last executing test programs: 10.746370082s ago: executing program 2 (id=87): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0x8, &(0x7f0000000380)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r0}, {}, {0x85, 0x0, 0x0, 0x1b}}]}, &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 10.663053274s ago: executing program 2 (id=88): pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0) pipe2$9p(&(0x7f0000000040)={0x0, 0x0}, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000240), 0x400000, 0x0) syz_usb_connect$cdc_ncm(0x4, 0x6e, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000020000002505a1a440000102030109025c0002010000000904000001a3f45747d649f9a30105240000000d240f8100000000000000000006241a0000000905810300000000000904010000020d00000904010102020d000009058202000000000009050302"], 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000300)=ANY=[@ANYBLOB="12010c001ddf8208c007121522300000000109021b0001000000010904010001faf48d00090582"], 0x0) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r3, &(0x7f0000000340)="92", 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x14f) mount$9p_fd(0x0, &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000100), 0x0, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}}) write$P9_RVERSION(r1, &(0x7f0000000180)={0xb, 0x65, 0xffff, 0x2000, 0x8, '9P2000.L'}, 0x15) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f00000001c0)={0x0, 0x7}, 0x4) setsockopt$packet_int(r4, 0x107, 0x16, &(0x7f0000000200)=0x4, 0x4) 7.27922584s ago: executing program 0 (id=98): syz_open_dev$mtd(&(0x7f0000000440), 0x0, 0x2) 7.190509103s ago: executing program 2 (id=99): syz_emit_ethernet(0x46, &(0x7f00000001c0)=ANY=[@ANYBLOB="ffffffffffffbbbbbbbbbbbb86dd60120008103afffe8000000000000000000000000000bbff02000000000000000000000000000186009078010002000000a9788acdd80fac289ac4e828bf871500000000000000", @ANYRESHEX], 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl(r0, 0x40186f40, &(0x7f00000000c0)) ioctl$FBIOGET_FSCREENINFO(r0, 0x4602, &(0x7f0000000140)) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="040e04f74120"], 0x7) 7.087326428s ago: executing program 0 (id=100): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201fb0009030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(0xffffffffffffffff, 0x0, 0x0) ioctl$EVIOCGLED(0xffffffffffffffff, 0x80404519, &(0x7f0000000ec0)=""/213) read$char_usb(r1, &(0x7f0000000100)=""/231, 0xe7) syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000200)=""/186, 0x110) syz_usb_disconnect(0xffffffffffffffff) syz_usb_disconnect(0xffffffffffffffff) syz_open_dev$evdev(&(0x7f0000000300), 0x3e, 0x208604) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$uac2(0x5, 0xd8, &(0x7f00000010c0)=ANY=[@ANYBLOB="c4ea5d4600000008630712204000010203010902c600030117b001080b0100017f20c009040000000101200009240106000615000b052404020207240c070602000904010000010220000904010101010220000c240202050005002eac90b4092402010406feff060a240202010006020e00092402010608060884082402010404040406240201010f090501090002080f020838010063f002000904020000010220000904020101010220000b24020102010308737ebf06240201010a0a24020202008100ffdc090582090800050707082501033f4e0200c90bca010fd15cbd55628114307ea7783185d403f5297bc6d275c49a42d95370178f1e681e66bab16ec4c18ee1df2517dcb7f8536acc6cf6b49fa570479964ab8347a125579342185b01e175f74367a7cc70d50ab942bcbb361deb0e5ad0f76418a603711d1b4343b74a6f17b11b7c4886513a1747f09864f3ee"], &(0x7f0000000dc0)={0xa, &(0x7f0000000b00)={0xa, 0x6, 0x310, 0x2, 0x8, 0x80, 0x10, 0x6}, 0x26, &(0x7f00000002c0)={0x5, 0xf, 0x26, 0x3, [@ss_container_id={0x14, 0x10, 0x4, 0x6, "7eed60a7a2dd00c9d3682af18fc618ce"}, @ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x6, 0x0, 0x27}]}, 0x2, [{0x4d, &(0x7f0000000c40)=@string={0x4d, 0x3, "9c61f24204ba78b8074c04284d25daeb0ce8fb76b17c466928785152e2c467a6c81d89cffd0ae5ce66667e635349556ecf01b22592fed8de721d071b917b288de6860bce4ed5ebafbffe78"}}, {0x100, &(0x7f0000000cc0)=ANY=[@ANYBLOB="00032bba176fac16dfa59690a9e1dd3f51f549ef55e595fadaaf4830abd8b4f092316830b58ae559030017d0ce7666bab74795e06e9c2a7d0cb155df03cc3f3e48c7a41e9568a4d3f2c76e1cadea60ca9e6e401f01f3365e65ee4d040f816e028572fe4728890337590da01bff94d827b3709fd21bf5f0b90000e3ce92d3964938004ea556f4a47548e7af8307d7dcc7ce508184ade6180b8a5f96c510aed2d1b0ec9029e1c325d6095c4c8db4a539caea0d50c006f643104f46c8d65063547e786bf93f0b7b963e06c644a5263ba353f742e780aa0bb01025428c41d04413a1ed47693b09470625893a72d6ffadb189c977041a9a760bf82caa531c82deae2b"]}]}) syz_usb_disconnect(0xffffffffffffffff) syz_usb_disconnect(r0) 5.8623285s ago: executing program 2 (id=107): r0 = syz_io_uring_setup(0xf03, &(0x7f0000000140)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f00000001c0)=0x0, &(0x7f0000000200)=0x0, &(0x7f0000000240)=0x0) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r4, 0x80, &(0x7f0000000300)=@rc={0x1f, @none}, 0x0, 0x0, 0x1}) io_uring_enter(r0, 0x203f, 0xfffffffd, 0x9, 0x0, 0x0) 5.719646643s ago: executing program 2 (id=109): mknodat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000000c40)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000002c80)={0x50, 0x0, r1, {0x7, 0x1f, 0xdfffffff, 0x5e490420, 0x4, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88}}, 0x50) syz_fuse_handle_req(r0, &(0x7f0000002d00)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c40000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f0000004d00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000004dc0)={0x20, 0x0, 0x3730, {0x0, 0x7f69ff17f1e1ab77}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000004e00)='./file0\x00', 0xc5001, 0x104) write$FUSE_IOCTL(r2, 0x0, 0x0) r3 = fsopen(&(0x7f0000000000)='bpf\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000b00)={&(0x7f0000000b40)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x28) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0900000004000000040000000700000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r4, @ANYBLOB="0200000001"], 0x48) r6 = fsmount(r3, 0x1, 0x0) openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r2, 0x84009422, &(0x7f0000000680)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) fchdir(r6) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000bc0)=@generic={&(0x7f0000000c00)='./file0\x00', r5}, 0x18) r7 = creat(&(0x7f0000000240)='./file0\x00', 0xa) close(r7) 4.338443115s ago: executing program 0 (id=118): r0 = socket$kcm(0x10, 0x2, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f0000000b80)={0x0, 'batadv0\x00', {0x5}}) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000000)=0x5) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mincore(&(0x7f0000000000/0x800000)=nil, 0x800000, &(0x7f0000000400)=""/188) r2 = syz_open_dev$usbfs(&(0x7f00000004c0), 0x75, 0x109301) ioctl$USBDEVFS_SUBMITURB(r2, 0x802c550a, &(0x7f0000000500)=@urb_type_control={0x2, {0x0, 0x1}, 0x6, 0xa0, &(0x7f0000000900)={0x80, 0x6, 0xf801, 0x200}, 0x8, 0x8001, 0x0, 0x0, 0x108001, 0xdffffff9, 0x0}) r3 = socket$kcm(0x10, 0x2, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sec\x00', 0x1ff) mount(0x0, &(0x7f00000002c0)='./sec\x00', &(0x7f0000000300)='securityfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/class/net/bridge0/bridge/multicast_querier_interval\x00', 0x2, 0x0) read$FUSE(r5, &(0x7f0000000f80)={0x2020}, 0x2020) r6 = openat(0xffffffffffffffff, &(0x7f0000000340)='./sec/tomoyo/profile\x00', 0x1, 0x2) write(r6, &(0x7f0000000380)="3c5c413ecd2d036a2762bb626c65640a", 0x10) sendmsg$nl_generic(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)={0x3b4, 0x41, 0x1, 0x0, 0x0, {0x3, 0x1}, [@nested={0x2b1, 0x167, 0x0, 0x1, [@typed={0x71, 0xa7, 0x0, 0x0, @binary="a7fbea1af9ea27f0f9a2ccb437538977cd2ea7cd8dc510db1ec746f91dab812785c3c490ab87a91d7402fdbd11b446ecafbdbb3ac91aa6e0099f3e21137456e3b3d6583e7d39d55ef6a7b5fc91cd2dda183cda5906191fca55857381d87e2c1ef4d38a42247ed38acc30898c18"}, @generic="0a20102146b54a6426cbdea925f61d03db5476baca0dfa461fbad1153d34944db1d58238e2280f4fc33591245f621ba1072e326897c9a12e5125aa69e8150f0bebb8c5b9040ec350a8ca92b41e61f08a5d60063f5a33b6a4215372e28665f979442f7252880dd871eb37e4a78076d3dd487e74", @generic="b5e9ff21c412b589dd61501c52269289b5a33e90035dfbc5b8067829eaa3f0f30197301fee3daf5b25f242b4a727be84d48cb6f3734e4755c46564ece27393a478c0e641c7c97aa4af575098a250f9120a078ab8860f4c560345b4a53f05dd8da7f1ce7ad32ba82f29671999c24a57b3a8132eb4997c51c2eadaf9588c1b6eadb7b63ffba0d0ac5cbb24944761f7236081b395f2e4c79368b520937966d6da3e7b26", @nested={0xcf, 0x34, 0x0, 0x1, [@nested={0x4, 0xc3}, @nested={0x4, 0xc}, @nested={0x4, 0xc6}, @nested={0x4, 0x3d}, @generic="283311b93b6b2bc5de8cd932556b5d39b2f5383a41958005d0c8377c8368274c3b94e77ea043367ea54d026c6a4f1382ef727433c205186df091021a9dc0d1a06f83d26496e919279b9aa2d71f214905cb92ecd552297f2ff1f17581aab5199041fec2db44eed50c6b8c3c116937efb1696cc4b8cc982df8a3f22141f0c348f9afef67089a1d54f9bfc9908cbe479fa009551906c99c2a17efb3bf3c41d2a31a446003c1b343f9805c4b813d104a806ab868be68683a35f4b0d4ea"]}, @generic="d01bf07f6b255d3fc54a39d0765023efeaad2046df7a7c9d3a97b6a492a9c881bff74e97c70a2ee7a1fe243c10700e9478cdbc552529e56de239ae2e312f8ceedf45bc68c2e92afee8eb5ddf", @nested={0x8, 0x15f, 0x0, 0x1, [@nested={0x4, 0x158}]}]}, @typed={0x3a, 0x1, 0x0, 0x0, @binary="00112233445566748899aabb86dd2c00001c00003a0001110000010101010253aa58fe6cbdf0357065ae44132403b1fd606412c3258e"}, @nested={0x4, 0x8002}, @typed={0xab, 0xc2, 0x0, 0x0, @binary="261ff607dd67eab54d6c8fc4fa6bbfd9ab36a2499f25e1afc24f09a82e50f2b754bea0a61928260175b126b61b3b3168c3b63fd7c16bdada3a5525d2192415281186a0e7411aa34e2df0ae71ccdb163486a8920b1c942cb54e0ad6cb3ba803f9d8ae1c169121824744c3869ee6f663461cc44e3f138c73ab68858f3cf0594561bb776a341c0c80279cc6168796ff851df5e8a85ca50760cce9249a532a313a0029f9cd55ff9717"}]}, 0x3b4}, 0x1, 0x0, 0x0, 0x40040}, 0x0) sendmsg$kcm(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f0000000100)="2e00000010006988040f80ec59acbc0413a1f848130000005e14060200d72d4ceded7df6589aae3d960000000e0090e84856db4157268d81b32e23d93e0a000f00000002800000121f0bbffbeea612551b786397ebde075f334287ca5a7ca5e0fbb327088ea8e0205344552257fa379a43e6455b37b71beeb2930df2587f37789dfe041e7be25632f21ce35229b235150718d7bcdd136c44499ce7f98458f2db0ae07fe3e91b274a48f0d36307e8fa443f983d6fb0a277bc3367c403930bdfefd3a4204da1acff15220dacca93679593fa1ea15269b60e2adb720efc119d3ce27a975885e90266ef3c60eed426a336bccaffca0ae39b50d7452c3b1d4d7acbafcb3014e563199d25a9a10f10133f48fbbdddf636bc1e55ae83c85af9a048aa1ef87c2a948b07f6c950f495058cfa745b05695388f96b75", 0x137}]}, 0x0) 3.880878053s ago: executing program 0 (id=122): r0 = syz_io_uring_setup(0xf03, &(0x7f0000000140)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f00000001c0)=0x0, &(0x7f0000000200)=0x0, &(0x7f0000000240)=0x0) syz_emit_ethernet(0x2f, &(0x7f0000000000)={@multicast, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x2f, 0x0, @rand_addr, @empty}, {0x0, 0x88be, 0xd, 0x0, @opaque="6b8b836832"}}}}}, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000001d80)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha512)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, 0x0, 0x0) r5 = accept$alg(r4, 0x0, 0x0) r6 = accept4(r5, 0x0, 0x0, 0x0) sendmsg$NL80211_CMD_EXTERNAL_AUTH(r6, &(0x7f0000001e00)={0x0, 0x0, &(0x7f0000001e40)={&(0x7f0000001e80)=ANY=[], 0x68}}, 0x40) r7 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r7, 0x80, &(0x7f0000000300)=@rc={0x1f, @none}, 0x0, 0x0, 0x1}) io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) r8 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r9 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000900)={'wg2\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f0000000ac0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r10, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xa, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x24000000}, 0x4c840) r11 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000c00), 0x0, 0x0) r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0) r13 = ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x2) r14 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r14, &(0x7f0000001e80)={0x0, 0x0, &(0x7f0000001ec0)={&(0x7f0000001f00)=@newlink={0x40, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3f, 0x108a2}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BR_MULTI_BOOLOPT={0xc, 0x2e, {0x3, 0x3}}]}}}]}, 0x40}}, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r13, 0x0) r15 = syz_open_dev$sg(&(0x7f0000000c40), 0x0, 0x0) ioctl$SG_IO(r15, 0x2285, &(0x7f0000000c80)={0x53, 0x0, 0x6, 0x68, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000d00)="1c3513000000", &(0x7f0000000d40)=""/4103, 0x10000, 0x30520cf7f25f0c64, 0x0, 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000b80)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r10, {0x5, 0xe}, {0x0, 0xfff3}, {0x9, 0xb}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x86dd}, @TCA_FLOWER_KEY_IP_TOS={0x5, 0x49, 0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041891}, 0x2c038235532fbca) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r8, 0x4010640d, &(0x7f00000000c0)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r8, 0xc01064b5, &(0x7f0000000100)={&(0x7f0000000800)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r8, 0xc02064b6, &(0x7f0000000840)={r16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r8, 0xc02064b9, &(0x7f0000000880)={&(0x7f00000008c0)=[0x0, 0x0, 0x0], &(0x7f0000000900), 0x3, r17}) ioctl$DRM_IOCTL_MODE_ATOMIC(r8, 0xc03864bc, &(0x7f0000000940)={0x0, 0x1, &(0x7f0000000980)=[r17], &(0x7f00000009c0)=[0x3], &(0x7f0000000a00)=[r19, r19, r18], &(0x7f0000000a40), 0x0, 0xffffffffffffffff}) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) 3.226551979s ago: executing program 0 (id=125): r0 = fsopen(&(0x7f0000000000)='bpf\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000b00)={&(0x7f0000000b40)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x28) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYRESOCT=r0, @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r1, @ANYRESHEX=r0], 0x48) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_int(r3, 0x29, 0x18, &(0x7f0000000040)=0xa86, 0x4) sendmmsg$inet6(r3, &(0x7f0000000080)=[{{&(0x7f00000000c0)={0xa, 0x4e22, 0xe5, @remote, 0x7}, 0x1c, 0x0}}], 0x1, 0x4008805) r4 = fsmount(r0, 0x1, 0x0) fchdir(r4) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000bc0)=@generic={&(0x7f0000000c00)='./file0\x00', r2}, 0x18) 3.226245312s ago: executing program 0 (id=126): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201fb0009030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(0xffffffffffffffff, 0x0, 0x0) ioctl$EVIOCGLED(0xffffffffffffffff, 0x80404519, &(0x7f0000000ec0)=""/213) read$char_usb(r1, &(0x7f0000000100)=""/231, 0xe7) syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000200)=""/186, 0x110) syz_usb_disconnect(0xffffffffffffffff) syz_usb_disconnect(0xffffffffffffffff) syz_open_dev$evdev(&(0x7f0000000300), 0x3e, 0x208604) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect$uac2(0x5, 0xd8, &(0x7f00000010c0)=ANY=[@ANYBLOB="c4ea5d4600000008630712204000010203010902c600030117b001080b0100017f20c009040000000101200009240106000615000b052404020207240c070602000904010000010220000904010101010220000c240202050005002eac90b4092402010406feff060a240202010006020e00092402010608060884082402010404040406240201010f090501090002080f020838010063f002000904020000010220000904020101010220000b24020102010308737ebf06240201010a0a24020202008100ffdc090582090800050707082501033f4e0200c90bca010fd15cbd55628114307ea7783185d403f5297bc6d275c49a42d95370178f1e681e66bab16ec4c18ee1df2517dcb7f8536acc6cf6b49fa570479964ab8347a125579342185b01e175f74367a7cc70d50ab942bcbb361deb0e5ad0f76418a603711d1b4343b74a6f17b11b7c4886513a1747f09864f3ee"], &(0x7f0000000dc0)={0xa, &(0x7f0000000b00)={0xa, 0x6, 0x310, 0x2, 0x8, 0x80, 0x10, 0x6}, 0x26, &(0x7f00000002c0)={0x5, 0xf, 0x26, 0x3, [@ss_container_id={0x14, 0x10, 0x4, 0x6, "7eed60a7a2dd00c9d3682af18fc618ce"}, @ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x6, 0x0, 0x27}]}, 0x2, [{0x4d, &(0x7f0000000c40)=@string={0x4d, 0x3, "9c61f24204ba78b8074c04284d25daeb0ce8fb76b17c466928785152e2c467a6c81d89cffd0ae5ce66667e635349556ecf01b22592fed8de721d071b917b288de6860bce4ed5ebafbffe78"}}, {0x100, &(0x7f0000000cc0)=ANY=[@ANYBLOB="00032bba176fac16dfa59690a9e1dd3f51f549ef55e595fadaaf4830abd8b4f092316830b58ae559030017d0ce7666bab74795e06e9c2a7d0cb155df03cc3f3e48c7a41e9568a4d3f2c76e1cadea60ca9e6e401f01f3365e65ee4d040f816e028572fe4728890337590da01bff94d827b3709fd21bf5f0b90000e3ce92d3964938004ea556f4a47548e7af8307d7dcc7ce508184ade6180b8a5f96c510aed2d1b0ec9029e1c325d6095c4c8db4a539caea0d50c006f643104f46c8d65063547e786bf93f0b7b963e06c644a5263ba353f742e780aa0bb01025428c41d04413a1ed47693b09470625893a72d6ffadb189c977041a9a760bf82caa531c82deae2b"]}]}) syz_usb_disconnect(0xffffffffffffffff) syz_usb_disconnect(r0) 2.40399086s ago: executing program 2 (id=133): r0 = syz_usb_connect(0x5, 0x57, &(0x7f0000000040)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x45, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x6, 0x5, "d15b89f2"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c01}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000180)={0x24, 0x0, &(0x7f00000001c0)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000200)={0x24, 0x0, &(0x7f0000000240)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44a}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000280)={0x2c, &(0x7f00000002c0)={0x40, 0x8, 0x8, "003cb3a4aa50323f"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000300)={0x84, &(0x7f00000003c0)={0x40, 0x14, 0x4, "008b35a5"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(r0) read$char_usb(r1, 0x0, 0x0) 1.993651413s ago: executing program 3 (id=136): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') sendfile(r1, r1, 0x0, 0xf4a) getsockname$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000200)=0x14) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newtclass={0x24, 0x28, 0x8, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0xffe0, 0xfff1}, {0x4, 0xd}, {0xe, 