last executing test programs: 1m15.081695637s ago: executing program 4 (id=70): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x6, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) poll(0x0, 0x0, 0x4) r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSWINSZ(r0, 0x5414, &(0x7f0000000040)={0x9, 0x2, 0x1000, 0x5}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x40000, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x88282, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) munlockall() r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e24, @multicast1}, 0x10) r3 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000580)="89000000120081ae08060cdc030000fe7f03446b000000000001ffca1bdcfdd9fb0024c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00150c00014003080c00bdad446b31007a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947e", 0x75}, {&(0x7f0000000600)="11d6cb557c849601b143d4f4f2fe4b15f1b62db6", 0x14}], 0x2}, 0x4000000) (fail_nth: 4) 1m15.027671077s ago: executing program 3 (id=71): r0 = fsopen(&(0x7f0000000100)='9p\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f00000001c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000240)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0) read$msr(r4, &(0x7f00000002c0)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x47, &(0x7f00000192c0)=0x7) write$P9_RVERSION(0xffffffffffffffff, 0x0, 0x15) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$OBJ_GET_PROG(0x7, &(0x7f0000019400)=@generic={&(0x7f00000193c0)='./file0\x00'}, 0x18) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r5, &(0x7f0000019300)={0x0, 0x0, &(0x7f0000019340)={&(0x7f0000019380)=ANY=[@ANYBLOB="580000000008010200000000000000000200ffff0600024022eb000005000300ffff00000900010073797a3000000000260004"], 0x58}, 0x1, 0x0, 0x0, 0x20000015}, 0x20008000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'veth0_macvtap\x00', 0x0}) r7 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r6, {0x0, 0x8}, {0xffff, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4, 0x1e}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x10) syz_usb_connect(0x0, 0x24, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000bd02c440560831ac1e93010203010902120081000000000904"], 0x0) 1m13.367362564s ago: executing program 4 (id=72): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000080)=0x5) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000000180)) rseq(0x0, 0x0, 0x0, 0x0) timer_getoverrun(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) set_mempolicy(0x1, 0x0, 0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r2, &(0x7f0000000b40)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x8, &(0x7f0000019b40)=0x4000007) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, 0x0, 0x0) r4 = socket(0x2b, 0x80801, 0x1) connect$inet6(r4, &(0x7f0000000140)={0xa, 0x4e23, 0x1, @ipv4={'\x00', '\xff\xff', @empty}, 0xfffffffe}, 0x1c) shutdown(r4, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x19, 0x0, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000b00)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000340)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r5, &(0x7f0000000380)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0xe, @empty, 0x2}, {0xa, 0x4e23, 0x7, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x3}, r6, 0x8}}, 0x48) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r5, 0x0, 0x0) 1m11.076626726s ago: executing program 4 (id=76): r0 = memfd_create(&(0x7f00000000c0)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x9a\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00\x81Ks\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x14\xb1`\x87#X\\W`;\'_4\xc5\xc9\x921<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\x02\x00\x00\x00\x8aeh;F[\xe2\x1c\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\x9a{C|S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ', 0x6) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x8010000}) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x2000003, 0x97052, r0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x1607c0, 0x78e22799f4a46ffe) r2 = syz_open_dev$radio(&(0x7f0000000540), 0x2, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r2, 0x40305652, &(0x7f0000000580)={0x0, 0x1, 0xe98, 0x0, 0xfffffffd}) (async) ioctl$VIDIOC_S_HW_FREQ_SEEK(r2, 0x40305652, &(0x7f0000000580)={0x0, 0x1, 0xe98, 0x0, 0xfffffffd}) r3 = open(&(0x7f0000000040)='./file0\x00', 0x108843, 0x98) fcntl$setlease(r3, 0x400, 0x0) fcntl$setlease(r1, 0x400, 0x1) (async) fcntl$setlease(r1, 0x400, 0x1) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) (async) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) 1m10.705737152s ago: executing program 4 (id=77): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./file0\x00', 0x0) mount$bind(&(0x7f0000000700)='.\x00', &(0x7f0000000740)='./file0/../file0\x00', 0x0, 0x101091, 0x0) chroot(&(0x7f0000000780)='./file0/../file0\x00') mount$bind(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f0000000880)='./file0/../file0\x00', &(0x7f00000008c0)='./file0\x00') mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x44, 0x6, 0x3c8, 0x168, 0x168, 0x0, 0x200, 0x168, 0x370, 0x370, 0x370, 0x370, 0x370, 0x6, 0x0, {[{{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x13}, 0xff, 0xff000000, 'pim6reg1\x00', 'bridge_slave_0\x00', {}, {0xff}, 0x88, 0x3}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x3, 0x3}}}, {{@ip={@private=0xa010100, @local, 0x0, 0x0, 'vcan0\x00', 'veth0_virt_wifi\x00', {}, {0xff}}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x0, 0x1], 0x1}, {0x0, [0x0, 0x0, 0x0, 0x2, 0x4]}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0xff, 0xff, 'bond_slave_0\x00', 'veth1_virt_wifi\x00', {}, {0xff}, 0x5c, 0x2}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@private=0xa010102, @multicast1, 0x0, 0xffffff00, 'syzkaller0\x00', 'bond0\x00', {}, {}, 0x0, 0x0, 0x13}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@remote, @loopback, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0x98}, @ECN={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x428) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f0000000580)=0x7) lsetxattr$security_selinux(&(0x7f0000000440)='.\x00', &(0x7f0000000480), &(0x7f0000000500)='system_u:object_r:hwdata_t:s0\x00', 0xffd7, 0x1) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x519c02, 0x0) ioctl$FS_IOC_RESVSP(r2, 0x40305828, &(0x7f0000000040)={0x82, 0x1, 0x6, 0xfffffffffffffffe}) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000000640)={r0, &(0x7f0000000540)='bond0\x00', 0x8200, &(0x7f00000005c0)={@_ha_fsid={[0x5, 0x9]}, {0x8, 0x8000, 0x8, 0x2}}, 0x0, &(0x7f0000000680)={@_ha_fsid}, &(0x7f0000000600)=0x80}) write(r2, &(0x7f0000001640)="8b", 0x11) 1m7.725925546s ago: executing program 3 (id=78): bpf$OBJ_GET_PROG(0x7, &(0x7f0000019400)=@generic={&(0x7f00000193c0)='./file0\x00'}, 0x18) 1m7.574344988s ago: executing program 4 (id=79): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f0000000380)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0xffffffffffffffff}}}], 0x20, 0x8811}}], 0x2, 0x40044) sendmmsg$inet6(r0, &(0x7f0000000000)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20004855) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sec/tomoyo/profile\x00', 0x81, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000480), 0x4) write(r2, &(0x7f00000002c0)='0-CONFIG=disabled\n', 0x12) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000300)=0x6) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000500)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000540)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f00000005c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000640), 0x651, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1c0) mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x1, 0x36, &(0x7f0000000140)={{0x12, 0x1, 0x310, 0xa, 0x43, 0x8, 0x8, 0x6737, 0x1, 0x9180, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x8e, 0x5, 0x10, 0x7, "", [{{0x9, 0x4, 0xfb, 0xb, 0x2, 0x82, 0xd2, 0xd2, 0x0, [], [{{0x9, 0x5, 0x9f, 0x2, 0x40, 0x7, 0x0, 0x7}}, {{0x9, 0x5, 0x1, 0x2, 0x40, 0x7, 0x5, 0x8}}]}}]}}]}}, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) recvmmsg(r4, &(0x7f0000000680), 0x1011f, 0x2, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f00000006c0)={0xa, 0x4e22}, 0x1c) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4b, &(0x7f0000000700)=0x8fa7, 0x4) listen(0xffffffffffffffff, 0x10040) syz_emit_ethernet(0x36, &(0x7f0000000740)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x67, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010001, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2, 0x5, 0x0, 0x6}}}}}}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000780)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) fsopen(&(0x7f00000007c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) 1m5.541786772s ago: executing program 4 (id=83): mount(&(0x7f0000000000)=@nullb, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000100)='affs\x00', 0x200000, 0x0) (async) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x2a, &(0x7f0000000080)=[{&(0x7f0000000380)="5c00000014006b03c84e21008bf32c19021800f80200000044000200ac14140e05251e6182949a36c23d3b48dfd8cdbf9367b498fa51f60a64c9f4d4938037e786a6d0bdd77f6f60c1504bb9189d9193e9bd1c1b7800000000000000", 0xa0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) 1m4.994710712s ago: executing program 32 (id=83): mount(&(0x7f0000000000)=@nullb, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000100)='affs\x00', 0x200000, 0x0) (async) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x2a, &(0x7f0000000080)=[{&(0x7f0000000380)="5c00000014006b03c84e21008bf32c19021800f80200000044000200ac14140e05251e6182949a36c23d3b48dfd8cdbf9367b498fa51f60a64c9f4d4938037e786a6d0bdd77f6f60c1504bb9189d9193e9bd1c1b7800000000000000", 0xa0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) 1m4.968684323s ago: executing program 3 (id=85): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000080)=0x5) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000000180)) rseq(0x0, 0x0, 0x0, 0x0) timer_getoverrun(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) set_mempolicy(0x1, 0x0, 0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r2, &(0x7f0000000b40)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x8, &(0x7f0000019b40)=0x4000007) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, 0x0, 0x0) r4 = socket(0x2b, 0x80801, 0x1) connect$inet6(r4, &(0x7f0000000140)={0xa, 0x4e23, 0x1, @ipv4={'\x00', '\xff\xff', @empty}, 0xfffffffe}, 0x1c) shutdown(r4, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x19, 0x0, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000b00)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000340)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r5, &(0x7f0000000380)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0xe, @empty, 0x2}, {0xa, 0x4e23, 0x7, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x3}, r6, 0x8}}, 0x48) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r5, 0x0, 0x0) 1m1.743238907s ago: executing program 3 (id=89): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./file0\x00', 0x0) mount$bind(&(0x7f0000000700)='.\x00', &(0x7f0000000740)='./file0/../file0\x00', 0x0, 0x101091, 0x0) chroot(&(0x7f0000000780)='./file0/../file0\x00') mount$bind(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f0000000880)='./file0/../file0\x00', &(0x7f00000008c0)='./file0\x00') mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x44, 0x6, 0x3c8, 0x168, 0x168, 0x0, 0x200, 0x168, 0x370, 0x370, 0x370, 0x370, 0x370, 0x6, 0x0, {[{{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x13}, 0xff, 0xff000000, 'pim6reg1\x00', 'bridge_slave_0\x00', {}, {0xff}, 0x88, 0x3}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x3, 0x3}}}, {{@ip={@private=0xa010100, @local, 0x0, 0x0, 'vcan0\x00', 'veth0_virt_wifi\x00', {}, {0xff}}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x0, 0x1], 0x1}, {0x0, [0x0, 0x0, 0x0, 0x2, 0x4]}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0xff, 0xff, 'bond_slave_0\x00', 'veth1_virt_wifi\x00', {}, {0xff}, 0x5c, 0x2}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@private=0xa010102, @multicast1, 0x0, 0xffffff00, 'syzkaller0\x00', 'bond0\x00', {}, {}, 0x0, 0x0, 0x13}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@remote, @loopback, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0x98}, @ECN={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x428) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f0000000580)=0x7) lsetxattr$security_selinux(&(0x7f0000000440)='.\x00', &(0x7f0000000480), &(0x7f0000000500)='system_u:object_r:hwdata_t:s0\x00', 0xffd7, 0x1) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x519c02, 0x0) ioctl$FS_IOC_RESVSP(r2, 0x40305828, &(0x7f0000000040)={0x82, 0x1, 0x6, 0xfffffffffffffffe}) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000000640)={r0, &(0x7f0000000540)='bond0\x00', 0x8200, &(0x7f00000005c0)={@_ha_fsid={[0x5, 0x9]}, {0x8, 0x8000, 0x8, 0x2}}, 0x0, &(0x7f0000000680)={@_ha_fsid}, &(0x7f0000000600)=0x80}) write(r2, &(0x7f0000001640)="8b", 0x11) 1m0.281810853s ago: executing program 3 (id=91): r0 = fsopen(&(0x7f0000000100)='9p\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f00000001c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000240)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0) read$msr(r4, &(0x7f00000002c0)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x47, &(0x7f00000192c0)=0x7) write$P9_RVERSION(0xffffffffffffffff, 0x0, 0x15) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$OBJ_GET_PROG(0x7, &(0x7f0000019400)=@generic={&(0x7f00000193c0)='./file0\x00'}, 0x18) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'veth0_macvtap\x00', 0x0}) r7 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r6, {0x0, 0x8}, {0xffff, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4, 0x1e}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x10) syz_usb_connect(0x0, 0x24, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000bd02c440560831ac1e93010203010902120081000000000904"], 0x0) 57.281560552s ago: executing program 3 (id=94): bpf$OBJ_GET_PROG(0x7, &(0x7f0000019400)=@generic={&(0x7f00000193c0)='./file0\x00'}, 0x18) 57.089367416s ago: executing program 33 (id=94): bpf$OBJ_GET_PROG(0x7, &(0x7f0000019400)=@generic={&(0x7f00000193c0)='./file0\x00'}, 0x18) 26.266810029s ago: executing program 0 (id=131): r0 = msgget(0x0, 0x4a) r1 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x20842, 0x4) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000400)={0x0, 0x1846, 0x4000, 0x802, 0x2b1, 0x0, r1}, &(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000000500)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r2) socket$alg(0x26, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000540)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000580)=0x8) r3 = getpgrp(0x0) sched_setaffinity(r3, 0x8, &(0x7f00000005c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000600)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r5 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f0000000640), 0x0, 0x0) read$msr(r6, &(0x7f0000001900)=""/102392, 0x18ff8) sched_setaffinity(r5, 0x8, &(0x7f000001a900)=0x80000000000003) msgctl$MSG_INFO(r0, 0xc, &(0x7f00000001c0)=""/81) fanotify_init(0x200, 0x0) mount(&(0x7f0000000240)=@nullb, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='btrfs\x00', 0x0, &(0x7f0000000300)='discard') io_uring_setup(0x9ab, &(0x7f0000000340)={0x0, 0x4ace, 0x4000, 0x2, 0x282}) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000140)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1}) io_uring_enter(0xffffffffffffffff, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) 25.00357388s ago: executing program 0 (id=132): bind$inet(0xffffffffffffffff, 0x0, 0x0) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(0xffffffffffffffff, 0x13, 0x0, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000001680), 0x181a01, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000001980)={0x1, &(0x7f00000019c0)=[{0x6, 0xf}]}) close_range(r0, 0xffffffffffffffff, 0x0) 20.703570401s ago: executing program 6 (id=138): r0 = socket$inet6(0xa, 0x2, 0x0) syz_emit_ethernet(0x1f, &(0x7f00000000c0)={@local, @empty, @void, {@llc_tr={0x11, {@llc={0x42, 0x42, "03", "6c404000000062cf004ab77f8437"}}}}}, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @empty}, 0x1c) prlimit64(0x0, 0xe, &(0x7f0000000300)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000340)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000380)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000003c0), 0x0, 0x0) read$msr(r3, &(0x7f0000000400)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f0000019400)=0x7) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000019440), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f0000019480)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000194c0), 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="12000000050000000800000008"], 0x48) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r5 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)={0x24, 0x1402, 0x1, 0x70bd2a, 0x25dfdc02, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz2\x00'}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000801}, 0x40810) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) pselect6(0x40, &(0x7f00000001c0)={0x8, 0x80, 0x401, 0x6, 0x6, 0x5, 0x401}, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, &(0x7f0000000280)={0x3, &(0x7f00000002c0)=[{0x40, 0x9, 0xfe, 0x6a66}, {0x30, 0x1, 0x1, 0xfffff034}, {0x6, 0x15, 0x0, 0xb}]}, 0x10) write$binfmt_aout(r6, &(0x7f0000000300)=ANY=[], 0x33fe0) syz_usb_connect(0x0, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000092df5510ac05269289b201020301090222000100000000090400000103e900000905a1e7", @ANYRESDEC], 0x0) 20.506131431s ago: executing program 0 (id=139): r0 = msgget(0x0, 0x4a) r1 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x20842, 0x4) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000400)={0x0, 0x1846, 0x4000, 0x802, 0x2b1, 0x0, r1}, &(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000000500)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r2) socket$alg(0x26, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000540)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000580)=0x8) r3 = getpgrp(0x0) sched_setaffinity(r3, 0x8, &(0x7f00000005c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000600)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r5 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f0000000640), 0x0, 0x0) read$msr(r6, &(0x7f0000001900)=""/102392, 0x18ff8) openat$vimc0(0xffffffffffffff9c, &(0x7f000001a940), 0x2, 0x0) msgctl$MSG_INFO(r0, 0xc, &(0x7f00000001c0)=""/81) fanotify_init(0x200, 0x0) mount(&(0x7f0000000240)=@nullb, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='btrfs\x00', 0x0, &(0x7f0000000300)='discard') io_uring_setup(0x9ab, &(0x7f0000000340)={0x0, 0x4ace, 0x4000, 0x2, 0x282}) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000140)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1}) io_uring_enter(0xffffffffffffffff, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) 18.734712743s ago: executing program 0 (id=140): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./file0\x00', 0x0) mount$bind(&(0x7f0000000700)='.\x00', &(0x7f0000000740)='./file0/../file0\x00', 0x0, 0x101091, 0x0) chroot(&(0x7f0000000780)='./file0/../file0\x00') mount$bind(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f0000000880)='./file0/../file0\x00', &(0x7f00000008c0)='./file0\x00') mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x44, 0x6, 0x3c8, 0x168, 0x168, 0x0, 0x200, 0x168, 0x370, 0x370, 0x370, 0x370, 0x370, 0x6, 0x0, {[{{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x13}, 0xff, 0xff000000, 'pim6reg1\x00', 'bridge_slave_0\x00', {}, {0xff}, 0x88, 0x3}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x3, 0x3}}}, {{@ip={@private=0xa010100, @local, 0x0, 0x0, 'vcan0\x00', 'veth0_virt_wifi\x00', {}, {0xff}}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x0, 0x1], 0x1}, {0x0, [0x0, 0x0, 0x0, 0x2, 0x4]}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0xff, 0xff, 'bond_slave_0\x00', 'veth1_virt_wifi\x00', {}, {0xff}, 0x5c, 0x2}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@private=0xa010102, @multicast1, 0x0, 0xffffff00, 'syzkaller0\x00', 'bond0\x00', {}, {}, 0x0, 0x0, 0x13}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@remote, @loopback, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0x98}, @ECN={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x428) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f0000000580)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x519c02, 0x0) ioctl$FS_IOC_RESVSP(r2, 0x40305828, &(0x7f0000000040)={0x82, 0x1, 0x6, 0xfffffffffffffffe}) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000000640)={r0, &(0x7f0000000540)='bond0\x00', 0x8200, &(0x7f00000005c0)={@_ha_fsid={[0x5, 0x9]}, {0x8, 0x8000, 0x8, 0x2}}, 0x0, &(0x7f0000000680)={@_ha_fsid}, &(0x7f0000000600)=0x80}) write(r2, &(0x7f0000001640)="8b", 0x11) 17.095801759s ago: executing program 6 (id=142): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x401, 0x200200) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(0xffffffffffffffff, 0xc0106441, &(0x7f0000000040)={0x0, 0x0, 0x4}) ioctl$DRM_IOCTL_PANTHOR_VM_DESTROY(r0, 0xc0086442, &(0x7f0000000080)={r1}) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_WANTACK(r2, 0x0, 0x0, &(0x7f00000000c0), 0x4) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01864c2, &(0x7f0000000100)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r0, 0xc01864cb, &(0x7f00000001c0)={&(0x7f0000000140)=[0x0, r3], &(0x7f0000000180)=[0x833a, 0x2], 0x2, 0x1}) r4 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) copy_file_range(r2, &(0x7f0000000200)=0x54a, r4, &(0x7f0000000280)=0x8, 0x8, 0x0) ioctl$DRM_IOCTL_AGP_RELEASE(r0, 0x6431) getsockopt$inet6_tcp_int(r4, 0x6, 0x24, &(0x7f00000002c0), &(0x7f0000000300)=0x4) sendmsg$IPSET_CMD_DEL(r4, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, 0xa, 0x6, 0x207, 0x0, 0x0, {0x7, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x200408c4}, 0x4004010) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ORIGINATORS(r5, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x38, r6, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x24}}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x20000000}]}, 0x38}, 0x1, 0x0, 0x0, 0x44}, 0xc0) r7 = openat$khugepaged_scan(0xffffffffffffff9c, &(0x7f0000000580), 0x1, 0x0) fcntl$addseals(r7, 0x409, 0x6) r8 = fcntl$dupfd(r4, 0x0, r2) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000640), r4) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r8, &(0x7f0000000700)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x65208000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x28, r9, 