last executing test programs: 9.436369148s ago: executing program 0 (id=1108): fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x77c, @empty, 0x1}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) accept(r0, 0x0, 0x0) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000100)={'wg0\x00', {0x2, 0x4e03, @rand_addr=0x64010101}}) socket$inet6_tcp(0xa, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/1/root/var\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/1/root/var/run\x00', 0x1ff) r3 = socket$unix(0x1, 0x1, 0x0) bind$unix(r3, &(0x7f00000001c0)=@file={0x1, './proc/1/root/var/run/gssproxy.sock\x00'}, 0x30) listen(r3, 0x5) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/net/rpc/use-gss-proxy\x00', 0x1, 0x20) write(r4, &(0x7f0000000280)='1', 0x1) close_range(r1, 0xffffffffffffffff, 0x0) 8.708118502s ago: executing program 2 (id=1112): setns(0xc9, 0x0) r0 = socket(0xa, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$inet_sctp(r0, 0x0, 0x24000052) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x64, 0x9, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x84}, @NFTA_SET_DESC={0x20, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0x1c, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}]}, {0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}]}]}]}]}, @NFT_MSG_NEWSETELEM={0x48, 0xc, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1c, 0x3, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x10, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0xc, 0x1, '\x00\x00\x00\x00\x00\x00\x00\x00'}]}]}, {0x4}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xf4}}, 0x0) 7.560875163s ago: executing program 0 (id=1118): mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, 0x0) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SCUDMATCHLEN(r2, 0x89e7, &(0x7f0000000140)={0x1d}) bind$x25(r2, &(0x7f0000000100), 0x12) listen(r2, 0x1) write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="000008050000010b"], 0x88) 7.559804291s ago: executing program 3 (id=1119): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f00000019c0)=@raw={'raw\x00', 0x9, 0x3, 0x1e8, 0x0, 0xffffffff, 0xffffffff, 0xb8, 0xffffffff, 0xb8, 0xffffffff, 0xffffffff, 0x150, 0xffffffff, 0x3, 0x0, {[{{@ip={@loopback, @loopback, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x6}, 0x0, 0x70, 0xb8}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'pptp\x00'}}}, {{@ip={@empty, @empty}, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x248) 7.012953797s ago: executing program 0 (id=1122): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) ptrace$peeksig(0x4209, r2, 0x0, 0x0) sched_setaffinity(r2, 0x0, 0x0) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000640), 0x101a00) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(r4, 0x40045402, &(0x7f0000000680)=0x1) 5.683704416s ago: executing program 0 (id=1124): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) ioprio_get$uid(0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER_AVC(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000405}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x14) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x94, 0x0, 0x0, 0x10001}]}, 0x10) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) r5 = socket$can_j1939(0x1d, 0x2, 0x7) connect$can_j1939(r5, &(0x7f0000000140)={0x1d, 0x0, 0x0, {0x1, 0xff, 0xa8fe8ad4eea2351f}, 0x2}, 0x18) setsockopt$SO_J1939_ERRQUEUE(r5, 0x6b, 0x4, &(0x7f00000001c0)=0x1, 0x4) sendmmsg(r5, &(0x7f0000003e40), 0x3fffffffffffe3d, 0xf5) sendmsg$kcm(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000140), 0x2000, 0x0) syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$BLKCLOSEZONE(r6, 0x40101287, &(0x7f0000000000)={0x612, 0x3}) sendfile(r4, r6, 0x0, 0x10000) 5.299670106s ago: executing program 2 (id=1126): socket(0x10, 0x2, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xa, 0xffea}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x9, 0xfffffff7, 0xb47e, 0xb, 0x20000003, 0xd, 0xf, 0x1ff}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000200)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70b928, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xffe0}, {0x2, 0xb}, {0xfff1, 0xe}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x9, 0x7, 0xa, 0x40000003, 0xfffffffc, 0xfffffffa}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000030}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r6) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574"], 0x38}}, 0x0) 4.502083115s ago: executing program 4 (id=1128): r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, &(0x7f0000000040)='netdevsim0\x00') 4.373148038s ago: executing program 2 (id=1129): fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x77c, @empty, 0x1}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) accept(r0, 0x0, 0x0) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000100)={'wg0\x00', {0x2, 0x4e03, @rand_addr=0x64010101}}) socket$inet6_tcp(0xa, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/1/root/var\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/1/root/var/run\x00', 0x1ff) r3 = socket$unix(0x1, 0x1, 0x0) bind$unix(r3, &(0x7f00000001c0)=@file={0x1, './proc/1/root/var/run/gssproxy.sock\x00'}, 0x30) listen(r3, 0x5) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/net/rpc/use-gss-proxy\x00', 0x1, 0x20) write(r4, &(0x7f0000000280)='1', 0x1) close_range(r1, 0xffffffffffffffff, 0x0) 4.291660071s ago: executing program 1 (id=1130): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002a80)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0xfffc}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0xfffd}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xb4}}, 0x0) 4.196259581s ago: executing program 4 (id=1131): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0x4}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) r1 = socket$kcm(0xa, 0x922000000003, 0x11) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f00000007c0)=@l2tp6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x85}, 0x9}, 0x80, 0x0}, 0x0) 4.057118937s ago: executing program 1 (id=1132): mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SCUDMATCHLEN(r2, 0x89e7, 0x0) bind$x25(r2, &(0x7f0000000100), 0x12) listen(r2, 0x1) write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="000008050000010b"], 0x88) 3.986767792s ago: executing program 4 (id=1133): socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000480)="aa", 0x1}], 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18}, 0xc800) recvmmsg(r1, &(0x7f0000001140), 0x700, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r2, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/configs/c.1/file0\x00', 0x181201, 0x0) write(r3, &(0x7f0000000200)='0x5678\n', 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0) write(r4, &(0x7f00000002c0)='1234567890\n', 0xb) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f0000000000)="fc0000001d000724ab09254ec100070007ab08001b000000f0ffff002100057e0000000000000e000039000000039815fad151ba0101099cec", 0x39) pipe(&(0x7f00000002c0)={0xffffffffffffffff}) splice(r6, 0x0, r5, 0x0, 0xffffffffffff8000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/ecm.usb0\x00') r7 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r7, &(0x7f0000000480)='dummy_udc.0\n', 0xc) nanosleep(&(0x7f0000000000)={0x0, 0x5f5e100}, 0x0) write(r7, &(0x7f00000004c0)='\n', 0x1) 3.777785007s ago: executing program 3 (id=1134): capset(&(0x7f0000000380)={0x20080522}, &(0x7f0000000040)={0x200000, 0x40200003, 0x0, 0x6, 0x7}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)={0x1c, r1, 0x1, 0x70bd2a, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x24040887}, 0x0) 3.578489717s ago: executing program 2 (id=1135): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001680)=ANY=[@ANYBLOB="a00000000001010400000000000000000a000000440001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c00028005000100000000005e000340000100003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000000010c00028005000100000000000800074000000000040006"], 0xa0}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)={0xa8, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x30, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @mcast1}}}]}, @CTA_TUPLE_REPLY={0x44, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x400}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}]}, 0xa8}}, 0x0) 3.512061455s ago: executing program 1 (id=1136): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x3a8bc000) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x20}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) write(0xca, &(0x7f0000000040)="0404e70000000004de92050000", 0xd) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)={0x20, 0x18, 0xa01, 0x70bd29, 0x0, {0x4}, [@typed={0xc, 0x17, 0x0, 0x0, @u64=0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0x200080c1}, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000540)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[], 0x0, 0x80}, 0x28) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="780000001000830404000000fedbdf2500007400", @ANYRES32=r4, @ANYBLOB="0008000007500500580012"], 0x78}, 0x1, 0x0, 0x0, 0x800}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r4}, 0x94) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000200)={0x1b, 0x0, 0x0, 0x42, 0x0, r5, 0x0, '\x00', 0x0, r2, 0x4, 0x0, 0x5}, 0x50) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@bloom_filter={0x1e, 0x10000008, 0x7fffffff, 0x7, 0x20, r6, 0x6, '\x00', r4, 0xffffffffffffffff, 0x1, 0x4, 0x1, 0xf}, 0x50) r8 = openat$binfmt_register(0xffffff9c, &(0x7f0000000040), 0x1, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) write$binfmt_register(r8, &(0x7f0000000080)={0x3a, 'syz2', 0x3a, 'E', 0x3a, 0x8001ff, 0x3a, '\x12\r\xf6', 0x3a, '\b', 0x3a, './file0'}, 0x2b) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x12, r7, 0x0) unshare(0x20060400) r9 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_drop_memb(r9, 0x107, 0x2, &(0x7f00000009c0)={0x0, 0x1, 0x6, @multicast}, 0x10) syz_clone(0x8200080, 0x0, 0x0, 0x0, 0x0, 0x0) 3.447925263s ago: executing program 3 (id=1137): syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) syz_emit_ethernet(0x4d, &(0x7f0000000040)={@link_local, @empty, @val={@void}, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x13, 0x11, 0xff, @remote, @local, {[], {0x0, 0xe22, 0x13, 0x0, @gue={{0x2, 0x0, 0x0, 0x7}, "30b00a"}}}}}}}, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'wlan0\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet_udp(0x2, 0x2, 0x0) r3 = syz_open_dev$vim2m(&(0x7f0000000080), 0x2, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix={0x0, 0xfffffffd, 0x59455247, 0x0, 0x0, 0x0, 0x0, 0x2}}) ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000040)={0x80000001, 0x1, 0x4}) 3.158343562s ago: executing program 2 (id=1138): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) sendto$inet_nvme_of_msg(0xffffffffffffffff, &(0x7f0000000240)={@cmd={{0x4, 0xc, 0x48, 0xff}, {@common={0xe, 0x0, 0xfffd, 0x7, [0xd, 0x6], 0x2, @sgl={0x7, 0x6, '\x00', 0x81}, @cdws={0x376, 0x1000, 0xfbd, 0xb, 0xfffff6f2, 0x5}}}}, @void}, 0x80, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x340, 0x0, 0x4c, 0x1a, 0x190, 0x73, 0x270, 0x258, 0x258, 0x270, 0x258, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @mcast2, [], [], 'netdevsim0\x00', 'macvlan1\x00'}, 0x0, 0x160, 0x190, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x2}}, @common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @rand_addr=' \x01\x00', @dev}}]}, @common=@inet=@SET2={0x30}}, {{@uncond, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3a0) 2.450526783s ago: executing program 0 (id=1139): socket(0x10, 0x2, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xa, 0xffea}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x9, 0xfffffff7, 0xb47e, 0xb, 0x20000003, 0xd, 0xf, 0x1ff}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000200)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70b928, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xffe0}, {0x2, 0xb}, {0xfff1, 0xe}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x9, 0x7, 0xa, 0x40000003, 0xfffffffc, 0xfffffffa}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000030}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r6) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574"], 0x38}}, 0x0) 2.26431939s ago: executing program 3 (id=1140): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000140)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x1}, @NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0xd}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x7c}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) 2.103656209s ago: executing program 4 (id=1141): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000680)={0x34, r2, 0x1, 0x1070bd0c, 0x4, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaa8}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}]}, 0x34}, 0x1, 0x0, 0x0, 0x40811}, 0x20) bind$inet6(r1, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@multicast, @multicast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x14, 0x11, 0xff, @remote, @local, {[], {0x0, 0xe22, 0x14, 0x0, @gue={{0x1, 0x0, 0x0, 0x3, 0x0, @void}, '\x00\x00\x00\x00\x00\x00\x00\x00'}}}}}}}, 0x0) 1.997059169s ago: executing program 3 (id=1142): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002a80)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0xfffc}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0xfffd}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xb4}}, 0x0) 1.947958523s ago: executing program 1 (id=1143): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000b00)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newtaction={0xb4, 0x30, 0x1, 0x70bd2b, 0x25dfdbde, {}, [{0xa0, 0x1, [@m_bpf={0x58, 0x1, 0x0, 0x0, {{0x8}, {0x30, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x1}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x3, 0xef, 0x1, 0x8000, 0x2}}, @TCA_ACT_BPF_OPS={0xc, 0x4, [{0x16, 0xf2, 0x3, 0x7}]}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}, @m_bpf={0x44, 0x2, 0x0, 0x0, {{0x8}, {0x1c, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_PARMS={0x18, 0x2, {0x3, 0x2, 0x0, 0x6, 0x80}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0xc044}, 0x4000814) 1.668277381s ago: executing program 0 (id=1144): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f00000019c0)=@raw={'raw\x00', 0x9, 0x3, 0x1e8, 0x0, 0xffffffff, 0xffffffff, 0xb8, 0xffffffff, 0xb8, 0xffffffff, 0xffffffff, 0x150, 0xffffffff, 0x3, 0x0, {[{{@ip={@loopback, @loopback, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x6}, 0x0, 0x70, 0xb8}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'pptp\x00'}}}, {{@ip={@empty, @empty}, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x248) 1.641476987s ago: executing program 4 (id=1145): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000240)=@bpf_lsm={0x18, 0x7, &(0x7f0000000180)=@raw=[@func={0x85, 0x0, 0x1, 0x0, 0x4}, @exit, @initr0, @exit, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffc}, @exit], &(0x7f00000000c0)='GPL\x00'}, 0x78) r4 = syz_open_procfs(0x0, &(0x7f0000000100)='task\x00') getdents64(r4, &(0x7f0000000340)=""/79, 0x4f) getdents(r4, 0x0, 0x3b) mkdirat(0xffffffffffffff9c, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) syz_io_uring_setup(0x3, 0x0, &(0x7f0000000240), &(0x7f0000001880), &(0x7f0000000000)) io_uring_enter(0xffffffffffffffff, 0x8ae, 0xfbb9, 0x1f, 0x0, 0x0) openat$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)='cpuset.sched_load_balance\x00', 0x2, 0x0) 1.592142341s ago: executing program 3 (id=1146): mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SCUDMATCHLEN(r2, 0x89e7, 0x0) bind$x25(r2, &(0x7f0000000100), 0x12) listen(r2, 0x1) write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="000008050000010b"], 0x88) 199.793551ms ago: executing program 1 (id=1147): openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2040, 0x100) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x1, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', &(0x7f0000000100), 0x2000) 199.358341ms ago: executing program 4 (id=1148): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f00000005c0)="308201d43082017ba00302010202142eea640d7f17e62e9e5869c087c68e1bd0f86fde300a06082a8648ce3d040302303a3138303606035529030c2f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793020170d3234303431333232313632365a180f323132343029323032323108000000bcaff7bd25c2a4f55504030c2f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b657930ffffffff072a8648ce3d020106082a3a656a4d4dc8e81d202b0d9b0301070342000407e56b51affc19412c88926b775771039ee2fe6e6a714ec7299f90e177189fc2e70a82d08ae181a9717c5a73fb25b94b1e248c739ff838f848b4ad1619c022c6a35d305b301d0603551d0e041604142900bcea1deb7bdc479a84a23d758efdfdd2b2d3301f0603551d230418301680142900bcea1deb7bc8479a84a23d758efdfdd2b2d3300c0603551d130101ff04023000300b0603551d0f040403020780300a06082a8648ce3d040302034700304402201ad7ac07c89738f489437ec7666ea5007c121db409760c996b8c265de9705cb4022073b7c77a5adb670a964219cf4f674f356aee294f1e5033fb", 0x1d8, 0xfffffffffffffffd) openat(0xffffffffffffff9c, 0x0, 0x101042, 0x15) 63.284784ms ago: executing program 2 (id=1149): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) ioprio_get$uid(0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER_AVC(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000405}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x14) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x94, 0x0, 0x0, 0x10001}]}, 0x10) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) r5 = socket$can_j1939(0x1d, 0x2, 0x7) connect$can_j1939(r5, &(0x7f0000000140)={0x1d, 0x0, 0x0, {0x1, 0xff, 0xa8fe8ad4eea2351f}, 0x2}, 0x18) setsockopt$SO_J1939_ERRQUEUE(r5, 0x6b, 0x4, &(0x7f00000001c0)=0x1, 0x4) sendmmsg(r5, &(0x7f0000003e40), 0x3fffffffffffe3d, 0xf5) sendmsg$kcm(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000140), 0x2000, 