last executing test programs: 23.429101358s ago: executing program 0 (id=2951): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0b00000005000000020000000400000005"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x3, 0x100005, 0xb, 0x1}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000d00)={0x11, 0x15, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000047b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000001008500000001000000181100", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000010000850000008200000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000a80)={r2, 0x0, 0x0}, 0x10) 23.169078918s ago: executing program 0 (id=2953): r0 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r0, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) listen(r0, 0xa) syz_emit_ethernet(0x36, &(0x7f00000000c0)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1d}, @void, {@ipv6={0x86dd, @generic={0xc, 0x6, "370c89", 0x0, 0x2b, 0x1, @ipv4={'\x00', '\xff\xff', @empty}, @local}}}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000fe7000/0x18000)=nil, &(0x7f00000002c0)=[@text16={0x10, &(0x7f0000000000)="360f7883b81e2626660fc7350ff4650666b95c030010dada32f4656df30f09e3650f01ef66b9720500000f32f8000f0d35", 0x31}], 0x1, 0x2, 0x0, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0x1a, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r6, 0x4080aebf, &(0x7f0000000580)=@vmx={0x109, 0x0, 0x2080, {0x0, 0x8000000}, {'\x00', "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008bc584c800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001f6f38740000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a4900"}}) ioctl$KVM_RUN(r6, 0xae80, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000100100000100000001000000000000001000000000000000100100000e"], 0x28}, 0x0) recvmsg(r0, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) listen(r0, 0x0) 21.469463781s ago: executing program 0 (id=2959): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1, 0xba7e}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x17, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r3, r2, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0xbc1, &(0x7f0000001cc0)={@multicast, @remote, @val={@void, {0x8100, 0x6, 0x1, 0x1}}, {@ipv6={0x86dd, @icmpv6={0x4, 0x6, '?5\b', 0xb87, 0x3a, 0x1, @private1={0xfc, 0x1, '\x00', 0x1}, @remote, {[], @time_exceed={0x3, 0x0, 0x0, 0x2, '\x00', {0xb, 0x6, "821276", 0x5, 0x2c, 0x1, @remote, @ipv4={'\x00', '\xff\xff', @multicast2}, [], "4cacd43d31dd7130a22b60e411ba0cacf757f923df5b11ce6f9e862ad6fb72373db509d9fa8989982f2d000a96934b6c5bafd6ccf2fcf940344acf443544a5f069d0d10aa331fc680462d328531aeb2268c7e2116060c7a292732734bc30b20251c34f073735ad74aee238ecda21439f3c401d6870c6ad250b4d19b10f056834cd026331f5e59724d49fc8795e0aa33520b123ec2d504bfac166ad92ccf5ac468575580880a2281891b080b385a40fdf6a069040c995e4212fc2982637f2a5e8d3a1a75b4a50218ea02fefeababcbf9def697e59ba1a8f3469da585d89b93b67a7db53004032064ed6298153736e95ab7b9057da76e00bdef0fafa404d28639efcaf07b11d4a0f7e6c44b41b301005bc3f29b9f736bd2a7da1b2fe6c31bb06e392c98c89406b03d83930acaaef89654bc0daa44920c12dcae97471bc00f0c8093a184085d80d57bc9fb0664929f624453be99ae84ad83ab432fff5ee9dc79248e7e8672aa613a3ed9c53e5f09ab7b806d4ce0fd3e90e8d2b39434e7e9a143ab4012d1879ac1e62225894941bc753c97b31fed468c93fc08041db02ca41b036c0ad5103716f2c1a8c6f9b3a3e032dec42a57b1dd88675772be17ed01479d13e538b40c3fc996f741ac0101f482fba051b1885c43e107bd7d834f629f294f9e880f9702431a0e7bb139c955bcc9b9712ebc342000c4a8534fef1ba1223910c65148853ce7443539291d6cce33ac327a9f3762fcc19552b7b514bbd0777308757395aa93b3a34e294e860e602d341c97ed49bb3d7ff8427a9be4b039e04cee5320e32e2e84e5737ea8c9331afbaa0ab10cdb59b2685b8b84d90e7311919a6a06970f20f26ccc5bb09dce092e307a8a973899fe00c4785b7e2128b227ebceb0ceff5bbdea7095d72a6bc59394de512e6809663d7fa0a75a55f966c27d9c9606c43334c0308789ac5a7c5e3150456e42cd29f878f6264d237ceac0096d0f76fb52f3d05f482550e33e9260d1a6bab35bd717b94a8a933c347958068dac22f4e97eed21e7bb7ba23a89fac78fd6f88fd382f09321d5c5181ece27d794a2728c248dd97601c4b81ae729dc6ae716e97c7a1ebd01b1893970a2875c1536ef21a2d68107c951d8a176a77ba1b803aa7c234f02447a2d902f554c316fec2b9448c8d7d3026afefb417318b757fe7cc5612726490ae9f89bc5f2e6215db868e72fde303490d7dbc4d44d0c837bad