last executing test programs: 2.140755197s ago: executing program 2 (id=106): r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000001a0001000000000000000a0080202000", @ANYBLOB='\x00\\'], 0x38}, 0x1, 0x0, 0x0, 0x10004040}, 0x0) 2.088250298s ago: executing program 2 (id=107): mremap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r0, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) 2.088129589s ago: executing program 2 (id=108): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x2c, r1, 0x1, 0x0, 0x8000000, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_TX_RATES={0x10, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xc, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4810}, 0x10) 2.088061438s ago: executing program 2 (id=109): openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2040, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x42140, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000a40)=ANY=[@ANYBLOB="12010000e3ddef20501da1604fa101020301090212"], 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f00000077c0), 0x280, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x48, &(0x7f000000d100)=ANY=[@ANYRES8=r2, @ANYRES16=r1], 0x8) 1.756290677s ago: executing program 0 (id=112): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2c, &(0x7f00000004c0)=0x79, 0x4) 1.756098687s ago: executing program 0 (id=113): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f00000000c0)="10", 0xfffffffe}], 0x1, &(0x7f00000004c0)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}, 0x8841) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) 1.756000887s ago: executing program 0 (id=114): getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000080)={@dev, 0x0}, &(0x7f00000000c0)=0x14) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000340)={{{@in=@remote, @in=@empty, 0x4e20, 0xc, 0x4e21, 0x0, 0x2, 0x80, 0x20, 0x0, r0}, {0x1, 0x9, 0x80000000, 0x8, 0x6, 0x6, 0x4, 0x2}, {0x6, 0x6afd, 0x6, 0xfff}, 0x8, 0x0, 0x0, 0x1, 0x0, 0x3}, {{@in6=@mcast1, 0x4d3, 0x3c}, 0xa, @in6=@empty, 0x3505, 0x2, 0x2, 0xc, 0xfff00000, 0x9, 0x1}}, 0xe8) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000001a0001002dbd7000010000000a"], 0x38}, 0x1, 0x0, 0x0, 0x404c055}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f00000000c0)={0x9}, 0x10) sendmsg$nl_route_sched(r1, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) 1.755959867s ago: executing program 0 (id=115): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/bus/input/devices\x00', 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 1.751895967s ago: executing program 0 (id=116): r0 = syz_usb_connect(0x1, 0x2d, &(0x7f0000000340)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904010001faf40d00090582239f"], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x800000000000) r2 = socket$inet_tcp(0x2, 0x1, 0x6) setsockopt$inet_tcp_buf(r2, 0x6, 0x1f, &(0x7f0000000400)='espintcp', 0x8) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r3, 0xffffffffffffffff, 0x0) syz_usb_disconnect(r0) read$char_usb(r1, 0x0, 0x0) 487.906868ms ago: executing program 2 (id=130): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001700)=ANY=[@ANYBLOB="18000000240001"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) recvmmsg(r0, &(0x7f0000004ec0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000002c0)=""/4077, 0xfed}], 0x1}, 0x9}], 0x1, 0x2000, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) connect$inet6(r1, &(0x7f0000000140)={0xa, 0x4e20, 0x4, @remote, 0xb}, 0x1c) syz_emit_ethernet(0x7e, &(0x7f0000000300)={@local, @multicast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x48, 0x11, 0x0, @remote, @local, {[], {0x4e20, 0xe22, 0x48, 0x0, @wg=@cookie={0x3, 0x2, "88c73b21f267636d01dbe5712c1c941e1cdafbbb43f09c28", "e13808ca72381f41e5fff9620915b6f78670dfaf9a2038083179cf6b7931c9b4"}}}}}}}, 0x0) syz_emit_ethernet(0xfef3, &(0x7f0000000380)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd6001010020641100fe8000000000000000000000000000bbfe8000000000000000000000000000aa4e200e22"], 0x0) 438.302949ms ago: executing program 2 (id=132): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) sendto$inet(r0, &(0x7f0000000240)='<', 0xfffffcc0, 0x805, 0x0, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) 437.681889ms ago: executing program 3 (id=135): r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) 376.25162ms ago: executing program 3 (id=136): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}}, 0x44004000) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x34, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_POSITION_ID={0x8, 0xa, 0x1, 0x0, 0x2}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x5c}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044850) 376.07114ms ago: executing program 3 (id=137): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000540)={'dummy0\x00', &(0x7f0000000300)=@ethtool_ts_info}) 352.263311ms ago: executing program 3 (id=138): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x10) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$NL80211_CMD_SET_NOACK_MAP(r0, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x20, 0x0, 0x800, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x0, 0x4d}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4000c}, 0x10) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000100)=0x1800, 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=@newlink={0x34, 0x10, 0x439, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, 0x0, 0x9801}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}]}, 