0x0) syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$BLKCLOSEZONE(r6, 0x40101287, &(0x7f0000000000)={0x612, 0x3}) sendfile(r4, r6, 0x0, 0x10000) 0s ago: executing program 1 (id=1150): syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) syz_emit_ethernet(0x4d, &(0x7f0000000040)={@link_local, @empty, @val={@void}, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x13, 0x11, 0xff, @remote, @local, {[], {0x0, 0xe22, 0x13, 0x0, @gue={{0x2, 0x0, 0x0, 0x7}, "30b00a"}}}}}}}, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'wlan0\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet_udp(0x2, 0x2, 0x0) r3 = syz_open_dev$vim2m(&(0x7f0000000080), 0x2, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix={0x0, 0xfffffffd, 0x59455247, 0x0, 0x0, 0x0, 0x0, 0x2}}) ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000040)={0x80000001, 0x1, 0x4}) kernel console output (not intermixed with test programs): .180622][ T991] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.222135][ T5598] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.285390][ T5598] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.339142][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.339253][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.386911][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.387033][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.680376][ T5601] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 70.838171][ T5601] veth0_vlan: entered promiscuous mode [ 70.874789][ T5601] veth1_vlan: entered promiscuous mode [ 71.004259][ T5601] veth0_macvtap: entered promiscuous mode [ 71.035350][ T5601] veth1_macvtap: entered promiscuous mode [ 71.093260][ T5599] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.126554][ T5601] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.153122][ T5601] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.247867][ T5600] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.265818][ T329] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.265981][ T329] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.266014][ T329] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.266045][ T329] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.374805][ T5610] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.512239][ T5600] veth0_vlan: entered promiscuous mode [ 71.585684][ T5600] veth1_vlan: entered promiscuous mode [ 71.607115][ T991] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.607151][ T991] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.611990][ T5598] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.662748][ T5610] veth0_vlan: entered promiscuous mode [ 71.687898][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.687918][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.694712][ T5610] veth1_vlan: entered promiscuous mode [ 71.729461][ T30] audit: type=1400 audit(1789502031.173:153): avc: denied { mounton } for pid=5601 comm="syz-executor" path="/root/syzkaller.D2R9Bq/syz-tmp" dev="sda1" ino=2042 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 71.730556][ T30] audit: type=1400 audit(1789502031.173:154): avc: denied { mount } for pid=5601 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 71.733395][ T30] audit: type=1400 audit(1789502031.173:155): avc: denied { mounton } for pid=5601 comm="syz-executor" path="/root/syzkaller.D2R9Bq/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 71.740654][ T30] audit: type=1400 audit(1789502031.183:156): avc: denied { mount } for pid=5601 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 71.746081][ T30] audit: type=1400 audit(1789502031.193:157): avc: denied { mounton } for pid=5601 comm="syz-executor" path="/root/syzkaller.D2R9Bq/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 71.747534][ T30] audit: type=1400 audit(1789502031.193:158): avc: denied { mounton } for pid=5601 comm="syz-executor" path="/root/syzkaller.D2R9Bq/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=6951 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 71.753119][ T30] audit: type=1400 audit(1789502031.193:159): avc: denied { unmount } for pid=5601 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 71.780380][ T30] audit: type=1400 audit(1789502031.223:160): avc: denied { mounton } for pid=5601 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2780 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 71.793773][ T30] audit: type=1400 audit(1789502031.233:161): avc: denied { mount } for pid=5601 comm="syz-executor" name="/" dev="gadgetfs" ino=6952 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 71.844659][ T5600] veth0_macvtap: entered promiscuous mode [ 71.903095][ T5599] veth0_vlan: entered promiscuous mode [ 71.924735][ T5600] veth1_macvtap: entered promiscuous mode [ 71.977742][ T5612] Bluetooth: hci3: command tx timeout [ 71.977805][ T5601] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 71.977818][ T5608] Bluetooth: hci1: command tx timeout [ 71.980410][ T5610] veth0_macvtap: entered promiscuous mode [ 71.983125][ T5599] veth1_vlan: entered promiscuous mode [ 71.989934][ T5598] veth0_vlan: entered promiscuous mode [ 71.992344][ T5610] veth1_macvtap: entered promiscuous mode [ 72.055806][ T5612] Bluetooth: hci2: command tx timeout [ 72.055838][ T5612] Bluetooth: hci0: command tx timeout [ 72.055959][ T5608] Bluetooth: hci4: command tx timeout [ 72.090907][ T5600] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.097992][ T5598] veth1_vlan: entered promiscuous mode [ 72.102118][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.119422][ T5600] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.161013][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.205821][ T50] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.206556][ T50] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.206594][ T50] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.206628][ T50] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.228522][ T5599] veth0_macvtap: entered promiscuous mode [ 72.235706][ T316] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.283979][ T5599] veth1_macvtap: entered promiscuous mode [ 72.345394][ T329] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.345517][ T329] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.345551][ T329] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.346013][ T5598] veth0_macvtap: entered promiscuous mode [ 72.399014][ T5598] veth1_macvtap: entered promiscuous mode [ 72.494400][ T5599] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.511496][ T5796] trusted_key: syz.1.9 sent an empty control message without MSG_MORE. [ 72.523437][ T5599] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.524685][ T329] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.524703][ T329] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.612002][ T5598] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.622407][ T991] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.622436][ T991] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.666941][ T5598] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.765354][ T991] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.766075][ T991] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.767864][ T329] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.767882][ T329] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.819082][ T5804] FAULT_INJECTION: forcing a failure. [ 72.819082][ T5804] name failslab, interval 1, probability 0, space 0, times 0 [ 72.820341][ T5804] CPU: 0 UID: 0 PID: 5804 Comm: syz.1.13 Not tainted syzkaller #0 PREEMPT(full) [ 72.820372][ T5804] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 72.820390][ T5804] Call Trace: [ 72.820397][ T5804] [ 72.820404][ T5804] dump_stack_lvl+0x100/0x190 [ 72.820444][ T5804] should_fail_ex.cold+0x5/0xa [ 72.820472][ T5804] should_failslab+0xc2/0x120 [ 72.820496][ T5804] __kvmalloc_node_noprof+0x113/0x9b0 [ 72.820521][ T5804] ? v4l2_ctrl_new+0x4a6/0x23a0 [ 72.820552][ T5804] v4l2_ctrl_new+0x4a6/0x23a0 [ 72.820585][ T5804] ? __pfx_v4l2_ctrl_new+0x10/0x10 [ 72.820618][ T5804] ? __pfx_v4l2_ctrl_new+0x10/0x10 [ 72.820644][ T5804] ? __pfx_v4l2_ctrl_new+0x10/0x10 [ 72.820675][ T5804] v4l2_ctrl_new_custom+0x41b/0xa20 [ 72.820715][ T5804] ? __pfx_v4l2_ctrl_new_custom+0x10/0x10 [ 72.820740][ T5804] ? __pfx_v4l2_ctrl_new_std+0x10/0x10 [ 72.820771][ T5804] ? __kvmalloc_node_noprof+0x377/0x9b0 [ 72.820797][ T5804] ? media_request_object_init+0x105/0x180 [ 72.820824][ T5804] vim2m_open+0x182/0x830 [ 72.820851][ T5804] v4l2_open+0x1d2/0x490 [ 72.820876][ T5804] ? __pfx_v4l2_open+0x10/0x10 [ 72.820901][ T5804] chrdev_open+0x234/0x6a0 [ 72.820930][ T5804] ? __pfx_chrdev_open+0x10/0x10 [ 72.820955][ T5804] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 72.820990][ T5804] do_dentry_open+0x6ab/0x14d0 [ 72.821011][ T5804] ? __pfx_chrdev_open+0x10/0x10 [ 72.821038][ T5804] vfs_open+0x82/0x3f0 [ 72.821064][ T5804] path_openat+0x19fa/0x2440 [ 72.821090][ T5804] ? __pfx_path_openat+0x10/0x10 [ 72.821118][ T5804] do_file_open+0x20e/0x430 [ 72.821142][ T5804] ? __pfx_do_file_open+0x10/0x10 [ 72.821180][ T5804] ? _raw_spin_unlock+0x28/0x50 [ 72.821201][ T5804] ? alloc_fd+0x471/0x7a0 [ 72.821229][ T5804] do_sys_openat2+0x10f/0x1e0 [ 72.821253][ T5804] ? __pfx_do_sys_openat2+0x10/0x10 [ 72.821275][ T5804] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 72.821305][ T5804] __x64_sys_openat+0x12d/0x210 [ 72.821329][ T5804] ? __pfx___x64_sys_openat+0x10/0x10 [ 72.821362][ T5804] do_syscall_64+0x123/0x790 [ 72.821388][ T5804] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.821406][ T5804] RIP: 0033:0x7f3e9855e98e [ 72.821423][ T5804] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 72.821447][ T5804] RSP: 002b:00007f3e967f5b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 72.821470][ T5804] RAX: ffffffffffffffda RBX: 00007f3e967f66c0 RCX: 00007f3e9855e98e [ 72.821482][ T5804] RDX: 0000000000000002 RSI: 00007f3e967f5c00 RDI: ffffffffffffff9c [ 72.821495][ T5804] RBP: 00007f3e967f5c00 R08: 0000000000000000 R09: 0000000000000000 [ 72.821506][ T5804] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 72.821518][ T5804] R13: 00007f3e98826038 R14: 00007f3e98825fa0 R15: 00007fff99c65cb8 [ 72.821544][ T5804] [ 72.830481][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.831210][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.831245][ T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.831278][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.831309][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.004811][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.004831][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.157069][ T1016] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.204940][ T1016] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.204972][ T1016] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.405186][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.405206][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.443417][ T1016] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.443438][ T1016] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.570761][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.570782][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.056646][ T5608] Bluetooth: hci1: command tx timeout [ 74.137019][ T5615] Bluetooth: hci0: command tx timeout [ 74.137054][ T5615] Bluetooth: hci2: command tx timeout [ 74.137098][ T5608] Bluetooth: hci4: command tx timeout [ 74.248688][ T5832] i2c-slave-eeprom 0-0001: i2c_slave_register: client slave flag not set. You might see address collisions [ 74.248714][ T5832] i2c-slave-eeprom 0-0001: i2c_slave_register: invalid address [ 74.249292][ T5832] i2c-slave-eeprom 0-0001: probe with driver i2c-slave-eeprom failed with error -22 [ 74.249646][ T5832] i2c i2c-0: new_device: Instantiated device slave-24c02 at 0x01 [ 74.423715][ T5840] netlink: 12 bytes leftover after parsing attributes in process `syz.2.24'. [ 74.468763][ T5835] netlink: 20 bytes leftover after parsing attributes in process `syz.1.20'. [ 74.468787][ T5835] netlink: 24 bytes leftover after parsing attributes in process `syz.1.20'. [ 74.963758][ T30] kauditd_printk_skb: 56 callbacks suppressed [ 74.963774][ T30] audit: type=1400 audit(1789502034.403:218): avc: denied { bind } for pid=5851 comm="syz.2.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 75.060115][ T30] audit: type=1400 audit(1789502034.503:219): avc: denied { ioctl } for pid=5853 comm="syz.2.30" path="/dev/video8" dev="devtmpfs" ino=947 ioctlcmd=0x561c scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 75.190736][ T30] audit: type=1400 audit(1789502034.633:220): avc: denied { bind } for pid=5856 comm="syz.2.31" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 75.204196][ T30] audit: type=1400 audit(1789502034.633:221): avc: denied { name_bind } for pid=5856 comm="syz.2.31" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 75.204247][ T30] audit: type=1400 audit(1789502034.633:222): avc: denied { node_bind } for pid=5856 comm="syz.2.31" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 75.214628][ T30] audit: type=1400 audit(1789502034.663:223): avc: denied { write } for pid=5856 comm="syz.2.31" lport=20004 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 75.214676][ T30] audit: type=1400 audit(1789502034.663:224): avc: denied { connect } for pid=5856 comm="syz.2.31" lport=20004 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 75.214718][ T30] audit: type=1400 audit(1789502034.663:225): avc: denied { name_connect } for pid=5856 comm="syz.2.31" dest=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 75.452241][ T30] audit: type=1400 audit(1789502034.893:226): avc: denied { create } for pid=5848 comm="syz.1.27" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 75.453641][ T30] audit: type=1400 audit(1789502034.893:227): avc: denied { connect } for pid=5848 comm="syz.1.27" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 75.473533][ T5866] block nbd1: NBD_DISCONNECT [ 75.606103][ T5871] syz.0.34 uses obsolete (PF_INET,SOCK_PACKET) [ 75.612242][ T5875] IPv6: addrconf: prefix option has invalid lifetime [ 75.865981][ T5877] netlink: 20 bytes leftover after parsing attributes in process `syz.4.36'. [ 75.866006][ T5877] netlink: 24 bytes leftover after parsing attributes in process `syz.4.36'. [ 77.724416][ T5927] FAULT_INJECTION: forcing a failure. [ 77.724416][ T5927] name failslab, interval 1, probability 0, space 0, times 0 [ 77.724448][ T5927] CPU: 1 UID: 0 PID: 5927 Comm: syz.3.48 Not tainted syzkaller #0 PREEMPT(full) [ 77.724472][ T5927] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 77.724485][ T5927] Call Trace: [ 77.724492][ T5927] [ 77.724500][ T5927] dump_stack_lvl+0x100/0x190 [ 77.724547][ T5927] should_fail_ex.cold+0x5/0xa [ 77.724578][ T5927] should_failslab+0xc2/0x120 [ 77.724604][ T5927] kmem_cache_alloc_noprof+0x92/0x6a0 [ 77.724626][ T5927] ? d_instantiate+0x8a/0xb0 [ 77.724654][ T5927] ? alloc_empty_file+0x5b/0x1c0 [ 77.724687][ T5927] alloc_empty_file+0x5b/0x1c0 [ 77.724715][ T5927] alloc_file_pseudo+0x183/0x290 [ 77.724743][ T5927] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 77.724779][ T5927] dma_buf_export+0x326/0xc60 [ 77.724801][ T5927] ? sg_alloc_table+0x4c/0x1c0 [ 77.724835][ T5927] system_heap_allocate+0xbb1/0x11f0 [ 77.724866][ T5927] ? __pfx_system_heap_allocate+0x10/0x10 [ 77.724890][ T5927] ? __might_fault+0xc5/0x140 [ 77.724932][ T5927] dma_heap_ioctl+0x3a0/0x6d0 [ 77.724957][ T5927] ? __pfx_dma_heap_ioctl+0x10/0x10 [ 77.724990][ T5927] ? selinux_file_ioctl+0x13b/0x290 [ 77.725010][ T5927] ? selinux_file_ioctl+0xb6/0x290 [ 77.725030][ T5927] ? __pfx_dma_heap_ioctl+0x10/0x10 [ 77.725050][ T5927] __x64_sys_ioctl+0x18e/0x210 [ 77.725071][ T5927] do_syscall_64+0x123/0x790 [ 77.725100][ T5927] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.725121][ T5927] RIP: 0033:0x7ff13cf9e159 [ 77.725138][ T5927] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 77.725155][ T5927] RSP: 002b:00007ff13de41028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 77.725174][ T5927] RAX: ffffffffffffffda RBX: 00007ff13d225fa0 RCX: 00007ff13cf9e159 [ 77.725187][ T5927] RDX: 0000200000000100 RSI: 00000000c0184800 RDI: 0000000000000003 [ 77.725200][ T5927] RBP: 00007ff13d03503b R08: 0000000000000000 R09: 0000000000000000 [ 77.725212][ T5927] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 77.725224][ T5927] R13: 00007ff13d226038 R14: 00007ff13d225fa0 R15: 00007fff29ad7db8 [ 77.725252][ T5927] [ 78.055109][ T5929] netlink: 20 bytes leftover after parsing attributes in process `syz.0.47'. [ 78.055132][ T5929] netlink: 24 bytes leftover after parsing attributes in process `syz.0.47'. [ 78.472370][ T5934] netlink: 28 bytes leftover after parsing attributes in process `syz.2.51'. [ 79.176810][ T5608] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 79.178043][ T5608] Bluetooth: hci0: Injecting HCI hardware error event [ 79.181886][ T5612] Bluetooth: hci0: hardware error 0x00 [ 79.609725][ T5960] netlink: 20 bytes leftover after parsing attributes in process `syz.3.59'. [ 79.609749][ T5960] netlink: 24 bytes leftover after parsing attributes in process `syz.3.59'. [ 79.746941][ T5962] block nbd4: NBD_DISCONNECT [ 80.265258][ T5968] device-mapper: ioctl: name not supplied when creating device [ 80.265288][ T30] kauditd_printk_skb: 19 callbacks suppressed [ 80.265928][ T30] audit: type=1400 audit(1789502039.703:247): avc: denied { read write } for pid=5949 comm="syz.2.55" name="control" dev="devtmpfs" ino=1266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 80.265978][ T30] audit: type=1400 audit(1789502039.703:248): avc: denied { open } for pid=5949 comm="syz.2.55" path="/12/dev/mapper/control" dev="devtmpfs" ino=1266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 80.266013][ T30] audit: type=1400 audit(1789502039.713:249): avc: denied { ioctl } for pid=5949 comm="syz.2.55" path="/12/dev/mapper/control" dev="devtmpfs" ino=1266 