last executing test programs: 4.095968366s ago: executing program 4 (id=1323): r0 = socket$kcm(0x29, 0x2, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001000)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef42d430f6296b72a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed40000000022278d00031e5388ee5c867ddd58211d6ece3ccb0cd2b6d3cffd962867a3a2f624f992daa94a6a556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff020000000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409e011f1264d43f153b3d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7000026a4e739c60f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf3f704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eedd9068ca1457870eb30d219e23ccc8e06dddeb61799257ab5000013c86ba99523d61a00000000c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb8629aeec90e6d1857da822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae200f279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522e8dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87995b51cb6febd5f34a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724be3733c26f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be10ba7dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2db484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b00ffffff7f000000000801f71d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cf0d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67856ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e2b8e7370baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b09000000d31df213c802d74797056fd3bca8b2d6cb134437cba0193ba4360bdcc98aad2560aa48291c4eb9d4e08ad7a9c5f04be1ab597124d84dfc7bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b8dd4221fff0f0000705d7257ff7f76c78ba0b44ec0bdfa0d32d7042059b13a079639f14f9032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e0caac037209d2f14fcddd00000000000000000000000000000000e609893bdce015e8ccfb36399844db61f6171b0b0e845e48728450c6ba4f7098f8e000676b59ab9f851f3ab77847ce05c89411277ec69c409b7ec50a3337a78675f38a568612c235ab5f2cd6d035d5f5f6a693c381adbbf7b37e37292783b2c7efe7d3a067906552f76d419e0300000000000000000000008f3a20b49fe7636806867283e35cff8d00e7b251bab3cf6377a24f8e8d4bda7503674bc94bf7f4d2fa6f25944bf0a186436d9f6831995976328a1fdc78492c65c1434855dc35c3cf7cf9610c5387794443c99b304799114132362849c3fa85d6379729ff9094933db0cfbe8887c50b87e1469fdf454cef4cbc5f7bf384000000000000a4e8c1a25f47c440144a9776be6cb40aafdb9d3cc8f6a6050974e1c4000000000000008b753f4e1bef9556efcc087a99dbf231167013a4b2eaf6338a0b100c98a331dffc09"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x30}, 0x48) r2 = socket$kcm(0x2, 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{0x0}], 0x1, 0x0, 0x0, 0x7400}, 0x20004800) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000040)={r2, r1}) sendmsg$kcm(r0, &(0x7f0000002080)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f0000000880)="1a", 0x100000}], 0x1}, 0x11) 4.067641593s ago: executing program 1 (id=1325): syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) syz_emit_vhci(0x0, 0xb) 4.019813367s ago: executing program 4 (id=1327): r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) munmap(&(0x7f0000c75000/0x4000)=nil, 0x4000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0x28f41000) r1 = memfd_secret(0x80000) mmap(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x13, r1, 0x0) ioctl$UFFDIO_MOVE(r0, 0xc028aa05, &(0x7f0000000140)={&(0x7f0000fff000/0x1000)=nil, &(0x7f0000c76000/0x1000)=nil, 0x1000, 0x1}) 3.894795168s ago: executing program 1 (id=1328): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x43, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=@newtaction={0x8c, 0x30, 0xffff, 0xfffffffe, 0x25dfdbfb, {}, [{0x78, 0x1, [@m_ct={0x74, 0x20, 0x0, 0x0, {{0x7}, {0x30, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xee7, 0x8001, 0x20000000, 0x8, 0x6}}, @TCA_CT_LABELS={0x14, 0x7, "d4f85f02296fe3daf8521bd2abf2b5f9"}]}, {0x1e, 0x6, "bc355c78c942c2cf7afcf6fb701bada36dba156096ceae154cf9"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x20004000}, 0x20000010) openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) pidfd_send_signal(0xffffffffffffffff, 0x0, 0x0, 0x7) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r2, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @loopback, 0x3}, 0x7e) sendto$inet6(r2, &(0x7f0000847fff)='X', 0x1, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}, 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x66, &(0x7f0000000080)={r3, 0x20005}, &(0x7f0000000100)=0x8) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0500000003f01f00040000009a0000"], 0x48) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_open_dev$I2C(0x0, 0x9, 0x940) openat(0xffffffffffffff9c, 0x0, 0x105042, 0xb) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bind$inet(r4, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r4, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) writev(r4, &(0x7f0000000200)=[{&(0x7f00000000c0)='X', 0x8030000}], 0x1) shutdown(r4, 0x1) 3.79401039s ago: executing program 2 (id=1330): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./dev/ram0\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000001000)="fc4e2ba9", 0x4, 0x1000) pwrite64(r0, &(0x7f0000001004)="01", 0x1, 0x1004) pwrite64(r0, &(0x7f0000001008)="01", 0x1, 0x1008) pwrite64(r0, &(0x7f000000100c)='\b', 0x1, 0x1060) pwrite64(r0, &(0x7f0000001010)="10", 0x1, 0x1080) pwrite64(r0, &(0x7f0000001018)='\n', 0x1, 0x1088) pwrite64(r0, &(0x7f0000001020)='\b', 0x1, 0x1090) pwrite64(r0, &(0x7f0000001028)="284f2ba9", 0x4, 0x10d8) fsync(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='md0', 0x3) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0) write(r2, &(0x7f0000000600)='1.2', 0x3) r3 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r3, &(0x7f0000000800)='1:0', 0x3) write(0xffffffffffffffff, &(0x7f0000000a00)='writemostly', 0xb) 3.603229991s ago: executing program 2 (id=1332): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) ftruncate(r0, 0x200000) pwrite64(r0, &(0x7f0000000100)="0000010042", 0x5, 0x1be) pwrite64(r0, &(0x7f0000000100)="55aa", 0x2, 0x1fe) pwrite64(r0, &(0x7f0000000100)='PRIVHEAD', 0x8, 0xc00) pwrite64(r0, &(0x7f0000000100)="0002000b", 0x4, 0xc0c) pwrite64(r0, &(0x7f0000000100)='12345678-1234-1234-1234-123456789612', 0x24, 0xc30) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\a', 0x7, 0xd23) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\b', 0x7, 0xd2b) pwrite64(r0, &(0x7f0000000100)='PRIVHEAD', 0x8, 0x1e8000) pwrite64(r0, &(0x7f0000000100)='12345678-1234-1234-1234-123456789612', 0x24, 0x1e8030) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\a', 0x7, 0x1e8123) pwrite64(r0, &(0x7f00000000c0)="da", 0x1, 0x1e812b) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', '\x00', '\x00', [0x0, 0x3]}) 3.070513007s ago: executing program 4 (id=1335): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x43, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=@newtaction={0x8c, 0x30, 0xffff, 0xfffffffe, 0x25dfdbfb, {}, [{0x78, 0x1, [@m_ct={0x74, 0x20, 0x0, 0x0, {{0x7}, {0x30, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xee7, 0x8001, 0x20000000, 0x8, 0x6}}, @TCA_CT_LABELS={0x14, 0x7, "d4f85f02296fe3daf8521bd2abf2b5f9"}]}, {0x1e, 0x6, "bc355c78c942c2cf7afcf6fb701bada36dba156096ceae154cf9"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x20004000}, 0x20000010) openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) pidfd_send_signal(0xffffffffffffffff, 0x0, 0x0, 0x7) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r1, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @loopback, 0x3}, 0x7e) sendto$inet6(r1, &(0x7f0000847fff)='X', 0x1, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}, 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f0000000080)={r2, 0x20005}, &(0x7f0000000100)=0x8) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0500000003f01f00040000009a00000001"], 0x48) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_open_dev$I2C(0x0, 0x9, 0x940) openat(0xffffffffffffff9c, 0x0, 0x105042, 0xb) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r3, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) writev(r3, &(0x7f0000000200)=[{&(0x7f00000000c0)='X', 0x8030000}], 0x1) shutdown(r3, 0x1) 3.032273896s ago: executing program 2 (id=1336): r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r0, &(0x7f0000000800)='1:0', 0x3) 2.803015241s ago: executing program 1 (id=1337): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0xc000) 2.802598917s ago: executing program 2 (id=1338): socket$nl_netfilter(0x10, 0x3, 0xc) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x0) close(0xffffffffffffffff) setns(0xc9, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)={0x2c, 0x13, 0x821, 0x0, 0x0, "", [@typed={0x8, 0x0, 0x0, 0x0, @fd=r1}, @typed={0x6, 0x0, 0x0, 0x0, @str='!\xa5'}, @typed={0xc, 0x1, 0x0, 0x0, @u64=0x3}]}, 0x2c}], 0x1}, 0x0) 2.697116557s ago: executing program 1 (id=1339): openat$comedi(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xb, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x8042, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d5, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r5, 0x1, &(0x7f0000000040), 0x0) process_vm_writev(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x44, 0x6, 0x3c8, 0x168, 0x168, 0x0, 0x200, 0x168, 0x370, 0x370, 0x370, 0x370, 0x370, 0x6, 0x0, {[{{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x13}, 0xff, 0xff000000, 'pim6reg1\x00', 'bridge_slave_0\x00', {}, {0xff}, 0x88, 0x3}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x3, 0x3}}}, {{@ip={@private=0xa010100, @local, 0x0, 0x0, 'vcan0\x00', 'veth0_virt_wifi\x00', {}, {0xff}}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x0, 0x1], 0x1}, {0x0, [0x0, 0x0, 0x0, 0x2, 0x4]}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0xff, 0xff, 'bond_slave_0\x00', 'veth1_virt_wifi\x00', {}, {0xff}, 0x5c, 0x2}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@private=0xa010102, @multicast1, 0x0, 0xffffff00, 'syzkaller0\x00', 'bond0\x00', {}, {}, 0x0, 0x0, 0x13}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@remote, @loopback, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0x98}, @ECN={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x428) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) 1.583934866s ago: executing program 1 (id=1342): r0 = syz_open_dev$sg(&(0x7f0000001600), 0x0, 0x40042) write$binfmt_aout(r0, 0x0, 0x125) 1.460254636s ago: executing program 2 (id=1344): r0 = socket$inet(0x2, 0x1, 0x6) bind$inet(r0, &(0x7f0000000000)={0x2, 0x801, @loopback}, 0x10) listen(r0, 0x5) setsockopt$inet_buf(r0, 0x0, 0x1, &(0x7f0000000300)="800001000000000000000001", 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':\x00'/18, &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000100), 0x0, &(0x7f0000000140)={[{'addr=127.0.0.1,port=2049,mountport=2049,proto=tcp,mountproto=tcp,nolock,timeo=10,retrans=1\x00'}]}) 1.457714065s ago: executing program 3 (id=1345): r0 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi1\x00', 0x0, 0x0) ioctl$COMEDI_INSN(r0, 0x8028640c, 0x0) 1.321963616s ago: executing program 3 (id=1346): r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) munmap(&(0x7f0000c75000/0x4000)=nil, 0x4000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0x28f41000) r1 = memfd_secret(0x80000) mmap(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x13, r1, 0x0) ioctl$UFFDIO_MOVE(r0, 0xc028aa05, &(0x7f0000000140)={&(0x7f0000fff000/0x1000)=nil, &(0x7f0000c76000/0x1000)=nil, 0x1000, 0x1}) 1.09223425s ago: executing program 4 (id=1347): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000000000)={0x0, 0x1, 0x2, 0x0, @vifc_lcl_ifindex, @local}, 0x10) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f00000004c0)=[{&(0x7f0000000000)=""/216, 0xd8}], 0x1, 0xa3, 0xd) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000300)=[{&(0x7f0000000400)=""/110, 0x6e}, {&(0x7f0000000280)=""/85, 0x55}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f00000006c0)=""/118, 0x76}, {&(0x7f0000000980)=""/73, 0x49}, {&(0x7f00000007c0)=""/154, 0x9a}, {&(0x7f00000001c0)=""/17, 0x11}], 0x7, &(0x7f0000001fc0)=""/191, 0xbf}}], 0x1, 0x0, &(0x7f0000003700)={0x77359400}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x8082}, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) r3 = socket$kcm(0x23, 0x5, 0x0) listen(r3, 0x800) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000f00)=[{&(0x7f0000000200)="5c00000014006b05c84e21000ab16d6e230675f811000000440002005817d30461bc24eeb556a7ef595105ea1698fa51f60a64c9f408000000e786a6d0bdbdc3d44bd70011b6c0504bb9189d9193e9bd00"/92, 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x240040c4) r5 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r5, &(0x7f0000000040)={0x23, 0x0, 0x58}, 0x10) r6 = accept4(r3, 0x0, 0x0, 0x80000) syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r6) write(r2, &(0x7f0000000000)='3', 0x4e) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001400), 0x2, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8041, 0x0) 988.194853ms ago: executing program 1 (id=1348): socket(0x10, 0x3, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x20040, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) ioctl$TIOCMGET(0xffffffffffffffff, 0x5415, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, 0x0, 0x0) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff) mount$afs(0x0, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42f82, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000040)=0x200) write$dsp(r1, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) sendmsg$NL80211_CMD_DEL_PMK(0xffffffffffffffff, 0x0, 0x4040001) r2 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) ioctl$SNDCTL_SYNTH_ID(r2, 0xc08c5114, 0x0) sched_setscheduler(0x0, 0x1, 0x0) 885.80035ms ago: executing program 0 (id=1351): r0 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010000000000000000000100000044000180060001000200000008000500000000000c00070000000000000000000800090000000000090006006e6f6e6500120000080008"], 0x58}}, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000380), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_FLUSH(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000100)=ANY=[@ANYBLOB="c4000000", @ANYRES16=r2, @ANYBLOB="01000000000000000000020000002c000280060002004e2000000800090010000000060002004e210000080007000101000006000f000700000008000400ff7fffff1400028008000600020000000800090008000000080004000200000060000180080009005600000007000600666f00000c0007002000000002000000080008000100000008000b00736970000600010002000000080005"], 0xc4}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000380)='1', 0x1) socket$inet(0x2, 0x2, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000300)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x14, 0x40, 0x0, 0x40, 0x11, 0x0, @private=0xa010101, @private=0xa010102}, {0x4e20, 0x4e20, 0x8}}}}}, 0x0) 849.834094ms ago: executing program 0 (id=1352): syz_open_dev$vim2m(&(0x7f0000000000), 0x9aec, 0x2) r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@newqdisc={0x34, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0x9}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x4, 0x8002}}]}, 0x34}, 0x1, 0x0, 0x0, 0x2000c043}, 0x2000400c) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=ANY=[@ANYBLOB="540000001400b59500000000000000000a000000", @ANYRES32=r2, @ANYBLOB="140001000040"], 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x80) r3 = socket$packet(0x11, 0x2, 0x300) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r3, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x11, 0x88a8, r5, 0x1, 0x0, 0x6, @local}, 0x14) 813.765815ms ago: executing program 0 (id=1353): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x5f, 0x4, 0xb47e, 0xb, 0x3, 0xd, 0xf, 0x1fe}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c8}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000280)=@newtfilter={0x88, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r6, {0xffff, 0x3}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0xedad, 0x80000001, 0x10000000, 0x6, 0x401}, 0x4}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x2}}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0xc0}, 0x20044004) r7 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r7, &(0x7f00000000c0)={&(0x7f0000000480)=@xdp={0x2c, 0x7, r8, 0x3e}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000340)="2c548f2664234aea5882c40b008c", 0xe}], 0x1, 0x0, 0x0, 0x86dd}, 0x40045) 667.168285ms ago: executing program 0 (id=1354): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newqdisc={0x44, 0x24, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x0, 0x6}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_red={{0x8}, {0x18, 0x2, [@TCA_RED_PARMS={0x14, 0x1, {0x1000, 0x10, 0x80, 0x8, 0x8, 0x8}}]}}]}, 0x44}}, 0x0) r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000001300)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050204e5"], 0x0) setns(0xc9, 0x0) r1 = socket(0x8, 0x5, 0x5) unlinkat(0xffffffffffffff9c, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r1, 0x40106183, &(0x7f0000000240)) 514.802232ms ago: executing program 2 (id=1355): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x524, &(0x7f0000000040)={0x0, 0xbc93, 0x1c080, 0x0, 0x20002f7}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r1, &(0x7f0000000180)='10000', 0x5) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r2, &(0x7f0000000280)='0', 0x1) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 405.534992ms ago: executing program 3 (id=1356): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0xc000) 