last executing test programs: 19.560296264s ago: executing program 4 (id=136): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f00000000c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r3, &(0x7f0000000700)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000019700)=0x7) set_mempolicy(0x6, &(0x7f0000019740)=0x8000000000000001, 0xe0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r4, 0x0, 0x80, &(0x7f0000000340)=@broute={'broute\x00', 0x20, 0x5, 0x5d0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000001400], 0x0, 0x0, &(0x7f000001a180)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{0x3, 0x4a, 0x22f0, 'veth1_to_hsr\x00', '\x00', 'pim6reg\x00', 'macvlan0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0x0, 0x0, 0xff, 0xff, 0x0, 0xff], @remote, [0xff, 0xff, 0x0, 0xff], 0x0, 0x70, 0x70, 0xe8, [], [], @common=@nflog={'nflog\x00', 0x50, {{0x1, 0x401, 0x3d9a, 0x0, 0x0, "2c5b78d353d585d033caf0b8701a6cf7b3dab647fc6bd350080384aa88a3ae887ee0dccbf13788e410c56f5e38b905e9ed8f23773f70a0a9fb41b56eac70be3f"}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x2, [{0x5, 0x4, 0x81b, '\x00', 'wg2\x00', 'wlan0\x00', 'ipvlan0\x00', @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], @empty, [0x0, 0xff, 0x0, 0xff, 0xff, 0xff], 0x0, 0xe0, 0xe0, 0x210, [@m802_3={{'802_3\x00', 0x0, 0x8}, {{0x4, 0x1, 0x3, 0x7}}}, @mark_m={{'mark_m\x00', 0x0, 0x18}, {{0x3, 0x1}}}], [], @common=@SECMARK={'SECMARK\x00', 0x108, {{0x1, 0x8000, 'system_u:object_r:netcontrol_device_t:s0\x00'}}}}, {0x3, 0x887c3b56b961a40e, 0x832e, 'vlan1\x00', 'veth1\x00', 'macvtap0\x00', 'veth0_to_team\x00', @broadcast, [0xff, 0x0, 0x0, 0x0, 0xff, 0xff], @local, [0xff, 0x0, 0x0, 0xff, 0x0, 0xff], 0x0, 0x70, 0x70, 0xe8, [], [], @common=@nflog={'nflog\x00', 0x50, {{0x5, 0xc0, 0x4, 0x0, 0x0, "80f592c4059d3808ae94554537f8f09a31a4e48047c33483f2899780ba8eae9416856423fe68b9a0f3c22731f03c8d4b745f18e92a534fbf2a16f24a67a123bc"}}}}]}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x2, [{0x3, 0x0, 0x8884, 'ip6erspan0\x00', 'ipvlan0\x00', 'hsr0\x00', 'veth1_to_bond\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x32}, [0xff, 0x0, 0xff, 0xff, 0x0, 0xff], @remote, [0x0, 0xff, 0x0, 0x0, 0xff], 0x0, 0x70, 0x70, 0xb8, [], [], @common=@ERROR={'ERROR\x00', 0x20, {"b54a500c8031e4e2d6d416da268047637313e1e36ca4210f414e44cac4fb"}}}, {0x9, 0x0, 0x6004, 'bridge_slave_1\x00', 'wlan1\x00', 'ipvlan0\x00', 'bridge0\x00', @broadcast, [0xff, 0x0, 0x0, 0xff, 0x0, 0xff], @remote, [0xff, 0xff, 0xff, 0x0, 0x0, 0xff], 0x0, 0x70, 0x70, 0xa8, [], [], @common=@mark={'mark\x00', 0x10, {{0xffffffd0, 0xfffffffffffffffc}}}}]}]}, 0x648) 18.642079156s ago: executing program 4 (id=137): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="6000000002060300000000000000000007000000140007800500150002000000080012400000000414000300686173683a69702c706f72742c697000050005000200000005000400050000000900020073797a31000000000500010007"], 0x60}, 0x1, 0x0, 0x0, 0x810}, 0x20004040) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000004c0)=ANY=[@ANYBLOB="5c000000090603417c17da00000000000a000000340007800c000180080001407f0000010c00148008000140ac1e01010600044050000000060005406b640000050007000600000005000100060000000900020073797a31"], 0x5c}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) sendmsg$IPSET_CMD_SAVE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x8, 0x6, 0x201, 0x0, 0x0, {0x3, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 13.613480057s ago: executing program 0 (id=151): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000340), r0) sendmsg$NET_DM_CMD_START(r0, &(0x7f0000000380)={0x0, 0x11, &(0x7f00000003c0)={&(0x7f0000000400)={0x14, r1, 0x1, 0x70bd2c, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x40000) 11.439244673s ago: executing program 0 (id=155): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002780)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x7}, 0x50) pipe2(0x0, 0x800) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000100), 0x18140, 0x0) socket$inet6(0xa, 0x80003, 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x1c2) mkdir(&(0x7f0000000400)='./file0\x00', 0x1f8) mount$overlay(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000440)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@volatile}], [{@defcontext={'defcontext', 0x3d, 'unconfined_u'}}, {@uid_eq}, {@appraise}, {@subj_role={'subj_role', 0x3d, 'lowerdir'}}, {@obj_role={'obj_role', 0x3d, '/dev/net/tun\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@euid_lt}]}) r4 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000380)='/dev/comedi2\x00', 0x1, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x280, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000340)={'dvmrp0\x00', 0xe43986f95b0e4309}) ioctl$TUNGETSNDBUF(r5, 0x400454dc, &(0x7f00000003c0)) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x40, 0x80) 11.406396044s ago: executing program 3 (id=156): mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000100)='configfs\x00', 0x12c9084, 0x0) ioctl$TCSBRKP(0xffffffffffffffff, 0x5425, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) setresgid(0x0, 0x0, 0x0) r0 = open(&(0x7f0000000140)='./file0\x00', 0x161a42, 0x118) fcntl$setlease(r0, 0x400, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r1, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) msgctl$IPC_RMID(0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f00000002c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000340), 0x5, 0x0) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/rcu_stall_count', 0x880, 0x8) read(r3, &(0x7f00000003c0)=""/4096, 0x1000) pread64(r2, 0x0, 0x0, 0x1) ioctl$MON_IOCX_MFETCH(r2, 0xc0109207, &(0x7f0000000380)={0x0, 0x0, 0xfffffffd}) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x10) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) ptrace$ARCH_MAP_VDSO_X32(0x1e, 0x0, 0x6, 0x2001) syz_open_dev$vim2m(&(0x7f0000000000), 0x0, 0x2) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x74}}) bind$rds(0xffffffffffffffff, 0x0, 0x0) 9.471278485s ago: executing program 0 (id=159): socket$netlink(0x10, 0x3, 0x8) r0 = socket(0x10, 0x3, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000400)='./config\x00', &(0x7f0000000440)='configfs\x00', 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) add_key$keyring(&(0x7f0000000540), &(0x7f0000000580)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) (async, rerun: 32) unshare(0x40400) (rerun: 32) recvfrom$unix(0xffffffffffffffff, &(0x7f00000005c0)=""/36, 0x24, 0x40000000, &(0x7f0000000600)=@file={0x1, './config/usb_gadget/g1/functions/uvc.0\x00'}, 0x6e) r1 = syz_open_dev$video(0x0, 0x7, 0x40) ioctl$VIDIOC_CROPCAP(r1, 0xc02c563a, &(0x7f0000000680)={0xb, {0x6, 0x7, 0x7, 0xffffffde}, {0x8, 0x1, 0x4, 0x7ff}, {0x7, 0x6}}) r2 = mq_open(&(0x7f0000000240)='_\x82*q\tAa\x97\xb8H/`\x1a\xe2\f\xeb%\xb3\x9b\xf7\x95\xfar\x96\xc0\xce\xdf\x13B\xd7_Q,\xe5\xe4V\xeb%S\xe5.\x95\xbd+W\x91\xdfr]\x7f{\xe8\x1b\r\x8cBr\r\x8aV\x13\xef%HV)\x7f\xb0\xa8\xf7\xe22=pe3\xc5ul\x96v\x05BB\xad\xc7\xac\xfb\xac-\xee\xa2', 0x40, 0x111, 0x0) mq_getsetattr(r2, 0x0, 0x0) (async) r3 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_SECURITY_KEYRING(r3, 0x110, 0x2, &(0x7f0000000700), 0x5) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff) symlinkat(&(0x7f0000000780)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00') (async) symlinkat(&(0x7f0000000800)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./config/usb_gadget/g1/configs/c.1/uvc.0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000880)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1\x00', 0x1ff) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000008c0), r4) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000900), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000980)={&(0x7f00000009c0)={0x20, r7, 0x200, 0x8000, 0x0, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0xc, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x1000000) (async) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r4, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000a80)={0x14, r5, 0x1, 0x70bd27, 0x25dfdbfb}, 0x14}}, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./config/usb_gadget/g1/functions/uvc.0/streaming/mjpeg/m1/bmaControls\x00', 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000000c0)={{{@in=@broadcast, @in=@local}}, {{@in=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000080)=0xe8) (async) ioctl$DRM_IOCTL_GET_CLIENT(r8, 0xc0186405, &(0x7f0000000cc0)={0x8, 0x9, {}, {0xffffffffffffffff}, 0xff, 0x2fa}) 9.183775335s ago: executing program 2 (id=160): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002780)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x7}, 0x50) pipe2(0x0, 0x800) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000100), 0x18140, 0x0) socket$inet6(0xa, 0x80003, 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x1c2) mkdir(&(0x7f0000000400)='./file0\x00', 0x1f8) mount$overlay(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000440)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@volatile}], [{@defcontext={'defcontext', 0x3d, 'unconfined_u'}}, {@uid_eq}, {@appraise}, {@subj_role={'subj_role', 0x3d, 'lowerdir'}}, {@obj_role={'obj_role', 0x3d, '/dev/net/tun\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@euid_lt}]}) r4 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000380)='/dev/comedi2\x00', 0x1, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x280, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000340)={'dvmrp0\x00', 0xe43986f95b0e4309}) ioctl$TUNGETSNDBUF(r5, 0x400454dc, &(0x7f00000003c0)) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, 0x0) 7.756268028s ago: executing program 2 (id=161): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3, 0x8f5}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0x1, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0xff, 0xb}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240448a4}, 0x4004884) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f00000002c0)={'syzkaller0\x00', @multicast}) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000300)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000340)={'syzkaller0\x00', 0x0}) sendto$packet(r4, &(0x7f0000000380)="05031c00d3fc1400fd004788031c09102c28", 0xfdef, 0x4, &(0x7f00000003c0)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) (fail_nth: 4) 7.17512171s ago: executing program 4 (id=162): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r3, &(0x7f0000000700)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000019700)=0x7) set_mempolicy(0x6, &(0x7f0000019740)=0x8000000000000001, 0xe0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r4, 0x0, 0x80, &(0x7f0000000340)=@broute={'broute\x00', 0x20, 0x5, 0x5d0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000001400], 0x0, 0x0, &(0x7f000001a180)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{0x3, 0x4a, 0x22f0, 'veth1_to_hsr\x00', '\x00', 'pim6reg\x00', 'macvlan0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0x0, 0x0, 0xff, 0xff, 0x0, 0xff], @remote, [0xff, 0xff, 0x0, 0xff], 0x0, 0x70, 0x70, 0xe8, [], [], @common=@nflog={'nflog\x00', 0x50, {{0x1, 0x401, 0x3d9a, 0x0, 0x0, "2c5b78d353d585d033caf0b8701a6cf7b3dab647fc6bd350080384aa88a3ae887ee0dccbf13788e410c56f5e38b905e9ed8f23773f70a0a9fb41b56eac70be3f"}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x2, [{0x5, 0x4, 0x81b, '\x00', 'wg2\x00', 'wlan0\x00', 'ipvlan0\x00', @empty, [0x0, 0x0, 0x0, 0x0, 0xff, 0xff], @empty, [0x0, 0xff, 0x0, 0xff, 0xff, 0xff], 0x0, 0xe0, 0xe0, 0x210, [@m802_3={{'802_3\x00', 0x0, 0x8}, {{0x4, 0x1, 0x3, 0x7}}}, @mark_m={{'mark_m\x00', 0x0, 0x18}, {{0x3, 0x1}}}], [], @common=@SECMARK={'SECMARK\x00', 0x108, {{0x1, 0x8000, 'system_u:object_r:netcontrol_device_t:s0\x00'}}}}, {0x3, 0x887c3b56b961a40e, 0x832e, 'vlan1\x00', 'veth1\x00', 'macvtap0\x00', 'veth0_to_team\x00', @broadcast, [0xff, 0x0, 0x0, 0x0, 0xff, 0xff], @local, [0xff, 0x0, 0x0, 0xff, 0x0, 0xff], 0x0, 0x70, 0x70, 0xe8, [], [], @common=@nflog={'nflog\x00', 0x50, {{0x5, 0xc0, 0x4, 0x0, 0x0, "80f592c4059d3808ae94554537f8f09a31a4e48047c33483f2899780ba8eae9416856423fe68b9a0f3c22731f03c8d4b745f18e92a534fbf2a16f24a67a123bc"}}}}]}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x2, [{0x3, 0x0, 0x8884, 'ip6erspan0\x00', 'ipvlan0\x00', 'hsr0\x00', 'veth1_to_bond\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x32}, [0xff, 0x0, 0xff, 0xff, 0x0, 0xff], @remote, [0x0, 0xff, 0x0, 0x0, 0xff], 0x0, 0x70, 0x70, 0xb8, [], [], @common=@ERROR={'ERROR\x00', 0x20, {"b54a500c8031e4e2d6d416da268047637313e1e36ca4210f414e44cac4fb"}}}, {0x9, 0x0, 0x6004, 'bridge_slave_1\x00', 'wlan1\x00', 'ipvlan0\x00', 'bridge0\x00', @broadcast, [0xff, 0x0, 0x0, 0xff, 0x0, 0xff], @remote, [0xff, 0xff, 0xff, 0x0, 0x0, 0xff], 0x0, 0x70, 0x70, 0xa8, [], [], @common=@mark={'mark\x00', 0x10, {{0xffffffd0, 0xfffffffffffffffc}}}}]}]}, 0x648) 6.512967208s ago: executing program 3 (id=163): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002780)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x7}, 0x50) pipe2(0x0, 0x800) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000100), 0x18140, 0x0) socket$inet6(0xa, 0x80003, 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x1c2) mkdir(&(0x7f0000000400)='./file0\x00', 0x1f8) mount$overlay(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000440)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@volatile}], [{@defcontext={'defcontext', 0x3d, 'unconfined_u'}}, {@uid_eq}, {@appraise}, {@subj_role={'subj_role', 0x3d, 'lowerdir'}}, {@obj_role={'obj_role', 0x3d, '/dev/net/tun\x00'}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@euid_lt}]}) r4 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000380)='/dev/comedi2\x00', 0x1, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x280, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000340)={'dvmrp0\x00', 0xe43986f95b0e4309}) ioctl$TUNGETSNDBUF(r5, 0x400454dc, &(0x7f00000003c0)) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, 0x0) 6.44906055s ago: executing program 4 (id=164): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f00005a4000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f00005a4000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x840) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = open(&(0x7f0000000100)='.\x00', 0x0, 0x0) flock(r2, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./security\x00', 0x1ed) mount(0x0, &(0x7f0000000600)='./security\x00', &(0x7f0000000640)='securityfs\x00', 0x8080, 0x0) r3 = open$dir(&(0x7f0000000680)='./security/ima/policy\x00', 0x2000, 0x149) pread64(r3, &(0x7f00000006c0)=""/259, 0xfffffe7b, 0x91) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r4, 0x84, 0x6b, &(0x7f0000000500)=[@in6={0xa, 0x4e22, 0x9, @private0={0xfc, 0x0, '\x00', 0xfd}, 0x5}], 0x1c) listen(r4, 0xfff) accept$inet6(r4, &(0x7f0000000540)={0xa, 0x0, 0x0, @mcast2}, &(0x7f0000000580)=0xffffffffffffff2a) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000480)={r2, 0x0, 0x79, 0xd, &(0x7f0000000180)="90c1172e2908e19be5f600a2afa0c237c7dc51f3c332345443418ce33c086a2bda7be3f5bc00cdd09c474b8572131360d6e0440d9952220551a2bcd23c5352c085d5bedfb26609ded79c19ff69d8f0e1cd4ff1721cbc7882c0d24d8a215a350814c5f3ac6a5e6934311728cd9d1473e1bbd533dd08eb4f6b45", &(0x7f0000000240)=""/13, 0x3ff, 0x0, 0x91, 0xaf, &(0x7f0000000280)="1ac7eb66739b0f4522704e5b4c3119ba7547a2c5b5a0fbedabe7852696379e56672ecfe7a4c74c381fc43354fa70890d3bfdcf4dc77fe5ce3a7bb7c4c52dc549f14deb49fbc9abd88c85231f4b9ef74d1d1bef719e44de49f747bbe8892fdd78a6ea2127a7d1fe45b6f7f58279b2323d34c17ec733f525e6cf0c35a7bfcf35103d7ede0f482c0f6e1c07c24fe3150e28ba", &(0x7f00000003c0)="9d32ac95913b6b5683b6b3beb75cb1fdae3247201edd6187b6ecaf12721af6a57250bf9a77b90c0823cd28ef402547971a326a02ccaa9fe673bb35c55e22d396d45b099cca5996c8b3ea80cfa0e98a0d1ff8da1806ebca3a698cdf4de1845ddffeac09bbc73331c79d6c47e047fd9093b9b65df41c3ee48b15f5ad448a01107d5155d301e4a01e40022d19e19300a8b435b67317fe37b064f552898b3f0ed9e6dd2bd47de586d7eda9e0f345220d4f", 0x1, 0x0, 0x81}, 0x50) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000340)="f2f0450fbb3364410f01c9363e0f955c8600400f01c53e4c0fc75e0a66ba2100ed660f3a161f3366baf80cb81218428aef66bafc0cb000eec4e3c96bc90ec744240017010000c74424027cbeb742ff2c24", 0x51}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x2, 0x4) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000800), &(0x7f0000000880)=0x4c) socketpair$unix(0x1, 0x2, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000008c0)={0x7, 0x100}, 0x0) r7 = getpid() listen(0xffffffffffffffff, 0x6) sched_setscheduler(r7, 0x1, &(0x7f0000000900)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000940)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) 5.369175511s ago: executing program 3 (id=166): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x1, 0x9006}, 0x4) setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f0000000140)={0x2, &(0x7f0000000180)=[{0x28, 0xa9, 0x1, 0xfffff034}, {0x6, 0xfa, 0x2, 0x9}]}, 0x10) syz_emit_ethernet(0x4be, &(0x7f00000001c0)=ANY=[@ANYBLOB="0180c2000002aaaaaaaaaa1f080045"], 0x0) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r2 = shmget(0x2, 0x1000, 0x2, &(0x7f0000ffd000/0x1000)=nil) shmctl$SHM_STAT_ANY(r2, 0xf, &(0x7f0000000640)=""/181) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/bus/pci/00/00.0\x00', 0x2, 0x0) r4 = mmap$IORING_MAP_OFF_PARAM_REGION(0x0, 0x4, 0x300000a, 0x130, r3, 0x20000000) syz_ublk_setup_io_uring(0x3ea9, &(0x7f0000000280)={0x0, 0xcd1e, 0x10, 0x0, 0x3c4, 0x0, r3}, &(0x7f0000000300), &(0x7f0000000340)=0x0, &(0x7f0000000440)) r6 = mmap$IORING_OFF_SQES(0x0, 0xd37, 0x1000005, 0x110, r3, 0x10000000) getsockopt$inet_sctp_SCTP_AUTH_SUPPORTED(r3, 0x84, 0x81, &(0x7f0000000700)={0x0, 0x3c5}, &(0x7f0000000740)=0x8) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f0000000780)={r7}, &(0x7f00000007c0)=0x8) r8 = socket(0xa, 0x1, 0x0) setsockopt$sock_int(r8, 0x1, 0xf, &(0x7f0000000580)=0x9, 0x4) bind$inet6(r8, &(0x7f00000005c0)={0xa, 0xe64, 0xb, @empty, 0x1}, 0x1c) r9 = socket(0xa, 0x1, 0x0) bind$inet6(r9, &(0x7f0000000600)={0xa, 0xe64, 0xb, @empty, 0x1}, 0x1c) r10 = io_uring_register$IORING_REGISTER_PERSONALITY(r3, 0x9, 0x0, 0x0) r11 = gettid() syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f00000004c0)={0x2e, 0x40, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x2, 0x0, r10, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000480)=@new_dev={0x1, 0xb6b, 0x0, 0x0, 0x1000, 0xffffffff, r11, 0x0, 0x2}}}, &(0x7f0000000540)) r12 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r12, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_GET_STATION(r12, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x24, r0, 0x303, 0x0, 0x0, {{}, {@val={0x8, 0x3, r13}, @void}}, [@NL80211_ATTR_PEER_AID={0x6, 0xb5, 0x4b8}]}, 0x24}}, 0x14014) 5.041932796s ago: executing program 0 (id=167): syz_usb_connect$uac1(0x5, 0x72, &(0x7f0000000040)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x40, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x60, 0x3, 0x1, 0x7f, 0xc0, 0x0, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xfffe, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x8, 0x3, 0x17, {0x7, 0x25, 0x1, 0x0, 0xc, 0x885f}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x5, 0x0, 0x7a, {0x7, 0x25, 0x1, 0x0, 0xc0, 0xda6d}}}}}}}}]}}, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x2, [{0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x3c0a}}, {0x9c, &(0x7f0000000280)=@string={0x9c, 0x3, "da6ff13077348148d731bb6601732794a40209df1dab360451dfdf981c84f432271671507e5e329e5e112369b89e1bcf8dd1b9f9a380c3315c5e8a7388104a94a008923156e089e9001028785c28366a6045b1302c4a7fe83fd2ed5d6bb9d9f12b4d8c9a5412ee0d9146c5bc166d6442bd56c88cbf02140f44fbcca64144fd176f654fa22c9a7f4bae82cd2c7ae2f6233cf26b2844b94cdb03dc"}}]}) syz_usb_connect$uac3(0x6, 0x103, &(0x7f00000000c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x8, 0x499, 0x102b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xf1, 0x3, 0x1, 0x5, 0x20, 0x0, {0x8, 0xb, 0x2, 0x2, 0x1, 0x20, 0x30, 0x5}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x8, 0x5e, 0x37}, [@selector_unit={0x8, 0x24, 0xc, 0x3, 0x3, "5d8952"}, @input_terminal={0x14, 0x24, 0x2, 0x1, 0x201, 0x2, 0xf, 0x3, 0x10, 0x1cac, 0xf747, 0x3d95}, @processing_unit={0x15, 0x24, 0x9, 0x3, 0x5, [0x2, 0x1, 0x2, 0x3]}, @multiply_unit={0xb, 0x24, 0xd, 0x4, 0x4, 0x1, 0x7}, @extension_unit={0x9, 0x24, 0xa, 0x4, 0x6, [0x3]}, @power_domain={0xf, 0x24, 0x10, 0x4, 0x6, 0x0, 0x4, "e8e1729024bd"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@as_header={0x17, 0x24, 0x1, 0x0, 0x0, 0x1, 0x0, 0xa0, 0x81, 0xf}]}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x3, 0x3, 0x8, {0xa, 0x25, 0x25, 0x0, 0xe, 0x8001}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x1, 0x1, 0x5, 0x1, "1e11ed056dd4"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x401, 0x0, 0x1, 0x5}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x0, 0xa, 0x8, {0xa, 0x25, 0x25, 0x9, 0x40, 0x3}}}}}}}}]}}, &(0x7f0000000680)={0xa, &(0x7f0000000240)={0xa, 0x6, 0x341, 0x39, 0x1, 0x0, 0x20, 0x2}, 0x25, &(0x7f0000000340)={0x5, 0xf, 0x25, 0x1, [@ssp_cap={0x20, 0x10, 0xa, 0xf6, 0x5, 0x1000, 0xf000, 0x2, [0x0, 0x30, 0x3f0f, 0xc000, 0xbe30]}]}, 0x4, [{0xec, &(0x7f0000000440)=@string={0xec, 