last executing test programs: 3m50.116951684s ago: executing program 4 (id=178): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'ccm(aes)\x00'}, 0x58) accept4(r0, 0x0, 0x0, 0x80000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0xb66, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0xa, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) sendmmsg(0xffffffffffffffff, &(0x7f0000000100)=[{{0x0, 0x2d, &(0x7f00000000c0)=[{&(0x7f0000000000)="1b", 0x40000}], 0x1}}], 0x51, 0x0) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) 3m50.001310181s ago: executing program 4 (id=180): socket$inet6(0xa, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x17, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x20000000}, [@call={0x85, 0x0, 0x0, 0x2f}, @printk={@lu, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x72}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x23, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$packet(0x11, 0x2, 0x300) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000180)=r1, 0x4) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000000c0)='veth0_virt_wifi\x00', 0x10) sendto$inet(r2, 0x0, 0x0, 0x804, &(0x7f0000000080)={0x2, 0x4ea2, @multicast1}, 0x10) 3m49.980027877s ago: executing program 4 (id=182): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newqdisc={0x48, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r6, {0xc, 0x10}, {0x7, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) 3m49.796642264s ago: executing program 4 (id=184): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000180)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x482, &(0x7f0000000600)=0x0) io_submit(r2, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x7, r1, 0x0}]) 3m49.554237887s ago: executing program 4 (id=185): prlimit64(0x0, 0x6, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0xfffffffe, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x4004800) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x3e7, &(0x7f0000000200)={&(0x7f0000000a00)={0x28, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}]}, 0x28}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8b04, &(0x7f0000000040)={'wlan1\x00', @random="0300"}) 3m49.383763781s ago: executing program 4 (id=186): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r1, &(0x7f0000000040)='FROZEN\x00', 0x7) r2 = syz_clone(0x2100, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = openat$cgroup_procs(r0, &(0x7f00000002c0)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000300)=r2, 0x12) write$cgroup_freezer_state(r1, &(0x7f0000000080)='THAWED\x00', 0x7) 3m49.120529513s ago: executing program 32 (id=186): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r1, &(0x7f0000000040)='FROZEN\x00', 0x7) r2 = syz_clone(0x2100, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = openat$cgroup_procs(r0, &(0x7f00000002c0)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000300)=r2, 0x12) write$cgroup_freezer_state(r1, &(0x7f0000000080)='THAWED\x00', 0x7) 3m29.231109609s ago: executing program 5 (id=282): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000040), 0x208e24b) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x4, &(0x7f0000000340)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x5}]}, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000004c00)=@newtfilter={0x44, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {0xf, 0x9}, {0x1}, {0x300, 0x1}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FD={0x8, 0x6, r3}]}}]}, 0x44}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) ftruncate(r1, 0x5) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000380)={0x8, 0x4d, 0x2ba8}) getpgid(0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) r4 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f00000000c0)={0xb, 0x1, 0x4, 0x0, 0x7}) ioctl$vim2m_VIDIOC_STREAMOFF(r4, 0x40045612, &(0x7f0000000000)=0x1) r5 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x29) write(r6, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) ppoll(&(0x7f0000000100)=[{r4, 0x1004}], 0x1, 0x0, 0x0, 0x0) ioctl$vim2m_VIDIOC_S_CTRL(r5, 0xc008561c, &(0x7f0000000040)={0xf0f046}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) r7 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000380)={0x200, 0x4f, 0x4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r7, 0xc02064b2, &(0x7f0000000100)={0x1, 0x3, 0x9}) 3m27.717728249s ago: executing program 5 (id=288): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7) r1 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000040)=@req3={0x80000000}, 0xfeda) listen(r1, 0x0) bind$netlink(r1, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfc, 0x80040040}, 0xc) r2 = socket(0x1e, 0x805, 0x0) sendmsg$tipc(r2, &(0x7f0000000080)={&(0x7f0000000100)=@name, 0x10, 0x0}, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f00000000c0)=@req3={0x80000000, 0x0, 0x2}, 0x1c) accept4$nfc_llcp(r1, 0x0, 0x0, 0x0) sendmsg$tipc(r2, &(0x7f0000000500)={&(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41, 0x0, 0x2}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x40001) 3m27.434484526s ago: executing program 5 (id=290): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r1, r1, 0x0, 0x200000) 3m25.764486221s ago: executing program 5 (id=296): r0 = socket$rxrpc(0x21, 0x2, 0xa) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'vlan1\x00'}) mount(0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000380)='mounts\x00') r2 = epoll_create(0x7) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000000)) mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000040)='devpts\x00', 0x3000096, 0x0) chroot(&(0x7f0000000100)='./file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x21d000, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f00000000c0)='./file0/../file0/../file0\x00') 3m25.450561385s ago: executing program 5 (id=299): r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000040)=0x91, 0x4) connect$inet6(r0, 0x0, 0x0) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000040)=0x4, 0x4) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x5c}, 0x1, 0x0, 0x0, 0x88c1}, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x58, 0x10, 0x401, 0x400000, 0x3, {0x0, 0x0, 0x0, 0x0, 0xe59bca127d81a0fa, 0xc574450d1af3b5a4}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge_slave={{0x11}, {0xc, 0x5, 0x0, 0x1, [@IFLA_BRPORT_MULTICAST_ROUTER={0x5, 0x19, 0x3}]}}}, @IFLA_IFNAME={0x14, 0x3, 'bridge_slave_0\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x800}, 0x4040) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f00000003c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x20, 0x20, 0x4, [@func={0x2, 0x0, 0x0, 0xc, 0x2}, @func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{0x2, 0x1}]}]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x3c}, 0x28) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r1, 0xc0385868, &(0x7f0000000140)={r1, &(0x7f0000000040)='bridge_slave_0\x00', 0x400, &(0x7f0000000080)={@align=0x3, {0x0, 0x81, 0x1, 0x66}}, 0x3, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000100)=0x81}) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'xchacha12-neon\x00'}, 0x58) 3m23.011472631s ago: executing program 5 (id=303): timer_create(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000340)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 3m20.386273064s ago: executing program 33 (id=303): timer_create(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000340)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x44, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 4.524860815s ago: executing program 3 (id=832): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3}, 0x61) setsockopt$packet_fanout_data(0xffffffffffffffff, 0x107, 0x16, &(0x7f0000000100)={0x1, &(0x7f0000000180)=[{0x1, 0x5, 0xfd, 0x9}]}, 0x10) write$binfmt_misc(r0, &(0x7f0000000100), 0x6) 4.361318195s ago: executing program 0 (id=833): pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) splice(r1, 0x0, r0, 0x0, 0x1ffffffffffffe, 0x1) syz_emit_ethernet(0x100f, &(0x7f0000001c80)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1001, 0x2, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0xfed, 0x0, @opaque="eacf83411e940631d1177c5419d8194af788aae8b9e6f49fdd8f087287ce20e2b8aead35077937c4f4df11921904e78d2c1ee1106293c71053e9b23d301bf5ea995eadb59b1bcea524abc8b3f7f5a17bb7c15686750cc25724638d59fa45f910082c2fb0d727dfadc3d4d7a760436da76427d7f0db92fd790c35b175166e74be34b4fba3ded3c947c40ce62ebe2594859d9d06e0578b3650ebfc9b377796b9e2c754477d6e79a290c3cdcd2c041db0f567fae6d4406f55986255ab696fbe9a8a5adc5f1ed4a99fb3fbf66c552bd97ef9af881a9f0dd48bc43a52285ee627a85771e0a779869232749a82cb37a854f9be86b81120852fe205d6c230b73a4bc6b851aaf3942e06635523a95b6889c811c310cba9ff6b71cdfb792cdc4dc2565f8b17618142e4924c8d23a9f79db882f866f30ad3b7747e856d06891f9a59045cf42684023f6c5e55197d72e0bc76c5dbcd2b2b1011813a31b912cadaf5e25ace31ede91dd573813536000db7fd426c2dd4940aa55c3665416ddeb03316e5c25871b0866f610fd6457e504507c529f8be0952b5a03ab69305bd4c2f66ba21fe0b90025b792391bb7a9445b6472d8e676c5c894476bd017ff96ca891374d4cf25ed4cbf92161ef10b4aee7ee89f5f6d85328030c35933b8b197eb16bc6dafd21f69a809779452cfef0860bcb258382ffe5bcee3aac978f92a5a4aeeb79464b288c75a5ad8db6faa7a8ef5628f51effb3d6cf2d6d65cbb1ce6d3d268de86fa1496259a9cf9686c73bc474ac890371b7a7cab2ac0a02e3d0f1c175c8e722df10f7e137b1d39c6f4640c1eb1691a1259732452d01adf4bf84a227198039c17493b6c2c59dae6d2ea6876b03d08e1ef4cdfca4c5b997d2d7bc672013c609803ecb634ee6824140acd66e2a354df0434d1acd5085909197d2f4d7e79967028237e01fe35867ff6b3b5685382a6815e35dafc279c25159e1ee2f54129ff7d310427287777589b9f44ee4e02cbc417f389890ba99c3fba2eafcf4ed8ac1e399649f636b9687ddffaf136605d2dd8a989a850092a693378777d0d0634edb83a6039d193ce1ac1035b81a10322369727b187d64fb1ef4708b81ce26503f0a44029265dd9a3e31ab8d8b3a745081693492e21349204311e1c46ea35b52ffffc6d4e7ea985ffe3b925384897503655bf8931fcb340ab568f0c3f3219f284697ae4748dc705deb97d8f44122c6e7f74bc2dba24a3ca47ad29146aed8a07483e430addce14b2c87bc273bdab76a08f544bdbda639c1c3c942f056f9b52a5bdb30bf6c8a9c5177c2760993d003304af0640c47bff9fdbbed0e837711ed76883e4af4430ac5b87df367ac6f2e556f658b13acaed052aea05b0b802e152bb3264e0b6c74951e5be82b4a4a6b03f9d33a6bda07eb5e8e982274e83d7d3a66a76cc21f0df152bb830c22a9efb0aa088c4bf79392cad3910486996bf187f3b99a099ecbfaaac96470c3cfe9ed91ed71dedbfe27f9cef7883e30c3413de120c6c68ecf33d5fa6de0353fbac3a85a099aa14cd90bcaec576ae97e1bec763feb131c1ba7134771da6af4c07f5b157d79eec848189cc0a4654890472d19043ebff3f033251dd8aa4b44939efd24a127cd751364e82f6e331e938815df34c6291faba82b7ebd2bdf9db630a3fb7a158cc63ff5eb47f2c2619122cf97a5c323fe5355a65863709ecdbb53b0c0818abdf0a6b775e18b0fd91338d8c25c43adfe7f46eabc9079511c2ded9cb6fd86de4dc1daeb99dd5c9bfbb0c1b0ecab6ebcdbe13df8d1bad4d2dd8a223eae7b7adce8a8b890ebdf972b34f04f027efdcf7402d19eda5d9feaee67a20d46197cfc2225e6d5d89ac7c6df4b3342591e0a87cb8cd88ee25e689de2c05d6d5bf4d4b7a040edf587cc986b59cb6f806e72dcd3f24a202bdafdef275cb1ce8971a7cb2b2c222e5afc453f84198f5fee3f6513b4efe7974ca03e08535d9e520943e3ce78d8a68f793444729d59afbbbe9465d6afdfe810ca28c81364ae03561eb7f3865171884bb394ae0d8676514aabd1c0e60bec3d09ae65683b83f5390b3d027fbb2e7eb86521193d9da3254c4118f7f82a9312d06bc8462cf8c6bcbcb5f4830549196ae9d936b1f3b2d5360ec266af607f3f773546760447740e1b08864c1327ae22774face56d42c21fe01a9d8320f99b8afe54fa952e182a2a8c6f3fb6078072647be431260e40e8b2979d38f5bce775887c503b1288fee8d23354e0519e424a54d1368fd2621cc943a4cd1eec057d69bdf51d7a539cf48fb8794a1e2b037a9586c2a3f529b726f583ba2785608ef740371db315e8f406e40b7ec358c35f0334fca281d5082a7b3c2f4c2b95db4773a610b6b9c7563fc213a672531d9bf3d4209a5839f2aa6c74a21e2e9b5bc107360e73c8b1735ecfb05520cde72cb49f924042216ab7f777ad81d844999f54cd49add432bc7858124d62ba7bd09785ac96f64e35399de1dcab142735efdb497d99e47edf940884dedc716f0116ab7997525bfa5404fb866cf08e67d07c9aa81caacc724676a3018bc6a633beaed5f034e07a2547eefab10b10a43a049fa7187864c32063fb2b1be39fb939cec48bd4abb96d54d63d2a27ab665a84cee315903d4ab0072fb37488a31df19c212eef5c9a81f845a69dd60b3f7b8bbaec699920aa00490a899442cf865710e3eb5d35cc790bf3625c0388ed82bcccc456b106b2e2698a00897a10b76693181ef0aa99f1d01c2b4750a3af4e23d82e6c71e1d38b0ecfa813e47865cda85c9cfed0fd25cc68d3613a95f70b6fa40f346fb02cd66b1ab2472f29b8b657358000de7797a3e2379cc2857bc235ac9d84eabb6a378e2ceb8245d5374504c6a9ef0fc32b8c0e933c03eb56062a479d33ec62e8c14bc17c397d5e47385db360efa77484a0dcb99c28d7d84a2aab97bc3e2869cc7fffc6cde95e738df6b3b741dd03d760f6b9942b1dc27d2d093c31dc0f9574ef47912b3a342bf9e5891db32f6e2074758c543028b8ec6c2857dc98e2cb653dd1b6beb21056350bf69aa033052369a6172a2c1fa1a11c64c5eebaba51106e09a7812353f1b3ee9370b3971511ec6a8eff183702a4f52cbd5c37194c73d430d7bceb0e969e6e39da2065cbf74b43b290a7b7900dd705a4556ab6daa11df39ddf5626555db4c3a90a7feeabdf0075881bb33309f0356f4eafe9b1fec1e1d372b04d0a0c73ea55deac783f4319746fb02a5c0f87d381000b1c9e0f29ef703a4b0d3e5e864d16c94b77b3087a89174d880d30cfed00610f79bf7fb1ef552a0e7080b81d403087e6d5ac0b07a304a909a1e3e59c16857263dfada9c6949494edf22b0c50d20311c402405dc112c110b881047505f30ac28d90254ee984a31f20fd8745f227fc4cd3845eb29ffadd24a87199fb7f8cafe6f1d15b53e595523e16c8a3aab7d1449805643dc8c019d69df0c9a7d86c0cf8ffab214269aedebec17846ef5ce22ec840eea633ec10aba1f090c5ccf8eadb6a311f677f80be3bd636c7ce6c7d1151b1b7d84faedefef9aa28740481cab45c22d6bfb70c6782779961bc414c716439bbd29ef94f3864c2b62774eb90a0f7a3fe43078025fc1bee923c4d9d1d9c3ee313e150a81e011674f798ccd74add3b8352b6e92b860caa13e92d2682f8bd5da6591a1356a9e93868478aab0f4ff750c0226723a85b27ce3c4fa12ef35c4e1c2a4270f5a9b4e4eecb5b3d83fcb556995e653f15af58478809b0f4fc1b69c5c1c66f4440ebd75dac9de592c794812821acc32523abcf895d37b61c4d113d18fb46599845645e52079dd63042ed289a644cfd615a82924604f2f5e53265b8ef6a97472c2aa406cc86620e2de2edbc7bb11357802c5bcf8ac8a98d6c56ce9682b69cecc1672b5e1921f241faa06de697a931f252d43d149c98b94aba967eab03ee074ed5c55227bfff988885cc4b4165a967deb1fe5c568652b0358a574ba87cae8e426c7de1a18ac8123ad5eedd45d42d4bba1886a613d5dcb891eb35ac2e713399381660f4aa74b88a145fb641352bc64ddcc869c33f5be8f9491afc5b5c5904c3ab7845cf219b6be7b1bf5259506bd6efab437c1247c30ede3b9689913b14dce7742e8b8c6361c11120fd7d094b39b3c2287fbd006a894d01c7f402484d9f685133aafacfb7d62c62e0c0bd31f7da2f80b9bd77f20e25e79b31c4226df9786c675dc1649be05459c602ae6637dbbee2745ad4bc50f3f0512a812e2b6a32aea2ae5f2a058b0d6e84a6cd36deefc9160e6583dd92c27f44ae733157c244189e69edc9f8b71105d5b66f563b833e561710e606f9f708bcd69dbe5a01ccbba8249371a8cd5832486631f3a0c6502443925819c062d4fc625fc69e4901a35b5a5626de029268348412ce86e005efb777e2cd556ff7cd6c5b2deb51ecd1a103b39965821f7bc2b8fca31d9e21be068dfb54fd0207b3f96acc3c8afd24fe5d6ff68e4fe9d1fcec9b145e370676086dd36f77982f9d5e5a11990e74aa3f478075c6a9e00cdd3bd567e9a2f1948c7303513f9e608bb9565356f785137b030fb41a7f130472f1ae672cd6fcf042d9b5c0d8c393d7d2a77371bde2685d09bafec9d0fd9c8552b99ac094ad9f8d36bc49c3ac92535a66d383d6d5146ba53bc31a471c07c55d68fec842f01587e185a37344eade7ceb664f247b4a580ac7ab5589a03c2dc0af5713319efed44238abeb3cee88375937eaf2d42827bd110fbf60f794e7a6fa2f44da278e321683510898e96f8af203881931d7d07cd11dcb194077839bba65ea1b2b3549f52b5ac574d6b91de2685d0144331ed7183f4e5453297909ae0aaae33f6f84959af5944fc4d213dca24423d9090257a20071f017c9f1acb49b44a210d046fe5204855198890af588b5a18df6bcd447ff15c3d19c3aaf88ce60ab43610b03fe2674f1636dc53b566804865603b0b66ec1afefe5da2bd96246fceda07a4b0132ffd41ea37a7e0738081509b05fadd1779a2a1efba0552bbf91114bfba58e10cd538dab40cd86fb814c3ef63746162675ba5016fc221349c6e03e634be44927b3c05b9eb1d0c959bbc07bfa1035092cd08191ef256cbad917a62037da079614f75f369641b8ddf53fe65efdb560b2216cea0d76c5f7825f5b2d87295bf15111e8e8d552878c2254c3b5dab2ca4cf015233d05cbc8191f75a275c507fbcea9118b51207f7042f519799d4d4162c3a4a14381f7f9bb3298c5766e36f96a01dc9c6a8c27124076f8cfe0632b7e12f880c7146aae3170a3855babf93c4f070f16379600fbb9e06fbdf8b516cab5a84569bffc69f2b17b6092c498c55e92d540d5aca20ad50e27eb51344636b57385d017aa5b4499e2934eb9c587aecebee9bd3ce8a6de83cd0f8f2cc92e11d1afab865ee564244b13bfbbd196af9bcb52fba938c58da1914c063ffcc80a9fa4d13b1d8cbc9971a2c3fcba8bc8238cbd187f62efa4ec642e317d5c29039dc339749241db19eacc73a13c7d7cf73d5cee235b1d5e7a635dff94584b9af6a4460c0414c141768c3240df1933e1abf500e39b62225f21b42112480374055c642bac1f3ee6c17e3ab30e328e30a3ecad60444870a69ecb2f76987b4bc4cb813501613a818433b36de75d45de59b76f527b1e91682e24b511099609f7e57a3e788e6199504b43350faf3f490d3498360263207499e7b4ee54965f86004032a5a03a0a826cdf432d4fa27bc525f0dcfee8e27b"}}}}}, 0x0) 4.322060497s ago: executing program 3 (id=836): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x81, 0xf}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0d00000004000000040000000010000001000000", @ANYRES32=r0], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x9}, 0x48) unshare(0x22020600) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r1}, &(0x7f0000000180), &(0x7f00000002c0)=r0}, 0x20) 4.173132421s ago: executing program 0 (id=838): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x6f}, 0x94) syz_emit_ethernet(0x4e, &(0x7f0000000000)=ANY=[@ANYBLOB="000080000000bbbbbbbbbbbb86dd6012000800183a000020000000000000000000000000000100000000000000000000000000000001"], 0x0) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x6}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0xfffffffffffffd2e, &(0x7f0000000000)='e', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x48) 4.156442674s ago: executing program 3 (id=839): ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x2000000035, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x5, 0xf2, 0xd, 0x7fffffffffffe, 0xcd3, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='&'], 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) 4.021517348s ago: executing program 3 (id=841): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0xfc5, 0xb080, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x1f0, 0x18, "", [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x2, 0x1, 0x1, {0x22, 0x6}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x0, 0xd, 0xf3}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000100)={0x2c, &(0x7f0000000180)={0x40, 0xf, 0x8, {0x8, 0x11, "110041c9def1"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000f80)={0x84, &(0x7f0000000a40)=ANY=[], 0x0, &(0x7f0000000540)={0x0, 0x8, 0x1, 0xb6}, &(0x7f0000000580)={0x20, 0x0, 0x4, {0x5, 0x1}}, &(0x7f00000005c0)={0x20, 0x0, 0x4, {0x200, 0x20}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 3.758929677s ago: executing program 0 (id=846): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x5, 0x87, 0x7ffc0201}]}) rseq(&(0x7f0000001080)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) close(0xffffffffffffffff) timer_settime(0x0, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) 3.641892841s ago: executing program 0 (id=848): r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000406d0422c200000000000109022d0001010080320904000002030000000921110100012223000905810340000a000009050203"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_connect(0x3, 0xf5, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022230000000600ff0900a10185020901150026ff0075089508810209029512910209039503b102c0"], 0x0}, 0x0) syz_open_dev$video(&(0x7f0000000000), 0x80000400, 0x428000) 1.999271987s ago: executing program 1 (id=856): r0 = fsopen(&(0x7f0000000e00)='nfs4\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000400)='source\x00', &(0x7f0000000500)='127.0.0.1:/\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000600)='addr\x00', &(0x7f0000000700)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000a00)='vers\x00', &(0x7f0000000b00)='4.0\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000c00)='sec\x00', &(0x7f0000000d00)='krb5\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) 1.867566724s ago: executing program 1 (id=858): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_HEADER(r0, 0x0, 0x374b7a7be74afff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000007580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000075c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_MESH_CONFIG(r1, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000007600)={0x1c, r2, 0x1, 0x70bd25, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x81}, 0x8000) 1.815872107s ago: executing program 1 (id=859): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(r0, 0x40045402, &(0x7f0000000040)=0x1) readv(r0, &(0x7f0000000200)=[{&(0x7f0000000640)=""/201, 0xc9}], 0x1) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000280)={{0x1, 0x1}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f00000000c0)={0x7, 0x9dc5, 0x0, 0x0, 0xf}) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) 1.677383483s ago: executing program 3 (id=860): sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000280)={0x30, 0x0, 0x1, 0xfffffffd, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_DEVKEY={0x14, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_ID={0x10, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x4}]}]}]}, 0x30}, 0x1, 0x0, 0x0, 0xd49920d352514f42}, 0x4000000) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000007c0), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEV(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000280)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010028bd7000fbdbdf251a00000004002e8008000300", @ANYRES32=r3, @ANYBLOB='4\x00.'], 0x6c}, 0x1, 0x0, 0x0, 0x20040040}, 0x20040) 1.675401024s ago: executing program 0 (id=861): r0 = syz_io_uring_setup(0x29d8, &(0x7f0000000540)={0x0, 0x8550, 0xc00, 0x1, 0xf}, &(0x7f0000000100)=0x0, &(0x7f00000001c0)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_WAITID={0x32, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x4}}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) io_uring_enter(r0, 0x1, 0x1, 0x61, 0x0, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r0, 0x18, &(0x7f0000000000)={0x6, 0xffffffffffffffff, 0x28, {0x2, 0x4}, 0x9}, 0x1) 1.653109659s ago: executing program 1 (id=862): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010008020000001800006600000008000300", @ANYRES32=r2, @ANYBLOB="08002600940900000800b7"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 1.569807854s ago: executing program 3 (id=863): r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000001000)=ANY=[@ANYBLOB="1201000200000040501d4d610001000000010902200001010080320904000002ff00000007050102"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0xb7, &(0x7f00000001c0)={0x20, 0x90069109b15ef6c8, 0x1e, "4d61501d0100000000000000100000000000800700000000000038040000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000200)=ANY=[@ANYBLOB="403f0100000080"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000d80)={0x34, &(0x7f0000000a80)=ANY=[@ANYBLOB="401605"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000680)={0x44, &(0x7f0000000340)=ANY=[@ANYBLOB="400cf202"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.554735545s ago: executing program 1 (id=864): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x85, &(0x7f00000012c0)={0x0, @in={{0x2, 0x4c23, @empty}}, 0x2, 0x8}, 0x90) sendmsg$inet6(r0, &(0x7f0000000540)={&(0x7f00000000c0)={0xa, 0x4e24, 0x8004, @loopback, 0x7fff}, 0x1c, &(0x7f0000000440)=[{&(0x7f0000000100)="f0", 0x1}], 0x1}, 0x400d4) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000280)={0x0, @in6={{0xa, 0x4e24, 0x42, @loopback, 0x8000}}, 0xabb6, 0x67, 0xa4b, 0xc4, 0xa, 0x0, 0xa9}, 0x9c) 1.425660789s ago: executing program 1 (id=866): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0009030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000400)=""/186, 0x110) syz_usb_disconnect(0xffffffffffffffff) syz_usb_disconnect(r0) syz_usb_connect(0x2, 0x36, &(0x7f0000000200)=ANY=[], 0x0) 1.356413349s ago: executing program 0 (id=868): r0 = syz_usb_connect(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x8, &(0x7f0000000200)=ANY=[@ANYBLOB="bcea"]) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x80000) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f00000001c0)={0x50, 0xff, 0x560c, {0x803, 0x5d5}, {0x90b, 0x2}, @const={0x40, {0x0, 0x0, 0x1ff, 0xfff0}}}) 1.297146823s ago: executing program 6 (id=869): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000280), r0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000340)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_DEV(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)={0x30, r2, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}]}, 0x30}, 0x4, 0x700000000000000}, 0x0) 1.213802597s ago: executing program 6 (id=870): sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_devices(r0, &(0x7f00000002c0)='devices.deny\x00', 0x2, 0x0) r1 = openat$cgroup_devices(r0, &(0x7f0000000140)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r1, &(0x7f0000000040)={'c', ' *:* ', 'rwm\x00'}, 0xa) 1.21357989s ago: executing program 6 (id=871): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x21}, 0x94) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x801a01, 0x0) ioctl$EVIOCGPROP(r1, 0x40047438, &(0x7f0000000180)=""/246) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) write(r1, &(0x7f0000000280)='{*', 0x2) 1.186142755s ago: executing program 6 (id=872): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x129240, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r1, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r2, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000600)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r1, 0x3ba0, &(0x7f0000000640)={0x48, 0xa, r3, 0x0, r4}) 1.145268884s ago: executing program 6 (id=873): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/bus/pci/drivers/lpc_ich/new_id\x00', 0x1, 0x0) write(r0, &(0x7f0000000a00)='FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF 0 0 b', 0x29) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) 1.035673399s ago: executing program 2 (id=874): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f00000001c0)={0x1000200001ee0000, 0x3}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r2, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002100)='numa_maps\x00') preadv(r3, &(0x7f00000014c0)=[{&(0x7f0000002140)=""/4096, 0x1000}], 0x1, 0x0, 0x0) 962.296948ms ago: executing program 6 (id=875): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0xb05, 0x18c6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000080), 0xa, 0x62080) ioctl$HIDIOCSFLAG(r1, 0x4004480f, &(0x7f0000000140)=0x62433eb7e799a357) 470.155888ms ago: executing program 2 (id=876): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00'}) r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x0, 0x0, 0xffffffff}, 0x1c) ioctl$sock_inet_SIOCGIFADDR(0xffffffffffffffff, 0x8915, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)=ANY=[@ANYBLOB="88020000", @ANYRES16=r1, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r2, @ANYBLOB="6102330050300100080211000001080211000000505050505050"], 0x288}, 0x1, 0x0, 0x0, 0x800}, 0x0) 201.519308ms ago: executing program 2 (id=877): unshare(0x22020400) r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x24020000) r2 = open(&(0x7f0000000280)='.\x00', 0x8400, 0x0) futimesat(r2, 0x0, 0x0) 193.474975ms ago: executing program 2 (id=878): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = dup3(0xffffffffffffffff, r0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000001000)={0x73622a85, 0x10b, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x54, 0x0, &(0x7f0000000e00)=[@acquire, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000002200)={0x4c, 0x0, &(0x7f0000002100)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x2, 0x0, &(0x7f0000002180)="ab83"}) 108.134714ms ago: executing program 2 (id=879): r0 = socket$inet6(0xa, 0x2, 0x3a) sendto$inet6(r0, 0x0, 0x0, 0x2004c080, 0x0, 0x0) r1 = socket$inet6_icmp(0xa, 0x2, 0x3a) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e21, 0x4, @ipv4={'\x00', '\xff\xff', @local}, 0x8}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000300)='net/icmp6\x00') preadv(r2, &(0x7f0000000280)=[{&(0x7f00000003c0)=""/252, 0xfc}, {&(0x7f0000000180)=""/215, 0xd7}], 0x2, 0x9, 0x7ffffffe) 0s ago: executing program 2 (id=880): bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1b, 0x6, 0x0, &(0x7f0000000080)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="03000000040000000400000009"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[], 0x48) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x18, 0x7, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000218100000", @ANYRES32=r0, @ANYBLOB="000000000000000018100000", @ANYRES32=r1, @ANYBLOB="000000000000000095"], &(0x7f0000000a00)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) syz_clone(0x10ef20e100, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0xc0126080, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000005c0)={r2, 0xe0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000034d, &(0x7f0000001d00), ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) kernel console output (not intermixed with test programs): c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 152.446924][ T7183] RSP: 002b:00007fe4d6be7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 152.446943][ T7183] RAX: ffffffffffffffda RBX: 00007fe4d6025fa0 RCX: 00007fe4d5d9e159 [ 152.446956][ T7183] RDX: 0000000000000000 RSI: 0000200000000040 RDI: ffffffffffffff9c [ 152.446968][ T7183] RBP: 00007fe4d5e3503b R08: 0000000000000000 R09: 0000000000000000 [ 152.446979][ T7183] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 152.446990][ T7183] R13: 00007fe4d6026038 R14: 00007fe4d6025fa0 R15: 00007ffea71e1a98 [ 152.447014][ T7183] [ 152.465814][ T7183] syz.0.357: vmalloc error: size 282624, failed to allocated page array size 552, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 152.465892][ T7183] CPU: 1 UID: 0 PID: 7183 Comm: syz.0.357 Not tainted syzkaller #0 PREEMPT(full) [ 152.465913][ T7183] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 152.465924][ T7183] Call Trace: [ 152.465930][ T7183] [ 152.465937][ T7183] dump_stack_lvl+0x100/0x190 [ 152.465965][ T7183] warn_alloc.cold+0x9e/0xb2 [ 152.465985][ T7183] ? __pfx_warn_alloc+0x10/0x10 [ 152.466009][ T7183] ? dump_stack_lvl+0x17c/0x190 [ 152.466039][ T7183] ? rcu_is_watching+0x13/0xc0 [ 152.466061][ T7183] ? __kasan_kmalloc+0x8a/0xb0 [ 152.466083][ T7183] ? __kmalloc_node_noprof+0x360/0x880 [ 152.466101][ T7183] ? __get_vm_area_node+0x1ff/0x350 [ 152.466121][ T7183] ? __get_vm_area_node+0x22b/0x350 [ 152.466141][ T7183] ? __vmalloc_node_range_noprof+0x3d4/0x1420 [ 152.466169][ T7183] __vmalloc_node_range_noprof+0x10f4/0x1420 [ 152.466194][ T7183] ? lock_acquire+0x1d1/0x380 [ 152.466216][ T7183] ? security_read_policy+0x105/0x2e0 [ 152.466242][ T7183] ? __mutex_lock+0x26c/0x1bd0 [ 152.466264][ T7183] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 152.466291][ T7183] ? __pfx___mutex_lock+0x10/0x10 [ 152.466314][ T7183] ? security_read_policy+0x105/0x2e0 [ 152.466337][ T7183] vmalloc_user_noprof+0x9e/0xe0 [ 152.466360][ T7183] ? security_read_policy+0x105/0x2e0 [ 152.466383][ T7183] security_read_policy+0x105/0x2e0 [ 152.466405][ T7183] ? __pfx_security_read_policy+0x10/0x10 [ 152.466428][ T7183] ? sel_open_policy+0x15e/0x380 [ 152.466455][ T7183] sel_open_policy+0x18c/0x380 [ 152.466481][ T7183] do_dentry_open+0x6ab/0x14d0 [ 152.466498][ T7183] ? __pfx_sel_open_policy+0x10/0x10 [ 152.466526][ T7183] vfs_open+0x82/0x3f0 [ 152.466550][ T7183] path_openat+0x19fa/0x2440 [ 152.466574][ T7183] ? __pfx_path_openat+0x10/0x10 [ 152.466600][ T7183] do_file_open+0x20e/0x430 [ 152.466623][ T7183] ? __pfx_do_file_open+0x10/0x10 [ 152.466659][ T7183] ? _raw_spin_unlock+0x28/0x50 [ 152.466677][ T7183] ? alloc_fd+0x471/0x7a0 [ 152.466703][ T7183] do_sys_openat2+0x10f/0x1e0 [ 152.466725][ T7183] ? __pfx_do_sys_openat2+0x10/0x10 [ 152.466761][ T7183] __x64_sys_openat+0x12d/0x210 [ 152.466783][ T7183] ? __pfx___x64_sys_openat+0x10/0x10 [ 152.466814][ T7183] do_syscall_64+0x123/0x790 [ 152.466837][ T7183] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 152.466855][ T7183] RIP: 0033:0x7fe4d5d9e159 [ 152.466869][ T7183] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 152.466886][ T7183] RSP: 002b:00007fe4d6be7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 152.466903][ T7183] RAX: ffffffffffffffda RBX: 00007fe4d6025fa0 RCX: 00007fe4d5d9e159 [ 152.466914][ T7183] RDX: 0000000000000000 RSI: 0000200000000040 RDI: ffffffffffffff9c [ 152.466925][ T7183] RBP: 00007fe4d5e3503b R08: 0000000000000000 R09: 0000000000000000 [ 152.466934][ T7183] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 152.466944][ T7183] R13: 00007fe4d6026038 R14: 00007fe4d6025fa0 R15: 00007ffea71e1a98 [ 152.466967][ T7183] [ 152.470480][ T7183] Mem-Info: [ 152.470494][ T7183] active_anon:57271 inactive_anon:0 isolated_anon:0 [ 152.470494][ T7183] active_file:0 inactive_file:59968 isolated_file:0 [ 152.470494][ T7183] unevictable:0 dirty:533 writeback:0 [ 152.470494][ T7183] slab_reclaimable:12055 slab_unreclaimable:97510 [ 152.470494][ T7183] mapped:45649 shmem:43218 pagetables:1666 [ 152.470494][ T7183] sec_pagetables:3 bounce:0 [ 152.470494][ T7183] kernel_misc_reclaimable:0 [ 152.470494][ T7183] free:1237439 free_pcp:19589 free_cma:0 [ 152.470536][ T7183] Node 0 active_anon:229084kB inactive_anon:0kB active_file:0kB inactive_file:239536kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:182464kB dirty:2120kB writeback:0kB shmem:172872kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13108kB pagetables:6536kB sec_pagetables:12kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 152.470578][ T7183] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:336kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:132kB dirty:12kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:128kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 152.470617][ T7183] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 152.470661][ T7183] lowmem_reserve[]: 0 2470 2470 2470 2470 [ 152.470690][ T7183] Node 0 DMA32 free:1004760kB boost:0kB min:33992kB low:42488kB high:50984kB reserved_highatomic:0kB free_highatomic:0kB active_anon:229084kB inactive_anon:0kB active_file:0kB inactive_file:239536kB unevictable:0kB writepending:2120kB zspages:0kB present:3129332kB managed:2530164kB mlocked:0kB bounce:0kB free_pcp:78356kB local_pcp:37448kB free_cma:0kB [ 152.470735][ T7183] lowmem_reserve[]: 0 0 0 0 0 [ 152.470761][ T7183] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:72kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 152.470813][ T7183] lowmem_reserve[]: 0 0 0 0 0 [ 152.470840][ T7183] Node 1 Normal free:3929636kB boost:0kB min:55904kB low:69880kB high:83856kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:336kB unevictable:0kB writepending:12kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 152.470883][ T7183] lowmem_reserve[]: 0 0 0 0 0 [ 152.470909][ T7183] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 152.471008][ T7183] Node 0 DMA32: 820*4kB (UME) 329*8kB (UM) 258*16kB (ME) 386*32kB (UM) 182*64kB (UM) 51*128kB (UME) 39*256kB (UME) 10*512kB (UM) 9*1024kB (UME) 1*2048kB (E) 229*4096kB (UM) = 1004920kB [ 152.471142][ T7183] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 152.471227][ T7183] Node 1 Normal: 1*4kB (U) 4*8kB (UM) 6*16kB (UM) 5*32kB (UM) 6*64kB (UM) 3*128kB (U) 2*256kB (M) 2*512kB (M) 1*1024kB (M) 3*2048kB (UM) 957*4096kB (UM) = 3929636kB [ 152.471361][ T7183] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 152.471374][ T7183] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 152.471386][ T7183] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 152.471398][ T7183] Node 1 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 152.471410][ T7183] 103182 total pagecache pages [ 152.471574][ T5716] pwc: Registered as video103. [ 152.472124][ T7183] 0 pages in swap cache [ 152.472132][ T7183] Free swap = 124996kB [ 152.472139][ T7183] Total swap = 124996kB [ 152.472146][ T7183] 2097051 pages RAM [ 152.472152][ T7183] 0 pages HighMem/MovableOnly [ 152.472157][ T7183] 432876 pages reserved [ 152.472164][ T7183] 0 pages cma reserved [ 152.492951][ T5716] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input10 [ 152.672245][ T5716] usb 4-1: USB disconnect, device number 11 [ 153.852802][ T9] usb-storage 1-1:3.117: USB Mass Storage device detected [ 154.071448][ T9] usb-storage 1-1:3.117: device ignored [ 154.176551][ T9] usb 1-1: USB disconnect, device number 8 [ 154.989002][ T31] audit: type=1400 audit(1789069751.178:578): avc: denied { read } for pid=7203 comm="syz.0.362" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 157.968174][ T7227] ima: policy update failed [ 158.154378][ T31] audit: type=1807 audit(1789069753.868:579): UNKNOWN=measu res=0 [ 158.154415][ T31] audit: type=1802 audit(1789069753.878:580): pid=7230 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=update_policy cause=invalid-policy comm="syz.6.366" res=0 errno=0 [ 158.154447][ T31] audit: type=1802 audit(1789069754.158:581): pid=7227 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=policy_update cause=failed comm="syz.6.366" res=0 errno=0 [ 159.318070][ T31] audit: type=1400 audit(1789069755.508:582): avc: denied { create } for pid=7242 comm="syz.2.370" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 159.322272][ T31] audit: type=1400 audit(1789069755.508:583): avc: denied { listen } for pid=7242 comm="syz.2.370" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 159.366749][ T7244] netlink: 'syz.2.370': attribute type 2 has an invalid length. [ 159.385441][ T31] audit: type=1400 audit(1789069755.568:584): avc: denied { connect } for pid=7242 comm="syz.2.370" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 159.429852][ T31] audit: type=1400 audit(1789069755.618:585): avc: denied { accept } for pid=7242 comm="syz.2.370" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 159.547300][ T5716] libceph: connect (1)[c::]:6789 error -101 [ 159.547476][ T5716] libceph: mon0 (1)[c::]:6789 connect error [ 159.805910][ T5716] libceph: connect (1)[c::]:6789 error -101 [ 159.807176][ T5716] libceph: mon0 (1)[c::]:6789 connect error [ 160.315715][ T5695] libceph: connect (1)[c::]:6789 error -101 [ 160.316522][ T5695] libceph: mon0 (1)[c::]:6789 connect error [ 160.339000][ T7248] ceph: No mds server is up or the cluster is laggy [ 161.116018][ T31] audit: type=1400 audit(1789069757.308:586): avc: denied { write } for pid=7254 comm="syz.1.372" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 161.257802][ T31] audit: type=1400 audit(1789069757.448:587): avc: denied { write } for pid=7239 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 161.480066][ T31] audit: type=1400 audit(1789069757.668:588): avc: denied { write } for pid=7264 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 162.472174][ T31] audit: type=1400 audit(1789069758.658:589): avc: denied { listen } for pid=7260 comm="syz.2.373" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 163.386436][ T31] audit: type=1400 audit(1789069759.578:590): avc: denied { read } for pid=7260 comm="syz.2.373" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 163.389228][ T4920] Bluetooth: hci3: link tx timeout [ 163.389536][ T4920] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 163.440721][ T52] Bluetooth: hci3: link tx timeout [ 163.440739][ T52] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 163.778666][ T31] audit: type=1400 audit(1789069759.968:591): avc: denied { write } for pid=7271 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 163.822770][ T7296] net_ratelimit: 10 callbacks suppressed [ 163.822789][ T7296] netlink: zone id is out of range [ 163.823090][ T7296] netlink: zone id is out of range [ 163.835290][ T7296] netlink: zone id is out of range [ 163.835321][ T7296] netlink: zone id is out of range [ 163.835327][ T7296] netlink: zone id is out of range [ 163.850394][ T7296] netlink: zone id is out of range [ 164.013275][ T7310] tipc: Started in network mode [ 164.013302][ T7310] tipc: Node identity 361730f6865c, cluster identity 4711 [ 164.013484][ T7310] tipc: Enabled bearer , priority 0 [ 164.056168][ T7310] tipc: Resetting bearer [ 164.108275][ T7309] tipc: Disabling bearer [ 164.160517][ T31] audit: type=1400 audit(1789069760.348:592): avc: denied { write } for pid=7312 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 165.059419][ T4932] libceph: connect (1)[c::]:6789 error -101 [ 165.059593][ T4932] libceph: mon0 (1)[c::]:6789 connect error [ 165.315749][ T4932] libceph: connect (1)[c::]:6789 error -101 [ 165.316676][ T4932] libceph: mon0 (1)[c::]:6789 connect error [ 165.460340][ T52] Bluetooth: hci3: command 0x0406 tx timeout [ 165.800306][ T7335] ceph: No mds server is up or the cluster is laggy [ 165.892805][ T5787] libceph: connect (1)[c::]:6789 error -101 [ 165.928146][ T5787] libceph: mon0 (1)[c::]:6789 connect error [ 166.224580][ T7345] syz.2.384 uses obsolete (PF_INET,SOCK_PACKET) [ 166.751017][ T31] audit: type=1400 audit(1789069762.938:593): avc: denied { write } for pid=7318 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 166.927282][ T31] audit: type=1400 audit(1789069763.108:594): avc: denied { cmd } for pid=7354 comm="iou-wrk-7357" path="/dev/ublk-control" dev="devtmpfs" ino=695 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=io_uring permissive=1 [ 167.892626][ T31] audit: type=1400 audit(1789069764.018:595): avc: denied { write } for pid=7363 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 169.741831][ T31] audit: type=1800 audit(1789069765.928:596): pid=7377 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.3.388" name=8006 dev="sda1" ino=2056 res=0 errno=0 [ 170.376426][ T4920] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 170.376477][ T4920] CPU: 0 UID: 0 PID: 4920 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT(full) [ 170.376502][ T4920] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 170.376517][ T4920] Workqueue: hci4 hci_rx_work [ 170.376544][ T4920] Call Trace: [ 170.376551][ T4920] [ 170.376559][ T4920] dump_stack_lvl+0x100/0x190 [ 170.376591][ T4920] sysfs_warn_dup.cold+0x1c/0x28 [ 170.376622][ T4920] sysfs_create_dir_ns+0x24b/0x2b0 [ 170.376652][ T4920] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 170.376676][ T4920] ? find_held_lock+0x2b/0x80 [ 170.376703][ T4920] ? kobject_add_internal+0x25f/0x930 [ 170.376735][ T4920] ? kobject_add_internal+0x25f/0x930 [ 170.376768][ T4920] ? do_raw_spin_unlock+0x145/0x1e0 [ 170.376795][ T4920] kobject_add_internal+0x2c8/0x930 [ 170.376830][ T4920] kobject_add+0x16a/0x1e0 [ 170.376848][ T4920] ? __pfx_kobject_add+0x10/0x10 [ 170.376865][ T4920] ? preempt_schedule_thunk+0x16/0x40 [ 170.376894][ T4920] ? kobject_put+0xb9/0x640 [ 170.376920][ T4920] ? _raw_spin_unlock+0x3e/0x50 [ 170.376949][ T4920] device_add+0x294/0x1970 [ 170.376974][ T4920] ? __pfx_dev_set_name+0x10/0x10 [ 170.377009][ T4920] ? __pfx_device_add+0x10/0x10 [ 170.377034][ T4920] ? mgmt_send_event_skb+0x2fb/0x460 [ 170.377065][ T4920] hci_conn_add_sysfs+0x1a3/0x260 [ 170.377092][ T4920] le_conn_complete_evt+0x122f/0x2130 [ 170.377123][ T4920] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 170.377155][ T4920] hci_le_conn_complete_evt+0x23c/0x3a0 [ 170.377180][ T4920] ? skb_pull_data+0x15f/0x1e0 [ 170.377212][ T4920] hci_le_meta_evt+0x34a/0x5f0 [ 170.377235][ T4920] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 170.377262][ T4920] hci_event_packet+0x51c/0xcd0 [ 170.377285][ T4920] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 170.377309][ T4920] ? __pfx_hci_event_packet+0x10/0x10 [ 170.377335][ T4920] ? kcov_remote_start+0x3cf/0x6d0 [ 170.377363][ T4920] hci_rx_work+0x451/0xfc0 [ 170.377389][ T4920] process_one_work+0xac7/0x1b10 [ 170.377430][ T4920] ? __pfx_process_one_work+0x10/0x10 [ 170.377460][ T4920] ? lock_acquire+0x1d1/0x380 [ 170.377486][ T4920] ? __pfx_hci_rx_work+0x10/0x10 [ 170.377510][ T4920] worker_thread+0x5ef/0xe50 [ 170.377545][ T4920] ? __pfx_worker_thread+0x10/0x10 [ 170.377575][ T4920] ? kthread+0x13a/0x450 [ 170.377599][ T4920] ? __pfx_worker_thread+0x10/0x10 [ 170.377626][ T4920] kthread+0x373/0x450 [ 170.377652][ T4920] ? __pfx_kthread+0x10/0x10 [ 170.377679][ T4920] ret_from_fork+0x730/0xd60 [ 170.377702][ T4920] ? __pfx_ret_from_fork+0x10/0x10 [ 170.377725][ T4920] ? __switch_to+0x800/0x10f0 [ 170.377752][ T4920] ? __pfx_kthread+0x10/0x10 [ 170.377780][ T4920] ret_from_fork_asm+0x1a/0x30 [ 170.377814][ T4920] [ 170.378480][ T4920] kobject: kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 170.378588][ T4920] Bluetooth: hci4: failed to register connection device [ 172.147510][ T5724] libceph: connect (1)[c::]:6789 error -101 [ 172.226789][ T5724] libceph: mon0 (1)[c::]:6789 connect error [ 172.373668][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 172.439418][ T7408] ceph: No mds server is up or the cluster is laggy [ 172.479404][ T31] audit: type=1400 audit(1789069768.668:597): avc: denied { write } for pid=7373 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 172.484694][ T1214] libceph: connect (1)[c::]:6789 error -101 [ 172.484851][ T1214] libceph: mon0 (1)[c::]:6789 connect error [ 173.501992][ T31] audit: type=1400 audit(1789069769.688:598): avc: denied { write } for pid=7424 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 173.940537][ T7429] kvm [7426]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0xe4bd [ 174.533110][ T31] audit: type=1400 audit(1789069770.718:599): avc: denied { read } for pid=7442 comm="syz.0.402" name="usbmon8" dev="devtmpfs" ino=739 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 174.535820][ T31] audit: type=1400 audit(1789069770.728:600): avc: denied { open } for pid=7442 comm="syz.0.402" path="/dev/usbmon8" dev="devtmpfs" ino=739 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 174.675507][ T31] audit: type=1400 audit(1789069770.868:601): avc: denied { sqpoll } for pid=7442 comm="syz.0.402" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 175.052802][ T31] audit: type=1400 audit(1789069771.238:602): avc: denied { map } for pid=7442 comm="syz.0.402" path="/dev/usbmon8" dev="devtmpfs" ino=739 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 175.323629][ T5716] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 175.473872][ T5716] usb 7-1: Using ep0 maxpacket: 16 [ 175.474667][ T5716] usb 7-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 175.477150][ T5716] usb 7-1: config 0 has an invalid interface number: 107 but max is 0 [ 175.477172][ T5716] usb 7-1: config 0 has no interface number 0 [ 175.477192][ T5716] usb 7-1: config 0 interface 107 altsetting 0 endpoint 0x88 has an invalid bInterval 55, changing to 9 [ 175.477206][ T5716] usb 7-1: config 0 interface 107 altsetting 0 endpoint 0x88 has invalid maxpacket 8496, setting to 1024 [ 175.482379][ T5716] usb 7-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 175.482398][ T5716] usb 7-1: Product: syz [ 175.482406][ T5716] usb 7-1: Manufacturer: syz [ 175.482414][ T5716] usb 7-1: SerialNumber: syz [ 175.490891][ T5716] usb 7-1: config 0 descriptor?? [ 175.502049][ T5716] keyspan 7-1:0.107: Keyspan 4 port adapter converter detected [ 175.502253][ T5716] keyspan 7-1:0.107: found no endpoint descriptor for endpoint 81 [ 175.511071][ T5716] keyspan 7-1:0.107: found no endpoint descriptor for endpoint 1 [ 175.559957][ T5716] usb 7-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 175.569778][ T5716] keyspan 7-1:0.107: found no endpoint descriptor for endpoint 2 [ 175.584009][ T5716] usb 7-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 175.590864][ T5716] keyspan 7-1:0.107: found no endpoint descriptor for endpoint 4 [ 175.598711][ T5716] usb 7-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 175.631955][ T5716] keyspan 7-1:0.107: found no endpoint descriptor for endpoint 6 [ 175.640654][ T5716] usb 7-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 176.423527][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 176.621002][ T31] audit: type=1400 audit(1789069772.808:603): avc: denied { ioctl } for pid=7446 comm="syz.6.404" path="socket:[16859]" dev="sockfs" ino=16859 ioctlcmd=0x8946 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 177.073676][ T31] audit: type=1400 audit(1789069773.188:604): avc: denied { connect } for pid=7460 comm="syz.0.408" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 177.900597][ T986] libceph: connect (1)[c::]:6789 error -101 [ 177.901268][ T986] libceph: mon0 (1)[c::]:6789 connect error [ 178.093530][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 178.165892][ T5787] libceph: connect (1)[c::]:6789 error -101 [ 178.166646][ T5787] libceph: mon0 (1)[c::]:6789 connect error [ 178.263634][ T986] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 178.474552][ T986] usb 3-1: device descriptor read/64, error -71 [ 178.686502][ T4932] libceph: connect (1)[c::]:6789 error -101 [ 178.687430][ T4932] libceph: mon0 (1)[c::]:6789 connect error [ 178.735674][ T986] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 178.778867][ T7471] ceph: No mds server is up or the cluster is laggy [ 178.879728][ T986] usb 3-1: device descriptor read/64, error -71 [ 178.907840][ T31] audit: type=1400 audit(1789069775.098:605): avc: denied { write } for pid=7478 comm="syz.0.411" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 178.958080][ T5716] usb 7-1: USB disconnect, device number 2 [ 178.984691][ T986] usb usb3-port1: attempt power cycle [ 179.104233][ T5716] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 179.123870][ T5716] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 179.258096][ T5716] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 179.263320][ T5716] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 179.266920][ T5716] keyspan 7-1:0.107: device disconnected [ 179.363872][ T986] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 179.473919][ T986] usb 3-1: device descriptor read/8, error -71 [ 179.892986][ T986] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 179.905123][ T986] usb 3-1: device descriptor read/8, error -71 [ 180.014731][ T986] usb usb3-port1: unable to enumerate USB device [ 180.186816][ T31] audit: type=1400 audit(1789069776.378:606): avc: denied { create } for pid=7493 comm="syz.1.416" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 180.204871][ T31] audit: type=1400 audit(1789069776.398:607): avc: denied { write } for pid=7493 comm="syz.1.416" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 181.267007][ T31] audit: type=1400 audit(1789069777.458:608): avc: denied { execute } for pid=7503 comm="syz.2.419" path="/dev/dsp" dev="devtmpfs" ino=1287 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sound_device_t tclass=chr_file permissive=1 [ 181.389321][ T31] audit: type=1400 audit(1789069777.578:609): avc: denied { watch } for pid=7503 comm="syz.2.419" path="/94/file0" dev="tmpfs" ino=520 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 181.503921][ T1214] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 181.655813][ T1214] usb 4-1: New USB device found, idVendor=174c, idProduct=56aa, bcdDevice= 1.00 [ 181.674764][ T1214] usb 4-1: config 1 interface 0 altsetting 1 has 4 endpoint descriptors, different from the interface descriptor's value: 5 [ 181.683421][ T1214] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 181.683446][ T1214] usb 4-1: Product: syz [ 181.683465][ T1214] usb 4-1: Manufacturer: syz [ 181.683478][ T1214] usb 4-1: SerialNumber: syz [ 182.583604][ T5716] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 182.733759][ T5716] usb 1-1: Using ep0 maxpacket: 32 [ 182.734500][ T5716] usb 1-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 182.735499][ T5716] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 182.735520][ T5716] usb 1-1: config 0 has no interface number 0 [ 182.735538][ T5716] usb 1-1: config 0 interface 1 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 182.735549][ T5716] usb 1-1: config 0 interface 1 has no altsetting 0 [ 182.769169][ T5716] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 182.769194][ T5716] usb 1-1: Product: syz [ 182.769206][ T5716] usb 1-1: Manufacturer: syz [ 182.769219][ T5716] usb 1-1: SerialNumber: syz [ 182.945178][ T5716] usb 1-1: config 0 descriptor?? [ 183.716216][ T7517] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 183.718392][ T7517] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 183.755614][ T7517] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 183.755954][ T7517] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 183.782952][ T5716] cx231xx 1-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 183.803394][ T5716] cx231xx 1-1:0.1: Failed to read PCB config [ 183.803467][ T5716] cx231xx 1-1:0.1: probe with driver cx231xx failed with error -71 [ 183.821939][ T5716] usb 1-1: USB disconnect, device number 9 [ 184.043520][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 184.203531][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 184.603529][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 184.613524][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 184.763677][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 184.783524][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 185.421153][ T1214] usb 4-1: USB disconnect, device number 12 [ 188.459894][ T31] audit: type=1400 audit(1789069784.648:610): avc: denied { getopt } for pid=7558 comm="syz.2.430" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 188.904249][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 188.904323][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 189.768156][ T7574] netlink: 'syz.1.426': attribute type 2 has an invalid length. [ 190.768988][ T31] audit: type=1400 audit(1789069786.958:611): avc: denied { write } for pid=7579 comm="syz.2.437" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 190.840372][ T7566] Bluetooth: hci1: command 0x0406 tx timeout [ 190.840509][ T7566] Bluetooth: hci0: command 0x0406 tx timeout [ 190.840579][ T7566] Bluetooth: hci2: command 0x0406 tx timeout [ 194.526712][ T7633] ip_tables: iptables: counters copy to user failed while replacing table [ 194.666836][ T7637] syz.3.446 (7637): /proc/7633/oom_adj is deprecated, please use /proc/7633/oom_score_adj instead. [ 195.134378][ T31] audit: type=1400 audit(1789069791.328:612): avc: denied { getopt } for pid=7631 comm="syz.3.446" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 198.777127][ T31] audit: type=1400 audit(1789069794.268:613): avc: denied { read } for pid=7646 comm="syz.2.449" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 198.777178][ T31] audit: type=1400 audit(1789069794.268:614): avc: denied { open } for pid=7646 comm="syz.2.449" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 200.009187][ T7651] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 200.009254][ T7651] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 200.041684][ T7651] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 200.041737][ T7651] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 200.066485][ T7651] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 200.066541][ T7651] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 200.103207][ T7651] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 200.103242][ T7651] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 200.131680][ T7651] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 200.161425][ T7651] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 200.161460][ T7651] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 200.185736][ T7651] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 200.203576][ T7651] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 200.290724][ T31] audit: type=1400 audit(1789069796.478:615): avc: denied { read write } for pid=7659 comm="syz.3.453" name="nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 200.290980][ T31] audit: type=1400 audit(1789069796.478:616): avc: denied { open } for pid=7659 comm="syz.3.453" path="/dev/nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 200.698058][ T7666] tipc: Enabling of bearer rejected, failed to enable media [ 202.540988][ T4920] Bluetooth: hci2: command 0x0406 tx timeout [ 202.541986][ T4920] Bluetooth: hci1: command 0x0406 tx timeout [ 202.543216][ T4920] Bluetooth: hci4: command 0x0c1a tx timeout [ 202.543292][ T4920] Bluetooth: hci3: command 0x0406 tx timeout [ 202.559718][ T5603] Bluetooth: hci0: command 0x0406 tx timeout [ 202.936959][ T7678] syz.2.456 (7678) used greatest stack depth: 19896 bytes left [ 203.067045][ T31] audit: type=1400 audit(1789069799.258:617): avc: denied { write } for pid=7683 comm="syz.2.460" name="usb_gadget" dev="configfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 203.105189][ T31] audit: type=1400 audit(1789069799.288:618): avc: denied { write } for pid=7683 comm="syz.2.460" name="functions" dev="configfs" ino=19890 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 203.155538][ T9] usb 1-1: new full-speed USB device number 10 using dummy_hcd [ 203.275041][ T31] audit: type=1326 audit(1789069799.468:619): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7689 comm="syz.6.462" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa6c499e159 code=0x7ffc0000 [ 203.275151][ T31] audit: type=1326 audit(1789069799.468:620): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7689 comm="syz.6.462" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa6c499e159 code=0x7ffc0000 [ 203.276060][ T31] audit: type=1326 audit(1789069799.468:621): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7689 comm="syz.6.462" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7fa6c499e159 code=0x7ffc0000 [ 203.276184][ T31] audit: type=1326 audit(1789069799.468:622): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7689 comm="syz.6.462" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa6c499e159 code=0x7ffc0000 [ 203.276287][ T31] audit: type=1326 audit(1789069799.468:623): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7689 comm="syz.6.462" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa6c499e159 code=0x7ffc0000 [ 203.276590][ T31] audit: type=1326 audit(1789069799.468:624): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7689 