last executing test programs: 1.545637987s ago: executing program 1 (id=820): openat(0xffffffffffffff9c, &(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x2, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000140), 0x5, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000400)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x800000000000208, 0x0, 0x0, 0x2, 0xc, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100000000020000ffffffffff00", "2809e8dbe108598948224ad54afac11d875397bd3c5240f45f819e01177d2d458dd4992861ac00", "90be8b1c5500000000004000f0f9ffff0000000000ffff00", [0x80000000006, 0x6]}}) 1.428477663s ago: executing program 1 (id=821): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000180)=ANY=[], 0x20) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f00000005c0)='fd', 0x0, r0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x2) fchdir(r2) r3 = syz_clone(0x300, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r3, r3) setpgid(0x0, r3) mount(0x0, &(0x7f0000000080)='./proc\x00', 0x0, 0x4000, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) 1.410257814s ago: executing program 0 (id=823): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20044738, &(0x7f0000000000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x3c}}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='veno', 0x4) sendmmsg$inet(r0, &(0x7f0000001100)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000ec0)="0ca5", 0x2}], 0x1}}, {{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000280)='R', 0x1}], 0x1}}], 0x2, 0x4000001) sendto$inet(r0, &(0x7f0000001a00)="97444ea165e5f1d1ae287f050b5eebaa7d25cb7f67e0af66c8f53433968f5733e3957f12c905040158f09bbcdc64a2cbc39f2a7a979168a76ba8ea25c257777aa842cc9be074f8847483654e50262eeb6283229378b9eafc7c4da760eb9464944a75d6da7a632bc6438f44d6bd3f00fe31f50e8bf12f8e2a2079bbabc670f08a9b7e0e8ee0d28637af51e3238fc6df43cc559740634ef993102f4bdc63cfbade5c2e97d298db381f83681c0d24ab146aa57c6f2ff84fc31cc05b2c6709033852740afa5ad200beb90fc09c46d7d67c4a25535480283bd6c3fd9027abcd4a7e98706f91c38295ce452b4874c0c344802b4436d8cb0f485834d29effdde761d72f50e4d7d31cddd6c08eef5f1a6635838d82781caad8287bc7bf25f07c865141f6c6bca12563b6fae3798ebeb1ee801f0631e3ee8e36a090f772c055b32b5a3bc57f64bd6a2da039c8af3560c2b245f70aa35050e0b6ba61ba0644f96b086a3761b8a5911f30b4d4374752df2bcb2f6a6ee3355314795b1962fe57ea4d2008c36c9475cd45bbef9ac51000fcb34ab877beb7fe48260cf23c1a675b70e0adc141fd98e73c919cc1d1287d1d4f999c8019751ecbf4c2c1", 0x1b5, 0x14, 0x0, 0x0) 1.373049535s ago: executing program 1 (id=824): r0 = inotify_init1(0x0) inotify_add_watch(r0, &(0x7f0000000400)='.\x00', 0xa4000021) pselect6(0x40, &(0x7f0000000000)={0xa, 0x80000001, 0x2, 0x10000000000006, 0x12, 0x8, 0x80000000, 0x8}, 0x0, 0x0, 0x0, 0x0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) listen(0xffffffffffffffff, 0x2) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x1fd) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x202000, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) execve(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) 696.133587ms ago: executing program 3 (id=837): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f00000011c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="cf0400000000edff00ff1200000008000300", @ANYRES32=r2, @ANYBLOB="040013000a0006"], 0x68}}, 0x0) 682.359298ms ago: executing program 3 (id=838): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000041000501010000000000000001010000000000001c000100"], 0x48}, 0x1, 0x0, 0x0, 0x2c048040}, 0xe800) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x4000080) 667.597509ms ago: executing program 3 (id=839): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000003, 0x13, r2, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000000c0)={[0x1, 0x1100000000000000, 0x6, 0x109e93, 0xffffffffffffffff, 0x400003, 0xd, 0xc, 0x0, 0x7fffffffffffffff, 0x5, 0x401, 0x6, 0x5, 0x20000000, 0xfffffffffffffffc], 0x80a0000, 0x1354}) ioctl$KVM_TDX_INIT_VM(0xffffffffffffffff, 0xc008aeba, &(0x7f0000000440)={0x1, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2000000000000000000000000000000007000000000000008f00000000800000060000000000000005000000000000003107000000000000020000000000000040000000000000000200000000000000724c000000000000020000000000000008000000000000000400000000000000060000000000000004000000000000000100000000000000ffffff7fffffffff4f000000000000006b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000010000008e"]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 626.699601ms ago: executing program 3 (id=840): r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000002c0), 0x10080, 0x0) ioctl$BTRFS_IOC_QGROUP_CREATE(r0, 0x4010942a, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x3, 0x0, &(0x7f00000001c0)='syzkaller\x00', 0x8}, 0x94) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'veth1_to_hsr\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={r1, r2, 0x25, 0x0, @val=@iter={0x0}}, 0x20) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)={0x64, r4, 0x405, 0x70bd27, 0x25dfdbff, {}, [{{0x8, 0x1, r5}, {0x48, 0x2, 0x0, 0x1, [{0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000401}, 0x4c004) 626.271201ms ago: executing program 3 (id=842): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x1011f, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000004000)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f0000004080)='./mnt\x00', &(0x7f00000040c0)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000004200)='./mnt/trace_marker\x00', 0x1, 0x1a) 552.279504ms ago: executing program 0 (id=845): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x5) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./config/dlm/cl1/spaces/ls1/nodes/1\x00', 0x200) 546.534554ms ago: executing program 0 (id=846): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f0000000580)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f) write$FUSE_CREATE_OPEN(r3, &(0x7f0000000180)={0xa0, 0xffffffffffffffda, 0x0, {{0x3, 0x0, 0x8000000200007, 0x282b, 0x20103, 0x80001, {0x200004, 0x10005c62, 0x203, 0x1000000000, 0x83, 0x4, 0x10000006, 0x6, 0x0, 0x0, 0x0, 0xee00, 0xee00, 0x8, 0x1}}, {0x0, 0xa}}}, 0xa0) sendfile(r3, r3, &(0x7f0000000100)=0x4, 0x8112) 472.529618ms ago: executing program 1 (id=848): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)={0x54, 0x2, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'bitmap:port\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT={0x6}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}]}, 0x54}}, 0x0) 472.379378ms ago: executing program 1 (id=849): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in=@empty, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x80000000000009, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, [@tmpl={0x44, 0x5, [{{@in6=@private2, 0x0, 0x6c}, 0x8, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0xffffffff, 0x5}]}]}, 0xfc}}, 0x20000000) 472.168228ms ago: executing program 1 (id=850): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_open_procfs(0x0, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000100)) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB="00220f000000b083629661235c8170b23bc912f63fd89d0e6ea8a798d4956196fe330ed38dbdbc61cdc484fc50ee7085ac687b9fa63777f28b7fdeced78560aa8a98604866aff24af89407c34ebd0a8dbc2cc96c4a95bccbf4bba40e49bf129180fc59786de7e547ff96c8b6673c2c378d5e035ed51f766efa86842a635f06e2784f07a620ef3e585850f40e4e14ba35d19a1a55c9212e61aa06ad56661881e929c69460e562364402b86bb208c2330e2e8a54564c1c824c795b3bea95716c01000000f67d920d2a"], 0x0}, 0x0) r3 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGCOLLECTIONINDEX(r3, 0x40184810, &(0x7f00000002c0)={0x3, 0xffffffff, 0xfffffffe, 0xffff01c2, 0x2, 0xa}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1, 0x4, 0x0, 0x0, 0x5}, 0x94) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x800000, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r5, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc}) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r7 = dup3(r6, r1, 0x0) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x2, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r8, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r8, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) r9 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) read$FUSE(r9, &(0x7f00000027c0)={0x2020}, 0x2020) socket$inet6(0xa, 0x2, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) 420.680151ms ago: executing program 3 (id=851): r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000001000)=ANY=[@ANYBLOB="1201000200000040501d4d610001000000010902200001010080320904000002ff00000007050102"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000140)=ANY=[@ANYBLOB="20c81e0000004d61501d0100000000000000100000000000800700ecff0000003804"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000200)={0x40, 0x40, 0x1, "80"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 266.780508ms ago: executing program 