0x3, "ff1872aadb05f719a35f9554fcde4141d74601f9559f56115c9c405e7860ca60c18a87e41f1789ab9e80aa03933e87d8de5e1ca65c6ef978c4c7166f66f1082d9e162ea64fad83ddf255a0ff85239985e0d2c02d6b11488a63bb027689877ffd46e07714fa960e374b79783c7664591898fa4aa12580916265cdf17c4315a3b0f7e4c3b0a8f92219b0b6489454a771e753e69d15b2a2c4859d0da65165153edc656fc0c492d8241dfaeb453af85619ef3b1083ef81d5d2199aa34748ae12394d55bb4a93055321bd21e28ecc3cd8000632173fcc45180baa7448f8e54d150b31f90bba760ed83e25107e"}}, {0x4, &(0x7f0000000540)=@lang_id={0x4, 0x3, 0x380a}}, {0xb6, &(0x7f0000000580)=@string={0xb6, 0x3, "0348148b2813fa4c89cc4315e6f98afb1f29fe47a299ffcac3c533125e2d1104cd96f570eb997cebc3fd5ab1fbd17b46ca76ae73a829789612aad4a5537aa99b029d728c1110cec06b843cb88dbeed27e8b3479fba3f630f876a68eb9d01bfcd33f0122f1a6a28cb97a14c49811ffa012adac3e47107499d1dcca931769907743e07ea27cef0053f124e19440700cff120c787c4d9dbd11f197834a976a7b3d7761a056fe2bac63f081b6555e93d36bf8e69c1c2"}}, {0x22, &(0x7f0000000640)=@string={0x22, 0x3, "5579966c98d8bfb0ea112267c0c2757ba4fa246eab8baa335179846f88ea10b4"}}]}) 4.396601506s ago: executing program 1 (id=168): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) bind$802154_dgram(r0, &(0x7f0000000000)={0x24, @none={0x0, 0x2}}, 0x14) connect$802154_dgram(r0, &(0x7f0000000280)={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0103}}}, 0x14) sendmmsg(r0, &(0x7f0000000a80)=[{{0x0, 0x0, 0x0}}, {{0x0, 0xd, 0x0}}], 0x4000050, 0x400c010) 4.303129731s ago: executing program 1 (id=169): openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x20846, 0x12) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001180), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000480), 0x0, &(0x7f00000010c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000004280)={0x2020}, 0x2020) ioctl$BTRFS_IOC_SNAP_CREATE(0xffffffffffffffff, 0x50009401, &(0x7f0000002100)={{}, "afe1658d587e93ab4b5fca380cdddd71e95c81000bac90d9689507b96ace5d2f9f55fddb8b36c7cac9209681a5fa01cd3874b06f2fcadd0d6c3b2543560ad96ffb3b3bb528250d54c3849e85a72f9805820433eaf86b855cc6bb316351ebf38753b22f619e6525c21a5050c57297595293366a0ed2ad9b308f845f1d9af97cf6384f5ec26ca2afea4eb950f209116b1d8b58fe396fcfb8ae0b8898f212b216cbb7d1bbd57a726d194a29a4e15e035b8162b139c67404e6a503db799c06078f56258de59c08f1812611aff6d4485a01f3413b9b4a11412629c2a4810db413d940af170b313dcf9a1e08e0156a7784c413ffa69bfb6b135b6093ad19c7f8bc70e5f9a0bcf07eb164c44642489845d93c25064c768ff253b3faf52378653b61ed2f3460a2221e6d9b2c04e99cd9fe74c005a330a08f558771a77771a1d1eb8b110912dbc327e07869f73b857cb841b5a47296a81d956c030dee87fda743cf9e56d08856a82ee26a390ac2569a31ca9beccda0251f28b124ee1e8ea6babc1b1e2d81fc795de9620301d65ded5865c5a9f6ce7422536d40694c2aa987542364f7f0bb75bdb0182d10b18a64045c7dadc0c82a47eab7e735fe240f27bb5da305cd08c86314a4a5fef8487c96bc1ea97409d73e1cc6ceba35f74eea39f2bf881833298b1e1a201eb9ea9c0754d41ef9a91b4deefcaeff08ee35a1f31b2d780b3934d5913626ef4a0f31c8e057e43ff14fc6fbf5e4a86b906b1ba320f3c52b629974a1324d97067935df1e4340b071130ee953bababf9dc0229e4a2f29cf1ae2713ffe85a5a9bd374c928ed416e1bd2516657bd4d3a9ac114ed279fcd89645245df7c55454fc367513ffae594d5236b320ad103f2d0956b3da7344a29fc910040027ca8b239d00ab5e79eeb83e25275fb61ceb65f6ace88cb43f106e128330ae709e19f209afd87b934dbd0faf470dfb52fdfd73bfa9a7a983b36d78469568ae69a0481cdc764c554d5ac03e607781cf3a5e209bffce2276529929d800f6d9b8a2f100108d7b883b5ce5e19da38ae5c99a8351b4e41c538fee7299a890edc630abbfe604c0b8847a7b5b4eec1dc00ed60e95b5374270ec634ff6d6ccbcd08145f9df1c2082c9447482ed42b4d0ea9a73bc9a68e36ee9e118bb5c08e1e7c2bd2627e82902d2c6f0da90bdbc52103f3992663653fd2b41a4294aa8f222812fa8b5e1864b75748f992bc2b396c03e202e8bfe9a1ccca1cb8b28c9c6faa47cc6b871140ddc45a0d02c752175a0498c3ba30e79c12d6ebbc32d5533d0216529e0f713eac725fe41bad4c9051d364bf38e3b72641510b09b2645447ea13b440d568adc9aa9ce85c967d78a14bdbd2fcfe0c7324a556ee841fc9ffd7a3c784fe41a349ced68e01c145db8847a547086c5595b9f6299bf7432e0e9c9a4a9108a24f7ad49c18a3ec771953480a0a0fdfeaded6b74f174ea2def77a0b9799f6b75a77a6314a4165e194be616eb5c98726d88da79f54fd01d39e751837a6bd0d77ca79073b3a7e62686fd8e089b0258645db505bb674174d626b1d1cfdf0f32b0d880884b73c63bc78a231a8cb45a12884907c021f87cdd7b2f1de020044666d38a866983c8ffa0cc6963a745c108e80a3b54eedac65b68c897043d914f146ba4ca18a61e144e7746d31879fa7ae7c2a43747e6060d79669bf9a8edcc229b7f1a0fe239b398692a6a65acd19c58442dfa8997430aab89aae8fb8f201bb1fd58605cf9dfe5c85a15e0928542a8fd7768f4b7750c7aeab8d9ced7c9fdea6cc38bc38209f608cc3d7c8bc9240b5b7d1661b8bfd231f30047befefd70183fb8330d184394159cd4153990c6a43ccded133adecced28499e73c4b25ee86e5d68848670736362931be74fe0aab5708ce05f4d6d7a068c590d36f99a0ba3501df60d9c01f54a7c366727287996de354c4a3a5e1ece988e5f59087c730afa107edbab31de441a88061ad799fefef86254a2f2891aa47420dd3f6267833a5345bf001d10c9f1fd121401ae846a9a5df517210cd0beb50a5139854aa1747115bca24522dae42667ef9ce893c4db108941198ed5323f582f11c4b13385f60b3038fa661f3ed276504fb51fb966ef88cbbb953c269ea2ed989ced5e8988839c55b398dbce98ce1e976c2065b2ded80f929dc6ef8afad6b61145686ce14e2d26f0694fda1e52a6c5155c0d8ea91544c76548a25376f13de7245b48e7298421d2c2433a472a8c89c3e621c5370654e1c7bba0f3d8bdf40c36cdbf02f6b5a7c4138b9e3931896fd89272b4d61a9875c00ba0d8d1bd960b9aaee3b6f127db1155680d7eefc5eaa6d4c648fca303706796bef110fbdb731d9e671f937e55ebf5d2e64f7cdcc073c905c134e8d3852689ed81c95be0c259816e7ff7b979557684aa1b6c2dd42754bda93e3e55c5ffc1122c988ca171fd57ab24ebe789e819c60ff3f9f1a9465ff4a9bdc5c2b2d9c351ffef5ab375f9024e297a26642b15108781fdf3c55d0aa9a8cb68ba93b7b13cd6d05b9b16502d7f9d72d015059e7999cc4ed880fd5ebf626ea409b9f0c4ded2974bb3daf88cc1930818dc3e09200897389211d3e780faa0acd64e37c60924a3fd0a16a7146a41b1b01e43fecf610c7d11d42baac5a60db7638077162cd58b3f734070e81ee71c5092422eaac366b41dd996723124df9005cbae4e2ec47f8a06616bd7faa5da6c0200c872c2ef929a16c823c57f2d4f798061e49102cab3af65a5cc9f8856dc5d3c0de1440c4d8df50a7ec09491d2e651ee5f5a76b8fc2d20a07def1a8951b9770f85728b42cd9dafce7c341c26a90b7d1c2e36f03f74eda3bfb2c40eec5c454c38e90f4d31e6a0f23b2ad53a429f73761713181b7839792cc494f21c5be9dd7f167a6681720ccd3cfcdd4b427058b995505a82993805a1860d5ea75e61c216ec9594adfd39cab47511578d57e312f2f3e0d2da8f2d8dbe3fc1fd281bdd8e7dbd203e4ec3e7d3b468ad2b81a76c5bac460f497e3cdb6bf0c6be5ceae4bd488b9597b13a37885b95426d8ea06760516ec13aa339084407d1f45e331e5dd77ac73306f70996728a0d67b48a833e9a3ddf22968e898b59e4b4c9a16aa9ea8120202737746e1a5ec2cca9640d69df2b27900de7abe573b7c023a88d7f3fcc3469a3a4e7f9f9095a6fed55fbb1d3582807407e62b55a38d33e70a0203513f30d37a4e6f03acd9d0fd2f3438eb485aa5e693806c002efd0811ab92518c41856039d7f36cf9981981231b3cea3493f0e8988bd05d3d424a5bfc8d1cdfd0e09e3ce12cab6edfb7f6d80c1edbb4d1d51a1500b0876e13e5173bfeba378c71046e70b590cf542094d01f458a3cec642fb1ce13a992765eca608579e85f03e7d871dbdbd882ce4821a944179e48a920d346ae21b08ee043cbbf3284c3a67d9b9417a5fed1202ca537f7711650f692df044f145587467dfdd45405d7caeb064bfa12b52057e90d2b5d2885bbaf032db769654af272dd78bb8ec8446344d0c1ca57d51fe1243e0a02ada90371e75418223f171f014f9a970964828cdd9faf3b66789cefd0374437f2a271c2765d9876943fb93205cb12448d4cccf68c28259e85a540e013ac77414a147fb1e0f0fc4a4d859a928eaef6e952a103a944052534c9264c85f4200cc8b465f66725c779f49312a308dda8fe7e423ebbee16e64ad6e112b3efd95584160f08c83595fdddfa39c4b89867fcf23085a24c53a6d846863b95f5605beb9b0a1cc6d191524da81ce89c0f7767652d887661b5299e300f2e83a6c962cf9089d82b139f4bedcc14bbf6611258d52e1f3d5a5e3ac05cfa4d066550b2180c31695a52da12c1412e55cdbe6660d86fe4c8eda51f2adf34b81af8ec55b549c3bbcc588c5f074e0dc76bb9bbd0cdea26dd47d84d9321f970912d374a081c9ebb74700a0792dbbb2da41ae7e3aa5230bdd260bd208b68100dc2f7bf2132d7cb34084e999b6ee2b91356ce766523a80359147af20fa15febc42b89d43e4a48d13cb8ed6678f346aa981954e0520ea8cd0a0c16281e57f33a5e3fd97d55d24386832c17f22b1c1fb91d5b1f362f3bc8aa8369c18444fc10e9d1285f6a3bcf24e2606b69fbd89f337f7ee3c27b1a2c7e8dec2c38c84c6712de1e7f1d790d86d8e0a402c40d406d39c13879f4d103adcbca13570eadcd424f8e06155885b054e1d7f994723fd22a6d704a89e6b126271ec5c19ea7b814c36f9ca9a0223da630324ca0f2a3010f4e53426d8d514bcc3303e6fa429c00244b918c01a444f74dd376bccb5709ed103514484a67240c4b992c722601e27dee6ba8b37608ba66e2065f8298a6df8c0a491113bf10e0bf18867dda3e1170fa1853b355fdf41898de4a339927872e8d9fb8a4d1c31833ac1355695a20c75ff6dafb70244a3754cb58feee89045e3408da902a7987e6a66dad0f044951a560954ee812abe142e9a4db701bdc46fabb0b98b4be01dadd629cffc661a3816744bcacdc38777494289ba156b272ade8f4ed3e32ce48958863b09bb09fb6999281164c0c5b50a77350d5f3c78d951fa76d1db68587e58bd40f824a68fd59c4ebd4f7e22e8e1458911012472b876ab15ca8c48ef664b1da41bd1ad9a5b799a1de8b2962c477f1726cbbe4f285a5c387842ac723b3877f5826503b68602c4bdaea94544b4b056142876d995d0db128a38f5c4547f12cf9d1cbc678cd42eebf67519484ab251855dbda09dd04ddc031860a69fd592fa1c12d59adc4699c246a666f6f6c20c1a21562f05f8db43ff424cea0d16789a6a69dc8552f4865bb3fac5b650b549432a0383c8f95c79084ca4841903f0c04319135f2bfc94ec8837374f0c1eccaacf8a0722d54b1a0e748a79e6c7ecdcdbfe376d080d9747a9a5a13cc7eb4111345216d1c787f05c992df3712d2a194ac325bb568abc6a97011bc62110ee12ba209d76f690ddb4e4b417f5b5db52ee7ad97159dfcf82b1c2a4eb5a97396fa24e52ba1c47330f7caca91b2965bac75dbcb86ac85a07b774dbf82be5fc92a8621e80973418d94a0bc10905a3815e04d1a668ea8cb5ffb293893b06bd372c75b477118b78dd69a04097ca8ff8f8fb21a5293d2fe6785e33d15d61008c4ca84121a8e48fabba3656250fba7e058ffc1705c7fa13509fc7c96fc9b16d0b21a26b11ebfc3325a2ca682bc014ec54dc8433af105ada5566f491d3ebe5e1e5f0859b28a576fb7978f2a1b4897890c1c9b0c1f4f8c7351ca738a6100c4f64092d865bc65a8b92007b117e5a4dd7988d3281aa2ccebb36f9af5032eeca2c8a72888c84346d3945507a6bb956b84f03d88a90bb9ecc466c7d94a3670783e11b312ecb4f9eb8489df8d129110b6bd710138476c8be75327e9ea6a0b94b8567b31692fee2d9c17d7e20d3d23cc4d317710537f608793e87d9158cd61a43306898da40d01b544fc951ccd13f11b4b8fbf47d694df601fd6677d796818571ee3125089316e3d33c5684affe9f29f12186bb5dc4c5eaee94e41d07a03c9c59db95bc42c23da55c497caa6a64c73ea3059a8c80955a9730666a0e02c3bf87cfb79542d84a529d7bf9c3ac60b323952fa439c2e5fd512c3bfe3770178b4e8d7efa223bd76830a6b8b604e15773d63d9fec504ea6561793723ff4f6fbdd016372e1a98a9252e8d1607512e5397c78498f68d3792ef7a28f74f4b15358afa5674d4340863a2897af87499bd073a06aef8215f76c9418f5b82b79b77f0a01dfc059b510794cda70b7daf2c74950652e"}) prlimit64(0x0, 0xe, &(0x7f0000003100)={0xa, 0xf32}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000003140)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000003180)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000031c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000003200)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000003280), 0x651, 0x0) recvmmsg(r2, &(0x7f00000032c0), 0x10106, 0x2, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000003300)={0x0, 0x0, 0x0}, 0x80) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x4000, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r4, &(0x7f0000000140)='100', 0x3) r5 = socket(0x10, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000200)={'ip6_vti0\x00', &(0x7f0000000280)={'syztnl1\x00', 0x0, 0x29, 0x0, 0x0, 0xfffffffd, 0x0, @loopback, @rand_addr=' \x01\x00', 0x8, 0x1, 0x9, 0x20000000}}) prlimit64(0x0, 0x3, 0x0, 0x0) r6 = creat(&(0x7f0000003340)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_script(r6, &(0x7f00000004c0)={'#! ', './file0', [{0x20, '\x15\xe6\x8e\\\xfe\x15^\xca\xbb\x88B\xeb\x90FAv\xdc\xbc\x1eiU\b\xc2D\xdb\xca\x9d\xb4oL\xe92\x7f+\f\x0e\xfd\xceTC\x1f;u\x84E\x04\xe3B19xO\xc2\xd4.Mp\xf4\x80{e\x87\xc4V\xe0\x99\x99\x8b\x93I\x8a\xb3\xce*\x9b\xd0X\aA0S\x02k\xdb\x12\a\x9c\x10nY\x85\x92\xf6\x93\xc4%\x0f\x80.\x8d\x9b\x15\x8e\xf4LWr\x14\x9eKh\x97L\xb4\x03\xe9=\x8e\xff\xf0\xb1al\xb6\xc9\xa1/L\x8c7\xa0\x8eD\x1f,\x93`\xc0h\xacjGx\xb8\x9cv\x99bA\xc5]\b\xf8\xa5\x9b\x1c\xeeKB\xdd\xe8\xbboT\x90\x84k\xae\xb5\xfa\xd9\x0f\xd4T<\x0f\xdb\xec\x05HcN\xae;\x87\x00\x00\x00\x00\b\x92\xa7\xdf\x1dS\x00\x8b\x81\xf4\x84X*\xa6e\x922|FO\v\xa6\x17jG\xe3]'}], 0xa, "85cadd42c3625d99eda3c51c4e193ec2012d8462c147ea29261500c6aa9c2c56a066b3ebc82fea7190d572b9c098378fdc5f33e13f3ea6a1f63341756d4ba54e0b1af2c6f82c635dbc2bf84868a9a346b4a4e0941ee28a59c4a34528af58f6363cc3ceef8c684f6b3c42"}, 0x14e) close(r6) r7 = syz_open_procfs(0x0, &(0x7f0000003480)='net/route\x00') pread64(r7, &(0x7f00000082c0)=""/102356, 0x18fd4, 0xc2a) execve(&(0x7f00000212c0)='./file0\x00', 0x0, &(0x7f0000021300)={[&(0x7f0000021340)=' ']}) setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, 0x0, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2d, &(0x7f0000021380)={0x1, {{0xa, 0x0, 0x0, @mcast1, 0x5}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) 3.240244434s ago: executing program 1 (id=170): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) bind$802154_dgram(r0, &(0x7f00000001c0)={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0102}}}, 0x14) connect$802154_dgram(r0, &(0x7f0000000280)={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0103}}}, 0x14) sendmmsg(r0, &(0x7f0000000a80)=[{{0x0, 0x0, 0x0}}, {{0x0, 0xd, 0x0}}], 0x4000050, 0x400c010) (fail_nth: 4) 2.916899243s ago: executing program 4 (id=171): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000200), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000240), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000300)=0x6) semctl$IPC_INFO(0x0, 0x3, 0x3, 0x0) r3 = semget(0x1, 0x5, 0x6b4) semctl$IPC_RMID(r3, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, &(0x7f00000003c0)={{0x200002, 0x0, 0x4, 0xfffffffe, 'syz0\x00', 0xf5}, 0x4, 0x400, 0x1, 0x0, 0x0, 0x77c3, 'syz1\x00', 0x0}) r4 = syz_open_dev$sndctrl(&(0x7f0000000500), 0x0, 0x0) prlimit64(r0, 0xb, &(0x7f0000000540)={0xffffffffffffffff, 0x3}, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r4, 0xc1105511, &(0x7f0000000580)={{0xc, 0x0, 0x0, 0x0, 'syz1\x00'}, 0x0, [0x800000000, 0x100, 0x7ffc, 0xfffffffffffffffe, 0x9, 0x100000002, 0x0, 0x4, 0x0, 0x5, 0xc3, 0x7f, 0x1, 0x0, 0x8000000, 0x0, 0x8, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x100000000, 0xffffffffffffffff, 0xfffffffffffffffc, 0x5, 0x4, 0x4, 0x2, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x20, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3, 0xfffffffe, 0x0, 0x6, 0xfffffdfffffffffe, 0x3, 0x804000, 0x0, 0xffffffff, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0xb4e, 0x6, 0x2000000, 0xfffffffc, 0x1, 0x0, 0x0, 0xd87, 0x8a95, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0xdf9cd8e, 0x7, 0x6, 0x5, 0x0, 0x0, 0x0, 0xbb, 0x200000, 0x0, 0xfffffffffffffff7, 0xfffffffe, 0x9, 0x7ffffffd, 0x3, 0x0, 0xffffffffffff2328, 0x2, 0x3, 0x0, 0x1, 0x1000000000000, 0x2, 0x8000000000000003, 0x20000000000f916, 0x8, 0x8, 0x8, 0x4, 0x0, 0x7, 0xb, 0x1, 0x7, 0x0, 0x0, 0x6, 0xfffffffffffffffe, 0x0, 0x0, 0x7ff]}) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000a80)={'vcan0\x00'}) r5 = io_uring_setup(0x1, &(0x7f0000000ac0)={0x0, 0x0, 0x3800}) io_uring_register$IORING_REGISTER_ZCRX_IFQ(r5, 0x20, &(0x7f0000000b40)={0x0, 0x0, 0x1, 0x2, &(0x7f0000000bc0)={&(0x7f0000000c00), 0x1000}, &(0x7f0000000c40)={&(0x7f0000000c80), 0x1000, 0x1}}, 0x1) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r6 = getpgrp(0xffffffffffffffff) getpgrp(r6) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r7 = getpid() sched_setscheduler(r7, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x1b5c8000) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) 2.472335935s ago: executing program 2 (id=172): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000380)=ANY=[@ANYBLOB="180200000400000000000000000000008500000041000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000095"], &(0x7f0000000400)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r0, 0x11, 0xe, 0x0, &(0x7f00000004c0)="5fd63edbfd8a4a1bfebc74607795", 0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x50) 1.725476689s ago: executing program 4 (id=173): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB="6401000010000100feffffff00010000fc00000000000000000000000000000164010101000000000000000000000000000107144e230005000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c000000ac14143f000000000000000000000000000000000000000092010000000000000600000000000000ffff0000000000001c250800000000000200000000000000f8ffffffffffffff0000000000000000ffffffffffffffff00000000000000001f00000000000000feffffffffffffff02000000fcffffff000000002abd700004350000020001002000000000000000480003006465666c6174650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000b000600000008001800400000000a001000010000000000000008000b000600000008"], 0x164}, 0x1, 0x0, 0x0, 0x8801}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r0, 0x0, 0x8080) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000d80)=ANY=[@ANYBLOB="05000000050000"], 0x50) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000bc0), 0x0, 0x0) sendmsg$nl_route(r3, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000001100)={&(0x7f0000001140)=ANY=[@ANYBLOB="400000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="23000100000000001a00128008000100707070000c00028008000100", @ANYRES32=r4, @ANYBLOB="08001f0005000000"], 0x40}}, 0x0) ioctl$INCFS_IOC_READ_FILE_SIGNATURE(r4, 0x8010671f, &(0x7f0000001180)={&(0x7f00000011c0)=""/57, 0x39}) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000f80)={r2}, 0xc) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000ac0), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_PROTOCOLS(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000b80)={&(0x7f0000000fc0)=ANY=[@ANYBLOB='d\x00\x00', @ANYBLOB="080026bd7000fddbdf25070000000800040003000000080007000000000014000500ff01000000000000000000000000000108000400020000001400060000000000000000000000ffff0a010102080007000000000408000800ac1414aaac83fb216a8ceb264dcb35eb3d5202e824020dd019838d58799ea9b8f210222ab803781f0b07585dc1fd46994847ff624bdb116a719972dee0a24b36ab0a29a3d85232377e0df6c8bed0379c2f0d5c3accfd95490187dac697dcd8720d1ae802395225b4ee7e3e634fbc973c286ff3996fd04fa181964de7115927b9175533"], 0x64}, 0x1, 0x0, 0x0, 0x8800}, 0x8000880) mkdirat(0xffffffffffffff9c, &(0x7f0000000c40)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000c80)='./proc\x00', &(0x7f0000000cc0)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000d40)="522db49c", 0x4) openat$dm_control(0xffffffffffffff9c, &(0x7f0000000180), 0x883, 0x0) r5 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@newtfilter={0xcc, 0x2c, 0xd2b, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x3}, {}, {0x4, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0xa0, 0x2, [@TCA_U32_CLASSID={0x8, 0x1, {0xd, 0x4}}, @TCA_U32_SEL={0x94, 0x5, {0xb, 0xc, 0x9, 0x7, 0x0, 0xefdf, 0x2, 0x84c, [{0xc000000, 0x9, 0x2, 0x3}, {0x0, 0x8000, 0x1, 0x32ec}, {0x9, 0x8, 0x807, 0x4}, {0x4, 0x2, 0xc5f5, 0x4}, {0xffff, 0x7, 0x2, 0x9}, {0xffffffff, 0x5, 0x80, 0x4}, {0x8, 0xb56, 0x1003}, {0x7, 0x4, 0x4d, 0x653}]}}]}}]}, 0xcc}}, 0x24040084) r7 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./proc/thread-self/fail-nth\x00', 0x80002, 0x0) write(r7, &(0x7f0000000040)='3', 0x4e) write$P9_RSYMLINK(r7, &(0x7f0000000080)={0x14, 0x11, 0x2, {0x0, 0x4, 0x3}}, 0x14) 1.701078085s ago: executing program 0 (id=174): prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000240)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0) read$msr(r3, &(0x7f0000003d40)=""/102392, 0x18ff8) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0a000000070000000200000004"], 0x50) close(0x3) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r6 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r5}, &(0x7f00000003c0), &(0x7f0000000400)=r6}, 0x20) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x14, 0x10, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b702000001000000850000008600000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x1, 0x10, &(0x7f00000006c0)=ANY=[], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r8, 0x1, 0x32, &(0x7f0000000740)=r10, 0x4) sendmsg$unix(r9, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) r11 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) recvmmsg(r11, &(0x7f0000000180), 0x72a, 0x0, 0x0) 1.468761699s ago: executing program 2 (id=175): getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(0xffffffffffffffff, 0x84, 0x74, &(0x7f00000009c0)=""/47, &(0x7f0000000a00)=0x2f) 597.797556ms ago: executing program 0 (id=176): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000019c0)=@raw={'raw\x00', 0x3c1, 0x1d, 0x320, 0x130, 0xc8, 0x8, 0x130, 0x5803, 0x250, 0x2e8, 0x2e8, 0x250, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffff00, 0xffffffff, 0xff], [0xffffff7f, 0xfffffefe, 0xffffffff, 0xffffffff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x84, 0xb7}, 0x0, 0x108, 0x130, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}, @inet=@rpfilter={{0x28}, {0x5}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0xc, 0x100, 0x3}}}, {{@ipv6={@private1={0xfc, 0x1, '\x00', 0x1}, @mcast2, [0xffffff00, 0xff000000, 0xff000000, 0xffffff00], [0xff, 0xffffff00, 0xff, 0xffffffff], 'team0\x00', 'wg2\x00', {}, {}, 0x112, 0x6, 0x4, 0x10}, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x8}}, @inet=@rpfilter={{0x28}, {0x8}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0x0, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x380) 576.396241ms ago: executing program 3 (id=177): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000001600), 0xe) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0xf, &(0x7f00000002c0)=0xffffffff, 0x1) (fail_nth: 4) 451.340712ms ago: executing program 1 (id=178): r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) r1 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000580), 0x8000, 0x0) ioctl$DM_DEV_CREATE(r1, 0xc138fd03, &(0x7f00000005c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) ioctl$DM_TABLE_LOAD(r0, 0xc138fd12, &(0x7f0000000700)={0x4, 0x0, 0x0, 0x1a8, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_dev={r2}, [@crypt={0x0, 0x2800, 