last executing test programs: 1.591306451s ago: executing program 3 (id=4): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) prlimit64(0x0, 0x7, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102400, 0x19000) ioctl$TIOCSSOFTCAR(0xffffffffffffffff, 0x5453, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$vsock_stream(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$PIO_UNIMAPCLR(r2, 0x4b68, 0x0) ioctl$PIO_SCRNMAP(r2, 0x4b41, &(0x7f0000000140)) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x404c0c6, 0x0, 0x0) 1.574855271s ago: executing program 0 (id=1): memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = syz_open_dev$loop(&(0x7f0000000000), 0x3, 0x80000) socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0xb, 0x2012, r0, 0x1000000) 1.277548868s ago: executing program 3 (id=6): syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0) syz_usb_connect(0x2, 0x0, 0x0, 0x0) 1.177681631s ago: executing program 4 (id=5): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x18b303, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x3, 0x7fffffff}]}) close_range(r0, 0xffffffffffffffff, 0x0) 925.615017ms ago: executing program 4 (id=7): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) syz_emit_ethernet(0x16, &(0x7f0000000080)={@random="a32a61defaa9", @empty, @void, {@llc={0x4, {@snap={0xaa, 0x0, 'o', "b073b2"}}}}}, 0x0) syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0xfffffffd, 0x10000, 0x0, 0x59}, 0x0, &(0x7f0000000140), &(0x7f0000000080)) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0xe1, 0x0, 0xb47, 0x9, 0x8, 0x80002001, 0x3}, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendto$inet(r0, &(0x7f0000000040)="17", 0xfffffe75, 0x10008085, 0x0, 0x0) 905.381457ms ago: executing program 0 (id=8): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000fc0)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00010000850000000d000000b7000000000000009500000000000000496cf2827fb43a431ca711fcc9cdfa146ec56175037958e271f60d25b7937f02c8695e5a1b2cdf41dc10d1e8bf076d83923dd29c034055b67dafe6c8dc3d5d78c07fa1f7e4d5b318e2ec0e0700897a74a0091ff110026e6d2ef831ab7ea0c34f17e3ad6ef3bb622003b538dfd8e012e79578e51bc53099e90fbdb2ca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e060e3670ef0e789f93781965f1328d6704902cbe7bc0476619f28d99cd0aa7b73340cc2160a1fe3c184b751c51160fbce841f8a97be6148ba532e6ea09c346dfebd31a08b32808b80200000000009dd27080e71113610e10d859e8327ef03fb6c86adac12233f9a1fb9c2aec61ce63a3462fd50117b89a9ab759b4eeb8cb000067d42b4e54861d0227dbfd2ed8576a3f7f3deadd7130856f756436303767d2e24f29e5dad9796edb697a6ea0180aabc18cae2ed4b4390af9a9ceafd07ed0030000002cab154ad029a119ca3c972780870014605c83d7d11c3c975d5aec84222fff0d7216fdb0d3a0ec4bfae563112f4b391aafe234870072858dc06e7c337642d3e5a815212f5e16c1b30c3a2a71bc85018e5ff2c910496f18afc9ffc2cc788bee1b47683db01a46939868d75211bbae0e7313bff5d4c391ddece00fc772dd6b4d4d0a917b239fe12280fc92c88c5b8dcdcc22ee1747790a8992533ac2a9f5a699593f084419cae0b4183fb01c73f99857399537f5dc2acb72c7eae993fc9eb22d130665b6341da114f08cd0509d380578673fffffff7f23877a6b24db0e067345560942fa629fbef2461c96a08707671215c302fae29187d4f5c06a960fd37c10223fdae7ed04935c3c90d3add8eebc8619d73415e6adcda2130f5011e42e50adab988dd8e12baf5c768a40538be5f76e9c2977aab37d9a44cfc1c7b4000000000000fa47742f6c5b9c4b11e7d7262a1457c39495c826b956ba859adfe38f77b91bd7d5ca1664fe2f3ced8468911806e8916dc15e21644db60c2499d5d16d7d915836ab26c169482008ef069dc42749289f854797f2f900c2a12d8c38a967c1bbe09315c29877a331bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aae73835d5a3cda9e90d76c1993e0799d4894ee7f8249dc1e3428d2129369ee1b85afa1a5be5f6eb2eea0d0df414b315f65112412392191fa83ee830548ef8e1038debd64cbe359454a3f2239cfe35f81b7aded448859968ff0e90500d0b07c0dd00490f167e6d5c1109681739dc33f75b20428d6474a0a91ee90b8de802c6b538622e6bbcb80f87b415263c401e64ed69a2f75409000000000000001d695c4559b82cabac3cccadc1e1c19af4e03020abf5ff0433d660f20898d2a045d009a0ffb20a77c9af2b80c05184a66d30bbea2ca45a4d6d6d1e6e79aef42355a500587b603306a5af8d867d80a07f10d82eafb030621204d3ded6f260af62d91faae95196d5e3ff010000000000000be959096ea948cfa8e7194123e918914a71ad5a8521fb9553bc60f7d9719b55b3abb6bba3d113a680a8d46fe074c83fbe378a3889e8145b2eaceab05ef932c6e4f8ef0ed0d818a7b76d839cf3c63ebb4380b168c38fa32e49563cfee3a7f0fc18bfa32c418cef875fb49e2989177a30280bc586e79a5dd8076c248e7d6e97b3ce267dd4e27b6ef206660090bb2164474cef378f97ca33fc03000000000000001547053453d0c9aec91a24079b21d52fb5516bf0c28ef37aa76442f6083dc99cd61afaf6be45d7b00d3639f2f10ac2d5ffff000000000000c24411d415b6b085fb73a2c7c3852e0e658ffeb4e863428a792bee94f6cd895424360e0464f9d7ea425f2fa6aac029d15af607ad83532ff181c985f54b39370c06e63055b4d6a36fa98a44e379d28307c9912fb097601f3f88a2ca6fd1f9320cfe7fc8e9f7f15f02e177ce23f43a154b42e26f037e8a01377cbd3f509e6e540c9ba9c2a589ac5d