49b4d4a2aab5ca89aac065d8af038aa8fdffe15c2af8c06532c694cb389901b4338cd6d455058afd05f27c7ca8b3d9031caf64dd5dbefbbaea45dd217cc62ff46d37102bf85b27f1ce6eb5251d47adac4d903a11d7774b987efba087876246a00e6866aae28bb040c14c76b639b5f23695c9806bf707172a9ac2256522569ed14fcf68a8218131fd1f2e481f9e429e1877bc7b03834f8dc5b358ecc7d9b795118b4892a56ae8a82137ef4d2f6269d7f447f86e76906f57611de142c077e4236d273b722d432842802595c9b92424fee12aa2d3cbb1d701db7c60aa3dd10d7b3931e85e0239f68f468b0fbfe9d6689663af9f0e71ed77818016dfe00b3c0f3eba769c835248cf7bf3c49d6a36f4b198277dc137dd182e4b751d5e63a401ed8999191b340de418328b92a2cee735d47db1ee23c9b52785f8b92b9ad7fffb517d1c1e08497f9e6a8a557d52a158b655d493060ec18a329f6a48e43b3b00e5ab05b6da7e0ac4b9101149a943640c05a89af8d7fa272779d1e77e2b31e24de0a58b85db742abec3f06d54aa3b698fbb1bcd615eec656f7c64b5f22da6b7e47a1a90cf68cd1abdd0ad37f6cbd9a60034c4879e7e8acf9e085ec8f7795d30206e04cab99b02abca4da82891fbb11d8739cfeaa1094a305bac305a2a4ba137f4332eec8eb82332b74ea26a23a14178b8fbf8d51feba4747280137c910b331a9703a2c38d8a890b8890aa89431940508282882475a9a84f59d34098cddc660401a296799bd1f9f486df6c9869054cb3afe571c9b52d51d40be0e6732186e425d79e8dc2ea874f4aeffe326fe154f18dce114909d5f34dd679b42f32662a419faddc21f32e57eaa17c3ffd1905095a13da146053f3a6cbca25bd897544103e0e9c95075cce85aece7c3cf4deed70a7be9af1b9a898253051786dcfbb579a875ce655eb102aa86f086dba94668460e2cbc52c17b6ee5fa2eee2352c45b6e27c612d727b6495f6e525a219c8af9a43e01379e6503b60732b6e92c154c2b35411164fddd8a13a7061f251ecde2d795893b0c646c137643b3336b5f6dc782d8c9e095270810a60687e59df6b3834a48058628d00dba71b75e90fabf7e81b97246c10c876b5e54ba11bc5928215d0be63a61f3836a187a44ea5b5a65de13814d9af7a94ad60ab0bad8b540df2703d0e2136cdfc3024f1728995c138678fc276b134fcc9dd5003707286902f492022f6f38488946f744970ff8fc7c99a8b6236636d0e15c79e096d1edad9ae4df00517f6df25446102b94af24f63f5f225ae0a884897a9ec7ec5c6a07ebfefd2f82528ba4bd0134c2a7e263979f94afd14ed4abf9bf3a17031de815c6a77a8024675eefa567876d60d744c801e1caf840136cacc263e041f61e606d49dea22933eb97ceecd90d16bab49f026e5c16ec692c05b1000782ad0d790a03145f107633ec343f722ae4e27082f88eb281c623e343fbe01b078c081cb85421e11b34d44107a074841e34a986166fe95e17761c2ec402c5f9b9a526713204fc7715d0458c814e9565268768d727086a0120de4217f0148313bddc1af03b28bfb952e51d2e0d2dbc701b78f4201d5ad18c1d0737fd1fe0f5d07962b3ae9101b6af416a72622f47773171ce387815336cee2e6ba94b1119bfc1cb6b3d233fd408a3d3f62285216f2fc1616b8f2e644c90486f8641f055e4f7a59e9bc354f58c600dae629381629f6a4d3660811c435754d26903521778a862d08f31d8e22dbf9eb5e9a499462fea7628ac13fbdb80a1b47361657f24e9643f44bb3e6bc7bd5e26f3f438bf32d27314ddbc5a44297c5f04310382623b8e5b5b0685010c98bae266e10da362addce73ae253a5f20cd2c086d7ca484a216d3de285e91c123399be7508833543ff05598c01061d123ae775b72fe3753e0c0e591876fa4e90797e2d90509f1691c66138190a3b8dead461f28750b311639ee87f737d7da2e35374d86c8ee646289509051a57c4fdcccb28d5ec1209a64886e47ce16fdbbca54328d00b222f0d92ad1bf32d2ca18e6e8c3b676d65b75a6f1ead8d827e8dff4090666c74f94b63194320c51d3f2ee59208eb05855c89470b4aa4c8d63a2e93da62b31445016d4de25369f8165424d6410377dce495f449c7f326d76fffa34adae837eaa89f715f9401777408fd45f00113a920f6c587a4090e077e6cd318d35e61129225abab83a6ca997e01c38ef261e3dd83e447ab06e3761989aa9ec2949c106c400a657af47b35b83b29bb92ffd6c6d39c2cd21e709f7005b6599384b42b8b44ea8a164059a82b414ecc425adcbe12710ce01116c2f9d4c14254209644aaa32983d3a28587536a3e5d0491b12729fac25e3683040275ed98cfffd4fdea6effcf244d02e34f32c9d479e107f64393cc4c93d12b00712483c19f07ea09bb7fa9b5fb20bf4ad4887c4c69fd9ef7811f5dea38f8920083613824169697a2e193230aa2b4c6c6fbaa3a911bfa4709670bf0952003736d1798f36c29bae1c061fa80d88080b78b16cfe8635698d16a33793f34c7321826b24feae56e19a7990944f7a0092da4281b256bad71cba3349af0a2b966648eaffd9b1f72fc4e90f466d58ea37c38cdec454c126190b156b2be701cb121b36bcaf919649af880e5fafec69325f98f200adea371e3199416eec8dea7ea491c8e98a29436869c555143667579f4d8eeedb47870d5bcfb24a8c688507d64b05a9eeacfa8c0a720e2edadc35ac3b83767bab948027a4624d006f10f24567486543077215b4123ecf0dc5686bd12fadce37142923786bcdaa94378f390e09c3c4bd3d0ad7371fcbfe67b41dbd5943556c6ded829186a3e3e6d5a946eadbbf9"}}}}}}}, 0x0) 20.778550792s ago: executing program 0 (id=2962): openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x82c1, 