0x200, 0x70bd27, 0x25dfdbff, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) r10 = io_uring_setup(0x4450, &(0x7f0000000740)={0x0, 0x9424, 0x200, 0x3, 0x24, 0x0, r4}) mount(&(0x7f00000007c0)=@nullb, &(0x7f0000000800)='./file0\x00', &(0x7f0000000840)='esdfs\x00', 0x28414, &(0x7f0000000880)=',j]}--]\'\\}{$+\x00') sendmsg$NFT_BATCH(r4, &(0x7f0000001340)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000001300)={&(0x7f0000000900)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_DELOBJ={0x198, 0x14, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x3}, @NFTA_OBJ_USERDATA={0x9d, 0x8, "3f508600e9d9b538f8f555fe1b09dd6da5e487280213cca87bf262fb252344d2c1f64e334948e687f618eb11ada6ac0f226f202f174caa82d49eb135e4dbc976af8121188dcd7eb1133f4656cc7b50198bdc30914214bdcd1bde50c9cef468c81c8935558a3f9fda37b9bf1b51ddfea56a9d95a697c2996560465d5fee77b1690caed70caf3960c5e28504655ce807ac345107af89ca623ddd"}, @NFTA_OBJ_USERDATA={0x99, 0x8, "768f2d06fca37d9bd7a6d9faae546bf21a504c0384708f8bb211d531cb07e1d9ab8de4d6d0a1f143e5aa7e271dd6abcf018b1745599708c109d39bd8d379eebcdc8066e87f706ebcfde296fbfa43a67423c8003b6bf556ef6bac9a81174cdb8a543525a838f6eaa67857877c141798a5c4ebc72ee177140fcf957fdd60e9c96ed0356e006728fa9597c3759390c08565614d3752af"}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}]}, @NFT_MSG_DELSET={0x190, 0xb, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x3}, [@NFTA_SET_USERDATA={0x4a, 0xd, 0x1, 0x0, "0d6babf4cf7a22115ea42e260030e3a7074a9f59a2da68cd25bb3c3d5828416a00ba65abcd1e6c152e50385215aa0fdb0a58fcade2fd172e37317fdb1f0e9915792a316ca310"}, @NFTA_SET_EXPRESSIONS={0x128, 0x12, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @fib={{0x8}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0x13}, @NFTA_FIB_RESULT={0x8}]}}}, {0x14, 0x1, 0x0, 0x1, @immediate={{0xe}, @void}}, {0x1c, 0x1, 0x0, 0x1, @numgen={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_NG_OFFSET={0x8, 0x4, 0x1, 0x0, 0x7}]}}}, {0x20, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0xa}]}}}, {0x10, 0x1, 0x0, 0x1, @dynset={{0xb}, @void}}, {0x10, 0x1, 0x0, 0x1, @range={{0xa}, @void}}, {0x88, 0x1, 0x0, 0x1, @flow_offload={{0x11}, @val={0x70, 0x2, 0x0, 0x1, [@NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz2\x00'}, @NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz2\x00'}, @NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}}}, {0xc, 0x1, 0x0, 0x1, @cmp={{0x8}, @void}}]}, @NFTA_SET_DATA_TYPE={0x8}]}, @NFT_MSG_DELTABLE={0x2b8, 0x2, 0xa, 0xb07, 0x0, 0x0, {0x0, 0x0, 0x6}, [@NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x3}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x4}, @NFTA_TABLE_USERDATA={0x51, 0x6, "78c26f8c607295e1ee4873063a55c2906f94105bbff4f6b6afad9cc0a867ad647af6884f9580fda5d4d557883aae07ec47b5709f9ffa2469269bb3c0588a58432cd35ee8626649c0faca1bc4c0"}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x1}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x4}, @NFTA_TABLE_USERDATA={0xfb, 0x6, "72fe88c0b1eec1bc4dc7a28fa7792b11bb10d43b23a2c975865f116989eadbc9831768aeaa45923061a744cadfc676f650a1c46a8d88555e4a5d242495dbdd1f37b0ca76828d78fd61990f1145bf39d9a0a7d5f6e2f46e527b3bba66539be0de53d44d6e4f39f6b7b62b3e46e746b395e48884110135e9dd21dea00444732e76101e067e2e7d5b52cd9eb1f1743bd837beb1a33742808d6e94f8e882728139f2e580eb05a1bce21f2c1b0d84f41b3349fdde807b30340ed7ef07c162cd583199629e7ee5b950ba7fe4339292aab4ce45cd9ed6d07aff883434c83983bbc5e63de4b7f2682500f1eb47a36b73d2b2b6b1138f5d80a3ad1f"}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_TABLE_USERDATA={0x103, 0x6, "1e605820b6430316430f40f147b4123d60b7157c2b6b7625442e3e34c3d3fc6956a8408ddb29b1f6e6d7460a62f38aa4d99822e639bc94f3987b40ca7e4734aeb1deb982d4c61eb72a52680b9eaead5adebe2f5e73020dc9eca81221365b24bbd1a6444b7f5845a2129a971c2d8cc40e2226e19c11b3dbf14567241451ab5608cf47e2949365fc4c5fd084a7fe77376b19a3d1c868750fcfacde671b5215eb7ceee373742477e500ef8d570be563dc6c90c2f670fb48a97e682dbba5b04817f9b7341e15ab5e7bc3d0a512d3e7779d9170895897941fad43bd831cf235104b8fc5ed338856c94529874a134965f281f92d044146c70cd2835336525abb9752"}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x5}]}, @NFT_MSG_NEWSET={0x58, 0x9, 0xa, 0x101, 0x0, 0x0, {0x3, 0x0, 0x5}, [@NFTA_SET_POLICY={0x8}, @NFTA_SET_TIMEOUT={0xc, 0xb, 0x1, 0x0, 0x8}, @NFTA_SET_USERDATA={0x8, 0xd, 0x1, 0x0, "da4cf32e"}, @NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}, @NFTA_SET_EXPRESSIONS={0x20, 0x12, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, @dup={{0x8}, @void}}, {0x10, 0x1, 0x0, 0x1, @inner={{0xa}, @void}}]}]}, @NFT_MSG_NEWFLOWTABLE={0x148, 0x16, 0xa, 0x201, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_FLAGS={0x8}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x2}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0xd8, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x7c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'batadv0\x00'}, {0x14, 0x1, 'sit0\x00'}, {0x14, 0x1, 'gre0\x00'}, {0x14, 0x1, 'veth0_virt_wifi\x00'}, {0x14, 0x1, 'wlan0\x00'}, {0x14, 0x1, 'caif0\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0x40, 0x3, 0x0, 0x1, [{0x14, 0x1, 'vcan0\x00'}, {0x14, 0x1, 'tunl0\x00'}, {0x14, 0x1, 'bridge0\x00'}]}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x3}]}, @NFTA_FLOWTABLE_FLAGS={0x8}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}]}, @NFT_MSG_DELOBJ={0x240, 0x14, 0xa, 0x301, 0x0, 0x0, {0x0, 0x0, 0x1}, [@NFTA_OBJ_USERDATA={0xf5, 0x8, "9ac854703e2467fcd8eddb2f2cb4793a356b106d4191585b8b21cc920537016ff61550f4f207830283a40e7fbbfd7df91206931bc020cf298758335ffc283efba1fd50a057de0a0a712353f7e992eda90a5ada6ba4b1f417d415ac90aa1b772ac3365ca4ffc33684485d36808da6cc93628fbb0979a92710d0d69481a610c1bf983bca935d8159572cfac8eafb5ac438f9e830b6f26507e03751ad76d937afc5c28414bb49a0f914d543a90e9bd7eee746b29b861fc5493573863e30751222a4b167441d98b86420bff7fa2216c5c976f4fedbd8f14232d774c90666156fc4ed59629f73aae7b274bb4b9d53d7a4d8234f"}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJ_USERDATA={0x86, 0x8, "7261bc10e9a1062df2835bb7f4f4cc823ff201afadc0946c0c8972ea37952d6a7b5cfc077f8ce3e1eb11bc8d8115b85c07d1ed200bc5494ab0e1030f34d054ce9de5d15870c9cf81c19d88a507866bdea9e25c9fe8b218027937f5243e2386af63e8083a56d800af297b6c1920a13314bef054508f298039bbb35bd99afb7c2e65f0"}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x2}, @NFTA_OBJ_USERDATA={0x88, 0x8, "0ed2c66720ce17c86474d75d524f81f3f4bef12151d684bfc6c6214e691a814a8d5c7b22a4da6a03e82f1bafc4866c150dafe50d6039b675f4e0df271016149835638a228b3b2a94e5b213f8fe966221a21c1081ddd9516cc71012a6f0f06fc57b7176c6844362a726cd5c321223397441663d6e0eb6a1a8a4939009f4855b7efa3c4d36"}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x9e8}, 0x1, 0x0, 0x0, 0x20008801}, 0x0) syz_io_uring_setup(0x16b4, &(0x7f0000001380)={0x0, 0x86bb, 0x0, 0x2, 0x20c, 0x0, r10}, &(0x7f0000001400), &(0x7f0000001440), &(0x7f0000001480)) r11 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000014c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep1(r11, 0x82, 0xc4, &(0x7f0000001540)={[{0xbe, 0x4e00, "a3e424ab89026e9807caaa68471844eaba18b8a9b60e7f3237bdf332e70c9307cde280a037f18a58aa0d1a448112a4d859246710cf7c91aa6bceff163d1d7fbca1e2e0c736b4791bf1a37395f18d8f85ea763785581dabfb28b488c8298354612e53b3891c8dd396bbac3a10bf8f47ba7092de3a950e140fce9942ffbd77dac4ad3e2cb4ca4845f84d111d14e21bfb44314e0d1c46c3faf33546f9abb4ded0d85750c73e33e682aabf28425cdc7209f150a58f4434ab21c0df7fcb97a0be"}]}) ioctl$BTRFS_IOC_FS_INFO(r7, 0x8400941f, &(0x7f0000001640)) ioctl$VIDIOC_S_INPUT(r8, 0xc0045627, &(0x7f0000001a40)=0x9) syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000001a80)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) ioctl$DRM_IOCTL_AGP_FREE(r8, 0x40206435, &(0x7f0000001b40)) 17.08825332s ago: executing program 2 (id=143): r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000280)=@filter={'filter\x00', 0xe, 0x2, 0x488, [0x0, 0x2000000090c0, 0x2000000094e8, 0x200000009518], 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0200000011000000140000009300687372300000000000000000000000006272696467655f736c6176655f300000626f6e645f736c6176655f310000000076657468315f746f5f7465616d000000aaaaaaaaaa3900ff0fffffff7ee7d07aeb2500ffffffffff0000b000000048010000780200006d61726b5f6d0000000000000000000000000000000000000000000000000000180000000000000000000000000000027e0000000000000000030000000000006c6f670000000000000000000000000000000000000000000000000000000000280000000000000004cac08667463b75584f4374b47575a62dc82079dc9d09167acee323e23d7d0000000000000000004552524f5200000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000a000000000000000000000000400000000000005345434d41524b000000000000000000000000000000000000000000000000000801000000000000010000000a00000073797374656d5f753a6f626a6563745f723a6d61696c5f73706f6f6c5f743a7330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000058000000001b7665746831000000000000000000000076657468300000000000000000000000697036677265746170300000000000007465616d5f736c6176655f300000000000000000000000ffff00ff00aaaaaaaaaabb000100ffffff0000e800000030010000800100007265616c6d000000000000000000000000000000000000000000000000000000100000000000000008000000ea0d040001000000000000006f776e65720000000000000000000000000000000000000000000000000000001800000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="06070000000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a300000000000000000000000000cff00000000000007000000000040006c6f670000000000000000000000000000000000000000000000000000000000280000000000000059cf408dfa821f9b1a11460000e81b7b989c0cf33f0000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ffffffff00000000000000000000001e0000000000000000000000000000000000000000000000000000000002000000feffffff00000000"]}, 0x500) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000000)={0x10000, 0x9, 0x10000, 0xb03e, 0x1}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000080)=0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000b80), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0x5, &(0x7f0000000bc0)={0x8, 0x100008b}, 0x0) r4 = openat$panthor(0xffffffffffffff9c, &(0x7f0000000c00), 0x2, 0x0) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(r4, 0xc0106441, 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendmmsg$inet6(r5, &(0x7f0000000c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20004855) setsockopt$inet6_tcp_int(r5, 0x6, 0x4, &(0x7f0000000c80)=0x7f, 0x4) sched_setscheduler(0x0, 0x1, &(0x7f0000000cc0)=0x7) r6 = syz_open_dev$sndmidi(&(0x7f0000000d00), 0x2, 0x143102) r7 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000d40)) sendmsg$nl_route_sched(r7, &(0x7f0000001a80)={0x0, 0x0, 0x0}, 0x0) writev(r6, &(0x7f0000001ac0)=[{&(0x7f0000001b00)="94", 0xf000}, {0x0}], 0x2) set_mempolicy(0x8006, &(0x7f0000001b40)=0xfff, 0x5) shmget$private(0x0, 0x400000, 0x8, &(0x7f000000e000/0x400000)=nil) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001b80)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000001c00)={0x0, 0x0, 0x0}, 0x24004045) r8 = shmget$private(0x0, 0x3000, 0x200, &(0x7f0000ffa000/0x3000)=nil) ioctl$DRM_IOCTL_GET_CLIENT(r4, 0xc0286405, &(0x7f0000001c40)={0x2, 0x2, {0x0}, {0xee00}, 0x200}) prlimit64(r9, 0x2, 0x0, 0x0) shmat(r8, &(0x7f0000001000/0x3000)=nil, 0x9000) io_uring_setup(0x1b80, &(0x7f0000001c80)={0x0, 0x8970, 0x1f280, 0x0, 0x8000399}) sendmsg$nl_xfrm(r2, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80028000}, 0xc, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200100002a0000042cbd7000fedbdf2500000000000000000000000000000001000000000000000000000000000000004e2400064e2400810200208089000000", @ANYRES32=0x0, @ANYRES32=r3, @ANYBLOB="00000000000000000000ffffe0000002000004d532000000000000000000000000000000000000008404000000000000cd09a6370000000000000000000000000700000000000000000000000000000008000000000000000500000000000000060000000000000000000000000000008b8d00000000000007000000000000000900000000000000260d000009000000f9ffffff2abd70000735000002000402e00000000000000008000c000200000028001a00fc010000000000000000000000000001ac1e00010000000000000000000000000a000405"], 0x120}, 0x1, 0x0, 0x0, 0x24040010}, 0x4004004) 16.900155107s ago: executing program 1 (id=145): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='smb3\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) dup(r2) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0xf32}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x7) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f00000001c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000380), 0x651, 0x0) recvmmsg(r4, &(0x7f00000003c0), 0x10106, 0x2, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x128}, 0x0) recvmsg$unix(r6, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x50}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x80) 15.385813699s ago: executing program 1 (id=146): r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, 0x0, 0x0) sendmmsg(r0, &(0x7f0000000d00)=[{{0x0, 0x0, 0x0}}], 0x3e8, 0x0) 15.220220767s ago: executing program 0 (id=147): r0 = fsopen(&(0x7f0000000100)='9p\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f00000001c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000240)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0) read$msr(r4, &(0x7f00000002c0)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x47, &(0x7f00000192c0)=0x7) write$P9_RVERSION(0xffffffffffffffff, 0x0, 0x15) bpf$OBJ_GET_PROG(0x7, &(0x7f0000019400)=@generic={&(0x7f00000193c0)='./file0\x00'}, 0x18) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(0xffffffffffffffff, &(0x7f0000019300)={0x0, 0x0, &(0x7f0000019340)={&(0x7f0000019380)=ANY=[@ANYBLOB="580000000008010200000000000000000200ffff0600024022eb000005000300ffff00000900010073797a3000000000260004"], 0x58}, 0x1, 0x0, 0x0, 0x20000015}, 0x20008000) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'veth0_macvtap\x00', 0x0}) r7 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r6, {0x0, 0x8}, {0xffff, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4, 0x1e}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x10) syz_usb_connect(0x0, 0x24, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000bd02c440560831ac1e93010203010902120081000000000904"], 0x0) 15.093061509s ago: executing program 5 (id=148): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./tracefs_dir\x00', 0xbf) mount(0x0, &(0x7f0000000100)='./tracefs_dir\x00', &(0x7f0000000280)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000002c0)='./tracefs_dir/buffer_size_kb\x00', 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 14.113459995s ago: executing program 5 (id=149): syz_usb_connect$cdc_ecm(0x2, 0x56, &(0x7f0000000300)=ANY=[@ANYBLOB="12010000020000102505a1a44000000001010902440001fd00000009040000ff0202ffff052406000005240000000d240f010000000000000000000905810320000000000905820220000000000905030208"], 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) io_uring_enter(0xffffffffffffffff, 0x2219, 0x7721, 0x16, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f0000000200), 0x2, 0x4a102) writev(r1, &(0x7f0000000280)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000003180)=ANY=[@ANYBLOB], 0x48) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x2000, 0x102) getdents64(r3, &(0x7f00000004c0)=""/160, 0xa0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000031c0)={0x0, 0x0, 0x0, &(0x7f0000003240), 0xacb, r2}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3fff}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x52, '\x00', 0x0, @fallback=0x9af8dba271b76fd5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setrlimit(0x2, &(0x7f0000000400)={0xffffffffffffffff, 0xe}) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r4, 0x2000000, 0xe, 0x0, &(0x7f0000000600)="c9f7b98600"/14, 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 14.089441911s ago: executing program 1 (id=150): r0 = msgget(0x0, 0x4a) r1 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x20842, 0x4) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000400)={0x0, 0x1846, 0x4000, 0x802, 0x2b1, 0x0, r1}, &(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000000500)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r2) socket$alg(0x26, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000540)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000580)=0x8) r3 = getpgrp(0x0) sched_setaffinity(r3, 0x8, &(0x7f00000005c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000600)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r5 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f0000000640), 0x0, 0x0) read$msr(r6, &(0x7f0000001900)=""/102392, 0x18ff8) openat$vimc0(0xffffffffffffff9c, &(0x7f000001a940), 0x2, 0x0) msgctl$MSG_INFO(r0, 0xc, &(0x7f00000001c0)=""/81) fanotify_init(0x200, 0x0) mount(&(0x7f0000000240)=@nullb, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='btrfs\x00', 0x0, &(0x7f0000000300)='discard') io_uring_setup(0x9ab, &(0x7f0000000340)={0x0, 0x4ace, 0x4000, 0x2, 0x282}) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000140)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1}) io_uring_enter(0xffffffffffffffff, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) 13.952062658s ago: executing program 0 (id=151): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/block/nullb0/queue/scheduler\x00', 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x0) syz_usb_connect$uac3(0x4, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) write(r0, &(0x7f00000001c0)='kyber', 0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000002c0)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./debug/tracing/options/context-info\x00', 0x1, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1c, &(0x7f0000000240)=[@in6={0xa, 0x2, 0x8001, @loopback, 0xffffffff}]}, &(0x7f0000000280)=0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x6d, &(0x7f00000003c0), &(0x7f0000000400)=0x3930) write(r1, &(0x7f0000000380)='0', 0x1) 12.646614095s ago: executing program 34 (id=151): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/block/nullb0/queue/scheduler\x00', 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x0) syz_usb_connect$uac3(0x4, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) write(r0, &(0x7f00000001c0)='kyber', 0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000002c0)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./debug/tracing/options/context-info\x00', 0x1, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1c, &(0x7f0000000240)=[@in6={0xa, 0x2, 0x8001, @loopback, 0xffffffff}]}, &(0x7f0000000280)=0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x6d, &(0x7f00000003c0), &(0x7f0000000400)=0x3930) write(r1, &(0x7f0000000380)='0', 0x1) 12.640221527s ago: executing program 1 (id=153): r0 = socket$inet6(0xa, 0x2, 0x0) syz_emit_ethernet(0x1f, &(0x7f00000000c0)={@local, @empty, @void, {@llc_tr={0x11, {@llc={0x42, 0x42, "03", "6c404000000062cf004ab77f8437"}}}}}, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @empty}, 0x1c) prlimit64(0x0, 0xe, &(0x7f0000000300)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000340)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000380)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000003c0), 0x0, 0x0) read$msr(r3, &(0x7f0000000400)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f0000019400)=0x7) r4 = openat$userio(0xffffffffffffff9c, &(0x7f0000019440), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f0000019480)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r4, &(0x7f00000194c0), 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="12000000050000000800000008"], 0x48) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r5 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)={0x24, 0x1402, 0x1, 0x70bd2a, 0x25dfdc02, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz2\x00'}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000801}, 0x40810) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) syz_emit_ethernet(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, &(0x7f0000000280)={0x3, &(0x7f00000002c0)=[{0x40, 0x9, 0xfe, 0x6a66}, {0x30, 0x1, 0x1, 0xfffff034}, {0x6, 0x15, 0x0, 0xb}]}, 0x10) write$binfmt_aout(r6, &(0x7f0000000300)=ANY=[], 0x33fe0) syz_usb_connect(0x0, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000092df5510ac05269289b201020301090222000100000000090400000103e900000905a1e7", @ANYRESDEC], 0x0) 11.417225138s ago: executing program 2 (id=154): r0 = socket$kcm(0xa, 0x5, 0x0) sendmsg$kcm(r0, &(0x7f0000000040)={&(0x7f00000001c0)=@l2tp6={0xa, 0x0, 0x7fff, @local, 0x8}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000280)='`', 0x1}], 0x1}, 0x41) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000380)="d8000000100081046881f782db44b904021d080b01000000e8fe55a11800150006001400060000120800040043000000a80016000a00014006000d3f036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5fe4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f1aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1, 0x0, 0x0, 0xc3ff}, 0x0) (fail_nth: 4) 9.615666561s ago: executing program 2 (id=155): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000600)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000680)={0x1d, r1}, 0x18) setsockopt$SO_J1939_ERRQUEUE(r0, 0x6b, 0x4, &(0x7f00000006c0)=0x1, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys_sec\x00', &(0x7f0000000140)='securityfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x0) write(r2, &(0x7f00000001c0)='select \n', 0x10) write(r2, &(0x7f0000000200)='file read @etc/passwd /as/\\Aid=0-0xec.argv[0]=\"sh\" exec.envp[\"PATH\"]=\"/bin\"\n', 0x4c) chown(&(0x7f0000000280)='./file0\x00', 0xffffffffffffffff, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(r3, 0x8008ae9d, &(0x7f0000000300)) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000700)={'vcan0\x00', 0x0}) r6 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r6, &(0x7f0000000740)={0x1d, r5, 0x0, {0x0, 0x0, 0x4}, 0xfe}, 0x18) r7 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r7, &(0x7f0000000000)={0xa, 0x4e20, 0x9, @mcast2, 0x4}, 0x1c) connect$netlink(r7, &(0x7f0000000040)=@unspec, 0xc) syz_emit_ethernet(0x3e, &(0x7f0000000080)={@broadcast, @local, @void, {@ipv6={0x86dd, @udp={0xa, 0x6, '\x00', 0x8, 0x11, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, @remote, {[], {0x4e1d, 0x4e20, 0x8}}}}}}, 0x0) sendmsg$can_j1939(r6, &(0x7f0000000780)={&(0x7f00000007c0), 0x18, &(0x7f0000000800)={&(0x7f0000000840)="4dfb0cf0d556f1327d", 0x9}, 0x1, 0x0, 0x0, 0x40000}, 0x4406f) sendmsg$nl_route_sched(r4, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000900)=@newtfilter={0x24, 0x11, 0x111, 0x70bd27, 0x100000, {0x0, 0x0, 0x74, r5, {0x6, 0xc}, {0x5, 0x10}, {0x6, 0xc}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4010}, 0xc4) 9.069055283s ago: executing program 6 (id=156): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = gettid() prlimit64(r0, 0x7, &(0x7f0000000040)={0x6, 0x6}, &(0x7f00000191c0)) fcntl$setownex(0xffffffffffffffff, 