last executing test programs: 25m46.678370404s ago: executing program 0 (id=950): r0 = syz_open_dev$media(&(0x7f00000000c0), 0x50d, 0x48000) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc0287c02, &(0x7f00000002c0)={0x80000000, 0x0, &(0x7f00000003c0)=[{{0x80000000}}, {{}, {0x80000000, 0x0}}]}) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x61, 0x8e}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r3, 0x0, 0x0) r6 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r6}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) bind$unix(r7, 0x0, 0x0) listen(r7, 0x0) pipe2(&(0x7f00000002c0), 0x0) pipe2$9p(&(0x7f0000000180), 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, &(0x7f00000001c0)={{r1, 0x0, 0x5, [0xb, 0x23b232f2]}, {0x80000000, r2, 0x6, [0x2, 0x6]}, 0x10000000, [0x101, 0x200]}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00'}) 25m45.703108858s ago: executing program 0 (id=962): socket(0x10, 0x3, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="12011001040000407d1e502d0000000000010902240001000080010904000002030002000921fd7f000122eb00090581031000f60000b5dbdaa7667c329bc8862737ed6421779e6c40e1a5dd9b764464dec9e1979c60685609da9076f49aa96bbc398bcc5fda6554a57307f04e40"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}, {0xfff1}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x3c, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_CLASSID={0x8, 0x1, {0xffee, 0xffe0}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24004800}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000900)={{0x14}, [@NFT_MSG_NEWRULE={0x5c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0x14}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x1}, @NFTA_EXTHDR_TYPE={0x5}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x84}}, 0x0) close(r0) 25m44.081968406s ago: executing program 0 (id=964): r0 = socket(0x40000000015, 0x5, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e20, 0x800006, @loopback, 0x4}, 0x1c) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{0x104, 0x80, 0x0, 0x6a8}, 'syz1\x00', 0xa}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_GET_DIRTY_LOG(r3, 0x4010ae42, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000/0x3000)=nil}) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = socket$kcm(0x11, 0x3, 0x0) r8 = openat$vcs(0xffffffffffffff9c, &(0x7f00000012c0), 0x40, 0x0) write$snddsp(r8, &(0x7f0000001300)="5ed0adb595a235308ebe6d54d3c559fb2920e3f26884b5f07219c603339e6a113849298a308142ff37f653089848027a5f990b1f0875ac11a7edde7d91b44914ada023f9b046c720760cbf053f16bd910ba449d1c494433d9d8ea71850e3057760e9860fa0bbf2aea0734aa371be22ba1bd7301aeca86175dee5163fdd0513c4931301", 0x83) read$proc_mixer(0xffffffffffffffff, &(0x7f0000000240)=""/4096, 0x1000) setsockopt$sock_attach_bpf(r7, 0x107, 0xf, 0x0, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001500010300000000000000000b000000c30f4c7a41931f2cfa9c8d665012a0e310d5"], 0x14}}, 0x0) setresuid(0x0, 0x0, 0x0) quotactl$Q_QUOTAOFF(0xffffffff80000301, &(0x7f00000013c0)=@sr0, 0x0, 0x0) ioctl$UI_DEV_CREATE(r1, 0x5501) syz_emit_ethernet(0x0, 0x0, 0x0) 25m43.111497656s ago: executing program 0 (id=965): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000200)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r1 = socket$kcm(0x29, 0x5, 0x0) sendmmsg$inet(r1, &(0x7f00000011c0)=[{{0x0, 0x0, &(0x7f0000000e00)=[{&(0x7f0000000380)}], 0x1}}], 0x1, 0x8800) writev(r1, &(0x7f0000000480)=[{&(0x7f0000000040)="9181fe1732b976928aa415f38191669b7601a17431f85d9744e62057f026de768ba4413a3ff44bdb15560fd1b4153d5547e5e15e4e591f29001c49a9a4ce595f925bf7947575c694b3f43a2698a0cf", 0x4f}, {&(0x7f0000000100)="ba662a0919375216b3ce9ffc4f968bf68ffb124787f5be5f7f7a8f52754c5cd8cae8aa52672dec524c6dd45e13e4eedbf11e362282f702ae445359272499a5900a404fd457c1aebd68b8c9828f47a78c0cb5502985a200f1b77b77483b49754722d1d5fdb9489d56c29c09219b17ddf9bfa266741584124b905eb88e80d99e007d08654abf725f084d170e9189ae67cde94ce3c98e1ce99483b6e36d39b35e5d201993c2247a8f6db426fd37e3030aed6693fe1122b81f88bf6751b993da1d846436177511fe11507846d6e2ab206eb34c31", 0xd2}, {&(0x7f00000003c0)="74997ee2d77907debc5deb2960bd5bf8521bea450c0cd28f394da74b7a2534822d39f0bfcaf46ed95a203148939737756ab0a23c2e9edf9eb96b2169a5bddb017fed4de8eeef83a2251e1506a19c6e64aa31ca994ba92dd45bd34af975938505ab486e6f965537999ec7088996f9578d6bb816e6e0033070b3f0cf24c177499727b723ab3d4daed3f125767b9c02c628d60088c3fee6d139f7f9efc8d91e5c8a4493c2a48291bbc658c927fcbc24", 0xae}], 0x3) close_range(r0, 0xffffffffffffffff, 0x2000000000000000) 25m43.0689862s ago: executing program 0 (id=966): r0 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000940)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001000)={0x34, &(0x7f0000000e40)={0x0, 0x15}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000880)={0x34, &(0x7f00000006c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000480)={0x34, &(0x7f0000000280)={0x0, 0x14}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000e80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000300)={0x34, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000540)={0x34, &(0x7f0000000340)={0x20, 0x0, 0x4, "ae7e7c97"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000ac0)={0x34, &(0x7f0000000700)={0x20, 0x31, 0x4, "4357aa06"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) 25m42.224524415s ago: executing program 0 (id=973): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx\x00'}, 0x58) socket$inet6_tcp(0xa, 0x1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x380000f, 0x204031, 0xffffffffffffffff, 0x50728000) r2 = mq_open(&(0x7f0000000000)='batadv_slave_1\x00', 0x8c2, 0x30, 0x0) mq_getsetattr(r2, &(0x7f0000000040)={0x0, 0x40, 0x4, 0x7ff}, 0x0) mq_timedreceive(r2, &(0x7f0000000500)=""/4096, 0x1000, 0x6, &(0x7f0000000240)={0x77359400}) 25m42.017528832s ago: executing program 32 (id=973): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx\x00'}, 0x58) socket$inet6_tcp(0xa, 0x1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x380000f, 0x204031, 0xffffffffffffffff, 0x50728000) r2 = mq_open(&(0x7f0000000000)='batadv_slave_1\x00', 0x8c2, 0x30, 0x0) mq_getsetattr(r2, &(0x7f0000000040)={0x0, 0x40, 0x4, 0x7ff}, 0x0) mq_timedreceive(r2, &(0x7f0000000500)=""/4096, 0x1000, 0x6, &(0x7f0000000240)={0x77359400}) 1m19.971910191s ago: executing program 4 (id=5368): r0 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x4c0142, 0x163) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) connect$nfc_raw(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{0x0}, {0x0}], 0x2) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) r2 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) bind$llc(r2, &(0x7f0000000000)={0x1a, 0x310, 0x9, 0x0, 0x81, 0x42}, 0xffffffffffffff7c) getsockname$llc(r2, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r3, r3, 0x0, 0x200000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='personality\x00') r4 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x3}, &(0x7f0000000140)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000000c0)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x4}}}, &(0x7f0000000300)) lseek(r4, 0x8000000010007, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0xa4242, 0x0) close(r3) 1m19.181004886s ago: executing program 4 (id=5370): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x2010, r0, 0xa94000) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000dc0)={0x38, 0x5, 0x8, 0x9, 0x0, 0x9, 0x0, 0xaa, 0xfa11, 0xffffffff}, 0x0) ioctl$CEC_TRANSMIT(0xffffffffffffffff, 0xc0386105, &(0x7f0000000280)={0x40000000001, 0x1, 0x100004, 0xfff, 0xfffffff5, 0x5, "0f6d00", 0x0, 0x5, 0x0, 0x4, 0x0, 0x4, 0xff}) fsopen(0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, 0x0, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x4, 0x0, 0xfffffffffffffffc, 0x0, 0x6}, {0x0, 0x0, 0x400000000}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in6=@empty, 0x0, 0x32}, 0x0, @in=@private=0xa010101, 0x0, 0x0, 0x0, 0xb7, 0x8, 0xfffffffe}}, 0xe8) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x1c) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) 1m15.385831238s ago: executing program 4 (id=5379): socket$inet6_sctp(0xa, 0x1, 0x84) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) ptrace(0x4208, r0) sched_setscheduler(0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000200)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x3) msgsnd(0x0, 0x0, 0x0, 0x800) openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$ublk_chdev(&(0x7f0000002000), 0x0, 0x2) 1m13.576675858s ago: executing program 4 (id=5383): bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) openat$comedi(0xffffffffffffff9c, 0x0, 0x88000, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) mlockall(0x2) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='quota,grpquota_block_hardlimit=3']) chdir(&(0x7f0000000100)='./file0\x00') symlink(&(0x7f0000000940)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000840)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x103042, 0x0) r1 = shmget$private(0x0, 0x400000, 0x8, &(0x7f000000e000/0x400000)=nil) shmctl$SHM_LOCK(r1, 0xb) shmat(r1, &(0x7f0000ffd000/0x1000)=nil, 0x7000) shmctl$SHM_UNLOCK(r1, 0xc) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x41000004, &(0x7f0000000040)) bind$inet(0xffffffffffffffff, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) socket$inet(0x2, 0x5, 0xc) close(0xffffffffffffffff) 1m11.635368538s ago: executing program 4 (id=5387): r0 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r0, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0x0, 0x4}, 0x20) getpeername$l2tp6(r0, 0x0, 0x0) r1 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101080, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) syz_open_procfs(0x0, &(0x7f0000000440)='net/rt6_stats\x00') prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000000)=0x200000000) write$vhost_msg_v2(r3, 0x0, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000000c0)=0xe) r5 = socket$inet_sctp(0x2, 0x1, 0x84) r6 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r6, 0x0, 0x482, &(0x7f00000000c0)={0x84, @multicast2, 0x4e22, 0x3, 'rr\x00', 0x1e, 0x4, 0x68}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r6, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010101, 0x4e21, 0x3, 'lc\x00', 0x11, 0x3240, 0x3d}, {@loopback, 0x4e23, 0x4, 0x8628, 0x12d5c, 0x12d5c}}, 0x44) setsockopt$IP_VS_SO_SET_DELDEST(r5, 0x0, 0x488, &(0x7f0000000280)={{0x84, @empty, 0x4e20, 0x3, 'lblc\x00', 0x1d, 0x2, 0x2a}, {@loopback, 0x4e23, 0x10000, 0xc24, 0x9, 0xfffffffc}}, 0x44) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000140)={'8255\x00', [0x3, 0xfffffffc, 0x5, 0x4, 0x2f, 0xfffffff7, 0x8001, 0xa22, 0xfffffff8, 0x2, 0xfffffffc, 0xc3, 0x5006, 0x1000007, 0x1, 0x10003, 0x801000, 0x7fffffff, 0x1ff, 0x3ff, 0x1001010, 0x1ff, 0x8, 0x3, 0x8001, 0x7, 0x3ff, 0x5, 0x404, 0x3, 0xfffd]}) syz_80211_inject_frame(&(0x7f00000000c0)=@device_b, &(0x7f0000000800)=ANY=[@ANYRES8=r2], 0x525) sendmsg$NFT_MSG_GETFLOWTABLE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x17, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x5}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x2000000) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000780)='./cgroup.net/syz1\x00', 0x200002, 0x0) openat$cgroup_ro(r7, &(0x7f00000007c0)='memory.events\x00', 0x275a, 0x0) 1m11.065897095s ago: executing program 4 (id=5392): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x40008, 0x7fffffff}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x9) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0xfffffffffffffccc, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f0000000100), 0xdc, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000140), 0x200000001003, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) 1m10.664614921s ago: executing program 33 (id=5392): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x40008, 0x7fffffff}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x9) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0xfffffffffffffccc, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f0000000100), 0xdc, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000140), 0x200000001003, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) 12.569513939s ago: executing program 5 (id=5553): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$inet(0x2, 0x3, 0x4) open_by_handle_at(0xffffffffffffffff, 0x0, 0x4f0280) setsockopt$inet_opts(r4, 0x0, 0x4, &(0x7f0000000400)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f00000000c0)='xfrm0\x00', 0x10) sendmmsg$inet(r4, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}], 0x68000, 0x0) 11.421682263s ago: executing program 5 (id=5556): bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) openat$comedi(0xffffffffffffff9c, 0x0, 0x88000, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) mlockall(0x2) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='quota,grpquota_block_har']) chdir(&(0x7f0000000100)='./file0\x00') setresuid(0x0, 0xee00, 0x0) symlink(&(0x7f0000000940)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000840)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') 8.985727644s ago: executing program 1 (id=5563): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b30, &(0x7f00000000c0)={'wlan0\x00'}) 8.806864021s ago: executing program 1 (id=5566): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r0, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0x9}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x7000002, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = open(&(0x7f0000000280)='.\x00', 0x0, 0x109) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) socket$nl_netfilter(0x10, 0x3, 0xc) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x18a42000) fremovexattr(r1, &(0x7f0000000000)=@known='system.posix_acl_default\x00') creat(&(0x7f00000005c0)='./file0\x00', 0x0) 8.458791403s ago: executing program 2 (id=5567): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x2010, r0, 0xa94000) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000dc0)={0x38, 0x5, 0x8, 0x9, 0x0, 0x9, 0x0, 0xaa, 0xfa11, 0xffffffff}, 0x0) ioctl$CEC_TRANSMIT(0xffffffffffffffff, 0xc0386105, &(0x7f0000000280)={0x40000000001, 0x1, 0x100004, 0xfff, 0xfffffff5, 0x5, "0f6d00", 0x0, 0x5, 0x0, 0x4, 0x0, 0x4, 0xff}) fsopen(0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={0x0, 0x10}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x4, 0x0, 0xfffffffffffffffc, 0x0, 0x6}, {0x0, 0x0, 0x400000000}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in6=@empty, 0x0, 0x32}, 0x0, @in=@private=0xa010101, 0x0, 0x0, 0x0, 0xb7, 0x8, 0xfffffffe}}, 0xe8) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x1c) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) 7.154698795s ago: executing program 5 (id=5572): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000080)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) bind(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x5) write$tun(r0, &(0x7f0000000200)=ANY=[], 0x4a) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000e00)=@newtaction={0x60, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x4c, 0x1, [@m_sample={0x48, 0x1, 0x0, 0x0, {{0xb}, {0x4e, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PARMS={0x18, 0x2, {0x9, 0x0, 0x10000000, 0x0, 0x3ff}}]}, {0x4}, {0xc}, {0xc, 0x4}}}]}]}, 0x60}}, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x3, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) r4 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r4, 0x0, 0x48b, &(0x7f0000000000)={0x2, 'ip6gretap0\x00', 0x4}, 0x18) 5.215500747s ago: executing program 1 (id=5577): bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) openat$comedi(0xffffffffffffff9c, 0x0, 0x88000, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) mlockall(0x2) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='quota,grpquota_block_hardlimit=3']) chdir(&(0x7f0000000100)='./file0\x00') symlink(&(0x7f0000000940)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000840)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x103042, 0x0) shmctl$SHM_LOCK(0x0, 0xb) shmat(0x0, &(0x7f0000ffd000/0x1000)=nil, 0x7000) shmctl$SHM_UNLOCK(0x0, 0xc) r1 = socket(0x40000000015, 0x5, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x41000004, &(0x7f0000000040)) bind$inet(r1, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) socket$inet(0x2, 0x5, 0xc) close(r1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x3, &(0x7f0000000240)) 5.058675083s ago: executing program 2 (id=5579): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x12, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0, 0x0, 0x0, 0x0, 0x4000000}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x66, 0x8, 0x0, 0x0, 0xfffffffe}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, @exit, @printk={@x, {}, {}, {}, {}, {0x5, 0x0, 0xb, 0xa, 0x0, 0xfffd}}]}, &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0xc}, 0x94) 4.628834291s ago: executing program 2 (id=5583): r0 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r0, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0x0, 0x4}, 0x20) connect$l2tp6(r0, &(0x7f0000000040)={0xa, 0x0, 0x10803, @remote, 0x5, 0xfffffffe}, 0x20) r1 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101080, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) syz_open_procfs(0x0, &(0x7f0000000440)='net/rt6_stats\x00') prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000000)=0x200000000) write$vhost_msg_v2(r3, 0x0, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000000c0)=0xe) r5 = socket$inet_sctp(0x2, 0x1, 0x84) r6 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r6, 0x0, 0x482, &(0x7f00000000c0)={0x84, @multicast2, 0x4e22, 0x3, 'rr\x00', 0x1e, 0x4, 0x68}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r6, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010101, 0x4e21, 0x3, 'lc\x00', 0x11, 0x3240, 0x3d}, {@loopback, 0x4e23, 0x4, 0x8628, 0x12d5c, 0x12d5c}}, 0x44) setsockopt$IP_VS_SO_SET_DELDEST(r5, 0x0, 0x488, &(0x7f0000000280)={{0x84, @empty, 0x4e20, 0x3, 'lblc\x00', 0x1d, 0x2, 0x2a}, {@loopback, 0x4e23, 0x10000, 0xc24, 0x9, 0xfffffffc}}, 0x44) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000140)={'8255\x00', [0x3, 0xfffffffc, 0x5, 0x4, 0x2f, 0xfffffff7, 0x8001, 0xa22, 0xfffffff8, 0x2, 0xfffffffc, 0xc3, 0x5006, 0x1000007, 0x1, 0x10003, 0x801000, 0x7fffffff, 0x1ff, 0x3ff, 0x1001010, 0x1ff, 0x8, 0x3, 0x8001, 0x7, 0x3ff, 0x5, 0x404, 0x3, 0xfffd]}) syz_80211_inject_frame(&(0x7f00000000c0)=@device_b, &(0x7f0000000800)=ANY=[@ANYRES8=r2], 0x525) sendmsg$NFT_MSG_GETFLOWTABLE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x17, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x5}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x2000000) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000780)='./cgroup.net/syz1\x00', 0x200002, 0x0) openat$cgroup_ro(r7, &(0x7f00000007c0)='memory.events\x00', 0x275a, 0x0) 4.624310483s ago: executing program 5 (id=5584): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'bond0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x40, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x21}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @hsr={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_HSR_SLAVE1={0x8, 0x1, r1}, @IFLA_HSR_SLAVE2={0x8, 0x2, r2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'macvlan0\x00'}) r3 = socket(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f0000000000), 0x4000000000001f2, 0x0) 3.872744908s ago: executing program 1 (id=5587): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) r0 = socket$rds(0x15, 0x5, 0x0) syz_open_pts(0xffffffffffffffff, 0x81) syz_open_dev$sg(0x0, 0x0, 0x8002) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0xf0) pread64(r0, &(0x7f00000003c0)=""/53, 0x35, 0x1) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x3, @raw_data="dea233684c996156af0d4bd8e3300217e750b8c97b7123d48003e7e1d3be5f710c41a1db6719881876e9bcc6e2f73c67cc6b675eb43188b5b7f9f898868de9a9c5d536d418ba283121a7565aba55a87d2a251c295f4492bbde02ad8bc8e88779f2de06f38e99172df4d45b6f13c813dee4230c204a93172922b778fef7a1f89ce876bb89d44cd705bbb28db4869dfac20d928950507a0592c02d17f51b0a627539f6e0a0bdb92004bc6252cd35e8cd106926acb583ad63a4e7e1ca17c1b6aac63fefa9dcbe429d00"}) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) socket(0xa, 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x20024090) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SYNC_IOC_MERGE(0xffffffffffffffff, 0xc0303e03, &(0x7f00000000c0)={"ff87c89d4e3e6bd4ae7ee3551b880c0ac56cb2a58b7da498a7045278c8043bbe"}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x6c, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x2c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2=0xe0000001}, {0x8, 0x2, @dev}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x3}]}, 0x6c}}, 0x0) 3.301844353s ago: executing program 6 (id=5588): setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000080), 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f00000005c0)='fd', 0x0, r0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x1, 0x2) fchdir(r2) r3 = open(&(0x7f0000000000)='.