336.860889ms ago: executing program 3 (id=1357): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000680)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x3, 0x6, 0x7, 0x200, 0x4, 0x8, 0x8ed, 0x10, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x8810) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r5) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) r7 = socket$unix(0x1, 0x2, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r9, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8, 0x3, 0x6, 0x1, 0x1, 0xd, 0xfff, 0xfffffffa, 0x8}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56561, 0x70bd2b, 0x1, {0x0, 0x0, 0x0, r11, {0x0, 0x6}, {0xfff2, 0x8}, {0x7, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8922, 0x0) 187.196972ms ago: executing program 4 (id=1358): r0 = syz_open_dev$sg(&(0x7f0000001600), 0x0, 0x40042) write$binfmt_aout(r0, 0x0, 0x125) 139.132662ms ago: executing program 3 (id=1359): r0 = socket$kcm(0x29, 0x2, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001000)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef42d430f6296b72a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed40000000022278d00031e5388ee5c867ddd58211d6ece3ccb0cd2b6d3cffd962867a3a2f624f992daa94a6a556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff020000000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409e011f1264d43f153b3d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7000026a4e739c60f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf3f704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eedd9068ca1457870eb30d219e23ccc8e06dddeb61799257ab5000013c86ba99523d61a00000000c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb8629aeec90e6d1857da822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae200f279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522e8dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87995b51cb6febd5f34a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724be3733c26f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be10ba7dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2db484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b00ffffff7f000000000801f71d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cf0d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67856ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e2b8e7370baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b09000000d31df213c802d74797056fd3bca8b2d6cb134437cba0193ba4360bdcc98aad2560aa48291c4eb9d4e08ad7a9c5f04be1ab597124d84dfc7bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b8dd4221fff0f0000705d7257ff7f76c78ba0b44ec0bdfa0d32d7042059b13a079639f14f9032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e0caac037209d2f14fcddd00000000000000000000000000000000e609893bdce015e8ccfb36399844db61f6171b0b0e845e48728450c6ba4f7098f8e000676b59ab9f851f3ab77847ce05c89411277ec69c409b7ec50a3337a78675f38a568612c235ab5f2cd6d035d5f5f6a693c381adbbf7b37e37292783b2c7efe7d3a067906552f76d419e0300000000000000000000008f3a20b49fe7636806867283e35cff8d00e7b251bab3cf6377a24f8e8d4bda7503674bc94bf7f4d2fa6f25944bf0a186436d9f6831995976328a1fdc78492c65c1434855dc35c3cf7cf9610c5387794443c99b304799114132362849c3fa85d6379729ff9094933db0cfbe8887c50b87e1469fdf454cef4cbc5f7bf384000000000000a4e8c1a25f47c440144a9776be6cb40aafdb9d3cc8f6a6050974e1c4000000000000008b753f4e1bef9556efcc087a99dbf231167013a4b2eaf6338a0b100c98a331dffc09"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x30}, 0x48) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{0x0}], 0x1, 0x0, 0x0, 0x7400}, 0x20004800) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000040)={0xffffffffffffffff, r1}) sendmsg$kcm(r0, &(0x7f0000002080)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f0000000880)="1a", 0x100000}], 0x1}, 0x11) 129.802575ms ago: executing program 0 (id=1360): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000180)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000300000000000000000000f195"], 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={0xffffffffffffffff, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)="2e00000010008188040f80ec59acbc0413a181000b00000000010000000000000e000a000f000000028002002d1f", 0x2e}], 0x1}, 0x80) 82.722053ms ago: executing program 4 (id=1361): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x110) read(r0, &(0x7f0000000100)=""/9, 0xfffffd87) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) recvmsg$unix(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000006c0)=""/179, 0x33fe0}], 0x1}, 0x0) write$tun(r0, &(0x7f00000000c0)=ANY=[], 0xffe) 13.201365ms ago: executing program 3 (id=1362): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./dev/ram0\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000001000)="fc4e2ba9", 0x4, 0x1000) pwrite64(r0, &(0x7f0000001004)="01", 0x1, 0x1004) pwrite64(r0, &(0x7f0000001008)="01", 0x1, 0x1008) pwrite64(r0, &(0x7f000000100c)='\b', 0x1, 0x1060) pwrite64(r0, &(0x7f0000001010)="10", 0x1, 0x1080) pwrite64(r0, &(0x7f0000001018)='\n', 0x1, 0x1088) pwrite64(r0, &(0x7f0000001020)='\b', 0x1, 0x1090) pwrite64(r0, &(0x7f0000001028)="284f2ba9", 0x4, 0x10d8) fsync(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='md0', 0x3) openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram0/state\x00', 0x1, 0x0) write(r2, &(0x7f0000000a00)='writemostly', 0xb) 0s ago: executing program 0 (id=1363): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000000480)=""/74, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000400)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000000340)=""/185, 0x0}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000001500)={@my=0x1}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000200)={0x28, 0x0, 0xffffffff, @my=0x1}, 0x10) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0xc1) r2 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x7a32, 0xc000, 0x7, 0x337}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {}, {0x0, 0xffff}}}, 0x24}}, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) sendmsg(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)='9', 0x1}], 0x1, 0x0, 0x0, 0x2c}, 0x4004855) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) kernel console output (not intermixed with test programs): r: mce write urb status = -71 [ 335.628131][ T10] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 335.629933][ T10] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input33 [ 335.637102][ T10] mceusb 4-1:0.0: Error: mce write urb status = -71 [ 335.660053][ T10] mceusb 4-1:0.0: Error: mce write urb status = -71 [ 335.686592][ T10] mceusb 4-1:0.0: Error: mce write urb status = -71 [ 335.706731][ T10] mceusb 4-1:0.0: Error: mce write urb status = -71 [ 335.716815][ T5675] rc_core: IR keymap rc-hauppauge not found [ 335.716846][ T5675] Registered IR keymap rc-empty [ 335.717223][ T5675] mceusb 1-1:0.0: Error: mce write urb status = -71 [ 335.730679][ T10] mceusb 4-1:0.0: Error: mce write urb status = -71 [ 335.737700][ T5675] mceusb 1-1:0.0: Error: mce write urb status = -71 [ 335.749173][ T10] mceusb 4-1:0.0: Error: mce write urb status = -71 [ 335.761269][ T5675] rc rc1: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc1 [ 335.768933][ T10] mceusb 4-1:0.0: Error: mce write urb status = -71 [ 335.775824][ T5675] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc1/input34 [ 335.786889][ T10] mceusb 4-1:0.0: Error: mce write urb status = -71 [ 335.796758][ T5675] mceusb 1-1:0.0: Error: mce write urb status = -71 [ 335.806496][ T10] mceusb 4-1:0.0: Error: mce write urb status = -71 [ 335.819154][ T5675] mceusb 1-1:0.0: Error: mce write urb status = -71 [ 335.826479][ T10] mceusb 4-1:0.0: Error: mce write urb status = -71 [ 335.837668][ T5675] mceusb 1-1:0.0: Error: mce write urb status = -71 [ 335.849922][ T10] mceusb 4-1:0.0: Registered with mce emulator interface version 1 [ 335.849944][ T10] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 335.857413][ T5675] mceusb 1-1:0.0: Error: mce write urb status = -71 [ 335.877799][ T5675] mceusb 1-1:0.0: Error: mce write urb status = -71 [ 335.899538][ T5675] mceusb 1-1:0.0: Error: mce write urb status = -71 [ 335.930033][ T5675] mceusb 1-1:0.0: Error: mce write urb status = -71 [ 335.959140][ T5675] mceusb 1-1:0.0: Error: mce write urb status = -71 [ 336.091158][ T8280] netlink: 4 bytes leftover after parsing attributes in process `syz.2.678'. [ 336.095992][ T5675] mceusb 1-1:0.0: Error: mce write urb status = -71 [ 336.126483][ T5675] mceusb 1-1:0.0: Error: mce write urb status = -71 [ 336.337771][ T5675] mceusb 1-1:0.0: Registered with mce emulator interface version 1 [ 336.337826][ T5675] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 336.346148][ T8285] netlink: 4 bytes leftover after parsing attributes in process `syz.2.678'. [ 336.927306][ T8294] netlink: 'syz.4.677': attribute type 2 has an invalid length. [ 337.009789][ T5698] usb 4-1: USB disconnect, device number 19 [ 337.155294][ T5801] usb 1-1: USB disconnect, device number 28 [ 337.476635][ T31] audit: type=1400 audit(1788959250.358:1018): avc: denied { create } for pid=8317 comm="syz.1.681" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 337.539376][ T31] audit: type=1400 audit(1788959250.418:1019): avc: denied { bind } for pid=8317 comm="syz.1.681" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 337.853410][ T8328] i2c i2c-0: Failed to register i2c client usb3503 at 0x08 (-16) [ 338.020327][ T8324] FAULT_INJECTION: forcing a failure. [ 338.020327][ T8324] name failslab, interval 1, probability 0, space 0, times 0 [ 338.033596][ T8324] CPU: 1 UID: 0 PID: 8324 Comm: syz.0.683 Tainted: G L syzkaller #0 PREEMPT(full) [ 338.033628][ T8324] Tainted: [L]=SOFTLOCKUP [ 338.033635][ T8324] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 338.033648][ T8324] Call Trace: [ 338.033656][ T8324] [ 338.033664][ T8324] dump_stack_lvl+0x100/0x190 [ 338.033697][ T8324] should_fail_ex.cold+0x5/0xa [ 338.033726][ T8324] should_failslab+0xc2/0x120 [ 338.033752][ T8324] __kmalloc_cache_noprof+0x91/0x6d0 [ 338.033780][ T8324] ? string+0x201/0x4d0 [ 338.033798][ T8324] ? format_decode+0x1ad/0xdd0 [ 338.033821][ T8324] ? tomoyo_init_log+0x1a0/0x20c0 [ 338.033847][ T8324] tomoyo_init_log+0x1a0/0x20c0 [ 338.033867][ T8324] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 338.033897][ T8324] ? vsnprintf+0x4c5/0x1300 [ 338.033927][ T8324] ? __pfx_tomoyo_init_log+0x10/0x10 [ 338.033948][ T8324] ? tomoyo_profile+0x47/0x60 [ 338.033977][ T8324] ? tomoyo_domain_quota_is_ok+0x367/0x580 [ 338.034011][ T8324] tomoyo_supervisor+0x506/0x1340 [ 338.034041][ T8324] ? __pfx_tomoyo_supervisor+0x10/0x10 [ 338.034064][ T8324] ? lockdep_hardirqs_on+0x7d/0x110 [ 338.034087][ T8324] ? irqentry_exit+0x24d/0xa10 [ 338.034127][ T8324] ? kasan_check_range+0x31/0x1e0 [ 338.034158][ T8324] ? tomoyo_check_acl+0x1f7/0x410 [ 338.034190][ T8324] tomoyo_path_permission+0x270/0x3b0 [ 338.034221][ T8324] tomoyo_check_open_permission+0x34d/0x3c0 [ 338.034252][ T8324] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 338.034290][ T8324] ? hook_file_open+0x248/0x8e0 [ 338.034312][ T8324] ? __pfx___schedule+0x10/0x10 [ 338.034356][ T8324] tomoyo_file_open+0x6b/0x90 [ 338.034381][ T8324] security_file_open+0xb5/0x1e0 [ 338.034404][ T8324] do_dentry_open+0x588/0x14d0 [ 338.034432][ T8324] vfs_open+0x82/0x3f0 [ 338.034460][ T8324] path_openat+0x19fa/0x2440 [ 338.034486][ T8324] ? __pfx_path_openat+0x10/0x10 [ 338.034517][ T8324] do_file_open+0x20e/0x430 [ 338.034542][ T8324] ? __pfx_do_file_open+0x10/0x10 [ 338.034565][ T8324] ? __pfx___schedule+0x10/0x10 [ 338.034603][ T8324] ? _raw_spin_unlock+0x3e/0x50 [ 338.034622][ T8324] ? alloc_fd+0x471/0x7a0 [ 338.034654][ T8324] do_sys_openat2+0x10f/0x1e0 [ 338.034679][ T8324] ? __pfx_do_sys_openat2+0x10/0x10 [ 338.034715][ T8324] __x64_sys_openat+0x12d/0x210 [ 338.034741][ T8324] ? __pfx___x64_sys_openat+0x10/0x10 [ 338.034778][ T8324] do_syscall_64+0x123/0x790 [ 338.034804][ T8324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 338.034824][ T8324] RIP: 0033:0x7fa15d15e98e [ 338.034841][ T8324] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 338.034859][ T8324] RSP: 002b:00007fa15e09eb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 338.034878][ T8324] RAX: ffffffffffffffda RBX: 00007fa15e09f6c0 RCX: 00007fa15d15e98e [ 338.034890][ T8324] RDX: 0000000000142f82 RSI: 00007fa15e09ec00 RDI: ffffffffffffff9c [ 338.034902][ T8324] RBP: 00007fa15e09ec00 R08: 0000000000000000 R09: 0000000000000000 [ 338.034914][ T8324] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 338.034925][ T8324] R13: 00007fa15d426038 R14: 00007fa15d425fa0 R15: 00007fffc0887c18 [ 338.034952][ T8324] [ 338.364917][ T31] audit: type=1400 audit(1788959251.238:1020): avc: denied { read } for pid=8329 comm="syz.4.684" lport=40911 faddr=2001::2 fport=20004 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 338.824039][ T8341] 8021q: adding VLAN 0 to HW filter on device bond1 [ 338.972302][ T31] audit: type=1400 audit(1788959251.848:1021): avc: denied { read } for pid=8353 comm="syz.1.690" name="mtd0" dev="devtmpfs" ino=702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 338.996874][ T5801] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 339.006766][ T31] audit: type=1400 audit(1788959251.888:1022): avc: denied { open } for pid=8353 comm="syz.1.690" path="/dev/mtd0" dev="devtmpfs" ino=702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 339.146862][ T5801] usb 3-1: New USB device found, idVendor=1b5c, idProduct=0105, bcdDevice= 1.f1 [ 339.157430][ T5801] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x4 has an invalid bInterval 0, changing to 7 [ 339.159336][ T8363] netlink: 20 bytes leftover after parsing attributes in process `syz.3.694'. [ 339.178779][ T5801] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 339.191972][ T5801] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 339.200852][ T5801] usb 3-1: Product: syz [ 339.205245][ T5801] usb 3-1: Manufacturer: syz [ 339.209989][ T5801] usb 3-1: SerialNumber: syz [ 339.217615][ T5801] usb 3-1: config 0 descriptor?? [ 339.229487][ T5801] ftdi_sio 3-1:0.0: FTDI USB Serial Device converter detected [ 339.238470][ T5801] usb 3-1: Detected SIO [ 339.242710][ T5801] ftdi_sio ttyUSB0: Overriding wMaxPacketSize on endpoint 4 [ 339.250402][ T5801] ftdi_sio ttyUSB0: Overriding wMaxPacketSize on endpoint 7 [ 339.263534][ T5801] usb 3-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 339.385996][ T5699] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 339.526022][ T5801] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 339.536002][ T5699] usb 5-1: Using ep0 maxpacket: 16 [ 339.536537][ T5699] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 339.537491][ T5699] usb 5-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 339.537523][ T5699] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 339.537545][ T5699] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 212, changing to 11 [ 339.537566][ T5699] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 58557, setting to 1024 [ 339.537587][ T5699] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 339.537617][ T5699] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 339.542130][ T5699] usb 5-1: config 0 descriptor?? [ 339.607231][ T5699] rc_core: IR keymap rc-hauppauge not found [ 339.607249][ T5699] Registered IR keymap rc-empty [ 339.607619][ T5699] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 339.626236][ T5699] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 339.647291][ T5699] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 339.651685][ T5699] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input35 [ 339.658356][ T5699] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 339.678012][ T5699] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 339.679734][ T5801] usb 4-1: unable to get BOS descriptor or descriptor too short [ 339.679785][ T5801] usb 4-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 339.680656][ T5801] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 339.680710][ T5801] usb 4-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 339.682471][ T5801] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 339.682489][ T5801] usb 4-1: Product: syz [ 339.682501][ T5801] usb 4-1: Manufacturer: syz [ 339.682514][ T5801] usb 4-1: SerialNumber: syz [ 339.696334][ T5699] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 339.716410][ T5699] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 339.736152][ T5699] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 339.756126][ T5699] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 339.776188][ T5699] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 339.796123][ T5699] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 339.816101][ T5699] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 339.838040][ T5699] mceusb 5-1:0.0: Error: mce write urb status = -71 [ 339.857499][ T5699] mceusb 5-1:0.0: Registered with mce emulator interface version 1 [ 339.857539][ T5699] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 340.014092][ T5801] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 340.139082][ T5801] usb 4-1: USB disconnect, device number 20 [ 340.190220][ T7043] udevd[7043]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 340.268666][ T5699] usb 5-1: USB disconnect, device number 18 [ 340.366527][ T10] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 340.537073][ T10] usb 2-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 340.538000][ T10] usb 2-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 