8ad67a65e9a44c576dc24452eaa9d819e2b04bdd1c000000070000000000000000000000005333c6199c12dcd926891927a7267c47cf897853d160100b39b613faefe16bed1fc105dddd77ab929b837d54aa17eb9fbdc2bdc0e98ae2c3f23a6131e2879f04ff01000030b92dd493be66c2242f8184733b80ba28e8ffffff7f00000000bb2f89049c5f6d63d56995747639964217aacfe548bc869098aa8e07e51dbc9e2d4db3c5f79fd355222ec2a00cf7f2ccd6dd6d2dc2a815d8314221a5472f1318a9dfbec5a759579caf3262129b14e99040b5d91398e17df85c25ccae973eecc7d187168d5c9cd848d566cc17587641ed01889c927da38d83314480b15e23138c5b877a72bd4cf74a299df4fbfc8e6ea96939f15d254d9033c5a45706bda78ab60200000000000000000000000000000000000000706f78f0a2ea9667fb5b951808545a46830970c2dfae01adbda7d29bf1f7abdaf52e0de6f9d7150808ed086642e64ebf98762b34338b80e41b704c3eefaf0bb5f7d895de17a10b0a0ea15ccc0d7a830b6eb33b6b21675511d693ef5e3c44bbf71cabc5175d879e7499f8baae2a1a09cf38da73297764fbc0e723e1cc3abb12e3076982ed32c94a2ce3e6f37c47e983da4ca5c96187db5a2a2e1742bc93a65d7187126126b3a80f17dd2f7dbbe82d104ede9ba6925afc2ee6cb94f56f1363cad635abf8f983292c49c0ebf5005154c7b58a3a2a2e5a00d2f953a86d2fd92b8661264f781e3fb02d05a28f3f17b64d0258853d45cb5ebde10cd3d82eeed2f1ed925b7cf400304932c5ed0a362b235ce37e1f17700f7d1fecf8be8a2c5d25a9c60657560d05441387ff158a018d19a286c56d0886eb59d509ee89cc2df52881d005b2e5c27563ba54e4153c132d0366a9660000000000000009c1aaec93ec0f925921fb2e9eb202a29bef28224dbabe723de5c584bc398a8792e493048c87f60a51a391e959212181d4bf32ed89c96d421c8171698c49403558fd13c649f90b0911d57eeb298b590581eba1ce383b539ab80fd15445987b1bb4eb512545e1ab65fef310e10b1ee362b51c72f82edf2f502ddf52567775e34a56d1be892f1e62b08950d517fa6fb1b0ef2edf1b67f8644786116b037d4a36fdd30b000063e58c856ec44cbbc2d370553f832af9480215e09aaa3843fe360b1c293a14627f2cfbe278f31d0abc0f5aaa10926dbbfe8a4b131c13a73d4e6d065c2c0fed3ab8442520ce0e0ad7d2d177377ab197ace3ef8b1c24ceb0bdee84bd6e6317633938dd19dc42de7f8f860eca6d9c74525fcd3497526df4c13e3ba5f0d75365a4542ae9440d2fede416d618cdaaf7e038879c5d177b3876fda4121e15a00adb976064a93e8d000000000000903350932d3eef7fdada20c19807066e2c72d0d816eb9fa50be213bf6bbb7ccb9f2e8a153e6ced68f192ebed6e86af0f2cec7335fa8039fd6eb025440bc2a34d071f0a0e6774308a2c5986aa9200a1306ffa5a71ca69e89a6980612b35fc858f37c2c398515a910a35e22ab0573c10b85df4c2972a2fb8b9c080fbb41a753791df727fdeadc5cf218a6eda31312256191c620cce34d1e3bf40a4a207ab1575b399eb8155781bfc7cb5920b49c039935a888d77041814f60fbbcafa487ee96b368e8769da90b44190e569fe8b1d155d0765baaca5c5548b5a78bb43e5d9e47a1d5809bb178184b5672d08e29aecf1f572ac1e6cab7e820751beed5f79de29a67a579150bfb31232d296b9d2977ed027ca90af7088d6466f1501d96a32bfa3cf9ab0dcd626ac9341833e92685af6917ae05473ae4768341426e244159b3c3e002b6f8ee80cbe6e26c816ab92658d956d849cd3a21ebf4b143d338035cd91f087633aa668e0644b05dc5a7937cd5fb62bd08242a858aeeda8c0cbb4fc2478a8155b859e88493f322702277939832bd4a1d8109f98c5a187564c9eb80acc63ac57459593c81ce8998e38ea231b81ebaa6b242ebdf382d70232f1d8e516a8eaf39d09ea40198cf1b72eb5ce5327d3a3861470be47a9a9dbf569e6f6f474fd1448adfd70c4f4a4487edaf193a00a808389a110a4286905ba81309735f6ac5d2ba7ab2be01fa25c11dbb3170258e9d9fed944fd85c03336a49f7016517a1988bc84ee301e167d3cf88c46c4eba6e2bfd099acd2eec5c624679aa7ebab76061a9ca792bffe3d6df4dbe70b5cab6299a51e63826fd0bda4846d06e322ebd745e73da718ba0c93e7567df9ed7ea8d2fdbde44e65a4cd01748b"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x8, 0x0, 0xff6c}, 0x48) socket$packet(0x11, 0x3, 0x300) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x56, 0x0, &(0x7f0000000100)="b9ff030f6044238cb89e14f088a81bff88641100404863334821ac14142ce934a0a662079f4b4d2f87e56dca6aab845013f208001a3901050b038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014caf28c0adc043084617d7ecf41e9d134589d46e5dfc4ca5780d38cae870b9a1df48b238190da450296b0ac01496ace23eefc9d4246dd14afbf79a2283a0bb7e1d235f3df126c3acc240d75a058f6efa6d1f5f7ff4000000000000000000", 0x0, 0xfb, 0x60006000, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000001c40)="beb61ec2ca90080239f2a54e2368fa761313c3a024a98109ba1e2e7b780d03c54b7a83d56fce397842e724674507d531762055fca371ea775f418df7bee236c9b9968146efb3232ae3413b617445e98bb644a892b9337f1a9135d9f30457a8ffb21aef4a95a155fab70a40b086056b0f63331a66b3457c", 0x2}, 0x2c) 851.568879ms ago: executing program 2 (id=3): mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x137) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_9p2000}]}}) write$P9_RVERSION(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff"], 0x15) 820.785499ms ago: executing program 1 (id=2): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x3, {0x2, 0x1, 0x1}}, 0x10) 780.96318ms ago: executing program 1 (id=9): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) ioctl$VT_OPENQRY(r0, 0x4b46, &(0x7f00000000c0)) 747.077101ms ago: executing program 1 (id=10): r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000640), 0x40, 