\x00', 0x0, 0x244) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(0x0, r4) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r3, 0x9362, 0x0) 3.223344839s ago: executing program 5 (id=5589): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x2010, r0, 0xa94000) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000dc0)={0x38, 0x5, 0x8, 0x9, 0x0, 0x9, 0x0, 0xaa, 0xfa11, 0xffffffff}, 0x0) ioctl$CEC_TRANSMIT(0xffffffffffffffff, 0xc0386105, &(0x7f0000000280)={0x40000000001, 0x1, 0x100004, 0xfff, 0xfffffff5, 0x5, "0f6d00", 0x0, 0x5, 0x0, 0x4, 0x0, 0x4, 0xff}) fsopen(0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={0x0, 0x10}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x4, 0x0, 0xfffffffffffffffc, 0x0, 0x6}, {0x0, 0x0, 0x400000000}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in6=@empty, 0x0, 0x32}, 0x0, @in=@private=0xa010101, 0x0, 0x0, 0x0, 0xb7, 0x8, 0xfffffffe}}, 0xe8) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x1c) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) 3.129328609s ago: executing program 3 (id=5590): openat$drirender128(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f00000001c0), 0x2) memfd_create(&(0x7f0000000500)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\xea7\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\x0f<\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xd9w\\\xf8\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xcd\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00\xd5\xf3\\\x00\xbe]Et\xad*\xecj\x02\xc8\xc4\f\x04\x99\xf6\xfc', 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141002) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$kcm(0x21, 0x2, 0x2) openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) pselect6(0x40, &(0x7f0000000440)={0x6, 0x0, 0x4850, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0x2, 0x9, 0xfffffffffffffffd, 0x100000000000a, 0x80000006, 0x400}, 0x0, 0x0) ioctl$UDMABUF_CREATE(r0, 0x40187542, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) 2.70895417s ago: executing program 6 (id=5591): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) r0 = socket$rds(0x15, 0x5, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0xf0) pread64(r0, &(0x7f00000003c0)=""/53, 0x35, 0x1) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x3, @raw_data="dea233684c996156af0d4bd8e3300217e750b8c97b7123d48003e7e1d3be5f710c41a1db6719881876e9bcc6e2f73c67cc6b675eb43188b5b7f9f898868de9a9c5d536d418ba283121a7565aba55a87d2a251c295f4492bbde02ad8bc8e88779f2de06f38e99172df4d45b6f13c813dee4230c204a93172922b778fef7a1f89ce876bb89d44cd705bbb28db4869dfac20d928950507a0592c02d17f51b0a627539f6e0a0bdb92004bc6252cd35e8cd106926acb583ad63a4e7e1ca17c1b6aac63fefa9dcbe429d00"}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'lo\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x20024090) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x15, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="180000000a0000000000009500"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x6c, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x2c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2=0xe0000001}, {0x8, 0x2, @dev}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x3}]}, 0x6c}}, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000280)={'erspan0\x00', &(0x7f0000000000)={'syztnl2\x00', r3, 0x7, 0x7800, 0x67a, 0x7, {{0x6, 0x4, 0x2, 0x29, 0x18, 0x64, 0x0, 0x6, 0x2f, 0x0, @remote, @remote, {[@ra={0x94, 0xffffff2d}]}}}}}) bind$rds(r0, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r0, &(0x7f0000000800)={&(0x7f0000000040)={0x2, 0x4e23, @loopback}, 0x10, 0x0, 0x0, &(0x7f0000000740)=[@mask_cswp={0x58, 0x114, 0x9, {{0x1, 0x80200000}, 0x0, 0x0, 0xfffffffffffffff8, 0xff, 0x9, 0xffffffffffffffff, 0x40, 0x4}}], 0x58, 0x4044004}, 0x40) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) 2.643180133s ago: executing program 2 (id=5592): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000380)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) bpf$BPF_LINK_CREATE_XDP(0x9, 0x0, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) bind$xdp(r1, &(0x7f0000000100)={0x2c, 0xa}, 0x10) wait4(0x0, 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_io_uring_setup(0x27c8, &(0x7f0000000540)={0x0, 0x800069ea, 0x3000, 0x3, 0x8000d}, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f0000000280)=@IORING_OP_WRITE={0x17, 0x0, 0x6000, @fd_index=0x8, 0x1, 0x0, 0x0, 0x14, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r2, 0x1, 0x1, 0x1, 0x0, 0x0) 2.591169825s ago: executing program 1 (id=5593): r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$VIDIOC_G_CROP(r0, 0xc014563b, &(0x7f0000000140)={0x5, {0x0, 0x40, 0x7, 0xffffffff}}) 1.854600961s ago: executing program 1 (id=5594): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000080)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) bind(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x5) write$tun(r0, &(0x7f0000000200)=ANY=[], 0x4a) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000e00)=@newtaction={0x60, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x4c, 0x1, [@m_sample={0x48, 0x1, 0x0, 0x0, {{0xb}, {0x4e, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PARMS={0x18, 0x2, {0x9, 0x0, 0x10000000, 0x0, 0x3ff}}]}, {0x4}, {0xc}, {0xc, 0x4}}}]}]}, 0x60}}, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x3, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) r4 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r4, 0x0, 0x48b, &(0x7f0000000000)={0x2, 'ip6gretap0\x00', 0x4}, 0x18) 1.743288448s ago: executing program 6 (id=5595): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x12, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0, 0x0, 0x0, 0x0, 0x4000000}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x66, 0x8, 0x0, 0x0, 0xfffffffe}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, @exit, @printk={@x, {}, {}, {}, {}, {0x5, 0x0, 0xb, 0xa, 0x0, 0xfffd}}]}, &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0xc}, 0x94) 1.598789526s ago: executing program 3 (id=5596): r0 = socket(0xa, 0x1, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'lo\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="300000001c00070c2bbd7000000000000200", @ANYRES32=r2, @ANYBLOB="4000100a14000100009a"], 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x20024090) 1.519407306s ago: executing program 3 (id=5597): r0 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x4c0142, 0x163) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) connect$nfc_raw(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) bind$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x310, 0x9, 0x0, 0x81, 0x42}, 0xffffffffffffff7c) getsockname$llc(0xffffffffffffffff, 0x0, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r2, r2, 0x0, 0x200000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='personality\x00') r3 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x3}, &(0x7f0000000140)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000000c0)=0x0) syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x4}}}, &(0x7f0000000300)) lseek(r3, 0x8000000010007, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0xa4242, 0x0) close(r2) 1.471727701s ago: executing program 2 (id=5598): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000640)=""/88, 0x58}, {&(0x7f0000000740)=""/105, 0xfffffe0b}], 0x2}, 0x0) 1.451816996s ago: executing program 6 (id=5599): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'bond0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x40, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x21}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @hsr={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_HSR_SLAVE1={0x8, 0x1, r1}, @IFLA_HSR_SLAVE2={0x8, 0x2, r2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'macvlan0\x00'}) r3 = socket(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f0000000000), 0x4000000000001f2, 0x0) 1.30926681s ago: executing program 2 (id=5600): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) r0 = socket$rds(0x15, 0x5, 0x0) syz_open_pts(0xffffffffffffffff, 0x81) syz_open_dev$sg(0x0, 0x0, 0x8002) pread64(r0, &(0x7f00000003c0)=""/53, 0x35, 0x1) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'lo\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x20024090) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x15, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="180000000a0000000000009500"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SYNC_IOC_MERGE(0xffffffffffffffff, 0xc0303e03, &(0x7f00000000c0)={"ff87c89d4e3e6bd4ae7ee3551b880c0ac56cb2a58b7da498a7045278c8043bbe"}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x6c, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x2c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2=0xe0000001}, {0x8, 0x2, @dev}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x3}]}, 0x6c}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000280)={'erspan0\x00', &(0x7f0000000000)={'syztnl2\x00', r2, 0x7, 0x7800, 0x67a, 0x7, {{0x6, 0x4, 0x2, 0x29, 0x18, 0x64, 0x0, 0x6, 0x2f, 0x0, @remote, @remote, {[@ra={0x94, 0xffffff2d}]}}}}}) bind$rds(r0, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r0, &(0x7f0000000800)={&(0x7f0000000040)={0x2, 0x4e23, @loopback}, 0x10, 0x0, 0x0, &(0x7f0000000740)=[@mask_cswp={0x58, 0x114, 0x9, {{0x1, 0x80200000}, 0x0, 0x0, 0xfffffffffffffff8, 0xff, 0x9, 0xffffffffffffffff, 0x40, 0x4}}], 0x58, 0x4044004}, 0x40) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) 1.18236128s ago: executing program 3 (id=5601): setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000080), 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f00000005c0)='fd', 0x0, r0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x1, 0x2) fchdir(r2) r3 = open(&(0x7f0000000000)='.\x00', 0x0, 0x244) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(0x0, r4) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r3, 0x9362, 0x0) 1.154474333s ago: executing program 6 (id=5602): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$MAP_CREATE(0x0, 0x0, 0x48) socket$unix(0x1, 0x1, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) read$msr(0xffffffffffffffff, 0x0, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TCSETSW2(r1, 0x5453, 0x0) 1.015425966s ago: executing program 3 (id=5603): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb70200"], 0x0, 0x10000, 0x0, 0x0, 0x41000, 0x1c, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000001b40)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000007008500000004"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r0}, 0xc) syz_emit_vhci(&(0x7f0000000d40)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x7}, @hci_rp_read_class_of_dev={{0x2}, {0x0, "afaeb0"}}}}, 0xa) 658.411063ms ago: executing program 5 (id=5604): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) write$binfmt_aout(r0, &(0x7f0000000100)=ANY=[], 0xff2e) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) read$FUSE(r2, &(0x7f0000005fc0)={0x2020}, 0x2020) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000080)="303030303a303073075585bf323f7c7f2553a6cf6223", 0x16) close(0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) connect$unix(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./my_configfs\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/functions/obex.usb1\x00', 0x1ff) rmdir(&(0x7f0000000440)='./my_configfs/usb_gadget/g1/functions/obex.usb1\x00') socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000019080)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="8f"], 0x10}}, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00') pread64(r4, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200) munlock(&(0x7f00000ef000/0x1000)=nil, 0x1000) 176.819064ms ago: executing program 6 (id=5605): r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$VIDIOC_G_CROP(r0, 0xc014563b, &(0x7f0000000140)={0x5, {0x0, 0x40, 0x7, 0xffffffff}}) 0s ago: executing program 3 (id=5606): openat$drirender128(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f00000001c0), 0x2) memfd_create(&(0x7f0000000500)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\xea7\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\x0f<\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xd9w\\\xf8\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xcd\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00\xd5\xf3\\\x00\xbe]Et\xad*\xecj\x02\xc8\xc4\f\x04\x99\xf6\xfc', 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141002) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$kcm(0x21, 0x2, 0x2) openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) pselect6(0x40, &(0x7f0000000440)={0x6, 0x0, 0x4850, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0x2, 0x9, 0xfffffffffffffffd, 0x100000000000a, 0x80000006, 0x400}, 0x0, 0x0) ioctl$UDMABUF_CREATE(r0, 0x40187542, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): T15564] usb 3-1: Product: syz [ 1521.185788][T15564] usb 3-1: Manufacturer: syz [ 1521.201582][T15564] usb 3-1: SerialNumber: syz [ 1521.764849][T23352] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 1521.777216][T23352] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 1522.442705][T23352] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000000. ret = -EPIPE [ 1522.454850][T23352] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1522.464893][T23352] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1522.496616][T23352] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -32 [ 1522.517631][T15564] usb 3-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 1522.532922][T15564] usb 3-1: clock source 0 is not valid, cannot use [ 1522.542072][T25804] comedi comedi0: 8255: I/O base address not correctly aligned [ 1522.550530][T15564] usb 3-1: 1:1: cannot get freq (v2/v3): err -71 [ 1522.557470][T15564] usb 3-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 1522.560545][T25804] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1522.623767][T15564] usb 3-1: USB disconnect, device number 111 [ 1523.497460][T15564] usb 4-1: USB disconnect, device number 47 [ 1524.012246][T25828] misc userio: Invalid payload size [ 1525.639810][T25839] misc userio: Invalid payload size [ 1525.874866][T25849] FAULT_INJECTION: forcing a failure. [ 1525.874866][T25849] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1525.978047][T25849] CPU: 0 UID: 0 PID: 25849 Comm: syz.5.4941 Tainted: G L syzkaller #0 PREEMPT(full) [ 1525.978082][T25849] Tainted: [L]=SOFTLOCKUP [ 1525.978089][T25849] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1525.978100][T25849] Call Trace: [ 1525.978107][T25849] [ 1525.978116][T25849] dump_stack_lvl+0x100/0x190 [ 1525.978144][T25849] should_fail_ex.cold+0x5/0xa [ 1525.978168][T25849] _copy_from_user+0x2e/0xd0 [ 1525.978195][T25849] ucma_create_id+0xcd/0x380 [ 1525.978216][T25849] ? __pfx_ucma_create_id+0x10/0x10 [ 1525.978234][T25849] ? __might_fault+0xc5/0x140 [ 1525.978260][T25849] ? __pfx_ucma_create_id+0x10/0x10 [ 1525.978280][T25849] ucma_write+0x1fb/0x330 [ 1525.978308][T25849] ? __pfx_ucma_write+0x10/0x10 [ 1525.978337][T25849] ? vfs_writev+0x2d3/0xdd0 [ 1525.978366][T25849] ? __pfx_ucma_write+0x10/0x10 [ 1525.978392][T25849] vfs_writev+0x5ed/0xdd0 [ 1525.978424][T25849] ? rcu_is_watching+0x12/0xc0 [ 1525.978458][T25849] ? __pfx_vfs_writev+0x10/0x10 [ 1525.978486][T25849] ? rcu_read_lock_any_held+0x6a/0xa0 [ 1525.978519][T25849] ? __fget_files+0x21f/0x3d0 [ 1525.978545][T25849] ? do_writev+0x28a/0x340 [ 1525.978570][T25849] do_writev+0x28a/0x340 [ 1525.978596][T25849] ? __pfx_do_writev+0x10/0x10 [ 1525.978628][T25849] do_syscall_64+0x115/0x870 [ 1525.978651][T25849] ? clear_bhb_loop+0x40/0x90 [ 1525.978674][T25849] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1525.978694][T25849] RIP: 0033:0x7fb72c99e019 [ 1525.978710][T25849] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1525.978727][T25849] RSP: 002b:00007fb72d7fd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 1525.978746][T25849] RAX: ffffffffffffffda RBX: 00007fb72cc25fa0 RCX: 00007fb72c99e019 [ 1525.978758][T25849] RDX: 0000000000000002 RSI: 0000200000000040 RDI: 0000000000000009 [ 1525.978769][T25849] RBP: 00007fb72d7fd090 R08: 0000000000000000 R09: 0000000000000000 [ 1525.978780][T25849] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1525.978791][T25849] R13: 00007fb72cc26038 R14: 00007fb72cc25fa0 R15: 00007ffebd321f08 [ 1525.978816][T25849] [ 1528.699451][T23348] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 1529.328660][T25876] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4948'. [ 1529.337791][T25876] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1529.431864][T23348] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1529.463566][T25883] comedi comedi0: 8255: I/O base address not correctly aligned [ 1529.473210][T25883] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1529.837156][T23348] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1529.850842][T23348] usb 5-1: Product: syz [ 1529.855131][T23348] usb 5-1: Manufacturer: syz [ 1529.859888][T23348] usb 5-1: SerialNumber: syz [ 1530.259246][T25899] netlink: 'syz.3.4953': attribute type 4 has an invalid length. [ 1530.373849][ T29] audit: type=1400 audit(1785791893.106:1252): avc: denied { getopt } for pid=25902 comm="syz.5.4955" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1530.597211][T23348] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 1530.625623][T23348] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 1530.633006][T25911] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4957'. [ 1530.648298][T25911] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1530.666894][T25916] comedi comedi0: 8255: I/O base address not correctly aligned [ 1530.676702][T25916] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1531.267393][T23348] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000000. ret = -EPIPE [ 1531.296867][T23348] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1531.313151][T23348] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1531.325403][T23348] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -32 [ 1531.601762][T23355] usb 6-1: new full-speed USB device number 77 using dummy_hcd [ 1532.026685][T15564] usb 2-1: new low-speed USB device number 21 using dummy_hcd [ 1532.051331][T23355] usb 6-1: config 0 has an invalid interface number: 205 but max is 0 [ 1532.062225][T23355] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1532.072595][T23355] usb 6-1: config 0 has no interface number 0 [ 1532.078733][T23355] usb 6-1: config 0 interface 205 has no altsetting 0 [ 1532.092839][T23355] usb 6-1: New USB device found, idVendor=1822, idProduct=3202, bcdDevice=13.4a [ 1532.102260][T23355] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1532.110543][T23355] usb 6-1: Product: syz [ 1532.114862][T23355] usb 6-1: Manufacturer: syz [ 1532.119944][T23355] usb 6-1: SerialNumber: syz [ 1532.126293][T23355] usb 6-1: config 0 descriptor?? [ 1532.199009][T15564] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 1532.206968][T23355] dvb-usb: found a 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' in warm state. [ 1532.224872][T23355] dvb-usb: bulk message failed: -22 (3/0) [ 1532.243887][T15564] usb 2-1: config 0 has no interface number 0 [ 1532.255524][T23355] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1532.268778][T23355] dvbdev: DVB: registering new adapter (TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device) [ 1532.275350][T15564] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1532.293608][T15564] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 1532.337651][T15564] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1532.369420][T23355] usb 6-1: media controller created [ 1532.375837][T23355] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1532.389263][T15564] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1532.401836][T23355] dvb-usb: bulk message failed: -22 (6/0) [ 1532.407737][T23355] dvb-usb: no frontend was attached by 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' [ 1532.409661][T24036] usb 5-1: USB disconnect, device number 6 [ 1532.422082][T23355] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input303 [ 1532.438812][T23355] dvb-usb: schedule remote query interval to 150 msecs. [ 1533.115604][T15564] usb 2-1: config 0 descriptor?? [ 1533.306307][T25929] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 1533.329408][T15564] iowarrior 2-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1533.353459][T23355] dvb-usb: bulk message failed: -22 (3/0) [ 1533.401807][T23355] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device successfully initialized and connected. [ 1533.509385][T23348] dvb-usb: bulk message failed: -22 (1/0) [ 1533.693210][T23348] dvb-usb: error while querying for an remote control event. [ 1534.114027][T23348] dvb-usb: bulk message failed: -22 (1/0) [ 1534.121391][T23355] usb 2-1: USB disconnect, device number 21 [ 1534.145153][T23348] dvb-usb: error while querying for an remote control event. [ 1534.300778][T25958] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4970'. [ 1534.331778][T23348] dvb-usb: bulk message failed: -22 (1/0) [ 1534.376685][T25958] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1534.389548][T25967] misc userio: Invalid payload size [ 1534.470394][T15564] usb 6-1: USB disconnect, device number 77 [ 1534.684599][T23348] dvb-usb: error while querying for an remote control event. [ 1534.935203][T25970] comedi comedi0: 8255: I/O base address not correctly aligned [ 1534.945299][T25970] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1535.980091][T25981] misc userio: Invalid payload size [ 1536.179052][T15564] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I successfully deinitialized and disconnected. [ 1536.649177][T15564] usb 6-1: new high-speed USB device number 78 using dummy_hcd [ 1536.761888][T25989] misc userio: Invalid payload size [ 1537.528990][T15564] usb 6-1: Using ep0 maxpacket: 8 [ 1538.645243][T15564] usb 6-1: device descriptor read/all, error -71 [ 1538.805035][T25998] Driver unsupported XDP return value 0 on prog (id 30) dev N/A, expect packet loss! [ 1538.894100][T25999] fuse: Unknown parameter ' ' [ 1539.029774][T15564] usb 6-1: new high-speed USB device number 79 using dummy_hcd [ 1539.278984][T15564] usb 6-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1539.290056][ T29] audit: type=1400 audit(1785791901.536:1253): avc: denied { bind } for pid=25997 comm="syz.4.4980" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 1539.388342][T15564] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1539.402052][T15564] usb 6-1: Product: syz [ 1539.406321][T15564] usb 6-1: Manufacturer: syz [ 1539.468473][T15564] usb 6-1: SerialNumber: syz [ 1539.812805][T26004] misc userio: Invalid payload size [ 1540.069099][T23362] usb 2-1: new full-speed USB device number 22 using dummy_hcd [ 1540.214679][T15564] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 1540.370735][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 1540.377091][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 1540.840489][T15564] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 1540.858069][T26018] comedi comedi0: 8255: I/O base address not correctly aligned [ 1540.925535][T26018] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1541.005608][T23362] usb 2-1: config 0 has an invalid interface number: 205 but max is 0 [ 1541.048250][T23362] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1541.101682][T23362] usb 2-1: config 0 has no interface number 0 [ 1541.331590][T15564] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x0000011c. ret = -EPIPE [ 1541.344521][T23362] usb 2-1: config 0 interface 205 has no altsetting 0 [ 1541.384980][T23362] usb 2-1: New USB device found, idVendor=1822, idProduct=3202, bcdDevice=13.4a [ 1541.403524][T15564] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1541.442608][T23362] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1541.476330][T15564] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1541.498503][T23362] usb 2-1: Product: syz [ 1541.523015][T23362] usb 2-1: Manufacturer: syz [ 1541.613216][T23362] usb 2-1: SerialNumber: syz [ 1541.627637][T15564] lan78xx 6-1:1.0: probe with driver lan78xx failed with error -32 [ 1542.085335][T23362] usb 2-1: config 0 descriptor?? [ 1542.105286][T23362] dvb-usb: found a 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' in warm state. [ 1542.117078][T23362] dvb-usb: bulk message failed: -22 (3/0) [ 1542.124747][T26024] netlink: 'syz.2.4987': attribute type 4 has an invalid length. [ 1542.140760][T23362] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1542.153717][T23362] dvbdev: DVB: registering new adapter (TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device) [ 1542.183710][T23362] usb 2-1: media controller created [ 1542.204693][T23362] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1542.508730][T23362] dvb-usb: bulk message failed: -22 (6/0) [ 1542.565203][T23366] usb 6-1: USB disconnect, device number 79 [ 1542.577445][T23362] dvb-usb: no frontend was attached by 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' [ 1543.012081][T23362] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input304 [ 1543.264095][T23362] dvb-usb: schedule remote query interval to 150 msecs. [ 1543.346360][T23362] dvb-usb: bulk message failed: -22 (3/0) [ 1543.413188][T23362] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device successfully initialized and connected. [ 1543.499605][T23366] dvb-usb: bulk message failed: -22 (1/0) [ 1543.538767][T23366] dvb-usb: error while querying for an remote control event. [ 1543.753633][T23366] usb 2-1: USB disconnect, device number 22 [ 1543.806604][T23366] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I successfully deinitialized and disconnected. [ 1543.855613][T26042] netlink: 'syz.1.4991': attribute type 4 has an invalid length. [ 1544.393224][T26052] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4994'. [ 1544.439538][T26052] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1544.768838][ T29] audit: type=1400 audit(1785791907.496:1254): avc: denied { bind } for pid=26059 comm="syz.1.4997" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1546.661826][ T29] audit: type=1400 audit(1785791907.546:1255): avc: denied { connect } for pid=26059 comm="syz.1.4997" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1546.774006][T26075] netlink: 'syz.2.4998': attribute type 4 has an invalid length. [ 1546.872823][ T29] audit: type=1400 audit(1785791909.606:1256): avc: denied { setopt } for pid=26059 comm="syz.1.4997" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 1546.905862][T26060] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4997'. [ 1547.219260][T23348] usb 6-1: new high-speed USB device number 80 using dummy_hcd [ 1547.417072][T26084] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5001'. [ 1547.418176][T23348] usb 6-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1547.438203][T23348] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1547.452444][T23348] usb 6-1: Product: syz [ 1547.456669][T23348] usb 6-1: Manufacturer: syz [ 1547.463090][T23348] usb 6-1: SerialNumber: syz [ 1548.067411][T26094] comedi comedi0: 8255: I/O base address not correctly aligned [ 1548.077566][T26094] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1548.267794][T26102] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5007'. [ 1548.282168][T26102] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1548.357052][T23348] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 1548.371615][T23348] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 1548.663739][ T29] audit: type=1400 audit(1785791911.396:1257): avc: denied { map } for pid=26110 comm="syz.2.5009" path="socket:[83118]" dev="sockfs" ino=83118 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 1548.763823][T26112] befs: (nbd2): No write support. Marking filesystem read-only [ 1548.917778][ T29] audit: type=1400 audit(1785791911.646:1258): avc: denied { name_bind } for pid=26110 comm="syz.2.5009" src=65530 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=rawip_socket permissive=1 [ 1549.185818][T23348] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x0000011c. ret = -EPIPE [ 1549.197912][T23348] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1549.208562][T23348] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1549.223568][T23348] lan78xx 6-1:1.0: probe with driver lan78xx failed with error -32 [ 1549.250091][T23366] usb 3-1: new high-speed USB device number 112 using dummy_hcd [ 1549.260727][T26126] netlink: 68 bytes leftover after parsing attributes in process `syz.1.5014'. [ 1549.484039][T23366] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1549.504959][T23366] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1549.525959][T23366] usb 3-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 1549.548383][T23366] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1549.829551][T23366] usb 3-1: config 0 descriptor?? [ 1549.938715][T26140] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5019'. [ 1549.949724][T26140] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1549.998347][T26140] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5019'. [ 1550.017375][T26140] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1550.050498][T23366] usbhid 3-1:0.0: can't add hid device: -71 [ 1550.061861][T23366] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1550.075953][T23366] usb 3-1: USB disconnect, device number 112 [ 1550.241949][T15564] usb 6-1: USB disconnect, device number 80 [ 1550.598480][T26161] binder: 26158:26161 ioctl 400c620e 200000003b00 returned -22 [ 1550.683228][ T29] audit: type=1400 audit(1785791913.416:1259): avc: denied { mounton } for pid=26162 comm="syz.5.5025" path="/174/sec/tomoyo/profile" dev="securityfs" ino=1090 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=file permissive=1 [ 1550.725609][T26163] 9p: Could not find request transport: xen [ 1551.471264][T23355] usb 3-1: new low-speed USB device number 113 using dummy_hcd [ 1551.676103][T23355] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 1552.071185][T23355] usb 3-1: config 0 has no interface number 0 [ 1552.084640][T23355] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1552.096889][T23355] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 1552.109198][T23355] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1552.120144][T23355] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1552.133258][T23355] usb 3-1: config 0 descriptor?? [ 1552.136824][ T29] audit: type=1326 audit(1785791914.866:1260): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=26166 comm="syz.5.5026" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fb72c99e019 code=0x0 [ 1552.139394][T26173] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1552.186610][T23355] iowarrior 3-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1553.400508][T23355] usb 3-1: USB disconnect, device number 113 [ 1553.426275][T26199] netlink: 'syz.3.5035': attribute type 4 has an invalid length. [ 1554.922201][ T29] audit: type=1400 audit(1785791917.656:1261): avc: denied { name_bind } for pid=26220 comm="syz.4.5044" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 1555.879587][T26240] syz_tun: entered allmulticast mode [ 1556.281357][T26240] syz_tun: left allmulticast mode [ 1556.538707][T26243] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5046'. [ 1556.976404][T26262] FAULT_INJECTION: forcing a failure. [ 1556.976404][T26262] name failslab, interval 1, probability 0, space 0, times 0 [ 1557.054703][T26262] CPU: 1 UID: 0 PID: 26262 Comm: syz.1.5053 Tainted: G L syzkaller #0 PREEMPT(full) [ 1557.054734][T26262] Tainted: [L]=SOFTLOCKUP [ 1557.054741][T26262] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1557.054752][T26262] Call Trace: [ 1557.054759][T26262] [ 1557.054767][T26262] dump_stack_lvl+0x100/0x190 [ 1557.054796][T26262] should_fail_ex.cold+0x5/0xa [ 1557.054819][T26262] should_failslab+0xc2/0x120 [ 1557.054846][T26262] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 1557.054869][T26262] ? __alloc_skb+0x5b7/0x710 [ 1557.054892][T26262] ? __alloc_skb+0x140/0x710 [ 1557.054917][T26262] __alloc_skb+0x140/0x710 [ 1557.054938][T26262] ? __alloc_skb+0x5b7/0x710 [ 1557.054959][T26262] ? __pfx___alloc_skb+0x10/0x10 [ 1557.054988][T26262] netlink_alloc_large_skb+0x69/0x150 [ 1557.055011][T26262] netlink_sendmsg+0x680/0xda0 [ 1557.055034][T26262] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1557.055056][T26262] ? selinux_socket_sendmsg+0x198/0x2f0 [ 1557.055089][T26262] ____sys_sendmsg+0xa4d/0xbe0 [ 1557.055116][T26262] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1557.055138][T26262] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1557.055178][T26262] ___sys_sendmsg+0x190/0x1e0 [ 1557.055198][T26262] ? __pfx____sys_sendmsg+0x10/0x10 [ 1557.055215][T26262] ? __lock_acquire+0x49f/0x1a40 [ 1557.055238][T26262] ? get_pid_task+0x106/0x250 [ 1557.055281][T26262] __sys_sendmsg+0x160/0x210 [ 1557.055312][T26262] ? __pfx___sys_sendmsg+0x10/0x10 [ 1557.055349][T26262] do_syscall_64+0x115/0x870 [ 1557.055372][T26262] ? clear_bhb_loop+0x40/0x90 [ 1557.055395][T26262] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1557.055414][T26262] RIP: 0033:0x7fe35b39e019 [ 1557.055431][T26262] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1557.055447][T26262] RSP: 002b:00007fe35c2d0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1557.055465][T26262] RAX: ffffffffffffffda RBX: 00007fe35b625fa0 RCX: 00007fe35b39e019 [ 1557.055477][T26262] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 1557.055488][T26262] RBP: 00007fe35c2d0090 R08: 0000000000000000 R09: 0000000000000000 [ 1557.055499][T26262] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1557.055510][T26262] R13: 00007fe35b626038 R14: 00007fe35b625fa0 R15: 00007ffd609a9fc8 [ 1557.055534][T26262] [ 1557.863996][T26267] netlink: 'syz.2.5055': attribute type 4 has an invalid length. [ 1561.179605][T23348] usb 5-1: new full-speed USB device number 7 using dummy_hcd [ 1561.440009][T23362] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 1561.492276][T23348] usb 5-1: config 0 has an invalid interface number: 205 but max is 0 [ 1561.500918][T23348] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1561.512818][T23348] usb 5-1: config 0 has no interface number 0 [ 1561.519628][T23348] usb 5-1: config 0 interface 205 has no altsetting 0 [ 1561.531978][T23348] usb 5-1: New USB device found, idVendor=1822, idProduct=3202, bcdDevice=13.4a [ 1561.542500][T23348] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1561.619628][T23362] usb 2-1: Using ep0 maxpacket: 16 [ 1562.330085][T23362] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1562.340620][T23362] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1562.353264][T23362] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1562.795651][T26325] misc userio: Invalid payload size [ 1563.049855][T23348] usb 5-1: Product: syz [ 1563.055280][T23348] usb 5-1: Manufacturer: syz [ 1563.061775][T23348] usb 5-1: SerialNumber: syz [ 1563.074998][T23348] usb 5-1: config 0 descriptor?? [ 1563.168802][T23348] dvb-usb: found a 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' in warm state. [ 1563.454723][T23348] dvb-usb: bulk message failed: -22 (3/0) [ 1563.668027][T23362] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1563.705171][T23362] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1563.730704][T23362] usb 2-1: string descriptor 0 read error: -71 [ 1563.737017][T23362] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1563.746603][T23362] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1563.746881][T23348] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1563.764222][T23362] usb 2-1: config 0 descriptor?? [ 1563.770033][T23362] usb 2-1: can't set config #0, error -71 [ 1563.780469][T23362] usb 2-1: USB disconnect, device number 23 [ 1563.813626][T26333] netlink: 68 bytes leftover after parsing attributes in process `syz.5.5069'. [ 1563.958363][ T29] audit: type=1400 audit(1785791926.676:1262): avc: denied { ioctl } for pid=26332 comm="syz.5.5069" path="socket:[84013]" dev="sockfs" ino=84013 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 1564.120208][ T29] audit: type=1400 audit(1785791926.726:1263): avc: denied { create } for pid=26332 comm="syz.5.5069" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 1564.328555][ T29] audit: type=1400 audit(1785791926.736:1264): avc: denied { write } for pid=26332 comm="syz.5.5069" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 1564.761794][T23348] dvbdev: DVB: registering new adapter (TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device) [ 1564.773415][T23348] usb 5-1: media controller created [ 1564.780121][T23348] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1564.792827][T23348] dvb-usb: bulk message failed: -22 (6/0) [ 1564.798641][T23348] dvb-usb: no frontend was attached by 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' [ 1564.813484][T23348] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input307 [ 1564.826726][T23348] dvb-usb: schedule remote query interval to 150 msecs. [ 1564.895625][T23348] dvb-usb: bulk message failed: -22 (3/0) [ 1565.066174][T23355] dvb-usb: bulk message failed: -22 (1/0) [ 1565.079373][T23355] dvb-usb: error while querying for an remote control event. [ 1565.087137][T23348] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device successfully initialized and connected. [ 1565.163856][T23348] usb 5-1: USB disconnect, device number 7 [ 1566.634684][T23348] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I successfully deinitialized and disconnected. [ 1567.072643][ T29] audit: type=1400 audit(1785791929.806:1265): avc: denied { ioctl } for pid=26363 comm="syz.5.5077" path="socket:[83610]" dev="sockfs" ino=83610 ioctlcmd=0x5868 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1569.429653][T23362] usb 6-1: new high-speed USB device number 81 using dummy_hcd [ 1569.619093][T23362] usb 6-1: Using ep0 maxpacket: 16 [ 1569.625572][T23362] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1569.636416][T23362] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1569.647561][T23362] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1569.657419][T23362] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1569.667395][T23362] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1569.681550][T23362] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1569.690828][T23362] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1569.691913][ T29] audit: type=1400 audit(1785791932.416:1266): avc: denied { setopt } for pid=26393 comm="syz.4.5084" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1569.698841][T23362] usb 6-1: Manufacturer: syz [ 1569.723068][T26396] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5084'. [ 1569.761922][T26396] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5084'. [ 1570.240848][T26396] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5084'. [ 1570.441297][T23362] usb 6-1: config 0 descriptor?? [ 1570.504782][ T29] audit: type=1400 audit(1785791933.116:1267): avc: denied { ioctl } for pid=26393 comm="syz.4.5084" path="socket:[83724]" dev="sockfs" ino=83724 