comm="syz.6.462" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fa6c499e159 code=0x7ffc0000 [ 203.417666][ T9] usb 1-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 203.456143][ T9] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 203.456167][ T9] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 203.456470][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 203.460126][ T9] usb 1-1: config 0 descriptor?? [ 203.499346][ T9] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 203.499634][ T9] dvb-usb: bulk message failed: -22 (3/0) [ 203.530945][ T9] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 203.531624][ T9] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 203.531666][ T9] usb 1-1: media controller created [ 203.557734][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 203.572752][ T9] dvb-usb: bulk message failed: -22 (6/0) [ 203.580870][ T9] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 203.592353][ T9] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input11 [ 203.615358][ T9] dvb-usb: schedule remote query interval to 150 msecs. [ 203.615380][ T9] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 203.794753][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 203.930984][ T9] dvb-usb: error while querying for an remote control event. [ 204.083241][ T7699] dvb-usb: bulk message failed: -22 (2/0) [ 204.291028][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 204.291057][ T9] dvb-usb: error while querying for an remote control event. [ 204.443624][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 204.443802][ T9] dvb-usb: error while querying for an remote control event. [ 204.593287][ T5603] Bluetooth: hci0: command 0x0406 tx timeout [ 204.593328][ T5603] Bluetooth: hci3: command 0x0406 tx timeout [ 204.593344][ T5603] Bluetooth: hci1: command 0x0406 tx timeout [ 204.593357][ T5603] Bluetooth: hci4: command 0x0c1a tx timeout [ 204.593371][ T5603] Bluetooth: hci2: command 0x0406 tx timeout [ 204.607479][ T986] dvb-usb: bulk message failed: -22 (1/0) [ 204.607559][ T986] dvb-usb: error while querying for an remote control event. [ 204.765350][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 204.765377][ T9] dvb-usb: error while querying for an remote control event. [ 204.890589][ T7702] sctp: [Deprecated]: syz.3.458 (pid 7702) Use of int in max_burst socket option deprecated. [ 204.890589][ T7702] Use struct sctp_assoc_value instead [ 204.925410][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 204.925438][ T9] dvb-usb: error while querying for an remote control event. [ 205.948657][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 205.948683][ T9] dvb-usb: error while querying for an remote control event. [ 206.005335][ T986] usb 1-1: USB disconnect, device number 10 [ 206.086541][ T986] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 207.230839][ T4920] Bluetooth: hci3: command 0x0406 tx timeout [ 207.230877][ T4920] Bluetooth: hci4: command 0x0c1a tx timeout [ 207.394352][ T986] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 207.468063][ T7708] FAULT_INJECTION: forcing a failure. [ 207.468063][ T7708] name fail_futex, interval 1, probability 0, space 0, times 1 [ 207.468096][ T7708] CPU: 1 UID: 0 PID: 7708 Comm: syz.2.465 Not tainted syzkaller #0 PREEMPT(full) [ 207.468117][ T7708] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 207.468128][ T7708] Call Trace: [ 207.468134][ T7708] [ 207.468141][ T7708] dump_stack_lvl+0x100/0x190 [ 207.468172][ T7708] should_fail_ex.cold+0x5/0xa [ 207.468197][ T7708] get_futex_key+0x1d0/0x14f0 [ 207.468225][ T7708] ? __pfx_get_futex_key+0x10/0x10 [ 207.468249][ T7708] ? __mutex_unlock_slowpath+0x35d/0x930 [ 207.468282][ T7708] futex_wake+0xf4/0x5e0 [ 207.468313][ T7708] ? __pfx_futex_wake+0x10/0x10 [ 207.468345][ T7708] ? lock_acquire+0x1d1/0x380 [ 207.468364][ T7708] ? detach_task_ctx_data+0x83/0x490 [ 207.468395][ T7708] do_futex+0x2b2/0x440 [ 207.468420][ T7708] ? __pfx_do_futex+0x10/0x10 [ 207.468441][ T7708] ? __might_fault+0xc5/0x140 [ 207.468474][ T7708] mm_exit_exec_release+0x256/0x2f0 [ 207.468496][ T7708] do_exit+0x707/0x2ae0 [ 207.468517][ T7708] ? __pfx___might_resched+0x10/0x10 [ 207.468540][ T7708] ? __pfx_do_exit+0x10/0x10 [ 207.468563][ T7708] ? do_raw_spin_lock+0x128/0x260 [ 207.468585][ T7708] ? find_held_lock+0x2b/0x80 [ 207.468608][ T7708] ? get_signal+0x7e0/0x21e0 [ 207.468630][ T7708] do_group_exit+0xd5/0x2a0 [ 207.468656][ T7708] get_signal+0x1ec7/0x21e0 [ 207.468685][ T7708] ? __pfx_get_signal+0x10/0x10 [ 207.468702][ T7708] ? poll_select_finish+0x36e/0x670 [ 207.468724][ T7708] ? __pfx_poll_select_finish+0x10/0x10 [ 207.468743][ T7708] ? do_futex+0x190/0x440 [ 207.468769][ T7708] arch_do_signal_or_restart+0x91/0x7e0 [ 207.468799][ T7708] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 207.468841][ T7708] exit_to_user_mode_loop+0x139/0x700 [ 207.468863][ T7708] ? rcu_is_watching+0x13/0xc0 [ 207.468890][ T7708] do_syscall_64+0x661/0x790 [ 207.468917][ T7708] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 207.468936][ T7708] RIP: 0033:0x7f5bdaf9e159 [ 207.468952][ T7708] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 207.468968][ T7708] RSP: 002b:00007f5bdbe79028 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 207.468987][ T7708] RAX: 0000000000000001 RBX: 00007f5bdb225fa0 RCX: 00007f5bdaf9e159 [ 207.468998][ T7708] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000200000000100 [ 207.469008][ T7708] RBP: 00007f5bdb03503b R08: 0000000000000000 R09: 0000000000000000 [ 207.469018][ T7708] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 207.469029][ T7708] R13: 00007f5bdb226038 R14: 00007f5bdb225fa0 R15: 00007ffcc2ac7af8 [ 207.469059][ T7708] [ 207.566737][ T986] usb 4-1: Using ep0 maxpacket: 16 [ 207.759676][ T31] kauditd_printk_skb: 39 callbacks suppressed [ 207.759693][ T31] audit: type=1400 audit(1789069803.948:664): avc: denied { listen } for pid=7721 comm="syz.2.471" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 207.858743][ T31] audit: type=1400 audit(1789069804.048:665): avc: denied { shutdown } for pid=7721 comm="syz.2.471" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 208.012870][ T7726] netlink: 14544 bytes leftover after parsing attributes in process `syz.6.466'. [ 208.064657][ T986] usb 4-1: unable to get BOS descriptor or descriptor too short [ 208.064702][ T986] usb 4-1: New USB device found, idVendor=003d, idProduct=0000, bcdDevice= 0.00 [ 208.064732][ T986] usb 4-1: no configurations [ 208.064743][ T986] usb 4-1: can't read configurations, error -22 [ 208.183758][ T5724] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 209.272885][ T5724] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 209.285138][ T5724] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 209.285177][ T5724] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 209.289859][ T5724] usb 3-1: config 0 descriptor?? [ 209.308849][ T5603] Bluetooth: hci4: command 0x0c1a tx timeout [ 209.599816][ T5724] usbhid 3-1:0.0: can't add hid device: -71 [ 209.599868][ T5724] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 209.606767][ T5724] usb 3-1: USB disconnect, device number 12 [ 209.777529][ T31] audit: type=1400 audit(1789069805.968:666): avc: denied { getopt } for pid=7741 comm="syz.6.477" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 210.493925][ T31] audit: type=1400 audit(1789069806.648:667): avc: denied { write } for pid=7746 comm="syz.6.478" name="binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 211.069453][ T9] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 214.643511][ T7772] ip6gretap1: entered allmulticast mode [ 214.655149][ T7772] batman_adv: batadv0: Adding interface: ip6gretap1 [ 214.655180][ T7772] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 214.655258][ T7772] batman_adv: batadv0: Interface activated: ip6gretap1 [ 215.028779][ T7765] FAULT_INJECTION: forcing a failure. [ 215.028779][ T7765] name fail_futex, interval 1, probability 0, space 0, times 0 [ 215.028809][ T7765] CPU: 0 UID: 0 PID: 7765 Comm: syz.6.483 Not tainted syzkaller #0 PREEMPT(full) [ 215.028828][ T7765] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 215.028837][ T7765] Call Trace: [ 215.028843][ T7765] [ 215.028849][ T7765] dump_stack_lvl+0x100/0x190 [ 215.028877][ T7765] should_fail_ex.cold+0x5/0xa [ 215.028900][ T7765] get_futex_key+0x293/0x14f0 [ 215.028924][ T7765] ? __pfx_get_futex_key+0x10/0x10 [ 215.028945][ T7765] ? __mutex_unlock_slowpath+0x35d/0x930 [ 215.028972][ T7765] futex_wake+0xf4/0x5e0 [ 215.028998][ T7765] ? __pfx_futex_wake+0x10/0x10 [ 215.029024][ T7765] ? lock_acquire+0x1d1/0x380 [ 215.029041][ T7765] ? detach_task_ctx_data+0x83/0x490 [ 215.029068][ T7765] do_futex+0x2b2/0x440 [ 215.029089][ T7765] ? __pfx_do_futex+0x10/0x10 [ 215.029109][ T7765] ? __might_fault+0xc5/0x140 [ 215.029137][ T7765] mm_exit_exec_release+0x256/0x2f0 [ 215.029158][ T7765] do_exit+0x707/0x2ae0 [ 215.029176][ T7765] ? __pfx___might_resched+0x10/0x10 [ 215.029195][ T7765] ? __pfx_do_exit+0x10/0x10 [ 215.029215][ T7765] ? do_raw_spin_lock+0x128/0x260 [ 215.029234][ T7765] ? find_held_lock+0x2b/0x80 [ 215.029255][ T7765] ? get_signal+0x7e0/0x21e0 [ 215.029274][ T7765] do_group_exit+0xd5/0x2a0 [ 215.029296][ T7765] get_signal+0x1ec7/0x21e0 [ 215.029322][ T7765] ? __pfx_get_signal+0x10/0x10 [ 215.029338][ T7765] ? poll_select_finish+0x36e/0x670 [ 215.029357][ T7765] ? __pfx_poll_select_finish+0x10/0x10 [ 215.029373][ T7765] ? do_futex+0x190/0x440 [ 215.029395][ T7765] arch_do_signal_or_restart+0x91/0x7e0 [ 215.029419][ T7765] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 215.029455][ T7765] exit_to_user_mode_loop+0x139/0x700 [ 215.029479][ T7765] ? rcu_is_watching+0x13/0xc0 [ 215.029502][ T7765] do_syscall_64+0x661/0x790 [ 215.029524][ T7765] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 215.029540][ T7765] RIP: 0033:0x7fa6c499e159 [ 215.029554][ T7765] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 215.029568][ T7765] RSP: 002b:00007fa6c2bf6028 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 215.029585][ T7765] RAX: 0000000000000001 RBX: 00007fa6c4c25fa0 RCX: 00007fa6c499e159 [ 215.029596][ T7765] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000200000000100 [ 215.029605][ T7765] RBP: 00007fa6c4a3503b R08: 0000000000000000 R09: 0000000000000000 [ 215.029614][ T7765] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 215.029624][ T7765] R13: 00007fa6c4c26038 R14: 00007fa6c4c25fa0 R15: 00007ffd507966e8 [ 215.029646][ T7765] [ 216.394840][ T5724] libceph: connect (1)[c::]:6789 error -101 [ 216.395640][ T5724] libceph: mon0 (1)[c::]:6789 connect error [ 216.423033][ T7781] ceph: No mds server is up or the cluster is laggy [ 218.043618][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 218.183214][ T7788] syzkaller0: entered promiscuous mode [ 218.183236][ T7788] syzkaller0: entered allmulticast mode [ 218.864001][ T7808] block nbd3: shutting down sockets [ 221.733814][ T31] audit: type=1400 audit(1789069817.868:668): avc: denied { append } for pid=7824 comm="syz.2.498" name="video1" dev="devtmpfs" ino=930 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 224.283762][ T5695] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 224.457301][ T5695] usb 3-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 224.479207][ T5695] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 224.546547][ T5695] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 224.546818][ T5695] usb 3-1: Product: syz [ 224.548704][ T5695] usb 3-1: Manufacturer: syz [ 224.550070][ T5695] usb 3-1: SerialNumber: syz [ 224.957681][ T7856] FAT-fs (nullb0): bogus number of reserved sectors [ 224.957759][ T7856] FAT-fs (nullb0): Can't find a valid FAT filesystem [ 224.963454][ T31] audit: type=1400 audit(1789069821.138:669): avc: denied { mounton } for pid=7853 comm="syz.1.503" path="/syzcgroup/unified/syz1" dev="cgroup2" ino=68 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 225.230933][ T31] audit: type=1400 audit(1789069821.418:670): avc: denied { open } for pid=7846 comm="syz.2.502" path="/dev/ttyq8" dev="devtmpfs" ino=383 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 225.257855][ T5695] usb 3-1: Cannot retrieve CPort count: -71 [ 225.257883][ T5695] usb 3-1: Cannot retrieve CPort count: -71 [ 225.257897][ T5695] es2_ap_driver 3-1:1.0: probe with driver es2_ap_driver failed with error -71 [ 225.294089][ T5695] usb 3-1: USB disconnect, device number 14 [ 225.448523][ T31] audit: type=1400 audit(1789069821.638:671): avc: denied { read write } for pid=7857 comm="syz.3.505" name="cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 225.449292][ T31] audit: type=1400 audit(1789069821.638:672): avc: denied { open } for pid=7857 comm="syz.3.505" path="/dev/cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 225.450895][ T7859] CacheFiles: No cache directory specified [ 225.452071][ T31] audit: type=1400 audit(1789069821.638:673): avc: denied { map } for pid=7857 comm="syz.3.505" path="/dev/cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 225.452639][ T31] audit: type=1400 audit(1789069821.638:674): avc: denied { execute } for pid=7857 comm="syz.3.505" path="/dev/cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 225.619497][ T7859] 9pnet_virtio: no channels available for device syz [ 226.390076][ T31] audit: type=1400 audit(1789069822.578:675): avc: denied { write } for pid=7864 comm="syz.2.507" name="001" dev="devtmpfs" ino=741 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 226.439634][ T7865] binder: 7864:7865 ioctl c00c6211 0 returned -14 [ 226.507926][ T7872] loop2: detected capacity change from 0 to 2640 [ 226.570427][ T7872] Buffer I/O error on dev loop2, logical block 0, lost async page write [ 226.570606][ T7872] Buffer I/O error on dev loop2, logical block 1, lost async page write [ 226.570676][ T7872] Buffer I/O error on dev loop2, logical block 2, lost async page write [ 226.570706][ T7872] Buffer I/O error on dev loop2, logical block 3, lost async page write [ 226.570734][ T7872] Buffer I/O error on dev loop2, logical block 4, lost async page write [ 226.570761][ T7872] Buffer I/O error on dev loop2, logical block 5, lost async page write [ 226.570789][ T7872] Buffer I/O error on dev loop2, logical block 6, lost async page write [ 226.570817][ T7872] Buffer I/O error on dev loop2, logical block 7, lost async page write [ 226.570844][ T7872] Buffer I/O error on dev loop2, logical block 8, lost async page write [ 226.570872][ T7872] Buffer I/O error on dev loop2, logical block 9, lost async page write [ 227.253274][ T7874] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 228.737390][ T7873] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 228.972036][ T283] IPVS: starting estimator thread 0... [ 229.063908][ T7885] IPVS: using max 74 ests per chain, 177600 per kthread [ 229.240118][ T5724] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 229.383600][ T5724] usb 7-1: Using ep0 maxpacket: 32 [ 229.392767][ T5724] usb 7-1: unable to get BOS descriptor or descriptor too short [ 229.392922][ T5724] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 229.603568][ T31] audit: type=1400 audit(1789069825.768:676): avc: denied { bind } for pid=7892 comm="syz.1.514" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 230.495061][ T31] audit: type=1400 audit(1789069826.158:677): avc: denied { append } for pid=7889 comm="syz.3.513" name="usbmon8" dev="devtmpfs" ino=739 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 230.495132][ T31] audit: type=1400 audit(1789069826.188:678): avc: denied { execute } for pid=7889 comm="syz.3.513" path="/dev/usbmon8" dev="devtmpfs" ino=739 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 230.721110][ T5724] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 230.721129][ T5724] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 230.721141][ T5724] usb 7-1: config 14 has no interface number 0 [ 230.721150][ T5724] usb 7-1: config 14 has no interface number 1 [ 230.721178][ T5724] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 230.721191][ T5724] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 230.721204][ T5724] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 230.721217][ T5724] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 230.721230][ T5724] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 230.721243][ T5724] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 230.721257][ T5724] usb 7-1: config 14 interface 57 has no altsetting 0 [ 230.721267][ T5724] usb 7-1: config 14 interface 228 has no altsetting 0 [ 230.926678][ T5724] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 230.926703][ T5724] usb 7-1: Product: syz [ 230.926718][ T5724] usb 7-1: Manufacturer: syz [ 230.926731][ T5724] usb 7-1: SerialNumber: syz [ 231.633246][ T7907] netlink: 8 bytes leftover after parsing attributes in process `syz.2.515'. [ 231.984496][ T5724] legousbtower 7-1:14.57: interrupt endpoints not found [ 232.005409][ T7910] snd_dummy snd_dummy.0: control 0:0:4:syz0:7 is already present [ 232.006189][ T7909] netlink: 14 bytes leftover after parsing attributes in process `syz.0.518'. [ 232.006290][ T7909] batman_adv: batadv0: Interface deactivated: dummy0 [ 232.036740][ T7909] batman_adv: batadv0: Removing interface: dummy0 [ 233.262560][ T7917] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(12) [ 233.262590][ T7917] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 233.263346][ T7917] vhci_hcd vhci_hcd.0: Device attached [ 233.534731][ T7918] vhci_hcd: connection closed [ 234.820973][ T50] vhci_hcd vhci_hcd.1: stop threads [ 234.852032][ T50] vhci_hcd vhci_hcd.1: release socket [ 234.852212][ T50] vhci_hcd vhci_hcd.1: disconnect device [ 234.947280][ T5724] legousbtower 7-1:14.228: get version request failed: -71 [ 234.947420][ T5724] legousbtower 7-1:14.228: probe with driver legousbtower failed with error -71 [ 234.977205][ T5724] usb 7-1: USB disconnect, device number 3 [ 235.567465][ T31] audit: type=1400 audit(1789069831.508:679): avc: denied { bind } for pid=7929 comm="syz.6.521" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 235.567514][ T31] audit: type=1400 audit(1789069831.508:680): avc: denied { node_bind } for pid=7929 comm="syz.6.521" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 235.567544][ T31] audit: type=1400 audit(1789069831.528:681): avc: denied { mount } for pid=7929 comm="syz.6.521" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 237.091685][ T7954] netlink: 44 bytes leftover after parsing attributes in process `syz.2.525'. [ 237.091708][ T7954] netlink: 59 bytes leftover after parsing attributes in process `syz.2.525'. [ 237.091722][ T7954] netlink: 59 bytes leftover after parsing attributes in process `syz.2.525'. [ 238.257357][ T31] audit: type=1400 audit(1789069834.438:682): avc: denied { write } for pid=7937 comm="syz.0.523" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 238.257615][ T31] audit: type=1400 audit(1789069834.448:683): avc: denied { nlmsg_write } for pid=7937 comm="syz.0.523" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 240.843694][ T31] audit: type=1400 audit(1789069836.958:684): avc: denied { connect } for pid=7971 comm="syz.3.533" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 240.843903][ T31] audit: type=1400 audit(1789069836.968:685): avc: denied { write } for