0x34}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000040)={'syz_tun\x00', &(0x7f0000000180)=@ethtool_link_settings={0x4d, 0x600, 0xf, 0x80, 0x0, 0x0, 0xfc, 0x1, 0x80, 0x4, [0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x4]}}) 335.263651ms ago: executing program 3 (id=139): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x300) setsockopt$inet_int(r0, 0x0, 0x14, &(0x7f0000000000)=0x40, 0x4) recvmmsg(r0, &(0x7f00000025c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001a00)=""/125, 0x7d}, 0x9}], 0x1, 0x45833af92e4b39ff, 0x0) 280.369353ms ago: executing program 1 (id=140): r0 = socket$xdp(0x2c, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000400)=0x10, 0x4) 279.979953ms ago: executing program 1 (id=142): r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f00000006c0), 0x82, 0x0) writev(r0, &(0x7f0000001dc0)=[{&(0x7f0000000b00)="e653adee", 0x4}], 0x1) 264.090533ms ago: executing program 1 (id=144): r0 = socket$can_bcm(0x1d, 0x2, 0x2) sendmsg$can_bcm(r0, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={0x0}, 0x1, 0x0, 0x0, 0x40084}, 0x20000000) 203.967075ms ago: executing program 1 (id=145): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB="500000000201010800000000000000000a000007300001802c0001"], 0x50}, 0x1, 0x0, 0x0, 0x20000880}, 0x4800) 203.459365ms ago: executing program 4 (id=147): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, r0, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0xc) 189.973895ms ago: executing program 1 (id=148): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r0, 0x0) ioctl$int_in(r0, 0x5452, 0x0) 172.807715ms ago: executing program 1 (id=149): r0 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, 0x0, 0x0, 0x0, 0x4a, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000b, 0x28011, r1, 0x0) preadv(r1, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000fe4000/0x11000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004084) r2 = io_uring_setup(0x899, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) 128.283246ms ago: executing program 4 (id=150): epoll_create1(0x80000) mremap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000004000/0x4000)=nil) read$FUSE(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) futex(0x0, 0x5, 0x0, 0x0, 0x0, 0x0) 127.982777ms ago: executing program 4 (id=151): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x0, 0x0, 0x3e8}}}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=@newtclass={0x44, 0x28, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x1, 0x1}, {0x0, 0x1}}, [@tclass_kind_options=@c_hfsc={{0x9}, {0x14, 0x2, [@TCA_HFSC_FSC={0x10, 0x2, {0x0, 0x0, 0x3e8}}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd2b, 0x2, {0x0, 0x0, 0x0, r2, {0x0, 0x10}, {}, {0x8, 0x4}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x1, 0x10}}]}}]}, 0x3c}}, 0x0) 127.861026ms ago: executing program 3 (id=152): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) 108.524377ms ago: executing program 0 (id=153): r0 = socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x72, &(0x7f0000000100)={@broadcast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x64, 0x4, 0x0, 0xfe, 0x1, 0x0, @rand_addr=0x64010101, @local}, @time_exceeded={0x5, 0x0, 0x0, 0xe0, 0x1, 0xe000, {0x12, 0x4, 0x0, 0x0, 0x3, 0x4, 0x0, 0x0, 0x11, 0x0, @rand_addr=0x64010100, @local, {[@cipso={0x86, 0x6, 0x3}, @timestamp_prespec={0x44, 0x2c, 0xfd, 0x3, 0x4, [{@private=0xa010100}, {@remote, 0xfffffffe}, {@empty, 0x1}, {@remote, 0x4}, {@local, 0x1}]}]}}}}}}}, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, &(0x7f0000002b80), 0x41000004, &(0x7f0000000040)) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000002880)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d0, 0x1e0, 0xc8, 0x8, 0x1e0, 0x5803, 0x2f0, 0x2e8, 0x2e8, 0x2f0, 0x2e8, 0x3, 0x0, {[{{@uncond, 0x0, 0xa8, 0xf0, 0x0, {0x0, 0x2000000000000}}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x89, 0x8, 0xe, 'syz0\x00', {0x1}}}}, {{@uncond, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x330) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000ac0)=@newtaction={0x78, 0x1d, 0x1, 0x70bd28, 0x0, {}, [{0x64, 0x1, [@m_vlan={0x30, 0x1e, 0x0, 0x0, {{0x9}, {0x4}, {0x4}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x2}}}}, @m_mpls={0x30, 0xe, 0x0, 0x0, {{0x9}, {0x4}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x4}, 0x0) 81.917838ms ago: executing program 4 (id=154): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, 0x0, 0x0) syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x81, 0x0, 0x0) mremap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000, 0x3, &(0x7f0000d62000/0x2000)=nil) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) 287.86µs ago: executing program 4 (id=155): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000300)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000ff4000/0xc000)=nil, 0xc000, 0x1000007, 0x20031, 0xffffffffffffffff, 0xd0db8000) 0s ago: executing program 4 (id=156): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x25dddbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}, {0x1, 0x4}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x48814) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000004c0)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r6, {0x0, 0x4}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x4, 0xffffff00, 0x4, 0xc31, 0x7}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x20000010}, 0x4) sendmsg$nl_route_sched(r3, &(0x7f0000000700)={0x0, 