0 (id=856): setns(0xc9, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24004045) r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) write$FUSE_INIT(r0, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x777) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r2, &(0x7f0000000180)='1', 0x1) write(0xffffffffffffffff, &(0x7f0000000200), 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r3, &(0x7f0000000280)='0', 0x1) ioctl$sock_SIOCGSKNS(r1, 0x894c, 0x0) 208.543261ms ago: executing program 0 (id=858): setuid(0xee01) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, 0x0) 208.34789ms ago: executing program 4 (id=859): r0 = socket$nl_generic(0x10, 0x3, 0x10) sched_setscheduler(0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000100)={@mcast1, 0x4, 0x1, 0x2, 0x0, 0xffff, 0x7}, 0x0) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x2000009, 0x13, 0xffffffffffffffff, 0x779f6000) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000040)={'batadv_slave_1\x00', {0x2, 0x0, @loopback=0x7f000000}}) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)=ANY=[@ANYBLOB="88020000", @ANYRES16=r1, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r2, @ANYBLOB="6102330050300100080211000001080211000000505050505050"], 0x288}, 0x1, 0x0, 0x0, 0x800}, 0x0) 208.16717ms ago: executing program 0 (id=860): ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000100)={0xa8, 0x0, 0x3}) r0 = syz_usb_connect$hid(0x5, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000204f045db600000000000109022d00010000600209040010050300010009210000360122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000380)={0x18, &(0x7f0000000100)=ANY=[@ANYBLOB="000457"], 0x0, 0x0, 0x0, 0x0}, 0x0) 208.046241ms ago: executing program 4 (id=861): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x104}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat(0xffffffffffffff9c, 0x0, 0x10042, 0x4d) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0)={0x9, 0x4, 0x4, 0x2, 0x80, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x1}, 0x48) 69.063017ms ago: executing program 2 (id=863): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_CAP_X2APIC_API(r2, 0x4068aea3, &(0x7f00000001c0)={0xa8, 0x0, 0x6}) 36.244559ms ago: executing program 2 (id=864): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, 0x0, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/62, 0x328000, 0x800, 0x9, 0x3}, 0x20) setsockopt$XDP_RX_RING(0xffffffffffffffff, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00', 0x0}) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x0, r2}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) ftruncate(r3, 0x8008976) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r4, 0x89f1, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) ptrace$poke(0x4, 0x0, 0x0, 0x8) socket$inet_udp(0x2, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, r3, 0x0) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f0000000180)=0x2004000) 36.087709ms ago: executing program 2 (id=865): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1fd) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000050)='./proc/net/afs/rootcell\x00', 0x2, 0x2) write(r0, &(0x7f0000000070)='syz0:127.0.0.1', 0xe) 36.008609ms ago: executing program 4 (id=866): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000040)=ANY=[@ANYBLOB="d0000000", @ANYRES16=r1, @ANYBLOB="010000000000000000000100000008000100000000000400048008000c8004000b800800020001000000a00008"], 0xd0}}, 0x571f68543cec8180) 35.912509ms ago: executing program 4 (id=867): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_RUN(r2, 0xae80, 0x0) 570.15µs ago: executing program 2 (id=868): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, 0x0, 0x20000000) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, 0x3, 0x6, 0x301, 0x0, 0x0, {0x2, 0x0, 0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x30}, 0x1, 0x0, 0x0, 0x4800}, 0x4000010) 338.94µs ago: executing program 4 (id=869): r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'virt_wifi0\x00', 0x0}) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r1, {0x0, 0x8}, {0xffff, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x1c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x9defcb4}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x1}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40001}, 0x8010) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r3) sendmsg$TIPC_NL_BEARER_ENABLE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="0100000000000000000003000000400001800d0001007564703a73797a30000000002c0004001400010002004e0f7f00000100000000000000001400020002004e207f00000200000000000000"], 0x54}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000a80)={0x70, r4, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x5c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x14, 0x3, '1234567890123456'}, @TIPC_NLA_NODE_KEY={0x44, 0x4, {'gcm(aes)\x00', 0x1c, "00172233f60ad0b992422bc1ccddeeff13596dbe548e3414b3da8002"}}]}]}, 0x70}}, 0x0) sendmsg$TIPC_NL_BEARER_SET(r2, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, r4, 0x4, 0x70bd2c, 0x25dfdbfc, {}, [@TIPC_NLA_LINK={0x30, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fff}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x10000000) 215.72µs ago: executing program 2 (id=870): r0 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff) mmap(&(0x7f00001f8000/0x4000)=nil, 0x4000, 0x100000b, 0x12012, r1, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0xc402, 0x80) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r2, 0x0) writev(r2, &(0x7f0000001740)=[{&(0x7f00000000c0)="04920944475a", 0x6}], 0x1) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1800}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r3, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000280)='./file0\x00', &(0x7f0000000040)=[0x5], &(0x7f0000000180)=[0x2], 0x0, 0x1f, 0x1}}, 0x40) 78.72µs ago: executing program 2 (id=871): getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x100, 0xe}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=@newtfilter={0x8c, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0xfff5, 0xfff3}, {}, {0x8, 0xc}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x6, 0x7e, 0x7, 0xfffffffc, 0x8}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000000) 0s ago: executing program 4 (id=872): r0 = socket(0xa, 0x3, 0xf) ioctl$SIOCGETSGCNT(r0, 0x5411, &(0x7f0000000000)={@empty, @initdev={0xac, 0x1e, 0x0, 0x0}}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.244' (ED25519) to the list of known hosts. [ 21.453046][ T30] audit: type=1400 audit(1789260640.421:64): avc: denied { mounton } for pid=278 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.454278][ T278] cgroup: Unknown subsys name 'net' [ 21.475821][ T30] audit: type=1400 audit(1789260640.421:65): avc: denied { mount } for pid=278 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.503093][ T30] audit: type=1400 audit(1789260640.451:66): avc: denied { unmount } for pid=278 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.503291][ T278] cgroup: Unknown subsys name 'devices' [ 21.674528][ T278] cgroup: Unknown subsys name 'hugetlb' [ 21.680202][ T278] cgroup: Unknown subsys name 'rlimit' [ 21.817304][ T30] audit: type=1400 audit(1789260640.781:67): avc: denied { setattr } for pid=278 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.840525][ T30] audit: type=1400 audit(1789260640.781:68): avc: denied { mounton } for pid=278 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 21.865297][ T30] audit: type=1400 audit(1789260640.781:69): avc: denied { mount } for pid=278 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.892047][ T280] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 21.901084][ T30] audit: type=1400 audit(1789260640.861:70): avc: denied { relabelto } for pid=280 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.913634][ T278] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.926879][ T30] audit: type=1400 audit(1789260640.861:71): avc: denied { write } for pid=280 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.960808][ T30] audit: type=1400 audit(1789260640.861:72): avc: denied { read } for pid=278 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.986348][ T30] audit: type=1400 audit(1789260640.861:73): avc: denied { open } for pid=278 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.502449][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.509618][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.517153][ T286] device bridge_slave_0 entered promiscuous mode [ 22.525039][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.532072][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.539463][ T286] device bridge_slave_1 entered promiscuous mode [ 22.597326][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.604439][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.611848][ T287] device bridge_slave_0 entered promiscuous mode [ 