ioctlcmd=0x5838 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1570.735859][ T29] audit: type=1400 audit(1785791933.466:1268): avc: denied { getopt } for pid=26393 comm="syz.4.5084" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 1570.789935][T23362] rc_core: IR keymap rc-hauppauge not found [ 1570.816604][T23362] Registered IR keymap rc-empty [ 1570.839202][T23362] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1570.847634][T26396] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5084'. [ 1570.879071][ T29] audit: type=1400 audit(1785791933.606:1269): avc: denied { bind } for pid=26414 comm="syz.1.5087" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 1571.021960][T26396] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5084'. [ 1571.024713][T23362] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1571.192464][T26396] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5084'. [ 1571.220985][ T29] audit: type=1400 audit(1785791933.636:1270): avc: denied { listen } for pid=26414 comm="syz.1.5087" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 1571.242780][T23362] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 1571.281530][T15564] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 1571.310870][T23362] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input308 [ 1571.346188][T23362] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1571.379712][T23362] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1571.429046][T23362] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1571.469403][T23362] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1571.490240][T15564] usb 2-1: config 1 interface 0 altsetting 13 endpoint 0x81 has invalid maxpacket 16416, setting to 1024 [ 1571.519071][T23362] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1571.528988][T15564] usb 2-1: config 1 interface 0 altsetting 13 endpoint 0x2 has an invalid bInterval 32, changing to 9 [ 1571.557264][T15564] usb 2-1: config 1 interface 0 has no altsetting 0 [ 1571.563997][T23362] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1571.582404][ T29] audit: type=1800 audit(1785791934.316:1271): pid=26427 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.4.5090" name="SYSV00000000" dev="tmpfs" ino=8 res=0 errno=0 [ 1571.619078][T23362] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1571.626444][T15564] usb 2-1: string descriptor 0 read error: -22 [ 1571.632802][T15564] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1571.659066][T23362] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1571.669054][T15564] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1571.679096][ T29] audit: type=1400 audit(1785791934.346:1272): avc: denied { mount } for pid=26420 comm="syz.3.5089" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 1571.719420][T23362] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1571.749100][T23362] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1571.771629][T23362] mceusb 6-1:0.0: Registered with mce emulator interface version 1 [ 1571.789823][T23362] mceusb 6-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1571.810215][ T29] audit: type=1400 audit(1785791934.546:1273): avc: denied { unmount } for pid=16873 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 1571.836745][T23362] usb 6-1: USB disconnect, device number 81 [ 1572.118549][T15564] keytouch 0003:0926:3333.006C: fixing up Keytouch IEC report descriptor [ 1572.139068][T23366] usb 4-1: new low-speed USB device number 48 using dummy_hcd [ 1572.168175][T15564] input: HID 0926:3333 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/0003:0926:3333.006C/input/input309 [ 1572.312090][T23366] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 1572.328800][T23366] usb 4-1: config 0 has no interface number 0 [ 1572.338676][T23366] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1572.351136][T15564] keytouch 0003:0926:3333.006C: input,hidraw0: USB HID v0.05 Keyboard [HID 0926:3333] on usb-dummy_hcd.1-1/input0 [ 1572.368265][T23366] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 1572.389280][T15564] usb 2-1: USB disconnect, device number 24 [ 1572.402862][T23366] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1572.430694][T26444] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1572.438000][T26444] IPv6: NLM_F_CREATE should be set when creating new route [ 1572.445275][T26444] IPv6: NLM_F_CREATE should be set when creating new route [ 1572.454677][T26442] fido_id[26442]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 1572.456412][T23366] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1572.501647][T23366] usb 4-1: config 0 descriptor?? [ 1572.512664][T26433] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1572.527569][T23366] iowarrior 4-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1572.556249][T26444] bridge1: entered promiscuous mode [ 1572.829696][T23366] usb 3-1: new high-speed USB device number 114 using dummy_hcd [ 1572.866029][T15564] usb 4-1: USB disconnect, device number 48 [ 1572.889024][T23362] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 1572.949485][T23355] usb 6-1: new high-speed USB device number 82 using dummy_hcd [ 1573.048685][T23366] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1573.098905][T23366] usb 3-1: config 63 has an invalid interface number: 66 but max is 0 [ 1573.143297][T23355] usb 6-1: Using ep0 maxpacket: 16 [ 1573.144395][T23362] usb 5-1: Using ep0 maxpacket: 8 [ 1573.155669][T23366] usb 3-1: config 63 has an invalid descriptor of length 0, skipping remainder of the config [ 1573.160467][T23355] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1573.179218][T23366] usb 3-1: config 63 has no interface number 0 [ 1573.192080][T23366] usb 3-1: config 63 interface 66 has no altsetting 0 [ 1573.201158][T23362] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 1573.202558][T23355] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1573.222419][T23362] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1573.233916][T23355] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1573.246181][T23355] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1573.256818][T23355] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1573.270140][T23366] usb 3-1: string descriptor 0 read error: -22 [ 1573.271435][T23355] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1573.278557][T23366] usb 3-1: New USB device found, idVendor=174f, idProduct=8acf, bcdDevice=39.f4 [ 1573.289501][T23355] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1573.299024][T23362] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1573.303679][T23355] usb 6-1: Manufacturer: syz [ 1573.336479][T23366] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1573.348698][T23362] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1573.360497][T23362] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1573.375785][T23362] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 1573.386908][T23362] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1573.398573][T23362] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1573.412032][T23362] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1573.423556][T23362] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1573.441645][T23362] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 1573.452011][T23362] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1573.463790][T23362] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1573.475936][T23362] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1573.487304][T23362] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1573.510623][T23362] usb 5-1: string descriptor 0 read error: -22 [ 1573.517801][T23362] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 1573.528169][T23362] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1574.126158][T23366] uvcvideo 3-1:63.66: Found Unit with invalid ID 0 [ 1574.134657][T23355] usb 6-1: config 0 descriptor?? [ 1574.149688][T23366] uvcvideo 3-1:63.66: Found UVC 0.07 device (174f:8acf) [ 1574.169634][T23362] adutux 5-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 1574.191785][T23366] uvcvideo 3-1:63.66: No valid video chain found. [ 1574.414272][T26444] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1574.439014][T26465] binder: 26458:26465 ioctl c0306201 0 returned -14 [ 1574.783903][T26444] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1574.880205][T26464] misc userio: Invalid payload size [ 1575.759837][T23355] rc_core: IR keymap rc-hauppauge not found [ 1575.765998][T23355] Registered IR keymap rc-empty [ 1575.785499][T23355] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1575.831055][T23355] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1575.916963][T23355] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 1576.073665][T23355] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input310 [ 1576.412109][T23355] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1576.512074][T23355] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1576.619788][T23355] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1576.699753][T23355] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1576.817000][ T29] audit: type=1400 audit(1785791939.466:1274): avc: denied { append } for pid=26483 comm="syz.1.5103" name="card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 1576.853889][T23355] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1576.892001][T23348] usb 5-1: USB disconnect, device number 8 [ 1576.916262][T23355] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1576.966236][T23351] usb 3-1: USB disconnect, device number 114 [ 1576.975985][T23355] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1577.001249][T23355] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1577.029316][T23355] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1577.053085][T23355] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 1577.083752][T23355] mceusb 6-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 1577.093695][T23355] mceusb 6-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1577.112464][T23355] usb 6-1: USB disconnect, device number 82 [ 1577.214002][T26497] comedi comedi0: 8255: I/O base address not correctly aligned [ 1577.239962][T26497] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1577.925601][T26503] netlink: 'syz.4.5108': attribute type 4 has an invalid length. [ 1578.949059][T23348] usb 2-1: new full-speed USB device number 25 using dummy_hcd [ 1578.990498][T26509] netlink: 56 bytes leftover after parsing attributes in process `syz.5.5110'. [ 1579.044432][T26509] netlink: 56 bytes leftover after parsing attributes in process `syz.5.5110'. [ 1579.140970][T23348] usb 2-1: config 0 has an invalid interface number: 205 but max is 0 [ 1579.920156][T23348] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1579.939558][T23348] usb 2-1: config 0 has no interface number 0 [ 1579.945758][T23348] usb 2-1: config 0 interface 205 has no altsetting 0 [ 1579.958237][T23348] usb 2-1: New USB device found, idVendor=1822, idProduct=3202, bcdDevice=13.4a [ 1579.968762][T23348] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1579.977658][T23348] usb 2-1: Product: syz [ 1579.982674][T23348] usb 2-1: Manufacturer: syz [ 1579.987309][T23348] usb 2-1: SerialNumber: syz [ 1580.026389][T23348] usb 2-1: config 0 descriptor?? [ 1580.053278][T23348] dvb-usb: found a 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' in warm state. [ 1580.053323][T23348] dvb-usb: bulk message failed: -22 (3/0) [ 1580.068840][T23355] usb 6-1: new high-speed USB device number 83 using dummy_hcd [ 1580.075698][T23348] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1580.077773][T23348] dvbdev: DVB: registering new adapter (TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device) [ 1580.077851][T23348] usb 2-1: media controller created [ 1580.080304][T23348] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1580.096955][T23348] dvb-usb: bulk message failed: -22 (6/0) [ 1580.097178][T23348] dvb-usb: no frontend was attached by 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' [ 1580.148026][T23348] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input311 [ 1580.160376][T26521] misc userio: Invalid payload size [ 1580.191663][T23348] dvb-usb: schedule remote query interval to 150 msecs. [ 1580.191843][T23348] dvb-usb: bulk message failed: -22 (3/0) [ 1580.231477][T23355] usb 6-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1580.231569][T23355] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1580.231596][T23355] usb 6-1: Product: syz [ 1580.231661][T23355] usb 6-1: Manufacturer: syz [ 1580.231725][T23355] usb 6-1: SerialNumber: syz [ 1580.258279][T23348] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device successfully initialized and connected. [ 1580.349428][T23351] dvb-usb: bulk message failed: -22 (1/0) [ 1580.349536][T23351] dvb-usb: error while querying for an remote control event. [ 1580.559700][T23351] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 1581.749105][T23351] usb 4-1: Using ep0 maxpacket: 16 [ 1581.765589][T26527] misc userio: Invalid payload size [ 1582.431034][T23351] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1582.431080][T23351] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1583.147222][T23355] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 1583.466832][T23348] dvb-usb: bulk message failed: -22 (1/0) [ 1583.472615][T23348] dvb-usb: error while querying for an remote control event. [ 1583.480072][T23355] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 1583.491313][T23355] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1583.500120][T23351] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1583.509828][T23351] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1583.519792][T23351] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1583.533524][T23355] lan78xx 6-1:1.0: probe with driver lan78xx failed with error -71 [ 1583.544701][T23355] usb 6-1: USB disconnect, device number 83 [ 1583.585277][T23362] usb 2-1: USB disconnect, device number 25 [ 1583.624604][T23351] usb 4-1: string descriptor 0 read error: -71 [ 1583.632874][T23351] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1583.634695][T23362] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I successfully deinitialized and disconnected. [ 1583.642658][T23351] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1583.698370][T23351] usb 4-1: config 0 descriptor?? [ 1583.722309][T23351] usb 4-1: can't set config #0, error -71 [ 1583.756230][T23351] usb 4-1: USB disconnect, device number 49 [ 1583.827814][ T29] audit: type=1400 audit(1785791946.556:1275): avc: denied { setopt } for pid=26540 comm="syz.5.5118" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1583.921796][T26546] netlink: 228 bytes leftover after parsing attributes in process `syz.3.5120'. [ 1584.393281][T26556] misc userio: Invalid payload size [ 1585.000759][T23351] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 1585.573602][T26561] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5122'. [ 1585.611737][T26561] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5122'. [ 1585.659109][T23351] usb 4-1: Using ep0 maxpacket: 16 [ 1585.672019][T23351] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 129, using maximum allowed: 30 [ 1585.688273][T23351] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1585.688609][T26567] netlink: 'syz.2.5124': attribute type 4 has an invalid length. [ 1585.707294][T23351] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1585.717708][T23351] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 129 [ 1585.740594][T23351] usb 4-1: New USB device found, idVendor=0458, idProduct=5013, bcdDevice= 0.00 [ 1585.752448][T23351] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1585.800665][T23351] usb 4-1: config 0 descriptor?? [ 1586.105444][T23351] usbhid 4-1:0.0: can't add hid device: -71 [ 1586.121775][T23351] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1586.152017][T23351] usb 4-1: USB disconnect, device number 50 [ 1588.342684][T26597] misc userio: Invalid payload size [ 1588.799002][T26592] misc userio: Invalid payload size [ 1590.927118][ T29] audit: type=1400 audit(1785791953.656:1276): avc: denied { write } for pid=26606 comm="syz.5.5131" name="nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 1591.020543][ T29] audit: type=1400 audit(1785791953.656:1277): avc: denied { open } for pid=26606 comm="syz.5.5131" path="/dev/nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 1591.073615][ T29] audit: type=1400 audit(1785791953.806:1278): avc: denied { map } for pid=26603 comm="syz.2.5132" path="socket:[85381]" dev="sockfs" ino=85381 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1591.123161][ T29] audit: type=1400 audit(1785791953.806:1279): avc: denied { read } for pid=26603 comm="syz.2.5132" path="socket:[85381]" dev="sockfs" ino=85381 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1591.836898][ T29] audit: type=1326 audit(1785791954.566:1280): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=26606 comm="syz.5.5131" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fb72c99e019 code=0x0 [ 1595.563690][ T29] audit: type=1400 audit(1785791958.216:1281): avc: denied { mounton } for pid=26660 comm="syz.5.5145" path="/proc/714/task" dev="proc" ino=85540 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 1595.652557][T26666] binder: 26658:26666 ioctl c0306201 200000000080 returned -22 [ 1595.654499][T26666] Bluetooth: MGMT ver 1.23 [ 1595.879960][T26672] comedi comedi0: 8255: I/O base address not correctly aligned [ 1595.908732][T26672] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1596.891438][T23362] usb 4-1: new low-speed USB device number 51 using dummy_hcd [ 1597.076614][T23362] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 1597.087212][T23362] usb 4-1: config 0 has no interface number 0 [ 1597.108032][T23362] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1597.245088][T23362] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 1597.322355][T23362] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1597.376774][T23362] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1597.523427][T23362] usb 4-1: config 0 descriptor?? [ 1597.597512][T26677] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1597.654809][T23362] iowarrior 4-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1598.503267][T23366] usb 4-1: USB disconnect, device number 51 [ 1600.345076][T26706] netlink: 132 bytes leftover after parsing attributes in process `syz.4.5152'. [ 1601.463370][T23366] usb 4-1: new full-speed USB device number 52 using dummy_hcd [ 1601.810777][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 1601.817130][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 1602.630369][T23366] usb 4-1: config 0 has an invalid interface number: 205 but max is 0 [ 1602.647569][T23366] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1602.658184][T23366] usb 4-1: config 0 has no interface number 0 [ 1602.664336][T23366] usb 4-1: config 0 interface 205 has no altsetting 0 [ 1602.674107][T23366] usb 4-1: New USB device found, idVendor=1822, idProduct=3202, bcdDevice=13.4a [ 1602.683443][T23366] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1602.718993][T23366] usb 4-1: Product: syz [ 1602.726044][T23366] usb 4-1: Manufacturer: syz [ 1602.735078][T23366] usb 4-1: SerialNumber: syz [ 1602.742035][T23366] usb 4-1: config 0 descriptor?? [ 1602.763592][T23366] dvb-usb: found a 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' in warm state. [ 1602.775115][T23366] dvb-usb: bulk message failed: -22 (3/0) [ 1602.813762][T23366] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1602.831542][T23366] dvbdev: DVB: registering new adapter (TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device) [ 1602.854558][T23366] usb 4-1: media controller created [ 1602.869258][T23366] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1602.889363][T23366] dvb-usb: bulk message failed: -22 (6/0) [ 1602.895693][T23366] dvb-usb: no frontend was attached by 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' [ 