0x0, 0x70, 'crypt\x00', {'aes-cbc-essiv:sha256', 0x20, @none, 0x20, '16', 0x20, {@ram_num={'1:', 0x0}, 0x20, '4096'}, ' 1 same_cpu_crypt'}}]}) 451.144976ms ago: executing program 2 (id=179): r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) r1 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000580), 0x8000, 0x0) ioctl$DM_DEV_CREATE(r1, 0xc138fd03, &(0x7f00000005c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000700)={0x4, 0x0, 0x0, 0x1a8, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_dev={r2}, [@crypt={0x0, 0x2800, 0x0, 0x70, 'crypt\x00', {'aes-cbc-essiv:sha256', 0x20, @none, 0x20, '16', 0x20, {@ram_num={'1:', 0x0}, 0x20, '4096'}, ' 1 same_cpu_crypt'}}]}) (fail_nth: 4) 375.69503ms ago: executing program 3 (id=180): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000540)=ANY=[@ANYBLOB="14000000100001000000000000000000bd00000a28000000000a010300000000000000000100000008000240000000020900010073797a310000000054000000030a01020000000000000000010000000900030073797a300000000028000480080002402000000008000140000000051400030076657468315f6d6163767461700000000900010073797a310000000014000000110001"], 0xa4}, 0x1, 0x0, 0x0, 0x4}, 0x0) r1 = syz_open_dev$radio(&(0x7f0000000100), 0x3, 0x2) ioctl$VIDIOC_ENUMOUTPUT(r1, 0xc0485630, &(0x7f0000000140)={0x3, "75420a2256165e7984d670394157bbf1f87b7dd5583abb313b0267af7b85da1c", 0x3, 0x2, 0x58, 0xffffff, 0x8}) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc0686611, &(0x7f0000000080)={0x68, 0x0, 0x30, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) ioctl$PPPIOCGFLAGS(r2, 0x8004745a, &(0x7f00000000c0)) syz_emit_ethernet(0x4e, &(0x7f0000000000)=ANY=[@ANYBLOB="e33110495bfdaaaaaaaaaabb86dd6000000000183aff00000000000000000000002000000000ff"], 0x0) close(0x3) 205.246324ms ago: executing program 1 (id=181): r0 = syz_open_dev$mtd(&(0x7f0000000140), 0xa, 0x80) ioctl$MEMUNLOCK(r0, 0x125f, 0x0) 144.667487ms ago: executing program 2 (id=182): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000680), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000001940)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001980), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000019c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000001a00)={0x0, 0x0, &(0x7f0000001a40)={&(0x7f0000001a80)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x6, 0x9}, {0x6, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0x3, 0x6363, 0x5, 0xffffffff, 0x3}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0xffffffff, 0xfffffffc, 0x408, 0xc, 0x215}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x2000800) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000001b00)={'syzkaller0\x00', @multicast}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000001b40), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f0000001b80)={0x0, 0x0, &(0x7f0000001bc0)={&(0x7f0000001c00)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000001c40), 0x100, 0x0) close(r6) r7 = socket$unix(0x1, 0x5, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x18, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100010000000000000700008500000075000000850000007d0000009500000000000000"], &(0x7f0000000140)='GPL\x00', 0x6, 0x0, 0x0, 0x41100, 0x11, '\x00', r3}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) openat$dm_control(0xffffffffffffff9c, 0x0, 0x2, 0x0) r11 = openat$dm_control(0xffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$DM_DEV_CREATE(r11, 0xc138fd03, &(0x7f00000002c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}}}) ioctl$DM_TABLE_LOAD(r11, 0xc138fd09, &(0x7f0000000400)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_dev={r12}, [@snapshot={0x0, 0x2018, 0x0, 0x80, 'snapshot\x00', {@ram={'/dev/ram', 0x1}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'P', 0x20, '16', ' 2 discard_zeroes_cow discard_passdown_origin'}}]}) ioctl$PPPIOCGIDLE64(0xffffffffffffffff, 0x8010743f, &(0x7f00000005c0)) ioctl$DM_TABLE_LOAD(r11, 0xc138fd09, &(0x7f00000006c0)={0x4, 0x0, 0x0, 0x198, 0x138, 0x1, 0x0, 0x10, 0x0, 0x0, @by_dev={r12}, [@writecache={0x0, 0x1000, 0x0, 0x60, 'writecache\x00', {0x73, 0x20, @ram={'/dev/ram', 0x1}, 0x20, @ram={'/dev/ram', 0x0}, 0x20, '4096', 0x20, '2 autocommit_time 100'}}]}) socket$nl_route(0x10, 0x3, 0x0) r13 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f0000001c80)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r13, &(0x7f0000001cc0)={0x0, 0x0, &(0x7f0000001d00)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r14, {0x0, 0xd}, {0xffff, 0xb}, {0x2, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_FLOW_MODE={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x88000}, 0x4890) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000001dc0)={'syzkaller0\x00'}) 21.834068ms ago: executing program 1 (id=183): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000040)={0x3, 0x2, 0x1}) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2, 0x11, r1, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000080)={0x5, 0x2, 0x4, 0x0, 0xd}) connect$inet6(r0, &(0x7f0000000500)={0xa, 0x6001, 0x1, @dev={0xfe, 0x80, '\x00', 0x3d}, 0xfffff1af}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000540)='highspeed', 0x6) ioctl$sock_inet6_tcp_SIOCOUTQ(r0, 0x5411, 0x0) 0s ago: executing program 3 (id=184): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000200), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000240), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000300)=0x6) semctl$IPC_INFO(0x0, 0x3, 0x3, 0x0) r3 = semget(0x1, 0x5, 0x6b4) semctl$IPC_RMID(r3, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, &(0x7f00000003c0)={{0x200002, 0x0, 0x4, 0xfffffffe, 'syz0\x00', 0xf5}, 0x4, 0x400, 0x1, 0x0, 0x0, 0x77c3, 'syz1\x00', 0x0}) r4 = syz_open_dev$sndctrl(&(0x7f0000000500), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r4, 0xc1105511, &(0x7f0000000580)={{0xc, 0x0, 0x0, 0x0, 'syz1\x00'}, 0x0, [0x800000000, 0x100, 0x7ffc, 0xfffffffffffffffe, 0x9, 0x100000002, 0x0, 0x4, 0x0, 0x5, 0xc3, 0x7f, 0x1, 0x0, 0x8000000, 0x0, 0x8, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x100000000, 0xffffffffffffffff, 0xfffffffffffffffc, 0x5, 0x4, 0x4, 0x2, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x20, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3, 0xfffffffe, 0x0, 0x6, 0xfffffdfffffffffe, 0x3, 0x804000, 0x0, 0xffffffff, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0xb4e, 0x6, 0x2000000, 0xfffffffc, 0x1, 0x0, 0x0, 0xd87, 0x8a95, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0xdf9cd8e, 0x7, 0x6, 0x5, 0x0, 0x0, 0x0, 0xbb, 0x200000, 0x0, 0xfffffffffffffff7, 0xfffffffe, 0x9, 0x7ffffffd, 0x3, 0x0, 0xffffffffffff2328, 0x2, 0x3, 0x0, 0x1, 0x1000000000000, 0x2, 0x8000000000000003, 0x20000000000f916, 0x8, 0x8, 0x8, 0x4, 0x0, 0x7, 0xb, 0x1, 0x7, 0x0, 0x0, 0x6, 0xfffffffffffffffe, 0x0, 0x0, 0x7ff]}) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000a80)={'vcan0\x00'}) r6 = io_uring_setup(0x1, &(0x7f0000000ac0)={0x0, 0x0, 0x3800}) io_uring_register$IORING_REGISTER_ZCRX_IFQ(r6, 0x20, &(0x7f0000000b40)={0x0, 0x0, 0x1, 0x2, &(0x7f0000000bc0)={&(0x7f0000000c00), 0x1000}, &(0x7f0000000c40)={&(0x7f0000000c80), 0x1000, 0x1}}, 0x1) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r7 = getpgrp(0xffffffffffffffff) getpgrp(r7) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r8 = getpid() sched_setscheduler(r8, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x1b5c8000) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): bridge_slave_1) entered forwarding state [ 66.170057][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.170099][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 66.190754][ T152] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.190794][ T152] bridge0: port 2(bridge_slave_1) entered forwarding state [ 66.237730][ T5601] 8021q: adding VLAN 0 to HW filter on device bond0 [ 66.278267][ T5617] 8021q: adding VLAN 0 to HW filter on device bond0 [ 66.280202][ T5609] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 66.297253][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 66.306496][ T5609] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 66.311628][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 66.312139][ T5609] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 66.318064][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 66.326828][ T5609] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 66.333041][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 66.338896][ T5601] 8021q: adding VLAN 0 to HW filter on device team0 [ 66.368500][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.368578][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 66.370873][ T5617] 8021q: adding VLAN 0 to HW filter on device team0 [ 66.409487][ T152] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.409563][ T152] bridge0: port 2(bridge_slave_1) entered forwarding state [ 66.416476][ T152] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.416545][ T152] bridge0: port 1(bridge_slave_0) entered forwarding state [ 66.438963][ T152] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.439031][ T152] bridge0: port 2(bridge_slave_1) entered forwarding state [ 66.602839][ T5604] Bluetooth: hci2: command tx timeout [ 66.602867][ T5604] Bluetooth: hci3: command tx timeout [ 66.603612][ T51] Bluetooth: hci0: command tx timeout [ 66.682847][ T51] Bluetooth: hci1: command tx timeout [ 66.684349][ T5609] 8021q: adding VLAN 0 to HW filter on device bond0 [ 66.727794][ T5609] 8021q: adding VLAN 0 to HW filter on device team0 [ 66.758079][ T152] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.758200][ T152] bridge0: port 1(bridge_slave_0) entered forwarding state [ 66.763705][ T51] Bluetooth: hci4: command tx timeout [ 66.769997][ T152] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.770083][ T152] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.266379][ T5610] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.288054][ T5602] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.417998][ T5602] veth0_vlan: entered promiscuous mode [ 67.438483][ T5617] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.439986][ T5610] veth0_vlan: entered promiscuous mode [ 67.450358][ T5602] veth1_vlan: entered promiscuous mode [ 67.462457][ T5610] veth1_vlan: entered promiscuous mode [ 67.496141][ T5601] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.531234][ T5602] veth0_macvtap: entered promiscuous mode [ 67.542861][ T5602] veth1_macvtap: entered promiscuous mode [ 67.547003][ T5610] veth0_macvtap: entered promiscuous mode [ 67.550206][ T5610] veth1_macvtap: entered promiscuous mode [ 67.600427][ T5602] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 67.631997][ T5602] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 67.666246][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 67.674164][ T5601] veth0_vlan: entered promiscuous mode [ 67.686000][ T5609] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.688237][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 67.712693][ T59] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.712791][ T59] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.712821][ T59] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.712851][ T59] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.731453][ T5601] veth1_vlan: entered promiscuous mode [ 67.858918][ T5601] veth0_macvtap: entered promiscuous mode [ 67.893534][ T5609] veth0_vlan: entered promiscuous mode [ 67.896968][ T5601] veth1_macvtap: entered promiscuous mode [ 67.909245][ T102] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.909260][ T102] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.939018][ T5609] veth1_vlan: entered promiscuous mode [ 67.944112][ T102] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.944125][ T102] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.988330][ T102] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.988345][ T102] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.006342][ T5601] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 68.015849][ T5617] veth0_vlan: entered promiscuous mode [ 68.021730][ T5617] veth1_vlan: entered promiscuous mode [ 68.029207][ T30] kauditd_printk_skb: 18 callbacks suppressed [ 68.029218][ T30] audit: type=1400 audit(1792615368.143:157): avc: denied { mounton } for pid=5602 comm="syz-executor" path="/root/syzkaller.uvQJfj/syz-tmp" dev="sda1" ino=2042 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 68.029800][ T30] audit: type=1400 audit(1792615368.143:158): avc: denied { mount } for pid=5602 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 68.031636][ T30] audit: type=1400 audit(1792615368.143:159): avc: denied { mounton } for pid=5602 comm="syz-executor" path="/root/syzkaller.uvQJfj/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 68.034377][ T30] audit: type=1400 audit(1792615368.153:160): avc: denied { mount } for pid=5602 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 68.037066][ T30] audit: type=1400 audit(1792615368.153:161): avc: denied { mounton } for pid=5602 comm="syz-executor" path="/root/syzkaller.uvQJfj/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 68.038137][ T30] audit: type=1400 audit(1792615368.153:162): avc: denied { mounton } for pid=5602 comm="syz-executor" path="/root/syzkaller.uvQJfj/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=7630 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 68.042864][ T30] audit: type=1400 audit(1792615368.153:163): avc: denied { unmount } for pid=5602 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 68.047479][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.047492][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.056146][ T5601] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 68.068864][ T30] audit: type=1400 audit(1792615368.183:164): avc: denied { mounton } for pid=5602 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2784 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 68.070564][ T30] audit: type=1400 audit(1792615368.183:165): avc: denied { mount } for pid=5602 comm="syz-executor" name="/" dev="gadgetfs" ino=7650 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 68.074266][ T30] audit: type=1400 audit(1792615368.193:166): avc: denied { mount } for pid=5602 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 68.093097][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.093130][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.093157][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.093183][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.227196][ T5602] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 68.242496][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.242531][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.242559][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.242586][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.361713][ T5609] veth0_macvtap: entered promiscuous mode [ 68.387183][ T5609] veth1_macvtap: entered promiscuous mode [ 68.418740][ T5801] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3'. [ 68.426754][ T5617] veth0_macvtap: entered promiscuous mode [ 68.539283][ T5617] veth1_macvtap: entered promiscuous mode [ 68.567279][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 68.570695][ T102] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.570707][ T102] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.584290][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 68.627464][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 68.646406][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 68.652602][ T59] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.652634][ T59] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.652660][ T59] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.652698][ T59] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.670109][ T4257] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.670122][ T4257] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.693854][ T4922] Bluetooth: hci3: command tx timeout [ 68.693876][ T4922] Bluetooth: hci2: command tx timeout [ 68.693957][ T51] Bluetooth: hci0: command tx timeout [ 68.752516][ T4257] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.753367][ T160] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.753510][ T160] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.753623][ T160] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.772599][ T51] Bluetooth: hci1: command tx timeout [ 68.843429][ T51] Bluetooth: hci4: command tx timeout [ 68.862388][ T5728] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 68.880540][ T160] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.880551][ T160] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.942946][ T160] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.942957][ T160] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.454029][ T5728] usb 4-1: New USB device found, idVendor=06cd, idProduct=0121, bcdDevice=dd.3d [ 69.511759][ T5808] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 69.704944][ T5728] usb 4-1: config 0 has an invalid interface number: 133 but max is 0 [ 69.704960][ T5728] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 69.704971][ T5728] usb 4-1: config 0 has no interface number 0 [ 69.704990][ T5728] usb 4-1: config 0 interface 133 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 69.992179][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 70.132390][ T0] NOHZ tick-stop error: local softirq work is pending, handler #102!!! [ 70.529864][ T5728] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 70.529886][ T5728] usb 4-1: Product: syz [ 70.529898][ T5728] usb 4-1: Manufacturer: syz [ 70.529911][ T5728] usb 4-1: SerialNumber: syz [ 70.550025][ T5728] usb 4-1: config 0 descriptor?? [ 70.658855][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.658880][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.748999][ T102] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.749011][ T102] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.768161][ T5604] Bluetooth: hci2: command tx timeout [ 70.768187][ T5604] Bluetooth: hci3: command tx timeout [ 70.768231][ T51] Bluetooth: hci0: command tx timeout [ 70.842486][ T51] Bluetooth: hci1: command tx timeout [ 70.922372][ T51] Bluetooth: hci4: command tx timeout [ 71.129842][ T5819] netlink: 52 bytes leftover after parsing attributes in process `syz.4.5'. [ 71.462175][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 71.652172][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 72.112359][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 72.539812][ T5728] keyspan 4-1:0.133: Keyspan 1 port adapter converter detected [ 72.540276][ T5728] keyspan 4-1:0.133: found no endpoint descriptor for endpoint 82 [ 72.541092][ T5728] keyspan 4-1:0.133: found no endpoint descriptor for endpoint 81 [ 72.541142][ T5728] keyspan 4-1:0.133: found no endpoint descriptor for endpoint 1 [ 72.541174][ T5728] keyspan 4-1:0.133: found no endpoint descriptor for endpoint 2 [ 72.546016][ T5728] usb 4-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 72.552031][ T5728] usb 4-1: USB disconnect, device number 2 [ 72.562948][ T5728] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 72.563404][ T5728] keyspan 4-1:0.133: device disconnected [ 73.874073][ T30] kauditd_printk_skb: 36 callbacks suppressed [ 73.874092][ T30] audit: type=1400 audit(1792615373.493:203): avc: denied { append } for pid=5826 comm="syz.3.7" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 73.874131][ T30] audit: type=1400 audit(1792615373.493:204): avc: denied { open } for pid=5826 comm="syz.3.7" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 73.874163][ T30] audit: type=1400 audit(1792615373.523:205): avc: denied { ioctl } for pid=5826 comm="syz.3.7" path="socket:[7942]" dev="sockfs" ino=7942 ioctlcmd=0x8901 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 74.150139][ T30] audit: type=1400 audit(1792615374.263:206): avc: denied { read write } for pid=5830 comm="syz.0.9" name="uhid" dev="devtmpfs" ino=1270 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 74.150391][ T30] audit: type=1400 audit(1792615374.263:207): avc: denied { open } for pid=5830 comm="syz.0.9" path="/dev/uhid" dev="devtmpfs" ino=1270 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 74.225152][ T5707] rxe_eth0 speed is unknown, defaulting to 1000 [ 74.614034][ T30] audit: type=1400 audit(1792615374.543:208): avc: denied { read } for pid=5830 comm="syz.0.9" name="event2" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 74.614184][ T30] audit: type=1400 audit(1792615374.543:209): avc: denied { open } for pid=5830 comm="syz.0.9" path="/dev/input/event2" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 74.614302][ T30] audit: type=1400 audit(1792615374.553:210): avc: denied { ioctl } for pid=5830 comm="syz.0.9" path="/dev/input/event2" dev="devtmpfs" ino=921 ioctlcmd=0x4593 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 75.144421][ T30] audit: type=1400 audit(1792615375.263:211): avc: denied { write } for pid=5833 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 75.207142][ T5848] netlink: 52 bytes leftover after parsing attributes in process `syz.0.12'. [ 76.290734][ T30] audit: type=1400 audit(1792615375.993:212): avc: denied { map } for pid=5852 comm="syz.1.6" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=7968 