22.619698][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.626782][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.634343][ T287] device bridge_slave_1 entered promiscuous mode [ 22.709654][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.716827][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.724304][ T290] device bridge_slave_0 entered promiscuous mode [ 22.740931][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.748268][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.756114][ T288] device bridge_slave_0 entered promiscuous mode [ 22.762917][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.769947][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.777370][ T290] device bridge_slave_1 entered promiscuous mode [ 22.795165][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.802233][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.809730][ T288] device bridge_slave_1 entered promiscuous mode [ 22.855706][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.862793][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.870231][ T289] device bridge_slave_0 entered promiscuous mode [ 22.879567][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.886805][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.894163][ T289] device bridge_slave_1 entered promiscuous mode [ 22.939561][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.946744][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.954043][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.961173][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.000166][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.007258][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.014661][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.021776][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.058722][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.065811][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.073107][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.080158][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.098638][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.105716][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.112982][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.119996][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.132184][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.139491][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.147183][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.155051][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.162908][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.170215][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.177443][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.184671][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.191777][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.221040][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.228562][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.236076][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.244264][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.251273][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.258897][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.267205][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.274247][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.300771][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.308286][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.316559][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.323629][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.331381][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.340106][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.348310][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.356500][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.363535][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.393574][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.403943][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.411839][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.419980][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.428304][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.435343][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.442682][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.451081][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.458112][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.465579][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.479784][ T286] device veth0_vlan entered promiscuous mode [ 23.491829][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.499879][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.507471][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.515661][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.533323][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.540994][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.548554][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.556925][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.565280][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.572299][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.579827][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.587280][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.594774][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.603042][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.611121][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.618155][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.625599][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.633940][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.642041][ T10] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.649076][ T10] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.656858][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.665232][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.673483][ T10] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.680669][ T10] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.688104][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.696267][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.708550][ T286] device veth1_macvtap entered promiscuous mode [ 23.725420][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 23.733557][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.742006][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.750464][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.758364][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.766493][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.774658][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.782640][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.790850][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.799157][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.807355][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.814902][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.822422][ T287] device veth0_vlan entered promiscuous mode [ 23.843314][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.851417][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.859677][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.867993][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.876133][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.884611][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.893354][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.901317][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.909337][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.916902][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.929553][ T287] device veth1_macvtap entered promiscuous mode [ 23.938108][ T288] device veth0_vlan entered promiscuous mode [ 23.944758][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.953510][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.961610][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.970143][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.979731][ T289] device veth0_vlan entered promiscuous mode [ 23.993270][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.001300][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.009769][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.018374][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.026860][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.035389][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.043836][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.052092][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.060457][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.069048][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.076574][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.087783][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.096174][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.108722][ T288] device veth1_macvtap entered promiscuous mode [ 24.118713][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.127105][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.140618][ T290] device veth0_vlan entered promiscuous mode [ 24.150966][ T289] device veth1_macvtap entered promiscuous mode [ 24.158388][ T286] request_module fs-gadgetfs succeeded, but still no fs? [ 24.158593][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.175214][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.183553][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.191360][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.199414][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.206935][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.239261][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.248022][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.272667][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.283981][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.294072][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.304119][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.315109][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.367322][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.378071][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.388748][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.681668][ T311] netlink: 'syz.3.4': attribute type 4 has an invalid length. [ 24.691559][ T312] netlink: 'syz.3.4': attribute type 4 has an invalid length. [ 24.730712][ T319] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 24.749165][ T290] device veth1_macvtap entered promiscuous mode [ 24.789244][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.799288][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.820536][ T325] kvm: vcpu 0: requested 128 ns lapic timer period limited to 200000 ns [ 24.829541][ T325] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 24.850732][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.860756][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.938092][ T331] pit: kvm: requested 16761 ns i8254 timer period limited to 200000 ns [ 24.947988][ T331] pit: kvm: requested 16761 ns i8254 timer period limited to 200000 ns [ 24.957531][ T331] pit: kvm: requested 16761 ns i8254 timer period limited to 200000 ns [ 24.973358][ T331] pit: kvm: requested 19276 ns i8254 timer period limited to 200000 ns [ 24.981944][ T331] pit: kvm: requested 184381 ns i8254 timer period limited to 200000 ns [ 24.995907][ T331] pit: kvm: requested 193600 ns i8254 timer period limited to 200000 ns [ 25.142831][ T6] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 25.182865][ T296] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 25.207876][ T311] syz.3.4 (311) used greatest stack depth: 21184 bytes left [ 25.322908][ T26] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 25.502860][ T6] usb 1-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 25.513959][ T6] usb 1-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 25.523774][ T6] usb 1-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 25.536618][ T6] usb 1-1: config 0 interface 0 has no altsetting 0 [ 25.543247][ T6] usb 1-1: New USB device found, idVendor=056a, idProduct=00bc, bcdDevice= 0.00 [ 25.552271][ T6] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.561651][ T6] usb 1-1: config 0 descriptor?? [ 25.572913][ T296] usb 2-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 25.582144][ T296] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.590657][ T296] usb 2-1: config 0 descriptor?? [ 25.613832][ T313] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 25.692909][ T26] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 25.703123][ T26] usb 5-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 25.712168][ T26] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.825459][ T353] device gretap1 entered promiscuous mode [ 25.852849][ T313] usb 4-1: Using ep0 maxpacket: 32 [ 25.953851][ T340] UDC core: couldn't find an available UDC or it's busy: -16 [ 25.961350][ T340] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 25.969276][ T340] UDC core: couldn't find an available UDC or it's busy: -16 [ 25.972862][ T313] usb 4-1: config index 0 descriptor too short (expected 164, got 36) [ 25.976816][ T340] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 25.984916][ T313] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 26.003192][ T313] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 26.012955][ T313] usb 4-1: New USB device found, idVendor=046d, idProduct=c29c, bcdDevice= 0.00 [ 26.021992][ T313] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.032208][ T313] usb 4-1: config 0 descriptor?? [ 26.102935][ T6] usbhid 1-1:0.0: can't add hid device: -71 [ 26.109769][ T6] usbhid: probe of 1-1:0.0 failed with error -71 [ 26.117176][ T6] usb 1-1: USB disconnect, device number 2 [ 26.185136][ T355] UDC core: couldn't find an available UDC or it's busy: -16 [ 26.192634][ T355] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 26.404601][ T356] UDC core: couldn't find an available UDC or it's busy: -16 [ 26.412190][ T356] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 26.524010][ T313] logitech 0003:046D:C29C.0001: unknown main item tag 0x0 [ 26.531230][ T313] logitech 0003:046D:C29C.0001: unknown main item tag 0x0 [ 26.538556][ T313] logitech 0003:046D:C29C.0001: unknown main item tag 0x0 [ 26.545720][ T313] logitech 0003:046D:C29C.0001: unknown main item tag 0x0 [ 26.553339][ T313] logitech 0003:046D:C29C.0001: unknown main item tag 0x0 [ 26.563202][ T313] logitech 0003:046D:C29C.0001: hidraw0: USB HID v0.00 Device [HID 046d:c29c] on usb-dummy_hcd.3-1/input0 [ 26.616886][ T30] kauditd_printk_skb: 48 callbacks suppressed [ 26.616899][ T30] audit: type=1400 audit(1789260645.581:122): avc: denied { write } for pid=367 comm="syz.0.19" name="kvm" dev="devtmpfs" ino=82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 26.645790][ T30] audit: type=1400 audit(1789260645.591:123): avc: denied { read write } for pid=371 comm="syz.2.20" name="fuse" dev="devtmpfs" ino=91 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 26.669017][ T30] audit: type=1400 audit(1789260645.591:124): avc: denied { open } for pid=371 comm="syz.2.20" path="/dev/fuse" dev="devtmpfs" ino=91 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 26.783116][ T378] netlink: 'syz.0.21': attribute type 4 has an invalid length. [ 26.833028][ T378] netlink: 'syz.0.21': attribute type 4 has an invalid length. [ 26.874258][ T313] logitech 0003:046D:C29C.0001: no inputs found [ 26.902146][ T313] usb 4-1: USB disconnect, device number 2 [ 26.973962][ T30] audit: type=1400 audit(1789260645.941:125): avc: denied { unmount } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 27.030065][ T380] fido_id[380]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 27.064861][ T30] audit: type=1400 audit(1789260646.011:126): avc: denied { write } for pid=381 comm="syz.2.22" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 27.318542][ T30] audit: type=1400 audit(1789260646.281:127): avc: denied { mount } for pid=385 comm="syz.2.33" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 27.341157][ T30] audit: type=1400 audit(1789260646.281:128): avc: denied { unmount } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 27.497934][ T30] audit: type=1400 audit(1789260646.461:129): avc: denied { setopt } for pid=387 comm="syz.2.24" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 27.665583][ T30] audit: type=1400 audit(1789260646.631:130): avc: denied { create } for pid=397 comm="syz.0.25" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 27.685969][ T30] audit: type=1400 audit(1789260646.631:131): avc: denied { write } for pid=397 comm="syz.0.25" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 27.929636][ T313] usb 2-1: USB disconnect, device number 2 [ 28.087937][ T26] usb 5-1: USB disconnect, device number 2 [ 28.158460][ T412] FAULT_INJECTION: forcing a failure. [ 28.158460][ T412] name failslab, interval 1, probability 0, space 0, times 1 [ 28.178758][ T412] CPU: 0 PID: 412 Comm: syz.0.32 Not tainted syzkaller #0 [ 28.186082][ T412] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 28.196164][ T412] Call Trace: [ 28.199455][ T412] [ 28.202389][ T412] __dump_stack+0x21/0x30 [ 28.206739][ T412] dump_stack_lvl+0x110/0x170 [ 28.211428][ T412] ? show_regs_print_info+0x20/0x20 [ 28.216647][ T412] dump_stack+0x15/0x20 [ 28.220810][ T412] should_fail+0x3ab/0x500 [ 28.225249][ T412] __should_failslab+0xa4/0xe0 [ 28.230022][ T412] should_failslab+0x9/0x20 [ 28.234527][ T412] slab_pre_alloc_hook+0x39/0xd0 [ 28.239507][ T412] ? x509_get_sig_params+0x1e9/0x640 [ 28.244788][ T412] __kmalloc_track_caller+0x6c/0x2c0 [ 28.250070][ T412] ? x509_get_sig_params+0x1e9/0x640 [ 28.255347][ T412] kmemdup+0x26/0x60 [ 28.259232][ T412] x509_get_sig_params+0x1e9/0x640 [ 28.264338][ T412] x509_cert_parse+0x574/0x8b0 [ 28.269187][ T412] x509_key_preparse+0x63/0x650 [ 28.274149][ T412] asymmetric_key_preparse+0x9e/0xe0 [ 28.279444][ T412] key_create_or_update+0x430/0x9c0 [ 28.284659][ T412] ? key_type_put+0x20/0x20 [ 28.289152][ T412] ? lookup_user_key_possessed+0x40/0x40 [ 28.294771][ T412] ? __kasan_check_write+0x14/0x20 [ 28.299877][ T412] __se_sys_add_key+0x34b/0x410 [ 28.304813][ T412] ? __x64_sys_add_key+0xd0/0xd0 [ 28.309742][ T412] ? __kasan_check_write+0x14/0x20 [ 28.314841][ T412] __x64_sys_add_key+0xbf/0xd0 [ 28.319595][ T412] x64_sys_call+0x713/0x9a0 [ 28.324085][ T412] do_syscall_64+0x4c/0xa0 [ 28.328496][ T412] ? clear_bhb_loop+0x50/0xa0 [ 28.333165][ T412] ? clear_bhb_loop+0x50/0xa0 [ 28.337833][ T412] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 28.343725][ T412] RIP: 0033:0x7f29c37df159 [ 28.348233][ T412] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 28.367828][ T412] RSP: 002b:00007f29c2238028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 28.376241][ T412] RAX: ffffffffffffffda RBX: 00007f29c3a66fa0 RCX: 00007f29c37df159 [ 28.384309][ T412] RDX: 0000200000000200 RSI: 0000200000000100 RDI: 0000200000000000 [ 28.392268][ T412] RBP: 00007f29c387603b R08: ffffffffffffffff R09: 0000000000000000 [ 28.400259][ T412] R10: 0000000000000559 R11: 0000000000000246 R12: 0000000000000000 [ 28.408221][ T412] R13: 00007f29c3a67038 R14: 00007f29c3a66fa0 R15: 00007fff315a6d58 [ 28.416191][ T412] [ 29.071163][ T326] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 29.827489][ T450] netlink: 'syz.2.47': attribute type 4 has an invalid length. [ 29.851869][ T450] netlink: 'syz.2.47': attribute type 4 has an invalid length. [ 30.096063][ T452] fuse: root generation should be zero [ 30.162888][ T326] usb 1-1: config 1 has an invalid interface number: 27 but max is 1 [ 30.174556][ T326] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 30.186249][ T326] usb 1-1: config 1 has 3 interfaces, different from the descriptor's value: 2 [ 30.199283][ T326] usb 1-1: config 1 has no interface number 2 [ 30.205591][ T326] usb 1-1: config 1 interface 1 altsetting 1 bulk endpoint 0x87 has invalid maxpacket 64 [ 30.442612][ T472] xt_hashlimit: size too large, truncated to 1048576 [ 30.465347][ T450] syz.2.47 (450) used greatest stack depth: 21096 bytes left [ 30.601317][ T479] Zero length message leads to an empty skb [ 30.691626][ T326] usb 1-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 30.704484][ T326] usb 1-1: config 1 interface 1 has no altsetting 0 [ 30.952882][ T326] usb 1-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 1.00 [ 30.966394][ T326] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 31.005957][ T326] usb 1-1: Product: syz [ 31.023959][ T326] usb 1-1: Manufacturer: syz [ 31.039141][ T326] usb 1-1: SerialNumber: syz [ 31.872852][ T30] kauditd_printk_skb: 39 callbacks suppressed [ 31.872876][ T30] audit: type=1400 audit(1789260650.761:171): avc: denied { read write } for pid=515 comm="syz.1.72" name="ppp" dev="devtmpfs" ino=154 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 31.908136][ T30] audit: type=1400 audit(1789260650.761:172): avc: denied { open } for pid=515 comm="syz.1.72" path="/dev/ppp" dev="devtmpfs" ino=154 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 32.032785][ T6] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 32.372997][ T520] usb 5-1: new low-speed USB device number 3 using dummy_hcd [ 32.437852][ T535] usb 1-1: USB disconnect, device number 3 [ 32.520253][ T30] audit: type=1400 audit(1789260651.481:173): avc: denied { setopt } for pid=537 comm="syz.0.77" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 32.570127][ T30] audit: type=1400 audit(1789260651.511:174): avc: denied { write } for pid=537 comm="syz.0.77" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 32.592836][ T6] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 32.617620][ T6] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 32.648157][ T6] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 32.662929][ T6] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 32.692940][ T6] usb 4-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 32.723002][ T6] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.812952][ T520] usb 5-1: unable to get BOS descriptor or descriptor too short [ 32.903184][ T520] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 32.919732][ T520] usb 5-1: config 1 interface 0 altsetting 15 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 32.940178][ T30] audit: type=1400 audit(1789260651.901:175): avc: denied { mount } for pid=554 comm="syz.2.79" name="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 32.946310][ T520] usb 5-1: config 1 interface 0 has no altsetting 0 [ 33.016327][ T30] audit: type=1400 audit(1789260651.951:176): avc: denied { unmount } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 33.081783][ T30] audit: type=1400 audit(1789260652.041:177): avc: denied { read write } for pid=557 comm="syz.2.86" name="vhost-vsock" dev="devtmpfs" ino=264 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 33.106912][ T30] audit: type=1400 audit(1789260652.041:178): avc: denied { open } for pid=557 comm="syz.2.86" path="/dev/vhost-vsock" dev="devtmpfs" ino=264 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 33.168962][ T30] audit: type=1400 audit(1789260652.041:179): avc: denied { ioctl } for pid=557 comm="syz.2.86" path="/dev/vhost-vsock" dev="devtmpfs" ino=264 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 33.196229][ T30] audit: type=1400 audit(1789260652.121:180): avc: denied { connect } for pid=560 comm="syz.2.88" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 33.199919][ T565] capability: warning: `syz.1.89' uses deprecated v2 capabilities in a way that may be insecure [ 33.273222][ T520] usb 5-1: string descriptor 0 read error: -22 [ 33.286921][ T520] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 33.304261][ T520] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.354503][ T520] cdc_ether 5-1:1.0: skipping garbage [ 33.360306][ T520] usb 5-1: bad CDC descriptors [ 33.584428][ T572] usb 5-1: USB disconnect, device number 3 [ 33.622817][ T535] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 34.062844][ T572] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 34.170567][ T573] usb 4-1: USB disconnect, device number 3 [ 34.182821][ T535] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 34.191911][ T535] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.215133][ T535] usb 3-1: Product: syz [ 34.219336][ T535] usb 3-1: Manufacturer: syz [ 34.224168][ T535] usb 3-1: SerialNumber: syz [ 34.449239][ T612] process 'syz.3.106' launched './file0' with NULL argv: empty string added [ 34.573021][ T572] usb 1-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice= 0.00 [ 34.582281][ T572] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.582803][ T39] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 34.952852][ T39] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 35.163940][ T39] usb 5-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 35.173169][ T39] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.181227][ T39] usb 5-1: Product: syz [ 35.185663][ T39] usb 5-1: Manufacturer: syz [ 35.190395][ T39] usb 5-1: SerialNumber: syz [ 35.402868][ T573] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 35.423938][ T627] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 35.762865][ T573] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 35.773417][ T573] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 35.783075][ T573] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 35.792730][ T573] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 35.805554][ T573] usb 2-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 35.814611][ T313] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 35.822125][ T573] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.052804][ T313] usb 4-1: Using ep0 maxpacket: 16 [ 36.212875][ T313] usb 4-1: unable to get BOS descriptor or descriptor too short [ 36.272093][ T573] usb 3-1: USB disconnect, device number 2 [ 36.283589][ T647] netlink: 8 bytes leftover after parsing attributes in process `syz.2.120'. [ 36.292640][ T647] netlink: 8 bytes leftover after parsing attributes in process `syz.2.120'. [ 36.301720][ T313] usb 4-1: config 121 has an invalid interface number: 127 but max is 0 [ 36.313235][ T649] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=122 sclass=netlink_route_socket pid=649 comm=syz.2.121 [ 36.314893][ T313] usb 4-1: config 121 has no interface number 0 [ 36.332194][ T313] usb 4-1: config 121 interface 127 has no altsetting 0 [ 36.502881][ T313] usb 4-1: New USB device found, idVendor=07aa, idProduct=9601, bcdDevice=89.4c [ 36.512173][ T313] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.520421][ T313] usb 4-1: Product: syz [ 36.524793][ T313] usb 4-1: Manufacturer: syz [ 36.529473][ T313] usb 4-1: SerialNumber: syz [ 36.803577][ T573] usb 1-1: USB disconnect, device number 4 [ 36.810768][ T661] input: syz0 as /devices/virtual/input/input5 [ 36.853738][ T313] dm9601: probe of 4-1:121.127 failed with error -22 [ 36.972340][ T313] usb 4-1: USB disconnect, device number 4 [ 37.097742][ T30] kauditd_printk_skb: 12 callbacks suppressed [ 37.097759][ T30] audit: type=1400 audit(1789260656.061:193): avc: denied { setopt } for pid=668 comm="syz.0.127" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 37.135619][ T535] usb 2-1: USB disconnect, device number 3 [ 37.155332][ T677] xt_hashlimit: size too large, truncated to 1048576 [ 37.199570][ T30] audit: type=1400 audit(1789260656.161:194): avc: denied { mount } for pid=682 comm="syz.0.133" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 37.228576][ T520] usb 5-1: USB disconnect, device number 4 [ 37.253649][ T684] xt_hashlimit: size too large, truncated to 1048576 [ 37.278872][ T30] audit: type=1400 audit(1789260656.241:195): avc: denied { create } for pid=687 comm="syz.4.135" dev="anon_inodefs" ino=17053 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 37.309232][ T30] audit: type=1400 audit(1789260656.241:196): avc: denied { ioctl } for pid=687 comm="syz.4.135" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=17053 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 37.381290][ T30] audit: type=1400 audit(1789260656.341:197): avc: denied { read } for pid=687 comm="syz.4.135" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=17053 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 37.484738][ T30] audit: type=1400 audit(1789260656.451:198): avc: denied { unmount } for pid=288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 37.537701][ T699] syz.3.139 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 37.565647][ T30] audit: type=1400 audit(1789260656.531:199): avc: denied { create } for pid=700 comm="syz.3.140" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 37.585488][ T701] Mass Storage Function, version: 2009/09/11 [ 37.591480][ T701] LUN: removable file: (no medium) [ 37.600344][ T30] audit: type=1400 audit(1789260656.571:200): avc: denied { write } for pid=700 comm="syz.3.140" name="num_buffers" dev="configfs" ino=17817 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 37.623912][ T30] audit: type=1400 audit(1789260656.571:201): avc: denied { open } for pid=700 comm="syz.3.140" path="/30/config/usb_gadget/g1/functions/mass_storage.usb0/num_buffers" dev="configfs" ino=17817 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 37.792791][ T535] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 37.812790][ T520] usb 1-1: new full-speed USB device number 5 using dummy_hcd [ 38.142865][ T520] usb 1-1: not running at top speed; connect to a high speed hub [ 38.152891][ T535] usb 2-1: config index 0 descriptor too short (expected 69, got 51) [ 38.161025][ T535] usb 2-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 47, changing to 9 [ 38.192807][ T535] usb 2-1: config 1 interface 1 altsetting 0 endpoint 0x81 has invalid maxpacket 26213, setting to 1024 [ 38.231888][ T30] audit: type=1400 audit(1789260657.191:202): avc: denied { create } for pid=720 comm="syz.4.148" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 38.308724][ T520] usb 1-1: config 0 has too many interfaces: 223, using maximum allowed: 32 [ 38.317757][ T520] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 38.328443][ T520] usb 1-1: config 0 has 2 interfaces, different from the descriptor's value: 223 [ 38.337942][ T520] usb 1-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 38.347284][ T520] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 38.359241][ T520] usb 1-1: config 0 descriptor?? [ 38.382918][ T535] usb 2-1: New USB device found, idVendor=1235, idProduct=8201, bcdDevice= 1.00 [ 38.402220][ T535] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.421685][ T535] usb 2-1: Product: syz [ 38.428944][ T535] usb 2-1: Manufacturer: syz [ 38.447777][ T535] usb 2-1: SerialNumber: syz [ 38.503567][ T520] usb 1-1: Found UVC 9.00 device (046d:0825) [ 38.520676][ T520] usb 1-1: No streaming interface found for terminal 2. [ 39.141849][ T535] usb 2-1: Focusrite Scarlett Gen 2/3 Mixer Driver disabled; use options snd_usb_audio vid=0x1235 pid=0x8201 device_setup=1 to enable and report any issues to g@b4.vu [ 39.194322][ T535] usb 2-1: USB disconnect, device number 4 [ 39.403173][ T317] udevd[317]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 39.592826][ T573] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 39.832913][ T573] usb 5-1: Using ep0 maxpacket: 16 [ 39.852855][ T535] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 39.902827][ T39] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 40.092818][ T535] usb 2-1: Using ep0 maxpacket: 32 [ 40.122943][ T573] usb 5-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 40.132114][ T573] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.140462][ T573] usb 5-1: Product: syz [ 40.144747][ T573] usb 5-1: Manufacturer: syz [ 40.149361][ T573] usb 5-1: SerialNumber: syz [ 40.156674][ T573] usb 5-1: config 0 descriptor?? [ 40.252856][ T535] usb 2-1: unable to get BOS descriptor or descriptor too short [ 40.263067][ T39] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 40.274393][ T39] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 40.284496][ T39] usb 3-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 40.293865][ T39] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 40.303807][ T39] usb 3-1: config 0 descriptor?? [ 40.332861][ T535] usb 2-1: config 14 has an invalid interface number: 57 but max is 1 [ 40.341153][ T535] usb 2-1: config 14 has an invalid interface number: 228 but max is 1 [ 40.351557][ T535] usb 2-1: config 14 has no interface number 0 [ 40.358108][ T535] usb 2-1: config 14 has no interface number 1 [ 40.364446][ T535] usb 2-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 40.382791][ T535] usb 2-1: config 14 interface 228 altsetting 5 has an invalid endpoint with address 0xD1, skipping [ 40.397477][ T535] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 40.409092][ T535] usb 2-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 40.422358][ T535] usb 2-1: config 14 interface 57 has no altsetting 0 [ 40.429247][ T535] usb 2-1: config 14 interface 228 has no altsetting 0 [ 40.436487][ T573] usb 5-1: USB disconnect, device number 5 [ 40.492902][ T535] usb 2-1: string descriptor 0 read error: -71 [ 40.499562][ T535] usb 2-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 40.508768][ T535] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.527136][ T789] usb 1-1: USB disconnect, device number 5 [ 40.553020][ T535] usb 2-1: can't set config #14, error -71 [ 40.571818][ T535] usb 2-1: USB disconnect, device number 5 [ 40.642829][ T39] usbhid 3-1:0.0: can't add hid device: -71 [ 40.648828][ T39] usbhid: probe of 3-1:0.0 failed with error -71 [ 40.661663][ T39] usb 3-1: USB disconnect, device number 3 [ 41.029693][ T860] netlink: 24 bytes leftover after parsing attributes in process `syz.0.207'. [ 41.163972][ T890] kernel profiling enabled (shift: 5) [ 41.775059][ T973] netlink: 8 bytes leftover after parsing attributes in process `syz.4.258'. [ 42.104531][ T30] kauditd_printk_skb: 237 callbacks suppressed [ 42.104545][ T30] audit: type=1400 audit(1789260661.071:440): avc: denied { bpf } for pid=991 comm="syz.0.267" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=0 [ 42.140004][ T30] audit: type=1400 audit(1789260661.091:441): avc: denied { map_create } for pid=991 comm="syz.0.267" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=0 [ 42.165500][ T30] audit: type=1400 audit(1789260661.091:442): avc: denied { map_create } for pid=991 comm="syz.0.267" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=0 [ 42.196655][ T30] audit: type=1400 audit(1789260661.161:443): avc: denied { read write } for pid=290 comm="syz-executor" name="loop4" dev="devtmpfs" ino=120 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 42.227326][ T30] audit: type=1400 audit(1789260661.171:444): avc: denied { prog_load } for pid=994 comm="syz.4.268" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=0 [ 42.251640][ T30] audit: type=1400 audit(1789260661.171:445): avc: denied { execmem } for pid=994 comm="syz.4.268" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=0 [ 42.271403][ T30] audit: type=1400 audit(1789260661.231:446): avc: denied { create } for pid=994 comm="syz.4.268" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=0 [ 42.300271][ T30] audit: type=1400 audit(1789260661.261:447): avc: denied { read write } for pid=287 comm="syz-executor" name="loop1" dev="devtmpfs" ino=117 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 42.330528][ T30] audit: type=1400 audit(1789260661.291:448): avc: denied { read write } for pid=287 comm="syz-executor" name="loop1" dev="devtmpfs" ino=117 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 42.363758][ T30] audit: type=1400 audit(1789260661.321:449): avc: denied { mounton } for pid=999 comm="syz.1.270" path="/42/config" dev="tmpfs" ino=239 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=0 [ 42.931191][ T1065] netlink: 84 bytes leftover after parsing attributes in process `syz.0.300'. [ 43.697779][ T1155] netem: change failed [ 43.702151][ T1155] device syzkaller0 entered promiscuous mode [ 44.248925][ T8] Bluetooth: hci0: Frame reassembly failed (-84) [ 44.707950][ T1219] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.715260][ T1219] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.376030][ T1241] device dummy0 entered promiscuous mode [ 45.458230][ T1249] Bluetooth: hci1: received HCILL_GO_TO_SLEEP_ACK in state 2 [ 45.473846][ T665] Bluetooth: hci1: Frame reassembly failed (-84) [ 46.322793][ T520] Bluetooth: hci0: command 0x1003 tx timeout [ 46.328853][ T1187] Bluetooth: hci0: sending frame failed (-49) [ 47.191812][ T30] kauditd_printk_skb: 353 callbacks suppressed [ 47.191826][ T30] audit: type=1400 audit(1789260666.151:803): avc: denied { read write } for pid=286 comm="syz-executor" name="loop3" dev="devtmpfs" ino=119 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 47.222372][ T30] audit: type=1400 audit(1789260666.151:804): avc: denied { mounton } for pid=1320 comm="syz.3.411" path="/99/proc" dev="tmpfs" ino=539 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=0 [ 47.245549][ T30] audit: type=1400 audit(1789260666.171:805): avc: denied { read write } for pid=286 comm="syz-executor" name="loop3" dev="devtmpfs" ino=119 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 47.245576][ T30] audit: type=1400 audit(1789260666.171:806): avc: denied { read } for pid=1322 comm="syz.3.412" name="kvm" dev="devtmpfs" ino=82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=0 [ 47.245597][ T30] audit: type=1400 audit(1789260666.191:807): avc: denied { execmem } for pid=1322 comm="syz.3.412" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=0 [ 47.311597][ T30] audit: type=1400 audit(1789260666.191:808): avc: denied { read } for pid=1322 comm="syz.3.412" name="msr" dev="devtmpfs" ino=85 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=0 [ 47.342789][ T30] audit: type=1400 audit(1789260666.301:809): avc: denied { read write } for pid=286 comm="syz-executor" name="loop3" dev="devtmpfs" ino=119 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 47.372912][ T30] audit: type=1400 audit(1789260666.341:810): avc: denied { read write } for pid=290 comm="syz-executor" name="loop4" dev="devtmpfs" ino=120 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 47.402088][ T30] audit: type=1400 audit(1789260666.371:811): avc: denied { read write } for pid=1325 comm="syz.4.414" name="fuse" dev="devtmpfs" ino=91 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=0 [ 47.429399][ T30] audit: type=1400 audit(1789260666.371:812): avc: denied { mounton } for pid=1325 comm="syz.4.414" path="/95/file0" dev="tmpfs" ino=517 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=0 [ 47.461342][ T1333] netlink: 32 bytes leftover after parsing attributes in process `syz.4.417'. [ 47.522805][ T789] Bluetooth: hci1: command 0x1003 tx timeout [ 47.539053][ T1187] Bluetooth: hci1: sending frame failed (-49) [ 47.554398][ T1343] netlink: 8 bytes leftover after parsing attributes in process `syz.4.420'. [ 47.572848][ T1345] netlink: 20 bytes leftover after parsing attributes in process `syz.1.421'. [ 48.308792][ T1387] netlink: 4 bytes leftover after parsing attributes in process `syz.1.440'. [ 48.402854][ T572] Bluetooth: hci0: command 0x1001 tx timeout [ 48.409330][ T1187] Bluetooth: hci0: sending frame failed (-49) [ 48.609667][ T665] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 48.621038][ T665] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 48.635454][ T665] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 48.648511][ T665] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 48.657112][ T665] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 48.666062][ T665] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 48.675028][ T665] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 48.684006][ T665] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 49.464662][ T1480] netlink: 8 bytes leftover after parsing attributes in process `syz.4.481'. [ 49.473924][ T1480] netlink: 12 bytes leftover after parsing attributes in process `syz.4.481'. [ 49.483457][ T1480] netlink: 8 bytes leftover after parsing attributes in process `syz.4.481'. [ 49.492396][ T1480] netlink: 12 bytes leftover after parsing attributes in process `syz.4.481'. [ 49.602794][ T64] Bluetooth: hci1: command 0x1001 tx timeout [ 49.608867][ T1187] Bluetooth: hci1: sending frame failed (-49) [ 50.492839][ T572] Bluetooth: hci0: command 0x1009 tx timeout [ 50.864604][ T1566] uffd: Set unprivileged_userfaultfd sysctl knob to 1 if kernel faults must be handled without obtaining CAP_SYS_PTRACE capability [ 51.395114][ T1621] netlink: 8 bytes leftover after parsing attributes in process `syz.3.545'. [ 51.682866][ T64] Bluetooth: hci1: command 0x1009 tx timeout [ 52.258220][ T30] kauditd_printk_skb: 446 callbacks suppressed [ 52.258239][ T30] audit: type=1400 audit(1789260671.221:1259): avc: denied { create } for pid=1691 comm="syz.0.580" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=0 [ 52.285380][ T30] audit: type=1400 audit(1789260671.251:1260): avc: denied { create } for pid=1691 comm="syz.0.580" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=0 [ 52.309773][ T30] audit: type=1400 audit(1789260671.271:1261): avc: denied { sys_admin } for pid=1691 comm="syz.0.580" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=0 [ 52.330993][ T30] audit: type=1400 audit(1789260671.271:1262): avc: denied { mounton } for pid=1691 comm="syz.0.580" path="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=0 [ 52.455653][ T30] audit: type=1400 audit(1789260671.421:1263): avc: denied { read write } for pid=290 comm="syz-executor" name="loop4" dev="devtmpfs" ino=120 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 52.484476][ T30] audit: type=1400 audit(1789260671.431:1264): avc: denied { read } for pid=1695 comm="syz.4.581" name="msr" dev="devtmpfs" ino=85 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=0 [ 52.507154][ T30] audit: type=1400 audit(1789260671.431:1265): avc: denied { write } for pid=1695 comm="syz.4.581" name="mcfilter6" dev="proc" ino=4026532679 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=0 [ 52.530547][ T30] audit: type=1400 audit(1789260671.431:1266): avc: denied { read write } for pid=290 comm="syz-executor" name="loop4" dev="devtmpfs" ino=120 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 52.554703][ T30] audit: type=1400 audit(1789260671.451:1267): avc: denied { read write } for pid=290 comm="syz-executor" name="loop4" dev="devtmpfs" ino=120 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 52.579131][ T30] audit: type=1400 audit(1789260671.451:1268): avc: denied { execmem } for pid=1700 comm="syz.4.583" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=0 [ 53.874610][ T1796] netlink: 8 bytes leftover after parsing attributes in process `syz.1.626'. [ 57.267955][ T30] kauditd_printk_skb: 486 callbacks suppressed [ 57.267969][ T30] audit: type=1400 audit(1789260673.233:1755): avc: denied { create } for pid=2125 comm="syz.1.774" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=0 [ 57.324665][ T30] audit: type=1400 audit(1789260673.233:1756): avc: denied { read write } for pid=289 comm="syz-executor" name="loop2" dev="devtmpfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 57.353938][ T2140] netlink: 20 bytes leftover after parsing attributes in process `syz.3.779'. [ 57.381317][ T30] audit: type=1400 audit(1789260673.253:1757): avc: denied { read write } for pid=287 comm="syz-executor" name="loop1" dev="devtmpfs" ino=117 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 57.381344][ T30] audit: type=1400 audit(1789260673.253:1758): avc: denied { read } for pid=2121 comm="syz.0.771" name="kvm" dev="devtmpfs" ino=82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=0 [ 57.381364][ T30] audit: type=1400 audit(1789260673.273:1759): avc: denied { name_bind } for pid=2132 comm="syz.3.776" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=0 [ 57.381384][ T30] audit: type=1400 audit(1789260673.273:1760): avc: denied { module_request } for pid=2132 comm="syz.3.776" kmod="tcp_yeah" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=0 [ 57.381404][ T30] audit: type=1400 audit(1789260673.283:1761): avc: denied { execmem } for pid=2134 comm="syz.2.778" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=0 [ 57.381422][ T30] audit: type=1400 audit(1789260673.283:1762): avc: denied { read } for pid=2134 comm="syz.2.778" name="msr" dev="devtmpfs" ino=85 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=0 [ 57.381444][ T30] audit: type=1400 audit(1789260673.313:1763): avc: denied { read