0x1e5, &(0x7f00000006c0)={&(0x7f0000000440)=@deltaction={0x28, 0x32, 0x101, 0x0, 0x0, {}, [@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}]}]}, 0x28}}, 0x0) kernel console output (not intermixed with test programs): rocess permissive=1 [ 15.813857][ T30] audit: type=1400 audit(1788647626.192:63): avc: denied { siginh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.32' (ED25519) to the list of known hosts. [ 23.036157][ T30] audit: type=1400 audit(1788647633.452:64): avc: denied { mounton } for pid=277 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.040055][ T277] cgroup: Unknown subsys name 'net' [ 23.059004][ T30] audit: type=1400 audit(1788647633.452:65): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.086404][ T30] audit: type=1400 audit(1788647633.482:66): avc: denied { unmount } for pid=277 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.086837][ T277] cgroup: Unknown subsys name 'devices' [ 23.230548][ T277] cgroup: Unknown subsys name 'hugetlb' [ 23.236327][ T277] cgroup: Unknown subsys name 'rlimit' [ 23.348109][ T30] audit: type=1400 audit(1788647633.762:67): avc: denied { setattr } for pid=277 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.371683][ T30] audit: type=1400 audit(1788647633.762:68): avc: denied { mounton } for pid=277 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.396434][ T30] audit: type=1400 audit(1788647633.762:69): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.520706][ T279] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 23.529671][ T30] audit: type=1400 audit(1788647633.952:70): avc: denied { relabelto } for pid=279 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 23.555146][ T30] audit: type=1400 audit(1788647633.952:71): avc: denied { write } for pid=279 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.592446][ T30] audit: type=1400 audit(1788647634.012:72): avc: denied { read } for pid=277 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.618437][ T30] audit: type=1400 audit(1788647634.012:73): avc: denied { open } for pid=277 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.618510][ T277] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 24.330800][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.337894][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.345468][ T287] device bridge_slave_0 entered promiscuous mode [ 24.353612][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.360914][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.368429][ T287] device bridge_slave_1 entered promiscuous mode [ 24.380187][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.387251][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.394736][ T286] device bridge_slave_0 entered promiscuous mode [ 24.401697][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.408804][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.416323][ T286] device bridge_slave_1 entered promiscuous mode [ 24.474382][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.481689][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.489239][ T285] device bridge_slave_0 entered promiscuous mode [ 24.507648][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.514748][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.522219][ T285] device bridge_slave_1 entered promiscuous mode [ 24.558870][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.565947][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.573415][ T289] device bridge_slave_0 entered promiscuous mode [ 24.583057][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.590172][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.597649][ T289] device bridge_slave_1 entered promiscuous mode [ 24.664444][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.671574][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.679098][ T288] device bridge_slave_0 entered promiscuous mode [ 24.686104][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.693226][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.700691][ T288] device bridge_slave_1 entered promiscuous mode [ 24.809963][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.817048][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.824413][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.831501][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.840539][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.847612][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.855067][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.862135][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.870276][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.877339][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.884765][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.891823][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.909782][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.916853][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.924296][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.931370][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.967147][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.974234][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.981535][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.988610][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.010092][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.017489][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.024980][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.032406][