0xf, &(0x7f0000019200)={0x0, r0}) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000019240)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000019280)={{r1, 0xffffffffffffffff}, &(0x7f00000192c0), &(0x7f0000019300)='%pB \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000019500)={r2}, 0x4) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000019540)={0xc, 0x11, &(0x7f0000019600)=ANY=[@ANYBLOB="180000000000000000000000000400008500000018000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f00000196c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000019700)={r3, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000019780)="b9090303008cb89e08f086dd0000", 0x0, 0xfe6, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x6a) r4 = getpgrp(0x0) sched_setaffinity(r4, 0x8, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000100)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r6 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x1, 0x0) r7 = syz_open_dev$MSR(&(0x7f0000000140), 0x0, 0x0) read$msr(r7, &(0x7f0000000180)=""/102392, 0x18ff8) sched_setaffinity(r6, 0x8, &(0x7f0000019180)=0x80000000000003) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_io_uring_setup(0xf00, &(0x7f0000019340)={0x0, 0x595d, 0x10000, 0x0, 0x4e}, &(0x7f00000193c0), &(0x7f0000019400), &(0x7f0000019440)) 7.658113553s ago: executing program 6 (id=157): bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[], 0x50) socket$nl_route(0x10, 0x3, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x169802, 0x0) r1 = dup(r0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x808b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000100)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x4000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000200), 0x651, 0x0) recvmmsg(r3, &(0x7f0000000240), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x6) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f00000002c0)={0x0, {0x2, 0x4e23, @remote}, {0x2, 0x4e22, @remote}, {0x2, 0x4e23, @empty}, 0x4, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000340)='team_slave_0\x00', 0x6, 0xffffffff, 0x2}) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_MSFILTER(r5, 0x29, 0x30, 0x0, 0x0) add_key(&(0x7f0000000780)='asymmetric\x00', 0x0, &(0x7f00000007c0)="308201103081bea00302012b020101300a06082a85030701010302300e310c300a06035504030c0373797a3020170d3232303531383232333234315a180f32313232303432343232333234315a300e310c300a06035504030c0373797a3066301f06082a85030701010101301306072a85030202230106082a850307010102020343000440d5a777f9262f8cbdcce31f0194053d2fecb50034f5516d3b904b23286f1dc836616036ecbbb40b954e544f152105d8526644317e5dc5d126005f60d8f0c727fc300a06082a8503070101030203410041320973a4c138d6637d8bf7503fda9f6848c150e3423a9b2b28122aa7c2753165778c3c9e0d56b2f9dc04333eb09ef9744e59b383f29127da5ec733c0c18f41", 0x114, 0xfffffffffffffffe) 7.653921549s ago: executing program 1 (id=158): r0 = socket$inet6(0xa, 0x1, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000180)={@dev={0xfe, 0x80, '\x00', 0x28}, 0x1, 0x0, 0xff, 0x2, 0x800, 0xa4}, &(0x7f0000000840)=0x20) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/59, 0x325000, 0x800}, 0x1c) ioctl$XFS_IOC_FSGEOMETRY_V4(r0, 0x8070587c, &(0x7f0000000700)) r2 = openat$selinux_validatetrans(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$selinux_validatetrans(r2, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setitimer(0x2, &(0x7f0000000140)={{0x0, 0x2710}, {0x0, 0x2710}}, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x0, 0x0, 0x2, 0x2) syz_open_dev$vim2m(&(0x7f0000000800), 0x7, 0x2) pipe(&(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r5, &(0x7f00000008c0)=[{&(0x7f0000000900)="580000001400", 0x6}], 0x1) r6 = socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r5, &(0x7f0000000940), 0xfef0) splice(r4, 0x0, r6, 0x0, 0x80000001, 0x0) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0xfffffffffffffe5a, r7, 0x72b}, 0x14}, 0x1, 0x0, 0x0, 0x8040}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0xffff, 0xfff1}, {0xffff, 0xc}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) r8 = syz_usb_connect$hid(0x3, 0x36, &(0x7f00000004c0)=ANY=[@ANYBLOB="1203000000000010700c0af0000000000001090224000100005000090400000903000000092100000001222b00090581030000000200"], 0x0) syz_usb_control_io$hid(r8, 0x0, 0x0) syz_usb_control_io$hid(r8, &(0x7f0000000500)={0x24, 0x0, 0x0, 0x0, &(0x7f0000000540)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000580)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r3, &(0x7f00000005c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x4010200}, 0xc, &(0x7f0000000640)={&(0x7f0000000680)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16, @ANYBLOB="200029bd7000fbdbdf2501000000000000000b000000000c001473797a3000000000c29bd65782f034e27cc2a82db1e3522c050000002bde9e14042391f7a287"], 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) socket(0x1e, 0x800, 0xb988) 7.482069744s ago: executing program 2 (id=159): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000080)=0x5) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000000180)) rseq(0x0, 0x0, 0x0, 0x0) timer_getoverrun(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) set_mempolicy(0x1, 0x0, 0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r2, &(0x7f0000000b40)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x8, &(0x7f0000019b40)=0x4000007) r3 = socket(0x2b, 0x80801, 0x1) connect$inet6(r3, &(0x7f0000000140)={0xa, 0x4e23, 0x1, @ipv4={'\x00', '\xff\xff', @empty}, 0xfffffffe}, 0x1c) shutdown(r3, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x19, 0x0, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000380)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0xe, @empty, 0x2}, {0xa, 0x4e23, 0x7, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x3}, 0xffffffffffffffff, 0x8}}, 0x48) 7.481314364s ago: executing program 5 (id=160): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f0000000380)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0xffffffffffffffff}}}], 0x20, 0x8811}}], 0x2, 0x40044) sendmmsg$inet6(r0, &(0x7f0000000000)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20004855) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sec/tomoyo/profile\x00', 0x81, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000480), 0x4) write(r2, &(0x7f00000002c0)='0-CONFIG=disabled\n', 0x12) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000300)=0x6) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000500)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000540)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f00000005c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000640), 0x651, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1c0) mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x1, 0x36, &(0x7f0000000140)={{0x12, 0x1, 0x310, 0xa, 0x43, 0x8, 0x8, 0x6737, 0x1, 0x9180, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x8e, 0x5, 0x10, 0x7, "", [{{0x9, 0x4, 0xfb, 0xb, 0x2, 0x82, 0xd2, 0xd2, 0x0, [], [{{0x9, 0x5, 0x9f, 0x2, 0x40, 0x7, 0x0, 0x7}}, {{0x9, 0x5, 0x1, 0x2, 0x40, 0x7, 0x5, 0x8}}]}}]}}]}}, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/ttyUSB0\x00', 0x2, 0x0) recvmmsg(r4, &(0x7f0000000680), 0x1011f, 0x2, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4b, &(0x7f0000000700)=0x8fa7, 0x4) listen(0xffffffffffffffff, 0x10040) syz_emit_ethernet(0x36, &(0x7f0000000740)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x67, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010001, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2, 0x5, 0x0, 0x6}}}}}}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000780)=0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) fsopen(&(0x7f00000007c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) 6.390643943s ago: executing program 2 (id=161): r0 = fsopen(&(0x7f0000000100)='9p\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f00000001c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000240)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0) read$msr(r4, &(0x7f00000002c0)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x47, &(0x7f00000192c0)=0x7) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$OBJ_GET_PROG(0x7, &(0x7f0000019400)=@generic={&(0x7f00000193c0)='./file0\x00'}, 0x18) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r5, &(0x7f0000019300)={0x0, 0x0, &(0x7f0000019340)={&(0x7f0000019380)=ANY=[@ANYBLOB="580000000008010200000000000000000200ffff0600024022eb000005000300ffff00000900010073797a3000000000260004"], 0x58}, 0x1, 0x0, 0x0, 0x20000015}, 0x20008000) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'veth0_macvtap\x00', 0x0}) r8 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r7, {0x0, 0x8}, {0xffff, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4, 0x1e}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x10) syz_usb_connect(0x0, 0x24, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000bd02c440560831ac1e93010203010902120081000000000904"], 0x0) 4.3520858s ago: executing program 5 (id=162): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./file0\x00', 0x0) mount$bind(&(0x7f0000000700)='.\x00', &(0x7f0000000740)='./file0/../file0\x00', 0x0, 0x101091, 0x0) chroot(&(0x7f0000000780)='./file0/../file0\x00') mount$bind(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f0000000880)='./file0/../file0\x00', &(0x7f00000008c0)='./file0\x00') mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x44, 0x6, 0x3c8, 0x168, 0x168, 0x0, 0x200, 0x168, 0x370, 0x370, 0x370, 0x370, 0x370, 0x6, 0x0, {[{{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x13}, 0xff, 0xff000000, 'pim6reg1\x00', 'bridge_slave_0\x00', {}, {0xff}, 0x88, 0x3}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x3, 0x3}}}, {{@ip={@private=0xa010100, @local, 0x0, 0x0, 'vcan0\x00', 'veth0_virt_wifi\x00', {}, {0xff}}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x0, 0x1], 0x1}, {0x0, [0x0, 0x0, 0x0, 0x2, 0x4]}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0xff, 0xff, 'bond_slave_0\x00', 'veth1_virt_wifi\x00', {}, {0xff}, 0x5c, 0x2}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@private=0xa010102, @multicast1, 0x0, 0xffffff00, 'syzkaller0\x00', 'bond0\x00', {}, {}, 0x0, 0x0, 0x13}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@remote, @loopback, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0x98}, @ECN={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x428) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f0000000580)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x519c02, 0x0) ioctl$FS_IOC_RESVSP(r2, 0x40305828, &(0x7f0000000040)={0x82, 0x1, 0x6, 0xfffffffffffffffe}) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000000640)={r0, &(0x7f0000000540)='bond0\x00', 0x8200, &(0x7f00000005c0)={@_ha_fsid={[0x5, 0x9]}, {0x8, 0x8000, 0x8, 0x2}}, 0x0, &(0x7f0000000680)={@_ha_fsid}, &(0x7f0000000600)=0x80}) write(r2, &(0x7f0000001640)="8b", 0x11) 3.197552617s ago: executing program 6 (id=163): fsopen(&(0x7f0000000280)='ufs\x00', 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x6, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) poll(0x0, 0x0, 0x4) r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSWINSZ(r0, 0x5414, &(0x7f0000000040)={0x9, 0x2, 0x1000, 0x5}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x40000, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$sndseq(0xffffffffffffff9c, 0x0, 0x25ca03) keyctl$KEYCTL_MOVE(0x1e, 0x0, 0xfffffffffffffffe, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) mlock2(&(0x7f0000247000/0x1000)=nil, 0x1000, 0x0) munlockall() r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e24, @multicast1}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e24, @empty}, 0x10) r3 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000000140)) timer_settime(0x0, 0x1, &(0x7f00000001c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) pipe(&(0x7f0000000240)={0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000340)=[{&(0x7f00000003c0)='|', 0xfd}], 0xf, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) r5 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000580)="89000000120081ae08060cdc030000fe7f03446b000000000001ffca1bdcfdd9fb0024c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00150c00014003080c00bdad446b31007a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947e", 0x75}, {&(0x7f0000000600)="11d6cb557c849601b143d4f4f2fe4b15f1b62db6", 0x14}], 0x2}, 0x4000000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000180)='vuto_da_alloc', 0x0) 2.671297036s ago: executing program 5 (id=164): setns(0xc9, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_KEY(r0, &(0x7f0000001f80)={0x0, 0x0, &(0x7f0000002240)={&(0x7f0000002280)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010025bd7000fbdbdf250900000008000300", @ANYRES32=0x0, @ANYBLOB="0c0099000100000001000000"], 0x28}, 0x1, 0x0, 0x0, 0x20000880}, 0x40840) ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000440)=0x2) r2 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ftruncate(r2, 0x80000001) mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_usb_connect$cdc_ecm(0x0, 0x4d, &(0x7f0000000040)=ANY=[], 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0xc, 0x13, &(0x7f00000004c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000020200008500000070000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001700000095"], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_SECURITY_KEYRING(r4, 0x110, 0x2, &(0x7f0000000080)='\x00\xdb\xf9}\x94\xd7\xe5\x1f\xab{\xd0E\xbc\x1f\xb5<\xe4f=\b\x00\x00\x00\x00\x00\x00\x00\xe2\xde\x8c\x10boj\xd3X\x86\v\x8clx=\xbc0F\x94k\x8d\xe0\xeeP\xa8\xa9\x10\xd4\x0f\x1eL!\x82\x8d\x80\xd0#\xca\xaf#\xf6\x95\xf4\xf2\xce\x8f\x8c\xa4\t\xac\x96\x13\x96\xf76\xc1', 0x53) r5 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f0000000140)={0x203, 0xa, 0x2}) ioctl$VIDIOC_PREPARE_BUF(r5, 0xc058565d, &(0x7f0000000180)=@userptr={0x6, 0xa, 0x4, 0x1, 0x0, {0x0, 0x2710}, {0x1, 0xc, 0xd2, 0x6, 0xf5, 0x6, "0080ca6f"}, 0x6, 0x2, {0x0}}) r6 = add_key$user(&(0x7f0000000200), &(0x7f0000000240)={'syz', 0x0}, &(0x7f0000000280)="1d", 0x1, 0xffffffffffffffff) syz_open_dev$dmmidi(&(0x7f00000002c0), 0x352, 0x60242) r7 = syz_open_dev$sndctrl(&(0x7f0000000300), 0x84, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r7, 0x40045542, &(0x7f0000000340)=0x4) syz_open_dev$dmmidi(&(0x7f0000000380), 0x200, 0x40002) r8 = add_key$user(&(0x7f00000003c0), &(0x7f0000000400)={'syz', 0x1}, &(0x7f0000000680)="3e12d23d346cfdeb1716f738374bc1c03bee4423fa20837e6e86b86592e9be83d8ebbbd6e24f37d5095f839fa4a3507df4f7526f2440e7988da94ccd868dd8741d1e43eba0b67b516be14a8b51a75bfd611b2d7ae6a21d056c2c5116a416a76b1a03dc55ea62d43c809e0ed6e56163fdab317afd5c34d614367e4425bb9a97e39fea3859296659bf4c2467159227ee717f4e959ac989e03926c4e20c2cda4efd37be90f502fd03e4748564d9694e12c10e", 0xb1, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000740)={r6, r6, r8}, 0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)={'sha256\x00'}}) socket$inet6(0xa, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x13, 0xffffffffffffffff, 0x0) keyctl$negate(0xd, r8, 0xfffffffffffffffa, 0xfffffffffffffffc) io_uring_register$IORING_REGISTER_FILES2(0xffffffffffffffff, 0xd, &(0x7f0000000800)={0xa, 0x1, 0x0, &(0x7f0000000840)=[{&(0x7f0000000900)=""/249, 0xf9}, {&(0x7f0000000a00)=""/241, 0xf1}, {&(0x7f0000000b00)=""/25, 0x19}, {&(0x7f0000000c00)=""/244, 0xf4}, {&(0x7f0000000d00)=""/9, 0x9}, {&(0x7f0000000d40)=""/40, 0x28}, {&(0x7f0000000d80)=""/225, 0xe1}, {&(0x7f0000000e80)=""/4096, 0x1000}, {&(0x7f0000001e80)=""/229, 0xe5}, {0x0}], &(0x7f0000001f80)}, 0x20) r9 = openat$uhid(0xffffffffffffff9c, &(0x7f0000001fc0), 0x2, 0x0) ioctl$VIDIOC_DQEVENT(r5, 0x80885659, &(0x7f00000022c0)={0x0, @frame_sync}) write$UHID_CREATE(r9, &(0x7f00000020c0)={0x0, {'syz0\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000002000)=""/38, 0xe3, 0x0, 0x8, 0xfffffffe, 0x400, 0xc08}}, 0x120) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={r3, 0xfca804a0, 0xe, 0x0, &(0x7f0000000640)="b8000005000000000152912e5763", 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) 1.904426071s ago: executing program 6 (id=165): socket$inet_udp(0x2, 0x2, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000106a053103000000000001090224000100008000090400101c0300010009210000000122f80409058103"], 0x0) r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) fcntl$lock(r0, 0x410, &(0x7f0000000140)={0x1, 0x1, 0x0, 0xfffe}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000180)={r0, 0xe0, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b00), ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x6, &(0x7f0000000b40)=[0x0, 0x0, 0x0], &(0x7f0000000b80)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xe3, &(0x7f0000000bc0)=[{}, {}, {}, {}, {}, {}, {}], 0x38, 0x10, &(0x7f0000000c00), &(0x7f0000000080), 0x8, 0x8b, 0x8, 0x8, &(0x7f0000000c80)}}, 0x10) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000cc0)={0x18, 0x0, {0x4001, @multicast, 'batadv0\x00'}}, 0x1e) sendmmsg(r1, &(0x7f0000000d00)=[{{0x0, 0x0, 0x0}}], 0x3e8, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000380)=0x9, 0x4) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x2006}, 0x1c) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000240)={{r0}, &(0x7f0000000280), &(0x7f0000000100)='%pB \x00'}, 0x20) prlimit64(0x0, 0xe, &(0x7f0000000340)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000003c0)=0x7) r3 = getpgrp(0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000440)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$TIOCGSOFTCAR(0xffffffffffffffff, 0x5419, &(0x7f00000005c0)) getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000600)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000006c0), 0x0, 0x0) read$msr(r4, &(0x7f0000002b80)=""/102392, 0x18ff8) socketpair$unix(0x1, 0x1, 0x0, &(0x7f000001bc00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r5, 0x8b04, &(0x7f000001bc40)={'wlan1\x00', @random="0200ffffff8d"}) 1.597401259s ago: executing program 2 (id=166): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f00000000c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000200), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000240), 0x10106, 0x2, 0x0) r3 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r3, 0x107, 0xf, &(0x7f00000002c0), 0x4) sendmsg$kcm(r3, &(0x7f0000000300)={&(0x7f0000000340)=@hci={0x1f, 0x0, 0x4}, 0x80, &(0x7f0000000440)=[{&(0x7f0000000500)="270502001a0014000600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accbe1ba0777cfbf6ae77256da82f6184b8a34f9015cc99e5700", 0x3e}, {&(0x7f0000000540)="b0a3d6", 0x3}], 0x2}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), 0xffffffffffffffff) r4 = syz_io_uring_setup(0xefd, &(0x7f00000003c0)={0x0, 0x5961, 0x10000, 0x0, 0x4e}, 0x0, &(0x7f0000000480), &(0x7f00000004c0)) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f00000005c0)='./nfsd\x00', &(0x7f0000000600)='nfsd\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./nfsd/filehandle\x00', 0x2, 0x0) write(r5, &(0x7f0000000680)='mydomain / 64\n', 0xe) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000700)='./proc\x00', &(0x7f0000000740)='proc\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x80) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', &(0x7f0000000200), 0x400) write(r6, &(0x7f00000007c0)='mydomain / 64\n', 0xe) io_uring_enter(r4, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000840)={'syzkaller0\x00', 0x10}) r7 = socket$inet(0x2, 0x2, 0xffffffff) ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000800), 0x500, 0x0) syz_open_dev$evdev(&(0x7f0000000100), 0x0, 0x8c2) 1.463188864s ago: executing program 5 (id=167): syz_io_uring_setup(0xf00, &(0x7f0000019340)={0x0, 0x595d, 0x10000, 0x0, 0x4e}, &(0x7f00000193c0), &(0x7f0000019400), &(0x7f0000019440)) 805.857916ms ago: executing program 35 (id=167): syz_io_uring_setup(0xf00, &(0x7f0000019340)={0x0, 0x595d, 0x10000, 0x0, 0x4e}, &(0x7f00000193c0), &(0x7f0000019400), &(0x7f0000019440)) 0s ago: executing program 1 (id=169): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) r1 = gettid() sched_setscheduler(r1, 0x2, &(0x7f0000000280)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSPGRP(r0, 0x5410, 0x0) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000040)='./sys\x00', 0x0, 0x0, 0x0) write(r0, &(0x7f0000000300)='1', 0x1) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r5, &(0x7f0000000300)='1', 0x1) (fail_nth: 4) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x4) kernel console output (not intermixed with test programs): sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 74.499191][ T5842] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=5842 comm=syz.4.16 [ 74.502584][ T30] audit: type=1400 audit(1792619221.481:231): avc: denied { create } for pid=5839 comm="syz.4.16" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 74.636678][ T5727] gp8psk: usb in 128 operation failed. [ 74.638442][ T5727] gp8psk: usb in 137 operation failed. [ 74.638452][ T5727] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 74.638872][ T5727] dvbdev: DVB: registering new adapter (Genpix SkyWalker-1 DVB-S receiver) [ 74.638896][ T5727] usb 2-1: media controller created [ 74.699387][ T5727] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 74.719589][ T5727] gp8psk_fe: Frontend attached [ 74.719788][ T5727] usb 2-1: DVB: registering adapter 1 frontend 0 (Genpix DVB-S)... [ 74.720067][ T5727] dvbdev: dvb_create_media_entity: media entity 'Genpix DVB-S' registered. [ 74.965338][ T5854] ecryptfs_validate_options: eCryptfs doesn't support cipher: aes [ 74.965644][ T5854] Error validating options; rc = [-22] [ 74.968996][ T5854] vlan0: entered promiscuous mode [ 74.989144][ T30] audit: type=1400 audit(1792619221.941:232): avc: denied { mount } for pid=5851 comm="syz.4.18" name="/" dev="securityfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 75.158400][ T5727] dvb-usb: Genpix SkyWalker-1 DVB-S receiver successfully initialized and connected. [ 75.158592][ T5727] gp8psk: found Genpix USB device pID = 203 (hex) [ 75.324168][ T5868] netlink: 12 bytes leftover after parsing attributes in process `syz.2.19'. [ 75.358117][ T5868] Zero length message leads to an empty skb [ 75.380859][ T29] usb 2-1: USB disconnect, device number 3 [ 75.388748][ T30] audit: type=1400 audit(1792619222.371:233): avc: denied { write } for pid=5873 comm="syz.3.20" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 75.422098][ T30] audit: type=1400 audit(1792619222.401:234): avc: denied { search } for pid=5262 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 75.422142][ T30] audit: type=1400 audit(1792619222.401:235): avc: denied { search } for pid=5262 comm="dhcpcd" name="udev" dev="tmpfs" ino=9 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 75.422176][ T30] audit: type=1400 audit(1792619222.401:236): avc: denied { search } for pid=5262 comm="dhcpcd" name="data" dev="tmpfs" ino=14 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 75.471079][ T5874] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 