0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x80) madvise(&(0x7f0000130000/0xd000)=nil, 0xd000, 0x66) mincore(&(0x7f0000000000/0x800000)=nil, 0x800000, &(0x7f0000000000)=""/188) 1.856015663s ago: executing program 3 (id=137): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000700)) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000740)=0x8) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000780)=0x126) r1 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) ioctl$SIOCGSTAMPNS(r1, 0x8907, 0x0) sendmsg$802154_raw(r1, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000cc0)="f10ec55757a16c2b180237815f", 0xd}}, 0x0) recvmmsg(r1, &(0x7f0000000d00)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x40002062, 0x0) pwritev(r0, &(0x7f00000007c0)=[{&(0x7f0000000800)="00214500002c00000000400600000a0000010a00000200500050000000010000000160100385bc40df0001010101", 0x2e}], 0x1, 0x6, 0x0) pwritev(r0, &(0x7f00000008c0)=[{&(0x7f0000000880)="00214500001400000000400600000a0000010a000002005000500000ffff00000001683003060000e40201010101", 0x2e}], 0x1, 0x3, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(r2, &(0x7f0000002e40)={0x9, {"a2e3ad214fc752f91b5b09094bf70e0dd038e7ff7fc6e5539b324c078b089b3438076d1a0890e0878f0e1ac6e7049b076d959b669a240d2b67f3988f7ef319520100ffe8d178708c523c921b1b5b39310d076d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e01000000138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12d3099dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f6dc7bcbf2a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b4bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827466cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d951061ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033095563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dacae008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2df086dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36ffffffff00000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817b97c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d00000f4ff000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) r3 = dup(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000840)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000900)='./sys\x00', &(0x7f0000000940)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/bus/pci/drivers/ahci\x00', 0x0, 0x0) r5 = openat(r4, &(0x7f00000009c0)='new_id\x00', 0x1, 0x0) write(r5, &(0x7f0000000a00)='8086 2922 ffffffff ffffffff 0 0 ', 0x20) read$FUSE(r3, &(0x7f0000000e00)={0x2020}, 0x2020) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg(r6, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a80)=[{&(0x7f0000000ac0)="68000000000905040000000000000000020000000900010073797a3000000000140002800600010000020000050002000600000008000500000000002c0004800800010000000001200002800c000100706f6c69637930000800020000000002080003000000001e", 0x68}], 0x1}, 0x0) 1.624316463s ago: executing program 3 (id=139): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0xc, 0x3032, 0xffffffffffffffff, 0x0) syz_emit_vhci(&(0x7f00000004c0)=ANY=[@ANYBLOB="040e0e01041000000200"], 0x11) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x11c0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x101040, 0x119) open(&(0x7f0000000140)='./file0\x00', 0x9c41, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='fd/3\x00') sendfile(r0, r0, 0x0, 0x7a01) shutdown(0xffffffffffffffff, 0x1) connect$bt_rfcomm(0xffffffffffffffff, 0x0, 0x0) 1.510313485s ago: executing program 1 (id=140): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f00000005c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/pci/devices/0000:00:03.0/remove\x00', 0x1, 0x0) write(r0, &(0x7f0000000700)='1', 0x1) 1.386161935s ago: executing program 1 (id=141): r0 = syz_open_dev$mtd(&(0x7f0000000440), 0x0, 0x2) ioctl$BLKPG(r0, 0x1269, &(0x7f0000000480)={0x1, 0x0, 0x0, &(0x7f00000004c0)={0x0, 0x10000, 0x1}}) (fail_nth: 3) 1.139833262s ago: executing program 1 (id=142): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0xa6) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='cgroup2\x00', 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x38, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x4}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x60}, 0x1, 0x0, 0x0, 0x40}, 0x24000840) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000180)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) setns(0xc9, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="4400000010001fff000000008000000000000000", @ANYRES32=0x0, @ANYBLOB="48310600003f000008000a00", @ANYRES32, @ANYBLOB="1c0012800e00014069703665727370616e"], 0x44}, 0x1, 0x0, 0x0, 0x20004081}, 0x40000) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0xd5) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = socket(0x11, 0x1, 0x800) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) getsockopt$kcm_KCM_RECV_DISABLE(r2, 0x11e, 0x1, 0x0, 0xfffffffffffffd61) r3 = syz_open_dev$vim2m(0x0, 0x10002, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000540)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r3, 0x40045612, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config\x00', 0x1c0) mount(0x0, &(0x7f00000005c0)='./config\x00', &(0x7f0000000600)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1\x00', 0x1c0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/idVendor\x00', 0x80200, 0x0) close(r4) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/usb_gadget/g1/configs/c.1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/functions/ncm.usb0\x00', 0x1c0) symlinkat(&(0x7f0000000740)='./config/usb_gadget/g1/configs/c.1/../../functions/ncm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/usb_gadget/g1/configs/c.1/ncm.usb0\x00') write(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000007c0)='./config/usb_gadget/g1/os_desc/qw_sign\x00', 0x1, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r5, &(0x7f0000000840)='dummy_udc.0', 0xb) setreuid(0x0, 0xee00) 790.430421ms ago: executing program 3 (id=143): r0 = syz_open_dev$mtd(&(0x7f0000000440), 0x0, 0x2) ioctl$BLKPG(r0, 0x1269, &(0x7f0000000480)={0x1, 0x0, 0x0, &(0x7f00000004c0)={0x0, 0x10000, 0x1}}) 606.833954ms ago: executing program 1 (id=144): r0 = socket(0x10, 0x3, 0x0) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000080), 0x103080) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f00000000c0)={{0x3}}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r1, 0x54a2) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r1, 0x54a2) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000)={0x4000004}, 0x10) write(r0, &(0x7f0000000040)="240000001a007f0214f9f407000904080a000000000000050002000008000f40a600000e", 0x24) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000001540)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000001580)="21000000470010aaaaaaaaaa0000000000000000000000000000000000030000000000000000000000000000000300"/76, 0x4d) 335.849168ms ago: executing program 1 (id=145): r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x11) fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f00000000c0)='\x00', &(0x7f0000000180)='./file0\x00', r0) r1 = syz_open_dev$mtd(&(0x7f0000000440), 0x0, 0x2) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f0000000040)={0x44, 0x140f, 0x400, 0x70bd2d, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xd, 0x45, 'opa_vnic\x00'}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xc, 0x45, 'rdma_cm\x00'}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0x8, 0x45, 'srp\x00'}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x4}]}, 0x44}, 0x1, 0x0, 0x0, 0x20044804}, 0x80) setreuid(0xee01, 0x0) setresuid(0x0, 0xee01, 0x0) ioctl$BLKPG(r1, 0x1269, &(0x7f0000000480)={0x1, 0x0, 0x0, &(0x7f00000004c0)={0x0, 0x10000, 0x1}}) 270.083894ms ago: executing program 3 (id=146): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r1, 0xc2604111, &(0x7f00000003c0)={0x0, [[0xffffffff, 0xffffffff, 0xffffffff, 0x1, 0xffffffff, 0xfffffffc, 0xffffffff, 0xfffffffd], [0xffffffff, 0x2, 0xfffffffd, 0xa, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0x83, 0xffffffff, 0xffffffff, 0xffffffff, 0x3, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x9, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0xa, 0x186a0, 0x0, 0x0, 0x1}, {0x103, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x101000, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0xffd, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) ioctl$SNDRV_PCM_IOCTL_DROP(r1, 0x4143, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_VFIO_IOAS$SET(r0, 0x3b88, &(0x7f00000000c0)={0xc, r2}) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f0000000100)={0xc}) ioctl$IOMMU_VFIO_IOAS$CLEAR(r0, 0x3b88, &(0x7f0000000140)={0xc}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r0, 0x3b82, &(0x7f0000000180)={0x20, r2, 0x0, 0x0, &(0x7f00000001c0)}) ioctl$IOMMU_VFIO_IOAS$SET(r0, 0x3b88, &(0x7f0000000200)={0xc, r2}) ioctl$IOMMU_VFIO_GET_API_VERSION(r0, 0x3b64) ioctl$IOMMU_VFIO_SET_IOMMU(r0, 0x3b66, 0x3) ioctl$IOMMU_VFIO_CHECK_EXTENSION(r0, 0x3b65, 0x9) ioctl$IOMMU_VFIO_IOMMU_GET_INFO(r0, 0x3b70, &(0x7f0000000240)={0x70, 0x0, 0x0, 0x0, {}, {{}, 0x0, 0x0, [{}]}}) ioctl$IOMMU_VFIO_IOMMU_MAP_DMA(r0, 0x3b71, &(0x7f0000000280)={0x20, 0x0, &(0x7f00000002c0)='LLLLLLLLLLLLLLLLLLLLLLLLLLLL', 0x1c, 0x1c}) ioctl$IOMMU_VFIO_IOMMU_UNMAP_DMA(r0, 0x3b72, &(0x7f0000000300)={0x18, 0x0, 0x1c, 0x1c}) ioctl$IOMMU_IOAS_UNMAP$ALL(r0, 0x3b86, &(0x7f0000000340)={0x18, r2}) ioctl$IOMMU_DESTROY$ioas(r0, 0x3b80, &(0x7f0000000380)={0x8, r2}) close(r0) 118.786044ms ago: executing program 3 (id=147): sched_setscheduler(0x0, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) capget(0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000002c0)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./dev/sda\x00', 0x42, 0x0) ioctl$BLKROSET(r0, 0x1276, 0x0) 0s ago: executing program 1 (id=148): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000700)) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000740)=0x8) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000780)=0x126) r1 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) ioctl$SIOCGSTAMPNS(r1, 0x8907, 0x0) sendmsg$802154_raw(r1, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000cc0)="f10ec55757a16c2b180237815f", 0xd}}, 0x0) recvmmsg(r1, &(0x7f0000000d00)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x40002062, 0x0) pwritev(r0, &(0x7f00000007c0)=[{&(0x7f0000000800)="00214500002c00000000400600000a0000010a00000200500050000000010000000160100385bc40df0001010101", 0x2e}], 0x1, 0x6, 0x0) pwritev(r0, &(0x7f00000008c0)=[{&(0x7f0000000880)="00214500001400000000400600000a0000010a000002005000500000ffff00000001683003060000e40201010101", 0x2e}], 0x1, 0x3, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(r2, &(0x7f0000002e40)={0x9, {"a2e3ad214fc752f91b5b09094bf70e0dd038e7ff7fc6e5539b324c078b089b3438076d1a0890e0878f0e1ac6e7049b076d959b669a240d2b67f3988f7ef319520100ffe8d178708c523c921b1b5b39310d076d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e01000000138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12d3099dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f6dc7bcbf2a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b4bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827466cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d951061ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033095563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dacae008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2df086dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36ffffffff00000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817b97c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d00000f4ff000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) r3 = dup(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000840)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000900)='./sys\x00', &(0x7f0000000940)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/bus/pci/drivers/ahci\x00', 0x0, 0x0) r5 = openat(r4, &(0x7f00000009c0)='new_id\x00', 0x1, 0x0) write(r5, &(0x7f0000000a00)='8086 2922 ffffffff ffffffff 0 0 ', 0x20) read$FUSE(r3, &(0x7f0000000e00)={0x2020}, 0x2020) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg(r6, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a80)=[{&(0x7f0000000ac0)="68000000000905040000000000000000020000000900010073797a3000000000140002800600010000020000050002000600000008000500000000002c0004800800010000000001200002800c000100706f6c69637930000800020000000002080003000000001e", 0x68}], 0x1}, 0x0) kernel console output (not intermixed with test programs): [ 80.539309][ T42] kauditd_printk_skb: 5 callbacks suppressed [ 80.539327][ T42] audit: type=1400 audit(1793921676.898:124): avc: denied { write } for pid=5726 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 80.691663][ T42] audit: type=1400 audit(1793921677.038:125): avc: denied { write } for pid=5730 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 80.861806][ T42] audit: type=1400 audit(1793921677.228:126): avc: denied { write } for pid=5735 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 81.002658][ T42] audit: type=1400 audit(1793921677.358:127): avc: denied { write } for pid=5738 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 81.204931][ T42] audit: type=1400 audit(1793921677.568:128): avc: denied { write } for pid=5741 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 81.385249][ T42] audit: type=1400 audit(1793921677.748:129): avc: denied { write } for pid=5744 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 81.816329][ T42] audit: type=1400 audit(1793921678.168:130): avc: denied { write } for pid=5748 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 81.981158][ T42] audit: type=1400 audit(1793921678.348:131): avc: denied { write } for pid=5751 comm="rm" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '[localhost]:41070' (ED25519) to the list of known hosts. [ 82.145075][ T42] audit: type=1400 audit(1793921678.508:132): avc: denied { write } for pid=5755 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 82.236022][ T42] audit: type=1400 audit(1793921678.598:133): avc: denied { name_bind } for pid=5760 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 87.345650][ T42] kauditd_printk_skb: 7 callbacks suppressed [ 87.345667][ T42] audit: type=1400 audit(1793921683.708:141): avc: denied { mounton } for pid=5761 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 87.354068][ T42] audit: type=1400 audit(1793921683.718:142): avc: denied { mount } for pid=5761 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 87.357473][ T5761] cgroup: Unknown subsys name 'net' [ 87.390073][ T42] audit: type=1400 audit(1793921683.758:143): avc: denied { unmount } for pid=5761 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 87.578216][ T5761] cgroup: Unknown subsys name 'cpuset' [ 87.643627][ T5761] cgroup: Unknown subsys name 'rlimit' [ 87.882742][ T42] audit: type=1400 audit(1793921684.248:144): avc: denied { setattr } for pid=5761 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=848 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 87.884591][ T42] audit: type=1400 audit(1793921684.248:145): avc: denied { create } for pid=5761 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 87.886132][ T42] audit: type=1400 audit(1793921684.248:146): avc: denied { write } for pid=5761 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 87.887402][ T42] audit: type=1400 audit(1793921684.248:147): avc: denied { read } for pid=5761 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 87.989789][ T42] audit: type=1400 audit(1793921684.348:148): avc: denied { mounton } for pid=5761 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 87.989839][ T42] audit: type=1400 audit(1793921684.348:149): avc: denied { mount } for pid=5761 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 88.088376][ T5789] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 88.100019][ T42] audit: type=1400 audit(1793921684.468:150): avc: denied { relabelto } for pid=5789 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 89.766979][ T5761] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 95.135010][ T67] cfg80211: failed to load regulatory.db [ 100.843581][ T42] kauditd_printk_skb: 3 callbacks suppressed [ 100.843602][ T42] audit: type=1400 audit(1793921697.188:154): avc: denied { execmem } for pid=5797 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 101.781337][ T42] audit: type=1400 audit(1793921698.148:155): avc: denied { create } for pid=5804 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 101.782160][ T42] audit: type=1400 audit(1793921698.148:156): avc: denied { read write } for pid=5804 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 101.782821][ T42] audit: type=1400 audit(1793921698.148:157): avc: denied { open } for pid=5804 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 101.810593][ T42] audit: type=1400 audit(1793921698.148:158): avc: denied { ioctl } for pid=5804 comm="syz-executor" path="socket:[7046]" dev="sockfs" ino=7046 ioctlcmd=0x400448c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 101.862108][ T72] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 101.875991][ T72] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 101.903109][ T72] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 102.013081][ T5814] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 102.014809][ T5814] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 102.015492][ T5814] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 102.016601][ T5814] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 102.018685][ T5817] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 102.018804][ T5817] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 102.019833][ T5818] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 102.020633][ T5818] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 