ioctlcmd=0xfd03 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 80.968970][ T5976] netlink: 28 bytes leftover after parsing attributes in process `syz.2.65'. [ 81.059412][ T30] audit: type=1400 audit(1789502040.503:250): avc: denied { create } for pid=5973 comm="syz.0.61" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 81.062135][ T30] audit: type=1400 audit(1789502040.503:251): avc: denied { bind } for pid=5973 comm="syz.0.61" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 81.209939][ T30] audit: type=1400 audit(1789502040.653:252): avc: denied { ioctl } for pid=5982 comm="syz.1.67" path="socket:[8170]" dev="sockfs" ino=8170 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 81.282755][ T5612] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 81.754658][ T25] cfg80211: failed to load regulatory.db [ 81.844872][ T30] audit: type=1400 audit(1789502041.283:253): avc: denied { map_read map_write } for pid=5990 comm="syz.0.70" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 81.978786][ T5997] macsec1: entered promiscuous mode [ 81.978808][ T5997] bridge0: entered promiscuous mode [ 81.984527][ T30] audit: type=1400 audit(1789502041.393:254): avc: denied { write } for pid=5996 comm="syz.1.72" path="socket:[9115]" dev="sockfs" ino=9115 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 82.167129][ T30] audit: type=1400 audit(1789502041.613:255): avc: denied { create } for pid=6005 comm="syz.3.78" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 82.171936][ T30] audit: type=1400 audit(1789502041.613:256): avc: denied { write } for pid=6005 comm="syz.3.78" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 82.184565][ T6007] process 'syz.1.75' launched './file0' with NULL argv: empty string added [ 82.233859][ T6009] netlink: 28 bytes leftover after parsing attributes in process `syz.4.76'. [ 82.666414][ T6015] binder: 6013:6015 ioctl c0306201 0 returned -14 [ 83.046436][ T6031] netlink: 'syz.3.85': attribute type 2 has an invalid length. [ 83.959208][ T6043] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 84.668160][ T6054] netlink: 28 bytes leftover after parsing attributes in process `syz.2.90'. [ 85.403936][ T6081] FAULT_INJECTION: forcing a failure. [ 85.403936][ T6081] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 85.403970][ T6081] CPU: 1 UID: 0 PID: 6081 Comm: syz.2.104 Not tainted syzkaller #0 PREEMPT(full) [ 85.403996][ T6081] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 85.404009][ T6081] Call Trace: [ 85.404017][ T6081] [ 85.404025][ T6081] dump_stack_lvl+0x100/0x190 [ 85.404062][ T6081] should_fail_ex.cold+0x5/0xa [ 85.404091][ T6081] _copy_to_iter+0x5a4/0x1720 [ 85.404119][ T6081] ? __pfx__copy_to_iter+0x10/0x10 [ 85.404144][ T6081] ? rcu_is_watching+0x13/0xc0 [ 85.404171][ T6081] ? __up_read+0x333/0x980 [ 85.404201][ T6081] copy_page_to_iter+0x285/0x370 [ 85.404228][ T6081] process_vm_rw_core.constprop.0+0x5a3/0x950 [ 85.404267][ T6081] ? __pfx_process_vm_rw_core.constprop.0+0x10/0x10 [ 85.404309][ T6081] ? iovec_from_user+0xda/0x140 [ 85.404334][ T6081] process_vm_rw+0x309/0x370 [ 85.404358][ T6081] ? __pfx_process_vm_rw+0x10/0x10 [ 85.404386][ T6081] ? find_held_lock+0x2b/0x80 [ 85.404412][ T6081] ? ksys_write+0x190/0x250 [ 85.404457][ T6081] ? xfd_validate_state+0x129/0x190 [ 85.404486][ T6081] __x64_sys_process_vm_readv+0xe2/0x1c0 [ 85.404508][ T6081] ? do_syscall_64+0xae/0x790 [ 85.404534][ T6081] ? lockdep_hardirqs_on+0x7d/0x110 [ 85.404560][ T6081] do_syscall_64+0x123/0x790 [ 85.404589][ T6081] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.404610][ T6081] RIP: 0033:0x7f6c27f9e159 [ 85.404628][ T6081] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 85.404647][ T6081] RSP: 002b:00007f6c28e0d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000136 [ 85.404668][ T6081] RAX: ffffffffffffffda RBX: 00007f6c28225fa0 RCX: 00007f6c27f9e159 [ 85.404682][ T6081] RDX: 0000000000000002 RSI: 0000200000008400 RDI: 0000000000000038 [ 85.404694][ T6081] RBP: 00007f6c2803503b R08: 0000000000000286 R09: 0000000000000000 [ 85.404707][ T6081] R10: 0000200000008640 R11: 0000000000000246 R12: 0000000000000000 [ 85.404720][ T6081] R13: 00007f6c28226038 R14: 00007f6c28225fa0 R15: 00007ffdcfb703c8 [ 85.404750][ T6081] [ 85.641204][ T6088] netlink: 24 bytes leftover after parsing attributes in process `syz.3.106'. [ 85.641258][ T6088] netlink: 48 bytes leftover after parsing attributes in process `syz.3.106'. [ 86.120802][ T6101] netlink: 20 bytes leftover after parsing attributes in process `syz.3.113'. [ 86.120852][ T6101] netlink: 24 bytes leftover after parsing attributes in process `syz.3.113'. [ 86.829815][ T6116] netlink: 28 bytes leftover after parsing attributes in process `syz.4.120'. [ 86.873640][ T6116] netlink: 28 bytes leftover after parsing attributes in process `syz.4.120'. [ 86.960612][ T6124] Zero length message leads to an empty skb [ 87.041244][ T30] kauditd_printk_skb: 24 callbacks suppressed [ 87.041262][ T30] audit: type=1400 audit(1789502046.483:281): avc: denied { read write } for pid=6128 comm="syz.0.125" name="fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 87.041485][ T30] audit: type=1400 audit(1789502046.483:282): avc: denied { open } for pid=6128 comm="syz.0.125" path="/dev/fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 87.119780][ T30] audit: type=1400 audit(1789502046.563:283): avc: denied { read write } for pid=6128 comm="syz.0.125" name="rdma_cm" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 87.119831][ T30] audit: type=1400 audit(1789502046.563:284): avc: denied { open } for pid=6128 comm="syz.0.125" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 87.257652][ T6136] netlink: 40 bytes leftover after parsing attributes in process `syz.4.128'. [ 87.316653][ T30] audit: type=1400 audit(1789502046.733:285): avc: denied { unmount } for pid=5600 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 88.271903][ T30] audit: type=1400 audit(1789502047.713:286): avc: denied { read write } for pid=6143 comm="syz.1.131" name="nullb0" dev="devtmpfs" ino=694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 88.271953][ T30] audit: type=1400 audit(1789502047.713:287): avc: denied { open } for pid=6143 comm="syz.1.131" path="/dev/nullb0" dev="devtmpfs" ino=694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 88.274511][ T30] audit: type=1400 audit(1789502047.713:288): avc: denied { map } for pid=6143 comm="syz.1.131" path="/dev/nullb0" dev="devtmpfs" ino=694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 88.274774][ T30] audit: type=1400 audit(1789502047.713:289): avc: denied { execute } for pid=6143 comm="syz.1.131" path="/dev/nullb0" dev="devtmpfs" ino=694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 88.276634][ T30] audit: type=1400 audit(1789502047.723:290): avc: denied { ioctl } for pid=6143 comm="syz.1.131" path="/dev/nullb0" dev="devtmpfs" ino=694 ioctlcmd=0x125f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 89.256705][ T5612] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 89.258211][ T5612] Bluetooth: hci3: Injecting HCI hardware error event [ 89.262817][ T5612] Bluetooth: hci3: hardware error 0x00 [ 90.362701][ T6180] FAULT_INJECTION: forcing a failure. [ 90.362701][ T6180] name failslab, interval 1, probability 0, space 0, times 0 [ 90.362735][ T6180] CPU: 1 UID: 0 PID: 6180 Comm: syz.0.143 Not tainted syzkaller #0 PREEMPT(full) [ 90.362761][ T6180] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 90.362774][ T6180] Call Trace: [ 90.362782][ T6180] [ 90.362790][ T6180] dump_stack_lvl+0x100/0x190 [ 90.362828][ T6180] should_fail_ex.cold+0x5/0xa [ 90.362862][ T6180] should_failslab+0xc2/0x120 [ 90.362888][ T6180] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 90.362913][ T6180] ? start_dirop+0x79/0xb0 [ 90.362938][ T6180] ? alloc_inode+0x68/0x250 [ 90.362960][ T6180] ? __pfx_debugfs_alloc_inode+0x10/0x10 [ 90.362991][ T6180] alloc_inode+0x68/0x250 [ 90.363011][ T6180] new_inode+0x22/0x1c0 [ 90.363033][ T6180] __debugfs_create_file+0xd8/0x4d0 [ 90.363067][ T6180] debugfs_create_file_full+0x41/0x60 [ 90.363100][ T6180] ref_tracker_dir_debugfs+0x19e/0x2e0 [ 90.363128][ T6180] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 90.363161][ T6180] ? stack_depot_init+0x17/0x80 [ 90.363208][ T6180] ? kasan_save_track+0x14/0x30 [ 90.363234][ T6180] ? __kasan_kmalloc+0xaa/0xb0 [ 90.363258][ T6180] ? lockdep_init_map_type+0x5c/0x250 [ 90.363288][ T6180] preinit_net+0x43b/0x920 [ 90.363316][ T6180] copy_net_ns+0x1dd/0x7a0 [ 90.363345][ T6180] create_new_namespaces+0x3ea/0xac0 [ 90.363377][ T6180] unshare_nsproxy_namespaces+0xf2/0x220 [ 90.363404][ T6180] ksys_unshare+0x4a2/0xa70 [ 90.363429][ T6180] ? __pfx_ksys_unshare+0x10/0x10 [ 90.363464][ T6180] __x64_sys_unshare+0x31/0x40 [ 90.363488][ T6180] do_syscall_64+0x123/0x790 [ 90.363518][ T6180] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.363540][ T6180] RIP: 0033:0x7febb479e159 [ 90.363558][ T6180] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 90.363576][ T6180] RSP: 002b:00007febb56c1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 90.363596][ T6180] RAX: ffffffffffffffda RBX: 00007febb4a25fa0 RCX: 00007febb479e159 [ 90.363609][ T6180] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000060040000 [ 90.363623][ T6180] RBP: 00007febb483503b R08: 0000000000000000 R09: 0000000000000000 [ 90.363636][ T6180] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 90.363649][ T6180] R13: 00007febb4a26038 R14: 00007febb4a25fa0 R15: 00007ffd6fa9a6d8 [ 90.363678][ T6180] [ 90.364978][ T6180] debugfs: out of free dentries, can not create file 'net_notrefcnt@ffff888078490338' [ 91.543312][ T5612] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 93.420013][ T6225] syz_tun: mtu less than device minimum [ 93.438001][ T30] audit: type=1400 audit(1789502052.863:291): avc: denied { ioctl } for pid=6219 comm="syz.0.155" path="socket:[9606]" dev="sockfs" ino=9606 ioctlcmd=0x8922 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 93.970937][ T30] audit: type=1400 audit(1789502053.413:292): avc: denied { write } for pid=6235 comm="syz.3.160" name="binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 94.017722][ T30] audit: type=1400 audit(1789502053.463:293): avc: denied { set_context_mgr } for pid=6235 comm="syz.3.160" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 94.024823][ T30] audit: type=1400 audit(1789502053.463:294): avc: denied { map } for pid=6235 comm="syz.3.160" path="/dev/binderfs/binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 94.033766][ T6240] binder: 6237:6240 ioctl c0306201 200000000080 returned -14 [ 94.043234][ T30] audit: type=1400 audit(1789502053.473:295): avc: denied { call } for pid=6237 comm="syz.1.159" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 94.043485][ T6240] binder_alloc: 6237: binder_alloc_buf, no vma [ 95.004477][ T30] audit: type=1400 audit(1789502054.443:296): avc: denied { read } for pid=6258 comm="syz.4.167" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 95.321845][ T6264] netlink: 20 bytes leftover after parsing attributes in process `syz.0.169'. [ 95.321894][ T6264] netlink: 24 bytes leftover after parsing attributes in process `syz.0.169'. [ 95.707476][ T30] audit: type=1400 audit(1789502055.153:297): avc: denied { ioctl } for pid=6266 comm="syz.1.170" path="socket:[10565]" dev="sockfs" ino=10565 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 95.710416][ T30] audit: type=1400 audit(1789502055.153:298): avc: denied { bind } for pid=6266 comm="syz.1.170" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 95.771437][ T30] audit: type=1400 audit(1789502055.213:299): avc: denied { write } for pid=6266 comm="syz.1.170" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 95.787952][ T30] audit: type=1400 audit(1789502055.223:300): avc: denied { read } for pid=6266 comm="syz.1.170" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 96.373655][ T6289] binder: 6285:6289 ioctl c0306201 200000000080 returned -14 [ 96.439326][ T6290] sctp: [Deprecated]: syz.3.177 (pid 6290) Use of int in max_burst socket option deprecated. [ 96.439326][ T6290] Use struct sctp_assoc_value instead [ 96.988698][ T6304] block nbd3: NBD_DISCONNECT [ 97.867648][ T6325] sctp: [Deprecated]: syz.1.191 (pid 6325) Use of int in max_burst socket option deprecated. [ 97.867648][ T6325] Use struct sctp_assoc_value instead [ 97.983071][ T6331] FAULT_INJECTION: forcing a failure. [ 97.983071][ T6331] name failslab, interval 1, probability 0, space 0, times 0 [ 97.983107][ T6331] CPU: 0 UID: 0 PID: 6331 Comm: syz.4.195 Not tainted syzkaller #0 PREEMPT(full) [ 97.983133][ T6331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 97.983146][ T6331] Call Trace: [ 97.983153][ T6331] [ 97.983161][ T6331] dump_stack_lvl+0x100/0x190 [ 97.983198][ T6331] should_fail_ex.cold+0x5/0xa [ 97.983228][ T6331] should_failslab+0xc2/0x120 [ 97.983255][ T6331] __kmalloc_noprof+0xfc/0x840 [ 97.983278][ T6331] ? sk_prot_alloc+0x10b/0x2a0 [ 97.983311][ T6331] sk_prot_alloc+0x10b/0x2a0 [ 97.983341][ T6331] sk_alloc+0x36/0xe80 [ 97.983366][ T6331] __netlink_create+0x5e/0x2c0 [ 97.983396][ T6331] ? __wake_up+0x3f/0x60 [ 97.983426][ T6331] netlink_create+0x29b/0x610 [ 97.983445][ T6331] ? __pfx_rtnetlink_bind+0x10/0x10 [ 97.983470][ T6331] __sock_create+0x339/0x860 [ 97.983507][ T6331] __sys_socket+0x14d/0x260 [ 97.983527][ T6331] ? __pfx___sys_socket+0x10/0x10 [ 97.983554][ T6331] __x64_sys_socket+0x72/0xb0 [ 97.983572][ T6331] ? lockdep_hardirqs_on+0x7d/0x110 [ 97.983608][ T6331] do_syscall_64+0x123/0x790 [ 97.983637][ T6331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.983656][ T6331] RIP: 0033:0x7fb24cf9e159 [ 97.983672][ T6331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 97.983690][ T6331] RSP: 002b:00007fb24dd83028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 97.983710][ T6331] RAX: ffffffffffffffda RBX: 00007fb24d225fa0 RCX: 00007fb24cf9e159 [ 97.983723][ T6331] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000010 [ 97.983736][ T6331] RBP: 00007fb24d03503b R08: 0000000000000000 R09: 0000000000000000 [ 97.983748][ T6331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 97.983761][ T6331] R13: 00007fb24d226038 R14: 00007fb24d225fa0 R15: 00007ffeda07c0c8 [ 97.983790][ T6331] [ 98.040529][ T6332] binder: 6326:6332 ioctl c0306201 200000000080 returned -14 [ 98.401252][ T6339] ======================================================= [ 98.401252][ T6339] WARNING: The mand mount option has been deprecated and [ 98.401252][ T6339] and is ignored by this kernel. Remove the mand [ 98.401252][ T6339] option from the mount to silence this warning. [ 98.401252][ T6339] ======================================================= [ 98.462377][ T30] kauditd_printk_skb: 15 callbacks suppressed [ 98.462396][ T30] audit: type=1400 audit(1789502057.903:316): avc: denied { mount } for pid=6338 comm="syz.0.198" name="/" dev="overlay" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 98.885234][ T30] audit: type=1400 audit(1789502058.323:317): avc: denied { mmap_zero } for pid=6348 comm="syz.0.202" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 98.931915][ T6357] netlink: 4 bytes leftover after parsing attributes in process `syz.4.206'. [ 99.828005][ T30] audit: type=1400 audit(1789502059.163:318): avc: denied { create } for pid=6361 comm="syz.3.209" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 99.828204][ T30] audit: type=1400 audit(1789502059.173:319): avc: denied { create } for pid=6361 comm="syz.3.209" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 99.828342][ T30] audit: type=1400 audit(1789502059.173:320): avc: denied { write } for pid=6361 comm="syz.3.209" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 99.828464][ T30] audit: type=1400 audit(1789502059.173:321): avc: denied { read } for pid=6361 comm="syz.3.209" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 100.125293][ T30] audit: type=1400 audit(1789502059.573:322): avc: denied { mount } for pid=6373 comm="syz.4.212" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 100.522954][ T6376] ucsi_ccg 0-0008: ucsi_ccg_init failed - -110 [ 100.523130][ T6376] ucsi_ccg 0-0008: probe with driver ucsi_ccg failed with error -110 [ 100.523360][ T6376] i2c i2c-0: new_device: Instantiated device ccgx-ucsi at 0x08 [ 100.588040][ T30] audit: type=1400 audit(1789502060.033:323): avc: denied { name_connect } for pid=6382 comm="syz.3.215" dest=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 101.014698][ T6396] binder: 6391:6396 ioctl c0306201 200000000080 returned -14 [ 101.161415][ T6398] netlink: 9 bytes leftover after parsing attributes in process `syz.2.218'. [ 101.163461][ T30] audit: type=1400 audit(1789502060.583:324): avc: denied { create } for pid=6386 comm="syz.2.218" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 101.163746][ T30] audit: type=1400 audit(1789502060.593:325): avc: denied { write } for pid=6386 comm="syz.2.218" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 101.298360][ T6398] netlink: 9 bytes leftover after parsing attributes in process `syz.2.218'. [ 101.954603][ T6406] tipc: Started in network mode [ 101.954627][ T6406] tipc: Node identity fa638b035606, cluster identity 4711 [ 101.954843][ T6406] tipc: Enabled bearer , priority 0 [ 101.983897][ T6406] tipc: Resetting bearer [ 102.492976][ T6403] tipc: Disabling bearer [ 102.876364][ T25] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 102.974065][ T6430] binder: 6424:6430 ioctl c0306201 200000000080 returned -14 [ 103.011446][ T6429] l2tp_ppp: sess 2/0: no socket in recv [ 103.031348][ T6430] binder: 6424:6430 ioctl 4018620d 0 returned -22 [ 103.148691][ T25] usb 2-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice= 1.00 [ 103.159443][ T25] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 103.161586][ T25] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 103.161605][ T25] usb 2-1: Product: syz [ 103.161619][ T25] usb 2-1: Manufacturer: syz [ 103.353126][ T25] usb 2-1: selecting invalid