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 76.317224][ T29] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 76.328913][ T2340] cfg80211: failed to load regulatory.db [ 76.473340][ T29] usb 3-1: New USB device found, idVendor=06cd, idProduct=0121, bcdDevice=dd.3d [ 76.475579][ T29] usb 3-1: config 0 has an invalid interface number: 133 but max is 0 [ 76.475609][ T29] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 76.475626][ T29] usb 3-1: config 0 has no interface number 0 [ 76.475657][ T29] usb 3-1: config 0 interface 133 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 76.478979][ T29] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 76.478999][ T29] usb 3-1: Product: syz [ 76.479013][ T29] usb 3-1: Manufacturer: syz [ 76.479026][ T29] usb 3-1: SerialNumber: syz [ 76.581215][ T29] usb 3-1: config 0 descriptor?? [ 77.642223][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 78.601364][ T5865] netlink: 52 bytes leftover after parsing attributes in process `syz.0.14'. [ 78.724776][ T29] keyspan 3-1:0.133: Keyspan 1 port adapter converter detected [ 78.724853][ T29] keyspan 3-1:0.133: found no endpoint descriptor for endpoint 82 [ 78.733253][ T29] keyspan 3-1:0.133: found no endpoint descriptor for endpoint 81 [ 78.733309][ T29] keyspan 3-1:0.133: found no endpoint descriptor for endpoint 1 [ 78.733362][ T29] keyspan 3-1:0.133: found no endpoint descriptor for endpoint 2 [ 78.748354][ T29] usb 3-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 78.762040][ T29] usb 3-1: USB disconnect, device number 2 [ 78.770419][ T29] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 78.777917][ T29] keyspan 3-1:0.133: device disconnected [ 78.954326][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 78.954343][ T30] audit: type=1400 audit(1792615379.073:215): avc: denied { write } for pid=5870 comm="syz.4.11" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 78.968597][ T30] audit: type=1400 audit(1792615379.083:216): avc: denied { read } for pid=5870 comm="syz.4.11" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 78.975722][ T30] audit: type=1400 audit(1792615379.093:217): avc: denied { ioctl } for pid=5870 comm="syz.4.11" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 79.079200][ T30] audit: type=1400 audit(1792615379.193:218): avc: denied { create } for pid=5868 comm="syz.2.16" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 79.185143][ T5871] rxe_eth0 speed is unknown, defaulting to 1000 [ 79.817577][ T30] audit: type=1400 audit(1792615379.913:219): avc: denied { remount } for pid=5864 comm="syz.0.14" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 79.949115][ T5875] rxe_eth0 speed is unknown, defaulting to 1000 [ 80.011429][ T30] audit: type=1400 audit(1792615380.123:220): avc: denied { create } for pid=5877 comm="syz.3.15" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 80.033454][ T30] audit: type=1400 audit(1792615380.153:221): avc: denied { setopt } for pid=5877 comm="syz.3.15" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 80.970352][ T30] audit: type=1400 audit(1792615380.693:222): avc: denied { write } for pid=5877 comm="syz.3.15" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 81.133697][ T30] audit: type=1400 audit(1792615381.253:223): avc: denied { unmount } for pid=5609 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 82.632698][ T30] audit: type=1400 audit(1792615382.743:224): avc: denied { write } for pid=5889 comm="syz.4.20" name="001" dev="devtmpfs" ino=732 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 84.912397][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 84.991169][ T5897] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 84.994497][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 84.994512][ T30] audit: type=1400 audit(1792615385.103:228): avc: denied { read append } for pid=5895 comm="syz.4.21" name="rtc0" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 84.994536][ T30] audit: type=1400 audit(1792615385.103:229): avc: denied { open } for pid=5895 comm="syz.4.21" path="/dev/rtc0" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 84.994556][ T30] audit: type=1400 audit(1792615385.103:230): avc: denied { ioctl } for pid=5895 comm="syz.4.21" path="/dev/rtc0" dev="devtmpfs" ino=920 ioctlcmd=0x700f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 84.994576][ T30] audit: type=1400 audit(1792615385.113:231): avc: denied { read } for pid=5895 comm="syz.4.21" name="loop-control" dev="devtmpfs" ino=644 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 84.994596][ T30] audit: type=1400 audit(1792615385.113:232): avc: denied { open } for pid=5895 comm="syz.4.21" path="/dev/loop-control" dev="devtmpfs" ino=644 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 84.994616][ T30] audit: type=1400 audit(1792615385.113:233): avc: denied { ioctl } for pid=5895 comm="syz.4.21" path="/dev/loop-control" dev="devtmpfs" ino=644 ioctlcmd=0x4c80 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 87.125972][ T5908] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 87.472389][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c0!!! [ 87.901881][ T30] audit: type=1400 audit(1792615388.013:234): avc: denied { create } for pid=5914 comm="syz.2.23" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 88.830974][ T5913] kvm: user requested TSC rate below hardware speed [ 89.143518][ T30] audit: type=1400 audit(1792615389.263:235): avc: denied { write } for pid=5914 comm="syz.2.23" name="cells" dev="proc" ino=4026533368 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 89.891738][ T30] audit: type=1400 audit(1792615390.003:236): avc: denied { create } for pid=5928 comm="syz.2.28" name="file2" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 89.937284][ T30] audit: type=1400 audit(1792615390.053:237): avc: denied { write } for pid=5928 comm="syz.2.28" name="file2" dev="tmpfs" ino=46 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 90.442393][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 90.642233][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 90.642246][ T30] audit: type=1400 audit(1792615390.243:239): avc: denied { map_read map_write } for pid=5928 comm="syz.2.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 92.597205][ T5937] input: syz0 as /devices/virtual/input/input5 [ 92.854827][ T5800] libceph: connect (1)[c::]:6789 error -101 [ 92.868267][ T5800] libceph: mon0 (1)[c::]:6789 connect error [ 92.872970][ T5937] ceph: No mds server is up or the cluster is laggy [ 93.144006][ T29] libceph: connect (1)[c::]:6789 error -101 [ 93.144532][ T29] libceph: mon0 (1)[c::]:6789 connect error [ 93.389222][ T30] audit: type=1400 audit(1792615393.473:240): avc: denied { mount } for pid=5941 comm="syz.0.27" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 94.492538][ T29] libceph: connect (1)[c::]:6789 error -101 [ 94.492698][ T29] libceph: mon0 (1)[c::]:6789 connect error [ 94.536224][ T30] audit: type=1400 audit(1792615394.643:241): avc: denied { unlink } for pid=5602 comm="syz-executor" name="file2" dev="tmpfs" ino=46 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 94.808074][ T30] audit: type=1400 audit(1792615394.923:242): avc: denied { ioctl } for pid=5948 comm="syz.2.29" path="/dev/video37" dev="devtmpfs" ino=1049 ioctlcmd=0x5609 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 94.837726][ T5708] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 94.950340][ T30] audit: type=1400 audit(1792615395.063:243): avc: denied { unmount } for pid=5602 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 94.992273][ T5708] usb 1-1: Using ep0 maxpacket: 32 [ 94.994214][ T5708] usb 1-1: unable to get BOS descriptor or descriptor too short [ 94.994254][ T5708] usb 1-1: New USB device found, idVendor=0ccd, idProduct=0102, bcdDevice=89.0e [ 94.995801][ T5708] usb 1-1: config 8 has an invalid interface number: 188 but max is 0 [ 94.995823][ T5708] usb 1-1: config 8 has no interface number 0 [ 94.995848][ T5708] usb 1-1: config 8 interface 188 has no altsetting 0 [ 94.999693][ T5708] usb 1-1: string descriptor 0 read error: -22 [ 94.999793][ T5708] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.152277][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 95.539791][ T5953] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 95.587659][ T5708] dvb-usb: found a 'Terratec Cinergy S2 USB HD Rev.3' in warm state. [ 95.587858][ T5708] dw2102: su3000_power_ctrl: 1, initialized 0 [ 95.588536][ T5708] dvb-usb: bulk message failed: -22 (2/0) [ 95.893317][ T5708] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 95.901390][ T5708] dvbdev: DVB: registering new adapter (Terratec Cinergy S2 USB HD Rev.3) [ 95.901441][ T5708] usb 1-1: media controller created [ 95.903451][ T5708] dvb-usb: bulk message failed: -22 (6/0) [ 95.903465][ T5708] dw2102: i2c transfer failed. [ 95.903490][ T5708] dvb-usb: bulk message failed: -22 (6/0) [ 95.903501][ T5708] dw2102: i2c transfer failed. [ 95.903510][ T5708] dvb-usb: bulk message failed: -22 (6/0) [ 95.903520][ T5708] dw2102: i2c transfer failed. [ 95.903529][ T5708] dvb-usb: bulk message failed: -22 (6/0) [ 95.903539][ T5708] dw2102: i2c transfer failed. [ 95.903547][ T5708] dvb-usb: bulk message failed: -22 (6/0) [ 95.903557][ T5708] dw2102: i2c transfer failed. [ 95.903566][ T5708] dvb-usb: bulk message failed: -22 (6/0) [ 95.903588][ T5708] dw2102: i2c transfer failed. [ 95.903594][ T5708] dvb-usb: MAC address: 02:02:02:02:02:02 [ 96.052026][ T30] audit: type=1400 audit(1792615396.163:244): avc: denied { setopt } for pid=5941 comm="syz.0.27" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 96.113650][ T5708] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 96.163678][ T5708] dvb-usb: bulk message failed: -22 (3/0) [ 96.163689][ T5708] dw2102: command 0x0e transfer failed. [ 96.163694][ T5708] dvb-usb: bulk message failed: -22 (3/0) [ 96.163701][ T5708] dw2102: command 0x0e transfer failed. [ 96.474538][ T5708] dvb-usb: bulk message failed: -22 (3/0) [ 96.474560][ T5708] dw2102: command 0x0e transfer failed. [ 96.474567][ T5708] dvb-usb: bulk message failed: -22 (3/0) [ 96.474591][ T5708] dw2102: command 0x0e transfer failed. [ 96.474598][ T5708] dvb-usb: bulk message failed: -22 (1/0) [ 96.474609][ T5708] dw2102: command 0x51 transfer failed. [ 96.973351][ T5708] DVB: Unable to find symbol ds3000_attach() [ 96.973367][ T5708] dvb-usb: no frontend was attached by 'Terratec Cinergy S2 USB HD Rev.3' [ 97.085889][ T5708] rc_core: IR keymap rc-su3000 not found [ 97.085900][ T5708] Registered IR keymap rc-empty [ 97.094531][ T5708] rc rc0: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 97.102560][ T5708] input: Terratec Cinergy S2 USB HD Rev.3 as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input6 [ 97.614583][ T5965] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 97.877795][ T5708] dvb-usb: schedule remote query interval to 150 msecs. [ 97.877811][ T5708] dw2102: su3000_power_ctrl: 0, initialized 1 [ 97.877818][ T5708] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully initialized and connected. [ 97.891578][ T5708] usb 1-1: USB disconnect, device number 2 [ 98.115535][ T5708] dvb-usb: Terratec Cinergy S2 USB HD Rev.3 successfully deinitialized and disconnected. [ 98.207364][ T5969] capability: warning: `syz.2.39' uses deprecated v2 capabilities in a way that may be insecure [ 98.396009][ T30] audit: type=1400 audit(1792615398.513:245): avc: denied { mmap_zero } for pid=5971 comm="syz.4.33" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 98.552577][ T5708] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 100.172774][ T5708] usb 1-1: Using ep0 maxpacket: 8 [ 100.182117][ T5708] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 100.207511][ T5708] usb 1-1: config 1 interface 0 has no altsetting 0 [ 100.209238][ T5708] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 100.209259][ T5708] usb 1-1: Product: syz [ 100.209271][ T5708] usb 1-1: Manufacturer: syz [ 100.209284][ T5708] usb 1-1: SerialNumber: syz [ 100.610771][ T5984] rxe_eth0 speed is unknown, defaulting to 1000 [ 100.719390][ T5708] usblp 1-1:1.0: usblp0: USB Unidirectional printer dev 3 if 0 alt 2 proto 1 vid 0x0525 pid 0xA4A8 [ 100.751344][ T5708] usb 1-1: USB disconnect, device number 3 [ 100.773052][ T5708] usblp0: removed [ 100.789146][ T5608] udevd[5608]: setting mode of /dev/bus/usb/001/003 to 020664 failed: No such file or directory [ 100.789200][ T5608] udevd[5608]: setting owner of /dev/bus/usb/001/003 to uid=0, gid=7 failed: No such file or directory [ 101.197277][ T5990] Zero length message leads to an empty skb [ 101.386714][ T5995] netlink: 52 bytes leftover after parsing attributes in process `syz.0.44'. [ 101.464845][ T5708] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 101.592475][ T5708] usb 2-1: device descriptor read/64, error -71 [ 101.832219][ T5708] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 101.861755][ T30] audit: type=1400 audit(1792615401.973:246): avc: denied { write } for pid=5999 comm="syz.3.41" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 101.900623][ T6002] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 101.900849][ T6002] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 102.036107][ T5708] usb 2-1: device descriptor read/64, error -71 [ 102.143890][ T5708] usb usb2-port1: attempt power cycle [ 102.163371][ T29] usb 4-1: new low-speed USB device number 3 using dummy_hcd [ 102.339089][ T29] usb 4-1: unable to get BOS descriptor or descriptor too short [ 102.339129][ T29] usb 4-1: New USB device found, idVendor=0a2c, idProduct=0008, bcdDevice=69.74 [ 102.343280][ T29] usb 4-1: config 2 has an invalid interface number: 124 but max is 0 [ 102.343301][ T29] usb 4-1: config 2 has no interface number 0 [ 102.385918][ T29] usb 4-1: string descriptor 0 read error: -22 [ 102.386015][ T29] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 102.397224][ T29] cypress_cy7c63 4-1:2.124: Cypress CY7C63xxx device now attached [ 102.514581][ T5708] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 102.539107][ T5708] usb 2-1: device descriptor read/8, error -71 [ 102.602040][ T29] usb 4-1: USB disconnect, device number 3 [ 102.621572][ T6010] netlink: 52 bytes leftover after parsing attributes in process `syz.0.47'. [ 102.627925][ T29] cypress_cy7c63 4-1:2.124: Cypress CY7C63xxx device now disconnected [ 102.842936][ T5708] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 102.863892][ T5708] usb 2-1: device descriptor read/8, error -71 [ 102.972805][ T5708] usb usb2-port1: unable to enumerate USB device [ 103.259088][ T6014] netlink: 52 bytes leftover after parsing attributes in process `syz.4.43'. [ 103.581605][ T30] audit: type=1400 audit(1792615403.663:247): avc: denied { map_create } for pid=6003 comm="syz.2.45" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 103.581810][ T30] audit: type=1400 audit(1792615403.663:248): avc: denied { map_read map_write } for pid=6003 comm="syz.2.45" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 104.195113][ T30] audit: type=1400 audit(1792615404.313:249): avc: denied { create } for pid=6029 comm="syz.0.50" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 104.682677][ T10] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 104.832385][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 104.834719][ T10] usb 1-1: New USB device found, idVendor=4752, idProduct=0011, bcdDevice=32.4f [ 104.838793][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xD has an invalid bInterval 0, changing to 7 [ 104.846770][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 104.846788][ T10] usb 1-1: Product: syz [ 104.846800][ T10] usb 1-1: Manufacturer: syz [ 104.846812][ T10] usb 1-1: SerialNumber: syz [ 104.879235][ T10] usb 1-1: config 0 descriptor?? [ 104.894055][ T10] hub 1-1:0.0: bad descriptor, ignoring hub [ 104.894076][ T10] hub 1-1:0.0: probe with driver hub failed with error -5 [ 104.918513][ T10] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 105.173420][ T6044] syz.2.53 (6044): drop_caches: 0 [ 106.284322][ T6055] netlink: 52 bytes leftover after parsing attributes in process `syz.4.58'. [ 106.502234][ T2340] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 106.727048][ T2340] usb 4-1: New USB device found, idVendor=06cd, idProduct=0121, bcdDevice=dd.3d [ 106.728061][ T2340] usb 4-1: config 0 has an invalid interface number: 133 but max is 0 [ 106.728084][ T2340] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 106.728117][ T2340] usb 4-1: config 0 has no interface number 0 [ 106.728135][ T2340] usb 4-1: config 0 interface 133 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 106.730082][ T2340] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.730096][ T2340] usb 4-1: Product: syz [ 106.730104][ T2340] usb 4-1: Manufacturer: syz [ 106.730112][ T2340] usb 4-1: SerialNumber: syz [ 106.822041][ T2340] usb 4-1: config 0 descriptor?? [ 106.981954][ T30] audit: type=1400 audit(1792615407.093:250): avc: denied { create } for pid=6058 comm="syz.4.59" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 107.018878][ T30] audit: type=1400 audit(1792615407.133:251): avc: denied { ioctl } for pid=6058 comm="syz.4.59" path="socket:[9512]" dev="sockfs" ino=9512 ioctlcmd=0x9436 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 107.019167][ T30] audit: type=1400 audit(1792615407.133:252): avc: denied { getopt } for pid=6058 comm="syz.4.59" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 107.024294][ T30] audit: type=1400 audit(1792615407.143:253): avc: denied { create } for pid=6058 comm="syz.4.59" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 107.348800][ T6062] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 107.449702][ T30] audit: type=1400 audit(1792615407.553:254): avc: denied { mounton } for pid=6061 comm="syz.4.60" path="/11/file0" dev="tmpfs" ino=83 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 107.503555][ T30] audit: type=1400 audit(1792615407.623:255): avc: denied { prog_load } for pid=6051 comm="syz.3.57" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 107.798159][ T6064] syz.2.56 uses obsolete (PF_INET,SOCK_PACKET) [ 107.817072][ T30] audit: type=1400 audit(1792615407.933:256): avc: denied { bind } for pid=6063 comm="syz.2.56" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 107.819322][ T30] audit: type=1400 audit(1792615407.933:257): avc: denied { name_bind } for pid=6063 comm="syz.2.56" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 107.821743][ T30] audit: type=1400 audit(1792615407.933:258): avc: denied { node_bind } for pid=6063 comm="syz.2.56" saddr=::1 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 107.906166][ T30] audit: type=1400 audit(1792615408.023:259): avc: denied { write } for pid=6063 comm="syz.2.56" laddr=::1 lport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 107.987597][ T6067] FAULT_INJECTION: forcing a failure. [ 107.987597][ T6067] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 107.987622][ T6067] CPU: 1 UID: 0 PID: 6067 Comm: syz.0.61 Not tainted syzkaller #0 PREEMPT(full) [ 107.987641][ T6067] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 107.987650][ T6067] Call Trace: [ 107.987656][ T6067] [ 107.987663][ T6067] dump_stack_lvl+0x100/0x190 [ 107.987684][ T6067] should_fail_ex.cold+0x5/0xa [ 107.987700][ T6067] _copy_from_iter+0x1f4/0x1690 [ 107.987712][ T6067] ? __asan_memset+0x23/0x50 [ 107.987729][ T6067] ? __pfx__copy_from_iter+0x10/0x10 [ 107.987746][ T6067] ? __pfx___alloc_skb+0x10/0x10 [ 107.987775][ T6067] netlink_sendmsg+0x94a/0x1020 [ 107.987799][ T6067] ? __pfx_netlink_sendmsg+0x10/0x10 [ 107.987819][ T6067] ? selinux_socket_sendmsg+0x198/0x2f0 [ 107.987838][ T6067] ? ____sys_sendmsg+0xa4d/0xbe0 [ 107.987853][ T6067] ____sys_sendmsg+0xa4d/0xbe0 [ 107.987867][ T6067] ? __pfx_netlink_sendmsg+0x10/0x10 [ 107.987888][ T6067] ? __pfx_____sys_sendmsg+0x10/0x10 [ 107.987918][ T6067] ? lock_acquire+0x1d1/0x380 [ 107.987938][ T6067] ? get_pid_task+0x2a/0x250 [ 107.987961][ T6067] ___sys_sendmsg+0x190/0x1e0 [ 107.987978][ T6067] ? __pfx____sys_sendmsg+0x10/0x10 [ 107.987994][ T6067] ? get_pid_task+0x106/0x250 [ 107.988017][ T6067] ? find_held_lock+0x2b/0x80 [ 107.988049][ T6067] __sys_sendmsg+0x160/0x210 [ 107.988070][ T6067] ? __pfx___sys_sendmsg+0x10/0x10 [ 107.988103][ T6067] do_syscall_64+0x123/0x790 [ 107.988123][ T6067] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.988143][ T6067] RIP: 0033:0x7f0d0439f559 [ 107.988152][ T6067] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 107.988163][ T6067] RSP: 002b:00007f0d05216028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 107.988179][ T6067] RAX: ffffffffffffffda RBX: 00007f0d04625fa0 RCX: 00007f0d0439f559 [ 107.988190][ T6067] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 107.988201][ T6067] RBP: 00007f0d05216090 R08: 0000000000000000 R09: 0000000000000000 [ 107.988211][ T6067] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 107.988220][ T6067] R13: 00007f0d04626038 R14: 00007f0d04625fa0 R15: 00007ffedd1cf648 [ 107.988244][ T6067] [ 108.236442][ T2340] keyspan 4-1:0.133: Keyspan 1 port adapter converter detected [ 108.236619][ T2340] keyspan 4-1:0.133: found no endpoint descriptor for endpoint 82 [ 108.241073][ T2340] keyspan 4-1:0.133: found no endpoint descriptor for endpoint 81 [ 108.241135][ T2340] keyspan 4-1:0.133: found no endpoint descriptor for