] lo: left allmulticast mode [ 289.065330][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 289.065430][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 289.066691][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 289.422632][T13083] FAULT_FLAG_ALLOW_RETRY missing 801 [ 289.422656][T13083] CPU: 0 UID: 0 PID: 13083 Comm: syz.9.2450 Tainted: G L syzkaller #0 PREEMPT(full) [ 289.422687][T13083] Tainted: [L]=SOFTLOCKUP [ 289.422695][T13083] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 289.422708][T13083] Call Trace: [ 289.422715][T13083] [ 289.422729][T13083] dump_stack_lvl+0x100/0x190 [ 289.422764][T13083] handle_userfault.cold+0x38/0x65 [ 289.422794][T13083] ? do_raw_spin_unlock+0x145/0x1e0 [ 289.422821][T13083] ? _raw_spin_unlock+0x28/0x50 [ 289.422844][T13083] ? __free_frozen_pages+0x751/0x10f0 [ 289.422873][T13083] ? __pfx_handle_userfault+0x10/0x10 [ 289.422904][T13083] ? rcu_read_unlock+0x2d/0xb0 [ 289.422933][T13083] ? rcu_read_unlock+0x2d/0xb0 [ 289.422969][T13083] do_anonymous_page+0x186d/0x2050 [ 289.423005][T13083] ? __pfx_do_anonymous_page+0x10/0x10 [ 289.423031][T13083] ? rcu_read_unlock+0x2d/0xb0 [ 289.423059][T13083] ? rcu_read_unlock+0x2d/0xb0 [ 289.423088][T13083] ? __pte_offset_map+0x179/0x310 [ 289.423114][T13083] __handle_mm_fault+0x1ff3/0x2f60 [ 289.423147][T13083] ? __pfx___handle_mm_fault+0x10/0x10 [ 289.423175][T13083] ? pte_offset_map_lock+0x174/0x320 [ 289.423198][T13083] ? find_held_lock+0x2b/0x80 [ 289.423223][T13083] ? find_held_lock+0x2b/0x80 [ 289.423248][T13083] ? follow_page_pte+0x536/0x1050 [ 289.423285][T13083] handle_mm_fault+0x363/0xa20 [ 289.423319][T13083] __get_user_pages+0x8ae/0x2c30 [ 289.423352][T13083] ? __pfx___get_user_pages+0x10/0x10 [ 289.423384][T13083] populate_vma_page_range+0x267/0x3f0 [ 289.423409][T13083] ? __pfx_populate_vma_page_range+0x10/0x10 [ 289.423432][T13083] ? __pfx___vma_start_write+0x10/0x10 [ 289.423467][T13083] mprotect_fixup+0x925/0xe00 [ 289.423501][T13083] ? __pfx_mprotect_fixup+0x10/0x10 [ 289.423553][T13083] do_mprotect_pkey+0xa51/0xdd0 [ 289.423588][T13083] ? __pfx_do_mprotect_pkey+0x10/0x10 [ 289.423650][T13083] __x64_sys_mprotect+0x78/0xc0 [ 289.423677][T13083] ? lockdep_hardirqs_on+0x7d/0x110 [ 289.423702][T13083] do_syscall_64+0x123/0x790 [ 289.423737][T13083] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 289.423758][T13083] RIP: 0033:0x7f043e19e159 [ 289.423775][T13083] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 289.423795][T13083] RSP: 002b:00007f043f021028 EFLAGS: 00000246 ORIG_RAX: 000000000000000a [ 289.423817][T13083] RAX: ffffffffffffffda RBX: 00007f043e426090 RCX: 00007f043e19e159 [ 289.423831][T13083] RDX: 000000000000000a RSI: 0000000000c00000 RDI: 0000200000400000 [ 289.423843][T13083] RBP: 00007f043e23506b R08: 0000000000000000 R09: 0000000000000000 [ 289.423855][T13083] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 289.423868][T13083] R13: 00007f043e426128 R14: 00007f043e426090 R15: 00007fffe17425e8 [ 289.423897][T13083] [ 289.540756][T12134] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 289.540813][T12134] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 289.934289][T13090] bridge0: port 3(syz_tun) entered blocking state [ 289.934387][T13090] bridge0: port 3(syz_tun) entered disabled state [ 289.952830][T13090] syz_tun: entered allmulticast mode [ 289.953761][T13090] syz_tun: entered promiscuous mode [ 289.954197][T13090] bridge0: port 3(syz_tun) entered blocking state [ 289.954252][T13090] bridge0: port 3(syz_tun) entered forwarding state [ 290.095307][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 290.095394][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 290.095855][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 290.649123][T12134] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 291.473089][T13117] jffs2: notice: (13117) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (1 unchecked, 1 orphan) and 2 of xref (0 dead, 1 orphan) found. [ 291.491929][ T30] audit: type=1400 audit(1789673723.934:3689): avc: denied { write } for pid=13116 comm="syz.9.2463" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 291.505291][ T30] audit: type=1400 audit(1789673723.944:3690): avc: denied { append } for pid=13116 comm="syz.9.2463" path="/135/file0/memory.events.local" dev="jffs2" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 291.505342][ T30] audit: type=1400 audit(1789673723.944:3691): avc: denied { map } for pid=13116 comm="syz.9.2463" path="/135/file0/memory.events.local" dev="jffs2" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 292.144309][T13128] syzkaller1: entered promiscuous mode [ 292.144330][T13128] syzkaller1: entered allmulticast mode [ 292.203646][T13132] lo: entered allmulticast mode [ 292.220970][T13130] lo: left allmulticast mode [ 292.408863][T13138] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2472'. [ 293.221159][T13169] FAULT_INJECTION: forcing a failure. [ 293.221159][T13169] name failslab, interval 1, probability 0, space 0, times 0 [ 293.221194][T13169] CPU: 1 UID: 0 PID: 13169 Comm: syz.4.2481 Tainted: G L syzkaller #0 PREEMPT(full) [ 293.221221][T13169] Tainted: [L]=SOFTLOCKUP [ 293.221228][T13169] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 293.221240][T13169] Call Trace: [ 293.221249][T13169] [ 293.221257][T13169] dump_stack_lvl+0x100/0x190 [ 293.221289][T13169] should_fail_ex.cold+0x5/0xa [ 293.221319][T13169] should_failslab+0xc2/0x120 [ 293.221344][T13169] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 293.221367][T13169] ? __alloc_skb+0x140/0x710 [ 293.221395][T13169] __alloc_skb+0x140/0x710 [ 293.221414][T13169] ? __alloc_skb+0x5b7/0x710 [ 293.221435][T13169] ? __pfx___alloc_skb+0x10/0x10 [ 293.221455][T13169] ? __lock_acquire+0x5c0/0x1f40 [ 293.221482][T13169] tcf_action_add+0x230/0x5c0 [ 293.221524][T13169] ? __pfx_tcf_action_add+0x10/0x10 [ 293.221588][T13169] ? __nla_parse+0x40/0x60 [ 293.221621][T13169] tc_ctl_action+0x2e3/0x470 [ 293.221648][T13169] ? __pfx_tc_ctl_action+0x10/0x10 [ 293.221683][T13169] ? __pfx_tc_ctl_action+0x10/0x10 [ 293.221708][T13169] rtnetlink_rcv_msg+0x3c9/0xe90 [ 293.221737][T13169] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 293.221769][T13169] ? ref_tracker_free+0x37e/0x6c0 [ 293.221798][T13169] netlink_rcv_skb+0x159/0x420 [ 293.221820][T13169] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 293.221847][T13169] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 293.221878][T13169] ? netlink_deliver_tap+0x1ae/0xcc0 [ 293.221904][T13169] netlink_unicast+0x585/0x850 [ 293.221930][T13169] ? __pfx_netlink_unicast+0x10/0x10 [ 293.221958][T13169] netlink_sendmsg+0x8b0/0xda0 [ 293.221985][T13169] ? __pfx_netlink_sendmsg+0x10/0x10 [ 293.222009][T13169] ? selinux_socket_sendmsg+0x198/0x2f0 [ 293.222034][T13169] ____sys_sendmsg+0xa4d/0xbe0 [ 293.222060][T13169] ? __pfx_netlink_sendmsg+0x10/0x10 [ 293.222083][T13169] ? __pfx_____sys_sendmsg+0x10/0x10 [ 293.222129][T13169] ___sys_sendmsg+0x190/0x1e0 [ 293.222161][T13169] ? __pfx____sys_sendmsg+0x10/0x10 [ 293.222191][T13169] ? futex_wait+0x11e/0x370 [ 293.222220][T13169] ? find_held_lock+0x2b/0x80 [ 293.222263][T13169] __sys_sendmsg+0x160/0x210 [ 293.222287][T13169] ? __pfx___sys_sendmsg+0x10/0x10 [ 293.222325][T13169] do_syscall_64+0x123/0x790 [ 293.222355][T13169] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 293.222376][T13169] RIP: 0033:0x7f054539e159 [ 293.222392][T13169] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 293.222410][T13169] RSP: 002b:00007f054622d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 293.222429][T13169] RAX: ffffffffffffffda RBX: 00007f0545625fa0 RCX: 00007f054539e159 [ 293.222442][T13169] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000005 [ 293.222453][T13169] RBP: 00007f054543506b R08: 0000000000000000 R09: 0000000000000000 [ 293.222464][T13169] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 293.222475][T13169] R13: 00007f0545626038 R14: 00007f0545625fa0 R15: 00007ffd5c115818 [ 293.222502][T13169] [ 293.658300][T13171] syzkaller0: entered promiscuous mode [ 293.805258][ T2308] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 293.955278][ T2308] usb 5-1: Using ep0 maxpacket: 16 [ 293.961031][ T2308] usb 5-1: New USB device found, idVendor=258a, idProduct=6a88, bcdDevice= 0.00 [ 293.962228][ T2308] usb 5-1: config 0 interface 0 has no altsetting 0 [ 293.962261][ T2308] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 293.997236][ T2308] usb 5-1: config 0 descriptor?? [ 294.006171][T12117] net_ratelimit: 20 callbacks suppressed [ 294.006186][T12117] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 294.006227][T12117] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 294.260427][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 294.260499][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 294.260986][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 294.457268][ T2308] input: HID 258a:6a88 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:258A:6A88.000D/input/input24 [ 294.547261][ T2308] itetech 0003:258A:6A88.000D: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 258a:6a88] on usb-dummy_hcd.4-1/input0 [ 295.055098][ T190] usb 5-1: USB disconnect, device number 12 [ 295.124738][T12117] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 295.124803][T12117] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 295.305081][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 295.305208][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 295.305701][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 296.770835][T13233] xt_hashlimit: size too large, truncated to 1048576 [ 296.823744][T13235] netlink: 256 bytes leftover after parsing attributes in process `syz.9.2506'. [ 296.823992][T13235] unsupported nlmsg_type 40 [ 298.344868][ T5609] Bluetooth: hci5: Invalid handle: 0xed88 > 0x0eff [ 298.412962][T13259] batman_adv: batadv0: Adding interface: syzkaller0 [ 298.412975][T13259] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 298.412992][T13259] batman_adv: batadv0: Interface activated: syzkaller0 [ 298.493118][T13257] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 298.588206][T13257] batman_adv: batadv0: Removing interface: syzkaller0 [ 298.804861][T13276] syzkaller0: entered promiscuous mode [ 298.804888][T13276] syzkaller0: entered allmulticast mode [ 299.466485][ C0] net_ratelimit: 18 callbacks suppressed [ 299.466506][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 299.466561][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 299.467244][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 299.637585][ T42] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 299.637640][ T42] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 299.691549][T13291] fuse: fd is not a fuse device [ 299.841671][ T30] audit: type=1400 audit(1789673732.294:3692): avc: denied { bind } for pid=13293 comm="syz.0.2529" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 299.841953][ T30] audit: type=1400 audit(1789673732.294:3693): avc: denied { name_bind } for pid=13293 comm="syz.0.2529" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 299.842180][ T30] audit: type=1400 audit(1789673732.294:3694): avc: denied { node_bind } for pid=13293 comm="syz.0.2529" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 300.495509][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 300.495590][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 300.497981][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 300.740091][ T190] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 300.766852][T12117] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 302.212642][T13331] FAULT_INJECTION: forcing a failure. [ 302.212642][T13331] name failslab, interval 1, probability 0, space 0, times 0 [ 302.212680][T13331] CPU: 0 UID: 0 PID: 13331 Comm: syz.4.2542 Tainted: G L syzkaller #0 PREEMPT(full) [ 302.212710][T13331] Tainted: [L]=SOFTLOCKUP [ 302.212717][T13331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 302.212730][T13331] Call Trace: [ 302.212736][T13331] [ 302.212744][T13331] dump_stack_lvl+0x100/0x190 [ 302.212779][T13331] should_fail_ex.cold+0x5/0xa [ 302.212808][T13331] should_failslab+0xc2/0x120 [ 302.212833][T13331] __kmalloc_cache_noprof+0x91/0x6d0 [ 302.212863][T13331] ? nf_flow_offload_xdp_setup+0x5fc/0x9a0 [ 302.212892][T13331] nf_flow_offload_xdp_setup+0x5fc/0x9a0 [ 302.212914][T13331] ? kasan_save_track+0x14/0x30 [ 302.212939][T13331] nf_flow_table_offload_setup+0x4ac/0x6b0 [ 302.212959][T13331] ? ____sys_sendmsg+0xa4d/0xbe0 [ 302.212988][T13331] ? ___sys_sendmsg+0x190/0x1e0 [ 302.213019][T13331] ? __sys_sendmsg+0x160/0x210 [ 302.213040][T13331] ? __pfx_nf_flow_table_offload_setup+0x10/0x10 [ 302.213084][T13331] ? __pfx_nf_flow_table_offload_setup+0x10/0x10 [ 302.213105][T13331] nft_register_flowtable_ops+0x9c/0x1a0 [ 302.213140][T13331] nft_register_flowtable_net_hooks+0x348/0x7e0 [ 302.213174][T13331] nf_tables_newflowtable+0x1ee4/0x2830 [ 302.213211][T13331] ? __pfx_nf_tables_newflowtable+0x10/0x10 [ 302.213243][T13331] ? __pfx___nla_validate_parse+0x10/0x10 [ 302.213276][T13331] ? lock_acquire+0x1d1/0x380 [ 302.213297][T13331] ? net_generic+0x25/0x2a0 [ 302.213328][T13331] ? __nla_parse+0x40/0x60 [ 302.213360][T13331] nfnetlink_rcv_batch+0x1410/0x2880 [ 302.213401][T13331] ? __pfx_nfnetlink_rcv_batch+0x10/0x10 [ 302.213433][T13331] ? lock_acquire+0x1d1/0x380 [ 302.213453][T13331] ? avc_has_perm_noaudit+0x56/0x3b0 [ 302.213491][T13331] ? avc_has_perm_noaudit+0x145/0x3b0 [ 302.213545][T13331] ? __nla_parse+0x40/0x60 [ 302.213576][T13331] nfnetlink_rcv+0x3bd/0x440 [ 302.213609][T13331] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 302.213643][T13331] netlink_unicast+0x585/0x850 [ 302.213669][T13331] ? __pfx_netlink_unicast+0x10/0x10 [ 302.213699][T13331] netlink_sendmsg+0x8b0/0xda0 [ 302.213726][T13331] ? __pfx_netlink_sendmsg+0x10/0x10 [ 302.213749][T13331] ? selinux_socket_sendmsg+0x198/0x2f0 [ 302.213774][T13331] ____sys_sendmsg+0xa4d/0xbe0 [ 302.213800][T13331] ? __pfx_netlink_sendmsg+0x10/0x10 [ 302.213822][T13331] ? __pfx_____sys_sendmsg+0x10/0x10 [ 302.213867][T13331] ___sys_sendmsg+0x190/0x1e0 [ 302.213898][T13331] ? __pfx____sys_sendmsg+0x10/0x10 [ 302.213928][T13331] ? futex_wait+0x11e/0x370 [ 302.213957][T13331] ? find_held_lock+0x2b/0x80 [ 302.214002][T13331] __sys_sendmsg+0x160/0x210 [ 302.214027][T13331] ? __pfx___sys_sendmsg+0x10/0x10 [ 302.214066][T13331] do_syscall_64+0x123/0x790 [ 302.214096][T13331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 302.214116][T13331] RIP: 0033:0x7f054539e159 [ 302.214134][T13331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 302.214152][T13331] RSP: 002b:00007f054622d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 302.214172][T13331] RAX: ffffffffffffffda RBX: 00007f0545625fa0 RCX: 00007f054539e159 [ 302.214185][T13331] RDX: 0000000000000080 RSI: 0000200000000c40 RDI: 0000000000000004 [ 302.214198][T13331] RBP: 00007f054543506b R08: 0000000000000000 R09: 0000000000000000 [ 302.214209][T13331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 302.214220][T13331] R13: 00007f0545626038 R14: 00007f0545625fa0 R15: 00007ffd5c115818 [ 302.214248][T13331] [ 303.815348][ T5724] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 303.966508][ T5724] usb 5-1: Using ep0 maxpacket: 8 [ 303.972369][ T5724] usb 5-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 303.973332][ T5724] usb 5-1: config 0 has an invalid interface number: 143 but max is 0 [ 303.973357][ T5724] usb 5-1: config 0 has no interface number 0 [ 303.973394][ T5724] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 303.977604][ T5724] usb 5-1: config 0 descriptor?? [ 304.100035][ T5724] viperboard 5-1:0.143: version 0.00 found at bus 005 address 013 [ 304.151682][ T5724] viperboard-i2c viperboard-i2c.2.