340.538794][ T10] usb 2-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 340.540420][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 340.540439][ T10] usb 2-1: Product: syz [ 340.540451][ T10] usb 2-1: Manufacturer: syz [ 340.540463][ T10] usb 2-1: SerialNumber: syz [ 340.555116][ T10] ti_usb_3410_5052 2-1:2.0: TI USB 5052 2 port adapter converter detected [ 340.565232][ T10] usb 2-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 340.574018][ T10] usb 2-1: TI USB 5052 2 port adapter converter now attached to ttyUSB2 [ 341.605781][ T8376] ftdi_sio ttyUSB0: ftdi_set_termios FAILED to set databits/stopbits/parity [ 341.619566][ T5699] usb 3-1: USB disconnect, device number 24 [ 341.627997][ T8376] ftdi_sio ttyUSB0: ftdi_set_termios urb failed to set baudrate [ 341.628089][ T8376] ftdi_sio ttyUSB0: failed to set flow control: -19 [ 341.643913][ T5699] ftdi_sio ttyUSB0: error from flowcontrol urb [ 341.658445][ T5699] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 341.670070][ T5699] ftdi_sio 3-1:0.0: device disconnected [ 342.388870][ T10] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 342.541740][ T10] usb 5-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 342.551636][ T10] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 342.557193][ T10] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 342.558803][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 342.558822][ T10] usb 5-1: Product: syz [ 342.558834][ T10] usb 5-1: Manufacturer: syz [ 342.558846][ T10] usb 5-1: SerialNumber: syz [ 342.567598][ T10] ti_usb_3410_5052 5-1:2.0: TI USB 5052 2 port adapter converter detected [ 342.616077][ T5699] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 342.619300][ T10] usb 5-1: TI USB 5052 2 port adapter converter now attached to ttyUSB3 [ 342.634680][ T10] usb 5-1: TI USB 5052 2 port adapter converter now attached to ttyUSB4 [ 342.711941][ T8373] Set syz1 is full, maxelem 65536 reached [ 342.765782][ T8388] FAULT_INJECTION: forcing a failure. [ 342.765782][ T8388] name failslab, interval 1, probability 0, space 0, times 0 [ 342.765836][ T8388] CPU: 0 UID: 0 PID: 8388 Comm: syz.4.699 Tainted: G L syzkaller #0 PREEMPT(full) [ 342.765860][ T8388] Tainted: [L]=SOFTLOCKUP [ 342.765864][ T8388] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 342.765873][ T8388] Call Trace: [ 342.765877][ T8388] [ 342.765883][ T8388] dump_stack_lvl+0x100/0x190 [ 342.765912][ T8388] should_fail_ex.cold+0x5/0xa [ 342.765935][ T8388] should_failslab+0xc2/0x120 [ 342.765955][ T8388] kmem_cache_alloc_noprof+0x92/0x6a0 [ 342.765973][ T8388] ? do_getname+0x35/0x390 [ 342.765999][ T8388] do_getname+0x35/0x390 [ 342.766022][ T8388] do_sys_openat2+0xc7/0x1e0 [ 342.766044][ T8388] ? __pfx_do_sys_openat2+0x10/0x10 [ 342.766065][ T8388] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 342.766086][ T8388] ? __fget_files+0x21f/0x3d0 [ 342.766109][ T8388] __x64_sys_openat+0x12d/0x210 [ 342.766130][ T8388] ? __pfx___x64_sys_openat+0x10/0x10 [ 342.766149][ T8388] ? ksys_write+0x1ac/0x250 [ 342.766172][ T8388] do_syscall_64+0x123/0x790 [ 342.766193][ T8388] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 342.766210][ T8388] RIP: 0033:0x7f12ecb9e159 [ 342.766223][ T8388] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 342.766237][ T8388] RSP: 002b:00007f12eadf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 342.766253][ T8388] RAX: ffffffffffffffda RBX: 00007f12ece25fa0 RCX: 00007f12ecb9e159 [ 342.766264][ T8388] RDX: 0000000000000002 RSI: 0000200000000200 RDI: ffffffffffffff9c [ 342.766274][ T8388] RBP: 00007f12eadf6090 R08: 0000000000000000 R09: 0000000000000000 [ 342.766283][ T8388] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 342.766292][ T8388] R13: 00007f12ece26038 R14: 00007f12ece25fa0 R15: 00007ffc132803f8 [ 342.766313][ T8388] [ 342.837069][ T5699] usb 3-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 342.856446][ T5699] usb 3-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 59146, setting to 1024 [ 342.873209][ T5699] usb 3-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 59146, setting to 1024 [ 343.053527][ T5699] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 343.053563][ T5699] usb 3-1: Product: syz [ 343.053585][ T5699] usb 3-1: Manufacturer: syz [ 343.053600][ T5699] usb 3-1: SerialNumber: syz [ 343.079746][ T8392] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 343.088962][ T5699] ti_usb_3410_5052 3-1:2.0: TI USB 5052 2 port adapter converter detected [ 343.103052][ T5699] usb 3-1: TI USB 5052 2 port adapter converter now attached to ttyUSB5 [ 343.114973][ T5699] usb 3-1: TI USB 5052 2 port adapter converter now attached to ttyUSB6 [ 343.142725][ T5699] usb 2-1: USB disconnect, device number 43 [ 343.168055][ T5699] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 343.224242][ T5699] ti_usb_3410_5052_2 ttyUSB2: TI USB 5052 2 port adapter converter now disconnected from ttyUSB2 [ 343.237664][ T5699] ti_usb_3410_5052 2-1:2.0: device disconnected [ 343.360156][ T8405] ieee802154 phy0 wpan0: encryption failed: -22 [ 343.534414][ T8409] netlink: 20 bytes leftover after parsing attributes in process `syz.3.706'. [ 343.606234][ T8411] i2c i2c-0: Failed to register i2c client usb3503 at 0x08 (-16) [ 344.356056][ T10] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 344.552801][ T8421] netlink: 'syz.1.707': attribute type 2 has an invalid length. [ 344.557808][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 344.557960][ T10] usb 4-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 344.563923][ T10] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 344.564270][ T10] usb 4-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 344.634463][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 344.634493][ T10] usb 4-1: Product: syz [ 344.634537][ T10] usb 4-1: Manufacturer: syz [ 344.634598][ T10] usb 4-1: SerialNumber: syz [ 344.973399][ T93] usb 5-1: USB disconnect, device number 19 [ 345.314414][ T93] ti_usb_3410_5052_2 ttyUSB3: TI USB 5052 2 port adapter converter now disconnected from ttyUSB3 [ 345.469391][ T9] usb 3-1: USB disconnect, device number 25 [ 345.538054][ T93] ti_usb_3410_5052_2 ttyUSB4: TI USB 5052 2 port adapter converter now disconnected from ttyUSB4 [ 345.593564][ T93] ti_usb_3410_5052 5-1:2.0: device disconnected [ 345.684927][ T10] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 345.724668][ T9] ti_usb_3410_5052_2 ttyUSB5: TI USB 5052 2 port adapter converter now disconnected from ttyUSB5 [ 345.821829][ T9] ti_usb_3410_5052_2 ttyUSB6: TI USB 5052 2 port adapter converter now disconnected from ttyUSB6 [ 345.822595][ T9] ti_usb_3410_5052 3-1:2.0: device disconnected [ 346.368459][ T10] usb 4-1: USB disconnect, device number 21 [ 346.629947][ T7043] udevd[7043]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 347.760847][ T8462] FAULT_INJECTION: forcing a failure. [ 347.760847][ T8462] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 347.761278][ T8462] CPU: 1 UID: 0 PID: 8462 Comm: syz.3.711 Tainted: G L syzkaller #0 PREEMPT(full) [ 347.761305][ T8462] Tainted: [L]=SOFTLOCKUP [ 347.761312][ T8462] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 347.761323][ T8462] Call Trace: [ 347.761329][ T8462] [ 347.761338][ T8462] dump_stack_lvl+0x100/0x190 [ 347.761369][ T8462] should_fail_ex.cold+0x5/0xa [ 347.761403][ T8462] _copy_from_iter+0x1f4/0x1690 [ 347.761437][ T8462] ? rcu_is_watching+0x13/0xc0 [ 347.761462][ T8462] ? __pfx__copy_from_iter+0x10/0x10 [ 347.761487][ T8462] ? __kasan_kmalloc+0xaa/0xb0 [ 347.761506][ T8462] ? __kvmalloc_node_noprof+0x377/0x9b0 [ 347.761522][ T8462] ? __print_lock_name+0x21/0x80 [ 347.761542][ T8462] ? proc_sys_call_handler+0x169/0x5a0 [ 347.761564][ T8462] ? proc_sys_call_handler+0x2c7/0x5a0 [ 347.761589][ T8462] proc_sys_call_handler+0x3ed/0x5a0 [ 347.761611][ T8462] ? __pfx_proc_sys_call_handler+0x10/0x10 [ 347.761634][ T8462] ? do_iter_readv_writev+0x203/0x930 [ 347.761658][ T8462] do_iter_readv_writev+0x6f7/0x930 [ 347.761681][ T8462] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 347.761702][ T8462] ? lock_acquire+0x1d1/0x380 [ 347.761726][ T8462] vfs_writev+0x360/0xdd0 [ 347.761753][ T8462] ? __pfx_vfs_writev+0x10/0x10 [ 347.761779][ T8462] ? irqentry_exit+0x24d/0xa10 [ 347.761796][ T8462] ? lockdep_hardirqs_on+0x7d/0x110 [ 347.761828][ T8462] ? do_writev+0x13e/0x340 [ 347.761847][ T8462] do_writev+0x13e/0x340 [ 347.761869][ T8462] ? __pfx_do_writev+0x10/0x10 [ 347.761889][ T8462] ? trace_irq_enable.constprop.0+0x2f/0x160 [ 347.761915][ T8462] do_syscall_64+0x123/0x790 [ 347.761934][ T8462] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 347.761949][ T8462] RIP: 0033:0x7f977e59e159 [ 347.761961][ T8462] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 347.761975][ T8462] RSP: 002b:00007f977f389028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 347.761990][ T8462] RAX: ffffffffffffffda RBX: 00007f977e826180 RCX: 00007f977e59e159 [ 347.761999][ T8462] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 0000000000000008 [ 347.762008][ T8462] RBP: 00007f977f389090 R08: 0000000000000000 R09: 0000000000000000 [ 347.762017][ T8462] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 347.762025][ T8462] R13: 00007f977e826218 R14: 00007f977e826180 R15: 00007ffef91f5d68 [ 347.762045][ T8462] [ 348.159609][ T8468] ieee802154 phy0 wpan0: encryption failed: -22 [ 348.532843][ T8476] i2c i2c-0: Failed to register i2c client usb3503 at 0x08 (-16) [ 349.433233][ T31] audit: type=1800 audit(1788959262.308:1023): pid=8487 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.3.723" name="syzkaller0" dev="sda1" ino=2048 res=0 errno=0 [ 349.715702][ T8493] syzkaller0: entered promiscuous mode [ 349.721854][ T8493] syzkaller0: entered allmulticast mode [ 349.740160][ T8493] tipc: Enabled bearer , priority 0 [ 349.769133][ T8493] tipc: Resetting bearer [ 349.780312][ T8492] tipc: Resetting bearer [ 349.786342][ T10] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 349.949299][ T8492] tipc: Disabling bearer [ 350.017158][ T10] usb 5-1: Using ep0 maxpacket: 16 [ 350.018465][ T10] usb 5-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 7.00 [ 350.024268][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 350.024296][ T10] usb 5-1: Product: syz [ 350.024320][ T10] usb 5-1: Manufacturer: syz [ 350.024337][ T10] usb 5-1: SerialNumber: syz [ 350.028140][ T10] usb 5-1: config 0 descriptor?? [ 350.247300][ T10] ftdi_sio 5-1:0.0: FTDI USB Serial Device converter detected [ 350.463540][ T10] usb 5-1: Detected FT2232H [ 350.494864][ T10] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 350.502567][ T10] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 350.517231][ T10] usb 5-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 350.538505][ T10] usb 5-1: USB disconnect, device number 20 [ 350.550407][ T10] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 350.560421][ T10] ftdi_sio 5-1:0.0: device disconnected [ 350.653929][ T31] audit: type=1400 audit(1788959263.528:1024): avc: denied { create } for pid=8503 comm="syz.1.727" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 350.754207][ T31] audit: type=1400 audit(1788959263.628:1025): avc: denied { bind } for pid=8499 comm="syz.3.726" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 350.755470][ T31] audit: type=1400 audit(1788959263.628:1026): avc: denied { write } for pid=8499 comm="syz.3.726" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 350.756019][ T31] audit: type=1400 audit(1788959263.628:1027): avc: denied { connect } for pid=8499 comm="syz.3.726" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 350.761338][ T31] audit: type=1400 audit(1788959263.638:1028): avc: denied { read append } for pid=8500 comm="syz.0.720" name="usbmon8" dev="devtmpfs" ino=739 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 350.767546][ T31] audit: type=1400 audit(1788959263.638:1029): avc: denied { open } for pid=8500 comm="syz.0.720" path="/dev/usbmon8" dev="devtmpfs" ino=739 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 350.772293][ T31] audit: type=1400 audit(1788959263.638:1030): avc: denied { getopt } for pid=8499 comm="syz.3.726" lport=49163 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 352.655441][ T8520] i2c i2c-0: Failed to register i2c client usb3503 at 0x08 (-16) [ 353.191717][ T8525] syzkaller0: entered promiscuous mode [ 353.191746][ T8525] syzkaller0: entered allmulticast mode [ 353.207637][ T8525] tipc: Enabled bearer , priority 0 [ 353.229607][ T8525] tipc: Resetting bearer [ 353.290277][ T8524] tipc: Resetting bearer [ 353.339560][ T8524] tipc: Disabling bearer [ 354.146858][ T31] audit: type=1400 audit(1788959267.028:1031): avc: denied { append } for pid=8529 comm="syz.4.735" name="nvme-fabrics" dev="devtmpfs" ino=701 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 354.271958][ T8531] nvme_fabrics: missing parameter 'nqn=%s' [ 354.407080][ T31] audit: type=1800 audit(1788959267.288:1032): pid=8534 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.3.736" name="syzkaller0" dev="sda1" ino=2048 res=0 errno=0 [ 354.746579][ T9] usb 5-1: new full-speed USB device number 21 using dummy_hcd [ 354.931525][ T9] usb 5-1: New USB device found, idVendor=1044, idProduct=7001, bcdDevice= 5.20 [ 354.947118][ T9] usb 5-1: config 4 has an invalid interface number: 44 but max is 0 [ 354.955392][ T9] usb 5-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 354.955416][ T9] usb 5-1: config 4 has no interface number 0 [ 354.955804][ T9] usb 5-1: config 4 interface 44 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 355.450639][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 355.459823][ T9] usb 5-1: Product: syz [ 355.464043][ T9] usb 5-1: Manufacturer: syz [ 355.468693][ T9] usb 5-1: SerialNumber: syz [ 355.768814][ T5786] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 355.784562][ T5786] hid-generic 0000:0000:0000.000C: hidraw0: HID v0.00 Device [syz1] on syz0 [ 355.888442][ T9] dvb-usb: found a 'Gigabyte U7000' in cold state, will try to load a firmware [ 356.681800][ T31] audit: type=1400 audit(1788959269.208:1033): avc: denied { read } for pid=8549 comm="syz.1.740" name="set_event" dev="tracefs" ino=4170 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 357.212414][ T8556] ceph: No mds server is up or the cluster is laggy [ 357.267794][ T31] audit: type=1400 audit(1788959270.048:1034): avc: denied { firmware_load } for pid=9 comm="kworker/0:0" path="/lib/firmware/dvb-usb-dib0700-1.20.fw" dev="sda1" ino=414 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 357.342067][ T9] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 357.342232][ T9] dib0700: firmware download failed at 7 with -22 [ 358.299369][ T10] libceph: connect (1)[c::]:6789 error -101 [ 358.317885][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 358.485443][ T8570] fuse: Unknown parameter '0x0000000000000004' [ 358.597108][ T10] libceph: connect (1)[c::]:6789 error -101 [ 358.597263][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 358.787397][ T5801] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 358.956155][ T5801] usb 3-1: Using ep0 maxpacket: 16 [ 358.964045][ T5801] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2c24, bcdDevice= 0.00 [ 359.008395][ T5801] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 359.019801][ T5801] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 359.019904][ T5801] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 359.020055][ T5801] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 359.085341][ T5801] usb 3-1: config 0 descriptor?? [ 359.119745][ T5786] usb 5-1: USB disconnect, device number 21 [ 359.332225][ T8579] Bluetooth: hci5: Frame reassembly failed (-84) [ 359.342293][ T8577] openvswitch: netlink: Flow key attribute not present in set flow. [ 359.343069][ T8577] openvswitch: netlink: Flow key attribute not present in set flow. [ 359.385043][ T31] audit: type=1400 audit(1788959272.258:1035): avc: denied { accept } for pid=8580 comm="syz.0.745" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 359.501237][ T31] audit: type=1400 audit(1788959272.378:1036): avc: denied { setopt } for pid=8580 comm="syz.0.745" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 359.501553][ T8583] syz.0.745: vmalloc error: size 8589938688, exceeds total pages, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 359.501663][ T8583] CPU: 1 UID: 0 PID: 8583 Comm: syz.0.745 Tainted: G L syzkaller #0 PREEMPT(full) [ 359.501687][ T8583] Tainted: [L]=SOFTLOCKUP [ 359.501693][ T8583] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 359.501704][ T8583] Call Trace: [ 359.501709][ T8583] [ 359.501716][ T8583] dump_stack_lvl+0x100/0x190 [ 359.501745][ T8583] warn_alloc.cold+0x9e/0xb2 [ 359.501763][ T8583] ? __pfx_warn_alloc+0x10/0x10 [ 359.501787][ T8583] ? __kasan_kmalloc+0xaa/0xb0 [ 359.501803][ T8583] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 359.501825][ T8583] ? xskq_create+0x52/0x290 [ 359.501841][ T8583] ? do_sock_setsockopt+0xf3/0x1d0 [ 359.501861][ T8583] ? do_syscall_64+0x123/0x790 [ 359.501880][ T8583] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 359.501907][ T8583] ? xsk_setsockopt+0x743/0xab0 [ 359.501923][ T8583] __vmalloc_node_range_noprof+0x123b/0x1420 [ 359.501953][ T8583] ? xsk_setsockopt+0x743/0xab0 [ 359.501973][ T8583] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 359.501993][ T8583] ? kasan_save_track+0x14/0x30 [ 359.502010][ T8583] ? __kasan_kmalloc+0xaa/0xb0 [ 359.502028][ T8583] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 359.502052][ T8583] ? xskq_create+0x52/0x290 [ 359.502070][ T8583] ? xsk_setsockopt+0x743/0xab0 [ 359.502087][ T8583] xskq_create+0x18f/0x290 [ 359.502105][ T8583] ? xsk_setsockopt+0x743/0xab0 [ 359.502123][ T8583] xsk_setsockopt+0x743/0xab0 [ 359.502140][ T8583] ? __pfx_xsk_setsockopt+0x10/0x10 [ 359.502157][ T8583] ? find_held_lock+0x2b/0x80 [ 359.502178][ T8583] ? __fget_files+0x215/0x3d0 [ 359.502201][ T8583] ? selinux_socket_setsockopt+0x6a/0x80 [ 359.502226][ T8583] ? __pfx_xsk_setsockopt+0x10/0x10 [ 359.502243][ T8583] do_sock_setsockopt+0xf3/0x1d0 [ 359.502265][ T8583] __sys_setsockopt+0x195/0x220 [ 359.502292][ T8583] __x64_sys_setsockopt+0xbd/0x160 [ 359.502308][ T8583] ? do_syscall_64+0xae/0x790 [ 359.502327][ T8583] ? lockdep_hardirqs_on+0x7d/0x110 [ 359.502345][ T8583] do_syscall_64+0x123/0x790 [ 359.502367][ T8583] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 359.502383][ T8583] RIP: 0033:0x7fa15d19e159 [ 359.502398][ T8583] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 359.502415][ T8583] RSP: 002b:00007fa15e05d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 359.502431][ T8583] RAX: ffffffffffffffda RBX: 00007fa15d426180 RCX: 00007fa15d19e159 [ 359.502443][ T8583] RDX: 0000000000000006 RSI: 000000000000011b RDI: 000000000000000b [ 359.502454][ T8583] RBP: 00007fa15d23503b R08: 0000000000000004 R09: 0000000000000000 [ 359.502465][ T8583] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 359.502475][ T8583] R13: 00007fa15d426218 R14: 00007fa15d426180 R15: 00007fffc0887c18 [ 359.502498][ T8583] [ 359.502535][ T8583] Mem-Info: [ 359.502543][ T8583] active_anon:12769 inactive_anon:10 isolated_anon:0 [ 359.502543][ T8583] active_file:143 inactive_file:63229 isolated_file:0 [ 359.502543][ T8583] unevictable:0 dirty:485 writeback:0 [ 359.502543][ T8583] slab_reclaimable:11974 slab_unreclaimable:98319 [ 359.502543][ T8583] mapped:31569 shmem:533 pagetables:1430 [ 359.502543][ T8583] sec_pagetables:0 bounce:0 [ 359.502543][ T8583] kernel_misc_reclaimable:0 [ 359.502543][ T8583] free:1271383 free_pcp:17097 free_cma:0 [ 359.503556][ T8583] Node 0 active_anon:51076kB inactive_anon:40kB active_file:572kB inactive_file:252712kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:126276kB dirty:1932kB writeback:0kB shmem:2132kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12940kB pagetables:5632kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 359.503605][ T8583] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:8kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:88kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 359.503647][ T8583] Node 0 DMA free:15328kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 359.503713][ T8583] lowmem_reserve[]: 0 2470 2470 2470 2470 [ 359.503742][ T8583] Node 0 DMA32 free:1130148kB boost:0kB min:33992kB low:42488kB high:50984kB reserved_highatomic:0kB free_highatomic:0kB active_anon:51076kB inactive_anon:40kB active_file:572kB inactive_file:252712kB unevictable:0kB writepending:1932kB zspages:0kB present:3129332kB managed:2530196kB mlocked:0kB bounce:0kB free_pcp:68388kB local_pcp:42200kB free_cma:0kB [ 359.503786][ T8583] lowmem_reserve[]: 0 0 0 0 0 [ 359.503812][ T8583] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:72kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 359.503870][ T8583] lowmem_reserve[]: 0 0 0 0 0 [ 359.503897][ T8583] Node 1 Normal free:3940056kB boost:0kB min:55904kB low:69880kB high:83856kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:8kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 359.503940][ T8583] lowmem_reserve[]: 0 0 0 0 0 [ 359.503967][ T8583] Node 0 DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 1*2048kB (M) 3*4096kB (M) = 15328kB [ 359.504115][ T8583] Node 0 DMA32: 2867*4kB (UME) 1688*8kB (UME) 1417*16kB (UME) 721*32kB (UME) 447*64kB (UME) 323*128kB (UME) 203*256kB (ME) 69*512kB (UME) 13*1024kB (UME) 8*2048kB (UM) 213*4096kB (UM) = 1130108kB [ 359.504294][ T8583] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 359.504372][ T8583] Node 1 Normal: 4*4kB (UM) 5*8kB (UM) 8*16kB (UM) 15*32kB (UM) 9*64kB (UM) 6*128kB (UM) 3*256kB (UM) 4*512kB (UM) 3*1024kB (UM) 2*2048kB (U) 959*4096kB (M) = 3940056kB [ 359.504520][ T8583] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 359.504534][ T8583] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 359.504565][ T8583] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 359.504579][ T8583] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 359.504591][ T8583] 63901 total pagecache pages [ 359.504597][ T8583] 0 pages in swap cache [ 359.504602][ T8583] Free swap = 124996kB [ 359.504608][ T8583] Total swap = 124996kB [ 359.504614][ T8583] 2097051 pages RAM [ 359.504619][ T8583] 0 pages HighMem/MovableOnly [ 359.504625][ T8583] 432868 pages reserved [ 359.504630][ T8583] 0 pages cma reserved [ 359.523760][ T31] audit: type=1400 audit(1788959272.398:1037): avc: denied { read } for pid=8580 comm="syz.0.745" path="socket:[32551]" dev="sockfs" ino=32551 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 359.550048][ T5801] pyra 0003:1E7D:2C24.000D: global environment stack underflow [ 359.550066][ T5801] pyra 0003:1E7D:2C24.000D: item 0 1 1 11 parsing failed [ 359.550529][ T5801] pyra 0003:1E7D:2C24.000D: parse failed [ 359.550576][ T5801] pyra 0003:1E7D:2C24.000D: probe with driver pyra failed with error -22 [ 359.566922][ T10] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 359.754256][ T8570] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 359.754542][ T8570] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 359.761520][ T5801] usb 3-1: USB disconnect, device number 26 [ 359.806328][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 359.817604][ T10] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 359.904210][ T10] usb 4-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 359.904253][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 359.904276][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 212, changing to 11 [ 359.904295][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 58557, setting to 1024 [ 359.904309][ T10] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 359.904329][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 359.937933][ T10] usb 4-1: config 0 descriptor?? [ 360.129343][ T10] rc_core: IR keymap rc-hauppauge not found [ 360.129359][ T10] Registered IR keymap rc-empty [ 360.146390][ T10] mceusb 4-1:0.0: Error: mce write urb status = -71 [ 360.187526][ T10] mceusb 4-1:0.0: Error: mce write urb status = -71 [ 360.214138][ T10] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 360.280469][ T8583] llcp: llcp_sock_recvmsg: Recv datagram failed state 3 -6 0 [ 360.293490][ T8590] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 360.293512][ T8590] CPU: 1 UID: 0 PID: 8590 Comm: syz.4.748 Tainted: G L syzkaller #0 PREEMPT(full) [ 360.293536][ T8590] Tainted: [L]=SOFTLOCKUP [ 360.293543][ T8590] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 360.293553][ T8590] Call Trace: [ 360.293560][ T8590] [ 360.293567][ T8590] dump_stack_lvl+0x100/0x190 [ 360.293595][ T8590] sysfs_warn_dup.cold+0x1c/0x28 [ 360.293620][ T8590] sysfs_create_dir_ns+0x24b/0x2b0 [ 360.293643][ T8590] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 360.293664][ T8590] ? find_held_lock+0x2b/0x80 [ 360.293685][ T8590] ? kobject_add_internal+0x25f/0x930 [ 360.293710][ T8590] ? kobject_add_internal+0x25f/0x930 [ 360.293735][ T8590] ? class_dir_child_ns_type+0xd/0x60 [ 360.293757][ T8590] kobject_add_internal+0x2c8/0x930 [ 360.293785][ T8590] kobject_add+0x16a/0x1e0 [ 360.293816][ T8590] ? __pfx_kobject_add+0x10/0x10 [ 360.293843][ T8590] ? get_device_parent+0x1b3/0x4c0 [ 360.293864][ T8590] ? kobject_put+0xb9/0x640 [ 360.293894][ T8590] device_add+0x294/0x1970 [ 360.293916][ T8590] ? lockdep_init_map_type+0x5c/0x250 [ 360.293936][ T8590] ? __pfx_device_add+0x10/0x10 [ 360.293956][ T8590] ? lockdep_init_map_type+0x5c/0x250 [ 360.293977][ T8590] ? __init_waitqueue_head+0xca/0x150 [ 360.294004][ T8590] tty_register_device_attr+0x388/0x7f0 [ 360.294024][ T8590] ? lockdep_init_map_type+0x5c/0x250 [ 360.294043][ T8590] ? __pfx_tty_register_device_attr+0x10/0x10 [ 360.294067][ T8590] ? tty_port_init+0x156/0x1c0 [ 360.294088][ T8590] gsm_activate_mux+0x155/0x2a0 [ 360.294107][ T8590] gsmld_ioctl+0xbbc/0x15c0 [ 360.294131][ T8590] ? kasan_quarantine_put+0x104/0x240 [ 360.294149][ T8590] ? __pfx_gsmld_ioctl+0x10/0x10 [ 360.294185][ T8590] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 360.294205][ T8590] ? __pfx_pty_unix98_ioctl+0x10/0x10 [ 360.294231][ T8590] ? __pfx_gsmld_ioctl+0x10/0x10 [ 360.294249][ T8590] tty_ioctl+0x11b4/0x1640 [ 360.294267][ T8590] ? __pfx_tty_ioctl+0x10/0x10 [ 360.294281][ T8590] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 360.294300][ T8590] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 360.294320][ T8590] ? __fget_files+0x34/0x3d0 [ 360.294352][ T8590] ? selinux_file_ioctl+0x13b/0x290 [ 360.294366][ T8590] ? selinux_file_ioctl+0xb6/0x290 [ 360.294384][ T8590] ? __pfx_tty_ioctl+0x10/0x10 [ 360.294401][ T8590] __x64_sys_ioctl+0x18e/0x210 [ 360.294419][ T8590] do_syscall_64+0x123/0x790 [ 360.294441][ T8590] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 360.294458][ T8590] RIP: 0033:0x7f12ecb9e159 [ 360.294472][ T8590] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 360.294486][ T8590] RSP: 002b:00007f12eadd5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 360.294503][ T8590] RAX: ffffffffffffffda RBX: 00007f12ece26090 RCX: 00007f12ecb9e159 [ 360.294514][ T8590] RDX: 00002000000001c0 RSI: 00000000404c4701 RDI: 0000000000000006 [ 360.294523][ T8590] RBP: 00007f12ecc3503b R08: 0000000000000000 R09: 0000000000000000 [ 360.294533][ T8590] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 360.294543][ T8590] R13: 00007f12ece26128 R14: 00007f12ece26090 R15: 00007ffc132803f8 [ 360.294565][ T8590] [ 360.294592][ T8590] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 360.341713][ T10] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input36 [ 360.763980][ T31] audit: type=1800 audit(1788959273.638:1038): pid=8595 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.0.749" name="syzkaller0" dev="sda1" ino=2048 res=0 errno=0 [ 360.823957][ T10] mceusb 4-1:0.0: Error: mce write urb status = -71 [ 360.838398][ T10] mceusb 4-1:0.0: Error: mce write urb status = -71 [ 360.856924][ T10] mceusb 4-1:0.0: Error: mce write urb status = -71 [ 360.877777][ T10] mceusb 4-1:0.0: Error: mce write urb status = -71 [ 360.898134][ T10] mceusb 4-1:0.0: Error: mce write urb status = -71 [ 360.917763][ T10] mceusb 4-1:0.0: Error: mce write urb status = -71 [ 360.938934][ T10] mceusb 4-1:0.0: Error: mce write urb status = -71 [ 360.967590][ T10] mceusb 4-1:0.0: Error: mce write urb status = -71 [ 360.996884][ T10] mceusb 4-1:0.0: Error: mce write urb status = -71 [ 361.017342][ T10] mceusb 4-1:0.0: Error: mce write urb status = -71 [ 361.027528][ T8602] syzkaller0: entered promiscuous mode [ 361.027564][ T8602] syzkaller0: entered allmulticast mode [ 361.031526][ T8602] tipc: Started in network mode [ 361.031548][ T8602] tipc: Node identity 1288f1522541, cluster identity 4711 [ 361.032651][ T8602] tipc: Enabled bearer , priority 0 [ 361.042426][ T8602] tipc: Resetting bearer [ 361.053021][ T8601] tipc: Resetting bearer [ 361.077038][ T10] mceusb 4-1:0.0: Registered with mce emulator interface version 1 [ 361.077075][ T10] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 361.087887][ T8601] tipc: Disabling bearer [ 361.113230][ T10] usb 4-1: USB disconnect, device number 22 [ 361.206670][ T5699] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 361.407224][ T5598] Bluetooth: hci5: Entering manufacturer mode failed (-110) [ 361.432638][ T5699] usb 3-1: New USB device found, idVendor=10d6, idProduct=2200, bcdDevice= 1.00 [ 361.997073][ T5699] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 361.997105][ T5699] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 362.029047][ T5699] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 362.029086][ T5699] usb 3-1: Product: syz [ 362.041819][ T5699] usb 3-1: Manufacturer: syz [ 362.041858][ T5699] usb 3-1: SerialNumber: syz [ 362.057637][ T5699] usb 3-1: config 0 descriptor?? [ 363.211221][ T8623] CIFS: Attempting to mount //127.0.0.1/share [ 363.235128][ T8623] CIFS: VFS: Error connecting to socket. Aborting operation. [ 363.243179][ T8623] CIFS: VFS: cifs_mount failed w/return code = -111 [ 363.401463][ T31] audit: type=1400 audit(1788959276.268:1039): avc: denied { connect } for pid=8599 comm="syz.2.750" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 363.639693][ T5699] hid-generic 0000:0000:0000.000E: unknown main item tag 0x0 [ 363.657886][ T5699] hid-generic 0000:0000:0000.000E: hidraw0: HID v0.00 Device [syz1] on syz0 [ 363.776024][ T10] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 363.930199][ T10] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 363.941760][ T10] usb 4-1: config 0 interface 0 altsetting 255 endpoint 0x4 has an invalid bInterval 0, changing to 7 [ 363.941800][ T10] usb 4-1: config 0 interface 0 has no altsetting 0 [ 364.122136][ T10] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 364.122176][ T10] usb 4-1: Product: syz [ 364.122200][ T10] usb 4-1: Manufacturer: syz [ 364.122216][ T10] usb 4-1: SerialNumber: syz [ 364.386106][ T5699] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 364.452301][ T8636] hid-generic 0000:0000:0000.000E: pid 8636 passed too large report [ 364.493516][ T10] usb 4-1: config 0 descriptor?? [ 364.557297][ T5699] usb 5-1: New USB device found, idVendor=10d6, idProduct=2200, bcdDevice= 1.00 [ 364.559161][ T5699] usb 5-1: config 0 has an invalid descriptor of length 136, skipping remainder of the config [ 364.559228][ T5699] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 364.614478][ T5699] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 364.614508][ T5699] usb 5-1: Product: syz [ 364.614543][ T5699] usb 5-1: Manufacturer: syz [ 364.614579][ T5699] usb 5-1: SerialNumber: syz [ 364.901633][ T5699] usb 5-1: config 0 descriptor?? [ 365.093656][ T10] usb 4-1: selecting invalid altsetting 0 [ 365.194860][ T5699] usb 3-1: USB disconnect, device number 27 [ 365.339329][ T8641] syzkaller0: entered promiscuous mode [ 365.339367][ T8641] syzkaller0: entered allmulticast mode [ 365.924838][ T8641] tipc: Started in network mode [ 365.930053][ T8641] tipc: Node identity a68cd6f60053, cluster identity 4711 [ 365.949170][ T8641] tipc: Enabled bearer , priority 0 [ 366.232228][ T10] usb 4-1: USB disconnect, device number 23 [ 366.255245][ T8641] tipc: Resetting bearer [ 366.267943][ T8640] tipc: Resetting bearer [ 366.348462][ T7081] udevd[7081]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 366.397788][ T8640] tipc: Disabling bearer [ 366.534449][ T31] audit: type=1800 audit(1788959279.408:1040): pid=8651 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.3.765" name="syzkaller0" dev="sda1" ino=2048 res=0 errno=0 [ 367.556450][ T5786] usb 5-1: USB disconnect, device number 22 [ 368.561186][ T5598] Bluetooth: hci5: command 0xfc11 tx timeout [ 368.569377][ T5604] Bluetooth: hci5: Entering manufacturer mode failed (-110) [ 369.023408][ T8666] netlink: zone id is out of range [ 369.023746][ T8666] netlink: zone id is out of range [ 369.024071][ T8666] netlink: zone id is out of range [ 369.024106][ T8666] netlink: zone id is out of range [ 369.024115][ T8666] netlink: zone id is out of range [ 369.078395][ T8666] netlink: zone id is out of range [ 369.879162][ T31] audit: type=1800 audit(1788959282.758:1041): pid=8682 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.3.774" name="syzkaller0" dev="sda1" ino=2048 res=0 errno=0 [ 370.093393][ T31] audit: type=1400 audit(1788959282.968:1042): avc: denied { setopt } for pid=8691 comm="syz.0.778" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 370.117762][ T8692] FAULT_INJECTION: forcing a failure. [ 370.117762][ T8692] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 370.117806][ T8692] CPU: 1 UID: 0 PID: 8692 Comm: syz.0.778 Tainted: G L syzkaller #0 PREEMPT(full) [ 370.117830][ T8692] Tainted: [L]=SOFTLOCKUP [ 370.117837][ T8692] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 370.117847][ T8692] Call Trace: [ 370.117853][ T8692] [ 370.117860][ T8692] dump_stack_lvl+0x100/0x190 [ 370.117890][ T8692] should_fail_ex.cold+0x5/0xa [ 370.117916][ T8692] _copy_from_user+0x2e/0xd0 [ 370.117944][ T8692] move_addr_to_kernel+0x65/0x170 [ 370.117969][ T8692] copy_msghdr_from_user+0x3f0/0x4c0 [ 370.117991][ T8692] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 370.118018][ T8692] ? lock_acquire+0x1d1/0x380 [ 370.118035][ T8692] ? get_pid_task+0x2a/0x250 [ 370.118059][ T8692] ___sys_sendmsg+0x106/0x1e0 [ 370.118084][ T8692] ? __pfx____sys_sendmsg+0x10/0x10 [ 370.118107][ T8692] ? get_pid_task+0x106/0x250 [ 370.118140][ T8692] ? find_held_lock+0x2b/0x80 [ 370.118180][ T8692] __sys_sendmsg+0x160/0x210 [ 370.118202][ T8692] ? __pfx___sys_sendmsg+0x10/0x10 [ 370.118235][ T8692] do_syscall_64+0x123/0x790 [ 370.118261][ T8692] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 370.118280][ T8692] RIP: 0033:0x7fa15d19e159 [ 370.118296][ T8692] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 370.118313][ T8692] RSP: 002b:00007fa15e09f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 370.118331][ T8692] RAX: ffffffffffffffda RBX: 00007fa15d425fa0 RCX: 00007fa15d19e159 [ 370.118342][ T8692] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000006 [ 370.118353][ T8692] RBP: 00007fa15e09f090 R08: 