endpoint 1 [ 108.241218][ T2340] keyspan 4-1:0.133: found no endpoint descriptor for endpoint 2 [ 108.250135][ T2340] usb 4-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 108.310607][ T2340] usb 4-1: USB disconnect, device number 4 [ 108.331837][ T2340] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 108.332110][ T2340] keyspan 4-1:0.133: device disconnected [ 109.102685][ T6073] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 112.368001][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 112.368033][ T30] audit: type=1400 audit(1792615668.474:265): avc: denied { prog_run } for pid=6089 comm="syz.3.68" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 114.352237][ T5696] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 114.502660][ T5696] usb 4-1: New USB device found, idVendor=06cd, idProduct=0121, bcdDevice=dd.3d [ 114.503531][ T5696] usb 4-1: config 0 has an invalid interface number: 133 but max is 0 [ 114.503553][ T5696] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 114.503570][ T5696] usb 4-1: config 0 has no interface number 0 [ 114.503599][ T5696] usb 4-1: config 0 interface 133 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 114.507887][ T5696] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 114.507901][ T5696] usb 4-1: Product: syz [ 114.507909][ T5696] usb 4-1: Manufacturer: syz [ 114.507917][ T5696] usb 4-1: SerialNumber: syz [ 114.581610][ T5696] usb 4-1: config 0 descriptor?? [ 117.221979][ T5696] keyspan 4-1:0.133: Keyspan 1 port adapter converter detected [ 117.222067][ T5696] keyspan 4-1:0.133: found no endpoint descriptor for endpoint 82 [ 117.252858][ T5696] keyspan 4-1:0.133: found no endpoint descriptor for endpoint 81 [ 117.252928][ T5696] keyspan 4-1:0.133: found no endpoint descriptor for endpoint 1 [ 117.252963][ T5696] keyspan 4-1:0.133: found no endpoint descriptor for endpoint 2 [ 117.287591][ T5696] usb 4-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 117.307436][ T5696] usb 4-1: USB disconnect, device number 5 [ 117.326965][ T5696] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 117.330567][ T5696] keyspan 4-1:0.133: device disconnected [ 117.809054][ T30] audit: type=1400 audit(1792615673.924:266): avc: denied { read write } for pid=6108 comm="syz.3.75" name="control" dev="devtmpfs" ino=1266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 117.809084][ T30] audit: type=1400 audit(1792615673.924:267): avc: denied { open } for pid=6108 comm="syz.3.75" path="/dev/mapper/control" dev="devtmpfs" ino=1266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 117.873846][ T30] audit: type=1400 audit(1792615673.994:268): avc: denied { ioctl } for pid=6108 comm="syz.3.75" path="/dev/mapper/control" dev="devtmpfs" ino=1266 ioctlcmd=0xfd03 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 117.912823][ T6110] FAULT_INJECTION: forcing a failure. [ 117.912823][ T6110] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 117.912847][ T6110] CPU: 0 UID: 0 PID: 6110 Comm: syz.3.75 Not tainted syzkaller #0 PREEMPT(full) [ 117.912867][ T6110] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 117.912879][ T6110] Call Trace: [ 117.912886][ T6110] [ 117.912893][ T6110] dump_stack_lvl+0x100/0x190 [ 117.912924][ T6110] should_fail_ex.cold+0x5/0xa [ 117.912950][ T6110] _copy_to_user+0x32/0xd0 [ 117.912980][ T6110] ctl_ioctl+0x17b/0xcc0 [ 117.913009][ T6110] ? __pfx_ctl_ioctl+0x10/0x10 [ 117.913060][ T6110] ? selinux_file_ioctl+0x13b/0x290 [ 117.913076][ T6110] ? selinux_file_ioctl+0xb6/0x290 [ 117.913096][ T6110] dm_ctl_ioctl+0x22/0x30 [ 117.913119][ T6110] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 117.913143][ T6110] __x64_sys_ioctl+0x18e/0x210 [ 117.913170][ T6110] do_syscall_64+0x123/0x790 [ 117.913190][ T6110] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.913207][ T6110] RIP: 0033:0x7f7f8fd9f559 [ 117.913221][ T6110] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 117.913237][ T6110] RSP: 002b:00007f7f90c18028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 117.913254][ T6110] RAX: ffffffffffffffda RBX: 00007f7f90026090 RCX: 00007f7f8fd9f559 [ 117.913265][ T6110] RDX: 0000200000000140 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 117.913276][ T6110] RBP: 00007f7f90c18090 R08: 0000000000000000 R09: 0000000000000000 [ 117.913287][ T6110] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 117.913297][ T6110] R13: 00007f7f90026128 R14: 00007f7f90026090 R15: 00007ffedf2f9708 [ 117.913321][ T6110] [ 118.184087][ T6113] FAULT_INJECTION: forcing a failure. [ 118.184087][ T6113] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 118.184113][ T6113] CPU: 0 UID: 0 PID: 6113 Comm: syz.2.76 Not tainted syzkaller #0 PREEMPT(full) [ 118.184133][ T6113] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 118.184146][ T6113] Call Trace: [ 118.184152][ T6113] [ 118.184160][ T6113] dump_stack_lvl+0x100/0x190 [ 118.184191][ T6113] should_fail_ex.cold+0x5/0xa [ 118.184216][ T6113] _copy_from_iter+0x1f4/0x1690 [ 118.184238][ T6113] ? __asan_memset+0x23/0x50 [ 118.184261][ T6113] ? __pfx__copy_from_iter+0x10/0x10 [ 118.184279][ T6113] ? __pfx___alloc_skb+0x10/0x10 [ 118.184310][ T6113] netlink_sendmsg+0x94a/0x1020 [ 118.184336][ T6113] ? __pfx_netlink_sendmsg+0x10/0x10 [ 118.184363][ T6113] ? selinux_socket_sendmsg+0x198/0x2f0 [ 118.184393][ T6113] ? ____sys_sendmsg+0xa4d/0xbe0 [ 118.184419][ T6113] ____sys_sendmsg+0xa4d/0xbe0 [ 118.184442][ T6113] ? __pfx_netlink_sendmsg+0x10/0x10 [ 118.184463][ T6113] ? __pfx_____sys_sendmsg+0x10/0x10 [ 118.184493][ T6113] ? lock_acquire+0x1d1/0x380 [ 118.184515][ T6113] ? get_pid_task+0x2a/0x250 [ 118.184543][ T6113] ___sys_sendmsg+0x190/0x1e0 [ 118.184571][ T6113] ? __pfx____sys_sendmsg+0x10/0x10 [ 118.184596][ T6113] ? get_pid_task+0x106/0x250 [ 118.184632][ T6113] ? find_held_lock+0x2b/0x80 [ 118.184665][ T6113] __sys_sendmsg+0x160/0x210 [ 118.184687][ T6113] ? __pfx___sys_sendmsg+0x10/0x10 [ 118.184726][ T6113] do_syscall_64+0x123/0x790 [ 118.184748][ T6113] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.184766][ T6113] RIP: 0033:0x7f80b0b9f559 [ 118.184781][ T6113] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 118.184797][ T6113] RSP: 002b:00007f80b1b18028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 118.184814][ T6113] RAX: ffffffffffffffda RBX: 00007f80b0e25fa0 RCX: 00007f80b0b9f559 [ 118.184826][ T6113] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 118.184837][ T6113] RBP: 00007f80b1b18090 R08: 0000000000000000 R09: 0000000000000000 [ 118.184846][ T6113] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 118.184855][ T6113] R13: 00007f80b0e26038 R14: 00007f80b0e25fa0 R15: 00007fffa8732678 [ 118.184878][ T6113] [ 118.648622][ T30] audit: type=1400 audit(1792615674.764:269): avc: denied { read write } for pid=6119 comm="syz.2.78" name="ppp" dev="devtmpfs" ino=708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 118.649433][ T30] audit: type=1400 audit(1792615674.764:270): avc: denied { open } for pid=6119 comm="syz.2.78" path="/dev/ppp" dev="devtmpfs" ino=708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 118.678784][ T30] audit: type=1400 audit(1792615674.794:271): avc: denied { ioctl } for pid=6119 comm="syz.2.78" path="/dev/ppp" dev="devtmpfs" ino=708 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 118.761392][ T6120] FAULT_INJECTION: forcing a failure. [ 118.761392][ T6120] name failslab, interval 1, probability 0, space 0, times 1 [ 118.761409][ T6120] CPU: 0 UID: 0 PID: 6120 Comm: syz.2.78 Not tainted syzkaller #0 PREEMPT(full) [ 118.761424][ T6120] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 118.761430][ T6120] Call Trace: [ 118.761434][ T6120] [ 118.761438][ T6120] dump_stack_lvl+0x100/0x190 [ 118.761458][ T6120] should_fail_ex.cold+0x5/0xa [ 118.761474][ T6120] should_failslab+0xc2/0x120 [ 118.761492][ T6120] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 118.761508][ T6120] ? __alloc_skb+0x140/0x710 [ 118.761523][ T6120] __alloc_skb+0x140/0x710 [ 118.761534][ T6120] ? __alloc_skb+0x5b7/0x710 [ 118.761545][ T6120] ? __pfx___alloc_skb+0x10/0x10 [ 118.761556][ T6120] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 118.761572][ T6120] ? trace_kmem_cache_alloc+0xdd/0x100 [ 118.761591][ T6120] ppp_xmit_process+0xc37/0x2160 [ 118.761607][ T6120] ? __pfx_ppp_xmit_process+0x10/0x10 [ 118.761622][ T6120] ppp_write+0x337/0x400 [ 118.761635][ T6120] ? __pfx_ppp_write+0x10/0x10 [ 118.761646][ T6120] vfs_writev+0x5ed/0xdd0 [ 118.761662][ T6120] ? __pfx_vfs_writev+0x10/0x10 [ 118.761679][ T6120] ? lock_acquire+0x1d1/0x380 [ 118.761693][ T6120] ? __fget_files+0x34/0x3d0 [ 118.761714][ T6120] ? __fget_files+0x21f/0x3d0 [ 118.761735][ T6120] ? do_pwritev+0x1ac/0x270 [ 118.761755][ T6120] do_pwritev+0x1ac/0x270 [ 118.761774][ T6120] ? __pfx_do_pwritev+0x10/0x10 [ 118.761792][ T6120] do_syscall_64+0x123/0x790 [ 118.761804][ T6120] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.761816][ T6120] RIP: 0033:0x7f80b0b9f559 [ 118.761825][ T6120] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 118.761835][ T6120] RSP: 002b:00007f80b1b18028 EFLAGS: 00000246 ORIG_RAX: 0000000000000128 [ 118.761846][ T6120] RAX: ffffffffffffffda RBX: 00007f80b0e25fa0 RCX: 00007f80b0b9f559 [ 118.761853][ T6120] RDX: 0000000000000001 RSI: 0000200000000900 RDI: 0000000000000003 [ 118.761859][ T6120] RBP: 00007f80b1b18090 R08: 0000000000000000 R09: 0000000000000000 [ 118.761865][ T6120] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 118.761871][ T6120] R13: 00007f80b0e26038 R14: 00007f80b0e25fa0 R15: 00007fffa8732678 [ 118.761885][ T6120] [ 118.761896][ T6120] ppp0: PPP: no memory (VJ comp pkt) [ 120.761975][ T30] audit: type=1400 audit(1792615676.874:272): avc: denied { create } for pid=6122 comm="syz.3.79" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 121.008886][ T30] audit: type=1400 audit(1792615677.124:273): avc: denied { getopt } for pid=6122 comm="syz.3.79" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 122.049008][ T30] audit: type=1400 audit(1792615677.714:274): avc: denied { name_bind } for pid=6131 comm="syz.4.70" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 122.049055][ T30] audit: type=1400 audit(1792615677.714:275): avc: denied { node_bind } for pid=6131 comm="syz.4.70" saddr=::ffff:127.0.0.1 src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 122.451177][ T160] IPVS: starting estimator thread 0... [ 122.467574][ T6138] netlink: 8 bytes leftover after parsing attributes in process `syz.2.81'. [ 122.467590][ T6138] netlink: 24 bytes leftover after parsing attributes in process `syz.2.81'. [ 122.472244][ T6138] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 122.472659][ C1] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 122.552260][ T6142] IPVS: using max 71 ests per chain, 170400 per kthread [ 122.848574][ T2340] usb 2-1: new full-speed USB device number 6 using dummy_hcd [ 122.996741][ T6149] netlink: 8 bytes leftover after parsing attributes in process `syz.0.84'. [ 123.139529][ T2340] usb 2-1: New USB device found, idVendor=06cd, idProduct=0121, bcdDevice=dd.3d [ 123.141506][ T2340] usb 2-1: config 0 has an invalid interface number: 133 but max is 0 [ 123.141527][ T2340] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 123.141543][ T2340] usb 2-1: config 0 has no interface number 0 [ 123.141566][ T2340] usb 2-1: config 0 interface 133 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 123.354575][ T30] kauditd_printk_skb: 12 callbacks suppressed [ 123.354607][ T30] audit: type=1400 audit(1792615679.404:288): avc: denied { write } for pid=6148 comm="syz.0.84" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 123.864220][ T2340] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 123.864244][ T2340] usb 2-1: Product: syz [ 123.864258][ T2340] usb 2-1: Manufacturer: syz [ 123.864272][ T2340] usb 2-1: SerialNumber: syz [ 123.866973][ T2340] usb 2-1: config 0 descriptor?? [ 125.601588][ T6160] batman_adv: batadv0: Adding interface: syzkaller0 [ 125.601605][ T6160] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 125.601630][ T6160] batman_adv: batadv0: Interface activated: syzkaller0 [ 126.071439][ T30] audit: type=1400 audit(1792615682.184:289): avc: denied { create } for pid=6161 comm="syz.0.88" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 126.110977][ T30] audit: type=1400 audit(1792615682.224:290): avc: denied { bind } for pid=6161 comm="syz.0.88" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 126.183680][ T6159] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 126.190980][ T30] audit: type=1400 audit(1792615682.304:291): avc: denied { mount } for pid=6161 comm="syz.0.88" name="/" dev="configfs" ino=1066 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 126.249567][ T30] audit: type=1400 audit(1792615682.364:292): avc: denied { search } for pid=6161 comm="syz.0.88" name="/" dev="configfs" ino=1066 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 126.249686][ T30] audit: type=1400 audit(1792615682.364:293): avc: denied { search } for pid=6161 comm="syz.0.88" name="nullb" dev="configfs" ino=3537 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 126.250703][ T30] audit: type=1400 audit(1792615682.364:294): avc: denied { write search } for pid=6161 comm="syz.0.88" name="nullb" dev="configfs" ino=3537 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 126.329970][ T2340] keyspan 2-1:0.133: Keyspan 1 port adapter converter detected [ 126.330048][ T2340] keyspan 2-1:0.133: found no endpoint descriptor for endpoint 82 [ 126.348058][ T30] audit: type=1400 audit(1792615682.464:295): avc: denied { add_name } for pid=6161 comm="syz.0.88" name="nullb0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 126.372361][ T30] audit: type=1400 audit(1792615682.494:296): avc: denied { create } for pid=6161 comm="syz.0.88" name="nullb0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 126.385965][ T2340] keyspan 2-1:0.133: found no endpoint descriptor for endpoint 81 [ 126.386021][ T2340] keyspan 2-1:0.133: found no endpoint descriptor for endpoint 1 [ 126.386092][ T2340] keyspan 2-1:0.133: found no endpoint descriptor for endpoint 2 [ 126.426073][ T2340] usb 2-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 126.451369][ T2340] usb 2-1: USB disconnect, device number 6 [ 126.456490][ T30] audit: type=1400 audit(1792615682.534:297): avc: denied { write } for pid=6161 comm="syz.0.88" name="/" dev="configfs" ino=1066 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 126.496032][ T2340] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 126.496551][ T2340] keyspan 2-1:0.133: device disconnected [ 126.520862][ T6159] batman_adv: batadv0: Removing interface: syzkaller0 [ 126.546455][ T6166] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 126.548193][ T6166] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 126.842899][ T6166] ublk0: read batch cmd buffer failed [ 126.842961][ T6166] ublk0: read batch cmd buffer failed [ 127.164555][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 127.164631][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 127.534150][ T6175] FAT-fs (nbd3): unable to read boot sector [ 127.950319][ T6166] ublk0: read batch cmd buffer failed [ 127.950412][ T6166] ublk0: read batch cmd buffer failed [ 128.379591][ T30] kauditd_printk_skb: 9 callbacks suppressed [ 128.379604][ T30] audit: type=1400 audit(1792615684.494:307): avc: denied { unmount } for pid=5617 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 128.564583][ T30] audit: type=1400 audit(1792615684.684:308): avc: denied { write } for pid=6182 comm="syz.4.93" name="loop7" dev="devtmpfs" ino=652 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 128.608047][ T6183] loop7: detected capacity change from 0 to 7 [ 129.035502][ T30] audit: type=1400 audit(1792615685.044:309): avc: denied { watch } for pid=6191 comm="syz.2.86" path="/22/file1" dev="tmpfs" ino=145 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 129.035641][ T30] audit: type=1400 audit(1792615685.044:310): avc: denied { watch_sb } for pid=6191 comm="syz.2.86" path="/22/file1" dev="tmpfs" ino=145 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 129.478834][ T6183] Dev loop7: unable to read RDB block 7 [ 129.478867][ T6183] loop7: unable to read partition table [ 129.479043][ T6183] loop7: partition table beyond EOD, truncated [ 129.479061][ T6183] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 129.485616][ T30] audit: type=1400 audit(1792615685.604:311): avc: denied { unmount } for pid=5609 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 129.701261][ T6162] Buffer I/O error on dev loop7, logical block 0, async page read [ 129.701564][ T6162] Buffer I/O error on dev loop7, logical block 0, async page read [ 129.725714][ T6162] Buffer I/O error on dev loop7, logical block 0, async page read [ 129.726376][ T6162] Buffer I/O error on dev loop7, logical block 0, async page read [ 129.726651][ T6162] Buffer I/O error on dev loop7, logical block 0, async page read [ 129.876623][ T30] audit: type=1326 audit(1792615685.994:312): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6196 comm="syz.2.95" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f80b0b9f559 code=0x7ffc0000 [ 129.878501][ T30] audit: type=1326 audit(1792615685.994:313): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6196 comm="syz.2.95" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f80b0b9f559 code=0x7ffc0000 [ 129.879831][ T30] audit: type=1326 audit(1792615685.994:314): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6196 comm="syz.2.95" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f80b0b9f559 code=0x7ffc0000 [ 129.880039][ T30] audit: type=1326 audit(1792615685.994:315): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6196 comm="syz.2.95" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f80b0b9f559 code=0x7ffc0000 [ 129.880543][ T30] audit: type=1326 audit(1792615685.994:316): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6196 comm="syz.2.95" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f80b0b9f559 code=0x7ffc0000 [ 130.292347][ T2340] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 130.445079][ T2340] usb 3-1: New USB device found, idVendor=0711, idProduct=0550, bcdDevice= 0.00 [ 130.474870][ T2340] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 130.474893][ T2340] usb 3-1: Product: syz [ 130.474906][ T2340] usb 3-1: Manufacturer: syz [ 130.474914][ T2340] usb 3-1: SerialNumber: syz [ 130.613842][ T2340] usb 3-1: USB2VGA dongle found at address 3 [ 130.636714][ T2340] usb 3-1: Allocated 8 output buffers [ 130.651901][ T29] usb 1-1: USB disconnect, device number 4 [ 130.964756][ T6197] mmap: syz.2.95 (6197) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 131.189418][ T6214] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 131.317553][ T6219] netlink: 'syz.1.101': attribute type 16 has an invalid length. [ 131.317573][ T6219] netlink: 'syz.1.101': attribute type 17 has an invalid length. [ 131.603241][ T2340] usb 3-1: Failed to early initialize device [ 131.636220][ T2340] usb 3-1: USB disconnect, device number 3 [ 131.947456][ T6231] netlink: 'syz.0.104': attribute type 1 has an invalid length. [ 131.947470][ T6231] netlink: 'syz.0.104': attribute type 3 has an invalid length. [ 131.947476][ T6231] netlink: 224 bytes leftover after parsing attributes in process `syz.0.104'. [ 132.032378][ T29] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 132.185440][ T29] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 132.190189][ T29] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 132.190209][ T29] usb 2-1: Product: syz [ 132.190220][ T29] usb 2-1: Manufacturer: syz [ 132.190228][ T29] usb 2-1: SerialNumber: syz [ 132.191958][ T29] usb 2-1: config 0 descriptor?? [ 132.503826][ T29] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 132.896585][ T6244] syzkaller0: entered promiscuous mode [ 132.896598][ T6244] syzkaller0: entered allmulticast mode [ 133.102201][ T2340] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 133.202201][ T1608] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 133.254483][ T2340] usb 4-1: Using ep0 maxpacket: 8 [ 133.257748][ T2340] usb 4-1: New USB device found, idVendor=200c, idProduct=100b, bcdDevice= 0.40 [ 133.260154][ T2340] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 133.260176][ T2340] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 133.300343][ T2340] usb 4-1: New USB device strings: Mfr=31, Product=2, SerialNumber=3 [ 133.300366][ T2340] usb 4-1: Product: syz [ 133.300379][ T2340] usb 4-1: Manufacturer: syz [ 133.300394][ T2340] usb 4-1: SerialNumber: syz [ 133.355367][ T1608] usb 3-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 133.359146][ T1608] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 133.359193][ T1608] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 133.360841][ T1608] usb 3-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 133.360862][ T1608] usb 3-1: Manufacturer: syz [ 133.367916][ T1608] usb 3-1: config 0 descriptor?? [ 133.431679][ T30] kauditd_printk_skb: 126 callbacks suppressed [ 133.431693][ T30] audit: type=1400 audit(1792615689.544:443): avc: denied { ioctl } for pid=6247 comm="syz.4.110" path="socket:[10873]" dev="sockfs" ino=10873 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 133.501242][ T6248] syzkaller0: entered promiscuous mode [ 133.501271][ T6248] syzkaller0: entered allmulticast mode [ 134.212170][ T6252] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 134.422841][ T6254] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 134.423160][ T6254] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 134.680404][ T30] audit: type=1400 audit(1792615690.304:444): avc: denied { create } for pid=6245 comm="syz.3.109" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 134.680445][ T30] audit: type=1400 audit(1792615690.344:445): avc: denied { create } for pid=6245 comm="syz.3.109" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 134.680489][ T30] audit: type=1400 audit(1792615690.364:446): avc: denied { bind } for pid=6245 comm="syz.3.109" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 134.680517][ T30] audit: type=1400 audit(1792615690.374:447): avc: denied { listen } for pid=6245 comm="syz.3.109" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 134.680545][ T30] audit: type=1400 audit(1792615690.374:448): avc: denied { connect } for pid=6245 comm="syz.3.109" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 134.680573][ T30] audit: type=1400 audit(1792615690.434:449): avc: denied { write } for pid=6245 comm="syz.3.109" path="socket:[10886]" dev="sockfs" ino=10886 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 134.732281][ T30] audit: type=1400 audit(1792615690.834:450): avc: denied { listen } for pid=6250 comm="syz.0.111" lport=20002 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 134.872596][ T2340] usb 4-1: unit 4 not found! [ 134.955668][ T29] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 134.986458][ T6255] netlink: 12 bytes leftover after parsing attributes in process `syz.0.111'. [ 135.070399][ T2340] usb 4-1: USB disconnect, device number 6 [ 135.074187][ T5707] usb 2-1: USB disconnect, device number 7 [ 135.157911][ T6162] udevd[6162]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 135.247677][ T6251] UBIFS error (pid: 6251): cannot open "ubi0_0", error -19 [ 135.256603][ T6251] netlink: 4 bytes leftover after parsing attributes in process `syz.0.111'. [ 135.320811][ T6258] 9pnet_virtio: no channels available for device syz [ 135.437144][ T30] audit: type=1400 audit(1792615691.554:451): avc: denied { create } for pid=6250 comm="syz.0.111" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 135.452298][ T6262] netlink: 52 bytes leftover after parsing attributes in process `syz.1.114'. [ 138.436550][ T6270] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 138.679079][ T30] audit: type=1400 audit(1792615694.794:452): avc: denied { mount } for pid=6272 comm="syz.1.115" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 139.100658][ T6275] FAULT_INJECTION: forcing a failure. [ 139.100658][ T6275] name failslab, interval 1, probability 0, space 0, times 0 [ 139.100681][ T6275] CPU: 1 UID: 0 PID: 6275 Comm: syz.1.115 Not tainted syzkaller #0 PREEMPT(full) [ 139.100701][ T6275] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 139.100711][ T6275] Call Trace: [ 139.100717][ T6275] [ 139.100723][ T6275] dump_stack_lvl+0x100/0x190 [ 139.100753][ T6275] should_fail_ex.cold+0x5/0xa [ 139.100770][ T6275] should_failslab+0xc2/0x120 [ 139.100789][ T6275] __kmalloc_cache_noprof+0x91/0x6d0 [ 139.100801][ T6275] ? __lock_acquire+0x5c0/0x1f40 [ 139.100815][ T6275] ? espintcp_init_sk+0x114/0xad0 [ 139.100836][ T6275] espintcp_init_sk+0x114/0xad0 [ 139.100854][ T6275] ? __pfx_espintcp_init_sk+0x10/0x10 [ 139.100869][ T6275] ? __pfx_espintcp_parse+0x10/0x10 [ 139.100893][ T6275] ? __pfx_espintcp_rcv+0x10/0x10 [ 139.100918][ T6275] tcp_set_ulp+0x44b/0x810 [ 139.100935][ T6275] do_tcp_setsockopt+0x53c/0x2b50 [ 139.100951][ T6275] ? __pfx_do_tcp_setsockopt+0x10/0x10 [ 139.100971][ T6275] ? __pfx_sock_has_perm+0x10/0x10 [ 139.100995][ T6275] ? selinux_netlbl_socket_setsockopt+0x134/0x470 [ 139.101014][ T6275] ? __pfx_selinux_netlbl_socket_setsockopt+0x10/0x10 [ 139.101038][ T6275] ? find_held_lock+0x2b/0x80 [ 139.101053][ T6275] ? __fget_files+0x215/0x3d0 [ 139.101066][ T6275] tcp_setsockopt+0xe2/0x100 [ 139.101078][ T6275] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 139.101095][ T6275] do_sock_setsockopt+0xf3/0x1d0 [ 139.101118][ T6275] __sys_setsockopt+0x195/0x220 [ 139.101143][ T6275] __x64_sys_setsockopt+0xbd/0x160 [ 139.101161][ T6275] ? do_syscall_64+0xae/0x790 [ 139.101178][ T6275] ? lockdep_hardirqs_on+0x7d/0x110 [ 139.101194][ T6275] do_syscall_64+0x123/0x790 [ 139.101206][ T6275] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 139.101217][ T6275] RIP: 0033:0x7f6cecb9f559 [ 139.101226][ T6275] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 139.101237][ T6275] RSP: 002b:00007f6cedaa4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 139.101248][ T6275] RAX: ffffffffffffffda RBX: 00007f6cece26090 RCX: 00007f6cecb9f559 [ 139.101256][ T6275] RDX: 000000000000001f RSI: 0000000000000006 RDI: 0000000000000006 [ 139.101266][ T6275] RBP: 00007f6cedaa4090 R08: 0000000000000008 R09: 0000000000000000 [ 139.101276][ T6275] R10: 00002000000006c0 R11: 0000000000000246 R12: 0000000000000001 [ 139.101286][ T6275] R13: 00007f6cece26128 R14: 00007f6cece26090 R15: 00007ffc39923818 [ 139.101311][ T6275] [ 140.031936][ T30] audit: type=1400 audit(1792615696.144:453): avc: denied { unmount } for pid=5601 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 140.124757][ T6281] FAULT_INJECTION: forcing a failure. [ 140.124757][ T6281] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 140.124775][ T6281] CPU: 0 UID: 0 PID: 6281 Comm: syz.1.117 Not tainted syzkaller #0 PREEMPT(full) [ 140.124788][ T6281] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 140.124794][ T6281] Call Trace: [ 140.124798][ T6281] [ 140.124803][ T6281] dump_stack_lvl+0x100/0x190 [ 140.124822][ T6281] should_fail_ex.cold+0x5/0xa [ 140.124838][ T6281] _copy_to_user+0x32/0xd0 [ 140.124857][ T6281] simple_read_from_buffer+0xcb/0x170 [ 140.124878][ T6281] proc_fail_nth_read+0x1af/0x230 [ 140.124897][ T6281] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 140.124916][ T6281] ? rw_verify_area+0xce/0x6d0 [ 140.124929][ T6281] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 140.124946][ T6281] vfs_read+0x1e4/0xb40 [ 140.124961][ T6281] ? lock_acquire+0x1d1/0x380 [ 140.124979][ T6281] ? __fget_files+0x34/0x3d0 [ 140.124989][ T6281] ? __pfx_vfs_read+0x10/0x10 [ 140.125001][ T6281] ? find_held_lock+0x2b/0x80 [ 140.125012][ T6281] ? __fget_files+0x215/0x3d0 [ 140.125023][ T6281] ? __fget_files+0x21f/0x3d0 [ 140.125037][ T6281] ksys_read+0x12a/0x250 [ 140.125051][ T6281] ? __pfx_ksys_read+0x10/0x10 [ 140.125069][ T6281] do_syscall_64+0x123/0x790 [ 140.125082][ T6281] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 140.125093][ T6281] RIP: 0033:0x7f6cecb5fd8e [ 140.125103][ T6281] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 140.125113][ T6281] RSP: 002b:00007f6cedac4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 140.125124][ T6281] RAX: ffffffffffffffda RBX: 00007f6cedac56c0 RCX: 00007f6cecb5fd8e [ 140.125131][ T6281] RDX: 000000000000000f RSI: 00007f6cedac50a0 RDI: 0000000000000005 [ 140.125138][ T6281] RBP: 00007f6cedac5090 R08: 0000000000000000 R09: 0000000000000000 [ 140.125144][ T6281] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 140.125150][ T6281] R13: 00007f6cece26038 R14: 00007f6cece25fa0 R15: 00007ffc39923818 [ 140.125164][ T6281] [ 140.406272][ T6283] xt_connbytes: Forcing CT accounting to be enabled [ 140.576165][ T30] audit: type=1400 audit(1792615696.694:454): avc: denied { create } for pid=6285 comm="syz.1.119" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 140.621968][ T1608] input: syz Pen as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:256C:006D.0001/input/input7 [ 140.724062][ T1608] uclogic 0003:256C:006D.0001: input,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.2-1/input0 [ 141.281935][ T5708] usb 3-1: USB disconnect, device number 4 [ 141.300194][ T6290] FAULT_INJECTION: forcing a failure. [ 141.300194][ T6290] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 141.300220][ T6290] CPU: 0 UID: 0 PID: 6290 Comm: syz.4.120 Not tainted syzkaller #0 PREEMPT(full) [ 141.300240][ T6290] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 141.300254][ T6290] Call Trace: [ 141.300261][ T6290] [ 141.300268][ T6290] dump_stack_lvl+0x100/0x190 [ 141.300298][ T6290] should_fail_ex.cold+0x5/0xa [ 141.300320][ T6290] ? prepare_alloc_pages+0x16d/0x5b0 [ 141.300350][ T6290] should_fail_alloc_page+0xeb/0x140 [ 141.300379][ T6290] prepare_alloc_pages+0x1f0/0x5b0 [ 141.300405][ T6290] ? is_bpf_text_address+0x94/0x1a0 [ 141.300432][ T6290] __alloc_frozen_pages_noprof+0x1e8/0x32e0 [ 141.300471][ T6290] ? stack_trace_save+0x8e/0xc0 [ 141.300490][ T6290] ? __pfx_stack_trace_save+0x10/0x10 [ 141.300510][ T6290] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 141.300537][ T6290] ? kasan_save_stack+0x3f/0x50 [ 141.300561][ T6290] ? kasan_save_stack+0x30/0x50 [ 141.300584][ T6290] ? kasan_save_track+0x14/0x30 [ 141.300607][ T6290] ? __kasan_slab_alloc+0x89/0x90 [ 141.300630][ T6290] ? kmem_cache_alloc_node_noprof+0x282/0x6e0 [ 141.300653][ T6290] ? alloc_vmap_area+0x643/0x2bc0 [ 141.300677][ T6290] ? __get_vm_area_node+0x1ed/0x350 [ 141.300701][ T6290] ? __vmalloc_node_range_noprof+0x268/0x1420 [ 141.300718][ T6290] ? __vmalloc_node_noprof+0xad/0xf0 [ 141.300734][ T6290] ? __vmalloc_noprof+0xa3/0x120 [ 141.300749][ T6290] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 141.300774][ T6290] ? bpf_prog_alloc+0x3b/0x200 [ 141.300796][ T6290] ? bpf_prog_load+0x49e/0x2ab0 [ 141.300821][ T6290] ? __sys_bpf+0x1f46/0x4a30 [ 141.300839][ T6290] ? __x64_sys_bpf+0xce/0x140 [ 141.300856][ T6290] ? do_syscall_64+0x123/0x790 [ 141.300871][ T6290] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 141.300896][ T6290] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 141.300921][ T6290] ? policy_nodemask+0xed/0x4f0 [ 141.300939][ T6290] alloc_pages_mpol+0x201/0x550 [ 141.300957][ T6290] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 141.300977][ T6290] alloc_pages_noprof+0x1a/0x160 [ 141.300995][ T6290] get_free_pages_noprof+0x10/0xb0 [ 141.301017][ T6290] __kasan_populate_vmalloc+0xa0/0x210 [ 141.301042][ T6290] alloc_vmap_area+0x963/0x2bc0 [ 141.301072][ T6290] ? kasan_save_track+0x14/0x30 [ 141.301092][ T6290] ? __kasan_kmalloc+0xaa/0xb0 [ 141.301113][ T6290] ? __pfx_alloc_vmap_area+0x10/0x10 [ 141.301136][ T6290] ? __get_vm_area_node+0x124/0x350 [ 141.301161][ T6290] __get_vm_area_node+0x1ed/0x350 [ 141.301188][ T6290] __vmalloc_node_range_noprof+0x268/0x1420 [ 141.301204][ T6290] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 141.301228][ T6290] ? up_write+0x2dc/0x5b0 [ 141.301256][ T6290] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 141.301278][ T6290] ? lock_acquire+0x1d1/0x380 [ 141.301298][ T6290] ? find_held_lock+0x2b/0x80 [ 141.301311][ T6290] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 141.301326][ T6290] ? avc_has_perm_noaudit+0x11e/0x470 [ 141.301351][ T6290] ? avc_has_perm_noaudit+0x145/0x470 [ 141.301372][ T6290] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 141.301392][ T6290] __vmalloc_node_noprof+0xad/0xf0 [ 141.301407][ T6290] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 141.301431][ T6290] __vmalloc_noprof+0xa3/0x120 [ 141.301446][ T6290] ? __pfx___vmalloc_noprof+0x10/0x10 [ 141.301470][ T6290] ? rcu_is_watching+0x13/0xc0 [ 141.301496][ T6290] ? cap_capable+0x107/0x430 [ 141.301520][ T6290] bpf_prog_alloc_no_stats+0x59/0x690 [ 141.301543][ T6290] ? security_capable+0x80/0x260 [ 141.301568][ T6290] bpf_prog_alloc+0x3b/0x200 [ 141.301591][ T6290] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 141.301615][ T6290] bpf_prog_load+0x49e/0x2ab0 [ 141.301646][ T6290] ? __pfx_bpf_prog_load+0x10/0x10 [ 141.301694][ T6290] __sys_bpf+0x1f46/0x4a30 [ 141.301722][ T6290] ? __pfx___sys_bpf+0x10/0x10 [ 141.301743][ T6290] ? find_held_lock+0x2b/0x80 [ 141.301759][ T6290] ? get_pid_task+0xfc/0x250 [ 141.301784][ T6290] ? get_pid_task+0xfc/0x250 [ 141.301817][ T6290] ? find_held_lock+0x2b/0x80 [ 141.301840][ T6290] ? rcu_read_lock_any_held+0x6a/0x90 [ 141.301858][ T6290] ? find_held_lock+0x2b/0x80 [ 141.301873][ T6290] ? ksys_write+0x190/0x250 [ 141.301896][ T6290] ? ksys_write+0x190/0x250 [ 141.301918][ T6290] ? lock_acquire+0x1d1/0x380 [ 141.301957][ T6290] ? fput+0x7c/0x100 [ 141.301973][ T6290] ? ksys_write+0x1ac/0x250 [ 141.301999][ T6290] ? __x64_sys_bpf+0xce/0x140 [ 141.302019][ T6290] __x64_sys_bpf+0xce/0x140 [ 141.302041][ T6290] ? do_syscall_64+0xae/0x790 [ 141.302061][ T6290] do_syscall_64+0x123/0x790 [ 141.302081][ T6290] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 141.302100][ T6290] RIP: 0033:0x7fd3d3f9f559 [ 141.302116][ T6290] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 141.302132][ T6290] RSP: 002b:00007fd3d4e52028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 141.302150][ T6290] RAX: ffffffffffffffda RBX: 00007fd3d4225fa0 RCX: 00007fd3d3f9f559 [ 141.302162][ T6290] RDX: 000000000000006d RSI: 00002000000017c0 RDI: 0000000000000005 [ 141.302172][ T6290] RBP: 00007fd3d4e52090 R08: 0000000000000000 R09: 0000000000000000 [ 141.302183][ T6290] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 141.302193][ T6290] R13: 00007fd3d4226038 R14: 00007fd3d4225fa0 R15: 00007ffe224dcf08 [ 141.302218][ T6290] [ 141.397194][ T6290] syz.4.120: vmalloc error: size 4096, align 0x1, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 141.397283][ T6290] CPU: 1 UID: 0 PID: 6290 Comm: syz.4.120 Not tainted syzkaller #0 PREEMPT(full) [ 141.397301][ T6290] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 141.397310][ T6290] Call Trace: [ 141.397315][ T6290] [ 141.397321][ T6290] dump_stack_lvl+0x100/0x190 [ 141.397348][ T6290] warn_alloc.cold+0x9e/0xb2 [ 141.397366][ T6290] ? __pfx_warn_alloc+0x10/0x10 [ 141.397385][ T6290] ? lockdep_hardirqs_on+0x7d/0x110 [ 141.397403][ T6290] ? __get_vm_area_node+0x2f0/0x350 [ 141.397432][ T6290] ? __get_vm_area_node+0x22b/0x350 [ 141.397459][ T6290] __vmalloc_node_range_noprof+0xfa2/0x1420 [ 141.397477][ T6290] ? up_write+0x2dc/0x5b0 [ 141.397502][ T6290] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 141.397526][ T6290] ? lock_acquire+0x1d1/0x380 [ 141.397545][ T6290] ? find_held_lock+0x2b/0x80 [ 141.397560][ T6290] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 141.397575][ T6290] ? avc_has_perm_noaudit+0x11e/0x470 [ 141.397599][ T6290] ? avc_has_perm_noaudit+0x145/0x470 [ 141.397619][ T6290] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 141.397641][ T6290] __vmalloc_node_noprof+0xad/0xf0 [ 141.397656][ T6290] ? bpf_prog_alloc_no_stats+0x59/0x690 [ 141.397681][ T6290] __vmalloc_noprof+0xa3/0x120 [ 141.397696][ T6290] ? __pfx___vmalloc_noprof+0x10/0x10 [ 141.397714][ T6290] ? rcu_is_watching+0x13/0xc0 [ 141.397737][ T6290] ? cap_capable+0x107/0x430 [ 141.397760][ T6290] bpf_prog_alloc_no_stats+0x59/0x690 [ 141.397782][ T6290] ? security_capable+0x80/0x260 [ 141.397804][ T6290] bpf_prog_alloc+0x3b/0x200 [ 141.397825][ T6290] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 141.397847][ T6290] bpf_prog_load+0x49e/0x2ab0 [ 141.397875][ T6290] ? __pfx_bpf_prog_load+0x10/0x10 [ 141.397917][ T6290] __sys_bpf+0x1f46/0x4a30 [ 141.397941][ T6290] ? __pfx___sys_bpf+0x10/0x10 [ 141.397959][ T6290] ? find_held_lock+0x2b/0x80 [ 141.397978][ T6290] ? get_pid_task+0xfc/0x250 [ 141.398000][ T6290] ? get_pid_task+0xfc/0x250 [ 141.398028][ T6290] ? find_held_lock+0x2b/0x80 [ 141.398048][ T6290] ? rcu_read_lock_any_held+0x6a/0x90 [ 141.398064][ T6290] ? find_held_lock+0x2b/0x80 [ 141.398078][ T6290] ? ksys_write+0x190/0x250 [ 141.398097][ T6290] ? ksys_write+0x190/0x250 [ 141.398117][ T6290] ? lock_acquire+0x1d1/0x380 [ 141.398150][ T6290] ? fput+0x7c/0x100 [ 141.398164][ T6290] ? ksys_write+0x1ac/0x250 [ 141.398187][ T6290] ? __x64_sys_bpf+0xce/0x140 [ 141.398204][ T6290] __x64_sys_bpf+0xce/0x140 [ 141.398223][ T6290] ? do_syscall_64+0xae/0x790 [ 141.398240][ T6290] do_syscall_64+0x123/0x790 [ 141.398257][ T6290] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 141.398273][ T6290] RIP: 0033:0x7fd3d3f9f559 [ 141.398286][ T6290] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 141.398300][ T6290] RSP: 002b:00007fd3d4e52028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 141.398315][ T6290] RAX: ffffffffffffffda RBX: 00007fd3d4225fa0 RCX: 00007fd3d3f9f559 [ 141.398325][ T6290] RDX: 000000000000006d RSI: 00002000000017c0 RDI: 0000000000000005 [ 141.398335][ T6290] RBP: 00007fd3d4e52090 R08: 0000000000000000 R09: 0000000000000000 [ 141.398344][ T6290] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 141.398353][ T6290] R13: 00007fd3d4226038 R14: 00007fd3d4225fa0 R15: 00007ffe224dcf08 [ 141.398377][ T6290] [ 141.398392][ T6290] Mem-Info: [ 141.398398][ T6290] active_anon:32976 inactive_anon:0 isolated_anon:0 [ 141.398398][ T6290] active_file:0 inactive_file:63645 isolated_file:0 [ 141.398398][ T6290] unevictable:0 dirty:617 writeback:0 [ 141.398398][ T6290] slab_reclaimable:12460 slab_unreclaimable:98318 [ 141.398398][ T6290] mapped:31122 shmem:24805 pagetables:1158 [ 141.398398][ T6290] sec_pagetables:0 bounce:0 [ 141.398398][ T6290] kernel_misc_reclaimable:0 [ 141.398398][ T6290] free:1257208 free_pcp:21951 free_cma:0 [ 141.398435][ T6290] Node 0 active_anon:131904kB inactive_anon:0kB active_file:0kB inactive_file:254376kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:124488kB dirty:2468kB writeback:0kB shmem:99220kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12132kB pagetables:4468kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 141.398475][ T6290] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:164kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 141.398511][ T6290] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 141.398553][ T6290] lowmem_reserve[]: 0 2452 2452 2452 2452 [ 141.398580][ T6290] Node 0 DMA32 free:1080512kB boost:0kB min:33836kB low:42292kB high:50748kB reserved_highatomic:0kB free_highatomic:0kB active_anon:131904kB inactive_anon:0kB active_file:0kB inactive_file:254376kB unevictable:0kB writepending:2468kB zspages:0kB present:3129332kB managed:2510880kB mlocked:0kB bounce:0kB free_pcp:87804kB local_pcp:54976kB free_cma:0kB [ 141.598873][ T6290] lowmem_reserve[]: 0 0 0 0 0 [ 141.598905][ T6290] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:52kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 141.598947][ T6290] lowmem_reserve[]: 0 0 0 0 0 [ 141.598978][ T6290] Node 1 Normal free:3932960kB boost:0kB min:56064kB low:70080kB high:84096kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 141.599020][ T6290] lowmem_reserve[]: 0 0 0 0 0 [ 141.599045][ T6290] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 141.599134][ T6290] Node 0 DMA32: 4898*4kB (UME) 4425*8kB (UME) 3013*16kB (UME) 1925*32kB (UME) 1810*64kB (UME) 707*128kB (UME) 173*256kB (ME) 33*512kB (M) 9*1024kB (UME) 6*2048kB (ME) 153*4096kB (M) = 1080512kB [ 141.599265][ T6290] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 141.599341][ T6290] Node 1 Normal: 4*4kB (UM) 6*8kB (UM) 2*16kB (UM) 12*32kB (UM) 7*64kB (UM) 5*128kB (UM) 3*256kB (UM) 3*512kB (UM) 1*1024kB (M) 0*2048kB 959*4096kB (UM) = 3932960kB [ 141.599475][ T6290] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 141.599487][ T6290] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 141.599498][ T6290] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 141.599510][ T6290] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 141.599521][ T6290] 88346 total pagecache pages [ 141.599527][ T6290] 0 pages in swap cache [ 141.599532][ T6290] Free swap = 124996kB [ 141.599537][ T6290] Total swap = 124996kB [ 141.599543][ T6290] 2097051 pages RAM [ 141.599548][ T6290] 0 pages HighMem/MovableOnly [ 141.599553][ T6290] 437702 pages reserved [ 141.599558][ T6290] 0 pages cma reserved [ 142.020025][ T30] audit: type=1400 audit(1792615698.134:455): avc: denied { map } for pid=6299 comm="syz.2.124" path="socket:[10110]" dev="sockfs" ino=10110 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 142.103414][ T5708] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 142.220719][ T30] audit: type=1400 audit(1792615698.334:456): avc: denied { bind } for pid=6307 comm="syz.1.127" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 142.252206][ T5708] usb 1-1: Using ep0 maxpacket: 8 [ 142.254143][ T5708] usb 1-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 142.551292][ T6310] Bluetooth: MGMT ver 1.23 [ 142.904307][ T30] audit: type=1400 audit(1792615698.664:457): avc: denied { write } for pid=6307 comm="syz.1.127" path="socket:[10133]" dev="sockfs" ino=10133 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 142.904353][ T30] audit: type=1400 audit(1792615698.684:458): avc: denied { create } for pid=6307 comm="syz.1.127" anonclass=[userfaultfd] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 142.904388][ T30] audit: type=1400 audit(1792615698.704:459): avc: denied { block_suspend } for pid=6307 comm="syz.1.127" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 142.945844][ T5708] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 143.909979][ T5708] pvrusb2: Hardware description: Terratec Grabster AV400 [ 143.909992][ T5708] pvrusb2: ********** [ 143.909997][ T5708] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 143.910006][ T5708] pvrusb2: Important functionality might not be entirely working. [ 143.910012][ T5708] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 143.910020][ T5708] pvrusb2: ********** [ 144.150027][ T2346] pvrusb2: Invalid write control endpoint [ 144.175115][ T30] audit: type=1400 audit(1792615700.294:460): avc: denied { create } for pid=6319 comm="syz.2.129" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 144.202706][ T30] audit: type=1400 audit(1792615700.314:461): avc: denied { connect } for pid=6319 comm="syz.2.129" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 144.202747][ T30] audit: type=1400 audit(1792615700.314:462): avc: denied { write } for pid=6319 comm="syz.2.129" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 144.222180][ T30] audit: type=1400 audit(1792615700.324:463): avc: denied { bind } for pid=6319 comm="syz.2.129" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 144.301576][ T30] audit: type=1400 audit(1792615700.414:464): avc: denied { write } for pid=6293 comm="syz.4.123" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 144.678958][ T6292] pvrusb2: Invalid write control endpoint [ 144.684542][ T6292] xt_ecn: cannot match TCP bits for non-tcp packets [ 144.806633][ T6328] netlink: 8 bytes leftover after parsing attributes in process `syz.1.130'. [ 145.045898][ T30] audit: type=1400 audit(1792615701.164:465): avc: denied { connect } for pid=6291 comm="syz.0.121" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 145.407530][ T2346] pvrusb2: Invalid write control endpoint [ 145.407563][ T2346] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 145.407593][ T2346] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 145.407626][ T2346] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 145.407659][ T2346] pvrusb2: Device being rendered inoperable [ 145.408348][ T2346] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 145.501999][ T2346] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 145.548526][ T2346] pvrusb2: Attached sub-driver cx25840 [ 145.548537][ T2346] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 145.548545][ T2346] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 145.868359][ T6357] bond0: (slave bond_slave_0): Releasing backup interface [ 145.878568][ T6357] bridge0: port 2(bridge_slave_1) entered disabled state [ 145.879215][ T6357] bridge0: port 1(bridge_slave_0) entered disabled state [ 145.898088][ T30] audit: type=1400 audit(1792615702.014:466): avc: denied { create } for pid=6356 comm="syz.2.132" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 145.899783][ T30] audit: type=1400 audit(1792615702.014:467): avc: denied { ioctl } for pid=6356 comm="syz.2.132" path="socket:[10184]" dev="sockfs" ino=10184 ioctlcmd=0x89ee scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 146.882871][ T29] usb 1-1: USB disconnect, device number 5 [ 147.087175][ T30] audit: type=1400 audit(1792615703.204:468): avc: denied { write } for pid=6371 comm="syz.0.138" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 147.088062][ T30] audit: type=1400 audit(1792615703.204:469): avc: denied { nlmsg_write } for pid=6371 comm="syz.0.138" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 147.508613][ T6374] trusted_key: encrypted_key: insufficient parameters specified [ 147.644908][ T6378] trusted_key: encrypted_key: insufficient parameters specified [ 149.182251][ T24] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 149.343221][ T24] usb 2-1: Using ep0 maxpacket: 16 [ 149.346053][ T24] usb 2-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=36.87 [ 149.346789][ T24] usb 2-1: config 127 has an invalid interface number: 124 but max is 0 [ 149.346803][ T24] usb 2-1: config 127 has no interface number 0 [ 149.346818][ T24] usb 2-1: config 127 interface 124 has no altsetting 0 [ 149.356994][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 149.357013][ T24] usb 2-1: Product: syz [ 149.357026][ T24] usb 2-1: Manufacturer: syz [ 149.357039][ T24] usb 2-1: SerialNumber: syz [ 150.388543][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 150.388576][ T30] audit: type=1400 audit(1792615706.504:473): avc: denied { read write } for pid=6394 comm="syz.3.146" name="rdma_cm" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 150.388745][ T30] audit: type=1400 audit(1792615706.504:474): avc: denied { open } for pid=6394 comm="syz.3.146" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 150.895368][ T30] audit: type=1400 audit(1792615707.014:475): avc: denied { name_connect } for pid=6403 comm="syz.2.149" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 150.898608][ T30] audit: type=1400 audit(1792615707.014:476): avc: denied { accept } for pid=6403 comm="syz.2.149" lport=42013 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 150.899309][ T6404] audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=64 [ 150.899321][ T6404] audit: out of memory in audit_log_start [ 150.972992][ T24] usb 2-1: reset high-speed USB device number 8 using dummy_hcd [ 151.999832][ T24] usb 2-1: device descriptor read/all, error -71 [ 152.930611][ T30] audit: type=1400 audit(1792615708.264:477): avc: denied { create } for pid=6406 comm="syz.2.150" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 153.003590][ T30] audit: type=1400 audit(1792615709.114:478): avc: denied { setopt } for pid=6412 comm="syz.1.152" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 153.215115][ T6417] No such timeout policy "syz1" [ 153.215411][ T6417] No such timeout policy "syz1" [ 153.215674][ T6417] No such timeout policy "syz1" [ 153.215930][ T6417] No such timeout policy "syz1" [ 153.244124][ T6416] netlink: 20 bytes leftover after parsing attributes in process `syz.1.152'. [ 153.250503][ T6417] No such timeout policy "syz1" [ 153.250793][ T6417] No such timeout policy "syz1" [ 153.251098][ T6417] No such timeout policy "syz1" [ 153.251348][ T6417] No such timeout policy "syz1" [ 153.251599][ T6417] No such timeout policy "syz1" [ 153.262101][ T6417] No such timeout policy "syz1" [ 153.584985][ T24] usb 2-1: USB disconnect, device number 8 [ 153.851449][ T30] audit: type=1400 audit(1792615709.964:479): avc: denied { map } for pid=6421 comm="syz.3.147" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=11038 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 153.878250][ T30] audit: type=1400 audit(1792615709.994:480): avc: denied { read write } for pid=6421 comm="syz.3.147" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=11038 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 154.254161][ T6426] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 155.311301][ T6432] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 155.751491][ T6437] FAULT_INJECTION: forcing a failure. [ 155.751491][ T6437] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 155.751519][ T6437] CPU: 0 UID: 0 PID: 6437 Comm: syz.2.153 Not tainted syzkaller #0 PREEMPT(full) [ 155.751540][ T6437] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 155.751551][ T6437] Call Trace: [ 155.751558][ T6437] [ 155.751565][ T6437] dump_stack_lvl+0x100/0x190 [ 155.751597][ T6437] should_fail_ex.cold+0x5/0xa [ 155.751624][ T6437] _copy_from_iter+0x1f4/0x1690 [ 155.751644][ T6437] ? __asan_memset+0x23/0x50 [ 155.751669][ T6437] ? __pfx__copy_from_iter+0x10/0x10 [ 155.751686][ T6437] ? __pfx___alloc_skb+0x10/0x10 [ 155.751705][ T6437] ? __pfx_selinux_socket_getpeersec_dgram+0x10/0x10 [ 155.751734][ T6437] ? kernel_text_address+0x8d/0x100 [ 155.751761][ T6437] netlink_sendmsg+0x94a/0x1020 [ 155.751788][ T6437] ? __pfx_netlink_sendmsg+0x10/0x10 [ 155.751814][ T6437] ? selinux_socket_sendmsg+0x198/0x2f0 [ 155.751844][ T6437] ? ____sys_sendmsg+0xa4d/0xbe0 [ 155.751869][ T6437] ____sys_sendmsg+0xa4d/0xbe0 [ 155.751894][ T6437] ? __pfx_netlink_sendmsg+0x10/0x10 [ 155.751916][ T6437] ? __pfx_____sys_sendmsg+0x10/0x10 [ 155.751947][ T6437] ? lock_acquire+0x1d1/0x380 [ 155.751969][ T6437] ? get_pid_task+0x2a/0x250 [ 155.751997][ T6437] ___sys_sendmsg+0x190/0x1e0 [ 155.752025][ T6437] ? __pfx____sys_sendmsg+0x10/0x10 [ 155.752052][ T6437] ? get_pid_task+0x106/0x250 [ 155.752087][ T6437] ? find_held_lock+0x2b/0x80 [ 155.752123][ T6437] __sys_sendmsg+0x160/0x210 [ 155.752145][ T6437] ? __pfx___sys_sendmsg+0x10/0x10 [ 155.752180][ T6437] do_syscall_64+0x123/0x790 [ 155.752201][ T6437] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.752220][ T6437] RIP: 0033:0x7f80b0b9f559 [ 155.752236][ T6437] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 155.752253][ T6437] RSP: 002b:00007f80b1b18028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 155.752271][ T6437] RAX: ffffffffffffffda RBX: 00007f80b0e25fa0 RCX: 00007f80b0b9f559 [ 155.752282][ T6437] RDX: 0000000000040000 RSI: 0000200000000380 RDI: 0000000000000004 [ 155.752293][ T6437] RBP: 00007f80b1b18090 R08: 0000000000000000 R09: 0000000000000000 [ 155.752304][ T6437] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 155.752315][ T6437] R13: 00007f80b0e26038 R14: 00007f80b0e25fa0 R15: 00007fffa8732678 [ 155.752348][ T6437] [ 156.055758][ T6439] FAULT_INJECTION: forcing a failure. [ 156.055758][ T6439] name failslab, interval 1, probability 0, space 0, times 0 [ 156.055786][ T6439] CPU: 1 UID: 0 PID: 6439 Comm: syz.2.158 Not tainted syzkaller #0 PREEMPT(full) [ 156.055807][ T6439] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 156.055818][ T6439] Call Trace: [ 156.055832][ T6439] [ 156.055840][ T6439] dump_stack_lvl+0x100/0x190 [ 156.055871][ T6439] should_fail_ex.cold+0x5/0xa [ 156.055898][ T6439] should_failslab+0xc2/0x120 [ 156.055927][ T6439] __kmalloc_cache_node_noprof+0x94/0x710 [ 156.055955][ T6439] ? __get_vm_area_node+0x124/0x350 [ 156.055987][ T6439] __get_vm_area_node+0x124/0x350 [ 156.056018][ T6439] __vmalloc_node_range_noprof+0x268/0x1420 [ 156.056037][ T6439] ? bpf_dispatcher_change_prog+0x342/0xa50 [ 156.056059][ T6439] ? bpf_prog_pack_alloc+0x37/0x940 [ 156.056085][ T6439] ? rcu_is_watching+0x13/0xc0 [ 156.056113][ T6439] ? find_held_lock+0x2b/0x80 [ 156.056129][ T6439] ? bpf_prog_pack_alloc+0x1aa/0x940 [ 156.056157][ T6439] ? bpf_prog_pack_alloc+0x1aa/0x940 [ 156.056189][ T6439] ? bpf_dispatcher_change_prog+0x342/0xa50 [ 156.056216][ T6439] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 156.056235][ T6439] ? lock_acquire+0x1d1/0x380 [ 156.056258][ T6439] ? bitmap_find_next_zero_area_off+0xed/0x110 [ 156.056280][ T6439] ? __bitmap_set+0x118/0x150 [ 156.056301][ T6439] ? bpf_dispatcher_change_prog+0x342/0xa50 [ 156.056321][ T6439] __vmalloc_node_noprof+0xad/0xf0 [ 156.056338][ T6439] ? bpf_dispatcher_change_prog+0x342/0xa50 [ 156.056362][ T6439] bpf_dispatcher_change_prog+0x342/0xa50 [ 156.056383][ T6439] ? bpf_test_init.isra.0+0x51/0x100 [ 156.056414][ T6439] bpf_prog_test_run_xdp+0xd9d/0x1670 [ 156.056443][ T6439] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 156.056470][ T6439] ? fput+0x7c/0x100 [ 156.056489][ T6439] ? __bpf_prog_get+0x97/0x290 [ 156.056516][ T6439] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 156.056535][ T6439] __sys_bpf+0x2265/0x4a30 [ 156.056564][ T6439] ? __pfx___sys_bpf+0x10/0x10 [ 156.056584][ T6439] ? find_held_lock+0x2b/0x80 [ 156.056601][ T6439] ? get_pid_task+0xfc/0x250 [ 156.056625][ T6439] ? get_pid_task+0xfc/0x250 [ 156.056659][ T6439] ? find_held_lock+0x2b/0x80 [ 156.056683][ T6439] ? rcu_read_lock_any_held+0x6a/0x90 [ 156.056701][ T6439] ? find_held_lock+0x2b/0x80 [ 156.056718][ T6439] ? ksys_write+0x190/0x250 [ 156.056742][ T6439] ? ksys_write+0x190/0x250 [ 156.056765][ T6439] ? lock_acquire+0x1d1/0x380 [ 156.056806][ T6439] ? fput+0x7c/0x100 [ 156.056828][ T6439] ? ksys_write+0x1ac/0x250 [ 156.056858][ T6439] ? __x64_sys_bpf+0xce/0x140 [ 156.056879][ T6439] __x64_sys_bpf+0xce/0x140 [ 156.056902][ T6439] ? do_syscall_64+0xae/0x790 [ 156.056922][ T6439] do_syscall_64+0x123/0x790 [ 156.056942][ T6439] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 156.056961][ T6439] RIP: 0033:0x7f80b0b9f559 [ 156.056977][ T6439] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 156.056994][ T6439] RSP: 002b:00007f80b1b18028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 156.057013][ T6439] RAX: ffffffffffffffda RBX: 00007f80b0e25fa0 RCX: 00007f80b0b9f559 [ 156.057025][ T6439] RDX: 0000000000000050 RSI: 0000200000000b80 RDI: 000000000000000a [ 156.057036][ T6439] RBP: 00007f80b1b18090 R08: 0000000000000000 R09: 0000000000000000 [ 156.057047][ T6439] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 156.057058][ T6439] R13: 00007f80b0e26038 R14: 00007f80b0e25fa0 R15: 00007fffa8732678 [ 156.057084][ T6439] [ 156.057510][ T6439] syz.2.158: vmalloc error: size 4096, align 0x1, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 156.057576][ T6439] CPU: 1 UID: 0 PID: 6439 Comm: syz.2.158 Not tainted syzkaller #0 PREEMPT(full) [ 156.057596][ T6439] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 156.057607][ T6439] Call Trace: [ 156.057613][ T6439] [ 156.057620][ T6439] dump_stack_lvl+0x100/0x190 [ 156.057650][ T6439] warn_alloc.cold+0x9e/0xb2 [ 156.057671][ T6439] ? __pfx_warn_alloc+0x10/0x10 [ 156.057693][ T6439] ? __kasan_kmalloc+0x8a/0xb0 [ 156.057730][ T6439] ? __get_vm_area_node+0x22b/0x350 [ 156.057763][ T6439] __vmalloc_node_range_noprof+0xfa2/0x1420 [ 156.057784][ T6439] ? bpf_prog_pack_alloc+0x37/0x940 [ 156.057811][ T6439] ? rcu_is_watching+0x13/0xc0 [ 156.057845][ T6439] ? find_held_lock+0x2b/0x80 [ 156.057863][ T6439] ? bpf_prog_pack_alloc+0x1aa/0x940 [ 156.057890][ T6439] ? bpf_prog_pack_alloc+0x1aa/0x940 [ 156.057923][ T6439] ? bpf_dispatcher_change_prog+0x342/0xa50 [ 156.057951][ T6439] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 156.057971][ T6439] ? lock_acquire+0x1d1/0x380 [ 156.057996][ T6439] ? bitmap_find_next_zero_area_off+0xed/0x110 [ 156.058018][ T6439] ? __bitmap_set+0x118/0x150 [ 156.058039][ T6439] ? bpf_dispatcher_change_prog+0x342/0xa50 [ 156.058061][ T6439] __vmalloc_node_noprof+0xad/0xf0 [ 156.058079][ T6439] ? bpf_dispatcher_change_prog+0x342/0xa50 [ 156.058104][ T6439] bpf_dispatcher_change_prog+0x342/0xa50 [ 156.058126][ T6439] ? bpf_test_init.isra.0+0x51/0x100 [ 156.058157][ T6439] bpf_prog_test_run_xdp+0xd9d/0x1670 [ 156.058186][ T6439] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 156.058215][ T6439] ? fput+0x7c/0x100 [ 156.058232][ T6439] ? __bpf_prog_get+0x97/0x290 [ 156.058259][ T6439] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 156.058278][ T6439] __sys_bpf+0x2265/0x4a30 [ 156.058306][ T6439] ? __pfx___sys_bpf+0x10/0x10 [ 156.058326][ T6439] ? find_held_lock+0x2b/0x80 [ 156.058342][ T6439] ? get_pid_task+0xfc/0x250 [ 156.058368][ T6439] ? get_pid_task+0xfc/0x250 [ 156.058402][ T6439] ? find_held_lock+0x2b/0x80 [ 156.058425][ T6439] ? rcu_read_lock_any_held+0x6a/0x90 [ 156.058444][ T6439] ? find_held_lock+0x2b/0x80 [ 156.058460][ T6439] ? ksys_write+0x190/0x250 [ 156.058483][ T6439] ? ksys_write+0x190/0x250 [ 156.058507][ T6439] ? lock_acquire+0x1d1/0x380 [ 156.058547][ T6439] ? fput+0x7c/0x100 [ 156.058565][ T6439] ? ksys_write+0x1ac/0x250 [ 156.058593][ T6439] ? __x64_sys_bpf+0xce/0x140 [ 156.058615][ T6439] __x64_sys_bpf+0xce/0x140 [ 156.058639][ T6439] ? do_syscall_64+0xae/0x790 [ 156.058659][ T6439] do_syscall_64+0x123/0x790 [ 156.058680][ T6439] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 156.058699][ T6439] RIP: 0033:0x7f80b0b9f559 [ 156.058714][ T6439] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 156.058731][ T6439] RSP: 002b:00007f80b1b18028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 156.058748][ T6439] RAX: ffffffffffffffda RBX: 00007f80b0e25fa0 RCX: 00007f80b0b9f559 [ 156.058760][ T6439] RDX: 0000000000000050 RSI: 0000200000000b80 RDI: 000000000000000a [ 156.058772][ T6439] RBP: 00007f80b1b18090 R08: 0000000000000000 R09: 0000000000000000 [ 156.058783][ T6439] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 156.058794][ T6439] R13: 00007f80b0e26038 R14: 00007f80b0e25fa0 R15: 00007fffa8732678 [ 156.058820][ T6439] [ 156.058833][ T6439] Mem-Info: [ 156.058840][ T6439] active_anon:67818 inactive_anon:0 isolated_anon:0 [ 156.058840][ T6439] active_file:0 inactive_file:65708 isolated_file:0 [ 156.058840][ T6439] unevictable:0 dirty:542 writeback:100 [ 156.058840][ T6439] slab_reclaimable:12426 slab_unreclaimable:98204 [ 156.058840][ T6439] mapped:30924 shmem:59254 pagetables:1163 [ 156.058840][ T6439] sec_pagetables:0 bounce:0 [ 156.058840][ T6439] kernel_misc_reclaimable:0 [ 156.058840][ T6439] free:1225918 free_pcp:13547 free_cma:0 [ 156.058885][ T6439] Node 0 active_anon:271272kB inactive_anon:0kB active_file:0kB inactive_file:262628kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:123696kB dirty:2168kB writeback:400kB shmem:237016kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12248kB pagetables:4488kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 156.058934][ T6439] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:164kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 156.058979][ T6439] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 156.059028][ T6439] lowmem_reserve[]: 0 2452 2452 2452 2452 [ 156.059069][ T6439] Node 0 DMA32 free:955352kB boost:0kB min:33836kB low:42292kB high:50748kB reserved_highatomic:0kB free_highatomic:0kB active_anon:271272kB inactive_anon:0kB active_file:0kB inactive_file:262628kB unevictable:0kB writepending:2468kB zspages:0kB present:3129332kB managed:2510880kB mlocked:0kB bounce:0kB free_pcp:54160kB local_pcp:18992kB free_cma:0kB [ 156.059120][ T6439] lowmem_reserve[]: 0 0 0 0 0 [ 156.059150][ T6439] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:52kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 156.059196][ T6439] lowmem_reserve[]: 0 0 0 0 0 [ 156.059225][ T6439] Node 1 Normal free:3932960kB boost:0kB min:56064kB low:70080kB high:84096kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 156.059274][ T6439] lowmem_reserve[]: 0 0 0 0 0 [ 156.059303][ T6439] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 156.059415][ T6439] Node 0 DMA32: 937*4kB (UE) 303*8kB (UME) 147*16kB (UME) 852*32kB (UME) 1511*64kB (UME) 817*128kB (UME) 222*256kB (UME) 50*512kB (UM) 11*1024kB (ME) 5*2048kB (ME) 150*4096kB (UM) = 955404kB [ 156.059558][ T6439] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 156.059644][ T6439] Node 1 Normal: 4*4kB (UM) 6*8kB (UM) 2*16kB (UM) 12*32kB (UM) 7*64kB (UM) 5*128kB (UM) 3*256kB (UM) 3*512kB (UM) 1*1024kB (M) 0*2048kB 959*4096kB (UM) = 3932960kB [ 156.059779][ T6439] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 156.059793][ T6439] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 156.059806][ T6439] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 156.059820][ T6439] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 156.059838][ T6439] 124883 total pagecache pages [ 156.059845][ T6439] 0 pages in swap cache [ 156.059851][ T6439] Free swap = 124996kB [ 156.059857][ T6439] Total swap = 124996kB [ 156.059864][ T6439] 2097051 pages RAM [ 156.059871][ T6439] 0 pages HighMem/MovableOnly [ 156.059876][ T6439] 437702 pages reserved [ 156.059883][ T6439] 0 pages cma reserved [ 156.060022][ T6439] Illegal XDP return value 954695680 on prog (id 12) dev N/A, expect packet loss! [ 157.059436][ T6443] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 157.470788][ T30] audit: type=1400 audit(1792615713.584:481): avc: denied { read } for pid=6431 comm="syz.3.156" name="usbmon5" dev="devtmpfs" ino=730 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 157.470831][ T30] audit: type=1400 audit(1792615713.584:482): avc: denied { open } for pid=6431 comm="syz.3.156" path="/dev/usbmon5" dev="devtmpfs" ino=730 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 157.924498][ T30] audit: type=1400 audit(1792615714.044:483): avc: denied { ioctl } for pid=6431 comm="syz.3.156" path="/dev/usbmon5" dev="devtmpfs" ino=730 ioctlcmd=0x9207 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 159.576520][ T6458] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 160.034706][ T30] audit: type=1400 audit(1792615716.154:484): avc: denied { create } for pid=6462 comm="syz.0.159" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 160.145809][ T30] audit: type=1400 audit(1792615716.264:485): avc: denied { setopt } for pid=6462 comm="syz.0.159" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 160.214752][ T30] audit: type=1400 audit(1792615716.324:486): avc: denied { name_bind } for pid=6468 comm="syz.1.165" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 160.270371][ T6471] F2FS-fs: Conflicting test_dummy_encryption options [ 160.308337][ T30] audit: type=1400 audit(1792615716.424:487): avc: denied { mount } for pid=6461 comm="syz.4.164" name="/" dev="securityfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 161.068473][ T6481] Unsupported ieee802154 address type: 0 [ 161.142249][ T30] audit: type=1400 audit(1792615717.184:488): avc: denied { bind } for pid=6480 comm="syz.1.168" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 161.142297][ T30] audit: type=1400 audit(1792615717.184:489): avc: denied { connect } for pid=6480 comm="syz.1.168" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 161.142334][ T30] audit: type=1400 audit(1792615717.184:490): avc: denied { write } for pid=6480 comm="syz.1.168" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 161.293705][ T5708] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 161.443958][ T5708] usb 1-1: unable to get BOS descriptor or descriptor too short [ 161.444001][ T5708] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 