pid=7971 comm="syz.3.533" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 241.307174][ T31] audit: type=1400 audit(1789069837.498:686): avc: denied { setopt } for pid=7977 comm="syz.0.534" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 241.754616][ T7983] batman_adv: batadv0: Adding interface: veth0 [ 241.754635][ T7983] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 241.754662][ T7983] batman_adv: batadv0: Interface activated: veth0 [ 241.808511][ T7983] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 241.808529][ T7983] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 241.921352][ T7983] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 241.921367][ T7983] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 241.952923][ T7983] batman_adv: batadv0: Interface deactivated: ip6gretap1 [ 241.952939][ T7983] batman_adv: batadv0: Removing interface: ip6gretap1 [ 242.051798][ T7983] batman_adv: batadv0: Interface deactivated: veth0 [ 242.051820][ T7983] batman_adv: batadv0: Removing interface: veth0 [ 243.345024][ T31] audit: type=1400 audit(1789069839.538:687): avc: denied { write } for pid=7994 comm="syz.2.537" name="usb_gadget" dev="configfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 243.376618][ T31] audit: type=1400 audit(1789069839.548:688): avc: denied { write } for pid=7994 comm="syz.2.537" name="configs" dev="configfs" ino=21651 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 243.376672][ T31] audit: type=1400 audit(1789069839.548:689): avc: denied { write } for pid=7994 comm="syz.2.537" name="functions" dev="configfs" ino=21650 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 243.383660][ T31] audit: type=1400 audit(1789069839.568:690): avc: denied { write } for pid=7994 comm="syz.2.537" name="ep.0" dev="configfs" ino=21658 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 243.499616][ T31] audit: type=1400 audit(1789069839.688:691): avc: denied { write } for pid=7994 comm="syz.2.537" name="c.1" dev="configfs" ino=21655 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 243.501012][ T31] audit: type=1400 audit(1789069839.688:692): avc: denied { create } for pid=7994 comm="syz.2.537" name="midi2.usb0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=lnk_file permissive=1 [ 243.502846][ T31] audit: type=1400 audit(1789069839.688:693): avc: denied { write } for pid=7994 comm="syz.2.537" name="c.1" dev="configfs" ino=21655 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 244.453641][ T7995] f_midi2: Invalid MIDI1 group definitions for block 0:1 [ 247.698371][ T31] kauditd_printk_skb: 1 callbacks suppressed [ 247.698389][ T31] audit: type=1400 audit(1789069843.408:695): avc: denied { audit_write } for pid=8016 comm="syz.1.536" capability=29 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 248.333932][ T25] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 248.695015][ T25] usb 3-1: Using ep0 maxpacket: 8 [ 250.199450][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 250.202532][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 251.183769][ T31] audit: type=1400 audit(1789069847.368:696): avc: denied { audit_read } for pid=8039 comm="syz.3.540" capability=37 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 252.432652][ T25] usb 3-1: device descriptor read/all, error -71 [ 252.480006][ T8043] ceph: No mds server is up or the cluster is laggy [ 252.480340][ T5724] libceph: connect (1)[c::]:6789 error -101 [ 252.480434][ T5724] libceph: mon0 (1)[c::]:6789 connect error [ 252.661779][ T31] audit: type=1400 audit(1789069848.848:697): avc: denied { ioctl } for pid=8050 comm="syz.2.549" path="socket:[21742]" dev="sockfs" ino=21742 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 252.887295][ T8056] netlink: 68 bytes leftover after parsing attributes in process `syz.6.550'. [ 252.995548][ T8056] netlink: 4 bytes leftover after parsing attributes in process `syz.6.550'. [ 252.995567][ T8056] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 252.995578][ T8056] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 252.995988][ T8056] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 252.995998][ T8056] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 254.945632][ T8072] netlink: zone id is out of range [ 254.945677][ T8072] netlink: zone id is out of range [ 254.945698][ T8072] netlink: zone id is out of range [ 254.945718][ T8072] netlink: zone id is out of range [ 254.945738][ T8072] netlink: zone id is out of range [ 254.945757][ T8072] netlink: zone id is out of range [ 254.945792][ T8072] netlink: zone id is out of range [ 254.945811][ T8072] netlink: zone id is out of range [ 254.945831][ T8072] netlink: zone id is out of range [ 254.945850][ T8072] netlink: zone id is out of range [ 259.331639][ T8099] netlink: 32 bytes leftover after parsing attributes in process `syz.1.554'. [ 259.435486][ T31] audit: type=1400 audit(1789069855.598:698): avc: denied { connect } for pid=8097 comm="syz.1.554" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 260.408081][ T8102] netlink: 4 bytes leftover after parsing attributes in process `syz.6.562'. [ 261.352846][ T5724] usb 4-1: new full-speed USB device number 15 using dummy_hcd [ 261.753534][ T8110] 9pnet: Found fid 0 not clunked [ 261.879899][ T31] audit: type=1400 audit(1789069858.068:699): avc: denied { create } for pid=8118 comm="syz.0.558" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 261.904133][ T31] audit: type=1400 audit(1789069858.078:700): avc: denied { write } for pid=8118 comm="syz.0.558" name="file0" dev="tmpfs" ino=707 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 261.904167][ T31] audit: type=1400 audit(1789069858.078:701): avc: denied { open } for pid=8118 comm="syz.0.558" path="/123/file0" dev="tmpfs" ino=707 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 261.905194][ T31] audit: type=1400 audit(1789069858.098:702): avc: denied { ioctl } for pid=8118 comm="syz.0.558" path="/123/file0" dev="tmpfs" ino=707 ioctlcmd=0x1273 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 262.259979][ T5724] usb 4-1: New USB device found, idVendor=10cf, idProduct=8061, bcdDevice=b7.12 [ 262.260836][ T5724] usb 4-1: config 0 has an invalid interface number: 6 but max is 0 [ 262.260856][ T5724] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 262.260872][ T5724] usb 4-1: config 0 has no interface number 0 [ 262.260903][ T5724] usb 4-1: config 0 interface 6 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 262.260925][ T5724] usb 4-1: config 0 interface 6 altsetting 0 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 262.262546][ T5724] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 262.262565][ T5724] usb 4-1: Product: syz [ 262.262578][ T5724] usb 4-1: Manufacturer: syz [ 262.262591][ T5724] usb 4-1: SerialNumber: syz [ 262.352563][ T5724] usb 4-1: config 0 descriptor?? [ 262.406449][ T31] audit: type=1400 audit(1789069858.578:703): avc: denied { ioctl } for pid=8122 comm="syz.2.559" path="socket:[20934]" dev="sockfs" ino=20934 ioctlcmd=0x943e scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 262.415305][ T8113] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 262.415390][ T8113] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 262.472711][ T5724] comedi comedi4: driver 'vmk80xx' has successfully auto-configured 'K8061 (VM140)'. [ 262.477934][ T8127] netlink: 188 bytes leftover after parsing attributes in process `syz.6.566'. [ 263.869233][ T5724] usb 4-1: USB disconnect, device number 15 [ 265.167113][ T25] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 265.401070][ T25] usb 3-1: device descriptor read/64, error -71 [ 265.822783][ T8158] tipc: Enabling of bearer rejected, failed to enable media [ 266.123550][ T25] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 266.344844][ T25] usb 3-1: device descriptor read/64, error -71 [ 266.680345][ T25] usb usb3-port1: attempt power cycle [ 267.603870][ T25] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 267.624185][ C1] raw-gadget.0 gadget.2: ignoring, device is not running [ 267.624247][ T25] usb 3-1: device descriptor read/8, error -32 [ 268.100553][ T31] audit: type=1400 audit(1789069864.288:704): avc: denied { unlink } for pid=5610 comm="syz-executor" name="file0" dev="tmpfs" ino=707 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 268.971733][ T8173] jffs2: notice: (8173) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 269.385560][ T5716] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 270.051011][ T5603] Bluetooth: hci4: ACL packet for unknown connection handle 201 [ 270.340463][ T31] audit: type=1400 audit(1789069866.528:705): avc: denied { setopt } for pid=8182 comm="syz.2.578" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 270.363268][ T5716] usb 4-1: Using ep0 maxpacket: 16 [ 270.363879][ T5716] usb 4-1: New USB device found, idVendor=041e, idProduct=3040, bcdDevice= 0.40 [ 270.364700][ T5716] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 270.364749][ T5716] usb 4-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 270.366425][ T5716] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 270.366445][ T5716] usb 4-1: Product: syz [ 270.366456][ T5716] usb 4-1: Manufacturer: syz [ 270.366469][ T5716] usb 4-1: SerialNumber: syz [ 271.758603][ T5716] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 273.506698][ T5716] usb 4-1: USB disconnect, device number 16 [ 273.568261][ T8218] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 273.771951][ T31] audit: type=1400 audit(1789069869.958:706): avc: denied { ioctl } for pid=8213 comm="syz.1.587" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 ioctlcmd=0x5878 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 274.562996][ T8214] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4fe08 [ 274.563025][ T8214] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 274.563040][ T8214] memcg:ffff888031985301 [ 274.563049][ T8214] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 274.563067][ T8214] page_type: f5(slab) [ 274.563082][ T8214] raw: 00fff00000000040 ffff88801c09b000 dead000000000100 dead000000000122 [ 274.563098][ T8214] raw: 0000000000000000 0000000200170017 00000000f5000000 ffff888031985301 [ 274.563113][ T8214] head: 00fff00000000040 ffff88801c09b000 dead000000000100 dead000000000122 [ 274.563129][ T8214] head: 0000000000000000 0000000200170017 00000000f5000000 ffff888031985301 [ 274.563144][ T8214] head: 00fff00000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff [ 274.563160][ T8214] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 274.563170][ T8214] page dumped because: unmovable page [ 274.563179][ T8214] page_owner tracks the page as allocated [ 274.563185][ T8214] page last allocated via order 2, migratetype Reclaimable, gfp_mask 0xd2810(GFP_NOWAIT|__GFP_RECLAIMABLE|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 8088, tgid 8088 (syz.2.557), ts 257780097794 [ 274.563214][ T8214] post_alloc_hook+0xfd/0x120 [ 274.563241][ T8214] get_page_from_freelist+0x110d/0x35d0 [ 274.563267][ T8214] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 274.563291][ T8214] new_slab+0xa9/0x6e0 [ 274.563314][ T8214] refill_objects+0xe3/0x410 [ 274.563337][ T8214] __pcs_replace_empty_main+0x35e/0x650 [ 274.563360][ T8214] kmem_cache_alloc_lru_noprof+0x4c0/0x6a0 [ 274.563377][ T8214] xas_alloc+0x350/0x460 [ 274.563396][ T8214] xas_create+0x75a/0x14e0 [ 274.563416][ T8214] xas_store+0x9e/0x1a30 [ 274.563437][ T8214] shmem_add_to_page_cache+0x95c/0xcd0 [ 274.563523][ T8214] shmem_alloc_and_add_folio+0x558/0xd40 [ 274.563549][ T8214] shmem_get_folio_gfp+0x75b/0x1980 [ 274.563573][ T8214] shmem_write_begin+0x1a4/0x420 [ 274.563596][ T8214] generic_perform_write+0x292/0xa40 [ 274.563616][ T8214] shmem_file_write_iter+0x10e/0x140 [ 274.563632][ T8214] page last free pid 4971 tgid 4971 ts 220007575747 stack trace: [ 274.563645][ T8214] __free_frozen_pages+0x79f/0x10f0 [ 274.563667][ T8214] qlist_free_all+0x47/0xf0 [ 274.563684][ T8214] kasan_quarantine_reduce+0x1a0/0x1f0 [ 274.563701][ T8214] __kasan_slab_alloc+0x69/0x90 [ 274.563721][ T8214] __kmalloc_cache_noprof+0x278/0x6d0 [ 274.563744][ T8214] nbd_alloc_and_init_config+0x97/0x2a0 [ 274.563767][ T8214] nbd_open+0x4cc/0x700 [ 274.563786][ T8214] blkdev_get_whole+0x99/0x290 [ 274.563809][ T8214] bdev_open+0x2c7/0xe40 [ 274.563823][ T8214] blkdev_open+0x34e/0x4f0 [ 274.563839][ T8214] do_dentry_open+0x6ab/0x14d0 [ 274.563854][ T8214] vfs_open+0x82/0x3f0 [ 274.563873][ T8214] path_openat+0x19fa/0x2440 [ 274.563891][ T8214] do_file_open+0x20e/0x430 [ 274.563909][ T8214] do_sys_openat2+0x10f/0x1e0 [ 274.563928][ T8214] __x64_sys_openat+0x12d/0x210 [ 275.058295][ T6047] udevd[6047]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 277.219930][ T8232] binder: 8225:8232 ioctl c0286687 200000000140 returned -22 [ 277.221955][ T31] audit: type=1400 audit(1789069873.408:707): avc: denied { create } for pid=8225 comm="syz.1.590" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ipx_socket permissive=1 [ 278.952359][ T8243] netlink: 32 bytes leftover after parsing attributes in process `syz.2.594'. [ 281.460473][ T31] audit: type=1400 audit(1789069877.648:708): avc: denied { create } for pid=8259 comm="syz.3.596" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 281.464559][ T31] audit: type=1400 audit(1789069877.658:709): avc: denied { create } for pid=8259 comm="syz.3.596" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 281.514789][ T31] audit: type=1400 audit(1789069877.708:710): avc: denied { write } for pid=8259 comm="syz.3.596" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 281.514985][ T8260] netlink: 20 bytes leftover after parsing attributes in process `syz.3.596'. [ 281.626082][ T31] audit: type=1400 audit(1789069877.818:711): avc: denied { read write } for pid=5610 comm="syz-executor" name="loop0" dev="devtmpfs" ino=645 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 281.630092][ T31] audit: type=1400 audit(1789069877.818:712): avc: denied { open } for pid=5610 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=645 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 281.630135][ T31] audit: type=1400 audit(1789069877.818:713): avc: denied { ioctl } for pid=5610 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=645 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 281.751371][ T31] audit: type=1400 audit(1789069877.938:714): avc: denied { create } for pid=8263 comm="syz.0.597" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 281.753280][ T31] audit: type=1400 audit(1789069877.938:715): avc: denied { write } for pid=8263 comm="syz.0.597" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 281.776917][ T31] audit: type=1400 audit(1789069877.968:716): avc: denied { read } for pid=8263 comm="syz.0.597" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 281.849542][ T8261] FAULT_INJECTION: forcing a failure. [ 281.849542][ T8261] name fail_futex, interval 1, probability 0, space 0, times 0 [ 281.849564][ T8261] CPU: 1 UID: 0 PID: 8261 Comm: syz.3.596 Not tainted syzkaller #0 PREEMPT(full) [ 281.849578][ T8261] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 281.849586][ T8261] Call Trace: [ 281.849590][ T8261] [ 281.849595][ T8261] dump_stack_lvl+0x100/0x190 [ 281.849616][ T8261] should_fail_ex.cold+0x5/0xa [ 281.849633][ T8261] get_futex_key+0x1d0/0x14f0 [ 281.849650][ T8261] ? __pfx_get_futex_key+0x10/0x10 [ 281.849664][ T8261] ? find_held_lock+0x2b/0x80 [ 281.849680][ T8261] ? futex_wake+0x4ea/0x5e0 [ 281.849699][ T8261] futex_wake+0xf4/0x5e0 [ 281.849715][ T8261] ? futex_wait+0x11e/0x370 [ 281.849733][ T8261] ? __pfx_futex_wake+0x10/0x10 [ 281.849752][ T8261] ? rcu_read_lock_any_held+0x6a/0x90 [ 281.849769][ T8261] ? find_held_lock+0x2b/0x80 [ 281.849787][ T8261] do_futex+0x2b2/0x440 [ 281.849803][ T8261] ? __pfx_do_futex+0x10/0x10 [ 281.849817][ T8261] ? __fget_files+0x215/0x3d0 [ 281.849834][ T8261] __x64_sys_futex+0x34f/0x4d0 [ 281.849851][ T8261] ? __pfx___x64_sys_futex+0x10/0x10 [ 281.849866][ T8261] ? __sys_setsockopt+0x1b5/0x220 [ 281.849882][ T8261] do_syscall_64+0x123/0x790 [ 281.849900][ T8261] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 281.849912][ T8261] RIP: 0033:0x7f8d8db9e159 [ 281.849923][ T8261] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 281.849934][ T8261] RSP: 002b:00007f8d8bdf60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 281.849946][ T8261] RAX: ffffffffffffffda RBX: 00007f8d8de26098 RCX: 00007f8d8db9e159 [ 281.849954][ T8261] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f8d8de2609c [ 281.849961][ T8261] RBP: 00007f8d8de26090 R08: 0000000000000001 R09: 0000000000000000 [ 281.849968][ T8261] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 281.849975][ T8261] R13: 00007f8d8de26128 R14: 00007ffc3f223c40 R15: 00007ffc3f223d28 [ 281.849990][ T8261] [ 281.917493][ T31] audit: type=1400 audit(1789069878.108:717): avc: denied { read write } for pid=8259 comm="syz.3.596" name="virtual_nci" dev="devtmpfs" ino=697 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 283.712685][ T8281] mmap: syz.2.601 (8281) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 283.817431][ T8281] input: syz1 as /devices/virtual/input/input13 [ 286.390526][ T8288] ceph: No mds server is up or the cluster is laggy [ 286.518585][ T9] libceph: connect (1)[c::]:6789 error -101 [ 286.518682][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 286.719964][ T31] kauditd_printk_skb: 37 callbacks suppressed [ 286.719981][ T31] audit: type=1400 audit(1789069882.908:755): avc: denied { unmount } for pid=5610 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 286.828967][ T31] audit: type=1400 audit(1789069883.018:756): avc: denied { map_create } for pid=8294 comm="syz.6.592" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 286.829014][ T31] audit: type=1400 audit(1789069883.018:757): avc: denied { map_read map_write } for pid=8294 comm="syz.6.592" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 286.895991][ T31] audit: type=1400 audit(1789069883.088:758): avc: denied { perfmon } for pid=8294 comm="syz.6.592" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 286.896033][ T31] audit: type=1400 audit(1789069883.088:759): avc: denied { prog_run } for pid=8294 comm="syz.6.592" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 287.046456][ T31] audit: type=1400 audit(1789069883.238:760): avc: denied { mount } for pid=8293 comm="syz.3.604" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 287.048381][ T31] audit: type=1400 audit(1789069883.238:761): avc: denied { search } for pid=8293 comm="syz.3.604" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 287.049899][ T31] audit: type=1400 audit(1789069883.238:762): avc: denied { append } for pid=8293 comm="syz.3.604" name="uprobe_events" dev="tracefs" ino=1078 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 287.049924][ T31] audit: type=1400 audit(1789069883.238:763): avc: denied { open } for pid=8293 comm="syz.3.604" path="/113/tracing/uprobe_events" dev="tracefs" ino=1078 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 287.064545][ T8296] netlink: 68 bytes leftover after parsing attributes in process `syz.3.604'. [ 287.087887][ T31] audit: type=1400 audit(1789069883.278:764): avc: denied { create } for pid=8293 comm="syz.3.604" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 