last executing test programs: 10.264327185s ago: executing program 4 (id=22): write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000040ac054382408b0b00000109022400010000002009040000fd0301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000003c0)={0x24, 0x0, 0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="002281"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) ioctl$HIDIOCSREPORT(r1, 0x81044804, &(0x7f0000000400)={0x1}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000300)={0x2c, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc01}}, 0x0, 0x0, 0x0}, 0x0) 9.974539137s ago: executing program 2 (id=23): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001180), 0xc0040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000080), 0x10}, 0x94) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000000c0)={[0x8, 0x1000005, 0x7fffffff, 0x0, 0x1, 0x0, 0x7fffffffff7fffff, 0xffffffffffffff70, 0xa, 0x7f, 0x0, 0x80, 0x3, 0x6, 0x1, 0x1], 0xeeee0000, 0x300}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 9.692096575s ago: executing program 2 (id=24): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000004700)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f00000047c0)={0x60, r2, 0x405, 0x70bd27, 0x25dfdbfe, {}, [{{0x8, 0x1, r3}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x44084) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000580)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000005c0)={0x60, r2, 0x1, 0x70bd28, 0x25dfdbfe, {}, [{{0x8, 0x1, r5}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8, 0x7, 0x300}}}]}}]}, 0x60}}, 0x110) 8.883109238s ago: executing program 2 (id=27): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002cbd7000000000000100000008000100030000001c0004800500030001000000050000000100000005000300010000000800020003"], 0x40}}, 0x0) 8.645491714s ago: executing program 2 (id=28): mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='1\x00', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='dir0/trace_marker\x00', 0x1, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='dir0/per_cpu/cpu0/trace_pipe\x00', 0x800, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000600)=0x1) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000700)=0x2) write(r1, &(0x7f0000000800)='a\n\x00', 0x2) write(r1, &(0x7f0000000900)='b\n\x00', 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='dir0/per_cpu/cpu0/trace\x00', 0x0, 0x0) read(r2, &(0x7f0000000b00), 0x64) read(r2, &(0x7f0000000c00), 0x64) close(r4) write(r1, &(0x7f0000000800)='a\n\x00', 0x2) write(r1, &(0x7f0000000900)='b\n\x00', 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='dir0/per_cpu/cpu0/trace\x00', 0x0, 0x0) read(r2, &(0x7f0000000b00), 0x64) read(r2, &(0x7f0000000c00), 0x64) close(r5) write(r1, &(0x7f0000000800)='a\n\x00', 0x2) write(r1, &(0x7f0000000900)='b\n\x00', 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='dir0/per_cpu/cpu0/trace\x00', 0x0, 0x0) read(r2, &(0x7f0000000b00), 0x64) read(r2, &(0x7f0000000c00), 0x64) close(r6) write(r1, &(0x7f0000000800)='a\n\x00', 0x2) write(r1, &(0x7f0000000900)='b\n\x00', 0x2) r7 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='dir0/per_cpu/cpu0/trace\x00', 0x0, 0x0) read(r2, &(0x7f0000000b00), 0x64) read(r2, &(0x7f0000000c00), 0x64) close(r7) write(r1, &(0x7f0000000800)='a\n\x00', 0x2) write(r1, &(0x7f0000000900)='b\n\x00', 0x2) r8 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='dir0/per_cpu/cpu0/trace\x00', 0x0, 0x0) read(r2, &(0x7f0000000b00), 0x64) read(r2, &(0x7f0000000c00), 0x64) close(r8) 8.273032115s ago: executing program 2 (id=30): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) syz_usb_connect$uac3(0x2, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000180)='./proc/fs/nfsd\x00', &(0x7f00000001c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/fs/nfsd/versions\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='-2 -3\n', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/fs/nfsd/portlist\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='tcp 2', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/fs/nfsd/threads\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0) write(r3, &(0x7f0000000180)='3', 0x1) 7.859618706s ago: executing program 4 (id=34): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./debug\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl(r0, 0x40186f40, &(0x7f00000001c0)="ffffffff00"/24) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev_mnt\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/ubi/ubi0/chk_gen\x00', 0x1, 0x0) write(r1, &(0x7f0000000380)='1', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev_mnt/ubi0\x00', 0x2, 0x0) ioctl(r2, 0x40986f00, &(0x7f0000000500)="00000000010000000000010000000000030007000000000074657374766f6c00"/160) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev_mnt/ubi0_0\x00', 0x2, 0x0) ioctl(r3, 0x40084f00, &(0x7f0000000780)="1000000000000000") write(r3, &(0x7f0000000700)="1234567890abcdef", 0x10) ioctl(r2, 0x40046f04, &(0x7f0000000800)='\x00\x00\x00\x00') ioctl(r2, 0x40046f05, &(0x7f0000000800)='\x00\x00\x00\x00') nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) 7.478936263s ago: executing program 2 (id=37): syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_status={{0xf, 0x4}, {0x1, 0xfa, 0x41b}}}, 0x7) mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/platform/vhci_hcd.0/usbip_debug\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='ffffffff', 0x8) close(r0) mkdir(&(0x7f0000000a00)='./debug\x00', 0x1ff) mount(&(0x7f0000000a40)=@filename='none\x00', &(0x7f0000000a80)='./debug\x00', &(0x7f0000000ac0)='debugfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./debug/dynamic_debug/control\x00', 0x1, 0x0) write(r1, &(0x7f0000000b40)='file vhci_hcd.c +p', 0x12) close(r1) syz_usbip_server_init(0x5) r2 = syz_open_dev$usbfs(&(0x7f0000000380), 0x10, 0x2) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f0000000400)={0x23, 0x3, 0x8, 0x1, 0x0, 0x3e8, &(0x7f0000000440)}) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f0000000480)={0x23, 0x1, 0x8, 0x1, 0x0, 0x3e8, &(0x7f00000004c0)}) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f0000000500)={0xa3, 0x0, 0x0, 0x1, 0x4, 0x3e8, &(0x7f0000000540)='\x00\x00\x00\x00'}) 7.161133358s ago: executing program 32 (id=37): syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_status={{0xf, 0x4}, {0x1, 0xfa, 0x41b}}}, 0x7) mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/platform/vhci_hcd.0/usbip_debug\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='ffffffff', 0x8) close(r0) mkdir(&(0x7f0000000a00)='./debug\x00', 0x1ff) mount(&(0x7f0000000a40)=@filename='none\x00', &(0x7f0000000a80)='./debug\x00', &(0x7f0000000ac0)='debugfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./debug/dynamic_debug/control\x00', 0x1, 0x0) write(r1, &(0x7f0000000b40)='file vhci_hcd.c +p', 0x12) close(r1) syz_usbip_server_init(0x5) r2 = syz_open_dev$usbfs(&(0x7f0000000380), 0x10, 0x2) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f0000000400)={0x23, 0x3, 0x8, 0x1, 0x0, 0x3e8, &(0x7f0000000440)}) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f0000000480)={0x23, 0x1, 0x8, 0x1, 0x0, 0x3e8, &(0x7f00000004c0)}) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f0000000500)={0xa3, 0x0, 0x0, 0x1, 0x4, 0x3e8, &(0x7f0000000540)='\x00\x00\x00\x00'}) 6.88304083s ago: executing program 4 (id=42): syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000050cb5340450c10108e492940a80909021b00090000000009040002010035040009058dff86"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r0, 0xffffffffffffffff, 0x0) 6.56929726s ago: executing program 3 (id=44): r0 = syz_usb_connect$cdc_ncm(0x0, 0x7a, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902680002010040000904000001020e0000052406000105240000000d370f0100000000000000000006241a0000000c241b4800f3ff00050080050905810300020000000904010000020d00000904010102020d0000090582020004000000090503020002"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000000)={0x44, 0x0, 0x0, 0x0, &(0x7f00000009c0)={0x20, 0x80, 0x1c, {0x1, 0x28, 0xe4d, 0x80, 0x3fc, 0xfffd, 0x5, 0xfffffffe, 0x800, 0x7543, 0x0, 0x6}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000080), 0xf, 0x8041) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, &(0x7f0000000300)={0x0, 0x2, "4cf90fba85c830e42a3ca4b10f01bbcb15f3806c4853e7c44a6974759d9f643905a56baa4195fb396d9bfa306999f1586e5d1ca49add100a36b751a7d9fe0b182ebf2c8a0e66f72c1c08260030752f07cd4089473e52885a3c85bbcf3ccfac5bb9435fe036dcfccd7254bbd8bce90e2284d29e1f17d6652270fd0abcb8729f16ff602b438bd122a9e09984e2799d0dbfef7533d1a930ea4f4b57605ace45f5815450693650ae000034aa0c5ca5e793516d156e5a5b34d6c17c40d753426a3d8e15e726d0f2622e873e0cbe63751bb62c68594d4cb0a21b92ad2e80f24a9b290a9eee6779022a0b7f5223e4e8c9f53f501ec8c439724078fdc076a51d50760566"}) close(r2) 4.313419997s ago: executing program 4 (id=49): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000003700000008000300", @ANYRES32=r1, @ANYBLOB="08002600901500000800570080"], 0x2c}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000014c0), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)={0x2c, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x98f}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8}]}, 0x2c}}, 0x0) 4.003379922s ago: executing program 1 (id=51): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='1', 0x1) r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0x0, 0x0, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000008001b000000000094ae70b89e734952bcf61559c41e31030000000000002fea5b731cce166b5ffe8d901bcfd82c8f243bff60e2ab86b259eb4f734074dbe4b5e4146ecd2384216950cf"], 0x28}}, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r3, &(0x7f0000000240), 0x0) close(r0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./proc\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', 0x0, &(0x7f0000000400)='proc\x00', 