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 304.151716][ T5724] viperboard-i2c viperboard-i2c.2.auto: probe with driver viperboard-i2c failed with error -5 [ 304.267106][ T5724] usb 5-1: USB disconnect, device number 13 [ 304.655324][ C0] net_ratelimit: 18 callbacks suppressed [ 304.655344][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 304.655404][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 304.655965][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 305.135594][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 305.135937][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 305.136239][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 305.193080][T12130] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 305.193139][T12130] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 305.552276][T13381] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2562'. [ 305.705505][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 305.705574][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 309.855437][ C0] net_ratelimit: 20 callbacks suppressed [ 309.855453][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 309.855488][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 309.856029][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 310.335967][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 310.336052][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 310.337052][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 310.775643][T12130] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 310.775701][T12130] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 310.895527][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 310.895598][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 311.619563][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 314.482213][ T5611] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 314.488661][ T5611] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 314.518681][ T5611] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 314.522926][ T5611] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 314.523376][ T5611] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 314.635260][ T44] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 314.785794][ T44] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 314.786678][ T44] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 314.786718][ T44] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 314.790072][ T44] usb 5-1: config 0 descriptor?? [ 314.903177][T13394] lo speed is unknown, defaulting to 1000 [ 314.997088][ T44] usbhid 5-1:0.0: can't add hid device: -71 [ 314.997144][ T44] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 315.000822][ T44] usb 5-1: USB disconnect, device number 14 [ 315.055311][ C0] net_ratelimit: 19 callbacks suppressed [ 315.055332][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 315.055386][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 315.056079][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 315.152283][ T30] audit: type=1400 audit(1789673747.604:3695): avc: denied { read } for pid=13419 comm="syz.2.2572" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 315.248361][T12130] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 315.248422][T12130] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 315.300219][T13394] bridge0: port 1(bridge_slave_0) entered blocking state [ 315.300347][T13394] bridge0: port 1(bridge_slave_0) entered disabled state [ 315.300449][T13394] bridge_slave_0: entered allmulticast mode [ 315.301759][T13394] bridge_slave_0: entered promiscuous mode [ 315.304339][T13394] bridge0: port 2(bridge_slave_1) entered blocking state [ 315.304441][T13394] bridge0: port 2(bridge_slave_1) entered disabled state [ 315.304703][T13394] bridge_slave_1: entered allmulticast mode [ 315.306310][T13394] bridge_slave_1: entered promiscuous mode [ 315.333189][T13394] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 315.339754][T13394] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 315.373740][T13394] team0: Port device team_slave_0 added [ 315.380975][T13394] team0: Port device team_slave_1 added [ 315.409244][T13394] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 315.409260][T13394] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 315.409281][T13394] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 315.410688][T13394] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 315.410700][T13394] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 315.410720][T13394] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 315.448899][T13394] hsr_slave_0: entered promiscuous mode [ 315.450745][T13394] hsr_slave_1: entered promiscuous mode [ 315.454551][T13394] debugfs: 'hsr0' already exists in 'hsr' [ 315.464060][T13394] Cannot create hsr debugfs directory [ 315.468787][ T5695] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 315.678243][ T30] audit: type=1400 audit(1789673748.134:3696): avc: denied { search } for pid=13425 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 315.678550][ T30] audit: type=1400 audit(1789673748.134:3697): avc: denied { search } for pid=13425 comm="dhcpcd-run-hook" name="dhcpcd" dev="tmpfs" ino=1770 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 315.678586][ T30] audit: type=1400 audit(1789673748.134:3698): avc: denied { search } for pid=13425 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 315.678620][ T30] audit: type=1400 audit(1789673748.134:3699): avc: denied { search } for pid=13425 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 315.682697][ T30] audit: type=1400 audit(1789673748.134:3700): avc: denied { read } for pid=13426 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 315.683024][ T30] audit: type=1400 audit(1789673748.134:3701): avc: denied { read open } for pid=13426 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 315.683159][ T30] audit: type=1400 audit(1789673748.134:3702): avc: denied { getattr } for pid=13426 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1775 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 315.712948][ T5695] usb 5-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 315.809486][ T5695] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 315.809530][ T5695] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 315.898195][ T5695] usb 5-1: config 0 descriptor?? [ 316.017503][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 316.017846][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 316.018149][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 316.095745][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 316.095807][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 316.167535][ T30] audit: type=1400 audit(1789673748.624:3703): avc: denied { write } for pid=13425 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 316.167577][ T30] audit: type=1400 audit(1789673748.624:3704): avc: denied { add_name } for pid=13425 comm="dhcpcd-run-hook" name="resolv.conf.eth8.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 316.484474][T13394] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 316.489397][T13394] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 316.490258][T13394] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 316.501135][T13394] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 316.503716][T13394] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 316.515958][T13394] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 316.516909][T13394] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 316.527589][T13394] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 316.575761][ T5609] Bluetooth: hci8: command tx timeout [ 316.627190][T13394] 8021q: adding VLAN 0 to HW filter on device bond0 [ 316.648823][T13394] 8021q: adding VLAN 0 to HW filter on device team0 [ 316.653405][T12134] bridge0: port 1(bridge_slave_0) entered blocking state [ 316.653476][T12134] bridge0: port 1(bridge_slave_0) entered forwarding state [ 316.689227][T12134] bridge0: port 2(bridge_slave_1) entered blocking state [ 316.689318][T12134] bridge0: port 2(bridge_slave_1) entered forwarding state [ 316.710592][ T5695] aiptek 5-1:0.0: Aiptek using 400 ms programming speed [ 316.722990][ T5695] input: Aiptek as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input25 [ 317.072912][ T5788] usb 5-1: USB disconnect, device number 15 [ 317.073014][ C0] aiptek 5-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 317.308599][T13394] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 317.558398][T13394] veth0_vlan: entered promiscuous mode [ 317.569372][T13394] veth1_vlan: entered promiscuous mode [ 317.605111][T13394] veth0_macvtap: entered promiscuous mode [ 317.614020][T13394] veth1_macvtap: entered promiscuous mode [ 317.647638][T13394] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 317.651019][T13394] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 317.699847][ T42] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 317.708201][T12134] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 317.709068][T12121] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 317.709172][T12121] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 317.832559][ T4221] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 317.832581][ T4221] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 317.868684][T12117] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 317.868707][T12117] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 318.161554][T13518] x_tables: duplicate underflow at hook 2 [ 318.657988][ T5609] Bluetooth: hci8: command tx timeout [ 318.754115][T12130] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 319.191427][T13546] netlink: 'syz.2.2577': attribute type 12 has an invalid length. [ 319.261793][ T5611] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 319.274900][ T5611] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 319.283239][ T5611] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 319.300345][ T5611] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 319.300815][ T5611] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 319.468816][T13557] jffs2: notice: (13557) jffs2_build_xattr_subsystem: complete building xattr subsystem, 3 of xdatum (1 unchecked, 1 orphan) and 3 of xref (0 dead, 1 orphan) found. [ 319.544638][T12130] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 319.658495][T12130] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 319.813516][T12130] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 320.021790][T13577] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2581'. [ 320.021812][T13577] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2581'. [ 320.070451][T13549] lo speed is unknown, defaulting to 1000 [ 320.265294][ C0] net_ratelimit: 23 callbacks suppressed [ 320.265315][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 320.265360][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 320.265703][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 320.340152][ T30] kauditd_printk_skb: 15 callbacks suppressed [ 320.340170][ T30] audit: type=1400 audit(1789673752.794:3720): avc: denied { write } for pid=13561 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 320.620082][ T30] audit: type=1400 audit(1789673753.074:3721): avc: denied { write } for pid=13605 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 320.738251][ T5609] Bluetooth: hci8: command tx timeout [ 320.771932][T12130] bridge_slave_1: left allmulticast mode [ 320.771965][T12130] bridge_slave_1: left promiscuous mode [ 320.772131][T12130] bridge0: port 2(bridge_slave_1) entered disabled state [ 320.800988][T12130] bridge_slave_0: left allmulticast mode [ 320.801012][T12130] bridge_slave_0: left promiscuous mode [ 320.801180][T12130] bridge0: port 1(bridge_slave_0) entered disabled state [ 320.820976][ T4291] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 320.821030][ T4291] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 321.241837][T12130] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 321.255361][T12130] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 321.268851][T12130] bond0 (unregistering): Released all slaves [ 321.295343][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 321.295415][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 321.296050][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 321.375568][ T5609] Bluetooth: hci5: command tx timeout [ 321.927061][T12134] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 321.927120][T12134] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 321.995846][ T30] audit: type=1400 audit(1789673754.454:3722): avc: denied { ioctl } for pid=13644 comm="syz.4.2606" path="socket:[62131]" dev="sockfs" ino=62131 ioctlcmd=0x8905 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 322.372614][T12130] hsr_slave_0: left promiscuous mode [ 322.376895][T12130] hsr_slave_1: left promiscuous mode [ 322.377947][T12130] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 322.377961][T12130] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 322.389640][T12130] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 322.389660][T12130] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 322.517027][T12130] veth1_macvtap: left promiscuous mode [ 322.517078][T12130] veth0_macvtap: left promiscuous mode [ 322.517169][T12130] veth1_vlan: left promiscuous mode [ 322.517225][T12130] veth0_vlan: left promiscuous mode [ 322.539431][ T30] audit: type=1400 audit(1789673754.994:3723): avc: denied { write } for pid=13621 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 322.817570][ T5609] Bluetooth: hci8: command tx timeout [ 322.874123][ T30] audit: type=1400 audit(1789673755.324:3724): avc: denied { write } for pid=13672 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 323.105324][T13686] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2614'. [ 323.280968][T12130] team0 (unregistering): Port device team_slave_1 removed [ 323.298800][T12130] team0 (unregistering): Port device team_slave_0 removed [ 323.303452][ T30] audit: type=1400 audit(1789673755.754:3725): avc: denied { write } for pid=13680 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 323.411271][ T30] audit: type=1400 audit(1789673755.864:3726): avc: denied { write } for pid=13696 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 323.456367][ T5609] Bluetooth: hci5: command tx timeout [ 323.666415][T13690] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2614'. [ 323.759486][T13549] bridge0: port 1(bridge_slave_0) entered blocking state [ 323.759567][T13549] bridge0: port 1(bridge_slave_0) entered disabled state [ 323.759699][T13549] bridge_slave_0: entered allmulticast mode [ 323.766841][T13549] bridge_slave_0: entered promiscuous mode [ 323.799643][T13549] bridge0: port 2(bridge_slave_1) entered blocking state [ 323.799716][T13549] bridge0: port 2(bridge_slave_1) entered disabled state [ 323.799829][T13549] bridge_slave_1: entered allmulticast mode [ 323.815028][T13549] bridge_slave_1: entered promiscuous mode [ 323.978952][T13705] bridge0: port 3(syz_tun) entered blocking state [ 323.979028][T13705] bridge0: port 3(syz_tun) entered disabled state [ 323.990532][ T30] audit: type=1400 audit(1789673756.434:3727): avc: denied { write } for pid=13703 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 324.098825][ T30] audit: type=1400 audit(1789673756.534:3728): avc: denied { write } for pid=13726 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 324.108131][T13705] syz_tun: entered promiscuous mode [ 324.113775][T13705] bridge0: port 3(syz_tun) entered blocking state [ 324.113861][T13705] bridge0: port 3(syz_tun) entered forwarding state [ 324.311225][T13549] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 324.331294][T13549] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 324.421580][ T5611] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 324.450680][ T5611] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 324.454434][ T5611] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 324.467361][T13549] team0: Port device team_slave_0 added [ 324.470156][T13549] team0: Port device team_slave_1 added [ 324.485873][ T5611] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 324.486359][ T5611] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 324.629183][T13549] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 324.629201][T13549] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 324.629224][T13549] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 324.636071][T13549] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 324.636089][T13549] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 324.636110][T13549] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 324.847072][T13549] hsr_slave_0: entered promiscuous mode [ 324.850002][T13549] hsr_slave_1: entered promiscuous mode [ 324.850522][T13549] debugfs: 'hsr0' already exists in 'hsr' [ 324.850538][T13549] Cannot create hsr debugfs directory [ 324.994263][T13742] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2624'. [ 325.132290][ T30] audit: type=1400 audit(1789673757.584:3729): avc: denied { write } for pid=13731 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 325.310604][T13757] FAULT_INJECTION: forcing a failure. [ 325.310604][T13757] name failslab, interval 1, probability 0, space 0, times 0 [ 325.310641][T13757] CPU: 0 UID: 0 PID: 13757 Comm: syz.4.2626 Tainted: G L syzkaller #0 PREEMPT(full) [ 325.310672][T13757] Tainted: [L]=SOFTLOCKUP [ 325.310680][T13757] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 325.310692][T13757] Call Trace: [ 325.310700][T13757] [ 325.310709][T13757] dump_stack_lvl+0x100/0x190 [ 325.310744][T13757] should_fail_ex.cold+0x5/0xa [ 325.310774][T13757] should_failslab+0xc2/0x120 [ 325.310799][T13757] kmem_cache_alloc_noprof+0x92/0x6a0 [ 325.310822][T13757] ? __anon_vma_prepare+0x340/0x5e0 [ 325.310857][T13757] __anon_vma_prepare+0x340/0x5e0 [ 325.310885][T13757] ? __filemap_get_folio_mpol+0x369/0x1280 [ 325.310916][T13757] __vmf_anon_prepare+0x11f/0x250 [ 325.310942][T13757] hugetlb_no_page+0x14fa/0x1c20 [ 325.310975][T13757] ? do_raw_spin_unlock+0x145/0x1e0 [ 325.311000][T13757] ? _raw_spin_unlock+0x28/0x50 [ 325.311023][T13757] ? __pfx_hugetlb_no_page+0x10/0x10 [ 325.311054][T13757] ? huge_pte_alloc+0x39f/0x5a0 [ 325.311083][T13757] hugetlb_fault+0x5a7/0x1650 [ 325.311116][T13757] ? __pfx_mt_find+0x10/0x10 [ 325.311143][T13757] ? __pfx_hugetlb_fault+0x10/0x10 [ 325.311190][T13757] handle_mm_fault+0x604/0xa20 [ 325.311223][T13757] __get_user_pages+0x8ae/0x2c30 [ 325.311253][T13757] ? __pfx_mt_find+0x10/0x10 [ 325.311282][T13757] ? __pfx___get_user_pages+0x10/0x10 [ 325.311315][T13757] populate_vma_page_range+0x267/0x3f0 [ 325.311340][T13757] ? __pfx_populate_vma_page_range+0x10/0x10 [ 325.311363][T13757] ? __pfx_find_vma_intersection+0x10/0x10 [ 325.311393][T13757] __mm_populate+0x107/0x3a0 [ 325.311417][T13757] ? __pfx___mm_populate+0x10/0x10 [ 325.311444][T13757] ? up_write+0x2dc/0x5b0 [ 325.311470][T13757] vm_mmap_pgoff+0x441/0x470 [ 325.311495][T13757] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 325.311514][T13757] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 325.311562][T13757] ksys_mmap_pgoff+0x285/0x610 [ 325.311591][T13757] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 325.311615][T13757] ? xfd_validate_state+0x129/0x190 [ 325.311645][T13757] __x64_sys_mmap+0x125/0x190 [ 325.311671][T13757] do_syscall_64+0x123/0x790 [ 325.311696][T13757] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 325.311715][T13757] RIP: 0033:0x7f054539e159 [ 325.311733][T13757] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 325.311751][T13757] RSP: 002b:00007f054622d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 325.311770][T13757] RAX: ffffffffffffffda RBX: 00007f0545625fa0 RCX: 00007f054539e159 [ 325.311783][T13757] RDX: 0000000000000009 RSI: 0000000000800000 RDI: 000000000a000000 [ 325.311794][T13757] RBP: 00007f054543506b R08: ffffffffffffffff R09: 0000000000000000 [ 325.311807][T13757] R10: 000000000004c032 R11: 0000000000000246 R12: 0000000000000000 [ 325.311818][T13757] R13: 00007f0545626038 R14: 00007f0545625fa0 R15: 00007ffd5c115818 [ 325.311845][T13757] [ 325.458794][ C0] net_ratelimit: 19 callbacks suppressed [ 325.458815][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 325.458874][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 325.459410][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 325.535575][ T5611] Bluetooth: hci5: command tx timeout [ 325.536012][ T30] audit: type=1400 audit(1789673757.994:3730): avc: denied { write } for pid=13766 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 325.860233][ T42] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 326.127249][ T30] audit: type=1400 audit(1789673758.574:3731): avc: denied { write } for pid=13775 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 326.176474][ T42] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 326.277614][ T30] audit: type=1400 audit(1789673758.734:3732): avc: denied { write } for pid=13796 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 326.317606][ T42] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 326.325836][T13729] lo speed is unknown, defaulting to 1000 [ 326.375906][ T4291] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 326.375962][ T4291] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 326.457760][ T42] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 326.495326][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 326.495391][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 326.496170][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 326.575424][ T5611] Bluetooth: hci8: command tx timeout [ 326.850086][ T30] audit: type=1400 audit(1789673759.304:3733): avc: denied { write } for pid=13798 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 326.895837][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 326.896199][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 326.943052][ T42] bridge_slave_1: left allmulticast mode [ 326.943081][ T42] bridge_slave_1: left promiscuous mode [ 326.945951][ T42] bridge0: port 2(bridge_slave_1) entered disabled state [ 326.969794][ T42] bridge_slave_0: left allmulticast mode [ 326.969819][ T42] bridge_slave_0: left promiscuous mode [ 326.970005][ T42] bridge0: port 1(bridge_slave_0) entered disabled state [ 326.994614][ T30] audit: type=1400 audit(1789673759.424:3734): avc: denied { write } for pid=13813 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 327.154799][ T42] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 327.164561][ T42] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 327.170564][ T42] bond0 (unregistering): Released all slaves [ 327.311780][T13729] bridge0: port 1(bridge_slave_0) entered blocking state [ 327.311868][T13729] bridge0: port 1(bridge_slave_0) entered disabled state [ 327.311987][T13729] bridge_slave_0: entered allmulticast mode [ 327.314688][T13729] bridge_slave_0: entered promiscuous mode [ 327.319038][T13729] bridge0: port 2(bridge_slave_1) entered blocking state [ 327.319740][T13729] bridge0: port 2(bridge_slave_1) entered disabled state [ 327.319867][T13729] bridge_slave_1: entered allmulticast mode [ 327.321549][T13729] bridge_slave_1: entered promiscuous mode [ 327.414141][T13729] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 327.431044][T13729] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 327.509302][T13729] team0: Port device team_slave_0 added [ 327.513441][T13729] team0: Port device team_slave_1 added [ 327.537176][T13549] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 327.544017][T13549] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 327.547728][T13729] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 327.547741][T13729] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 327.547761][T13729] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 327.549310][T13549] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 327.560825][T13549] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 327.561663][T13729] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 327.561676][T13729] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 327.561698][T13729] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 327.598275][T13549] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 327.615799][ T5611] Bluetooth: hci5: command tx timeout [ 327.674673][T13549] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 327.695087][ T42] hsr_slave_0: left promiscuous mode [ 327.700825][ T42] hsr_slave_1: left promiscuous mode [ 327.701562][ T42] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 327.701580][ T42] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 327.702258][ T42] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 327.702273][ T42] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 327.736610][ T42] veth1_macvtap: left promiscuous mode [ 327.736644][ T42] veth0_macvtap: left promiscuous mode [ 327.736730][ T42] veth1_vlan: left promiscuous mode [ 327.736798][ T42] veth0_vlan: left promiscuous mode [ 327.789774][ T30] audit: type=1400 audit(1789673760.244:3735): avc: denied { write } for pid=13819 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 327.893458][ T30] audit: type=1400 audit(1789673760.344:3736): avc: denied { write } for pid=13830 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 328.003967][ T42] team0 (unregistering): Port device team_slave_1 removed [ 328.019519][ T42] team0 (unregistering): Port device team_slave_0 removed [ 328.084567][T13549] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 328.094056][T13549] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 328.106898][ T5271] 8021q: adding VLAN 0 to HW filter on device eth5 [ 328.135844][T13729] hsr_slave_0: entered promiscuous mode [ 328.136616][T13729] hsr_slave_1: entered promiscuous mode [ 328.137171][T13729] debugfs: 'hsr0' already exists in 'hsr' [ 328.137186][T13729] Cannot create hsr debugfs directory [ 328.453729][T13549] 8021q: adding VLAN 0 to HW filter on device bond0 [ 328.491841][T13549] 8021q: adding VLAN 0 to HW filter on device team0 [ 328.512993][T12134] bridge0: port 1(bridge_slave_0) entered blocking state [ 328.513072][T12134] bridge0: port 1(bridge_slave_0) entered forwarding state [ 328.572350][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 328.572429][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 328.655769][ T5611] Bluetooth: hci8: command tx timeout [ 328.699541][ T30] audit: type=1400 audit(1789673761.154:3737): avc: denied { write } for pid=13839 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 328.813521][ T30] audit: type=1400 audit(1789673761.264:3738): avc: denied { write } for pid=13853 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 328.910707][ T5271] 8021q: adding VLAN 0 to HW filter on device eth6 [ 329.195725][T13549] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 329.291141][T13549] veth0_vlan: entered promiscuous mode [ 329.317017][T13549] veth1_vlan: entered promiscuous mode [ 329.323897][ T30] audit: type=1400 audit(1789673761.774:3739): avc: denied { write } for pid=13861 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 329.372619][T13729] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 329.377289][T13729] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 329.379764][T13729] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 329.386326][T13729] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 329.386946][T13729] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 329.394026][T13729] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 329.399253][T13729] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 329.411301][T13729] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 329.424321][T13549] veth0_macvtap: entered promiscuous mode [ 329.452975][T13549] veth1_macvtap: entered promiscuous mode [ 329.484690][T13549] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 329.504822][T13549] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 329.593347][ T5271] 8021q: adding VLAN 0 to HW filter on device eth7 [ 329.607247][ T4221] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 329.607286][ T4221] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 329.607315][ T4221] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 329.615434][ T4221] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 329.653334][T13729] 8021q: adding VLAN 0 to HW filter on device bond0 [ 329.698633][T12134] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 329.698654][T12134] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 329.728626][T13729] 8021q: adding VLAN 0 to HW filter on device team0 [ 329.748209][T12134] bridge0: port 1(bridge_slave_0) entered blocking state [ 329.748307][T12134] bridge0: port 1(bridge_slave_0) entered forwarding state [ 329.771656][T12134] bridge0: port 2(bridge_slave_1) entered blocking state [ 329.771754][T12134] bridge0: port 2(bridge_slave_1) entered forwarding state [ 329.824167][T12134] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 329.824189][T12134] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 330.363039][ T5271] 8021q: adding VLAN 0 to HW filter on device eth8 [ 330.441980][T13729] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 330.494324][T13729] veth0_vlan: entered promiscuous mode [ 330.510633][T13729] veth1_vlan: entered promiscuous mode [ 330.538483][T13729] veth0_macvtap: entered promiscuous mode [ 330.542394][T13729] veth1_macvtap: entered promiscuous mode [ 330.556859][T13729] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 330.564020][T13729] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 330.596462][T12128] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 330.630607][ T4221] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 330.630646][ T4221] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 330.630672][ T4221] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 330.667111][ C0] net_ratelimit: 17 callbacks suppressed [ 