altsetting 1 [ 103.383913][ T25] dvb_ttusb_budget: ttusb_init_controller: error [ 103.384047][ T25] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 103.591819][ T25] DVB: Unable to find symbol cx22700_attach() [ 103.648020][ T25] DVB: Unable to find symbol tda10046_attach() [ 103.648029][ T25] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 103.701874][ T25] usb 2-1: USB disconnect, device number 2 [ 103.902500][ T6447] tipc: Enabled bearer , priority 0 [ 103.934207][ T6447] tipc: Resetting bearer [ 103.962745][ T6446] tipc: Disabling bearer [ 103.988375][ T30] kauditd_printk_skb: 4 callbacks suppressed [ 103.988386][ T30] audit: type=1400 audit(1789502063.433:330): avc: denied { getopt } for pid=6450 comm="syz.3.242" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 104.224707][ T30] audit: type=1400 audit(1789502063.663:331): avc: denied { prog_load } for pid=6454 comm="syz.4.244" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 104.603973][ T30] audit: type=1400 audit(1789502064.023:332): avc: denied { mount } for pid=6457 comm="syz.1.245" name="/" dev="securityfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 104.843476][ T30] audit: type=1400 audit(1789502064.283:333): avc: denied { unmount } for pid=5601 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 104.976672][ T30] audit: type=1400 audit(1789502064.423:334): avc: denied { name_bind } for pid=6463 comm="syz.2.247" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 105.038498][ T30] audit: type=1400 audit(1789502064.483:335): avc: denied { create } for pid=6464 comm="syz.1.248" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 105.060689][ T30] audit: type=1400 audit(1789502064.493:336): avc: denied { write } for pid=6464 comm="syz.1.248" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 105.144080][ T6469] netlink: 'syz.0.249': attribute type 4 has an invalid length. [ 105.144100][ T6469] netlink: 156 bytes leftover after parsing attributes in process `syz.0.249'. [ 105.354144][ T6477] binder: 6472:6477 ioctl c0306201 200000000080 returned -14 [ 105.369907][ T6477] binder: 6472:6477 ioctl 4018620d 0 returned -22 [ 105.575071][ C0] net_ratelimit: 166 callbacks suppressed [ 105.725291][ T1868] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 105.875948][ T1868] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 105.877249][ T1868] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 105.877277][ T1868] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 105.877345][ T1868] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.906798][ T1868] usb 4-1: config 0 descriptor?? [ 106.618292][ T5612] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 106.619972][ T5612] Bluetooth: hci4: Injecting HCI hardware error event [ 106.647898][ T5608] Bluetooth: hci4: hardware error 0x00 [ 107.093002][ T1868] usbhid 4-1:0.0: can't add hid device: -71 [ 107.093419][ T1868] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 107.099188][ T1868] usb 4-1: USB disconnect, device number 2 [ 107.715948][ T30] audit: type=1400 audit(1789502067.133:337): avc: denied { map_create } for pid=6498 comm="syz.4.260" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 107.824132][ T30] audit: type=1400 audit(1789502067.263:338): avc: denied { bind } for pid=6498 comm="syz.4.260" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 108.551502][ T6518] syzkaller0: entered promiscuous mode [ 108.551519][ T6518] syzkaller0: entered allmulticast mode [ 108.584083][ T6518] tipc: Enabling of bearer rejected, failed to enable media [ 109.738132][ T5608] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 109.936286][ T30] audit: type=1400 audit(1789502069.373:339): avc: denied { map_read map_write } for pid=6498 comm="syz.4.260" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 110.615083][ C1] net_ratelimit: 64 callbacks suppressed [ 111.177423][ T6536] binder: 6530:6536 ioctl c0306201 200000000080 returned -14 [ 111.244778][ T6536] binder: 6530:6536 ioctl 4018620d 0 returned -22 [ 111.277192][ T30] audit: type=1400 audit(1789502070.723:340): avc: denied { read } for pid=6538 comm="syz.3.273" name="g1" dev="configfs" ino=10647 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 111.277243][ T30] audit: type=1400 audit(1789502070.723:341): avc: denied { read open } for pid=6538 comm="syz.3.273" path="/48/config/usb_gadget/g1" dev="configfs" ino=10647 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 111.296202][ T30] audit: type=1400 audit(1789502070.733:342): avc: denied { write } for pid=6538 comm="syz.3.273" name="g1" dev="configfs" ino=10647 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 111.310774][ T30] audit: type=1400 audit(1789502070.753:343): avc: denied { create } for pid=6538 comm="syz.3.273" name="ffs" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=lnk_file permissive=1 [ 111.683682][ T30] audit: type=1400 audit(1789502071.123:344): avc: denied { prog_run } for pid=6541 comm="syz.4.274" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 114.978198][ T30] audit: type=1400 audit(1789502074.423:345): avc: denied { create } for pid=6585 comm="syz.2.288" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 115.022904][ T30] audit: type=1400 audit(1789502074.463:346): avc: denied { bind } for pid=6585 comm="syz.2.288" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 115.106790][ T30] audit: type=1400 audit(1789502074.553:347): avc: denied { listen } for pid=6585 comm="syz.2.288" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 115.109446][ T30] audit: type=1400 audit(1789502074.553:348): avc: denied { write } for pid=6585 comm="syz.2.288" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 115.288632][ T6599] binder: 6597:6599 ioctl c0306201 200000000080 returned -14 [ 115.292508][ T6599] binder: 6597:6599 ioctl c0306201 0 returned -14 [ 115.895170][ T5719] net_ratelimit: 76 callbacks suppressed [ 117.456723][ T30] audit: type=1400 audit(1789502076.903:349): avc: denied { read write } for pid=6626 comm="syz.1.302" name="control" dev="devtmpfs" ino=1266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 117.457066][ T30] audit: type=1400 audit(1789502076.903:350): avc: denied { open } for pid=6626 comm="syz.1.302" path="/63/dev/mapper/control" dev="devtmpfs" ino=1266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 117.457745][ T30] audit: type=1400 audit(1789502076.903:351): avc: denied { ioctl } for pid=6626 comm="syz.1.302" path="/63/dev/mapper/control" dev="devtmpfs" ino=1266 ioctlcmd=0xfd09 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 119.562973][ T30] audit: type=1400 audit(1789502079.003:352): avc: denied { ioctl } for pid=6651 comm="syz.3.311" path="socket:[12330]" dev="sockfs" ino=12330 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 119.588098][ T6653] binder: 6645:6653 ioctl c0306201 200000000080 returned -14 [ 119.785934][ T6655] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=io+mem:owns=io+mem [ 119.872295][ T6653] binder: 6645:6653 ioctl c0306201 0 returned -14 [ 120.324381][ T30] audit: type=1400 audit(1789502079.763:353): avc: denied { setopt } for pid=6660 comm="syz.3.313" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 120.394939][ T6662] pim6reg: entered allmulticast mode [ 120.516238][ T6666] netlink: 32 bytes leftover after parsing attributes in process `syz.1.315'. [ 120.586667][ T30] audit: type=1400 audit(1789502080.033:354): avc: denied { relabelfrom } for pid=6667 comm="syz.2.316" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 120.595085][ T30] audit: type=1400 audit(1789502080.033:355): avc: denied { relabelto } for pid=6667 comm="syz.2.316" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 120.935048][ C1] net_ratelimit: 53 callbacks suppressed [ 121.254720][ T6668] syzkaller0: entered promiscuous mode [ 121.254740][ T6668] syzkaller0: entered allmulticast mode [ 123.090924][ T6699] binder: 6697:6699 ioctl c0306201 200000000080 returned -14 [ 123.142005][ T6699] binder: 6697:6699 ioctl c0306201 0 returned -14 [ 124.337954][ T6716] Bluetooth: MGMT ver 1.23 [ 125.975043][ C1] net_ratelimit: 65 callbacks suppressed [ 126.975259][ T6737] binder: 6734:6737 ioctl c0306201 200000000080 returned -14 [ 126.992843][ T6738] netlink: 24 bytes leftover after parsing attributes in process `syz.1.340'. [ 127.375838][ T30] audit: type=1400 audit(1789502086.823:356): avc: denied { listen } for pid=6742 comm="syz.4.342" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 127.498873][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 [ 127.498919][ T1307] ieee802154 phy1 wpan1: encryption failed: -22 [ 127.754356][ T6750] tmpfs: Bad value for 'nr_inodes' [ 127.872941][ T6753] FAULT_INJECTION: forcing a failure. [ 127.872941][ T6753] name failslab, interval 1, probability 0, space 0, times 0 [ 127.872972][ T6753] CPU: 0 UID: 0 PID: 6753 Comm: syz.3.346 Not tainted syzkaller #0 PREEMPT(full) [ 127.872998][ T6753] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 127.873012][ T6753] Call Trace: [ 127.873019][ T6753] [ 127.873029][ T6753] dump_stack_lvl+0x100/0x190 [ 127.873067][ T6753] should_fail_ex.cold+0x5/0xa [ 127.873099][ T6753] should_failslab+0xc2/0x120 [ 127.873125][ T6753] __kmalloc_node_noprof+0xff/0x880 [ 127.873148][ T6753] ? lockdep_init_map_type+0x5c/0x250 [ 127.873168][ T6753] ? blk_mq_alloc_tag_set+0x477/0x1330 [ 127.873199][ T6753] blk_mq_alloc_tag_set+0x477/0x1330 [ 127.873220][ T6753] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 127.873249][ T6753] ? idr_alloc+0xdd/0x130 [ 127.873275][ T6753] ? __pfx_idr_alloc+0x10/0x10 [ 127.873308][ T6753] loop_add+0x3b7/0xb60 [ 127.873338][ T6753] ? __pfx_loop_add+0x10/0x10 [ 127.873379][ T6753] ? __fget_files+0x34/0x3d0 [ 127.873409][ T6753] loop_control_ioctl+0xae/0x620 [ 127.873429][ T6753] ? __pfx_loop_control_ioctl+0x10/0x10 [ 127.873448][ T6753] ? selinux_file_ioctl+0x13b/0x290 [ 127.873467][ T6753] ? selinux_file_ioctl+0xb6/0x290 [ 127.873488][ T6753] ? __pfx_loop_control_ioctl+0x10/0x10 [ 127.873509][ T6753] __x64_sys_ioctl+0x18e/0x210 [ 127.873531][ T6753] do_syscall_64+0x123/0x790 [ 127.873558][ T6753] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.873580][ T6753] RIP: 0033:0x7ff13cf9e159 [ 127.873615][ T6753] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 127.873636][ T6753] RSP: 002b:00007ff13de41028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 127.873658][ T6753] RAX: ffffffffffffffda RBX: 00007ff13d225fa0 RCX: 00007ff13cf9e159 [ 127.873673][ T6753] RDX: 00000000ffffffe4 RSI: 0000000000004c80 RDI: 0000000000000004 [ 127.873687][ T6753] RBP: 00007ff13d03503b R08: 0000000000000000 R09: 0000000000000000 [ 127.873701][ T6753] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 127.873714][ T6753] R13: 00007ff13d226038 R14: 00007ff13d225fa0 R15: 00007fff29ad7db8 [ 127.873742][ T6753] [ 129.219258][ T6770] netlink: 24 bytes leftover after parsing attributes in process `syz.4.351'. [ 130.445462][ T6745] mac80211_hwsim hwsim3 syzkaller0: entered promiscuous mode [ 130.445488][ T6745] mac80211_hwsim hwsim3 syzkaller0: entered allmulticast mode [ 130.794895][ T6792] binder: 6787:6792 ioctl c0306201 200000000080 returned -14 [ 131.076812][ T6798] net_ratelimit: 82 callbacks suppressed [ 131.841145][ T30] audit: type=1400 audit(1789502091.283:357): avc: denied { write } for pid=6795 comm="syz.0.361" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 132.104394][ T6811] tmpfs: Bad value for 'nr_inodes' [ 133.133856][ T30] audit: type=1400 audit(1789502092.573:358): avc: denied { connect } for pid=6828 comm="syz.3.371" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 133.454102][ T6832] syzkaller0: entered promiscuous mode [ 133.454118][ T6832] syzkaller0: entered allmulticast mode [ 133.471681][ T6832] tipc: Started in network mode [ 133.471711][ T6832] tipc: Node identity 267859fd1e2a, cluster identity 4711 [ 133.471869][ T6832] tipc: Enabled bearer , priority 0 [ 133.481238][ T6831] tipc: Resetting bearer [ 133.574027][ T30] audit: type=1400 audit(1789502093.013:359): avc: denied { allowed } for pid=6839 comm="syz.3.374" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 133.599310][ T6831] tipc: Disabling bearer [ 133.613717][ T30] audit: type=1400 audit(1789502093.053:360): avc: denied { read } for pid=6839 comm="syz.3.374" name="iommu" dev="devtmpfs" ino=624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 133.613764][ T30] audit: type=1400 audit(1789502093.053:361): avc: denied { open } for pid=6839 comm="syz.3.374" path="/dev/iommu" dev="devtmpfs" ino=624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 133.627997][ T30] audit: type=1400 audit(1789502093.063:362): avc: denied { ioctl } for pid=6839 comm="syz.3.374" path="/dev/iommu" dev="devtmpfs" ino=624 ioctlcmd=0x3b85 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 133.634027][ T30] audit: type=1400 audit(1789502093.063:363): avc: denied { cmd } for pid=6839 comm="syz.3.374" path="socket:[12615]" dev="sockfs" ino=12615 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 133.828104][ T30] audit: type=1400 audit(1789502093.273:364): avc: denied { sqpoll } for pid=6837 comm="syz.1.375" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 133.925670][ T6846] binder: 6843:6846 ioctl c0306201 200000000080 returned -14 [ 133.976764][ T6850] tmpfs: Bad value for 'nr_inodes' [ 135.311918][ T30] audit: type=1400 audit(1789502094.753:365): avc: denied { setopt } for pid=6862 comm="syz.1.383" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 135.996220][ T6878] tipc: Started in network mode [ 135.996245][ T6878] tipc: Node identity 080211000001, cluster identity 4711 [ 135.996381][ T6878] tipc: Enabled bearer , priority 0 [ 136.203904][ T6881] net_ratelimit: 164 callbacks suppressed [ 136.226704][ T6883] tmpfs: Bad value for 'nr_inodes' [ 136.862716][ T6891] netlink: 4 bytes leftover after parsing attributes in process `syz.3.393'. [ 136.862803][ T6891] bridge_slave_1: left allmulticast mode [ 136.862824][ T6891] bridge_slave_1: left promiscuous mode [ 136.865762][ T6891] bridge0: port 2(bridge_slave_1) entered disabled state [ 136.942045][ T6891] bridge_slave_0: left allmulticast mode [ 136.942066][ T6891] bridge_slave_0: left promiscuous mode [ 136.943352][ T6891] bridge0: port 1(bridge_slave_0) entered disabled state [ 137.161365][ T5602] tipc: Node number set to 134418688 [ 138.760372][ T6917] netlink: 20 bytes leftover after parsing attributes in process `syz.4.404'. [ 139.136111][ T30] audit: type=1400 audit(1789502098.563:366): avc: denied { connect } for pid=6918 comm="syz.2.402" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 139.243885][ T30] audit: type=1400 audit(1789502098.663:367): avc: denied { mounton } for pid=6918 comm="syz.2.402" path="/85/file0" dev="tmpfs" ino=456 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 140.046745][ T6924] tipc: Enabling of bearer rejected, already enabled [ 140.402493][ T6935] tmpfs: Bad value for 'nr_inodes' [ 141.014749][ T6961] netlink: 72 bytes leftover after parsing attributes in process `syz.3.409'. [ 141.014773][ T6961] netlink: 8 bytes leftover after parsing attributes in process `syz.3.409'. [ 141.520634][ T5725] net_ratelimit: 73 callbacks suppressed [ 142.001072][ T30] audit: type=1400 audit(1789502101.443:368): avc: denied { watch } for pid=6973 comm="syz.1.417" path="/88/file0" dev="tmpfs" ino=481 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 142.001322][ T30] audit: type=1400 audit(1789502101.443:369): avc: denied { watch_sb } for pid=6973 comm="syz.1.417" path="/88/file0" dev="tmpfs" ino=481 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 142.121749][ T6978] syzkaller0: entered promiscuous mode [ 142.121764][ T6978] syzkaller0: entered allmulticast mode [ 142.140958][ T6978] tipc: Enabled bearer , priority 0 [ 142.154721][ T6977] tipc: Resetting bearer [ 142.204362][ T6977] tipc: Disabling bearer [ 142.211821][ T6981] syzkaller0: entered promiscuous mode [ 142.211838][ T6981] syzkaller0: entered allmulticast mode [ 142.398469][ T6983] tmpfs: Bad value for 'nr_inodes' [ 142.521485][ T6994] tipc: Enabling of bearer rejected, failed to enable media [ 142.892636][ T7003] netlink: 12 bytes leftover after parsing attributes in process `syz.4.424'. [ 142.949354][ T30] audit: type=1400 audit(1789502102.393:370): avc: denied { create } for pid=7001 comm="syz.4.424" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 142.953700][ T30] audit: type=1400 audit(1789502102.393:371): avc: denied { write } for pid=7001 comm="syz.4.424" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 142.992837][ T7003] 8021q: adding VLAN 0 to HW filter on device bond1 [ 143.068818][ T7003] bond1 (unregistering): Released all slaves [ 143.928363][ T7025] FAULT_INJECTION: forcing a failure. [ 143.928363][ T7025] name fail_futex, interval 1, probability 0, space 0, times 1 [ 143.928393][ T7025] CPU: 0 UID: 0 PID: 7025 Comm: syz.2.429 Not tainted syzkaller #0 PREEMPT(full) [ 143.928418][ T7025] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 143.928430][ T7025] Call Trace: [ 143.928438][ T7025] [ 143.928447][ T7025] dump_stack_lvl+0x100/0x190 [ 143.928487][ T7025] should_fail_ex.cold+0x5/0xa [ 143.928521][ T7025] get_futex_key+0x1d0/0x14f0 [ 143.928552][ T7025] ? __pfx_get_futex_key+0x10/0x10 [ 143.928582][ T7025] futex_wait_setup+0x91/0x540 [ 143.928607][ T7025] __futex_wait+0x19f/0x300 [ 143.928630][ T7025] ? __pfx___futex_wait+0x10/0x10 [ 143.928658][ T7025] ? __pfx_try_to_wake_up+0x10/0x10 [ 143.928682][ T7025] ? futex_hash+0x311/0x400 [ 143.928708][ T7025] ? __pfx_futex_wake_mark+0x10/0x10 [ 143.928741][ T7025] ? find_held_lock+0x2b/0x80 [ 143.928768][ T7025] ? futex_wake+0x4ea/0x5e0 [ 143.928803][ T7025] futex_wait+0xe6/0x370 [ 143.928822][ T7025] ? __pfx_futex_wait+0x10/0x10 [ 143.928849][ T7025] ? rcu_read_lock_any_held+0x6a/0x90 [ 143.928877][ T7025] ? find_held_lock+0x2b/0x80 [ 143.928903][ T7025] ? ksys_write+0x190/0x250 [ 143.928923][ T7025] ? ksys_write+0x190/0x250 [ 143.928946][ T7025] do_futex+0x265/0x440 [ 143.928972][ T7025] ? __pfx_do_futex+0x10/0x10 [ 143.928999][ T7025] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 143.929031][ T7025] __x64_sys_futex+0x34f/0x4d0 [ 143.929056][ T7025] ? fput+0x7c/0x100 [ 143.929080][ T7025] ? __pfx___x64_sys_futex+0x10/0x10 [ 143.929106][ T7025] ? ksys_write+0x1ac/0x250 [ 143.929127][ T7025] ? __pfx_ksys_write+0x10/0x10 [ 143.929155][ T7025] do_syscall_64+0x123/0x790 [ 143.929183][ T7025] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 143.929207][ T7025] RIP: 0033:0x7f6c27f9e159 [ 143.929227][ T7025] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 143.929248][ T7025] RSP: 002b:00007f6c28e0d0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 143.929269][ T7025] RAX: ffffffffffffffda RBX: 00007f6c28225fa8 RCX: 00007f6c27f9e159 [ 143.929283][ T7025] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f6c28225fa8 [ 143.929296][ T7025] RBP: 00007f6c28225fa0 R08: 0000000000000000 R09: 0000000000000000 [ 143.929310][ T7025] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 143.929323][ T7025] R13: 00007f6c28226038 R14: 00007ffdcfb702e0 R15: 00007ffdcfb703c8 [ 143.929353][ T7025] [ 143.982312][ T7027] tipc: Enabling of bearer rejected, already enabled [ 144.226075][ T7029] tmpfs: Bad value for 'nr_inodes' [ 144.520926][ T30] audit: type=1400 audit(1789502103.963:372): avc: denied { create } for pid=7036 comm="syz.3.435" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 144.656681][ T30] audit: type=1400 audit(1789502104.103:373): avc: denied { watch } for pid=7044 comm="syz.3.437" path="/91" dev="tmpfs" ino=485 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 144.708580][ T7039] tipc: Enabled bearer , priority 0 [ 144.723192][ T7039] tipc: Resetting bearer [ 144.743649][ T7038] tipc: Disabling bearer [ 145.851466][ T7058] tipc: Enabled bearer , priority 0 [ 145.900401][ T7056] tipc: Disabling bearer [ 146.079257][ T30] audit: type=1400 audit(1789502105.463:374): avc: denied { write } for pid=7068 comm="syz.1.446" name="001" dev="devtmpfs" ino=741 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 146.206498][ T7076] netlink: 44 bytes leftover after parsing attributes in process `syz.1.446'. [ 146.239195][ T7075] hub 8-0:1.0: USB hub found [ 146.240503][ T7075] hub 8-0:1.0: 1 port detected [ 146.655508][ T7084] binder: 7078:7084 ioctl c0306201 200000000080 returned -14 [ 146.675141][ T7084] binder: 7078:7084 ioctl c0306201 0 returned -14 [ 146.695071][ C0] net_ratelimit: 89 callbacks suppressed [ 147.046058][ T7094] netlink: 24 bytes leftover after parsing attributes in process `syz.3.453'. [ 149.157545][ T30] audit: type=1400 audit(1789502108.463:375): avc: denied { read } for pid=7115 comm="syz.3.462" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 149.461595][ T7124] tipc: Enabled bearer , priority 0 [ 149.563495][ T7116] tipc: Disabling bearer [ 149.624565][ T7135] netlink: 24 bytes leftover after parsing attributes in process `syz.1.467'. [ 149.981867][ T7146] netlink: 52 bytes leftover after parsing attributes in process `syz.1.471'. [ 150.006444][ T30] audit: type=1400 audit(1789502109.453:376): avc: denied { read } for pid=7139 comm="syz.0.469" name="file0" dev="fuse" ino=70368744177670 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 150.006761][ T30] audit: type=1400 audit(1789502109.453:377): avc: denied { open } for pid=7139 comm="syz.0.469" path="/78/file0/file0" dev="fuse" ino=70368744177670 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 150.056579][ T7149] binder: 7143:7149 ioctl c0306201 200000000080 returned -14 [ 150.078709][ T7149] binder: 7143:7149 ioctl c0306201 0 returned -14 [ 150.950369][ T7163] Driver unsupported XDP return value 0 on prog (id 22) dev N/A, expect packet loss! [ 151.239641][ T7175] netlink: 24 bytes leftover after parsing attributes in process `syz.0.481'. [ 151.299581][ T7173] syzkaller0: entered promiscuous mode [ 151.299597][ T7173] syzkaller0: entered allmulticast mode [ 151.304095][ T7173] tipc: Started in network mode [ 151.304120][ T7173] tipc: Node identity 22d345bc7f46, cluster identity 4711 [ 151.304302][ T7173] tipc: Enabled bearer , priority 0 [ 151.398262][ T7168] tipc: Resetting bearer [ 151.480086][ T7168] tipc: Disabling bearer [ 151.975185][ C0] net_ratelimit: 71 callbacks suppressed [ 152.796892][ T7196] hub 8-0:1.0: USB hub found [ 152.797153][ T7196] hub 8-0:1.0: 1 port detected [ 152.998447][ T7203] binder: 7198:7203 ioctl c0306201 200000000080 returned -14 [ 153.025310][ T7207] netlink: 24 bytes leftover after parsing attributes in process `syz.4.495'. [ 153.164709][ T7209] binder: 7198:7209 ioctl c0306201 0 returned -14 [ 153.450781][ T7216] netlink: 8 bytes leftover after parsing attributes in process `syz.3.498'. [ 154.442869][ T7226] tipc: Enabled bearer , priority 0 [ 154.457695][ T7225] tipc: Disabling bearer [ 156.221002][ T7274] bond0: option arp_interval: invalid value ( ) [ 156.221027][ T7274] bond0: option arp_interval: allowed values 0 - 2147483647 [ 156.344516][ T7271] syzkaller0: entered promiscuous mode [ 156.344533][ T7271] syzkaller0: entered allmulticast mode [ 156.408338][ T7271] tipc: Enabled bearer , priority 0 [ 156.582905][ T7270] tipc: Resetting bearer [ 156.758937][ T7270] tipc: Disabling bearer [ 157.015536][ C1] net_ratelimit: 61 callbacks suppressed [ 157.582506][ T7301] ip_tables: iptables: counters copy to user failed while replacing table [ 157.656557][ T7305] netlink: 24 bytes leftover after parsing attributes in process `syz.2.533'. [ 157.804210][ T7303] bond0: option arp_interval: invalid value ( ) [ 157.804232][ T7303] bond0: option arp_interval: allowed values 0 - 2147483647 [ 158.183780][ T30] audit: type=1400 audit(1789502117.623:378): avc: denied { getattr } for pid=7315 comm="syz.4.538" path="pid:[4026532782]" dev="nsfs" ino=4026532782 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 158.194324][ T7317] netlink: 1092 bytes leftover after parsing attributes in process `syz.4.538'. [ 158.234067][ T7318] FAULT_INJECTION: forcing a failure. [ 158.234067][ T7318] name fail_futex, interval 1, probability 0, space 0, times 0 [ 158.234107][ T7318] CPU: 0 UID: 0 PID: 7318 Comm: syz.2.535 Not tainted syzkaller #0 PREEMPT(full) [ 158.234132][ T7318] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 158.234145][ T7318] Call Trace: [ 158.234153][ T7318] [ 158.234161][ T7318] dump_stack_lvl+0x100/0x190 [ 158.234198][ T7318] should_fail_ex.cold+0x5/0xa [ 158.234230][ T7318] get_futex_key+0x293/0x14f0 [ 158.234260][ T7318] ? __pfx_get_futex_key+0x10/0x10 [ 158.234285][ T7318] ? find_held_lock+0x2b/0x80 [ 158.234312][ T7318] ? futex_wake+0x4ea/0x5e0 [ 158.234349][ T7318] futex_wake+0xf4/0x5e0 [ 158.234378][ T7318] ? futex_wait+0x11e/0x370 [ 158.234401][ T7318] ? __pfx_futex_wake+0x10/0x10 [ 158.234436][ T7318] ? rcu_read_lock_any_held+0x6a/0x90 [ 158.234464][ T7318] ? find_held_lock+0x2b/0x80 [ 158.234490][ T7318] ? ksys_write+0x190/0x250 [ 158.234512][ T7318] ? ksys_write+0x190/0x250 [ 158.234535][ T7318] do_futex+0x2b2/0x440 [ 158.234563][ T7318] ? __pfx_do_futex+0x10/0x10 [ 158.234597][ T7318] __x64_sys_futex+0x34f/0x4d0 [ 158.234627][ T7318] ? __pfx___x64_sys_futex+0x10/0x10 [ 158.234665][ T7318] do_syscall_64+0x123/0x790 [ 158.234696][ T7318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.234720][ T7318] RIP: 0033:0x7f6c27f9e159 [ 158.234739][ T7318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 158.234757][ T7318] RSP: 002b:00007f6c28dec028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 158.234779][ T7318] RAX: ffffffffffffffda RBX: 00007f6c28226090 RCX: 00007f6c27f9e159 [ 158.234794][ T7318] RDX: 00000000000000cb RSI: 0000000000000601 RDI: 0000000000000000 [ 158.234808][ T7318] RBP: 00007f6c2803503b R08: 9999999999999999 R09: 000000000000000e [ 158.234822][ T7318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 158.234835][ T7318] R13: 00007f6c28226128 R14: 00007f6c28226090 R15: 00007ffdcfb703c8 [ 158.234864][ T7318] [ 158.692481][ T7334] netlink: 24 bytes leftover after parsing attributes in process `syz.4.545'. [ 159.215291][ T7343] syzkaller0: entered promiscuous mode [ 159.215307][ T7343] syzkaller0: entered allmulticast mode [ 159.667489][ T7354] netlink: 44 bytes leftover after parsing attributes in process `syz.4.553'. [ 159.806551][ T7360] netlink: 4 bytes leftover after parsing attributes in process `syz.4.558'. [ 160.024303][ T7366] netlink: 4 bytes leftover after parsing attributes in process `syz.2.559'. [ 160.024325][ T7366] netlink: 8 bytes leftover after parsing attributes in process `syz.2.559'. [ 160.247723][ T7369] syzkaller0: entered promiscuous mode [ 160.247743][ T7369] syzkaller0: entered allmulticast mode [ 160.270343][ T7374] netlink: 16 bytes leftover after parsing attributes in process `syz.4.563'. [ 160.503221][ T30] audit: type=1400 audit(1789502119.943:379): avc: denied { read write } for pid=7379 comm="syz.2.567" name="vhost-vsock" dev="devtmpfs" ino=1272 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 160.503273][ T30] audit: type=1400 audit(1789502119.943:380): avc: denied { open } for pid=7379 comm="syz.2.567" path="/dev/vhost-vsock" dev="devtmpfs" ino=1272 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 161.751977][ T7393] netlink: 9 bytes leftover after parsing attributes in process `syz.2.567'. [ 161.774339][ T7393] netlink: 9 bytes leftover after parsing attributes in process `syz.2.567'. [ 162.099223][ T7397] net_ratelimit: 88 callbacks suppressed [ 162.728109][ T7414] tipc: Enabling of bearer rejected, failed to enable media [ 163.187857][ T7430] __nla_validate_parse: 1 callbacks suppressed [ 163.187871][ T7430] netlink: 12 bytes leftover after parsing attributes in process `syz.0.581'. [ 163.265465][ T7433] binder: BINDER_SET_CONTEXT_MGR already set [ 163.265477][ T7433] binder: 7432:7433 ioctl 4018620d 200000004a80 returned -16 [ 163.486094][ T30] audit: type=1400 audit(1789502122.923:381): avc: denied { create } for pid=7434 comm="syz.0.584" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 163.518937][ T30] audit: type=1400 audit(1789502122.963:382): avc: denied { ioctl } for pid=7434 comm="syz.0.584" path="socket:[14438]" dev="sockfs" ino=14438 ioctlcmd=0x89e7 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 163.554712][ T30] audit: type=1400 audit(1789502122.993:383): avc: denied { bind } for pid=7434 comm="syz.0.584" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 163.575428][ T30] audit: type=1400 audit(1789502123.023:384): avc: denied { listen } for pid=7434 comm="syz.0.584" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 163.690296][ T7448] netlink: 9 bytes leftover after parsing attributes in process `syz.2.585'. [ 163.759144][ T7448] netlink: 9 bytes leftover after parsing attributes in process `syz.2.585'. [ 163.845972][ T30] audit: type=1804 audit(1789502123.283:385): pid=7449 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz.3.589" name="/newroot/123/tracing/per_cpu/cpu0/trace_pipe_raw" dev="tracefs" ino=3620 res=1 errno=0 [ 164.072066][ T7452] FAULT_INJECTION: forcing a failure. [ 164.072066][ T7452] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 164.072100][ T7452] CPU: 1 UID: 0 PID: 7452 Comm: syz.1.590 Not tainted syzkaller #0 PREEMPT(full) [ 164.072125][ T7452] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 164.072139][ T7452] Call Trace: [ 164.072147][ T7452] [ 164.072157][ T7452] dump_stack_lvl+0x100/0x190 [ 164.072195][ T7452] should_fail_ex.cold+0x5/0xa [ 164.072226][ T7452] _copy_to_user+0x32/0xd0 [ 164.072251][ T7452] dma_heap_ioctl+0x458/0x6d0 [ 164.072288][ T7452] ? __pfx_dma_heap_ioctl+0x10/0x10 [ 164.072322][ T7452] ? selinux_file_ioctl+0x13b/0x290 [ 164.072348][ T7452] ? selinux_file_ioctl+0xb6/0x290 [ 164.072375][ T7452] ? __pfx_dma_heap_ioctl+0x10/0x10 [ 164.072401][ T7452] __x64_sys_ioctl+0x18e/0x210 [ 164.072425][ T7452] do_syscall_64+0x123/0x790 [ 164.072456][ T7452] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 164.072478][ T7452] RIP: 0033:0x7f3e9859e159 [ 164.072496][ T7452] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 164.072516][ T7452] RSP: 002b:00007f3e967f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 164.072537][ T7452] RAX: ffffffffffffffda RBX: 00007f3e98825fa0 RCX: 00007f3e9859e159 [ 164.072552][ T7452] RDX: 0000200000000100 RSI: 00000000c0184800 RDI: 0000000000000003 [ 164.072565][ T7452] RBP: 00007f3e9863503b R08: 0000000000000000 R09: 0000000000000000 [ 164.072577][ T7452] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 164.072590][ T7452] R13: 00007f3e98826038 R14: 00007f3e98825fa0 R15: 00007fff99c65cb8 [ 164.072620][ T7452] [ 164.218111][ T5612] Bluetooth: hci5: command 0x1003 tx timeout [ 164.218139][ T5608] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 164.449006][ T7464] tipc: Enabling of bearer rejected, already enabled [ 164.473936][ T7464] tipc: Resetting bearer [ 164.766087][ T7472] binder: BINDER_SET_CONTEXT_MGR already set [ 164.766100][ T7472] binder: 7470:7472 ioctl 4018620d 200000004a80 returned -16 [ 164.966643][ T30] audit: type=1804 audit(1789502124.403:386): pid=7484 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz.4.601" name="/newroot/122/tracing/per_cpu/cpu0/trace_pipe_raw" dev="tracefs" ino=3620 res=1 errno=0 [ 165.205613][ T30] audit: type=1400 audit(1789502124.653:387): avc: denied { write } for pid=7453 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 166.122258][ T7510] syzkaller0: entered promiscuous mode [ 166.122275][ T7510] syzkaller0: entered allmulticast mode [ 166.201009][ T30] audit: type=1400 audit(1789502125.543:388): avc: denied { write } for pid=7505 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 166.208731][ T7504] syzkaller0: entered promiscuous mode [ 166.208748][ T7504] syzkaller0: entered allmulticast mode [ 166.214607][ T7504] tipc: Enabled bearer , priority 0 [ 166.226368][ T7504] tipc: Resetting bearer [ 166.279216][ T7503] tipc: Resetting bearer [ 166.338413][ T7503] tipc: Disabling bearer [ 166.400337][ T7516] binder: BINDER_SET_CONTEXT_MGR already set [ 166.400351][ T7516] binder: 7514:7516 ioctl 4018620d 200000004a80 returned -16 [ 166.629292][ T30] audit: type=1804 audit(1789502126.073:389): pid=7527 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz.1.615" name="/newroot/131/tracing/per_cpu/cpu0/trace_pipe_raw" dev="tracefs" ino=3620 res=1 errno=0 [ 166.821811][ T7534] FAULT_INJECTION: forcing a failure. [ 166.821811][ T7534] name fail_futex, interval 1, probability 0, space 0, times 0 [ 166.821846][ T7534] CPU: 0 UID: 0 PID: 7534 Comm: syz.4.616 Not tainted syzkaller #0 PREEMPT(full) [ 166.821870][ T7534] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 166.821883][ T7534] Call Trace: [ 166.821891][ T7534] [ 166.821900][ T7534] dump_stack_lvl+0x100/0x190 [ 166.821937][ T7534] should_fail_ex.cold+0x5/0xa [ 166.821967][ T7534] get_futex_key+0x1d0/0x14f0 [ 166.821997][ T7534] ? __pfx_get_futex_key+0x10/0x10 [ 166.822034][ T7534] futex_wait_setup+0x91/0x540 [ 166.822066][ T7534] __futex_wait+0x19f/0x300 [ 166.822088][ T7534] ? __pfx___futex_wait+0x10/0x10 [ 166.822106][ T7534] ? __pfx_try_to_wake_up+0x10/0x10 [ 166.822129][ T7534] ? futex_hash+0x311/0x400 [ 166.822158][ T7534] ? __pfx_futex_wake_mark+0x10/0x10 [ 166.822193][ T7534] ? find_held_lock+0x2b/0x80 [ 166.822220][ T7534] ? futex_wake+0x4ea/0x5e0 [ 166.822266][ T7534] futex_wait+0xe6/0x370 [ 166.822290][ T7534] ? __pfx_futex_wait+0x10/0x10 [ 166.822319][ T7534] ? rcu_read_lock_any_held+0x6a/0x90 [ 166.822358][ T7534] ? find_held_lock+0x2b/0x80 [ 166.822386][ T7534] ? ksys_write+0x190/0x250 [ 166.822407][ T7534] ? ksys_write+0x190/0x250 [ 166.822430][ T7534] do_futex+0x265/0x440 [ 166.822459][ T7534] ? __pfx_do_futex+0x10/0x10 [ 166.822495][ T7534] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 166.822530][ T7534] __x64_sys_futex+0x34f/0x4d0 [ 166.822562][ T7534] ? fput+0x7c/0x100 [ 166.822597][ T7534] ? __pfx___x64_sys_futex+0x10/0x10 [ 166.822624][ T7534] ? ksys_write+0x1ac/0x250 [ 166.822646][ T7534] ? __pfx_ksys_write+0x10/0x10 [ 166.822678][ T7534] do_syscall_64+0x123/0x790 [ 166.822709][ T7534] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 166.822731][ T7534] RIP: 0033:0x7fb24cf9e159 [ 166.822749][ T7534] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 166.822771][ T7534] RSP: 002b:00007fb24dd830e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 166.822792][ T7534] RAX: ffffffffffffffda RBX: 00007fb24d225fa8 RCX: 00007fb24cf9e159 [ 166.822807][ T7534] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fb24d225fa8 [ 166.822820][ T7534] RBP: 00007fb24d225fa0 R08: 0000000000000000 R09: 0000000000000000 [ 166.822833][ T7534] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 166.822845][ T7534] R13: 00007fb24d226038 R14: 00007ffeda07bfe0 R15: 00007ffeda07c0c8 [ 166.822875][ T7534] [ 167.219322][ T7534] net_ratelimit: 68 callbacks suppressed [ 167.344184][ T30] audit: type=1400 audit(1789502126.783:390): avc: denied { write } for pid=7515 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 167.844664][ T7555] binder: 7554:7555 ioctl c0306201 0 returned -14 [ 168.387163][ T7561] netlink: 12 bytes leftover after parsing attributes in process `syz.3.623'. [ 168.710571][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 168.710585][ T30] audit: type=1804 audit(1789502128.153:392): pid=7573 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz.3.628" name="/newroot/131/tracing/per_cpu/cpu0/trace_pipe_raw" dev="tracefs" ino=3620 res=1 errno=0 [ 169.413440][ T7587] syzkaller0: entered promiscuous mode [ 169.413458][ T7587] syzkaller0: entered allmulticast mode [ 169.620962][ T7584] FAULT_INJECTION: forcing a failure. [ 169.620962][ T7584] name fail_futex, interval 1, probability 0, space 0, times 0 [ 169.620988][ T7584] CPU: 0 UID: 0 PID: 7584 Comm: syz.0.630 Not tainted syzkaller #0 PREEMPT(full) [ 169.621009][ T7584] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 169.621021][ T7584] Call Trace: [ 169.621027][ T7584] [ 169.621034][ T7584] dump_stack_lvl+0x100/0x190 [ 169.621065][ T7584] should_fail_ex.cold+0x5/0xa [ 169.621093][ T7584] get_futex_key+0x1d0/0x14f0 [ 169.621122][ T7584] ? __pfx_get_futex_key+0x10/0x10 [ 169.621146][ T7584] ? __mutex_unlock_slowpath+0x35d/0x930 [ 169.621178][ T7584] futex_wake+0xf4/0x5e0 [ 169.621209][ T7584] ? __pfx_futex_wake+0x10/0x10 [ 169.621239][ T7584] ? lock_acquire+0x1d1/0x380 [ 169.621259][ T7584] ? detach_task_ctx_data+0x83/0x490 [ 169.621297][ T7584] do_futex+0x2b2/0x440 [ 169.621325][ T7584] ? __pfx_do_futex+0x10/0x10 [ 169.621347][ T7584] ? __might_fault+0xc5/0x140 [ 169.621382][ T7584] mm_exit_exec_release+0x256/0x2f0 [ 169.621406][ T7584] do_exit+0x707/0x2ae0 [ 169.621434][ T7584] ? __pfx_do_exit+0x10/0x10 [ 169.621457][ T7584] ? do_raw_spin_lock+0x128/0x260 [ 169.621481][ T7584] ? find_held_lock+0x2b/0x80 [ 169.621505][ T7584] ? get_signal+0x7e0/0x21e0 [ 169.621528][ T7584] do_group_exit+0xd5/0x2a0 [ 169.621555][ T7584] get_signal+0x1ec7/0x21e0 [ 169.621586][ T7584] ? __pfx_get_signal+0x10/0x10 [ 169.621610][ T7584] ? do_futex+0x190/0x440 [ 169.621638][ T7584] arch_do_signal_or_restart+0x91/0x7e0 [ 169.621670][ T7584] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 169.621715][ T7584] exit_to_user_mode_loop+0x139/0x700 [ 169.621738][ T7584] ? rcu_is_watching+0x13/0xc0 [ 169.621767][ T7584] do_syscall_64+0x661/0x790 [ 169.621795][ T7584] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 169.621814][ T7584] RIP: 0033:0x7febb479e159 [ 169.621831][ T7584] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 169.621849][ T7584] RSP: 002b:00007febb56a00e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 169.621869][ T7584] RAX: fffffffffffffe00 RBX: 00007febb4a26098 RCX: 00007febb479e159 [ 169.621883][ T7584] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007febb4a26098 [ 169.621895][ T7584] RBP: 00007febb4a26090 R08: 0000000000000000 R09: 0000000000000000 [ 169.621907][ T7584] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 169.621919][ T7584] R13: 00007febb4a26128 R14: 00007ffd6fa9a5f0 R15: 00007ffd6fa9a6d8 [ 169.621948][ T7584] [ 170.850896][ T30] audit: type=1804 audit(1789502130.293:393): pid=7624 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz.0.642" name="/newroot/106/tracing/per_cpu/cpu0/trace_pipe_raw" dev="tracefs" ino=3620 res=1 errno=0 [ 171.999692][ T7639] FAULT_INJECTION: forcing a failure. [ 171.999692][ T7639] name fail_futex, interval 1, probability 0, space 0, times 0 [ 171.999718][ T7639] CPU: 0 UID: 0 PID: 7639 Comm: syz.4.648 Not tainted syzkaller #0 PREEMPT(full) [ 171.999741][ T7639] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 171.999753][ T7639] Call Trace: [ 171.999760][ T7639] [ 171.999769][ T7639] dump_stack_lvl+0x100/0x190 [ 171.999805][ T7639] should_fail_ex.cold+0x5/0xa [ 171.999833][ T7639] get_futex_key+0x1d0/0x14f0 [ 171.999863][ T7639] ? __pfx_get_futex_key+0x10/0x10 [ 171.999889][ T7639] ? __mutex_unlock_slowpath+0x35d/0x930 [ 171.999924][ T7639] futex_wake+0xf4/0x5e0 [ 171.999957][ T7639] ? __pfx_futex_wake+0x10/0x10 [ 171.999990][ T7639] ? lock_acquire+0x1d1/0x380 [ 172.000011][ T7639] ? detach_task_ctx_data+0x83/0x490 [ 172.000044][ T7639] do_futex+0x2b2/0x440 [ 172.000071][ T7639] ? __pfx_do_futex+0x10/0x10 [ 172.000094][ T7639] ? __might_fault+0xc5/0x140 [ 172.000129][ T7639] mm_exit_exec_release+0x256/0x2f0 [ 172.000161][ T7639] do_exit+0x707/0x2ae0 [ 172.000190][ T7639] ? __pfx_do_exit+0x10/0x10 [ 172.000215][ T7639] ? do_raw_spin_lock+0x128/0x260 [ 172.000239][ T7639] ? find_held_lock+0x2b/0x80 [ 172.000265][ T7639] ? get_signal+0x7e0/0x21e0 [ 172.000290][ T7639] do_group_exit+0xd5/0x2a0 [ 172.000317][ T7639] get_signal+0x1ec7/0x21e0 [ 172.000350][ T7639] ? __pfx_get_signal+0x10/0x10 [ 172.000374][ T7639] ? do_futex+0x190/0x440 [ 172.000402][ T7639] arch_do_signal_or_restart+0x91/0x7e0 [ 172.000434][ T7639] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 172.000479][ T7639] exit_to_user_mode_loop+0x139/0x700 [ 172.000503][ T7639] ? rcu_is_watching+0x13/0xc0 [ 172.000531][ T7639] do_syscall_64+0x661/0x790 [ 172.000560][ T7639] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 172.000581][ T7639] RIP: 0033:0x7fb24cf9e159 [ 172.000597][ T7639] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 172.000615][ T7639] RSP: 002b:00007fb24b1f60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 172.000635][ T7639] RAX: fffffffffffffe00 RBX: 00007fb24d226098 RCX: 00007fb24cf9e159 [ 172.000648][ T7639] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fb24d226098 [ 172.000661][ T7639] RBP: 00007fb24d226090 R08: 0000000000000000 R09: 0000000000000000 [ 172.000674][ T7639] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 172.000686][ T7639] R13: 00007fb24d226128 R14: 00007ffeda07bfe0 R15: 00007ffeda07c0c8 [ 172.000715][ T7639] [ 172.455352][ T30] audit: type=1804 audit(1789502131.893:394): pid=7659 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz.2.656" name="/newroot/132/tracing/per_cpu/cpu0/trace_pipe_raw" dev="tracefs" ino=3620 res=1 errno=0 [ 172.517821][ T7662] net_ratelimit: 102 callbacks suppressed [ 172.546798][ T7665] The dccp option matching is deprecated and scheduled to be removed in 2027. [ 172.546798][ T7665] Please contact the netfilter-devel mailing list or update your nftables rules. [ 173.518418][ T30] audit: type=1400 audit(1789502132.963:395): avc: denied { unmount } for pid=5599 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 173.884336][ T30] audit: type=1400 audit(1789502133.303:396): avc: denied { node_bind } for pid=7682 comm="syz.3.668" saddr=127.0.0.1 src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 174.015651][ T5615] Bluetooth: hci1: command 0x0406 tx timeout [ 174.059517][ T7699] FAULT_INJECTION: forcing a failure. [ 174.059517][ T7699] name fail_futex, interval 1, probability 0, space 0, times 0 [ 174.059547][ T7699] CPU: 1 UID: 0 PID: 7699 Comm: syz.0.673 Not tainted syzkaller #0 PREEMPT(full) [ 174.059571][ T7699] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 174.059585][ T7699] Call Trace: [ 174.059593][ T7699] [ 174.059602][ T7699] dump_stack_lvl+0x100/0x190 [ 174.059639][ T7699] should_fail_ex.cold+0x5/0xa [ 174.059665][ T7699] ? do_raw_spin_lock+0x128/0x260 [ 174.059708][ T7699] get_futex_key+0x1d0/0x14f0 [ 174.059737][ T7699] ? __pfx_get_futex_key+0x10/0x10 [ 174.059762][ T7699] ? __lock_acquire+0x5c0/0x1f40 [ 174.059787][ T7699] futex_wake+0xf4/0x5e0 [ 174.059817][ T7699] ? __pfx_futex_wake+0x10/0x10 [ 174.059847][ T7699] ? fd_install+0x223/0x580 [ 174.059878][ T7699] do_futex+0x2b2/0x440 [ 174.059907][ T7699] ? __pfx_do_futex+0x10/0x10 [ 174.059932][ T7699] ? __seccomp_filter+0x896/0x1130 [ 174.059963][ T7699] __x64_sys_futex+0x34f/0x4d0 [ 174.059994][ T7699] ? __pfx___x64_sys_futex+0x10/0x10 [ 174.060021][ T7699] ? selinux_file_ioctl+0xb6/0x290 [ 174.060056][ T7699] do_syscall_64+0x123/0x790 [ 174.060090][ T7699] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.060113][ T7699] RIP: 0033:0x7febb479e159 [ 174.060131][ T7699] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 174.060151][ T7699] RSP: 002b:00007febb56c10e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 174.060172][ T7699] RAX: ffffffffffffffda RBX: 00007febb4a25fa8 RCX: 00007febb479e159 [ 174.060189][ T7699] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007febb4a25fac [ 174.060204][ T7699] RBP: 00007febb4a25fa0 R08: 0000000000000001 R09: 0000000000000000 [ 174.060217][ T7699] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 174.060230][ T7699] R13: 00007febb4a26038 R14: 00007ffd6fa9a5f0 R15: 00007ffd6fa9a6d8 [ 174.060261][ T7699] [ 174.547545][ T7708] netlink: 4595 bytes leftover after parsing attributes in process `syz.2.679'. [ 174.549061][ T7708] netlink: 4595 bytes leftover after parsing attributes in process `syz.2.679'. [ 174.804229][ T7717] netlink: 4 bytes leftover after parsing attributes in process `syz.1.680'. [ 175.484173][ T7729] FAULT_INJECTION: forcing a failure. [ 175.484173][ T7729] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 175.484207][ T7729] CPU: 0 UID: 0 PID: 7729 Comm: syz.1.684 Not tainted syzkaller #0 PREEMPT(full) [ 175.484233][ T7729] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 175.484246][ T7729] Call Trace: [ 175.484255][ T7729] [ 175.484264][ T7729] dump_stack_lvl+0x100/0x190 [ 175.484302][ T7729] should_fail_ex.cold+0x5/0xa [ 175.484331][ T7729] _copy_to_user+0x32/0xd0 [ 175.484357][ T7729] dma_heap_ioctl+0x458/0x6d0 [ 175.484385][ T7729] ? __pfx_dma_heap_ioctl+0x10/0x10 [ 175.484419][ T7729] ? selinux_file_ioctl+0x13b/0x290 [ 175.484446][ T7729] ? selinux_file_ioctl+0xb6/0x290 [ 175.484471][ T7729] ? __pfx_dma_heap_ioctl+0x10/0x10 [ 175.484504][ T7729] __x64_sys_ioctl+0x18e/0x210 [ 175.484531][ T7729] do_syscall_64+0x123/0x790 [ 175.484565][ T7729] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 175.484587][ T7729] RIP: 0033:0x7f3e9859e159 [ 175.484606][ T7729] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 175.484626][ T7729] RSP: 002b:00007f3e967f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 175.484647][ T7729] RAX: ffffffffffffffda RBX: 00007f3e98825fa0 RCX: 00007f3e9859e159 [ 175.484661][ T7729] RDX: 0000200000000100 RSI: 00000000c0184800 RDI: 0000000000000003 [ 175.484674][ T7729] RBP: 00007f3e9863503b R08: 0000000000000000 R09: 0000000000000000 [ 175.484687][ T7729] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 175.484700][ T7729] R13: 00007f3e98826038 R14: 00007f3e98825fa0 R15: 00007fff99c65cb8 [ 175.484730][ T7729] [ 176.862269][ T7768] FAULT_INJECTION: forcing a failure. [ 176.862269][ T7768] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 176.862367][ T7768] CPU: 0 UID: 0 PID: 7768 Comm: syz.3.701 Not tainted syzkaller #0 PREEMPT(full) [ 176.862393][ T7768] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 176.862422][ T7768] Call Trace: [ 176.862430][ T7768] [ 176.862440][ T7768] dump_stack_lvl+0x100/0x190 [ 176.862478][ T7768] should_fail_ex.cold+0x5/0xa [ 176.862509][ T7768] _copy_to_user+0x32/0xd0 [ 176.862535][ T7768] dma_heap_ioctl+0x458/0x6d0 [ 176.862565][ T7768] ? __pfx_dma_heap_ioctl+0x10/0x10 [ 176.862599][ T7768] ? selinux_file_ioctl+0x13b/0x290 [ 176.862623][ T7768] ? selinux_file_ioctl+0xb6/0x290 [ 176.862648][ T7768] ? __pfx_dma_heap_ioctl+0x10/0x10 [ 176.862672][ T7768] __x64_sys_ioctl+0x18e/0x210 [ 176.862698][ T7768] do_syscall_64+0x123/0x790 [ 176.862729][ T7768] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 176.862751][ T7768] RIP: 0033:0x7ff13cf9e159 [ 176.862770][ T7768] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 176.862789][ T7768] RSP: 002b:00007ff13de41028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 176.862811][ T7768] RAX: ffffffffffffffda RBX: 00007ff13d225fa0 RCX: 00007ff13cf9e159 [ 176.862825][ T7768] RDX: 0000200000000100 RSI: 00000000c0184800 RDI: 0000000000000003 [ 176.862838][ T7768] RBP: 00007ff13d03503b R08: 0000000000000000 R09: 0000000000000000 [ 176.862851][ T7768] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 176.862864][ T7768] R13: 00007ff13d226038 R14: 00007ff13d225fa0 R15: 00007fff29ad7db8 [ 176.862895][ T7768] [ 177.079947][ T7772] netlink: 4 bytes leftover after parsing attributes in process `syz.1.703'. [ 177.355906][ T30] audit: type=1400 audit(1789502136.803:397): avc: denied { create } for pid=7779 comm="syz.0.708" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 177.538509][ T30] audit: type=1400 audit(1789502136.933:398): avc: denied { ioctl } for pid=7779 comm="syz.0.708" path="socket:[14324]" dev="sockfs" ino=14324 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 177.612889][ T7788] net_ratelimit: 67 callbacks suppressed [ 178.122645][ T7788] netlink: 'syz.0.708': attribute type 15 has an invalid length. [ 178.141179][ T141] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 258 - 0 [ 178.141367][ T141] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 258 - 0 [ 178.142039][ T141] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 258 - 0 [ 178.176602][ T141] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 258 - 0 [ 178.244842][ T7788] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=5125 sclass=netlink_route_socket pid=7788 comm=syz.0.708 [ 178.500938][ T7801] block nbd4: NBD_DISCONNECT [ 179.386026][ T30] audit: type=1400 audit(1789502138.823:399): avc: denied { write } for pid=7830 comm="syz.1.728" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 181.095205][ T7882] block nbd1: NBD_DISCONNECT [ 181.952893][ T7895] netlink: 20 bytes leftover after parsing attributes in process `syz.4.740'. [ 181.952937][ T7895] netlink: 24 bytes leftover after parsing attributes in process `syz.4.740'. [ 182.601830][ T7906] netlink: 12 bytes leftover after parsing attributes in process `syz.1.744'. [ 182.897555][ T7920] net_ratelimit: 1243 callbacks suppressed [ 182.980743][ T7924] netlink: 24 bytes leftover after parsing attributes in process `syz.0.755'. [ 183.256182][ T7931] block nbd4: NBD_DISCONNECT [ 183.466026][ T7932] netlink: 20 bytes leftover after parsing attributes in process `syz.0.757'. [ 183.466058][ T7932] netlink: 24 bytes leftover after parsing attributes in process `syz.0.757'. [ 183.632505][ T7937] netlink: 12 bytes leftover after parsing attributes in process `syz.2.759'. [ 184.802877][ T7958] netlink: 24 bytes leftover after parsing attributes in process `syz.3.767'. [ 185.022406][ T7968] netlink: 4 bytes leftover after parsing attributes in process `syz.3.772'. [ 185.438961][ T7979] block nbd3: NBD_DISCONNECT [ 185.552051][ T7981] netlink: 20 bytes leftover after parsing attributes in process `syz.2.774'. [ 187.444909][ T8021] block nbd0: NBD_DISCONNECT [ 187.729453][ T8026] __nla_validate_parse: 2 callbacks suppressed [ 187.729491][ T8026] netlink: 20 bytes leftover after parsing attributes in process `syz.1.790'. [ 187.729521][ T8026] netlink: 24 bytes leftover after parsing attributes in process `syz.1.790'. [ 188.055026][ C1] net_ratelimit: 88 callbacks suppressed [ 188.303426][ T8030] netlink: 24 bytes leftover after parsing attributes in process `syz.4.794'. [ 188.400351][ T8038] netlink: 184 bytes leftover after parsing attributes in process `syz.1.798'. [ 188.949550][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 [ 188.949599][ T1307] ieee802154 phy1 wpan1: encryption failed: -22 [ 189.040005][ T8068] block nbd3: NBD_DISCONNECT [ 189.462697][ T8070] netlink: 184 bytes leftover after parsing attributes in process `syz.4.811'. [ 189.470769][ T8071] netlink: 24 bytes leftover after parsing attributes in process `syz.2.810'. [ 189.648446][ T8087] netlink: 36 bytes leftover after parsing attributes in process `syz.1.809'. [ 189.923890][ T8095] netlink: 12 bytes leftover after parsing attributes in process `syz.1.816'. [ 190.750042][ T8122] block nbd0: NBD_DISCONNECT [ 191.019767][ T5612] Bluetooth: hci1: command 0x0406 tx timeout [ 191.267262][ T8127] netlink: 24 bytes leftover after parsing attributes in process `syz.3.825'. [ 192.010589][ T8149] syzkaller0: entered promiscuous mode [ 192.010605][ T8149] syzkaller0: entered allmulticast mode [ 192.100200][ T8155] netlink: 24 bytes leftover after parsing attributes in process `syz.1.837'. [ 192.434340][ T8169] block nbd0: NBD_DISCONNECT [ 193.311117][ T30] audit: type=1400 audit(1789502152.753:400): avc: denied { create } for pid=8181 comm="syz.4.847" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 193.415082][ C0] net_ratelimit: 96 callbacks suppressed [ 194.006031][ T8202] syzkaller0: entered promiscuous mode [ 194.006048][ T8202] syzkaller0: entered allmulticast mode [ 194.841076][ T8228] block nbd0: NBD_DISCONNECT [ 195.848627][ T8245] syzkaller0: entered promiscuous mode [ 195.848643][ T8245] syzkaller0: entered allmulticast mode [ 196.289955][ T8264] netlink: 56 bytes leftover after parsing attributes in process `syz.4.873'. [ 196.290039][ T8264] netlink: 24 bytes leftover after parsing attributes in process `syz.4.873'. [ 196.406747][ T8265] netlink: 20 bytes leftover after parsing attributes in process `syz.0.874'. [ 197.180093][ T8288] syzkaller0: entered promiscuous mode [ 197.180109][ T8288] syzkaller0: entered allmulticast mode [ 197.492361][ T30] audit: type=1400 audit(1789502156.933:401): avc: denied { create } for pid=8296 comm="syz.3.887" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 197.519119][ T30] audit: type=1400 audit(1789502156.963:402): avc: denied { write } for pid=8296 comm="syz.3.887" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 197.546041][ T8299] netlink: 20 bytes leftover after parsing attributes in process `syz.1.888'. [ 198.103181][ T8322] syzkaller0: entered promiscuous mode [ 198.103199][ T8322] syzkaller0: entered allmulticast mode [ 198.248081][ T8326] block nbd3: NBD_DISCONNECT [ 198.455093][ C1] net_ratelimit: 148 callbacks suppressed [ 198.857479][ T8328] FAULT_INJECTION: forcing a failure. [ 198.857479][ T8328] name fail_futex, interval 1, probability 0, space 0, times 0 [ 198.857511][ T8328] CPU: 1 UID: 0 PID: 8328 Comm: syz.0.899 Not tainted syzkaller #0 PREEMPT(full) [ 198.857535][ T8328] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 198.857549][ T8328] Call Trace: [ 198.857556][ T8328] [ 198.857565][ T8328] dump_stack_lvl+0x100/0x190 [ 198.857601][ T8328] should_fail_ex.cold+0x5/0xa [ 198.857631][ T8328] get_futex_key+0x293/0x14f0 [ 198.857661][ T8328] ? __pfx_get_futex_key+0x10/0x10 [ 198.857685][ T8328] ? find_held_lock+0x2b/0x80 [ 198.857712][ T8328] ? futex_wake+0x4ea/0x5e0 [ 198.857750][ T8328] futex_wake+0xf4/0x5e0 [ 198.857778][ T8328] ? futex_wait+0x11e/0x370 [ 198.857802][ T8328] ? __pfx_futex_wake+0x10/0x10 [ 198.857836][ T8328] ? rcu_read_lock_any_held+0x6a/0x90 [ 198.857866][ T8328] ? find_held_lock+0x2b/0x80 [ 198.857892][ T8328] ? ksys_write+0x190/0x250 [ 198.857913][ T8328] ? ksys_write+0x190/0x250 [ 198.857937][ T8328] do_futex+0x2b2/0x440 [ 198.857965][ T8328] ? __pfx_do_futex+0x10/0x10 [ 198.857999][ T8328] __x64_sys_futex+0x34f/0x4d0 [ 198.858028][ T8328] ? fput+0x7c/0x100 [ 198.858051][ T8328] ? __pfx___x64_sys_futex+0x10/0x10 [ 198.858077][ T8328] ? ksys_write+0x1ac/0x250 [ 198.858108][ T8328] do_syscall_64+0x123/0x790 [ 198.858137][ T8328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 198.858159][ T8328] RIP: 0033:0x7febb479e159 [ 198.858177][ T8328] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 198.858197][ T8328] RSP: 002b:00007febb56c1028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 198.858219][ T8328] RAX: ffffffffffffffda RBX: 00007febb4a25fa0 RCX: 00007febb479e159 [ 198.858234][ T8328] RDX: 00000000000000cb RSI: 0000000000000601 RDI: 0000000000000000 [ 198.858248][ T8328] RBP: 00007febb483503b R08: 9999999999999999 R09: 000000000000000e [ 198.858269][ T8328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 198.858282][ T8328] R13: 00007febb4a26038 R14: 00007febb4a25fa0 R15: 00007ffd6fa9a6d8 [ 198.858314][ T8328] [ 199.172465][ T8333] netlink: 12 bytes leftover after parsing attributes in process `syz.0.900'. [ 200.206109][ T8356] FAULT_INJECTION: forcing a failure. [ 200.206109][ T8356] name fail_futex, interval 1, probability 0, space 0, times 0 [ 200.206138][ T8356] CPU: 1 UID: 0 PID: 8356 Comm: syz.0.911 Not tainted syzkaller #0 PREEMPT(full) [ 200.206161][ T8356] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 200.206174][ T8356] Call Trace: [ 200.206181][ T8356] [ 200.206190][ T8356] dump_stack_lvl+0x100/0x190 [ 200.206226][ T8356] should_fail_ex.cold+0x5/0xa [ 200.206256][ T8356] get_futex_key+0x293/0x14f0 [ 200.206287][ T8356] ? __pfx_get_futex_key+0x10/0x10 [ 200.206312][ T8356] ? find_held_lock+0x2b/0x80 [ 200.206343][ T8356] ? futex_wake+0x4ea/0x5e0 [ 200.206376][ T8356] futex_wake+0xf4/0x5e0 [ 200.206400][ T8356] ? futex_wait+0x11e/0x370 [ 200.206421][ T8356] ? __pfx_futex_wake+0x10/0x10 [ 200.206458][ T8356] ? rcu_read_lock_any_held+0x6a/0x90 [ 200.206488][ T8356] ? find_held_lock+0x2b/0x80 [ 200.206513][ T8356] ? ksys_write+0x190/0x250 [ 200.206533][ T8356] ? ksys_write+0x190/0x250 [ 200.206558][ T8356] do_futex+0x2b2/0x440 [ 200.206587][ T8356] ? __pfx_do_futex+0x10/0x10 [ 200.206642][ T8356] __x64_sys_futex+0x34f/0x4d0 [ 200.206674][ T8356] ? fput+0x7c/0x100 [ 200.206700][ T8356] ? __pfx___x64_sys_futex+0x10/0x10 [ 200.206726][ T8356] ? ksys_write+0x1ac/0x250 [ 200.206756][ T8356] do_syscall_64+0x123/0x790 [ 200.206788][ T8356] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 200.206809][ T8356] RIP: 0033:0x7febb479e159 [ 200.206828][ T8356] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 200.206849][ T8356] RSP: 002b:00007febb56c1028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 200.206869][ T8356] RAX: ffffffffffffffda RBX: 00007febb4a25fa0 RCX: 00007febb479e159 [ 200.206884][ T8356] RDX: 00000000000000cb RSI: 0000000000000601 RDI: 0000000000000000 [ 200.206896][ T8356] RBP: 00007febb483503b R08: 9999999999999999 R09: 000000000000000e [ 200.206910][ T8356] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 200.206923][ T8356] R13: 00007febb4a26038 R14: 00007febb4a25fa0 R15: 00007ffd6fa9a6d8 [ 200.206952][ T8356] [ 201.962107][ T8391] FAULT_INJECTION: forcing a failure. [ 201.962107][ T8391] name fail_futex, interval 1, probability 0, space 0, times 0 [ 201.962139][ T8391] CPU: 0 UID: 0 PID: 8391 Comm: syz.2.923 Not tainted syzkaller #0 PREEMPT(full) [ 201.962164][ T8391] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 201.962178][ T8391] Call Trace: [ 201.962185][ T8391] [ 201.962194][ T8391] dump_stack_lvl+0x100/0x190 [ 201.962230][ T8391] should_fail_ex.cold+0x5/0xa [ 201.962260][ T8391] get_futex_key+0x293/0x14f0 [ 201.962291][ T8391] ? __pfx_get_futex_key+0x10/0x10 [ 201.962316][ T8391] ? find_held_lock+0x2b/0x80 [ 201.962345][ T8391] ? futex_wake+0x4ea/0x5e0 [ 201.962382][ T8391] futex_wake+0xf4/0x5e0 [ 201.962410][ T8391] ? futex_wait+0x11e/0x370 [ 201.962433][ T8391] ? __pfx_futex_wake+0x10/0x10 [ 201.962468][ T8391] ? rcu_read_lock_any_held+0x6a/0x90 [ 201.962505][ T8391] ? find_held_lock+0x2b/0x80 [ 201.962534][ T8391] ? ksys_write+0x190/0x250 [ 201.962556][ T8391] ? ksys_write+0x190/0x250 [ 201.962580][ T8391] do_futex+0x2b2/0x440 [ 201.962608][ T8391] ? __pfx_do_futex+0x10/0x10 [ 201.962643][ T8391] __x64_sys_futex+0x34f/0x4d0 [ 201.962673][ T8391] ? fput+0x7c/0x100 [ 201.962698][ T8391] ? __pfx___x64_sys_futex+0x10/0x10 [ 201.962724][ T8391] ? ksys_write+0x1ac/0x250 [ 201.962754][ T8391] do_syscall_64+0x123/0x790 [ 201.962785][ T8391] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 201.962807][ T8391] RIP: 0033:0x7f6c27f9e159 [ 201.962824][ T8391] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 201.962844][ T8391] RSP: 002b:00007f6c28e0d028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 201.962885][ T8391] RAX: ffffffffffffffda RBX: 00007f6c28225fa0 RCX: 00007f6c27f9e159 [ 201.962900][ T8391] RDX: 00000000000000cb RSI: 0000000000000601 RDI: 0000000000000000 [ 201.962913][ T8391] RBP: 00007f6c2803503b R08: 9999999999999999 R09: 000000000000000e [ 201.962928][ T8391] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 201.962943][ T8391] R13: 00007f6c28226038 R14: 00007f6c28225fa0 R15: 00007ffdcfb703c8 [ 201.962975][ T8391] [ 203.106827][ T8417] syzkaller0: entered promiscuous mode [ 203.106843][ T8417] syzkaller0: entered allmulticast mode [ 203.492839][ T30] audit: type=1400 audit(1789502162.933:403): avc: denied { read write } for pid=8424 comm="syz.1.938" name="max_speed" dev="configfs" ino=16324 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 203.493221][ T30] audit: type=1400 audit(1789502162.933:404): avc: denied { open } for pid=8424 comm="syz.1.938" path="/198/config/usb_gadget/g1/max_speed" dev="configfs" ino=16324 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 203.735027][ C1] net_ratelimit: 165 callbacks suppressed [ 204.769952][ T30] audit: type=1400 audit(1789502164.213:405): avc: denied { nlmsg_read } for pid=8455 comm="syz.0.950" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 205.592229][ T30] audit: type=1400 audit(1789502165.033:406): avc: denied { map } for pid=8462 comm="syz.2.953" path="pipe:[4582]" dev="pipefs" ino=4582 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 205.592276][ T30] audit: type=1400 audit(1789502165.033:407): avc: denied { execute } for pid=8462 comm="syz.2.953" path="pipe:[4582]" dev="pipefs" ino=4582 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 206.541101][ T8493] syzkaller0: entered promiscuous mode [ 206.541118][ T8493] syzkaller0: entered allmulticast mode [ 207.660884][ T30] audit: type=1400 audit(1789502167.103:408): avc: denied { read } for pid=8510 comm="syz.2.965" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 207.662544][ T30] audit: type=1400 audit(1789502167.103:409): avc: denied { open } for pid=8510 comm="syz.2.965" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 207.688103][ T30] audit: type=1400 audit(1789502167.133:410): avc: denied { read } for pid=8506 comm="syz.3.967" path="socket:[17530]" dev="sockfs" ino=17530 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 207.789854][ T30] audit: type=1400 audit(1789502167.233:411): avc: denied { ioctl } for pid=8510 comm="syz.2.965" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 207.945802][ T8518] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input6 [ 208.775043][ C1] net_ratelimit: 75 callbacks suppressed [ 209.307485][ T8535] syzkaller0: entered promiscuous mode [ 209.307502][ T8535] syzkaller0: entered allmulticast mode [ 209.754569][ T30] audit: type=1400 audit(1789502169.193:412): avc: denied { write } for pid=8552 comm="syz.2.983" name="raw-gadget" dev="devtmpfs" ino=814 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 210.015094][ T5602] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 210.167726][ T5602] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 210.169003][ T5602] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 210.169031][ T5602] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 210.169055][ T5602] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 210.169120][ T5602] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 210.247067][ T5602] usb 3-1: config 0 descriptor?? [ 210.716354][ T8586] sctp: [Deprecated]: syz.0.990 (pid 8586) Use of int in max_burst socket option deprecated. [ 210.716354][ T8586] Use struct sctp_assoc_value instead [ 211.098358][ T8596] binder: 8591:8596 ioctl c0306201 200000000080 returned -14 [ 211.153146][ T5602] plantronics 0003:047F:FFFF.0001: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 212.206630][ T8623] sctp: [Deprecated]: syz.0.1004 (pid 8623) Use of int in max_burst socket option deprecated. [ 212.206630][ T8623] Use struct sctp_assoc_value instead [ 212.269746][ T8635] binder: 8634:8635 ioctl c0306201 200000000080 returned -14 [ 212.807930][ T10] usb 3-1: USB disconnect, device number 2 [ 213.221175][ T8672] binder: 8669:8672 ioctl c0306201 200000000080 returned -14 [ 213.555231][ T30] audit: type=1400 audit(1789502172.863:413): avc: denied { read } for pid=8678 comm="syz.2.1024" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 213.555582][ T30] audit: type=1400 audit(1789502172.863:414): avc: denied { open } for pid=8678 comm="syz.2.1024" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 213.851260][ T8689] net_ratelimit: 423 callbacks suppressed [ 214.660752][ T8702] binder: 8700:8702 ioctl c0306201 200000000080 returned -14 [ 215.088730][ T30] audit: type=1400 audit(1789502174.533:415): avc: denied { create } for pid=8707 comm="syz.2.1035" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 215.089171][ T30] audit: type=1400 audit(1789502174.533:416): avc: denied { connect } for pid=8707 comm="syz.2.1035" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 215.089407][ T30] audit: type=1400 audit(1789502174.533:417): avc: denied { setopt } for pid=8707 comm="syz.2.1035" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 215.089641][ T30] audit: type=1400 audit(1789502174.533:418): avc: denied { write } for pid=8707 comm="syz.2.1035" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 217.233911][ T30] audit: type=1326 audit(1789502176.673:419): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8735 comm="syz.3.1043" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff13cf9e159 code=0x7ffc0000 [ 217.233963][ T30] audit: type=1326 audit(1789502176.673:420): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8735 comm="syz.3.1043" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff13cf9e159 code=0x7ffc0000 [ 217.235647][ T30] audit: type=1326 audit(1789502176.673:421): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8735 comm="syz.3.1043" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff13cf9e159 code=0x7ffc0000 [ 217.235693][ T30] audit: type=1326 audit(1789502176.673:422): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8735 comm="syz.3.1043" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff13cf9e159 code=0x7ffc0000 [ 217.235729][ T30] audit: type=1326 audit(1789502176.673:423): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8735 comm="syz.3.1043" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7ff13cf9e159 code=0x7ffc0000 [ 217.235765][ T30] audit: type=1326 audit(1789502176.683:424): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8735 comm="syz.3.1043" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff13cf9e159 code=0x7ffc0000 [ 217.554118][ T8744] binder: 8743:8744 ioctl c0306201 200000000080 returned -14 [ 217.926541][ T8753] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1046'. [ 218.740905][ T5608] Bluetooth: hci1: Malformed MSFT vendor event: 0x02 [ 219.015056][ C0] net_ratelimit: 54 callbacks suppressed [ 219.371209][ T8790] syzkaller0: entered promiscuous mode [ 219.371225][ T8790] syzkaller0: entered allmulticast mode [ 221.015441][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 221.456442][ T5608] Bluetooth: hci1: unexpected event for opcode 0x1009 [ 222.389917][ T8829] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1071'. [ 223.243125][ T8845] syzkaller0: entered promiscuous mode [ 223.243141][ T8845] syzkaller0: entered allmulticast mode [ 223.492997][ T8853] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1081'. [ 223.554937][ T30] kauditd_printk_skb: 22 callbacks suppressed [ 223.556392][ T30] audit: type=1400 audit(1789502182.993:447): avc: denied { write } for pid=8854 comm="syz.2.1082" name="rt6_stats" dev="proc" ino=4026533464 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 223.701450][ T8859] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1083'. [ 224.025485][ T8875] net_ratelimit: 77 callbacks suppressed [ 224.285981][ T8881] syzkaller0: entered promiscuous mode [ 224.285998][ T8881] syzkaller0: entered allmulticast mode [ 225.086961][ T30] audit: type=1400 audit(1789502184.533:448): avc: denied { mounton } for pid=8891 comm="syz.1.1096" path="/proc/596/task" dev="proc" ino=18091 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 225.372471][ T8899] FAULT_INJECTION: forcing a failure. [ 225.372471][ T8899] name fail_futex, interval 1, probability 0, space 0, times 0 [ 225.372502][ T8899] CPU: 1 UID: 0 PID: 8899 Comm: syz.1.1098 Not tainted syzkaller #0 PREEMPT(full) [ 225.372528][ T8899] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 225.372543][ T8899] Call Trace: [ 225.372550][ T8899] [ 225.372559][ T8899] dump_stack_lvl+0x100/0x190 [ 225.372595][ T8899] should_fail_ex.cold+0x5/0xa [ 225.372622][ T8899] get_futex_key+0x293/0x14f0 [ 225.372655][ T8899] ? __pfx_get_futex_key+0x10/0x10 [ 225.372681][ T8899] ? find_held_lock+0x2b/0x80 [ 225.372707][ T8899] ? futex_wake+0x4ea/0x5e0 [ 225.372750][ T8899] futex_wake+0xf4/0x5e0 [ 225.372775][ T8899] ? futex_wait+0x11e/0x370 [ 225.372796][ T8899] ? __pfx_futex_wake+0x10/0x10 [ 225.372832][ T8899] ? rcu_read_lock_any_held+0x6a/0x90 [ 225.372859][ T8899] ? find_held_lock+0x2b/0x80 [ 225.372886][ T8899] ? ksys_write+0x190/0x250 [ 225.372906][ T8899] ? ksys_write+0x190/0x250 [ 225.372929][ T8899] do_futex+0x2b2/0x440 [ 225.372956][ T8899] ? __pfx_do_futex+0x10/0x10 [ 225.372991][ T8899] __x64_sys_futex+0x34f/0x4d0 [ 225.373023][ T8899] ? __pfx___x64_sys_futex+0x10/0x10 [ 225.373062][ T8899] do_syscall_64+0x123/0x790 [ 225.373094][ T8899] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 225.373117][ T8899] RIP: 0033:0x7f3e9859e159 [ 225.373136][ T8899] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 225.373154][ T8899] RSP: 002b:00007f3e967f6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 225.373176][ T8899] RAX: ffffffffffffffda RBX: 00007f3e98825fa0 RCX: 00007f3e9859e159 [ 225.373191][ T8899] RDX: 00000000000000cb RSI: 0000000000000601 RDI: 0000000000000000 [ 225.373206][ T8899] RBP: 00007f3e9863503b R08: 9999999999999999 R09: 000000000000000e [ 225.373221][ T8899] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 225.373234][ T8899] R13: 00007f3e98826038 R14: 00007f3e98825fa0 R15: 00007fff99c65cb8 [ 225.373265][ T8899] [ 225.604621][ T8907] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1099'. [ 226.387711][ T8932] FAULT_INJECTION: forcing a failure. [ 226.387711][ T8932] name fail_futex, interval 1, probability 0, space 0, times 0 [ 226.387742][ T8932] CPU: 0 UID: 0 PID: 8932 Comm: syz.3.1110 Not tainted syzkaller #0 PREEMPT(full) [ 226.387767][ T8932] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 226.387780][ T8932] Call Trace: [ 226.387787][ T8932] [ 226.387796][ T8932] dump_stack_lvl+0x100/0x190 [ 226.387832][ T8932] should_fail_ex.cold+0x5/0xa [ 226.387862][ T8932] get_futex_key+0x293/0x14f0 [ 226.387892][ T8932] ? __pfx_get_futex_key+0x10/0x10 [ 226.387920][ T8932] ? find_held_lock+0x2b/0x80 [ 226.387950][ T8932] ? futex_wake+0x4ea/0x5e0 [ 226.387990][ T8932] futex_wake+0xf4/0x5e0 [ 226.388018][ T8932] ? futex_wait+0x11e/0x370 [ 226.388041][ T8932] ? __pfx_futex_wake+0x10/0x10 [ 226.388076][ T8932] ? rcu_read_lock_any_held+0x6a/0x90 [ 226.388104][ T8932] ? find_held_lock+0x2b/0x80 [ 226.388148][ T8932] ? ksys_write+0x190/0x250 [ 226.388171][ T8932] ? ksys_write+0x190/0x250 [ 226.388196][ T8932] do_futex+0x2b2/0x440 [ 226.388224][ T8932] ? __pfx_do_futex+0x10/0x10 [ 226.388257][ T8932] __x64_sys_futex+0x34f/0x4d0 [ 226.388288][ T8932] ? __pfx___x64_sys_futex+0x10/0x10 [ 226.388324][ T8932] do_syscall_64+0x123/0x790 [ 226.388355][ T8932] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 226.388377][ T8932] RIP: 0033:0x7ff13cf9e159 [ 226.388394][ T8932] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 226.388413][ T8932] RSP: 002b:00007ff13de41028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 226.388434][ T8932] RAX: ffffffffffffffda RBX: 00007ff13d225fa0 RCX: 00007ff13cf9e159 [ 226.388448][ T8932] RDX: 00000000000000cb RSI: 0000000000000601 RDI: 0000000000000000 [ 226.388461][ T8932] RBP: 00007ff13d03503b R08: 9999999999999999 R09: 000000000000000e [ 226.388474][ T8932] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 226.388487][ T8932] R13: 00007ff13d226038 R14: 00007ff13d225fa0 R15: 00007fff29ad7db8 [ 226.388516][ T8932] [ 226.781377][ T8935] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1111'. [ 228.573362][ T8968] FAULT_INJECTION: forcing a failure. [ 228.573362][ T8968] name fail_futex, interval 1, probability 0, space 0, times 0 [ 228.573436][ T8968] CPU: 1 UID: 0 PID: 8968 Comm: syz.1.1121 Not tainted syzkaller #0 PREEMPT(full) [ 228.573464][ T8968] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 228.573480][ T8968] Call Trace: [ 228.573488][ T8968] [ 228.573498][ T8968] dump_stack_lvl+0x100/0x190 [ 228.573538][ T8968] should_fail_ex.cold+0x5/0xa [ 228.573571][ T8968] get_futex_key+0x293/0x14f0 [ 228.573602][ T8968] ? __pfx_get_futex_key+0x10/0x10 [ 228.573627][ T8968] ? rcu_is_watching+0x13/0xc0 [ 228.573654][ T8968] ? trace_hrtimer_start+0x77/0x220 [ 228.573684][ T8968] ? hrtimer_start_range_ns_common+0x778/0x16f0 [ 228.573718][ T8968] futex_wake+0xf4/0x5e0 [ 228.573749][ T8968] ? find_held_lock+0x2b/0x80 [ 228.573777][ T8968] ? finish_task_switch.isra.0+0x2bd/0x10d0 [ 228.573803][ T8968] ? __pfx_futex_wake+0x10/0x10 [ 228.573834][ T8968] ? rcu_is_watching+0x13/0xc0 [ 228.573862][ T8968] ? lockdep_hardirqs_on+0x7d/0x110 [ 228.573890][ T8968] ? finish_task_switch.isra.0+0x2c2/0x10d0 [ 228.573920][ T8968] do_futex+0x2b2/0x440 [ 228.573951][ T8968] ? __pfx_do_futex+0x10/0x10 [ 228.573989][ T8968] __x64_sys_futex+0x34f/0x4d0 [ 228.574023][ T8968] ? __pfx___x64_sys_futex+0x10/0x10 [ 228.574055][ T8968] ? trace_irq_enable.constprop.0+0x2f/0x160 [ 228.574091][ T8968] do_syscall_64+0x123/0x790 [ 228.574121][ T8968] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 228.574144][ T8968] RIP: 0033:0x7f3e9859e159 [ 228.574162][ T8968] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 228.574184][ T8968] RSP: 002b:00007f3e967f6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 228.574205][ T8968] RAX: ffffffffffffffda RBX: 00007f3e98825fa0 RCX: 00007f3e9859e159 [ 228.574220][ T8968] RDX: 00000000000000cb RSI: 0000000000000601 RDI: 0000000000000000 [ 228.574233][ T8968] RBP: 00007f3e9863503b R08: 9999999999999999 R09: 000000000000000e [ 228.574247][ T8968] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 228.574261][ T8968] R13: 00007f3e98826038 R14: 00007f3e98825fa0 R15: 00007fff99c65cb8 [ 228.574290][ T8968] [ 229.255027][ C1] net_ratelimit: 87 callbacks suppressed [ 229.829312][ T8976] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1123'. [ 230.245353][ T30] audit: type=1400 audit(1789502189.683:449): avc: denied { write } for pid=8970 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 230.843849][ T8991] syzkaller0: entered promiscuous mode [ 230.843865][ T8991] syzkaller0: entered allmulticast mode [ 230.938341][ T30] audit: type=1400 audit(1789502190.383:450): avc: denied { write } for pid=8993 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 231.830653][ T30] audit: type=1400 audit(1789502191.273:451): avc: denied { write } for pid=9014 comm="syz.4.1133" name="strings" dev="configfs" ino=10650 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 231.888562][ T30] audit: type=1400 audit(1789502191.333:452): avc: denied { write } for pid=9001 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 231.921477][ T30] audit: type=1400 audit(1789502191.343:453): avc: denied { write } for pid=9014 comm="syz.4.1133" name="functions" dev="configfs" ino=10648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 232.022405][ T30] audit: type=1400 audit(1789502191.463:454): avc: denied { write } for pid=9014 comm="syz.4.1133" name="configs" dev="configfs" ino=10649 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 232.113044][ T30] audit: type=1400 audit(1789502191.553:455): avc: denied { write } for pid=9014 comm="syz.4.1133" name="strings" dev="configfs" ino=19005 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 232.139535][ T30] audit: type=1400 audit(1789502191.563:456): avc: denied { write } for pid=9014 comm="syz.4.1133" name="c.1" dev="configfs" ino=19004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 232.139591][ T30] audit: type=1400 audit(1789502191.563:457): avc: denied { create } for pid=9014 comm="syz.4.1133" name="ecm.usb0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=lnk_file permissive=1 [ 232.147685][ T30] audit: type=1400 audit(1789502191.563:458): avc: denied { write } for pid=9014 comm="syz.4.1133" name="c.1" dev="configfs" ino=19004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 232.148477][ T9030] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1135'. [ 233.102878][ T9024] configfs-gadget.g1 gadget.0: HOST MAC aa:80:e8:4b:3e:59 [ 233.102905][ T9024] configfs-gadget.g1 gadget.0: MAC 42:bf:bf:70:62:d5 [ 233.264625][ T9027] netlink: 84 bytes leftover after parsing attributes in process `syz.1.1136'. [ 233.264890][ T9027] bridge0: port 2(bridge_slave_1) entered disabled state [ 233.265473][ T9027] bridge0: port 1(bridge_slave_0) entered disabled state [ 233.461348][ T9045] syzkaller0: entered promiscuous mode [ 233.461364][ T9045] syzkaller0: entered allmulticast mode [ 234.385024][ C0] net_ratelimit: 70 callbacks suppressed [ 235.393312][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 235.393328][ T30] audit: type=1400 audit(1789502194.833:464): avc: denied { write } for pid=9079 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 235.567005][ T5266] usb0: bond_netdev_event received NETDEV_PRE_UP [ 235.567038][ T5266] net usb0: siw: event 14 [ 235.567136][ T5266] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000025: 0000 [#1] SMP KASAN NOPTI [ 235.589828][ T5266] KASAN: null-ptr-deref in range [0x0000000000000128-0x000000000000012f] [ 235.598269][ T5266] CPU: 0 UID: 0 PID: 5266 Comm: dhcpcd Not tainted syzkaller #0 PREEMPT(full) [ 235.607199][ T5266] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 235.617259][ T5266] RIP: 0010:__dynamic_dev_dbg+0x1da/0x310 [ 235.622994][ T5266] Code: 85 40 ff ff ff 00 00 00 00 48 c7 85 48 ff ff ff 00 00 00 00 48 c7 85 50 ff ff ff 00 00 00 00 48 c7 85 58 ff ff ff 00 00 00 00 <80> 3c 08 00 0f 85 13 01 00 00 4c 8b 7b 50 4d 85 ff 0f 84 a8 00 00 [ 235.637793][ T30] audit: type=1400 audit(1789502195.083:465): avc: denied { read } for pid=4953 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 235.637832][ T30] audit: type=1400 audit(1789502195.083:466): avc: denied { search } for pid=4953 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 235.637861][ T30] audit: type=1400 audit(1789502195.083:467): avc: denied { write search } for pid=4953 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 235.637890][ T30] audit: type=1400 audit(1789502195.083:468): avc: denied { add_name } for pid=4953 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 235.637918][ T30] audit: type=1400 audit(1789502195.083:469): avc: denied { create } for pid=4953 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 235.637945][ T30] audit: type=1400 audit(1789502195.083:470): avc: denied { append open } for pid=4953 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 235.637976][ T30] audit: type=1400 audit(1789502195.083:471): avc: denied { getattr } for pid=4953 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 235.659557][ T9086] kcov: kcov_start: t = ffff88802a29a580, size = 524288, area = ffffc9000e89a000 [ 235.803927][ T5266] RSP: 0000:ffffc9000515f6b0 EFLAGS: 00010202 [ 235.810011][ T5266] RAX: 0000000000000025 RBX: 00000000000000d8 RCX: dffffc0000000000 [ 235.818062][ T5266] RDX: ffffffff8cdc35e0 RSI: 00000000000000d8 RDI: 0000000000000128 [ 235.826021][ T5266] RBP: ffffc9000515f858 R08: 0000000000000005 R09: 0000000000000000 [ 235.833981][ T5266] R10: ffffc9000515f868 R11: 0000000000000001 R12: 1ffff92000a2bed7 [ 235.841947][ T5266] R13: ffffffff913bb538 R14: ffffc9000515f7f8 R15: ffffffff8cdc4280 [ 235.849938][ T5266] FS: 00007f4dfc78b780(0000) GS:ffff888123b59000(0000) knlGS:0000000000000000 [ 235.859209][ T5266] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 235.865789][ T5266] CR2: 0000001b32b23ffc CR3: 000000007be45000 CR4: 00000000003526f0 [ 235.873802][ T5266] Call Trace: [ 235.877086][ T5266] [ 235.880003][ T5266] ? find_held_lock+0x2b/0x80 [ 235.884673][ T5266] ? __pfx___dynamic_dev_dbg+0x10/0x10 [ 235.890121][ T5266] ? ib_device_get_by_netdev+0x1a8/0x530 [ 235.895752][ T5266] ? ib_device_get_by_netdev+0x1b2/0x530 [ 235.901372][ T5266] ? ip6_route_dev_notify+0xe4/0x750 [ 235.906643][ T5266] ? ndisc_netdev_event+0xa1/0x560 [ 235.911742][ T5266] ? notifier_call_chain+0x31b/0x3f0 [ 235.917020][ T5266] eth_open+0x17b/0x1f0 [ 235.921200][ T5266] ? __pfx_eth_open+0x10/0x10 [ 235.925885][ T5266] __dev_open+0x3ad/0x8f0 [ 235.930216][ T5266] ? __pfx___dev_open+0x10/0x10 [ 235.935068][ T5266] ? __local_bh_enable_ip+0xa5/0x120 [ 235.940340][ T5266] __dev_change_flags+0x596/0x850 [ 235.945363][ T5266] ? __pfx___dev_change_flags+0x10/0x10 [ 235.950899][ T5266] netif_change_flags+0x8d/0x160 [ 235.955824][ T5266] dev_change_flags+0xba/0x260 [ 235.960575][ T5266] devinet_ioctl+0x110b/0x1f10 [ 235.965327][ T5266] ? __pfx_devinet_ioctl+0x10/0x10 [ 235.970435][ T5266] ? _copy_from_user+0x59/0xd0 [ 235.975185][ T5266] inet_ioctl+0x3aa/0x3f0 [ 235.979511][ T5266] ? __pfx_inet_ioctl+0x10/0x10 [ 235.984355][ T5266] ? tomoyo_path_number_perm+0x188/0x580 [ 235.989974][ T5266] sock_do_ioctl+0x118/0x280 [ 235.994556][ T5266] ? __pfx_sock_do_ioctl+0x10/0x10 [ 235.999655][ T5266] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 236.005537][ T5266] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 236.010548][ T5266] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 236.017036][ T5266] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 236.023871][ T5266] sock_ioctl+0x599/0x6b0 [ 236.028181][ T5266] ? __pfx_sock_ioctl+0x10/0x10 [ 236.033016][ T5266] ? selinux_file_ioctl+0x13b/0x290 [ 236.038196][ T5266] ? selinux_file_ioctl+0xb6/0x290 [ 236.043292][ T5266] ? __pfx_sock_ioctl+0x10/0x10 [ 236.048122][ T5266] __x64_sys_ioctl+0x18e/0x210 [ 236.052870][ T5266] do_syscall_64+0x123/0x790 [ 236.057449][ T5266] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 236.063329][ T5266] RIP: 0033:0x7f4dfc88b378 [ 236.067732][ T5266] Code: 00 00 48 8d 44 24 08 48 89 54 24 e0 48 89 44 24 c0 48 8d 44 24 d0 48 89 44 24 c8 b8 10 00 00 00 c7 44 24 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 07 89 d0 c3 0f 1f 40 00 48 8b 15 49 3a 0d [ 236.087327][ T5266] RSP: 002b:00007ffe8d844188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 236.095724][ T5266] RAX: ffffffffffffffda RBX: 0000000000000011 RCX: 00007f4dfc88b378 [ 236.103678][ T5266] RDX: 00007ffe8d854380 RSI: 0000000000008914 RDI: 0000000000000011 [ 236.111634][ T5266] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 236.119586][ T5266] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe8d864520 [ 236.127542][ T5266] R13: 00007f4dfc78b708 R14: 0000000000000028 R15: 0000000000008914 [ 236.135506][ T5266] [ 236.138519][ T5266] Modules linked in: [ 236.142552][ C0] virtqueue callback for ffff888028380400 (ffffffff86eb84f0) [ 236.150656][ T5266] ---[ end trace 0000000000000000 ]--- [ 236.156147][ C0] No more buffers in queue [ 236.161205][ C0] Receiving skb proto 0x0800 len 52 type 0 [ 236.167092][ C0] Receiving skb proto 0x0800 len 52 type 0 [ 236.172970][ C0] Receiving skb proto 0x0800 len 52 type 0 [ 236.178818][ C0] No more buffers in queue [ 236.183495][ C0] eth0: xmit ffff888076154280 42:01:0a:80:00:01 [ 236.189793][ C0] Added buffer head 11 to ffff888028380000 [ 236.189824][ C0] virtqueue callback for ffff888028380000 (ffffffff86ec12a0) [ 236.203203][ C0] eth0: xmit ffff8880761548c0 42:01:0a:80:00:01 [ 236.209510][ C0] Added buffer head 16 to ffff888028380000 [ 236.209540][ C0] virtqueue callback for ffff888028380000 (ffffffff86ec12a0) [ 236.224989][ C0] Sent skb ffff888076154280 [ 236.225046][ C0] Sent skb ffff8880761548c0 [ 236.225079][ C0] No more buffers in queue [ 236.225098][ C0] No more buffers in queue [ 236.274659][ T9088] kcov: kcov_start: t = ffff888027b0cb00, size = 524288, area = ffffc90011038000 [ 236.394273][ T9083] kcov: kcov_task_exit: t = ffff8880277da580, kcov->t = ffff8880277da580 [ 236.394417][ T9088] kcov: kcov_task_exit: t = ffff888027b0cb00, kcov->t = ffff888027b0cb00 [ 236.441865][ T9068] kcov: kcov_task_exit: t = ffff888029404b00, kcov->t = ffff888029404b00 [ 236.459955][ C0] virtqueue callback for ffff888028380400 (ffffffff86eb84f0) [ 236.459995][ C0] No more buffers in queue [ 236.460271][ C0] Receiving skb proto 0x0806 len 28 type 1 [ 236.460299][ C0] No more buffers in queue [ 236.460317][ C0] Added buffer head 1139 to ffff888028380400 [ 236.460356][ C0] Added buffer head 1138 to ffff888028380400 [ 236.460377][ C0] Added buffer head 1137 to ffff888028380400 [ 236.460401][ C0] Added buffer head 1136 to ffff888028380400 [ 236.460438][ C0] Added buffer head 1135 to ffff888028380400 [ 236.460458][ C0] Added buffer head 1134 to ffff888028380400 [ 236.460477][ C0] Added buffer head 1133 to ffff888028380400 [ 236.460497][ C0] Added buffer head 1132 to ffff888028380400 [ 236.460522][ C0] Added buffer head 1131 to ffff888028380400 [ 236.460541][ C0] Added buffer head 1130 to ffff888028380400 [ 236.460561][ C0] Added buffer head 1129 to ffff888028380400 [ 236.460581][ C0] Added buffer head 1128 to ffff888028380400 [ 236.460600][ C0] Added buffer head 1127 to ffff888028380400 [ 236.460620][ C0] Added buffer head 1126 to ffff888028380400 [ 236.460640][ C0] Added buffer head 900 to ffff888028380400 [ 236.460660][ C0] Added buffer head 899 to ffff888028380400 [ 236.460680][ C0] Added buffer head 898 to ffff888028380400 [ 236.460699][ C0] Added buffer head 897 to ffff888028380400 [ 236.460718][ C0] Added buffer head 896 to ffff888028380400 [ 236.460737][ C0] Added buffer head 895 to ffff888028380400 [ 236.460757][ C0] Added buffer head 894 to ffff888028380400 [ 236.460776][ C0] Added buffer head 893 to ffff888028380400 [ 236.460801][ C0] Added buffer head 977 to ffff888028380400 [ 236.460820][ C0] Added buffer head 976 to ffff888028380400 [ 236.460839][ ** replaying previous printk message ** [ 236.460839][ C0] Added buffer head 975 to ffff888028380400 [ 236.460858][ C0] Added buffer head 974 to ffff888028380400 [ 236.460878][ C0] Added buffer head 973 to ffff888028380400 [ 236.460896][ C0] Added buffer head 972 to ffff888028380400 [ 236.460915][ C0] Added buffer head 971 to ffff888028380400 [ 236.460935][ C0] Added buffer head 970 to ffff888028380400 [ 236.460954][ C0] Added buffer head 969 to ffff888028380400 [ 236.460973][ C0] Added buffer head 968 to ffff888028380400 [ 236.460993][ C0] Added buffer head 967 to ffff888028380400 [ 236.461113][ C0] eth0: xmit ffff888079bb2500 42:01:0a:80:00:01 [ 236.461143][ C0] Added buffer head 16 to ffff888028380000 [ 236.461174][ C0] virtqueue callback for ffff888028380000 (ffffffff86ec12a0) [ 236.461217][ C0] Sent skb ffff888079bb2500 [ 236.461251][ C0] No more buffers in queue [ 236.551398][ T9090] kcov: kcov_start: t = ffff888068642580, size = 524288, area = ffffc90006621000 [ 236.568901][ T9091] kcov: kcov_start: t = ffff888068640000, size = 524288, area = ffffc9000fad9000 [ 236.587343][ T9086] sock ffff8880744c3400 [ 236.587371][ T9086] ffff8880586ec000 [ 236.587382][ T9086] ffff8880586ec000 [ 236.587422][ T9086] sk ffff888035455000 [ 236.587435][ T9086] sk ffff888035455000 [ 236.626888][ T9067] kobject: 'syzkaller0' (ffff888087a207c0): kobject_cleanup, parent 0000000000000000 [ 236.626916][ T9067] kobject: 'syzkaller0' (ffff888087a207c0): calling ktype release [ 236.626953][ T9067] kobject: 'syzkaller0': free name [ 236.655716][ T9077] kcov: kcov_task_exit: t = ffff888028c40000, kcov->t = ffff888028c40000 [ 236.655908][ T9072] kcov: kcov_task_exit: t = ffff88802a7b0000, kcov->t = ffff88802a7b0000 [ 236.675658][ T5610] send_to_group: group=ffff8880384ed800 mask=8 marks_mask=2008 marks_ignore_mask=0 data=ffff888036a47ac0 data_type=2 dir=0000000000000000 cookie=0 [ 236.675696][ T5610] inotify_handle_inode_event: group=ffff8880384ed800 mark=ffff88802a41c258 mask=8 [ 236.675722][ T5610] fsnotify_insert_event: group=ffff8880384ed800 event=ffff88807377fa00 [ 236.676237][ T4971] get_one_event: group=ffff8880384ed800 event=ffff88807377fa00 [ 236.676256][ T4971] fsnotify_remove_first_event: group=ffff8880384ed800 event=ffff88807377fa00 [ 236.676334][ T4971] inotify_read: group=ffff8880384ed800 kevent=ffff88807377fa00 [ 236.676351][ T4971] copy_event_to_user: group=ffff8880384ed800 event=ffff88807377fa00 [ 236.676374][ T4971] inotify_read: group=ffff8880384ed800 kevent=0000000000000000 [ 236.695911][ T9084] sock ffff8880744c3400, sk ffff888035455000 [ 236.695936][ T9084] sock ffff8880744c3400, sk ffff888035455000 [ 236.695951][ T9084] sk ffff888035455000 state 2 socket ffff8880744c3400 [ 236.695969][ T9084] sk ffff888035455000 state 2 refcnt 2 [ 236.695986][ T9084] sk ffff888035455000 dlc ffff8880586ec000 [ 236.696002][ T9084] ffff8880586ec000 [ 236.697416][ T9085] kcov: kcov_task_exit: t = ffff88802a332580, kcov->t = ffff88802a332580 [ 236.697565][ T9086] kcov: kcov_task_exit: t = ffff88802a29a580, kcov->t = ffff88802a29a580 [ 236.699818][ T4971] kobject: 'loop3' (ffff88802494c6e0): kobject_uevent_env [ 236.699852][ T4971] kobject: 'loop3' (ffff88802494c6e0): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 236.701136][ T5625] inotify_handle_inode_event: group=ffff8880384ed800 mark=ffff88802a41c258 mask=8000 [ 236.701164][ T5625] fsnotify_insert_event: group=ffff8880384ed800 event=ffff88807377f740 [ 236.713532][ T4971] get_one_event: group=ffff8880384ed800 event=ffff88807377f740 [ 236.713566][ T4971] fsnotify_remove_first_event: group=ffff8880384ed800 event=ffff88807377f740 [ 236.713582][ T4971] inotify_read: group=ffff8880384ed800 kevent=ffff88807377f740 [ 236.713597][ T4971] copy_event_to_user: group=ffff8880384ed800 event=ffff88807377f740 [ 236.713620][ T4971] inotify_read: group=ffff8880384ed800 kevent=0000000000000000 [ 236.766863][ T9092] kcov: kcov_start: t = ffff888027b08000, size = 524288, area = ffffc90010836000 [ 236.878107][ T5266] RIP: 0010:__dynamic_dev_dbg+0x1da/0x310 [ 236.878144][ T5266] Code: 85 40 ff ff ff 00 00 00 00 48 c7 85 48 ff ff ff 00 00 00 00 48 c7 85 50 ff ff ff 00 00 00 00 48 c7 85 58 ff ff ff 00 00 00 00 <80> 3c 08 00 0f 85 13 01 00 00 4c 8b 7b 50 4d 85 ff 0f 84 a8 00 00 [ 236.878162][ T5266] RSP: 0000:ffffc9000515f6b0 EFLAGS: 00010202 [ 236.878178][ T5266] RAX: 0000000000000025 RBX: 00000000000000d8 RCX: dffffc0000000000 [ 236.878191][ T5266] RDX: ffffffff8cdc35e0 RSI: 00000000000000d8 RDI: 0000000000000128 [ 236.878204][ T5266] RBP: ffffc9000515f858 R08: 0000000000000005 R09: 0000000000000000 [ 236.878216][ T5266] R10: ffffc9000515f868 R11: 0000000000000001 R12: 1ffff92000a2bed7 [ 236.878228][ T5266] R13: ffffffff913bb538 R14: ffffc9000515f7f8 R15: ffffffff8cdc4280 [ 236.878241][ T5266] FS: 00007f4dfc78b780(0000) GS:ffff888123b59000(0000) knlGS:0000000000000000 [ 236.878261][ T5266] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 236.878274][ T5266] CR2: 000000110c35e852 CR3: 000000007be45000 CR4: 00000000003526f0 [ 236.878289][ T5266] Kernel panic - not syncing: Fatal exception [ 237.346864][ T5266] Kernel Offset: disabled [ 237.351187][ T5266] Rebooting in 86400 seconds..