102.021160][ T5818] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 102.055491][ T42] audit: type=1400 audit(1793921698.388:159): avc: denied { read } for pid=5812 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 102.055539][ T42] audit: type=1400 audit(1793921698.388:160): avc: denied { open } for pid=5812 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 102.055572][ T42] audit: type=1400 audit(1793921698.388:161): avc: denied { mounton } for pid=5812 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 102.058169][ T42] audit: type=1400 audit(1793921698.388:162): avc: denied { module_request } for pid=5812 comm="syz-executor" kmod="netdev-nr3" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 102.077048][ T5810] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 102.107500][ T5810] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 102.110176][ T5814] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 102.147795][ T5814] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 102.150203][ T42] audit: type=1400 audit(1793921698.508:163): avc: denied { mounton } for pid=5804 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 102.150305][ T5814] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 102.186508][ T5818] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 102.210212][ T5818] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 102.218105][ T5818] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 102.716134][ T5809] rxe_eth0 speed is unknown, defaulting to 1000 [ 102.717547][ T5809] rxe_eth0 speed is unknown, defaulting to 1000 [ 102.718666][ T5809] rxe_eth0 speed is unknown, defaulting to 1000 [ 102.751021][ T5812] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 102.773095][ T5807] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 102.774259][ T5804] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 103.146549][ T5809] infiniband rxe0: set active [ 103.164188][ T5809] infiniband rxe0: added rxe_eth0 [ 103.195553][ T5809] smbdirect: ib_dev[rxe0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 103.195592][ T5809] smbdirect: ib_dev[rxe0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 103.195627][ T5809] smbdirect: ib_dev[rxe0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 103.299895][ T43] rxe_eth0 speed is unknown, defaulting to 1000 [ 103.305104][ T5809] RDS/IB: rxe0: added [ 103.305324][ T5809] smc: adding ib device rxe0 with port count 1 [ 103.305385][ T5809] smc: ib device rxe0 port 1 has no pnetid [ 103.345788][ T982] rxe_eth0 speed is unknown, defaulting to 1000 [ 103.436246][ T5809] rxe_eth0 speed is unknown, defaulting to 1000 [ 103.697515][ T5809] rxe_eth0 speed is unknown, defaulting to 1000 [ 103.841247][ T5807] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.841326][ T5807] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.841438][ T5807] bridge_slave_0: entered allmulticast mode [ 103.842476][ T5807] bridge_slave_0: entered promiscuous mode [ 103.887651][ T5807] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.887756][ T5807] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.887867][ T5807] bridge_slave_1: entered allmulticast mode [ 103.899772][ T5807] bridge_slave_1: entered promiscuous mode [ 103.970292][ T5807] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 104.024512][ T5807] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 104.078009][ T5809] rxe_eth0 speed is unknown, defaulting to 1000 [ 104.092074][ T5806] Bluetooth: hci3: command tx timeout [ 104.178534][ T5807] team0: Port device team_slave_0 added [ 104.253138][ T5806] Bluetooth: hci2: command tx timeout [ 104.253325][ T5818] Bluetooth: hci1: command tx timeout [ 104.261609][ T5818] Bluetooth: hci0: command tx timeout [ 104.273517][ T5807] team0: Port device team_slave_1 added [ 104.273862][ T5804] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.274000][ T5804] bridge0: port 1(bridge_slave_0) entered disabled state [ 104.274407][ T5804] bridge_slave_0: entered allmulticast mode [ 104.275664][ T5804] bridge_slave_0: entered promiscuous mode [ 104.278077][ T5804] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.278238][ T5804] bridge0: port 2(bridge_slave_1) entered disabled state [ 104.278530][ T5804] bridge_slave_1: entered allmulticast mode [ 104.280128][ T5804] bridge_slave_1: entered promiscuous mode [ 104.366809][ T5807] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 104.366829][ T5807] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.366853][ T5807] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 104.371134][ T5807] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 104.371149][ T5807] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.371172][ T5807] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.435104][ T5812] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.435240][ T5812] bridge0: port 1(bridge_slave_0) entered disabled state [ 104.435403][ T5812] bridge_slave_0: entered allmulticast mode [ 104.437724][ T5812] bridge_slave_0: entered promiscuous mode [ 104.461903][ T5812] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.461980][ T5812] bridge0: port 2(bridge_slave_1) entered disabled state [ 104.462091][ T5812] bridge_slave_1: entered allmulticast mode [ 104.464084][ T5812] bridge_slave_1: entered promiscuous mode [ 104.536626][ T5804] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 104.551576][ T5804] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 104.674535][ T5804] team0: Port device team_slave_0 added [ 104.674579][ T5809] rxe_eth0 speed is unknown, defaulting to 1000 [ 104.692112][ T5812] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 104.768668][ T5804] team0: Port device team_slave_1 added [ 104.770876][ T5812] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 104.800787][ T5807] hsr_slave_0: entered promiscuous mode [ 104.801614][ T5807] hsr_slave_1: entered promiscuous mode [ 104.913877][ T5812] team0: Port device team_slave_0 added [ 104.962745][ T5812] team0: Port device team_slave_1 added [ 105.005996][ T5804] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 105.006013][ T5804] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 105.006036][ T5804] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 105.056871][ T5812] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 105.056888][ T5812] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 105.056911][ T5812] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 105.058089][ T5804] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 105.058101][ T5804] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 105.058124][ T5804] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 105.120112][ T5812] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 105.120129][ T5812] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 105.120150][ T5812] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 105.321149][ T5812] hsr_slave_0: entered promiscuous mode [ 105.321635][ T5812] hsr_slave_1: entered promiscuous mode [ 105.322060][ T5812] debugfs: 'hsr0' already exists in 'hsr' [ 105.322073][ T5812] Cannot create hsr debugfs directory [ 105.327599][ T5804] hsr_slave_0: entered promiscuous mode [ 105.328585][ T5804] hsr_slave_1: entered promiscuous mode [ 105.329176][ T5804] debugfs: 'hsr0' already exists in 'hsr' [ 105.329186][ T5804] Cannot create hsr debugfs directory [ 105.968790][ T5807] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 106.002521][ T5807] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 106.023238][ T5807] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 106.028109][ T5807] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 106.029138][ T5807] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 106.050039][ T5807] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 106.116915][ T5807] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 106.139164][ T5807] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 106.169076][ T5818] Bluetooth: hci3: command tx timeout [ 106.332472][ T5806] Bluetooth: hci1: command tx timeout [ 106.332562][ T5818] Bluetooth: hci0: command tx timeout [ 106.339186][ T5818] Bluetooth: hci2: command tx timeout [ 106.372738][ T5804] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 106.431095][ T5804] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 106.432080][ T5804] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 106.436062][ T5804] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 106.438243][ T5804] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 106.449932][ T5804] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 106.463864][ T5809] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.464493][ T5809] bridge0: port 1(bridge_slave_0) entered disabled state [ 106.465446][ T5809] bridge_slave_0: entered allmulticast mode [ 106.466805][ T5809] bridge_slave_0: entered promiscuous mode [ 106.498577][ T5804] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 106.514946][ T5804] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 106.534086][ T5809] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.534181][ T5809] bridge0: port 2(bridge_slave_1) entered disabled state [ 106.534537][ T5809] bridge_slave_1: entered allmulticast mode [ 106.535861][ T5809] bridge_slave_1: entered promiscuous mode [ 106.651910][ T5809] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 106.695223][ T5809] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 106.814532][ T5809] team0: Port device team_slave_0 added [ 106.826287][ T5809] team0: Port device team_slave_1 added [ 106.923967][ T5812] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 106.947391][ T5812] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 106.948175][ T5812] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 106.954074][ T5812] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 106.963679][ T5809] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 106.963696][ T5809] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 106.963719][ T5809] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 106.966225][ T5812] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 106.980868][ T5812] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 106.982197][ T5812] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 107.043563][ T5812] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 107.066579][ T5809] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 107.066595][ T5809] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 107.066616][ T5809] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 107.146428][ T5807] 8021q: adding VLAN 0 to HW filter on device bond0 [ 107.238114][ T5809] hsr_slave_0: entered promiscuous mode [ 107.242843][ T5809] hsr_slave_1: entered promiscuous mode [ 107.275333][ T5809] debugfs: 'hsr0' already exists in 'hsr' [ 107.275356][ T5809] Cannot create hsr debugfs directory [ 107.386115][ T5804] 8021q: adding VLAN 0 to HW filter on device bond0 [ 107.465954][ T5804] 8021q: adding VLAN 0 to HW filter on device team0 [ 107.498340][ T69] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.498567][ T69] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.505939][ T5807] 8021q: adding VLAN 0 to HW filter on device team0 [ 107.544278][ T69] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.544370][ T69] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.546521][ T69] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.546638][ T69] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.594626][ T69] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.594718][ T69] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.745965][ T5812] 8021q: adding VLAN 0 to HW filter on device bond0 [ 107.769234][ T5807] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 107.769256][ T5807] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 107.821494][ T42] kauditd_printk_skb: 5 callbacks suppressed [ 107.821513][ T42] audit: type=1400 audit(1793921704.188:169): avc: denied { sys_module } for pid=5807 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 107.846059][ T5812] 8021q: adding VLAN 0 to HW filter on device team0 [ 107.980148][ T259] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.980257][ T259] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.982103][ T259] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.982197][ T259] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.112755][ T5809] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 108.117612][ T5809] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 108.118746][ T5809] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 108.156936][ T5809] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 108.211678][ T5809] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 108.216843][ T5809] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 108.217807][ T5809] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 108.230149][ T5809] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 108.251483][ T5818] Bluetooth: hci3: command tx timeout [ 108.429584][ T5809] 8021q: adding VLAN 0 to HW filter on device bond0 [ 108.436229][ T5818] Bluetooth: hci2: command tx timeout [ 108.436265][ T5818] Bluetooth: hci0: command tx timeout [ 108.436305][ T5806] Bluetooth: hci1: command tx timeout [ 108.443503][ T5809] 8021q: adding VLAN 0 to HW filter on device team0 [ 108.458539][ T69] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.458611][ T69] bridge0: port 1(bridge_slave_0) entered forwarding state [ 108.463307][ T69] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.463380][ T69] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.572144][ T5809] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 108.866177][ T5807] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.872685][ T5804] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.061777][ T5804] veth0_vlan: entered promiscuous mode [ 109.077002][ T5804] veth1_vlan: entered promiscuous mode [ 109.181416][ T5807] veth0_vlan: entered promiscuous mode [ 109.188258][ T5807] veth1_vlan: entered promiscuous mode [ 109.203053][ T5804] veth0_macvtap: entered promiscuous mode [ 109.262910][ T5804] veth1_macvtap: entered promiscuous mode [ 109.286376][ T5807] veth0_macvtap: entered promiscuous mode [ 109.289989][ T5807] veth1_macvtap: entered promiscuous mode [ 109.370271][ T5804] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.382033][ T5804] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.432097][ T5807] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.538413][ T5807] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.550759][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.550988][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.551020][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.551050][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.554524][ T5812] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.558194][ T5809] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.850513][ T5812] veth0_vlan: entered promiscuous mode [ 109.856937][ T5812] veth1_vlan: entered promiscuous mode [ 109.947381][ T5809] veth0_vlan: entered promiscuous mode [ 109.975707][ T423] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.975722][ T423] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.999700][ T423] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.999721][ T423] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.053693][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.060204][ T5879] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.060549][ T5879] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.060771][ T5879] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.062233][ T5809] veth1_vlan: entered promiscuous mode [ 110.108062][ T226] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.108086][ T226] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.151645][ T42] audit: type=1400 audit(1793921706.518:170): avc: denied { mount } for pid=5804 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 110.178253][ T42] audit: type=1400 audit(1793921706.538:171): avc: denied { mounton } for pid=5804 comm="syz-executor" path="/syzkaller.Dp5lkE/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 110.180807][ T42] audit: type=1400 audit(1793921706.548:172): avc: denied { mount } for pid=5804 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 110.185174][ T42] audit: type=1400 audit(1793921706.548:173): avc: denied { mounton } for pid=5804 comm="syz-executor" path="/syzkaller.Dp5lkE/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 110.187069][ T42] audit: type=1400 audit(1793921706.548:174): avc: denied { mounton } for pid=5804 comm="syz-executor" path="/syzkaller.Dp5lkE/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=9682 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 110.224912][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.224934][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.249053][ T42] audit: type=1400 audit(1793921706.608:175): avc: denied { unmount } for pid=5804 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 110.308059][ T5812] veth0_macvtap: entered promiscuous mode [ 110.310527][ T42] audit: type=1400 audit(1793921706.678:176): avc: denied { mounton } for pid=5804 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2861 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 110.313032][ T42] audit: type=1400 audit(1793921706.678:177): avc: denied { mount } for pid=5804 comm="syz-executor" name="/" dev="gadgetfs" ino=9684 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 110.326591][ T5812] veth1_macvtap: entered promiscuous mode [ 110.337530][ T5818] Bluetooth: hci3: command tx timeout [ 110.362518][ T5809] veth0_macvtap: entered promiscuous mode [ 110.374077][ T5809] veth1_macvtap: entered promiscuous mode [ 110.407053][ T42] audit: type=1400 audit(1793921706.768:178): avc: denied { mounton } for pid=5804 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 110.420716][ T5812] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.477250][ T5809] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.493180][ T5812] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.504027][ T5818] Bluetooth: hci2: command tx timeout [ 110.504057][ T5818] Bluetooth: hci1: command tx timeout [ 110.525818][ T5809] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.535731][ T72] Bluetooth: hci0: command tx timeout [ 110.650204][ T5804] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 110.730324][ T1170] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.730345][ T1170] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.815382][ T226] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.815402][ T226] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.819970][ T5877] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.820275][ T5877] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.820299][ T5877] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.820320][ T5877] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.820340][ T5877] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.820360][ T5877] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.820380][ T5877] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.820403][ T5877] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.926379][ T423] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.926395][ T423] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.096685][ T1170] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.096708][ T1170] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.459036][ T43] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 111.543799][ T5973] iommufd_mock iommufd_mock0: Adding to iommu group 10 [ 111.581185][ T5973] capability: warning: `syz.2.3' uses 32-bit capabilities (legacy support in use) [ 111.621131][ T43] usb 5-1: Using ep0 maxpacket: 32 [ 111.621275][ T5973] capability: warning: `syz.2.3' uses deprecated v2 capabilities in a way that may be insecure [ 111.623564][ T43] usb 5-1: New USB device found: idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 111.625065][ T43] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 111.683570][ T43] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 111.683596][ T43] usb 5-1: Product: syz [ 111.683609][ T43] usb 5-1: Manufacturer: syz [ 111.683621][ T43] usb 5-1: SerialNumber: syz [ 111.708815][ T43] usb 5-1: config 0 descriptor?? [ 111.710442][ T5966] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 111.712689][ T43] hub 5-1:0.0: bad descriptor, ignoring hub [ 111.712708][ T43] hub 5-1:0.0: probe with driver hub failed with error -5 [ 111.847581][ T5976] iommufd_mock iommufd_mock1: Adding to iommu group 11 [ 111.922397][ T5979] iommufd_mock iommufd_mock1: Adding to iommu group 11 [ 111.945224][ T5979] FAULT_INJECTION: forcing a failure. [ 111.945224][ T5979] name failslab, interval 1, probability 0, space 0, times 1 [ 111.945252][ T5979] CPU: 1 UID: 0 PID: 5979 Comm: syz.2.6 Not tainted syzkaller #0 PREEMPT(full) [ 111.945274][ T5979] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 111.945285][ T5979] Call Trace: [ 111.945309][ T5979] [ 111.945317][ T5979] dump_stack_lvl+0x100/0x190 [ 111.945355][ T5979] should_fail_ex.cold+0x5/0xa [ 111.945385][ T5979] should_failslab+0xc2/0x120 [ 111.945410][ T5979] __kmalloc_noprof+0xfc/0x840 [ 111.946900][ T5979] ? rcu_is_watching+0x13/0xc0 [ 111.947146][ T5979] ? tomoyo_realpath_from_path+0xb6/0x690 [ 111.947565][ T5979] tomoyo_realpath_from_path+0xb6/0x690 [ 111.947629][ T5979] tomoyo_path_number_perm+0x23c/0x580 [ 111.947657][ T5979] ? tomoyo_path_number_perm+0x22e/0x580 [ 111.947867][ T5979] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 111.947906][ T5979] ? __lock_acquire+0x5c0/0x1f40 [ 111.947946][ T5979] ? __fget_files+0x34/0x3d0 [ 111.947971][ T5979] ? find_held_lock+0x2b/0x80 [ 111.947996][ T5979] ? hook_file_ioctl_common+0x140/0x440 [ 111.948026][ T5979] ? __fget_files+0x21f/0x3d0 [ 111.948054][ T5979] security_file_ioctl+0xd3/0x230 [ 111.948086][ T5979] __x64_sys_ioctl+0xb7/0x210 [ 111.948110][ T5979] do_syscall_64+0x123/0x790 [ 111.948136][ T5979] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.948156][ T5979] RIP: 0033:0x7f509a79fb19 [ 111.948174][ T5979] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 111.948192][ T5979] RSP: 002b:00007f509b65d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 111.948211][ T5979] RAX: ffffffffffffffda RBX: 00007f509aa25fa0 RCX: 00007f509a79fb19 [ 111.948224][ T5979] RDX: 0000200000000480 RSI: 0000000000003b85 RDI: 0000000000000003 [ 111.948235][ T5979] RBP: 00007f509b65d090 R08: 0000000000000000 R09: 0000000000000000 [ 111.948247][ T5979] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 111.948258][ T5979] R13: 00007f509aa26038 R14: 00007f509aa25fa0 R15: 00007fff200258a8 [ 111.948285][ T5979] [ 111.948339][ T5979] ERROR: Out of memory at tomoyo_realpath_from_path. [ 112.421622][ T5966] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 112.422031][ T5966] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 112.623653][ T5995] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 112.730160][ T24] usb 5-1: USB disconnect, device number 2 [ 112.780048][ T5995] usb 8-1: Using ep0 maxpacket: 32 [ 112.780949][ T5995] usb 8-1: New USB device found: idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 112.782110][ T5995] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 112.784234][ T5995] usb 8-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 112.784253][ T5995] usb 8-1: Product: syz [ 112.784263][ T5995] usb 8-1: Manufacturer: syz [ 112.784274][ T5995] usb 8-1: SerialNumber: syz [ 112.786773][ T5995] usb 8-1: config 0 descriptor?? [ 112.787596][ T5997] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 112.800264][ T5995] hub 8-1:0.0: bad descriptor, ignoring hub [ 112.800289][ T5995] hub 8-1:0.0: probe with driver hub failed with error -5 [ 113.129040][ T24] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 113.224172][ T5997] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 113.225213][ T5997] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 113.279128][ T24] usb 6-1: Using ep0 maxpacket: 32 [ 113.279965][ T24] usb 6-1: New USB device found: idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 113.281002][ T24] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 113.283073][ T24] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 113.283094][ T24] usb 6-1: Product: syz [ 113.283106][ T24] usb 6-1: Manufacturer: syz [ 113.283117][ T24] usb 6-1: SerialNumber: syz [ 113.285325][ T24] usb 6-1: config 0 descriptor?? [ 113.286084][ T6004] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 113.287183][ T24] hub 6-1:0.0: bad descriptor, ignoring hub [ 113.287199][ T24] hub 6-1:0.0: probe with driver hub failed with error -5 [ 113.339342][ T24] chaoskey 6-1:0.0: Unable to register with hwrng [ 113.446004][ T5997] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 113.446340][ T5997] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 113.516198][ T42] kauditd_printk_skb: 68 callbacks suppressed [ 113.516216][ T42] audit: type=1400 audit(1793921709.878:247): avc: denied { read append } for pid=6005 comm="syz.0.13" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 113.516970][ T42] audit: type=1400 audit(1793921709.878:248): avc: denied { open } for pid=6005 comm="syz.0.13" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 113.522716][ T42] audit: type=1400 audit(1793921709.888:249): avc: denied { ioctl } for pid=6005 comm="syz.0.13" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 113.632243][ T42] audit: type=1400 audit(1793921709.998:250): avc: denied { create } for pid=6005 comm="syz.0.13" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 113.647608][ T42] audit: type=1400 audit(1793921709.998:251): avc: denied { bind } for pid=6005 comm="syz.0.13" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 113.647654][ T42] audit: type=1400 audit(1793921709.998:252): avc: denied { listen } for pid=6005 comm="syz.0.13" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 113.647690][ T42] audit: type=1400 audit(1793921709.998:253): avc: denied { connect } for pid=6005 comm="syz.0.13" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 113.647725][ T42] audit: type=1400 audit(1793921710.008:254): avc: denied { shutdown } for pid=6005 comm="syz.0.13" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 113.704764][ T42] audit: type=1400 audit(1793921710.058:255): avc: denied { mount } for pid=6005 comm="syz.0.13" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 113.784644][ T29] usb 8-1: USB disconnect, device number 2 [ 113.821291][ T42] audit: type=1400 audit(1793921710.188:256): avc: denied { block_suspend } for pid=6005 comm="syz.0.13" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 113.829341][ T6001] syz.2.11 (6001): drop_caches: 2 [ 114.037896][ T5892] rxe_eth0 speed is unknown, defaulting to 1000 [ 114.124857][ T6007] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 114.125228][ T6007] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 114.131843][ T29] usb 8-1: new full-speed USB device number 3 using dummy_hcd [ 114.272833][ T6018] netlink: 52 bytes leftover after parsing attributes in process `syz.0.16'. [ 114.281297][ T6018] Bluetooth: MGMT ver 1.23 [ 114.319673][ T29] usb 8-1: New USB device found: idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 114.322400][ T29] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid maxpacket 1024, setting to 64 [ 114.325291][ T29] usb 8-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 114.325318][ T29] usb 8-1: Product: syz [ 114.325332][ T29] usb 8-1: Manufacturer: syz [ 114.325345][ T29] usb 8-1: SerialNumber: syz [ 114.327863][ T29] usb 8-1: config 0 descriptor?? [ 114.330063][ T5997] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 114.331024][ T29] hub 8-1:0.0: bad descriptor, ignoring hub [ 114.331041][ T29] hub 8-1:0.0: probe with driver hub failed with error -5 [ 114.350429][ T5892] usb 6-1: USB disconnect, device number 2 [ 114.470988][ T6018] device-mapper: table: 248:0: ram0 too small for target: start=4096, len=18014398509481983, dev_size=8192 [ 114.471018][ T6018] device-mapper: core: Cannot calculate initial queue limits [ 114.471026][ T6018] device-mapper: ioctl: unable to set up device queue for new table. [ 114.559622][ T5997] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 114.589722][ T5997] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 114.597542][ T5997] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 114.597924][ T5997] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 114.802364][ T6030] FAULT_INJECTION: forcing a failure. [ 114.802364][ T6030] name failslab, interval 1, probability 0, space 0, times 0 [ 114.802394][ T6030] CPU: 2 UID: 0 PID: 6030 Comm: syz.2.18 Not tainted syzkaller #0 PREEMPT(full) [ 114.802415][ T6030] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 114.802426][ T6030] Call Trace: [ 114.802432][ T6030] [ 114.802440][ T6030] dump_stack_lvl+0x100/0x190 [ 114.802478][ T6030] should_fail_ex.cold+0x5/0xa [ 114.802508][ T6030] should_failslab+0xc2/0x120 [ 114.802532][ T6030] __kmalloc_noprof+0xfc/0x840 [ 114.802560][ T6030] ? rcu_is_watching+0x13/0xc0 [ 114.802582][ T6030] ? tomoyo_realpath_from_path+0xb6/0x690 [ 114.802612][ T6030] tomoyo_realpath_from_path+0xb6/0x690 [ 114.802638][ T6030] tomoyo_path_number_perm+0x23c/0x580 [ 114.802670][ T6030] ? tomoyo_path_number_perm+0x22e/0x580 [ 114.802700][ T6030] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 114.802740][ T6030] ? __lock_acquire+0x5c0/0x1f40 [ 114.802795][ T6030] ? __fget_files+0x34/0x3d0 [ 114.802821][ T6030] ? find_held_lock+0x2b/0x80 [ 114.802842][ T6030] ? hook_file_ioctl_common+0x140/0x440 [ 114.802873][ T6030] ? __fget_files+0x21f/0x3d0 [ 114.802898][ T6030] security_file_ioctl+0xd3/0x230 [ 114.802926][ T6030] __x64_sys_ioctl+0xb7/0x210 [ 114.802948][ T6030] do_syscall_64+0x123/0x790 [ 114.802973][ T6030] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.802994][ T6030] RIP: 0033:0x7f509a79fb19 [ 114.803010][ T6030] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 114.803026][ T6030] RSP: 002b:00007f509b65d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 114.803043][ T6030] RAX: ffffffffffffffda RBX: 00007f509aa25fa0 RCX: 00007f509a79fb19 [ 114.803057][ T6030] RDX: 0000200000000740 RSI: 0000000080044501 RDI: 0000000000000003 [ 114.803068][ T6030] RBP: 00007f509b65d090 R08: 0000000000000000 R09: 0000000000000000 [ 114.803078][ T6030] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 114.803088][ T6030] R13: 00007f509aa26038 R14: 00007f509aa25fa0 R15: 00007fff200258a8 [ 114.803114][ T6030] [ 114.803220][ T6030] ERROR: Out of memory at tomoyo_realpath_from_path. [ 114.908694][ T6032] syz.2.19 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 116.570920][ T6058] FAULT_INJECTION: forcing a failure. [ 116.570920][ T6058] name failslab, interval 1, probability 0, space 0, times 0 [ 116.570950][ T6058] CPU: 0 UID: 0 PID: 6058 Comm: syz.0.28 Not tainted syzkaller #0 PREEMPT(full) [ 116.570971][ T6058] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 116.570983][ T6058] Call Trace: [ 116.570989][ T6058] [ 116.571000][ T6058] dump_stack_lvl+0x100/0x190 [ 116.571037][ T6058] should_fail_ex.cold+0x5/0xa [ 116.571066][ T6058] should_failslab+0xc2/0x120 [ 116.571089][ T6058] __kmalloc_noprof+0xfc/0x840 [ 116.571116][ T6058] ? rcu_is_watching+0x13/0xc0 [ 116.571138][ T6058] ? tomoyo_realpath_from_path+0xb6/0x690 [ 116.571164][ T6058] tomoyo_realpath_from_path+0xb6/0x690 [ 116.571190][ T6058] tomoyo_path_number_perm+0x23c/0x580 [ 116.571217][ T6058] ? tomoyo_path_number_perm+0x22e/0x580 [ 116.571283][ T6058] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 116.571321][ T6058] ? __lock_acquire+0x5c0/0x1f40 [ 116.571359][ T6058] ? __fget_files+0x34/0x3d0 [ 116.571383][ T6058] ? find_held_lock+0x2b/0x80 [ 116.571403][ T6058] ? hook_file_ioctl_common+0x140/0x440 [ 116.571431][ T6058] ? __fget_files+0x21f/0x3d0 [ 116.571459][ T6058] security_file_ioctl+0xd3/0x230 [ 116.571489][ T6058] __x64_sys_ioctl+0xb7/0x210 [ 116.571510][ T6058] do_syscall_64+0x123/0x790 [ 116.571535][ T6058] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.571554][ T6058] RIP: 0033:0x7feab959fb19 [ 116.571570][ T6058] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 116.571587][ T6058] RSP: 002b:00007feaba502028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 116.571605][ T6058] RAX: ffffffffffffffda RBX: 00007feab9825fa0 RCX: 00007feab959fb19 [ 116.571617][ T6058] RDX: 0000200000000480 RSI: 00000000c138fd0e RDI: 0000000000000003 [ 116.571628][ T6058] RBP: 00007feaba502090 R08: 0000000000000000 R09: 0000000000000000 [ 116.571639][ T6058] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 116.571649][ T6058] R13: 00007feab9826038 R14: 00007feab9825fa0 R15: 00007fffdf59d358 [ 116.571674][ T6058] [ 116.571681][ T6058] ERROR: Out of memory at tomoyo_realpath_from_path. [ 116.624862][ T6060] netlink: 12 bytes leftover after parsing attributes in process `syz.2.29'. [ 116.691614][ T6062] FAULT_INJECTION: forcing a failure. [ 116.691614][ T6062] name failslab, interval 1, probability 0, space 0, times 0 [ 116.691645][ T6062] CPU: 0 UID: 0 PID: 6062 Comm: syz.0.30 Not tainted syzkaller #0 PREEMPT(full) [ 116.691670][ T6062] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 116.691682][ T6062] Call Trace: [ 116.691689][ T6062] [ 116.691695][ T6062] dump_stack_lvl+0x100/0x190 [ 116.691737][ T6062] should_fail_ex.cold+0x5/0xa [ 116.691772][ T6062] should_failslab+0xc2/0x120 [ 116.691809][ T6062] __kmalloc_noprof+0xfc/0x840 [ 116.691844][ T6062] ? n_hdlc_alloc_buf+0x5b/0xf0 [ 116.691887][ T6062] n_hdlc_alloc_buf+0x5b/0xf0 [ 116.691925][ T6062] n_hdlc_tty_open+0x257/0x520 [ 116.691959][ T6062] ? __pfx_n_hdlc_tty_open+0x10/0x10 [ 116.691994][ T6062] tty_ldisc_open+0xa2/0x120 [ 116.692026][ T6062] tty_set_ldisc+0x325/0x740 [ 116.692062][ T6062] tty_ioctl+0x699/0x1870 [ 116.692085][ T6062] ? __pfx_tty_ioctl+0x10/0x10 [ 116.692105][ T6062] ? ioctl_has_perm.constprop.0.isra.0+0x37d/0x530 [ 116.692130][ T6062] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 116.692155][ T6062] ? __fget_files+0x34/0x3d0 [ 116.692192][ T6062] ? selinux_file_ioctl+0x1e0/0x290 [ 116.692210][ T6062] ? selinux_file_ioctl+0x1e7/0x290 [ 116.692230][ T6062] ? __pfx_tty_ioctl+0x10/0x10 [ 116.692252][ T6062] __x64_sys_ioctl+0x18e/0x210 [ 116.692276][ T6062] do_syscall_64+0x123/0x790 [ 116.692306][ T6062] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.692328][ T6062] RIP: 0033:0x7feab959fb19 [ 116.692347][ T6062] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 116.692364][ T6062] RSP: 002b:00007feaba502028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 116.692385][ T6062] RAX: ffffffffffffffda RBX: 00007feab9825fa0 RCX: 00007feab959fb19 [ 116.692397][ T6062] RDX: 0000200000001c40 RSI: 0000000000005423 RDI: 0000000000000007 [ 116.692408][ T6062] RBP: 00007feab9637b70 R08: 0000000000000000 R09: 0000000000000000 [ 116.692419][ T6062] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 116.692429][ T6062] R13: 00007feab9826038 R14: 00007feab9825fa0 R15: 00007fffdf59d358 [ 116.692454][ T6062] [ 116.898751][ T29] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 117.070338][ T29] usb 7-1: New USB device found: idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 117.071371][ T29] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 117.071401][ T29] usb 7-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 117.071430][ T29] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 117.076436][ T6060] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 117.109115][ T29] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 117.952017][ T5950] usb 8-1: USB disconnect, device number 3 [ 