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.039703][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.047458][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.056220][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.063512][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.071466][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.080254][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.088774][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.095946][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.122388][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.131465][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.139890][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.146924][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.154441][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.164724][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 25.172234][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.193081][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.201393][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.210067][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.218174][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.225285][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.232975][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.241375][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.248456][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.255896][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.264121][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.271167][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.305237][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.321505][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.329851][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.336894][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.344405][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.352650][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.362260][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.370367][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.378594][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.385622][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.393075][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.401181][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.409540][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.416662][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.424099][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.432200][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.440263][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.448144][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.456284][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.464409][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.472566][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.480739][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.489189][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.497662][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.505313][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.513447][ T289] device veth0_vlan entered promiscuous mode [ 25.529978][ T285] device veth0_vlan entered promiscuous mode [ 25.541967][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.550425][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.558842][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.567269][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.576054][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.583810][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.603311][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.612097][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.620731][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.629282][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.637452][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.649654][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.657767][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.669275][ T285] device veth1_macvtap entered promiscuous mode [ 25.676244][ T287] device veth0_vlan entered promiscuous mode [ 25.685626][ T288] device veth0_vlan entered promiscuous mode [ 25.698386][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.706174][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.714257][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.722550][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.730723][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.738839][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.748110][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.756688][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.765216][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.773573][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.781946][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.789644][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.797045][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.804581][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.812491][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.820152][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.828932][ T289] device veth1_macvtap entered promiscuous mode [ 25.838279][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.846568][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.856858][ T286] device