0000000000000000 R09: 0000000000000000 [ 370.118364][ T8692] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 370.118374][ T8692] R13: 00007fa15d426038 R14: 00007fa15d425fa0 R15: 00007fffc0887c18 [ 370.118398][ T8692] [ 370.256203][ T5699] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 370.446123][ T5699] usb 5-1: Using ep0 maxpacket: 16 [ 370.451939][ T5699] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 370.464118][ T5699] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 370.466052][ T9] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 370.477443][ T5699] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 370.497145][ T5699] usb 5-1: config 0 descriptor?? [ 370.507041][ T5699] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 370.586245][ T9] usb 2-1: device descriptor read/64, error -71 [ 370.626121][ T10] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 370.776193][ T10] usb 1-1: Using ep0 maxpacket: 8 [ 370.777516][ T10] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 370.778329][ T10] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 370.778363][ T10] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 370.778381][ T10] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 370.778399][ T10] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 370.778418][ T10] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 370.778448][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 370.807947][ T8701] netlink: 'syz.2.777': attribute type 10 has an invalid length. [ 370.831023][ T8701] syz_tun: entered promiscuous mode [ 370.837054][ T9] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 370.846693][ T8701] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 370.956086][ T9] usb 2-1: device descriptor read/64, error -71 [ 370.989252][ T10] usb 1-1: usb_control_msg returned -32 [ 371.001939][ T10] usbtmc 1-1:16.0: can't read capabilities [ 371.066828][ T9] usb usb2-port1: attempt power cycle [ 371.190969][ T8701] infiniband syz1: set active [ 371.190995][ T8701] infiniband syz1: added syz_tun [ 371.205011][ T8701] smbdirect: ib_dev[syz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 371.205043][ T8701] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 371.205078][ T8701] smbdirect: ib_dev[syz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 371.267807][ T8701] RDS/IB: syz1: added [ 371.268206][ T8701] smc: adding ib device syz1 with port count 1 [ 371.268311][ T8701] smc: ib device syz1 port 1 has no pnetid [ 371.354105][ T8698] usbtmc 1-1:16.0: usb_control_msg returned -71 [ 371.354209][ T8709] usbtmc 1-1:16.0: send_request_dev_dep_msg_in returned -90 [ 371.361043][ T10] usb 1-1: USB disconnect, device number 29 [ 371.417210][ T9] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 371.436718][ T9] usb 2-1: device descriptor read/8, error -71 [ 371.675973][ T9] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 371.696485][ T9] usb 2-1: device descriptor read/8, error -71 [ 371.816543][ T9] usb usb2-port1: unable to enumerate USB device [ 372.139896][ T31] audit: type=1400 audit(1788959285.008:1043): avc: denied { create } for pid=8711 comm="syz.3.781" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 372.160341][ T31] audit: type=1400 audit(1788959285.008:1044): avc: denied { setopt } for pid=8711 comm="syz.3.781" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 372.555966][ T9] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 372.715945][ T9] usb 3-1: Using ep0 maxpacket: 8 [ 372.718727][ T9] usb 3-1: unable to get BOS descriptor or descriptor too short [ 372.718763][ T9] usb 3-1: New USB device found, idVendor=0af0, idProduct=d357, bcdDevice= 0.00 [ 372.719223][ T9] usb 3-1: config 174 has no interfaces? [ 372.720816][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 372.720834][ T9] usb 3-1: Product: syz [ 372.720846][ T9] usb 3-1: Manufacturer: syz [ 372.720859][ T9] usb 3-1: SerialNumber: syz [ 373.444507][ T8729] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 373.903440][ T31] audit: type=1400 audit(1788959286.458:1045): avc: denied { ioctl } for pid=8727 comm="syz.3.786" path="socket:[33038]" dev="sockfs" ino=33038 ioctlcmd=0x8903 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 373.903930][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 [ 373.903969][ T1307] ieee802154 phy1 wpan1: encryption failed: -22 [ 373.978900][ T5699] usb 5-1: USB disconnect, device number 23 [ 373.981033][ T9] usb 3-1: USB disconnect, device number 28 [ 374.184471][ T8740] netlink: 20 bytes leftover after parsing attributes in process `syz.1.790'. [ 374.296122][ T8744] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 374.322844][ T31] audit: type=1400 audit(1788959287.198:1046): avc: denied { relabelfrom } for pid=8743 comm="syz.4.791" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 374.344541][ T31] audit: type=1400 audit(1788959287.228:1047): avc: denied { relabelto } for pid=8743 comm="syz.4.791" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 374.562972][ T10] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 374.665062][ T8750] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[5608] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[8750] [ 375.062341][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 375.062389][ T10] usb 2-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 375.079456][ T10] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 375.079505][ T10] usb 2-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 375.091576][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 375.091600][ T10] usb 2-1: Product: syz [ 375.091612][ T10] usb 2-1: Manufacturer: syz [ 375.091625][ T10] usb 2-1: SerialNumber: syz [ 375.325349][ T10] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 375.381777][ T10] usb 2-1: USB disconnect, device number 48 [ 375.443425][ T7043] udevd[7043]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 376.486381][ T5699] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 376.751359][ T5699] usb 1-1: Using ep0 maxpacket: 8 [ 376.751975][ T5699] usb 1-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 376.752968][ T5699] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 376.753004][ T5699] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 376.768708][ T5699] usb 1-1: config 0 descriptor?? [ 376.771781][ T5699] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 377.281987][ T5699] gspca_vc032x: reg_r err -110 [ 377.282059][ T5699] vc032x 1-1:0.0: probe with driver vc032x failed with error -110 [ 378.348326][ T10] usb 1-1: USB disconnect, device number 30 [ 380.120377][ T10] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 380.276039][ T10] usb 2-1: Using ep0 maxpacket: 8 [ 380.287914][ T10] usb 2-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 380.310199][ T10] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 380.320744][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 380.331160][ T10] usb 2-1: config 0 descriptor?? [ 380.341374][ T10] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 381.165041][ T10] gspca_vc032x: reg_r err -71 [ 381.170272][ T10] vc032x 2-1:0.0: probe with driver vc032x failed with error -71 [ 381.186704][ T10] usb 2-1: USB disconnect, device number 49 [ 381.653286][ T25] usb 5-1: new low-speed USB device number 24 using dummy_hcd [ 381.689527][ T8791] netlink: 'syz.0.802': attribute type 1 has an invalid length. [ 381.927795][ T8808] i2c i2c-0: Failed to register i2c client usb3503 at 0x08 (-16) [ 382.197055][ T25] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 382.198249][ T25] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 382.198269][ T25] usb 5-1: config 0 has no interface number 0 [ 382.198298][ T25] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 382.198319][ T25] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 382.198346][ T25] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 382.210156][ T25] usb 5-1: config 0 descriptor?? [ 382.376040][ T25] iowarrior 5-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 382.582941][ T8791] 8021q: adding VLAN 0 to HW filter on device bond2 [ 382.622081][ T31] audit: type=1400 audit(1788959295.468:1048): avc: denied { create } for pid=8789 comm="syz.0.802" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 383.036537][ T10] usb 5-1: USB disconnect, device number 24 [ 383.054152][ T8815] netlink: 20 bytes leftover after parsing attributes in process `syz.3.807'. [ 383.339097][ T8793] bond2: (slave veth3): Enslaving as an active interface with a down link [ 384.491119][ T8823] netlink: 8 bytes leftover after parsing attributes in process `syz.2.808'. [ 384.726070][ T10] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 384.876989][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 384.884901][ T10] usb 3-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 384.895327][ T10] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 384.895353][ T10] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 384.895376][ T10] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 384.895397][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 384.944746][ T10] hub 3-1:1.0: bad descriptor, ignoring hub [ 384.957925][ T10] hub 3-1:1.0: probe with driver hub failed with error -5 [ 384.965417][ T10] cdc_wdm 3-1:1.0: skipping garbage [ 384.965429][ T10] cdc_wdm 3-1:1.0: skipping garbage [ 384.965641][ T10] cdc_wdm 3-1:1.0: probe with driver cdc_wdm failed with error -22 [ 384.987205][ T5699] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 385.154220][ T31] audit: type=1400 audit(1788959298.018:1049): avc: denied { ioctl } for pid=8821 comm="syz.2.808" path="socket:[34335]" dev="sockfs" ino=34335 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 385.154288][ T31] audit: type=1400 audit(1788959298.018:1050): avc: denied { write } for pid=8821 comm="syz.2.808" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 385.154339][ T31] audit: type=1400 audit(1788959298.018:1051): avc: denied { connect } for pid=8821 comm="syz.2.808" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 385.154377][ T31] audit: type=1400 audit(1788959298.028:1052): avc: denied { getopt } for pid=8821 comm="syz.2.808" laddr=172.20.20.10 lport=255 faddr=172.20.20.187 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 385.161833][ T5699] usb 4-1: unable to get BOS descriptor or descriptor too short [ 385.161868][ T5699] usb 4-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 385.163192][ T5699] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 385.163245][ T5699] usb 4-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 385.183449][ T5699] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 385.183472][ T5699] usb 4-1: Product: syz [ 385.183485][ T5699] usb 4-1: Manufacturer: syz [ 385.183497][ T5699] usb 4-1: SerialNumber: syz [ 385.242856][ T8830] kAFS: No cell specified [ 385.297611][ T25] usb 3-1: USB disconnect, device number 29 [ 385.559373][ T5699] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 385.587334][ T25] usb 2-1: new full-speed USB device number 50 using dummy_hcd [ 385.611469][ T5699] usb 4-1: USB disconnect, device number 24 [ 385.675296][ T7043] udevd[7043]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 385.737725][ T25] usb 2-1: unable to get BOS descriptor or descriptor too short [ 385.738228][ T25] usb 2-1: not running at top speed; connect to a high speed hub [ 385.738251][ T25] usb 2-1: New USB device found, idVendor=045b, idProduct=0212, bcdDevice=fb.ac [ 385.741017][ T25] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 385.741035][ T25] usb 2-1: Product: syz [ 385.741047][ T25] usb 2-1: Manufacturer: syz [ 385.741059][ T25] usb 2-1: SerialNumber: syz [ 385.757462][ T25] upd78f0730 2-1:254.0: upd78f0730 converter detected [ 385.763193][ T25] usb 2-1: upd78f0730 converter now attached to ttyUSB0 [ 385.841521][ T8838] FAULT_INJECTION: forcing a failure. [ 385.841521][ T8838] name failslab, interval 1, probability 0, space 0, times 0 [ 385.841570][ T8838] CPU: 1 UID: 0 PID: 8838 Comm: syz.2.814 Tainted: G L syzkaller #0 PREEMPT(full) [ 385.841592][ T8838] Tainted: [L]=SOFTLOCKUP [ 385.841597][ T8838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 385.841612][ T8838] Call Trace: [ 385.841617][ T8838] [ 385.841623][ T8838] dump_stack_lvl+0x100/0x190 [ 385.841651][ T8838] should_fail_ex.cold+0x5/0xa [ 385.841674][ T8838] should_failslab+0xc2/0x120 [ 385.841694][ T8838] __kmalloc_noprof+0xfc/0x840 [ 385.841712][ T8838] ? tomoyo_encode2+0xfb/0x3c0 [ 385.841733][ T8838] tomoyo_encode2+0xfb/0x3c0 [ 385.841753][ T8838] tomoyo_encode+0x29/0x50 [ 385.841769][ T8838] tomoyo_realpath_from_path+0x18c/0x690 [ 385.841793][ T8838] tomoyo_path_number_perm+0x23c/0x580 [ 385.841815][ T8838] ? tomoyo_path_number_perm+0x22e/0x580 [ 385.841840][ T8838] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 385.841871][ T8838] ? __lock_acquire+0x5c0/0x1f40 [ 385.841900][ T8838] ? __fget_files+0x34/0x3d0 [ 385.841919][ T8838] ? find_held_lock+0x2b/0x80 [ 385.841940][ T8838] ? hook_file_ioctl_common+0x140/0x440 [ 385.841964][ T8838] ? __fget_files+0x21f/0x3d0 [ 385.841986][ T8838] security_file_ioctl+0xd3/0x230 [ 385.842003][ T8838] __x64_sys_ioctl+0xb7/0x210 [ 385.842020][ T8838] do_syscall_64+0x123/0x790 [ 385.842042][ T8838] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 385.842059][ T8838] RIP: 0033:0x7f3da019e159 [ 385.842072][ T8838] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 385.842086][ T8838] RSP: 002b:00007f3da0fc4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 385.842102][ T8838] RAX: ffffffffffffffda RBX: 00007f3da0425fa0 RCX: 00007f3da019e159 [ 385.842112][ T8838] RDX: 0000200000000140 RSI: 00000000806c4120 RDI: 0000000000000005 [ 385.842122][ T8838] RBP: 00007f3da0fc4090 R08: 0000000000000000 R09: 0000000000000000 [ 385.842132][ T8838] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 385.842141][ T8838] R13: 00007f3da0426038 R14: 00007f3da0425fa0 R15: 00007ffe54066228 [ 385.842166][ T8838] [ 385.842187][ T8838] ERROR: Out of memory at tomoyo_realpath_from_path. [ 385.956329][ T5699] usb 2-1: USB disconnect, device number 50 [ 385.965985][ T5699] upd78f0730 ttyUSB0: upd78f0730 converter now disconnected from ttyUSB0 [ 385.966351][ T5699] upd78f0730 2-1:254.0: device disconnected [ 386.178338][ T31] audit: type=1800 audit(1788959299.048:1053): pid=8840 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.4.815" name="syzkaller0" dev="sda1" ino=2048 res=0 errno=0 [ 387.057298][ T8851] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 388.026003][ T31] audit: type=1400 audit(1788959300.898:1054): avc: denied { ioctl } for pid=8860 comm="syz.2.821" path="socket:[34373]" dev="sockfs" ino=34373 ioctlcmd=0x8905 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 388.077339][ T31] audit: type=1400 audit(1788959300.958:1055): avc: denied { setattr } for pid=8860 comm="syz.2.821" path="socket:[34373]" dev="sockfs" ino=34373 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 388.077388][ T31] audit: type=1400 audit(1788959300.958:1056): avc: denied { setattr } for pid=8860 comm="syz.2.821" path="socket:[34373]" dev="sockfs" ino=34373 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 388.155447][ T8872] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 388.260718][ T8879] kAFS: No cell specified [ 388.512878][ T31] audit: type=1400 audit(1788959301.388:1057): avc: denied { load_policy } for pid=8886 comm="syz.0.827" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 388.548817][ T8887] SELinux: invalid class [ 388.565420][ T8887] SELinux: failed to load policy [ 388.578838][ T31] audit: type=1400 audit(1788959301.458:1058): avc: denied { create } for pid=8886 comm="syz.0.827" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 388.694959][ T8892] batadv_slave_0: entered promiscuous mode [ 388.701584][ T8892] batadv_slave_0: left promiscuous mode [ 388.717058][ T8890] syzkaller0: entered promiscuous mode [ 388.717079][ T8890] syzkaller0: entered allmulticast mode [ 388.744126][ T31] audit: type=1400 audit(1788959301.618:1059): avc: denied { map } for pid=8889 comm="syz.4.828" path="/dev/nullb0" dev="devtmpfs" ino=694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 388.770505][ T31] audit: type=1400 audit(1788959301.648:1060): avc: denied { execute } for pid=8889 comm="syz.4.828" path="/dev/nullb0" dev="devtmpfs" ino=694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 388.897005][ T31] audit: type=1400 audit(1788959301.778:1061): avc: denied { ioctl } for pid=8889 comm="syz.4.828" path="/dev/nullb0" dev="devtmpfs" ino=694 ioctlcmd=0x127f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 389.081510][ T8901] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 389.081650][ T8901] block device autoloading is deprecated and will be removed. [ 389.885994][ T10] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 389.886148][ T9] usb 1-1: new low-speed USB device number 31 using dummy_hcd [ 389.994620][ T8909] binder: BINDER_SET_CONTEXT_MGR already set [ 389.994671][ T8909] binder: 8908:8909 ioctl 4018620d 200000001000 returned -16 [ 390.106032][ T10] usb 3-1: device descriptor read/64, error -71 [ 390.106099][ T9] usb 1-1: device descriptor read/64, error -71 [ 390.129085][ T8909] jffs2: notice: (8909) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 390.137398][ T31] audit: type=1400 audit(1788959303.018:1062): avc: denied { remount } for pid=8908 comm="syz.4.835" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 390.898493][ T9] usb 1-1: new low-speed USB device number 32 using dummy_hcd [ 