75.471101][ T5874] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 75.471507][ T5874] vhci_hcd vhci_hcd.0: Device attached [ 75.476677][ T5878] vhci_hcd: connection closed [ 75.480579][ T151] vhci_hcd vhci_hcd.3: stop threads [ 75.480725][ T151] vhci_hcd vhci_hcd.3: release socket [ 75.480744][ T151] vhci_hcd vhci_hcd.3: disconnect device [ 75.691869][ T29] dvb-usb: Genpix SkyWalker-1 DVB-S receiver successfully deinitialized and disconnected. [ 75.744405][ T5880] batman_adv: batadv0: Adding interface: syz_tun [ 75.744422][ T5880] batman_adv: batadv0: The MTU of interface syz_tun is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 75.744447][ T5880] batman_adv: batadv0: Interface activated: syz_tun [ 76.772240][ T10] cfg80211: failed to load regulatory.db [ 77.190925][ T5896] smbdirect: ib_dev[rxe0] renamed to [syz2] [ 77.653210][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 77.950976][ T5861] IPVS: starting estimator thread 0... [ 77.956920][ T5900] binder: 5898:5900 ioctl c0306201 200000000740 returned -14 [ 77.963152][ T5900] binder: BINDER_SET_CONTEXT_MGR already set [ 77.963161][ T5900] binder: 5898:5900 ioctl 4018620d 200000000800 returned -16 [ 77.964131][ T5900] binder: 5898:5900 ioctl c0306201 200000000840 returned -14 [ 77.972952][ T5903] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=5903 comm=syz.2.26 [ 77.983904][ T5899] netlink: 44 bytes leftover after parsing attributes in process `syz.2.26'. [ 78.044628][ T5901] IPVS: using max 38 ests per chain, 91200 per kthread [ 78.063127][ T5727] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 78.103830][ T5726] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 78.141787][ T5910] FAULT_INJECTION: forcing a failure. [ 78.141787][ T5910] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 78.141815][ T5910] CPU: 1 UID: 0 PID: 5910 Comm: syz.3.27 Not tainted syzkaller #0 PREEMPT(full) [ 78.141836][ T5910] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 78.141847][ T5910] Call Trace: [ 78.141853][ T5910] [ 78.141861][ T5910] dump_stack_lvl+0x100/0x190 [ 78.141892][ T5910] should_fail_ex.cold+0x5/0xa [ 78.141919][ T5910] _copy_from_user+0x2e/0xd0 [ 78.141948][ T5910] ctl_ioctl+0xf3/0xcc0 [ 78.141977][ T5910] ? __pfx_ctl_ioctl+0x10/0x10 [ 78.142029][ T5910] ? selinux_file_ioctl+0x13b/0x290 [ 78.142047][ T5910] ? selinux_file_ioctl+0xb6/0x290 [ 78.142067][ T5910] dm_ctl_ioctl+0x22/0x30 [ 78.142090][ T5910] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 78.142115][ T5910] __x64_sys_ioctl+0x18e/0x210 [ 78.142142][ T5910] do_syscall_64+0x123/0x790 [ 78.142163][ T5910] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 78.142181][ T5910] RIP: 0033:0x7febbf79f559 [ 78.142196][ T5910] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 78.142212][ T5910] RSP: 002b:00007febc068f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 78.142230][ T5910] RAX: ffffffffffffffda RBX: 00007febbfa25fa0 RCX: 00007febbf79f559 [ 78.142242][ T5910] RDX: 0000200000001fc0 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 78.142253][ T5910] RBP: 00007febc068f090 R08: 0000000000000000 R09: 0000000000000000 [ 78.142264][ T5910] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 78.142275][ T5910] R13: 00007febbfa26038 R14: 00007febbfa25fa0 R15: 00007ffd98206e28 [ 78.142300][ T5910] [ 78.272900][ T5726] usb 2-1: Using ep0 maxpacket: 16 [ 78.273425][ T5726] usb 2-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 78.274375][ T5726] usb 2-1: config 0 has an invalid descriptor of length 55, skipping remainder of the config [ 78.274406][ T5726] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 78.274427][ T5726] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 78.274448][ T5726] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 78.276137][ T5727] usb 1-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 78.282490][ T5726] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 78.282510][ T5726] usb 2-1: Product: syz [ 78.282523][ T5726] usb 2-1: Manufacturer: syz [ 78.282535][ T5726] usb 2-1: SerialNumber: syz [ 78.288636][ T5726] usb 2-1: config 0 descriptor?? [ 78.302115][ T5727] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 78.302141][ T5727] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 78.302163][ T5727] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 78.302182][ T5727] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 78.391355][ T5727] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 78.391381][ T5727] usb 1-1: Product: syz [ 78.391394][ T5727] usb 1-1: Manufacturer: syz [ 78.391406][ T5727] usb 1-1: SerialNumber: syz [ 78.451914][ T5915] netlink: 40 bytes leftover after parsing attributes in process `syz.2.28'. [ 78.512822][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 78.523479][ T5727] usb 1-1: config 0 descriptor?? [ 78.525867][ T5727] ums-isd200 1-1:0.0: USB Mass Storage device detected [ 78.545714][ T5726] appledisplay 2-1:0.0: Error while getting initial brightness: -71 [ 78.552044][ T5726] appledisplay 2-1:0.0: probe with driver appledisplay failed with error -71 [ 78.582267][ T5726] usb 2-1: USB disconnect, device number 4 [ 78.679005][ T5917] sctp: [Deprecated]: syz.2.28 (pid 5917) Use of int in max_burst socket option deprecated. [ 78.679005][ T5917] Use struct sctp_assoc_value instead [ 78.794002][ T5727] ums-isd200 1-1:0.0: probe with driver ums-isd200 failed with error -22 [ 78.815982][ T5726] rxe_eth0 speed is unknown, defaulting to 1000 [ 78.844685][ T5806] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 79.000474][ T5806] usb 4-1: Using ep0 maxpacket: 16 [ 79.001064][ T5806] usb 4-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 79.001940][ T5806] usb 4-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 79.001967][ T5806] usb 4-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 79.001988][ T5806] usb 4-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 28 [ 79.002014][ T5806] usb 4-1: config 0 interface 0 has no altsetting 0 [ 79.002042][ T5806] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 79.020614][ T5806] usb 4-1: config 0 descriptor?? [ 79.032859][ T29] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 79.204204][ T29] usb 3-1: New USB device found, idVendor=04d9, idProduct=a070, bcdDevice= 0.00 [ 79.205091][ T29] usb 3-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 79.205142][ T29] usb 3-1: config 0 interface 0 has no altsetting 0 [ 79.205172][ T29] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 79.210664][ T29] usb 3-1: config 0 descriptor?? [ 79.262959][ T191] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 79.803067][ T0] NOHZ tick-stop error: local softirq work is pending, handler #142!!! [ 80.103247][ T5942] warning: `syz.3.29' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 80.407713][ T5806] usbhid 4-1:0.0: can't add hid device: -71 [ 80.407816][ T5806] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 80.410354][ T5806] usb 4-1: USB disconnect, device number 3 [ 80.439109][ T30] kauditd_printk_skb: 56 callbacks suppressed [ 80.439124][ T30] audit: type=1400 audit(1792619227.421:293): avc: denied { write } for pid=5941 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 80.471997][ T191] usb 5-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 80.472903][ T191] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 80.472927][ T191] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 80.472950][ T191] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 80.472969][ T191] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 80.473000][ T191] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 80.520291][ T191] usb 5-1: config 0 descriptor?? [ 80.560873][ T5727] usb 1-1: USB disconnect, device number 2 [ 80.648931][ T30] audit: type=1400 audit(1792619227.631:294): avc: denied { create } for pid=5947 comm="syz.0.33" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 80.673116][ T30] audit: type=1400 audit(1792619227.651:295): avc: denied { write } for pid=5947 comm="syz.0.33" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 80.673155][ T30] audit: type=1400 audit(1792619227.651:296): avc: denied { nlmsg_write } for pid=5947 comm="syz.0.33" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 80.680082][ T29] usbhid 3-1:0.0: can't add hid device: -71 [ 80.680150][ T29] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 80.689437][ T30] audit: type=1400 audit(1792619227.671:297): avc: denied { ioctl } for pid=5947 comm="syz.0.33" path="socket:[8896]" dev="sockfs" ino=8896 ioctlcmd=0x587a scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 80.689524][ T29] usb 3-1: USB disconnect, device number 2 [ 80.768514][ T191] hdpvr 5-1:0.0: firmware version 0xa9 dated E\}bÊDLC§îâAôÙ ˆq–Æ‚4;lðÓ¬hÃÏþµÀCD0 [ 80.768534][ T191] hdpvr 5-1:0.0: untested firmware, the driver might not work. [ 80.823653][ T30] audit: type=1400 audit(1792619227.811:298): avc: denied { prog_run } for pid=5947 comm="syz.0.33" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 80.904654][ T30] audit: type=1400 audit(1792619227.881:299): avc: denied { mmap_zero } for pid=5947 comm="syz.0.33" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 80.910362][ T30] audit: type=1400 audit(1792619227.891:300): avc: denied { read write } for pid=5947 comm="syz.0.33" name="fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 80.912063][ T30] audit: type=1400 audit(1792619227.891:301): avc: denied { open } for pid=5947 comm="syz.0.33" path="/dev/fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 80.984187][ T5948] fuse: Unknown parameter 'lroup_id' [ 81.892809][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 82.202142][ T191] hdpvr 5-1:0.0: Could not setup controls [ 82.202647][ T191] hdpvr 5-1:0.0: registering videodev failed [ 82.226378][ T191] hdpvr 5-1:0.0: probe with driver hdpvr failed with error -71 [ 82.231252][ T191] usb 5-1: USB disconnect, device number 3 [ 82.350545][ T30] audit: type=1400 audit(1792619229.331:302): avc: denied { mounton } for pid=5968 comm="syz.2.36" path="/12/file0" dev="tmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 82.426665][ T5971] FAULT_INJECTION: forcing a failure. [ 82.426665][ T5971] name failslab, interval 1, probability 0, space 0, times 0 [ 82.426694][ T5971] CPU: 1 UID: 0 PID: 5971 Comm: syz.2.36 Not tainted syzkaller #0 PREEMPT(full) [ 82.426715][ T5971] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 82.426726][ T5971] Call Trace: [ 82.426732][ T5971] [ 82.426739][ T5971] dump_stack_lvl+0x100/0x190 [ 82.426772][ T5971] should_fail_ex.cold+0x5/0xa [ 82.426798][ T5971] should_failslab+0xc2/0x120 [ 82.426827][ T5971] __kmalloc_flags_noprof+0x122/0x8e0 [ 82.426851][ T5971] ? alloc_slab_obj_exts+0x6a/0x170 [ 82.426877][ T5971] alloc_slab_obj_exts+0x6a/0x170 [ 82.426899][ T5971] __memcg_slab_post_alloc_hook+0x3fc/0x10c0 [ 82.426929][ T5971] ? kasan_save_track+0x14/0x30 [ 82.426955][ T5971] kmem_cache_alloc_noprof+0x4f5/0x6a0 [ 82.426979][ T5971] ? alloc_empty_file+0x5b/0x1c0 [ 82.427003][ T5971] alloc_empty_file+0x5b/0x1c0 [ 82.427023][ T5971] path_openat+0xdb/0x2430 [ 82.427045][ T5971] ? __pfx_path_openat+0x10/0x10 [ 82.427069][ T5971] do_file_open+0x20e/0x430 [ 82.427088][ T5971] ? __pfx_do_file_open+0x10/0x10 [ 82.427120][ T5971] ? _raw_spin_unlock+0x28/0x50 [ 82.427146][ T5971] ? alloc_fd+0x471/0x7a0 [ 82.427171][ T5971] do_sys_openat2+0x163/0x1d0 [ 82.427195][ T5971] ? __pfx_do_sys_openat2+0x10/0x10 [ 82.427214][ T5971] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 82.427235][ T5971] ? __fget_files+0x21f/0x3d0 [ 82.427257][ T5971] __x64_sys_openat+0x12d/0x210 [ 82.427276][ T5971] ? __pfx___x64_sys_openat+0x10/0x10 [ 82.427294][ T5971] ? ksys_write+0x1ac/0x250 [ 82.427327][ T5971] do_syscall_64+0x123/0x790 [ 82.427348][ T5971] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.427367][ T5971] RIP: 0033:0x7f51ce79f559 [ 82.427383][ T5971] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 82.427400][ T5971] RSP: 002b:00007f51cf715028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 82.427418][ T5971] RAX: ffffffffffffffda RBX: 00007f51cea25fa0 RCX: 00007f51ce79f559 [ 82.427429][ T5971] RDX: 0000000000040042 RSI: 0000200000004400 RDI: ffffffffffffff9c [ 82.427441][ T5971] RBP: 00007f51cf715090 R08: 0000000000000000 R09: 0000000000000000 [ 82.427451][ T5971] R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000001 [ 82.427461][ T5971] R13: 00007f51cea26038 R14: 00007f51cea25fa0 R15: 00007fff2a26d0f8 [ 82.427486][ T5971] [ 84.593728][ T191] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 85.653674][ T6014] FAULT_INJECTION: forcing a failure. [ 85.653674][ T6014] name failslab, interval 1, probability 0, space 0, times 0 [ 85.653702][ T6014] CPU: 1 UID: 0 PID: 6014 Comm: syz.1.34 Not tainted syzkaller #0 PREEMPT(full) [ 85.653723][ T6014] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 85.653734][ T6014] Call Trace: [ 85.653740][ T6014] [ 85.653748][ T6014] dump_stack_lvl+0x100/0x190 [ 85.653788][ T6014] should_fail_ex.cold+0x5/0xa [ 85.653815][ T6014] should_failslab+0xc2/0x120 [ 85.653844][ T6014] __kmalloc_cache_noprof+0x91/0x6d0 [ 85.653866][ T6014] ? proc_do_submiturb+0x1d49/0x3820 [ 85.653891][ T6014] proc_do_submiturb+0x1d49/0x3820 [ 85.653927][ T6014] usbdev_ioctl+0x1c39/0x3b40 [ 85.653950][ T6014] ? __pfx_usbdev_ioctl+0x10/0x10 [ 85.653973][ T6014] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 85.653999][ T6014] ? do_vfs_ioctl+0x226/0x13e0 [ 85.654023][ T6014] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 85.654044][ T6014] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x530 [ 85.654066][ T6014] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 85.654089][ T6014] ? __fget_files+0x34/0x3d0 [ 85.654117][ T6014] ? selinux_file_ioctl+0x13b/0x290 [ 85.654133][ T6014] ? selinux_file_ioctl+0xb6/0x290 [ 85.654153][ T6014] ? __pfx_usbdev_ioctl+0x10/0x10 [ 85.654172][ T6014] __x64_sys_ioctl+0x18e/0x210 [ 85.654198][ T6014] do_syscall_64+0x123/0x790 [ 85.654220][ T6014] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.654238][ T6014] RIP: 0033:0x7f680219f559 [ 85.654253][ T6014] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 85.654268][ T6014] RSP: 002b:00007f6802fc2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 85.654284][ T6014] RAX: ffffffffffffffda RBX: 00007f6802426180 RCX: 00007f680219f559 [ 85.654293][ T6014] RDX: 000020000001a980 RSI: 000000008038550a RDI: 0000000000000007 [ 85.654301][ T6014] RBP: 00007f6802fc2090 R08: 0000000000000000 R09: 0000000000000000 [ 85.654310][ T6014] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 85.654318][ T6014] R13: 00007f6802426218 R14: 00007f6802426180 R15: 00007ffd9a5710a8 [ 85.654338][ T6014] [ 85.658657][ T30] kauditd_printk_skb: 18 callbacks suppressed [ 85.658672][ T30] audit: type=1400 audit(1792619232.631:321): avc: denied { write } for pid=6011 comm="syz.1.34" name="001" dev="devtmpfs" ino=741 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 85.658713][ T30] audit: type=1400 audit(1792619232.641:322): avc: denied { bind } for pid=6011 comm="syz.1.34" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 85.817678][ T29] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 85.937177][ T191] usb 4-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 86.006254][ T191] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 86.006282][ T191] usb 4-1: Product: syz [ 86.006295][ T191] usb 4-1: Manufacturer: syz [ 86.006307][ T191] usb 4-1: SerialNumber: syz [ 86.014916][ T191] usb 4-1: config 0 descriptor?? [ 86.097616][ T29] usb 1-1: Using ep0 maxpacket: 32 [ 86.107618][ T29] usb 1-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 86.133513][ T29] usb 1-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 86.133540][ T29] usb 1-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 86.133554][ T29] usb 1-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 86.133569][ T29] usb 1-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 86.184437][ T29] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 86.184461][ T29] usb 1-1: Product: syz [ 86.184474][ T29] usb 1-1: Manufacturer: syz [ 86.184488][ T29] usb 1-1: SerialNumber: syz [ 86.225059][ C1] imon 1-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 86.231065][ T29] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:155.0/input/input7 [ 86.425246][ T6008] netlink: 13 bytes leftover after parsing attributes in process `syz.0.43'. [ 86.448380][ T191] usb 4-1: Firmware: major: 201, minor: 173, hardware type: UNKNOWN (109) [ 86.463145][ T29] imon 1-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 86.463163][ T29] (id 0x00) [ 86.552851][ T29] rc_core: IR keymap rc-imon-pad not found [ 86.552869][ T29] Registered IR keymap rc-empty [ 86.552929][ T29] imon 1-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 86.552945][ T29] imon 1-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 86.649758][ T191] usb 4-1: failed to fetch extended address, random address set [ 86.649810][ T191] usb 4-1: atusb_probe: initialization failed, error = -524 [ 86.650139][ T191] atusb 4-1:0.0: probe with driver atusb failed with error -524 [ 86.658867][ T191] usb 4-1: USB disconnect, device number 4 [ 86.662656][ T5614] udevd[5614]: setting owner of /dev/bus/usb/004/004 to uid=0, gid=0 failed: No such file or directory [ 86.695464][ T29] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:155.0/rc/rc0 [ 86.707726][ T29] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:155.0/rc/rc0/input8 [ 86.726580][ T29] imon 1-1:155.0: iMON device (15c2:ffdc, intf0) on usb<1:3> initialized [ 87.709457][ T10] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 87.800268][ T5726] usb 1-1: USB disconnect, device number 3 [ 87.805215][ T6028] 9pnet_fd: p9_fd_create_unix (6028): problem connecting socket: ./cgroup: -111 [ 87.818705][ T30] audit: type=1400 audit(1792619234.801:323): avc: denied { create } for pid=6027 comm="syz.1.47" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 87.844730][ T30] audit: type=1400 audit(1792619234.831:324): avc: denied { getopt } for pid=6027 comm="syz.1.47" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 87.844771][ T30] audit: type=1400 audit(1792619234.831:325): avc: denied { accept } for pid=6027 comm="syz.1.47" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 88.760789][ T10] usb 3-1: Using ep0 maxpacket: 32 [ 88.768631][ T10] usb 3-1: New USB device found, idVendor=0d46, idProduct=0081, bcdDevice=fc.21 [ 88.779455][ T10] usb 3-1: config 3 has an invalid interface number: 79 but max is 0 [ 88.779481][ T10] usb 3-1: config 3 has an invalid descriptor of length 0, skipping remainder of the config [ 88.779498][ T10] usb 3-1: config 3 has no interface number 0 [ 88.779528][ T10] usb 3-1: config 3 interface 79 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 88.779552][ T10] usb 3-1: config 3 interface 79 has no altsetting 0 [ 88.822229][ T2327] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 88.843479][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 88.843503][ T10] usb 3-1: Product: syz [ 88.843517][ T10] usb 3-1: Manufacturer: syz [ 88.843530][ T10] usb 3-1: SerialNumber: syz [ 89.051298][ T6036] FAULT_INJECTION: forcing a failure. [ 89.051298][ T6036] name failslab, interval 1, probability 0, space 0, times 0 [ 89.051329][ T6036] CPU: 0 UID: 0 PID: 6036 Comm: syz.3.50 Not tainted syzkaller #0 PREEMPT(full) [ 89.051349][ T6036] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 89.051362][ T6036] Call Trace: [ 89.051368][ T6036] [ 89.051375][ T6036] dump_stack_lvl+0x100/0x190 [ 89.051406][ T6036] should_fail_ex.cold+0x5/0xa [ 89.051433][ T6036] should_failslab+0xc2/0x120 [ 89.051462][ T6036] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 89.051488][ T6036] ? __alloc_skb+0x5b7/0x710 [ 89.051508][ T6036] ? __alloc_skb+0x140/0x710 [ 89.051531][ T6036] __alloc_skb+0x140/0x710 [ 89.051549][ T6036] ? __alloc_skb+0x5b7/0x710 [ 89.051569][ T6036] ? __pfx___alloc_skb+0x10/0x10 [ 89.051592][ T6036] netlink_alloc_large_skb+0x69/0x150 [ 89.051610][ T6036] netlink_sendmsg+0x7a2/0x1020 [ 89.051635][ T6036] ? __pfx_netlink_sendmsg+0x10/0x10 [ 89.051660][ T6036] ? selinux_socket_sendmsg+0x198/0x2f0 [ 89.051691][ T6036] ? ____sys_sendmsg+0xa4d/0xbe0 [ 89.051716][ T6036] ____sys_sendmsg+0xa4d/0xbe0 [ 89.051740][ T6036] ? __pfx_netlink_sendmsg+0x10/0x10 [ 89.051762][ T6036] ? __pfx_____sys_sendmsg+0x10/0x10 [ 89.051793][ T6036] ? lock_acquire+0x1d1/0x380 [ 89.051815][ T6036] ? get_pid_task+0x2a/0x250 [ 89.051843][ T6036] ___sys_sendmsg+0x190/0x1e0 [ 89.051870][ T6036] ? __pfx____sys_sendmsg+0x10/0x10 [ 89.051896][ T6036] ? get_pid_task+0x106/0x250 [ 89.051931][ T6036] ? find_held_lock+0x2b/0x80 [ 89.051964][ T6036] __sys_sendmsg+0x160/0x210 [ 89.051985][ T6036] ? __pfx___sys_sendmsg+0x10/0x10 [ 89.052020][ T6036] do_syscall_64+0x123/0x790 [ 89.052041][ T6036] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.052060][ T6036] RIP: 0033:0x7febbf79f559 [ 89.052075][ T6036] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 89.052098][ T6036] RSP: 002b:00007febc068f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 89.052115][ T6036] RAX: ffffffffffffffda RBX: 00007febbfa25fa0 RCX: 00007febbf79f559 [ 89.052127][ T6036] RDX: 0000000000000040 RSI: 0000200000002080 RDI: 0000000000000003 [ 89.052138][ T6036] RBP: 00007febc068f090 R08: 0000000000000000 R09: 0000000000000000 [ 89.052149][ T6036] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 89.052159][ T6036] R13: 00007febbfa26038 R14: 00007febbfa25fa0 R15: 00007ffd98206e28 [ 89.052184][ T6036] [ 89.066516][ T6019] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 89.066817][ T6019] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 89.071412][ T30] audit: type=1400 audit(1792619236.051:326): avc: denied { write } for pid=6018 comm="syz.2.45" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 89.447233][ T2327] usb 5-1: New USB device found, idVendor=0856, idProduct=ac31, bcdDevice=93.1e [ 89.482672][ T2327] usb 5-1: config 0 has too many interfaces: 129, using maximum allowed: 32 [ 89.482696][ T2327] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 129 [ 89.575906][ T2327] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.575932][ T2327] usb 5-1: Product: syz [ 89.575946][ T2327] usb 5-1: Manufacturer: syz [ 89.575960][ T2327] usb 5-1: SerialNumber: syz [ 89.687872][ T6042] FAULT_INJECTION: forcing a failure. [ 89.687872][ T6042] name failslab, interval 1, probability 0, space 0, times 0 [ 89.687897][ T6042] CPU: 1 UID: 0 PID: 6042 Comm: syz.3.51 Not tainted syzkaller #0 PREEMPT(full) [ 89.687915][ T6042] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 89.687924][ T6042] Call Trace: [ 89.687930][ T6042] [ 89.687936][ T6042] dump_stack_lvl+0x100/0x190 [ 89.687964][ T6042] should_fail_ex.cold+0x5/0xa [ 89.687989][ T6042] should_failslab+0xc2/0x120 [ 89.688014][ T6042] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 89.688037][ T6042] ? alloc_vmap_area+0x1829/0x2bc0 [ 89.688063][ T6042] alloc_vmap_area+0x1829/0x2bc0 [ 89.688092][ T6042] ? kasan_save_track+0x14/0x30 [ 89.688120][ T6042] ? __kasan_kmalloc+0xaa/0xb0 [ 89.688141][ T6042] ? __pfx_alloc_vmap_area+0x10/0x10 [ 89.688165][ T6042] ? __get_vm_area_node+0x124/0x350 [ 89.688191][ T6042] __get_vm_area_node+0x1ed/0x350 [ 89.688218][ T6042] __vmalloc_node_range_noprof+0x268/0x1420 [ 89.688234][ T6042] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 89.688260][ T6042] ? up_write+0x2dc/0x5b0 [ 89.688285][ T6042] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 89.688307][ T6042] ? lock_acquire+0x1d1/0x380 [ 89.688327][ T6042] ? find_held_lock+0x2b/0x80 [ 89.688342][ T6042] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 89.688357][ T6042] ? avc_has_perm_noaudit+0x11e/0x470 [ 89.688381][ T6042] ? avc_has_perm_noaudit+0x145/0x470 [ 89.688401][ T6042] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 89.688423][ T6042] __vmalloc_node_noprof+0xad/0xf0 [ 89.688438][ T6042] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 89.688463][ T6042] __vmalloc_noprof+0xa3/0x120 [ 89.688478][ T6042] ? __pfx___vmalloc_noprof+0x10/0x10 [ 89.688496][ T6042] ? rcu_is_watching+0x13/0xc0 [ 89.688519][ T6042] ? cap_capable+0x107/0x430 [ 89.688542][ T6042] bpf_prog_alloc_no_stats+0x59/0x690 [ 89.688564][ T6042] ? security_capable+0x80/0x260 [ 89.688586][ T6042] bpf_prog_alloc+0x3b/0x200 [ 89.688606][ T6042] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 89.688629][ T6042] bpf_prog_load+0x49e/0x2ab0 [ 89.688657][ T6042] ? __pfx_bpf_prog_load+0x10/0x10 [ 89.688700][ T6042] __sys_bpf+0x1f46/0x4a30 [ 89.688724][ T6042] ? __pfx___sys_bpf+0x10/0x10 [ 89.688742][ T6042] ? find_held_lock+0x2b/0x80 [ 89.688756][ T6042] ? get_pid_task+0xfc/0x250 [ 89.688777][ T6042] ? get_pid_task+0xfc/0x250 [ 89.688806][ T6042] ? find_held_lock+0x2b/0x80 [ 89.688825][ T6042] ? rcu_read_lock_any_held+0x6a/0x90 [ 89.688841][ T6042] ? find_held_lock+0x2b/0x80 [ 89.688855][ T6042] ? ksys_write+0x190/0x250 [ 89.688875][ T6042] ? ksys_write+0x190/0x250 [ 89.688894][ T6042] ? lock_acquire+0x1d1/0x380 [ 89.688927][ T6042] ? fput+0x7c/0x100 [ 89.688942][ T6042] ? ksys_write+0x1ac/0x250 [ 89.688964][ T6042] ? __x64_sys_bpf+0xce/0x140 [ 89.688981][ T6042] __x64_sys_bpf+0xce/0x140 [ 89.689001][ T6042] ? do_syscall_64+0xae/0x790 [ 89.689017][ T6042] do_syscall_64+0x123/0x790 [ 89.689035][ T6042] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.689051][ T6042] RIP: 0033:0x7febbf79f559 [ 89.689065][ T6042] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 89.689079][ T6042] RSP: 002b:00007febc064d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 89.689094][ T6042] RAX: ffffffffffffffda RBX: 00007febbfa26180 RCX: 00007febbf79f559 [ 89.689104][ T6042] RDX: 0000000000000048 RSI: 0000200000001300 RDI: 0000000000000005 [ 89.689118][ T6042] RBP: 00007febc064d090 R08: 0000000000000000 R09: 0000000000000000 [ 89.689127][ T6042] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 89.689136][ T6042] R13: 00007febbfa26218 R14: 00007febbfa26180 R15: 00007ffd98206e28 [ 89.689158][ T6042] [ 90.113823][ T2327] usb 5-1: config 0 descriptor?? [ 90.114246][ T2327] usb 5-1: can't set config #0, error -71 [ 90.118056][ T2327] usb 5-1: USB disconnect, device number 4 [ 90.156544][ T30] audit: type=1400 audit(1792619237.061:327): avc: denied { unmount } for pid=5609 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 90.561023][ T10] kobil_sct 3-1:3.79: required endpoints missing [ 90.579786][ T10] usb 3-1: USB disconnect, device number 3 [ 90.594422][ T6047] netlink: 12 bytes leftover after parsing attributes in process `syz.3.54'. [ 90.594738][ T6047] netlink: Unknown conntrack attr (0) [ 90.635979][ T30] audit: type=1400 audit(1792619237.621:328): avc: denied { setopt } for pid=6046 comm="syz.1.49" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 91.689471][ T30] audit: type=1400 audit(1792619238.671:329): avc: denied { name_connect } for pid=6058 comm="syz.3.56" dest=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 91.786709][ T30] audit: type=1400 audit(1792619238.771:330): avc: denied { append } for pid=6043 comm="syz.0.52" name="dlm-control" dev="devtmpfs" ino=94 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 92.603124][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 92.736275][ T30] audit: type=1400 audit(1792619238.991:331): avc: denied { create } for pid=6065 comm="syz.3.59" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 92.794996][ T10] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 92.953767][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 92.954501][ T10] usb 2-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 92.955612][ T10] usb 2-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 92.955679][ T10] usb 2-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 92.955702][ T10] usb 2-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 92.955727][ T10] usb 2-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 92.957479][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 92.957500][ T10] usb 2-1: Product: syz [ 92.957515][ T10] usb 2-1: Manufacturer: syz [ 92.957529][ T10] usb 2-1: SerialNumber: syz [ 93.062899][ C0] imon 2-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 93.072246][ T10] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:155.0/input/input9 [ 93.457495][ T6061] netlink: 13 bytes leftover after parsing attributes in process `syz.1.58'. [ 93.618592][ T6074] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 93.648225][ T6074] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=6074 comm=syz.4.61 [ 93.680210][ T30] audit: type=1400 audit(1792619240.661:332): avc: denied { create } for pid=6073 comm="syz.4.61" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 93.705670][ T30] audit: type=1400 audit(1792619240.691:333): avc: denied { ioctl } for pid=6073 comm="syz.4.61" path="socket:[9053]" dev="sockfs" ino=9053 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 94.115172][ T5806] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 94.143379][ T10] imon 2-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 94.143398][ T10] (id 0x00) [ 94.273822][ T5806] usb 5-1: New USB device found, idVendor=0552, idProduct=5510, bcdDevice= 0.00 [ 94.278780][ T5806] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 94.278801][ T5806] usb 5-1: Product: syz [ 94.278810][ T5806] usb 5-1: Manufacturer: syz [ 94.302868][ T10] rc_core: IR keymap rc-imon-pad not found [ 94.302884][ T10] Registered IR keymap rc-empty [ 94.302941][ T10] imon 2-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 94.302957][ T10] imon 2-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 94.366138][ T10] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:155.0/rc/rc0 [ 94.380710][ T10] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:155.0/rc/rc0/input10 [ 94.401279][ T10] imon 2-1:155.0: iMON device (15c2:ffdc, intf0) on usb<2:5> initialized [ 94.491863][ T6087] FAULT_INJECTION: forcing a failure. [ 94.491863][ T6087] name failslab, interval 1, probability 0, space 0, times 0 [ 94.491922][ T6087] CPU: 1 UID: 0 PID: 6087 Comm: syz.2.57 Not tainted syzkaller #0 PREEMPT(full) [ 94.491946][ T6087] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 94.491957][ T6087] Call Trace: [ 94.491963][ T6087] [ 94.491971][ T6087] dump_stack_lvl+0x100/0x190 [ 94.492003][ T6087] should_fail_ex.cold+0x5/0xa [ 94.492030][ T6087] should_failslab+0xc2/0x120 [ 94.492059][ T6087] kmem_cache_alloc_noprof+0x92/0x6a0 [ 94.492086][ T6087] ? security_file_alloc+0x34/0x2c0 [ 94.492111][ T6087] security_file_alloc+0x34/0x2c0 [ 94.492130][ T6087] init_file+0x95/0x480 [ 94.492149][ T6087] alloc_empty_file+0x79/0x1c0 [ 94.492169][ T6087] path_openat+0xdb/0x2430 [ 94.492190][ T6087] ? __pfx_path_openat+0x10/0x10 [ 94.492215][ T6087] do_file_open+0x20e/0x430 [ 94.492234][ T6087] ? __pfx_do_file_open+0x10/0x10 [ 94.492250][ T6087] ? lockdep_hardirqs_on+0x7d/0x110 [ 94.492285][ T6087] ? _raw_spin_unlock+0x28/0x50 [ 94.492310][ T6087] ? alloc_fd+0x471/0x7a0 [ 94.492335][ T6087] do_sys_openat2+0x163/0x1d0 [ 94.492355][ T6087] ? __pfx_do_sys_openat2+0x10/0x10 [ 94.492383][ T6087] __x64_sys_openat+0x12d/0x210 [ 94.492402][ T6087] ? __pfx___x64_sys_openat+0x10/0x10 [ 94.492421][ T6087] ? ksys_write+0x1ac/0x250 [ 94.492453][ T6087] do_syscall_64+0x123/0x790 [ 94.492474][ T6087] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.492493][ T6087] RIP: 0033:0x7f51ce79f559 [ 94.492509][ T6087] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.492530][ T6087] RSP: 002b:00007f51cf6f4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 94.492548][ T6087] RAX: ffffffffffffffda RBX: 00007f51cea26090 RCX: 00007f51ce79f559 [ 94.492560][ T6087] RDX: 0000000000000002 RSI: 00002000000001c0 RDI: ffffffffffffff9c [ 94.492571][ T6087] RBP: 00007f51cf6f4090 R08: 0000000000000000 R09: 0000000000000000 [ 94.492582][ T6087] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 94.492592][ T6087] R13: 00007f51cea26128 R14: 00007f51cea26090 R15: 00007fff2a26d0f8 [ 94.492617][ T6087] [ 95.325437][ T29] usb 2-1: USB disconnect, device number 5 [ 95.362850][ T30] audit: type=1400 audit(1792619242.341:334): avc: denied { mount } for pid=6085 comm="syz.0.62" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 95.507566][ T5806] scsi host1: uas [ 95.982905][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 96.416401][ T5727] usb 1-1: new low-speed USB device number 4 using dummy_hcd [ 96.419138][ T6092] netlink: 'syz.2.63': attribute type 21 has an invalid length. [ 96.419155][ T6092] netlink: 128 bytes leftover after parsing attributes in process `syz.2.63'. [ 96.419241][ T6092] netlink: 'syz.2.63': attribute type 4 has an invalid length. [ 96.419254][ T6092] netlink: 3 bytes leftover after parsing attributes in process `syz.2.63'. [ 96.448333][ C1] usb 5-1: stat urb: status -71 [ 96.448480][ C1] usb 5-1: cmd cmplt err -71 [ 96.448581][ T5806] usb 5-1: USB disconnect, device number 5 [ 96.476486][ T5806] scsi 1:0:0:0: tag#20 uas_zap_pending 0 uas-tag 1 inflight: CMD [ 96.476544][ T5806] scsi 1:0:0:0: tag#20 CDB: Inquiry 12 00 00 00 24 00 [ 96.566771][ T5727] usb 1-1: unable to get BOS descriptor or descriptor too short [ 96.566798][ T5727] usb 1-1: New USB device found, idVendor=6737, idProduct=0001, bcdDevice=91.80 [ 96.571642][ T5727] usb 1-1: config 142 has an invalid interface number: 251 but max is 0 [ 96.571657][ T5727] usb 1-1: config 142 has no interface number 0 [ 96.571676][ T5727] usb 1-1: config 142 interface 251 altsetting 11 has an endpoint descriptor with address 0x9F, changing to 0x8F [ 96.571690][ T5727] usb 1-1: config 142 interface 251 altsetting 11 endpoint 0x8F is Bulk; changing to Interrupt [ 96.571703][ T5727] usb 1-1: config 142 interface 251 altsetting 11 endpoint 0x1 is Bulk; changing to Interrupt [ 96.571716][ T5727] usb 1-1: config 142 interface 251 has no altsetting 0 [ 96.575708][ T5727] usb 1-1: string descriptor 0 read error: -22 [ 96.575796][ T5727] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 96.592064][ T6090] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 96.592182][ T6090] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 96.603246][ T5727] cypress_m8 1-1:142.251: HID->COM RS232 Adapter converter detected [ 96.646548][ T5727] usb 1-1: HID->COM RS232 Adapter converter now attached to ttyUSB0 [ 97.410113][ T30] audit: type=1400 audit(1792619244.391:335): avc: denied { write } for pid=6075 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 98.081442][ T30] audit: type=1400 audit(1792619245.061:336): avc: denied { write } for pid=6109 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 98.362284][ T30] audit: type=1400 audit(1792619245.341:337): avc: denied { write } for pid=6120 comm="syz.4.68" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 98.440726][ T10] usb 1-1: USB disconnect, device number 4 [ 98.450701][ T30] audit: type=1400 audit(1792619245.431:338): avc: denied { unmount } for pid=5609 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 98.452096][ T10] cyphidcom ttyUSB0: HID->COM RS232 Adapter converter now disconnected from ttyUSB0 [ 98.452411][ T10] cypress_m8 1-1:142.251: device disconnected [ 98.708853][ T30] audit: type=1400 audit(1792619245.691:339): avc: denied { open } for pid=6131 comm="syz.4.70" path="/dev/ptyqc" dev="devtmpfs" ino=131 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 98.709240][ T30] audit: type=1400 audit(1792619245.691:340): avc: denied { ioctl } for pid=6131 comm="syz.4.70" path="/dev/ptyqc" dev="devtmpfs" ino=131 ioctlcmd=0x5414 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 98.776475][ T6136] FAULT_INJECTION: forcing a failure. [ 98.776475][ T6136] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 98.776533][ T6136] CPU: 0 UID: 0 PID: 6136 Comm: syz.4.70 Not tainted syzkaller #0 PREEMPT(full) [ 98.776553][ T6136] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 98.776564][ T6136] Call Trace: [ 98.776571][ T6136] [ 98.776578][ T6136] dump_stack_lvl+0x100/0x190 [ 98.776614][ T6136] should_fail_ex.cold+0x5/0xa [ 98.776642][ T6136] _copy_from_iter+0x43a/0x1690 [ 98.776667][ T6136] ? __pfx__copy_from_iter+0x10/0x10 [ 98.776684][ T6136] ? __pfx___alloc_skb+0x10/0x10 [ 98.776715][ T6136] netlink_sendmsg+0x94a/0x1020 [ 98.776742][ T6136] ? __pfx_netlink_sendmsg+0x10/0x10 [ 98.776769][ T6136] ? selinux_socket_sendmsg+0x198/0x2f0 [ 98.776801][ T6136] ? ____sys_sendmsg+0xa4d/0xbe0 [ 98.776827][ T6136] ____sys_sendmsg+0xa4d/0xbe0 [ 98.776851][ T6136] ? __pfx_netlink_sendmsg+0x10/0x10 [ 98.776874][ T6136] ? __pfx_____sys_sendmsg+0x10/0x10 [ 98.776907][ T6136] ? get_pid_task+0x2a/0x250 [ 98.776936][ T6136] ___sys_sendmsg+0x190/0x1e0 [ 98.776965][ T6136] ? __pfx____sys_sendmsg+0x10/0x10 [ 98.776992][ T6136] ? preempt_schedule_irq+0x79/0x90 [ 98.777031][ T6136] ? find_held_lock+0x2b/0x80 [ 98.777065][ T6136] __sys_sendmsg+0x160/0x210 [ 98.777088][ T6136] ? __pfx___sys_sendmsg+0x10/0x10 [ 98.777124][ T6136] do_syscall_64+0x123/0x790 [ 98.777145][ T6136] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.777164][ T6136] RIP: 0033:0x7ff14d39f559 [ 98.777181][ T6136] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 98.777198][ T6136] RSP: 002b:00007ff14e19f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 98.777217][ T6136] RAX: ffffffffffffffda RBX: 00007ff14d626090 RCX: 00007ff14d39f559 [ 98.777229][ T6136] RDX: 0000000004000000 RSI: 00002000000000c0 RDI: 0000000000000008 [ 98.777240][ T6136] RBP: 00007ff14e19f090 R08: 0000000000000000 R09: 0000000000000000 [ 98.777251][ T6136] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 98.777261][ T6136] R13: 00007ff14d626128 R14: 00007ff14d626090 R15: 00007ffe509bccc8 [ 98.777286][ T6136] [ 99.580399][ T30] audit: type=1400 audit(1792619246.531:341): avc: denied { read write } for pid=6128 comm="syz.0.69" name="nullb0" dev="devtmpfs" ino=694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 99.580448][ T30] audit: type=1400 audit(1792619246.531:342): avc: denied { open } for pid=6128 comm="syz.0.69" path="/dev/nullb0" dev="devtmpfs" ino=694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 99.607084][ T6137] FAULT_INJECTION: forcing a failure. [ 99.607084][ T6137] name failslab, interval 1, probability 0, space 0, times 0 [ 99.607113][ T6137] CPU: 0 UID: 0 PID: 6137 Comm: syz.0.69 Not tainted syzkaller #0 PREEMPT(full) [ 99.607128][ T6137] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 99.607135][ T6137] Call Trace: [ 99.607140][ T6137] [ 99.607144][ T6137] dump_stack_lvl+0x100/0x190 [ 99.607166][ T6137] should_fail_ex.cold+0x5/0xa [ 99.607182][ T6137] should_failslab+0xc2/0x120 [ 99.607201][ T6137] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 99.607220][ T6137] ? __do_sys_fsconfig+0x834/0xcb0 [ 99.607244][ T6137] ? smb3_parse_devname+0xfd/0x500 [ 99.607269][ T6137] kstrndup+0x64/0x120 [ 99.607291][ T6137] smb3_parse_devname+0xfd/0x500 [ 99.607305][ T6137] smb3_fs_context_parse_param+0x3f02/0x7740 [ 99.607320][ T6137] ? __pfx_smb3_fs_context_parse_param+0x10/0x10 [ 99.607335][ T6137] ? __pfx_selinux_fs_context_parse_param+0x10/0x10 [ 99.607359][ T6137] ? __pfx_smb3_fs_context_parse_param+0x10/0x10 [ 99.607371][ T6137] ? vfs_parse_fs_param+0x200/0x3b0 [ 99.607384][ T6137] vfs_parse_fs_param+0x200/0x3b0 [ 99.607398][ T6137] __do_sys_fsconfig+0x617/0xcb0 [ 99.607414][ T6137] ? __pfx___do_sys_fsconfig+0x10/0x10 [ 99.607436][ T6137] do_syscall_64+0x123/0x790 [ 99.607449][ T6137] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.607461][ T6137] RIP: 0033:0x7f8c9359f559 [ 99.607472][ T6137] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 99.607482][ T6137] RSP: 002b:00007f8c94435028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 99.607494][ T6137] RAX: ffffffffffffffda RBX: 00007f8c93826180 RCX: 00007f8c9359f559 [ 99.607501][ T6137] RDX: 00002000000006c0 RSI: 0000000000000001 RDI: 0000000000000009 [ 99.607507][ T6137] RBP: 00007f8c93636b20 R08: 0000000000000000 R09: 0000000000000000 [ 99.607514][ T6137] R10: 0000200000000b00 R11: 0000000000000246 R12: 0000000000000000 [ 99.607520][ T6137] R13: 00007f8c93826218 R14: 00007f8c93826180 R15: 00007ffcc59e2478 [ 99.607540][ T6137] [ 99.607654][ T6137] CIFS: VFS: Unable to allocate memory for devname [ 100.537816][ T30] audit: type=1400 audit(1792619247.521:343): avc: denied { write } for pid=6119 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 100.739298][ T30] audit: type=1400 audit(1792619247.721:344): avc: denied { write } for pid=6148 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 102.347245][ T6150] netlink: 8 bytes leftover after parsing attributes in process `syz.2.73'. [ 102.833156][ T5705] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 102.982843][ T5705] usb 1-1: Using ep0 maxpacket: 16 [ 102.983429][ T5705] usb 1-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 102.984332][ T5705] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 102.984357][ T5705] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 102.984370][ T5705] usb 1-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 28 [ 102.984384][ T5705] usb 1-1: config 0 interface 0 has no altsetting 0 [ 102.984405][ T5705] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.985660][ T5705] usb 1-1: config 0 descriptor?? [ 103.620380][ T6174] netlink: 34 bytes leftover after parsing attributes in process `syz.3.71'. [ 104.252430][ T6180] binder: 6177:6180 ioctl 40087602 200000000580 returned -22 [ 104.252870][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 104.252911][ T30] audit: type=1400 audit(1792619251.231:350): avc: denied { setattr } for pid=6177 comm="syz.4.77" path="/newroot/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 104.262527][ T6180] SELinux: Context system_u:object_r:hwdata_t:s0 is not valid (left unmapped). [ 104.297165][ T30] audit: type=1400 audit(1792619251.251:351): avc: denied { relabelto } for pid=6177 comm="syz.4.77" name="16" dev="tmpfs" ino=103 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:hwdata_t:s0" [ 104.302866][ T10] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 104.308258][ T30] audit: type=1400 audit(1792619251.291:352): avc: denied { associate } for pid=6177 comm="syz.4.77" name="16" dev="tmpfs" ino=103 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:hwdata_t:s0" [ 104.453297][ T10] usb 4-1: New USB device found, idVendor=0856, idProduct=ac31, bcdDevice=93.1e [ 104.454117][ T10] usb 4-1: config 0 has too many interfaces: 129, using maximum allowed: 32 [ 104.454132][ T10] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 129 [ 104.455851][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 104.455865][ T10] usb 4-1: Product: syz [ 104.455887][ T10] usb 4-1: Manufacturer: syz [ 104.455895][ T10] usb 4-1: SerialNumber: syz [ 104.464727][ T10] usb 4-1: config 0 descriptor?? [ 105.403155][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 105.676485][ T10] mos7840 4-1:0.0: required endpoints missing [ 105.678095][ T10] usb 4-1: USB disconnect, device number 5 [ 105.741953][ T5705] usbhid 1-1:0.0: can't add hid device: -71 [ 105.742037][ T5705] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 106.142580][ T5705] usb 1-1: USB disconnect, device number 5 [ 106.148893][ T30] audit: type=1400 audit(1792619253.121:353): avc: denied { unmount } for pid=5596 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 107.734449][ T12] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.862939][ T5806] usb 3-1: new low-speed USB device number 4 using dummy_hcd [ 107.885741][ T12] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 108.005606][ T12] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 108.025219][ T5806] usb 3-1: unable to get BOS descriptor or descriptor too short [ 108.025259][ T5806] usb 3-1: New USB device found, idVendor=6737, idProduct=0001, bcdDevice=91.80 [ 108.027967][ T5806] usb 3-1: config 142 has an invalid interface number: 251 but max is 0 [ 108.027990][ T5806] usb 3-1: config 142 has no interface number 0 [ 108.028023][ T5806] usb 3-1: config 142 interface 251 altsetting 11 has an endpoint descriptor with address 0x9F, changing to 0x8F [ 108.028050][ T5806] usb 3-1: config 142 interface 251 altsetting 11 endpoint 0x8F is Bulk; changing to Interrupt [ 108.028072][ T5806] usb 3-1: config 142 interface 251 altsetting 11 endpoint 0x1 is Bulk; changing to Interrupt [ 108.028093][ T5806] usb 3-1: config 142 interface 251 has no altsetting 0 [ 108.032432][ T5806] usb 3-1: string descriptor 0 read error: -22 [ 108.032509][ T5806] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 108.128950][ T6190] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 108.129042][ T6190] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 108.145683][ T5806] cypress_m8 3-1:142.251: HID->COM RS232 Adapter converter detected [ 108.148952][ T5806] usb 3-1: HID->COM RS232 Adapter converter now attached to ttyUSB0 [ 108.151710][ T12] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 108.255141][ T30] audit: type=1400 audit(1792619255.241:354): avc: denied { create } for pid=6191 comm="syz.1.80" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 108.256086][ T30] audit: type=1400 audit(1792619255.241:355): avc: denied { setopt } for pid=6191 comm="syz.1.80" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 108.333223][ T5865] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 108.392967][ T5858] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 108.438433][ T5858] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 108.487615][ T5865] netdevsim netdevsim4 eth4: set [0, 0] type 1 family 0 port 8472 - 0 [ 108.501857][ T1740] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 108.518322][ T12] bridge_slave_1: left allmulticast mode [ 108.518374][ T12] bridge_slave_1: left promiscuous mode [ 108.519579][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 108.555034][ T12] bridge_slave_0: left