0x0) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = dup(r1) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000004c0), 0x14000, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[], [], 0x6b}}) 19.620192371s ago: executing program 0 (id=2965): setns(0xc9, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008010}, 0x48006) syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff0000408c1059010100010203010902200001010080fa0904000002ff0000000705810200020007050202"], &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r0 = socket$inet(0x2, 0x1, 0x0) ioctl(r0, 0x8914, &(0x7f0000000200)="63616e3000000000000000000000000001") syz_usbip_server_init(0x3) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) socket(0x2, 0x80805, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e96", 0x8) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) 19.545264496s ago: executing program 3 (id=2967): setns(0xc9, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], 0x0, 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r3, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000240)=@newlink={0x38, 0x10, 0x439, 0x70bd40, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x9801}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @wireguard={{0xe}, {0x4}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x24000007}, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$l2tp6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @empty, 0x2}, 0x20) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001980)={&(0x7f0000000380), 0x6e, &(0x7f0000001900)=[{&(0x7f0000000400)=""/231, 0xe7}, {&(0x7f0000000900)=""/4096, 0x1000}], 0x2, &(0x7f0000001940)=[@cred={{0x18}}, @rights={{0x10, 0x1, 0x1, [0xffffffffffffffff]}}], 0x28}, 0x20a1) connect$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x8001}, 0x20) 17.731144604s ago: executing program 3 (id=2969): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) r1 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) ioctl(r1, 0x800452d3, &(0x7f0000000000)) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x20) write(r2, &(0x7f0000000000)='3', 0x4e) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x0, 0x401d031, 0xffffffffffffffff, 0x0) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000}, 0x20000000) 17.372329707s ago: executing program 3 (id=2970): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r1, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x35, 0x5, 0x57e, 0x330, 0x0, 0x0, "0600ff0901a101150026ff007508951f852009018102852109018102852209018102851609019102851709019102851509019102c0"}}, 0x14d) nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0) write$UHID_INPUT2(r1, &(0x7f0000000080)={0xc, {0x3, "20009c"}}, 0x9) 16.712629816s ago: executing program 0 (id=2972): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = dup(r1) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000680)=@raw={'raw\x00', 0x3c1, 0x3, 0x290, 0x0, 0x940c, 0x3002, 0x230, 0x2c0, 0x230, 0x3d8, 0x3d8, 0x230, 0x3d8, 0x3, 0x0, {[{{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x8}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x12d, 0x7ff, 0x2}}}, {{@ipv6={@empty, @private0={0xfc, 0x0, '\x00', 0x1}, [0xffffff00, 0xff000000, 0xffffff00, 0xff], [0xff000000, 0xffffff00, 0xffffffff, 0xff], 'vxcan1\x00', 'gretap0\x00', {}, {0xff}, 0x87, 0x75, 0x5, 0x60}, 0x0, 0xa8, 0xc8}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2f0) sendmsg$inet6(r1, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000180)=[{0x0}], 0x1}, 0x4048043) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x4e24, 0x401, @local, 0xdf9}}, 0x5, 0x1, 0xf06, 0x0, 0xac, 0x5, 0x5}, 0x9c) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="28000000020301000000000000000000000000000800010001000000090002000000ffff"], 0x28}}, 0x0) syz_emit_ethernet(0x3e, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd60"], 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=@dellink={0x20, 0x11, 0x101, 0x0, 0x0, {0x0, 0x0, 0x0, r7}}, 0x20}}, 0x20008802) 10.739805766s ago: executing program 2 (id=2985): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1fd) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000180)={0x2020, 0x0, 0x0, 0x0}, 0x2020) mount$bpf(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x100000, &(0x7f00000021c0)={[{@mode={'mode', 