117.962210][ T5995] usb 7-1: USB disconnect, device number 2 [ 118.279361][ T5892] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 118.435136][ T5892] usb 6-1: Using ep0 maxpacket: 32 [ 118.437284][ T5892] usb 6-1: unable to get BOS descriptor or descriptor too short [ 118.437329][ T5892] usb 6-1: New USB device found: idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 118.443489][ T5892] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 118.443512][ T5892] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 118.443527][ T5892] usb 6-1: config 14 has no interface number 0 [ 118.443537][ T5892] usb 6-1: config 14 has no interface number 1 [ 118.443579][ T5892] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 118.443595][ T5892] usb 6-1: config 14 interface 228 altsetting 5 has an invalid endpoint descriptor of length 6, skipping [ 118.443611][ T5892] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 118.443629][ T5892] usb 6-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 118.443647][ T5892] usb 6-1: config 14 interface 57 has no altsetting 0 [ 118.443659][ T5892] usb 6-1: config 14 interface 228 has no altsetting 0 [ 118.461287][ T5892] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 118.461311][ T5892] usb 6-1: Product: syz [ 118.461324][ T5892] usb 6-1: Manufacturer: syz [ 118.461335][ T5892] usb 6-1: SerialNumber: syz [ 118.668384][ T24] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 118.677838][ T42] kauditd_printk_skb: 38 callbacks suppressed [ 118.677857][ T42] audit: type=1400 audit(1793921715.038:295): avc: denied { unlink } for pid=6089 comm="syz.2.39" name="#1" dev="tmpfs" ino=97 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 118.704042][ T42] audit: type=1400 audit(1793921715.068:296): avc: denied { mount } for pid=6089 comm="syz.2.39" name="/" dev="overlay" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 118.879042][ T24] usb 8-1: Using ep0 maxpacket: 32 [ 118.920903][ T24] usb 8-1: unable to get BOS descriptor or descriptor too short [ 118.920955][ T24] usb 8-1: New USB device found: idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 118.921953][ T24] usb 8-1: config 14 has an invalid interface number: 57 but max is 1 [ 118.921977][ T24] usb 8-1: config 14 has an invalid interface number: 228 but max is 1 [ 118.921995][ T24] usb 8-1: config 14 has no interface number 0 [ 118.922010][ T24] usb 8-1: config 14 has no interface number 1 [ 118.922063][ T24] usb 8-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 118.922084][ T24] usb 8-1: config 14 interface 228 altsetting 5 has an invalid endpoint descriptor of length 5, skipping [ 118.922105][ T24] usb 8-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 118.922128][ T24] usb 8-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 118.922152][ T24] usb 8-1: config 14 interface 57 has no altsetting 0 [ 118.922168][ T24] usb 8-1: config 14 interface 228 has no altsetting 0 [ 118.924485][ T24] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 118.924507][ T24] usb 8-1: Product: syz [ 118.924520][ T24] usb 8-1: Manufacturer: syz [ 118.924533][ T24] usb 8-1: SerialNumber: syz [ 118.928800][ T5892] legousbtower 6-1:14.57: interrupt endpoints not found [ 119.121426][ T6085] syz.0.37 (6085): drop_caches: 2 [ 119.133319][ T5892] legousbtower 6-1:14.228: interrupt endpoints not found [ 119.255078][ T6094] FAULT_INJECTION: forcing a failure. [ 119.255078][ T6094] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 119.255107][ T6094] CPU: 1 UID: 0 PID: 6094 Comm: syz.0.41 Not tainted syzkaller #0 PREEMPT(full) [ 119.255129][ T6094] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 119.255140][ T6094] Call Trace: [ 119.255146][ T6094] [ 119.255154][ T6094] dump_stack_lvl+0x100/0x190 [ 119.255203][ T6094] should_fail_ex.cold+0x5/0xa [ 119.255321][ T6094] _copy_from_user+0x2e/0xd0 [ 119.255408][ T6094] copy_msghdr_from_user+0x9f/0x4c0 [ 119.255437][ T6094] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 119.255467][ T6094] ? lock_acquire+0x1d1/0x380 [ 119.255491][ T6094] ? get_pid_task+0x2a/0x250 [ 119.255509][ T6094] ___sys_sendmsg+0x106/0x1e0 [ 119.255535][ T6094] ? __pfx____sys_sendmsg+0x10/0x10 [ 119.255560][ T6094] ? get_pid_task+0x106/0x250 [ 119.255583][ T6094] ? find_held_lock+0x2b/0x80 [ 119.255616][ T6094] __sys_sendmsg+0x160/0x210 [ 119.255637][ T6094] ? __pfx___sys_sendmsg+0x10/0x10 [ 119.255669][ T6094] do_syscall_64+0x123/0x790 [ 119.255692][ T6094] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.255710][ T6094] RIP: 0033:0x7feab959fb19 [ 119.255726][ T6094] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 119.255742][ T6094] RSP: 002b:00007feaba502028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 119.255760][ T6094] RAX: ffffffffffffffda RBX: 00007feab9825fa0 RCX: 00007feab959fb19 [ 119.255771][ T6094] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000005 [ 119.255781][ T6094] RBP: 00007feaba502090 R08: 0000000000000000 R09: 0000000000000000 [ 119.255791][ T6094] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 119.255801][ T6094] R13: 00007feab9826038 R14: 00007feab9825fa0 R15: 00007fffdf59d358 [ 119.255822][ T6094] [ 119.312172][ T67] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 119.373140][ T5892] usb 6-1: USB disconnect, device number 3 [ 119.423085][ T24] legousbtower 8-1:14.57: interrupt endpoints not found [ 119.483423][ T67] usb 7-1: Using ep0 maxpacket: 32 [ 119.484210][ T67] usb 7-1: New USB device found: idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 119.485225][ T67] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 119.487191][ T67] usb 7-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 119.487212][ T67] usb 7-1: Product: syz [ 119.487250][ T67] usb 7-1: Manufacturer: syz [ 119.487263][ T67] usb 7-1: SerialNumber: syz [ 119.541458][ T67] usb 7-1: config 0 descriptor?? [ 119.557199][ T6092] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 119.568487][ T67] hub 7-1:0.0: bad descriptor, ignoring hub [ 119.568516][ T67] hub 7-1:0.0: probe with driver hub failed with error -5 [ 119.570172][ T5893] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 119.623324][ T24] legousbtower 8-1:14.228: interrupt endpoints not found [ 119.759130][ T5893] usb 5-1: Using ep0 maxpacket: 32 [ 119.760359][ T5893] usb 5-1: New USB device found: idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 119.766542][ T5893] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 119.777699][ T5893] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 119.777723][ T5893] usb 5-1: Product: syz [ 119.777734][ T5893] usb 5-1: Manufacturer: syz [ 119.777746][ T5893] usb 5-1: SerialNumber: syz [ 119.788501][ T5893] usb 5-1: config 0 descriptor?? [ 119.794345][ T6096] raw-gadget.3 gadget.0: fail, usb_ep_enable returned -22 [ 119.796512][ T5893] hub 5-1:0.0: bad descriptor, ignoring hub [ 119.796534][ T5893] hub 5-1:0.0: probe with driver hub failed with error -5 [ 119.810079][ T5893] chaoskey 5-1:0.0: Unable to register with hwrng [ 120.244423][ T6104] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 120.244983][ T6104] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 120.340417][ T6102] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 120.341693][ T6102] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 120.630743][ T6107] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 120.631330][ T6107] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 120.941825][ T5995] usb 5-1: USB disconnect, device number 3 [ 121.442263][ T6117] syz.1.49 (6117): drop_caches: 2 [ 121.737885][ T42] audit: type=1400 audit(1793921718.098:297): avc: denied { connect } for pid=6119 comm="syz.1.50" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 121.817496][ T982] usb 8-1: USB disconnect, device number 4 [ 122.089133][ T5908] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 122.239092][ T5908] usb 6-1: Using ep0 maxpacket: 32 [ 122.242385][ T5908] usb 6-1: unable to get BOS descriptor or descriptor too short [ 122.242434][ T5908] usb 6-1: New USB device found: idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 122.243898][ T5908] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 122.243923][ T5908] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 122.243940][ T5908] usb 6-1: config 14 has no interface number 0 [ 122.243954][ T5908] usb 6-1: config 14 has no interface number 1 [ 122.244002][ T5908] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 122.244023][ T5908] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 122.244046][ T5908] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 122.244068][ T5908] usb 6-1: config 14 interface 228 altsetting 5 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 122.244090][ T5908] usb 6-1: config 14 interface 57 has no altsetting 0 [ 122.244106][ T5908] usb 6-1: config 14 interface 228 has no altsetting 0 [ 122.246471][ T5908] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 122.246496][ T5908] usb 6-1: Product: syz [ 122.246508][ T5908] usb 6-1: Manufacturer: syz [ 122.246521][ T5908] usb 6-1: SerialNumber: syz [ 122.661633][ T5908] legousbtower 6-1:14.57: interrupt endpoints not found [ 122.865091][ T5908] legousbtower 6-1:14.228: interrupt endpoints not found [ 123.841574][ T5893] usb 7-1: USB disconnect, device number 3 [ 124.236131][ T42] audit: type=1400 audit(1793921720.598:298): avc: denied { write } for pid=6135 comm="syz.2.57" name="functions" dev="configfs" ino=8848 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 124.271454][ T42] audit: type=1400 audit(1793921720.628:299): avc: denied { write } for pid=6135 comm="syz.2.57" name="extensions" dev="configfs" ino=8066 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 124.404132][ T6138] syz.3.58 (6138): drop_caches: 2 [ 124.547891][ T6141] Bluetooth: hci4: received HCILL_GO_TO_SLEEP_ACK in state 2 [ 124.557924][ T56] Bluetooth: hci4: Frame reassembly failed (-84) [ 124.878247][ T67] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 125.030043][ T5892] usb 6-1: USB disconnect, device number 5 [ 125.089171][ T67] usb 5-1: Using ep0 maxpacket: 32 [ 125.093278][ T67] usb 5-1: New USB device found: idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 125.094309][ T67] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 125.096284][ T67] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 125.096305][ T67] usb 5-1: Product: syz [ 125.096316][ T67] usb 5-1: Manufacturer: syz [ 125.096328][ T67] usb 5-1: SerialNumber: syz [ 125.123721][ T6150] FAULT_INJECTION: forcing a failure. [ 125.123721][ T6150] name failslab, interval 1, probability 0, space 0, times 0 [ 125.123746][ T6150] CPU: 3 UID: 0 PID: 6150 Comm: syz.3.61 Not tainted syzkaller #0 PREEMPT(full) [ 125.123764][ T6150] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 125.123773][ T6150] Call Trace: [ 125.123778][ T6150] [ 125.123785][ T6150] dump_stack_lvl+0x100/0x190 [ 125.123818][ T6150] should_fail_ex.cold+0x5/0xa [ 125.123843][ T6150] should_failslab+0xc2/0x120 [ 125.123862][ T6150] __kmalloc_cache_noprof+0x91/0x6d0 [ 125.123885][ T6150] ? packet_sendmsg+0x27ec/0x4f80 [ 125.123908][ T6150] packet_sendmsg+0x27ec/0x4f80 [ 125.123943][ T6150] ? __pfx_packet_sendmsg+0x10/0x10 [ 125.123966][ T6150] ? selinux_socket_sendmsg+0x198/0x2f0 [ 125.123992][ T6150] sock_write_iter+0x560/0x5d0 [ 125.124016][ T6150] ? __pfx_packet_sendmsg+0x10/0x10 [ 125.124032][ T6150] ? __pfx_sock_write_iter+0x10/0x10 [ 125.124061][ T6150] ? bpf_lsm_file_permission+0x9/0x10 [ 125.124084][ T6150] ? security_file_permission+0x76/0x210 [ 125.124102][ T6150] ? rw_verify_area+0xce/0x6d0 [ 125.124128][ T6150] vfs_write+0x6af/0x1050 [ 125.124145][ T6150] ? __pfx_sock_write_iter+0x10/0x10 [ 125.124170][ T6150] ? __pfx_vfs_write+0x10/0x10 [ 125.124185][ T6150] ? find_held_lock+0x2b/0x80 [ 125.124216][ T6150] ksys_write+0x1f8/0x250 [ 125.124232][ T6150] ? __pfx_ksys_write+0x10/0x10 [ 125.124254][ T6150] do_syscall_64+0x123/0x790 [ 125.124274][ T6150] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.124295][ T6150] RIP: 0033:0x7fc40d39fb19 [ 125.124310][ T6150] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 125.124324][ T6150] RSP: 002b:00007fc40e213028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 125.124340][ T6150] RAX: ffffffffffffffda RBX: 00007fc40d625fa0 RCX: 00007fc40d39fb19 [ 125.124350][ T6150] RDX: 0000000000000009 RSI: 0000200000000000 RDI: 0000000000000003 [ 125.124358][ T6150] RBP: 00007fc40e213090 R08: 0000000000000000 R09: 0000000000000000 [ 125.124368][ T6150] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 125.124377][ T6150] R13: 00007fc40d626038 R14: 00007fc40d625fa0 R15: 00007ffe1183d728 [ 125.124398][ T6150] [ 125.124649][ T67] usb 5-1: config 0 descriptor?? [ 125.125542][ T6146] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 125.126650][ T67] hub 5-1:0.0: bad descriptor, ignoring hub [ 125.126671][ T67] hub 5-1:0.0: probe with driver hub failed with error -5 [ 125.264094][ T42] audit: type=1400 audit(1793921721.628:300): avc: denied { search } for pid=6151 comm="syz.1.62" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 125.264143][ T42] audit: type=1400 audit(1793921721.628:301): avc: denied { read write } for pid=6151 comm="syz.1.62" name="set_event" dev="tracefs" ino=5396 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 125.264954][ T42] audit: type=1400 audit(1793921721.628:302): avc: denied { open } for pid=6151 comm="syz.1.62" path="/13/trace/set_event" dev="tracefs" ino=5396 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 125.499554][ T5995] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 125.629160][ T10] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 125.649010][ T5995] usb 8-1: Using ep0 maxpacket: 32 [ 125.649862][ T5995] usb 8-1: New USB device found: idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 125.653549][ T5995] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 125.655731][ T5995] usb 8-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 125.655754][ T5995] usb 8-1: Product: syz [ 125.655766][ T5995] usb 8-1: Manufacturer: syz [ 125.655779][ T5995] usb 8-1: SerialNumber: syz [ 125.660453][ T5995] usb 8-1: config 0 descriptor?? [ 125.661218][ T6156] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 125.662424][ T5995] hub 8-1:0.0: bad descriptor, ignoring hub [ 125.662445][ T5995] hub 8-1:0.0: probe with driver hub failed with error -5 [ 125.671516][ T5995] chaoskey 8-1:0.0: Unable to register with hwrng [ 125.779086][ T10] usb 6-1: Using ep0 maxpacket: 32 [ 125.785698][ T10] usb 6-1: unable to get BOS descriptor or descriptor too short [ 125.785747][ T10] usb 6-1: New USB device found: idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 125.787411][ T10] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 125.787438][ T10] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 125.787460][ T10] usb 6-1: config 14 has no interface number 0 [ 125.787477][ T10] usb 6-1: config 14 has no interface number 1 [ 125.787535][ T10] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 125.787561][ T10] usb 6-1: config 14 interface 228 altsetting 5 has an invalid endpoint descriptor of length 5, skipping [ 125.787584][ T10] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 125.787610][ T10] usb 6-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 125.787637][ T10] usb 6-1: config 14 interface 57 has no altsetting 0 [ 125.787657][ T10] usb 6-1: config 14 interface 228 has no altsetting 0 [ 125.791626][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 125.791649][ T10] usb 6-1: Product: syz [ 125.791660][ T10] usb 6-1: Manufacturer: syz [ 125.791671][ T10] usb 6-1: SerialNumber: syz [ 125.967003][ T6161] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 125.967723][ T6161] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 126.100986][ T226] raw-gadget.1 gadget.0: failed to queue suspend event [ 126.170206][ T6161] raw-gadget.1 gadget.0: failed to queue disconnect event [ 126.186882][ T6156] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 126.187725][ T6156] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 126.214015][ T10] legousbtower 6-1:14.57: interrupt endpoints not found [ 126.426993][ T10] legousbtower 6-1:14.228: interrupt endpoints not found [ 126.444373][ T6163] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 126.444727][ T6163] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 126.573628][ T5818] Bluetooth: hci4: command 0x1003 tx timeout [ 126.575509][ T72] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 126.759346][ T2358] usb 8-1: USB disconnect, device number 5 [ 128.608036][ T10] usb 6-1: USB disconnect, device number 6 [ 128.699499][ T24] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 128.856097][ T24] usb 7-1: Using ep0 maxpacket: 32 [ 128.875828][ T24] usb 7-1: unable to get BOS descriptor or descriptor too short [ 128.875875][ T24] usb 7-1: New USB device found: idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 128.876871][ T24] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 128.876892][ T24] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 128.876909][ T24] usb 7-1: config 14 has no interface number 0 [ 128.876922][ T24] usb 7-1: config 14 has no interface number 1 [ 128.876967][ T24] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 128.876987][ T24] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 128.877008][ T24] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 128.877030][ T24] usb 7-1: config 14 interface 228 altsetting 5 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 128.877052][ T24] usb 7-1: config 14 interface 57 has no altsetting 0 [ 128.877067][ T24] usb 7-1: config 14 interface 228 has no altsetting 0 [ 128.879969][ T24] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 128.879992][ T24] usb 7-1: Product: syz [ 128.880004][ T24] usb 7-1: Manufacturer: syz [ 128.880015][ T24] usb 7-1: SerialNumber: syz [ 129.299695][ T24] legousbtower 7-1:14.57: interrupt endpoints not found [ 129.500515][ T24] legousbtower 7-1:14.228: interrupt endpoints not found [ 129.618131][ T5950] usb 5-1: USB disconnect, device number 4 [ 129.789598][ T6185] netlink: 4 bytes leftover after parsing attributes in process `syz.3.73'. [ 129.871724][ T6187] FAULT_INJECTION: forcing a failure. [ 129.871724][ T6187] name failslab, interval 1, probability 0, space 0, times 0 [ 129.871753][ T6187] CPU: 2 UID: 0 PID: 6187 Comm: syz.3.74 Not tainted syzkaller #0 PREEMPT(full) [ 129.871772][ T6187] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 129.871783][ T6187] Call Trace: [ 129.871789][ T6187] [ 129.871796][ T6187] dump_stack_lvl+0x100/0x190 [ 129.871832][ T6187] should_fail_ex.cold+0x5/0xa [ 129.871861][ T6187] should_failslab+0xc2/0x120 [ 129.871887][ T6187] __kmalloc_noprof+0xfc/0x840 [ 129.871915][ T6187] ? genl_family_rcv_msg_attrs_parse.isra.0+0x100/0x2f0 [ 129.871948][ T6187] genl_family_rcv_msg_attrs_parse.isra.0+0x100/0x2f0 [ 129.871980][ T6187] genl_family_rcv_msg_doit+0xc7/0x300 [ 129.872009][ T6187] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 129.872046][ T6187] ? bpf_lsm_capable+0x9/0x10 [ 129.872064][ T6187] ? security_capable+0x80/0x260 [ 129.872091][ T6187] ? ns_capable+0xcd/0xf0 [ 129.872114][ T6187] genl_rcv_msg+0x560/0x800 [ 129.872144][ T6187] ? __pfx_genl_rcv_msg+0x10/0x10 [ 129.872171][ T6187] ? __lock_acquire+0x5c0/0x1f40 [ 129.872196][ T6187] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 129.872226][ T6187] ? __pfx_nl80211_start_ap+0x10/0x10 [ 129.872254][ T6187] ? __pfx_nl80211_post_doit+0x10/0x10 [ 129.872292][ T6187] netlink_rcv_skb+0x159/0x420 [ 129.872317][ T6187] ? __pfx_genl_rcv_msg+0x10/0x10 [ 129.872344][ T6187] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 129.872380][ T6187] ? netlink_deliver_tap+0x1ae/0xb50 [ 129.872408][ T6187] genl_rcv+0x28/0x40 [ 129.872434][ T6187] netlink_unicast+0x668/0x950 [ 129.872462][ T6187] ? __pfx_netlink_unicast+0x10/0x10 [ 129.872492][ T6187] netlink_sendmsg+0x9ac/0x10c0 [ 129.872521][ T6187] ? __pfx_netlink_sendmsg+0x10/0x10 [ 129.872551][ T6187] ? selinux_socket_sendmsg+0x198/0x2f0 [ 129.872581][ T6187] ? ____sys_sendmsg+0xa99/0xc30 [ 129.872608][ T6187] ____sys_sendmsg+0xa99/0xc30 [ 129.872633][ T6187] ? __pfx_netlink_sendmsg+0x10/0x10 [ 129.872660][ T6187] ? __pfx_____sys_sendmsg+0x10/0x10 [ 129.872693][ T6187] ? lock_acquire+0x1d1/0x380 [ 129.872716][ T6187] ? get_pid_task+0x2a/0x250 [ 129.872737][ T6187] ___sys_sendmsg+0x190/0x1e0 [ 129.872767][ T6187] ? __pfx____sys_sendmsg+0x10/0x10 [ 129.872795][ T6187] ? get_pid_task+0x106/0x250 [ 129.872823][ T6187] ? find_held_lock+0x2b/0x80 [ 129.872862][ T6187] __sys_sendmsg+0x160/0x210 [ 129.872886][ T6187] ? __pfx___sys_sendmsg+0x10/0x10 [ 129.872922][ T6187] do_syscall_64+0x123/0x790 [ 129.872948][ T6187] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.872969][ T6187] RIP: 0033:0x7fc40d39fb19 [ 129.872987][ T6187] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 129.873004][ T6187] RSP: 002b:00007fc40e213028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 129.873024][ T6187] RAX: ffffffffffffffda RBX: 00007fc40d625fa0 RCX: 00007fc40d39fb19 [ 129.873036][ T6187] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 129.873047][ T6187] RBP: 00007fc40e213090 R08: 0000000000000000 R09: 0000000000000000 [ 129.873058][ T6187] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 129.873069][ T6187] R13: 00007fc40d626038 R14: 00007fc40d625fa0 R15: 00007ffe1183d728 [ 129.873094][ T6187] [ 129.926203][ T6191] FAULT_INJECTION: forcing a failure. [ 129.926203][ T6191] name failslab, interval 1, probability 0, space 0, times 0 [ 129.926235][ T6191] CPU: 0 UID: 0 PID: 6191 Comm: syz.3.76 Not tainted syzkaller #0 PREEMPT(full) [ 129.926255][ T6191] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 129.926266][ T6191] Call Trace: [ 129.926272][ T6191] [ 129.926279][ T6191] dump_stack_lvl+0x100/0x190 [ 129.926315][ T6191] should_fail_ex.cold+0x5/0xa [ 129.926343][ T6191] should_failslab+0xc2/0x120 [ 129.926365][ T6191] __kmalloc_cache_noprof+0x91/0x6d0 [ 129.926389][ T6191] ? trace_contention_end+0x126/0x160 [ 129.926415][ T6191] ? ubi_attach_mtd_dev+0x3bd/0x3420 [ 129.926440][ T6191] ubi_attach_mtd_dev+0x3bd/0x3420 [ 129.926465][ T6191] ? __radix_tree_lookup+0x217/0x2b0 [ 129.926491][ T6191] ? __pfx_ubi_attach_mtd_dev+0x10/0x10 [ 129.926511][ T6191] ? __pfx_get_mtd_device+0x10/0x10 [ 129.926544][ T6191] ctrl_cdev_ioctl+0x375/0x410 [ 129.926691][ T6191] ? __pfx_ctrl_cdev_ioctl+0x10/0x10 [ 129.926714][ T6191] ? selinux_file_ioctl+0x1e0/0x290 [ 129.926732][ T6191] ? selinux_file_ioctl+0x1e7/0x290 [ 129.926756][ T6191] ? __pfx_ctrl_cdev_ioctl+0x10/0x10 [ 129.926778][ T6191] __x64_sys_ioctl+0x18e/0x210 [ 129.926799][ T6191] do_syscall_64+0x123/0x790 [ 129.926822][ T6191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.926841][ T6191] RIP: 0033:0x7fc40d39fb19 [ 129.926862][ T6191] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 129.926878][ T6191] RSP: 002b:00007fc40e213028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 129.926896][ T6191] RAX: ffffffffffffffda RBX: 00007fc40d625fa0 RCX: 00007fc40d39fb19 [ 129.926908][ T6191] RDX: 0000200000000100 RSI: 0000000040186f40 RDI: 0000000000000003 [ 129.926919][ T6191] RBP: 00007fc40e213090 R08: 0000000000000000 R09: 0000000000000000 [ 129.926931][ T6191] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 129.926941][ T6191] R13: 00007fc40d626038 R14: 00007fc40d625fa0 R15: 00007ffe1183d728 [ 129.926966][ T6191] [ 130.349141][ T2358] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 130.508989][ T2358] usb 8-1: Using ep0 maxpacket: 32 [ 130.510294][ T2358] usb 8-1: New USB device found: idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 130.511899][ T2358] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 130.515073][ T2358] usb 8-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 130.515093][ T2358] usb 8-1: Product: syz [ 130.515102][ T2358] usb 8-1: Manufacturer: syz [ 130.515110][ T2358] usb 8-1: SerialNumber: syz [ 130.517448][ T2358] usb 8-1: config 0 descriptor?? [ 130.520101][ T6198] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 130.525649][ T2358] hub 8-1:0.0: bad descriptor, ignoring hub [ 130.525672][ T2358] hub 8-1:0.0: probe with driver hub failed with error -5 [ 130.559715][ T42] audit: type=1400 audit(1793921726.918:303): avc: denied { read write } for pid=6201 comm="syz.1.80" name="sg5" dev="devtmpfs" ino=1301 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 130.560374][ T42] audit: type=1400 audit(1793921726.918:304): avc: denied { open } for pid=6201 comm="syz.1.80" path="/dev/sg5" dev="devtmpfs" ino=1301 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 130.562976][ T42] audit: type=1400 audit(1793921726.928:305): avc: denied { ioctl } for pid=6201 comm="syz.1.80" path="/dev/sg5" dev="devtmpfs" ino=1301 ioctlcmd=0x5393 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 130.688267][ T42] audit: type=1400 audit(1793921727.018:306): avc: denied { mount } for pid=6207 comm="syz.0.81" name="/" dev="9p" ino=71827803 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 130.719961][ T42] audit: type=1400 audit(1793921727.068:307): avc: denied { write } for pid=6207 comm="syz.0.81" name="/" dev="9p" ino=71827803 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 130.733197][ T42] audit: type=1400 audit(1793921727.098:308): avc: denied { remove_name } for pid=6207 comm="syz.0.81" name="file0" dev="9p" ino=71827805 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 130.753466][ T42] audit: type=1400 audit(1793921727.098:309): avc: denied { unlink } for pid=6207 comm="syz.0.81" name="file0" dev="9p" ino=71827805 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 130.780918][ T42] audit: type=1400 audit(1793921727.148:310): avc: denied { write } for pid=6207 comm="syz.0.81" name="/" dev="9p" ino=71827803 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 130.781656][ T42] audit: type=1400 audit(1793921727.148:311): avc: denied { add_name } for pid=6207 comm="syz.0.81" name="file1" dev="9p" ino=71827807 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 130.784213][ T42] audit: type=1400 audit(1793921727.148:312): avc: denied { link } for pid=6207 comm="syz.0.81" name="file1" dev="9p" ino=71827807 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 131.222425][ T5907] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 131.366931][ T6219] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 131.367334][ T6219] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 131.429139][ T5907] usb 6-1: Using ep0 maxpacket: 32 [ 131.430217][ T5907] usb 6-1: New USB device found: idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 131.431221][ T5907] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 131.433914][ T5907] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 131.433938][ T5907] usb 6-1: Product: syz [ 131.433952][ T5907] usb 6-1: Manufacturer: syz [ 131.433966][ T5907] usb 6-1: SerialNumber: syz [ 131.436500][ T5907] usb 6-1: config 0 descriptor?? [ 131.438164][ T6214] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 131.439537][ T5907] hub 6-1:0.0: bad descriptor, ignoring hub [ 131.439559][ T5907] hub 6-1:0.0: probe with driver hub failed with error -5 [ 131.465563][ T5907] chaoskey 6-1:0.0: Unable to register with hwrng [ 131.512476][ T29] usb 7-1: USB disconnect, device number 4 [ 131.539495][ T69] raw-gadget.0 gadget.3: failed to queue suspend event [ 131.579656][ T10] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 131.598381][ T6211] raw-gadget.0 gadget.3: failed to queue disconnect event [ 131.739195][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 131.746182][ T10] usb 5-1: unable to get BOS descriptor or descriptor too short [ 131.746225][ T10] usb 5-1: New USB device found: idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 131.756178][ T10] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 131.756204][ T10] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 131.756220][ T10] usb 5-1: config 14 has no interface number 0 [ 131.756233][ T10] usb 5-1: config 14 has no interface number 1 [ 131.756283][ T10] usb 5-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 131.756302][ T10] usb 5-1: config 14 interface 228 altsetting 5 has an invalid endpoint descriptor of length 6, skipping [ 131.756321][ T10] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 131.756342][ T10] usb 5-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 131.756364][ T10] usb 5-1: config 14 interface 57 has no altsetting 0 [ 131.756378][ T10] usb 5-1: config 14 interface 228 has no altsetting 0 [ 131.774158][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 131.774184][ T10] usb 5-1: Product: syz [ 131.774196][ T10] usb 5-1: Manufacturer: syz [ 131.774208][ T10] usb 5-1: SerialNumber: syz [ 131.982903][ T6224] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 131.983326][ T6224] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 132.274649][ T10] legousbtower 5-1:14.57: interrupt endpoints not found [ 132.320917][ T6231] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 132.322734][ T6231] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 132.474653][ T10] legousbtower 5-1:14.228: interrupt endpoints not found [ 132.619049][ T29] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 132.639135][ T5900] usb 6-1: USB disconnect, device number 7 [ 132.779543][ T29] usb 7-1: Using ep0 maxpacket: 8 [ 132.780558][ T29] usb 7-1: New USB device found: idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 132.781613][ T29] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 132.781634][ T29] usb 7-1: config 0 has no interface number 0 [ 132.781664][ T29] usb 7-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 132.781693][ T29] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 132.784185][ T29] usb 7-1: config 0 descriptor?? [ 132.830286][ T29] iowarrior 7-1:0.1: no interrupt-in endpoint found [ 134.660746][ T5892] usb 5-1: USB disconnect, device number 5 [ 134.950220][ T67] usb 8-1: USB disconnect, device number 6 [ 135.045400][ T5892] usb 7-1: USB disconnect, device number 5 [ 135.212749][ T6248] netlink: 'syz.1.91': attribute type 11 has an invalid length. [ 135.300931][ T6251] FAULT_INJECTION: forcing a failure. [ 135.300931][ T6251] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 135.300960][ T6251] CPU: 3 UID: 0 PID: 6251 Comm: syz.3.92 Not tainted syzkaller #0 PREEMPT(full) [ 135.300982][ T6251] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 135.300993][ T6251] Call Trace: [ 135.300999][ T6251] [ 135.301007][ T6251] dump_stack_lvl+0x100/0x190 [ 135.301045][ T6251] should_fail_ex.cold+0x5/0xa [ 135.301075][ T6251] should_fail_alloc_page+0xeb/0x140 [ 135.301100][ T6251] prepare_alloc_pages+0x1f0/0x5b0 [ 135.301126][ T6251] __alloc_frozen_pages_noprof+0x1ae/0x31e0 [ 135.301155][ T6251] ? __pfx_get_page_from_freelist+0x10/0x10 [ 135.301185][ T6251] ? rcu_is_watching+0x13/0xc0 [ 135.301208][ T6251] ? trace_mm_page_alloc+0x164/0x1c0 [ 135.301231][ T6251] ? __alloc_frozen_pages_noprof+0x2f1/0x31e0 [ 135.301260][ T6251] ? do_raw_spin_lock+0x128/0x260 [ 135.301280][ T6251] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 135.301313][ T6251] ? mark_held_locks+0x40/0x70 [ 135.301351][ T6251] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 135.301373][ T6251] ? lockdep_hardirqs_on+0x7d/0x110 [ 135.301394][ T6251] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 135.301413][ T6251] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 135.301445][ T6251] ? __kasan_slab_alloc+0x89/0x90 [ 135.301466][ T6251] ? kmem_cache_alloc_node_noprof+0x282/0x6e0 [ 135.301495][ T6251] ? alloc_vmap_area+0x643/0x2bc0 [ 135.301524][ T6251] ? __get_vm_area_node+0x1ed/0x350 [ 135.301542][ T6251] ? __vmalloc_node_range_noprof+0x2ad/0x1440 [ 135.301564][ T6251] ? __vmalloc_node_noprof+0xad/0xf0 [ 135.301584][ T6251] ? dev_ethtool+0x5b9e/0x6cb0 [ 135.301603][ T6251] ? dev_ioctl+0x63b/0x10e0 [ 135.301627][ T6251] ? sock_do_ioctl+0x1a0/0x280 [ 135.301653][ T6251] ? sock_ioctl+0x599/0x6b0 [ 135.301680][ T6251] ? __x64_sys_ioctl+0x18e/0x210 [ 135.301698][ T6251] ? do_syscall_64+0x123/0x790 [ 135.301719][ T6251] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.301747][ T6251] alloc_pages_bulk_noprof+0x5f0/0x1480 [ 135.301782][ T6251] ? policy_nodemask+0xed/0x5e0 [ 135.301810][ T6251] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 135.301852][ T6251] __kasan_populate_vmalloc+0xf0/0x210 [ 135.301890][ T6251] alloc_vmap_area+0x963/0x2bc0 [ 135.301958][ T6251] ? kasan_save_track+0x14/0x30 [ 135.301978][ T6251] ? __kasan_kmalloc+0xaa/0xb0 [ 135.301996][ T6251] ? __pfx_alloc_vmap_area+0x10/0x10 [ 135.302025][ T6251] ? __lock_acquire+0x5c0/0x1f40 [ 135.302049][ T6251] ? __get_vm_area_node+0x124/0x350 [ 135.302071][ T6251] __get_vm_area_node+0x1ed/0x350 [ 135.302095][ T6251] __vmalloc_node_range_noprof+0x2ad/0x1440 [ 135.302117][ T6251] ? dev_ethtool+0x5b9e/0x6cb0 [ 135.302144][ T6251] ? dev_ethtool+0x5b9e/0x6cb0 [ 135.302167][ T6251] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 135.302188][ T6251] ? __might_fault+0xc5/0x140 [ 135.302210][ T6251] ? __might_fault+0xc5/0x140 [ 135.302230][ T6251] ? __might_fault+0xc5/0x140 [ 135.302254][ T6251] ? dev_ethtool+0x5b9e/0x6cb0 [ 135.302270][ T6251] __vmalloc_node_noprof+0xad/0xf0 [ 135.302291][ T6251] ? dev_ethtool+0x5b9e/0x6cb0 [ 135.302311][ T6251] dev_ethtool+0x5b9e/0x6cb0 [ 135.302328][ T6251] ? bpf_ksym_find+0x128/0x1c0 [ 135.302365][ T6251] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 135.302400][ T6251] ? __pfx_dev_ethtool+0x10/0x10 [ 135.302461][ T6251] ? tomoyo_path_number_perm+0x46d/0x580 [ 135.302492][ T6251] ? stack_trace_save+0x8e/0xc0 [ 135.302517][ T6251] ? __pfx_stack_trace_save+0x10/0x10 [ 135.302543][ T6251] ? stack_depot_save_flags+0x27/0xa10 [ 135.302573][ T6251] ? __lock_acquire+0x5c0/0x1f40 [ 135.302600][ T6251] ? __lock_acquire+0x5c0/0x1f40 [ 135.302626][ T6251] ? __kasan_slab_free+0x5f/0x80 [ 135.302644][ T6251] ? kfree+0x22b/0x6d0 [ 135.302666][ T6251] ? tomoyo_path_number_perm+0x46d/0x580 [ 135.302691][ T6251] ? security_file_ioctl+0xd3/0x230 [ 135.302719][ T6251] ? __x64_sys_ioctl+0xb7/0x210 [ 135.302736][ T6251] ? do_syscall_64+0x123/0x790 [ 135.302756][ T6251] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.303598][ T6251] ? lock_acquire+0x1d1/0x380 [ 135.303633][ T6251] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 135.303666][ T6251] ? udp_ioctl+0x3d/0x150 [ 135.303696][ T6251] ? sk_ioctl+0x173/0x360 [ 135.303730][ T6251] ? __lock_acquire+0x5c0/0x1f40 [ 135.303755][ T6251] ? inet_ioctl+0x1ad/0x3f0 [ 135.303776][ T6251] ? __pfx_inet_ioctl+0x10/0x10 [ 135.303800][ T6251] ? lock_acquire+0x1d1/0x380 [ 135.303824][ T6251] ? dev_load+0x2a/0x240 [ 135.303847][ T6251] ? find_held_lock+0x2b/0x80 [ 135.303866][ T6251] ? dev_load+0x8e/0x240 [ 135.303887][ T6251] ? dev_load+0x8e/0x240 [ 135.303914][ T6251] dev_ioctl+0x63b/0x10e0 [ 135.303940][ T6251] sock_do_ioctl+0x1a0/0x280 [ 135.303968][ T6251] ? __pfx_sock_do_ioctl+0x10/0x10 [ 135.303993][ T6251] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 135.304025][ T6251] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 135.304042][ T6251] ? ioctl_has_perm.constprop.0.isra.0+0x37d/0x530 [ 135.304062][ T6251] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 135.304085][ T6251] sock_ioctl+0x599/0x6b0 [ 135.304113][ T6251] ? __pfx_sock_ioctl+0x10/0x10 [ 135.304146][ T6251] ? selinux_file_ioctl+0x1e0/0x290 [ 135.304164][ T6251] ? selinux_file_ioctl+0x1e7/0x290 [ 135.304183][ T6251] ? __pfx_sock_ioctl+0x10/0x10 [ 135.304212][ T6251] __x64_sys_ioctl+0x18e/0x210 [ 135.304234][ T6251] do_syscall_64+0x123/0x790 [ 135.304257][ T6251] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.304277][ T6251] RIP: 0033:0x7fc40d39fb19 [ 135.304296][ T6251] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 135.304312][ T6251] RSP: 