last executing test programs: 7.714016649s ago: executing program 4 (id=70): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) add_key(0x0, 0x0, &(0x7f0000000ac0)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4ab59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203000001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817f7ffe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa3bfac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f", 0x554, 0xfffffffffffffffd) ioctl(r2, 0x4048aecb, &(0x7f0000001000)="070000000000000001000000ffffffff") 7.677929208s ago: executing program 4 (id=71): r0 = openat$khugepaged_scan(0xffffffffffffff9c, &(0x7f00000003c0), 0x1, 0x0) write$khugepaged_scan(r0, &(0x7f0000000440), 0x8) 7.615124665s ago: executing program 4 (id=73): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000980)=@newtaction={0x20c, 0x30, 0x871a15abc695f91d, 0x0, 0x0, {}, [{0x1f8, 0x1, [@m_tunnel_key={0xbc, 0x17, 0x0, 0x0, {{0xf}, {0x38, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e22}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}, @TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0xe, 0x92db, 0x3, 0x6, 0x2}, 0x2}}, @TCA_TUNNEL_KEY_NO_CSUM={0x5, 0xa, 0x1}]}, {0x55, 0x6, "b36c9360a687b7b48dab4646d9ca683e6f662cdd59e47700fe58c607f2e1944e6d769925ab9d591039d5e685ae47c195900d58202e5b7c9f7144b2ec9b078940184666c5cf7d3e11408e96ff85bc8b3529"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_xt={0x9c, 0xb, 0x0, 0x0, {{0x7}, {0x5c, 0x2, 0x0, 0x1, [@TCA_IPT_TABLE={0x24, 0x1, 'nat\x00'}, @TCA_IPT_TABLE={0x24, 0x1, 'mangle\x00'}, @TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_HOOK={0x8}]}, {0x19, 0x6, "b0c788834491db917a9a992c9833c17cff3b436365"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x2}}}}, @m_mirred={0x9c, 0x13, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x8, 0x1, 0x20000000, 0x4, 0xcb8c}, 0x4}}]}, {0x4d, 0x6, "a611650f26be9cd7202da28cac16d8d11fdb771f20ce375a34e3dba9f39705a673d73efe471bb4fd0d2fbed092b7ee194fceec6f36a9fd75fe5dedc20749c4f127768202979a913d3c"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}]}]}, 0x20c}}, 0x20000000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000080)={0x29, 0x0, [{0x296, 0x0, 0x2}]}) 7.566470228s ago: executing program 4 (id=77): syz_mount_image$exfat(&(0x7f00000000c0), &(0x7f0000000080)='./file0\x00', 0x80a, &(0x7f0000000340)=ANY=[@ANYBLOB='iocharset=cp437,fmask=00000000000000000000315,errors=remount-ro,umask=00000000000000000000177,errors=remount-ro,umask=00000000000000000001775,gid=', @ANYRESHEX=0x0, @ANYBLOB="2c696f636861727365743d63703933362c666d61736b3d30303030303030303030303030303030303030303030312c005e78aae2dff810901336831a8ac30acbcd22a575ef96"], 0x5, 0x1516, &(0x7f00000037c0)="$eJzs3AuYTlX7MPD7XmvtMSQ9TXIY1lr35kkOyyRJDknlkCRJkuSUmKRJXklIDDklDUlIDkNyGEJymJg0zufzMUmSJklCckrWd03xeXur7/2//7fv9b/+c/+ua1/Pup+177XXfu7nsPZ2+LbL0FpNat/ViIjg34K/PiQDQCwADASAawAgAIAKcRXisvtzS0z+9w7C/loPp13pGbArieufs3H9czauf87G9c/ZuP45G9c/Z+P652xcf8Zyss3TC1/LW87d+P5/Tsa///+LZJUd++Xastd3/RdSuP45G9f/f63gv7IT1z9n4/rnbFz/nI3rnxPk+tMern/OxvVnLCe70vef/2GLgSs/hxy1Xen3H2OMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4yxnOGMv0wBwKX2lZ4XY4wxxhhjjDHG/jo+15WeAWOMMcYYY4wxxv7/QxAgQUEAMZALYiE35AEBAFdDPrgGInAtxMF1kB+uhwJQEApBYYiHIlAUNBiwQBBCMSgOUbgBSsCNUBJKQWkoAw7KQgLcBOXgZigPt0AFuBUqwm1QCSpDFagKt0M1uAOqw51wF9wNNaAm1ILacA/UgXuhLtwH9eB+qA8PQAN4EBrCQ9AIHobG8Ag0gUehKTwGzaA5tICW0Oq/lf8i9ICXoCf0gmToDX3gZegL/aA/DICB8AoMgldhMLwGKTAEhsLrMAzegOHwJoyAkTAK3oLR8DaMgbEwDsZDKkyAifAOTIJ3YTJMgakwDdJgOsyA92AmzILZ8D7MgQ9gLsyD+bAA0uFDWAiLIAM+gsXwMWTCElgKy2A5rICVsApWwxpYC+tgPWyAjbAJNsMW2ArbYDvsgJ2wC3bDJ7AHPoW98Bnsg8//xfzT/5DfFQEBBQpUqDAGYzAWYzEP5sG8mBfzYT6MYATjMA7zY34sgAWwEBbCeIzHolgUDRokJCyGxTCKUSyBJbAklsTSWBodOkzABCyHN2N5LI8VsAJWxIpYCStjZayKVbEaVsPqWB3vwruwBtbAWlgL78F7sDfWxbpYD+thfax/6fYUNsJG2BgbYxNsgk2xKTbDZtgCW2ArbIWtsTW2wTaYiInYDtthe2yPSZiEHbADdsSO2Ak7YWfsjF2wC3bFbtgNX8wF+BK+hL2whuiNfbAP9sWUXP1xAA7AV3AQvoqv4muYgkNwKL6Or+MbOBxP4QgciaNwFFYTb+MYHIskxmMqpuJEnIiTcBJOxik4BadhGk7HGTgDZ+IsnIXv4xz8AD/AeTgPF2A6puNCXIQZmIGL8TRm4hJcistwOa7A5bgKV+MqXIvrcC1uwA24CTfhFtyC23Ab7sAduAsVAH6Cn+KnmIL7cB/ux/14AA/gQTyIWZiFh/AQHsbDeASP4FE8isfwOJ7A43gST+IpPI1n8Ayew3N4Hp+P/7rxrlJrUkBkU0KJGBEjYkWsyCPyiLwir8gn8omIiIg4ESfyi/yigCggColCIl7Ei6KiqDDCCBJhDACIqIiKEqKEKClKitKitHDCiQSRIMqJcqK8KC8qiFtFRXGbqCQqi7auqqgqqolEV13cKe4Sd4kaoqaoJWqL2qKOqCPqirqinqgn6ov6ooF4UDQUvbE/PiyyK9NEDMGmYig2E82FvPgN1loMxzairUgUT4qROALbi9YuSTwjOogx2FH8TYzF50RnMR67iBdEV9FNdBcvih6ijespeonJ2Fv0EdOwr+gn+osBYibWFO/jnNy1xGsiRQwRQ8XrYgG+IYaLN8UIMVKMEm+J0eJtMUaMFePEeJEqJoiJ4h0xSbwrJospYqqYJtLEdDFDvCdmillitnhfzBEfiLlinpgvFoh08aFYKBaJDPGRWCw+FpliiVgqlonlYoVYKVaJ1WKNWCvWifVig9goNonNYovYKraJ7WKH2Cl2id3iE7FHfCr2is/EPvG52C++EAfEl+Kg+Epkia/FIfGNOCy+FUfEd+Ko+F4cE8fFCfGDOCl+FKfEaXFGnBXnxE/ivPhZXBBegEQppJRKBjJG5pKxMrfMI6+SeWVw8dW9VsbJ62R+eb0sIAvKQrKwjJdFZFGppZFWkgxlMVlcRuUNsoS8UZaUpWRpWUY6WVYmyJtkOXmzLC9vkRXkrbKivE1WkpVlFVlV3i6ryTskRH49Rg1ZU9aSteU9so68V9aV98l68n5ZXz4gG8gHZUP5kGwkH5aN5SOyiXxUNpWPyWayuWwhW8pW8nHZWj4h28i2MlE+KdvJp2R7+bRMks/IDtJffIs8JzvL52UX+YLsKrvJ7vJneUF62VP2kgC9ZR/5suwr+8n+coAcKF+Rg+SrcrB8TabIIXKofF0Ok2/I4fJNOUKOlKPkW3K0fFuOkWPlODlepsoJcqJ8R06S78rJcoqcKqfJNDld9r840mwp/2n+O3+QP/iXo2+Sm+UWuVVuk9vlDrlT7pK75W65R+6Re+VeuU/uk/vlfnlAHpAH5UGZJbPkIXlIHpaH5RF5RB6VR+UxeVyelT/Ik/JHeUqelqflWXlOnpPnL74GoFAJJZVSgYpRuVSsyq3yqKtUXnW1yqeuURF1rYpT16n86npVQBVUhVRhFa+KqKJKK6OsIhWqYqq4iqob8OIbRpVWZZRTZVWCuulfyVcl1I2qpCr1m/xL80v+k/m1Uq1Ua9VatVFtVKJKVO1UO9VetVdJKkl1UB1UR9VRdVKdVGfVWXVRXVRX1VV1V91VD9VD9VQ9VbJKVn3Uy6qv6qf6qwFqoHpFDVKD1GA1WKWoFDVUDVXD1DA1XA1XI9QINUqNUqPVaDVGjVHj1DiVqlLVRDVRTVKT1GQ1WU1VU1WaSlMz1Aw1U81Us9VsNUfNUXPVXDVfzVfpKl0tVAtVhspQi9VilamWqCVqmVqmVqgVapVapdaoNWqdWqc2qA0qU21Wm9VWtVVtV9vVTrVT7Va71R61R+1Ve9U+tU/tV/vVAXVAHVQHVZbKUofUIXVYHVZH1BF1VB1Vx9QxdUKdUCfVSXVKnVJn1Bl1Tp1T59V5dUFdyF72BSIQgQpUEBPEBLFBbJAnyBPkDfIG+YJ8QSSIBHFBXJA/uD4oEBQMCgWFg/igSFA00IEJbCAuFj0a3BCUCG4MSgalgtJBmcAFZYOE4KagXHBzUD64JagQ3BpUDG4LKgWVgypB1eD2oFpwR1A9uDO4K7g7qBHUDGoFtYN7gjrBvUHd4L6gXnB/UD94IGgQPBg0DB4KGgUPB42DR4ImwaNB0+CxoFnQPGgRtAxa/aXje3+q4BOup+6lk3Vv3Ue/rPvqfrq/HqAH6lf0IP2qHqxf0yl6iB6qX9fD9Bt6uH5Tj9Aj9Sj9lh6t39Zj9Fg9To/XqXqCnqjf0ZP0u3qynqKn6mk6TU/XM/R7eqaepWfr9/Uc/YGeq+fp+XqBTtcf6oV6kc7QH+nF+mOdqZfopXqZXq5X6JV6lV6t1+i1ep1erzfojXqT3qy36K16m96ud+idepferT/Re/Sneq/+TO/Tn+v9+gt9QH+pD+qvdJb+Wh/S3+jD+lt9RH+nj+rv9TF9XJ/QP+iT+kd9Sp/WZ/RZfU7/pM/rn/UF7bMX99k/70YZZWJMjIk1sSaPyWPymrwmn8lnIiZi4kycyW/ymwKmgClkCpl4E2+KmqImGxkyxUwxEzVRU8KUMCVNSVPalDbOOJNgEkw5U86UN+VNBVPBVDQVTSVTyVQxVczt5nZzh7nD3GnuNHebu01NU9PUNrVNHVPH1DV1TT1Tz9Q39U0D08A0NA1NI9PINDaNTRPTxDQ1TU0z08y0MC1MK9PKtDatTRvTxiSaRNPOtDPtTXuTZJJMB9PBdDQdTSfTyXQ2nU0X08V0NV1Nd9Pd9DA9TE/T0ySbZNPH9DF9TV/T3/Q3A81AM8gMMoPNYJNiUsxQM9QMM8PMcDPcjDAjzajshap524wxY804M96kmlQz0Uw0k8wkM9lMNlPNVJNm0swMM8PMNDPNbDPbzDFzzFwz18w38026STcLzUKTYTLMYrPYZJpMs9QsNcvNcrPSrDSrzWqz1qw162G92Wg2ms1ms9lqtprtZrvZaXaa3Wa32WP2mL1mr9ln9pn9Zr85YA6Yg+agyTJZ5pA5ZA6bw+aIOWKOmqPmmDlmTpgT5qQ5aU6ZU+aMOWPOmYIXfy+9ibW5bR57lc1rr7b57DX2H+NCtrCNt0VsUattAVvwN7Gx1pa0pWxpW8Y6W9Ym2Jt+F1eylW0VW9XebqvZO2z138V17L22rr3P1rP329r2nt/E9e0DtoF91DZEBLDNbWPb0jaxj9qm9jHbzDa3LWxL284+Zdvbp22SfcZ2sM/+Ll5oF9nVdo1da9fZPfZTe8aetYftt/ac/cn2tL3sQPuKHWRftYPtazbFDvldPMq+ZUfbt+0YO9aOs+N/F0+102yanW5n2PfsTDvrd3G6/dDOsRl2rp1n59sFv8TZc8qwH9nF9mObaZfYpXaZXW5X2JV21f+d6zK7wW60m+xu+4ndarfZ7XaH3Wl3/RJnn8de+5ndZz+3h+w39oD90h60R2yW/fqXOPv8jtjv7FH7vT1mj9sT9gd70v5oT9nTv5x/9rn/YH+2F6y3QEhAkhQFFEO5KJZyUx66ivLS1ZSPrqEIXUtxdB3lp+upABWkQlSY4qkIFSVNhiwRhVSMilOUbqBL6/TSVIYclaUEuonK0c1Unm6hCnQrVaTbqBJVpipUlW6nanQHVac76S66m2pQTapFtekeqkP3Ul26j+rR/VSfHqAG9CA1pIeoET1MjekRakKPUlN6jJpRc2pBLakVPU6t6QlqQ20pkZ6kdvQUtaenKYmeoQ70LHWkv1Eneo460/PUhV6grtSNutOL1INeop7Ui5KpN/Whl6kv9aP+NIAG0is0iF6lwfQapdAQGkqv0zB6g4bTmzSCRtIoeotG09s0hsbSOBpPqTSBJtI7NInepck0habSNEqj6TSD3qOZNItm0/s0hz6guTSP5tMCSqcPaSEtogz6iBbTx5RJS2gpLaPltIJW0ipaTWtoLa2j9bSBNtIm2kxbaCtto+20g3bSLtpNn9Ae+pT20me0jz6n/fQFHaAv6SB9RVn0NR2ib+gwfUtH6Dvfi76nY3ScTtAPdJJ+pFN0ms7QWTpHP9F5+pkukCcIMRShDFUYhDFhrjA2zB3mCa8K84ZXh/nCa8JIeG0YF14X5g+vDwuEBcNCYeEwPiwSFg11aEIbUhiGxcLiYTS8ISwR3hiWDEuFpcMyoQvLhgnhTWG58OawfHhLWCG8NawY3hZWCiuHj95fNbw9rBbeEVYP7wwTw7vDGmHNsFZYO7wnrBPeG9YN7wvrhfeH5cMHwgbhg2HD8KGwUfhw2Dh8JGwSPho2DR8Lm4XNwxZhy7BV+HjYOnwibBO2DRPDJ8N24VNh+/DpMCl8JuwQPvtL/wOL/rw/Oewd9glfDl8Ovb9Pzo8uiKZHP4wujC6KZkQ/ii6OfhzNjC6JLo0uiy6ProiujK6Kro6uia6Nrouuj26IboxuinpfOxc4dMJJp1zgYlwuF+tyuzzuKpfXXe3yuWtcxF3r4tx1Lr+73hVwBV0hV9jFuyKuqNPOOOvIha6YK+6i7gZXwt3oSrpSrrQr45wr6xJcS9fKtXKt3ROujWvrEt2T7kn3lHvKPe2eds+4Du5Z19H9zXVyz7nO7nn3vHvBdXXdXHf3ouvhJuT79TOZ7Pq4Pq6v6+v6u/5uoBvoBrlBbrAb7FJcihvqhrphbpgb7oa7EW6EG+VGudFutBvjxrhxbpxLdaluopvoJrlJbrKb7Ka6qS7NpbkZboab6Wa6arN+PcpcN9fNd/Ndukt3C132mjHDLXaLXabLdEvdUrfcLXcr3Uq32q12a91at96tdxvdRrfZbXZb3Va33W13O91Ot9vtdnv8Nb8O6va5/W6/O+AOuIPuK5flvnaH3DfusPvWHXHfuaPue3fMHXcn3A/upPvRnXKn3Rl31p1zP7nz7md3wXmXGpkQmRh5JzIp8m5kcmRKZGpkWiQtMj0yI/JeZGZkVmR25P3InMgHkbmReZH5kQWR9MiHkYWRRZGMyEeRxZGPI5mRJZGlkWWR5ZEVEe+LbA19MV/cR/0NvoS/0Zf0pXxpX8Y7X9Yn+Jt8OX+zL+9v8RX8rb6iv81X8pV9Ff+Yb+ab+xa+pW/lH/et/RO+jW/rE/2Tvp1/yrf3T/sk/4zv4J/1Hf3ffCf/nO/sn/dd/Au+q+/mu/sXfQ//ku/pe/lk39v38S/7vr6f7+8H+IH+FT/Iv+oH+9d8ih/ih/rX/TD/hh/u3/Qj/Eg/KuYtP/rSJTKM96l+gp/o3/GT/Lt+sp/ip/ppPs1P9zP8e36mn+Vn+/f9HP+Bn+vn+fl+gU/3H/qFfpHP8B/5xf5jn+mXXLqp7Ff6VX61X+PX+nV+vd/gN/pNfrPf4rf6bX673+F3+l1+t//E7/Gf+r3+M7/Pf+73+y/8Af+lP+i/8ln+a3/If+MP+2/9Ef+dP+q/98f8cX/C/+BP+h/9KX/an/Fn/Tn/kz/vf/YX+N+sMcYYY4z9l0y43BR/1N/7D54Tf7dzHwC4elvhrL/vz15Rri/wa7ufiG8XAYBnenV5+NJWo0ZycvLFfTMlBMXnAVz6k6BsMXA5XgKJ8BQkQVso94fz7ye6naN/Mn70VoA8f5cTC5fjy+N/8SfjP/7kqIUVwzNx/4/x5wGULH45JzdcjpdAosp+bAvl/2T8gq3/yfxzf5kK0ObvcvLC5fjy/BPgCXgWkn6zJ2OMMcYYY4wx9qt+okqnS9efl/7G5x9dn8eryzm54HL8z67PGWOMMcYYY4wxduU91637048nJbXt9K83qv+3srjxP7XhPcClZxQA/JsDAvzHz2LLf+RYKRc/Ov/YtfysD+B/Rin/isYV/mJijDHGGGOM/eUuL/p/+7y6UhNijDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcZyoP/Efyd2pc+RMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYu9L+TwAAAP//8SoNew==") r0 = creat(&(0x7f0000000380)='./bus\x00', 0x0) io_setup(0x202, &(0x7f0000000200)=0x0) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000680)='./bus\x00', 0x0, 0x5000, 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x101000, 0x0) ioctl$LOOP_SET_STATUS64(r2, 0x4c04, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x8e18, 0x2, 0x0, 0x0, 0xa, 0xd, "ef359f413bb93852f7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e737ff0edf110ff4117639c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a004", "036c47c6780800d1cbf7966d61f53dc17769048b0000fd0c000000000000000000000000000000000200000000000000000000000000008000", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x8]}) io_submit(r1, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0xe7030003, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x100000, 0x16}]) 7.302141887s ago: executing program 4 (id=88): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=@newlink={0x3c, 0x10, 0x40d, 0x70bd2a, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @gretap={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_FWMARK={0x8, 0x14, 0x1000}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x404c084}, 0x0) 6.459101219s ago: executing program 4 (id=99): r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000001080)) madvise(&(0x7f0000cf6000/0x4000)=nil, 0x4000, 0x16) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f0000000140)={0x60, 0x0, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x4, &(0x7f0000000000)=[{0x800000000, 0x9, 0xffffffbfffffffff}], 0x1, 0x80000001, 0x1e, 0x4, 0x2c, 0x6e}) 6.066536923s ago: executing program 32 (id=99): r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000001080)) madvise(&(0x7f0000cf6000/0x4000)=nil, 0x4000, 0x16) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f0000000140)={0x60, 0x0, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x4, &(0x7f0000000000)=[{0x800000000, 0x9, 0xffffffbfffffffff}], 0x1, 0x80000001, 0x1e, 0x4, 0x2c, 0x6e}) 4.831691568s ago: executing program 0 (id=118): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0) write(r1, &(0x7f0000000280)='external:', 0x9) r2 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0) write(r2, &(0x7f0000000500)='ppl', 0x3) 4.802587886s ago: executing program 0 (id=119): r0 = io_uring_setup(0x78eb, &(0x7f00000000c0)={0x0, 0xc63b, 0x3018, 0x2, 0x1f9}) r1 = epoll_create1(0x80000) epoll_pwait(r1, &(0x7f0000000040)=[{}, {}, {}, {}, {}, {}, {}], 0x7, 0x1f61ce97, 0x0, 0x0) io_uring_enter(r0, 0x0, 0x2, 0xf, &(0x7f0000000000)={[0x2000000]}, 0x18) 4.375498538s ago: executing program 5 (id=100): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)={0x64, r1, 0x40b, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_FRAME={0x42, 0x33, @action={{{0x0, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x28b7}, @device_a, @device_b, @initial, {0x2, 0x4}, @value=@ver_80211n={0x0, 0x6, 0x3, 0x2, 0x0, 0x3, 0x0, 0x0, 0x1}}, @sp_mp_open={0xf, 0x1, {0x20, {}, @void, @val={0x2d, 0x1a, {0x2, 0x2, 0x5, 0x0, {0xfffffffffffffffe, 0x6bc, 0x0, 0x2d0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x6, 0x4, 0xab}}}}}}, @NL80211_ATTR_OFFCHANNEL_TX_OK={0x4}]}, 0x64}, 0x1, 0x0, 0x0, 0x8}, 0x40) 4.353359254s ago: executing program 5 (id=126): r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8000000, 0x3, 0x2f8, 0x110, 0xffffffff, 0xffffffff, 0x110, 0xffffffff, 0x228, 0xffffffff, 0xffffffff, 0x228, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @private1, [0xff000000, 0xffffff00, 0x6dc8f3d6512d1aed, 0xffffffff], [0xff, 0xff000000, 0xff000000], 'bond_slave_0\x00', 'batadv0\x00', {}, {}, 0x2f, 0x2, 0x3, 0xe}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, '\x00', 'syz1\x00'}}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0x17}, @mcast1, [], [], 'veth1\x00', 'wlan1\x00'}, 0x0, 0xa8, 0x118}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x7fffffff, 0x9, 0xb3, 0x1, 