0x0) ioctl$RTC_IRQP_SET(r0, 0x4008700c, 0xba1) 725.320302ms ago: executing program 2 (id=11): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x20, 0x800, 0x6}) openat$dir(0xffffffffffffff9c, 0x0, 0x121140, 0xd9) 693.424923ms ago: executing program 2 (id=12): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=@newsa={0x13c, 0x10, 0x413, 0x70bd28, 0x0, {{@in=@local, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x22, 0x7, 0x4e24, 0x0, 0xa, 0x20, 0x20, 0x1d}, {@in6=@initdev={0xfe, 0x88, '\x00', 0x3, 0x0}, 0x0, 0x32}, @in=@private=0xa010100, {0x4, 0x7, 0x0, 0x40000000000004, 0xfffffffffdffffff, 0x4, 0x7f}, {0x0, 0xffffffffffffffff, 0x3}, {0xf6, 0x4, 0xa}, 0x0, 0x34ff, 0x2, 0x1, 0xbe, 0x70}, [@algo_aead={0x4c, 0x12, {{'rfc4309(ccm(aes))\x00'}, 0x0, 0x80}}]}, 0x13c}}, 0x804) 692.972763ms ago: executing program 1 (id=13): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x972, &(0x7f0000006680)) r0 = syz_usb_connect(0x2, 0x3f, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000016038308c5109a8146e40102230109022d0001000000000904000003030000000905be3b"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000bc0)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f00000009c0)={0x44, &(0x7f00000000c0)={0x70, 0x3, 0x20, "2528e23894812e34b1f451f6a0075d16766b0b89aa466401c6412e40b9f31791"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 611.122434ms ago: executing program 2 (id=14): openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0xa0380, 0x0) socket$igmp6(0xa, 0x3, 0x2) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x8, 0x7, 0x7ffc0001}]}) close(r0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x12, 0x6, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r0}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{r1, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f00000001c0)=r0}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000440)={{r2, 0xffffffffffffffff}, &(0x7f00000004c0), &(0x7f0000000400)=r0}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000002c0)={r3, &(0x7f0000000080), &(0x7f0000000500)=""/216}, 0x20) 572.705826ms ago: executing program 2 (id=15): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="12010002000008404c05cc090000000000010902240001000090080904000009030003000921fdff080122090009058103"], 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x22, 0x9, {0x9}}}, 0x0) 487.130008ms ago: executing program 0 (id=16): r0 = syz_usb_connect(0x3, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="12010000b510f210950b2a7773820102030109022400010000000009042200028953950009050a02ff0300fa000905820250"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f0000000600)=ANY=[@ANYBLOB="001606"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000380)={0x2c, &(0x7f0000000180)={0x40, 0xf, 0x2, "e805"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000001500)={0x44, &(0x7f0000000340)={0x0, 0x5, 0x1, ';'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac2(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, 0x0) 0s ago: executing program 4 (id=17): bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, 0x0, 0x0) sendmsg$inet6(0xffffffffffffffff, 0x0, 0x0) fcntl$addseals(0xffffffffffffffff, 0x409, 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/module/firmware_class/parameters/path\x00', 0x101002, 0x0) read$FUSE(r0, &(0x7f0000002440)={0x2020}, 0x204e) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) setsockopt$inet6_IPV6_PKTINFO(0xffffffffffffffff, 0x29, 0x32, 0x0, 0x0) kernel console output (not intermixed with test programs): T30] audit: type=1400 audit(1786448314.749:62): avc: denied { rlimitinh } for pid=224 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.747144][ T30] audit: type=1400 audit(1786448314.749:63): avc: denied { siginh } for pid=224 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.61' (ED25519) to the list of known hosts. [ 21.849030][ T30] audit: type=1400 audit(1786448321.889:64): avc: denied { mounton } for pid=278 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.850060][ T278] cgroup: Unknown subsys name 'net' [ 21.871886][ T30] audit: type=1400 audit(1786448321.889:65): avc: denied { mount } for pid=278 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.899855][ T30] audit: type=1400 audit(1786448321.919:66): avc: denied { unmount } for pid=278 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.900035][ T278] cgroup: Unknown subsys name 'devices' [ 22.012726][ T278] cgroup: Unknown subsys name 'hugetlb' [ 22.018712][ T278] cgroup: Unknown subsys name 'rlimit' [ 22.154311][ T30] audit: type=1400 audit(1786448322.199:67): avc: denied { setattr } for pid=278 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.177979][ T30] audit: type=1400 audit(1786448322.199:68): avc: denied { mounton } for pid=278 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 22.183792][ T280] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.203981][ T30] audit: type=1400 audit(1786448322.199:69): avc: denied { mount } for pid=278 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.236994][ T30] audit: type=1400 audit(1786448322.259:70): avc: denied { relabelto } for pid=280 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.247909][ T278] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.263673][ T30] audit: type=1400 audit(1786448322.259:71): avc: denied { write } for pid=280 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.300280][ T30] audit: type=1400 audit(1786448322.289:72): avc: denied { read } for pid=278 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.326119][ T30] audit: type=1400 audit(1786448322.289:73): avc: denied { open } for pid=278 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.805436][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.812806][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.820149][ T287] device bridge_slave_0 entered promiscuous mode [ 22.855744][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.863106][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.871356][ T287] device bridge_slave_1 entered promiscuous mode [ 22.891766][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.898869][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.906306][ T290] device bridge_slave_0 entered promiscuous mode [ 22.913176][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.920208][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.927799][ T290] device bridge_slave_1 entered promiscuous mode [ 22.959818][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.967696][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.975541][ T289] device bridge_slave_0 entered promiscuous mode [ 22.983455][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.991628][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.000230][ T289] device bridge_slave_1 entered promiscuous mode [ 23.045097][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.052237][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.059980][ T288] device bridge_slave_0 entered promiscuous mode [ 23.068056][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.075352][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.082923][ T288] device bridge_slave_1 entered promiscuous mode [ 23.094567][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.101720][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.109156][ T286] device bridge_slave_0 entered promiscuous mode [ 23.116080][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.123143][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.130720][ T286] device bridge_slave_1 entered promiscuous mode [ 23.318430][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.325536][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.332849][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.339882][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.349873][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.356935][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.364322][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.371453][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.380964][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.388124][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.397892][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.405146][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.412428][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.419463][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.429041][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.436123][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.443424][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.450597][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.509592][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.518103][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.525655][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.534104][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.542140][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.549763][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.557144][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.564449][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.571890][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.579713][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.587466][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.601468][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.609102][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