allmulticast mode [ 108.555059][ T12] bridge_slave_0: left promiscuous mode [ 108.555274][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 108.664995][ T1740] usb 2-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice= 1.00 [ 108.666629][ T1740] usb 2-1: config 1 interface 0 altsetting 1 has an endpoint descriptor with address 0x93, changing to 0x83 [ 108.666657][ T1740] usb 2-1: config 1 interface 0 altsetting 1 endpoint 0x83 has invalid wMaxPacketSize 0 [ 108.674114][ T1740] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 108.674137][ T1740] usb 2-1: Product: syz [ 108.674151][ T1740] usb 2-1: Manufacturer: syz [ 108.674164][ T1740] usb 2-1: SerialNumber: syz [ 108.741021][ T1740] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 108.741072][ T1740] usb 2-1: setting power ON [ 108.844702][ T6190] cyphidcom ttyUSB0: cypress_serial_control - failed sending serial line settings - -32 [ 108.844728][ T6190] cyphidcom ttyUSB0: cypress_m8 suspending failing port 0 - interval might be too short [ 108.844957][ C1] usb 3-1: cypress_read_int_callback - unexpected nonzero read status received: -71 [ 109.071620][ T5598] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 109.083355][ T5598] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 109.097096][ T5598] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 109.141097][ T6215] usb usb8: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 109.147760][ T30] audit: type=1400 audit(1792619256.121:356): avc: denied { write } for pid=6202 comm="syz.0.82" name="001" dev="devtmpfs" ino=741 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 109.184207][ T5598] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 109.275886][ T5598] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 109.374504][ T30] audit: type=1400 audit(1792619256.351:357): avc: denied { mounton } for pid=6210 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 109.642792][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 109.692798][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 109.742802][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 109.903162][ T6221] netlink: 8 bytes leftover after parsing attributes in process `syz.0.86'. [ 110.599943][ T30] audit: type=1400 audit(1792619256.881:358): avc: denied { create } for pid=6218 comm="syz.0.86" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 110.600008][ T30] audit: type=1400 audit(1792619256.881:359): avc: denied { write } for pid=6218 comm="syz.0.86" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 110.600040][ T30] audit: type=1400 audit(1792619256.881:360): avc: denied { read } for pid=6218 comm="syz.0.86" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 110.600071][ T30] audit: type=1400 audit(1792619256.951:361): avc: denied { ioctl } for pid=6218 comm="syz.0.86" path="socket:[10023]" dev="sockfs" ino=10023 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 110.672957][ T2327] usb 3-1: USB disconnect, device number 4 [ 110.719139][ T30] audit: type=1400 audit(1792619257.701:362): avc: denied { write } for pid=6195 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 110.824239][ T2327] cyphidcom ttyUSB0: HID->COM RS232 Adapter converter now disconnected from ttyUSB0 [ 110.824706][ T2327] cypress_m8 3-1:142.251: device disconnected [ 110.858440][ T1740] dvb-usb: bulk message failed: -110 (2/0) [ 110.860884][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 110.862238][ T1740] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 110.862744][ T1740] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 110.877897][ T1740] usb 2-1: media controller created [ 110.915690][ T1740] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 110.939722][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 110.953290][ T1740] usb 2-1: selecting invalid altsetting 6 [ 110.953311][ T1740] usb 2-1: digital interface selection failed (-22) [ 110.953325][ T1740] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 110.954159][ T1740] usb 2-1: setting power OFF [ 110.954917][ T1740] dvb-usb: bulk message failed: -71 (2/0) [ 110.954935][ T1740] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 110.954944][ T1740] (NULL device *): no iso interface [ 110.961721][ T12] bond0 (unregistering): Released all slaves [ 110.982854][ T30] audit: type=1326 audit(1792619257.961:363): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6228 comm="syz.2.87" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f51ce79f559 code=0x7ffc0000 [ 110.982895][ T30] audit: type=1326 audit(1792619257.961:364): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6228 comm="syz.2.87" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f51ce79f559 code=0x7ffc0000 [ 110.982926][ T30] audit: type=1326 audit(1792619257.961:365): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6228 comm="syz.2.87" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f51ce79f559 code=0x7ffc0000 [ 110.982957][ T30] audit: type=1326 audit(1792619257.961:366): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6228 comm="syz.2.87" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f51ce79f559 code=0x7ffc0000 [ 111.147188][ T1740] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 111.163130][ T1740] usb 2-1: USB disconnect, device number 6 [ 111.164784][ T6223] team0: No ports can be present during mode change [ 111.164970][ T6224] vlan0: entered promiscuous mode [ 111.169561][ T6224] team0: Port device vlan0 added [ 111.172056][ T6225] tipc: Started in network mode [ 111.172070][ T6225] tipc: Node identity aaaaaaaaaa1a, cluster identity 4711 [ 111.172147][ T6225] tipc: Enabled bearer , priority 0 [ 111.312899][ T4917] Bluetooth: hci0: command tx timeout [ 111.778320][ T6234] netlink: 44 bytes leftover after parsing attributes in process `syz.2.87'. [ 111.927563][ T5262] 8021q: adding VLAN 0 to HW filter on device eth1 [ 112.164320][ T2327] tipc: Node number set to 11578026 [ 112.208679][ T6210] rxe_eth0 speed is unknown, defaulting to 1000 [ 112.298986][ T6247] binder: 6245:6247 ioctl 40087602 200000000580 returned -22 [ 113.403605][ T4917] Bluetooth: hci0: command tx timeout [ 114.601719][ T30] kauditd_printk_skb: 188 callbacks suppressed [ 114.601737][ T30] audit: type=1400 audit(1792619261.581:555): avc: denied { read } for pid=6250 comm="sed" name="eth0.dhcp" dev="tmpfs" ino=1805 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 114.601776][ T30] audit: type=1400 audit(1792619261.581:556): avc: denied { open } for pid=6250 comm="sed" path="/run/dhcpcd/hook-state/resolv.conf/eth0.dhcp" dev="tmpfs" ino=1805 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 114.601813][ T30] audit: type=1400 audit(1792619261.581:557): avc: denied { getattr } for pid=6250 comm="sed" path="/run/dhcpcd/hook-state/resolv.conf/eth0.dhcp" dev="tmpfs" ino=1805 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 114.874430][ T30] audit: type=1400 audit(1792619261.861:558): avc: denied { write } for pid=6241 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 114.874478][ T30] audit: type=1400 audit(1792619261.861:559): avc: denied { create } for pid=6241 comm="dhcpcd-run-hook" name="resolv.conf.eth2.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 114.874529][ T30] audit: type=1400 audit(1792619261.861:560): avc: denied { write } for pid=6241 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf.eth2.link" dev="tmpfs" ino=2102 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 114.877128][ T30] audit: type=1400 audit(1792619261.861:561): avc: denied { append } for pid=6241 comm="dhcpcd-run-hook" name="resolv.conf.eth2.link" dev="tmpfs" ino=2102 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 115.143369][ T30] audit: type=1400 audit(1792619262.131:562): avc: denied { write } for pid=6263 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 115.146044][ T30] audit: type=1400 audit(1792619262.131:563): avc: denied { unlink } for pid=6263 comm="rm" name="resolv.conf.eth2.link" dev="tmpfs" ino=2102 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 115.345879][ T12] hsr_slave_0: left promiscuous mode [ 115.372003][ T12] hsr_slave_1: left promiscuous mode [ 115.373224][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 115.373260][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 115.401630][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 115.401649][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 116.195948][ T4917] Bluetooth: hci0: command tx timeout [ 116.196043][ T30] audit: type=1400 audit(1792619262.481:564): avc: denied { append } for pid=6266 comm="syz.2.93" name="001" dev="devtmpfs" ino=738 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 116.236733][ T12] veth1_macvtap: left promiscuous mode [ 116.236770][ T12] veth0_macvtap: left promiscuous mode [ 116.236820][ T12] veth1_vlan: left promiscuous mode [ 116.443185][ T5790] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 116.447272][ T6278] syz.0.88 uses obsolete (PF_INET,SOCK_PACKET) [ 116.594074][ T5790] usb 3-1: New USB device found, idVendor=1781, idProduct=0938, bcdDevice=9b.49 [ 116.595120][ T5790] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE8, changing to 0x88 [ 116.595147][ T5790] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 116.595171][ T5790] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xA has an invalid bInterval 0, changing to 7 [ 116.597180][ T5790] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 116.597200][ T5790] usb 3-1: Product: syz [ 116.597213][ T5790] usb 3-1: Manufacturer: syz [ 116.597226][ T5790] usb 3-1: SerialNumber: syz [ 116.601084][ T5790] usb 3-1: config 0 descriptor?? [ 116.647594][ T12] team0 (unregistering): Port device team_slave_1 removed [ 116.680152][ T12] team0 (unregistering): Port device team_slave_0 removed [ 117.219900][ T6282] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 118.096234][ T6285] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 118.132277][ T5598] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 118.134133][ T5598] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 118.134727][ T5598] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 118.135533][ T5598] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 118.136040][ T5598] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 118.222812][ T5262] 8021q: adding VLAN 0 to HW filter on device eth2 [ 118.274603][ T4917] Bluetooth: hci0: command tx timeout [ 118.393969][ T29] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 118.553727][ T29] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 118.555013][ T29] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 118.555093][ T29] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 118.555110][ T29] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 118.555146][ T29] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 118.555170][ T29] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 118.556902][ T29] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 118.556919][ T29] usb 1-1: Product: syz [ 118.556971][ T29] usb 1-1: Manufacturer: syz [ 118.567588][ T29] cdc_wdm 1-1:1.0: skipping garbage [ 118.567602][ T29] cdc_wdm 1-1:1.0: skipping garbage [ 118.585037][ T29] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 118.585054][ T29] cdc_wdm 1-1:1.0: Unknown control protocol [ 118.747516][ T6210] bridge0: port 1(bridge_slave_0) entered blocking state [ 118.747645][ T6210] bridge0: port 1(bridge_slave_0) entered disabled state [ 118.747788][ T6210] bridge_slave_0: entered allmulticast mode [ 118.749112][ T6210] bridge_slave_0: entered promiscuous mode [ 118.778445][ T6210] bridge0: port 2(bridge_slave_1) entered blocking state [ 118.778538][ T6210] bridge0: port 2(bridge_slave_1) entered disabled state [ 118.778622][ T6210] bridge_slave_1: entered allmulticast mode [ 118.779791][ T6210] bridge_slave_1: entered promiscuous mode [ 118.828650][ T6210] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 118.831379][ T6210] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 118.948122][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 118.948215][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 118.948279][ T10] usb 1-1: USB disconnect, device number 6 [ 118.948745][ C1] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 118.948765][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 118.948780][ C1] cdc_wdm 1-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 118.953670][ T5861] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.044726][ T6210] team0: Port device team_slave_0 added [ 119.050009][ T6210] team0: Port device team_slave_1 added [ 119.139819][ T6210] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 119.139871][ T6210] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 119.139884][ T6210] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 119.140139][ T6286] rxe_eth0 speed is unknown, defaulting to 1000 [ 119.237163][ T5861] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.271253][ T6210] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 119.271268][ T6210] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 119.271289][ T6210] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 119.511846][ T5861] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.543183][ T5262] 8021q: adding VLAN 0 to HW filter on device eth3 [ 119.584639][ T6210] hsr_slave_0: entered promiscuous mode [ 119.599112][ T6210] hsr_slave_1: entered promiscuous mode [ 119.877955][ T30] kauditd_printk_skb: 9 callbacks suppressed [ 119.877973][ T30] audit: type=1400 audit(1792619266.861:574): avc: denied { mount } for pid=6324 comm="syz.0.100" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 119.894355][ T5861] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 120.214028][ T4917] Bluetooth: hci3: command tx timeout [ 120.780300][ T30] audit: type=1400 audit(1792619267.011:575): avc: denied { bind } for pid=6321 comm="syz.1.97" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 120.780347][ T30] audit: type=1400 audit(1792619267.011:576): avc: denied { accept } for pid=6321 comm="syz.1.97" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 120.780383][ T30] audit: type=1400 audit(1792619267.021:577): avc: denied { read } for pid=6321 comm="syz.1.97" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 121.291402][ T30] audit: type=1400 audit(1792619268.231:578): avc: denied { create } for pid=6333 comm="syz.1.101" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 121.496348][ T30] audit: type=1400 audit(1792619268.481:579): avc: denied { connect } for pid=6333 comm="syz.1.101" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 121.704341][ T30] audit: type=1400 audit(1792619268.681:580): avc: denied { unmount } for pid=5609 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 122.272835][ T4917] Bluetooth: hci3: command tx timeout [ 123.468836][ T6341] No buffer was provided with the request [ 124.353119][ T4917] Bluetooth: hci3: command tx timeout [ 124.513170][ T1157] netdevsim netdevsim3 eth6: set [0, 0] type 1 family 0 port 8472 - 0 [ 124.513219][ T1157] netdevsim netdevsim3 eth5: set [0, 0] type 1 family 0 port 8472 - 0 [ 124.576768][ T5857] netdevsim netdevsim3 eth7: set [0, 0] type 1 family 0 port 8472 - 0 [ 124.841280][ T5861] bridge_slave_1: left allmulticast mode [ 124.841303][ T5861] bridge_slave_1: left promiscuous mode [ 124.841475][ T5861] bridge0: port 2(bridge_slave_1) entered disabled state [ 124.855505][ T2327] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 124.878670][ T5861] bridge_slave_0: left allmulticast mode [ 124.878693][ T5861] bridge_slave_0: left promiscuous mode [ 124.878872][ T5861] bridge0: port 1(bridge_slave_0) entered disabled state [ 125.003493][ T2327] usb 1-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 125.032489][ T2327] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 125.032518][ T2327] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 125.032541][ T2327] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 125.032560][ T2327] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 125.449161][ T2327] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 125.449188][ T2327] usb 1-1: Product: syz [ 125.449202][ T2327] usb 1-1: Manufacturer: syz [ 125.449217][ T2327] usb 1-1: SerialNumber: syz [ 125.454479][ T2327] usb 1-1: config 0 descriptor?? [ 125.459521][ T2327] ums-isd200 1-1:0.0: USB Mass Storage device detected [ 125.508884][ T30] audit: type=1400 audit(1792619272.491:581): avc: denied { write } for pid=6336 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 125.700914][ T30] audit: type=1400 audit(1792619272.681:582): avc: denied { write } for pid=6366 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 125.737290][ T2327] scsi host1: usb-storage 1-1:0.0 [ 125.797762][ T5861] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 125.814008][ T5861] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 125.815268][ T5861] bond0 (unregistering): Released all slaves [ 126.031884][ T5262] 8021q: adding VLAN 0 to HW filter on device eth4 [ 126.043124][ T5705] usb 1-1: USB disconnect, device number 7 [ 127.368416][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 127.368466][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 127.371007][ T5790] iguanair 3-1:0.0: failed to get version [ 127.373880][ T5790] iguanair 3-1:0.0: probe with driver iguanair failed with error -110 [ 127.376663][ T5865] netdevsim netdevsim3 eth8: set [0, 0] type 1 family 0 port 8472 - 0 [ 127.378128][ T4917] Bluetooth: hci3: command tx timeout [ 127.430648][ T5790] usb 3-1: USB disconnect, device number 5 [ 127.536035][ T6371] syzkaller0: entered promiscuous mode [ 127.536048][ T6371] syzkaller0: entered allmulticast mode [ 127.536907][ T30] audit: type=1400 audit(1792619274.521:583): avc: denied { write } for pid=6369 comm="syz.1.106" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 127.621681][ T6210] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 127.648930][ T6210] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 127.665275][ T6210] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 127.698156][ T6210] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 127.739809][ T6210] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 127.772639][ T6210] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 127.876941][ T6210] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 127.902333][ T6210] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 128.187278][ T6403] netlink: 8 bytes leftover after parsing attributes in process `syz.0.110'. [ 128.206568][ T5861] hsr_slave_0: left promiscuous mode [ 128.212450][ T30] audit: type=1400 audit(1792619275.191:584): avc: denied { setopt } for pid=6387 comm="syz.1.109" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 128.214969][ T5861] hsr_slave_1: left promiscuous mode [ 128.216117][ T5861] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 128.216133][ T5861] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 128.258122][ T5861] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 128.258139][ T5861] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 128.274153][ T30] audit: type=1400 audit(1792619275.251:585): avc: denied { validate_trans } for pid=6387 comm="syz.1.109" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 128.292546][ T6404] netlink: 64 bytes leftover after parsing attributes in process `syz.0.110'. [ 128.292566][ T6404] netlink: 64 bytes leftover after parsing attributes in process `syz.0.110'. [ 128.292586][ T6404] netlink: 64 bytes leftover after parsing attributes in process `syz.0.110'. [ 128.295929][ T5861] veth1_macvtap: left promiscuous mode [ 128.295957][ T5861] veth0_macvtap: left promiscuous mode [ 128.296025][ T5861] veth1_vlan: left promiscuous mode [ 128.296072][ T5861] veth0_vlan: left promiscuous mode [ 128.359039][ T30] audit: type=1400 audit(1792619275.341:586): avc: denied { write } for pid=6381 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 128.475603][ T30] audit: type=1400 audit(1792619275.461:587): avc: denied { write } for pid=6407 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 128.822625][ T5861] team0 (unregistering): Port device team_slave_1 removed [ 128.838826][ T5861] team0 (unregistering): Port device team_slave_0 removed [ 128.872728][ T30] audit: type=1400 audit(1792619275.851:588): avc: denied { bind } for pid=6410 comm="syz.2.108" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 128.892805][ T30] audit: type=1400 audit(1792619275.881:589): avc: denied { write } for pid=6410 comm="syz.2.108" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 128.944947][ T5705] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 128.969114][ T5262] 8021q: adding VLAN 0 to HW filter on device eth5 [ 129.017862][ T6286] bridge0: port 1(bridge_slave_0) entered blocking state [ 129.017990][ T6286] bridge0: port 1(bridge_slave_0) entered disabled state [ 129.018092][ T6286] bridge_slave_0: entered allmulticast mode [ 129.019286][ T6286] bridge_slave_0: entered promiscuous mode [ 129.050344][ T6286] bridge0: port 2(bridge_slave_1) entered blocking state [ 129.050411][ T6286] bridge0: port 2(bridge_slave_1) entered disabled state [ 129.050494][ T6286] bridge_slave_1: entered allmulticast mode [ 129.051451][ T6286] bridge_slave_1: entered promiscuous mode [ 129.083142][ T5705] usb 2-1: device descriptor read/64, error -71 [ 129.159339][ T6411] rxe_eth0 speed is unknown, defaulting to 1000 [ 129.185230][ T30] audit: type=1400 audit(1792619276.171:590): avc: denied { create } for pid=6415 comm="syz.0.111" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 129.259385][ T6286] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 129.274912][ T6286] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 129.323160][ T5705] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 129.398852][ T6286] team0: Port device team_slave_0 added [ 129.411754][ T6286] team0: Port device team_slave_1 added [ 129.462980][ T5705] usb 2-1: device descriptor read/64, error -71 [ 129.508042][ T6286] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 129.508054][ T6286] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 129.508069][ T6286] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 129.521194][ T6286] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 129.521207][ T6286] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 129.521226][ T6286] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 129.603259][ T5705] usb usb2-port1: attempt power cycle [ 129.672953][ T6286] hsr_slave_0: entered promiscuous mode [ 129.679907][ T6286] hsr_slave_1: entered promiscuous mode [ 129.680447][ T6286] debugfs: 'hsr0' already exists in 'hsr' [ 129.680463][ T6286] Cannot create hsr debugfs directory [ 129.689645][ T6210] 8021q: adding VLAN 0 to HW filter on device bond0 [ 130.443127][ T5705] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 