002b:00007fc40e213028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 135.304331][ T6251] RAX: ffffffffffffffda RBX: 00007fc40d625fa0 RCX: 00007fc40d39fb19 [ 135.304352][ T6251] RDX: 00002000000000c0 RSI: 0000000000008946 RDI: 0000000000000003 [ 135.304363][ T6251] RBP: 00007fc40e213090 R08: 0000000000000000 R09: 0000000000000000 [ 135.304373][ T6251] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 135.304384][ T6251] R13: 00007fc40d626038 R14: 00007fc40d625fa0 R15: 00007ffe1183d728 [ 135.304409][ T6251] [ 135.304711][ T6251] syz.3.92: vmalloc error: size 240, align 0x1, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 135.304900][ T6251] CPU: 3 UID: 0 PID: 6251 Comm: syz.3.92 Not tainted syzkaller #0 PREEMPT(full) [ 135.304920][ T6251] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 135.304930][ T6251] Call Trace: [ 135.304936][ T6251] [ 135.304943][ T6251] dump_stack_lvl+0x100/0x190 [ 135.304976][ T6251] warn_alloc.cold+0x9e/0xb2 [ 135.304998][ T6251] ? __pfx_warn_alloc+0x10/0x10 [ 135.305023][ T6251] ? lockdep_hardirqs_on+0x7d/0x110 [ 135.305046][ T6251] ? __get_vm_area_node+0x2f0/0x350 [ 135.305069][ T6251] ? __get_vm_area_node+0x22b/0x350 [ 135.305091][ T6251] __vmalloc_node_range_noprof+0xdc6/0x1440 [ 135.305121][ T6251] ? dev_ethtool+0x5b9e/0x6cb0 [ 135.305145][ T6251] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 135.305165][ T6251] ? __might_fault+0xc5/0x140 [ 135.305188][ T6251] ? __might_fault+0xc5/0x140 [ 135.305209][ T6251] ? __might_fault+0xc5/0x140 [ 135.305232][ T6251] ? dev_ethtool+0x5b9e/0x6cb0 [ 135.305248][ T6251] __vmalloc_node_noprof+0xad/0xf0 [ 135.305268][ T6251] ? dev_ethtool+0x5b9e/0x6cb0 [ 135.305287][ T6251] dev_ethtool+0x5b9e/0x6cb0 [ 135.305305][ T6251] ? bpf_ksym_find+0x128/0x1c0 [ 135.305331][ T6251] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 135.305379][ T6251] ? __pfx_dev_ethtool+0x10/0x10 [ 135.305401][ T6251] ? tomoyo_path_number_perm+0x46d/0x580 [ 135.305430][ T6251] ? stack_trace_save+0x8e/0xc0 [ 135.305455][ T6251] ? __pfx_stack_trace_save+0x10/0x10 [ 135.305480][ T6251] ? stack_depot_save_flags+0x27/0xa10 [ 135.305509][ T6251] ? __lock_acquire+0x5c0/0x1f40 [ 135.305536][ T6251] ? __lock_acquire+0x5c0/0x1f40 [ 135.305561][ T6251] ? __kasan_slab_free+0x5f/0x80 [ 135.305579][ T6251] ? kfree+0x22b/0x6d0 [ 135.305600][ T6251] ? tomoyo_path_number_perm+0x46d/0x580 [ 135.305626][ T6251] ? security_file_ioctl+0xd3/0x230 [ 135.305653][ T6251] ? __x64_sys_ioctl+0xb7/0x210 [ 135.305670][ T6251] ? do_syscall_64+0x123/0x790 [ 135.305688][ T6251] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.305713][ T6251] ? lock_acquire+0x1d1/0x380 [ 135.305739][ T6251] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 135.305772][ T6251] ? udp_ioctl+0x3d/0x150 [ 135.305802][ T6251] ? sk_ioctl+0x173/0x360 [ 135.305835][ T6251] ? __lock_acquire+0x5c0/0x1f40 [ 135.305859][ T6251] ? inet_ioctl+0x1ad/0x3f0 [ 135.305881][ T6251] ? __pfx_inet_ioctl+0x10/0x10 [ 135.305907][ T6251] ? lock_acquire+0x1d1/0x380 [ 135.305931][ T6251] ? dev_load+0x2a/0x240 [ 135.305955][ T6251] ? find_held_lock+0x2b/0x80 [ 135.305975][ T6251] ? dev_load+0x8e/0x240 [ 135.305996][ T6251] ? dev_load+0x8e/0x240 [ 135.306024][ T6251] dev_ioctl+0x63b/0x10e0 [ 135.306052][ T6251] sock_do_ioctl+0x1a0/0x280 [ 135.306078][ T6251] ? __pfx_sock_do_ioctl+0x10/0x10 [ 135.306104][ T6251] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 135.306137][ T6251] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 135.306154][ T6251] ? ioctl_has_perm.constprop.0.isra.0+0x37d/0x530 [ 135.306175][ T6251] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 135.306200][ T6251] sock_ioctl+0x599/0x6b0 [ 135.306227][ T6251] ? __pfx_sock_ioctl+0x10/0x10 [ 135.306259][ T6251] ? selinux_file_ioctl+0x1e0/0x290 [ 135.306276][ T6251] ? selinux_file_ioctl+0x1e7/0x290 [ 135.306295][ T6251] ? __pfx_sock_ioctl+0x10/0x10 [ 135.306325][ T6251] __x64_sys_ioctl+0x18e/0x210 [ 135.306356][ T6251] do_syscall_64+0x123/0x790 [ 135.306378][ T6251] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.306399][ T6251] RIP: 0033:0x7fc40d39fb19 [ 135.306418][ T6251] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 135.306435][ T6251] RSP: 002b:00007fc40e213028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 135.306454][ T6251] RAX: ffffffffffffffda RBX: 00007fc40d625fa0 RCX: 00007fc40d39fb19 [ 135.306466][ T6251] RDX: 00002000000000c0 RSI: 0000000000008946 RDI: 0000000000000003 [ 135.306477][ T6251] RBP: 00007fc40e213090 R08: 0000000000000000 R09: 0000000000000000 [ 135.306488][ T6251] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 135.306499][ T6251] R13: 00007fc40d626038 R14: 00007fc40d625fa0 R15: 00007ffe1183d728 [ 135.306524][ T6251] [ 135.306532][ T6251] Mem-Info: [ 135.306541][ T6251] active_anon:8937 inactive_anon:0 isolated_anon:0 [ 135.306541][ T6251] active_file:0 inactive_file:59373 isolated_file:0 [ 135.306541][ T6251] unevictable:3232 dirty:306 writeback:0 [ 135.306541][ T6251] slab_reclaimable:7600 slab_unreclaimable:69855 [ 135.306541][ T6251] mapped:25724 shmem:1557 pagetables:1211 [ 135.306541][ T6251] sec_pagetables:303 bounce:0 [ 135.306541][ T6251] kernel_misc_reclaimable:0 [ 135.306541][ T6251] free:456572 free_pcp:9793 free_cma:0 [ 135.306587][ T6251] Node 0 active_anon:35748kB inactive_anon:0kB active_file:0kB inactive_file:237288kB unevictable:10928kB isolated(anon):0kB isolated(file):0kB mapped:102896kB dirty:1220kB writeback:0kB shmem:4228kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13568kB pagetables:4648kB sec_pagetables:1212kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 135.306635][ T6251] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:2000kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:2000kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:96kB pagetables:196kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 135.306680][ T6251] Node 0 DMA free:15360kB boost:0kB min:344kB low:428kB high:512kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 135.306728][ T6251] lowmem_reserve[]: 0 1201 1201 1201 1201 [ 135.306758][ T6251] Node 0 DMA32 free:166272kB boost:0kB min:27068kB low:33832kB high:40596kB reserved_highatomic:0kB free_highatomic:0kB active_anon:35748kB inactive_anon:0kB active_file:0kB inactive_file:237288kB unevictable:10928kB writepending:1220kB zspages:0kB present:2080628kB managed:1230668kB mlocked:8804kB bounce:0kB free_pcp:37028kB local_pcp:10084kB free_cma:0kB [ 135.306809][ T6251] lowmem_reserve[]: 0 0 0 0 0 [ 135.306839][ T6251] Node 1 Normal free:1644656kB boost:0kB min:40168kB low:50208kB high:60248kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:2000kB writepending:4kB zspages:0kB present:2097152kB managed:1781880kB mlocked:0kB bounce:0kB free_pcp:2144kB local_pcp:0kB free_cma:0kB [ 135.306890][ T6251] lowmem_reserve[]: 0 0 0 0 0 [ 135.306922][ T6251] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 135.307021][ T6251] Node 0 DMA32: 28*4kB (U) 508*8kB (UME) 560*16kB (UE) 104*32kB (UE) 52*64kB (UME) 26*128kB (UE) 8*256kB (UME) 1*512kB (E) 3*1024kB (ME) 5*2048kB (UME) 31*4096kB (UM) = 165968kB [ 135.307196][ T6251] Node 1 Normal: 6*4kB (UM) 5*8kB (U) 17*16kB (UM) 21*32kB (UM) 14*64kB (UM) 6*128kB (UM) 2*256kB (U) 4*512kB (UM) 1*1024kB (U) 2*2048kB (UM) 399*4096kB (M) = 1644656kB [ 135.307333][ T6251] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 135.307427][ T6251] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 135.307441][ T6251] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 135.307454][ T6251] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 135.307468][ T6251] 62786 total pagecache pages [ 135.307474][ T6251] 0 pages in swap cache [ 135.307480][ T6251] Free swap = 124996kB [ 135.307487][ T6251] Total swap = 124996kB [ 135.307494][ T6251] 1048443 pages RAM [ 135.307499][ T6251] 0 pages HighMem/MovableOnly [ 135.307505][ T6251] 291466 pages reserved [ 135.307510][ T6251] 0 pages cma reserved [ 135.575947][ T42] kauditd_printk_skb: 20 callbacks suppressed [ 135.575964][ T42] audit: type=1400 audit(1793921731.938:333): avc: denied { setopt } for pid=6256 comm="syz.3.95" lport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 135.643507][ T42] audit: type=1400 audit(1793921731.948:334): avc: denied { write } for pid=6256 comm="syz.3.95" lport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 135.674256][ T6263] netlink: 16 bytes leftover after parsing attributes in process `syz.3.95'. [ 135.723229][ T42] audit: type=1400 audit(1793921732.088:335): avc: denied { read write } for pid=6267 comm="syz.0.98" name="mtd0" dev="devtmpfs" ino=714 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 135.723284][ T42] audit: type=1400 audit(1793921732.088:336): avc: denied { open } for pid=6267 comm="syz.0.98" path="/dev/mtd0" dev="devtmpfs" ino=714 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 135.773496][ T6263] syzkaller1: entered promiscuous mode [ 135.773522][ T6263] syzkaller1: entered allmulticast mode [ 135.850952][ T6270] phram: not enough arguments [ 135.888108][ T6270] device-mapper: table: 248:2: cache: Error opening cache device (-ENOENT) [ 135.888138][ T6270] device-mapper: ioctl: error adding target to table [ 135.889423][ T42] audit: type=1400 audit(1793921732.248:337): avc: denied { read write } for pid=6269 comm="syz.1.97" name="video36" dev="devtmpfs" ino=1066 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 135.892271][ T42] audit: type=1400 audit(1793921732.258:338): avc: denied { open } for pid=6269 comm="syz.1.97" path="/dev/video36" dev="devtmpfs" ino=1066 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 135.907759][ T6270] audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=64 [ 135.907783][ T6270] audit: out of memory in audit_log_start [ 136.151934][ T6275] ubi0: attaching mtd0 [ 136.154026][ T6275] ubi0: scanning is finished [ 136.154045][ T6275] ubi0: empty MTD device detected [ 136.196068][ T42] audit: type=1400 audit(1793921732.558:339): avc: denied { map } for pid=6276 comm="syz.1.101" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=11018 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 136.196686][ T42] audit: type=1400 audit(1793921732.558:340): avc: denied { read write } for pid=6276 comm="syz.1.101" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=11018 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 136.202015][ T6277] FAULT_INJECTION: forcing a failure. [ 136.202015][ T6277] name failslab, interval 1, probability 0, space 0, times 0 [ 136.202042][ T6277] CPU: 3 UID: 0 PID: 6277 Comm: syz.1.101 Not tainted syzkaller #0 PREEMPT(full) [ 136.202062][ T6277] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 136.202073][ T6277] Call Trace: [ 136.202080][ T6277] [ 136.202087][ T6277] dump_stack_lvl+0x100/0x190 [ 136.202123][ T6277] should_fail_ex.cold+0x5/0xa [ 136.202153][ T6277] should_failslab+0xc2/0x120 [ 136.202177][ T6277] __kmalloc_noprof+0xfc/0x840 [ 136.202206][ T6277] ? io_connect_prep+0x2b0/0x450 [ 136.202400][ T6277] io_connect_prep+0x2b0/0x450 [ 136.202431][ T6277] io_submit_sqes+0xa48/0x2760 [ 136.202469][ T6277] __do_sys_io_uring_enter+0xa88/0x1b10 [ 136.202495][ T6277] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 136.202520][ T6277] ? __fget_files+0x21f/0x3d0 [ 136.202544][ T6277] ? __pfx___do_sys_io_uring_enter+0x10/0x10 [ 136.202572][ T6277] ? fput+0x7c/0x100 [ 136.202595][ T6277] ? ksys_write+0x1ac/0x250 [ 136.202615][ T6277] ? __pfx_ksys_write+0x10/0x10 [ 136.202658][ T6277] do_syscall_64+0x123/0x790 [ 136.202682][ T6277] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.202701][ T6277] RIP: 0033:0x7f531119fb19 [ 136.202717][ T6277] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 136.202735][ T6277] RSP: 002b:00007f5311ff4028 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 136.202753][ T6277] RAX: ffffffffffffffda RBX: 00007f5311425fa0 RCX: 00007f531119fb19 [ 136.202765][ T6277] RDX: 00000000fffffffd RSI: 0000000000002000 RDI: 0000000000000003 [ 136.202775][ T6277] RBP: 00007f5311ff4090 R08: 0000000000000000 R09: 0000000000000000 [ 136.202785][ T6277] R10: 0000000000000009 R11: 0000000000000246 R12: 0000000000000001 [ 136.202796][ T6277] R13: 00007f5311426038 R14: 00007f5311425fa0 R15: 00007ffcf821e5d8 [ 136.202821][ T6277] [ 136.383469][ T5950] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 136.505917][ T6275] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 136.505943][ T6275] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 136.505959][ T6275] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 136.505974][ T6275] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 136.505990][ T6275] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 136.506005][ T6275] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 136.506020][ T6275] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 2432662637 [ 136.506037][ T6275] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 136.506756][ T6287] ubi0: background thread "ubi_bgt0d" started, PID 6287 [ 136.589369][ T5950] usb 5-1: Using ep0 maxpacket: 32 [ 136.596706][ T5950] usb 5-1: New USB device found: idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 136.597914][ T5950] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 136.623082][ T5950] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 136.623109][ T5950] usb 5-1: Product: syz [ 136.623121][ T5950] usb 5-1: Manufacturer: syz [ 136.623133][ T5950] usb 5-1: SerialNumber: syz [ 136.640552][ T5950] usb 5-1: config 0 descriptor?? [ 136.648282][ T6274] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 136.649577][ T5950] hub 5-1:0.0: bad descriptor, ignoring hub [ 136.649599][ T5950] hub 5-1:0.0: probe with driver hub failed with error -5 [ 136.834589][ T6297] x_tables: duplicate underflow at hook 2 [ 136.834998][ T6295] tmpfs: Bad value for 'mpol' [ 137.360802][ T6312] syzkaller0: entered promiscuous mode [ 137.360826][ T6312] syzkaller0: entered allmulticast mode [ 137.557331][ T6304] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 137.557780][ T6304] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 137.680282][ T6315] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 137.680350][ T6315] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 137.702332][ T6315] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 137.713711][ T6315] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 137.713791][ T6315] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 137.725088][ T6315] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 137.745484][ T6315] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 137.745552][ T6315] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 137.748074][ T6315] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 137.804164][ T6315] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 137.804231][ T6315] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 137.819963][ T24] usb 5-1: USB disconnect, device number 6 [ 137.834616][ T6315] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 137.861992][ T6321] netlink: 4 bytes leftover after parsing attributes in process `syz.1.113'. [ 138.266972][ T6325] netlink: 68 bytes leftover after parsing attributes in process `syz.1.114'. [ 138.887512][ T6338] netlink: 808 bytes leftover after parsing attributes in process `syz.0.118'. [ 138.887766][ T6338] Zero length message leads to an empty skb [ 139.428150][ T6350] netlink: 28 bytes leftover after parsing attributes in process `syz.3.123'. [ 139.428187][ T6350] netlink: 28 bytes leftover after parsing attributes in process `syz.3.123'. [ 139.666130][ T6353] process 'syz.3.124' launched '/dev/fd/5' with NULL argv: empty string added [ 139.783053][ T5818] Bluetooth: hci1: command 0x0c1a tx timeout [ 139.783115][ T5818] Bluetooth: hci0: command 0x0c1a tx timeout [ 139.857463][ T5806] Bluetooth: hci2: command 0x0c1a tx timeout [ 140.073185][ T5900] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 140.233013][ T5900] usb 5-1: Using ep0 maxpacket: 32 [ 140.240014][ T5900] usb 5-1: New USB device found: idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 140.248677][ T5900] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 140.254152][ T5900] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 140.254176][ T5900] usb 5-1: Product: syz [ 140.254188][ T5900] usb 5-1: Manufacturer: syz [ 140.254200][ T5900] usb 5-1: SerialNumber: syz [ 140.256895][ T5900] usb 5-1: config 0 descriptor?? [ 140.280416][ T6358] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 140.281773][ T5900] hub 5-1:0.0: bad descriptor, ignoring hub [ 140.281796][ T5900] hub 5-1:0.0: probe with driver hub failed with error -5 [ 140.722510][ T6381] syzkaller0: entered promiscuous mode [ 140.722535][ T6381] syzkaller0: entered allmulticast mode [ 140.827785][ T10] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 140.909343][ T42] kauditd_printk_skb: 57 callbacks suppressed [ 140.909362][ T42] audit: type=1400 audit(1793921737.268:398): avc: denied { ioctl } for pid=6382 comm="syz.1.135" path="socket:[13487]" dev="sockfs" ino=13487 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 140.910453][ T42] audit: type=1400 audit(1793921737.268:399): avc: denied { ioctl } for pid=6382 comm="syz.1.135" path="socket:[13489]" dev="sockfs" ino=13489 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 140.910732][ T6387] netlink: 108 bytes leftover after parsing attributes in process `syz.1.135'. [ 140.998944][ T10] usb 7-1: Using ep0 maxpacket: 32 [ 141.006814][ T10] usb 7-1: unable to get BOS descriptor or descriptor too short [ 141.006855][ T10] usb 7-1: New USB device found: idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 141.007886][ T10] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 141.007908][ T10] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 141.007923][ T10] usb 7-1: config 14 has no interface number 0 [ 141.007935][ T10] usb 7-1: config 14 has no interface number 1 [ 141.007974][ T10] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 