0x3d, 0x2}}, {@uid={'uid', 0x3d, r1}}, {@mode={'mode', 0x3d, 0x3}}], [{@seclabel}, {@appraise}, {@obj_type={'obj_type', 0x3d, 'tracefs\x00'}}, {@smackfshat={'smackfshat', 0x3d, 'tracefs\x00'}}]}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x1f985000) 10.66545397s ago: executing program 1 (id=2986): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[], 0x78}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f00000032c0)=[{&(0x7f0000000440)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000100)="03", 0x1}], 0x1}], 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000300)={0x7f, 0x4d, 0x2ba8}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x7, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0xfffffffd, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe5, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffff9, 0x8, 0xd, 0x800, 0x3, 0x6, 0x4, 0x100006, 0xc7, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0xc, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0x1ff, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x3, 0x1000000, 0x489, 0x7ff, 0x4, 0x80000001, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0xfffffff7, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0xa, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf781, 0x80000001, 0x5, 0x2, 0x489, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee48, 0x2000004, 0x1, 0x10, 0x6, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x8, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0xa, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x3, 0x10010, 0xfffffffd, 0x5, 0xfffffffe], [0xc, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x5, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0xa0, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xea1, 0x428, 0x5, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x1, 0x8, 0x13fff, 0x1, 0x1]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0xfffffffffffffffa, 0x5, 0xf2, 0xd, 0x7fffffffffffe, 0xa, 0x5, 0xa, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 10.374655416s ago: executing program 2 (id=2987): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10000, 0x5}) syz_emit_ethernet(0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaa00810000000800450000ac141400e000000100000000001090780200"/51], 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000006, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r1, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) close(0xffffffffffffffff) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, 0x0, 0x0) r4 = fsopen(&(0x7f00000001c0)='romfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r3, 0x84, 0x10, &(0x7f0000000900)=@assoc_value, 0x8) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x3, 0x2, 0x6, 0x0, {0xa, 0x4e23, 0xa, @mcast1, 0x2}}}, 0x80, 0x0}, 0x2000f765) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000180)={0x42}, 0x10) sendmsg$tipc(r2, &(0x7f0000000380)={&(0x7f0000000140)=@name={0x1e, 0x2, 0x3, {{0x40, 0x3}}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x24008884}, 0x8805) r5 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(r5, 0x0, 0x82, &(0x7f00000002c0)={'broute\x00', 0x0, 0x0, 0x0, [0x3, 0x7, 0x4, 0x1, 0x2, 0x7]}, &(0x7f0000000200)=0x2) r6 = add_key$fscrypt_provisioning(&(0x7f0000000000), &(0x7f00000005c0)={'syz', 0x0}, &(0x7f0000000600)=ANY=[@ANYBLOB="01000000000000006161622d64ac61616161616161616161616161616161616161616161616161613131313131313131313131313131313131313131313131313131313131313131"], 0x48, 0xfffffffffffffffc) keyctl$revoke(0x3, r6) socket$nl_generic(0x10, 0x3, 0x10) clock_gettime(0x7, &(0x7f00000009c0)) io_setup(0x6, &(0x7f00000000c0)=0x0) io_getevents(r7, 0x2e5, 0x4, &(0x7f0000000100)=[{}, {}, {}, {}], &(0x7f0000000180)={0x0, 0x3938700}) r8 = fsopen(&(0x7f0000000240)='ramfs\x00', 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043e", @ANYRES8=r8], 0xec) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) 9.932882162s ago: executing program 1 (id=2988): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_GET_MSRS_cpu(r4, 0xc008ae88, &(0x7f00000000c0)={0x1, 0x0, [{0x40000070, 0x0, 0x100000001}]}) 9.920261723s ago: executing program 2 (id=2989): socket$kcm(0x10, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x0, &(0x7f0000000280)=0x6) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r1 = getpid() r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r2) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000340)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r3, @ANYBLOB="07a214338173c92e2f00"], 0x20}}, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r5 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) ioctl$TIOCGPGRP(r6, 0x540f, &(0x7f00000000c0)) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r5, 0x8, &(0x7f00000002c0)=0x80000000000003) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x800) unshare(0x6a040000) socket$nl_crypto(0x10, 0x3, 0x15) sendto$inet6(0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x4000, &(0x7f0000000100)={0xa, 0xfffc, 0xfffffffc, @dev={0xfe, 0x80, '\x00', 0x40}, 0x3}, 0x1c) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) shutdown(0xffffffffffffffff, 0x1) setsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000080)={0x0, 0x1, 0x0, 0x8, 0x2, 0x819}, 0x14) socket(0x2, 0x80805, 0x0) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r7, 0x0) 9.504525748s ago: executing program 1 (id=2991): pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) r1 = socket$nl_generic(0x10, 0x3, 0x10) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f00000001c0)=ANY=[@ANYBLOB="2a01000020000040b708000000000000430109029200030172e5000904000000010100000a24010000000201020c0d240700000500006e626805000c240000e945fff5ffffffff092403f3ff000005024524", @ANYRES8=r3, @ANYBLOB="05"], 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r5, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0x78b}) r6 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r6}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_RUN(r7, 0xae80, 0x0) io_setup(0x3, &(0x7f0000000080)=0x0) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0700000004000000010000000100000000000000", @ANYRES32=0x0, @ANYBLOB="080000000000000000000000264ba8f3fd0000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) r9 = openat$audio1(0xffffffffffffff9c, &(0x7f00000000c0), 0x802, 0x0) r10 = creat(&(0x7f00000007c0)='./file0\x00', 0x42) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[], 0x88}, 0x0) r11 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000001b80), 0x2, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x4a, &(0x7f0000000340)={&(0x7f0000000280)={0x14, 0x22, 0x300, 0x70bd2d, 0x25dfdbfb, {0x19}}, 0x14}, 0x1, 0x0, 0x0, 0x8080}, 0x4) write$selinux_load(r11, &(0x7f0000000280)=ANY=[@ANYBLOB="8cff7cf9080000005345204c696e7578"], 0x65) io_submit(r8, 0x6, &(0x7f0000000980)=[&(0x7f0000000380)={0x0, 0x0, 0x0, 0x6, 0x48, r9, &(0x7f00000002c0)="5782b6ab30d4c85dc8f1cf96f74a7baf00d67eeae4114a61401b659e3a5a8dd06e1aa5cb81a864b3f46d12645a22073614a763057b0b952d7bc3b3c408b3a29962f02280118b8bfc88835604cfa71e380a7744b47bb0e838f09958d5378c25e6025bc59f6e650785b9e5f9fb013ef58d44c471da5a2be9448c505192dfb586b38bc881188a047d477cbfc5c344bb0e939d7186247691d35e9aaace8104e4176dac3f18be4ce072372306f1632cc9", 0xae, 0x4, 0x0, 0x3, r0}, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x8000, r0, &(0x7f0000000500)="485603e47826e215e82eec5971231b73e03bedf8010ac491cad48cf8f80b3ed04ec6e8df42548a998a296c671b4f58e44f55d323f9927fbbf77c94e37c0d06af6e6aa6e5f5bc5411a0c91c3c1c53d80e1146118e370a7bb4618b23081cbf7f5441e6bc5f6cd9f4a0bd65f0c5caa09786e603344a8355a765e459dd2a421d782af599e2da3a61c6547e72f8a7b7043e31c50d58f90636a19d1aede1b3e5d3175a8e3d4f21e36976565fc1e6fce53166b8fe717fe6f50db8e547c1d6e863fc9f76de69a79743e1edb55ea5d04d7d536332cd", 0xd1, 0x2, 0x0, 0x1, r3}, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x5, 0x8001, r4, &(0x7f0000000640)="0b74b25e88", 0x5, 0x4, 0x0, 0x0, r2}, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x3, 0x4, r1, &(0x7f00000006c0)="d9ca6815013db2d8c97d645dd6418d0d7c63b02adc8a32d23b2a8ead6e85cd9a85850f647e79b1ba9d86f1968a6faec94be746590f5c38b84480c40568ee9134ea6778d104faf10845d55f24d0e58bfece26c7e3a1060b5395b9213af233ed0e223f1591da11dfb03890bd5ae7d269dc6c209b286821dc6d1ec25295a752e67bb5b04585368acd7bd26b571377a9e52bc1b2141949e62f39f6d34cd370e652a3458687dfa1bb25a2300e8e083e16ab", 0xaf, 0x78, 0x0, 0x2, r0}, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x6, 