1602.933945][T23366] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input312 [ 1602.949265][T23351] usb 3-1: new low-speed USB device number 115 using dummy_hcd [ 1603.106121][T23351] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 1603.132265][T23351] usb 3-1: config 0 has no interface number 0 [ 1603.181425][T23351] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1603.248874][T23351] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 1603.317052][T23351] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1603.369586][T23351] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1603.464785][T23351] usb 3-1: config 0 descriptor?? [ 1603.596766][T26730] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1604.388826][T23351] iowarrior 3-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1604.485361][T23366] dvb-usb: schedule remote query interval to 150 msecs. [ 1604.492519][T23366] dvb-usb: bulk message failed: -22 (3/0) [ 1604.519059][T23366] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device successfully initialized and connected. [ 1604.683405][T15564] dvb-usb: bulk message failed: -22 (1/0) [ 1604.789339][T15564] dvb-usb: error while querying for an remote control event. [ 1604.974330][T15564] usb 4-1: USB disconnect, device number 52 [ 1605.027164][T26749] netlink: 'syz.1.5168': attribute type 4 has an invalid length. [ 1605.056299][T15564] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I successfully deinitialized and disconnected. [ 1605.293241][T26756] misc userio: Invalid payload size [ 1606.147240][T23366] usb 3-1: USB disconnect, device number 115 [ 1606.606728][T26761] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5170'. [ 1608.048705][T26777] comedi comedi0: 8255: I/O base address not correctly aligned [ 1608.062952][T26777] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1608.992487][T26790] binder: 26786:26790 ioctl c0306201 0 returned -14 [ 1609.863159][T26796] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1610.307481][T26798] retu-mfd 0-0001: could not read Retu revision: -5 [ 1610.404351][T26798] retu-mfd 0-0001: probe with driver retu-mfd failed with error -5 [ 1610.419694][T26798] i2c i2c-0: new_device: Instantiated device retu at 0x01 [ 1612.432502][T26800] retu-mfd 0-0002: could not read Tahvo revision: -5 [ 1612.474508][T26800] retu-mfd 0-0002: probe with driver retu-mfd failed with error -5 [ 1612.502930][T26800] i2c i2c-0: new_device: Instantiated device tahvo at 0x02 [ 1612.707003][T26822] misc userio: Invalid payload size [ 1613.432467][ T29] audit: type=1400 audit(1785791976.166:1282): avc: denied { append } for pid=26831 comm="syz.2.5186" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 1613.617467][T26834] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5186'. [ 1614.613539][ T29] audit: type=1400 audit(1785791976.446:1283): avc: denied { wake_alarm } for pid=26832 comm="syz.4.5187" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1615.471742][T26848] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5186'. [ 1615.756808][T15564] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 1615.929034][T15564] usb 5-1: Using ep0 maxpacket: 8 [ 1615.937365][T15564] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 1615.978531][T15564] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1616.156852][T15564] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1616.436227][T15564] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1617.028403][T15564] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1617.081013][T15564] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 1617.088514][T15564] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1617.102678][T15564] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1617.140772][T15564] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1617.167381][T15564] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1617.209012][T15564] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 1617.223418][T15564] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1617.235478][T15564] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1617.247741][T15564] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1617.259584][T15564] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1617.279593][T15564] usb 5-1: string descriptor 0 read error: -22 [ 1617.286739][T15564] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 1617.304296][T15564] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1617.346787][T15564] adutux 5-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 1617.999373][T26871] misc userio: Invalid payload size [ 1619.764892][T23356] usb 5-1: USB disconnect, device number 9 [ 1622.069024][T23366] usb 4-1: new low-speed USB device number 53 using dummy_hcd [ 1622.320863][T23366] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 1622.365569][T23366] usb 4-1: config 0 has no interface number 0 [ 1622.383896][T23366] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1623.585288][T23366] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 1623.596060][T23366] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1623.605098][T23366] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1623.630240][T23366] usb 4-1: config 0 descriptor?? [ 1623.647612][T26916] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1623.686836][T23366] iowarrior 4-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1624.408123][T26941] comedi comedi0: 8255: I/O base address not correctly aligned [ 1624.430910][T26941] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1625.491952][T23366] usb 4-1: USB disconnect, device number 53 [ 1625.972896][ T29] audit: type=1400 audit(1785791988.706:1284): avc: denied { ioctl } for pid=26955 comm="syz.1.5211" path="/dev/fuse" dev="devtmpfs" ino=99 ioctlcmd=0xe503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 1626.074257][ T29] audit: type=1400 audit(1785791988.796:1285): avc: denied { mounton } for pid=26955 comm="syz.1.5211" path="/457/file0" dev="tmpfs" ino=2467 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=sock_file permissive=1 [ 1626.119106][T26962] comedi comedi0: 8255: I/O base address not correctly aligned [ 1626.151463][T26962] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1628.285712][T26976] comedi comedi0: 8255: I/O base address not correctly aligned [ 1628.311177][T26976] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1633.148885][T27045] FAULT_INJECTION: forcing a failure. [ 1633.148885][T27045] name failslab, interval 1, probability 0, space 0, times 0 [ 1633.161670][T27045] CPU: 0 UID: 0 PID: 27045 Comm: syz.4.5232 Tainted: G L syzkaller #0 PREEMPT(full) [ 1633.161698][T27045] Tainted: [L]=SOFTLOCKUP [ 1633.161705][T27045] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1633.161715][T27045] Call Trace: [ 1633.161722][T27045] [ 1633.161729][T27045] dump_stack_lvl+0x100/0x190 [ 1633.161755][T27045] should_fail_ex.cold+0x5/0xa [ 1633.161779][T27045] should_failslab+0xc2/0x120 [ 1633.161802][T27045] kmem_cache_alloc_noprof+0x91/0x6a0 [ 1633.161825][T27045] ? sk_prot_alloc+0x60/0x2a0 [ 1633.161855][T27045] sk_prot_alloc+0x60/0x2a0 [ 1633.161883][T27045] sk_alloc+0x36/0xe80 [ 1633.161906][T27045] kcm_create+0xfc/0x6a0 [ 1633.161930][T27045] __sock_create+0x339/0x860 [ 1633.161952][T27045] __sys_socket+0x14d/0x260 [ 1633.161968][T27045] ? fput+0x79/0x100 [ 1633.161989][T27045] ? __pfx___sys_socket+0x10/0x10 [ 1633.162007][T27045] ? rcu_is_watching+0x12/0xc0 [ 1633.162034][T27045] ? trace_hardirqs_off+0x70/0x170 [ 1633.162062][T27045] __x64_sys_socket+0x72/0xb0 [ 1633.162078][T27045] ? lockdep_hardirqs_on+0x78/0x100 [ 1633.162100][T27045] do_syscall_64+0x115/0x870 [ 1633.162121][T27045] ? clear_bhb_loop+0x40/0x90 [ 1633.162142][T27045] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1633.162162][T27045] RIP: 0033:0x7f514d79e019 [ 1633.162177][T27045] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1633.162194][T27045] RSP: 002b:00007f514e6a1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 1633.162211][T27045] RAX: ffffffffffffffda RBX: 00007f514da26180 RCX: 00007f514d79e019 [ 1633.162223][T27045] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000029 [ 1633.162233][T27045] RBP: 00007f514e6a1090 R08: 0000000000000000 R09: 0000000000000000 [ 1633.162244][T27045] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1633.162255][T27045] R13: 00007f514da26218 R14: 00007f514da26180 R15: 00007ffceb427a38 [ 1633.162279][T27045] [ 1633.692024][T27035] misc userio: Invalid payload size [ 1634.486334][T27052] misc userio: Invalid payload size [ 1636.124871][T27079] binder: 27074:27079 ioctl c0306201 200000000080 returned -22 [ 1636.612600][T27089] comedi comedi0: 8255: I/O base address not correctly aligned [ 1636.630380][T27089] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1641.037268][T27124] misc userio: Invalid payload size [ 1642.115012][T27149] binder: 27139:27149 ioctl c0306201 0 returned -14 [ 1642.789491][T27151] comedi comedi0: 8255: I/O base address not correctly aligned [ 1642.821283][T27151] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1643.231764][T27153] smc: net device ip6_vti0 applied user defined pnetid SYZ2 [ 1643.333156][T27161] comedi comedi0: 8255: I/O base address not correctly aligned [ 1643.478713][T27161] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1644.012858][T23355] usb 4-1: new full-speed USB device number 54 using dummy_hcd [ 1644.234985][T23355] usb 4-1: config 0 has an invalid interface number: 205 but max is 0 [ 1644.296232][T23355] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1644.439518][T23355] usb 4-1: config 0 has no interface number 0 [ 1644.514905][T23355] usb 4-1: config 0 interface 205 has no altsetting 0 [ 1644.630978][T23355] usb 4-1: New USB device found, idVendor=1822, idProduct=3202, bcdDevice=13.4a [ 1644.752062][T23355] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1644.835318][T23355] usb 4-1: Product: syz [ 1644.852416][T23355] usb 4-1: Manufacturer: syz [ 1644.873786][T23355] usb 4-1: SerialNumber: syz [ 1644.970845][T23355] usb 4-1: config 0 descriptor?? [ 1645.120505][T23355] dvb-usb: found a 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' in warm state. [ 1645.183794][T23355] dvb-usb: bulk message failed: -22 (3/0) [ 1645.951557][T23355] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1646.726570][T23355] dvbdev: DVB: registering new adapter (TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device) [ 1646.739282][T23355] usb 4-1: media controller created [ 1646.750159][T23355] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1646.859485][T23355] dvb-usb: bulk message failed: -22 (6/0) [ 1646.923846][T23355] dvb-usb: no frontend was attached by 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' [ 1647.156804][T23355] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input313 [ 1647.369326][T27185] FAULT_INJECTION: forcing a failure. [ 1647.369326][T27185] name failslab, interval 1, probability 0, space 0, times 0 [ 1647.382012][T27185] CPU: 1 UID: 0 PID: 27185 Comm: syz.5.5265 Tainted: G L syzkaller #0 PREEMPT(full) [ 1647.382040][T27185] Tainted: [L]=SOFTLOCKUP [ 1647.382046][T27185] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1647.382056][T27185] Call Trace: [ 1647.382062][T27185] [ 1647.382069][T27185] dump_stack_lvl+0x100/0x190 [ 1647.382094][T27185] should_fail_ex.cold+0x5/0xa [ 1647.382114][T27185] should_failslab+0xc2/0x120 [ 1647.382135][T27185] kmem_cache_alloc_noprof+0x91/0x6a0 [ 1647.382156][T27185] ? dst_alloc+0x99/0x1a0 [ 1647.382178][T27185] dst_alloc+0x99/0x1a0 [ 1647.382199][T27185] rt_dst_alloc+0x35/0x3a0 [ 1647.382221][T27185] ip_route_input_slow+0x15b8/0x3fa0 [ 1647.382253][T27185] ? __pfx_ip_route_input_slow+0x10/0x10 [ 1647.382304][T27185] ip_route_input_noref+0x122/0x2e0 [ 1647.382331][T27185] ? __pfx_ip_route_input_noref+0x10/0x10 [ 1647.382362][T27185] ? __pfx_ip_rcv_finish+0x10/0x10 [ 1647.382381][T27185] ? __pfx_nf_hook.constprop.0+0x10/0x10 [ 1647.382412][T27185] ip_rcv_finish_core+0x459/0x2c30 [ 1647.382448][T27185] ip_rcv+0x1c0/0x3c0 [ 1647.382465][T27185] ? __pfx_ip_rcv+0x10/0x10 [ 1647.382480][T27185] __netif_receive_skb_one_core+0x197/0x1e0 [ 1647.382501][T27185] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 1647.382527][T27185] ? lock_acquire+0x1b9/0x370 [ 1647.382558][T27185] __netif_receive_skb+0x1f/0x120 [ 1647.382578][T27185] netif_receive_skb+0x139/0x7d0 [ 1647.382598][T27185] ? __pfx_netif_receive_skb+0x10/0x10 [ 1647.382626][T27185] tun_rx_batched.isra.0+0x3f6/0x750 [ 1647.382659][T27185] ? __pfx_tun_rx_batched.isra.0+0x10/0x10 [ 1647.382695][T27185] ? tun_get_user+0x1cc8/0x3c20 [ 1647.382718][T27185] tun_get_user+0x1e31/0x3c20 [ 1647.382749][T27185] ? __pfx_tun_get_user+0x10/0x10 [ 1647.382770][T27185] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 1647.382804][T27185] ? find_held_lock+0x2b/0x80 [ 1647.382820][T27185] ? tun_get+0x191/0x370 [ 1647.382835][T27185] ? tun_get+0x191/0x370 [ 1647.382859][T27185] tun_chr_write_iter+0xdc/0x200 [ 1647.382881][T27185] vfs_write+0x6ac/0x1050 [ 1647.382910][T27185] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 1647.382932][T27185] ? __pfx_vfs_write+0x10/0x10 [ 1647.382957][T27185] ? find_held_lock+0x2b/0x80 [ 1647.382990][T27185] ksys_write+0x12a/0x250 [ 1647.383018][T27185] ? __pfx_ksys_write+0x10/0x10 [ 1647.383052][T27185] do_syscall_64+0x115/0x870 [ 1647.383074][T27185] ? clear_bhb_loop+0x40/0x90 [ 1647.383096][T27185] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1647.383114][T27185] RIP: 0033:0x7fb72c95e84e [ 1647.383130][T27185] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1647.383147][T27185] RSP: 002b:00007fb72d7fcfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1647.383164][T27185] RAX: ffffffffffffffda RBX: 00007fb72d7fd6c0 RCX: 00007fb72c95e84e [ 1647.383175][T27185] RDX: 0000000000000033 RSI: 0000200000000080 RDI: 00000000000000c8 [ 1647.383186][T27185] RBP: 00007fb72d7fd090 R08: 0000000000000000 R09: 0000000000000000 [ 1647.383197][T27185] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1647.383207][T27185] R13: 00007fb72cc26038 R14: 00007fb72cc25fa0 R15: 00007ffebd321f08 [ 1647.383232][T27185] [ 1647.710409][T23355] dvb-usb: schedule remote query interval to 150 msecs. [ 1647.717393][T23355] dvb-usb: bulk message failed: -22 (3/0) [ 1647.738974][T23355] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device successfully initialized and connected. [ 1647.801821][T23355] usb 4-1: USB disconnect, device number 54 [ 1647.839411][T23356] usb 3-1: new high-speed USB device number 116 using dummy_hcd [ 1648.003846][T23356] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1648.014050][T23356] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1648.024918][T23356] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1648.038866][T23356] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1648.065297][T23356] usb 3-1: SerialNumber: syz [ 1648.564817][T23356] usb 3-1: 0:2 : does not exist [ 1648.580476][T23355] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I successfully deinitialized and disconnected. [ 1648.705128][T27209] tmpfs: Unknown parameter 'grpquota_b' [ 1648.733187][T27211] netlink: 56 bytes leftover after parsing attributes in process `syz.3.5269'. [ 1648.806290][T27211] netlink: 56 bytes leftover after parsing attributes in process `syz.3.5269'. [ 1649.493487][T23356] usb 3-1: USB disconnect, device number 116 [ 1649.547639][ T29] audit: type=1400 audit(1785792012.276:1286): avc: denied { connect } for pid=27219 comm="syz.2.5274" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1649.675875][T27099] udevd[27099]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1649.779050][T23355] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 1649.991878][T23355] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1650.009288][T23355] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1650.010530][T23366] usb 3-1: new high-speed USB device number 117 using dummy_hcd [ 1650.017385][T23355] usb 4-1: Product: syz [ 1650.030518][T23355] usb 4-1: Manufacturer: syz [ 1650.035710][T23355] usb 4-1: SerialNumber: syz [ 1650.359977][T23355] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 1650.602530][T23355] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 1650.604631][T23366] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1650.623168][T23366] usb 3-1: config 0 interface 0 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 27 [ 1650.636253][T23366] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1650.642961][T23366] usb 3-1: New USB device found, idVendor=056a, idProduct=005b, bcdDevice= 0.00 [ 1650.653283][T23366] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1650.665354][T23366] usb 3-1: config 0 descriptor?? [ 1650.672578][T23355] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1650.716652][T23355] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -71 [ 1650.760533][T23355] usb 4-1: USB disconnect, device number 55 [ 1650.969324][T23356] usb 6-1: new full-speed USB device number 84 using dummy_hcd [ 1651.143158][T23356] usb 6-1: config 0 has an invalid interface number: 205 but max is 0 [ 1651.158377][T23356] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1651.200633][T23356] usb 6-1: config 0 has no interface number 0 [ 1651.223850][T23356] usb 6-1: config 0 interface 205 has no altsetting 0 [ 1651.267802][T23356] usb 6-1: New USB device found, idVendor=1822, idProduct=3202, bcdDevice=13.4a [ 1651.300052][T23356] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1651.336124][T23356] usb 6-1: Product: syz [ 1651.347534][T23356] usb 6-1: Manufacturer: syz [ 1651.369582][T23356] usb 6-1: SerialNumber: syz [ 1651.422645][T23356] usb 6-1: config 0 descriptor?? [ 1651.471239][T23356] dvb-usb: found a 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' in warm state. [ 1652.307757][T23356] dvb-usb: bulk message failed: -22 (3/0) [ 1652.953358][T23356] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1653.705219][T23356] dvbdev: DVB: registering new adapter (TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device) [ 1653.716873][T23356] usb 6-1: media controller created [ 1653.723966][T23356] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1653.738233][T23356] dvb-usb: bulk message failed: -22 (6/0) [ 1653.744726][T23356] dvb-usb: no frontend was attached by 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' [ 1653.778556][T23366] usb 3-1: USB disconnect, device number 117 [ 1653.790309][T23356] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input314 [ 1653.832257][T23356] dvb-usb: schedule remote query interval to 150 msecs. [ 1653.847913][T23356] dvb-usb: bulk message failed: -22 (3/0) [ 1653.873445][T23356] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device successfully initialized and connected. [ 1653.999063][T23355] dvb-usb: bulk message failed: -22 (1/0) [ 1654.728112][T23355] dvb-usb: error while querying for an remote control event. [ 1654.855097][T27264] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5283'. [ 1654.884882][T23366] usb 6-1: USB disconnect, device number 84 [ 1654.917219][T27264] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1655.022384][T23366] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I successfully deinitialized and disconnected. [ 1655.039839][T27280] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5286'. [ 1655.051968][T27280] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1655.410353][T23362] usb 3-1: new high-speed USB device number 118 using dummy_hcd [ 1655.680334][T23362] usb 3-1: Using ep0 maxpacket: 8 [ 1655.804056][T23362] usb 3-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 1655.936258][T23362] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1656.047450][T23362] usb 3-1: Product: syz [ 1656.779318][T23362] usb 3-1: Manufacturer: syz [ 1656.783972][T23362] usb 3-1: SerialNumber: syz [ 1656.791205][T23362] usb 3-1: config 0 descriptor?? [ 1656.807432][T23362] gspca_main: se401-2.14.0 probing 047d:5003 [ 1656.933890][T27308] netlink: 56 bytes leftover after parsing attributes in process `syz.3.5291'. [ 1656.948531][T27308] netlink: 56 bytes leftover after parsing