330.667131][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 330.667180][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 330.667865][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 330.737014][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 330.737304][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 330.737544][ T5611] Bluetooth: hci8: command tx timeout [ 330.780315][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 330.780331][ T30] audit: type=1400 audit(1789673763.234:3745): avc: denied { write } for pid=13913 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 330.803785][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 330.803804][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 330.877391][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 330.877411][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 330.909852][ T4291] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 330.909912][ T4291] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 331.000942][ T30] audit: type=1400 audit(1789673763.454:3746): avc: denied { write } for pid=13925 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 331.463179][ T30] audit: type=1400 audit(1789673763.914:3747): avc: denied { write } for pid=13938 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 331.566797][ T30] audit: type=1400 audit(1789673764.024:3748): avc: denied { write } for pid=13958 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 331.698803][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 331.698864][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 331.700874][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 331.921429][ T30] audit: type=1400 audit(1789673764.364:3749): avc: denied { write } for pid=13960 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 332.046489][ T30] audit: type=1400 audit(1789673764.494:3750): avc: denied { write } for pid=13971 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 332.463636][ T30] audit: type=1400 audit(1789673764.914:3751): avc: denied { attach_queue } for pid=13981 comm="syz.4.2637" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 332.636206][T13997] FAULT_INJECTION: forcing a failure. [ 332.636206][T13997] name failslab, interval 1, probability 0, space 0, times 0 [ 332.636244][T13997] CPU: 0 UID: 0 PID: 13997 Comm: syz.1.2639 Tainted: G L syzkaller #0 PREEMPT(full) [ 332.636275][T13997] Tainted: [L]=SOFTLOCKUP [ 332.636283][T13997] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 332.636296][T13997] Call Trace: [ 332.636303][T13997] [ 332.636312][T13997] dump_stack_lvl+0x100/0x190 [ 332.636346][T13997] should_fail_ex.cold+0x5/0xa [ 332.636375][T13997] should_failslab+0xc2/0x120 [ 332.636403][T13997] kmem_cache_alloc_noprof+0x92/0x6a0 [ 332.636426][T13997] ? __pmd_alloc+0xbf/0x950 [ 332.636455][T13997] __pmd_alloc+0xbf/0x950 [ 332.636483][T13997] huge_pte_alloc+0x429/0x5a0 [ 332.636515][T13997] hugetlb_fault+0x33a/0x1650 [ 332.636548][T13997] ? __pfx_mt_find+0x10/0x10 [ 332.636577][T13997] ? __pfx_hugetlb_fault+0x10/0x10 [ 332.636628][T13997] handle_mm_fault+0x604/0xa20 [ 332.636663][T13997] __get_user_pages+0x8ae/0x2c30 [ 332.636694][T13997] ? __pfx_mt_find+0x10/0x10 [ 332.636725][T13997] ? __pfx___get_user_pages+0x10/0x10 [ 332.636758][T13997] populate_vma_page_range+0x267/0x3f0 [ 332.636785][T13997] ? __pfx_populate_vma_page_range+0x10/0x10 [ 332.636808][T13997] ? __pfx_find_vma_intersection+0x10/0x10 [ 332.636840][T13997] __mm_populate+0x107/0x3a0 [ 332.636862][T13997] ? __pfx___mm_populate+0x10/0x10 [ 332.636887][T13997] ? up_write+0x2dc/0x5b0 [ 332.636913][T13997] vm_mmap_pgoff+0x441/0x470 [ 332.636945][T13997] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 332.636965][T13997] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 332.637005][T13997] ksys_mmap_pgoff+0x285/0x610 [ 332.637034][T13997] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 332.637057][T13997] ? xfd_validate_state+0x129/0x190 [ 332.637083][T13997] __x64_sys_mmap+0x125/0x190 [ 332.637108][T13997] do_syscall_64+0x123/0x790 [ 332.637139][T13997] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 332.637160][T13997] RIP: 0033:0x7f7c0319e159 [ 332.637177][T13997] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 332.637195][T13997] RSP: 002b:00007f7c040d3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 332.637216][T13997] RAX: ffffffffffffffda RBX: 00007f7c03425fa0 RCX: 00007f7c0319e159 [ 332.637229][T13997] RDX: 0000000000000009 RSI: 0000000000800000 RDI: 000000000a000000 [ 332.637240][T13997] RBP: 00007f7c0323506b R08: ffffffffffffffff R09: 0000000000000000 [ 332.637252][T13997] R10: 000000000004c032 R11: 0000000000000246 R12: 0000000000000000 [ 332.637263][T13997] R13: 00007f7c03426038 R14: 00007f7c03425fa0 R15: 00007ffe1b0eb2f8 [ 332.637290][T13997] [ 332.820518][ T5611] Bluetooth: hci8: command tx timeout [ 332.927275][ T30] audit: type=1400 audit(1789673765.374:3752): avc: denied { write } for pid=13973 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 333.046035][ T30] audit: type=1400 audit(1789673765.484:3753): avc: denied { write } for pid=14006 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 333.377061][T12121] IPVS: starting estimator thread 0... [ 333.591479][T14016] IPVS: using max 40 ests per chain, 96000 per kthread [ 333.812223][T14028] FAULT_INJECTION: forcing a failure. [ 333.812223][T14028] name failslab, interval 1, probability 0, space 0, times 0 [ 333.812258][T14028] CPU: 0 UID: 0 PID: 14028 Comm: syz.3.2651 Tainted: G L syzkaller #0 PREEMPT(full) [ 333.812287][T14028] Tainted: [L]=SOFTLOCKUP [ 333.812295][T14028] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 333.812307][T14028] Call Trace: [ 333.812315][T14028] [ 333.812323][T14028] dump_stack_lvl+0x100/0x190 [ 333.812365][T14028] should_fail_ex.cold+0x5/0xa [ 333.812395][T14028] should_failslab+0xc2/0x120 [ 333.812423][T14028] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 333.812447][T14028] ? __d_alloc+0x35/0xa50 [ 333.812478][T14028] __d_alloc+0x35/0xa50 [ 333.812508][T14028] d_alloc+0x4a/0x1e0 [ 333.812537][T14028] lookup_one_qstr_excl+0x171/0x250 [ 333.812571][T14028] start_dirop+0x59/0xb0 [ 333.812595][T14028] simple_start_creating+0xf9/0x110 [ 333.812617][T14028] ? __pfx_simple_start_creating+0x10/0x10 [ 333.812641][T14028] ? mntput+0x70/0xa0 [ 333.812661][T14028] ? simple_pin_fs+0xa3/0x190 [ 333.812682][T14028] debugfs_start_creating.part.0+0x9f/0x180 [ 333.812712][T14028] debugfs_create_dir+0x4b/0x420 [ 333.812740][T14028] drm_debugfs_clients_add+0x6f/0x210 [ 333.812767][T14028] drm_file_alloc+0x5c6/0xb40 [ 333.812796][T14028] drm_open_helper+0x1fc/0x540 [ 333.812825][T14028] drm_open+0x1a0/0x3e0 [ 333.812849][T14028] ? __pfx_drm_open+0x10/0x10 [ 333.812874][T14028] drm_stub_open+0x20f/0x380 [ 333.812899][T14028] ? __pfx_drm_stub_open+0x10/0x10 [ 333.812921][T14028] chrdev_open+0x234/0x6a0 [ 333.812948][T14028] ? __pfx_chrdev_open+0x10/0x10 [ 333.812973][T14028] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 333.813010][T14028] do_dentry_open+0x6ab/0x14d0 [ 333.813030][T14028] ? __pfx_chrdev_open+0x10/0x10 [ 333.813060][T14028] vfs_open+0x82/0x3f0 [ 333.813089][T14028] path_openat+0x19fa/0x2440 [ 333.813118][T14028] ? __pfx_path_openat+0x10/0x10 [ 333.813151][T14028] do_file_open+0x20e/0x430 [ 333.813179][T14028] ? __pfx_do_file_open+0x10/0x10 [ 333.813223][T14028] ? _raw_spin_unlock+0x28/0x50 [ 333.813247][T14028] ? alloc_fd+0x471/0x7a0 [ 333.813280][T14028] do_sys_openat2+0x10f/0x1e0 [ 333.813307][T14028] ? __pfx_do_sys_openat2+0x10/0x10 [ 333.813339][T14028] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 333.813377][T14028] __x64_sys_openat+0x12d/0x210 [ 333.813408][T14028] ? __pfx___x64_sys_openat+0x10/0x10 [ 333.813449][T14028] do_syscall_64+0x123/0x790 [ 333.813478][T14028] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 333.813498][T14028] RIP: 0033:0x7feb4f15e98e [ 333.813515][T14028] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 333.813533][T14028] RSP: 002b:00007feb4ff94b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 333.813553][T14028] RAX: ffffffffffffffda RBX: 00007feb4ff956c0 RCX: 00007feb4f15e98e [ 333.813567][T14028] RDX: 0000000000040100 RSI: 00007feb4ff94c00 RDI: ffffffffffffff9c [ 333.813579][T14028] RBP: 00007feb4ff94c00 R08: 0000000000000000 R09: 0000000000000000 [ 333.813591][T14028] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 333.813604][T14028] R13: 00007feb4f426038 R14: 00007feb4f425fa0 R15: 00007ffde9bf5c08 [ 333.813632][T14028] [ 334.576717][ T5788] usb 5-1: new full-speed USB device number 16 using dummy_hcd [ 334.648010][ T30] audit: type=1400 audit(1789673767.104:3754): avc: denied { write } for pid=14029 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 334.726960][ T5788] usb 5-1: unable to get BOS descriptor or descriptor too short [ 334.727404][ T5788] usb 5-1: not running at top speed; connect to a high speed hub [ 334.727432][ T5788] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 334.728344][ T5788] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 334.728367][ T5788] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 334.728386][ T5788] usb 5-1: config 14 has an invalid descriptor of length 0, skipping remainder of the config [ 334.728411][ T5788] usb 5-1: config 14 has no interface number 0 [ 334.728425][ T5788] usb 5-1: config 14 has no interface number 1 [ 334.728473][ T5788] usb 5-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 334.728497][ T5788] usb 5-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 334.728520][ T5788] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 334.728544][ T5788] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 137, setting to 64 [ 334.728566][ T5788] usb 5-1: config 14 interface 57 has no altsetting 0 [ 334.728582][ T5788] usb 5-1: config 14 interface 228 has no altsetting 0 [ 334.731964][ T5788] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 334.731988][ T5788] usb 5-1: Product: syz [ 334.732002][ T5788] usb 5-1: Manufacturer: syz [ 334.732016][ T5788] usb 5-1: SerialNumber: syz [ 335.221774][ T5788] legousbtower 5-1:14.57: interrupt endpoints not found [ 335.627647][ T5788] legousbtower 5-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 335.649972][ T5788] legousbtower 5-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 335.844878][ T30] kauditd_printk_skb: 4 callbacks suppressed [ 335.844895][ T30] audit: type=1400 audit(1789673768.294:3759): avc: denied { write } for pid=14094 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 335.875507][ C0] net_ratelimit: 21 callbacks suppressed [ 335.875528][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 335.875586][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 335.876244][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 336.247962][ T30] audit: type=1400 audit(1789673768.704:3760): avc: denied { write } for pid=14098 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 336.408597][ C1] usb 5-1: tower_interrupt_in_callback: usb_submit_urb failed (-1) [ 336.412562][ T10] usb 5-1: USB disconnect, device number 16 [ 336.415527][ T30] audit: type=1400 audit(1789673768.864:3761): avc: denied { write } for pid=14110 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 336.453724][ T10] legousbtower 5-1:14.228: LEGO USB Tower #-160 now disconnected [ 336.738108][ T42] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 336.738168][ T42] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 336.770976][ T30] audit: type=1400 audit(1789673769.224:3762): avc: denied { write } for pid=14112 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 336.875100][ T30] audit: type=1400 audit(1789673769.324:3763): avc: denied { write } for pid=14123 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 336.905582][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 336.905660][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 336.906135][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 337.595282][ T30] audit: type=1400 audit(1789673770.044:3764): avc: denied { write } for pid=14125 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 337.710122][ T30] audit: type=1400 audit(1789673770.164:3765): avc: denied { write } for pid=14156 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 337.775622][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 337.775945][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 338.451171][T14174] fuse: fd is not a fuse device [ 338.685785][ T30] audit: type=1400 audit(1789673771.144:3766): avc: denied { write } for pid=14158 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 338.921387][ T30] audit: type=1400 audit(1789673771.374:3767): avc: denied { write } for pid=14200 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 339.162849][T14208] 9pnet: p9_errstr2errno: server reported unknown error 0x00000 [ 339.394106][T14219] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 339.447134][ T190] usb 2-1: new full-speed USB device number 16 using dummy_hcd [ 339.509885][T14225] netlink: 'syz.0.2688': attribute type 1 has an invalid length. [ 339.591523][T14225] 8021q: adding VLAN 0 to HW filter on device bond5 [ 339.607975][T14229] bond4: (slave veth0_to_bond): Releasing active interface [ 339.620825][T14229] bond5: (slave veth0_to_bond): making interface the new active one [ 339.624437][T14229] bond5: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 339.699789][T14233] netlink: 'syz.3.2690': attribute type 1 has an invalid length. [ 339.724724][T14225] bond5: entered promiscuous mode [ 339.724739][T14225] veth0_to_bond: entered promiscuous mode [ 339.724850][T14225] bond5: entered allmulticast mode [ 339.724861][T14225] veth0_to_bond: entered allmulticast mode [ 339.783765][ T190] usb 2-1: New USB device found, idVendor=12d6, idProduct=0444, bcdDevice= 1.00 [ 339.784482][ T190] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 339.784512][ T190] usb 2-1: can't read configurations, error -71 [ 339.808043][T14235] mac80211_hwsim hwsim29 wlan1: entered promiscuous mode [ 340.038427][ T5724] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 340.185268][ T5724] usb 5-1: Using ep0 maxpacket: 32 [ 340.186085][ T5724] usb 5-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 340.187253][ T5724] usb 5-1: config index 0 descriptor too short (expected 29220, got 36) [ 340.187273][ T5724] usb 5-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 340.187290][ T5724] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 340.187326][ T5724] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 340.187346][ T5724] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 340.187366][ T5724] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 340.187397][ T5724] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 340.203754][ T5724] usb 5-1: config 0 descriptor?? [ 340.441521][ T5724] usblp 5-1:0.0: usblp0: USB Bidirectional printer dev 17 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 340.452351][ T5724] usb 5-1: USB disconnect, device number 17 [ 340.464389][ T5724] usblp0: removed [ 340.592189][T14263] FAULT_INJECTION: forcing a failure. [ 340.592189][T14263] name failslab, interval 1, probability 0, space 0, times 0 [ 340.592223][T14263] CPU: 0 UID: 0 PID: 14263 Comm: syz.1.2701 Tainted: G L syzkaller #0 PREEMPT(full) [ 340.592250][T14263] Tainted: [L]=SOFTLOCKUP [ 