390.898940][ T10] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 391.066266][ T10] usb 3-1: device descriptor read/64, error -71 [ 391.172922][ T9] usb 1-1: device descriptor read/64, error -71 [ 391.360786][ T9] usb usb1-port1: attempt power cycle [ 391.362231][ T10] usb usb3-port1: attempt power cycle [ 391.419439][ T8920] binder: BINDER_SET_CONTEXT_MGR bad uid 60929 != 0 [ 391.419476][ T8920] binder: 8919:8920 ioctl 4018620d 200000004a80 returned -1 [ 391.489446][ T31] audit: type=1400 audit(1788959304.368:1063): avc: denied { append } for pid=8923 comm="syz.4.838" name="nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 391.611015][ T8929] netlink: 92 bytes leftover after parsing attributes in process `syz.4.839'. [ 391.663717][ T8929] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[5600] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[8929] [ 391.707010][ T10] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 391.717053][ T9] usb 1-1: new low-speed USB device number 33 using dummy_hcd [ 391.726550][ T10] usb 3-1: device descriptor read/8, error -71 [ 391.736505][ T9] usb 1-1: device descriptor read/8, error -71 [ 391.751379][ T8931] netlink: 8 bytes leftover after parsing attributes in process `syz.3.841'. [ 391.760279][ T8931] netlink: 'syz.3.841': attribute type 10 has an invalid length. [ 391.768107][ T8931] netlink: 12 bytes leftover after parsing attributes in process `syz.3.841'. [ 391.780489][ T8931] geneve2: entered promiscuous mode [ 391.785797][ T8931] geneve2: entered allmulticast mode [ 391.806009][ T93] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 391.975983][ T93] usb 2-1: Using ep0 maxpacket: 32 [ 391.977012][ T93] usb 2-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 391.977823][ T93] usb 2-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 391.980808][ T93] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 391.980827][ T93] usb 2-1: Product: syz [ 391.980841][ T93] usb 2-1: Manufacturer: syz [ 391.980853][ T93] usb 2-1: SerialNumber: syz [ 391.994011][ T93] imon:imon_find_endpoints: no valid input (IR) endpoint found [ 391.994072][ T93] imon 2-1:155.0: unable to initialize intf0, err -19 [ 391.994086][ T93] imon:imon_probe: failed to initialize context! [ 391.994095][ T93] imon 2-1:155.0: unable to register, err -19 [ 392.026454][ T9] usb 1-1: new low-speed USB device number 34 using dummy_hcd [ 392.027267][ T10] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 392.048078][ T9] usb 1-1: device descriptor read/8, error -71 [ 392.194203][ T9] usb usb1-port1: unable to enumerate USB device [ 392.360942][ T10] usb 3-1: device descriptor read/8, error -71 [ 392.474536][ T10] usb usb3-port1: unable to enumerate USB device [ 392.589582][ T5786] usb 2-1: USB disconnect, device number 51 [ 393.622976][ T31] kauditd_printk_skb: 1 callbacks suppressed [ 393.623017][ T31] audit: type=1400 audit(1788959306.498:1065): avc: denied { connect } for pid=8961 comm="syz.0.850" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 393.633904][ T8964] FAULT_INJECTION: forcing a failure. [ 393.633904][ T8964] name failslab, interval 1, probability 0, space 0, times 0 [ 393.633935][ T8964] CPU: 0 UID: 0 PID: 8964 Comm: syz.0.850 Tainted: G L syzkaller #0 PREEMPT(full) [ 393.633959][ T8964] Tainted: [L]=SOFTLOCKUP [ 393.633966][ T8964] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 393.633977][ T8964] Call Trace: [ 393.633983][ T8964] [ 393.633990][ T8964] dump_stack_lvl+0x100/0x190 [ 393.634018][ T8964] should_fail_ex.cold+0x5/0xa [ 393.634043][ T8964] should_failslab+0xc2/0x120 [ 393.634064][ T8964] __kmalloc_cache_noprof+0x91/0x6d0 [ 393.634088][ T8964] ? do_raw_spin_lock+0x128/0x260 [ 393.634108][ T8964] ? __alloc_workqueue+0x155/0x1950 [ 393.634132][ T8964] __alloc_workqueue+0x155/0x1950 [ 393.634156][ T8964] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 393.634177][ T8964] ? lockdep_hardirqs_on+0x7d/0x110 [ 393.634198][ T8964] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 393.634218][ T8964] ? __debug_object_init+0x2de/0x3d0 [ 393.634240][ T8964] alloc_workqueue_noprof+0xc7/0x130 [ 393.634262][ T8964] ? __pfx_alloc_workqueue_noprof+0x10/0x10 [ 393.634288][ T8964] ? lockdep_init_map_type+0x5c/0x250 [ 393.634306][ T8964] ? lockdep_init_map_type+0x5c/0x250 [ 393.634327][ T8964] __rds_conn_create+0x1234/0x25a0 [ 393.634357][ T8964] ? __pfx___rds_conn_create+0x10/0x10 [ 393.634376][ T8964] ? trace_kmalloc+0xeb/0x110 [ 393.634394][ T8964] ? __kasan_kmalloc+0xaa/0xb0 [ 393.634413][ T8964] ? lockdep_init_map_type+0x5c/0x250 [ 393.634438][ T8964] rds_conn_create_outgoing+0x44/0x60 [ 393.634463][ T8964] rds_sendmsg+0x10da/0x34d0 [ 393.634478][ T8964] ? irqentry_exit+0x24d/0xa10 [ 393.634506][ T8964] ? __pfx_rds_sendmsg+0x10/0x10 [ 393.634532][ T8964] ? selinux_socket_sendmsg+0x198/0x2f0 [ 393.634559][ T8964] ? ____sys_sendmsg+0xa4d/0xbe0 [ 393.634580][ T8964] ____sys_sendmsg+0xa4d/0xbe0 [ 393.634599][ T8964] ? __pfx_rds_sendmsg+0x10/0x10 [ 393.634615][ T8964] ? __pfx_____sys_sendmsg+0x10/0x10 [ 393.634641][ T8964] ? plist_check_list+0x1b8/0x280 [ 393.634656][ T8964] ? plist_del+0x308/0x510 [ 393.634674][ T8964] ___sys_sendmsg+0x190/0x1e0 [ 393.634696][ T8964] ? __pfx____sys_sendmsg+0x10/0x10 [ 393.634718][ T8964] ? futex_wake+0x220/0x5e0 [ 393.634750][ T8964] ? find_held_lock+0x2b/0x80 [ 393.634785][ T8964] __sys_sendmsg+0x160/0x210 [ 393.634802][ T8964] ? __pfx___sys_sendmsg+0x10/0x10 [ 393.634831][ T8964] do_syscall_64+0x123/0x790 [ 393.634852][ T8964] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 393.634869][ T8964] RIP: 0033:0x7fa15d19e159 [ 393.634883][ T8964] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 393.634897][ T8964] RSP: 002b:00007fa15e09f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 393.634914][ T8964] RAX: ffffffffffffffda RBX: 00007fa15d425fa0 RCX: 00007fa15d19e159 [ 393.634924][ T8964] RDX: 0000000000000040 RSI: 00002000000002c0 RDI: 0000000000000003 [ 393.634934][ T8964] RBP: 00007fa15d23503b R08: 0000000000000000 R09: 0000000000000000 [ 393.634944][ T8964] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 393.634953][ T8964] R13: 00007fa15d426038 R14: 00007fa15d425fa0 R15: 00007fffc0887c18 [ 393.634975][ T8964] [ 393.635048][ T31] audit: type=1400 audit(1788959306.508:1066): avc: denied { write } for pid=8961 comm="syz.0.850" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 393.871287][ T31] audit: type=1400 audit(1788959306.748:1067): avc: denied { write } for pid=8969 comm="syz.0.852" name="mtd0" dev="devtmpfs" ino=702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 393.888636][ T31] audit: type=1400 audit(1788959306.768:1068): avc: denied { ioctl } for pid=8969 comm="syz.0.852" path="/dev/mtd0" dev="devtmpfs" ino=702 ioctlcmd=0x4d18 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 394.091296][ T31] audit: type=1400 audit(1788959306.968:1069): avc: denied { append } for pid=8978 comm="syz.1.857" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 394.113324][ T8983] comedi comedi3: 8255: I/O base address not correctly aligned [ 394.293769][ T8991] xt_hashlimit: size too large, truncated to 1048576 [ 394.391122][ T8996] Bluetooth: ISO socket layer initialized [ 394.507374][ T9001] oom_control is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 394.552675][ T31] audit: type=1400 audit(1788959307.428:1070): avc: denied { ioctl } for pid=9003 comm="syz.3.868" path="socket:[35905]" dev="sockfs" ino=35905 ioctlcmd=0x8915 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 394.844897][ T9015] tun0: tun_chr_ioctl cmd 1074025676 [ 394.844929][ T9015] tun0: owner set to 0 [ 394.943569][ T31] audit: type=1400 audit(1788959307.818:1071): avc: denied { connect } for pid=9022 comm="syz.0.877" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 394.973680][ T31] audit: type=1400 audit(1788959307.848:1072): avc: denied { write } for pid=9022 comm="syz.0.877" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 395.202311][ T31] audit: type=1400 audit(1788959308.078:1073): avc: denied { connect } for pid=9032 comm="syz.4.882" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 395.276452][ T9042] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 395.461104][ T9051] md/raid0:md0: too few disks (1 of 124) - aborting! [ 395.474690][ T9051] md: pers->run() failed ... [ 395.801333][ T9063] EXT4-fs (sda1): re-mounted 4f91c6db-4997-4bb4-91b8-7e83a20c1bf1. [ 395.916016][ T31] audit: type=1800 audit(1788959308.788:1074): pid=9038 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.3.880" name="/" dev="fuse" ino=1 res=0 errno=0 [ 396.071013][ T9074] FAULT_INJECTION: forcing a failure. [ 396.071013][ T9074] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 396.085013][ T9074] CPU: 1 UID: 0 PID: 9074 Comm: syz.1.897 Tainted: G L syzkaller #0 PREEMPT(full) [ 396.085041][ T9074] Tainted: [L]=SOFTLOCKUP [ 396.085047][ T9074] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 396.085058][ T9074] Call Trace: [ 396.085064][ T9074] [ 396.085071][ T9074] dump_stack_lvl+0x100/0x190 [ 396.085099][ T9074] should_fail_ex.cold+0x5/0xa [ 396.085118][ T9074] ? prepare_alloc_pages+0x16d/0x5b0 [ 396.085141][ T9074] should_fail_alloc_page+0xeb/0x140 [ 396.085163][ T9074] prepare_alloc_pages+0x1f0/0x5b0 [ 396.085189][ T9074] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 396.085221][ T9074] ? stack_trace_save+0x8e/0xc0 [ 396.085250][ T9074] ? __pfx_stack_trace_save+0x10/0x10 [ 396.085274][ T9074] ? lockdep_hardirqs_on+0x7d/0x110 [ 396.085294][ T9074] ? stack_depot_save_flags+0x27/0x9f0 [ 396.085317][ T9074] ? stack_depot_save_flags+0x49a/0x9f0 [ 396.085343][ T9074] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 396.085372][ T9074] ? __kasan_kmalloc+0xaa/0xb0 [ 396.085393][ T9074] ? rds_cong_from_addr+0x50/0x540 [ 396.085414][ T9074] ? __rds_conn_create+0xa7e/0x25a0 [ 396.085436][ T9074] ? rds_conn_create_outgoing+0x44/0x60 [ 396.085459][ T9074] ? rds_sendmsg+0x10da/0x34d0 [ 396.085475][ T9074] ? ____sys_sendmsg+0xa4d/0xbe0 [ 396.085499][ T9074] ? ___sys_sendmsg+0x190/0x1e0 [ 396.085519][ T9074] ? __sys_sendmsg+0x160/0x210 [ 396.085535][ T9074] ? do_syscall_64+0x123/0x790 [ 396.085554][ T9074] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 396.085590][ T9074] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 396.085613][ T9074] ? policy_nodemask+0xed/0x4f0 [ 396.085639][ T9074] alloc_pages_mpol+0x201/0x550 [ 396.085664][ T9074] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 396.085690][ T9074] ? lockdep_init_map_type+0x5c/0x250 [ 396.085715][ T9074] alloc_pages_noprof+0x1a/0x160 [ 396.085746][ T9074] get_zeroed_page_noprof+0x18/0xb0 [ 396.085769][ T9074] rds_cong_from_addr+0x15b/0x540 [ 396.085794][ T9074] rds_cong_get_maps+0x49/0xe0 [ 396.085814][ T9074] ? __ipv6_addr_type+0xe8/0x2e0 [ 396.085834][ T9074] __rds_conn_create+0xa7e/0x25a0 [ 396.085867][ T9074] ? __pfx___rds_conn_create+0x10/0x10 [ 396.085890][ T9074] ? trace_kmalloc+0xeb/0x110 [ 396.085918][ T9074] ? __kasan_kmalloc+0xaa/0xb0 [ 396.085938][ T9074] ? lockdep_init_map_type+0x5c/0x250 [ 396.085964][ T9074] rds_conn_create_outgoing+0x44/0x60 [ 396.085995][ T9074] rds_sendmsg+0x10da/0x34d0 [ 396.086014][ T9074] ? trace_sched_exit_tp+0x120/0x160 [ 396.086049][ T9074] ? __pfx_rds_sendmsg+0x10/0x10 [ 396.086080][ T9074] ? selinux_socket_sendmsg+0x198/0x2f0 [ 396.086114][ T9074] ? ____sys_sendmsg+0xa4d/0xbe0 [ 396.086138][ T9074] ____sys_sendmsg+0xa4d/0xbe0 [ 396.086161][ T9074] ? __pfx_rds_sendmsg+0x10/0x10 [ 396.086180][ T9074] ? __pfx_____sys_sendmsg+0x10/0x10 [ 396.086216][ T9074] ___sys_sendmsg+0x190/0x1e0 [ 396.086243][ T9074] ? __pfx____sys_sendmsg+0x10/0x10 [ 396.086269][ T9074] ? futex_wait+0x11e/0x370 [ 396.086307][ T9074] ? find_held_lock+0x2b/0x80 [ 396.086349][ T9074] __sys_sendmsg+0x160/0x210 [ 396.086370][ T9074] ? __pfx___sys_sendmsg+0x10/0x10 [ 396.086403][ T9074] do_syscall_64+0x123/0x790 [ 396.086426][ T9074] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 396.086442][ T9074] RIP: 0033:0x7fe0cbd9e159 [ 396.086457][ T9074] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 396.086474][ T9074] RSP: 002b:00007fe0ccbc3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 396.086492][ T9074] RAX: ffffffffffffffda RBX: 00007fe0cc025fa0 RCX: 00007fe0cbd9e159 [ 396.086504][ T9074] RDX: 0000000000000040 RSI: 00002000000002c0 RDI: 0000000000000003 [ 396.086515][ T9074] RBP: 00007fe0cbe3503b R08: 0000000000000000 R09: 0000000000000000 [ 396.086526][ T9074] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 396.086537][ T9074] R13: 00007fe0cc026038 R14: 00007fe0cc025fa0 R15: 00007ffdc077b4c8 [ 396.086562][ T9074] [ 396.222921][ T1146] Bluetooth: hci5: Frame reassembly failed (-84) [ 396.319800][ T10] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 396.467656][ T10] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 396.468845][ T10] usb 3-1: config 0 interface 0 altsetting 255 endpoint 0x7 has an invalid bInterval 0, changing to 7 [ 396.468868][ T10] usb 3-1: config 0 interface 0 altsetting 255 endpoint 0x7 has invalid maxpacket 18375, setting to 1024 [ 396.468890][ T10] usb 3-1: config 0 interface 0 has no altsetting 0 [ 396.470752][ T10] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 396.470771][ T10] usb 3-1: Product: syz [ 396.470782][ T10] usb 3-1: Manufacturer: syz [ 396.470795][ T10] usb 3-1: SerialNumber: syz [ 396.478186][ T10] usb 3-1: config 0 descriptor?? [ 396.479534][ T9073] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 396.498676][ T10] usb 3-1: selecting invalid altsetting 0 [ 396.742160][ T5699] usb 3-1: USB disconnect, device number 34 [ 396.752037][ T9088] netlink: 4 bytes leftover after parsing attributes in process `syz.0.905'. [ 396.937959][ T10] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 396.973000][ T9095] netlink: 8 bytes leftover after parsing attributes in process `syz.0.908'. [ 397.007601][ T9095] 8021q: adding VLAN 0 to HW filter on device bond3 [ 397.028077][ T9095] bond3: (slave geneve2): making interface the new active one [ 397.039818][ T9095] bond3: (slave geneve2): Enslaving as an active interface with an up link [ 397.066475][ T9095] bond3 (unregistering): (slave geneve2): Releasing active interface [ 397.082685][ T9095] bond3 (unregistering): Released all slaves [ 397.086773][ T10] usb 2-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 397.087653][ T10] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 397.087687][ T10] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 397.087708][ T10] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 397.087742][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 397.567669][ T10] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -71 [ 397.567703][ T10] ATM dev 0: usbatm_atm_init: atm_start failed: -71! [ 397.583937][ T5911] IPVS: starting estimator thread 0... [ 397.614975][ T10] cxacru 2-1:1.0: probe with driver cxacru failed with error -71 [ 397.631795][ T10] usb 2-1: USB disconnect, device number 52 [ 397.687638][ T9113] IPVS: using max 44 ests per chain, 105600 per kthread [ 397.740663][ T9119] binder: 9118:9119 ioctl c0306201 200000000180 returned -22 [ 398.072028][ T9129] netlink: 84 bytes leftover after parsing attributes in process `syz.2.922'. [ 398.219232][ T5699] logitech-hidpp-device 0005:046D:B012.000F: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz1 [ 398.286331][ T5598] Bluetooth: hci5: command 0x1003 tx timeout [ 398.288661][ T5604] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 398.344130][ T9136] fido_id[9136]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 398.536694][ T9143] FAULT_INJECTION: forcing a failure. [ 398.536694][ T9143] name failslab, interval 1, probability 0, space 0, times 0 [ 398.536738][ T9143] CPU: 0 UID: 0 PID: 9143 Comm: syz.2.926 Tainted: G L syzkaller #0 PREEMPT(full) [ 398.536766][ T9143] Tainted: [L]=SOFTLOCKUP [ 398.536773][ T9143] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 398.536785][ T9143] Call Trace: [ 398.536791][ T9143] [ 398.536799][ T9143] dump_stack_lvl+0x100/0x190 [ 398.536833][ T9143] should_fail_ex.cold+0x5/0xa [ 398.536861][ T9143] should_failslab+0xc2/0x120 [ 398.536894][ T9143] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 398.536918][ T9143] ? __alloc_skb+0x140/0x710 [ 398.536944][ T9143] __alloc_skb+0x140/0x710 [ 398.536962][ T9143] ? __alloc_skb+0x5b7/0x710 [ 398.536982][ T9143] ? __pfx___alloc_skb+0x10/0x10 [ 398.537009][ T9143] _sctp_make_chunk+0x51/0x270 [ 398.537037][ T9143] sctp_make_control+0x2f/0x2d0 [ 398.537064][ T9143] sctp_make_heartbeat+0xad/0x2f0 [ 398.537091][ T9143] ? __pfx_sctp_make_heartbeat+0x10/0x10 [ 398.537114][ T9143] ? kernel_text_address+0x8d/0x100 [ 398.537148][ T9143] ? sctp_sm_lookup_event+0x10e/0x520 [ 398.537172][ T9143] ? __pfx_sctp_sm_lookup_event+0x10/0x10 [ 398.537199][ T9143] ? __pfx_sctp_pname+0x10/0x10 [ 398.537222][ T9143] sctp_sf_do_prm_requestheartbeat+0x27/0x220 [ 398.537245][ T9143] ? __pfx_sctp_pname+0x10/0x10 [ 398.537266][ T9143] sctp_do_sm+0x17a/0x5c30 [ 398.537297][ T9143] ? __pfx_sctp_do_sm+0x10/0x10 [ 398.537316][ T9143] ? kasan_save_track+0x14/0x30 [ 398.537337][ T9143] ? __kmalloc_node_track_caller_noprof+0x33d/0x870 [ 398.537357][ T9143] ? sctp_setsockopt+0x511/0xb370 [ 398.537376][ T9143] ? do_sock_setsockopt+0xf3/0x1d0 [ 398.537396][ T9143] ? __sys_setsockopt+0x195/0x220 [ 398.537414][ T9143] ? __x64_sys_setsockopt+0xbd/0x160 [ 398.537469][ T9143] sctp_primitive_REQUESTHEARTBEAT+0x9f/0xd0 [ 398.537496][ T9143] sctp_apply_peer_addr_params+0x110/0x3690 [ 398.537530][ T9143] sctp_setsockopt+0x28d6/0xb370 [ 398.537557][ T9143] ? __pfx_sctp_setsockopt+0x10/0x10 [ 