.616745][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.624998][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.632168][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.639673][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.648112][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.655268][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.662892][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.671130][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.678158][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.703577][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.712130][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.720819][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.728159][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.736863][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.745615][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.752947][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.761009][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.769738][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.776991][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.785060][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.793779][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.802459][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.810743][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.828803][ T290] device veth0_vlan entered promiscuous mode [ 23.844222][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.853054][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.861473][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.869197][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.877268][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.885549][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.893865][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.901408][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.908775][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.917203][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.924332][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.932204][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.940427][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.947607][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.955397][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.963959][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.972532][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.979887][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.007230][ T290] device veth1_macvtap entered promiscuous mode [ 24.015089][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.024589][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.033310][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.042286][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.051047][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.058113][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.065725][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.073971][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.082506][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.090054][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.098226][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.106182][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.114617][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.123155][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.131613][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.142478][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.150777][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.162946][ T286] device veth0_vlan entered promiscuous mode [ 24.170765][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.178868][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.188214][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.196142][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.215523][ T287] device veth0_vlan entered promiscuous mode [ 24.223516][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.232566][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.241344][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.249538][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.258799][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.267025][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.276087][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.284733][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.294574][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.302292][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.315161][ T286] device veth1_macvtap entered promiscuous mode [ 24.325264][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.340826][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.349240][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.357917][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.366944][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.376093][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.384443][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.403529][ T290] request_module fs-gadgetfs succeeded, but still no fs? [ 24.408709][ T288] device veth0_vlan entered promiscuous mode [ 24.431394][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.439927][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.448097][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.456203][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.464701][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.473622][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.482161][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.490193][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.498040][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.505653][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.513592][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.522686][ T287] device veth1_macvtap entered promiscuous mode [ 24.530408][ T289] device veth0_vlan entered promiscuous mode [ 24.572297][ T288] device veth1_macvtap entered promiscuous mode [ 24.694980][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.794060][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.865609][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.876357][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.889304][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.898408][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.913914][ T289] device veth1_macvtap entered promiscuous mode [ 24.941032][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.000315][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.020511][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.049828][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.071301][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.128292][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.151367][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.160984][ T26] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 25.186167][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.230491][ T199] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.326387][ T332] tipc: Can't bind to reserved service type 2 [ 25.366364][ T330] 9pnet: p9_errstr2errno: server reported unknown error [ 25.410667][ T26] usb 4-1: Using ep0 maxpacket: 16 [ 25.530709][ T26] usb 4-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xF3, skipping [ 25.710701][ T26] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 25.720304][ T26] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.728711][ T39] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 25.736639][ T26] usb 4-1: Product: syz [ 25.741262][ T26] usb 4-1: Manufacturer: syz [ 25.746007][ T26] usb 4-1: SerialNumber: syz [ 25.752749][ T26] usb 4-1: config 0 descriptor?? [ 25.830661][ T327] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 25.910610][ T6] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 26.008545][ T60] usb 4-1: USB disconnect, device number 2 [ 26.120796][ T39] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 26.131511][ T39] usb 2-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xBE, skipping [ 26.133036][ T358] ================================================================== [ 26.142640][ T39] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 26.150663][ T358] BUG: KASAN: slab-out-of-bounds in firmware_param_path_get+0x348/0x350 [ 26.150703][ T358] Write of size 1 at addr ffff888111813fff by task syz.4.17/358 [ 26.150721][ T358] [ 26.150726][ T358] CPU: 0 PID: 358 Comm: syz.4.17 Not tainted syzkaller #0 [ 26.150745][ T358] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.200000][ T358] Call Trace: [ 26.203281][ T358] [ 26.206208][ T358] __dump_stack+0x21/0x30 [ 26.210559][ T358] dump_stack_lvl+0x110/0x170 [ 26.215286][ T358] ? show_regs_print_info+0x20/0x20 [ 26.220970][ T358] ? load_image+0x3f0/0x3f0 [ 26.226124][ T358] print_address_description+0x7f/0x2c0 [ 26.231704][ T358] ? firmware_param_path_get+0x348/0x350 [ 26.237564][ T358] kasan_report+0x10f/0x150 [ 26.242255][ T358] ? firmware_param_path_get+0x348/0x350 [ 26.248216][ T358] __asan_report_store1_noabort+0x17/0x20 [ 26.254049][ T358] firmware_param_path_get+0x348/0x350 [ 26.259834][ T358] param_attr_show+0x150/0x1b0 [ 26.264828][ T358] ? module_destroy_params+0x100/0x100 [ 26.270664][ T358] ? param_attr_store+0x320/0x320 [ 26.275888][ T358] module_attr_show+0x56/0x70 [ 26.280924][ T358] sysfs_kf_seq_show+0x266/0x3d0 [ 26.286104][ T358] kernfs_seq_show+0x119/0x160 [ 26.291149][ T358] seq_read_iter+0x472/0xce0 [ 26.296393][ T358] kernfs_fop_read_iter+0x146/0x460 [ 26.301725][ T358] vfs_read+0x6c0/0xc20 [ 26.305977][ T358] ? kernel_read+0x1f0/0x1f0 [ 26.310833][ T358] ? wait_for_completion_killable_timeout+0x10/0x10 [ 26.317859][ T358] ? __fget_files+0x2e1/0x340 [ 26.322656][ T358] ? __fdget_pos+0x2d2/0x380 [ 26.327262][ T358] ? ksys_read+0x70/0x260 [ 26.331593][ T358] ksys_read+0x14a/0x260 [ 26.336283][ T358] ? vfs_write+0xfd0/0xfd0 [ 26.340697][ T358] ? __kasan_check_write+0x14/0x20 [ 26.345900][ T358] ? switch_fpu_return+0x15d/0x2c0 [ 26.351011][ T358] __x64_sys_read+0x7b/0x90 [ 26.355512][ T358] x64_sys_call+0x96d/0x9a0 [ 26.360115][ T358] do_syscall_64+0x4c/0xa0 [ 26.365021][ T358] ? clear_bhb_loop+0x50/0xa0 [ 26.369726][ T358] ? clear_bhb_loop+0x50/0xa0 [ 26.374410][ T358] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 26.380304][ T358] RIP: 0033:0x7fce9f8bc0d9 [ 26.384750][ T358] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 26.405073][ T358] RSP: 002b:00007fce9e315028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 26.413495][ T358] RAX: ffffffffffffffda RBX: 00007fce9fb43fa0 RCX: 00007fce9f8bc0d9 [ 26.421505][ T358] RDX: 000000000000204e RSI: 0000200000002440 RDI: 0000000000000003 [ 26.429478][ T358] RBP: 00007fce9f953024 R08: 0000000000000000 R09: 0000000000000000 [ 26.437451][ T358] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 26.445452][ T358] R13: 00007fce9fb44038 R14: 00007fce9fb43fa0 R15: 00007ffcb6545be8 [ 26.453800][ T358] [ 26.456904][ T358] [ 26.459230][ T358] Allocated by task 309: [ 26.463558][ T358] __kasan_kmalloc+0xd4/0x100 [ 26.468355][ T358] kmem_cache_alloc_trace+0x119/0x270 [ 26.474299][ T358] kernfs_iop_get_link+0x66/0x600 [ 26.479769][ T358] vfs_readlink+0x16f/0x3e0 [ 26.484296][ T358] do_readlinkat+0x251/0x490 [ 26.489159][ T358] __x64_sys_readlink+0x7f/0x90 [ 26.494135][ T358] x64_sys_call+0x93c/0x9a0 [ 26.498737][ T358] do_syscall_64+0x4c/0xa0 [ 26.503176][ T358] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 26.509100][ T358] [ 26.511437][ T358] Freed by task 309: [ 26.515328][ T358] kasan_set_track+0x4a/0x70 [ 26.520282][ T358] kasan_set_free_info+0x23/0x40 [ 26.525707][ T358] ____kasan_slab_free+0x125/0x160 [ 26.530925][ T358] __kasan_slab_free+0x11/0x20 [ 26.535883][ T358] slab_free_freelist_hook+0xc2/0x190 [ 26.541520][ T358] kfree+0xc4/0x270 [ 26.545348][ T358] kfree_link+0x15/0x20 [ 26.549517][ T358] vfs_readlink+0x220/0x3e0 [ 26.554033][ T358] do_readlinkat+0x251/0x490 [ 26.558818][ T358] __x64_sys_readlink+0x7f/0x90 [ 26.563668][ T358] x64_sys_call+0x93c/0x9a0 [ 26.568168][ T358] do_syscall_64+0x4c/0xa0 [ 26.572670][ T358] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 26.578560][ T358] [ 26.580880][ T358] The buggy address belongs to the object at ffff888111812000 [ 26.580880][ T358] which belongs to the cache kmalloc-4k of size 4096 [ 26.595015][ T358] The buggy address is located 4095 bytes to the right of [ 26.595015][ T358] 4096-byte region [ffff888111812000, ffff888111813000) [ 26.609068][ T358] The buggy address belongs to the page: [ 26.614695][ T358] page:ffffea0004460400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x111810 [ 26.625020][ T358] head:ffffea0004460400 order:3 compound_mapcount:0 compound_pincount:0 [ 26.633447][ T358] flags: 0x4000000000010200(slab|head|zone=1) [ 26.639609][ T358] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043380 [ 26.648202][ T358] raw: 0000000000000000 0000000080040004 00000001ffffffff 0000000000000000 [ 26.657471][ T358] page dumped because: kasan: bad access detected [ 26.663878][ T358] page_owner tracks the page as allocated [ 26.669592][ T358] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 113, ts 5221150586, free_ts 0 [ 26.687876][ T358] post_alloc_hook+0x192/0x1b0 [ 26.692740][ T358] prep_new_page+0x1c/0x110 [ 26.697241][ T358] get_page_from_freelist+0x2c3a/0x2cd0 [ 26.702787][ T358] __alloc_pages+0x1a2/0x460 [ 26.707378][ T358] new_slab+0xa0/0x4d0 [ 26.711441][ T358] ___slab_alloc+0x3ac/0x840 [ 26.716443][ T358] __slab_alloc+0x49/0x90 [ 26.720981][ T358] kmem_cache_alloc_trace+0x146/0x270 [ 26.726567][ T358] kernfs_iop_get_link+0x66/0x600 [ 26.731878][ T358] vfs_readlink+0x16f/0x3e0 [ 26.736732][ T358] do_readlinkat+0x251/0x490 [ 26.741516][ T358] __x64_sys_readlink+0x7f/0x90 [ 26.746714][ T358] x64_sys_call+0x93c/0x9a0 [ 26.751490][ T358] do_syscall_64+0x4c/0xa0 [ 26.756083][ T358] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 26.762153][ T358] page_owner free stack trace missing [ 26.767933][ T358] [ 26.770533][ T358] Memory