287.852979][ T8303] netlink: 4 bytes leftover after parsing attributes in process `syz.3.604'. [ 290.988323][ T8329] CIFS: Attempting to mount //127.0.0.1/share [ 291.363646][ T8336] netlink: 'syz.6.611': attribute type 2 has an invalid length. [ 291.681821][ T8339] syz_tun: entered allmulticast mode [ 291.893923][ T31] kauditd_printk_skb: 33 callbacks suppressed [ 291.893948][ T31] audit: type=1400 audit(1789069887.538:798): avc: denied { setopt } for pid=8332 comm="syz.6.611" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 291.894125][ T31] audit: type=1400 audit(1789069887.598:799): avc: denied { read write } for pid=8332 comm="syz.6.611" name="ptp0" dev="devtmpfs" ino=1264 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 291.894244][ T31] audit: type=1400 audit(1789069887.598:800): avc: denied { open } for pid=8332 comm="syz.6.611" path="/dev/ptp0" dev="devtmpfs" ino=1264 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 291.894341][ T31] audit: type=1400 audit(1789069887.618:801): avc: denied { ioctl } for pid=8332 comm="syz.6.611" path="/dev/ptp0" dev="devtmpfs" ino=1264 ioctlcmd=0x3d0c scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 291.894463][ T31] audit: type=1400 audit(1789069887.868:802): avc: denied { setopt } for pid=8333 comm="syz.1.600" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 291.894579][ T31] audit: type=1400 audit(1789069887.878:803): avc: denied { create } for pid=8333 comm="syz.1.600" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 293.424966][ T8329] CIFS: VFS: cifs_mount failed w/return code = -512 [ 294.520269][ T31] audit: type=1400 audit(1789069890.338:804): avc: denied { setopt } for pid=8347 comm="syz.1.613" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 294.520311][ T31] audit: type=1400 audit(1789069890.358:805): avc: denied { write } for pid=8347 comm="syz.1.613" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 294.631342][ T31] audit: type=1400 audit(1789069890.818:806): avc: denied { write } for pid=8356 comm="syz.2.615" path="/dev/vhci" dev="devtmpfs" ino=1267 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 294.631515][ T5603] Bluetooth: hci3: unexpected event for opcode 0x041c [ 294.895606][ T31] audit: type=1400 audit(1789069891.088:807): avc: denied { read write } for pid=8364 comm="syz.2.620" name="sg0" dev="devtmpfs" ino=830 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 295.872597][ T8380] devpts: Unknown parameter 'צdv}[o`Tr֮6 [ 295.872597][ T8380] vw7ɛ09]O[h\0~IZKȕP~q^P(k]_> 8s>&PMx{UOz1os2zcybͩĿ~Z'Xky҄WSg*Z0x00000000ffffffff' [ 295.925029][ T8380] i2c i2c-0: new_device: Instantiated device hd3ss3220 at 0x04 [ 295.927974][ T8380] i2c i2c-0: delete_device: Can't find device in list [ 295.996650][ T8383] netlink: 'syz.6.625': attribute type 39 has an invalid length. [ 296.981700][ T31] kauditd_printk_skb: 12 callbacks suppressed [ 296.981719][ T31] audit: type=1400 audit(1789069893.108:820): avc: denied { mount } for pid=8392 comm="syz.6.627" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 297.006393][ T31] audit: type=1400 audit(1789069893.198:821): avc: denied { mount } for pid=8392 comm="syz.6.627" name="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 297.183697][ T8396] virtio_blk virtio3: 1/0/0 default/read/poll queues [ 297.185584][ T8396] virtio_blk virtio3: [vda] 262144 512-byte logical blocks (134 MB/128 MiB) [ 298.106218][ T31] audit: type=1400 audit(1789069894.288:822): avc: denied { unmount } for pid=6917 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 298.312852][ T31] audit: type=1400 audit(1789069894.498:823): avc: denied { unmount } for pid=6917 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 298.492028][ T31] audit: type=1400 audit(1789069894.678:824): avc: denied { write } for pid=8403 comm="syz.3.629" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 298.600956][ T8408] netlink: 59 bytes leftover after parsing attributes in process `syz.6.630'. [ 298.806144][ T31] audit: type=1400 audit(1789069894.998:825): avc: denied { connect } for pid=8415 comm="syz.2.633" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 299.008064][ T31] audit: type=1400 audit(1789069895.188:826): avc: denied { read write } for pid=8409 comm="syz.3.631" name="mtrr" dev="proc" ino=4026531995 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 299.008252][ T31] audit: type=1400 audit(1789069895.188:827): avc: denied { open } for pid=8409 comm="syz.3.631" path="/119/proc/mtrr" dev="proc" ino=4026531995 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 299.008373][ T31] audit: type=1400 audit(1789069895.198:828): avc: denied { ioctl } for pid=8409 comm="syz.3.631" path="/119/proc/mtrr" dev="proc" ino=4026531995 ioctlcmd=0x4d01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 299.295763][ T8424] Config c/1 of g1 needs at least one function. [ 299.297962][ T8424] udc dummy_udc.0: failed to start g1: -22 [ 299.298029][ T8424] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 299.305309][ T8424] UDC core: g1: couldn't find an available UDC or it's busy [ 299.311711][ T31] audit: type=1400 audit(1789069895.448:829): avc: denied { mount } for pid=8411 comm="syz.1.617" name="/" dev="configfs" ino=1109 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 299.315961][ T8420] ceph: No mds server is up or the cluster is laggy [ 299.425676][ T5695] libceph: connect (1)[c::]:6789 error -101 [ 299.426438][ T5695] libceph: mon0 (1)[c::]:6789 connect error [ 299.673369][ T5716] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 299.731930][ T25] libceph: connect (1)[c::]:6789 error -101 [ 299.732876][ T25] libceph: mon0 (1)[c::]:6789 connect error [ 299.859450][ T5716] usb 7-1: Using ep0 maxpacket: 8 [ 299.897335][ T5716] usb 7-1: unable to get BOS descriptor or descriptor too short [ 299.897378][ T5716] usb 7-1: New USB device found, idVendor=0499, idProduct=89a4, bcdDevice=4f.cd [ 299.911996][ T5716] usb 7-1: config 2 has an invalid interface number: 232 but max is 0 [ 299.912023][ T5716] usb 7-1: config 2 has no interface number 0 [ 299.912057][ T5716] usb 7-1: config 2 interface 232 altsetting 128 endpoint 0x5 has invalid maxpacket 3917, setting to 1024 [ 299.912081][ T5716] usb 7-1: config 2 interface 232 altsetting 128 bulk endpoint 0x5 has invalid maxpacket 1024 [ 299.912103][ T5716] usb 7-1: config 2 interface 232 has no altsetting 0 [ 299.938004][ T5716] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 299.938032][ T5716] usb 7-1: Product: syz [ 299.938047][ T5716] usb 7-1: Manufacturer: syz [ 299.938061][ T5716] usb 7-1: SerialNumber: syz [ 299.954006][ T8417] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 300.282709][ T8414] xt_hashlimit: max too large, truncated to 1048576 [ 301.652728][ T8438] comedi comedi1: dt2814: I/O base address not correctly aligned [ 302.647271][ T31] kauditd_printk_skb: 32 callbacks suppressed [ 302.647321][ T31] audit: type=1400 audit(1789069898.838:862): avc: denied { write } for pid=8442 comm="syz.1.639" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 302.813200][ T31] audit: type=1326 audit(1789069898.908:863): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8439 comm="syz.0.638" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4d5d9e159 code=0x7fc00000 [ 302.813259][ T31] audit: type=1326 audit(1789069898.908:864): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8439 comm="syz.0.638" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7fe4d5d9e159 code=0x7fc00000 [ 303.147173][ T31] audit: type=1400 audit(1789069899.338:865): avc: denied { sqpoll } for pid=8452 comm="syz.1.643" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 303.186762][ T31] audit: type=1400 audit(1789069899.378:866): avc: denied { name_bind } for pid=8448 comm="syz.6.640" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 304.093271][ T8460] Invalid ELF header type: 3 != 1 [ 304.971555][ T31] audit: type=1400 audit(1789069900.268:867): avc: denied { module_load } for pid=8447 comm="syz.2.641" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 304.971602][ T31] audit: type=1400 audit(1789069900.378:868): avc: denied { mount } for pid=8447 comm="syz.2.641" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 304.971632][ T31] audit: type=1400 audit(1789069900.388:869): avc: denied { mount } for pid=8447 comm="syz.2.641" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 304.971662][ T31] audit: type=1400 audit(1789069900.388:870): avc: denied { ioctl } for pid=8447 comm="syz.2.641" path="socket:[22799]" dev="sockfs" ino=22799 ioctlcmd=0x52c8 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 305.043777][ T31] audit: type=1400 audit(1789069901.228:871): avc: denied { unmount } for pid=5611 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 305.136173][ T5709] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 305.174713][ T5716] usb 7-1: USB disconnect, device number 4 [ 305.234091][ T8465] netlink: 'syz.2.646': attribute type 9 has an invalid length. [ 305.305287][ T5709] usb 2-1: Using ep0 maxpacket: 8 [ 305.309428][ T5709] usb 2-1: New USB device found, idVendor=05c6, idProduct=9205, bcdDevice=29.ac [ 305.315495][ T5709] usb 2-1: config 0 has an invalid interface number: 6 but max is 2 [ 305.315521][ T5709] usb 2-1: config 0 has an invalid interface number: 176 but max is 2 [ 305.315540][ T5709] usb 2-1: config 0 has no interface number 1 [ 305.315556][ T5709] usb 2-1: config 0 has no interface number 2 [ 305.315597][ T5709] usb 2-1: too many endpoints for config 0 interface 0 altsetting 255: 255, using maximum allowed: 30 [ 305.315626][ T5709] usb 2-1: config 0 interface 0 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 305.315650][ T5709] usb 2-1: config 0 interface 0 has no altsetting 0 [ 305.315676][ T5709] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 305.335003][ T6018] udevd[6018]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:2.232/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 305.347581][ T5709] usb 2-1: config 0 descriptor?? [ 305.529314][ T8471] netlink: 8 bytes leftover after parsing attributes in process `syz.3.645'. [ 305.529429][ T8471] netlink: 20 bytes leftover after parsing attributes in process `syz.3.645'. [ 305.569332][ T8471] netlink: 8 bytes leftover after parsing attributes in process `syz.3.645'. [ 305.569448][ T8471] netlink: 20 bytes leftover after parsing attributes in process `syz.3.645'. [ 305.615801][ T7921] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 305.616177][ T7921] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 305.637991][ T1475] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 305.638107][ T1475] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 305.780959][ T5709] usb 2-1: Could not set interface, error -71 [ 305.832797][ T5709] qmi_wwan 2-1:0.0: probe with driver qmi_wwan failed with error -22 [ 305.878202][ T5709] usb 2-1: USB disconnect, device number 10 [ 306.073488][ T8479] netlink: 'syz.2.652': attribute type 1 has an invalid length. [ 306.261482][ T8485] netlink: 'syz.2.655': attribute type 2 has an invalid length. [ 306.261503][ T8485] netlink: 'syz.2.655': attribute type 7 has an invalid length. [ 308.083456][ T31] kauditd_printk_skb: 9 callbacks suppressed [ 308.083473][ T31] audit: type=1400 audit(1789069904.278:881): avc: denied { write } for pid=8501 comm="syz.3.660" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 308.083512][ T31] audit: type=1400 audit(1789069904.278:882): avc: denied { nlmsg_write } for pid=8501 comm="syz.3.660" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 308.085738][ T8504] netlink: 8 bytes leftover after parsing attributes in process `syz.1.661'. [ 308.382363][ T31] audit: type=1400 audit(1789069904.568:883): avc: denied { read write } for pid=8511 comm="syz.6.665" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 308.408745][ T31] audit: type=1400 audit(1789069904.598:884): avc: denied { open } for pid=8511 comm="syz.6.665" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 308.762982][ T5716] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 308.787761][ T31] audit: type=1400 audit(1789069904.978:885): avc: denied { write } for pid=8516 comm="syz.2.666" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 308.914728][ T5716] usb 7-1: New USB device found, idVendor=0ccd, idProduct=0099, bcdDevice=bd.95 [ 308.920678][ T5716] usb 7-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 308.920801][ T5716] usb 7-1: config 2 has 1 interface, different from the descriptor's value: 3 [ 308.983693][ T5716] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 308.983994][ T5716] usb 7-1: Product: syz [ 308.984312][ T5716] usb 7-1: Manufacturer: syz [ 308.984944][ T5716] usb 7-1: SerialNumber: syz [ 309.489902][ T31] audit: type=1400 audit(1789069905.678:886): avc: denied { bind } for pid=8511 comm="syz.6.665" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 309.491565][ T8515] Bluetooth: MGMT ver 1.23 [ 309.491658][ T31] audit: type=1400 audit(1789069905.678:887): avc: denied { write } for pid=8511 comm="syz.6.665" path="socket:[22934]" dev="sockfs" ino=22934 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 309.587492][ T31] audit: type=1400 audit(1789069905.758:888): avc: denied { ioctl } for pid=8511 comm="syz.6.665" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 309.692305][ T31] audit: type=1400 audit(1789069905.878:889): avc: denied { open } for pid=8511 comm="syz.6.665" path="/dev/ptyr0" dev="devtmpfs" ino=135 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 309.797511][ T31] audit: type=1400 audit(1789069905.938:890): avc: denied { ioctl } for pid=8511 comm="syz.6.665" path="/dev/ptyr0" dev="devtmpfs" ino=135 ioctlcmd=0x542b scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 310.524027][ T9] libceph: connect (1)[c::]:6789 error -101 [ 310.524662][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 310.528229][ T9] libceph: connect (1)[c::]:6789 error -101 [ 310.529036][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 310.550579][ T8521] ceph: No mds server is up or the cluster is laggy [ 310.809688][ T9] libceph: connect (1)[c::]:6789 error -101 [ 310.810384][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 311.149932][ T5716] usb 7-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 311.150292][ T5716] dvb_usb_af9015 7-1:2.0: probe with driver dvb_usb_af9015 failed with error -22 [ 311.169480][ T5716] usb 7-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 311.169521][ T5716] dvb_usb_af9035 7-1:2.0: probe with driver dvb_usb_af9035 failed with error -22 [ 311.272119][ T5709] libceph: connect (1)[c::]:6789 error -101 [ 311.272215][ T5709] libceph: mon0 (1)[c::]:6789 connect error [ 311.287687][ T8539] ceph: No mds server is up or the cluster is laggy [ 311.664808][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 311.664856][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 312.047938][ T5716] usb 7-1: USB disconnect, device number 5 [ 312.257020][ T8553] comedi comedi3: c6xdigio: I/O base address not correctly aligned [ 312.346736][ T8560] jffs2: notice: (8560) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 312.579329][ T8574] overlayfs: conflicting options: userxattr,redirect_dir=on [ 312.636557][ T5709] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 312.805931][ T5709] usb 1-1: unable to get BOS descriptor or descriptor too short [ 312.806088][ T5709] usb 1-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 313.051523][ T5709] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 313.051555][ T5709] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 313.051659][ T5709] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 313.136069][ T5709] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 313.136131][ T5709] usb 1-1: Product: syz [ 313.136166][ T5709] usb 1-1: Manufacturer: syz [ 313.136232][ T5709] usb 1-1: SerialNumber: syz [ 313.208046][ T8577] ceph: No mds server is up or the cluster is laggy [ 313.350444][ T9] libceph: connect (1)[c::]:6789 error -101 [ 313.351413][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 313.645254][ T4932] libceph: connect (1)[c::]:6789 error -101 [ 313.646394][ T4932] libceph: mon0 (1)[c::]:6789 connect error [ 314.154844][ T4932] libceph: connect (1)[c::]:6789 error -101 [ 314.155798][ T4932] libceph: mon0 (1)[c::]:6789 connect error [ 314.271838][ T8584] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 314.302535][ T31] kauditd_printk_skb: 8 callbacks suppressed [ 314.302569][ T31] audit: type=1400 audit(1789069910.459:899): avc: denied { write } for pid=8558 comm="syz.0.682" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 314.302733][ T31] audit: type=1400 audit(1789069910.469:900): avc: denied { add_name } for pid=8558 comm="syz.0.682" name="dev" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 314.302810][ T31] audit: type=1400 audit(1789069910.469:901): avc: denied { create } for pid=8558 comm="syz.0.682" name="dev" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 315.381283][ T31] audit: type=1400 audit(1789069911.559:902): avc: denied { setopt } for pid=8589 comm="syz.3.691" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 315.487529][ T5709] usb 1-1: Can't get UAC3 power state for id 10 [ 315.519971][ T5709] usb 1-1: 2:0: failed to get current value for ch 0 (-71) [ 315.562011][ T5709] usb 1-1: 2:0: cannot get min/max values for control 2 (id 2) [ 315.562041][ T5709] usb 1-1: Warning! Unlikely small volume range (=1), linear volume or custom curve? [ 315.562056][ T5709] usb 1-1: [2] FU [Generic Out Playback Volume] ch = 1, val = 0/1/1 [ 315.647056][ T8593] net_ratelimit: 147 callbacks suppressed [ 315.647075][ T8593] openvswitch: netlink: Mixed IPv4 and IPv6 tunnel attributes [ 316.023921][ T31] audit: type=1400 audit(1789069912.209:903): avc: denied { create } for pid=8603 comm="syz.0.697" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 316.060100][ T31] audit: type=1400 audit(1789069912.239:904): avc: denied { write } for pid=8603 comm="syz.0.697" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 316.063156][ T31] audit: type=1400 audit(1789069912.239:905): avc: denied { module_request } for pid=8603 comm="syz.0.697" kmod=63727970746F2DE4CE28 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 316.065408][ T31] audit: type=1400 audit(1789069912.249:906): avc: denied { read write } for pid=5611 comm="syz-executor" name="loop2" dev="devtmpfs" ino=647 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 316.067307][ T31] audit: type=1400 audit(1789069912.249:907): avc: denied { open } for pid=5611 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=647 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 316.087707][ T31] audit: type=1400 audit(1789069912.249:908): avc: denied { ioctl } for pid=5611 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=647 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 316.241223][ T5709] usb 1-1: USB disconnect, device number 11 [ 317.566316][ T8628] netlink: 32 bytes leftover after parsing attributes in process `syz.1.707'. [ 317.566339][ T8628] netlink: 32 bytes leftover after parsing attributes in process `syz.1.707'. [ 317.679529][ T8633] netlink: ct family unspecified [ 318.268038][ T8648] netlink: 36 bytes leftover after parsing attributes in process `syz.0.712'. [ 318.269177][ T8648] netlink: 36 bytes leftover after