340.592258][T14263] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 340.592270][T14263] Call Trace: [ 340.592278][T14263] [ 340.592286][T14263] dump_stack_lvl+0x100/0x190 [ 340.592322][T14263] should_fail_ex.cold+0x5/0xa [ 340.592351][T14263] should_failslab+0xc2/0x120 [ 340.592379][T14263] __kmalloc_noprof+0xfc/0x840 [ 340.592401][T14263] ? __might_fault+0xc5/0x140 [ 340.592431][T14263] ? lsm_blob_alloc+0x68/0x90 [ 340.592462][T14263] lsm_blob_alloc+0x68/0x90 [ 340.592495][T14263] security_msg_msg_alloc+0x22/0x240 [ 340.592524][T14263] load_msg+0x354/0x4a0 [ 340.592551][T14263] do_msgrcv+0x209/0x16f0 [ 340.592575][T14263] ? __pfx_do_msg_fill+0x10/0x10 [ 340.592601][T14263] ? __sys_connect+0xe4/0x170 [ 340.592623][T14263] ? __pfx_do_msgrcv+0x10/0x10 [ 340.592654][T14263] ? xfd_validate_state+0x129/0x190 [ 340.592688][T14263] ? do_syscall_64+0x123/0x790 [ 340.592716][T14263] do_syscall_64+0x123/0x790 [ 340.592745][T14263] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 340.592767][T14263] RIP: 0033:0x7f7c0319e159 [ 340.592785][T14263] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 340.592805][T14263] RSP: 002b:00007f7c040d3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000046 [ 340.592826][T14263] RAX: ffffffffffffffda RBX: 00007f7c03425fa0 RCX: 00007f7c0319e159 [ 340.592839][T14263] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 340.592851][T14263] RBP: 00007f7c0323506b R08: 0000000000004800 R09: 0000000000000000 [ 340.592863][T14263] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 340.592876][T14263] R13: 00007f7c03426038 R14: 00007f7c03425fa0 R15: 00007ffe1b0eb2f8 [ 340.592903][T14263] [ 340.955239][ T5724] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 341.056074][ C0] net_ratelimit: 17 callbacks suppressed [ 341.056095][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 341.056160][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 341.056978][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 341.105392][ T5724] usb 5-1: Using ep0 maxpacket: 32 [ 341.118757][ T5724] usb 5-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 341.119680][ T5724] usb 5-1: config index 0 descriptor too short (expected 29220, got 36) [ 341.119702][ T5724] usb 5-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 341.119720][ T5724] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 341.119757][ T5724] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 341.119776][ T5724] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 341.119796][ T5724] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 341.119833][ T5724] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 341.229859][ T5724] usb 5-1: config 0 descriptor?? [ 341.297144][T12117] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 341.297205][T12117] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 341.377103][T14286] FAULT_INJECTION: forcing a failure. [ 341.377103][T14286] name failslab, interval 1, probability 0, space 0, times 0 [ 341.377138][T14286] CPU: 0 UID: 0 PID: 14286 Comm: syz.3.2709 Tainted: G L syzkaller #0 PREEMPT(full) [ 341.377165][T14286] Tainted: [L]=SOFTLOCKUP [ 341.377173][T14286] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 341.377186][T14286] Call Trace: [ 341.377193][T14286] [ 341.377202][T14286] dump_stack_lvl+0x100/0x190 [ 341.377237][T14286] should_fail_ex.cold+0x5/0xa [ 341.377268][T14286] should_failslab+0xc2/0x120 [ 341.377297][T14286] __kmalloc_cache_noprof+0x91/0x6d0 [ 341.377334][T14286] ? inode_doinit_with_dentry+0x70b/0x1340 [ 341.377358][T14286] ? inode_doinit_with_dentry+0x7b1/0x1340 [ 341.377388][T14286] inode_doinit_with_dentry+0x7b1/0x1340 [ 341.377424][T14286] ? __pfx_inode_doinit_with_dentry+0x10/0x10 [ 341.377449][T14286] ? find_held_lock+0x2b/0x80 [ 341.377474][T14286] ? security_fs_use+0x3a6/0x8e0 [ 341.377499][T14286] ? security_fs_use+0x3a6/0x8e0 [ 341.377529][T14286] sb_finish_set_opts+0x20f/0x850 [ 341.377554][T14286] ? __pfx_sb_finish_set_opts+0x10/0x10 [ 341.377575][T14286] ? kernfs_get_tree+0x251/0xbb0 [ 341.377607][T14286] selinux_set_mnt_opts+0x1222/0x18d0 [ 341.377642][T14286] security_sb_set_mnt_opts+0xc0/0x140 [ 341.377675][T14286] vfs_get_tree+0x1ac/0x320 [ 341.377704][T14286] vfs_cmd_create+0xd7/0x2a0 [ 341.377726][T14286] __do_sys_fsconfig+0x55a/0xcb0 [ 341.377749][T14286] ? __pfx___do_sys_fsconfig+0x10/0x10 [ 341.377784][T14286] do_syscall_64+0x123/0x790 [ 341.377813][T14286] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 341.377834][T14286] RIP: 0033:0x7feb4f19e159 [ 341.377853][T14286] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 341.377872][T14286] RSP: 002b:00007feb4ff95028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 341.377893][T14286] RAX: ffffffffffffffda RBX: 00007feb4f425fa0 RCX: 00007feb4f19e159 [ 341.377906][T14286] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000004 [ 341.377918][T14286] RBP: 00007feb4f23506b R08: 0000000000000000 R09: 0000000000000000 [ 341.377930][T14286] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 341.377942][T14286] R13: 00007feb4f426038 R14: 00007feb4f425fa0 R15: 00007ffde9bf5c08 [ 341.377971][T14286] [ 341.401141][T14288] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2710'. [ 341.453989][ T5724] usblp 5-1:0.0: usblp0: USB Bidirectional printer dev 18 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 341.620467][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 341.620786][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 341.621055][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 341.621347][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 341.621718][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 341.699165][T14296] fuse: fd is not a fuse device [ 341.700126][ C1] usblp0: nonzero read bulk status received: -71 [ 341.700419][ T190] usb 5-1: USB disconnect, device number 18 [ 341.702779][T14237] usblp0: error -71 reading from printer [ 341.825306][ T5724] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 341.907208][T14236] usblp0: removed [ 341.977096][ T5724] usb 4-1: Using ep0 maxpacket: 32 [ 341.979998][ T5724] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 341.985945][ T5724] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 341.985969][ T5724] usb 4-1: config 0 has no interface number 0 [ 341.986001][ T5724] usb 4-1: config 0 interface 184 has no altsetting 0 [ 341.987888][ T5724] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 341.987911][ T5724] usb 4-1: Product: syz [ 341.987925][ T5724] usb 4-1: Manufacturer: syz [ 341.987938][ T5724] usb 4-1: SerialNumber: syz [ 342.001056][ T5724] usb 4-1: config 0 descriptor?? [ 342.086473][T14305] fuse: fd is not a fuse device [ 342.654596][ T5724] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 342.654630][ T5724] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 342.735255][ T5611] Bluetooth: hci4: command 0x0406 tx timeout [ 342.775131][T14333] CIFS: Attempting to mount //127.0.0.1/share [ 342.832185][T14333] CIFS: VFS: \\127.0.0.1 Invalid dialect returned by server 0x8400 [ 342.835634][T14333] CIFS: VFS: cifs_mount failed w/return code = -5 [ 343.069320][ T5724] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000010: -71 [ 343.069355][ T5724] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to write HW_CFG: -71 [ 343.069375][ T5724] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 343.069599][ T5724] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -71 [ 343.079509][ T5724] usb 4-1: USB disconnect, device number 10 [ 343.520018][T14350] fuse: fd is not a fuse device [ 343.726190][T14353] i2c i2c-0: new_device: Instantiated device anx7411 at 0x2c [ 344.192014][T14381] FAULT_INJECTION: forcing a failure. [ 344.192014][T14381] name failslab, interval 1, probability 0, space 0, times 0 [ 344.192051][T14381] CPU: 1 UID: 0 PID: 14381 Comm: syz.4.2744 Tainted: G L syzkaller #0 PREEMPT(full) [ 344.192082][T14381] Tainted: [L]=SOFTLOCKUP [ 344.192090][T14381] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 344.192104][T14381] Call Trace: [ 344.192112][T14381] [ 344.192121][T14381] dump_stack_lvl+0x100/0x190 [ 344.192158][T14381] should_fail_ex.cold+0x5/0xa [ 344.192189][T14381] should_failslab+0xc2/0x120 [ 344.192216][T14381] __kmalloc_cache_noprof+0x91/0x6d0 [ 344.192247][T14381] ? snd_midi_event_new+0x6f/0x210 [ 344.192278][T14381] snd_midi_event_new+0x6f/0x210 [ 344.192304][T14381] snd_virmidi_input_open+0x107/0x470 [ 344.192336][T14381] open_substream+0x480/0x970 [ 344.192368][T14381] rawmidi_open_priv+0x524/0x6f0 [ 344.192402][T14381] snd_rawmidi_open+0x4b4/0xb90 [ 344.192427][T14381] ? __pfx_snd_rawmidi_open+0x10/0x10 [ 344.192445][T14381] ? lock_acquire+0x1d1/0x380 [ 344.192471][T14381] ? __pfx_default_wake_function+0x10/0x10 [ 344.192496][T14381] ? soundcore_open+0x231/0x5a0 [ 344.192521][T14381] ? soundcore_open+0x231/0x5a0 [ 344.192547][T14381] ? __pfx_snd_rawmidi_open+0x10/0x10 [ 344.192569][T14381] soundcore_open+0x2e3/0x5a0 [ 344.192596][T14381] ? __pfx_soundcore_open+0x10/0x10 [ 344.192621][T14381] chrdev_open+0x234/0x6a0 [ 344.192648][T14381] ? __pfx_chrdev_open+0x10/0x10 [ 344.192675][T14381] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 344.192712][T14381] do_dentry_open+0x6ab/0x14d0 [ 344.192733][T14381] ? __pfx_chrdev_open+0x10/0x10 [ 344.192763][T14381] vfs_open+0x82/0x3f0 [ 344.192793][T14381] path_openat+0x19fa/0x2440 [ 344.192823][T14381] ? __pfx_path_openat+0x10/0x10 [ 344.192863][T14381] do_file_open+0x20e/0x430 [ 344.192891][T14381] ? __pfx_do_file_open+0x10/0x10 [ 344.192932][T14381] ? _raw_spin_unlock+0x28/0x50 [ 344.192955][T14381] ? alloc_fd+0x471/0x7a0 [ 344.192991][T14381] do_sys_openat2+0x10f/0x1e0 [ 344.193019][T14381] ? __pfx_do_sys_openat2+0x10/0x10 [ 344.193045][T14381] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 344.193079][T14381] __x64_sys_openat+0x12d/0x210 [ 344.193109][T14381] ? __pfx___x64_sys_openat+0x10/0x10 [ 344.193148][T14381] do_syscall_64+0x123/0x790 [ 344.193179][T14381] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 344.193200][T14381] RIP: 0033:0x7f054535e98e [ 344.193218][T14381] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 344.193238][T14381] RSP: 002b:00007f054622cb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 344.193259][T14381] RAX: ffffffffffffffda RBX: 00007f054622d6c0 RCX: 00007f054535e98e [ 344.193273][T14381] RDX: 0000000000000000 RSI: 00007f054622cc00 RDI: ffffffffffffff9c [ 344.193286][T14381] RBP: 00007f054622cc00 R08: 0000000000000000 R09: 0000000000000000 [ 344.193299][T14381] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 344.193313][T14381] R13: 00007f0545626038 R14: 00007f0545625fa0 R15: 00007ffd5c115818 [ 344.193342][T14381] [ 344.817517][T14395] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2750'. [ 345.938601][ T5611] Bluetooth: hci9: Opcode 0x1003 failed: -110 [ 345.940833][ T5609] Bluetooth: hci9: command 0x1003 tx timeout [ 346.255319][ C0] net_ratelimit: 23 callbacks suppressed [ 346.255343][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 346.255404][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 346.255788][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 346.772699][T14458] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2773'. [ 346.873544][T14455] fuse: root generation should be zero [ 346.877710][ T42] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 346.877762][ T42] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 347.025252][ T5724] usb 5-1: new full-speed USB device number 19 using dummy_hcd [ 347.175856][ T44] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 347.177364][ T5724] usb 5-1: New USB device found, idVendor=086a, idProduct=0003, bcdDevice=f7.3f [ 347.180300][ T5724] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 347.180325][ T5724] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 347.180347][ T5724] usb 5-1: config 0 has no interface number 0 [ 347.180379][ T5724] usb 5-1: config 0 interface 2 altsetting 2 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 347.180401][ T5724] usb 5-1: config 0 interface 2 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 347.180423][ T5724] usb 5-1: config 0 interface 2 has no altsetting 0 [ 347.188711][ T5724] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 347.188735][ T5724] usb 5-1: Product: syz [ 347.188748][ T5724] usb 5-1: Manufacturer: syz [ 347.188761][ T5724] usb 5-1: SerialNumber: syz [ 347.204510][ T5724] usb 5-1: config 0 descriptor?? [ 347.208694][T14458] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 347.224555][ T5724] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 347.232006][ T5724] usb 5-1: invalid MIDI in EP 0 [ 347.295669][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 347.295724][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 347.296814][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 347.327349][ T44] usb 2-1: Using ep0 maxpacket: 32 [ 347.332275][ T44] usb 2-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 347.338538][ T44] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 347.338569][ T44] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 347.338600][ T44] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 347.399986][ T44] usb 2-1: config 0 descriptor?? [ 347.489373][T14477] Failure starting scanning (-16) [ 347.498191][T14477] Failure starting scanning (-16) [ 347.615458][T14480] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2780'. [ 347.669021][T14483] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2780'. [ 347.708013][T14482] fuse: fd is not a fuse device [ 347.834418][ T44] hid_parser_main: 21 callbacks suppressed [ 347.834444][ T44] ft260 0003:0403:6030.000E: unknown main item tag 0x0 [ 347.834471][ T44] ft260 0003:0403:6030.000E: unknown main item tag 0x0 [ 347.846593][ T5611] Bluetooth: hci4: unexpected event for opcode 0x0c6d [ 347.922314][ T5724] snd-usb-audio 5-1:0.2: probe with driver snd-usb-audio failed with error -22 [ 347.976457][T12121] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 347.976539][T12121] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 347.984356][ T5724] usb 5-1: USB disconnect, device number 19 [ 348.020191][ T44] ft260 0003:0403:6030.000E: chip code: 0000 0000 [ 348.117918][T14488] udevd[14488]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 348.221478][ T44] ft260 0003:0403:6030.000E: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.1-1/input0 [ 348.422751][ T44] ft260 0003:0403:6030.000E: failed to retrieve status: -32, no wakeup [ 348.423768][ T44] ft260 0003:0403:6030.000E: failed to retrieve status: -32 [ 348.448452][T14493] bridge0: port 2(bridge_slave_1) entered disabled state [ 348.448908][T14493] bridge0: port 1(bridge_slave_0) entered disabled state [ 348.528238][ T5611] Bluetooth: hci7: unexpected event for opcode 0x2003 [ 348.648494][ T5695] usb 2-1: USB disconnect, device number 18 [ 348.835947][T14493] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 348.859754][T14493] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 349.265584][ T4221] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 349.265717][ T4221] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 349.265750][ T4221] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 349.265786][ T4221] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 350.440893][T14541] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2801'. [ 