attributes in process `syz.3.5291'. [ 1657.209066][T23355] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 1657.298111][T23362] gspca_se401: ExtraFeatures: 71 [ 1657.303351][T23362] gspca_se401: Too many frame sizes [ 1657.372698][T23355] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1657.383641][T23355] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1657.446037][T23355] usb 4-1: Product: syz [ 1657.456552][T23355] usb 4-1: Manufacturer: syz [ 1657.480172][T23355] usb 4-1: SerialNumber: syz [ 1657.527636][T27291] netlink: 'syz.2.5288': attribute type 3 has an invalid length. [ 1657.860121][T23355] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 1657.933286][T23355] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 1657.981125][T23355] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1658.045117][T23355] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -71 [ 1658.104634][T23355] usb 4-1: USB disconnect, device number 56 [ 1659.145290][T23355] usb 3-1: USB disconnect, device number 118 [ 1659.246810][T27346] tmpfs: Unknown parameter 'grpquota_block_har' [ 1659.339065][T23362] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 1659.559690][T23362] usb 4-1: Using ep0 maxpacket: 8 [ 1659.608646][T23362] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 1659.685107][T23362] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1659.803413][T23362] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1659.925590][T23362] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1660.028099][T23362] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1660.135021][T27348] netlink: 16 bytes leftover after parsing attributes in process `syz.5.5300'. [ 1660.213218][T27348] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1660.912787][T23362] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 1660.927874][T23362] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1660.939548][T23362] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1660.951401][T23362] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1660.962742][T23362] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1660.977769][T23362] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 1660.986108][T23362] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1661.013484][T23362] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1661.025391][T23362] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1661.036656][T23362] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1661.053093][T23362] usb 4-1: string descriptor 0 read error: -22 [ 1661.059643][T23362] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 1661.069160][T23362] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1661.115352][T23362] adutux 4-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 1663.116887][T27380] binder: 27375:27380 ioctl c0306201 0 returned -14 [ 1663.603765][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 1663.618992][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 1663.626568][ T5727] kworker/0:7 (5727) used greatest stack depth: 18152 bytes left [ 1663.660761][T23355] usb 4-1: USB disconnect, device number 57 [ 1663.805532][T27393] netlink: 56 bytes leftover after parsing attributes in process `syz.2.5307'. [ 1663.842487][T27393] netlink: 56 bytes leftover after parsing attributes in process `syz.2.5307'. [ 1663.875397][T27398] netlink: 56 bytes leftover after parsing attributes in process `syz.4.5308'. [ 1663.994617][T27398] netlink: 56 bytes leftover after parsing attributes in process `syz.4.5308'. [ 1664.259232][T23355] usb 3-1: new high-speed USB device number 119 using dummy_hcd [ 1665.048053][T23362] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 1665.221073][T27422] tmpfs: Unknown parameter 'grpquota_block_har' [ 1665.251044][T23355] usb 3-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1665.366395][T23362] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1665.416208][T23362] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1665.463560][T23362] usb 5-1: Product: syz [ 1665.491215][T23362] usb 5-1: Manufacturer: syz [ 1665.519290][T23362] usb 5-1: SerialNumber: syz [ 1665.949907][T23362] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 1666.011439][T23355] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1666.019620][T23355] usb 3-1: Product: syz [ 1666.023807][T23355] usb 3-1: Manufacturer: syz [ 1666.028409][T23355] usb 3-1: SerialNumber: syz [ 1666.059720][T23362] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 1666.084965][T23362] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1666.122678][T23362] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 1666.193585][T23362] usb 5-1: USB disconnect, device number 10 [ 1666.304118][ T29] audit: type=1400 audit(1785792029.036:1287): avc: denied { remount } for pid=27423 comm="syz.5.5313" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 1666.329498][T23355] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 1666.343419][T23355] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 1666.354421][T23355] lan78xx 3-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1666.385740][T23355] lan78xx 3-1:1.0: probe with driver lan78xx failed with error -71 [ 1666.400336][T23355] usb 3-1: USB disconnect, device number 119 [ 1669.190360][T27470] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1670.941199][ T29] audit: type=1400 audit(1785792033.676:1288): avc: denied { map } for pid=27480 comm="syz.3.5328" path="/dev/bus/usb/006/001" dev="devtmpfs" ino=737 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 1670.984845][T27484] FAULT_INJECTION: forcing a failure. [ 1670.984845][T27484] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1671.008429][ T29] audit: type=1400 audit(1785792033.676:1289): avc: denied { execute } for pid=27480 comm="syz.3.5328" path="/dev/bus/usb/006/001" dev="devtmpfs" ino=737 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 1671.035263][T27484] CPU: 0 UID: 0 PID: 27484 Comm: syz.1.5330 Tainted: G L syzkaller #0 PREEMPT(full) [ 1671.035282][T27484] Tainted: [L]=SOFTLOCKUP [ 1671.035286][T27484] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1671.035292][T27484] Call Trace: [ 1671.035296][T27484] [ 1671.035301][T27484] dump_stack_lvl+0x100/0x190 [ 1671.035319][T27484] should_fail_ex.cold+0x5/0xa [ 1671.035333][T27484] _copy_from_user+0x2e/0xd0 [ 1671.035351][T27484] map_update_elem+0x922/0xb00 [ 1671.035369][T27484] ? __pfx_map_update_elem+0x10/0x10 [ 1671.035387][T27484] ? selinux_bpf+0x11a/0x150 [ 1671.035403][T27484] __sys_bpf+0x2a92/0x4e80 [ 1671.035418][T27484] ? __pfx___sys_bpf+0x10/0x10 [ 1671.035429][T27484] ? find_held_lock+0x2b/0x80 [ 1671.035438][T27484] ? get_pid_task+0xfc/0x250 [ 1671.035448][T27484] ? get_pid_task+0xfc/0x250 [ 1671.035462][T27484] ? find_held_lock+0x2b/0x80 [ 1671.035474][T27484] ? rcu_read_lock_any_held+0x6a/0xa0 [ 1671.035485][T27484] ? find_held_lock+0x2b/0x80 [ 1671.035494][T27484] ? ksys_write+0x190/0x250 [ 1671.035510][T27484] ? ksys_write+0x190/0x250 [ 1671.035536][T27484] ? fput+0x79/0x100 [ 1671.035551][T27484] ? __x64_sys_bpf+0xce/0x140 [ 1671.035561][T27484] __x64_sys_bpf+0xce/0x140 [ 1671.035572][T27484] ? do_syscall_64+0x90/0x870 [ 1671.035587][T27484] do_syscall_64+0x115/0x870 [ 1671.035600][T27484] ? clear_bhb_loop+0x40/0x90 [ 1671.035613][T27484] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1671.035624][T27484] RIP: 0033:0x7fe35b39e019 [ 1671.035633][T27484] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1671.035644][T27484] RSP: 002b:00007fe35c2d0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1671.035658][T27484] RAX: ffffffffffffffda RBX: 00007fe35b625fa0 RCX: 00007fe35b39e019 [ 1671.035665][T27484] RDX: 0000000000000020 RSI: 0000200000000080 RDI: 0000000000000002 [ 1671.035672][T27484] RBP: 00007fe35c2d0090 R08: 0000000000000000 R09: 0000000000000000 [ 1671.035678][T27484] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1671.035684][T27484] R13: 00007fe35b626038 R14: 00007fe35b625fa0 R15: 00007ffd609a9fc8 [ 1671.035698][T27484] [ 1673.159813][T23355] usb 4-1: new low-speed USB device number 58 using dummy_hcd [ 1673.840953][T23355] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 1673.849045][T23355] usb 4-1: config 0 has no interface number 0 [ 1673.855126][T23355] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1673.902245][T23355] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 1673.962879][T23355] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1674.001597][T23355] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1674.041512][T23355] usb 4-1: config 0 descriptor?? [ 1674.070765][T27509] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1674.102543][T23355] iowarrior 4-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1674.858159][T27539] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5340'. [ 1675.127333][T23355] usb 4-1: USB disconnect, device number 58 [ 1675.422195][T27551] binder: 27550:27551 ioctl 4018620d 0 returned -22 [ 1676.609297][T23351] usb 2-1: new low-speed USB device number 26 using dummy_hcd [ 1677.391932][T23351] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 1677.547868][T23351] usb 2-1: config 0 has no interface number 0 [ 1677.554196][T23351] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1677.565514][T23351] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 1677.576283][T23351] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1677.586350][T23351] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1677.608994][T23351] usb 2-1: config 0 descriptor?? [ 1677.616340][T27569] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1677.729911][T23351] iowarrior 2-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1678.583252][T23362] usb 2-1: USB disconnect, device number 26 [ 1678.742900][T27595] netlink: 16 bytes leftover after parsing attributes in process `syz.5.5353'. [ 1678.757828][T27595] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1678.978997][T23366] usb 3-1: new low-speed USB device number 120 using dummy_hcd [ 1679.334366][T23366] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 1679.343325][T23366] usb 3-1: config 0 has no interface number 0 [ 1679.351010][T23366] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1679.362997][T23366] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 1679.388871][T23366] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1679.411624][T23366] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1679.434490][T23366] usb 3-1: config 0 descriptor?? [ 1679.444079][T27602] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1679.486672][T23366] iowarrior 3-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1680.125472][T23362] usb 3-1: USB disconnect, device number 120 [ 1680.850052][T27630] misc userio: Invalid payload size [ 1680.876685][T27628] misc userio: Invalid payload size [ 1682.610850][T27649] comedi comedi0: 8255: I/O base address not correctly aligned [ 1682.658466][T27649] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1683.084674][T27654] FAULT_INJECTION: forcing a failure. [ 1683.084674][T27654] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1683.203761][T27654] CPU: 1 UID: 0 PID: 27654 Comm: syz.2.5367 Tainted: G L syzkaller #0 PREEMPT(full) [ 1683.203792][T27654] Tainted: [L]=SOFTLOCKUP [ 1683.203799][T27654] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1683.203810][T27654] Call Trace: [ 1683.203817][T27654] [ 1683.203824][T27654] dump_stack_lvl+0x100/0x190 [ 1683.203859][T27654] should_fail_ex.cold+0x5/0xa [ 1683.203884][T27654] strncpy_from_user+0x3b/0x2d0 [ 1683.203912][T27654] do_getname+0x78/0x390 [ 1683.203939][T27654] acct_on+0x93/0xa00 [ 1683.203959][T27654] ? __pfx_acct_on+0x10/0x10 [ 1683.203977][T27654] ? bpf_lsm_capable+0x9/0x10 [ 1683.203995][T27654] ? security_capable+0x80/0x260 [ 1683.204022][T27654] __x64_sys_acct+0x81/0x1e0 [ 1683.204040][T27654] ? lockdep_hardirqs_on+0x78/0x100 [ 1683.204063][T27654] do_syscall_64+0x115/0x870 [ 1683.204084][T27654] ? clear_bhb_loop+0x40/0x90 [ 1683.204106][T27654] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1683.204124][T27654] RIP: 0033:0x7ff0cdb9e019 [ 1683.204140][T27654] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1683.204159][T27654] RSP: 002b:00007ff0ceaea028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a3 [ 1683.204179][T27654] RAX: ffffffffffffffda RBX: 00007ff0cde26090 RCX: 00007ff0cdb9e019 [ 1683.204191][T27654] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000100 [ 1683.204202][T27654] RBP: 00007ff0ceaea090 R08: 0000000000000000 R09: 0000000000000000 [ 1683.204213][T27654] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1683.204223][T27654] R13: 00007ff0cde26128 R14: 00007ff0cde26090 R15: 00007ffcd65f6118 [ 1683.204249][T27654] [ 1684.384841][ T48] Bluetooth: (null): Invalid header checksum [ 1684.392549][ T48] Bluetooth: (null): Invalid header checksum [ 1684.947879][T23362] usb 6-1: new high-speed USB device number 85 using dummy_hcd [ 1685.200576][T23362] usb 6-1: Using ep0 maxpacket: 8 [ 1685.337387][T23362] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 1685.345083][T23362] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1685.356582][T23362] usb 6-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1685.368973][T23362] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1685.413558][T27685] comedi comedi0: 8255: I/O base address not correctly aligned [ 1685.433711][T23362] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1685.464358][T27685] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1685.515817][T23362] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 1685.550993][T23362] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1685.601920][T23362] usb 6-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1685.687776][T23362] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1685.725423][T23362] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1685.755370][T23362] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 1685.871930][T23362] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1685.930658][T23362] usb 6-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1685.988257][T23362] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1686.054516][T23362] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1686.101556][T23362] usb 6-1: string descriptor 0 read error: -22 [ 1686.116402][T23362] usb 6-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 1686.424736][T23362] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1686.474922][T23362] adutux 6-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 1688.812705][T23362] usb 6-1: USB disconnect, device number 85 [ 1689.184881][T27717] misc userio: Invalid payload size [ 1690.442593][T27737] tmpfs: Unknown parameter 'grpquota_block_hardlim' [ 1691.416638][T27723] misc userio: Invalid payload size [ 1693.217942][T27773] netlink: Invalid conntrack helper [ 1693.231433][ T50] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1693.245303][ T50] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1693.258653][ T50] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1693.266423][ T50] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1693.273945][ T50] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1693.291502][T27773] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1693.311958][ T5611] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1693.319485][ T5611] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1693.327497][ T5611] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1693.337708][ T5611] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1693.351616][ T5611] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1693.681404][T27790] syz_tun: entered allmulticast mode [ 1693.697123][T27789] syz_tun: left allmulticast mode [ 1693.901653][T27800] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5405'. [ 1694.334342][ T29] audit: type=1400 audit(1785792057.066:1290): avc: denied { create } for pid=27814 comm="syz.2.5411" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 1694.533397][T27821] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1695.409461][ T50] Bluetooth: hci1: command tx timeout [ 1695.487603][ T48] bridge_slave_1: left allmulticast mode [ 1695.504674][ T29] audit: type=1400 audit(1785792058.216:1291): avc: denied { ioctl } for pid=27828 comm="syz.3.5413" path="socket:[91251]" dev="sockfs" ino=91251 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 1695.537115][ T48] bridge_slave_1: left promiscuous mode [ 1696.453958][ T48] bridge0: port 2(bridge_slave_1) entered disabled state [ 1696.485363][ T48] bridge_slave_0: left allmulticast mode [ 1696.518866][ T48] bridge_slave_0: left promiscuous mode [ 1696.539980][ T48] bridge0: port 1(bridge_slave_0) entered disabled state [ 1696.692412][ T29] audit: type=1400 audit(1785792059.426:1292): avc: denied { setopt } for pid=27844 comm="syz.3.5418" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1696.995521][ T29] audit: type=1400 audit(1785792059.726:1293): avc: denied { write } for pid=27813 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1697.106713][ T29] audit: type=1400 audit(1785792059.836:1294): avc: denied { write } for pid=27854 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1697.220928][ T48] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1697.230973][ T48] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1697.244496][ T48] bond0 (unregistering): Released all slaves [ 1697.250881][ T29] audit: type=1400 audit(1785792059.986:1295): avc: denied { execute } for pid=27855 comm="syz.5.5420" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 1697.279443][ T48] bond1 (unregistering): Released all slaves [ 1697.295199][ T48] bond2 (unregistering): Released all slaves [ 1697.315658][T27856] Trying to write to read-only block-device nullb0 [ 1697.325627][ T48] bond3 (unregistering): Released all slaves [ 1697.388327][T27772] bridge0: port 1(bridge_slave_0) entered blocking state [ 1697.395597][T27772] bridge0: port 1(bridge_slave_0) entered disabled state [ 1697.403152][T27772] bridge_slave_0: entered allmulticast mode [ 1697.414982][T27772] bridge_slave_0: entered promiscuous mode [ 1697.423347][T27772] bridge0: port 2(bridge_slave_1) entered blocking state [ 1697.449104][T27772] bridge0: port 2(bridge_slave_1) entered disabled state [ 1697.458116][T27772] bridge_slave_1: entered allmulticast mode [ 1697.467950][T27772] bridge_slave_1: entered promiscuous mode [ 1697.485055][ T5271] 8021q: adding VLAN 0 to HW filter on device eth5 [ 1697.492471][ T50] Bluetooth: hci1: command tx timeout [ 1697.564104][T27772] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1697.604653][T27772] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1698.583685][T23355] usb 3-1: new high-speed USB device number 121 using dummy_hcd [ 1698.591418][T23351] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 1698.652951][T27772] team0: Port device team_slave_0 added [ 1698.676002][T27772] team0: Port device team_slave_1 added [ 1698.725488][ T48] IPVS: stopping backup sync thread 23720 ... [ 1698.758354][T27772] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1698.759280][T23351] usb 2-1: Using ep0 maxpacket: 8 [ 1698.778175][T27772] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1698.779846][T23355] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 64 [ 1698.833365][T23351] usb 2-1: New USB device found, idVendor=060b, idProduct=0001, bcdDevice= 0.00 [ 1698.869926][T27772] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1699.045561][T27772] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1699.081963][T27772] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1699.246319][T27772] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1699.368188][T23351] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1699.585513][ T50] Bluetooth: hci1: command tx timeout [ 1699.676068][T23355] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0xE has invalid maxpacket 64 [ 1699.687183][T23355] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 1699.698569][T23351] usb 2-1: config 0 descriptor?? [ 