0x0, "86d6b549c4bf723e1f33da7c11e5cee0b1adedc05fbfc6af15c3f8b75adf8819ec9d8cd0614114f5f1d3b7ba1d33f3750c2e3b8acf37107767e107dac4688212"}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x358) 4.271130126s ago: executing program 5 (id=127): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x88406, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_X86_SET_MCE(r2, 0x4040ae9e, &(0x7f0000000280)={0xed80000000000000, 0x70000, 0x9, 0x0, 0x2}) 4.228627157s ago: executing program 5 (id=128): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) recvmmsg(r0, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}, 0x10001}, {{0x0, 0x0, 0x0}, 0x8004}, {{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000001500)=""/4097, 0x1001}, {&(0x7f0000000180)=""/83, 0x53}, {&(0x7f0000000400)=""/80, 0x50}], 0x3}, 0x400000}, {{0x0, 0x0, 0x0}}], 0x4, 0x20000, 0x0) 3.820210074s ago: executing program 0 (id=134): r0 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x4000000000000002, 0x0, 0x0) socket$tipc(0x1e, 0x2, 0x0) socket$tipc(0x1e, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) socket$tipc(0x1e, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000020)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000030)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000050)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000060)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000070)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000080)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000090)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000a0)) r1 = socket$tipc(0x1e, 0x5, 0x0) socket$tipc(0x1e, 0x5, 0x0) socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000140)={0x42, 0x1}, 0x10) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000280)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000d0)) r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) write(r2, &(0x7f0000000200)="580000001400010300000000000000001e000000ffffffff00"/88, 0x58) bind$inet6(0xffffffffffffffff, 0x0, 0x0) 3.819896014s ago: executing program 0 (id=135): r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004086800000000000000001090222000101008032090400000103000000092111010001224e0007058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000100)={0x24, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="00224e00000005200973a10185010a19031500250575089501b1020a16031500250575089501b10285020a5304150025057508950181020a5404150025057508950181020a550415002505750895018102c0"], 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/iio/devices/iio:device0/buffer/enable\x00', 0x2, 0x0) write(r1, &(0x7f0000000c80)='0', 0x1) 3.368612263s ago: executing program 5 (id=140): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x304}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001480)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$tun(r1, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) writev(r0, &(0x7f0000000300)=[{&(0x7f00000005c0)="6e2d3c94288948959426d1de787672fa8d3705a324cefea880e8c0bd80226c9eb3d90a4e08c79410f56616b3a74447ce08834e294e4f434f3e4aea8add09078987227848f2f3afb37adb6af1bad9389c927333df0d9b7fb8ca914cbfeb6ebb21e2495be7c3d2c697c0c0ac2266181511a87dddd889f912df0822095bfea15a483a65d0b80e1a3f81a8748a6900683b154513e649542d8ffec2c058b20b55688dd5f01933a90fb1dcb5c990028e2e9b17d234a5470fe03290ff9c6b7f4333654564be0b5f074feee291dc5daf806c811fe508b19319cccaf2b0236d0c941b20ae95e047af56935bd8fc5f5101287a12623cee4de00cf3af4942a2fbadfb76e4f2cdb1089af1d79ee99a61b8003112c2d43ba025c6e4631d2a186fdf9c64ab60b8064b051343c313a28355ba59bb6ea25d668899af0d5bc16c40ce7ee8cd", 0xffffffa0}, {&(0x7f0000000340)="bf67a361000138944b854b78cc4e2237f68791bd7786513b715bf9ad6389844bc809b10b216304437e8d4b9e9cec7b31a34a02854029d58ba77b51b6479ef73e43d95fb478cc230a625897", 0x4b}, {&(0x7f0000000440)="9daf5194d6ff2fb71e455a389b8ead15aebc12ea8ead35a3b45cb2f2603e607dfe3f1228fb0b1cd1968a9bcd1badfa49059ce704fa1228343bfe3f3600c5000000000000d09c5c82111202b07c1c755457049ad0ebcd70cbaa678adaa17831266adfc9fa04f5093b8c9fd353b714b22e5454084aa316bd17dbadd5a49b0dd3b073051bb901212a764a56d76d2ff9747d5cad8712e20378bbbcca075b5564a0b50df37294931900f48618135effbb4f2392455f6451fd556b02e166b774d78b8f419eebd9998b8d428dc4b2fcb57503d0eeba1a3280f447ccf7812d1895b6479c7059fe50fff0e5c7dcf0768191e9bcb9c2b1e58427a93a7396d404a4116c8cd5e00456979d2dce4347f00189da68317adf15ea9e728f1fb93db495bd754b84cfc923a1428c97643f05cf00000000000000000000000000005e2cd2cd53a53fab4d50415b7fc9634782", 0x149}], 0x3) 2.892725539s ago: executing program 5 (id=145): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0009030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x0) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r2, &(0x7f0000000100)='+p', 0x2) read$char_usb(r1, &(0x7f0000000000)=""/172, 0xac) syz_usb_disconnect(r0) syz_usb_connect$printer(0x2, 0x2d, &(0x7f0000002240)=ANY=[], 0x0) 2.466770541s ago: executing program 3 (id=160): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000800)={'geneve1\x00', 0x0}) r2 = socket(0x11, 0x3, 0x0) sendto$packet(r2, &(0x7f0000000000)="1412e0c84935a9738e0ff2f788a8", 0xe, 0x0, &(0x7f00000007c0)={0x11, 0x86dd, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) 2.446972236s ago: executing program 3 (id=161): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x6c, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DREG={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_IMMEDIATE_DATA={0xc, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0x5, 0x1, "7f"}]}]}}}, {0x3c, 0x1, 0x0, 0x1, @payload={{0xc}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_SREG={0x8, 0x5, 0x1, 0x0, 0x1}, @NFTA_PAYLOAD_BASE={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_PAYLOAD_OFFSET={0x8, 0x3, 0x1, 0x0, 0xc}, @NFTA_PAYLOAD_LEN={0x8, 0x4, 0x1, 0x0, 0x4}, @NFTA_PAYLOAD_CSUM_FLAGS={0x8, 0x8, 0x1, 0x0, 0x1}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x120}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x54, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @loopback}}, {0x14, 0x2, @in={0x2, 0x0, @multicast2}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}]}, 0x54}}, 0x0) 2.383560393s ago: executing program 3 (id=162): syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000180)='./bus\x00', 0x1, &(0x7f0000000040)=ANY=[], 0x1, 0x1f8, &(0x7f0000000380)="$eJzsmTtvE0EQx/+797ATARINBQ1IRCJIyfnuDCgNRfgCICW8OixyRIFLjM5X2JaQsGho+Bh8BQpXLujoaKEAJCQKXFIv2ofvFvwQxhiKzE/K3v9mZ2d3RrdTxCAI4tjy+dP3jy+vb+1uADjhraFi7F+d0odb/h+qRrx/9ebo1NP+r/EEA5iWg989w2DbQT5aL4Sw59bMcxe80LfAccnoO2AIjL4PjttGJ2C4d1LrR1Ibe3PFiDQJHjTTvYcHaRLKIZJDLIe6vb8LYNhj2ANQNedj1nyr033cSNMkU4KXFk+M9sl+9plfzKqdC7jDbY5rVv3kKe6+eN6T76PahFb9InBERtfBsGP0FioIgkB+ArokVv5n3TK+MzV/S7iYP/8b3uLFksKHFqc3Zzlv/JW9/lD4AP7hpvIOLxKn998KtQTBLMuKFPJCF5Yzw/7b8VVflnmw88tNGaZnj029W10ssm/u+ESfsn/KlnvR6k8u3KJ/1PLDJ7VWp7t5cNjYT/aToziuXw0vh+GVuKZ6sx5n9L+q6k+rVnxviq/PfLQbeZ5FbSDPouI91qPVcXdeN7+pNVz1P471CzqG/FRU2pXJezDzx9VTqnVn6uEJgiAIgiAIgiAIgiAIgiDm4hyY+i+o+aFKCIFnekbYxDeV7UcAAAD//6F8UZs=") syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000140)='./bus\x00', 0x0, &(0x7f00000002c0)=ANY=[], 0xfd, 0x202, &(0x7f0000000380)="$eJzsmb9v00AUx793dpw0QiAWBhaQqESH1rEdQF0Y4B8AqeXXRkRNVXAb5HpoKiERsbDwZyDxFzB0YmCDiRUGQEJiICMjOnQ/XF+wjXAUBBLvI+X563vv3t29nN6QgCCI/5ZPH799eHp5dX0ZwBEsom3GvzhFDLfi33eMePfs1c7RhweW6400AoCZ+rJyQVYecuAgM1oIIWzfonmug2t9rTs19wYYfKNvg+O60TEYbhl9z9LDBSOS2L8zTDbubiVxIE0oTSRN387vApiMGTYAdPT+vguN8u+O9u8PkiROfxYtka9TcjUVlXUs9udOLnFctOonv6+bTx6P5XtemyCvH4AQHKHRfTCsGb2KNnzfl1dAl8Q6/0m3yG9djfrzzyKutOaTx4MWx1dqYrgUy3NZa0bhAfh7qzcW4+azWPrvHDC/sXqEWa4FtdVDV/p8dGJy8Lqc5/Of3OHp+SZ0Md16YHp2KfhtVwuv7Pot4Xk6cWVM0T9lyz1r9Sc9qull2w96u6P9la3twWa8Ge9EUf9CcC4Izkc91Zu1/UX/66j+1LXyt2piPeZhb5BlabgHZGl4+B5pa3XctRfDr2oOV/2PY+mMziGvijp1u3oNZj5cPaVacmo3TxAEQRAEQRAEQRAEQRAE0YhTYDD/UDH9gygeAeKY9oqc6Kp6/xEAAP//sXZTYQ==") 2.295076896s ago: executing program 3 (id=163): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x4, 0x4, 0x4, 0x10, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000300)=@raw=[@map_fd={0x18, 0x2, 0x1, 0x0, r0}, @generic={0xb7, 0x3, 0x0, 0x0, 0x8}, @generic={0xbf, 0x4, 0xa}, @generic={0x7, 0x4, 0x0, 0x0, 0xfffffff8}, @generic={0xb7, 0x5, 0x0, 0x0, 0x8}, @generic={0x85, 0x0, 0x0, 0x0, 0x19}, @generic={0x95}], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000400)={r1, 0x0, 0xe, 0x0, &(0x7f0000000500)="11223344556677889900aabbccdd", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2.267169593s ago: executing program 3 (id=164): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f00000001c0)={{0xfec08000, 0x40000, 0xc, 0xf1, 0x23, 0xfd, 0xea, 0xd4, 0x0, 0xd9, 0xf6, 0x6}, {0xeeee0000, 0x1, 0xa, 0x4, 0x8, 0x3, 0x6, 0xb, 0x7, 0x4, 0x7, 0x45}, {0x8080000, 0xdddd0000, 0xf, 0x2, 0xfe, 0x2, 0x4, 0x9, 0x5, 0x1, 0xc4, 0x44}, {0xeeee3000, 0xffffffff, 0x805b134020ae36da, 0xf8, 0x3, 0x68, 0x9, 0x1, 0x6, 0x3, 0x8, 0x1}, {0xffffffff, 0xa000, 0x4, 0x5, 0x3, 0xb, 0xd, 0xa, 0x5, 0xc, 0x2c, 0x4b}, {0x60000, 0xffff1000, 0xa, 0x0, 0x3, 0x9, 0x1, 0xc3, 0xfc, 0x90, 0x2, 0xb9}, {0xdddd1000, 0xf000, 0xf, 0x82, 0x1, 0xfb, 0x0, 0x5, 0xfe, 0x7, 0x47, 0xf5}, {0x2000, 0x41000, 0xf, 0x5, 0xf9, 0x0, 0xa, 0x1, 0xb6, 0x1, 0xff, 0x7}, {0x692daea2027b6777, 0x6}, {0x0, 0x8}, 0x1000c, 0x0, 0xffff1000, 0x14008a, 0x6, 0x0, 0xe6e70c00, [0x6, 0x401, 0x8, 0xc5]}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x0, 0x7, 0x3, 0x0, 0xd2, 0x9c, 0x5, 0x8, 0x10, 0x8, 0xf1, 0x1, 0x0, 0x3, 0x24, 0x5, 0xbc, 0x3, 0xe9, '\x00', 0x89, 0x9f70}) ioctl$KVM_SIGNAL_MSI(r1, 0x4020aea5, &(0x7f0000000000)={0x8000000, 0xffff1000, 0x1, 0x1, 0x999}) 2.195411262s ago: executing program 3 (id=165): setns(0xc9, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000001500)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/65, 0x0, 0xeeef0000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001840)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000000740)=""/183, 0x0, 0x9000}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000040)={@my=0x1}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x1}, 0x10) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000200)={0x28, 0x0, 0xffffffff, @my=0x1}, 0x10) syz_usb_connect(0x3, 0x24, 0x0, 0x0) 1.71146996s ago: executing program 2 (id=168): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002b80)={0x24, 0x41, 0x1, 0x5fffc, 0x4, {0x1}, [@nested={0x4, 0x48}, @nested={0x8, 0x1, 0x0, 0x1, [@nested={0x4, 0x4b}]}, @typed={0x4, 0x2, 0x0, 0x0, @binary}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c801}, 0x240980c4) 1.71131275s ago: executing program 2 (id=169): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="14000000270009002bbd7000fedbdf2504"], 0x14}, 0x1, 0x0, 0x0, 0x2014}, 0x0) 1.7112349s ago: executing program 2 (id=170): sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x1c, 0x0, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) nanosleep(0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000000)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d") ioctl(r0, 0xc138fd0e, &(0x7f0000000000)="04000000000000000000000060010000380100"/42) 1.7110532s ago: executing program 2 (id=171): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10) r1 = fcntl$dupfd(r0, 0x406, r0) sendto$inet(r0, 0x0, 0x0, 0x200047fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmsg$NFT_BATCH(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000007f40)=ANY=[], 0x76b0}, 0x1, 0x0, 0x0, 0x20000000}, 0x4004001) r2 = socket$inet6(0x10, 0x2, 0x4) sendto$inet6(r2, &(0x7f0000000080)="4c00000012001f15b9409b8400feffffffffffff000000000017030038c88cc055c5ac27a6c5b068d0bf46d323452536005ad94acc000000000000000000000051d1ec0cffc8792cd8000080", 0x4c, 0x0, 0x0, 0x0) 868.138361ms ago: executing program 2 (id=183): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000800)=@framed={{0x18, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r0}, {}, {0x85, 0x0, 0x0, 0xaa}, {0x7, 0x0, 0xb, 0x7, 0x0, 0x0, 0xff7f0000}}]}, &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 856.400755ms ago: executing program 2 (id=184): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x8) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./debug/dynamic_debug/control\x00', 0x802, 0x0) write(r0, &(0x7f0000000100)='+p', 0x2) syz_usb_connect$cdc_ncm(0x3, 0x2b, 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d81201000001010203010902200001010080320904000002ff000000070581020002"], 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_ep_write(r1, 0x81, 0x1, &(0x7f0000000700)='\x00') read$char_usb(r2, &(0x7f0000000600)=""/64, 0x40) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r3, 0xffffffffffffffff, 0x200000000000000) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) write$rfkill(0xffffffffffffffff, 0x0, 0x0) 607.44144ms ago: executing program 1 (id=186): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@newqdisc={0x24, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffff}, {0xffff, 0xffff}}}, 0x24}}, 0x20000800) ptrace(0x10, r0) ptrace$peeksig(0x4212, r0, &(0x7f00000004c0)={0x3, 0x1}, &(0x7f0000000000)) 607.20074ms ago: executing program 1 (id=187): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = open(&(0x7f0000000780)='./bus\x00', 0x14507e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r2, 0x0) fallocate(r1, 0x0, 0x0, 0x1000f4) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x200000, &(0x7f0000200000/0x200000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r4, 0xc040aed5, &(0x7f0000000200)={0xd000, 0x210000}) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000100)={0x0, 0x1, 0x0, 0x200000, &(0x7f0000200000/0x200000)=nil}) 588.650355ms ago: executing program 1 (id=188): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) r0 = syz_kvm_add_vcpu$x86(0x0, 0x0) ioctl$KVM_RUN(r0, 