350.502347][ T30] audit: type=1400 audit(1789673782.954:3768): avc: denied { write } for pid=14518 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 350.838380][ T30] audit: type=1400 audit(1789673783.294:3769): avc: denied { write } for pid=14549 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 350.980460][T14564] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2808'. [ 351.080826][ T5611] Bluetooth: hci7: ACL packet for unknown connection handle 201 [ 351.081163][ T5611] Bluetooth: hci7: ACL packet for unknown connection handle 201 [ 351.100027][T14559] lo speed is unknown, defaulting to 1000 [ 351.298038][T12128] net_ratelimit: 20 callbacks suppressed [ 351.298057][T12128] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 351.298108][T12128] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 351.455359][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 351.455424][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 351.455903][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 351.708988][ T30] audit: type=1400 audit(1789673784.164:3770): avc: denied { write } for pid=14571 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 351.855724][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 351.856096][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 351.856394][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 351.946604][ T30] audit: type=1400 audit(1789673784.394:3771): avc: denied { write } for pid=14601 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 352.420127][T12121] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 352.420202][T12121] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 352.608215][ T30] audit: type=1400 audit(1789673785.064:3772): avc: denied { write } for pid=14605 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 352.713141][ T30] audit: type=1400 audit(1789673785.164:3773): avc: denied { write } for pid=14627 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 353.145647][ T30] audit: type=1400 audit(1789673785.604:3774): avc: denied { write } for pid=14630 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 353.257254][ T30] audit: type=1400 audit(1789673785.714:3775): avc: denied { write } for pid=14658 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 355.988998][ T30] audit: type=1400 audit(1789673788.444:3776): avc: denied { mount } for pid=14717 comm="syz.4.2851" name="/" dev="pstore" ino=4039 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pstore_t tclass=filesystem permissive=1 [ 356.655470][ C0] net_ratelimit: 18 callbacks suppressed [ 356.655493][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 356.655553][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 356.655978][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 356.838729][T12128] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 356.838790][T12128] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 356.975657][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 356.975980][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 357.130669][T14762] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2867'. [ 357.693486][T14781] ref_ctr_offset mismatch. inode: 0xf9 offset: 0x0 ref_ctr_offset(old): 0x0 ref_ctr_offset(new): 0x300000018 [ 357.719505][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 357.719562][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 357.721425][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 357.897975][ T30] audit: type=1800 audit(1789673790.354:3777): pid=14789 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.2.2878" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 357.982299][T14793] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2881'. [ 358.150958][ T30] audit: type=1400 audit(1789673790.604:3778): avc: denied { watch_mount watch_reads } for pid=14800 comm="syz.4.2883" path="/167" dev="tmpfs" ino=913 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 359.003303][T14835] FAULT_INJECTION: forcing a failure. [ 359.003303][T14835] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 359.003341][T14835] CPU: 0 UID: 0 PID: 14835 Comm: syz.4.2896 Tainted: G L syzkaller #0 PREEMPT(full) [ 359.003372][T14835] Tainted: [L]=SOFTLOCKUP [ 359.003380][T14835] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 359.003393][T14835] Call Trace: [ 359.003400][T14835] [ 359.003409][T14835] dump_stack_lvl+0x100/0x190 [ 359.003445][T14835] should_fail_ex.cold+0x5/0xa [ 359.003470][T14835] ? prepare_alloc_pages+0x16d/0x5b0 [ 359.003499][T14835] should_fail_alloc_page+0xeb/0x140 [ 359.003527][T14835] prepare_alloc_pages+0x1f0/0x5b0 [ 359.003557][T14835] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 359.003578][T14835] ? stack_trace_save+0x8e/0xc0 [ 359.003597][T14835] ? __pfx_stack_trace_save+0x10/0x10 [ 359.003617][T14835] ? stack_depot_save_flags+0x27/0x9f0 [ 359.003641][T14835] ? lock_acquire+0x1d1/0x380 [ 359.003662][T14835] ? validate_mm+0x1f1/0x4e0 [ 359.003691][T14835] ? kasan_save_stack+0x3f/0x50 [ 359.003719][T14835] ? kasan_save_stack+0x30/0x50 [ 359.003742][T14835] ? kasan_save_track+0x14/0x30 [ 359.003763][T14835] ? __kasan_slab_alloc+0x89/0x90 [ 359.003786][T14835] ? kmem_cache_alloc_noprof+0x269/0x6a0 [ 359.003808][T14835] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 359.003827][T14835] ? move_page_tables+0x2fac/0x4930 [ 359.003856][T14835] ? move_vma+0x57c/0x12e0 [ 359.003883][T14835] ? __do_sys_mremap+0x99f/0x1780 [ 359.003910][T14835] ? do_syscall_64+0x123/0x790 [ 359.003937][T14835] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 359.003977][T14835] ? look_up_lock_class+0x64/0x120 [ 359.004005][T14835] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 359.004030][T14835] ? policy_nodemask+0xed/0x4f0 [ 359.004058][T14835] alloc_pages_mpol+0x201/0x550 [ 359.004085][T14835] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 359.004109][T14835] ? do_raw_spin_lock+0x128/0x260 [ 359.004141][T14835] alloc_pages_noprof+0x1a/0x160 [ 359.004171][T14835] pte_alloc_one+0x1c/0x3d0 [ 359.004200][T14835] __pte_alloc+0x6d/0x380 [ 359.004221][T14835] ? __pfx___pte_alloc+0x10/0x10 [ 359.004241][T14835] ? __pfx___might_resched+0x10/0x10 [ 359.004260][T14835] ? move_page_tables+0x1936/0x4930 [ 359.004294][T14835] ? alloc_new_pud+0x217/0x320 [ 359.004324][T14835] move_page_tables+0x2fac/0x4930 [ 359.004370][T14835] ? __pfx_move_page_tables+0x10/0x10 [ 359.004415][T14835] ? lock_acquire+0x1d1/0x380 [ 359.004436][T14835] ? avc_has_perm_noaudit+0x56/0x3b0 [ 359.004469][T14835] copy_vma_and_data+0x2bf/0x780 [ 359.004503][T14835] ? __pfx_copy_vma_and_data+0x10/0x10 [ 359.004542][T14835] ? rcu_is_watching+0x13/0xc0 [ 359.004569][T14835] ? percpu_counter_add_batch+0xb9/0x230 [ 359.004597][T14835] ? __vm_enough_memory+0x184/0x390 [ 359.004625][T14835] move_vma+0x57c/0x12e0 [ 359.004659][T14835] ? __pfx_move_vma+0x10/0x10 [ 359.004689][T14835] ? selinux_mmap_addr+0x2b/0x110 [ 359.004716][T14835] ? security_mmap_addr+0x71/0x1e0 [ 359.004742][T14835] ? __get_unmapped_area+0x255/0x3e0 [ 359.004771][T14835] ? vrm_set_new_addr+0x1f5/0x2a0 [ 359.004806][T14835] mremap_to+0x234/0x4c0 [ 359.004837][T14835] ? __pfx_mremap_to+0x10/0x10 [ 359.004866][T14835] ? mas_walk+0x260/0x310 [ 359.004896][T14835] __do_sys_mremap+0x99f/0x1780 [ 359.004927][T14835] ? futex_wait+0x90/0x370 [ 359.004952][T14835] ? __pfx___do_sys_mremap+0x10/0x10 [ 359.004983][T14835] ? percpu_counter_add_batch+0xb9/0x230 [ 359.005017][T14835] ? __pfx_do_futex+0x10/0x10 [ 359.005054][T14835] ? __sys_socket+0xac/0x260 [ 359.005075][T14835] ? xfd_validate_state+0x129/0x190 [ 359.005107][T14835] do_syscall_64+0x123/0x790 [ 359.005136][T14835] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 359.005154][T14835] RIP: 0033:0x7f054539e159 [ 359.005171][T14835] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 359.005190][T14835] RSP: 002b:00007f054622d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 [ 359.005210][T14835] RAX: ffffffffffffffda RBX: 00007f0545625fa0 RCX: 00007f054539e159 [ 359.005224][T14835] RDX: 0000000000003021 RSI: 0000000000004000 RDI: 0000200000001000 [ 359.005237][T14835] RBP: 00007f054543506b R08: 0000200000ffd000 R09: 0000000000000000 [ 359.005249][T14835] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 [ 359.005262][T14835] R13: 00007f0545626038 R14: 00007f0545625fa0 R15: 00007ffd5c115818 [ 359.005290][T14835] [ 359.405305][ T10] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 359.557595][ T10] usb 4-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 359.560041][ T10] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 359.560084][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 359.571804][T14837] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 359.596163][ T10] opticon 4-1:1.0: opticon converter detected [ 359.608035][ T10] usb 4-1: opticon converter now attached to ttyUSB0 [ 359.680893][T14839] SELinux: failed to load policy [ 359.925276][ T30] audit: type=1326 audit(1789673792.374:3779): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14848 comm="syz.2.2904" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa58379e159 code=0x7ffc0000 [ 359.925325][ T30] audit: type=1326 audit(1789673792.374:3780): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14848 comm="syz.2.2904" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa58379e159 code=0x7ffc0000 [ 359.934097][ T30] audit: type=1326 audit(1789673792.384:3781): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14848 comm="syz.2.2904" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7fa58379e159 code=0x7ffc0000 [ 359.934141][ T30] audit: type=1326 audit(1789673792.384:3782): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14848 comm="syz.2.2904" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa58379e159 code=0x7ffc0000 [ 359.934172][ T30] audit: type=1326 audit(1789673792.384:3783): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14848 comm="syz.2.2904" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa58379e159 code=0x7ffc0000 [ 360.070904][ T30] audit: type=1326 audit(1789673792.524:3784): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14848 comm="syz.2.2904" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=72 compat=0 ip=0x7fa58379e159 code=0x7ffc0000 [ 360.103611][ T30] audit: type=1326 audit(1789673792.534:3785): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14848 comm="syz.2.2904" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa58379e159 code=0x7ffc0000 [ 360.560043][ T10] usb 4-1: USB disconnect, device number 11 [ 360.568074][ T10] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 360.568507][ T10] opticon 4-1:1.0: device disconnected [ 361.087520][ T5788] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 361.151594][T14884] overlayfs: failed to clone upperpath [ 361.235276][ T5788] usb 5-1: Using ep0 maxpacket: 8 [ 361.235809][ T5788] usb 5-1: New USB device found, idVendor=0bc7, idProduct=0008, bcdDevice=4f.c8 [ 361.236694][ T5788] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 361.236732][ T5788] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF9, changing to 0x89 [ 361.236757][ T5788] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x89 has an invalid bInterval 0, changing to 7 [ 361.236781][ T5788] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid maxpacket 59391, setting to 1024 [ 361.236807][ T5788] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xF has an invalid bInterval 255, changing to 11 [ 361.236829][ T5788] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid maxpacket 59391, setting to 1024 [ 361.236852][ T5788] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 361.238589][ T5788] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 361.238611][ T5788] usb 5-1: Product: syz [ 361.238635][ T5788] usb 5-1: Manufacturer: syz [ 361.238650][ T5788] usb 5-1: SerialNumber: syz [ 361.240914][ T5788] usb 5-1: config 0 descriptor?? [ 361.241849][T14875] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 361.241944][T14875] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 361.270814][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 361.270830][ T30] audit: type=1400 audit(1789673793.714:3787): avc: denied { watch } for pid=14891 comm="syz.1.2921" path="/49" dev="tmpfs" ino=270 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 361.694810][T14910] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2927'. [ 361.725478][T14910] 8021q: adding VLAN 0 to HW filter on device bond2 [ 361.746617][T14910] batman_adv: batadv0: Interface deactivated: dummy0 [ 361.751630][T14910] batman_adv: batadv0: Removing interface: dummy0 [ 361.792612][T14910] bond2: (slave dummy0): Enslaving as an active interface with an up link [ 361.807363][T14915] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2940'. [ 361.837814][T14910] bond2 (unregistering): (slave dummy0): Releasing backup interface [ 361.841431][T14910] bond2 (unregistering): Released all slaves [ 361.865583][ C0] net_ratelimit: 21 callbacks suppressed [ 361.865602][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 361.865656][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 361.866139][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 362.165229][ T5811] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 362.284760][T14947] ffs_data_put(): freeing [ 362.315679][ T5811] usb 4-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 362.316840][ T5811] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 362.316870][ T5811] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 362.316901][ T5811] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 362.318472][ T5811] usb 4-1: config 0 descriptor?? [ 362.437045][ T4291] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 362.437114][ T4291] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 362.466533][ T5788] rc_core: IR keymap rc-snapstream-firefly not found [ 362.466553][ T5788] Registered IR keymap rc-empty [ 362.468765][ T5788] rc rc0: syz syz as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 362.472610][ T5788] input: syz syz as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input26 [ 362.495108][ T5788] input: syz syz mouse as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input27 [ 362.555717][ T5788] usb 5-1: USB disconnect, device number 20 [ 362.555819][ C1] ati_remote 5-1:0.0: ati_remote_irq_in: usb_submit_urb()=-19 [ 362.768340][ T5811] cp2112 0003:10C4:EA90.000F: unknown main item tag 0x0 [ 362.768372][ T5811] cp2112 0003:10C4:EA90.000F: unknown main item tag 0x0 [ 362.768394][ T5811] cp2112 0003:10C4:EA90.000F: unknown main item tag 0x0 [ 362.768414][ T5811] cp2112 0003:10C4:EA90.000F: unknown main item tag 0x0 [ 362.768433][ T5811] cp2112 0003:10C4:EA90.000F: unknown main item tag 0x0 [ 362.768453][ T5811] cp2112 0003:10C4:EA90.000F: unknown main item tag 0x0 [ 362.768472][ T5811] cp2112 0003:10C4:EA90.000F: unknown main item tag 0x0 [ 362.812992][ T5811] cp2112 0003:10C4:EA90.000F: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.3-1/input0 [ 362.895479][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 362.895551][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 362.896089][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 362.968700][ T5811] cp2112 0003:10C4:EA90.000F: Part Number: 0x00 Device Version: 