1699.703892][T23355] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 1699.734719][T23355] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x8D has invalid maxpacket 64 [ 1699.745215][T23355] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0xD has invalid maxpacket 64 [ 1699.756711][T23355] usb 3-1: New USB device found, idVendor=0711, idProduct=0550, bcdDevice= 0.00 [ 1699.768757][T23355] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 1699.776894][T23355] usb 3-1: Product: syz [ 1699.781227][T23355] usb 3-1: Manufacturer: syz [ 1699.789209][T27864] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1699.800703][T27864] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1699.808098][T27864] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1699.815441][T27864] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1699.822913][T27864] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1699.830342][T27864] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1699.840690][T23355] usb 3-1: USB2VGA dongle found at address 121 [ 1699.849609][T23355] usb 3-1: Allocated 8 output buffers [ 1699.861731][T23355] usb 3-1: Failed to early initialize device [ 1699.904644][T27772] hsr_slave_0: entered promiscuous mode [ 1699.926243][T27772] hsr_slave_1: entered promiscuous mode [ 1699.948819][T27772] debugfs: 'hsr0' already exists in 'hsr' [ 1699.969536][T27772] Cannot create hsr debugfs directory [ 1699.974527][ T29] audit: type=1400 audit(1785792062.706:1296): avc: denied { write } for pid=27870 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1700.053283][ T48] hsr_slave_0: left promiscuous mode [ 1700.070671][ T48] hsr_slave_1: left promiscuous mode [ 1700.079434][ T48] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1700.101634][ T48] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1700.112541][ T29] audit: type=1400 audit(1785792062.846:1297): avc: denied { write } for pid=27887 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1700.119613][T27864] usb 3-1: Failed to initialize device [ 1700.136137][T23351] hid (null): unknown global tag 0xd [ 1700.160669][T23351] macally 0003:060B:0001.006D: unknown global tag 0xd [ 1700.167674][T23351] macally 0003:060B:0001.006D: item 0 0 1 13 parsing failed [ 1700.212596][T23366] usb 3-1: USB disconnect, device number 121 [ 1700.219072][T23351] macally 0003:060B:0001.006D: probe with driver macally failed with error -22 [ 1700.361159][T23362] usb 2-1: USB disconnect, device number 27 [ 1700.407405][ T48] team0 (unregistering): Port device team_slave_1 removed [ 1700.427001][ T48] team0 (unregistering): Port device team_slave_0 removed [ 1702.006680][ T50] Bluetooth: hci1: command tx timeout [ 1702.013461][ T5271] 8021q: adding VLAN 0 to HW filter on device eth6 [ 1702.702984][ T48] IPVS: stop unused estimator thread 0... [ 1702.976432][ T29] audit: type=1400 audit(1785792065.706:1298): avc: denied { write } for pid=27918 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1703.240505][T27772] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1703.276536][T27772] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1703.281843][ T29] audit: type=1400 audit(1785792066.016:1299): avc: denied { write } for pid=27933 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1703.299759][T27772] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1703.354671][T27772] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1703.382158][T27772] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1703.415644][T27772] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1703.435295][T27772] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1703.458612][T27772] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1703.624368][ T5271] 8021q: adding VLAN 0 to HW filter on device eth7 [ 1704.164344][T27772] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1704.251655][T27772] 8021q: adding VLAN 0 to HW filter on device team0 [ 1704.297625][T18227] bridge0: port 1(bridge_slave_0) entered blocking state [ 1704.304746][T18227] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1704.382505][T18227] bridge0: port 2(bridge_slave_1) entered blocking state [ 1704.389611][T18227] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1704.839541][T23366] usb 3-1: new high-speed USB device number 122 using dummy_hcd [ 1704.853561][T27969] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5439'. [ 1705.140932][T23366] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x15, changing to 0x5 [ 1705.195058][T23366] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 10228, setting to 64 [ 1705.236978][T27969] bridge0: port 2(bridge_slave_1) entered disabled state [ 1705.237301][T23366] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 1705.244222][T27969] bridge0: port 1(bridge_slave_0) entered disabled state [ 1705.325066][T23366] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1705.371433][ T29] audit: type=1400 audit(1785792068.096:1300): avc: denied { write } for pid=27954 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1705.401731][T23366] usb 3-1: config 0 descriptor?? [ 1705.460015][T27990] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5441'. [ 1705.616272][ T29] audit: type=1400 audit(1785792068.346:1301): avc: denied { write } for pid=27991 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1705.655336][T23366] ath6kl: Failed to submit usb control message: -71 [ 1705.678303][T23366] ath6kl: unable to send the bmi data to the device: -71 [ 1705.703401][T23366] ath6kl: Unable to send get target info: -71 [ 1705.710552][T27969] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1705.753233][T23366] ath6kl: Failed to init ath6kl core: -71 [ 1705.764541][T27969] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1705.775379][T23366] ath6kl_usb 3-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 1705.808136][T23366] usb 3-1: USB disconnect, device number 122 [ 1706.467939][T28009] syz.1.5444 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 1707.459962][T24190] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1707.473265][ T5271] 8021q: adding VLAN 0 to HW filter on device eth8 [ 1707.519084][T24190] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1707.549098][ T6300] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1707.577460][ T6300] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1711.193192][T27772] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1711.464271][ T29] audit: type=1400 audit(1785792074.176:1302): avc: denied { connect } for pid=28049 comm="syz.1.5455" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1712.725546][ T29] audit: type=1400 audit(1785792075.456:1303): avc: denied { write } for pid=28065 comm="syz.3.5450" name="urandom" dev="devtmpfs" ino=9 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:urandom_device_t tclass=chr_file permissive=1 [ 1712.898220][ T29] audit: type=1400 audit(1785792075.566:1304): avc: denied { read write } for pid=16181 comm="syz-executor" name="loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1713.080729][ T29] audit: type=1400 audit(1785792075.566:1305): avc: denied { open } for pid=16181 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1713.270415][ T29] audit: type=1400 audit(1785792075.576:1306): avc: denied { ioctl } for pid=16181 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1713.515492][ T29] audit: type=1400 audit(1785792076.116:1307): avc: denied { append } for pid=28063 comm="syz.5.5449" name="mice" dev="devtmpfs" ino=917 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 1714.003321][T27772] veth0_vlan: entered promiscuous mode [ 1714.017942][T27772] veth1_vlan: entered promiscuous mode [ 1714.046042][T27772] veth0_macvtap: entered promiscuous mode [ 1714.067103][T27772] veth1_macvtap: entered promiscuous mode [ 1714.081909][T27772] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1714.094692][T27772] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1714.143407][ T1025] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1714.209055][ T6297] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1714.383875][ T6300] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1714.404317][ T6300] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1714.726068][ T29] audit: type=1400 audit(1785792077.266:1308): avc: denied { unlink } for pid=28079 comm="syz.1.5458" name="#1" dev="tmpfs" ino=2759 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 1714.786072][T24190] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1714.802564][T24190] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1714.891097][ T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1714.912674][ T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1715.341645][T28097] netlink: 'syz.3.5461': attribute type 1 has an invalid length. [ 1715.351039][T28097] netlink: 224 bytes leftover after parsing attributes in process `syz.3.5461'. [ 1715.566882][T28102] netlink: 92 bytes leftover after parsing attributes in process `syz.6.5393'. [ 1715.639427][T23362] usb 6-1: new high-speed USB device number 86 using dummy_hcd [ 1716.743987][T23362] usb 6-1: Using ep0 maxpacket: 8 [ 1717.643757][T23362] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1717.670384][T23362] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1717.720655][T23362] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1717.776375][T23362] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1717.905951][T23362] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1717.995038][T23362] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1718.040623][ T29] audit: type=1400 audit(1785792080.776:1309): avc: denied { getopt } for pid=28123 comm="syz.2.5470" lport=256 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1718.076279][T28124] veth0_macvtap: entered allmulticast mode [ 1718.082607][T28124] A link change request failed with some changes committed already. Interface veth0_macvtap may have been left with an inconsistent configuration, please check. [ 1718.113869][T23362] usb 6-1: usb_control_msg returned -71 [ 1718.125031][T23362] usbtmc 6-1:16.0: can't read capabilities [ 1718.167914][T23362] usb 6-1: USB disconnect, device number 86 [ 1718.244789][ T29] audit: type=1400 audit(1785792080.976:1310): avc: denied { watch_sb watch_reads } for pid=28128 comm="syz.5.5472" path="/261/file1" dev="tmpfs" ino=1445 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 1720.035357][ T29] audit: type=1400 audit(1785792082.766:1311): avc: denied { create } for pid=28139 comm="syz.2.5475" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1720.071880][T28144] syz_tun: entered allmulticast mode [ 1720.087954][ T29] audit: type=1400 audit(1785792082.786:1312): avc: denied { bind } for pid=28139 comm="syz.2.5475" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1720.090966][T28144] syz_tun: left allmulticast mode [ 1720.309165][T27982] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 1720.345363][ T29] audit: type=1400 audit(1785792083.076:1313): avc: denied { write } for pid=28145 comm="syz.1.5479" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 1720.395907][T28149] overlayfs: workdir and upperdir must be separate subtrees [ 1720.529117][T27982] usb 7-1: Using ep0 maxpacket: 32 [ 1720.542918][T27982] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1720.591737][T27982] usb 7-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1720.670304][T27982] usb 7-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1720.787027][T27982] usb 7-1: config 1 interface 0 has no altsetting 1 [ 1720.842695][T27982] usb 7-1: config 1 interface 1 has no altsetting 0 [ 1720.917222][T27982] usb 7-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice= 0.40 [ 1720.977510][T27982] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1721.036645][T27982] usb 7-1: Product: syz [ 1721.076905][T27982] usb 7-1: Manufacturer: syz [ 1721.113763][T27982] usb 7-1: SerialNumber: syz [ 1721.177710][T27982] usb 7-1: interface 2 not found [ 1721.222993][T27982] usb 7-1: selecting invalid altsetting 0 [ 1721.289275][T27982] usb 7-1: selecting invalid altsetting 0 [ 1721.311977][T27982] usbtest 7-1:1.1: probe with driver usbtest failed with error -22 [ 1721.336864][T27982] usb 7-1: selecting invalid altsetting 0 [ 1721.369218][T27982] snd-usb-audio 7-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 1721.382599][T27982] usb 7-1: selecting invalid altsetting 0 [ 1721.394022][T27982] snd-ua101 7-1:1.1: probe with driver snd-ua101 failed with error -22 [ 1721.420761][T27982] usb 7-1: USB disconnect, device number 2 [ 1721.542206][T28159] netlink: 132 bytes leftover after parsing attributes in process `syz.5.5480'. [ 1722.575890][T28167] tmpfs: Bad value for 'grpquota_block_hardlimit' [ 1723.440936][T28172] tmpfs: Unknown parameter 'grpquota_b' [ 1724.495523][T28183] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 1724.521765][T28183] CIFS: Attempting to mount //127.0.0.1/share [ 1724.531486][T28183] CIFS: VFS: Error connecting to socket. Aborting operation. [ 1724.539085][T28183] CIFS: VFS: cifs_mount failed w/return code = -101 [ 1724.690153][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 1724.696567][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 1725.124451][ T29] audit: type=1400 audit(1785792087.856:1314): avc: denied { map } for pid=28188 comm="syz.2.5491" path="socket:[92885]" dev="sockfs" ino=92885 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 1727.029017][ T29] audit: type=1400 audit(1785792089.496:1315): avc: denied { write } for pid=28168 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1727.788129][ T29] audit: type=1400 audit(1785792090.516:1316): avc: denied { write } for pid=28207 comm="syz.1.5496" name="usb_gadget" dev="configfs" ino=2526 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1727.863577][ T29] audit: type=1400 audit(1785792090.556:1317): avc: denied { write } for pid=28207 comm="syz.1.5496" name="functions" dev="configfs" ino=91832 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1727.905044][ T29] audit: type=1400 audit(1785792090.596:1318): avc: denied { write } for pid=28207 comm="syz.1.5496" name="configs" dev="configfs" ino=91833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1727.934523][ T29] audit: type=1400 audit(1785792090.596:1319): avc: denied { write } for pid=28207 comm="syz.1.5496" name="c.1" dev="configfs" ino=91848 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1728.213243][ T29] audit: type=1400 audit(1785792090.596:1320): avc: denied { create } for pid=28207 comm="syz.1.5496" name="uac2.usb0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=lnk_file permissive=1 [ 1728.401979][ T29] audit: type=1400 audit(1785792090.666:1321): avc: denied { write } for pid=28207 comm="syz.1.5496" name="c.1" dev="configfs" ino=91848 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1729.042070][ T29] audit: type=1400 audit(1785792091.776:1322): avc: denied { write } for pid=28220 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1729.294853][T28235] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5501'. [ 1729.440327][T27982] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 1729.807014][T27982] usb 7-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 1730.698964][T27982] usb 7-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 1730.707173][T27982] usb 7-1: Product: syz [ 1730.714380][T27982] usb 7-1: SerialNumber: syz [ 1730.720995][T27982] usb 7-1: config 0 descriptor?? [ 1730.944714][T27982] hso 7-1:0.0: Failed to find INT IN ep [ 1731.100624][ T29] audit: type=1400 audit(1785792093.826:1323): avc: denied { write } for pid=28238 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1731.186375][T27992] usb 7-1: USB disconnect, device number 3 [ 1731.279201][T27982] usb 2-1: new low-speed USB device number 28 using dummy_hcd [ 1731.289244][ T29] audit: type=1400 audit(1785792094.026:1324): avc: denied { write } for pid=28264 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1731.463300][T27982] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 1731.478187][T27982] usb 2-1: config 0 has no interface number 0 [ 1731.502026][T27982] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1731.533415][T27982] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 1731.567867][T27982] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1731.596883][T27982] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1731.633541][T27982] usb 2-1: config 0 descriptor?? [ 1731.650647][T28261] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 1731.686505][T27982] iowarrior 2-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1732.209863][T23362] usb 2-1: USB disconnect, device number 28 [ 1734.048993][T28281] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 1734.098989][ T50] Bluetooth: hci1: command 0x0c1a tx timeout [ 1734.122040][T28281] Bluetooth: hci1: Error when powering off device on rfkill (-110) [ 1735.018093][ T29] audit: type=1400 audit(1785792097.706:1325): avc: denied { write } for pid=28267 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1736.268138][T28339] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1737.258574][ T29] audit: type=1400 audit(1785792099.936:1326): avc: denied { getopt } for pid=28341 comm="syz.2.5520" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 1737.382375][T28345] FAT-fs (nbd2): unable to read boot sector [ 1737.463216][ T29] audit: type=1400 audit(1785792099.966:1327): avc: denied { write } for pid=28342 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1738.272637][ T29] audit: type=1400 audit(1785792100.956:1328): avc: denied { write } for pid=28341 comm="syz.2.5520" name="strings" dev="configfs" ino=73093 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1738.584324][ T29] audit: type=1400 audit(1785792101.036:1329): avc: denied { listen } for pid=28341 comm="syz.2.5520" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1739.701710][ T29] audit: type=1400 audit(1785792102.426:1330): avc: denied { write } for pid=28350 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1741.807942][ T29] audit: type=1400 audit(1785792104.536:1331): avc: denied { write } for pid=28388 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1743.408847][T28409] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1746.949263][T28437] tmpfs: Unknown parameter 'grpquota_block_har' [ 1747.078191][T23351] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 1747.897569][T23351] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1747.968438][T23351] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1748.075228][T23351] usb 2-1: Product: syz [ 1748.313515][T23351] usb 2-1: Manufacturer: syz [ 1748.356658][T23351] usb 2-1: SerialNumber: syz [ 1749.124975][T23351] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 1749.674307][T23351] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 1751.916523][T23351] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x0000011c. ret = -EPROTO [ 1752.071696][T23351] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1752.229112][T23351] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1752.330221][T23351] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -71 [ 1752.463011][T23351] usb 2-1: USB disconnect, device number 29 [ 1753.945306][ T29] audit: type=1400 audit(1785792116.676:1332): avc: denied { mount } for pid=28505 comm="syz.6.5564" name="/" dev="autofs" ino=93367 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 1754.968164][T28529] tmpfs: Unknown parameter 'grpquota_block_har' [ 1755.774237][T28535] netlink: 56 bytes leftover after parsing attributes in process `syz.5.5572'. [ 1755.810470][T28535] netlink: 56 bytes leftover after parsing attributes in process `syz.5.5572'. [ 1756.089025][T23351] usb 6-1: new high-speed USB device number 87 using dummy_hcd [ 1756.505778][T23351] usb 6-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1756.552772][T23351] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1756.631787][T23351] usb 6-1: Product: syz [ 1756.653370][T23351] usb 6-1: Manufacturer: syz [ 1756.672428][T23351] usb 6-1: SerialNumber: syz [ 1757.075920][T23351] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 1757.208307][T23351] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 1757.300555][T23351] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1757.487339][T23351] lan78xx 6-1:1.0: probe with driver lan78xx failed with error -71 [ 1757.602374][T23351] usb 6-1: USB disconnect, device number 87 [ 1758.121304][T28561] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5581'. [ 1758.283832][T28565] bond0: entered promiscuous mode [ 1758.310619][T28565] bond_slave_0: entered promiscuous mode [ 1758.371911][T28565] bond_slave_1: entered promiscuous mode [ 1758.632444][T28565] hsr1: Slave B (batadv0) is not up; please bring it up to get a fully working HSR network [ 1758.764435][T28565] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 1758.776704][T28576] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1761.104238][T28605] netlink: 56 bytes leftover after parsing attributes in process `syz.1.5594'. [ 1761.133191][T28605] netlink: 56 bytes leftover after parsing attributes in process `syz.1.5594'. [ 1761.224302][T28609] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5596'. [ 1761.410159][T28614] bond0: entered promiscuous mode [ 1761.419111][T23352] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 1761.446640][T28614] bond_slave_0: entered promiscuous mode [ 1761.493710][T28614] bond_slave_1: entered promiscuous mode [ 1761.520891][T28614] batadv0: entered promiscuous mode [ 1761.538343][T28614] debugfs: 'hsr1' already exists in 'hsr' [ 1761.553711][T28614] Cannot create hsr debugfs directory [ 1761.572926][T23352] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1761.583183][T23352] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1761.591750][T28614] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 1761.612383][T23352] usb 2-1: Product: syz [ 1761.633747][T23352] usb 2-1: Manufacturer: syz [ 1761.657755][T23352] usb 2-1: SerialNumber: syz [ 1762.009848][T23352] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO [ 1762.167701][T23352] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): lan78xx_setup_irq_domain() failed : -71 [ 1762.258126][T23352] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1762.573348][T23352] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -71 [ 1762.674926][T23352] usb 2-1: USB disconnect, device number 30 [ 1762.862199][T28634] [ 1762.864552][T28634] ====================================================== [ 1762.871558][T28634] WARNING: possible circular locking dependency detected [ 1762.878567][T28634] syzkaller #0 Tainted: G L [ 1762.884534][T28634] ------------------------------------------------------ [ 1762.891541][T28634] syz.5.5604/28634 is trying to acquire lock: [ 1762.897591][T28634] ffffffff901d0fe8 (gadget_subsys.su_mutex){+.