0xae80, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000000)='3', 0x4e) futex(0x0, 0xc, 0x1, 0x0, &(0x7f0000048000), 0x0) write(0xffffffffffffffff, 0x0, 0x0) 223.082052ms ago: executing program 1 (id=189): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps\x00') pread64(r0, 0x0, 0x0, 0xffffffff8) 179.321173ms ago: executing program 0 (id=190): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000140)='./bus\x00', 0x8, &(0x7f00000003c0)={[{@noauto_da_alloc}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x91}}]}, 0x21, 0x4f3, &(0x7f00000012c0)="$eJzs3c9vVEUcAPDvbru0lEJBOahRQUTRELY/gIZwES4aQ0iMxJMHqO3SNN1lm26JtHIoR+8kknjSP8GbBxNOHrx505sXPJigEg018bDmvV3apb+1P9Z2P5/k9b2ZWfY702Vm9g3sTgAt62hEzEbEnoi4FhE99fxM/YgLtSN53ONHt4fnHt0ezkS1euW3TFqe5EXDn0nsqz9nZ0S8/07ER5mlcSvTM+NDxWJhsp7unSpN9FamZ06NZes5A4P9g33nTp8d2LS2Hil99fDtsUsffPP1Sw++n33zk6Ra3Z/uT8sa27GZak3PRXdDXntEXNqKYE3SXv/7w86T9LZnIuJY2v97oi19NQGA3axa7YlqT2MaANjtkvv/7shk8/W1gO7IZvP52hre4ejKFsuVqZM95Zs3RiJdwzoYuez1sWKhr75WeDBymSTdn14vpAeeSt8tnI6IQxFxt2NvWp4fLhdHmvnGBwBa2L5F8/+fHbX5HwDY5TqbXQEAYNuZ/wGg9Zj/AaD1/Iv536cDAWCXcP8PAK3H/A8ArWfN+f/O9tQDANgW712+nBzVudr3Xz/5pu5TI4XKeL50czg/XJ6cyI+Wy6PFQn64Wl3r+Yrl8kT/mflkZXrmaql888bU1bHS0GjhaiG3lY0BANbl0JH7PyaT/uz5vekRDXs5mKthd8s2uwJA07Q1uwJA0/g8D7SuddzjWwaAXW6ZLXqfsuJ/Ebpn81fYqU48b/0fWtVG1v+tHcDO9t/W/9/a9HoA288cDq2rWs3Y8x8AWow1fmBD//4PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALao7PTLZfLoX+GzyM5vPR+yPiIORy1wfKxb6IuJARPzQketI0v3NrjQAsEHZXzL1/b9O9BzvXly6J/NXR3qOiI8/v/LZraGpqcn+JP/3+fype/X8gT3NaAAA0OjC0qzaPF0/N9zIP350e/jJsZ1VfHixtrloEneuftRK2qM9PXdGLiK6/sjU0zXJ+5W2TYg/eycinlto/62GCN3pGkht59PF8ZPY+7cg/sLvf3H87FPxs2lZcs6lv4tnN6Eu0GruX6yNk/W+l3Sxev/LxtH0vHz/70xHqI1Lxr9kLJlbMv5l58e/tiXxM2mfPzqfXr0mD898++6SzGpPrexOxAvty8XPzMfPLD/+5o6vs40/vfjysZXKql9EnFi2/U92pC6lw2zvVGmitzI9c2qsNDRaGC3cGBgY7B/sO3f67EBvukZd+/ndcjF+PX/ywErxk/Z3rRC/c/X2x2vrbP+Xf1/78JVV4r/x6vKv/+FV4idz4uvrjD/UdWHF7buT+CMrtH+N1z9OrjP+g59nRtb5UABgG1SmZ8aHisXC5BoXyXvNtR7jYmdexGzEZj1huigREf+HdrnYyEWzRyZgqy10+mbXBAAAAAAAAAAAAAAAWEllema8Y4s/rdXsNgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALB7/RMAAP//TwTJNg==") syz_mount_image$fuse(0x0, &(0x7f0000000740)='./bus\x00', 0x283016, 0x0, 0x11, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='.\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000380)='./file0\x00', r0, &(0x7f0000000200)='./bus/file0\x00', 0x0) r1 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f0000000240)={0x0, {}, 0x0, {}, 0x9, 0x0, 0x13, 0x0, "22536a030000000000000043a52dbc3a9ae8b04fcca15748328cb3e74d938981061383375e1d61471a2d2dfe00000000000500000000000400", "0010650c31ef6c1f1bb0aa6d0c5ba9263626c0240010f9db74161ccff2c5cf5e", [0x5, 0x42ba4fbf]}) mount$overlay(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x2004008, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) 179.031593ms ago: executing program 1 (id=191): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f000000aa00)=ANY=[@ANYBLOB="d850000044000701fefffffffcdbdf25037c000004004580c0500180bc506480b850cd80b450d680b05018800400f28004008d809f506a80cb84262700fc44f829e9ac5d2b0168d2ed51fbf02783ae7705c94d9468d49caa3fe7907450398014006d800500a4000000000008004d00ac14140c5950028037000180d01032234b706888b980d85f5def3c191ca34a6233501153013bfba3"], 0x50d8}}, 0xc000) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) r5 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0xfff1, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000380)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x7, 0xfff2}, {0xa, 0xffff}, {0x300, 0xe}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_skbmod={0x54, 0x1, 0x0, 0x0, {{0xb}, {0x28, 0x2, 0x0, 0x1, [@TCA_SKBMOD_PARMS={0x24, 0x2, {{0xd7, 0xd782, 0x20000000, 0x704, 0x4}, 0x10}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x4008040}, 0x4000000) write$tun(r2, &(0x7f0000004e40)=ANY=[], 0x3a65) 22.372984ms ago: executing program 1 (id=192): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7001}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x104, 0xe}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x84, 0x2c, 0xd2f, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x8, 0x40, 0x1, 0x7, 0x80}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x24008084}, 0x20000000) 0s ago: executing program 0 (id=193): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='+p', 0x2) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(0xffffffffffffffff, &(0x7f0000001700)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x200440c5}, 0x0) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, 0x0, 0x4008840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x3c}}, 0x200088c4) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RELOAD_REGDB(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)={0x14, r2, 0x1, 0x70bd2d, 0x25dfdc01}, 0x14}, 0x1, 0x0, 0x0, 0x24000000}, 0x20008004) sendmmsg(r1, &(0x7f00000000c0), 0x4000000000000d2, 0x8048848) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.151' (ED25519) to the list of known hosts. [ 22.515446][ T30] audit: type=1400 audit(1790384886.660:64): avc: denied { mounton } for pid=277 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.519432][ T277] cgroup: Unknown subsys name 'net' [ 22.538206][ T30] audit: type=1400 audit(1790384886.660:65): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.565537][ T30] audit: type=1400 audit(1790384886.690:66): avc: denied { unmount } for pid=277 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.566017][ T277] cgroup: Unknown subsys name 'devices' [ 22.741020][ T277] cgroup: Unknown subsys name 'hugetlb' [ 22.746702][ T277] cgroup: Unknown subsys name 'rlimit' [ 22.946521][ T30] audit: type=1400 audit(1790384887.090:67): avc: denied { setattr } for pid=277 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.969768][ T30] audit: type=1400 audit(1790384887.090:68): avc: denied { mounton } for pid=277 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.994899][ T30] audit: type=1400 audit(1790384887.090:69): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.013647][ T279] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 23.026990][ T30] audit: type=1400 audit(1790384887.170:70): avc: denied { relabelto } for pid=279 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.052431][ T30] audit: type=1400 audit(1790384887.170:71): avc: denied { write } for pid=279 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.060699][ T277] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.078537][ T30] audit: type=1400 audit(1790384887.210:72): avc: denied { read } for pid=277 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.112410][ T30] audit: type=1400 audit(1790384887.210:73): avc: denied { open } for pid=277 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.009738][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.016827][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.024365][ T289] device bridge_slave_0 entered promiscuous mode [ 24.031272][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.038329][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.045798][ T285] device bridge_slave_0 entered promiscuous mode [ 24.055563][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.062665][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.070206][ T285] device bridge_slave_1 entered promiscuous mode [ 24.078604][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.085734][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.093151][ T289] device bridge_slave_1 entered promiscuous mode [ 24.099879][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.106930][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.114454][ T286] device bridge_slave_0 entered promiscuous mode [ 24.124094][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.131226][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.138703][ T286] device bridge_slave_1 entered promiscuous mode [ 24.170892][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.177968][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.185473][ T287] device bridge_slave_0 entered promiscuous mode [ 24.208996][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.216094][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.223576][ T287] device bridge_slave_1 entered promiscuous mode [ 24.248771][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.255900][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.263412][ T288] device bridge_slave_0 entered promiscuous mode [ 24.273015][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.280248][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.287705][ T288] device bridge_slave_1 entered promiscuous mode [ 24.442844][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.449948][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.457379][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.464487][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.483479][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.490577][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.497855][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.505436][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.521104][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.528175][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.535494][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.542552][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.561175][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.568254][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.575584][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.582648][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.591158][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.598216][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.605544][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.612595][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.661473][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.668851][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.676281][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.683669][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.691030][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.698210][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.705721][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.713187][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.720595][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.727860][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.736517][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.744044][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.769644][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.777628][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.786106][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.794588][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.801675][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.809788][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.817955][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.825037][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.832493][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.840831][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.847887][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.855346][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.862849][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.871196][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.878233][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.885710][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.893992][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.901302][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.910787][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.946487][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.963492][ T288] device veth0_vlan entered promiscuous mode [ 24.973959][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.982253][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.989342][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.997161][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.005465][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.013843][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.022429][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.030465][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.038411][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.046563][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.055049][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.062102][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.069693][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.077887][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.084958][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.092629][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.101076][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.109340][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.116364][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.124226][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.133132][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.141412][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.148480][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.155917][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.164072][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.172209][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.180574][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.188541][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.196858][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.205199][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.212863][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.228654][ T289] device veth0_vlan entered promiscuous mode [ 25.248214][ T285] device veth0_vlan entered promiscuous mode [ 25.255984][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.265058][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.273521][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.281758][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.289963][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.297983][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.306130][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.314174][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.322441][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.331015][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.339443][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.347756][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.356370][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.364484][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.372729][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.380394][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.387840][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.395523][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.414603][ T287] device veth0_vlan entered promiscuous mode [ 25.426635][ T289] device veth1_macvtap entered promiscuous mode [ 25.436879][ T288] device veth1_macvtap entered promiscuous mode [ 25.444708][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.453042][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.461206][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.468635][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.476286][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.483979][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.492365][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.499985][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.508289][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.516847][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.525640][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.534619][ T286] device veth0_vlan entered promiscuous mode [ 25.549447][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.557823][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.567351][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.575848][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.586678][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.595400][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.605177][ T285] device veth1_macvtap entered promiscuous mode [ 25.619282][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.627665][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.636206][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.644746][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.657956][ T287] device veth1_macvtap entered promiscuous mode [ 25.670933][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.679972][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.688384][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.697079][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.705618][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.720488][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.734147][ T288] request_module fs-gadgetfs succeeded, but still no fs? [ 25.750080][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.762495][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.771478][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.780149][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.790836][ T286] device veth1_macvtap entered promiscuous mode [ 25.838289][ T315] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.862987][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.877278][ T316] capability: warning: `syz.0.1' uses 32-bit capabilities (legacy support in use) [ 25.877755][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.926450][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.954437][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.996554][ T330] binder: BINDER_SET_CONTEXT_MGR already set [ 26.008935][ T330] binder: 329:330 ioctl 4018620d 200000004a80 returned -16 [ 26.117084][ T345] loop4: detected capacity change from 0 to 256 [ 26.129738][ T342] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.133994][ T345] ======================================================= [ 26.133994][ T345] WARNING: The mand mount option has been deprecated and [ 26.133994][ T345] and is ignored by this kernel. Remove the mand [ 26.133994][ T345] option from the mount to silence this warning. [ 26.133994][ T345] ======================================================= [ 26.137448][ T342] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.179511][ T347] ip_tables: iptables: counters copy to user failed while replacing table [ 26.242966][ T345] exFAT-fs (loop4): failed to load upcase table (idx : 0x00011a39, chksum : 0xd54015fb, utbl_chksum : 0xe619d30d) [ 26.325058][ T344] tipc: Started in network mode [ 26.339795][ T344] tipc: Node identity ac1414aa, cluster identity 4711 [ 26.351527][ T340] syz.3.13 (340) used greatest stack depth: 22784 bytes left [ 26.365677][ T344] tipc: New replicast peer: 100.1.1.1 [ 26.381657][ T344] tipc: Enabled bearer , priority 10 [ 26.778890][ T39] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 26.788868][ T314] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 26.929782][ T356] loop3: detected capacity change from 0 to 131072 [ 26.936103][ T342] syz.2.11 (342) used greatest stack depth: 21032 bytes left [ 26.952814][ T356] F2FS-fs (loop3): invalid crc value [ 26.970296][ T356] F2FS-fs (loop3): Found nat_bits in checkpoint [ 27.007311][ T367] process 'syz.4.20' launched './file0' with NULL argv: empty string added [ 27.016355][ T356] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e4 [ 27.020976][ T39] usb 1-1: Using ep0 maxpacket: 16 [ 27.038985][ T314] usb 2-1: Using ep0 maxpacket: 16 [ 27.159014][ T39] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 27.169252][ T314] usb 2-1: config 0 has an invalid interface number: 105 but max is 0 [ 27.178733][ T39] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 27.195289][ T314] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 27.205596][ T314] usb 2-1: config 0 has no interface number 0 [ 27.274756][ T377] loop4: detected capacity change from 0 to 512 [ 27.328943][ T39] usb 1-1: New USB device found, idVendor=1235, idProduct=000e, bcdDevice= 0.40 [ 27.337438][ T377] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 27.338328][ T39] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.349429][ T299] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 27.357891][ T39] usb 1-1: Product: syz [ 27.366522][ T377] ext4 filesystem being mounted at /8/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 27.369506][ T39] usb 1-1: Manufacturer: syz [ 27.384490][ T39] usb 1-1: SerialNumber: syz [ 27.398077][ T377] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1 sclass=netlink_route_socket pid=377 comm=syz.4.24 [ 27.410566][ T314] usb 2-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 27.419707][ T314] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.427790][ T314] usb 2-1: Product: syz [ 27.432231][ T314] usb 2-1: Manufacturer: syz [ 27.436880][ T314] usb 2-1: SerialNumber: syz [ 27.446311][ T314] usb 2-1: config 0 descriptor?? [ 27.489521][ T314] usb 2-1: Found UVC 0.00 device syz (046d:08f3) [ 27.496123][ T314] usb 2-1: No valid video chain found. [ 27.499039][ T26] tipc: Node number set to 2886997162 [ 27.691402][ T26] usb 2-1: USB disconnect, device number 2 [ 27.788914][ T299] usb 4-1: unable to get BOS descriptor or descriptor too short [ 27.888895][ T299] usb 4-1: config 11 has an invalid interface number: 102 but max is 0 [ 27.897928][ T299] usb 4-1: config 11 has no interface number 0 [ 27.904206][ T299] usb 4-1: config 11 interface 102 altsetting 2 endpoint 0x7 has invalid maxpacket 959, setting to 64 [ 27.915382][ T299] usb 4-1: config 11 interface 102 has no altsetting 0 [ 28.009085][ T39] snd-usb-audio: probe of 1-1:1.0 failed with error -2 [ 28.017955][ T39] usb 1-1: USB disconnect, device number 2 [ 28.047201][ T30] kauditd_printk_skb: 72 callbacks suppressed [ 28.047217][ T30] audit: type=1400 audit(1790384892.190:146): avc: denied { create } for pid=385 comm="syz.4.26" dev="anon_inodefs" ino=16452 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 28.066894][ T386] loop4: detected capacity change from 0 to 1024 [ 28.077538][ T30] audit: type=1400 audit(1790384892.200:147): avc: denied { ioctl } for pid=385 comm="syz.4.26" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=16452 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 28.099805][ T386] EXT4-fs (loop4): error: could not find journal device path: error -2 [ 28.118926][ T57] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 28.119239][ T299] usb 4-1: New USB device found, idVendor=2304, idProduct=0207, bcdDevice= b.b5 [ 28.138102][ T299] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.146256][ T299] usb 4-1: Product: syz [ 28.150636][ T299] usb 4-1: Manufacturer: syz [ 28.155264][ T299] usb 4-1: SerialNumber: syz [ 28.182676][ T30] audit: type=1400 audit(1790384892.330:148): avc: denied { relabelfrom } for pid=385 comm="syz.4.26" name="" dev="pipefs" ino=16451 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 28.215113][ T30] audit: type=1400 audit(1790384892.360:149): avc: denied { unmount } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 28.243332][ T30] audit: type=1400 audit(1790384892.380:150): avc: denied { create } for pid=389 comm="syz.4.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 28.263079][ T30] audit: type=1400 audit(1790384892.390:151): avc: denied { bind } for pid=389 comm="syz.4.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 28.276262][ T392] loop1: detected capacity change from 0 to 1024 [ 28.284375][ T30] audit: type=1400 audit(1790384892.390:152): avc: denied { connect } for pid=389 comm="syz.4.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 28.308425][ T30] audit: type=1400 audit(1790384892.390:153): avc: denied { listen } for pid=389 comm="syz.4.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 28.328729][ T30] audit: type=1400 audit(1790384892.390:154): avc: denied { accept } for pid=389 comm="syz.4.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 28.348308][ T30] audit: type=1400 audit(1790384892.390:155): avc: denied { read } for pid=389 comm="syz.4.28" name="uinput" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 28.374813][ T392] EXT4-fs (loop1): Mount option "nouser_xattr" will be removed by 3.5 [ 28.374813][ T392] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 28.374813][ T392] [ 28.396610][ T392] EXT4-fs (loop1): Ignoring removed nomblk_io_submit option [ 28.408899][ T57] usb 3-1: device descriptor read/64, error -71 [ 28.444566][ T392] EXT4-fs (loop1): mounted filesystem without journal. Opts: noblock_validity,bsddf,sysvgroups,resuid=0x0000000000000000,init_itable,nouser_xattr,grpid,noauto_da_alloc,nomblk_io_submit,,errors=continue. Quota mode: none. [ 28.504246][ T396] F2FS-fs (loop3): Corrupted max_depth of 3: 16842753 [ 28.577410][ T390] loop4: detected capacity change from 0 to 40427 [ 28.617014][ T390] F2FS-fs (loop4): invalid crc value [ 28.637470][ T390] F2FS-fs (loop4): Found nat_bits in checkpoint [ 28.670508][ T299] usb 4-1: USB disconnect, device number 2 [ 28.779281][ T390] F2FS-fs (loop4): Start checkpoint disabled! [ 28.803953][ T390] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e6 [ 28.811648][ T57] usb 3-1: device descriptor read/64, error -71 [ 28.822199][ T410] loop0: detected capacity change from 0 to 512 [ 28.850597][ T390] attempt to access beyond end of device [ 28.850597][ T390] loop4: rw=10241, want=45104, limit=40427 [ 28.891252][ T410] EXT4-fs (loop0): Ignoring removed nomblk_io_submit option [ 28.910789][ T410] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 28.942667][ T410] EXT4-fs (loop0): 1 truncate cleaned up [ 28.955499][ T410] EXT4-fs (loop0): mounted filesystem without journal. Opts: noload,max_dir_size_kb=0x0000000000000007,bsddf,nomblk_io_submit,data_err=ignore,usrjquota=,,errors=continue. Quota mode: none. [ 29.021896][ T10] attempt to access beyond end of device [ 29.021896][ T10] loop4: rw=2049, want=40984, limit=40427 [ 29.078904][ T57] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 29.224757][ T421] netlink: 'syz.4.33': attribute type 1 has an invalid length. [ 29.330372][ T434] netlink: 32 bytes leftover after parsing attributes in process `syz.1.44'. [ 29.340880][ T434] Zero length message leads to an empty skb [ 29.358851][ T57] usb 3-1: device descriptor read/64, error -71 [ 29.638681][ T457] loop3: detected capacity change from 0 to 40427 [ 29.688797][ T457] F2FS-fs (loop3): invalid crc value [ 29.705107][ T457] F2FS-fs (loop3): Found nat_bits in checkpoint [ 29.748851][ T57] usb 3-1: device descriptor read/64, error -71 [ 29.758675][ T457] F2FS-fs (loop3): Start checkpoint disabled! [ 29.771700][ T457] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 29.806546][ T457] netlink: 28 bytes leftover after parsing attributes in process `syz.3.53'. [ 29.868934][ T57] usb usb3-port1: attempt power cycle [ 29.946784][ T471] netlink: 36 bytes leftover after parsing attributes in process `syz.3.58'. [ 29.956504][ T471] netlink: 36 bytes leftover after parsing attributes in process `syz.3.58'. [ 29.983815][ T473] netlink: 20 bytes leftover after parsing attributes in process `syz.3.59'. [ 30.054470][ T473] device ip6gretap0 entered promiscuous mode [ 30.086679][ T473] syz.3.59 (473) used greatest stack depth: 20456 bytes left [ 30.151734][ T467] loop1: detected capacity change from 0 to 131072 [ 30.179776][ T489] loop4: detected capacity change from 0 to 256 [ 30.189557][ T467] F2FS-fs (loop1): Test dummy encryption mode enabled [ 30.196612][ T467] F2FS-fs (loop1): QUOTA feature is enabled, so ignore jquota_fmt [ 30.236026][ T467] F2FS-fs (loop1): Found nat_bits in checkpoint [ 30.277999][ T467] F2FS-fs (loop1): sanity_check_inode: corrupted inode ino=3, run fsck to fix. [ 30.287220][ T57] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 30.298089][ T467] F2FS-fs (loop1): Failed to read root inode [ 30.377674][ T495] netlink: 32 bytes leftover after parsing attributes in process `syz.0.67'. [ 30.414622][ T497] syz.0.69 (497) used obsolete PPPIOCDETACH ioctl [ 30.468963][ T57] usb 3-1: device descriptor read/8, error -71 [ 30.635340][ T527] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.642647][ T527] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.646886][ T518] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0x1aabf3fb, utbl_chksum : 0xe619d30d) [ 30.685624][ T527] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.692758][ T527] bridge0: port 2(bridge_slave_1) entered listening state [ 30.700218][ T527] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.707414][ T527] bridge0: port 1(bridge_slave_0) entered listening state [ 30.729335][ T518] loop_set_status: loop4 () has still dirty pages (nrpages=2) [ 30.747749][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 30.751562][ T57] usb 3-1: device descriptor read/8, error -71 [ 30.762081][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 30.784570][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 30.802047][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 30.813875][ T542] FAULT_INJECTION: forcing a failure. [ 30.813875][ T542] name failslab, interval 1, probability 0, space 0, times 1 [ 30.832495][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 30.841480][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 30.844834][ T542] CPU: 0 PID: 542 Comm: syz.0.87 Not tainted syzkaller #0 [ 30.856582][ T542] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 30.860389][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 30.866692][ T542] Call Trace: [ 30.877783][ T542] [ 30.880742][ T542] __dump_stack+0x21/0x30 [ 30.885242][ T542] dump_stack_lvl+0x110/0x170 [ 30.889964][ T542] ? show_regs_print_info+0x20/0x20 [ 30.895216][ T542] ? kfree+0xc4/0x270 [ 30.899242][ T542] ? ____kasan_slab_free+0x130/0x160 [ 30.904566][ T542] dump_stack+0x15/0x20 [ 30.908758][ T542] should_fail+0x3ab/0x500 [ 30.910883][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 30.913212][ T542] __should_failslab+0xa4/0xe0 [ 30.926159][ T542] should_failslab+0x9/0x20 [ 30.930735][ T542] slab_pre_alloc_hook+0x39/0xd0 [ 30.935714][ T542] __kmalloc+0x6d/0x2c0 [ 30.939913][ T542] ? asymmetric_key_generate_id+0x59/0xf0 [ 30.945659][ T542] asymmetric_key_generate_id+0x59/0xf0 [ 30.951252][ T542] x509_cert_parse+0x60c/0x8b0 [ 30.956057][ T542] x509_key_preparse+0x63/0x650 [ 30.960941][ T542] asymmetric_key_preparse+0x9e/0xe0 [ 30.966335][ T542] key_create_or_update+0x430/0x9c0 [ 30.971550][ T542] ? key_type_put+0x20/0x20 [ 30.976062][ T542] ? lookup_user_key_possessed+0x40/0x40 [ 30.981697][ T542] ? __kasan_check_write+0x14/0x20 [ 30.986904][ T542] __se_sys_add_key+0x34b/0x410 [ 30.991779][ T542] ? __x64_sys_add_key+0xd0/0xd0 [ 30.996733][ T542] ? __kasan_check_write+0x14/0x20 [ 31.001966][ T542] __x64_sys_add_key+0xbf/0xd0 [ 31.006744][ T542] x64_sys_call+0x713/0x9a0 [ 31.011274][ T542] do_syscall_64+0x4c/0xa0 [ 31.015738][ T542] ? clear_bhb_loop+0x50/0xa0 [ 31.020440][ T542] ? clear_bhb_loop+0x50/0xa0 [ 31.025128][ T542] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 31.031049][ T542] RIP: 0033:0x7f633fd31159 [ 31.035470][ T542] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 31.055089][ T542] RSP: 002b:00007f633e78a028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 31.063516][ T542] RAX: ffffffffffffffda RBX: 00007f633ffb8fa0 RCX: 00007f633fd31159 [ 31.071495][ T542] RDX: 0000200000000200 RSI: 0000000000000000 RDI: 0000200000000000 [ 31.079479][ T542] RBP: 00007f633fdc806b R08: ffffffffffffffff R09: 0000000000000000 [ 31.087470][ T542] R10: 0000000000000559 R11: 0000000000000246 R12: 0000000000000000 [ 31.095447][ T542] R13: 00007f633ffb9038 R14: 00007f633ffb8fa0 R15: 00007fff9b3383b8 [ 31.103430][ T542] [ 31.109684][ T536] device lo entered promiscuous mode [ 31.123618][ T536] device tunl0 entered promiscuous mode [ 31.139788][ T536] device gre0 entered promiscuous mode [ 31.168864][ T536] device gretap0 entered promiscuous mode [ 31.178699][ T536] device erspan0 entered promiscuous mode [ 31.189608][ T536] device ip_vti0 entered promiscuous mode [ 31.205872][ T536] device ip6_vti0 entered promiscuous mode [ 31.224409][ T536] device sit0 entered promiscuous mode [ 31.259562][ T536] device ip6tnl0 entered promiscuous mode [ 31.267243][ T536] device ip6gre0 entered promiscuous mode [ 31.274455][ T536] device syz_tun entered promiscuous mode [ 31.290310][ T536] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.297596][ T536] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.307718][ T536] device bridge0 entered promiscuous mode [ 31.315641][ T536] device dummy0 entered promiscuous mode [ 31.324008][ T536] device veth0 entered promiscuous mode [ 31.331172][ T536] device veth1 entered promiscuous mode [ 31.338145][ T536] device wg0 entered promiscuous mode [ 31.344894][ T536] device wg1 entered promiscuous mode [ 31.355048][ T536] device wg2 entered promiscuous mode [ 31.361936][ T536] device veth0_to_bridge entered promiscuous mode [ 31.370422][ T536] device veth1_to_bridge entered promiscuous mode [ 31.383673][ T536] device veth0_to_bond entered promiscuous mode [ 31.390964][ T536] device bond_slave_0 entered promiscuous mode [ 31.397467][ T536] device veth1_to_bond entered promiscuous mode [ 31.409602][ T536] device bond_slave_1 entered promiscuous mode [ 31.419280][ T536] device veth0_to_team entered promiscuous mode [ 31.427214][ T536] device team_slave_0 entered promiscuous mode [ 31.433953][ T536] device veth1_to_team entered promiscuous mode [ 31.441548][ T536] device team_slave_1 entered promiscuous mode [ 31.448025][ T536] device veth0_to_batadv entered promiscuous mode [ 31.455859][ T536] device batadv_slave_0 entered promiscuous mode [ 31.463396][ T536] device veth1_to_batadv entered promiscuous mode [ 31.472731][ T536] device batadv_slave_1 entered promiscuous mode [ 31.480306][ T536] device xfrm0 entered promiscuous mode [ 31.486777][ T536] device veth0_to_hsr entered promiscuous mode [ 31.494303][ T536] device hsr_slave_0 entered promiscuous mode [ 31.502067][ T536] device veth1_to_hsr entered promiscuous mode [ 31.509586][ T536] device hsr_slave_1 entered promiscuous mode [ 31.516513][ T536] device veth1_virt_wifi entered promiscuous mode [ 31.525492][ T536] device veth0_virt_wifi entered promiscuous mode [ 31.533225][ T536] device veth1_vlan entered promiscuous mode [ 31.561823][ T536] device vlan0 entered promiscuous mode [ 31.567584][ T536] device vlan1 entered promiscuous mode [ 31.578873][ T536] device veth0_macvtap entered promiscuous mode [ 31.589251][ T536] device macsec0 entered promiscuous mode [ 31.596168][ T536] device bridge1 entered promiscuous mode [ 31.603601][ T543] netlink: 28 bytes leftover after parsing attributes in process `syz.1.86'. [ 31.663512][ T578] FAULT_INJECTION: forcing a failure. [ 31.663512][ T578] name failslab, interval 1, probability 0, space 0, times 0 [ 31.708956][ T578] CPU: 0 PID: 578 Comm: syz.3.95 Not tainted syzkaller #0 [ 31.716148][ T578] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 31.726240][ T578] Call Trace: [ 31.729548][ T578] [ 31.732501][ T578] __dump_stack+0x21/0x30 [ 31.736853][ T578] dump_stack_lvl+0x110/0x170 [ 31.741558][ T578] ? show_regs_print_info+0x20/0x20 [ 31.746900][ T578] dump_stack+0x15/0x20 [ 31.751134][ T578] should_fail+0x3ab/0x500 [ 31.755595][ T578] __should_failslab+0xa4/0xe0 [ 31.760404][ T578] should_failslab+0x9/0x20 [ 31.765085][ T578] slab_pre_alloc_hook+0x39/0xd0 [ 31.770072][ T578] ? __alloc_skb+0xe4/0x730 [ 31.774601][ T578] kmem_cache_alloc+0x44/0x260 [ 31.779391][ T578] __alloc_skb+0xe4/0x730 [ 31.783745][ T578] audit_log_start+0x407/0x8a0 [ 31.788531][ T578] ? audit_serial+0x30/0x30 [ 31.793056][ T578] ? slow_avc_audit+0x240/0x240 [ 31.797924][ T578] common_lsm_audit+0xd2/0x1670 [ 31.802796][ T578] ? avc_audit_pre_callback+0x290/0x290 [ 31.808357][ T578] ? debug_smp_processor_id+0x17/0x20 [ 31.813748][ T578] ? call_rcu+0x5af/0xf60 [ 31.818092][ T578] ? ipv6_skb_to_auditdata+0xdd0/0xdd0 [ 31.823568][ T578] ? rcu_gp_kthread_wake+0x90/0x90 [ 31.828694][ T578] ? preempt_schedule_thunk+0x16/0x18 [ 31.834081][ T578] slow_avc_audit+0x1c4/0x240 [ 31.838775][ T578] ? avc_get_hash_stats+0x180/0x180 [ 31.843992][ T578] ? avc_denied+0x133/0x1b0 [ 31.848508][ T578] avc_has_extended_perms+0x943/0xed0 [ 31.853896][ T578] ? avc_flush+0x2b0/0x2b0 [ 31.858350][ T578] ? do_futex+0xdd3/0x2800 [ 31.862806][ T578] ? kmem_cache_free+0x100/0x320 [ 31.867820][ T578] ? do_sys_openat2+0x6df/0x7f0 [ 31.872698][ T578] ? futex_exit_release+0x1e0/0x1e0 [ 31.877932][ T578] ? ioctl_has_perm+0x1b8/0x4f0 [ 31.882805][ T578] ioctl_has_perm+0x3ab/0x4f0 [ 31.887507][ T578] ? has_cap_mac_admin+0x370/0x370 [ 31.892634][ T578] ? __kasan_slab_free+0x11/0x20 [ 31.897598][ T578] ? slab_free_freelist_hook+0xc2/0x190 [ 31.903155][ T578] ? putname+0x111/0x160 [ 31.907495][ T578] ? kmem_cache_free+0x100/0x320 [ 31.912451][ T578] selinux_file_ioctl+0x3ad/0x4c0 [ 31.917492][ T578] ? selinux_file_alloc_security+0x120/0x120 [ 31.923488][ T578] ? __fget_files+0x2e1/0x340 [ 31.928176][ T578] security_file_ioctl+0x74/0xa0 [ 31.933154][ T578] __se_sys_ioctl+0x53/0x1a0 [ 31.937783][ T578] ? switch_fpu_return+0x15d/0x2c0 [ 31.942916][ T578] __x64_sys_ioctl+0x7b/0x90 [ 31.947609][ T578] x64_sys_call+0x2f/0x9a0 [ 31.952042][ T578] do_syscall_64+0x4c/0xa0 [ 31.956475][ T578] ? clear_bhb_loop+0x50/0xa0 [ 31.961169][ T578] ? clear_bhb_loop+0x50/0xa0 [ 31.965861][ T578] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 31.971769][ T578] RIP: 0033:0x7fcfb3753159 [ 31.976203][ T578] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 31.995819][ T578] RSP: 002b:00007fcfb21ac028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 32.004252][ T578] RAX: ffffffffffffffda RBX: 00007fcfb39dafa0 RCX: 00007fcfb3753159 [ 32.012238][ T578] RDX: 00000000ffffffe4 RSI: 0000000000004c80 RDI: 0000000000000005 [ 32.020224][ T578] RBP: 00007fcfb37ea06b R08: 0000000000000000 R09: 0000000000000000 [ 32.028212][ T578] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 32.036194][ T578] R13: 00007fcfb39db038 R14: 00007fcfb39dafa0 R15: 00007ffff55052d8 [ 32.044190][ T578] [ 32.198880][ T384] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 32.258364][ T588] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.272986][ T576] set_capacity_and_notify: 1 callbacks suppressed [ 32.273003][ T576] loop2: detected capacity change from 0 to 40427 [ 32.278501][ T588] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.293709][ T588] device bridge_slave_0 entered promiscuous mode [ 32.302109][ T588] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.309792][ T588] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.317304][ T588] device bridge_slave_1 entered promiscuous mode [ 32.329629][ T576] F2FS-fs (loop2): Invalid SB checksum offset: 0 [ 32.338992][ T576] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock [ 32.378505][ T576] F2FS-fs (loop2): invalid crc value [ 32.396450][ T609] bridge0: port 3(syz_tun) entered blocking state [ 32.403128][ T576] F2FS-fs (loop2): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 32.418995][ T609] bridge0: port 3(syz_tun) entered disabled state [ 32.437469][ T609] device syz_tun entered promiscuous mode [ 32.445305][ T609] bridge0: port 3(syz_tun) entered blocking state [ 32.447795][ T576] F2FS-fs (loop2): Try to recover 2th superblock, ret: 0 [ 32.451802][ T609] bridge0: port 3(syz_tun) entered listening state [ 32.463781][ T615] tipc: Started in network mode [ 32.466280][ T576] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 32.471717][ T615] tipc: Node identity ac1414aa, cluster identity 4711 [ 32.490719][ T615] tipc: New replicast peer: 100.1.1.1 [ 32.502948][ T615] tipc: Enabled bearer , priority 10 [ 32.524285][ T576] attempt to access beyond end of device [ 32.524285][ T576] loop2: rw=34817, want=79880, limit=40427 [ 32.548182][ T621] netlink: 8 bytes leftover after parsing attributes in process `syz.0.114'. [ 32.565810][ T588] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.572960][ T588] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.577638][ T623] FAULT_INJECTION: forcing a failure. [ 32.577638][ T623] name failslab, interval 1, probability 0, space 0, times 0 [ 32.580413][ T588] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.593334][ T384] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid maxpacket 1024, setting to 64 [ 32.600025][ T588] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.600440][ T623] CPU: 0 PID: 623 Comm: syz.3.115 Not tainted syzkaller #0 [ 32.625436][ T623] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 32.635602][ T623] Call Trace: [ 32.638898][ T623] [ 32.641875][ T623] __dump_stack+0x21/0x30 [ 32.646234][ T623] dump_stack_lvl+0x110/0x170 [ 32.650926][ T623] ? show_regs_print_info+0x20/0x20 [ 32.656147][ T623] dump_stack+0x15/0x20 [ 32.660319][ T623] should_fail+0x3ab/0x500 [ 32.664758][ T623] ? audit_log_start+0x407/0x8a0 [ 32.669710][ T623] __should_failslab+0xa4/0xe0 [ 32.674489][ T623] should_failslab+0x9/0x20 [ 32.679021][ T623] slab_pre_alloc_hook+0x39/0xd0 [ 32.683977][ T623] ? audit_log_start+0x407/0x8a0 [ 32.688927][ T623] ? audit_log_start+0x407/0x8a0 [ 32.694060][ T623] __kmalloc_track_caller+0x6c/0x2c0 [ 32.699373][ T623] ? audit_log_start+0x407/0x8a0 [ 32.704327][ T623] ? audit_log_start+0x407/0x8a0 [ 32.709278][ T623] __alloc_skb+0x210/0x730 [ 32.713764][ T623] audit_log_start+0x407/0x8a0 [ 32.718541][ T623] ? audit_serial+0x30/0x30 [ 32.723059][ T623] ? call_rcu+0x5af/0xf60 [ 32.727401][ T623] ? rcu_gp_kthread_wake+0x90/0x90 [ 32.732538][ T623] ? slow_avc_audit+0x240/0x240 [ 32.737416][ T623] common_lsm_audit+0xd2/0x1670 [ 32.742279][ T623] ? avc_update_node+0x34f/0x8a0 [ 32.747229][ T623] ? avc_audit_pre_callback+0x290/0x290 [ 32.753046][ T623] ? ipv6_skb_to_auditdata+0xdd0/0xdd0 [ 32.758543][ T623] ? avc_update_node+0x2c6/0x8a0 [ 32.763499][ T623] slow_avc_audit+0x1c4/0x240 [ 32.768197][ T623] ? avc_get_hash_stats+0x180/0x180 [ 32.773418][ T623] ? avc_has_perm_noaudit+0x30a/0x490 [ 32.778818][ T623] avc_has_perm+0x1fb/0x250 [ 32.783372][ T623] ? avc_has_perm_noaudit+0x490/0x490 [ 32.788790][ T623] ? memcpy+0x56/0x70 [ 32.792836][ T623] selinux_mount+0x3d1/0x510 [ 32.797463][ T623] ? debug_smp_processor_id+0x17/0x20 [ 32.802857][ T623] ? selinux_sb_statfs+0x220/0x220 [ 32.807995][ T623] ? __kasan_slab_free+0x11/0x20 [ 32.812949][ T623] ? slab_free_freelist_hook+0xc2/0x190 [ 32.818514][ T623] security_sb_mount+0x86/0xc0 [ 32.823306][ T623] path_mount+0xc3/0xff0 [ 32.827595][ T623] ? user_path_at_empty+0x162/0x1c0 [ 32.832823][ T623] __se_sys_mount+0x320/0x390 [ 32.837528][ T623] ? __x64_sys_mount+0xd0/0xd0 [ 32.842312][ T623] ? __kasan_check_write+0x14/0x20 [ 32.847441][ T623] __x64_sys_mount+0xbf/0xd0 [ 32.852051][ T623] x64_sys_call+0x6bf/0x9a0 [ 32.856567][ T623] do_syscall_64+0x4c/0xa0 [ 32.861004][ T623] ? clear_bhb_loop+0x50/0xa0 [ 32.866133][ T623] ? clear_bhb_loop+0x50/0xa0 [ 32.870821][ T623] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 32.876730][ T623] RIP: 0033:0x7fcfb3753159 [ 32.881158][ T623] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.900782][ T623] RSP: 002b:00007fcfb21ac028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 32.909219][ T623] RAX: ffffffffffffffda RBX: 00007fcfb39dafa0 RCX: 00007fcfb3753159 [ 32.917205][ T623] RDX: 00002000000000c0 RSI: 0000200000000040 RDI: 0000000000000000 [ 32.925190][ T623] RBP: 00007fcfb37ea06b R08: 0000200000000180 R09: 0000000000000000 [ 32.933180][ T623] R10: 0000000000202008 R11: 0000000000000246 R12: 0000000000000000 [ 32.941162][ T623] R13: 00007fcfb39db038 R14: 00007fcfb39dafa0 R15: 00007ffff55052d8 [ 32.949152][ T623] [ 32.980041][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 32.988059][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.996015][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.028383][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 33.037664][ T623] FAULT_INJECTION: forcing a failure. [ 33.037664][ T623] name failslab, interval 1, probability 0, space 0, times 0 [ 33.059397][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.066476][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.077619][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 33.085874][ T623] CPU: 1 PID: 623 Comm: syz.3.115 Not tainted syzkaller #0 [ 33.093112][ T623] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 33.103199][ T623] Call Trace: [ 33.106507][ T623] [ 33.109460][ T623] __dump_stack+0x21/0x30 [ 33.113819][ T623] dump_stack_lvl+0x110/0x170 [ 33.118524][ T623] ? show_regs_print_info+0x20/0x20 [ 33.123752][ T623] dump_stack+0x15/0x20 [ 33.127931][ T623] should_fail+0x3ab/0x500 [ 33.132373][ T623] __should_failslab+0xa4/0xe0 [ 33.137183][ T623] should_failslab+0x9/0x20 [ 33.141717][ T623] slab_pre_alloc_hook+0x39/0xd0 [ 33.146685][ T623] ? create_new_namespaces+0x34/0x660 [ 33.148213][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.152084][ T623] kmem_cache_alloc+0x44/0x260 [ 33.152114][ T623] create_new_namespaces+0x34/0x660 [ 33.159229][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.163937][ T623] ? ns_capable+0x8c/0xf0 [ 33.180680][ T623] unshare_nsproxy_namespaces+0x120/0x170 [ 33.186441][ T623] ksys_unshare+0x4d7/0x810 [ 33.190980][ T623] ? sighand_ctor+0x60/0x60 [ 33.195516][ T623] ? __kasan_check_write+0x14/0x20 [ 33.200655][ T623] ? switch_fpu_return+0x15d/0x2c0 [ 33.205802][ T623] __x64_sys_unshare+0x38/0x40 [ 33.210600][ T623] x64_sys_call+0x442/0x9a0 [ 33.215138][ T623] do_syscall_64+0x4c/0xa0 [ 33.219580][ T623] ? clear_bhb_loop+0x50/0xa0 [ 33.224307][ T623] ? clear_bhb_loop+0x50/0xa0 [ 33.229050][ T623] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 33.234982][ T623] RIP: 0033:0x7fcfb3753159 [ 33.239430][ T623] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 33.259224][ T623] RSP: 002b:00007fcfb21ac028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 33.267657][ T623] RAX: ffffffffffffffda RBX: 00007fcfb39dafa0 RCX: 00007fcfb3753159 [ 33.275747][ T623] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006a040000 [ 33.283769][ T623] RBP: 00007fcfb37ea06b R08: 0000000000000000 R09: 0000000000000000 [ 33.291789][ T623] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 33.299886][ T623] R13: 00007fcfb39db038 R14: 00007fcfb39dafa0 R15: 00007ffff55052d8 [ 33.307898][ T623] [ 33.323065][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 33.329221][ T384] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 33.349480][ T384] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 33.355617][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 33.365462][ T384] usb 2-1: Product: syz [ 33.365480][ T384] usb 2-1: Manufacturer: syz [ 33.365493][ T384] usb 2-1: SerialNumber: syz [ 33.382955][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 33.399925][ T384] usb 2-1: config 0 descriptor?? [ 33.407928][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 33.418905][ T582] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 33.437468][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 33.449327][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 33.457028][ T30] kauditd_printk_skb: 63 callbacks suppressed [ 33.457070][ T30] audit: type=1400 audit(1790384897.590:215): avc: denied { create } for pid=635 comm="syz.3.121" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 33.486894][ T576] F2FS-fs (loop2): Start checkpoint disabled! [ 33.495168][ T537] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 33.505255][ T576] attempt to access beyond end of device [ 33.505255][ T576] loop2: rw=2049, want=45104, limit=40427 [ 33.517136][ T537] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 33.526641][ T588] device veth0_vlan entered promiscuous mode [ 33.526965][ T30] audit: type=1400 audit(1790384897.630:216): avc: denied { remount } for pid=575 comm="syz.2.96" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 33.534833][ T537] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 33.560338][ T537] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 33.575424][ T537] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 33.591152][ T30] audit: type=1400 audit(1790384897.740:217): avc: denied { unmount } for pid=288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 33.593284][ T537] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 33.621265][ T588] device veth1_macvtap entered promiscuous mode [ 33.628468][ T565] tipc: Node number set to 2886997162 [ 33.648282][ T558] usb 2-1: USB disconnect, device number 3 [ 33.654751][ T537] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 33.664758][ T537] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 33.680387][ T537] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 33.692456][ T537] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 33.701454][ T537] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 33.705466][ T645] loop3: detected capacity change from 0 to 128 [ 33.728369][ T30] audit: type=1400 audit(1790384897.870:218): avc: denied { mounton } for pid=588 comm="syz-executor" path="/root/syzkaller.BroOlL/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 33.798540][ T30] audit: type=1400 audit(1790384897.940:219): avc: denied { write } for pid=649 comm="syz.2.123" name="snapshot" dev="devtmpfs" ino=90 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 33.834745][ T30] audit: type=1400 audit(1790384897.950:220): avc: denied { mounton } for pid=644 comm="syz.3.125" path="/24/file2/sys_mount" dev="loop3" ino=1048607 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=dir permissive=1 [ 33.860563][ T30] audit: type=1400 audit(1790384897.970:221): avc: denied { open } for pid=649 comm="syz.2.123" path="/dev/snapshot" dev="devtmpfs" ino=90 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 33.890818][ T30] audit: type=1400 audit(1790384897.980:222): avc: denied { append } for pid=652 comm="syz.5.127" name="kvm" dev="devtmpfs" ino=82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 33.936312][ T30] audit: type=1400 audit(1790384898.080:223): avc: denied { bind } for pid=659 comm="syz.2.129" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 33.956040][ T30] audit: type=1400 audit(1790384898.080:224): avc: denied { write } for pid=659 comm="syz.2.129" path="socket:[17347]" dev="sockfs" ino=17347 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 33.987923][ T286] FAT-fs (loop3): error, invalid access to FAT (entry 0x00000001) [ 33.996070][ T286] FAT-fs (loop3): Filesystem has been set read-only [ 34.034804][ T666] loop3: detected capacity change from 0 to 512 [ 34.087040][ T667] FAULT_INJECTION: forcing a failure. [ 34.087040][ T667] name failslab, interval 1, probability 0, space 0, times 0 [ 34.107252][ T667] CPU: 1 PID: 667 Comm: syz.2.132 Not tainted syzkaller #0 [ 34.114528][ T667] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 34.124616][ T667] Call Trace: [ 34.127928][ T667] [ 34.130897][ T667] __dump_stack+0x21/0x30 [ 34.135267][ T667] dump_stack_lvl+0x110/0x170 [ 34.140155][ T667] ? show_regs_print_info+0x20/0x20 [ 34.145411][ T667] dump_stack+0x15/0x20 [ 34.146809][ T666] EXT4-fs (loop3): invalid journal inode [ 34.149596][ T667] should_fail+0x3ab/0x500 [ 34.149623][ T667] __should_failslab+0xa4/0xe0 [ 34.149653][ T667] should_failslab+0x9/0x20 [ 34.149674][ T667] slab_pre_alloc_hook+0x39/0xd0 [ 34.155670][ T666] EXT4-fs (loop3): can't get journal size [ 34.159745][ T667] kmem_cache_alloc_trace+0x48/0x270 [ 34.159773][ T667] ? init_pseudo+0x56/0x140 [ 34.159798][ T667] init_pseudo+0x56/0x140 [ 34.193896][ T667] sockfs_init_fs_context+0x1c/0xb0 [ 34.199147][ T667] alloc_fs_context+0x645/0x7c0 [ 34.204043][ T667] fs_context_for_mount+0x22/0x30 [ 34.209114][ T667] __se_sys_fsopen+0x117/0x330 [ 34.213921][ T667] __x64_sys_fsopen+0x5b/0x70 [ 34.218637][ T667] x64_sys_call+0x553/0x9a0 [ 34.223219][ T667] do_syscall_64+0x4c/0xa0 [ 34.227666][ T667] ? clear_bhb_loop+0x50/0xa0 [ 34.232377][ T667] ? clear_bhb_loop+0x50/0xa0 [ 34.237087][ T667] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 34.243019][ T667] RIP: 0033:0x7fc2bd6cb159 [ 34.247465][ T667] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.267099][ T667] RSP: 002b:00007fc2bc124028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 34.275550][ T667] RAX: ffffffffffffffda RBX: 00007fc2bd952fa0 RCX: 00007fc2bd6cb159 [ 34.283554][ T667] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000200000000180 [ 34.291562][ T667] RBP: 00007fc2bd76206b R08: 0000000000000000 R09: 0000000000000000 [ 34.299571][ T667] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 34.307584][ T667] R13: 00007fc2bd953038 R14: 00007fc2bd952fa0 R15: 00007ffec4fc6fc8 [ 34.315601][ T667] [ 34.337414][ T666] EXT4-fs (loop3): 1 truncate cleaned up [ 34.343298][ T666] EXT4-fs (loop3): mounted filesystem without journal. Opts: norecovery,,errors=continue. Quota mode: none. [ 34.358531][ T677] FAULT_INJECTION: forcing a failure. [ 34.358531][ T677] name failslab, interval 1, probability 0, space 0, times 0 [ 34.371395][ T677] CPU: 1 PID: 677 Comm: syz.2.136 Not tainted syzkaller #0 [ 34.378643][ T677] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 34.388732][ T677] Call Trace: [ 34.392035][ T677] [ 34.394990][ T677] __dump_stack+0x21/0x30 [ 34.399353][ T677] dump_stack_lvl+0x110/0x170 [ 34.404063][ T677] ? show_regs_print_info+0x20/0x20 [ 34.409293][ T677] dump_stack+0x15/0x20 [ 34.413481][ T677] should_fail+0x3ab/0x500 [ 34.417936][ T677] __should_failslab+0xa4/0xe0 [ 34.422738][ T677] should_failslab+0x9/0x20 [ 34.427268][ T677] slab_pre_alloc_hook+0x39/0xd0 [ 34.432228][ T677] kmem_cache_alloc_trace+0x48/0x270 [ 34.437530][ T677] ? call_usermodehelper_setup+0x8e/0x210 [ 34.443284][ T677] call_usermodehelper_setup+0x8e/0x210 [ 34.448855][ T677] ? __request_module+0x920/0x920 [ 34.453903][ T677] __request_module+0x391/0x920 [ 34.458778][ T677] ? _trace_android_vh_delayacct_thrashing_end+0x110/0x110 [ 34.465996][ T677] get_fs_type+0x181/0x4e0 [ 34.470425][ T677] __se_sys_fsopen+0xfd/0x330 [ 34.475120][ T677] __x64_sys_fsopen+0x5b/0x70 [ 34.479811][ T677] x64_sys_call+0x553/0x9a0 [ 34.484329][ T677] do_syscall_64+0x4c/0xa0 [ 34.488754][ T677] ? clear_bhb_loop+0x50/0xa0 [ 34.493448][ T677] ? clear_bhb_loop+0x50/0xa0 [ 34.498133][ T677] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 34.504037][ T677] RIP: 0033:0x7fc2bd6cb159 [ 34.508466][ T677] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.528085][ T677] RSP: 