0xf03e, r10, &(0x7f0000000800)="8e948de5f395ce7e0d395813dadd5616f08869878a618e99e98adf62baa6e38f0438df4763d4ee028cd078bc11a7bfdffbd247ba268f937b32b23c7a7429cada54a24ac07521c203cf2a9d9d48f8e25b78c8250b4e2f22807a54ccd9aec0e17a237dafd233e3d53ef842ca6e5527a727617210b25e2a", 0x76, 0x9de, 0x0, 0x2}, &(0x7f0000000940)={0x0, 0x0, 0x0, 0x6, 0x1, r7, &(0x7f00000008c0)="487146c353ad3fc8b46bb80b18bba4fc9a1bbb82a234f8a3ff7d83f40088a82a772b9c2f80c65da72c4b761e64e23ee79c9582d04e450eaa1eead5ba91af39ee00a4ed75d9cd4a28116495ea79f49e14b6ba0223b7ad7b0967e4130f5231f1026ca571826fe2e7f984ecd4d3634233625d0b6a28b385ebfe0980dd95", 0x7c, 0x5, 0x0, 0x3, r3}]) 7.861018343s ago: executing program 4 (id=2993): socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$inet(0x2, 0x3, 0x6) setsockopt$inet_int(r0, 0x0, 0x3, &(0x7f0000000500)=0x1, 0x4) sendto$inet(r0, &(0x7f0000000300)="450000280000400040063ccd7f0000027f0000013039001500", 0x19, 0x0, &(0x7f0000000400)={0x2, 0x15, @loopback}, 0x10) (fail_nth: 1) 7.450018985s ago: executing program 4 (id=2994): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg$NL80211_CMD_NEW_MPATH(r0, &(0x7f0000000940)={&(0x7f0000000480), 0xc, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x20004080}, 0x40048c4) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, 0x0, 0x0) socket(0x1f, 0x80000, 0x6) openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x11000) r2 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r2}, &(0x7f0000000000)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r3, 0x1, &(0x7f0000000040), 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000540)=ANY=[@ANYBLOB="0001000000000000c40000042798d946da2e1ff742855dfa9a4bfd4e6573aa940e34062b3f38ad01e52f4fd22ee401bba96f32ffc39c6aff8f3eba13c9710cced420a3ffa20a51dae7e25b76c44468781500fc2187c2e9973873918856ea91c297f972c5ae65ae2824dae7db9768d525eead386e548550b8ff90fd369c3cf2a2e25228bd06bd52219f207457578e6ad795c8efaf95649dccdb6c13135ab33ab7592f29586860f1a5222a608f67846d796243d4bda20eceab0ecf96a98ffc7026ea2dee1ab507ee4335ddc5b29154fc1f0487a3538c64f7b0926a53dc2c79b861e2bfcf4e75117314a2577eb2c2402314a2eba6e8a0c72576158d23c1f53d02839adec3733d8228c2e2bfff7488dcc18262feb977334a93d52292b848672056eea3683fdb17acdf6e25a5e1c40b4597fc76de71fcaf91b9c19ca6cd197243b0c44245e8ed18fb5aed6c4df4829819260496692119a65ef6060cab4a837721027caafafbacc362cdccb9c9bdeeaf8317ef"], 0xd) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 7.375788237s ago: executing program 3 (id=2995): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg$NL80211_CMD_NEW_MPATH(r0, &(0x7f0000000940)={&(0x7f0000000480), 0xc, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x20004080}, 0x40048c4) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, 0x0, 0x0) socket(0x1f, 0x80000, 0x6) openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x11000) gettid() fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) connect$inet6(r2, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) write$tun(r3, &(0x7f0000000540)=ANY=[@ANYBLOB="0001000000000000c40000042798d946da2e1ff742855dfa9a4bfd4e6573aa940e34062b3f38ad01e52f4fd22ee401bba96f32ffc39c6aff8f3eba13c9710cced420a3ffa20a51dae7e25b76c44468781500fc2187c2e9973873918856ea91c297f972c5ae65ae2824dae7db9768d525eead386e548550b8ff90fd369c3cf2a2e25228bd06bd52219f207457578e6ad795c8efaf95649dccdb6c13135ab33ab7592f29586860f1a5222a608f67846d796243d4bda20eceab0ecf96a98ffc7026ea2dee1ab507ee4335ddc5b29154fc1f0487a3538c64f7b0926a53dc2c79b861e2bfcf4e75117314a2577eb2c2402314a2eba6e8a0c72576158d23c1f53d02839adec3733d8228c2e2bfff7488dcc18262feb977334a93d52292b848672056eea3683fdb17acdf6e25a5e1c40b4597fc76de71fcaf91b9c19ca6cd197243b0c44245e8ed18fb5aed6c4df4829819260496692119a65ef6060cab4a837721027caafafbacc362cdccb9c9bdeeaf8317ef"], 0xd) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 7.094634992s ago: executing program 1 (id=2996): socket(0x400000000010, 0x3, 0x0) prlimit64(0x0, 0x6, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6a72c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) unlinkat(0xffffffffffffff9c, 0x0, 0x2e5) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000040)={0x18, 0x0, {0x1, @multicast, 'ip6gre0\x00'}}, 0x1e) r4 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x200, 