state around the buggy address: [ 26.776361][ T358] ffff888111813e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.784744][ T358] ffff888111813f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.793086][ T358] >ffff888111813f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 26.801144][ T358] ^ [ 26.809116][ T358] ffff888111814000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.817705][ T358] ffff888111814080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.825776][ T358] ================================================================== [ 26.833851][ T358] Disabling lock debugging due to kernel taint [ 26.841317][ T6] usb 1-1: Using ep0 maxpacket: 16 [ 26.854229][ T30] kauditd_printk_skb: 63 callbacks suppressed [ 26.854244][ T30] audit: type=1400 audit(1786448326.899:137): avc: denied { read } for pid=83 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 26.882441][ T30] audit: type=1400 audit(1786448326.899:138): avc: denied { search } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 26.904121][ T39] usb 2-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 26.905028][ T30] audit: type=1400 audit(1786448326.899:139): avc: denied { write } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 26.915389][ T39] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 26.940460][ T30] audit: type=1400 audit(1786448326.899:140): avc: denied { add_name } for pid=83 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 26.945069][ T39] usb 2-1: Product: syz [ 26.964798][ T30] audit: type=1400 audit(1786448326.899:141): avc: denied { create } for pid=83 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 26.968892][ T39] usb 2-1: Manufacturer: syz [ 26.990158][ T30] audit: type=1400 audit(1786448326.899:142): avc: denied { append open } for pid=83 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 26.994944][ T39] usb 2-1: SerialNumber: syz [ 27.018176][ T30] audit: type=1400 audit(1786448326.899:143): avc: denied { getattr } for pid=83 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 27.023893][ T39] usb 2-1: config 0 descriptor?? [ 27.045935][ T327] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 27.052831][ T30] audit: type=1400 audit(1786448326.929:144): avc: denied { unmount } for pid=288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 27.063065][ T327] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 27.091618][ T6] usb 1-1: config 0 has an invalid interface number: 34 but max is 0 [ 27.099817][ T6] usb 1-1: config 0 has no interface number 0 [ 27.101135][ T39] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 27.106279][ T6] usb 1-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 27.123390][ T327] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 27.136371][ T327] usb 3-1: New USB device found, idVendor=054c, idProduct=09cc, bcdDevice= 0.00 [ 27.145512][ T6] usb 1-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 27.155648][ T327] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.164449][ T327] usb 3-1: config 0 descriptor?? [ 27.320838][ T6] usb 1-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 27.330243][ T6] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.338555][ T6] usb 1-1: Product: syz [ 27.342903][ T6] usb 1-1: Manufacturer: syz [ 27.347955][ T6] usb 1-1: SerialNumber: syz [ 27.353629][ T6] usb 1-1: config 0 descriptor?? [ 27.370771][ T356] raw-gadget.3 gadget: fail, usb_ep_enable returned -22 [ 27.377851][ T356] raw-gadget.3 gadget: fail, usb_ep_enable returned -22 [ 27.592642][ T356] raw-gadget.3 gadget: fail, usb_ep_enable returned -22 [ 27.599832][ T356] raw-gadget.3 gadget: fail, usb_ep_enable returned -22 [ 27.641939][ T327] sony 0003:054C:09CC.0001: unknown main item tag 0x0 [ 27.648749][ T327] sony 0003:054C:09CC.0001: unknown main item tag 0x0 [ 27.655878][ T327] sony 0003:054C:09CC.0001: unknown main item tag 0x0 [ 27.662725][ T327] sony 0003:054C:09CC.0001: unknown main item tag 0x0 [ 27.669495][ T327] sony 0003:054C:09CC.0001: unknown main item tag 0x0 [ 27.676524][ T327] sony 0003:054C:09CC.0001: unknown main item tag 0x0 [ 27.684157][ T327] sony 0003:054C:09CC.0001: hidraw0: USB HID vff.fd Device [HID 054c:09cc] on usb-dummy_hcd.2-1/input0 [ 27.695726][ T327] sony 0003:054C:09CC.0001: failed to claim input [ 27.830686][ T6] asix 1-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 27.867672][ T327] usb 3-1: USB disconnect, device number 2 [ 28.443419][ T359] usb 2-1: USB disconnect, device number 2 [ 29.120707][ T6] asix 1-1:0.34 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 29.131289][ T6] asix 1-1:0.34 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 29.142010][ T6] asix: probe of 1-1:0.34 failed with error -71 [ 29.149529][ T6] usb 1-1: USB disconnect, device number 2