002b:00007fc2bc124028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 34.536524][ T677] RAX: ffffffffffffffda RBX: 00007fc2bd952fa0 RCX: 00007fc2bd6cb159 [ 34.544509][ T677] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000180 [ 34.552493][ T677] RBP: 00007fc2bd76206b R08: 0000000000000000 R09: 0000000000000000 [ 34.560481][ T677] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 34.568462][ T677] R13: 00007fc2bd953038 R14: 00007fc2bd952fa0 R15: 00007ffec4fc6fc8 [ 34.576466][ T677] [ 34.607666][ T682] FAULT_INJECTION: forcing a failure. [ 34.607666][ T682] name failslab, interval 1, probability 0, space 0, times 0 [ 34.611071][ T666] loop_set_status: loop3 () has still dirty pages (nrpages=1) [ 34.621324][ T682] CPU: 0 PID: 682 Comm: syz.2.138 Not tainted syzkaller #0 [ 34.635018][ T682] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 34.645120][ T682] Call Trace: [ 34.648431][ T682] [ 34.651382][ T682] __dump_stack+0x21/0x30 [ 34.655744][ T682] dump_stack_lvl+0x110/0x170 [ 34.660459][ T682] ? show_regs_print_info+0x20/0x20 [ 34.665699][ T682] dump_stack+0x15/0x20 [ 34.669885][ T682] should_fail+0x3ab/0x500 [ 34.674335][ T682] __should_failslab+0xa4/0xe0 [ 34.679121][ T682] should_failslab+0x9/0x20 [ 34.683804][ T682] slab_pre_alloc_hook+0x39/0xd0 [ 34.688783][ T682] kmem_cache_alloc_trace+0x48/0x270 [ 34.694108][ T682] ? legacy_init_fs_context+0x51/0xb0 [ 34.699515][ T682] legacy_init_fs_context+0x51/0xb0 [ 34.704756][ T682] alloc_fs_context+0x645/0x7c0 [ 34.709622][ T682] fs_context_for_mount+0x22/0x30 [ 34.714656][ T682] __se_sys_fsopen+0x117/0x330 [ 34.719434][ T682] __x64_sys_fsopen+0x5b/0x70 [ 34.724155][ T682] x64_sys_call+0x553/0x9a0 [ 34.728685][ T682] do_syscall_64+0x4c/0xa0 [ 34.733143][ T682] ? clear_bhb_loop+0x50/0xa0 [ 34.737845][ T682] ? clear_bhb_loop+0x50/0xa0 [ 34.742565][ T682] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 34.748631][ T682] RIP: 0033:0x7fc2bd6cb159 [ 34.753085][ T682] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.772710][ T682] RSP: 002b:00007fc2bc124028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 34.781164][ T682] RAX: ffffffffffffffda RBX: 00007fc2bd952fa0 RCX: 00007fc2bd6cb159 [ 34.789276][ T682] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00002000000002c0 [ 34.797334][ T682] RBP: 00007fc2bd76206b R08: 0000000000000000 R09: 0000000000000000 [ 34.805376][ T682] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 34.813392][ T682] R13: 00007fc2bd953038 R14: 00007fc2bd952fa0 R15: 00007ffec4fc6fc8 [ 34.821409][ T682] [ 34.898854][ T558] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 34.906454][ T20] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 34.915051][ T692] bridge0: port 3(syz_tun) entered blocking state [ 34.921660][ T692] bridge0: port 3(syz_tun) entered disabled state [ 34.928286][ T692] FAULT_INJECTION: forcing a failure. [ 34.928286][ T692] name failslab, interval 1, probability 0, space 0, times 0 [ 34.941965][ T692] CPU: 1 PID: 692 Comm: syz.3.139 Not tainted syzkaller #0 [ 34.949296][ T692] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 34.959387][ T692] Call Trace: [ 34.962693][ T692] [ 34.965646][ T692] __dump_stack+0x21/0x30 [ 34.970014][ T692] dump_stack_lvl+0x110/0x170 [ 34.974732][ T692] ? show_regs_print_info+0x20/0x20 [ 34.979987][ T692] ? kernfs_xattr_get+0x81/0x90 [ 34.984980][ T692] ? selinux_kernfs_init_security+0x143/0x450 [ 34.991080][ T692] dump_stack+0x15/0x20 [ 34.995271][ T692] should_fail+0x3ab/0x500 [ 34.999717][ T692] __should_failslab+0xa4/0xe0 [ 35.004527][ T692] should_failslab+0x9/0x20 [ 35.009066][ T692] slab_pre_alloc_hook+0x39/0xd0 [ 35.014044][ T692] ? __kernfs_new_node+0xe1/0x670 [ 35.019104][ T692] kmem_cache_alloc+0x44/0x260 [ 35.023908][ T692] __kernfs_new_node+0xe1/0x670 [ 35.028790][ T692] ? kernfs_new_node+0x260/0x260 [ 35.033779][ T692] ? rwsem_write_trylock+0x136/0x300 [ 35.039098][ T692] ? up_write+0x7b/0x290 [ 35.043369][ T692] ? make_kgid+0x1c4/0x650 [ 35.047808][ T692] ? from_kuid_munged+0x6e0/0x6e0 [ 35.052860][ T692] kernfs_new_node+0x150/0x260 [ 35.057649][ T692] __kernfs_create_file+0x4e/0x270 [ 35.062801][ T692] sysfs_add_file_mode_ns+0x29a/0x350 [ 35.068217][ T692] sysfs_create_file_ns+0x12a/0x1b0 [ 35.073446][ T692] ? sysfs_add_file_mode_ns+0x350/0x350 [ 35.079033][ T692] ? sysfs_do_create_link_sd+0xe9/0x110 [ 35.084624][ T692] br_sysfs_addif+0xc8/0x1a0 [ 35.089241][ T692] br_add_if+0x3a2/0x1070 [ 35.093595][ T692] ? security_capable+0x87/0xb0 [ 35.098476][ T692] br_ioctl_stub+0x5e9/0xac0 [ 35.103200][ T692] ? br_dev_siocdevprivate+0x1460/0x1460 [ 35.108873][ T692] ? has_cap_mac_admin+0x370/0x370 [ 35.114034][ T692] ? __kasan_check_write+0x14/0x20 [ 35.119183][ T692] ? mutex_lock+0x9b/0x1c0 [ 35.123633][ T692] ? wait_for_completion_killable_timeout+0x10/0x10 [ 35.130292][ T692] ? selinux_file_ioctl+0x3ad/0x4c0 [ 35.135540][ T692] ? br_dev_siocdevprivate+0x1460/0x1460 [ 35.141244][ T692] sock_ioctl+0x422/0x6d0 [ 35.145612][ T692] ? sock_poll+0x3f0/0x3f0 [ 35.150086][ T692] ? __fget_files+0x2e1/0x340 [ 35.154819][ T692] ? security_file_ioctl+0x84/0xa0 [ 35.159987][ T692] ? sock_poll+0x3f0/0x3f0 [ 35.164438][ T692] __se_sys_ioctl+0x121/0x1a0 [ 35.169155][ T692] __x64_sys_ioctl+0x7b/0x90 [ 35.173804][ T692] x64_sys_call+0x2f/0x9a0 [ 35.178263][ T692] do_syscall_64+0x4c/0xa0 [ 35.182683][ T692] ? clear_bhb_loop+0x50/0xa0 [ 35.187363][ T692] ? clear_bhb_loop+0x50/0xa0 [ 35.192057][ T692] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 35.197977][ T692] RIP: 0033:0x7fcfb3753159 [ 35.202419][ T692] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.222026][ T692] RSP: 002b:00007fcfb21ac028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 35.230451][ T692] RAX: ffffffffffffffda RBX: 00007fcfb39dafa0 RCX: 00007fcfb3753159 [ 35.238459][ T692] RDX: 0000200000000000 RSI: 00000000000089a2 RDI: 0000000000000004 [ 35.246486][ T692] RBP: 00007fcfb37ea06b R08: 0000000000000000 R09: 0000000000000000 [ 35.254469][ T692] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 35.262461][ T692] R13: 00007fcfb39db038 R14: 00007fcfb39dafa0 R15: 00007ffff55052d8 [ 35.270456][ T692] [ 35.281597][ T558] usb 2-1: Using ep0 maxpacket: 8 [ 35.408971][ T558] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 35.419193][ T20] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 35.431533][ T564] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 35.439158][ T558] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 4 [ 35.453179][ T20] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 35.457889][ T701] loop2: detected capacity change from 0 to 40427 [ 35.463483][ T20] usb 1-1: New USB device found, idVendor=8086, idProduct=0000, bcdDevice= 0.00 [ 35.478627][ T20] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 35.489631][ T701] file system registered [ 35.495492][ T701] read descriptors [ 35.505036][ T288] ffs_data_put(): freeing [ 35.649218][ T558] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.c0 [ 35.658497][ T558] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.666610][ T558] usb 2-1: Product: syz [ 35.671041][ T558] usb 2-1: Manufacturer: syz [ 35.675669][ T558] usb 2-1: SerialNumber: syz [ 35.684869][ T564] usb 6-1: Using ep0 maxpacket: 32 [ 35.702206][ T732] tipc: Enabled bearer , priority 10 [ 35.719314][ T734] loop3: detected capacity change from 0 to 16 [ 35.726904][ T734] erofs: (device loop3): check_layout_compatibility: unidentified incompatible feature 1f0, please upgrade kernel version [ 35.749411][ T558] cdc_acm 2-1:1.0: skipping garbage [ 35.785694][ T735] uffd: Set unprivileged_userfaultfd sysctl knob to 1 if kernel faults must be handled without obtaining CAP_SYS_PTRACE capability [ 35.821610][ T734] loop3: detected capacity change from 0 to 16 [ 35.828677][ T734] erofs: (device loop3): check_layout_compatibility: unidentified incompatible feature f0, please upgrade kernel version [ 35.849126][ T564] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 35.950675][ T6] usb 2-1: USB disconnect, device number 4 [ 35.970955][ T20] hid-generic 0003:8086:0000.0001: unknown main item tag 0x0 [ 35.978712][ T20] hid-generic 0003:8086:0000.0001: unknown main item tag 0x0 [ 35.988075][ T20] hid-generic 0003:8086:0000.0001: hiddev96,hidraw0: USB HID v1.11 Device [HID 8086:0000] on usb-dummy_hcd.0-1/input0 [ 36.038952][ T564] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 36.048138][ T564] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 36.056471][ T564] usb 6-1: Product: syz [ 36.060684][ T564] usb 6-1: Manufacturer: syz [ 36.065291][ T564] usb 6-1: SerialNumber: syz [ 36.073987][ T564] usb 6-1: config 0 descriptor?? [ 36.098993][ T697] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 36.119489][ T564] hub 6-1:0.0: bad descriptor, ignoring hub [ 36.125503][ T564] hub: probe of 6-1:0.0 failed with error -5 [ 36.417174][ T756] device-mapper: ioctl: The device has no table. [ 36.439162][ T384] usb 6-1: USB disconnect, device number 2 [ 36.777424][ T766] loop1: detected capacity change from 0 to 131072 [ 36.788967][ T384] usb 6-1: new full-speed USB device number 3 using dummy_hcd [ 36.831594][ T766] F2FS-fs (loop1): Test dummy encryption mode enabled [ 36.840001][ T766] F2FS-fs (loop1): invalid crc value [ 36.846674][ T766] F2FS-fs (loop1): Found nat_bits in checkpoint [ 36.883158][ T766] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=80000000, run fsck to fix. [ 36.894270][ T766] F2FS-fs (loop1): Cannot turn on quotas: -2 on 0 [ 36.901133][ T766] F2FS-fs (loop1): Start checkpoint disabled! [ 36.908195][ T766] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e6 [ 36.925282][ T766] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 36.951044][ T537] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=80000000, run fsck to fix. [ 37.169465][ T384] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid maxpacket 1024, setting to 64 [ 37.232259][ T789] device ip6_vti0 entered promiscuous mode [ 37.252727][ T791] loop1: detected capacity change from 0 to 512 [ 37.294670][ T791] EXT4-fs (loop1): invalid journal inode [ 37.300487][ T791] EXT4-fs (loop1): can't get journal size [ 37.307709][ T791] EXT4-fs (loop1): 1 truncate cleaned up [ 37.313669][ T791] EXT4-fs (loop1): mounted filesystem without journal. Opts: norecovery,,errors=continue. Quota mode: none. [ 37.348870][ T791] loop_set_status: loop1 () has still dirty pages (nrpages=1) [ 37.369012][ T384] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 37.378158][ T384] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 37.386412][ T384] usb 6-1: Product: syz [ 37.390726][ T384] usb 6-1: Manufacturer: syz [ 37.395319][ T384] usb 6-1: SerialNumber: syz [ 37.400785][ T384] usb 6-1: config 0 descriptor?? [ 37.418927][ T697] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 37.439598][ T384] hub 6-1:0.0: bad descriptor, ignoring hub [ 37.445601][ T384] hub: probe of 6-1:0.0 failed with error -5 [ 37.558854][ T565] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 37.570415][ T807] FAULT_INJECTION: forcing a failure. [ 37.570415][ T807] name failslab, interval 1, probability 0, space 0, times 0 [ 37.583165][ T807] CPU: 0 PID: 807 Comm: syz.1.188 Not tainted syzkaller #0 [ 37.590409][ T807] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 37.600466][ T807] Call Trace: [ 37.603743][ T807] [ 37.606669][ T807] __dump_stack+0x21/0x30 [ 37.611001][ T807] dump_stack_lvl+0x110/0x170 [ 37.615784][ T807] ? show_regs_print_info+0x20/0x20 [ 37.621039][ T807] dump_stack+0x15/0x20 [ 37.625226][ T807] should_fail+0x3ab/0x500 [ 37.629671][ T807] __should_failslab+0xa4/0xe0 [ 37.634455][ T807] should_failslab+0x9/0x20 [ 37.638990][ T807] slab_pre_alloc_hook+0x39/0xd0 [ 37.643930][ T807] kmem_cache_alloc_trace+0x48/0x270 [ 37.649215][ T807] ? futex_requeue+0x17ce/0x1910 [ 37.654169][ T807] futex_requeue+0x17ce/0x1910 [ 37.659027][ T807] ? do_futex+0x2800/0x2800 [ 37.663556][ T807] ? futex_wake+0x8f0/0x8f0 [ 37.668065][ T807] ? __stack_depot_save+0x34/0x480 [ 37.673179][ T807] ? path_openat+0x284f/0x2f80 [ 37.677942][ T807] do_futex+0xcc6/0x2800 [ 37.682204][ T807] ? kasan_set_track+0x4a/0x70 [ 37.686973][ T807] ? kmem_cache_free+0x100/0x320 [ 37.691909][ T807] ? do_sys_openat2+0x6df/0x7f0 [ 37.696761][ T807] ? x64_sys_call+0x219/0x9a0 [ 37.701446][ T807] ? do_syscall_64+0x4c/0xa0 [ 37.706047][ T807] ? entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 37.712207][ T807] ? _kstrtoull+0x3bb/0x4c0 [ 37.716715][ T807] ? futex_exit_release+0x1e0/0x1e0 [ 37.721921][ T807] ? kstrtouint_from_user+0x1c4/0x220 [ 37.727288][ T807] ? kstrtol_from_user+0x2a0/0x2a0 [ 37.732398][ T807] ? __kasan_check_write+0x14/0x20 [ 37.737511][ T807] ? proc_fail_nth_write+0x180/0x200 [ 37.742796][ T807] ? proc_fail_nth_read+0x220/0x220 [ 37.747993][ T807] ? security_file_permission+0x79/0xa0 [ 37.753549][ T807] ? vfs_write+0xc72/0xfd0 [ 37.757966][ T807] ? file_end_write+0x1b0/0x1b0 [ 37.762811][ T807] ? __kasan_check_write+0x14/0x20 [ 37.767919][ T807] ? mutex_unlock+0x8f/0x230 [ 37.772518][ T807] __se_sys_futex+0x135/0x330 [ 37.777203][ T807] ? __kasan_check_write+0x14/0x20 [ 37.782318][ T807] ? __x64_sys_futex+0x100/0x100 [ 37.787257][ T807] ? ksys_write+0x1fa/0x260 [ 37.791758][ T807] ? __kasan_check_write+0x14/0x20 [ 37.796867][ T807] __x64_sys_futex+0xe5/0x100 [ 37.801545][ T807] x64_sys_call+0x251/0x9a0 [ 37.806049][ T807] do_syscall_64+0x4c/0xa0 [ 37.810469][ T807] ? clear_bhb_loop+0x50/0xa0 [ 37.815268][ T807] ? clear_bhb_loop+0x50/0xa0 [ 37.820047][ T807] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 37.826068][ T807] RIP: 0033:0x7f7fe51fa159 [ 37.830589][ T807] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 37.850209][ T807] RSP: 002b:00007f7fe3c53028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 