0x00 [ 363.544312][ T4221] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 363.544371][ T4221] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 363.576729][T14922] cp2112 0003:10C4:EA90.000F: Error starting transaction: -38 [ 363.577603][ T5811] cp2112 0003:10C4:EA90.000F: error reading lock byte: -71 [ 363.589812][ T5811] usb 4-1: USB disconnect, device number 12 [ 364.139391][T14997] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 364.330789][T15005] device-mapper: table: 248:2: too large device [ 364.330807][T15005] device-mapper: ioctl: error adding target to table [ 364.519789][T15013] FAULT_INJECTION: forcing a failure. [ 364.519789][T15013] name failslab, interval 1, probability 0, space 0, times 0 [ 364.519832][T15013] CPU: 1 UID: 0 PID: 15013 Comm: syz.1.2970 Tainted: G L syzkaller #0 PREEMPT(full) [ 364.519860][T15013] Tainted: [L]=SOFTLOCKUP [ 364.519868][T15013] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 364.519881][T15013] Call Trace: [ 364.519887][T15013] [ 364.519895][T15013] dump_stack_lvl+0x100/0x190 [ 364.519929][T15013] should_fail_ex.cold+0x5/0xa [ 364.519958][T15013] should_failslab+0xc2/0x120 [ 364.519983][T15013] kmem_cache_alloc_noprof+0x92/0x6a0 [ 364.520005][T15013] ? avc_has_perm_noaudit+0x145/0x3b0 [ 364.520032][T15013] ? xfrm_state_alloc+0x23/0x5c0 [ 364.520056][T15013] xfrm_state_alloc+0x23/0x5c0 [ 364.520076][T15013] xfrm_add_sa+0x114e/0x5c50 [ 364.520110][T15013] ? __pfx_xfrm_add_sa+0x10/0x10 [ 364.520138][T15013] ? __nla_parse+0x40/0x60 [ 364.520167][T15013] ? __pfx_xfrm_add_sa+0x10/0x10 [ 364.520192][T15013] xfrm_user_rcv_msg+0x483/0xd80 [ 364.520221][T15013] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 364.520245][T15013] ? kfree_skbmem+0x19f/0x210 [ 364.520275][T15013] ? consume_skb+0xd6/0x110 [ 364.520329][T15013] ? rcu_is_watching+0x13/0xc0 [ 364.520356][T15013] ? trace_contention_end+0x126/0x160 [ 364.520378][T15013] ? __mutex_lock+0x26c/0x1bd0 [ 364.520407][T15013] netlink_rcv_skb+0x159/0x420 [ 364.520429][T15013] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 364.520454][T15013] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 364.520493][T15013] xfrm_netlink_rcv+0x71/0x90 [ 364.520515][T15013] netlink_unicast+0x585/0x850 [ 364.520540][T15013] ? __pfx_netlink_unicast+0x10/0x10 [ 364.520570][T15013] netlink_sendmsg+0x8b0/0xda0 [ 364.520595][T15013] ? __pfx_netlink_sendmsg+0x10/0x10 [ 364.520620][T15013] ? selinux_socket_sendmsg+0x198/0x2f0 [ 364.520645][T15013] ____sys_sendmsg+0xa4d/0xbe0 [ 364.520673][T15013] ? __pfx_netlink_sendmsg+0x10/0x10 [ 364.520697][T15013] ? __pfx_____sys_sendmsg+0x10/0x10 [ 364.520737][T15013] ___sys_sendmsg+0x190/0x1e0 [ 364.520769][T15013] ? __pfx____sys_sendmsg+0x10/0x10 [ 364.520799][T15013] ? futex_wait+0x11e/0x370 [ 364.520835][T15013] ? find_held_lock+0x2b/0x80 [ 364.520879][T15013] __sys_sendmsg+0x160/0x210 [ 364.520905][T15013] ? __pfx___sys_sendmsg+0x10/0x10 [ 364.520945][T15013] do_syscall_64+0x123/0x790 [ 364.520977][T15013] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 364.520998][T15013] RIP: 0033:0x7f7c0319e159 [ 364.521016][T15013] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 364.521035][T15013] RSP: 002b:00007f7c040d3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 364.521054][T15013] RAX: ffffffffffffffda RBX: 00007f7c03425fa0 RCX: 00007f7c0319e159 [ 364.521065][T15013] RDX: 0000000000000000 RSI: 0000200000000340 RDI: 0000000000000005 [ 364.521077][T15013] RBP: 00007f7c0323506b R08: 0000000000000000 R09: 0000000000000000 [ 364.521089][T15013] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 364.521101][T15013] R13: 00007f7c03426038 R14: 00007f7c03425fa0 R15: 00007ffe1b0eb2f8 [ 364.521127][T15013] [ 364.891907][ C0] vxcan1: j1939_tp_rxtimer: 0xffff888086f42400: rx timeout, send abort [ 364.947418][T15025] FAULT_INJECTION: forcing a failure. [ 364.947418][T15025] name failslab, interval 1, probability 0, space 0, times 0 [ 364.947452][T15025] CPU: 1 UID: 0 PID: 15025 Comm: syz.1.2974 Tainted: G L syzkaller #0 PREEMPT(full) [ 364.947484][T15025] Tainted: [L]=SOFTLOCKUP [ 364.947494][T15025] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 364.947505][T15025] Call Trace: [ 364.947513][T15025] [ 364.947521][T15025] dump_stack_lvl+0x100/0x190 [ 364.947555][T15025] should_fail_ex.cold+0x5/0xa [ 364.947583][T15025] should_failslab+0xc2/0x120 [ 364.947610][T15025] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 364.947634][T15025] ? start_dirop+0x79/0xb0 [ 364.947656][T15025] ? alloc_inode+0x68/0x250 [ 364.947676][T15025] ? __pfx_debugfs_alloc_inode+0x10/0x10 [ 364.947707][T15025] alloc_inode+0x68/0x250 [ 364.947726][T15025] new_inode+0x22/0x1c0 [ 364.947747][T15025] debugfs_create_dir+0x9d/0x420 [ 364.947778][T15025] kvm_dev_ioctl+0x1286/0x1b50 [ 364.947810][T15025] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 364.947841][T15025] ? selinux_file_ioctl+0x13b/0x290 [ 364.947862][T15025] ? selinux_file_ioctl+0xb6/0x290 [ 364.947886][T15025] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 364.947911][T15025] __x64_sys_ioctl+0x18e/0x210 [ 364.947933][T15025] do_syscall_64+0x123/0x790 [ 364.947963][T15025] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 364.947985][T15025] RIP: 0033:0x7f7c0319e159 [ 364.948002][T15025] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 364.948020][T15025] RSP: 002b:00007f7c040d3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 364.948041][T15025] RAX: ffffffffffffffda RBX: 00007f7c03425fa0 RCX: 00007f7c0319e159 [ 364.948054][T15025] RDX: 0000000000000000 RSI: 000000000000ae01 RDI: 0000000000000004 [ 364.948066][T15025] RBP: 00007f7c0323506b R08: 0000000000000000 R09: 0000000000000000 [ 364.948078][T15025] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 364.948090][T15025] R13: 00007f7c03426038 R14: 00007f7c03425fa0 R15: 00007ffe1b0eb2f8 [ 364.948119][T15025] [ 364.960384][T15025] debugfs: out of free dentries, can not create directory '15025-5' [ 365.391953][ C0] vxcan1: j1939_tp_rxtimer: 0xffff888086f42400: abort rx timeout. Force session deactivation [ 365.769554][T15046] netlink: 'syz.2.2980': attribute type 4 has an invalid length. [ 366.656243][ T31] INFO: task syz.7.1542:10274 blocked for more than 143 seconds. [ 366.656271][ T31] Tainted: G L syzkaller #0 [ 366.656282][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 366.656291][ T31] task:syz.7.1542 state:D stack:27944 pid:10274 tgid:10273 ppid:9174 task_flags:0x400140 flags:0x00080002 [ 366.656358][ T31] Call Trace: [ 366.656366][ T31] [ 366.656377][ T31] __schedule+0x1259/0x6920 [ 366.656406][ T31] ? __lock_acquire+0x5c0/0x1f40 [ 366.656442][ T31] ? __pfx___schedule+0x10/0x10 [ 366.656464][ T31] ? find_held_lock+0x2b/0x80 [ 366.656490][ T31] ? schedule+0x225/0x2c0 ** replaying previous printk message ** [ 366.656490][ T31] ? schedule+0x225/0x2c0 [ 366.656516][ T31] schedule+0xdd/0x2c0 [ 366.656540][ T31] schedule_preempt_disabled+0x13/0x30 [ 366.656561][ T31] __mutex_lock+0xccb/0x1bd0 [ 366.656587][ T31] ? write_ports+0xa5/0xcc0 [ 366.656611][ T31] ? nfsctl_transaction_write+0xcd/0x1a0 [ 366.656633][ T31] ? ksys_write+0x12a/0x250 [ 366.656651][ T31] ? do_syscall_64+0x123/0x790 [ 366.656678][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 366.656716][ T31] ? __lock_acquire+0x5c0/0x1f40 [ 366.656741][ T31] ? write_ports+0xa5/0xcc0 [ 366.656763][ T31] write_ports+0xa5/0xcc0 [ 366.656789][ T31] ? __pfx_write_ports+0x10/0x10 [ 366.656812][ T31] ? lock_acquire+0x1d1/0x380 [ 366.656831][ T31] ? __might_fault+0xc5/0x140 [ 366.656859][ T31] ? find_held_lock+0x2b/0x80 [ 366.656884][ T31] ? __might_fault+0xc5/0x140 [ 366.656910][ T31] ? __might_fault+0xc5/0x140 [ 366.656941][ T31] ? __pfx_write_ports+0x10/0x10 [ 366.656966][ T31] ? _copy_from_user+0x59/0xd0 [ 366.656987][ T31] ? __pfx_write_ports+0x10/0x10 [ 366.657009][ T31] nfsctl_transaction_write+0x106/0x1a0 [ 366.657034][ T31] vfs_write+0x2aa/0x1050 [ 366.657054][ T31] ? __pfx_nfsctl_transaction_write+0x10/0x10 [ 366.657077][ T31] ? lock_acquire+0x1d1/0x380 [ 366.657096][ T31] ? __fget_files+0x34/0x3d0 [ 366.657118][ T31] ? __pfx_vfs_write+0x10/0x10 [ 366.657136][ T31] ? find_held_lock+0x2b/0x80 [ 366.657162][ T31] ? __fget_files+0x215/0x3d0 [ 366.657190][ T31] ? __fget_files+0x21f/0x3d0 [ 366.657220][ T31] ksys_write+0x12a/0x250 [ 366.657239][ T31] ? __pfx_ksys_write+0x10/0x10 [ 366.657267][ T31] do_syscall_64+0x123/0x790 [ 366.657295][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 366.657322][ T31] RIP: 0033:0x7f956f99e159 [ 366.657338][ T31] RSP: 002b:00007f95708fa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 366.657353][ T31] RAX: ffffffffffffffda RBX: 00007f956fc25fa0 RCX: 00007f956f99e159 [ 366.657364][ T31] RDX: 0000000000000005 RSI: 0000200000000240 RDI: 0000000000000003 [ 366.657376][ T31] RBP: 00007f956fa3506b R08: 0000000000000000 R09: 0000000000000000 [ 366.657387][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 366.657398][ T31] R13: 00007f956fc26038 R14: 00007f956fc25fa0 R15: 00007ffdc4c3a4e8 [ 366.657424][ T31] [ 366.657432][ T31] INFO: task syz.7.1542:10277 blocked for more than 143 seconds. [ 366.657447][ T31] Tainted: G L syzkaller #0 [ 366.657458][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 366.657465][ T31] task:syz.7.1542 state:D stack:27656 pid:10277 tgid:10273 ppid:9174 task_flags:0x400040 flags:0x00080002 [ 366.657523][ T31] Call Trace: [ 366.657529][ T31] [ 366.657540][ T31] __schedule+0x1259/0x6920 [ 366.657563][ T31] ? __lock_acquire+0x5c0/0x1f40 [ 366.660298][ T31] ? __pfx___schedule+0x10/0x10 [ 366.660336][ T31] ? find_held_lock+0x2b/0x80 [ 366.660362][ T31] ? schedule+0x225/0x2c0 [ 366.660388][ T31] schedule+0xdd/0x2c0 [ 366.660408][ T31] schedule_preempt_disabled+0x13/0x30 [ 366.660430][ T31] __mutex_lock+0xccb/0x1bd0 [ 366.660455][ T31] ? nfsd_nrthreads+0x57/0xd0 [ 366.660480][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 366.660509][ T31] ? lock_acquire+0x1d1/0x380 [ 366.660531][ T31] ? net_generic+0xea/0x2a0 [ 366.660548][ T31] ? net_generic+0xea/0x2a0 [ 366.660572][ T31] ? nfsd_nrthreads+0x57/0xd0 [ 366.660590][ T31] nfsd_nrthreads+0x57/0xd0 [ 366.660609][ T31] write_threads+0x34a/0x600 [ 366.660635][ T31] ? __pfx_write_threads+0x10/0x10 [ 366.660658][ T31] ? __might_fault+0xc5/0x140 [ 366.660685][ T31] ? __might_fault+0xc5/0x140 [ 366.660710][ T31] ? __might_fault+0xc5/0x140 [ 366.660738][ T31] ? __pfx_write_threads+0x10/0x10 [ 366.660854][ T31] ? __pfx_write_threads+0x10/0x10 [ 366.660878][ T31] ? _copy_from_user+0x59/0xd0 [ 366.660900][ T31] ? __pfx_write_threads+0x10/0x10 [ 366.660921][ T31] nfsctl_transaction_write+0x106/0x1a0 [ 366.660944][ T31] vfs_write+0x2aa/0x1050 [ 366.660964][ T31] ? __pfx_nfsctl_transaction_write+0x10/0x10 [ 366.660984][ T31] ? lock_acquire+0x1d1/0x380 [ 366.661002][ T31] ? __fget_files+0x34/0x3d0 [ 366.661024][ T31] ? __pfx_vfs_write+0x10/0x10 [ 366.661041][ T31] ? find_held_lock+0x2b/0x80 [ 366.661064][ T31] ? __fget_files+0x215/0x3d0 [ 366.661089][ T31] ? __fget_files+0x21f/0x3d0 [ 366.661118][ T31] ksys_write+0x12a/0x250 [ 366.661150][ T31] ? __pfx_ksys_write+0x10/0x10 [ 366.661176][ T31] do_syscall_64+0x123/0x790 [ 366.661203][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 366.661221][ T31] RIP: 0033:0x7f956f99e159 [ 366.661237][ T31] RSP: 002b:00007f95708d9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 366.661255][ T31] RAX: ffffffffffffffda RBX: 00007f956fc26090 RCX: 00007f956f99e159 [ 366.661268][ T31] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 366.661279][ T31] RBP: 00007f956fa3506b R08: 0000000000000000 R09: 0000000000000000 [ 366.661289][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 366.661300][ T31] R13: 00007f956fc26128 R14: 00007f956fc26090 R15: 00007ffdc4c3a4e8 [ 366.661332][ T31] [ 366.661341][ T31] INFO: task syz.5.1644:10523 blocked for more than 143 seconds. [ 366.661357][ T31] Tainted: G L syzkaller #0 [ 366.661367][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 366.661375][ T31] task:syz.5.1644 state:D stack:27944 pid:10523 tgid:10521 ppid:6856 task_flags:0x400140 flags:0x00080002 [ 366.661431][ T31] Call Trace: [ 366.661437][ T31] [ 366.661446][ T31] __schedule+0x1259/0x6920 [ 366.661467][ T31] ? __lock_acquire+0x5c0/0x1f40 [ 366.661489][ T31] ? do_raw_spin_lock+0x128/0x260 [ 366.661515][ T31] ? lock_acquire+0x1d1/0x380 [ 366.661534][ T31] ? __pfx___schedule+0x10/0x10 [ 366.661554][ T31] ? find_held_lock+0x2b/0x80 [ 366.661578][ T31] ? schedule+0x225/0x2c0 [ 366.661602][ T31] schedule+0xdd/0x2c0 [ 366.661622][ T31] schedule_preempt_disabled+0x13/0x30 [ 366.661642][ T31] __mutex_lock+0xccb/0x1bd0 [ 366.661665][ T31] ? write_ports+0xa5/0xcc0 [ 366.661686][ T31] ? nfsctl_transaction_write+0xcd/0x1a0 [ 366.661706][ T31] ? ksys_write+0x12a/0x250 [ 366.661723][ T31] ? do_syscall_64+0x123/0x790 [ 366.661749][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 366.661785][ T31] ? __lock_acquire+0x5c0/0x1f40 [ 366.663336][ T31] ? write_ports+0xa5/0xcc0 [ 366.663362][ T31] write_ports+0xa5/0xcc0 [ 366.663385][ T31] ? __pfx_write_ports+0x10/0x10 [ 366.663407][ T31] ? lock_acquire+0x1d1/0x380 [ 366.663425][ T31] ? __might_fault+0xc5/0x140 [ 366.663451][ T31] ? find_held_lock+0x2b/0x80 [ 366.663475][ T31] ? __might_fault+0xc5/0x140 [ 366.663499][ T31] ? __might_fault+0xc5/0x140 [ 366.663528][ T31] ? __pfx_write_ports+0x10/0x10 [ 366.663552][ T31] ? _copy_from_user+0x59/0xd0 [ 366.663575][ T31] ? __pfx_write_ports+0x10/0x10 [ 366.663596][ T31] nfsctl_transaction_write+0x106/0x1a0 [ 366.663620][ T31] vfs_write+0x2aa/0x1050 [ 366.663639][ T31] ? __pfx_nfsctl_transaction_write+0x10/0x10 [ 366.663660][ T31] ? lock_acquire+0x1d1/0x380 [ 366.663677][ T31] ? __fget_files+0x34/0x3d0 [ 366.663700][ T31] ? __pfx_vfs_write+0x10/0x10 [ 366.663716][ T31] ? find_held_lock+0x2b/0x80 [ 366.663741][ T31] ? __fget_files+0x215/0x3d0 [ 366.663767][ T31] ? __fget_files+0x21f/0x3d0 [ 366.663796][ T31] ksys_write+0x12a/0x250 [ 366.663813][ T31] ? __pfx_ksys_write+0x10/0x10 [ 366.663837][ T31] do_syscall_64+0x123/0x790 [ 366.663864][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 366.663885][ T31] RIP: 0033:0x7f7237f9e159 [ 366.663901][ T31] RSP: 002b:00007f7238d84028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 366.663919][ T31] RAX: ffffffffffffffda RBX: 00007f7238225fa0 RCX: 00007f7237f9e159 [ 366.663932][ T31] RDX: 0000000000000009 RSI: 0000200000000240 RDI: 0000000000000003 [ 366.663943][ T31] RBP: 00007f723803506b R08: 0000000000000000 R09: 0000000000000000 [ 366.663953][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 366.663964][ T31] R13: 00007f7238226038 R14: 00007f7238225fa0 R15: 00007ffcf44bdbd8 [ 366.663990][ T31] [ 366.663998][ T31] INFO: task syz.5.1644:10528 blocked for more than 143 seconds. [ 366.664014][ T31] Tainted: G L syzkaller #0 [ 366.664025][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 366.664032][ T31] task:syz.5.1644 state:D stack:27944 pid:10528 tgid:10521 ppid:6856 task_flags:0x400040 flags:0x00080002 [ 366.664086][ T31] Call Trace: [ 366.664092][ T31] [ 366.664102][ T31] __schedule+0x1259/0x6920 [ 366.664124][ T31] ? __lock_acquire+0x5c0/0x1f40 [ 366.664147][ T31] ? do_raw_spin_lock+0x128/0x260 [ 366.664173][ T31] ? lock_acquire+0x1d1/0x380 [ 366.664193][ T31] ? __pfx___schedule+0x10/0x10 [ 366.664212][ T31] ? find_held_lock+0x2b/0x80 [ 366.664237][ T31] ? schedule+0x225/0x2c0 [ 366.664264][ T31] schedule+0xdd/0x2c0 [ 366.664285][ T31] schedule_preempt_disabled+0x13/0x30 [ 366.664342][ T31] __mutex_lock+0xccb/0x1bd0 [ 366.664366][ T31] ? write_versions+0x9d/0xba0 [ 366.664394][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 366.664422][ T31] ? __lock_acquire+0x5c0/0x1f40 [ 366.664444][ T31] ? __lock_acquire+0x5c0/0x1f40 [ 366.664470][ T31] ? write_versions+0x9d/0xba0 [ 366.664492][ T31] write_versions+0x9d/0xba0 [ 366.664515][ T31] ? find_held_lock+0x2b/0x80 [ 366.664541][ T31] ? __pfx_write_versions+0x10/0x10 [ 366.664566][ T31] ? __pfx_write_versions+0x10/0x10 [ 366.664592][ T31] ? _copy_from_user+0x59/0xd0 [ 366.664614][ T31] ? __pfx_write_versions+0x10/0x10 [ 366.664635][ T31] nfsctl_transaction_write+0x106/0x1a0 [ 366.707774][ T31] vfs_write+0x2aa/0x1050 [ 366.707806][ T31] ? __pfx_nfsctl_transaction_write+0x10/0x10 [ 366.715859][ T31] ? lock_acquire+0x1d1/0x380 [ 366.715889][ T31] ? __fget_files+0x34/0x3d0 [ 366.715911][ T31] ? __pfx_vfs_write+0x10/0x10 [ 366.715928][ T31] ? find_held_lock+0x2b/0x80 [ 366.715952][ T31] ? __fget_files+0x215/0x3d0 [ 366.715976][ T31] ? __fget_files+0x21f/0x3d0 [ 366.716003][ T31] ksys_write+0x12a/0x250 [ 366.716020][ T31] ? __pfx_ksys_write+0x10/0x10 [ 366.716089][ T31] do_syscall_64+0x123/0x790 [ 366.716116][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 366.716134][ T31] RIP: 0033:0x7f7237f9e159 [ 366.716149][ T31] RSP: 002b:00007f72361f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 366.716167][ T31] RAX: ffffffffffffffda RBX: 00007f7238226090 RCX: 00007f7237f9e159 [ 366.716178][ T31] RDX: 0000000000000006 RSI: 0000200000000180 RDI: 0000000000000004 [ 366.716189][ T31] RBP: 00007f723803506b R08: 0000000000000000 R09: 0000000000000000 [ 366.716200][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 366.716211][ T31] R13: 00007f7238226128 R14: 00007f7238226090 R15: 00007ffcf44bdbd8 [ 366.716235][ T31] [ 366.716243][ T31] INFO: task syz.5.1644:10529 blocked for more than 143 seconds. [ 366.716259][ T31] Tainted: G L syzkaller #0 [ 366.716269][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 366.716276][ T31] task:syz.5.1644 state:D stack:27944 pid:10529 tgid:10521 ppid:6856 task_flags:0x400040 flags:0x00080002 [ 366.716442][ T31] Call Trace: [ 366.716448][ T31] [ 366.716458][ T31] __schedule+0x1259/0x6920 [ 366.716479][ T31] ? __lock_acquire+0x5c0/0x1f40 [ 366.716502][ T31] ? do_raw_spin_lock+0x128/0x260 [ 366.716527][ T31] ? lock_acquire+0x1d1/0x380 [ 366.716546][ T31] ? __pfx___schedule+0x10/0x10 [ 366.716565][ T31] ? find_held_lock+0x2b/0x80 [ 366.716588][ T31] ? schedule+0x225/0x2c0 [ 366.716611][ T31] schedule+0xdd/0x2c0 [ 366.716631][ T31] schedule_preempt_disabled+0x13/0x30 [ 366.717194][ T31] __mutex_lock+0xccb/0x1bd0 [ 366.717219][ T31] ? write_threads+0x288/0x600 [ 366.717247][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 366.717271][ T31] ? simple_strntoull+0xdf/0x170 [ 366.717291][ T31] ? net_generic+0x25/0x2a0 [ 366.717312][ T31] ? net_generic+0xea/0x2a0 [ 366.717332][ T31] ? net_generic+0xea/0x2a0 [ 366.717357][ T31] ? write_threads+0x288/0x600 [ 366.717377][ T31] write_threads+0x288/0x600 [ 366.717401][ T31] ? __pfx_write_threads+0x10/0x10 [ 366.717429][ T31] ? __might_fault+0xc5/0x140 [ 366.717456][ T31] ? __might_fault+0xc5/0x140 [ 366.717489][ T31] ? _copy_from_user+0x59/0xd0 [ 366.717511][ T31] ? __pfx_write_threads+0x10/0x10 [ 366.717534][ T31] nfsctl_transaction_write+0x106/0x1a0 [ 366.717559][ T31] vfs_write+0x2aa/0x1050 [ 366.717579][ T31] ? __pfx_nfsctl_transaction_write+0x10/0x10 [ 366.717602][ T31] ? lock_acquire+0x1d1/0x380 [ 366.717620][ T31] ? __fget_files+0x34/0x3d0 [ 366.717643][ T31] ? __pfx_vfs_write+0x10/0x10 [ 366.717660][ T31] ? find_held_lock+0x2b/0x80 [ 366.717687][ T31] ? __fget_files+0x215/0x3d0 [ 366.717714][ T31] ? __fget_files+0x21f/0x3d0 [ 366.717745][ T31] ksys_write+0x12a/0x250 [ 366.717764][ T31] ? __pfx_ksys_write+0x10/0x10 [ 366.717791][ T31] do_syscall_64+0x123/0x790 [ 366.717825][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 366.717844][ T31] RIP: 0033:0x7f7237f9e159 [ 366.717859][ T31] RSP: 002b:00007f72361d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 366.717876][ T31] RAX: ffffffffffffffda RBX: 00007f7238226180 RCX: 00007f7237f9e159 [ 366.717887][ T31] RDX: 0000000000000002 RSI: 00002000000002c0 RDI: 0000000000000005 [ 366.717898][ T31] RBP: 00007f723803506b R08: 0000000000000000 R09: 0000000000000000 [ 366.717909][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 366.717920][ T31] R13: 00007f7238226218 R14: 00007f7238226180 R15: 00007ffcf44bdbd8 [ 366.719613][ T31] [ 366.720377][ T31] [ 366.720377][ T31] Showing all locks held in the system: [ 366.720386][ T31] locks held by kworker/0:1/10: 3, on CPU#0: [ 366.720439][ T31] #0: ffff88801c0bed40 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 [ 366.720493][ T31] #1: ffffc900000f7d08 ((work_completion)(&(&ssp->srcu_sup->work)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 366.720542][ T31] #2: ffffffff8ef3d628 (&ssp->srcu_sup->srcu_gp_mutex){+.+.}-{4:4}, at: process_srcu+0x77/0x20f0 [ 366.720585][ T31] locks held by pr/ttyS0/16: 2, last CPU#0: [ 366.720598][ T31] #0: ffffffff8edd87b8 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x49/0x60 [ 366.720640][ T31] #1: ffffffff9bc6bc78 (&port_lock_key){-.-.}-{3:3}, at: univ8250_console_device_lock+0x64/0xc0 [ 366.720689][ T31] locks held by khungtaskd/31: 1, last CPU#1: [ 366.720701][ T31] #0: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 [ 366.720771][ T31] locks held by getty/5359: 2, on CPU#1: [ 366.720783][ T31] #0: ffff8880347940a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 366.720827][ T31] #1: ffffc9000321e2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0 [ 366.720884][ T31] locks held by syz.1.1502/10173: 3, on CPU#1: [ 366.720896][ T31] #0: ffff88807d8b97b0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 366.720939][ T31] #1: ffff888077b86460 (sb_writers#30){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 366.720981][ T31] #2: ffffffff8f289500 (nfsd_mutex){+.+.}-{4:4}, at: write_ports+0xa5/0xcc0 [ 366.721024][ T31] locks held by syz.7.1542/10274: 3, on CPU#1: [ 366.721035][ T31] #0: ffff88807da509b0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 366.721077][ T31] #1: ffff88807b406460 (sb_writers#30){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 366.721119][ T31] #2: ffffffff8f289500 (nfsd_mutex){+.+.}-{4:4}, at: write_ports+0xa5/0xcc0 [ 366.721176][ T31] locks held by syz.7.1542/10277: 3, on CPU#0: [ 366.721188][ T31] #0: ffff88807a5a1970 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 366.721229][ T31] #1: ffff88807b406460 (sb_writers#30){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 366.721270][ T31] #2: ffffffff8f289500 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nrthreads+0x57/0xd0 [ 366.721308][ T31] locks held by syz.5.1644/10523: 3, on CPU#1: [ 366.721320][ T31] #0: ffff88807a7095f0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 366.721362][ T31] #1: ffff888031e7c460 (sb_writers#30){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 366.721403][ T31] #2: ffffffff8f289500 (nfsd_mutex){+.+.}-{4:4}, at: write_ports+0xa5/0xcc0 [ 366.721443][ T31] locks held by syz.5.1644/10528: 3, on CPU#0: [ 366.721455][ T31] #0: ffff8880548cf5f0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 366.722451][ T31] #1: ffff888031e7c460 (sb_writers#30){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 366.722494][ T31] #2: ffffffff8f289500 (nfsd_mutex){+.+.}-{4:4}, at: write_versions+0x9d/0xba0 [ 366.722535][ T31] locks held by syz.5.1644/10529: 3, on CPU#1: [ 366.722547][ T31] #0: ffff88807a5b5970 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 366.722902][ T31] #1: ffff888031e7c460 (sb_writers#30){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 366.722943][ T31] #2: ffffffff8f289500 (nfsd_mutex){+.+.}-{4:4}, at: write_threads+0x288/0x600 [ 366.723753][ T31] locks held by syz-executor/11019: 1, on CPU#1: [ 366.723766][ T31] #0: ffffffff8edf83a8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 [ 366.723818][ T31] locks held by syz.9.2524/13278: 3, on CPU#0: [ 366.723830][ T31] #0: ffff888058d96ef0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 366.723872][ T31] #1: ffff888086398460 (sb_writers#30){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 366.723914][ T31] #2: ffffffff8f289500 (nfsd_mutex){+.+.}-{4:4}, at: write_versions+0x9d/0xba0 [ 366.723956][ T31] locks held by syz.9.2524/13279: 3, on CPU#0: [ 366.723967][ T31] #0: ffff8880523dab70 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 366.724009][ T31] #1: ffff888086398460 (sb_writers#30){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 366.724049][ T31] #2: ffffffff8f289500 (nfsd_mutex){+.+.}-{4:4}, at: write_ports+0xa5/0xcc0 [ 366.724091][ T31] locks held by syz.9.2524/13280: 3, on CPU#1: [ 366.724102][ T31] #0: ffff888022b47270 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 366.724144][ T31] #1: ffff888086398460 (sb_writers#30){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 366.724185][ T31] #2: ffffffff8f289500 (nfsd_mutex){+.+.}-{4:4}, at: write_threads+0x288/0x600 [ 366.724230][ T31] locks held by syz.1.2976/15038: 2, last CPU#0: [ 366.724241][ T31] #0: ffff88807b265cf8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x124/0xa00 [ 366.724283][ T31] #1: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x310 [ 366.724324][ T31] locks held by syz.2.2989/15076: 1, on CPU#1: [ 366.724335][ T31] #0: ffffffff8edf83a8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 [ 366.724374][ T31] [ 366.724378][ T31] ============================================= [ 366.724378][ T31] [ 366.724386][ T31] NMI backtrace for cpu 1 [ 366.724399][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 366.724422][ T31] Tainted: [L]=SOFTLOCKUP [ 366.724428][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 366.724437][ T31] Call Trace: [ 366.724443][ T31] [ 366.724450][ T31] dump_stack_lvl+0x100/0x190 [ 366.724475][ T31] nmi_cpu_backtrace.cold+0x12d/0x151 [ 366.724500][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 366.724521][ T31] nmi_trigger_cpumask_backtrace+0x21f/0x2a0 [ 366.724542][ T31] sys_info+0x141/0x190 [ 366.724558][ T31] watchdog+0xcb1/0x1030 [ 366.724582][ T31] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 366.724603][ T31] ? __pfx_watchdog+0x10/0x10 [ 366.724622][ T31] ? __kthread_parkme+0x18f/0x230 [ 366.724645][ T31] ? kthread+0x13a/0x450 [ 366.724667][ T31] ? __pfx_watchdog+0x10/0x10 [ 366.724684][ T31] kthread+0x373/0x450 [ 366.724706][ T31] ? __pfx_kthread+0x10/0x10 [ 366.724732][ T31] ret_from_fork+0x730/0xd60 [ 366.724753][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 366.724772][ T31] ? __switch_to+0x800/0x10f0 [ 366.724795][ T31] ? __pfx_kthread+0x10/0x10 [ 366.724824][ T31] ret_from_fork_asm+0x1a/0x30 [ 366.724852][ T31] [ 366.724873][ T31] Sending NMI from CPU 1 to CPUs 0: [ 366.724896][ C0] NMI backtrace for cpu 0 [ 366.724909][ C0] CPU: 0 UID: 0 PID: 16 Comm: pr/ttyS0 Tainted: G L syzkaller #0 PREEMPT(full) [ 366.724929][ C0] Tainted: [L]=SOFTLOCKUP [ 366.724935][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 366.724943][ C0] RIP: 0010:io_serial_in+0x87/0xb0 [ 366.724961][ C0] Code: 48 5b fc 48 8d 7d 40 44 89 e1 48 b8 00 00 00 00 00 fc ff df 48 89 fa d3 e3 48 c1 ea 03 80 3c 02 00 75 1a 66 03 5d 40 89 da ec <5b> 0f b6 c0 5d 41 5c c3 cc cc cc cc e8 48 8b ce fc eb a2 e8 d1 8b [ 366.724975][ C0] RSP: 0018:ffffc90000157958 EFLAGS: 00000002 [ 366.724987][ C0] RAX: dffffc0000000000 RBX: 00000000000003fd RCX: 0000000000000000 [ 366.724996][ C0] RDX: 00000000000003fd RSI: ffffffff85b0d710 RDI: ffffffff9bc6bca0 [ 366.725006][ C0] RBP: ffffffff9bc6bc60 R08: 0000000000000001 R09: 000000000000001f [ 366.725015][ C0] R10: 0000000000000000 R11: 205d313354202020 R12: 0000000000000000 [ 366.725025][ C0] R13: 0000000000000020 R14: fffffbfff378d7e9 R15: dffffc0000000000 [ 366.725035][ C0] FS: 0000000000000000(0000) GS:ffff888123b59000(0000) knlGS:0000000000000000 [ 366.725050][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 366.725060][ C0] CR2: 00007f4a63dd3a6d CR3: 000000005713c000 CR4: 00000000003526f0 [ 366.725070][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000001800 [ 366.725079][ C0] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 366.725088][ C0] Call Trace: [ 366.725093][ C0] [ 366.725099][ C0] wait_for_lsr+0x13a/0x210 [ 366.725118][ C0] serial8250_fifo_wait_for_lsr_thre+0x5f/0xd0 [ 366.725136][ C0] __serial8250_console_fifo_write+0xa5/0x290 [ 366.725153][ C0] ? __pfx_io_serial_out+0x10/0x10 [ 366.725171][ C0] serial8250_console_write+0xf46/0x1330 [ 366.725195][ C0] ? __pfx_serial8250_console_write+0x10/0x10 [ 366.725217][ C0] ? __nbcon_context_update_unsafe+0x1b6/0x220 [ 366.725244][ C0] ? __pfx___nbcon_context_update_unsafe+0x10/0x10 [ 366.725274][ C0] nbcon_emit_next_record+0x8f7/0xa70 [ 366.725293][ C0] ? __pfx_nbcon_emit_next_record+0x10/0x10 [ 366.725316][ C0] ? nbcon_context_try_acquire+0x3a6/0xc60 [ 366.725341][ C0] ? do_raw_spin_lock+0x30/0x260 [ 366.725364][ C0] ? __pfx___cant_migrate+0x10/0x10 [ 366.725386][ C0] ? _raw_spin_lock_irqsave+0x42/0x60 [ 366.725405][ C0] nbcon_emit_one+0x1a8/0x2b0 [ 366.725419][ C0] ? __pfx_nbcon_emit_one+0x10/0x10 [ 366.725437][ C0] nbcon_kthread_func+0x613/0x7d0 [ 366.725456][ C0] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 366.725478][ C0] ? __kthread_parkme+0x18f/0x230 [ 366.725499][ C0] ? kthread+0x13a/0x450 [ 366.725520][ C0] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 366.725536][ C0] kthread+0x373/0x450 [ 366.725558][ C0] ? __pfx_kthread+0x10/0x10 [ 366.725581][ C0] ret_from_fork+0x730/0xd60 [ 366.725599][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 366.725618][ C0] ? __switch_to+0x800/0x10f0 [ 366.725640][ C0] ? __pfx_kthread+0x10/0x10 [ 366.725663][ C0] ret_from_fork_asm+0x1a/0x30 [ 366.725687][ C0] [ 366.732456][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 368.952439][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 368.963118][ T31] Tainted: [L]=SOFTLOCKUP [ 368.967436][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 368.977565][ T31] Call Trace: [ 368.980826][ T31] [ 368.983739][ T31] dump_stack_lvl+0x100/0x190 [ 368.988430][ T31] vpanic+0x553/0x970 [ 368.992398][ T31] ? __pfx_vpanic+0x10/0x10 [ 368.996889][ T31] panic+0xd1/0xe0 [ 369.000592][ T31] ? __pfx_panic+0x10/0x10 [ 369.004997][ T31] ? nmi_trigger_cpumask_backtrace+0x263/0x2a0 [ 369.011138][ T31] ? nmi_trigger_cpumask_backtrace+0x26d/0x2a0 [ 369.017274][ T31] ? watchdog.cold+0x1ec/0x234 [ 369.022025][ T31] watchdog.cold+0x1fd/0x234 [ 369.026601][ T31] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 369.032392][ T31] ? __pfx_watchdog+0x10/0x10 [ 369.037053][ T31] ? __kthread_parkme+0x18f/0x230 [ 369.042065][ T31] ? kthread+0x13a/0x450 [ 369.046293][ T31] ? __pfx_watchdog+0x10/0x10 [ 369.050952][ T31] kthread+0x373/0x450 [ 369.055010][ T31] ? __pfx_kthread+0x10/0x10 [ 369.059594][ T31] ret_from_fork+0x730/0xd60 [ 369.064190][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 369.069292][ T31] ? __switch_to+0x800/0x10f0 [ 369.073970][ T31] ? __pfx_kthread+0x10/0x10 [ 369.078634][ T31] ret_from_fork_asm+0x1a/0x30 [ 369.083403][ T31] [ 369.086612][ T31] Kernel Offset: disabled [ 369.090915][ T31] Rebooting in 86400 seconds..