141.007992][ T10] usb 7-1: config 14 interface 228 altsetting 5 has an invalid endpoint descriptor of length 6, skipping [ 141.008010][ T10] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 141.008030][ T10] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 141.008058][ T10] usb 7-1: config 14 interface 57 has no altsetting 0 [ 141.008072][ T10] usb 7-1: config 14 interface 228 has no altsetting 0 [ 141.012970][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 141.012992][ T10] usb 7-1: Product: syz [ 141.013002][ T10] usb 7-1: Manufacturer: syz [ 141.013013][ T10] usb 7-1: SerialNumber: syz [ 141.076188][ T6379] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 141.076612][ T6379] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 141.225165][ T5806] Bluetooth: hci3: command 0x0c1a tx timeout [ 141.433409][ T72] Bluetooth: hci3: unexpected event for opcode 0x1004 [ 141.472754][ T10] legousbtower 7-1:14.57: interrupt endpoints not found [ 141.612611][ T42] audit: type=1400 audit(1793921737.978:400): avc: denied { ioctl } for pid=6400 comm="syz.1.141" path="/dev/mtd0" dev="devtmpfs" ino=714 ioctlcmd=0x1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 141.613927][ T6401] 0x000000000000-0x000000010000 : "" [ 141.635034][ T6401] ftl_cs: FTL header not found. [ 141.675832][ T10] legousbtower 7-1:14.228: interrupt endpoints not found [ 141.819731][ T42] audit: type=1400 audit(1793921738.178:401): avc: denied { mounton } for pid=6403 comm="syz.1.142" path="/40/file0" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 141.824535][ T6404] netlink: 8 bytes leftover after parsing attributes in process `syz.1.142'. [ 141.864641][ T72] Bluetooth: hci0: command 0x0c1a tx timeout [ 141.864682][ T72] Bluetooth: hci1: command 0x0c1a tx timeout [ 141.873251][ T6404] ip6erspan0: entered promiscuous mode [ 141.897780][ T42] audit: type=1400 audit(1793921738.258:402): avc: denied { write } for pid=6403 comm="syz.1.142" name="functions" dev="configfs" ino=8848 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 141.903281][ T42] audit: type=1400 audit(1793921738.258:403): avc: denied { create } for pid=6403 comm="syz.1.142" name="ncm.usb0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 141.906387][ T42] audit: type=1400 audit(1793921738.268:404): avc: denied { write } for pid=6403 comm="syz.1.142" name="c.1" dev="configfs" ino=8853 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 141.906634][ T42] audit: type=1400 audit(1793921738.268:405): avc: denied { write } for pid=6403 comm="syz.1.142" name="c.1" dev="configfs" ino=8853 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 141.930129][ T5806] Bluetooth: hci2: command 0x0c1a tx timeout [ 142.050337][ T6405] configfs-gadget.g1 gadget.0: HOST MAC 12:64:01:6f:41:02 [ 142.050364][ T6405] configfs-gadget.g1 gadget.0: MAC 0e:e4:ad:26:40:17 [ 142.229207][ T42] audit: type=1400 audit(1793921738.588:406): avc: denied { ioctl } for pid=6408 comm="syz.3.143" path="/dev/mtd0" dev="devtmpfs" ino=714 ioctlcmd=0x1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 142.255787][ T6409] 0x000000000000-0x000000010000 : "" [ 142.261718][ T6409] ftl_cs: FTL header not found. [ 142.281818][ T6376] usb 5-1: reset high-speed USB device number 7 using dummy_hcd [ 142.282510][ T6376] usb 5-1: device reset changed ep0 maxpacket size! [ 142.294018][ T24] usb 5-1: USB disconnect, device number 7 [ 142.559821][ T6415] Bluetooth: MGMT ver 1.23 [ 142.620486][ T42] audit: type=1400 audit(1793921738.968:407): avc: denied { write } for pid=6413 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1858 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 142.691503][ T24] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 142.887260][ T24] usb 5-1: New USB device found: idVendor=0000, idProduct=0000, bcdDevice=7.04 [ 142.888360][ T24] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 142.888386][ T24] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 142.888438][ T24] usb 5-1: Dual-Role OTG device on HNP port [ 142.888735][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 142.973550][ C2] ------------[ cut here ]------------ [ 142.973581][ C2] usb_ep_enable: ep129 (ep1in-bulk) has maxpacket 0 [ 142.973601][ C2] WARNING: drivers/usb/gadget/udc/core.c:124 at usb_ep_enable+0x3e6/0x490, CPU#2: syz.3.147/6426 [ 143.023523][ C2] Modules linked in: [ 143.026228][ C2] CPU: 2 UID: 0 PID: 6426 Comm: syz.3.147 Not tainted syzkaller #0 PREEMPT(full) [ 143.029953][ C2] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 143.053025][ C2] RIP: 0010:usb_ep_enable+0x3f8/0x490 [ 143.055348][ C2] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 93 00 00 00 48 8d 3d 0a 4a 84 0a 48 8b 4b 08 40 0f b6 d5 4d 89 e0 48 c7 c6 00 b7 fb 8c <67> 48 0f b9 3a bd ea ff ff ff e9 8e fd ff ff 49 c7 c4 a0 a9 fb 8c [ 143.083505][ C2] RSP: 0018:ffffc90000648a10 EFLAGS: 00010046 [ 143.087713][ C2] RAX: dffffc0000000000 RBX: ffff88802c9ec0e0 RCX: ffffffff8cfbee00 [ 143.100725][ C2] RDX: 0000000000000081 RSI: ffffffff8cfbb700 RDI: ffffffff92780070 [ 143.106251][ C2] RBP: 0000000000000081 R08: ffffffff8cfba9e0 R09: 0000000000000000 [ 143.109877][ C2] R10: ffffffff926aa25f R11: 0000000000000002 R12: ffffffff8cfba9e0 [ 143.124668][ C2] R13: 0000000000000000 R14: ffff88802c9ec0e0 R15: ffff888026c617a0 [ 143.131002][ C2] FS: 0000000000000000(0000) GS:ffff8880d4679000(0000) knlGS:0000000000000000 [ 143.145120][ C2] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 143.171813][ C2] CR2: 000055bd50ca5728 CR3: 00000000549e5000 CR4: 0000000000352ef0 [ 143.183245][ C2] Call Trace: [ 143.184947][ C2] [ 143.186208][ C2] hidg_set_alt+0x190/0xa10 [ 143.188062][ C2] ? do_raw_spin_unlock+0x145/0x1e0 [ 143.203741][ C2] ? rcu_is_watching+0x13/0xc0 [ 143.205671][ C2] composite_setup+0x2ccf/0x9290 [ 143.207671][ C2] ? __lock_acquire+0x5c0/0x1f40 [ 143.225047][ C2] ? __pfx_composite_setup+0x10/0x10 [ 143.227455][ C2] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 143.231718][ C2] ? do_raw_spin_lock+0x128/0x260 [ 143.233896][ C2] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 143.252339][ C2] ? configfs_composite_setup+0xfb/0x130 [ 143.255105][ C2] configfs_composite_setup+0xfb/0x130 [ 143.257284][ C2] dummy_timer+0x20a0/0x3840 [ 143.272659][ C2] ? do_raw_spin_lock+0x128/0x260 [ 143.274420][ C2] ? find_held_lock+0x2b/0x80 [ 143.276560][ C2] ? debug_object_deactivate+0x2e4/0x3b0 [ 143.278892][ C2] ? debug_object_deactivate+0x2e4/0x3b0 [ 143.281293][ C2] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 143.294154][ C2] ? debug_object_deactivate+0x2e4/0x3b0 [ 143.312697][ C2] ? __pfx_debug_object_deactivate+0x10/0x10 [ 143.315377][ C2] ? __pfx_dummy_timer+0x10/0x10 [ 143.328024][ C2] ? mark_held_locks+0x40/0x70 [ 143.340469][ C2] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 143.344896][ C2] ? __pfx_dummy_timer+0x10/0x10 [ 143.347095][ C2] __hrtimer_run_queues+0x448/0x9a0 [ 143.371638][ C2] hrtimer_run_softirq+0x1ca/0x360 [ 143.374387][ C2] handle_softirqs+0x216/0xa20 [ 143.376699][ C2] ? __pfx_handle_softirqs+0x10/0x10 [ 143.379012][ C2] ? _raw_spin_unlock+0x28/0x50 [ 143.381152][ C2] ? __hrtimer_rearm_deferred+0x9b/0x7b0 [ 143.393582][ C2] __irq_exit_rcu+0x178/0x220 [ 143.395411][ C2] irq_exit_rcu+0x9/0x30 [ 143.397137][ C2] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 143.408881][ C2] [ 143.410183][ C2] [ 143.422751][ C2] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 143.425278][ C2] RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x70 [ 143.427424][ C2] Code: 66 9f 67 00 48 89 df 5b e9 1d e5 6d 00 be 03 00 00 00 5b e9 f2 97 2c 03 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 65 48 8b 05 7c 07 ac 13 48 8b 34 24 65 48 8b 15 60 07 [ 143.454916][ C2] RSP: 0018:ffffc90005217420 EFLAGS: 00000293 [ 143.457509][ C2] RAX: 0000000000000000 RBX: 000000000004f835 RCX: ffff888034250000 [ 143.460957][ C2] RDX: 0000000000000001 RSI: ffffffff829557c6 RDI: 0000000000000007 [ 143.474230][ C2] RBP: 0000000000000000 R08: 0000000000000fff R09: 0000000000000000 [ 143.482987][ C2] R10: ffffea00013e0d47 R11: 0000000000000000 R12: 0000000000000009 [ 143.485769][ C2] R13: 0000000000000001 R14: dffffc0000000000 R15: ffffea00013e0d58 [ 143.500486][ C2] ? pfn_valid+0x256/0x4b0 [ 143.504782][ C2] pfn_valid+0x35/0x4b0 [ 143.509608][ C2] page_table_check_clear+0x21/0x5e0 [ 143.515987][ C2] ? vm_normal_page+0x1d1/0x380 [ 143.520366][ C2] __page_table_check_pte_clear+0x10f/0x120 [ 143.526197][ C2] ? __pfx___page_table_check_pte_clear+0x10/0x10 [ 143.534162][ C2] ? __pfx___might_resched+0x10/0x10 [ 143.550528][ C2] __zap_vma_range+0x2bc7/0x46c0 [ 143.553786][ C2] ? __pfx___zap_vma_range+0x10/0x10 [ 143.561255][ C2] ? mas_next_slot+0xc05/0x13a0 [ 143.565931][ C2] unmap_vmas+0x294/0x5f0 [ 143.569175][ C2] ? __pfx_unmap_vmas+0x10/0x10 [ 143.573770][ C2] ? mtree_range_walk+0x72b/0xb70 [ 143.578459][ C2] ? mas_walk+0x260/0x310 [ 143.582612][ C2] exit_mmap+0x1ef/0xa40 [ 143.587198][ C2] ? __pfx_exit_mmap+0x10/0x10 [ 143.608483][ C2] ? rcu_is_watching+0x13/0xc0 [ 143.610695][ C2] ? find_held_lock+0x2b/0x80 [ 143.612591][ C2] ? uprobe_clear_state+0x5f/0x250 [ 143.614506][ C2] ? __mutex_unlock_slowpath+0x35d/0x930 [ 143.618754][ C2] __mmput+0x12a/0x410 [ 143.633628][ C2] mmput+0x62/0x70 [ 143.636408][ C2] do_exit+0x80c/0x2a00 [ 143.638672][ C2] ? __pfx_futex_wake_mark+0x10/0x10 [ 143.641448][ C2] ? __pfx_do_exit+0x10/0x10 [ 143.644805][ C2] ? do_raw_spin_lock+0x128/0x260 [ 143.647232][ C2] ? find_held_lock+0x2b/0x80 [ 143.649827][ C2] ? get_signal+0xa28/0x22e0 [ 143.653126][ C2] do_group_exit+0xd5/0x2a0 [ 143.655658][ C2] get_signal+0x1f58/0x22e0 [ 143.657916][ C2] ? __pfx_futex_wait+0x10/0x10 [ 143.664265][ C2] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 143.717403][ C2] ? __pfx_get_signal+0x10/0x10 [ 143.719741][ C2] ? do_futex+0x190/0x440 [ 143.721723][ C2] arch_do_signal_or_restart+0x91/0x7e0 [ 143.724043][ C2] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 143.726910][ C2] ? __pfx_blkdev_ioctl+0x10/0x10 [ 143.730010][ C2] exit_to_user_mode_loop+0x139/0x700 [ 143.736848][ C2] ? rcu_is_watching+0x13/0xc0 [ 143.742071][ C2] do_syscall_64+0x661/0x790 [ 143.746983][ C2] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 143.753234][ C2] RIP: 0033:0x7fc40d39fb19 [ 143.757889][ C2] Code: Unable to access opcode bytes at 0x7fc40d39faef. [ 143.762164][ C2] RSP: 002b:00007fc40e2130e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 143.775380][ C2] RAX: fffffffffffffe00 RBX: 00007fc40d625fa8 RCX: 00007fc40d39fb19 [ 143.788527][ C2] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fc40d625fa8 [ 143.792523][ C2] RBP: 00007fc40d625fa0 R08: 0000000000000000 R09: 0000000000000000 [ 143.799587][ C2] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 143.806101][ C2] R13: 00007fc40d626038 R14: 00007ffe1183d640 R15: 00007ffe1183d728 [ 143.839605][ C2] [ 143.856587][ C2] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 143.859723][ C2] CPU: 2 UID: 0 PID: 6426 Comm: syz.3.147 Not tainted syzkaller #0 PREEMPT(full) [ 143.863905][ C2] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 143.868745][ C2] Call Trace: [ 143.870160][ C2] [ 143.871379][ C2] dump_stack_lvl+0x100/0x190 [ 143.875024][ C2] vpanic+0x2dc/0x6f8 [ 143.877109][ C2] panic+0xd1/0xe0 [ 143.878778][ C2] ? __pfx_panic+0x10/0x10 [ 143.880767][ C2] check_panic_on_warn.cold+0x19/0x34 [ 143.883802][ C2] ? usb_ep_enable+0x3e6/0x490 [ 143.886668][ C2] __warn.cold+0x191/0x321 [ 143.889004][ C2] __report_bug+0x30f/0x440 [ 143.891377][ C2] ? usb_ep_enable+0x3e6/0x490 [ 143.893873][ C2] ? __pfx___report_bug+0x10/0x10 [ 143.895915][ C2] ? try_to_wake_up+0x158/0x1ca0 [ 143.897627][ C2] report_bug_entry+0xe2/0x290 [ 143.899844][ C2] ? usb_ep_enable+0x3f8/0x490 [ 143.901909][ C2] handle_bug+0x1cd/0x2a0 [ 143.903549][ C2] exc_invalid_op+0x17/0x50 [ 143.905305][ C2] asm_exc_invalid_op+0x1a/0x20 [ 143.907127][ C2] RIP: 0010:usb_ep_enable+0x3f8/0x490 [ 143.909064][ C2] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 93 00 00 00 48 8d 3d 0a 4a 84 0a 48 8b 4b 08 40 0f b6 d5 4d 89 e0 48 c7 c6 00 b7 fb 8c <67> 48 0f b9 3a bd ea ff ff ff e9 8e fd ff ff 49 c7 c4 a0 a9 fb 8c [ 143.917731][ C2] RSP: 0018:ffffc90000648a10 EFLAGS: 00010046 [ 143.920743][ C2] RAX: dffffc0000000000 RBX: ffff88802c9ec0e0 RCX: ffffffff8cfbee00 [ 143.923867][ C2] RDX: 0000000000000081 RSI: ffffffff8cfbb700 RDI: ffffffff92780070 [ 143.927130][ C2] RBP: 0000000000000081 R08: ffffffff8cfba9e0 R09: 0000000000000000 [ 143.930712][ C2] R10: ffffffff926aa25f R11: 0000000000000002 R12: ffffffff8cfba9e0 [ 143.952682][ C2] R13: 0000000000000000 R14: ffff88802c9ec0e0 R15: ffff888026c617a0 [ 143.955754][ C2] hidg_set_alt+0x190/0xa10 [ 143.957528][ C2] ? do_raw_spin_unlock+0x145/0x1e0 [ 143.960337][ C2] ? rcu_is_watching+0x13/0xc0 [ 143.964125][ C2] composite_setup+0x2ccf/0x9290 [ 143.966870][ C2] ? __lock_acquire+0x5c0/0x1f40 [ 143.969634][ C2] ? __pfx_composite_setup+0x10/0x10 [ 143.973245][ C2] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 143.977387][ C2] ? do_raw_spin_lock+0x128/0x260 [ 143.981054][ C2] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 143.984145][ C2] ? configfs_composite_setup+0xfb/0x130 [ 143.989175][ C2] configfs_composite_setup+0xfb/0x130 [ 143.992712][ C2] dummy_timer+0x20a0/0x3840 [ 143.994841][ C2] ? do_raw_spin_lock+0x128/0x260 [ 143.997849][ C2] ? find_held_lock+0x2b/0x80 [ 144.004234][ C2] ? debug_object_deactivate+0x2e4/0x3b0 [ 144.006175][ C2] ? debug_object_deactivate+0x2e4/0x3b0 [ 144.012422][ C2] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 144.021021][ C2] ? debug_object_deactivate+0x2e4/0x3b0 [ 144.029316][ C2] ? __pfx_debug_object_deactivate+0x10/0x10 [ 144.032112][ C2] ? __pfx_dummy_timer+0x10/0x10 [ 144.034046][ C2] ? mark_held_locks+0x40/0x70 [ 144.035859][ C2] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 144.038177][ C2] ? __pfx_dummy_timer+0x10/0x10 [ 144.040165][ C2] __hrtimer_run_queues+0x448/0x9a0 [ 144.042157][ C2] hrtimer_run_softirq+0x1ca/0x360 [ 144.044118][ C2] handle_softirqs+0x216/0xa20 [ 144.046004][ C2] ? __pfx_handle_softirqs+0x10/0x10 [ 144.048262][ C2] ? _raw_spin_unlock+0x28/0x50 [ 144.050133][ C2] ? __hrtimer_rearm_deferred+0x9b/0x7b0 [ 144.052866][ C2] __irq_exit_rcu+0x178/0x220 [ 144.055635][ C2] irq_exit_rcu+0x9/0x30 [ 144.057990][ C2] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 144.060406][ C2] [ 144.061881][ C2] [ 144.064023][ C2] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 144.067825][ C2] RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x70 [ 144.070972][ C2] Code: 66 9f 67 00 48 89 df 5b e9 1d e5 6d 00 be 03 00 00 00 5b e9 f2 97 2c 03 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 65 48 8b 05 7c 07 ac 13 48 8b 34 24 65 48 8b 15 60 07 [ 144.079788][ C2] RSP: 0018:ffffc90005217420 EFLAGS: 00000293 [ 144.085126][ C2] RAX: 0000000000000000 RBX: 000000000004f835 RCX: ffff888034250000 [ 144.088431][ C2] RDX: 0000000000000001 RSI: ffffffff829557c6 RDI: 0000000000000007 [ 144.094659][ C2] RBP: 0000000000000000 R08: 0000000000000fff R09: 0000000000000000 [ 144.099868][ C2] R10: ffffea00013e0d47 R11: 0000000000000000 R12: 0000000000000009 [ 144.103376][ C2] R13: 0000000000000001 R14: dffffc0000000000 R15: ffffea00013e0d58 [ 144.106405][ C2] ? pfn_valid+0x256/0x4b0 [ 144.108973][ C2] pfn_valid+0x35/0x4b0 [ 144.131230][ C2] page_table_check_clear+0x21/0x5e0 [ 144.134394][ C2] ? vm_normal_page+0x1d1/0x380 [ 144.137180][ C2] __page_table_check_pte_clear+0x10f/0x120 [ 144.168395][ C2] ? __pfx___page_table_check_pte_clear+0x10/0x10 [ 144.172792][ C2] ? __pfx___might_resched+0x10/0x10 [ 144.193105][ C2] __zap_vma_range+0x2bc7/0x46c0 [ 144.195402][ C2] ? __pfx___zap_vma_range+0x10/0x10 [ 144.197641][ C2] ? mas_next_slot+0xc05/0x13a0 [ 144.199571][ C2] unmap_vmas+0x294/0x5f0 [ 144.201294][ C2] ? __pfx_unmap_vmas+0x10/0x10 [ 144.207140][ C2] ? mtree_range_walk+0x72b/0xb70 [ 144.209243][ C2] ? mas_walk+0x260/0x310 [ 144.211059][ C2] exit_mmap+0x1ef/0xa40 [ 144.213998][ C2] ? __pfx_exit_mmap+0x10/0x10 [ 144.216546][ C2] ? rcu_is_watching+0x13/0xc0 [ 144.218787][ C2] ? find_held_lock+0x2b/0x80 [ 144.221581][ C2] ? uprobe_clear_state+0x5f/0x250 [ 144.224128][ C2] ? __mutex_unlock_slowpath+0x35d/0x930 [ 144.227280][ C2] __mmput+0x12a/0x410 [ 144.229041][ C2] mmput+0x62/0x70 [ 144.230757][ C2] do_exit+0x80c/0x2a00 [ 144.232450][ C2] ? __pfx_futex_wake_mark+0x10/0x10 [ 144.235593][ C2] ? __pfx_do_exit+0x10/0x10 [ 144.238278][ C2] ? do_raw_spin_lock+0x128/0x260 [ 144.240672][ C2] ? find_held_lock+0x2b/0x80 [ 144.242778][ C2] ? get_signal+0xa28/0x22e0 [ 144.244943][ C2] do_group_exit+0xd5/0x2a0 [ 144.247457][ C2] get_signal+0x1f58/0x22e0 [ 144.249544][ C2] ? __pfx_futex_wait+0x10/0x10 [ 144.252511][ C2] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 144.255147][ C2] ? __pfx_get_signal+0x10/0x10 [ 144.259433][ C2] ? do_futex+0x190/0x440 [ 144.262277][ C2] arch_do_signal_or_restart+0x91/0x7e0 [ 144.264867][ C2] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 144.267598][ C2] ? __pfx_blkdev_ioctl+0x10/0x10 [ 144.270346][ C2] exit_to_user_mode_loop+0x139/0x700 [ 144.274836][ C2] ? rcu_is_watching+0x13/0xc0 [ 144.280522][ C2] do_syscall_64+0x661/0x790 [ 144.282249][ C2] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 144.285786][ C2] RIP: 0033:0x7fc40d39fb19 [ 144.287554][ C2] Code: Unable to access opcode bytes at 0x7fc40d39faef. [ 144.290618][ C2] RSP: 002b:00007fc40e2130e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 144.294092][ C2] RAX: fffffffffffffe00 RBX: 00007fc40d625fa8 RCX: 00007fc40d39fb19 [ 144.297546][ C2] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fc40d625fa8 [ 144.301518][ C2] RBP: 00007fc40d625fa0 R08: 0000000000000000 R09: 0000000000000000 [ 144.341048][ C2] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 144.344004][ C2] R13: 00007fc40d626038 R14: 00007ffe1183d640 R15: 00007ffe1183d728 [ 144.346996][ C2] [ 144.383485][ C2] Kernel Offset: disabled [ 144.385376][ C2] Rebooting in 86400 seconds..