parsing attributes in process `syz.0.712'. [ 318.669772][ T8654] usb usb9: usbfs: process 8654 (syz.3.720) did not claim interface 15 before use [ 319.492224][ T31] kauditd_printk_skb: 46 callbacks suppressed [ 319.492242][ T31] audit: type=1400 audit(1789069915.659:955): avc: denied { mmap_zero } for pid=8694 comm="syz.2.739" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 319.492282][ T31] audit: type=1400 audit(1789069915.669:956): avc: denied { write } for pid=8694 comm="syz.2.739" name="mtd0" dev="devtmpfs" ino=702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 319.496048][ T31] audit: type=1400 audit(1789069915.669:957): avc: denied { open } for pid=8694 comm="syz.2.739" path="/dev/mtd0" dev="devtmpfs" ino=702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 319.505745][ T31] audit: type=1400 audit(1789069915.689:958): avc: denied { ioctl } for pid=8694 comm="syz.2.739" path="/dev/mtd0" dev="devtmpfs" ino=702 ioctlcmd=0x4d02 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 319.924883][ T8698] netlink: zone id is out of range [ 319.924923][ T8698] netlink: zone id is out of range [ 319.924943][ T8698] netlink: zone id is out of range [ 319.924963][ T8698] netlink: zone id is out of range [ 319.924982][ T8698] netlink: zone id is out of range [ 319.925001][ T8698] netlink: zone id is out of range [ 319.925036][ T8698] netlink: zone id is out of range [ 319.925065][ T8698] netlink: zone id is out of range [ 320.153723][ T31] audit: type=1400 audit(1789069916.339:959): avc: denied { mounton } for pid=8708 comm="syz.0.744" path="/147/config" dev="tmpfs" ino=845 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 320.153772][ T31] audit: type=1400 audit(1789069916.339:960): avc: denied { mount } for pid=8708 comm="syz.0.744" name="/" dev="configfs" ino=1109 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 320.155348][ T31] audit: type=1400 audit(1789069916.339:961): avc: denied { search } for pid=8708 comm="syz.0.744" name="/" dev="configfs" ino=1109 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 320.155386][ T31] audit: type=1400 audit(1789069916.339:962): avc: denied { search } for pid=8708 comm="syz.0.744" name="usb_gadget" dev="configfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 320.155415][ T31] audit: type=1400 audit(1789069916.339:963): avc: denied { search } for pid=8708 comm="syz.0.744" name="g1" dev="configfs" ino=21649 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 320.155443][ T31] audit: type=1400 audit(1789069916.339:964): avc: denied { write } for pid=8708 comm="syz.0.744" name="UDC" dev="configfs" ino=23308 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 320.221317][ T8713] netlink: 12 bytes leftover after parsing attributes in process `syz.6.746'. [ 320.372130][ T8709] Config c/1 of g1 needs at least one function. [ 320.380954][ T8718] netlink: 28 bytes leftover after parsing attributes in process `syz.2.747'. [ 320.400140][ T8709] udc dummy_udc.0: failed to start g1: -22 [ 320.400171][ T8709] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 320.480181][ T8709] UDC core: g1: couldn't find an available UDC or it's busy [ 320.868732][ T8747] net_ratelimit: 149 callbacks suppressed [ 320.868753][ T8747] openvswitch: netlink: IP tunnel dst address not specified [ 320.912376][ T25] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 321.063597][ T25] usb 3-1: Using ep0 maxpacket: 32 [ 321.064259][ T25] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 321.065360][ T25] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 321.080451][ T5709] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 321.101126][ T25] usb 3-1: config 0 descriptor?? [ 321.246855][ T5709] usb 2-1: Using ep0 maxpacket: 8 [ 321.261473][ T5709] usb 2-1: New USB device found, idVendor=0bc7, idProduct=0008, bcdDevice=4f.c8 [ 321.284275][ T5709] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 321.286238][ T5709] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF9, changing to 0x89 [ 321.286378][ T5709] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has an invalid bInterval 0, changing to 7 [ 321.286510][ T5709] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid maxpacket 59391, setting to 1024 [ 321.286654][ T5709] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 321.286798][ T5709] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 321.292392][ T5603] Bluetooth: hci3: command 0x0406 tx timeout [ 321.292496][ T4920] Bluetooth: hci3: Opcode 0x206a failed: -110 [ 321.316163][ T25] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 321.323250][ T25] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 321.326285][ T25] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 321.326322][ T25] usb 3-1: media controller created [ 321.384264][ T5709] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 321.387832][ T5709] usb 2-1: Product: syz [ 321.388698][ T5709] usb 2-1: Manufacturer: syz [ 321.388966][ T5709] usb 2-1: SerialNumber: syz [ 321.412669][ T25] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 321.563330][ T5709] usb 2-1: config 0 descriptor?? [ 321.566076][ T8744] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 321.686954][ T25] az6027: usb out operation failed. (-71) [ 321.698225][ T25] az6027: usb out operation failed. (-71) [ 321.698239][ T25] stb0899_attach: Driver disabled by Kconfig [ 321.698247][ T25] az6027: no front-end attached [ 321.698247][ T25] [ 321.704859][ T25] az6027: usb out operation failed. (-71) [ 321.704874][ T25] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 321.711773][ T25] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input16 [ 321.717453][ T25] dvb-usb: schedule remote query interval to 400 msecs. [ 321.717470][ T25] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 321.732973][ T25] usb 3-1: USB disconnect, device number 21 [ 321.895862][ T25] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 321.970362][ T8774] macvlan2: entered promiscuous mode [ 321.970384][ T8774] bridge0: entered promiscuous mode [ 322.704014][ T986] usb 7-1: new low-speed USB device number 6 using dummy_hcd [ 322.864970][ T986] usb 7-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 322.866007][ T986] usb 7-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config [ 322.866844][ T986] usb 7-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config [ 322.867672][ T986] usb 7-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config [ 322.870094][ T986] usb 7-1: string descriptor 0 read error: -22 [ 322.870196][ T986] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 322.920262][ T5709] rc_core: IR keymap rc-snapstream-firefly not found [ 322.920279][ T5709] Registered IR keymap rc-empty [ 322.949558][ T5709] rc rc0: syz syz as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 322.960748][ T8821] netlink: 32 bytes leftover after parsing attributes in process `syz.0.796'. [ 322.960809][ T8821] netlink: 32 bytes leftover after parsing attributes in process `syz.0.796'. [ 322.984527][ T986] adutux 7-1:168.0: interrupt endpoints not found [ 322.986270][ T5709] input: syz syz as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input15 [ 323.029326][ T5709] input: syz syz mouse as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input18 [ 323.063728][ T5709] usb 2-1: USB disconnect, device number 11 [ 323.063810][ C0] ati_remote 2-1:0.0: ati_remote_irq_in: usb_submit_urb()=-19 [ 323.108103][ T4956] ati_remote 2-1:0.0: ati_remote_open: usb_submit_urb failed! [ 323.194505][ T5695] usb 7-1: USB disconnect, device number 6 [ 323.262070][ T5694] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 323.412071][ T5694] usb 1-1: Using ep0 maxpacket: 16 [ 323.412719][ T5694] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 0.00 [ 323.413855][ T5694] usb 1-1: config 254 has an invalid interface number: 235 but max is 0 [ 323.413871][ T5694] usb 1-1: config 254 has an invalid descriptor of length 0, skipping remainder of the config [ 323.413882][ T5694] usb 1-1: config 254 has no interface number 0 [ 323.413900][ T5694] usb 1-1: config 254 interface 235 altsetting 2 has an endpoint descriptor with address 0xDA, changing to 0x8A [ 323.413914][ T5694] usb 1-1: config 254 interface 235 altsetting 2 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 323.413928][ T5694] usb 1-1: config 254 interface 235 altsetting 2 endpoint 0x8A has invalid wMaxPacketSize 0 [ 323.413940][ T5694] usb 1-1: config 254 interface 235 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 323.413954][ T5694] usb 1-1: config 254 interface 235 has no altsetting 0 [ 323.415522][ T5694] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 323.415543][ T5694] usb 1-1: Product: syz [ 323.415554][ T5694] usb 1-1: Manufacturer: syz [ 323.415573][ T5694] usb 1-1: SerialNumber: syz [ 323.475567][ T5709] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 323.519530][ T8825] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 323.639499][ T5694] usbtest 1-1:254.235: Linux gadget zero [ 323.639519][ T5694] usbtest 1-1:254.235: high-speed {control in/out iso-in} tests (+alt) [ 323.655829][ T5709] usb 2-1: New USB device found, idVendor=1d34, idProduct=000a, bcdDevice= 0.00 [ 323.657976][ T5709] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 323.658004][ T5709] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 323.658044][ T5709] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 323.703757][ T5709] usb 2-1: config 0 descriptor?? [ 323.886927][ T25] usb 1-1: USB disconnect, device number 12 [ 324.292334][ T5694] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 324.418982][ T5709] hid-led 0003:1D34:000A.000B: probe with driver hid-led failed with error -71 [ 324.421391][ T5709] usb 2-1: USB disconnect, device number 12 [ 324.474013][ T5694] usb 3-1: New USB device found, idVendor=0a99, idProduct=0001, bcdDevice= 0.00 [ 324.474922][ T5694] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 324.474950][ T5694] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 324.477857][ T5694] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 324.477878][ T5694] usb 3-1: Product: syz [ 324.477892][ T5694] usb 3-1: Manufacturer: syz [ 324.513223][ T31] kauditd_printk_skb: 93 callbacks suppressed [ 324.513240][ T31] audit: type=1400 audit(1789069920.699:1058): avc: denied { write } for pid=8847 comm="syz.0.808" path="/dev/vhci" dev="devtmpfs" ino=1267 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 324.579860][ T5694] navman 3-1:1.0: navman converter detected [ 324.602505][ T5694] usb 3-1: navman converter now attached to ttyUSB0 [ 324.637274][ T5603] Bluetooth: hci4: unexpected event for opcode 0x203c [ 324.690724][ T31] audit: type=1400 audit(1789069920.869:1059): avc: denied { read write } for pid=8853 comm="syz.6.811" name="rdma_cm" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 324.690965][ T31] audit: type=1400 audit(1789069920.869:1060): avc: denied { open } for pid=8853 comm="syz.6.811" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 324.787401][ T8845] navman ttyUSB0: navman_open - failed submitting interrupt urb, error -90 [ 324.788591][ T5694] usb 3-1: USB disconnect, device number 22 [ 324.801590][ T5694] navman ttyUSB0: navman converter now disconnected from ttyUSB0 [ 324.802079][ T5694] navman 3-1:1.0: device disconnected [ 324.943291][ T31] audit: type=1400 audit(1789069921.129:1061): avc: denied { create } for pid=8859 comm="syz.3.814" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 324.945742][ T31] audit: type=1400 audit(1789069921.129:1062): avc: denied { connect } for pid=8859 comm="syz.3.814" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 324.946362][ T31] audit: type=1400 audit(1789069921.129:1063): avc: denied { prog_load } for pid=8859 comm="syz.3.814" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 324.946770][ T31] audit: type=1400 audit(1789069921.129:1064): avc: denied { bpf } for pid=8859 comm="syz.3.814" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 324.948750][ T31] audit: type=1400 audit(1789069921.129:1065): avc: denied { perfmon } for pid=8859 comm="syz.3.814" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 324.949938][ T31] audit: type=1400 audit(1789069921.129:1066): avc: denied { prog_run } for pid=8859 comm="syz.3.814" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 325.273856][ T8870] netlink: 16 bytes leftover after parsing attributes in process `syz.0.817'. [ 325.362805][ T31] audit: type=1400 audit(1789069921.539:1067): avc: denied { execute } for pid=8872 comm="syz.6.820" name="file2" dev="tmpfs" ino=557 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 325.830047][ T8899] vlan2: entered promiscuous mode [ 326.124755][ T8899] netlink: zone id is out of range [ 326.124794][ T8899] netlink: zone id is out of range [ 326.124814][ T8899] netlink: zone id is out of range [ 326.124835][ T8899] netlink: zone id is out of range [ 326.124853][ T8899] netlink: zone id is out of range [ 326.124873][ T8899] netlink: zone id is out of range [ 326.124908][ T8899] netlink: zone id is out of range [ 326.124928][ T8899] netlink: zone id is out of range [ 326.124951][ T8899] netlink: zone id is out of range [ 326.124970][ T8899] netlink: zone id is out of range [ 326.981843][ T5709] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 327.041826][ T5694] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 327.142720][ T5709] usb 4-1: Using ep0 maxpacket: 32 [ 327.143386][ T5709] usb 4-1: New USB device found, idVendor=0fc5, idProduct=b080, bcdDevice= 0.00 [ 327.144411][ T5709] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 327.144443][ T5709] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 327.144466][ T5709] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 327.144493][ T5709] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 327.149797][ T5709] usb 4-1: config 0 descriptor?? [ 327.232251][ T5694] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 327.233090][ T5694] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 327.233117][ T5694] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 327.233136][ T5694] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 327.233170][ T5694] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 327.238557][ T5694] usb 7-1: config 0 descriptor?? [ 327.353967][ T5695] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 327.504188][ T5694] usbhid 7-1:0.0: can't add hid device: -71 [ 327.504646][ T5694] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 327.532903][ T8954] ceph: No mds server is up or the cluster is laggy [ 327.548745][ T5695] usb 1-1: New USB device found, idVendor=046d, idProduct=c222, bcdDevice= 0.00 [ 327.579140][ T25] libceph: connect (1)[c::]:6789 error -101 [ 327.579798][ T25] libceph: mon0 (1)[c::]:6789 connect error [ 327.598087][ T5695] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 327.598122][ T5695] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 327.598217][ T5695] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 327.719459][ T5694] usb 7-1: USB disconnect, device number 7 [ 328.264691][ T5709] hid-led 0003:0FC5:B080.000C: unknown main item tag 0x1 [ 328.264723][ T5709] hid-led 0003:0FC5:B080.000C: unknown main item tag 0x0 [ 328.264742][ T5709] hid-led 0003:0FC5:B080.000C: unknown main item tag 0x4 [ 328.348522][ T5695] lg-g15 0003:046D:C222.000D: hidraw0: USB HID v1.11 Device [HID 046d:c222] on usb-dummy_hcd.0-1/input0 [ 328.402740][ T5695] lg-g15 0003:046D:C222.000D: Error -90 disabling keyboard emulation for the G-keys, falling back to generic hid-input driver [ 328.502039][ T5695] usb 4-1: USB disconnect, device number 17 [ 328.518753][ T986] usb 1-1: USB disconnect, device number 13 [ 329.124870][ T8981] netlink: 24 bytes leftover after parsing attributes in process `syz.3.860'. [ 329.124895][ T8981] netlink: 'syz.3.860': attribute type 3 has an invalid length. [ 329.503594][ T986] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 329.581867][ T9007] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 329.598551][ T5695] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 329.630228][ T9009] lpc_ich 0000:00:00.0: I/O space for ACPI uninitialized [ 329.630252][ T9009] lpc_ich 0000:00:00.0: I/O space for ACPI uninitialized [ 329.630268][ T9009] lpc_ich 0000:00:00.0: I/O space for GPIO uninitialized [ 329.630275][ T9009] lpc_ich 0000:00:00.0: No MFD cells added [ 329.630573][ T9009] lpc_ich 0000:00:01.0: I/O space for ACPI uninitialized [ 329.630590][ T9009] lpc_ich 0000:00:01.0: I/O space for ACPI uninitialized [ 329.630606][ T9009] lpc_ich 0000:00:01.0: I/O space for GPIO uninitialized [ 329.630613][ T9009] lpc_ich 0000:00:01.0: No MFD cells added [ 329.630786][ T9009] lpc_ich 0000:00:01.3: RCBA is disabled by hardware/BIOS, device disabled [ 329.630840][ T9009] lpc_ich 0000:00:01.3: I/O space for GPIO uninitialized [ 329.630847][ T9009] lpc_ich 0000:00:01.3: No MFD cells added [ 329.662789][ T986] usb 4-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 329.663601][ T986] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 329.663632][ T986] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 329.663650][ T986] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 329.663670][ T986] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 329.663700][ T986] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 329.703360][ T5709] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 329.754522][ T9009] lpc_ich 0000:00:05.0: I/O space for ACPI uninitialized [ 329.754553][ T9009] lpc_ich 0000:00:05.0: I/O space for ACPI uninitialized [ 329.754576][ T9009] lpc_ich 0000:00:05.0: I/O space for GPIO uninitialized [ 329.754588][ T9009] lpc_ich 0000:00:05.0: No MFD cells added [ 329.762117][ T5695] usb 2-1: Using ep0 maxpacket: 32 [ 329.771114][ T5695] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 329.793681][ T5695] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 329.835174][ T5695] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 329.835200][ T5695] usb 2-1: Product: syz [ 329.835215][ T5695] usb 2-1: Manufacturer: syz [ 329.835228][ T5695] usb 2-1: SerialNumber: syz [ 329.839352][ T5695] usb 2-1: config 0 descriptor?? [ 329.839968][ T8995] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 329.840961][ T5695] hub 2-1:0.0: bad descriptor, ignoring hub [ 329.840982][ T5695] hub 2-1:0.0: probe with driver hub failed with error -5 [ 329.861804][ T5709] usb 1-1: Using ep0 maxpacket: 8 [ 329.863276][ T5709] usb 1-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 329.864616][ T5709] usb 1-1: config 179 has an invalid interface number: 65 but max is 0 [ 329.864635][ T5709] usb 1-1: config 179 has no interface number 0 [ 329.864668][ T5709] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 329.864689][ T5709] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 329.864709][ T5709] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 329.864745][ T5709] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 329.864764][ T5709] usb 1-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 329.864794][ T5709] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 329.869590][ T8999] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 330.121627][ T5717] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 330.147255][ T5709] input: Generic X-Box pad