veth0_vlan entered promiscuous mode [ 25.872578][ T288] device veth1_macvtap entered promiscuous mode [ 25.881887][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.890374][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.898788][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.907053][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.915375][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.925017][ T287] device veth1_macvtap entered promiscuous mode [ 25.941604][ T285] request_module fs-gadgetfs succeeded, but still no fs? [ 25.958681][ T307] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.967907][ T307] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.976427][ T307] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.985440][ T307] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.994399][ T307] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.013115][ T286] device veth1_macvtap entered promiscuous mode [ 26.032046][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.043066][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.051634][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.060917][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.075439][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.084194][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.092659][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.106168][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.114514][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.137552][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.152107][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.200703][ T325] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 26.211013][ T326] device syzkaller0 entered promiscuous mode [ 26.468308][ T60] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 26.468885][ T39] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 26.608298][ T305] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 26.828344][ T60] usb 4-1: too many endpoints for config 1 interface 0 altsetting 13: 33, using maximum allowed: 30 [ 26.839445][ T60] usb 4-1: config 1 interface 0 altsetting 13 has 1 endpoint descriptor, different from the interface descriptor's value: 33 [ 26.852611][ T60] usb 4-1: config 1 interface 0 has no altsetting 0 [ 26.968372][ T305] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 26.978145][ T305] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 26.987975][ T305] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 27.018443][ T60] usb 4-1: New USB device found, idVendor=0458, idProduct=5013, bcdDevice= 0.40 [ 27.027732][ T60] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.035875][ T60] usb 4-1: Product: syz [ 27.040223][ T60] usb 4-1: Manufacturer: syz [ 27.044818][ T60] usb 4-1: SerialNumber: syz [ 27.048598][ T39] usb 1-1: New USB device found, idVendor=0cf2, idProduct=6250, bcdDevice= 0.00 [ 27.058629][ T39] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.066647][ T39] usb 1-1: Product: syz [ 27.070943][ T39] usb 1-1: Manufacturer: syz [ 27.075591][ T39] usb 1-1: SerialNumber: syz [ 27.119424][ T39] usb-storage 1-1:1.0: USB Mass Storage device detected [ 27.167722][ T336] syz.2.9 (336) used greatest stack depth: 21640 bytes left [ 27.188912][ T305] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 27.204736][ T305] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 27.213302][ T305] usb 5-1: Product: syz [ 27.217516][ T305] usb 5-1: Manufacturer: syz [ 27.222340][ T305] usb 5-1: SerialNumber: syz [ 27.321316][ T39] usb 1-1: USB disconnect, device number 2 [ 27.379426][ T366] fuse: Bad value for 'fd' [ 27.479982][ T305] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 2 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 27.611013][ T403] capability: warning: `syz.1.38' uses 32-bit capabilities (legacy support in use) [ 27.658356][ T60] usbhid 4-1:1.0: can't add hid device: -71 [ 27.664464][ T60] usbhid: probe of 4-1:1.0 failed with error -71 [ 27.672081][ T60] usb 4-1: USB disconnect, device number 2 [ 27.682197][ T39] usb 5-1: USB disconnect, device number 2 [ 27.693919][ T39] usblp0: removed [ 27.995593][ T422] netlink: 12 bytes leftover after parsing attributes in process `syz.3.45'. [ 28.018266][ T422] netlink: 8 bytes leftover after parsing attributes in process `syz.3.45'. [ 28.027007][ T422] netlink: 8 bytes leftover after parsing attributes in process `syz.3.45'. [ 28.078781][ T30] kauditd_printk_skb: 62 callbacks suppressed [ 28.078796][ T30] audit: type=1400 audit(1788647638.502:136): avc: denied { create } for pid=424 comm="syz.3.46" dev="anon_inodefs" ino=16191 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 28.120181][ T30] audit: type=1400 audit(1788647638.532:137): avc: denied { ioctl } for pid=424 comm="syz.3.46" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=16191 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 28.146980][ T30] audit: type=1400 audit(1788647638.572:138): avc: denied { accept } for pid=419 comm="syz.0.44" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 28.270620][ T30] audit: type=1400 audit(1788647638.692:139): avc: denied { append } for pid=436 comm="syz.3.52" name="001" dev="devtmpfs" ino=184 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 28.491199][ T30] audit: type=1400 audit(1788647638.912:140): avc: denied { unmount } for pid=285 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 28.569655][ T30] audit: type=1400 audit(1788647638.942:141): avc: denied { mounton } for pid=455 comm="syz.3.62" path="/12/file0" dev="tmpfs" ino=78 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 28.594648][ T462] netlink: 4 bytes leftover after parsing attributes in process `syz.3.64'. [ 28.627520][ T30] audit: type=1400 audit(1788647638.952:142): avc: denied { read write } for pid=457 comm="syz.4.63" name="vga_arbiter" dev="devtmpfs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 28.654065][ T30] audit: type=1400 audit(1788647638.952:143): avc: denied { open } for pid=457 comm="syz.4.63" path="/dev/vga_arbiter" dev="devtmpfs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 28.681492][ T30] audit: type=1400 audit(1788647639.062:144): avc: denied { read } for pid=469 comm="syz.2.68" name="usbmon0" dev="devtmpfs" ino=155 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 28.728604][ T30] audit: type=1400 audit(1788647639.072:145): avc: denied { open } for pid=469 comm="syz.2.68" path="/dev/usbmon0" dev="devtmpfs" ino=155 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 28.924364][ T488] kvm [487]: vcpu0, guest rIP: 0x1b8 disabled perfctr wrmsr: 0xc2 data 0x0 [ 29.027361][ T505] netlink: 4 bytes leftover after parsing attributes in process `syz.2.84'. [ 29.138284][ T305] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 29.171306][ T530] process 'syz.2.94' launched './file0' with NULL argv: empty string added [ 29.180102][ T529] netlink: 12 bytes leftover after parsing attributes in process `syz.1.95'. [ 29.189225][ T529] netlink: 8 bytes leftover after parsing attributes in process `syz.1.95'. [ 29.198024][ T529] netlink: 8 bytes leftover after parsing attributes in process `syz.1.95'. [ 29.233439][ T534] Zero length message leads to an empty skb [ 29.518334][ T305] usb 5-1: config index 0 descriptor too short (expected 23569, got 27) [ 29.526841][ T305] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 29.568303][ T39] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 29.608330][ T305] usb 5-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 29.617541][ T305] usb 5-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 29.625974][ T305] usb 5-1: Manufacturer: syz [ 29.631656][ T305] usb 5-1: config 0 descriptor?? [ 29.708292][ T306] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 29.818310][ T39] usb 2-1: Using ep0 maxpacket: 32 [ 29.858354][ T60] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 29.870248][ T20] usb 5-1: USB disconnect, device number 3 [ 29.938338][ T39] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 29.949366][ T39] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 29.958328][ T306] usb 3-1: Using ep0 maxpacket: 32 [ 29.959213][ T39] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 29.973310][ T39] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.982002][ T39] usb 2-1: config 0 descriptor?? [ 30.018948][ T39] hub 2-1:0.0: USB hub found [ 30.058325][ T6] usb 1-1: new low-speed USB device number 3 using dummy_hcd [ 30.088311][ T306] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 30.098629][ T306] usb 3-1: config 0 has no interfaces? [ 30.228311][ T60] usb 4-1: unable to get BOS descriptor or descriptor too short [ 30.258354][ T306] usb 3-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 30.267638][ T306] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.276488][ T306] usb 3-1: Product: syz [ 30.280966][ T306] usb 3-1: Manufacturer: syz [ 30.285585][ T306] usb 3-1: SerialNumber: syz [ 30.288533][ T39] hub 2-1:0.0: 1 port detected [ 30.294242][ T306] usb 3-1: config 0 descriptor?? [ 30.348407][ T60] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 30.356170][ T60] usb 4-1: can't read configurations, error -71 [ 30.418396][ T6] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 30.426505][ T6] usb 1-1: config 0 has no interface number 0 [ 30.432678][ T6] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 30.443763][ T6] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 30.454507][ T6] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 30.463564][ T6] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.472257][ T6] usb 1-1: config 0 descriptor?? [ 30.488376][ T573] raw-gadget.4 gadget: fail, usb_ep_enable returned -22 [ 30.518295][ T39] hub 2-1:0.0: hub_hub_status failed (err = -71) [ 30.524788][ T39] hub 2-1:0.0: config failed, can't get hub status (err -71) [ 30.540378][ T6] usb 3-1: USB disconnect, device number 2 [ 30.628345][ T39] usbhid 2-1:0.0: can't add hid device: -71 [ 30.634368][ T39] usbhid: probe of 2-1:0.0 failed with error -71 [ 30.668768][ T39] usb 2-1: USB disconnect, device number 2 [ 30.712689][ T305] usb 1-1: USB disconnect, device number 3 [ 31.114268][ T616] user requested TSC rate below hardware speed [ 31.122105][ T616] kvm: vcpu 2: requested 148514 ns lapic timer period limited to 200000 ns [ 31.131497][ T616] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 31.306271][ T641] netlink: 12 bytes leftover after parsing attributes in process `syz.1.145'. [ 31.323459][ T641] netlink: 40 bytes leftover after parsing attributes in process `syz.1.145'. [ 31.540480][ T667] ================================================================== [ 31.548611][ T667] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0x88e/0x3200 [ 31.556814][ T667] Read of size 8 at addr ffff8881193879c0 by task syz.4.156/667 [ 31.564463][ T667] [ 31.566812][ T667] CPU: 1 PID: 667 Comm: syz.4.156 Not tainted syzkaller #0 [ 31.574009][ T667] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 31.584079][ T667] Call