0x0, 0x0) write(r4, 0x0, 0x0) openat$audio(0xffffffffffffff9c, 0x0, 0x40000000040201, 0x0) syz_open_procfs(0x0, 0x0) syz_open_dev$sndpcmp(0x0, 0x0, 0xa2c65) 3.913559357s ago: executing program 4 (id=52): r0 = syz_open_dev$dri(&(0x7f0000000180), 0x78, 0x802) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x7, 0x6576, 0x3}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x3, 0x11, r0, 0x100000000) 3.494362336s ago: executing program 3 (id=53): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) open(0x0, 0x0, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0xffff}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendto$inet(r2, &(0x7f0000000040)="a6", 0xffffff4c, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TLS_TX(r2, 0x6, 0x1, &(0x7f0000000140)=@ccm_128={{}, "3f968a231afa0e18", "4a952e4ea416ad75f769d6386c3c044b", '\by\x00', "e4eb37b07ad86ed7"}, 0x28) 3.311422541s ago: executing program 1 (id=54): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/cpu/cpu1/online\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='0', 0x1) syz_open_procfs(0x0, &(0x7f0000000180)='net/rt_acct\x00') mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) write(r0, &(0x7f0000000180)='1', 0x1) 3.275554826s ago: executing program 0 (id=55): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/disk', 0x1, 0x0) write(r0, &(0x7f0000000040)='1\x00', 0x2) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/mem_sleep', 0x1, 0x0) write(r1, &(0x7f0000000140)='1\x00', 0x2) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000200)='/sys/power/resume', 0x1, 0x0) write(r2, &(0x7f0000000240)='1\x00', 0x2) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000300)='/sys/power/pm_async', 0x1, 0x0) write(r3, &(0x7f0000000340)='1\x00', 0x2) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000400)='/sys/power/pm_debug_messages', 0x1, 0x0) write(r4, &(0x7f0000000440)='1\x00', 0x2) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000500)='/sys/power/pm_freeze_timeout', 0x1, 0x0) write(r5, &(0x7f0000000540)='1\x00', 0x2) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000600)='/sys/power/pm_print_times', 0x1, 0x0) write(r6, &(0x7f0000000640)='1\x00', 0x2) r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000700)='/sys/power/sync_on_suspend', 0x1, 0x0) write(r7, &(0x7f0000000740)='1\x00', 0x2) 3.128972617s ago: executing program 4 (id=56): mkdir(&(0x7f0000000000)='./nfsd_dir\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd_dir\x00', &(0x7f0000000300)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd_dir/portlist\x00', 0x2, 0x0) close(r0) mkdir(&(0x7f0000000e00)='./proc_dir\x00', 0x1ff) mount(0x0, &(0x7f0000001000)='./proc_dir\x00', &(0x7f0000001100)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001200)='./proc_dir/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r0, &(0x7f0000000b00)='* :oexport_dir 2000000000 8194 0 0 0\n', 0x25) 2.720906458s ago: executing program 0 (id=57): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x402) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x207, 0x7, 0xfffffffc}) 2.719540079s ago: executing program 1 (id=58): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlink(&(0x7f00000001c0)='./config/usb_gadget/g1/functions/uac2.usb0\x00', &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1/uac2.usb0\x00') 2.554869513s ago: executing program 0 (id=59): mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, &(0x7f0000000400)='\x00') mkdir(&(0x7f0000000500)='./config/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000600)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdir(&(0x7f0000000700)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) mkdir(&(0x7f0000000800)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0x1ff) symlink(&(0x7f0000000900)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', &(0x7f0000000a00)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/fs/h\x00') symlink(&(0x7f0000000b00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', &(0x7f0000000c00)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/ss/h\x00') mkdir(&(0x7f0000000d00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0x1ff) mkdir(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u/360p\x00', 0x1ff) mkdir(&(0x7f0000000f00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x1ff) symlink(&(0x7f0000001000)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', &(0x7f0000001100)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h/u\x00') symlink(&(0x7f0000001200)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', &(0x7f0000001300)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/fs/h\x00') symlink(&(0x7f0000001400)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', &(0x7f0000001500)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/hs/h\x00') symlink(&(0x7f0000001600)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', &(0x7f0000001700)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/ss/h\x00') symlink(&(0x7f0000001800)='./config/usb_gadget/g1/functions/uvc.usb0\x00', &(0x7f0000001900)='./config/usb_gadget/g1/configs/c.1/uvc.usb0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000001a00)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f0000001b00)='dummy_udc.0\x00', 0xb) close(r0) 2.553451135s ago: executing program 1 (id=60): mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x40, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@arm64={0xe, 0x41, 0xb2, '\x00', 0x7ff}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000180)={0x1, 0x0, [{0x40000072, 0x0, 0x80000006}]}) 2.425220413s ago: executing program 3 (id=61): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x11, '\x00', @data=0x6, 0x9}]}) ioctl$FE_SET_FRONTEND(r0, 0x40246f4c, &(0x7f0000000040)={0x30a32c0, 0x1, @vsb={0x14}}) 2.156253209s ago: executing program 3 (id=62): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000000c0), 0x62181) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000940)={0x1fffe, 0x89f, 0x0, 'queue1\x00', 0x8}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r0, 0xc05c5340, &(0x7f0000000040)={0x0, 0xfffffffe, 0x0, {0x800, 0xb1}, 0xe}) 2.108130777s ago: executing program 1 (id=63): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='bbr', 0x3) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r1, 0x0, 0x0) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)='1', 0x1) unshare(0x44040200) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000040)='bic', 0xff3d) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r3, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r3, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000640)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x14f7325d9d03b00}, 0x4000) 1.951707874s ago: executing program 3 (id=64): r0 = socket$can_j1939(0x1d, 0x2, 0x7) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000380)={'vxcan1\x00', 0x0}) r3 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r3, &(0x7f0000000080)={0x1d, r2, 0x0, {0x0, 0x0, 0x4}, 0xfe}, 0x18) sendmsg$can_j1939(r3, &(0x7f00000001c0)={&(0x7f0000000040), 0x18, &(0x7f0000000180)={&(0x7f0000000100)="92034724033eea403a", 0x9}}, 0xee) bind$can_j1939(r0, &(0x7f0000000300)={0x1d, r2, 0x0, {0x1, 0xf0, 0x2}, 0xfd}, 0x18) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmsg$inet(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000540)="81b641f1f3843704b6", 0x9}], 0x1}, 0x4048081) 1.830709897s ago: executing program 0 (id=65): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0) syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000440)=@mgmt_frame=@probe_response={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000480)={0x0, 0x1dcd6500}, &(0x7f00000004c0)) syz_80211_inject_frame(&(0x7f0000000540)=@device_b, &(0x7f0000000580)=@mgmt_frame=@auth={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e) nanosleep(&(0x7f00000005c0)={0x0, 0x1dcd6500}, &(0x7f0000000600)) syz_80211_inject_frame(&(0x7f0000000640)=@device_b, &(0x7f0000000680)=@mgmt_frame=@assoc_resp={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28) nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x4c, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_TDLS_ACTION={0x5, 0x88, 0x2}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x1}, @NL80211_ATTR_TDLS_DIALOG_TOKEN={0x5}, @NL80211_ATTR_IE={0xc, 0x2a, [@ssid={0x0, 0x6, @default_ap_ssid}]}]}, 0x4c}}, 0x0) 357.104614ms ago: executing program 0 (id=66): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x5c, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x5c}}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_TRIGGER_SCAN(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000600)={0x1c, r7, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}}, 0x0) 191.604123ms ago: executing program 1 (id=67): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newlink={0x48, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x48a1}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}]}}}]}, 0x48}}, 0x80) syz_emit_ethernet(0x76, &(0x7f0000000540)={@multicast, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "122d92", 0x40, 0x3a, 0xff, @remote, @mcast2, {[], @time_exceed={0x3, 0x1, 0x0, 0xfd, '\x00', {0x9, 0x6, 'E\\C', 0x8000, 0x0, 0xff, @loopback, @private2={0xfc, 0x2, '\x00', 0x1}, [@hopopts={0x89}], "98efd03a7e60b623"}}}}}}}, 0x0) 8.658004ms ago: executing program 0 (id=68): r0 = syz_usb_connect$uac1(0x0, 0x72, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010102000000400c200b1040000102030109026000030103a0020904000000010100000a240112000a000201020904010000010200000904010101010200000905010910000206000725010c0040000904020001010200000904020101010200000905820900020303100725010c08ff03"], &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x4c}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000a00)={0x84, &(0x7f0000000600)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$audion(&(0x7f0000000000), 0x3, 0x1) ioctl$SOUND_PCM_READ_BITS(r1, 0x80045005, &(0x7f0000000440)) 0s ago: executing program 3 (id=69): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x1ff) write(r0, &(0x7f0000000600)='0x1d6b\x00', 0x7) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x1ff) write(r1, &(0x7f0000000800)='0x0104\x00', 0x7) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/configs/c1.