as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:179.65/input/input21 [ 330.272556][ T5717] usb 7-1: Using ep0 maxpacket: 16 [ 330.273168][ T5717] usb 7-1: New USB device found, idVendor=0b05, idProduct=18c6, bcdDevice= 0.00 [ 330.274316][ T5717] usb 7-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 330.274342][ T5717] usb 7-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 330.274366][ T5717] usb 7-1: config 0 interface 0 has no altsetting 0 [ 330.274393][ T5717] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 330.339065][ T5717] usb 7-1: config 0 descriptor?? [ 330.339198][ T5709] usb 2-1: USB disconnect, device number 13 [ 330.371131][ T31] kauditd_printk_skb: 47 callbacks suppressed [ 330.371215][ T31] audit: type=1400 audit(1789069926.549:1115): avc: denied { read } for pid=8998 comm="syz.0.868" name="event4" dev="devtmpfs" ino=3419 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 330.371254][ T31] audit: type=1400 audit(1789069926.549:1116): avc: denied { open } for pid=8998 comm="syz.0.868" path="/dev/input/event4" dev="devtmpfs" ino=3419 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 330.378120][ T31] audit: type=1400 audit(1789069926.559:1117): avc: denied { ioctl } for pid=8998 comm="syz.0.868" path="/dev/input/event4" dev="devtmpfs" ino=3419 ioctlcmd=0x4580 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 330.439036][ C0] xpad 1-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 330.439074][ C0] xpad 1-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 330.439328][ T4932] usb 1-1: USB disconnect, device number 14 [ 330.475426][ T9018] netlink: 8 bytes leftover after parsing attributes in process `syz.2.876'. [ 330.577467][ T31] audit: type=1400 audit(1789069926.759:1118): avc: denied { read } for pid=9021 comm="syz.2.878" name="binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 330.580195][ T31] audit: type=1400 audit(1789069926.759:1119): avc: denied { open } for pid=9021 comm="syz.2.878" path="/dev/binderfs/binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 330.581400][ T31] audit: type=1400 audit(1789069926.759:1120): avc: denied { ioctl } for pid=9021 comm="syz.2.878" path="/dev/binderfs/binder0" dev="binder" ino=10 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 330.604087][ T31] audit: type=1400 audit(1789069926.769:1121): avc: denied { set_context_mgr } for pid=9021 comm="syz.2.878" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 330.616415][ T9022] binder: BINDER_SET_CONTEXT_MGR already set [ 330.616425][ T9022] binder: 9021:9022 ioctl 4018620d 200000001000 returned -16 [ 330.690432][ T31] audit: type=1400 audit(1789069926.879:1122): avc: denied { create } for pid=9023 comm="syz.2.879" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 330.702843][ T31] audit: type=1400 audit(1789069926.879:1123): avc: denied { write } for pid=9023 comm="syz.2.879" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 330.703795][ T31] audit: type=1400 audit(1789069926.879:1124): avc: denied { connect } for pid=9023 comm="syz.2.879" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 330.792501][ T5717] usbhid 7-1:0.0: can't add hid device: -71 [ 330.792583][ T5717] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 330.793187][ T986] [drm] Initialized gud 1.0.0 for 4-1:1.0 on minor 1 [ 330.827998][ T5717] usb 7-1: USB disconnect, device number 8 [ 330.852431][ T5709] usb 2-1: new full-speed USB device number 14 using dummy_hcd [ 330.952939][ T986] ================================================================== [ 330.952951][ T986] BUG: KASAN: use-after-free in fbcon_prepare_logo+0x94e/0xc60 [ 330.952972][ T986] Read of size 256 at addr ffff888088690760 by task kworker/0:2/986 [ 330.952984][ T986] [ 330.952990][ T986] CPU: 0 UID: 0 PID: 986 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full) [ 330.953002][ T986] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 330.953010][ T986] Workqueue: usb_hub_wq hub_event [ 330.953025][ T986] Call Trace: [ 330.953030][ T986] [ 330.953035][ T986] dump_stack_lvl+0x100/0x190 [ 330.953052][ T986] print_report+0x13d/0x4b0 [ 330.953068][ T986] ? __virt_addr_valid+0x239/0x430 [ 330.953083][ T986] ? fbcon_prepare_logo+0x94e/0xc60 [ 330.953104][ T986] kasan_report+0xdf/0x1c0 [ 330.953128][ T986] ? fbcon_prepare_logo+0x94e/0xc60 [ 330.953150][ T986] kasan_check_range+0x10f/0x1e0 [ 330.953165][ T986] __asan_memcpy+0x23/0x60 [ 330.953175][ T986] fbcon_prepare_logo+0x94e/0xc60 [ 330.953192][ T986] fbcon_init+0x1065/0x1830 [ 330.953207][ T986] visual_init+0x320/0x620 [ 330.953223][ T986] do_bind_con_driver.isra.0+0x636/0x9c0 [ 330.953236][ T986] do_take_over_console+0x501/0x5d0 [ 330.953247][ T986] do_fbcon_takeover+0xe9/0x210 [ 330.953260][ T986] fbcon_fb_registered+0x364/0x4b0 [ 330.953276][ T986] do_register_framebuffer+0x503/0x870 [ 330.953289][ T986] ? __pfx_do_register_framebuffer+0x10/0x10 [ 330.953310][ T986] ? find_held_lock+0x2b/0x80 [ 330.953330][ T986] register_framebuffer+0x23/0x40 [ 330.953351][ T986] __drm_fb_helper_initial_config_and_unlock+0xf3b/0x17f0 [ 330.953380][ T986] ? __pfx___drm_fb_helper_initial_config_and_unlock+0x10/0x10 [ 330.953405][ T986] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 330.953431][ T986] drm_fb_helper_initial_config+0x44/0x60 [ 330.953445][ T986] drm_fbdev_client_hotplug+0x19e/0x220 [ 330.953457][ T986] ? __pfx_drm_fbdev_client_hotplug+0x10/0x10 [ 330.953469][ T986] drm_client_register+0x197/0x280 [ 330.953489][ T986] drm_fbdev_client_setup+0x155/0x480 [ 330.953501][ T986] drm_client_setup+0x160/0x1a0 [ 330.953512][ T986] gud_probe+0x186c/0x1c60 [ 330.953529][ T986] ? __pfx_gud_probe+0x10/0x10 [ 330.953542][ T986] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 330.953555][ T986] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 330.953568][ T986] ? __pm_runtime_set_status+0x13c/0x970 [ 330.953585][ T986] usb_probe_interface+0x386/0x9b0 [ 330.953602][ T986] ? __pfx_usb_probe_interface+0x10/0x10 [ 330.953617][ T986] ? kernfs_put+0x3f/0x60 [ 330.953633][ T986] ? sysfs_create_link+0x68/0xc0 [ 330.953647][ T986] ? __pfx_usb_probe_interface+0x10/0x10 [ 330.953662][ T986] really_probe+0x241/0xa60 [ 330.953675][ T986] __driver_probe_device+0x210/0x460 [ 330.953686][ T986] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 330.953699][ T986] driver_probe_device+0x4a/0x140 [ 330.953710][ T986] __device_attach_driver+0x1df/0x320 [ 330.953722][ T986] ? __pfx___device_attach_driver+0x10/0x10 [ 330.953734][ T986] bus_for_each_drv+0x159/0x1e0 [ 330.953750][ T986] ? __pfx_bus_for_each_drv+0x10/0x10 [ 330.953765][ T986] ? lockdep_hardirqs_on+0x7d/0x110 [ 330.953778][ T986] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 330.953792][ T986] __device_attach+0x1e4/0x4d0 [ 330.953803][ T986] ? __pfx___device_attach+0x10/0x10 [ 330.953815][ T986] ? do_raw_spin_unlock+0x145/0x1e0 [ 330.953829][ T986] device_initial_probe+0xaf/0xd0 [ 330.953842][ T986] bus_probe_device+0x64/0x160 [ 330.953852][ T986] device_add+0x121d/0x1970 [ 330.953866][ T986] ? __pfx_device_add+0x10/0x10 [ 330.953879][ T986] ? mark_held_locks+0x40/0x70 [ 330.953889][ T986] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 330.953906][ T986] usb_set_configuration+0xd97/0x1c60 [ 330.953924][ T986] ? __pfx_usb_generic_driver_probe+0x10/0x10 [ 330.953935][ T986] usb_generic_driver_probe+0xa1/0xe0 [ 330.953946][ T986] usb_probe_device+0xef/0x400 [ 330.953960][ T986] ? __pfx_usb_probe_device+0x10/0x10 [ 330.953974][ T986] really_probe+0x241/0xa60 [ 330.953987][ T986] __driver_probe_device+0x210/0x460 [ 330.953999][ T986] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 330.954011][ T986] driver_probe_device+0x4a/0x140 [ 330.954023][ T986] __device_attach_driver+0x1df/0x320 [ 330.954035][ T986] ? __pfx___device_attach_driver+0x10/0x10 [ 330.954046][ T986] bus_for_each_drv+0x159/0x1e0 [ 330.954062][ T986] ? __pfx_bus_for_each_drv+0x10/0x10 [ 330.954077][ T986] ? lockdep_hardirqs_on+0x7d/0x110 [ 330.954090][ T986] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 330.954103][ T986] __device_attach+0x1e4/0x4d0 [ 330.954117][ T986] ? __pfx___device_attach+0x10/0x10 [ 330.954129][ T986] ? do_raw_spin_unlock+0x145/0x1e0 [ 330.954144][ T986] device_initial_probe+0xaf/0xd0 [ 330.954157][ T986] bus_probe_device+0x64/0x160 [ 330.954167][ T986] device_add+0x121d/0x1970 [ 330.954183][ T986] ? __pfx_device_add+0x10/0x10 [ 330.954202][ T986] ? usb_detect_static_quirks+0x335/0x3e0 [ 330.954225][ T986] usb_new_device.part.0+0xcc2/0x1686 [ 330.954251][ T986] ? do_raw_spin_lock+0x128/0x260 [ 330.954264][ T986] ? __pfx_usb_new_device.part.0+0x10/0x10 [ 330.954280][ T986] ? mark_held_locks+0x40/0x70 [ 330.954292][ T986] hub_event.cold+0x1e3/0xe90 [ 330.954313][ T986] ? __pfx_hub_event+0x10/0x10 [ 330.954326][ T986] ? check_irq_usage+0x570/0x8b0 [ 330.954338][ T986] ? lock_acquire+0x1d1/0x380 [ 330.954348][ T986] ? process_one_work+0xa2c/0x1b10 [ 330.954365][ T986] ? process_one_work+0x906/0x1b10 [ 330.954381][ T986] ? process_one_work+0x906/0x1b10 [ 330.954397][ T986] process_one_work+0xac7/0x1b10 [ 330.954416][ T986] ? __pfx_process_one_work+0x10/0x10 [ 330.954433][ T986] ? lock_acquire+0x1d1/0x380 [ 330.954445][ T986] ? __pfx_hub_event+0x10/0x10 [ 330.954461][ T986] worker_thread+0x5ef/0xe50 [ 330.954485][ T986] ? __pfx_worker_thread+0x10/0x10 [ 330.954501][ T986] ? kthread+0x13a/0x450 [ 330.954515][ T986] ? __pfx_worker_thread+0x10/0x10 [ 330.954531][ T986] kthread+0x373/0x450 [ 330.954545][ T986] ? __pfx_kthread+0x10/0x10 [ 330.954560][ T986] ret_from_fork+0x730/0xd60 [ 330.954572][ T986] ? __pfx_ret_from_fork+0x10/0x10 [ 330.954584][ T986] ? __switch_to+0x800/0x10f0 [ 330.954599][ T986] ? __pfx_kthread+0x10/0x10 [ 330.954614][ T986] ret_from_fork_asm+0x1a/0x30 [ 330.954629][ T986] [ 330.954633][ T986] [ 330.954636][ T986] The buggy address belongs to the physical page: [ 330.954643][ T986] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x28c pfn:0x88690 [ 330.954653][ T986] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 330.954667][ T986] raw: 00fff00000000000 ffffea000221a448 ffffea000221b7c8 0000000000000000 [ 330.954676][ T986] raw: 000000000000028c 0000000000000000 00000000ffffffff 0000000000000000 [ 330.954682][ T986] page dumped because: kasan: bad access detected [ 330.954688][ T986] page_owner tracks the page as freed [ 330.954691][ T986] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x140cc2(GFP_HIGHUSER|__GFP_COMP), pid 9012, tgid 9011 (syz.2.874), ts 329949156055 [ 330.954707][ T986] post_alloc_hook+0xfd/0x120 [ 330.954723][ T986] get_page_from_freelist+0x110d/0x35d0 [ 330.954739][ T986] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 330.954755][ T986] alloc_pages_mpol+0x201/0x550 [ 330.954768][ T986] folio_alloc_noprof+0x22/0x250 [ 330.954782][ T986] filemap_alloc_folio_noprof.part.0+0x3db/0x440 [ 330.954793][ T986] __filemap_get_folio_mpol+0x653/0x1320 [ 330.954807][ T986] kvm_gmem_get_folio+0xec/0x2a0 [ 330.954818][ T986] kvm_gmem_fault_user_mapping+0x151/0x6e0 [ 330.954829][ T986] __do_fault+0x10b/0x440 [ 330.954839][ T986] do_fault+0xb3f/0x1830 [ 330.954850][ T986] __handle_mm_fault+0x150b/0x2f60 [ 330.954864][ T986] handle_mm_fault+0x363/0xa20 [ 330.954877][ T986] __get_user_pages+0x8ae/0x2c30 [ 330.954888][ T986] populate_vma_page_range+0x267/0x3f0 [ 330.954900][ T986] __mm_populate+0x107/0x3a0 [ 330.954911][ T986] page last free pid 9015 tgid 9011 ts 330235032757 stack trace: [ 330.954918][ T986] free_unref_folios+0xa4a/0x1790 [ 330.954933][ T986] folios_put_refs+0x585/0xaa0 [ 330.954946][ T986] truncate_inode_pages_range+0x30c/0x1050 [ 330.954962][ T986] evict+0x8dc/0xad0 [ 330.954976][ T986] iput.part.0+0x989/0x1050 [ 330.954992][ T986] iput+0x35/0x40 [ 330.955006][ T986] dentry_unlink_inode+0x284/0x470 [ 330.955020][ T986] dentry_kill+0x25d/0xc20 [ 330.955035][ T986] dput.part.0+0xd7/0x240 [ 330.955050][ T986] dput+0x1f/0x30 [ 330.955064][ T986] __fput+0x519/0xb50 [ 330.955075][ T986] task_work_run+0x150/0x240 [ 330.955090][ T986] do_exit+0x951/0x2ae0 [ 330.955101][ T986] do_group_exit+0xd5/0x2a0 [ 330.955114][ T986] get_signal+0x1ec7/0x21e0 [ 330.955124][ T986] arch_do_signal_or_restart+0x91/0x7e0 [ 330.955139][ T986] [ 330.955141][ T986] Memory state around the buggy address: [ 330.955147][ T986] ffff888088690600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 330.955154][ T986] ffff888088690680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 330.955161][ T986] >ffff888088690700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 330.955166][ T986] ^ [ 330.955172][ T986] ffff888088690780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 330.955179][ T986] ffff888088690800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 330.955184][ T986] ================================================================== [ 330.955201][ T986] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 331.855370][ T986] CPU: 0 UID: 0 PID: 986 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full) [ 331.864633][ T986] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 331.874674][ T986] Workqueue: usb_hub_wq hub_event [ 331.879694][ T986] Call Trace: [ 331.882963][ T986] [ 331.885877][ T986] dump_stack_lvl+0x100/0x190 [ 331.890544][ T986] vpanic+0x553/0x970 [ 331.894528][ T986] ? __pfx_vpanic+0x10/0x10 [ 331.899014][ T986] ? mark_held_locks+0x40/0x70 [ 331.903761][ T986] ? irqentry_exit+0x24d/0xa10 [ 331.908515][ T986] ? fbcon_prepare_logo+0x94e/0xc60 [ 331.913726][ T986] panic+0xd1/0xe0 [ 331.917434][ T986] ? __pfx_panic+0x10/0x10 [ 331.921842][ T986] ? fbcon_prepare_logo+0x94e/0xc60 [ 331.927034][ T986] ? preempt_schedule_common+0x3c/0xb0 [ 331.932513][ T986] check_panic_on_warn.cold+0x19/0x34 [ 331.937868][ T986] end_report.part.0+0x3a/0x90 [ 331.942621][ T986] kasan_report.cold+0xe/0x18 [ 331.947293][ T986] ? fbcon_prepare_logo+0x94e/0xc60 [ 331.952492][ T986] kasan_check_range+0x10f/0x1e0 [ 331.957418][ T986] __asan_memcpy+0x23/0x60 [ 331.961828][ T986] fbcon_prepare_logo+0x94e/0xc60 [ 331.966845][ T986] fbcon_init+0x1065/0x1830 [ 331.971340][ T986] visual_init+0x320/0x620 [ 331.975753][ T986] do_bind_con_driver.isra.0+0x636/0x9c0 [ 331.981369][ T986] do_take_over_console+0x501/0x5d0 [ 331.986550][ T986] do_fbcon_takeover+0xe9/0x210 [ 331.991388][ T986] fbcon_fb_registered+0x364/0x4b0 [ 331.996489][ T986] do_register_framebuffer+0x503/0x870 [ 332.001932][ T986] ? __pfx_do_register_framebuffer+0x10/0x10 [ 332.007898][ T986] ? find_held_lock+0x2b/0x80 [ 332.012574][ T986] register_framebuffer+0x23/0x40 [ 332.017595][ T986] __drm_fb_helper_initial_config_and_unlock+0xf3b/0x17f0 [ 332.024796][ T986] ? __pfx___drm_fb_helper_initial_config_and_unlock+0x10/0x10 [ 332.032342][ T986] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 332.038314][ T986] drm_fb_helper_initial_config+0x44/0x60 [ 332.044025][ T986] drm_fbdev_client_hotplug+0x19e/0x220 [ 332.049555][ T986] ? __pfx_drm_fbdev_client_hotplug+0x10/0x10 [ 332.055604][ T986] drm_client_register+0x197/0x280 [ 332.060704][ T986] drm_fbdev_client_setup+0x155/0x480 [ 332.066082][ T986] drm_client_setup+0x160/0x1a0 [ 332.070917][ T986] gud_probe+0x186c/0x1c60 [ 332.075321][ T986] ? __pfx_gud_probe+0x10/0x10 [ 332.080082][ T986] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 332.085876][ T986] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 332.091671][ T986] ? __pm_runtime_set_status+0x13c/0x970 [ 332.097324][ T986] usb_probe_interface+0x386/0x9b0 [ 332.102455][ T986] ? __pfx_usb_probe_interface+0x10/0x10 [ 332.108096][ T986] ? kernfs_put+0x3f/0x60 [ 332.112425][ T986] ? sysfs_create_link+0x68/0xc0 [ 332.117349][ T986] ? __pfx_usb_probe_interface+0x10/0x10 [ 332.122976][ T986] really_probe+0x241/0xa60 [ 332.127488][ T986] __driver_probe_device+0x210/0x460 [ 332.132755][ T986] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 332.138548][ T986] driver_probe_device+0x4a/0x140 [ 332.143560][ T986] __device_attach_driver+0x1df/0x320 [ 332.148915][ T986] ? __pfx___device_attach_driver+0x10/0x10 [ 332.154790][ T986] bus_for_each_drv+0x159/0x1e0 [ 332.159642][ T986] ? __pfx_bus_for_each_drv+0x10/0x10 [ 332.165006][ T986] ? lockdep_hardirqs_on+0x7d/0x110 [ 332.170192][ T986] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 332.175981][ T986] __device_attach+0x1e4/0x4d0 [ 332.180737][ T986] ? __pfx___device_attach+0x10/0x10 [ 332.186043][ T986] ? do_raw_spin_unlock+0x145/0x1e0 [ 332.191245][ T986] device_initial_probe+0xaf/0xd0 [ 332.196264][ T986] bus_probe_device+0x64/0x160 [ 332.201010][ T986] device_add+0x121d/0x1970 [ 332.205499][ T986] ? __pfx_device_add+0x10/0x10 [ 332.210340][ T986] ? mark_held_locks+0x40/0x70 [ 332.215085][ T986] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 332.220884][ T986] usb_set_configuration+0xd97/0x1c60 [ 332.226258][ T986] ? __pfx_usb_generic_driver_probe+0x10/0x10 [ 332.232333][ T986] usb_generic_driver_probe+0xa1/0xe0 [ 332.237703][ T986] usb_probe_device+0xef/0x400 [ 332.242466][ T986] ? __pfx_usb_probe_device+0x10/0x10 [ 332.247823][ T986] really_probe+0x241/0xa60 [ 332.252312][ T986] __driver_probe_device+0x210/0x460 [ 332.257586][ T986] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 332.263390][ T986] driver_probe_device+0x4a/0x140 [ 332.268427][ T986] __device_attach_driver+0x1df/0x320 [ 332.273803][ T986] ? __pfx___device_attach_driver+0x10/0x10 [ 332.279682][ T986] bus_for_each_drv+0x159/0x1e0 [ 332.284531][ T986] ? __pfx_bus_for_each_drv+0x10/0x10 [ 332.289923][ T986] ? lockdep_hardirqs_on+0x7d/0x110 [ 332.295139][ T986] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 332.300950][ T986] __device_attach+0x1e4/0x4d0 [ 332.305702][ T986] ? __pfx___device_attach+0x10/0x10 [ 332.310969][ T986] ? do_raw_spin_unlock+0x145/0x1e0 [ 332.316156][ T986] device_initial_probe+0xaf/0xd0 [ 332.321168][ T986] bus_probe_device+0x64/0x160 [ 332.325917][ T986] device_add+0x121d/0x1970 [ 332.330410][ T986] ? __pfx_device_add+0x10/0x10 [ 332.335244][ T986] ? usb_detect_static_quirks+0x335/0x3e0 [ 332.340953][ T986] usb_new_device.part.0+0xcc2/0x1686 [ 332.346317][ T986] ? do_raw_spin_lock+0x128/0x260 [ 332.351326][ T986] ? __pfx_usb_new_device.part.0+0x10/0x10 [ 332.357118][ T986] ? mark_held_locks+0x40/0x70 [ 332.361863][ T986] hub_event.cold+0x1e3/0xe90 [ 332.366537][ T986] ? __pfx_hub_event+0x10/0x10 [ 332.371287][ T986] ? check_irq_usage+0x570/0x8b0 [ 332.376208][ T986] ? lock_acquire+0x1d1/0x380 [ 332.380869][ T986] ? process_one_work+0xa2c/0x1b10 [ 332.385967][ T986] ? process_one_work+0x906/0x1b10 [ 332.391063][ T986] ? process_one_work+0x906/0x1b10 [ 332.396162][ T986] process_one_work+0xac7/0x1b10 [ 332.401089][ T986] ? __pfx_process_one_work+0x10/0x10 [ 332.406450][ T986] ? lock_acquire+0x1d1/0x380 [ 332.411109][ T986] ? __pfx_hub_event+0x10/0x10 [ 332.415859][ T986] worker_thread+0x5ef/0xe50 [ 332.420439][ T986] ? __pfx_worker_thread+0x10/0x10 [ 332.425538][ T986] ? kthread+0x13a/0x450 [ 332.429776][ T986] ? __pfx_worker_thread+0x10/0x10 [ 332.434878][ T986] kthread+0x373/0x450 [ 332.438937][ T986] ? __pfx_kthread+0x10/0x10 [ 332.443527][ T986] ret_from_fork+0x730/0xd60 [ 332.448107][ T986] ? __pfx_ret_from_fork+0x10/0x10 [ 332.453201][ T986] ? __switch_to+0x800/0x10f0 [ 332.457876][ T986] ? __pfx_kthread+0x10/0x10 [ 332.462452][ T986] ret_from_fork_asm+0x1a/0x30 [ 332.467215][ T986] [ 332.470319][ T986] Kernel Offset: disabled [ 332.474626][ T986] Rebooting in 86400 seconds..