write } for pid=286 comm="syz-executor" name="loop3" dev="devtmpfs" ino=119 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=0 [ 57.381464][ T30] audit: type=1400 audit(1789260673.313:1764): avc: denied { read write } for pid=2136 comm="syz.1.777" name="fuse" dev="devtmpfs" ino=91 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=0 [ 58.303698][ T2214] sch_tbf: burst 1520 is lower than device lo mtu (11337746) ! [ 59.986373][ T2340] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=2340 comm=syz.4.869 [ 60.002677][ T2344] ================================================================== [ 60.010791][ T2344] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0x88e/0x3200 [ 60.019361][ T2344] Read of size 8 at addr ffff88811710fac0 by task syz.2.871/2344 [ 60.027087][ T2344] [ 60.029413][ T2344] CPU: 1 PID: 2344 Comm: syz.2.871 Not tainted syzkaller #0 [ 60.036698][ T2344] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 60.046772][ T2344] Call Trace: [ 60.050036][ T2344] [ 60.052975][ T2344] __dump_stack+0x21/0x30 [ 60.057292][ T2344] dump_stack_lvl+0x110/0x170 [ 60.061986][ T2344] ? show_regs_print_info+0x20/0x20 [ 60.067192][ T2344] ? load_image+0x3f0/0x3f0 [ 60.071680][ T2344] print_address_description+0x7f/0x2c0 [ 60.077386][ T2344] ? tc_setup_flow_action+0x88e/0x3200 [ 60.082834][ T2344] kasan_report+0x10f/0x150 [ 60.087343][ T2344] ? tc_setup_flow_action+0x88e/0x3200 [ 60.093399][ T2344] __asan_report_load8_noabort+0x14/0x20 [ 60.099019][ T2344] tc_setup_flow_action+0x88e/0x3200 [ 60.104315][ T2344] mall_replace_hw_filter+0x2db/0x8d0 [ 60.109696][ T2344] ? pcpu_block_update_hint_alloc+0x8bc/0xc50 [ 60.115760][ T2344] ? mall_set_parms+0x520/0x520 [ 60.120599][ T2344] ? tcf_exts_destroy+0xb0/0xb0 [ 60.125461][ T2344] ? pcpu_alloc+0x1118/0x16f0 [ 60.130127][ T2344] ? mall_set_parms+0x1e4/0x520 [ 60.134960][ T2344] mall_change+0x544/0x760 [ 60.139380][ T2344] ? __kasan_check_write+0x14/0x20 [ 60.144475][ T2344] ? mall_get+0xa0/0xa0 [ 60.148643][ T2344] ? tcf_chain_tp_insert_unique+0x946/0xa70 [ 60.154548][ T2344] ? mall_get+0xa0/0xa0 [ 60.158706][ T2344] tc_new_tfilter+0x13df/0x1990 [ 60.163563][ T2344] ? tcf_gate_entry_destructor+0x20/0x20 [ 60.169183][ T2344] ? security_capable+0x87/0xb0 [ 60.174020][ T2344] ? ns_capable+0x8c/0xf0 [ 60.178334][ T2344] ? netlink_net_capable+0x125/0x160 [ 60.183610][ T2344] ? tcf_gate_entry_destructor+0x20/0x20 [ 60.189240][ T2344] rtnetlink_rcv_msg+0x83c/0xcb0 [ 60.194165][ T2344] ? rtnetlink_bind+0x80/0x80 [ 60.198840][ T2344] ? avc_has_perm_noaudit+0x390/0x490 [ 60.204214][ T2344] ? memcpy+0x56/0x70 [ 60.208187][ T2344] ? avc_has_perm_noaudit+0x30a/0x490 [ 60.213554][ T2344] ? arch_stack_walk+0xee/0x140 [ 60.218399][ T2344] ? avc_denied+0x1b0/0x1b0 [ 60.222892][ T2344] ? stack_trace_save+0xa6/0xf0 [ 60.227725][ T2344] ? avc_has_perm+0x163/0x250 [ 60.232390][ T2344] ? avc_has_perm_noaudit+0x490/0x490 [ 60.237762][ T2344] ? x64_sys_call+0x4b/0x9a0 [ 60.242358][ T2344] ? selinux_nlmsg_lookup+0x39d/0x440 [ 60.247802][ T2344] netlink_rcv_skb+0x1e9/0x430 [ 60.252568][ T2344] ? rtnetlink_bind+0x80/0x80 [ 60.257244][ T2344] ? netlink_ack+0xb10/0xb10 [ 60.261834][ T2344] ? _copy_from_iter+0x4a4/0x10a0 [ 60.266860][ T2344] ? __netlink_lookup+0x387/0x3b0 [ 60.271883][ T2344] rtnetlink_rcv+0x1c/0x20 [ 60.276294][ T2344] netlink_unicast+0x86c/0xa30 [ 60.281048][ T2344] netlink_sendmsg+0x879/0xb80 [ 60.285805][ T2344] ? netlink_getsockopt+0x530/0x530 [ 60.291164][ T2344] ? security_socket_sendmsg+0x82/0xa0 [ 60.296629][ T2344] ? netlink_getsockopt+0x530/0x530 [ 60.301823][ T2344] ____sys_sendmsg+0x5be/0x8f0 [ 60.306594][ T2344] ? __sys_sendmsg_sock+0x40/0x40 [ 60.311623][ T2344] ? import_iovec+0x7c/0xb0 [ 60.316112][ T2344] ___sys_sendmsg+0x236/0x2e0 [ 60.320772][ T2344] ? __sys_sendmsg+0x280/0x280 [ 60.325518][ T2344] ? sock_show_fdinfo+0xa0/0xa0 [ 60.330358][ T2344] ? __fdget+0x1a1/0x230 [ 60.334585][ T2344] __x64_sys_sendmsg+0x201/0x2d0 [ 60.339508][ T2344] ? ___sys_sendmsg+0x2e0/0x2e0 [ 60.344365][ T2344] ? __kasan_check_write+0x14/0x20 [ 60.349476][ T2344] ? switch_fpu_return+0x15d/0x2c0 [ 60.354594][ T2344] x64_sys_call+0x4b/0x9a0 [ 60.359003][ T2344] do_syscall_64+0x4c/0xa0 [ 60.363404][ T2344] ? clear_bhb_loop+0x50/0xa0 [ 60.368070][ T2344] ? clear_bhb_loop+0x50/0xa0 [ 60.372732][ T2344] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 60.378649][ T2344] RIP: 0033:0x7f87c5778159 [ 60.383048][ T2344] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 60.402658][ T2344] RSP: 002b:00007f87c41d1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 60.411056][ T2344] RAX: ffffffffffffffda RBX: 00007f87c59fffa0 RCX: 00007f87c5778159 [ 60.419102][ T2344] RDX: 0000000020000000 RSI: 0000200000000580 RDI: 0000000000000004 [ 60.427074][ T2344] RBP: 00007f87c580f03b R08: 0000000000000000 R09: 0000000000000000 [ 60.435047][ T2344] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 60.442999][ T2344] R13: 00007f87c5a00038 R14: 00007f87c59fffa0 R15: 00007fffdba75d98 [ 60.450955][ T2344] [ 60.453960][ T2344] [ 60.456264][ T2344] Allocated by task 2344: [ 60.460582][ T2344] __kasan_kmalloc+0xd4/0x100 [ 60.465281][ T2344] __kmalloc+0x13d/0x2c0 [ 60.469528][ T2344] tcf_idr_create+0x5f/0x790 [ 60.474112][ T2344] tcf_idr_create_from_flags+0x61/0x70 [ 60.479663][ T2344] tcf_gact_init+0x342/0x570 [ 60.484242][ T2344] tcf_action_init_1+0x3fd/0x6b0 [ 60.490120][ T2344] tcf_action_init+0x233/0x7a0 [ 60.494894][ T2344] tcf_exts_validate+0x24a/0x580 [ 60.499841][ T2344] mall_set_parms+0x48/0x520 [ 60.505118][ T2344] mall_change+0x478/0x760 [ 60.509518][ T2344] tc_new_tfilter+0x13df/0x1990 [ 60.514368][ T2344] rtnetlink_rcv_msg+0x83c/0xcb0 [ 60.519287][ T2344] netlink_rcv_skb+0x1e9/0x430 [ 60.524030][ T2344] rtnetlink_rcv+0x1c/0x20 [ 60.528425][ T2344] netlink_unicast+0x86c/0xa30 [ 60.533274][ T2344] netlink_sendmsg+0x879/0xb80 [ 60.538016][ T2344] ____sys_sendmsg+0x5be/0x8f0 [ 60.542761][ T2344] ___sys_sendmsg+0x236/0x2e0 [ 60.547437][ T2344] __x64_sys_sendmsg+0x201/0x2d0 [ 60.552369][ T2344] x64_sys_call+0x4b/0x9a0 [ 60.556762][ T2344] do_syscall_64+0x4c/0xa0 [ 60.561155][ T2344] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 60.567046][ T2344] [ 60.569358][ T2344] The buggy address belongs to the object at ffff88811710fa00 [ 60.569358][ T2344] which belongs to the cache kmalloc-192 of size 192 [ 60.583576][ T2344] The buggy address is located 0 bytes to the right of [ 60.583576][ T2344] 192-byte region [ffff88811710fa00, ffff88811710fac0) [ 60.597183][ T2344] The buggy address belongs to the page: [ 60.602806][ T2344] page:ffffea00045c43c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11710f [ 60.613042][ T2344] flags: 0x4000000000000200(slab|zone=1) [ 60.618677][ T2344] raw: 4000000000000200 ffffea000458abc0 0000000300000003 ffff888100042c00 [ 60.627242][ T2344] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 60.635807][ T2344] page dumped because: kasan: bad access detected [ 60.642220][ T2344] page_owner tracks the page as allocated [ 60.647937][ T2344] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 106, ts 4480408627, free_ts 0 [ 60.662933][ T2344] post_alloc_hook+0x192/0x1b0 [ 60.667682][ T2344] prep_new_page+0x1c/0x110 [ 60.672169][ T2344] get_page_from_freelist+0x2c3a/0x2cd0 [ 60.677760][ T2344] __alloc_pages+0x1a2/0x460 [ 60.682332][ T2344] new_slab+0xa0/0x4d0 [ 60.686489][ T2344] ___slab_alloc+0x3ac/0x840 [ 60.691083][ T2344] __slab_alloc+0x49/0x90 [ 60.695403][ T2344] kmem_cache_alloc_trace+0x146/0x270 [ 60.700761][ T2344] kernfs_fop_open+0x375/0xbb0 [ 60.705508][ T2344] do_dentry_open+0x82a/0x1010 [ 60.710257][ T2344] vfs_open+0x73/0x80 [ 60.714219][ T2344] path_openat+0x26e6/0x2f80 [ 60.718794][ T2344] do_filp_open+0x1df/0x400 [ 60.723309][ T2344] do_sys_openat2+0x15e/0x7f0 [ 60.727963][ T2344] __x64_sys_openat+0x136/0x160 [ 60.732795][ T2344] x64_sys_call+0x219/0x9a0 [ 60.737278][ T2344] page_owner free stack trace missing [ 60.742656][ T2344] [ 60.744959][ T2344] Memory state around the buggy address: [ 60.750570][ T2344] ffff88811710f980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 60.758650][ T2344] ffff88811710fa00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 60.766705][ T2344] >ffff88811710fa80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 60.774764][ T2344] ^ [ 60.780897][ T2344] ffff88811710fb00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.788938][ T2344] ffff88811710fb80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 60.796979][ T2344] ================================================================== [ 60.805019][ T2344] Disabling lock debugging due to kernel taint Sep 13 00:51:16 syzkaller kern.alert kernel: [ 60.642220][ T2344] page_owner tracks the page as allocated Sep 13 00:51:16 syzkaller kern.alert kernel: [ 60.647937][ T2344] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 106, ts 4480408627, free_ts 0 Sep 13 00:51:16 syzkaller kern.alert kernel: [ 60.737278][ T2344] page_owner free stack trace missing