0x0) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001240)={&(0x7f0000000500)=ANY=[@ANYBLOB="840100001900010000000000000000001d0109004d00108025b57efaa223b473fe7783bc4a506cf756740574b89d316af9b5963870ef3391f3ac176f88d6e1db9b2bb2e5c90fa4eb2f71ebaede447dc8f6f61c6615fcf740adda4853b2d23adb37"], 0x184}}, 0x0) ppoll(&(0x7f0000000000)=[{r4, 0x8082}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r4, 0xc004500a, &(0x7f0000000040)=0x8) mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x8012, r4, 0x0) rmdir(&(0x7f00000001c0)='./file0\x00') r6 = syz_io_uring_setup(0x18d7, &(0x7f0000000300)={0x0, 0x3267, 0x2, 0xfffffffd, 0x17b}, &(0x7f0000000080), &(0x7f0000ffe000), &(0x7f0000000380)) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(r6, 0x2, &(0x7f0000000180), 0xfe) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fdinfo/3\x00') read$FUSE(r7, &(0x7f0000002140)={0x2020}, 0x2020) timer_settime(0x0, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) clock_settime(0x999522f1c2343942, &(0x7f0000000100)) sendmmsg(r3, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}}], 0x3e8, 0x0) 3.351851525s ago: executing program 2 (id=2997): r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r1, 0x800448d2, &(0x7f0000000000)={0x0, 0x0}) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) wait4(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000100)) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000040)=0x2, 0x4) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000002c0)="94", 0x1}, {0x0}, {&(0x7f0000000280)="21b0564bd729a4e6cfae95b94ac3e1ce1d39e8310c906ebad0", 0x19}], 0x3) ioctl$OTPGETREGIONCOUNT(0xffffffffffffffff, 0x40044d0e, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$netlink(0x10, 0x3, 0x15) sendmsg$netlink(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000680)=ANY=[@ANYBLOB="2c0000002520010002000000fedbdf251c0000000c0035000000000000ee00000c004300070000020000000045df0000000000000005770f03e28c30b2b1563d9093378e5ebcc2"], 0x2c}], 0x1, 0x0, 0x0, 0x4008000}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mmap$IORING_OFF_SQ_RING(0x0, 0x8004002, 0xc1e6e71558eba5be, 0x401d031, 0xffffffffffffffff, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) mq_open(&(0x7f0000000b80)='!s\xc6(X\xc7_\xa4BM\xa0\xdc]q\xc6\xc0\xbd4yL\x0f\xb2(O\xd7\"D\x9e\xae\xd0Bf\xa2WICn)\xd62\t\b\x9cK\xc8Q\xf6\xa9\xb7pa\x8c\xb2\x1c\xe3\x94\"\xc3\x0e\xb2N\xac\xd8\x10\ra\xef\x05\xc6f\x92\xd1$\xbbh\xe9\x85\xd7<\x8er\x82\"\xc0T\xcb)\xfc\xdf\x88V\xd9\xee\xb8j\x1dO\xd5\xbf\x8cY\x14\xf0*`\xbe\x87\xbb\xfe\xdc\x89\xf5{\xd1\xa6\xf0\xe0\x17jj\xf7\x1dJ\x89\x93\x84\xbe\x05\x89\xc3\xa6>\x90\x9b\xee\x96\xba\x1a\f\xf0\xcd\xa3#\x1biJ\x8b\x19\x8e\xd5P\xeb\r\xc9I~#6x\xf9\r\x87\xac\x10\xd8\x90v\xad2\xa3w\xa2}\x84\x95p\xfc\xf7F\xfe\x8c\xf5\xfc[\xd6\xaa\x90\x18\xc1 \xa5;\x92\xa2\xe6\x0f%\xf7\x9c\xb5\x0fQ\x0e|T\xf7\x8c\xa9g\xa0\xcdP\n\x9a\x88Q\x8d~&\xcev\x01\x8e\xd07\xb4\xba\xb3\xf7\xfb\xcf\x12i\tw\x9d\xa1d\x84\xe3\x7f\xaci=4\xad\x02\xe6\x7fz\xa2\x01CN\x9d\x93\x14\x8fq\xb2f\x88x,xHe\xd0\xe8o\x88K\x8f\x8c\xa6\xd8*f\xc8j\xd9\n\xa2Q0\xc0\xe1\x81k\xf2\xe1\xcf\xc6\x1d\xd1Z\xa5\xe7\xb6=\xdb\x06n\x9b\xda\x8ah\xd4\xaa\x8c\xe7d\xf9\\\xef\xb0+\x8d)n\xbe=\x1b\x9bu\x16U\x86Q\xcf\xf0\xfb\x0e\aSQ)\xfcff(\xebf0^(\x00\x11\x13\xe6\x1f\xde\x98\x05\x00\x00\x00\xd8\x04<@\x8c1\\\x93\xc4\v\xd8\x06\xb2\x87\x8a|\xe1\xde\xdb\xdcD\xa3\xeeYL\x90\x13\xa5[\x8f\xb9\xc3\xee \x8ey\x85\xde`\xda\x97n \xacy\xf2k\xcec1C\xf1\xbb\xa5E38kE\x84Z\xca@p?\x13/\xa4Qz1\xbe\x12o\x1dXl\xa8N\n\x9a\xdd\x9eT\xe0b\xcd\a\xf9\xec\x8c\xc2\x1eV\xc5\xa6\xeb\xe6\x977\x18\xc3\x01\xee\xe0c\x0f\xbb\n&[\xc2\xef\xe8\x9d\xce);r\xbd\a\x93\xce5\x1c#\xc8\x12\x01\x89w\xff:\xd6\x1e\xb8\xcal\x1c1\xd5$\a\x1fW\x1d(>t\x81\x9bH1\x11\xd9W\xc5\x91\x96\x1a5\x8d\xa4o\r\xec\xdc|]\b\x00\x00\x00\x05\xd1\xea\xc4q-\xf8\xe6ZG\xdcz\xa1n\x8e\x94\x89o\xbf\xf7O\v\xc2\x97%\xc1\x14\xa7F\xc3\x13\xae\xa1\xc7+\xd0S\xd7w\x87\xd2\xdc\xbf\x86>\xfa\xf9\xb9\xc8\xef\xb5!\xda \xaf\xbd8%\b\xd4\xfd\xc9\x00\x05p\xf7Y\x17\x90\x8f7B\xbfSO\xb55e\x8e\x83\x95\xac\x8c\aF\x84`\x82iqAI\xd1U\x1b\xe15\xb9\xca\x1c\xbeN\xd0\xfeg\xdfH\x84\x86\xe3\x17\xe0\x1dx\xf9]\x1d*\x1a\x1d\xc9I\xd8ds(\xa6\xf8l[\xce,\xf7\xa7\x1d0\xd8\xb3\xf1o\x00\ak\xc9\xe9l\xd6\xecl\xdbZ$_\x1d\x9b8\xdd\xef\xcc f\\\x0f\xac-\xf3\xda\xbaO\xb3\xf9\xb0\xcf=Z\xa2M\xa4\xfb:\x8a]\x87-\xdf\xb8\xd3\x11\x1d\x06{\xc5!