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./config/usb_gadget/g1/functions/hid.usb0/subclass\x00', 0x1, 0x1ff) write(r2, &(0x7f0000000c00)='1\x00', 0x2) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000d00)='./config/usb_gadget/g1/functions/hid.usb0/protocol\x00', 0x1, 0x1ff) write(r3, &(0x7f0000000e00)='1\x00', 0x2) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x1, 0x1ff) write(r4, &(0x7f0000001000)='8\x00', 0x2) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000001100)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x1, 0x1ff) write(r5, &(0x7f0000001200)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f) close(r5) symlinkat(&(0x7f0000001300)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000001400)='./config/usb_gadget/g1/configs/c1.1/hid.usb0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./dev\x00', 0x1ff) mount(&(0x7f0000002100)=@filename='none\x00', &(0x7f0000002200)='./dev\x00', &(0x7f0000002300)='devtmpfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000001500)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x1ff) write(r6, &(0x7f0000001600)='dummy_udc.0\x00', 0xc) close(r6) nanosleep(&(0x7f0000001700)={0x1}, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000002400)='./dev/hidg0\x00', 0x800, 0x0) read(r7, &(0x7f0000002500), 0x64) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.156' (ED25519) to the list of known hosts. [ 73.896939][ T29] kauditd_printk_skb: 7 callbacks suppressed [ 73.897044][ T29] audit: type=1400 audit(1785407561.191:129): avc: denied { mounton } for pid=5598 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 73.928633][ T29] audit: type=1400 audit(1785407561.221:130): avc: denied { mount } for pid=5598 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 73.932249][ T5598] cgroup: Unknown subsys name 'net' [ 73.958045][ T29] audit: type=1400 audit(1785407561.251:131): avc: denied { unmount } for pid=5598 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 74.096091][ T5598] cgroup: Unknown subsys name 'cpuset' [ 74.104414][ T5598] cgroup: Unknown subsys name 'rlimit' [ 74.196037][ T29] audit: type=1400 audit(1785407561.491:132): avc: denied { setattr } for pid=5598 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=821 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 74.231072][ T29] audit: type=1400 audit(1785407561.491:133): avc: denied { create } for pid=5598 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 74.269478][ T29] audit: type=1400 audit(1785407561.491:134): avc: denied { write } for pid=5598 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 74.291513][ T29] audit: type=1400 audit(1785407561.491:135): avc: denied { read } for pid=5598 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 74.313792][ T29] audit: type=1400 audit(1785407561.491:136): avc: denied { mounton } for pid=5598 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 74.339861][ T29] audit: type=1400 audit(1785407561.491:137): avc: denied { mount } for pid=5598 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 74.339875][ T5600] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 74.373919][ T29] audit: type=1400 audit(1785407561.671:138): avc: denied { relabelto } for pid=5600 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 75.367220][ T5598] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 77.515017][ T5622] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 77.527944][ T5623] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 77.535399][ T5625] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 77.545523][ T5623] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 77.546339][ T5629] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 77.561599][ T5625] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 77.565423][ T5629] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 77.571099][ T5623] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 77.578029][ T5629] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 77.584773][ T5625] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 77.593413][ T5629] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 77.601002][ T5625] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 77.606773][ T5629] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 77.612532][ T5625] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 77.622292][ T5629] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 77.633996][ T5625] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 77.634062][ T5629] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 77.649984][ T5616] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 77.653179][ T5629] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 77.668897][ T5629] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 77.677175][ T5629] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 77.686242][ T5629] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 77.703075][ T5629] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 77.710327][ T5618] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 77.720000][ T5629] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 79.168864][ T5611] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.176111][ T5611] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.183386][ T5611] bridge_slave_0: entered allmulticast mode [ 79.190352][ T5611] bridge_slave_0: entered promiscuous mode [ 79.203048][ T5611] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.210195][ T5611] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.223570][ T5611] bridge_slave_1: entered allmulticast mode [ 79.231095][ T5611] bridge_slave_1: entered promiscuous mode [ 79.308980][ T5611] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.327379][ T5614] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.334608][ T5614] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.341857][ T5614] bridge_slave_0: entered allmulticast mode [ 79.349179][ T5614] bridge_slave_0: entered promiscuous mode [ 79.370492][ T5611] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.393116][ T5614] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.400220][ T5614] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.407619][ T5614] bridge_slave_1: entered allmulticast mode [ 79.414468][ T5614] bridge_slave_1: entered promiscuous mode [ 79.508127][ T5613] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.515390][ T5613] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.522527][ T5613] bridge_slave_0: entered allmulticast mode [ 79.529658][ T5613] bridge_slave_0: entered promiscuous mode [ 79.543757][ T5611] team0: Port device team_slave_0 added [ 79.552154][ T5614] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.568942][ T5613] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.576241][ T5613] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.584197][ T5613] bridge_slave_1: entered allmulticast mode [ 79.591072][ T5613] bridge_slave_1: entered promiscuous mode [ 79.603920][ T5611] team0: Port device team_slave_1 added [ 79.611522][ T5614] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.621422][ T5610] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.629088][ T5610] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.636499][ T5610] bridge_slave_0: entered allmulticast mode [ 79.643647][ T5610] bridge_slave_0: entered promiscuous mode [ 79.681016][ T5610] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.688258][ T5610] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.695699][ T5610] bridge_slave_1: entered allmulticast mode [ 79.702818][ T5610] bridge_slave_1: entered promiscuous mode [ 79.703843][ T5622] Bluetooth: hci0: command tx timeout [ 79.709684][ T4930] Bluetooth: hci2: command tx timeout [ 79.767453][ T5613] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.777158][ T5612] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.785083][ T4930] Bluetooth: hci4: command tx timeout [ 79.785099][ T5629] Bluetooth: hci1: command tx timeout [ 79.785388][ T5622] Bluetooth: hci3: command tx timeout [ 79.791428][ T5612] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.809821][ T5612] bridge_slave_0: entered allmulticast mode [ 79.816969][ T5612] bridge_slave_0: entered promiscuous mode [ 79.825201][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.832266][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.858333][ T5611] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.871674][ T5614] team0: Port device team_slave_0 added [ 79.879607][ T5610] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.890470][ T5613] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.904064][ T5612] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.911228][ T5612] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.918495][ T5612] bridge_slave_1: entered allmulticast mode [ 79.925642][ T5612] bridge_slave_1: entered promiscuous mode [ 79.932774][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.939912][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.965949][ T5611] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.978622][ T5614] team0: Port device team_slave_1 added [ 79.986293][ T5610] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.058024][ T5612] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.085874][ T5613] team0: Port device team_slave_0 added [ 80.101712][ T5612] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.111484][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 80.118532][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.145301][ T5614] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.158304][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.165433][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.192082][ T5614] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.205271][ T5610] team0: Port device team_slave_0 added [ 80.212450][ T5613] team0: Port device team_slave_1 added [ 80.250118][ T5610] team0: Port device team_slave_1 added [ 80.270738][ T5611] hsr_slave_0: entered promiscuous mode [ 80.277257][ T5611] hsr_slave_1: entered promiscuous mode [ 80.300257][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 80.307273][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.333399][ T5613] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.345599][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.352564][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.378892][ T5613] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.397647][ T5612] team0: Port device team_slave_0 added [ 80.430992][ T5612] team0: Port device team_slave_1 added [ 80.437374][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 80.444687][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.470595][ T5610] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.501974][ T5614] hsr_slave_0: entered promiscuous mode [ 80.508338][ T5614] hsr_slave_1: entered promiscuous mode [ 80.514726][ T5614] debugfs: 'hsr0' already exists in 'hsr' [ 80.521023][ T5614] Cannot create hsr debugfs directory [ 80.536383][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.543376][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.569583][ T5610] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.599490][ T5613] hsr_slave_0: entered promiscuous mode [ 80.606665][ T5613] hsr_slave_1: entered promiscuous mode [ 80.612656][ T5613] debugfs: 'hsr0' already exists in 'hsr' [ 80.618510][ T5613] Cannot create hsr debugfs directory [ 80.656344][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 80.663709][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.689961][ T5612] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.702607][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.709607][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.735712][ T5612] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.837749][ T5610] hsr_slave_0: entered promiscuous mode [ 80.843995][ T5610] hsr_slave_1: entered promiscuous mode [ 80.849992][ T5610] debugfs: 'hsr0' already exists in 'hsr' [ 80.855951][ T5610] Cannot create hsr debugfs directory [ 80.920752][ T5612] hsr_slave_0: entered promiscuous mode [ 80.927136][ T5612] hsr_slave_1: entered promiscuous mode [ 80.933633][ T5612] debugfs: 'hsr0' already exists in 'hsr' [ 80.939384][ T5612] Cannot create hsr debugfs directory [ 81.252584][ T5611] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 81.265534][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 81.274366][ T5611] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 81.284239][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 81.304295][ T5611] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 81.315281][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 81.341550][ T5611] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 81.351190][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 81.425517][ T5613] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 81.439240][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 81.447793][ T5613] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 81.458987][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 81.472658][ T5613] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 81.484412][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 81.492397][ T5613] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 81.501652][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 81.626072][ T5614] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 81.639708][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 81.659307][ T5614] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 81.670840][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 81.701400][ T5614] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 81.715138][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 81.743418][ T5614] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 81.757210][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 81.783716][ T5622] Bluetooth: hci2: command tx timeout [ 81.783725][ T4930] Bluetooth: hci0: command tx timeout [ 81.839439][ T5611] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.863009][ T5622] Bluetooth: hci4: command tx timeout [ 81.873163][ T5622] Bluetooth: hci3: command tx timeout [ 81.873216][ T4930] Bluetooth: hci1: command tx timeout [ 81.895356][ T5610] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 81.907052][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 81.915758][ T5610] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 81.926240][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 81.934237][ T5610] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 81.944152][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 81.952358][ T5610] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 81.961255][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 81.977127][ T5611] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.007554][ T5613] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.030915][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.038651][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.071476][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.078612][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.135418][ T5613] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.149564][ T5612] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 82.159206][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 82.167331][ T5612] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 82.176629][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 82.196723][ T5612] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 82.206173][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 82.214971][ T5612] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 82.225294][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 82.245310][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.252444][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.278076][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.285213][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.392856][ T5614] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.481905][ T5610] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.491512][ T5614] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.537619][ T1008] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.544844][ T1008] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.576053][ T1008] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.583235][ T1008] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.604136][ T5610] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.664114][ T69] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.671321][ T69] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.719294][ T69] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.726485][ T69] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.804013][ T5612] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.915020][ T5612] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.971766][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.978978][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.030734][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.037931][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.080960][ T5611] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.209725][ T5613] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.272749][ T5611] veth0_vlan: entered promiscuous mode [ 83.318932][ T5611] veth1_vlan: entered promiscuous mode [ 83.488411][ T5611] veth0_macvtap: entered promiscuous mode [ 83.505846][ T5613] veth0_vlan: entered promiscuous mode [ 83.519151][ T5611] veth1_macvtap: entered promiscuous mode [ 83.573838][ T5613] veth1_vlan: entered promiscuous mode [ 83.616707][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.665782][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.702610][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.728372][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.753743][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.767701][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.792281][ T5613] veth0_macvtap: entered promiscuous mode [ 83.825022][ T5613] veth1_macvtap: entered promiscuous mode [ 83.864993][ T4930] Bluetooth: hci0: command tx timeout [ 83.865016][ T5622] Bluetooth: hci2: command tx timeout [ 83.870349][ T5614] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.940888][ T5610] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.951289][ T4930] Bluetooth: hci1: command tx timeout [ 83.953443][ T5629] Bluetooth: hci4: command tx timeout [ 83.965379][ T5622] Bluetooth: hci3: command tx timeout [ 83.965981][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.997193][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.128077][ T69] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.152447][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.161412][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.181605][ T69] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.207809][ T5612] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.215944][ T69] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.225372][ T69] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.312563][ T69] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.327922][ T69] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.361216][ T29] kauditd_printk_skb: 13 callbacks suppressed [ 84.361233][ T29] audit: type=1400 audit(1785407571.651:152): avc: denied { mounton } for pid=5611 comm="syz-executor" path="/root/syzkaller.PxpIIJ/syz-tmp" dev="sda1" ino=2042 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 84.394620][ T5614] veth0_vlan: entered promiscuous mode [ 84.421408][ T29] audit: type=1400 audit(1785407571.651:153): avc: denied { mount } for pid=5611 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 84.445877][ T29] audit: type=1400 audit(1785407571.651:154): avc: denied { mounton } for pid=5611 comm="syz-executor" path="/root/syzkaller.PxpIIJ/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 84.474225][ T69] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.491495][ T69] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.500433][ T5614] veth1_vlan: entered promiscuous mode [ 84.521001][ T29] audit: type=1400 audit(1785407571.651:155): avc: denied { mount } for pid=5611 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 84.549354][ T29] audit: type=1400 audit(1785407571.691:156): avc: denied { mounton } for pid=5611 comm="syz-executor" path="/root/syzkaller.PxpIIJ/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 84.583050][ T5610] veth0_vlan: entered promiscuous mode [ 84.592714][ T29] audit: type=1400 audit(1785407571.701:157): avc: denied { mounton } for pid=5611 comm="syz-executor" path="/root/syzkaller.PxpIIJ/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=7664 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 84.599304][ T5611] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 84.620872][ T29] audit: type=1400 audit(1785407571.701:158): avc: denied { unmount } for pid=5611 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 84.675381][ T29] audit: type=1400 audit(1785407571.711:159): avc: denied { mounton } for pid=5611 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2784 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 84.700034][ T29] audit: type=1400 audit(1785407571.741:160): avc: denied { mount } for pid=5611 comm="syz-executor" name="/" dev="gadgetfs" ino=7711 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 84.724695][ T29] audit: type=1400 audit(1785407571.741:161): avc: denied { mount } for pid=5611 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 84.725509][ T5612] veth0_vlan: entered promiscuous mode [ 84.763817][ T5610] veth1_vlan: entered promiscuous mode [ 84.771716][ T5614] veth0_macvtap: entered promiscuous mode [ 84.784231][ T5614] veth1_macvtap: entered promiscuous mode [ 84.793048][ T69] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.805245][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.809168][ T69] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.846867][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.888814][ T1008] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.898968][ T1008] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.910492][ T5612] veth1_vlan: entered promiscuous mode [ 84.922248][ T1008] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.938029][ T1008] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.003538][ T5610] veth0_macvtap: entered promiscuous mode [ 85.056732][ T5610] veth1_macvtap: entered promiscuous mode [ 85.140085][ T5612] veth0_macvtap: entered promiscuous mode [ 85.153397][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.168591][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.178385][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.186306][ T5743] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 85.210990][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.231857][ T5612] veth1_macvtap: entered promiscuous mode [ 85.244165][ T5811] batman_adv: batadv0: Adding interface: dummy0 [ 85.250567][ T5811] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.276580][ T5811] batman_adv: batadv0: Interface activated: dummy0 [ 85.312860][ T1008] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.325038][ T1008] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.337956][ T69] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.371235][ T1008] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.373065][ T69] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.390827][ T1008] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.400023][ T5743] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 85.400080][ T5743] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 85.400108][ T5743] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 64 [ 85.400136][ T5743] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 85.400163][ T5743] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 64 [ 85.403114][ T5743] usb 4-1: New USB device found, idVendor=06cd, idProduct=0107, bcdDevice= 1.00 [ 85.475522][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.503751][ T5743] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 85.530687][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.552043][ T5743] usb 4-1: Product: syz [ 85.570891][ T5743] usb 4-1: Manufacturer: syz [ 85.577224][ T1027] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.578049][ T5743] usb 4-1: SerialNumber: syz [ 85.597699][ T1027] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.621046][ T5807] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 85.629960][ T5807] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 85.637598][ T5807] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 85.688919][ T5807] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 85.695237][ T1027] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.709643][ T5807] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 85.723816][ T1027] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.763470][ T5743] keyspan 4-1:1.0: Keyspan 1 port adapter converter detected [ 85.842267][ T5743] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 82 [ 85.876730][ T1178] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.891926][ T1178] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.894639][ T5743] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 2 [ 85.944270][ T5622] Bluetooth: hci0: command tx timeout [ 85.953715][ T5622] Bluetooth: hci2: command tx timeout [ 85.958492][ T5743] usb 4-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 86.024541][ T5622] Bluetooth: hci1: command tx timeout [ 86.030527][ T5629] Bluetooth: hci3: command tx timeout [ 86.030696][ T4930] Bluetooth: hci4: command tx timeout [ 86.138054][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.183503][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.191600][ T69] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.226593][ T5725] usb 4-1: USB disconnect, device number 2 [ 86.232519][ T69] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.335203][ T5725] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 86.389522][ T5725] keyspan 4-1:1.0: device disconnected [ 86.417340][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.456651][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.570595][ T5827] Mass Storage Function, version: 2009/09/11 [ 86.594768][ T5827] LUN: removable file: (no medium) [ 86.622621][ T5827] mass_storage.usb0/lun.0: file too small: file0 [ 86.650055][ T5825] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 86.681730][ T187] cfg80211: failed to load regulatory.db [ 86.948705][ T4930] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 87.297568][ T5850] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=5850 comm=syz.3.18 [ 87.311699][ T5852] configfs-gadget.g1 gadget.0: HOST MAC 56:89:c8:03:ca:0c [ 87.334239][ T5852] configfs-gadget.g1 gadget.0: MAC 2a:35:ce:46:6c:70 [ 87.353709][ T5859] netlink: 4 bytes leftover after parsing attributes in process `syz.3.18'. [ 87.387716][ T5850] netlink: 11 bytes leftover after parsing attributes in process `syz.3.18'. [ 87.457910][ T5855] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 87.822960][ T42] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 88.015514][ T42] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 88.041116][ T42] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 88.064315][ T42] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 88.093154][ T42] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 88.138398][ T42] usb 5-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 88.147956][ T42] usb 5-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 88.172403][ T42] usb 5-1: Manufacturer: syz [ 88.225287][ T42] usb 5-1: config 0 descriptor?? [ 88.294642][ T5883] bridge_slave_0: left allmulticast mode [ 88.304646][ T5883] bridge_slave_0: left promiscuous mode [ 88.329130][ T5883] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.362963][ T5883] bridge_slave_1: left allmulticast mode [ 88.368683][ T5883] bridge_slave_1: left promiscuous mode [ 88.385743][ T5883] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.413985][ T5883] bond0: (slave bond_slave_0): Releasing backup interface [ 88.447398][ T5883] bond0: (slave bond_slave_1): Releasing backup interface [ 88.485542][ T5883] team0: Port device team_slave_0 removed [ 88.511971][ T5883] team0: Port device team_slave_1 removed [ 88.518327][ T5796] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 88.534348][ T5883] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 88.545027][ T5883] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 88.567064][ T5883] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 88.584975][ T5883] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 88.600231][ T5883] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 88.676953][ T42] appleir 