37.858628][ T807] RAX: ffffffffffffffda RBX: 00007f7fe5481fa0 RCX: 00007f7fe51fa159 [ 37.866599][ T807] RDX: 0000000000000001 RSI: 000000000000000c RDI: 0000000000000000 [ 37.874570][ T807] RBP: 00007f7fe529106b R08: 0000200000048000 R09: 0000000000000000 [ 37.883039][ T807] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 37.891029][ T807] R13: 00007f7fe5482038 R14: 00007f7fe5481fa0 R15: 00007ffe4bda0108 [ 37.899014][ T807] [ 37.913615][ T6] usb 1-1: USB disconnect, device number 3 [ 37.929200][ T565] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 37.943743][ T565] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 37.973087][ T813] loop0: detected capacity change from 0 to 512 [ 38.028965][ T564] usb 6-1: USB disconnect, device number 3 [ 38.036670][ T813] EXT4-fs (loop0): mounted filesystem without journal. Opts: noauto_da_alloc,max_dir_size_kb=0x0000000000000091,,errors=continue. Quota mode: writeback. [ 38.052443][ T813] ext4 filesystem being mounted at /52/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 38.068476][ T813] EXT4-fs error (device loop0): ext4_get_first_dir_block:3597: inode #12: comm syz.0.190: Attempting to read directory block (0) that is past i_size (3) [ 38.109279][ T813] loop_set_status: loop0 () has still dirty pages (nrpages=2) [ 38.128136][ T818] ================================================================== [ 38.136263][ T818] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0x88e/0x3200 [ 38.144463][ T818] Read of size 8 at addr ffff88810f1b08c0 by task syz.1.192/818 [ 38.152121][ T818] [ 38.154447][ T818] CPU: 0 PID: 818 Comm: syz.1.192 Not tainted syzkaller #0 [ 38.161649][ T818] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 38.171717][ T818] Call Trace: [ 38.174997][ T818] [ 38.177936][ T818] __dump_stack+0x21/0x30 [ 38.182276][ T818] dump_stack_lvl+0x110/0x170 [ 38.186956][ T818] ? show_regs_print_info+0x20/0x20 [ 38.192159][ T818] ? load_image+0x3f0/0x3f0 [ 38.196669][ T818] print_address_description+0x7f/0x2c0 [ 38.199239][ T565] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice= 1.00 [ 38.202223][ T818] ? tc_setup_flow_action+0x88e/0x3200 [ 38.211578][ T565] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.216722][ T818] kasan_report+0x10f/0x150 [ 38.227236][ T565] usb 3-1: Product: syz [ 38.229252][ T818] ? tc_setup_flow_action+0x88e/0x3200 [ 38.229284][ T818] __asan_report_load8_noabort+0x14/0x20 [ 38.234083][ T565] usb 3-1: Manufacturer: syz [ 38.238909][ T818] tc_setup_flow_action+0x88e/0x3200 [ 38.238945][ T818] mall_replace_hw_filter+0x2db/0x8d0 [ 38.245223][ T565] usb 3-1: SerialNumber: syz [ 38.249167][ T818] ? pcpu_block_update_hint_alloc+0x8bc/0xc50 [ 38.249196][ T818] ? mall_set_parms+0x520/0x520 [ 38.249217][ T818] ? tcf_exts_destroy+0xb0/0xb0 [ 38.249240][ T818] ? pcpu_alloc+0x1118/0x16f0 [ 38.249264][ T818] ? mall_set_parms+0x1e4/0x520 [ 38.249283][ T818] mall_change+0x544/0x760 [ 38.249301][ T818] ? __kasan_check_write+0x14/0x20 [ 38.249325][ T818] ? mall_get+0xa0/0xa0 [ 38.249343][ T818] ? tcf_chain_tp_insert_unique+0x946/0xa70 [ 38.309395][ T818] ? mall_get+0xa0/0xa0 [ 38.313570][ T818] tc_new_tfilter+0x13df/0x1990 [ 38.318429][ T818] ? tcf_gate_entry_destructor+0x20/0x20 [ 38.324069][ T818] ? security_capable+0x87/0xb0 [ 38.328927][ T818] ? ns_capable+0x8c/0xf0 [ 38.333272][ T818] ? netlink_net_capable+0x125/0x160 [ 38.338556][ T818] ? tcf_gate_entry_destructor+0x20/0x20 [ 38.344188][ T818] rtnetlink_rcv_msg+0x83c/0xcb0 [ 38.349223][ T818] ? rtnetlink_bind+0x80/0x80 [ 38.353940][ T818] ? avc_has_perm_noaudit+0x390/0x490 [ 38.359386][ T818] ? memcpy+0x56/0x70 [ 38.363404][ T818] ? avc_has_perm_noaudit+0x30a/0x490 [ 38.368816][ T818] ? arch_stack_walk+0xee/0x140 [ 38.373697][ T818] ? avc_denied+0x1b0/0x1b0 [ 38.378223][ T818] ? stack_trace_save+0xa6/0xf0 [ 38.383091][ T818] ? avc_has_perm+0x163/0x250 [ 38.387775][ T818] ? avc_has_perm_noaudit+0x490/0x490 [ 38.393153][ T818] ? x64_sys_call+0x4b/0x9a0 [ 38.397763][ T818] ? selinux_nlmsg_lookup+0x39d/0x440 [ 38.403140][ T818] netlink_rcv_skb+0x1e9/0x430 [ 38.407939][ T818] ? rtnetlink_bind+0x80/0x80 [ 38.412621][ T818] ? netlink_ack+0xb10/0xb10 [ 38.417215][ T818] ? _copy_from_iter+0x4a4/0x10a0 [ 38.422246][ T818] ? __netlink_lookup+0x387/0x3b0 [ 38.427280][ T818] rtnetlink_rcv+0x1c/0x20 [ 38.431700][ T818] netlink_unicast+0x86c/0xa30 [ 38.436471][ T818] netlink_sendmsg+0x879/0xb80 [ 38.441241][ T818] ? netlink_getsockopt+0x530/0x530 [ 38.446551][ T818] ? security_socket_sendmsg+0x82/0xa0 [ 38.452194][ T818] ? netlink_getsockopt+0x530/0x530 [ 38.457401][ T818] ____sys_sendmsg+0x5be/0x8f0 [ 38.462183][ T818] ? __sys_sendmsg_sock+0x40/0x40 [ 38.467212][ T818] ? import_iovec+0x7c/0xb0 [ 38.471806][ T818] ___sys_sendmsg+0x236/0x2e0 [ 38.476490][ T818] ? __sys_sendmsg+0x280/0x280 [ 38.481259][ T818] ? sock_show_fdinfo+0xa0/0xa0 [ 38.486116][ T818] ? __fdget+0x1a1/0x230 [ 38.490360][ T818] __x64_sys_sendmsg+0x201/0x2d0 [ 38.495311][ T818] ? ___sys_sendmsg+0x2e0/0x2e0 [ 38.500180][ T818] ? __kasan_check_write+0x14/0x20 [ 38.505294][ T818] ? switch_fpu_return+0x15d/0x2c0 [ 38.510430][ T818] x64_sys_call+0x4b/0x9a0 [ 38.514848][ T818] do_syscall_64+0x4c/0xa0 [ 38.519266][ T818] ? clear_bhb_loop+0x50/0xa0 [ 38.523946][ T818] ? clear_bhb_loop+0x50/0xa0 [ 38.528624][ T818] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 38.534518][ T818] RIP: 0033:0x7f7fe51fa159 [ 38.538942][ T818] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 38.558662][ T818] RSP: 002b:00007f7fe3c53028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 38.567089][ T818] RAX: ffffffffffffffda RBX: 00007f7fe5481fa0 RCX: 00007f7fe51fa159 [ 38.575072][ T818] RDX: 0000000020000000 RSI: 0000200000000480 RDI: 0000000000000004 [ 38.583060][ T818] RBP: 00007f7fe529106b R08: 0000000000000000 R09: 0000000000000000 [ 38.591036][ T818] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 38.599009][ T818] R13: 00007f7fe5482038 R14: 00007f7fe5481fa0 R15: 00007ffe4bda0108 [ 38.606985][ T818] [ 38.610007][ T818] [ 38.612331][ T818] Allocated by task 818: [ 38.616571][ T818] __kasan_kmalloc+0xd4/0x100 [ 38.621281][ T818] __kmalloc+0x13d/0x2c0 [ 38.625527][ T818] tcf_idr_create+0x5f/0x790 [ 38.630118][ T818] tcf_idr_create_from_flags+0x61/0x70 [ 38.635581][ T818] tcf_gact_init+0x342/0x570 [ 38.640170][ T818] tcf_action_init_1+0x3fd/0x6b0 [ 38.645133][ T818] tcf_action_init+0x233/0x7a0 [ 38.649936][ T818] tcf_exts_validate+0x24a/0x580 [ 38.654898][ T818] mall_set_parms+0x48/0x520 [ 38.659498][ T818] mall_change+0x478/0x760 [ 38.663916][ T818] tc_new_tfilter+0x13df/0x1990 [ 38.668773][ T818] rtnetlink_rcv_msg+0x83c/0xcb0 [ 38.673726][ T818] netlink_rcv_skb+0x1e9/0x430 [ 38.678889][ T818] rtnetlink_rcv+0x1c/0x20 [ 38.683322][ T818] netlink_unicast+0x86c/0xa30 [ 38.688088][ T818] netlink_sendmsg+0x879/0xb80 [ 38.692856][ T818] ____sys_sendmsg+0x5be/0x8f0 [ 38.697633][ T818] ___sys_sendmsg+0x236/0x2e0 [ 38.702423][ T818] __x64_sys_sendmsg+0x201/0x2d0 [ 38.707360][ T818] x64_sys_call+0x4b/0x9a0 [ 38.711938][ T818] do_syscall_64+0x4c/0xa0 [ 38.716474][ T818] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 38.722383][ T818] [ 38.724722][ T818] The buggy address belongs to the object at ffff88810f1b0800 [ 38.724722][ T818] which belongs to the cache kmalloc-192 of size 192 [ 38.738773][ T818] The buggy address is located 0 bytes to the right of [ 38.738773][ T818] 192-byte region [ffff88810f1b0800, ffff88810f1b08c0) [ 38.752421][ T818] The buggy address belongs to the page: [ 38.758087][ T818] page:ffffea00043c6c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10f1b0 [ 38.768435][ T818] flags: 0x4000000000000200(slab|zone=1) [ 38.774111][ T818] raw: 4000000000000200 ffffea00043c6d80 0000000600000006 ffff888100042c00 [ 38.782717][ T818] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 38.791435][ T818] page dumped because: kasan: bad access detected [ 38.797971][ T818] page_owner tracks the page as allocated [ 38.803783][ T818] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 102, ts 5527796556, free_ts 5527775298 [ 38.819609][ T818] post_alloc_hook+0x192/0x1b0 [ 38.824430][ T818] prep_new_page+0x1c/0x110 [ 38.828948][ T818] get_page_from_freelist+0x2c3a/0x2cd0 [ 38.834514][ T818] __alloc_pages+0x1a2/0x460 [ 38.839247][ T818] new_slab+0xa0/0x4d0 [ 38.843335][ T818] ___slab_alloc+0x3ac/0x840 [ 38.847951][ T818] __slab_alloc+0x49/0x90 [ 38.852304][ T818] kmem_cache_alloc_trace+0x146/0x270 [ 38.857700][ T818] kernfs_fop_open+0x375/0xbb0 [ 38.862497][ T818] do_dentry_open+0x82a/0x1010 [ 38.867290][ T818] vfs_open+0x73/0x80 [ 38.871293][ T818] path_openat+0x26e6/0x2f80 [ 38.875895][ T818] do_filp_open+0x1df/0x400 [ 38.880406][ T818] do_sys_openat2+0x15e/0x7f0 [ 38.885095][ T818] __x64_sys_openat+0x136/0x160 [ 38.889957][ T818] x64_sys_call+0x219/0x9a0 [ 38.894488][ T818] page last free stack trace: [ 38.899186][ T818] free_unref_page_prepare+0x5fa/0x600 [ 38.904834][ T818] free_unref_page+0xae/0x540 [ 38.909541][ T818] __free_pages+0x6c/0x100 [ 38.913977][ T818] free_pages+0x82/0x90 [ 38.918148][ T818] selinux_genfs_get_sid+0x20b/0x250 [ 38.923470][ T818] inode_doinit_with_dentry+0x884/0xd90 [ 38.929032][ T818] selinux_d_instantiate+0x27/0x40 [ 38.934161][ T818] security_d_instantiate+0x9e/0xf0 [ 38.939377][ T818] d_splice_alias+0x6d/0x390 [ 38.943976][ T818] kernfs_iop_lookup+0x2c2/0x310 [ 38.948944][ T818] path_openat+0x1436/0x2f80 [ 38.953576][ T818] do_filp_open+0x1df/0x400 [ 38.958094][ T818] do_sys_openat2+0x15e/0x7f0 [ 38.962868][ T818] __x64_sys_openat+0x136/0x160 [ 38.967733][ T818] x64_sys_call+0x219/0x9a0 [ 38.972271][ T818] do_syscall_64+0x4c/0xa0 [ 38.976712][ T818] [ 38.979044][ T818] Memory state around the buggy address: [ 38.984680][ T818] ffff88810f1b0780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 38.992761][ T818] ffff88810f1b0800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 39.000840][ T818] >ffff88810f1b0880: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 39.008912][ T818] ^ [ 39.015070][ T818] ffff88810f1b0900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 39.023141][ T818] ffff88810f1b0980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 39.031209][ T818] ================================================================== [ 39.039277][ T818] Disabling lock debugging due to kernel taint [ 39.061982][ T30] kauditd_printk_skb: 42 callbacks suppressed [ 39.061998][ T30] audit: type=1400 audit(1790384903.210:267): avc: denied { read } for pid=83 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 39.090227][ T6] usb 3-1: USB disconnect, device number 6 [ 39.093281][ T30] audit: type=1400 audit(1790384903.210:268): avc: denied { search } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 39.118539][ T285] EXT4-fs error (device loop0): ext4_empty_dir:3136: inode #12: comm syz-executor: invalid size [ 39.131692][ T285] EXT4-fs error (device loop0): ext4_empty_dir:3136: inode #12: comm syz-executor: invalid size [ 39.142451][ T30] audit: type=1400 audit(1790384903.210:269): avc: denied { write } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 39.142619][ T285] EXT4-fs error (device loop0): ext4_empty_dir:3136: inode #12: comm syz-executor: invalid size [ 39.166593][ T285] EXT4-fs error (device loop0): ext4_empty_dir:3136: inode #12: comm syz-executor: invalid size [ 39.174663][ T30] audit: type=1400 audit(1790384903.210:270): avc: denied { add_name } for pid=83 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 39.187795][ T285] EXT4-fs error (device loop0): ext4_empty_dir:3136: inode #12: comm syz-executor: invalid size [ 39.219301][ T285] EXT4-fs error (device loop0): ext4_empty_dir:3136: inode #12: comm syz-executor: invalid size [ 39.233710][ T30] audit: type=1400 audit(1790384903.210:271): avc: denied { create } for pid=83 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 39.243195][ T285] EXT4-fs error (device loop0): ext4_empty_dir:3136: inode #12: comm syz-executor: invalid size [ 39.255073][ T30] audit: type=1400 audit(1790384903.210:272): avc: denied { append open } for pid=83 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 39.266571][ T285] EXT4-fs error (device loop0): ext4_empty_dir:3136: inode #12: comm syz-executor: invalid size [ 39.287644][ T30] audit: type=1400 audit(1790384903.210:273): avc: denied { getattr } for pid=83 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 39.321236][ T285] EXT4-fs error (device loop0): ext4_empty_dir:3136: inode #12: comm syz-executor: invalid size [ 39.355863][ T285] bridge0: port 3(syz_tun) entered disabled state [ 39.363445][ T285] device syz_tun left promiscuous mode [ 39.369204][ T285] bridge0: port 3(syz_tun) entered disabled state [ 39.390439][ T10] tipc: Disabling bearer [ 39.395826][ T10] tipc: Left network mode [ 39.879675][ T10] device bridge_slave_1 left promiscuous mode [ 39.885897][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.894088][ T10] device bridge_slave_0 left promiscuous mode [ 39.900304][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.908573][ T10] device veth1_macvtap left promiscuous mode [ 39.914980][ T10] device veth0_vlan left promiscuous mode [ 41.066284][ T30] audit: type=1400 audit(1790384905.210:274): avc: denied { search } for pid=820 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 41.108853][ T30] audit: type=1400 audit(1790384905.210:275): avc: denied { read } for pid=821 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=487 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 41.134266][ T30] audit: type=1400 audit(1790384905.210:276): avc: denied { open } for pid=821 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=487 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1