398.537580][ T9143] ? __fget_files+0x215/0x3d0 [ 398.537605][ T9143] ? selinux_socket_setsockopt+0x6a/0x80 [ 398.537633][ T9143] ? sock_common_setsockopt+0x2e/0xf0 [ 398.537657][ T9143] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 398.537684][ T9143] do_sock_setsockopt+0xf3/0x1d0 [ 398.537711][ T9143] __sys_setsockopt+0x195/0x220 [ 398.537736][ T9143] __x64_sys_setsockopt+0xbd/0x160 [ 398.537754][ T9143] ? do_syscall_64+0xae/0x790 [ 398.537777][ T9143] ? lockdep_hardirqs_on+0x7d/0x110 [ 398.537800][ T9143] do_syscall_64+0x123/0x790 [ 398.537827][ T9143] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 398.537847][ T9143] RIP: 0033:0x7f3da019e159 [ 398.537865][ T9143] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 398.537889][ T9143] RSP: 002b:00007f3da0fc4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 398.537909][ T9143] RAX: ffffffffffffffda RBX: 00007f3da0425fa0 RCX: 00007f3da019e159 [ 398.537923][ T9143] RDX: 0000000000000009 RSI: 0000000000000084 RDI: 0000000000000005 [ 398.537935][ T9143] RBP: 00007f3da023503b R08: 000000000000009c R09: 0000000000000000 [ 398.537947][ T9143] R10: 0000200000000400 R11: 0000000000000246 R12: 0000000000000000 [ 398.537959][ T9143] R13: 00007f3da0426038 R14: 00007f3da0425fa0 R15: 00007ffe54066228 [ 398.537988][ T9143] [ 399.073264][ T9166] overlayfs: failed to clone upperpath [ 399.444632][ T31] kauditd_printk_skb: 6 callbacks suppressed [ 399.444674][ T31] audit: type=1400 audit(1788959312.318:1080): avc: denied { bind } for pid=9179 comm="syz.1.944" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 399.594090][ T9186] FAULT_INJECTION: forcing a failure. [ 399.594090][ T9186] name failslab, interval 1, probability 0, space 0, times 0 [ 399.594143][ T9186] CPU: 1 UID: 0 PID: 9186 Comm: syz.3.947 Tainted: G L syzkaller #0 PREEMPT(full) [ 399.594169][ T9186] Tainted: [L]=SOFTLOCKUP [ 399.594174][ T9186] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 399.594182][ T9186] Call Trace: [ 399.594188][ T9186] [ 399.594194][ T9186] dump_stack_lvl+0x100/0x190 [ 399.594221][ T9186] should_fail_ex.cold+0x5/0xa [ 399.594246][ T9186] should_failslab+0xc2/0x120 [ 399.594266][ T9186] kmem_cache_alloc_noprof+0x92/0x6a0 [ 399.594283][ T9186] ? d_instantiate+0x8a/0xb0 [ 399.594305][ T9186] ? alloc_empty_file+0x5b/0x1c0 [ 399.594330][ T9186] alloc_empty_file+0x5b/0x1c0 [ 399.594352][ T9186] alloc_file_pseudo+0x183/0x290 [ 399.594374][ T9186] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 399.594396][ T9186] ? alloc_fd+0x471/0x7a0 [ 399.594420][ T9186] sock_alloc_file+0x50/0x210 [ 399.594439][ T9186] __sys_socket+0x1c0/0x260 [ 399.594462][ T9186] ? __pfx___sys_socket+0x10/0x10 [ 399.594490][ T9186] __x64_sys_socket+0x72/0xb0 [ 399.594511][ T9186] ? lockdep_hardirqs_on+0x7d/0x110 [ 399.594532][ T9186] do_syscall_64+0x123/0x790 [ 399.594553][ T9186] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 399.594577][ T9186] RIP: 0033:0x7f977e59e159 [ 399.594591][ T9186] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 399.594607][ T9186] RSP: 002b:00007f977f3cb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 399.594627][ T9186] RAX: ffffffffffffffda RBX: 00007f977e825fa0 RCX: 00007f977e59e159 [ 399.594640][ T9186] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 0000000000000018 [ 399.594650][ T9186] RBP: 00007f977e63503b R08: 0000000000000000 R09: 0000000000000000 [ 399.594662][ T9186] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 399.594674][ T9186] R13: 00007f977e826038 R14: 00007f977e825fa0 R15: 00007ffef91f5d68 [ 399.594698][ T9186] [ 399.624702][ T31] audit: type=1400 audit(1788959312.498:1081): avc: denied { execute } for pid=9183 comm="syz.2.946" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=36327 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 399.830115][ T31] audit: type=1400 audit(1788959312.708:1082): avc: denied { bind } for pid=9193 comm="syz.3.951" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 399.832515][ T31] audit: type=1400 audit(1788959312.708:1083): avc: denied { node_bind } for pid=9193 comm="syz.3.951" saddr=172.20.20.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 399.842199][ T9191] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 399.887586][ T9194] syzkaller0: entered promiscuous mode [ 399.887623][ T9194] syzkaller0: entered allmulticast mode [ 399.944837][ T31] audit: type=1400 audit(1788959312.818:1084): avc: denied { write } for pid=9192 comm="syz.1.950" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 400.098081][ T31] audit: type=1400 audit(1788959312.978:1085): avc: denied { read } for pid=5263 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 400.604279][ T31] audit: type=1400 audit(1788959313.478:1086): avc: denied { bind } for pid=9209 comm="syz.3.958" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 400.688380][ T31] audit: type=1400 audit(1788959313.568:1087): avc: denied { checkpoint_restore } for pid=9218 comm="syz.0.963" capability=40 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 400.692093][ T31] audit: type=1400 audit(1788959313.568:1088): avc: denied { setopt } for pid=9219 comm="syz.2.962" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 400.692562][ T31] audit: type=1400 audit(1788959313.568:1089): avc: denied { getopt } for pid=9219 comm="syz.2.962" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 400.775679][ T5786] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 400.859016][ T9224] bridge0: port 2(bridge_slave_1) entered disabled state [ 400.859417][ T9224] bridge0: port 1(bridge_slave_0) entered disabled state [ 400.927030][ T5786] usb 2-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 400.927843][ T5786] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 400.927881][ T5786] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 400.927908][ T5786] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 400.927938][ T5786] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 401.011265][ T9224] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 401.029250][ T9224] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 401.376325][ T13] netdevsim netdevsim12 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 401.376378][ T13] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 401.376416][ T13] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 401.376446][ T13] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 401.376473][ T13] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 401.444081][ T5786] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -71 [ 401.444126][ T5786] ATM dev 0: usbatm_atm_init: atm_start failed: -71! [ 401.460470][ T5786] cxacru 2-1:1.0: probe with driver cxacru failed with error -71 [ 401.471188][ T5786] usb 2-1: USB disconnect, device number 53 [ 401.634459][ T9217] can-isotp: isotp_sendmsg: can_send_ret -ENETDOWN [ 402.131887][ T9258] random: crng reseeded on system resumption [ 402.411412][ T9262] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 402.631722][ T9262] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 402.855217][ T9262] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 402.962591][ T9305] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 402.990288][ T9312] netlink: 8 bytes leftover after parsing attributes in process `syz.3.998'. [ 403.017767][ T9308] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 conventional PCI endpoint [ 403.137616][ T9262] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 403.178287][ T5604] Bluetooth: hci2: unexpected event for opcode 0x2006 [ 403.394195][ T13] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 403.396450][ T1146] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 403.426457][ T13] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 403.496494][ T13] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 403.637793][ T5604] Bluetooth: hci4: unexpected event for opcode 0x2023 [ 403.855372][ T9356] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 404.060952][ T9369] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 404.690584][ T9400] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 405.270167][ T9425] loop0: detected capacity change from 0 to 4096 [ 405.323684][ T9425] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 405.329307][ T9425] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 405.329498][ T9425] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 405.329511][ T9425] ldm_validate_privheads(): Cannot find PRIVHEAD 3. [ 405.329523][ T9425] ldm_validate_privheads(): Primary and backup PRIVHEADs don't match. [ 405.329567][ T9425] loop0: [ 406.273811][ T31] kauditd_printk_skb: 4 callbacks suppressed [ 406.273853][ T31] audit: type=1400 audit(1788959319.148:1093): avc: denied { read } for pid=9481 comm="syz.0.1076" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 407.037916][ T31] audit: type=1400 audit(1788959319.918:1094): avc: denied { ioctl } for pid=9532 comm="syz.1.1100" path="socket:[38106]" dev="sockfs" ino=38106 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 407.176733][ T9539] nvme_fabrics: missing parameter 'transport=%s' [ 407.176763][ T9539] nvme_fabrics: missing parameter 'nqn=%s' [ 407.206487][ T5691] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 407.242287][ T9542] netlink: 'syz.0.1103': attribute type 10 has an invalid length. [ 407.257785][ T5604] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 407.258487][ T5604] Bluetooth: hci2: Injecting HCI hardware error event [ 407.259490][ T5604] Bluetooth: hci2: hardware error 0x00 [ 407.268086][ T9542] syz_tun: entered promiscuous mode [ 407.311577][ T9544] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 407.319544][ T9542] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 407.356635][ T5691] usb 3-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 407.367059][ T5691] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 407.380021][ T5691] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 407.380077][ T5691] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 407.380113][ T5691] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 407.631655][ T9561] random: crng reseeded on system resumption [ 407.673402][ T5691] cxacru 3-1:1.0: receive of cm 0x90 failed (-71) [ 407.684599][ T9565] cxacru 3-1:1.0: Direct firmware load for cxacru-fw.bin failed with error -2 [ 407.685032][ T9565] cxacru 3-1:1.0: Falling back to sysfs fallback for: cxacru-fw.bin [ 407.695331][ T31] audit: type=1400 audit(1788959320.568:1095): avc: denied { firmware_load } for pid=9565 comm="cxacru" scontext=system_u:system_r:kernel_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 407.729801][ T5691] usb 3-1: USB disconnect, device number 35 [ 407.906005][ T9571] nvme_fabrics: missing parameter 'transport=%s' [ 407.906038][ T9571] nvme_fabrics: missing parameter 'nqn=%s' [ 407.959267][ T31] audit: type=1400 audit(1788959320.838:1096): avc: denied { create } for pid=9577 comm="syz.1.1117" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 407.981812][ T31] audit: type=1400 audit(1788959320.858:1097): avc: denied { ioctl } for pid=9577 comm="syz.1.1117" path="socket:[38164]" dev="sockfs" ino=38164 ioctlcmd=0x89e3 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 408.263607][ T9594] netlink: 256 bytes leftover after parsing attributes in process `syz.3.1124'. [ 408.273075][ T9594] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1124'. [ 408.371171][ T9601] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1128'. [ 408.386757][ T9601] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1128'. [ 408.429388][ T9600] syzkaller0: entered promiscuous mode [ 408.434971][ T9600] syzkaller0: entered allmulticast mode [ 408.458070][ T5598] Bluetooth: hci2: unexpected event for opcode 0x2023 [ 409.205206][ T31] audit: type=1400 audit(1788959322.078:1098): avc: denied { name_bind } for pid=9627 comm="syz.0.1140" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 409.294529][ T5598] Bluetooth: hci1: unexpected event for opcode 0x200d [ 409.336466][ T5604] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 409.765475][ T31] audit: type=1400 audit(1788959322.638:1099): avc: denied { getopt } for pid=9643 comm="syz.4.1147" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 410.432393][ T9673] FAULT_INJECTION: forcing a failure. [ 410.432393][ T9673] name failslab, interval 1, probability 0, space 0, times 0 [ 410.432437][ T9673] CPU: 1 UID: 0 PID: 9673 Comm: syz.4.1158 Tainted: G L syzkaller #0 PREEMPT(full) [ 410.432461][ T9673] Tainted: [L]=SOFTLOCKUP [ 410.432468][ T9673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 410.432479][ T9673] Call Trace: [ 410.432486][ T9673] [ 410.432493][ T9673] dump_stack_lvl+0x100/0x190 [ 410.432525][ T9673] should_fail_ex.cold+0x5/0xa [ 410.432552][ T9673] should_failslab+0xc2/0x120 [ 410.432575][ T9673] kmem_cache_alloc_noprof+0x92/0x6a0 [ 410.432596][ T9673] ? skb_clone+0x190/0x400 [ 410.432622][ T9673] skb_clone+0x190/0x400 [ 410.432642][ T9673] netlink_deliver_tap+0xaed/0xcc0 [ 410.432672][ T9673] netlink_unicast+0x6a5/0x850 [ 410.432692][ T9673] ? __pfx_netlink_unicast+0x10/0x10 [ 410.432708][ T9673] ? __pfx_nf_tables_abort+0x10/0x10 [ 410.432740][ T9673] netlink_ack+0x655/0xb80 [ 410.432765][ T9673] nfnetlink_rcv_batch+0x1d52/0x2880 [ 410.432808][ T9673] ? __pfx_nfnetlink_rcv_batch+0x10/0x10 [ 410.432837][ T9673] ? lock_acquire+0x1d1/0x380 [ 410.432855][ T9673] ? avc_has_perm_noaudit+0x56/0x3b0 [ 410.432887][ T9673] ? avc_has_perm_noaudit+0x145/0x3b0 [ 410.432930][ T9673] ? __nla_parse+0x40/0x60 [ 410.432960][ T9673] nfnetlink_rcv+0x3bd/0x440 [ 410.432983][ T9673] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 410.433012][ T9673] netlink_unicast+0x585/0x850 [ 410.433033][ T9673] ? __pfx_netlink_unicast+0x10/0x10 [ 410.433058][ T9673] netlink_sendmsg+0x8b0/0xda0 [ 410.433081][ T9673] ? __pfx_netlink_sendmsg+0x10/0x10 [ 410.433105][ T9673] ? selinux_socket_sendmsg+0x198/0x2f0 [ 410.433138][ T9673] ____sys_sendmsg+0xa4d/0xbe0 [ 410.433161][ T9673] ? __pfx_netlink_sendmsg+0x10/0x10 [ 410.433179][ T9673] ? __pfx_____sys_sendmsg+0x10/0x10 [ 410.433214][ T9673] ___sys_sendmsg+0x190/0x1e0 [ 410.433241][ T9673] ? __pfx____sys_sendmsg+0x10/0x10 [ 410.433267][ T9673] ? futex_wait+0x11e/0x370 [ 410.433309][ T9673] ? find_held_lock+0x2b/0x80 [ 410.433346][ T9673] __sys_sendmsg+0x160/0x210 [ 410.433365][ T9673] ? __pfx___sys_sendmsg+0x10/0x10 [ 410.433391][ T9673] do_syscall_64+0x123/0x790 [ 410.433413][ T9673] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 410.433432][ T9673] RIP: 0033:0x7f12ecb9e159 [ 410.433448][ T9673] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 410.433465][ T9673] RSP: 002b:00007f12eadf6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 410.433488][ T9673] RAX: ffffffffffffffda RBX: 00007f12ece25fa0 RCX: 00007f12ecb9e159 [ 410.433500][ T9673] RDX: 0000000000000000 RSI: 000020000000c2c0 RDI: 0000000000000004 [ 410.433510][ T9673] RBP: 00007f12ecc3503b R08: 0000000000000000 R09: 0000000000000000 [ 410.433520][ T9673] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 410.433530][ T9673] R13: 00007f12ece26038 R14: 00007f12ece25fa0 R15: 00007ffc132803f8 [ 410.433553][ T9673] [ 411.442486][ T5608] svc: failed to register nfsdv3 RPC service (errno 111). [ 411.448669][ T5608] svc: failed to register nfsaclv3 RPC service (errno 111). [ 411.448685][ T5608] failed to unregister tcp with rpcbind [ 411.495371][ T31] audit: type=1400 audit(1788959324.368:1100): avc: denied { read append } for pid=9682 comm="syz.3.1161" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 411.638526][ T9698] netlink: 'syz.4.1169': attribute type 10 has an invalid length. [ 411.673227][ T9698] syz_tun: entered promiscuous mode [ 411.688021][ T9698] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 411.833581][ T9708] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1171'. [ 411.897038][ T31] audit: type=1400 audit(1788959324.768:1101): avc: denied { append } for pid=9710 comm="syz.4.1173" name="sg0" dev="devtmpfs" ino=983 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 412.155983][ T31] audit: type=1400 audit(1788959324.988:1102): avc: denied { bind } for pid=9715 comm="syz.1.1175" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 412.156047][ T31] audit: type=1400 audit(1788959324.988:1103): avc: denied { listen } for pid=9715 comm="syz.1.1175" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 412.156096][ T31] audit: type=1400 audit(1788959325.018:1104): avc: denied { read } for pid=9715 comm="syz.1.1175" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 412.311546][ T9686] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 412.311646][ T9686] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 412.478568][ T9686] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 412.478677][ T9686] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 412.504663][ T9686] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 412.521145][ T9686] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 413.134600][ T5604] Bluetooth: hci4: unexpected event for opcode 0x2006 [ 413.504064][ T9764] net/sunrpc/rpc_pipe.c: rpc_populate failed to populate directory / [ 413.656143][ T5604] Bluetooth: hci1: command 0x0406 tx timeout [ 413.737735][ T9786] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 414.174021][ T9822] netlink: zone id is out of range [ 414.174045][ T9822] netlink: zone id is out of range [ 414.174067][ T9822] netlink: zone id is out of range [ 414.174074][ T9822] netlink: zone id is out of range [ 414.174078][ T9822] netlink: zone id is out of range [ 414.174084][ T9822] netlink: zone id is out of range [ 414.174089][ T9822] netlink: zone id is out of range [ 414.174094][ T9822] netlink: zone id is out of range [ 414.174100][ T9822] netlink: zone id is out of range [ 414.186519][ T9823] IPVS: sync thread started: state = BACKUP, mcast_ifn = syz_tun, syncid = 0, id = 0 [ 414.293782][ T9829] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1224'. [ 414.470865][ T9840] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.1229'. [ 414.525973][ T5604] Bluetooth: hci3: command 0x0406 tx timeout [ 414.609861][ T9848] binder: BINDER_SET_CONTEXT_MGR already set [ 414.609877][ T9848] binder: 9846:9848 ioctl 4018620d 200000000040 returned -16 [ 414.699875][ T9851] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 414.728353][ T4968] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 414.728647][ T4968] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 414.728805][ T4968] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 414.728817][ T4968] ldm_validate_privheads(): Cannot find PRIVHEAD 3. [ 414.728827][ T4968] ldm_validate_privheads(): Primary and backup PRIVHEADs don't match. [ 414.728868][ T4968] loop0: [ 414.852493][ T9859] netlink: get zone limit has 4 unknown bytes [ 414.907529][ T9861] FAULT_INJECTION: forcing a failure. [ 414.907529][ T9861] name failslab, interval 1, probability 0, space 0, times 0 [ 414.907575][ T9861] CPU: 1 UID: 0 PID: 9861 Comm: syz.3.1239 Tainted: G L syzkaller #0 PREEMPT(full) [ 414.907601][ T9861] Tainted: [L]=SOFTLOCKUP [ 414.907607][ T9861] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 414.907619][ T9861] Call Trace: [ 414.907625][ T9861] [ 414.907631][ T9861] dump_stack_lvl+0x100/0x190 [ 414.907660][ T9861] should_fail_ex.cold+0x5/0xa [ 414.907685][ T9861] should_failslab+0xc2/0x120 [ 414.907710][ T9861] kmem_cache_alloc_noprof+0x92/0x6a0 [ 414.907729][ T9861] ? __asan_memcpy+0x3c/0x60 [ 414.907744][ T9861] ? __kernfs_new_node+0xd2/0xa10 [ 414.907770][ T9861] __kernfs_new_node+0xd2/0xa10 [ 414.907796][ T9861] ? __pfx___kernfs_new_node+0x10/0x10 [ 414.907821][ T9861] ? lock_acquire+0x1d1/0x380 [ 414.907837][ T9861] ? kernfs_root+0x23/0x2a0 [ 414.907858][ T9861] ? find_held_lock+0x2b/0x80 [ 414.907878][ T9861] ? kernfs_root+0xee/0x2a0 [ 414.907898][ T9861] ? kernfs_root+0xee/0x2a0 [ 414.907923][ T9861] kernfs_create_dir_ns+0xa6/0x2b0 [ 414.907951][ T9861] sysfs_create_dir_ns+0x13a/0x2b0 [ 414.907971][ T9861] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 414.907990][ T9861] ? find_held_lock+0x2b/0x80 [ 414.908011][ T9861] ? kobject_add_internal+0x25f/0x930 [ 414.908035][ T9861] ? kobject_add_internal+0x25f/0x930 [ 414.908060][ T9861] ? do_raw_spin_unlock+0x145/0x1e0 [ 414.908081][ T9861] kobject_add_internal+0x2c8/0x930 [ 414.908108][ T9861] kobject_init_and_add+0x121/0x180 [ 414.908134][ T9861] ? __pfx_kobject_init_and_add+0x10/0x10 [ 414.908162][ T9861] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 414.908186][ T9861] ? lockdep_init_map_type+0x5c/0x250 [ 414.908206][ T9861] swnode_register+0x5c9/0x750 [ 414.908239][ T9861] fwnode_create_software_node+0x1c8/0x3f0 [ 414.908267][ T9861] device_create_managed_software_node+0x103/0x270 [ 414.908290][ T9861] iommufd_test+0x3007/0x6600 [ 414.908309][ T9861] ? __lock_acquire+0x5c0/0x1f40 [ 414.908326][ T9861] ? __lock_acquire+0x5c0/0x1f40 [ 414.908343][ T9861] ? __pfx_iommufd_test+0x10/0x10 [ 414.908361][ T9861] ? tomoyo_path_number_perm+0x188/0x580 [ 414.908392][ T9861] ? lock_acquire+0x1d1/0x380 [ 414.908409][ T9861] ? __might_fault+0xc5/0x140 [ 414.908432][ T9861] ? find_held_lock+0x2b/0x80 [ 414.908453][ T9861] ? __might_fault+0xc5/0x140 [ 414.908484][ T9861] iommufd_fops_ioctl+0x358/0x520 [ 414.908504][ T9861] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 414.908522][ T9861] ? __fget_files+0x34/0x3d0 [ 414.908550][ T9861] ? selinux_file_ioctl+0x13b/0x290 [ 414.908566][ T9861] ? selinux_file_ioctl+0xb6/0x290 [ 414.908583][ T9861] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 414.908602][ T9861] __x64_sys_ioctl+0x18e/0x210 [ 414.908620][ T9861] do_syscall_64+0x123/0x790 [ 414.908642][ T9861] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 414.908659][ T9861] RIP: 0033:0x7f977e59e159 [ 414.908673][ T9861] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 414.908688][ T9861] RSP: 002b:00007f977f3cb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 414.908704][ T9861] RAX: ffffffffffffffda RBX: 00007f977e825fa0 RCX: 00007f977e59e159 [ 414.908714][ T9861] RDX: 0000200000000140 RSI: 0000000000003ba0 RDI: 0000000000000006 [ 414.908724][ T9861] RBP: 00007f977e63503b R08: 0000000000000000 R09: 0000000000000000 [ 414.908734][ T9861] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 414.908744][ T9861] R13: 00007f977e826038 R14: 00007f977e825fa0 R15: 00007ffef91f5d68 [ 414.908767][ T9861] [ 414.908797][ T9861] kobject: kobject_add_internal failed for node1 (error: -12 parent: software_nodes) [ 414.908859][ T9861] iommufd_mock iommufd_mock0: add pasid-num-bits property failed, rc: -12 [ 415.393747][ T9872] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1243'. [ 415.426241][ T9872] 8021q: adding VLAN 0 to HW filter on device bond1 [ 415.440122][ T9872] bond1 (unregistering): Released all slaves [ 415.534238][ T9879] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1245'. [ 415.578111][ T9882] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1246'. [ 415.588545][ T9882] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1246'. [ 415.642683][ T9884] blktrace: Concurrent blktraces are not allowed on sg0 [ 415.651746][ T9880] bridge0: port 2(bridge_slave_1) entered disabled state [ 415.651935][ T9880] bridge0: port 1(bridge_slave_0) entered disabled state [ 415.728304][ T5604] Bluetooth: hci1: command 0x0406 tx timeout [ 415.809182][ T9880] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 415.819698][ T9880] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 416.079670][ T13] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 416.080157][ T5911] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 416.080193][ T5911] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 416.080219][ T5911] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 416.340550][ T4968] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 416.346298][ T4968] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 416.347345][ T4968] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 416.347380][ T4968] ldm_validate_privheads(): Cannot find PRIVHEAD 3. [ 416.347392][ T4968] ldm_validate_privheads(): Primary and backup PRIVHEADs don't match. [ 416.347436][ T4968] loop0: [ 416.606031][ T5604] Bluetooth: hci3: command 0x0406 tx timeout [ 416.672624][ T9904] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1256'. [ 417.179862][ T5604] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 417.179982][ T5604] Bluetooth: hci4: Injecting HCI hardware error event [ 417.181607][ T5598] Bluetooth: hci4: hardware error 0x00 [ 417.237231][ T9920] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 417.341900][ T9920] md: could not open device unknown-block(1,0). [ 417.535199][ T9945] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1274'. [ 417.557463][ T9945] 8021q: adding VLAN 0 to HW filter on device bond1 [ 417.572532][ T9945] bond1 (unregistering): Released all slaves [ 417.804877][ T9960] binder: 9959:9960 ioctl c0306201 200000000180 returned -22 [ 417.873041][ T9962] syzkaller0: entered promiscuous mode [ 417.880992][ T9962] syzkaller0: entered allmulticast mode [ 419.248629][ T5598] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 420.603974][ T9948] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 420.759222][ T9972] i2c i2c-0: Failed to register i2c client usb3503 at 0x08 (-16) [ 421.126459][ T9978] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1284'. [ 421.251138][ T9984] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 421.259908][ T9986] netlink: 'syz.1.1285': attribute type 10 has an invalid length. [ 421.269400][ T9986] syz_tun: entered promiscuous mode [ 421.285304][ T9986] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 421.471033][ T9991] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 421.508933][ T9991] md: could not open device unknown-block(1,0). [ 421.561400][ T9997] nvme_fabrics: missing parameter 'nqn=%s' [ 421.900202][ T31] audit: type=1400 audit(1788959334.778:1105): avc: denied { read } for pid=10023 comm="syz.3.1303" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 421.955853][ T31] audit: type=1400 audit(1788959334.828:1106): avc: denied { write } for pid=10023 comm="syz.3.1303" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 422.001349][T10026] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 422.106180][T10026] md: could not open device unknown-block(1,0). [ 422.312585][T10042] syzkaller0: entered promiscuous mode [ 422.312626][T10042] syzkaller0: entered allmulticast mode [ 422.537660][T10051] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1313'. [ 422.546388][T10051] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1313'. [ 422.556289][ T5911] IPVS: starting estimator thread 0... [ 422.649512][T10052] IPVS: using max 55 ests per chain, 132000 per kthread [ 422.834047][T10058] openvswitch: netlink: Flow key attribute not present in set flow. [ 422.845029][T10058] openvswitch: netlink: Flow key attribute not present in set flow. [ 423.122848][T10060] random: crng reseeded on system resumption [ 423.456429][ T4968] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 423.468530][ T4968] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 423.476711][ T4968] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 423.476728][ T4968] ldm_validate_privheads(): Cannot find PRIVHEAD 3. [ 423.476740][ T4968] ldm_validate_privheads(): Primary and backup PRIVHEADs don't match. [ 423.476786][ T4968] loop0: [ 423.531171][T10074] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 423.559212][T10074] md: could not open device unknown-block(1,0). [ 423.800761][T10085] syzkaller0: entered promiscuous mode [ 423.800806][T10085] syzkaller0: entered allmulticast mode [ 423.804574][T10086] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1324'. [ 423.805860][T10086] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1324'. [ 423.884475][T10091] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1329'. [ 423.968251][T10094] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 424.043708][T10094] md: could not open device unknown-block(1,0). [ 424.650372][ T4968] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 424.660458][ T4968] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 424.670380][ T4968] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 424.670397][ T4968] ldm_validate_privheads(): Cannot find PRIVHEAD 3. [ 424.670409][ T4968] ldm_validate_privheads(): Primary and backup PRIVHEADs don't match. [ 424.670460][ T4968] loop0: [ 424.974968][T10115] openvswitch: netlink: Flow key attribute not present in set flow. [ 424.992264][T10115] openvswitch: netlink: Flow key attribute not present in set flow. [ 425.173608][T10127] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1340'. [ 425.197734][T10127] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1340'. [ 426.131182][T10119] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 426.131391][T10119] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 426.663873][T10155] dvmrp0: entered allmulticast mode [ 426.675649][ T31] audit: type=1400 audit(1788959339.558:1107): avc: denied { listen } for pid=10154 comm="syz.4.1347" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 426.676940][T10155] netlink: 'syz.4.1347': attribute type 2 has an invalid length. [ 426.733867][ T31] audit: type=1400 audit(1788959339.608:1108): avc: denied { accept } for pid=10154 comm="syz.4.1347" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 426.783741][T10162] kAFS: No cell specified [ 426.841261][T10167] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1351'. [ 426.842443][T10167] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1351'. [ 426.880039][T10169] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1352'. [ 427.096109][ T5598] Bluetooth: hci1: command 0x0406 tx timeout [ 427.433845][T10185] syzkaller0: entered promiscuous mode [ 427.433880][T10185] syzkaller0: entered allmulticast mode [ 427.439035][T10185] tipc: Enabled bearer , priority 0 [ 427.457159][T10184] tipc: Resetting bearer [ 427.477379][T10184] tipc: Disabling bearer [ 427.680038][T10191] netlink: 'syz.0.1360': attribute type 10 has an invalid length. [ 427.769551][T10197] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 427.829884][T ** replaying previous printk message ** [ 427.829884][T10197] ------------[ cut here ]------------ [ 427.829918][T10197] UBSAN: array-index-out-of-bounds in drivers/md/md.c:1697:17 [ 427.829936][T10197] index 124 is out of range for type 'mdp_disk_t [27]' [ 427.829952][T10197] CPU: 1 UID: 0 PID: 10197 Comm: syz.3.1362 Tainted: G L syzkaller #0 PREEMPT(full) [ 427.829976][T10197] Tainted: [L]=SOFTLOCKUP [ 427.829982][T10197] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 427.829993][T10197] Call Trace: [ 427.829999][T10197] [ 427.830006][T10197] dump_stack_lvl+0x100/0x190 [ 427.830034][T10197] ubsan_epilogue+0xa/0x30 [ 427.830056][T10197] __ubsan_handle_out_of_bounds+0xcc/0xf0 [ 427.830084][T10197] super_90_sync+0x1eed/0x1ff0 [ 427.830118][T10197] md_update_sb+0xbba/0x2840 [ 427.830149][T10197] ? __pfx_md_update_sb+0x10/0x10 [ 427.830173][T10197] ? __pfx_mddev_suspend+0x10/0x10 [ 427.830193][T10197] ? mddev_create_serial_pool+0x223/0x6e0 [ 427.830218][T10197] state_store+0x31e/0x1340 [ 427.830242][T10197] rdev_attr_store+0x465/0x560 [ 427.830262][T10197] ? __pfx_rdev_attr_store+0x10/0x10 [ 427.830280][T10197] sysfs_kf_write+0xf2/0x150 [ 427.830303][T10197] kernfs_fop_write_iter+0x3e0/0x5f0 [ 427.830320][T10197] ? __pfx_sysfs_kf_write+0x10/0x10 [ 427.830342][T10197] vfs_write+0x6af/0x1050 [ 427.830360][T10197] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 427.830379][T10197] ? __pfx_vfs_write+0x10/0x10 [ 427.830393][T10197] ? find_held_lock+0x2b/0x80 [ 427.830431][T10197] ksys_write+0x12a/0x250 [ 427.830447][T10197] ? __pfx_ksys_write+0x10/0x10 [ 427.830470][T10197] do_syscall_64+0x123/0x790 [ 427.830493][T10197] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 427.830510][T10197] RIP: 0033:0x7f977e59e159 [ 427.830525][T10197] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 427.830542][T10197] RSP: 002b:00007f977f3cb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 427.830558][T10197] RAX: ffffffffffffffda RBX: 00007f977e825fa0 RCX: 00007f977e59e159 [ 427.830569][T10197] RDX: 000000000000000b RSI: 0000200000000a00 RDI: 0000000000000006 [ 427.830579][T10197] RBP: 00007f977e63503b R08: 0000000000000000 R09: 0000000000000000 [ 427.830589][T10197] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 427.830599][T10197] R13: 00007f977e826038 R14: 00007f977e825fa0 R15: 00007ffef91f5d68 [ 427.830624][T10197] [ 427.830631][T10197] ---[ end trace ]--- [ 427.830639][T10197] Kernel panic - not syncing: UBSAN: panic_on_warn set ... [ 428.080642][T10197] CPU: 1 UID: 0 PID: 10197 Comm: syz.3.1362 Tainted: G L syzkaller #0 PREEMPT(full) [ 428.091568][T10197] Tainted: [L]=SOFTLOCKUP [ 428.095861][T10197] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 428.105899][T10197] Call Trace: [ 428.109155][T10197] [ 428.112062][T10197] dump_stack_lvl+0x100/0x190 [ 428.116732][T10197] vpanic+0x553/0x970 [ 428.120693][T10197] ? __pfx_vpanic+0x10/0x10 [ 428.125182][T10197] panic+0xd1/0xe0 [ 428.128877][T10197] ? __pfx_panic+0x10/0x10 [ 428.133270][T10197] ? mark_held_locks+0x40/0x70 [ 428.138014][T10197] check_panic_on_warn.cold+0x19/0x34 [ 428.143369][T10197] __ubsan_handle_out_of_bounds+0xcc/0xf0 [ 428.149098][T10197] super_90_sync+0x1eed/0x1ff0 [ 428.153859][T10197] md_update_sb+0xbba/0x2840 [ 428.158443][T10197] ? __pfx_md_update_sb+0x10/0x10 [ 428.163455][T10197] ? __pfx_mddev_suspend+0x10/0x10 [ 428.168562][T10197] ? mddev_create_serial_pool+0x223/0x6e0 [ 428.174264][T10197] state_store+0x31e/0x1340 [ 428.178751][T10197] rdev_attr_store+0x465/0x560 [ 428.183492][T10197] ? __pfx_rdev_attr_store+0x10/0x10 [ 428.188754][T10197] sysfs_kf_write+0xf2/0x150 [ 428.193322][T10197] kernfs_fop_write_iter+0x3e0/0x5f0 [ 428.198581][T10197] ? __pfx_sysfs_kf_write+0x10/0x10 [ 428.203764][T10197] vfs_write+0x6af/0x1050 [ 428.208079][T10197] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 428.213858][T10197] ? __pfx_vfs_write+0x10/0x10 [ 428.218591][T10197] ? find_held_lock+0x2b/0x80 [ 428.223258][T10197] ksys_write+0x12a/0x250 [ 428.227563][T10197] ? __pfx_ksys_write+0x10/0x10 [ 428.232401][T10197] do_syscall_64+0x123/0x790 [ 428.236991][T10197] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 428.242867][T10197] RIP: 0033:0x7f977e59e159 [ 428.247256][T10197] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 428.266848][T10197] RSP: 002b:00007f977f3cb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 428.275235][T10197] RAX: ffffffffffffffda RBX: 00007f977e825fa0 RCX: 00007f977e59e159 [ 428.283197][T10197] RDX: 000000000000000b RSI: 0000200000000a00 RDI: 0000000000000006 [ 428.291145][T10197] RBP: 00007f977e63503b R08: 0000000000000000 R09: 0000000000000000 [ 428.299092][T10197] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 428.307041][T10197] R13: 00007f977e826038 R14: 00007f977e825fa0 R15: 00007ffef91f5d68 [ 428.315005][T10197] [ 428.318212][T10197] Kernel Offset: disabled [ 428.322512][T10197] Rebooting in 86400 seconds..