+.}-{4:4}, at: configfs_rmdir+0x5ae/0x950 [ 1762.907343][T28634] [ 1762.907343][T28634] but task is already holding lock: [ 1762.914695][T28634] ffff888054404600 (&sb->s_type->i_mutex_key#28){++++}-{4:4}, at: vfs_rmdir+0xed/0x8a0 [ 1762.924370][T28634] [ 1762.924370][T28634] which lock already depends on the new lock. [ 1762.924370][T28634] [ 1762.934762][T28634] [ 1762.934762][T28634] the existing dependency chain (in reverse order) is: [ 1762.943764][T28634] [ 1762.943764][T28634] -> #2 (&sb->s_type->i_mutex_key#28){++++}-{4:4}: [ 1762.952457][T28634] lock_acquire+0x1b9/0x370 [ 1762.957482][T28634] down_write+0x8b/0x1f0 [ 1762.962246][T28634] configfs_depend_item_unlocked+0xf3/0x6a0 [ 1762.968660][T28634] usbg_make_tpg+0x261/0x620 [ 1762.973769][T28634] target_fabric_make_tpg+0xab/0x8c0 [ 1762.979576][T28634] configfs_mkdir+0x51e/0xb70 [ 1762.984779][T28634] vfs_mkdir+0x361/0x850 [ 1762.989541][T28634] filename_mkdirat+0x48b/0x5e0 [ 1762.994905][T28634] __x64_sys_mkdirat+0x89/0xc0 [ 1763.000205][T28634] do_syscall_64+0x115/0x870 [ 1763.005320][T28634] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1763.011728][T28634] [ 1763.011728][T28634] -> #1 (&opts->dep_lock){+.+.}-{4:4}: [ 1763.019371][T28634] lock_acquire+0x1b9/0x370 [ 1763.024395][T28634] __mutex_lock+0x1a4/0x1bd0 [ 1763.029504][T28634] tcm_set_name+0x29/0xb0 [ 1763.034348][T28634] function_make+0x21c/0x3f0 [ 1763.039456][T28634] configfs_mkdir+0x51e/0xb70 [ 1763.044655][T28634] vfs_mkdir+0x361/0x850 [ 1763.049420][T28634] filename_mkdirat+0x48b/0x5e0 [ 1763.054786][T28634] __x64_sys_mkdirat+0x89/0xc0 [ 1763.060064][T28634] do_syscall_64+0x115/0x870 [ 1763.065173][T28634] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1763.071578][T28634] [ 1763.071578][T28634] -> #0 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 1763.079825][T28634] check_prev_add+0xeb/0xe60 [ 1763.084929][T28634] __lock_acquire+0x136c/0x1a40 [ 1763.090278][T28634] lock_acquire+0x1b9/0x370 [ 1763.095280][T28634] __mutex_lock+0x1a4/0x1bd0 [ 1763.100367][T28634] configfs_rmdir+0x5ae/0x950 [ 1763.105541][T28634] vfs_rmdir+0x328/0x8a0 [ 1763.110281][T28634] filename_rmdir+0x31a/0x5c0 [ 1763.115451][T28634] __x64_sys_rmdir+0x46/0x70 [ 1763.120533][T28634] do_syscall_64+0x115/0x870 [ 1763.125619][T28634] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1763.132007][T28634] [ 1763.132007][T28634] other info that might help us debug this: [ 1763.132007][T28634] [ 1763.142202][T28634] Chain exists of: [ 1763.142202][T28634] gadget_subsys.su_mutex --> &opts->dep_lock --> &sb->s_type->i_mutex_key#28 [ 1763.142202][T28634] [ 1763.156860][T28634] Possible unsafe locking scenario: [ 1763.156860][T28634] [ 1763.164288][T28634] CPU0 CPU1 [ 1763.169622][T28634] ---- ---- [ 1763.174962][T28634] lock(&sb->s_type->i_mutex_key#28); [ 1763.180403][T28634] lock(&opts->dep_lock); [ 1763.187306][T28634] lock(&sb->s_type->i_mutex_key#28); [ 1763.195267][T28634] lock(gadget_subsys.su_mutex); [ 1763.200261][T28634] [ 1763.200261][T28634] *** DEADLOCK *** [ 1763.200261][T28634] [ 1763.208374][T28634] 3 locks held by syz.5.5604/28634: [ 1763.213541][T28634] #0: ffff88801e3d6450 (sb_writers#18){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x5c0 [ 1763.222908][T28634] #1: ffff88805659ec00 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x5c0 [ 1763.234183][T28634] #2: ffff888054404600 (&sb->s_type->i_mutex_key#28){++++}-{4:4}, at: vfs_rmdir+0xed/0x8a0 [ 1763.244240][T28634] [ 1763.244240][T28634] stack backtrace: [ 1763.250113][T28634] CPU: 0 UID: 0 PID: 28634 Comm: syz.5.5604 Tainted: G L syzkaller #0 PREEMPT(full) [ 1763.250130][T28634] Tainted: [L]=SOFTLOCKUP [ 1763.250134][T28634] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1763.250140][T28634] Call Trace: [ 1763.250144][T28634] [ 1763.250149][T28634] dump_stack_lvl+0x100/0x190 [ 1763.250163][T28634] print_circular_bug.cold+0x178/0x1c7 [ 1763.250184][T28634] check_noncircular+0x146/0x160 [ 1763.250202][T28634] check_prev_add+0xeb/0xe60 [ 1763.250221][T28634] __lock_acquire+0x136c/0x1a40 [ 1763.250240][T28634] ? trace_sched_exit_tp+0x120/0x160 [ 1763.250264][T28634] lock_acquire+0x1b9/0x370 [ 1763.250280][T28634] ? configfs_rmdir+0x5ae/0x950 [ 1763.250296][T28634] ? __pfx___might_resched+0x10/0x10 [ 1763.250311][T28634] __mutex_lock+0x1a4/0x1bd0 [ 1763.250332][T28634] ? configfs_rmdir+0x5ae/0x950 [ 1763.250348][T28634] ? configfs_rmdir+0x5ae/0x950 [ 1763.250365][T28634] ? __pfx___schedule+0x10/0x10 [ 1763.250376][T28634] ? reacquire_held_locks+0xce/0x1e0 [ 1763.250389][T28634] ? __pfx___mutex_lock+0x10/0x10 [ 1763.250402][T28634] ? preempt_schedule_common+0x42/0xc0 [ 1763.250416][T28634] ? _raw_spin_unlock+0x3e/0x50 [ 1763.250431][T28634] ? fast_dput+0x168/0x6d0 [ 1763.250450][T28634] ? configfs_rmdir+0x5ae/0x950 [ 1763.250463][T28634] configfs_rmdir+0x5ae/0x950 [ 1763.250477][T28634] ? __pfx_configfs_rmdir+0x10/0x10 [ 1763.250491][T28634] ? __pfx_down_write+0x10/0x10 [ 1763.250506][T28634] vfs_rmdir+0x328/0x8a0 [ 1763.250521][T28634] filename_rmdir+0x31a/0x5c0 [ 1763.250533][T28634] ? __pfx_filename_rmdir+0x10/0x10 [ 1763.250548][T28634] ? do_getname+0x191/0x390 [ 1763.250562][T28634] __x64_sys_rmdir+0x46/0x70 [ 1763.250574][T28634] do_syscall_64+0x115/0x870 [ 1763.250586][T28634] ? clear_bhb_loop+0x40/0x90 [ 1763.250598][T28634] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1763.250610][T28634] RIP: 0033:0x7fb72c99e019 [ 1763.250620][T28634] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1763.250631][T28634] RSP: 002b:00007fb72d7bb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 1763.250641][T28634] RAX: ffffffffffffffda RBX: 00007fb72cc26180 RCX: 00007fb72c99e019 [ 1763.250648][T28634] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000440 [ 1763.250655][T28634] RBP: 00007fb72ca3500c R08: 0000000000000000 R09: 0000000000000000 [ 1763.250661][T28634] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1763.250667][T28634] R13: 00007fb72cc26218 R14: 00007fb72cc26180 R15: 00007ffebd321f08 [ 1763.250677][T28634] [ 1763.519577][ T29] audit: type=1400 audit(1785792125.516:1333): avc: denied { write } for pid=28629 comm="syz.5.5604" name="functions" dev="configfs" ino=73091 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1763.542571][ T29] audit: type=1400 audit(1785792125.576:1334): avc: denied { write } for pid=28629 comm="syz.5.5604" name="functions" dev="configfs" ino=73091 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1763.565490][ T29] audit: type=1400 audit(1785792125.586:1335): avc: denied { remove_name } for pid=28629 comm="syz.5.5604" name="obex.usb1" dev="configfs" ino=93664 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1763.588952][ T29] audit: type=1400 audit(1785792125.586:1336): avc: denied { rmdir } for pid=28629 comm="syz.5.5604" name="obex.usb1" dev="configfs" ino=93664 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1764.913183][ T6298] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1765.071254][ T6298] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1765.184805][ T6298] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1765.242128][ T6298] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1765.374827][ T6298] bridge_slave_1: left allmulticast mode [ 1765.389153][ T6298] bridge_slave_1: left promiscuous mode [ 1765.428408][ T6298] bridge0: port 2(bridge_slave_1) entered disabled state [ 1765.469576][ T6298] bridge_slave_0: left allmulticast mode [ 1765.479482][ T6298] bridge_slave_0: left promiscuous mode [ 1765.516120][ T6298] bridge0: port 1(bridge_slave_0) entered disabled state [ 1765.585739][ T6298] bond0 (unregistering): left promiscuous mode [ 1765.593070][ T6298] bond_slave_0: left promiscuous mode [ 1765.603486][ T6298] bond_slave_1: left promiscuous mode [ 1765.610256][ T6298] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1765.623574][ T6298] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1765.634870][ T6298] bond0 (unregistering): Released all slaves [ 1765.732923][ T29] audit: type=1400 audit(1785792128.466:1337): avc: denied { write } for pid=28641 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1765.857105][ T29] audit: type=1400 audit(1785792128.586:1338): avc: denied { write } for pid=28652 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1765.933490][ T6298] batadv0: left promiscuous mode [ 1765.954776][ T6298] hsr_slave_0: left promiscuous mode [ 1765.962070][ T6298] hsr_slave_1: left promiscuous mode [ 1765.968092][ T6298] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1765.975811][ T6298] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1765.983355][ T6298] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1765.998974][ T6298] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1766.012976][ T6298] veth1_macvtap: left promiscuous mode [ 1766.019018][ T6298] veth0_macvtap: left promiscuous mode [ 1766.028975][ T6298] veth1_vlan: left promiscuous mode [ 1766.034177][ T6298] veth0_vlan: left promiscuous mode [ 1766.135029][ T6298] team0 (unregistering): Port device team_slave_1 removed [ 1766.144902][ T6298] team0 (unregistering): Port device team_slave_0 removed [ 1766.195906][ T5271] 8021q: adding VLAN 0 to HW filter on device eth9 [ 1766.384314][ T29] audit: type=1400 audit(1785792129.116:1339): avc: denied { write } for pid=28655 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1766.423167][ T29] audit: type=1400 audit(1785792129.156:1340): avc: denied { write } for pid=28666 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1766.462561][ T5271] 8021q: adding VLAN 0 to HW filter on device eth10 [ 1766.618395][ T29] audit: type=1400 audit(1785792129.346:1341): avc: denied { write } for pid=28669 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1766.664397][ T29] audit: type=1400 audit(1785792129.396:1342): avc: denied { write } for pid=28680 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1766.724271][ T5271] 8021q: adding VLAN 0 to HW filter on device eth11 [ 1766.733079][ T6298] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1766.752933][ T6298] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1766.806154][ T6298] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1766.881162][ T6298] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1766.907803][ T5271] 8021q: adding VLAN 0 to HW filter on device eth12 [ 1767.101088][ T5271] 8021q: adding VLAN 0 to HW filter on device eth13 [ 1767.192416][ T6298] bridge_slave_1: left allmulticast mode [ 1767.198729][ T6298] bridge_slave_1: left promiscuous mode [ 1767.207541][ T6298] bridge0: port 2(bridge_slave_1) entered disabled state [ 1767.215851][ T6298] bridge_slave_0: left allmulticast mode [ 1767.222316][ T6298] bridge_slave_0: left promiscuous mode [ 1767.228020][ T6298] bridge0: port 1(bridge_slave_0) entered disabled state [ 1767.240550][ T6298] bridge_slave_1: left allmulticast mode [ 1767.246227][ T6298] bridge_slave_1: left promiscuous mode [ 1767.254748][ T6298] bridge0: port 2(bridge_slave_1) entered disabled state [ 1767.263059][ T6298] bridge_slave_0: left allmulticast mode [ 1767.268716][ T6298] bridge_slave_0: left promiscuous mode [ 1767.274678][ T6298] bridge0: port 1(bridge_slave_0) entered disabled state [ 1767.284784][ T6298] bridge_slave_1: left allmulticast mode [ 1767.290552][ T6298] bridge_slave_1: left promiscuous mode [ 1767.296225][ T6298] bridge0: port 2(bridge_slave_1) entered disabled state [ 1767.304551][ T6298] bridge_slave_0: left allmulticast mode [ 1767.310567][ T6298] bridge_slave_0: left promiscuous mode [ 1767.316226][ T6298] bridge0: port 1(bridge_slave_0) entered disabled state [ 1767.400943][ T6298] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1767.410200][ T6298] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1767.419225][ T6298] bond0 (unregistering): Released all slaves [ 1767.427001][ T6298] bond1 (unregistering): Released all slaves [ 1767.435085][ T6298] bond2 (unregistering): Released all slaves [ 1767.443029][ T6298] bond3 (unregistering): Released all slaves [ 1767.451347][ T6298] bond4 (unregistering): Released all slaves [ 1767.475816][ T6298] bond0 (unregistering): left promiscuous mode [ 1767.484443][ T6298] bond_slave_0: left promiscuous mode [ 1767.490153][ T6298] bond_slave_1: left promiscuous mode [ 1767.496172][ T6298] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1767.505822][ T6298] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1767.514984][ T6298] bond0 (unregistering): Released all slaves [ 1767.522215][ T6298] bond1 (unregistering): Released all slaves [ 1767.578621][ T6298] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1767.588108][ T6298] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1767.597198][ T6298] bond0 (unregistering): Released all slaves [ 1767.604450][ T6298] bond1 (unregistering): Released all slaves [ 1767.612650][ T6298] bond2 (unregistering): Released all slaves [ 1767.622477][ T6298] bond3 (unregistering): Released all slaves [ 1767.632093][ T6298] bond4 (unregistering): Released all slaves [ 1767.640428][ T6298] bond5 (unregistering): Released all slaves [ 1767.648268][ T6298] bond6 (unregistering): Released all slaves [ 1767.656679][ T5271] 8021q: adding VLAN 0 to HW filter on device eth14 [ 1767.750959][ T6298] IPVS: stopping backup sync thread 23188 ... [ 1767.757431][ T6298] IPVS: stopping backup sync thread 23967 ... [ 1767.764303][ T6298] IPVS: stopping backup sync thread 23045 ... [ 1767.875761][ T5271] 8021q: adding VLAN 0 to HW filter on device eth15 [ 1768.095209][ T5271] 8021q: adding VLAN 0 to HW filter on device eth16 [ 1768.138451][ T6298] hsr_slave_0: left promiscuous mode [ 1768.144625][ T6298] hsr_slave_1: left promiscuous mode [ 1768.151640][ T6298] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1768.160155][ T6298] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1768.169505][ T6298] hsr_slave_0: left promiscuous mode [ 1768.175200][ T6298] hsr_slave_1: left promiscuous mode [ 1768.182142][ T6298] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1768.189778][ T6298] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1768.197325][ T6298] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1768.205693][ T6298] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1768.215120][ T6298] hsr_slave_0: left promiscuous mode [ 1768.221451][ T6298] hsr_slave_1: left promiscuous mode [ 1768.227072][ T6298] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1768.234791][ T6298] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1768.245269][ T6298] veth1_macvtap: left promiscuous mode [ 1768.252139][ T6298] veth0_macvtap: left promiscuous mode [ 1768.358920][ T6298] team0 (unregistering): Port device team_slave_1 removed [ 1768.369713][ T6298] team0 (unregistering): Port device team_slave_0 removed [ 1768.432604][ T6298] team0 (unregistering): Port device team_slave_1 removed [ 1768.442027][ T6298] team0 (unregistering): Port device team_slave_0 removed [ 1768.533307][ T6298] team0 (unregistering): Port device team_slave_1 removed [ 1768.542583][ T6298] team0 (unregistering): Port device team_slave_0 removed [ 1768.583972][ T5271] 8021q: adding VLAN 0 to HW filter on device eth18 [ 1768.776450][ T29] kauditd_printk_skb: 12 callbacks suppressed [ 1768.776466][ T29] audit: type=1400 audit(1785792131.506:1355): avc: denied { write } for pid=28772 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1768.813713][ T29] audit: type=1400 audit(1785792131.546:1356): avc: denied { write } for pid=28783 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1768.856428][ T5271] 8021q: adding VLAN 0 to HW filter on device eth17 [ 1769.015869][ T29] audit: type=1400 audit(1785792131.746:1357): avc: denied { write } for pid=28787 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1769.057201][ T29] audit: type=1400 audit(1785792131.786:1358): avc: denied { write } for pid=28798 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1769.115797][ T5271] 8021q: adding VLAN 0 to HW filter on device eth19 [ 1769.247025][ T29] audit: type=1400 audit(1785792131.976:1359): avc: denied { write } for pid=28801 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1769.285516][ T6298] IPVS: stop unused estimator thread 0... [ 1769.291807][ T29] audit: type=1400 audit(1785792132.016:1360): avc: denied { write } for pid=28812 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1769.313130][ T6298] IPVS: stop unused estimator thread 0... [ 1769.318637][ T5271] 8021q: adding VLAN 0 to HW filter on device eth20 [ 1769.329706][ T6298] IPVS: stop unused estimator thread 0... [ 1769.444462][ T29] audit: type=1400 audit(1785792132.176:1361): avc: denied { write } for pid=28815 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1769.480025][ T29] audit: type=1400 audit(1785792132.216:1362): avc: denied { write } for pid=28826 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1769.519039][ T5271] 8021q: adding VLAN 0 to HW filter on device eth21 [ 1769.637576][ T29] audit: type=1400 audit(1785792132.366:1363): avc: denied { write } for pid=28830 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1769.668635][ T29] audit: type=1400 audit(1785792132.396:1364): avc: denied { write } for pid=28841 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1769.696608][ T5271] 8021q: adding VLAN 0 to HW filter on device eth22 [ 1769.848044][ T5271] 8021q: adding VLAN 0 to HW filter on device eth23 [ 1770.011387][ T5271] 8021q: adding VLAN 0 to HW filter on device eth24