130.463682][ T5705] usb 2-1: device descriptor read/8, error -71 [ 130.487973][ T6210] 8021q: adding VLAN 0 to HW filter on device team0 [ 130.562438][ T5858] bridge0: port 1(bridge_slave_0) entered blocking state [ 130.562482][ T5858] bridge0: port 1(bridge_slave_0) entered forwarding state [ 130.586877][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 130.586893][ T30] audit: type=1400 audit(1792619277.571:593): avc: denied { write } for pid=6435 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 130.618297][ T145] bridge0: port 2(bridge_slave_1) entered blocking state [ 130.618371][ T145] bridge0: port 2(bridge_slave_1) entered forwarding state [ 130.723400][ T5705] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 130.753641][ T5705] usb 2-1: device descriptor read/8, error -71 [ 130.797415][ T5262] 8021q: adding VLAN 0 to HW filter on device eth6 [ 130.873366][ T5705] usb usb2-port1: unable to enumerate USB device [ 132.136448][ T6286] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 132.161089][ T6286] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 132.179192][ T6286] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 132.199722][ T6286] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 132.217240][ T6286] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 132.236694][ T6286] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 132.253738][ T6286] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 132.260232][ T6286] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 132.639469][ T6286] 8021q: adding VLAN 0 to HW filter on device bond0 [ 132.697430][ T6286] 8021q: adding VLAN 0 to HW filter on device team0 [ 132.722823][ T145] bridge0: port 1(bridge_slave_0) entered blocking state [ 132.722913][ T145] bridge0: port 1(bridge_slave_0) entered forwarding state [ 132.749465][ T145] bridge0: port 2(bridge_slave_1) entered blocking state [ 132.749511][ T145] bridge0: port 2(bridge_slave_1) entered forwarding state [ 132.971491][ T30] audit: type=1400 audit(1792619279.951:594): avc: denied { write } for pid=6452 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 133.208309][ T30] audit: type=1400 audit(1792619280.191:595): avc: denied { write } for pid=6472 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 133.293084][ T6210] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 133.387868][ T5262] 8021q: adding VLAN 0 to HW filter on device eth7 [ 134.486054][ T6210] veth0_vlan: entered promiscuous mode [ 134.520422][ T6210] veth1_vlan: entered promiscuous mode [ 134.611404][ T6210] veth0_macvtap: entered promiscuous mode [ 134.632524][ T6210] veth1_macvtap: entered promiscuous mode [ 134.703879][ T6210] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 134.720632][ T6210] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 134.871026][ T5857] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 134.877990][ T1157] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 134.878254][ T1157] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 134.878546][ T1157] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 135.495674][ T30] audit: type=1400 audit(1792619282.461:596): avc: denied { write } for pid=6501 comm="syz.1.115" name="loop5" dev="devtmpfs" ino=650 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 135.627291][ T6286] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 136.667077][ T145] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 136.667097][ T145] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 136.765647][ T30] audit: type=1400 audit(1792619283.751:597): avc: denied { write } for pid=6491 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 136.796084][ T1157] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 136.796097][ T1157] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 136.873165][ T2327] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 137.861075][ T30] audit: type=1400 audit(1792619284.841:598): avc: denied { mounton } for pid=6210 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 137.904205][ T2327] usb 1-1: New USB device found, idVendor=0856, idProduct=ac31, bcdDevice=93.1e [ 137.906613][ T2327] usb 1-1: config 0 has too many interfaces: 129, using maximum allowed: 32 [ 137.906636][ T2327] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 129 [ 137.908842][ T2327] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 137.908862][ T2327] usb 1-1: Product: syz [ 137.908874][ T2327] usb 1-1: Manufacturer: syz [ 137.908887][ T2327] usb 1-1: SerialNumber: syz [ 137.958884][ T2327] usb 1-1: config 0 descriptor?? [ 138.058064][ T30] audit: type=1400 audit(1792619285.031:599): avc: denied { write } for pid=6525 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 138.169212][ T2327] mos7840 1-1:0.0: required endpoints missing [ 138.184433][ T2327] usb 1-1: USB disconnect, device number 8 [ 138.295104][ T30] audit: type=1400 audit(1792619285.281:600): avc: denied { bind } for pid=6529 comm="syz.5.84" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 138.295150][ T30] audit: type=1400 audit(1792619285.281:601): avc: denied { connect } for pid=6529 comm="syz.5.84" lport=7 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 138.297011][ T30] audit: type=1400 audit(1792619285.281:602): avc: denied { write } for pid=6529 comm="syz.5.84" laddr=::1 lport=7 faddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 138.386373][ T5262] 8021q: adding VLAN 0 to HW filter on device eth8 [ 138.448191][ T6531] netlink: 4 bytes leftover after parsing attributes in process `syz.5.84'. [ 138.568733][ T6286] veth0_vlan: entered promiscuous mode [ 138.595752][ T6286] veth1_vlan: entered promiscuous mode [ 138.623511][ T30] audit: type=1400 audit(1792619285.601:603): avc: denied { write } for pid=6532 comm="syz.2.117" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 138.723578][ T5806] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 138.750422][ T6286] veth0_macvtap: entered promiscuous mode [ 138.768728][ T6286] veth1_macvtap: entered promiscuous mode [ 138.837964][ T6286] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 138.873962][ T5806] usb 6-1: Using ep0 maxpacket: 16 [ 138.876880][ T5806] usb 6-1: New USB device found, idVendor=0582, idProduct=0156, bcdDevice= 0.40 [ 138.881068][ T5806] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 138.881089][ T5806] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 138.881134][ T5806] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 138.882141][ T6286] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 138.897516][ T5806] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.897536][ T5806] usb 6-1: Product: syz [ 138.897549][ T5806] usb 6-1: Manufacturer: syz [ 138.897561][ T5806] usb 6-1: SerialNumber: syz [ 138.921133][ T5806] usb 6-1: 0:2 : does not exist [ 138.962892][ T5861] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 138.964097][ T5861] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 138.964126][ T5861] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 138.964152][ T5861] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 139.142636][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 139.142655][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 139.184780][ T6530] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 139.185140][ T6530] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 139.209592][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 139.209609][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 139.260032][ T6157] udevd[6157]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 139.271169][ T30] audit: type=1400 audit(1792619286.251:604): avc: denied { write } for pid=6529 comm="syz.5.84" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 140.450901][ T10] usb 6-1: USB disconnect, device number 2 [ 143.352691][ T30] audit: type=1400 audit(1792619289.911:605): avc: denied { search } for pid=6572 comm="syz.0.120" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 143.352737][ T30] audit: type=1400 audit(1792619289.911:606): avc: denied { read } for pid=6572 comm="syz.0.120" name="buffer_size_kb" dev="tracefs" ino=3712 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 143.352832][ T30] audit: type=1400 audit(1792619289.911:607): avc: denied { open } for pid=6572 comm="syz.0.120" path="/26/tracefs_dir/buffer_size_kb" dev="tracefs" ino=3712 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 144.398403][ T5726] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 146.011085][ T30] audit: type=1400 audit(1792619292.991:608): avc: denied { write } for pid=6580 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 146.310353][ T30] audit: type=1400 audit(1792619293.291:609): avc: denied { write } for pid=6595 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 146.820817][ T6601] FAULT_INJECTION: forcing a failure. [ 146.820817][ T6601] name failslab, interval 1, probability 0, space 0, times 0 [ 146.820904][ T6601] CPU: 0 UID: 0 PID: 6601 Comm: syz.1.125 Tainted: G L syzkaller #0 PREEMPT(full) [ 146.820931][ T6601] Tainted: [L]=SOFTLOCKUP [ 146.820937][ T6601] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 146.820948][ T6601] Call Trace: [ 146.820954][ T6601] [ 146.820962][ T6601] dump_stack_lvl+0x100/0x190 [ 146.820995][ T6601] should_fail_ex.cold+0x5/0xa [ 146.821022][ T6601] should_failslab+0xc2/0x120 [ 146.821051][ T6601] __kmalloc_flags_noprof+0x122/0x8e0 [ 146.821077][ T6601] ? alloc_slab_obj_exts+0x6a/0x170 [ 146.821103][ T6601] alloc_slab_obj_exts+0x6a/0x170 [ 146.821126][ T6601] __memcg_slab_post_alloc_hook+0x3fc/0x10c0 [ 146.821157][ T6601] ? kasan_unpoison+0x27/0x60 [ 146.821183][ T6601] __kvmalloc_node_noprof+0x74b/0x9b0 [ 146.821208][ T6601] ? pti_set_user_pgtbl+0x41/0x50 [ 146.821231][ T6601] ? xt_alloc_table_info+0x44/0xa0 [ 146.821261][ T6601] xt_alloc_table_info+0x44/0xa0 [ 146.821286][ T6601] do_ip6t_set_ctl+0x611/0xd00 [ 146.821310][ T6601] ? nf_sockopt_find.isra.0+0x222/0x290 [ 146.821333][ T6601] ? nf_sockopt_find.isra.0+0x222/0x290 [ 146.821364][ T6601] ? __pfx_do_ip6t_set_ctl+0x10/0x10 [ 146.821387][ T6601] ? __mutex_unlock_slowpath+0x35d/0x930 [ 146.821411][ T6601] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 146.821441][ T6601] ? nf_sockopt_find.isra.0+0x222/0x290 [ 146.821467][ T6601] nf_setsockopt+0x8d/0xf0 [ 146.821492][ T6601] ipv6_setsockopt+0x135/0x170 [ 146.821520][ T6601] udpv6_setsockopt+0x64/0xb0 [ 146.821548][ T6601] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 146.821577][ T6601] do_sock_setsockopt+0xf3/0x1d0 [ 146.821605][ T6601] __sys_setsockopt+0x195/0x220 [ 146.821631][ T6601] __x64_sys_setsockopt+0xbd/0x160 [ 146.821650][ T6601] ? do_syscall_64+0xae/0x790 [ 146.821668][ T6601] ? lockdep_hardirqs_on+0x7d/0x110 [ 146.821686][ T6601] do_syscall_64+0x123/0x790 [ 146.821707][ T6601] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 146.821726][ T6601] RIP: 0033:0x7f680219f559 [ 146.821743][ T6601] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 146.821760][ T6601] RSP: 002b:00007f6802fe3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 146.821779][ T6601] RAX: ffffffffffffffda RBX: 00007f6802426090 RCX: 00007f680219f559 [ 146.821791][ T6601] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000008 [ 146.821802][ T6601] RBP: 00007f6802fe3090 R08: 00000000000004a0 R09: 0000000000000000 [ 146.821813][ T6601] R10: 0000200000000840 R11: 0000000000000246 R12: 0000000000000001 [ 146.821823][ T6601] R13: 00007f6802426128 R14: 00007f6802426090 R15: 00007ffd9a5710a8 [ 146.821848][ T6601] [ 146.827111][ T6601] --map-set only usable from mangle table [ 148.624909][ T30] audit: type=1400 audit(1792619294.661:610): avc: denied { append } for pid=6604 comm="syz.5.127" name="sda" dev="devtmpfs" ino=860 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 149.536568][ T30] audit: type=1400 audit(1792619296.521:611): avc: denied { write } for pid=6605 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 150.084102][ T30] audit: type=1400 audit(1792619296.931:612): avc: denied { write } for pid=6622 comm="syz.5.133" name="instances" dev="tracefs" ino=3772 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 150.084154][ T30] audit: type=1400 audit(1792619296.941:613): avc: denied { add_name } for pid=6622 comm="syz.5.133" name="inst1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 150.084189][ T30] audit: type=1400 audit(1792619296.941:614): avc: denied { create } for pid=6622 comm="syz.5.133" name="inst1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:tracefs_t tclass=dir permissive=1 [ 150.084224][ T30] audit: type=1400 audit(1792619297.061:615): avc: denied { read } for pid=6622 comm="syz.5.133" name="transaction_report" dev="binder" ino=1048673 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 150.084263][ T30] audit: type=1400 audit(1792619297.061:616): avc: denied { open } for pid=6622 comm="syz.5.133" path="/dev/binderfs/features/transaction_report" dev="binder" ino=1048673 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 151.332854][ T2327] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 151.363637][ T30] audit: type=1400 audit(1792619298.351:617): avc: denied { write } for pid=6640 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 151.433825][ T6643] netlink: 4 bytes leftover after parsing attributes in process `syz.5.134'. [ 151.483883][ T2327] usb 3-1: New USB device found, idVendor=0856, idProduct=ac31, bcdDevice=93.1e [ 151.484947][ T2327] usb 3-1: config 0 has too many interfaces: 129, using maximum allowed: 32 [ 151.484973][ T2327] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 129 [ 151.487277][ T2327] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 151.487300][ T2327] usb 3-1: Product: syz [ 151.487314][ T2327] usb 3-1: Manufacturer: syz [ 151.487329][ T2327] usb 3-1: SerialNumber: syz [ 151.491575][ T2327] usb 3-1: config 0 descriptor?? [ 151.674497][ T5790] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 151.697535][ T2327] mos7840 3-1:0.0: required endpoints missing [ 151.699749][ T2327] usb 3-1: USB disconnect, device number 6 [ 151.823612][ T5790] usb 6-1: Using ep0 maxpacket: 16 [ 151.825047][ T5790] usb 6-1: New USB device found, idVendor=0582, idProduct=0156, bcdDevice= 0.40 [ 151.826477][ T5790] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 151.826497][ T5790] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 151.826543][ T5790] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 151.831714][ T5790] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 151.831736][ T5790] usb 6-1: Product: syz [ 151.831750][ T5790] usb 6-1: Manufacturer: syz [ 151.831764][ T5790] usb 6-1: SerialNumber: syz [ 151.862036][ T5790] usb 6-1: 0:2 : does not exist [ 151.988137][ T30] audit: type=1400 audit(1792619298.971:618): avc: denied { write } for pid=6656 comm="syz.0.132" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 151.988472][ T30] audit: type=1400 audit(1792619298.971:619): avc: denied { open } for pid=6656 comm="syz.0.132" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 151.988636][ T6657] random: crng reseeded on system resumption [ 152.061615][ T6643] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 152.065488][ T6643] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 153.110957][ T6637] udevd[6637]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 153.160519][ T2327] usb 6-1: USB disconnect, device number 3 [ 155.123105][ T2327] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 155.272821][ T2327] usb 7-1: Using ep0 maxpacket: 16 [ 155.274366][ T2327] usb 7-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 155.275373][ T2327] usb 7-1: config 0 has an invalid descriptor of length 55, skipping remainder of the config [ 155.275411][ T2327] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 155.275436][ T2327] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 155.275460][ T2327] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 155.277990][ T2327] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 155.278011][ T2327] usb 7-1: Product: syz [ 155.278024][ T2327] usb 7-1: Manufacturer: syz [ 155.278038][ T2327] usb 7-1: SerialNumber: syz [ 155.368915][ T2327] usb 7-1: config 0 descriptor?? [ 155.578627][ T2327] appledisplay 7-1:0.0: Error while getting initial brightness: -71 [ 155.589686][ T2327] appledisplay 7-1:0.0: probe with driver appledisplay failed with error -71 [ 155.611199][ T2327] usb 7-1: USB disconnect, device number 3 [ 156.757890][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 156.757909][ T30] audit: type=1400 audit(1792619303.741:621): avc: denied { mount } for pid=6687 comm="syz.1.137" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 156.824238][ T30] audit: type=1400 audit(1792619303.811:622): avc: denied { unmount } for pid=5595 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 156.949291][ T30] audit: type=1400 audit(1792619303.931:623): avc: denied { map } for pid=6689 comm="syz.5.144" path="/6/tracing/per_cpu/cpu0/trace_pipe_raw" dev="tracefs" ino=3751 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 157.085626][ T6699] CIFS: VFS: UNC: path must begin with // or \\ [ 157.085641][ T6699] Malformed UNC in devname [ 157.085641][ T6699] [ 157.085707][ T6699] CIFS: VFS: Malformed UNC in devname [ 157.717828][ T6701] binder: 6695:6701 ioctl 40087602 200000000580 returned -22 [ 158.556222][ T6691] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 158.587859][ T30] audit: type=1400 audit(1792619305.571:624): avc: denied { write } for pid=6683 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 159.564678][ T5609] batman_adv: batadv0: Interface deactivated: syz_tun [ 159.644720][ T5609] batman_adv: batadv0: Removing interface: syz_tun [ 159.659425][ T30] audit: type=1400 audit(1792619306.641:625): avc: denied { write } for pid=6709 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 160.789309][ T1157] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 160.941810][ T1157] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 161.096748][ T1157] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 161.302471][ T1157] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 161.405450][ T30] audit: type=1400 audit(1792619308.391:626): avc: denied { write } for pid=6720 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 161.490345][ T5598] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 161.492204][ T5598] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 161.494562][ T5598] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 161.495149][ T5598] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 161.495528][ T5598] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 161.550054][ T30] audit: type=1400 audit(1792619308.531:627): avc: denied { create } for pid=6732 comm="syz.6.142" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 161.572863][ T30] audit: type=1400 audit(1792619308.551:628): avc: denied { setopt } for pid=6732 comm="syz.6.142" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 161.594055][ T5857] netdevsim netdevsim0 eth9: set [0, 0] type 1 family 0 port 8472 - 0 [ 161.613519][ T30] audit: type=1400 audit(1792619308.601:629): avc: denied { write } for pid=6737 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 161.651801][ T30] audit: type=1400 audit(1792619308.631:630): avc: denied { ioctl } for pid=6740 comm="syz.2.143" path="socket:[13611]" dev="sockfs" ino=13611 ioctlcmd=0x5820 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 161.663377][ T5857] netdevsim netdevsim0 eth10: set [0, 0] type 1 family 0 port 8472 - 0 [ 161.738632][ T5857] netdevsim netdevsim0 eth11: set [0, 0] type 1 family 0 port 8472 - 0 [ 161.772878][ T9] usb 6-1: new full-speed USB device number 4 using dummy_hcd [ 161.873189][ T43] netdevsim netdevsim0 eth12: set [0, 0] type 1 family 0 port 8472 - 0 [ 161.875441][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 161.875456][ T30] audit: type=1800 audit(1792619308.841:632): pid=6746 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.2.143" name="SYSV00000000" dev="tmpfs" ino=1 res=0 errno=0 [ 161.966372][ T1157] bridge_slave_1: left allmulticast mode [ 161.966396][ T1157] bridge_slave_1: left promiscuous mode [ 161.966574][ T1157] bridge0: port 2(bridge_slave_1) entered disabled state [ 161.968640][ T9] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 161.977901][ T1157] bridge_slave_0: left allmulticast mode [ 161.977919][ T1157] bridge_slave_0: left promiscuous mode [ 161.978055][ T1157] bridge0: port 1(bridge_slave_0) entered disabled state [ 162.024176][ T5790] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 162.032269][ T9] usb 6-1: too many endpoints for config 253 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 162.032314][ T9] usb 6-1: config 253 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 162.032341][ T9] usb 6-1: config 253 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 255 [ 162.072607][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 162.072633][ T9] usb 6-1: SerialNumber: syz [ 162.193540][ T5790] usb 7-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 162.199885][ T5790] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 162.199909][ T5790] usb 7-1: Product: syz [ 162.199924][ T5790] usb 7-1: Manufacturer: syz [ 162.199939][ T5790] usb 7-1: SerialNumber: syz [ 162.333618][ T30] audit: type=1400 audit(1792619309.311:633): avc: denied { firmware_load } for pid=29 comm="kworker/1:1" path="/lib/firmware/ath9k_htc/htc_9271-1.4.0.fw" dev="sda1" ino=313 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 162.435889][ T30] audit: type=1400 audit(1792619309.421:634): avc: denied { write } for pid=6745 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 162.469238][ T6759] FAULT_INJECTION: forcing a failure. [ 162.469238][ T6759] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 162.469271][ T6759] CPU: 0 UID: 0 PID: 6759 Comm: syz.2.154 Tainted: G L syzkaller #0 PREEMPT(full) [ 162.469298][ T6759] Tainted: [L]=SOFTLOCKUP [ 162.469305][ T6759] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 162.469316][ T6759] Call Trace: [ 162.469322][ T6759] [ 162.469330][ T6759] dump_stack_lvl+0x100/0x190 [ 162.469361][ T6759] should_fail_ex.cold+0x5/0xa [ 162.469389][ T6759] _copy_from_iter+0x1f4/0x1690 [ 162.469411][ T6759] ? __asan_memset+0x23/0x50 [ 162.469437][ T6759] ? __pfx__copy_from_iter+0x10/0x10 [ 162.469455][ T6759] ? __pfx___alloc_skb+0x10/0x10 [ 162.469486][ T6759] netlink_sendmsg+0x94a/0x1020 [ 162.469513][ T6759] ? __pfx_netlink_sendmsg+0x10/0x10 [ 162.469540][ T6759] ? selinux_socket_sendmsg+0x198/0x2f0 [ 162.469573][ T6759] ? ____sys_sendmsg+0xa4d/0xbe0 [ 162.469598][ T6759] ____sys_sendmsg+0xa4d/0xbe0 [ 162.469622][ T6759] ? __pfx_netlink_sendmsg+0x10/0x10 [ 162.469643][ T6759] ? __pfx_____sys_sendmsg+0x10/0x10 [ 162.469675][ T6759] ? lock_acquire+0x1d1/0x380 [ 162.469698][ T6759] ? get_pid_task+0x2a/0x250 [ 162.469724][ T6759] ___sys_sendmsg+0x190/0x1e0 [ 162.469753][ T6759] ? __pfx____sys_sendmsg+0x10/0x10 [ 162.469778][ T6759] ? get_pid_task+0x106/0x250 [ 162.469814][ T6759] ? find_held_lock+0x2b/0x80 [ 162.469848][ T6759] __sys_sendmsg+0x160/0x210 [ 162.469871][ T6759] ? __pfx___sys_sendmsg+0x10/0x10 [ 162.469906][ T6759] do_syscall_64+0x123/0x790 [ 162.469928][ T6759] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 162.469948][ T6759] RIP: 0033:0x7f51ce79f559 [ 162.469964][ T6759] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 162.469982][ T6759] RSP: 002b:00007f51cf6f4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 162.470001][ T6759] RAX: ffffffffffffffda RBX: 00007f51cea26090 RCX: 00007f51ce79f559 [ 162.470014][ T6759] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 0000000000000004 [ 162.470026][ T6759] RBP: 00007f51cf6f4090 R08: 0000000000000000 R09: 0000000000000000 [ 162.470037][ T6759] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 162.470048][ T6759] R13: 00007f51cea26128 R14: 00007f51cea26090 R15: 00007fff2a26d0f8 [ 162.470073][ T6759] [ 162.698907][ T29] usb 7-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 162.906948][ T30] audit: type=1400 audit(1792619309.891:635): avc: denied { write } for pid=6760 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 163.958115][ T4917] Bluetooth: hci4: command tx timeout [ 163.975867][ T6735] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 163.976236][ T6735] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 164.026747][ T10] usb 7-1: USB disconnect, device number 4 [ 164.179842][ T30] audit: type=1400 audit(1792619311.161:636): avc: denied { setopt } for pid=6768 comm="syz.2.155" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 164.182004][ T30] audit: type=1400 audit(1792619311.161:637): avc: denied { mount } for pid=6768 comm="syz.2.155" name="/" dev="securityfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 164.226925][ T2327] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 164.244409][ T30] audit: type=1400 audit(1792619311.231:638): avc: denied { write } for pid=6768 comm="syz.2.155" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 164.247934][ T6769] netlink: 4 bytes leftover after parsing attributes in process `syz.2.155'. [ 164.423952][ T2327] usb 2-1: Using ep0 maxpacket: 16 [ 164.425447][ T2327] usb 2-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 164.426602][ T2327] usb 2-1: config 0 has an invalid descriptor of length 55, skipping remainder of the config [ 164.426657][ T2327] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 164.426683][ T2327] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 164.426728][ T2327] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 164.429113][ T2327] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 164.429161][ T2327] usb 2-1: Product: syz [ 164.429176][ T2327] usb 2-1: Manufacturer: syz [ 164.429191][ T2327] usb 2-1: SerialNumber: syz [ 164.439080][ T2327] usb 2-1: config 0 descriptor?? [ 164.542553][ T1157] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 164.575359][ T1157] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 164.582715][ T1157] bond0 (unregistering): Released all slaves [ 164.664671][ T29] usb 7-1: ath9k_htc: Unable to allocate URBs [ 164.667219][ T10] usb 7-1: ath9k_htc: USB layer deinitialized [ 164.773652][ T2327] appledisplay 2-1:0.0: Error while getting initial brightness: -71 [ 164.834561][ T2327] appledisplay 2-1:0.0: probe with driver appledisplay failed with error -71 [ 164.875604][ T1157] tipc: Disabling bearer [ 164.879976][ T2327] usb 2-1: USB disconnect, device number 11 [ 164.894244][ T1157] tipc: Left network mode [ 166.063143][ T4917] Bluetooth: hci4: command tx timeout [ 166.249918][ T9] rndis_host 6-1:253.0: RNDIS init failed, -71 [ 166.250107][ T9] rndis_host 6-1:253.0: probe with driver rndis_host failed with error -71 [ 166.294375][ T9] usb 6-1: USB disconnect, device number 4 [ 166.852948][ T5806] usb 6-1: new low-speed USB device number 5 using dummy_hcd [ 166.933567][ T6733] rxe_eth0 speed is unknown, defaulting to 1000 [ 167.037688][ T5806] usb 6-1: unable to get BOS descriptor or descriptor too short [ 167.037715][ T5806] usb 6-1: New USB device found, idVendor=6737, idProduct=0001, bcdDevice=91.80 [ 167.038506][ T5806] usb 6-1: config 142 has an invalid interface number: 251 but max is 0 [ 167.038521][ T5806] usb 6-1: config 142 has no interface number 0 [ 167.038539][ T5806] usb 6-1: config 142 interface 251 altsetting 11 has an endpoint descriptor with address 0x9F, changing to 0x8F [ 167.038553][ T5806] usb 6-1: config 142 interface 251 altsetting 11 endpoint 0x8F is Bulk; changing to Interrupt [ 167.038566][ T5806] usb 6-1: config 142 interface 251 altsetting 11 endpoint 0x1 is Bulk; changing to Interrupt [ 167.038582][ T5806] usb 6-1: config 142 interface 251 has no altsetting 0 [ 167.044030][ T5806] usb 6-1: string descriptor 0 read error: -22 [ 167.044122][ T5806] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 167.099693][ T6791] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 167.099773][ T6791] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 167.108673][ T5806] cypress_m8 6-1:142.251: HID->COM RS232 Adapter converter detected [ 167.143050][ T30] audit: type=1400 audit(1792619314.131:639): avc: denied { write } for pid=6773 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 167.180275][ T5806] usb 6-1: HID->COM RS232 Adapter converter now attached to ttyUSB0 [ 167.296220][ T1157] hsr_slave_0: left promiscuous mode [ 167.307851][ T1157] hsr_slave_1: left promiscuous mode [ 167.323094][ T1157] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 167.323109][ T1157] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 167.350643][ T1157] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 167.350656][ T1157] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 167.813666][ T6791] cyphidcom ttyUSB0: cypress_serial_control - failed sending serial line settings - -32 [ 167.813696][ T6791] cyphidcom ttyUSB0: cypress_m8 suspending failing port 0 - interval might be too short [ 167.813900][ C0] usb 6-1: cypress_read_int_callback - unexpected nonzero read status received: -71 [ 167.950303][ T1157] veth1_macvtap: left promiscuous mode [ 167.950337][ T1157] veth0_macvtap: left promiscuous mode [ 167.950416][ T1157] veth1_vlan: left promiscuous mode [ 168.401342][ T4917] Bluetooth: hci4: command tx timeout [ 168.460820][ T6804] netlink: 34 bytes leftover after parsing attributes in process `syz.2.161'. [ 168.962101][ T30] audit: type=1400 audit(1792619315.941:640): avc: denied { write } for pid=6799 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 169.162971][ T2327] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 169.367410][ T1740] usb 6-1: USB disconnect, device number 5 [ 169.380082][ T1740] cyphidcom ttyUSB0: HID->COM RS232 Adapter converter now disconnected from ttyUSB0 [ 169.380557][ T1740] cypress_m8 6-1:142.251: device disconnected [ 169.382108][ T2327] usb 3-1: New USB device found, idVendor=0856, idProduct=ac31, bcdDevice=93.1e [ 169.410896][ T2327] usb 3-1: config 0 has too many interfaces: 129, using maximum allowed: 32 [ 169.410920][ T2327] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 129 [ 169.413126][ T2327] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 169.413149][ T2327] usb 3-1: Product: syz [ 169.413163][ T2327] usb 3-1: Manufacturer: syz [ 169.413178][ T2327] usb 3-1: SerialNumber: syz [ 169.456576][ T2327] usb 3-1: config 0 descriptor?? [ 169.565079][ T1157] team0 (unregistering): Port device vlan0 removed [ 169.713193][ T30] audit: type=1400 audit(1792619316.651:641): avc: denied { ioctl } for pid=6809 comm="syz.6.157" path="/dev/nullb0" dev="devtmpfs" ino=694 ioctlcmd=0x890b scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 170.281201][ T6815] binder: 6812:6815 ioctl 40087602 200000000580 returned -22 [ 170.432876][ T4917] Bluetooth: hci4: command tx timeout [ 171.735948][ T1157] team0 (unregistering): Port device team_slave_1 removed [ 171.760616][ T1157] team0 (unregistering): Port device team_slave_0 removed [ 172.065212][ T2327] mos7840 3-1:0.0: required endpoints missing [ 172.084239][ T2327] usb 3-1: USB disconnect, device number 7 [ 172.124464][ T5806] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 172.272926][ T5806] usb 7-1: Using ep0 maxpacket: 16 [ 172.273711][ T5806] usb 7-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 172.274686][ T5806] usb 7-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 172.274716][ T5806] usb 7-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 172.274737][ T5806] usb 7-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 28 [ 172.274761][ T5806] usb 7-1: config 0 interface 0 has no altsetting 0 [ 172.274788][ T5806] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 172.282008][ T5806] usb 7-1: config 0 descriptor?? [ 172.412892][ T1740] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 172.545545][ T1740] usb 2-1: device descriptor read/64, error -71 [ 172.691227][ T1157] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 172.924131][ T1740] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 172.931485][ T30] audit: type=1400 audit(1792619319.911:642): avc: denied { write } for pid=6826 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 173.063387][ T1740] usb 2-1: device descriptor read/64, error -71 [ 173.088250][ T30] audit: type=1400 audit(1792619320.071:643): avc: denied { write } for pid=6844 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 173.171935][ T1157] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 173.173872][ T1740] usb usb2-port1: attempt power cycle [ 173.322408][ T5598] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 173.325847][ T5598] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 173.338067][ T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 173.355027][ T52] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 173.356047][ T52] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 173.439966][ T1157] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 173.493947][ T6733] bridge0: port 1(bridge_slave_0) entered blocking state [ 173.494044][ T6733] bridge0: port 1(bridge_slave_0) entered disabled state [ 173.494124][ T6733] bridge_slave_0: entered allmulticast mode [ 173.496339][ T6733] bridge_slave_0: entered promiscuous mode [ 173.518943][ T6733] bridge0: port 2(bridge_slave_1) entered blocking state [ 173.519015][ T6733] bridge0: port 2(bridge_slave_1) entered disabled state [ 173.524584][ T6733] bridge_slave_1: entered allmulticast mode [ 173.530416][ T6733] bridge_slave_1: entered promiscuous mode [ 173.533890][ T1740] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 173.676737][ T1740] usb 2-1: device descriptor read/8, error -71 [ 173.691646][ T6733] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 173.815629][ T1157] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 173.861000][ T6733] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 174.162080][ T6864] FAULT_INJECTION: forcing a failure. [ 174.162080][ T6864] name failslab, interval 1, probability 0, space 0, times 0 [ 174.162142][ T6864] CPU: 1 UID: 0 PID: 6864 Comm: syz.1.169 Tainted: G L syzkaller #0 PREEMPT(full) [ 174.162168][ T6864] Tainted: [L]=SOFTLOCKUP [ 174.162175][ T6864] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 174.162186][ T6864] Call Trace: [ 174.162194][ T6864] [ 174.162202][ T6864] dump_stack_lvl+0x100/0x190 [ 174.162234][ T6864] should_fail_ex.cold+0x5/0xa [ 174.162262][ T6864] should_failslab+0xc2/0x120 [ 174.162291][ T6864] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 174.162321][ T6864] ? kvasprintf_const+0x66/0x1a0 [ 174.162346][ T6864] kvasprintf+0xbc/0x150 [ 174.162363][ T6864] ? __pfx_kvasprintf+0x10/0x10 [ 174.162383][ T6864] ? acpi_dev_for_each_child+0x88/0xc0 [ 174.162407][ T6864] ? find_held_lock+0x2b/0x80 [ 174.162429][ T6864] kvasprintf_const+0x66/0x1a0 [ 174.162449][ T6864] kobject_set_name_vargs+0x5a/0x140 [ 174.162475][ T6864] dev_set_name+0xc7/0x100 [ 174.162508][ T6864] ? __pfx_dev_set_name+0x10/0x10 [ 174.162541][ T6864] ? set_primary_fwnode+0x211/0x2a0 [ 174.162563][ T6864] ? pci_dev_assign_slot+0x1ea/0x270 [ 174.162591][ T6864] pci_setup_device+0x5f5/0x2500 [ 174.162623][ T6864] ? __pfx_pci_setup_device+0x10/0x10 [ 174.162652][ T6864] ? kasan_save_track+0x14/0x30 [ 174.162677][ T6864] ? __kasan_kmalloc+0xaa/0xb0 [ 174.162704][ T6864] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 174.162727][ T6864] ? lockdep_init_map_type+0x5c/0x250 [ 174.162750][ T6864] ? __raw_spin_lock_init+0x3a/0x110 [ 174.162778][ T6864] pci_scan_single_device+0x1ac/0x240 [ 174.162803][ T6864] ? __pfx_pci_scan_single_device+0x10/0x10 [ 174.162837][ T6864] pci_scan_slot+0x1c9/0x7c0 [ 174.162867][ T6864] ? __pfx_pci_scan_slot+0x10/0x10 [ 174.162894][ T6864] ? rcu_is_watching+0x13/0xc0 [ 174.162927][ T6864] pci_scan_child_bus_extend+0x6b/0x7b0 [ 174.162953][ T6864] ? pci_find_next_bus+0x60/0xb0 [ 174.162988][ T6864] pci_rescan_bus+0x18/0x40 [ 174.163013][ T6864] rescan_store+0xfb/0x130 [ 174.163040][ T6864] ? __pfx_rescan_store+0x10/0x10 [ 174.163071][ T6864] ? __pfx_rescan_store+0x10/0x10 [ 174.163096][ T6864] bus_attr_store+0x74/0xb0 [ 174.163121][ T6864] ? __pfx_bus_attr_store+0x10/0x10 [ 174.163145][ T6864] sysfs_kf_write+0xf2/0x150 [ 174.163167][ T6864] kernfs_fop_write_iter+0x3e0/0x5f0 [ 174.163193][ T6864] ? __pfx_sysfs_kf_write+0x10/0x10 [ 174.163214][ T6864] vfs_write+0x6af/0x1050 [ 174.163240][ T6864] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 174.163269][ T6864] ? __pfx_vfs_write+0x10/0x10 [ 174.163291][ T6864] ? find_held_lock+0x2b/0x80 [ 174.163327][ T6864] ksys_write+0x12a/0x250 [ 174.163351][ T6864] ? __pfx_ksys_write+0x10/0x10 [ 174.163375][ T6864] ? trace_hardirqs_off+0x70/0x170 [ 174.163410][ T6864] do_syscall_64+0x123/0x790 [ 174.163432][ T6864] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.163452][ T6864] RIP: 0033:0x7f680219f559 [ 174.163468][ T6864] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 174.163486][ T6864] RSP: 002b:00007f6802fa1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 174.163517][ T6864] RAX: ffffffffffffffda RBX: 00007f6802426270 RCX: 00007f680219f559 [ 174.163530][ T6864] RDX: 0000000000000001 RSI: 0000200000000300 RDI: 0000000000000006 [ 174.163542][ T6864] RBP: 00007f6802fa1090 R08: 0000000000000000 R09: 0000000000000000 [ 174.163553][ T6864] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 174.163564][ T6864] R13: 00007f6802426308 R14: 00007f6802426270 R15: 00007ffd9a5710a8 [ 174.163591][ T6864] [ 174.163811][ T6864] pci (null): [8086:1237] type 00 class 0x060000 conventional PCI endpoint [ 174.168194][ T6864] ------------[ cut here ]------------ [ 174.168223][ T6864] ret < 0 [ 174.168229][ T6864] WARNING: drivers/pci/probe.c:2770 at pci_device_add+0x1343/0x1820, CPU#1: syz.1.169/6864 [ 174.553410][ T6864] Modules linked in: [ 174.557304][ T6864] CPU: 1 UID: 0 PID: 6864 Comm: syz.1.169 Tainted: G L syzkaller #0 PREEMPT(full) [ 174.568079][ T6864] Tainted: [L]=SOFTLOCKUP [ 174.572402][ T6864] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 174.582909][ T6864] RIP: 0010:pci_device_add+0x1343/0x1820 [ 174.588543][ T6864] Code: e5 04 83 e0 8f 09 e8 88 83 c8 00 00 00 e9 20 f4 ff ff e8 e0 79 a1 fc 90 0f 0b 90 90 0f 0b 90 e9 06 f7 ff ff e8 ce 79 a1 fc 90 <0f> 0b 90 e9 7e fa ff ff e8 c0 79 a1 fc 90 0f 0b 90 e9 11 fa ff ff [ 174.608172][ T6864] RSP: 0018:ffffc9000440f930 EFLAGS: 00010293 [ 174.614246][ T6864] RAX: 0000000000000000 RBX: 00000000ffffffea RCX: 0000000000000000 [ 174.622219][ T6864] RDX: ffff8880287da580 RSI: ffffffff856b7e62 RDI: ffff8880287da580 [ 174.630663][ T6864] RBP: ffff88801d680400 R08: 0000000000000005 R09: 0000000000000000 [ 174.639068][ T6864] R10: 00000000ffffffea R11: ffffffff81000130 R12: ffff8880252e6028 [ 174.647098][ T6864] R13: ffff8880252e6000 R14: 0000000000000001 R15: ffff888025692000 [ 174.655078][ T6864] FS: 00007f6802fa16c0(0000) GS:ffff888122a34000(0000) knlGS:0000000000000000 [ 174.664016][ T6864] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 174.670600][ T6864] CR2: 00007f6802fa0ff8 CR3: 000000004cdf2000 CR4: 00000000003526f0 [ 174.678592][ T6864] Call Trace: [ 174.681868][ T6864] [ 174.684805][ T6864] ? __pfx_pci_device_add+0x10/0x10 [ 174.689995][ T6864] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 174.695544][ T6864] ? __raw_spin_lock_init+0x3a/0x110 [ 174.700820][ T6864] pci_scan_single_device+0x1d0/0x240 [ 174.706185][ T6864] ? __pfx_pci_scan_single_device+0x10/0x10 [ 174.712080][ T6864] pci_scan_slot+0x1c9/0x7c0 [ 174.716687][ T6864] ? __pfx_pci_scan_slot+0x10/0x10 [ 174.721797][ T6864] ? rcu_is_watching+0x13/0xc0 [ 174.726574][ T6864] pci_scan_child_bus_extend+0x6b/0x7b0 [ 174.732569][ T6864] ? pci_find_next_bus+0x60/0xb0 [ 174.737801][ T6864] pci_rescan_bus+0x18/0x40 [ 174.742296][ T6864] rescan_store+0xfb/0x130 [ 174.746716][ T6864] ? __pfx_rescan_store+0x10/0x10 [ 174.751731][ T6864] ? __pfx_rescan_store+0x10/0x10 [ 174.756762][ T6864] bus_attr_store+0x74/0xb0 [ 174.761254][ T6864] ? __pfx_bus_attr_store+0x10/0x10 [ 174.766460][ T6864] sysfs_kf_write+0xf2/0x150 [ 174.771036][ T6864] kernfs_fop_write_iter+0x3e0/0x5f0 [ 174.776321][ T6864] ? __pfx_sysfs_kf_write+0x10/0x10 [ 174.781506][ T6864] vfs_write+0x6af/0x1050 [ 174.785852][ T6864] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 174.791657][ T6864] ? __pfx_vfs_write+0x10/0x10 [ 174.796430][ T6864] ? find_held_lock+0x2b/0x80 [ 174.801099][ T6864] ksys_write+0x12a/0x250 [ 174.805431][ T6864] ? __pfx_ksys_write+0x10/0x10 [ 174.810270][ T6864] ? trace_hardirqs_off+0x70/0x170 [ 174.815390][ T6864] do_syscall_64+0x123/0x790 [ 174.819971][ T6864] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.825872][ T6864] RIP: 0033:0x7f680219f559 [ 174.830755][ T6864] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 174.850685][ T6864] RSP: 002b:00007f6802fa1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 174.859103][ T6864] RAX: ffffffffffffffda RBX: 00007f6802426270 RCX: 00007f680219f559 [ 174.867079][ T6864] RDX: 0000000000000001 RSI: 0000200000000300 RDI: 0000000000000006 [ 174.875073][ T6864] RBP: 00007f6802fa1090 R08: 0000000000000000 R09: 0000000000000000 [ 174.883043][ T6864] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 174.891009][ T6864] R13: 00007f6802426308 R14: 00007f6802426270 R15: 00007ffd9a5710a8 [ 174.899012][ T6864] [ 174.902024][ T6864] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 174.909288][ T6864] CPU: 1 UID: 0 PID: 6864 Comm: syz.1.169 Tainted: G L syzkaller #0 PREEMPT(full) [ 174.920022][ T6864] Tainted: [L]=SOFTLOCKUP [ 174.924333][ T6864] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 174.934368][ T6864] Call Trace: [ 174.937630][ T6864] [ 174.940540][ T6864] dump_stack_lvl+0x100/0x190 [ 174.945207][ T6864] vpanic+0x553/0x970 [ 174.949166][ T6864] ? __pfx_vpanic+0x10/0x10 [ 174.953656][ T6864] panic+0xd1/0xe0 [ 174.957348][ T6864] ? __pfx_panic+0x10/0x10 [ 174.961749][ T6864] check_panic_on_warn.cold+0x19/0x34 [ 174.967101][ T6864] ? pci_device_add+0x1343/0x1820 [ 174.972107][ T6864] __warn.cold+0x191/0x318 [ 174.976494][ T6864] __report_bug+0x30f/0x440 [ 174.980986][ T6864] ? pci_device_add+0x1343/0x1820 [ 174.985994][ T6864] ? __pfx___report_bug+0x10/0x10 [ 174.990987][ T6864] ? lockdep_hardirqs_on+0x7d/0x110 [ 174.996155][ T6864] ? irqentry_exit+0x202/0xab0 [ 175.000894][ T6864] ? pci_device_add+0x1343/0x1820 [ 175.005895][ T6864] ? pci_device_add+0x1343/0x1820 [ 175.010893][ T6864] report_bug+0xb3/0x220 [ 175.015107][ T6864] ? pci_device_add+0x1343/0x1820 [ 175.020105][ T6864] handle_bug+0x16a/0x2a0 [ 175.024408][ T6864] exc_invalid_op+0x17/0x50 [ 175.028883][ T6864] asm_exc_invalid_op+0x1a/0x20 [ 175.033710][ T6864] RIP: 0010:pci_device_add+0x1343/0x1820 [ 175.039320][ T6864] Code: e5 04 83 e0 8f 09 e8 88 83 c8 00 00 00 e9 20 f4 ff ff e8 e0 79 a1 fc 90 0f 0b 90 90 0f 0b 90 e9 06 f7 ff ff e8 ce 79 a1 fc 90 <0f> 0b 90 e9 7e fa ff ff e8 c0 79 a1 fc 90 0f 0b 90 e9 11 fa ff ff [ 175.058897][ T6864] RSP: 0018:ffffc9000440f930 EFLAGS: 00010293 [ 175.064933][ T6864] RAX: 0000000000000000 RBX: 00000000ffffffea RCX: 0000000000000000 [ 175.072885][ T6864] RDX: ffff8880287da580 RSI: ffffffff856b7e62 RDI: ffff8880287da580 [ 175.080828][ T6864] RBP: ffff88801d680400 R08: 0000000000000005 R09: 0000000000000000 [ 175.088767][ T6864] R10: 00000000ffffffea R11: ffffffff81000130 R12: ffff8880252e6028 [ 175.096709][ T6864] R13: ffff8880252e6000 R14: 0000000000000001 R15: ffff888025692000 [ 175.104652][ T6864] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 175.110701][ T6864] ? pci_device_add+0x1342/0x1820 [ 175.115714][ T6864] ? __pfx_pci_device_add+0x10/0x10 [ 175.120886][ T6864] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 175.126406][ T6864] ? __raw_spin_lock_init+0x3a/0x110 [ 175.131681][ T6864] pci_scan_single_device+0x1d0/0x240 [ 175.137072][ T6864] ? __pfx_pci_scan_single_device+0x10/0x10 [ 175.142965][ T6864] pci_scan_slot+0x1c9/0x7c0 [ 175.147551][ T6864] ? __pfx_pci_scan_slot+0x10/0x10 [ 175.152657][ T6864] ? rcu_is_watching+0x13/0xc0 [ 175.157408][ T6864] pci_scan_child_bus_extend+0x6b/0x7b0 [ 175.162946][ T6864] ? pci_find_next_bus+0x60/0xb0 [ 175.167866][ T6864] pci_rescan_bus+0x18/0x40 [ 175.172351][ T6864] rescan_store+0xfb/0x130 [ 175.176746][ T6864] ? __pfx_rescan_store+0x10/0x10 [ 175.181748][ T6864] ? __pfx_rescan_store+0x10/0x10 [ 175.186752][ T6864] bus_attr_store+0x74/0xb0 [ 175.191232][ T6864] ? __pfx_bus_attr_store+0x10/0x10 [ 175.196411][ T6864] sysfs_kf_write+0xf2/0x150 [ 175.201013][ T6864] kernfs_fop_write_iter+0x3e0/0x5f0 [ 175.206280][ T6864] ? __pfx_sysfs_kf_write+0x10/0x10 [ 175.211465][ T6864] vfs_write+0x6af/0x1050 [ 175.215780][ T6864] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 175.221572][ T6864] ? __pfx_vfs_write+0x10/0x10 [ 175.226313][ T6864] ? find_held_lock+0x2b/0x80 [ 175.230978][ T6864] ksys_write+0x12a/0x250 [ 175.235308][ T6864] ? __pfx_ksys_write+0x10/0x10 [ 175.240147][ T6864] ? trace_hardirqs_off+0x70/0x170 [ 175.245250][ T6864] do_syscall_64+0x123/0x790 [ 175.249821][ T6864] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 175.255690][ T6864] RIP: 0033:0x7f680219f559 [ 175.260084][ T6864] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 175.279673][ T6864] RSP: 002b:00007f6802fa1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 175.288064][ T6864] RAX: ffffffffffffffda RBX: 00007f6802426270 RCX: 00007f680219f559 [ 175.296015][ T6864] RDX: 0000000000000001 RSI: 0000200000000300 RDI: 0000000000000006 [ 175.303968][ T6864] RBP: 00007f6802fa1090 R08: 0000000000000000 R09: 0000000000000000 [ 175.311910][ T6864] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 175.319861][ T6864] R13: 00007f6802426308 R14: 00007f6802426270 R15: 00007ffd9a5710a8 [ 175.327812][ T6864] [ 175.330997][ T6864] Kernel Offset: disabled [ 175.335295][ T6864] Rebooting in 86400 seconds..