0003:05AC:8243.0001: unknown main item tag 0x0 [ 88.679713][ T5888] team0: Mode changed to "loadbalance" [ 88.705691][ T5796] usb 2-1: config index 0 descriptor too short (expected 32, got 18) [ 88.723145][ T5796] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 88.762520][ T42] appleir 0003:05AC:8243.0001: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.4-1/input0 [ 88.784111][ T5796] usb 2-1: New USB device found, idVendor=110a, idProduct=1250, bcdDevice= 0.00 [ 88.815182][ T5796] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 88.834279][ T5796] usb 2-1: Product: syz [ 88.838920][ T5796] usb 2-1: Manufacturer: syz [ 89.318847][ T5725] usb 5-1: USB disconnect, device number 2 [ 89.504785][ T29] kauditd_printk_skb: 90 callbacks suppressed [ 89.504802][ T29] audit: type=1400 audit(1785407576.801:252): avc: denied { create } for pid=5910 comm="syz.0.29" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 89.566679][ T29] audit: type=1400 audit(1785407576.801:253): avc: denied { read } for pid=5612 comm="syz-executor" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 89.616403][ T29] audit: type=1400 audit(1785407576.801:254): avc: denied { open } for pid=5612 comm="syz-executor" path="/5/dir0" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 89.634654][ T5612] audit: audit_backlog=65 > audit_backlog_limit=64 [ 89.658158][ T5612] audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=64 [ 89.671045][ T29] audit: type=1400 audit(1785407576.801:255): avc: denied { write } for pid=5910 comm="syz.0.29" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 89.672199][ T5612] audit: backlog limit exceeded [ 89.714312][ T29] audit: type=1400 audit(1785407576.811:256): avc: denied { read } for pid=5612 comm="syz-executor" name="instances" dev="tracefs" ino=3756 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 89.719974][ T5612] audit: audit_backlog=65 > audit_backlog_limit=64 [ 89.748057][ T29] audit: type=1400 audit(1785407576.831:257): avc: denied { write } for pid=5612 comm="syz-executor" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 ... md0  binderfs  gadgetfs  tap62 ptp_kvm vim2mv4l|diskz block2 rtc,char+ core* log)~ stderr(} stdout'| stdin&{ fd%zshm$ypts#x(btrfs-control"w(cpu_dma_latency!v qrtr-tun u vsockt mixer2s admmidi2r amidi2q dmmidi2p midi2o mixer1n adsp1m audio1ldsp1 k mixer j audio idsph sequencer2g sequencerfsnde(comedi4_subd1d(comedi4_subd0c comedi4b comedi3a comedi2` comedi1_ comedi0^ vhost-vsock] vhost-net\uhid[ infinibandZvhciY mapperUptp0T media27S v4l-touch23R video102Q video101P radio47O radio46N swradio23M vbi47L vbi46K video100J cec47I video99H cec46G media26F v4l-touch22E video98D video97[ 90.018005][ T5922] netlink: 'syz.0.33': attribute type 4 has an invalid length. C radio45B [ 90.028916][ T5924] ubi0: attaching mtd0 radio44A swradio22@ vbi45? vbi44> video96= cec45< video95; cec44: media259 v4l-touch218 video947 video936 radio435 radio424 swradio21[ 90.081432][ T5924] ubi0: scanning is finished 3 [ 90.086599][ T5924] ubi0: empty MTD device detected vbi432 vbi421 video920 cec43/ video91. cec42- media24, v4l-touch20+ video90* video89) radio41( radio40' swradio20& vbi41% vbi40$ video88# cec41" video87! cec40  media23 v4l-touch19 video86 video85 radio39 radio38 [ 90.161488][ T5796] mxuport 2-1:1.0: mxuport_send_ctrl_data_urb - usb_control_msg failed (-71) swradio19 vbi39 vbi38 video84 [ 90.181976][ T5796] mxuport 2-1:1.0: mxuport_send_ctrl_data_urb - usb_control_msg failed (-71) cec39 video83 cec38 media22 v4l-touch18 video82 video81 radio37 radio36 swradio18  vbi37[ 90.221162][ T5796] mxuport 2-1:1.0: probe with driver mxuport failed with error -71  vbi36  video80  cec37 video79[ 90.284741][ T5796] usb 2-1: USB disconnect, device number 2 [ 90.302042][ T5933] lo: entered allmulticast mode [ 90.400068][ T5933] netlink: 11 bytes leftover after parsing attributes in process `syz.3.36'. [ 90.429099][ T35] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 90.520827][ T5924] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 90.546563][ T5924] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 90.573109][ T5924] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 90.587977][ T5924] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 90.590772][ T35] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 90.597591][ T5924] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 90.616641][ T5924] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 90.642492][ T5924] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 1354219787 [ 90.667238][ T5924] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 90.696398][ T5938] ubi0: background thread "ubi_bgt0d" started, PID 5938 [ 90.731528][ T35] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 90.809283][ T5941] gadgetfs: bound to dummy_udc driver [ 90.882845][ T35] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 90.977921][ T5629] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 90.994596][ T5629] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 91.004141][ T5629] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 91.024364][ T5629] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 91.034775][ T5629] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 91.135840][ T5932] lo: left allmulticast mode [ 91.343055][ T5796] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 91.514063][ T5796] usb 5-1: too many configurations: 9, using maximum allowed: 8 [ 91.554177][ T42] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 91.561810][ T5796] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 91.585804][ T5796] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 91.597951][ T5796] usb 5-1: config 0 interface 0 has no altsetting 0 [ 91.608294][ T5796] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 91.628953][ T5796] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 91.654753][ T5796] usb 5-1: config 0 interface 0 has no altsetting 0 [ 91.674431][ T5796] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 91.693106][ T5796] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 91.707515][ T5796] usb 5-1: config 0 interface 0 has no altsetting 0 [ 91.716360][ T5796] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 91.726786][ T5796] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 91.738363][ T5796] usb 5-1: config 0 interface 0 has no altsetting 0 [ 91.746702][ T42] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 91.758501][ T42] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 91.769178][ T5796] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 91.782129][ T42] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 91.799038][ T5796] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 91.821074][ T42] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 91.829297][ T5796] usb 5-1: config 0 interface 0 has no altsetting 0 [ 91.837833][ T42] usb 4-1: Product: syz [ 91.843000][ T5796] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 91.852439][ T42] usb 4-1: Manufacturer: syz [ 91.860411][ T5796] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 91.872665][ T42] usb 4-1: SerialNumber: syz [ 91.896186][ T5796] usb 5-1: config 0 interface 0 has no altsetting 0 [ 91.906680][ T42] cdc_mbim 4-1:1.0: skipping garbage [ 91.920656][ T5796] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 91.932966][ T5796] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 91.954096][ T5796] usb 5-1: config 0 interface 0 has no altsetting 0 [ 91.972634][ T5796] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 91.993158][ T5796] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 92.031004][ T5796] usb 5-1: config 0 interface 0 has no altsetting 0 [ 92.062684][ T5796] usb 5-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 92.081936][ T5796] usb 5-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 92.106853][ T5796] usb 5-1: Product: syz [ 92.121333][ T5796] usb 5-1: Manufacturer: syz [ 92.128901][ T5958] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 92.150082][ T5796] usb 5-1: SerialNumber: syz [ 92.159251][ T5796] usb 5-1: config 0 descriptor?? [ 92.183954][ T5796] yurex 5-1:0.0: USB YUREX device now attached to Yurex #0 [ 92.289715][ T5980] unchecked MSR access error: WRMSR to 0x400 (tried to write 0x0000000000000001) at rIP: 0xffffffff81b1d00a (__mcheck_cpu_init_prepare_banks+0x18a/0x380) [ 92.305437][ T5980] Call Trace: [ 92.308719][ T5980] [ 92.311635][ T5980] ? __pfx___mcheck_cpu_init_prepare_banks+0x10/0x10 [ 92.318341][ T5980] ? __pfx_call_function_single_prep_ipi+0x10/0x10 [ 92.324852][ T5980] ? debug_object_deactivate+0x2e4/0x3b0 [ 92.330489][ T5980] ? on_each_cpu_cond_mask+0x41/0x90 [ 92.335772][ T5980] mce_cpu_restart+0xd5/0x1f0 [ 92.340472][ T5980] ? __pfx_mce_cpu_restart+0x10/0x10 [ 92.345768][ T5980] smp_call_function_many_cond+0x153b/0x1870 [ 92.351762][ T5980] ? __pfx_mce_cpu_restart+0x10/0x10 [ 92.357073][ T5980] ? lockdep_hardirqs_on+0x78/0x100 [ 92.362267][ T5980] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 92.368064][ T5980] ? __pfx_smp_call_function_many_cond+0x10/0x10 [ 92.374390][ T5980] ? __pfx___try_to_del_timer_sync+0x10/0x10 [ 92.380385][ T5980] ? __timer_delete_sync+0x151/0x1c0 [ 92.385664][ T5980] ? __pfx_mce_cpu_restart+0x10/0x10 [ 92.390960][ T5980] on_each_cpu_cond_mask+0x40/0x90 [ 92.396086][ T5980] set_bank+0x240/0x3a0 [ 92.400259][ T5980] ? __pfx_set_bank+0x10/0x10 [ 92.404938][ T5980] ? find_held_lock+0x2b/0x80 [ 92.409635][ T5980] ? sysfs_file_kobj+0xe4/0x290 [ 92.414502][ T5980] ? sysfs_file_kobj+0xe4/0x290 [ 92.419350][ T5980] ? __pfx_set_bank+0x10/0x10 [ 92.424042][ T5980] dev_attr_store+0x58/0x80 [ 92.428557][ T5980] ? __pfx_dev_attr_store+0x10/0x10 [ 92.433767][ T5980] sysfs_kf_write+0xf2/0x150 [ 92.438373][ T5980] kernfs_fop_write_iter+0x3e0/0x5f0 [ 92.443646][ T5980] ? __pfx_sysfs_kf_write+0x10/0x10 [ 92.448852][ T5980] vfs_write+0x6ac/0x1050 [ 92.453199][ T5980] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 92.459031][ T5980] ? __pfx_vfs_write+0x10/0x10 [ 92.463829][ T5980] ksys_write+0x12a/0x250 [ 92.468171][ T5980] ? __pfx_ksys_write+0x10/0x10 [ 92.473033][ T5980] do_syscall_64+0x115/0x870 [ 92.477629][ T5980] ? clear_bhb_loop+0x40/0x90 [ 92.482291][ T5980] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.488185][ T5980] RIP: 0033:0x7f25feb9df99 [ 92.492602][ T5980] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.512232][ T5980] RSP: 002b:00007f25fcdb4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 92.520662][ T5980] RAX: ffffffffffffffda RBX: 00007f25fee26180 RCX: 00007f25feb9df99 [ 92.528626][ T5980] RDX: 0000000000000002 RSI: 0000200000000480 RDI: 0000000000000003 [ 92.536595][ T5980] RBP: 00007f25fec34ec4 R08: 0000000000000000 R09: 0000000000000000 [ 92.544572][ T5980] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 92.552528][ T5980] R13: 00007f25fee26218 R14: 00007f25fee26180 R15: 00007ffe50bf0928 [ 92.560505][ T5980] [ 92.872498][ T187] usb 5-1: USB disconnect, device number 3 [ 92.927180][ T187] yurex 5-1:0.0: USB YUREX #0 now disconnected [ 92.976127][ T5976] smpboot: CPU 1 is now offline [ 93.074645][ T4930] Bluetooth: hci1: command tx timeout [ 93.100839][ T5978] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 93.116977][ T5958] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 93.127695][ T42] cdc_mbim 4-1:1.0: setting tx_max = 16384 [ 93.136086][ T42] cdc_mbim 4-1:1.0: cdc-wdm0: USB WDM device [ 93.150608][ T42] wwan wwan0: port wwan0mbim0 attached [ 93.195360][ T35] bond0 (unregistering): Released all slaves [ 93.214655][ T5275] 8021q: adding VLAN 0 to HW filter on device eth1 [ 93.276119][ T42] cdc_mbim 4-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.3-1, CDC MBIM, 0a:ca:2d:62:d0:0b [ 93.539894][ T5759] usb 4-1: USB disconnect, device number 3 [ 93.551041][ T5759] cdc_mbim 4-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.3-1, CDC MBIM [ 93.822854][ T5759] wwan wwan0: port wwan0mbim0 disconnected [ 93.887871][ T5610] FAULT_INJECTION: forcing a failure. [ 93.887871][ T5610] name failslab, interval 1, probability 1, space 0, times 1 [ 93.930281][ T5610] CPU: 1 UID: 0 PID: 5610 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 93.930310][ T5610] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 93.930322][ T5610] Call Trace: [ 93.930331][ T5610] [ 93.930337][ T5610] dump_stack_lvl+0x100/0x190 [ 93.930365][ T5610] should_fail_ex.cold+0x5/0xa [ 93.930385][ T5610] should_failslab+0xc2/0x120 [ 93.930408][ T5610] __kvmalloc_node_noprof+0x116/0x970 [ 93.930432][ T5610] ? xt_alloc_entry_offsets+0x42/0x60 [ 93.930457][ T5610] xt_alloc_entry_offsets+0x42/0x60 [ 93.930479][ T5610] translate_table+0x229/0x16c0 [ 93.930506][ T5610] ? find_held_lock+0x2b/0x80 [ 93.930538][ T5610] ? __pfx_translate_table+0x10/0x10 [ 93.930564][ T5610] do_ip6t_set_ctl+0x689/0xd00 [ 93.930585][ T5610] ? nf_sockopt_find.isra.0+0x222/0x290 [ 93.930609][ T5610] ? nf_sockopt_find.isra.0+0x222/0x290 [ 93.930632][ T5610] ? __pfx_do_ip6t_set_ctl+0x10/0x10 [ 93.930651][ T5610] ? __mutex_unlock_slowpath+0x35d/0x930 [ 93.930678][ T5610] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 93.930711][ T5610] ? nf_sockopt_find.isra.0+0x222/0x290 [ 93.930737][ T5610] nf_setsockopt+0x8d/0xf0 [ 93.930761][ T5610] ipv6_setsockopt+0x135/0x170 [ 93.930787][ T5610] tcp_setsockopt+0xa7/0x100 [ 93.930813][ T5610] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 93.930843][ T5610] do_sock_setsockopt+0xf3/0x1d0 [ 93.930876][ T5610] __sys_setsockopt+0x195/0x220 [ 93.930904][ T5610] __x64_sys_setsockopt+0xbd/0x160 [ 93.930926][ T5610] ? do_syscall_64+0x90/0x870 [ 93.930946][ T5610] ? lockdep_hardirqs_on+0x78/0x100 [ 93.930967][ T5610] do_syscall_64+0x115/0x870 [ 93.930987][ T5610] ? clear_bhb_loop+0x40/0x90 [ 93.931012][ T5610] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.931033][ T5610] RIP: 0033:0x7f8f20d9f7da [ 93.931051][ T5610] Code: 48 83 ec 10 48 63 c9 48 63 ff 45 89 c9 6a 2c e8 6c 99 fb ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 49 89 ca b8 36 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 e8 ff ff ff f7 [ 93.931067][ T5610] RSP: 002b:00007ffcfce37998 EFLAGS: 00000202 ORIG_RAX: 0000000000000036 [ 93.931087][ T5610] RAX: ffffffffffffffda RBX: 00007ffcfce37a20 RCX: 00007f8f20d9f7da [ 93.931099][ T5610] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000003 [ 93.931111][ T5610] RBP: 0000000000000003 R08: 0000000000000558 R09: 0000000000000000 [ 93.931215][ T5610] R10: 00007f8f20fedbe0 R11: 0000000000000202 R12: 00007f8f20fedb80 [ 93.931229][ T5610] R13: 00007ffcfce379bc R14: 0000000000000000 R15: 00007f8f20feefc0 [ 93.931254][ T5610] [ 93.960871][ T6006] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 94.052645][ T6016] Zero length message leads to an empty skb [ 94.069204][ T6006] block device autoloading is deprecated and will be removed. [ 94.145697][ T6002] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 94.300824][ T6002] block device autoloading is deprecated and will be removed. [ 94.489537][ T5275] 8021q: adding VLAN 0 to HW filter on device eth2 [ 94.559831][ T6023] smpboot: CPU 1 is now offline [ 94.614224][ T29] kauditd_printk_skb: 377 callbacks suppressed [ 94.614235][ T29] audit: type=1400 audit(1785407581.911:435): avc: denied { write } for pid=6022 comm="syz.1.54" name="rt_acct" dev="proc" ino=4026533320 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 94.686761][ T35] hsr_slave_0: left promiscuous mode [ 94.722840][ T35] hsr_slave_1: left promiscuous mode [ 94.848577][ T35] veth1_macvtap: left promiscuous mode [ 94.874099][ T35] veth0_macvtap: left promiscuous mode [ 94.894586][ T35] veth1_vlan: left promiscuous mode [ 94.914082][ T35] veth0_vlan: left promiscuous mode [ 95.109188][ T29] audit: type=1400 audit(1785407582.401:436): avc: denied { read append } for pid=6032 comm="syz.0.57" name="card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 95.154837][ T4930] Bluetooth: hci1: command tx timeout [ 95.280491][ T29] audit: type=1400 audit(1785407582.401:437): avc: denied { open } for pid=6032 comm="syz.0.57" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 95.478585][ T29] audit: type=1400 audit(1785407582.431:438): avc: denied { write } for pid=6033 comm="syz.1.58" name="functions" dev="configfs" ino=8694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 95.516509][ T5629] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 95.537113][ T5629] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 95.545921][ T5629] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 95.553489][ T5629] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 95.561728][ T5629] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 95.631169][ T6038] configfs-gadget.g1 gadget.0: afunc_bind:1251 Error! [ 95.700284][ T6038] udc dummy_udc.0: failed to start g1: -19 [ 95.708676][ T29] audit: type=1400 audit(1785407582.431:439): avc: denied { write } for pid=6033 comm="syz.1.58" name="c.1" dev="configfs" ino=8796 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 95.762294][ T6038] UDC core: g1: couldn't find an available UDC or it's busy [ 95.847695][ T29] audit: type=1400 audit(1785407582.431:440): avc: denied { write } for pid=6033 comm="syz.1.58" name="c.1" dev="configfs" ino=8796 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 96.013549][ T29] audit: type=1400 audit(1785407582.431:441): avc: denied { ioctl } for pid=6032 comm="syz.0.57" path="/dev/dri/card0" dev="devtmpfs" ino=627 ioctlcmd=0x64b2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 96.077482][ T29] audit: type=1400 audit(1785407582.641:442): avc: denied { write } for pid=6036 comm="syz.0.59" name="functions" dev="configfs" ino=8694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 96.156884][ T29] audit: type=1400 audit(1785407582.721:443): avc: denied { write } for pid=6036 comm="syz.0.59" name="header" dev="configfs" ino=9746 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 96.198807][ T6060] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 96.257111][ T29] audit: type=1400 audit(1785407582.731:444): avc: denied { write } for pid=6036 comm="syz.0.59" name="fs" dev="configfs" ino=9814 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 96.343517][ T6061] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 96.474993][ T6058] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 97.223417][ T5629] Bluetooth: hci1: command tx timeout [ 97.228980][ C0] vxcan1: j1939_tp_rxtimer: 0xffff8880557b1400: rx timeout, send abort [ 97.359043][ T35] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 97.623513][ T5629] Bluetooth: hci0: command tx timeout [ 97.656608][ T35] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 97.685852][ T5275] 8021q: adding VLAN 0 to HW filter on device eth3 [ 97.729906][ C0] vxcan1: j1939_tp_rxtimer: 0xffff8880557b1400: abort rx timeout. Force session deactivation [ 97.783512][ C0] ------------[ cut here ]------------ [ 97.789963][ C0] cpu_t != t [ 97.789974][ C0] WARNING: arch/x86/kernel/cpu/mce/core.c:1770 at mce_timer_fn+0x289/0x2e0, CPU#0: syz-executor/5611 [ 97.804092][ C0] Modules linked in: [ 97.808094][ C0] CPU: 0 UID: 0 PID: 5611 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 97.817566][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 97.827617][ C0] RIP: 0010:mce_timer_fn+0x289/0x2e0 [ 97.832910][ C0] Code: 58 00 4d 01 e4 4d 39 ec 4d 0f 47 e5 31 ff 4c 89 e6 e8 9b a2 58 00 4d 85 e4 0f 84 20 ff ff ff e9 f7 fe ff ff e8 e8 a7 58 00 90 <0f> 0b 90 e9 cf fd ff ff 4c 89 f6 48 c7 c7 00 cf 9f 8e e8 30 f1 85 [ 97.852530][ C0] RSP: 0018:ffffc90000007c30 EFLAGS: 00010246 [ 97.858592][ C0] RAX: 0000000000000000 RBX: ffff8880b8423440 RCX: ffffffff81f55efd [ 97.866561][ C0] RDX: ffff88807ebd2540 RSI: ffffffff81b1b858 RDI: ffffffff8e46e920 [ 97.874520][ C0] RBP: ffff8880b8523440 R08: 0000000000000001 R09: 0000000000000000 [ 97.882467][ C0] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 [ 97.890436][ C0] R13: 1ffff92000000f8e R14: ffffffff81b1b5d0 R15: 0000000000000001 [ 97.898402][ C0] FS: 0000555558855500(0000) GS:ffff888123ddc000(0000) knlGS:0000000000000000 [ 97.907330][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 97.913927][ C0] CR2: 00007fbda6d32700 CR3: 000000005ad44000 CR4: 00000000003526f0 [ 97.921879][ C0] Call Trace: [ 97.925156][ C0] [ 97.927981][ C0] ? __pfx_mce_timer_fn+0x10/0x10 [ 97.933003][ C0] call_timer_fn+0x19a/0x610 [ 97.937574][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 97.942668][ C0] ? __pfx_mce_timer_fn+0x10/0x10 [ 97.947701][ C0] ? mark_held_locks+0x40/0x70 [ 97.952450][ C0] ? __pfx_mce_timer_fn+0x10/0x10 [ 97.957476][ C0] __run_timers+0x757/0xb00 [ 97.961965][ C0] ? __pfx___run_timers+0x10/0x10 [ 97.966990][ C0] ? ktime_get+0x9f/0x320 [ 97.971301][ C0] ? _raw_spin_lock_irq+0x45/0x50 [ 97.976329][ C0] run_timer_base+0x114/0x190 [ 97.980985][ C0] ? __pfx_run_timer_base+0x10/0x10 [ 97.986188][ C0] run_timer_softirq+0x10/0x50 [ 97.990931][ C0] handle_softirqs+0x1ea/0x9b0 [ 97.995719][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 98.000985][ C0] ? _raw_spin_unlock+0x28/0x50 [ 98.005842][ C0] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 98.011457][ C0] __irq_exit_rcu+0x162/0x210 [ 98.016134][ C0] irq_exit_rcu+0x9/0x30 [ 98.020378][ C0] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 98.026015][ C0] [ 98.028950][ C0] [ 98.031858][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 98.037840][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 [ 98.044251][ C0] Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 b6 ee 27 f6 48 89 df e8 3e 3e 28 f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 05 4e 17 f6 65 8b 05 4e 37 a6 08 85 c0 74 16 5b [ 98.063857][ C0] RSP: 0018:ffffc900037efae0 EFLAGS: 00000246 [ 98.069900][ C0] RAX: 0000000000000002 RBX: ffffffff8ebf3ce8 RCX: 0000000000000040 [ 98.077871][ C0] RDX: 0000000000000000 RSI: ffffffff8e1a6f32 RDI: ffffffff8c402680 [ 98.085834][ C0] RBP: 0000000000000296 R08: 0000000000000001 R09: 0000000000000000 [ 98.093803][ C0] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000080000000 [ 98.101750][ C0] R13: 0000000000000200 R14: 0000000000000001 R15: ffff888073ecd800 [ 98.109732][ C0] __rcu_read_unlock+0x27f/0x5e0 [ 98.114672][ C0] simple_xattr_add+0xc08/0x1330 [ 98.119598][ C0] shmem_initxattrs+0x1f0/0x650 [ 98.124455][ C0] security_inode_init_security+0x242/0x370 [ 98.130326][ C0] ? __pfx_shmem_initxattrs+0x10/0x10 [ 98.135701][ C0] ? __pfx_security_inode_init_security+0x10/0x10 [ 98.142101][ C0] shmem_mknod+0x2ce/0x480 [ 98.146516][ C0] ? __pfx_may_create+0x10/0x10 [ 98.151355][ C0] ? __pfx_shmem_mknod+0x10/0x10 [ 98.156289][ C0] ? inode_permission+0x374/0x620 [ 98.161314][ C0] shmem_mkdir+0x31/0x80 [ 98.165580][ C0] vfs_mkdir+0x361/0x850 [ 98.169824][ C0] filename_mkdirat+0x48b/0x5e0 [ 98.174677][ C0] ? __pfx_filename_mkdirat+0x10/0x10 [ 98.180026][ C0] ? strncpy_from_user+0x19d/0x2d0 [ 98.185137][ C0] ? do_getname+0x191/0x390 [ 98.189623][ C0] __x64_sys_mkdirat+0x89/0xc0 [ 98.194387][ C0] do_syscall_64+0x115/0x870 [ 98.198958][ C0] ? clear_bhb_loop+0x40/0x90 [ 98.203641][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.209514][ C0] RIP: 0033:0x7f0e6e59ce07 [ 98.213931][ C0] Code: 00 66 90 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 db f7 ff ff 66 2e 0f 1f 84 00 00 00 00 00 90 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 98.233546][ C0] RSP: 002b:00007fff9e157bd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000102 [ 98.242031][ C0] RAX: ffffffffffffffda RBX: 00007fff9e157c30 RCX: 00007f0e6e59ce07 [ 98.250007][ C0] RDX: 00000000000001ff RSI: 00007fff9e157c30 RDI: 00000000ffffff9c [ 98.258031][ C0] RBP: 00007fff9e157c1c R08: 0000000000000001 R09: 00000000ffffffff [ 98.266022][ C0] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000009 [ 98.274019][ C0] R13: 00000000000927c0 R14: 00000000000176e0 R15: 00007fff9e157c70 [ 98.282004][ C0] [ 98.285064][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 98.292326][ C0] CPU: 0 UID: 0 PID: 5611 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 98.301774][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 98.311805][ C0] Call Trace: [ 98.315063][ C0] [ 98.317883][ C0] dump_stack_lvl+0x100/0x190 [ 98.322542][ C0] vpanic+0x552/0x970 [ 98.326498][ C0] ? __pfx_vpanic+0x10/0x10 [ 98.330979][ C0] panic+0xd1/0xe0 [ 98.334676][ C0] ? __pfx_panic+0x10/0x10 [ 98.339070][ C0] ? check_panic_on_warn+0x1f/0x90 [ 98.344159][ C0] check_panic_on_warn.cold+0x19/0x34 [ 98.349511][ C0] ? mce_timer_fn+0x289/0x2e0 [ 98.354169][ C0] __warn.cold+0x191/0x318 [ 98.358560][ C0] __report_bug+0x30f/0x440 [ 98.363039][ C0] ? mce_timer_fn+0x289/0x2e0 [ 98.367697][ C0] ? __pfx___report_bug+0x10/0x10 [ 98.372698][ C0] ? lockdep_unlock+0x5a/0xc0 [ 98.377349][ C0] ? mark_lock+0x402/0xa20 [ 98.381746][ C0] ? mce_timer_fn+0x289/0x2e0 [ 98.386410][ C0] report_bug+0xb2/0x220 [ 98.390632][ C0] ? mce_timer_fn+0x289/0x2e0 [ 98.395292][ C0] handle_bug+0x16a/0x2a0 [ 98.399604][ C0] exc_invalid_op+0x17/0x50 [ 98.404085][ C0] asm_exc_invalid_op+0x1a/0x20 [ 98.408917][ C0] RIP: 0010:mce_timer_fn+0x289/0x2e0 [ 98.414183][ C0] Code: 58 00 4d 01 e4 4d 39 ec 4d 0f 47 e5 31 ff 4c 89 e6 e8 9b a2 58 00 4d 85 e4 0f 84 20 ff ff ff e9 f7 fe ff ff e8 e8 a7 58 00 90 <0f> 0b 90 e9 cf fd ff ff 4c 89 f6 48 c7 c7 00 cf 9f 8e e8 30 f1 85 [ 98.433770][ C0] RSP: 0018:ffffc90000007c30 EFLAGS: 00010246 [ 98.439819][ C0] RAX: 0000000000000000 RBX: ffff8880b8423440 RCX: ffffffff81f55efd [ 98.447767][ C0] RDX: ffff88807ebd2540 RSI: ffffffff81b1b858 RDI: ffffffff8e46e920 [ 98.455716][ C0] RBP: ffff8880b8523440 R08: 0000000000000001 R09: 0000000000000000 [ 98.463669][ C0] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 [ 98.471615][ C0] R13: 1ffff92000000f8e R14: ffffffff81b1b5d0 R15: 0000000000000001 [ 98.479563][ C0] ? __pfx_mce_timer_fn+0x10/0x10 [ 98.484586][ C0] ? call_timer_fn+0x55d/0x610 [ 98.489327][ C0] ? mce_timer_fn+0x288/0x2e0 [ 98.493991][ C0] ? __pfx_mce_timer_fn+0x10/0x10 [ 98.498997][ C0] call_timer_fn+0x19a/0x610 [ 98.503590][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 98.508682][ C0] ? __pfx_mce_timer_fn+0x10/0x10 [ 98.513691][ C0] ? mark_held_locks+0x40/0x70 [ 98.518437][ C0] ? __pfx_mce_timer_fn+0x10/0x10 [ 98.523444][ C0] __run_timers+0x757/0xb00 [ 98.527930][ C0] ? __pfx___run_timers+0x10/0x10 [ 98.532936][ C0] ? ktime_get+0x9f/0x320 [ 98.537246][ C0] ? _raw_spin_lock_irq+0x45/0x50 [ 98.542287][ C0] run_timer_base+0x114/0x190 [ 98.546990][ C0] ? __pfx_run_timer_base+0x10/0x10 [ 98.552185][ C0] run_timer_softirq+0x10/0x50 [ 98.556925][ C0] handle_softirqs+0x1ea/0x9b0 [ 98.561672][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 98.566941][ C0] ? _raw_spin_unlock+0x28/0x50 [ 98.571839][ C0] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 98.577467][ C0] __irq_exit_rcu+0x162/0x210 [ 98.582127][ C0] irq_exit_rcu+0x9/0x30 [ 98.586349][ C0] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 98.591960][ C0] [ 98.594866][ C0] [ 98.597771][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 98.603747][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 [ 98.610154][ C0] Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 b6 ee 27 f6 48 89 df e8 3e 3e 28 f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 05 4e 17 f6 65 8b 05 4e 37 a6 08 85 c0 74 16 5b [ 98.629740][ C0] RSP: 0018:ffffc900037efae0 EFLAGS: 00000246 [ 98.635809][ C0] RAX: 0000000000000002 RBX: ffffffff8ebf3ce8 RCX: 0000000000000040 [ 98.643800][ C0] RDX: 0000000000000000 RSI: ffffffff8e1a6f32 RDI: ffffffff8c402680 [ 98.651748][ C0] RBP: 0000000000000296 R08: 0000000000000001 R09: 0000000000000000 [ 98.659694][ C0] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000080000000 [ 98.667639][ C0] R13: 0000000000000200 R14: 0000000000000001 R15: ffff888073ecd800 [ 98.675603][ C0] __rcu_read_unlock+0x27f/0x5e0 [ 98.680531][ C0] simple_xattr_add+0xc08/0x1330 [ 98.685454][ C0] shmem_initxattrs+0x1f0/0x650 [ 98.690288][ C0] security_inode_init_security+0x242/0x370 [ 98.696183][ C0] ? __pfx_shmem_initxattrs+0x10/0x10 [ 98.701536][ C0] ? __pfx_security_inode_init_security+0x10/0x10 [ 98.707932][ C0] shmem_mknod+0x2ce/0x480 [ 98.712329][ C0] ? __pfx_may_create+0x10/0x10 [ 98.717165][ C0] ? __pfx_shmem_mknod+0x10/0x10 [ 98.722097][ C0] ? inode_permission+0x374/0x620 [ 98.727104][ C0] shmem_mkdir+0x31/0x80 [ 98.731327][ C0] vfs_mkdir+0x361/0x850 [ 98.735550][ C0] filename_mkdirat+0x48b/0x5e0 [ 98.740381][ C0] ? __pfx_filename_mkdirat+0x10/0x10 [ 98.745734][ C0] ? strncpy_from_user+0x19d/0x2d0 [ 98.750828][ C0] ? do_getname+0x191/0x390 [ 98.755314][ C0] __x64_sys_mkdirat+0x89/0xc0 [ 98.760057][ C0] do_syscall_64+0x115/0x870 [ 98.764625][ C0] ? clear_bhb_loop+0x40/0x90 [ 98.769281][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.775149][ C0] RIP: 0033:0x7f0e6e59ce07 [ 98.779541][ C0] Code: 00 66 90 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 db f7 ff ff 66 2e 0f 1f 84 00 00 00 00 00 90 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 98.799145][ C0] RSP: 002b:00007fff9e157bd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000102 [ 98.807540][ C0] RAX: ffffffffffffffda RBX: 00007fff9e157c30 RCX: 00007f0e6e59ce07 [ 98.815488][ C0] RDX: 00000000000001ff RSI: 00007fff9e157c30 RDI: 00000000ffffff9c [ 98.823436][ C0] RBP: 00007fff9e157c1c R08: 0000000000000001 R09: 00000000ffffffff [ 98.831382][ C0] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000009 [ 98.839328][ C0] R13: 00000000000927c0 R14: 00000000000176e0 R15: 00007fff9e157c70 [ 98.847281][ C0] [ 98.850360][ C0] Kernel Offset: disabled [ 98.854662][ C0] Rebooting in 86400 seconds..