161.446664][ T5708] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 161.446687][ T5708] usb 1-1: Product: syz [ 161.446701][ T5708] usb 1-1: Manufacturer: 濚ヱ㑷䢁㇗暻猁鐧ʤ꬝ж食萜㋴ᘧ偱幾鸲ᅞ椣麸켛톍惡肣㇃幜玊ႈ鑊ࢠ㆒က砨⡜樶䕠ケ䨬툿巭륫䴫验ቔ෮䚑볅洖䉤嚽賈ʿ༔פּꛌ䑁៽敯ꉏ騬䭿芮ⳍ⏶⡫륄󣀃 [ 161.446729][ T5708] usb 1-1: SerialNumber: syz [ 161.665179][ T6487] FAULT_INJECTION: forcing a failure. [ 161.665179][ T6487] name failslab, interval 1, probability 0, space 0, times 0 [ 161.665223][ T6487] CPU: 0 UID: 0 PID: 6487 Comm: syz.1.169 Not tainted syzkaller #0 PREEMPT(full) [ 161.665246][ T6487] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 161.665258][ T6487] Call Trace: [ 161.665265][ T6487] [ 161.665289][ T6487] dump_stack_lvl+0x100/0x190 [ 161.665324][ T6487] should_fail_ex.cold+0x5/0xa [ 161.665355][ T6487] should_failslab+0xc2/0x120 [ 161.665387][ T6487] __kmalloc_cache_noprof+0x91/0x6d0 [ 161.665412][ T6487] ? kset_create_and_add+0x4d/0x190 [ 161.665443][ T6487] kset_create_and_add+0x4d/0x190 [ 161.665470][ T6487] netdev_register_kobject+0x225/0x410 [ 161.665505][ T6487] register_netdevice+0x15b1/0x25a0 [ 161.665538][ T6487] ? __pfx_register_netdevice+0x10/0x10 [ 161.665563][ T6487] ? net_generic+0xea/0x2a0 [ 161.665592][ T6487] vti6_tnl_create2+0x80/0x160 [ 161.665618][ T6487] vti6_locate+0x5cc/0x6d0 [ 161.665644][ T6487] ? __pfx_vti6_locate+0x10/0x10 [ 161.665677][ T6487] vti6_siocdevprivate+0x581/0x760 [ 161.665705][ T6487] ? __pfx_vti6_siocdevprivate+0x10/0x10 [ 161.665746][ T6487] ? full_name_hash+0xbc/0x100 [ 161.665772][ T6487] dev_ifsioc+0xc71/0x1f80 [ 161.665799][ T6487] ? __pfx_dev_ifsioc+0x10/0x10 [ 161.665820][ T6487] ? __pfx___mutex_lock+0x10/0x10 [ 161.665845][ T6487] ? lock_acquire+0x1d1/0x380 [ 161.665871][ T6487] ? dev_load+0x8e/0x240 [ 161.665892][ T6487] ? dev_load+0x8e/0x240 [ 161.665921][ T6487] dev_ioctl+0x70e/0x10e0 [ 161.665947][ T6487] sock_ioctl+0x494/0x6b0 [ 161.665977][ T6487] ? __pfx_sock_ioctl+0x10/0x10 [ 161.666016][ T6487] ? __x64_sys_ioctl+0x130/0x210 [ 161.666041][ T6487] ? __pfx_sock_ioctl+0x10/0x10 [ 161.666072][ T6487] __x64_sys_ioctl+0x18e/0x210 [ 161.666100][ T6487] do_syscall_64+0x123/0x790 [ 161.666122][ T6487] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.666142][ T6487] RIP: 0033:0x7f6cecb9f559 [ 161.666158][ T6487] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 161.666177][ T6487] RSP: 002b:00007f6ceda83028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 161.666197][ T6487] RAX: ffffffffffffffda RBX: 00007f6cece26180 RCX: 00007f6cecb9f559 [ 161.666211][ T6487] RDX: 0000200000000200 RSI: 00000000000089f1 RDI: 0000000000000008 [ 161.666223][ T6487] RBP: 00007f6cecc36b20 R08: 0000000000000000 R09: 0000000000000000 [ 161.666235][ T6487] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 161.666247][ T6487] R13: 00007f6cece26218 R14: 00007f6cece26180 R15: 00007ffc39923818 [ 161.666279][ T6487] [ 162.264987][ T5708] usb 1-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 162.275240][ T5708] usb 1-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 162.321756][ T6490] syzkaller0: entered promiscuous mode [ 162.321779][ T6490] syzkaller0: entered allmulticast mode [ 162.427718][ T5708] usb 1-1: USB disconnect, device number 6 [ 162.472397][ T6493] FAULT_INJECTION: forcing a failure. [ 162.472397][ T6493] name failslab, interval 1, probability 0, space 0, times 0 [ 162.472415][ T6493] CPU: 1 UID: 0 PID: 6493 Comm: syz.1.170 Not tainted syzkaller #0 PREEMPT(full) [ 162.472428][ T6493] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 162.472434][ T6493] Call Trace: [ 162.472438][ T6493] [ 162.472442][ T6493] dump_stack_lvl+0x100/0x190 [ 162.472462][ T6493] should_fail_ex.cold+0x5/0xa [ 162.472479][ T6493] should_failslab+0xc2/0x120 [ 162.472496][ T6493] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 162.472513][ T6493] ? __alloc_skb+0x140/0x710 [ 162.472528][ T6493] __alloc_skb+0x140/0x710 [ 162.472539][ T6493] ? __alloc_skb+0x5b7/0x710 [ 162.472551][ T6493] ? __pfx___alloc_skb+0x10/0x10 [ 162.472566][ T6493] __pskb_copy_fclone+0xf2/0xe30 [ 162.472584][ T6493] hwsim_hw_xmit+0x441/0x1540 [ 162.472598][ T6493] ? ieee802154_hold_queue+0x100/0x450 [ 162.472616][ T6493] ? __pfx_hwsim_hw_xmit+0x10/0x10 [ 162.472627][ T6493] ? ieee802154_hold_queue+0x2a4/0x450 [ 162.472645][ T6493] ? find_held_lock+0x2b/0x80 [ 162.472657][ T6493] ? mark_held_locks+0x40/0x70 [ 162.472670][ T6493] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 162.472688][ T6493] ? __pfx_hwsim_hw_xmit+0x10/0x10 [ 162.472699][ T6493] ieee802154_tx.isra.0+0x29f/0x570 [ 162.472714][ T6493] ieee802154_subif_start_xmit+0xc8/0xf0 [ 162.472729][ T6493] dev_hard_start_xmit+0x121/0x760 [ 162.472750][ T6493] sch_direct_xmit+0x1b2/0xc70 [ 162.472774][ T6493] ? lock_acquire+0x1d1/0x380 [ 162.472787][ T6493] ? __pfx_sch_direct_xmit+0x10/0x10 [ 162.472803][ T6493] ? __pfx_do_raw_spin_trylock+0x10/0x10 [ 162.472823][ T6493] __dev_queue_xmit+0x2812/0x4a40 [ 162.472837][ T6493] ? __might_fault+0xc5/0x140 [ 162.472850][ T6493] ? __pfx___dev_queue_xmit+0x10/0x10 [ 162.472859][ T6493] ? __might_fault+0xc5/0x140 [ 162.472871][ T6493] ? __might_fault+0xc5/0x140 [ 162.472886][ T6493] ? _copy_from_iter+0x270/0x1690 [ 162.472897][ T6493] ? ieee802154_header_create+0x3bf/0x5e0 [ 162.472914][ T6493] ? __pfx__copy_from_iter+0x10/0x10 [ 162.472927][ T6493] ? __pfx_sock_has_perm+0x10/0x10 [ 162.472942][ T6493] ? lock_acquire+0x1d1/0x380 [ 162.472958][ T6493] dgram_sendmsg+0xa0d/0xf50 [ 162.472969][ T6493] ? __pfx_dgram_sendmsg+0x10/0x10 [ 162.472983][ T6493] ? selinux_socket_sendmsg+0x198/0x2f0 [ 162.473001][ T6493] ____sys_sendmsg+0xa4d/0xbe0 [ 162.473016][ T6493] ? __pfx_ieee802154_sock_sendmsg+0x10/0x10 [ 162.473034][ T6493] ? __pfx_____sys_sendmsg+0x10/0x10 [ 162.473052][ T6493] ? _kstrtoull+0x144/0x200 [ 162.473065][ T6493] ? __pfx__kstrtoull+0x10/0x10 [ 162.473080][ T6493] ___sys_sendmsg+0x190/0x1e0 [ 162.473097][ T6493] ? __pfx____sys_sendmsg+0x10/0x10 [ 162.473120][ T6493] ? __fget_files+0x34/0x3d0 [ 162.473139][ T6493] __sys_sendmmsg+0x20c/0x430 [ 162.473154][ T6493] ? __pfx___sys_sendmmsg+0x10/0x10 [ 162.473166][ T6493] ? ksys_write+0x190/0x250 [ 162.473190][ T6493] ? fput+0x7c/0x100 [ 162.473200][ T6493] ? ksys_write+0x1ac/0x250 [ 162.473214][ T6493] ? __pfx_ksys_write+0x10/0x10 [ 162.473230][ T6493] __x64_sys_sendmmsg+0x9c/0x100 [ 162.473243][ T6493] ? lockdep_hardirqs_on+0x7d/0x110 [ 162.473254][ T6493] do_syscall_64+0x123/0x790 [ 162.473266][ T6493] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 162.473278][ T6493] RIP: 0033:0x7f6cecb9f559 [ 162.473287][ T6493] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 162.473298][ T6493] RSP: 002b:00007f6cedac5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 162.473309][ T6493] RAX: ffffffffffffffda RBX: 00007f6cece25fa0 RCX: 00007f6cecb9f559 [ 162.473316][ T6493] RDX: 0000000004000050 RSI: 0000200000000a80 RDI: 0000000000000004 [ 162.473323][ T6493] RBP: 00007f6cedac5090 R08: 0000000000000000 R09: 0000000000000000 [ 162.473329][ T6493] R10: 000000000400c010 R11: 0000000000000246 R12: 0000000000000001 [ 162.473336][ T6493] R13: 00007f6cece26038 R14: 00007f6cece25fa0 R15: 00007ffc39923818 [ 162.473350][ T6493] [ 162.541785][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 162.541799][ T30] audit: type=1400 audit(1792615718.654:492): avc: denied { unmount } for pid=5617 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 162.769299][ T6479] udevd[6479]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 163.923855][ T30] audit: type=1400 audit(1792615720.044:493): avc: denied { execute } for pid=6504 comm="syz.3.166" path="/33/proc/bus/pci/00/00.0" dev="proc" ino=4026532185 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=file permissive=1 [ 165.000430][ T6514] audit: audit_lost=2 audit_rate_limit=0 audit_backlog_limit=64 [ 165.000447][ T6514] audit: out of memory in audit_log_start [ 165.111563][ T6517] device-mapper: ioctl: dm_ctl_ioctl: unknown command 0xc138fd12 [ 165.140621][ T6518] FAULT_INJECTION: forcing a failure. [ 165.140621][ T6518] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 165.140647][ T6518] CPU: 1 UID: 0 PID: 6518 Comm: syz.2.179 Not tainted syzkaller #0 PREEMPT(full) [ 165.140668][ T6518] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 165.140679][ T6518] Call Trace: [ 165.140686][ T6518] [ 165.140694][ T6518] dump_stack_lvl+0x100/0x190 [ 165.140725][ T6518] should_fail_ex.cold+0x5/0xa [ 165.140751][ T6518] _copy_to_user+0x32/0xd0 [ 165.140782][ T6518] ctl_ioctl+0x17b/0xcc0 [ 165.140812][ T6518] ? __pfx_ctl_ioctl+0x10/0x10 [ 165.140865][ T6518] ? selinux_file_ioctl+0x13b/0x290 [ 165.140883][ T6518] ? selinux_file_ioctl+0xb6/0x290 [ 165.140904][ T6518] dm_ctl_ioctl+0x22/0x30 [ 165.140928][ T6518] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 165.140954][ T6518] __x64_sys_ioctl+0x18e/0x210 [ 165.140981][ T6518] do_syscall_64+0x123/0x790 [ 165.141003][ T6518] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.141021][ T6518] RIP: 0033:0x7f80b0b9f559 [ 165.141037][ T6518] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 165.141055][ T6518] RSP: 002b:00007f80b1b18028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 165.141074][ T6518] RAX: ffffffffffffffda RBX: 00007f80b0e25fa0 RCX: 00007f80b0b9f559 [ 165.141086][ T6518] RDX: 0000200000000700 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 165.141098][ T6518] RBP: 00007f80b1b18090 R08: 0000000000000000 R09: 0000000000000000 [ 165.141111][ T6518] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 165.141122][ T6518] R13: 00007f80b0e26038 R14: 00007f80b0e25fa0 R15: 00007fffa8732678 [ 165.141148][ T6518] [ 165.348536][ T30] audit: type=1400 audit(1792615721.464:494): avc: denied { read } for pid=6521 comm="syz.1.181" name="mtd0" dev="devtmpfs" ino=702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 165.348777][ T30] audit: type=1400 audit(1792615721.464:495): avc: denied { open } for pid=6521 comm="syz.1.181" path="/dev/mtd0" dev="devtmpfs" ino=702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 165.382217][ T30] audit: type=1400 audit(1792615721.494:496): avc: denied { ioctl } for pid=6521 comm="syz.1.181" path="/dev/mtd0" dev="devtmpfs" ino=702 ioctlcmd=0x125f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 165.491384][ T30] audit: type=1400 audit(1792615721.604:497): avc: denied { map } for pid=6527 comm="syz.1.183" path="/dev/video3" dev="devtmpfs" ino=933 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 165.523244][ T6526] syzkaller0: entered promiscuous mode [ 165.523264][ T6526] syzkaller0: entered allmulticast mode [ 165.563058][ T6526] tipc: Started in network mode [ 165.563082][ T6526] tipc: Node identity 6a161a999e1, cluster identity 4711 [ 165.563222][ T6526] tipc: Enabled bearer , priority 0 [ 165.695344][ T6534] ================================================================== [ 165.695357][ T6534] BUG: KASAN: slab-use-after-free in snapshot_ctr+0x1c20/0x1fd0 [ 165.695391][ T6534] Read of size 8 at addr ffff8880764b9718 by task syz.2.182/6534 [ 165.695406][ T6534] [ 165.695415][ T6534] CPU: 1 UID: 0 PID: 6534 Comm: syz.2.182 Not tainted syzkaller #0 PREEMPT(full) [ 165.695439][ T6534] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 165.695451][ T6534] Call Trace: [ 165.695457][ T6534] [ 165.695464][ T6534] dump_stack_lvl+0x100/0x190 [ 165.695495][ T6534] print_report+0x13d/0x4b0 [ 165.695523][ T6534] ? __virt_addr_valid+0x239/0x430 [ 165.695548][ T6534] ? snapshot_ctr+0x1c20/0x1fd0 [ 165.695575][ T6534] kasan_report+0xdf/0x1c0 [ 165.695593][ T6534] ? snapshot_ctr+0x1c20/0x1fd0 [ 165.695620][ T6534] snapshot_ctr+0x1c20/0x1fd0 [ 165.695648][ T6534] ? kasan_save_track+0x14/0x30 [ 165.695676][ T6534] ? __pfx_snapshot_ctr+0x10/0x10 [ 165.695703][ T6534] ? dm_split_args+0xc1/0x570 [ 165.695722][ T6534] ? rcu_is_watching+0x13/0xc0 [ 165.695747][ T6534] ? dm_split_args+0xc1/0x570 [ 165.695765][ T6534] ? kfree+0x1e5/0x6d0 [ 165.695786][ T6534] ? skip_spaces+0xee/0x130 [ 165.695809][ T6534] dm_table_add_target+0x58b/0xee0 [ 165.695830][ T6534] ? __pfx_dm_table_add_target+0x10/0x10 [ 165.695853][ T6534] ? dm_table_create+0x2d3/0x3d0 [ 165.695873][ T6534] table_load+0x3b9/0x7b0 [ 165.695902][ T6534] ? __pfx_table_load+0x10/0x10 [ 165.695929][ T6534] ? __might_fault+0xc5/0x140 [ 165.695948][ T6534] ? __might_fault+0xc5/0x140 [ 165.695970][ T6534] ctl_ioctl+0x4d2/0xcc0 [ 165.695995][ T6534] ? __pfx_table_load+0x10/0x10 [ 165.696022][ T6534] ? __pfx_ctl_ioctl+0x10/0x10 [ 165.696059][ T6534] ? selinux_file_ioctl+0x13b/0x290 [ 165.696077][ T6534] ? selinux_file_ioctl+0xb6/0x290 [ 165.696095][ T6534] dm_ctl_ioctl+0x22/0x30 [ 165.696118][ T6534] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 165.696142][ T6534] __x64_sys_ioctl+0x18e/0x210 [ 165.696166][ T6534] do_syscall_64+0x123/0x790 [ 165.696185][ T6534] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.696205][ T6534] RIP: 0033:0x7f80b0b9f559 [ 165.696222][ T6534] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 165.696250][ T6534] RSP: 002b:00007f80b1af7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 165.696269][ T6534] RAX: ffffffffffffffda RBX: 00007f80b0e26090 RCX: 00007f80b0b9f559 [ 165.696282][ T6534] RDX: 0000200000000400 RSI: 00000000c138fd09 RDI: 0000000000000009 [ 165.696294][ T6534] RBP: 00007f80b0c36b20 R08: 0000000000000000 R09: 0000000000000000 [ 165.696306][ T6534] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 165.696318][ T6534] R13: 00007f80b0e26128 R14: 00007f80b0e26090 R15: 00007fffa8732678 [ 165.696335][ T6534] [ 165.696343][ T6534] [ 165.696347][ T6534] Allocated by task 6534: [ 165.696356][ T6534] kasan_save_stack+0x30/0x50 [ 165.696380][ T6534] kasan_save_track+0x14/0x30 [ 165.696404][ T6534] __kasan_kmalloc+0xaa/0xb0 [ 165.696428][ T6534] __kmalloc_cache_node_noprof+0x30c/0x710 [ 165.696454][ T6534] dm_get_table_device+0x2f8/0x830 [ 165.696476][ T6534] dm_get_device+0x525/0x7e0 [ 165.696490][ T6534] snapshot_ctr+0x201/0x1fd0 [ 165.696512][ T6534] dm_table_add_target+0x58b/0xee0 [ 165.696530][ T6534] table_load+0x3b9/0x7b0 [ 165.696553][ T6534] ctl_ioctl+0x4d2/0xcc0 [ 165.696575][ T6534] dm_ctl_ioctl+0x22/0x30 [ 165.696598][ T6534] __x64_sys_ioctl+0x18e/0x210 [ 165.696621][ T6534] do_syscall_64+0x123/0x790 [ 165.696636][ T6534] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.696654][ T6534] [ 165.696658][ T6534] Freed by task 6534: [ 165.696666][ T6534] kasan_save_stack+0x30/0x50 [ 165.696690][ T6534] kasan_save_track+0x14/0x30 [ 165.696716][ T6534] kasan_save_free_info+0x3b/0x70 [ 165.696735][ T6534] __kasan_slab_free+0x5f/0x80 [ 165.696761][ T6534] kfree+0x22b/0x6d0 [ 165.696780][ T6534] dm_put_table_device+0x2bf/0x380 [ 165.696804][ T6534] dm_get_device+0x3f1/0x7e0 [ 165.696821][ T6534] snapshot_ctr+0x326/0x1fd0 [ 165.696846][ T6534] dm_table_add_target+0x58b/0xee0 [ 165.696864][ T6534] table_load+0x3b9/0x7b0 [ 165.696888][ T6534] ctl_ioctl+0x4d2/0xcc0 [ 165.696911][ T6534] dm_ctl_ioctl+0x22/0x30 [ 165.696935][ T6534] __x64_sys_ioctl+0x18e/0x210 [ 165.696957][ T6534] do_syscall_64+0x123/0x790 [ 165.696973][ T6534] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.696991][ T6534] [ 165.696996][ T6534] The buggy address belongs to the object at ffff8880764b9700 [ 165.696996][ T6534] which belongs to the cache kmalloc-96 of size 96 [ 165.697011][ T6534] The buggy address is located 24 bytes inside of [ 165.697011][ T6534] freed 96-byte region [ffff8880764b9700, ffff8880764b9760) [ 165.697029][ T6534] [ 165.697033][ T6534] The buggy address belongs to the physical page: [ 165.697041][ T6534] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x764b9 [ 165.697057][ T6534] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 165.697072][ T6534] page_type: f5(slab) [ 165.697088][ T6534] raw: 00fff00000000000 ffff88801d038280 dead000000000100 dead000000000122 [ 165.697105][ T6534] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000 [ 165.697115][ T6534] page dumped because: kasan: bad access detected [ 165.697123][ T6534] page_owner tracks the page as allocated [ 165.697130][ T6534] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5796, tgid 5796 (kworker/0:8), ts 73882487401 [ 165.697159][ T6534] post_alloc_hook+0xfd/0x120 [ 165.697178][ T6534] get_page_from_freelist+0x110d/0x35d0 [ 165.697198][ T6534] __alloc_frozen_pages_noprof+0x2e9/0x32e0 [ 165.697220][ T6534] new_slab+0xa9/0x6e0 [ 165.697245][ T6534] refill_objects+0xe3/0x410 [ 165.697264][ T6534] __pcs_replace_empty_main+0x35e/0x650 [ 165.697284][ T6534] __kmalloc_cache_noprof+0x4ef/0x6d0 [ 165.697304][ T6534] dst_cow_metrics_generic+0x4c/0x1e0 [ 165.697321][ T6534] icmp6_dst_alloc+0x418/0x4f0 [ 165.697344][ T6534] mld_sendpack+0x5ae/0xec0 [ 165.697366][ T6534] mld_send_initial_cr+0x219/0x320 [ 165.697389][ T6534] mld_dad_work+0x32/0x1f0 [ 165.697413][ T6534] process_one_work+0xac7/0x1b10 [ 165.697430][ T6534] worker_thread+0x5ef/0xe50 [ 165.697446][ T6534] kthread+0x373/0x450 [ 165.697471][ T6534] ret_from_fork+0x730/0xd60 [ 165.697490][ T6534] page last free pid 1608 tgid 1608 ts 73881460558 stack trace: [ 165.697502][ T6534] __free_frozen_pages+0x79f/0x10f0 [ 165.697519][ T6534] qlist_free_all+0x47/0xf0 [ 165.697541][ T6534] kasan_quarantine_reduce+0x1a0/0x1f0 [ 165.697565][ T6534] __kasan_slab_alloc+0x69/0x90 [ 165.697591][ T6534] kmem_cache_alloc_node_noprof+0x282/0x6e0 [ 165.697615][ T6534] __alloc_skb+0x140/0x710 [ 165.697633][ T6534] mld_newpack.isra.0+0x18e/0xa20 [ 165.697658][ T6534] add_grhead+0x299/0x340 [ 165.697681][ T6534] add_grec+0x1389/0x1930 [ 165.697704][ T6534] mld_send_initial_cr+0x156/0x320 [ 165.697728][ T6534] mld_dad_work+0x32/0x1f0 [ 165.697751][ T6534] process_one_work+0xac7/0x1b10 [ 165.697767][ T6534] worker_thread+0x5ef/0xe50 [ 165.697783][ T6534] kthread+0x373/0x450 [ 165.697808][ T6534] ret_from_fork+0x730/0xd60 [ 165.697827][ T6534] ret_from_fork_asm+0x1a/0x30 [ 165.697847][ T6534] [ 165.697850][ T6534] Memory state around the buggy address: [ 165.697859][ T6534] ffff8880764b9600: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 165.697873][ T6534] ffff8880764b9680: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 165.697886][ T6534] >ffff8880764b9700: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 165.697896][ T6534] ^ [ 165.697906][ T6534] ffff8880764b9780: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 165.697918][ T6534] ffff8880764b9800: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 165.697929][ T6534] ================================================================== [ 165.698011][ T6534] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 166.456012][ T6534] CPU: 1 UID: 0 PID: 6534 Comm: syz.2.182 Not tainted syzkaller #0 PREEMPT(full) [ 166.465189][ T6534] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 166.475234][ T6534] Call Trace: [ 166.478491][ T6534] [ 166.481400][ T6534] dump_stack_lvl+0x100/0x190 [ 166.486066][ T6534] vpanic+0x553/0x970 [ 166.490026][ T6534] ? __pfx_vpanic+0x10/0x10 [ 166.494508][ T6534] ? snapshot_ctr+0x1c20/0x1fd0 [ 166.499342][ T6534] panic+0xd1/0xe0 [ 166.503039][ T6534] ? __pfx_panic+0x10/0x10 [ 166.507431][ T6534] ? snapshot_ctr+0x1c20/0x1fd0 [ 166.512264][ T6534] ? preempt_schedule+0x57/0xd0 [ 166.517103][ T6534] check_panic_on_warn.cold+0x19/0x34 [ 166.522454][ T6534] end_report.part.0+0x3a/0x90 [ 166.527206][ T6534] kasan_report.cold+0xe/0x18 [ 166.531874][ T6534] ? snapshot_ctr+0x1c20/0x1fd0 [ 166.536709][ T6534] snapshot_ctr+0x1c20/0x1fd0 [ 166.541373][ T6534] ? kasan_save_track+0x14/0x30 [ 166.546209][ T6534] ? __pfx_snapshot_ctr+0x10/0x10 [ 166.551225][ T6534] ? dm_split_args+0xc1/0x570 [ 166.555879][ T6534] ? rcu_is_watching+0x13/0xc0 [ 166.560630][ T6534] ? dm_split_args+0xc1/0x570 [ 166.565285][ T6534] ? kfree+0x1e5/0x6d0 [ 166.569333][ T6534] ? skip_spaces+0xee/0x130 [ 166.573817][ T6534] dm_table_add_target+0x58b/0xee0 [ 166.578907][ T6534] ? __pfx_dm_table_add_target+0x10/0x10 [ 166.584519][ T6534] ? dm_table_create+0x2d3/0x3d0 [ 166.589435][ T6534] table_load+0x3b9/0x7b0 [ 166.593755][ T6534] ? __pfx_table_load+0x10/0x10 [ 166.598592][ T6534] ? __might_fault+0xc5/0x140 [ 166.603258][ T6534] ? __might_fault+0xc5/0x140 [ 166.607919][ T6534] ctl_ioctl+0x4d2/0xcc0 [ 166.612145][ T6534] ? __pfx_table_load+0x10/0x10 [ 166.616980][ T6534] ? __pfx_ctl_ioctl+0x10/0x10 [ 166.621737][ T6534] ? selinux_file_ioctl+0x13b/0x290 [ 166.626915][ T6534] ? selinux_file_ioctl+0xb6/0x290 [ 166.632011][ T6534] dm_ctl_ioctl+0x22/0x30 [ 166.636324][ T6534] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 166.641341][ T6534] __x64_sys_ioctl+0x18e/0x210 [ 166.646087][ T6534] do_syscall_64+0x123/0x790 [ 166.650659][ T6534] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 166.656531][ T6534] RIP: 0033:0x7f80b0b9f559 [ 166.660922][ T6534] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 166.680507][ T6534] RSP: 002b:00007f80b1af7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 166.688897][ T6534] RAX: ffffffffffffffda RBX: 00007f80b0e26090 RCX: 00007f80b0b9f559 [ 166.696847][ T6534] RDX: 0000200000000400 RSI: 00000000c138fd09 RDI: 0000000000000009 [ 166.704794][ T6534] RBP: 00007f80b0c36b20 R08: 0000000000000000 R09: 0000000000000000 [ 166.712744][ T6534] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 166.720690][ T6534] R13: 00007f80b0e26128 R14: 00007f80b0e26090 R15: 00007fffa8732678 [ 166.728645][ T6534] [ 166.731833][ T6534] Kernel Offset: disabled [ 166.736141][ T6534] Rebooting in 86400 seconds..