Trace: [ 31.587363][ T667] [ 31.590297][ T667] __dump_stack+0x21/0x30 [ 31.594648][ T667] dump_stack_lvl+0x110/0x170 [ 31.599338][ T667] ? show_regs_print_info+0x20/0x20 [ 31.604568][ T667] ? load_image+0x3f0/0x3f0 [ 31.609101][ T667] print_address_description+0x7f/0x2c0 [ 31.614768][ T667] ? tc_setup_flow_action+0x88e/0x3200 [ 31.620246][ T667] kasan_report+0x10f/0x150 [ 31.624794][ T667] ? tc_setup_flow_action+0x88e/0x3200 [ 31.630286][ T667] __asan_report_load8_noabort+0x14/0x20 [ 31.635926][ T667] tc_setup_flow_action+0x88e/0x3200 [ 31.641221][ T667] mall_replace_hw_filter+0x2db/0x8d0 [ 31.646605][ T667] ? pcpu_block_update_hint_alloc+0x8bc/0xc50 [ 31.652697][ T667] ? mall_set_parms+0x520/0x520 [ 31.657576][ T667] ? tcf_exts_destroy+0xb0/0xb0 [ 31.662438][ T667] ? pcpu_alloc+0x1118/0x16f0 [ 31.667133][ T667] ? mall_set_parms+0x1e4/0x520 [ 31.671989][ T667] mall_change+0x544/0x760 [ 31.676405][ T667] ? __kasan_check_write+0x14/0x20 [ 31.681538][ T667] ? mall_get+0xa0/0xa0 [ 31.685714][ T667] ? tcf_chain_tp_insert_unique+0x946/0xa70 [ 31.691628][ T667] ? mall_get+0xa0/0xa0 [ 31.695830][ T667] tc_new_tfilter+0x13df/0x1990 [ 31.700686][ T667] ? tcf_gate_entry_destructor+0x20/0x20 [ 31.706377][ T667] ? security_capable+0x87/0xb0 [ 31.711246][ T667] ? ns_capable+0x8c/0xf0 [ 31.715578][ T667] ? netlink_net_capable+0x125/0x160 [ 31.720873][ T667] ? tcf_gate_entry_destructor+0x20/0x20 [ 31.726537][ T667] rtnetlink_rcv_msg+0x83c/0xcb0 [ 31.731499][ T667] ? rtnetlink_bind+0x80/0x80 [ 31.736175][ T667] ? avc_has_perm_noaudit+0x390/0x490 [ 31.741549][ T667] ? memcpy+0x56/0x70 [ 31.745565][ T667] ? avc_has_perm_noaudit+0x30a/0x490 [ 31.750973][ T667] ? arch_stack_walk+0xee/0x140 [ 31.755850][ T667] ? avc_denied+0x1b0/0x1b0 [ 31.760372][ T667] ? stack_trace_save+0xa6/0xf0 [ 31.765273][ T667] ? avc_has_perm+0x163/0x250 [ 31.769982][ T667] ? avc_has_perm_noaudit+0x490/0x490 [ 31.775370][ T667] ? x64_sys_call+0x4b/0x9a0 [ 31.779992][ T667] ? selinux_nlmsg_lookup+0x39d/0x440 [ 31.785373][ T667] netlink_rcv_skb+0x1e9/0x430 [ 31.790146][ T667] ? rtnetlink_bind+0x80/0x80 [ 31.794850][ T667] ? netlink_ack+0xb10/0xb10 [ 31.799476][ T667] ? _copy_from_iter+0x4a4/0x10a0 [ 31.804528][ T667] ? __netlink_lookup+0x387/0x3b0 [ 31.809745][ T667] rtnetlink_rcv+0x1c/0x20 [ 31.814169][ T667] netlink_unicast+0x86c/0xa30 [ 31.818963][ T667] netlink_sendmsg+0x879/0xb80 [ 31.823760][ T667] ? netlink_getsockopt+0x530/0x530 [ 31.828971][ T667] ? security_socket_sendmsg+0x82/0xa0 [ 31.834453][ T667] ? netlink_getsockopt+0x530/0x530 [ 31.839692][ T667] ____sys_sendmsg+0x5be/0x8f0 [ 31.844570][ T667] ? __sys_sendmsg_sock+0x40/0x40 [ 31.849612][ T667] ? import_iovec+0x7c/0xb0 [ 31.854125][ T667] ___sys_sendmsg+0x236/0x2e0 [ 31.858902][ T667] ? __sys_sendmsg+0x280/0x280 [ 31.863697][ T667] ? sock_show_fdinfo+0xa0/0xa0 [ 31.868576][ T667] ? __fdget+0x1a1/0x230 [ 31.872833][ T667] __x64_sys_sendmsg+0x201/0x2d0 [ 31.877779][ T667] ? ___sys_sendmsg+0x2e0/0x2e0 [ 31.882634][ T667] ? __kasan_check_write+0x14/0x20 [ 31.887970][ T667] ? switch_fpu_return+0x15d/0x2c0 [ 31.893179][ T667] x64_sys_call+0x4b/0x9a0 [ 31.897619][ T667] do_syscall_64+0x4c/0xa0 [ 31.902085][ T667] ? clear_bhb_loop+0x50/0xa0 [ 31.906782][ T667] ? clear_bhb_loop+0x50/0xa0 [ 31.911469][ T667] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 31.917380][ T667] RIP: 0033:0x7f495f411159 [ 31.921815][ T667] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 31.941433][ T667] RSP: 002b:00007f495de6a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 31.949886][ T667] RAX: ffffffffffffffda RBX: 00007f495f698fa0 RCX: 00007f495f411159 [ 31.957892][ T667] RDX: 0000000000000004 RSI: 0000200000000580 RDI: 0000000000000006 [ 31.965875][ T667] RBP: 00007f495f4a8024 R08: 0000000000000000 R09: 0000000000000000 [ 31.973891][ T667] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 31.981875][ T667] R13: 00007f495f699038 R14: 00007f495f698fa0 R15: 00007ffe9bb60fa8 [ 31.989861][ T667] [ 31.992891][ T667] [ 31.995220][ T667] Allocated by task 667: [ 31.999462][ T667] __kasan_kmalloc+0xd4/0x100 [ 32.004150][ T667] __kmalloc+0x13d/0x2c0 [ 32.008410][ T667] tcf_idr_create+0x5f/0x790 [ 32.013013][ T667] tcf_idr_create_from_flags+0x61/0x70 [ 32.018480][ T667] tcf_gact_init+0x342/0x570 [ 32.023083][ T667] tcf_action_init_1+0x3fd/0x6b0 [ 32.028038][ T667] tcf_action_init+0x233/0x7a0 [ 32.032814][ T667] tcf_exts_validate+0x24a/0x580 [ 32.037761][ T667] mall_set_parms+0x48/0x520 [ 32.042363][ T667] mall_change+0x478/0x760 [ 32.046785][ T667] tc_new_tfilter+0x13df/0x1990 [ 32.051654][ T667] rtnetlink_rcv_msg+0x83c/0xcb0 [ 32.056628][ T667] netlink_rcv_skb+0x1e9/0x430 [ 32.061408][ T667] rtnetlink_rcv+0x1c/0x20 [ 32.065838][ T667] netlink_unicast+0x86c/0xa30 [ 32.070616][ T667] netlink_sendmsg+0x879/0xb80 [ 32.075485][ T667] ____sys_sendmsg+0x5be/0x8f0 [ 32.080257][ T667] ___sys_sendmsg+0x236/0x2e0 [ 32.084941][ T667] __x64_sys_sendmsg+0x201/0x2d0 [ 32.089886][ T667] x64_sys_call+0x4b/0x9a0 [ 32.094316][ T667] do_syscall_64+0x4c/0xa0 [ 32.098742][ T667] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 32.104654][ T667] [ 32.106996][ T667] The buggy address belongs to the object at ffff888119387900 [ 32.106996][ T667] which belongs to the cache kmalloc-192 of size 192 [ 32.121070][ T667] The buggy address is located 0 bytes to the right of [ 32.121070][ T667] 192-byte region [ffff888119387900, ffff8881193879c0) [ 32.134707][ T667] The buggy address belongs to the page: [ 32.140347][ T667] page:ffffea000464e1c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x119387 [ 32.150606][ T667] flags: 0x4000000000000200(slab|zone=1) [ 32.156264][ T667] raw: 4000000000000200 ffffea000464e040 0000000b0000000b ffff888100042c00 [ 32.164949][ T667] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 32.173675][ T667] page dumped because: kasan: bad access detected [ 32.180092][ T667] page_owner tracks the page as allocated [ 32.185822][ T667] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 114, ts 6640031905, free_ts 0 [ 32.201025][ T667] post_alloc_hook+0x192/0x1b0 [ 32.205932][ T667] prep_new_page+0x1c/0x110 [ 32.210447][ T667] get_page_from_freelist+0x2c3a/0x2cd0 [ 32.216005][ T667] __alloc_pages+0x1a2/0x460 [ 32.220605][ T667] new_slab+0xa0/0x4d0 [ 32.224691][ T667] ___slab_alloc+0x3ac/0x840 [ 32.229317][ T667] __slab_alloc+0x49/0x90 [ 32.233659][ T667] kmem_cache_alloc_trace+0x146/0x270 [ 32.239045][ T667] kernfs_fop_open+0x375/0xbb0 [ 32.243825][ T667] do_dentry_open+0x82a/0x1010 [ 32.248612][ T667] vfs_open+0x73/0x80 [ 32.252615][ T667] path_openat+0x26e6/0x2f80 [ 32.257217][ T667] do_filp_open+0x1df/0x400 [ 32.261729][ T667] do_sys_openat2+0x15e/0x7f0 [ 32.266412][ T667] __x64_sys_openat+0x136/0x160 [ 32.271268][ T667] x64_sys_call+0x219/0x9a0 [ 32.275780][ T667] page_owner free stack trace missing [ 32.281151][ T667] [ 32.283481][ T667] Memory state around the buggy address: [ 32.289112][ T667] ffff888119387880: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 32.297191][ T667] ffff888119387900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.305268][ T667] >ffff888119387980: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 32.313341][ T667] ^ [ 32.319498][ T667] ffff888119387a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.327565][ T667] ffff888119387a80: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.335637][ T667] ================================================================== [ 32.343805][ T667] Disabling lock debugging due to kernel taint [ 32.428279][ T39] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 32.508295][ T305] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 32.748365][ T305] usb 4-1: Using ep0 maxpacket: 32 [ 32.868432][ T305] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 32.880077][ T305] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 32.889939][ T305] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 32.899093][ T305] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.907767][ T305] usb 4-1: config 0 descriptor?? [ 32.948367][ T39] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 32.958056][ T305] hub 4-1:0.0: USB hub found [ 32.963001][ T39] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.971062][ T39] usb 2-1: Product: syz [ 32.975246][ T39] usb 2-1: Manufacturer: syz [ 32.980336][ T39] usb 2-1: SerialNumber: syz [ 33.158336][ T305] hub 4-1:0.0: 1 port detected [ 33.418314][ T305] hub 4-1:0.0: hub_hub_status failed (err = -71) [ 33.424713][ T305] hub 4-1:0.0: config failed, can't get hub status (err -71) [ 33.528300][ T305] usbhid 4-1:0.0: can't add hid device: -71 [ 33.534321][ T305] usbhid: probe of 4-1:0.0 failed with error -71 [ 33.568694][ T305] usb 4-1: USB disconnect, device number 5 [ 33.675156][ T30] kauditd_printk_skb: 31 callbacks suppressed [ 33.675172][ T30] audit: type=1326 audit(1788647644.092:177): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=650 comm="syz.1.149" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7b97670159 code=0x7ffc0000 [ 33.707014][ T30] audit: type=1326 audit(1788647644.092:178): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=650 comm="syz.1.149" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7b97670159 code=0x7ffc0000 [ 33.731685][ T30] audit: type=1326 audit(1788647644.112:179): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=650 comm="syz.1.149" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7b97670159 code=0x7ffc0000 [ 33.756349][ T30] audit: type=1326 audit(1788647644.112:180): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=650 comm="syz.1.149" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7b97670159 code=0x7ffc0000 [ 33.781101][ T30] audit: type=1326 audit(1788647644.112:181): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=650 comm="syz.1.149" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7f7b97670159 code=0x7ffc0000 [ 33.805892][ T30] audit: type=1326 audit(1788647644.112:182): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=650 comm="syz.1.149" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7b97670159 code=0x7ffc0000 [ 33.830565][ T30] audit: type=1326 audit(1788647644.112:183): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=650 comm="syz.1.149" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7b97670159 code=0x7ffc0000 [ 33.855175][ T30] audit: type=1326 audit(1788647644.112:184): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=650 comm="syz.1.149" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f7b9763098e code=0x7ffc0000 [ 33.879825][ T30] audit: type=1326 audit(1788647644.112:185): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=650 comm="syz.1.149" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f7b9763098e code=0x7ffc0000 [ 33.904441][ T30] audit: type=1326 audit(1788647644.112:186): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=650 comm="syz.1.149" exe="/root/ci2-android-5-15/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f7b9763098e code=0x7ffc0000 [ 34.720216][ T305] usb 2-1: USB disconnect, device number 3