\xa9\x0e\x9a,\xd8\xca\xe6\x98n\x8b\xb2\x04J6\x98\xe3\x9e\xfb8\xa3\x9b6\xca%[\xf89\xc5mf\x17\xd1\xd6\xf4\xb9\xe2\xa3I\x87?\xe5\x00\x9f\f!m\xc7\xe7c\xe1\x16\x00\xbb\xd1\xfb\xa3\x04#\xa560\xe9\x86\x8f\xfas|\x90\x9d#\xebkr\x83DRG', 0x800, 0x90, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000240), r5) sendmsg$IEEE802154_LIST_PHY(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)={0x14, r6, 0x30b, 0x70bd2c, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4044}, 0x20000004) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000002c0), r5) r7 = fsopen(&(0x7f0000000300)='debugfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) r8 = fsmount(r7, 0x0, 0x3) fchdir(r8) r9 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x0, 0x124) ioctl$FS_IOC_SETFLAGS(r9, 0x40086602, &(0x7f0000000080)=0x8000) 2.983695757s ago: executing program 4 (id=2998): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[], 0x78}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f00000032c0)=[{&(0x7f0000000440)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000100)="03", 0x1}], 0x1}], 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000300)={0x7f, 0x4d, 0x2ba8}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x7, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0xfffffffd, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe5, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffff9, 0x8, 0xd, 0x800, 0x3, 0x6, 0x4, 0x100006, 0xc7, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0xc, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0x1ff, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x3, 0x1000000, 0x489, 0x7ff, 0x4, 0x80000001, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0xfffffff7, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0xa, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf781, 0x80000001, 0x5, 0x2, 0x489, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee48, 0x2000004, 0x1, 0x10, 0x6, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x8, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0xa, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x3, 0x10010, 0xfffffffd, 0x5, 0xfffffffe], [0xc, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x5, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0xa0, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xea1, 0x428, 0x5, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x1, 0x8, 0x13fff, 0x1, 0x1]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0xfffffffffffffffa, 0x5, 0xf2, 0xd, 0x7fffffffffffe, 0xa, 0x5, 0xa, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 2.325189404s ago: executing program 3 (id=2999): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000002580)={0x0, 0x0, &(0x7f00000025c0)={&(0x7f0000002600)=@getqdisc={0x24, 0x26, 0x301, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x0, 0xc}}}, 0x24}}, 0x24000864) (fail_nth: 1) 1.850282725s ago: executing program 3 (id=3000): syz_emit_ethernet(0x56, &(0x7f0000000340)=ANY=[@ANYBLOB="aaaaaaaaaaaaaa4c77b99cbb86dd60c61e000000000000000100000000e01f00000000000000ff0200000000000000000000000000010100c2"], 0x0) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0x6, 0x15, &(0x7f0000000000)=@framed={{}, [@printk={@i, {0x3, 0x3, 0x3, 0xa, 0x1, 0xfe00}}, @func={0x85, 0x0, 0x1, 0x0, 0x1}, @exit, @printk={@x}]}, &(0x7f0000000100)='GPL\x00', 0x3}, 0x90) r1 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000140)={'mangle\x00', 0x0, [0x7, 0x4, 0x6, 0x9e, 0x7]}, &(0x7f00000001c0)=0x54) r2 = open(&(0x7f0000000000)='./file0\x00', 0x80140, 0x0) fcntl$setlease(r2, 0x400, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=@newsa={0x16c, 0x10, 0x713, 0x0, 0xa5dfdbfc, {{@in=@private=0xa010102, @in=@remote, 0xffff, 0x0, 0x4e21, 0x22, 0xa, 0x0, 0x0, 0x1d}, {@in6=@mcast2, 0xfe, 0x32}, @in6=@empty, {0xffff, 0x0, 0xfffffffffffffffd, 0x8, 0x1, 0xb, 0x7fffffff, 0x543}, {0x4, 0x8000000000000002, 0x0, 0x1}, {0x2}, 0x70bd2b, 0x3500, 0x2, 0x4, 0x0, 0x10}, [@encap={0x1c, 0x4, {0xfffffffffffffffe, 0x4e23, 0x4e20, @in6=@dev={0xfe, 0x80, '\x00', 0x2d}}}, @algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "210466d38547aa140db9a200000000c538c7cb7a"}}]}, 0x16c}, 0x1, 0x0, 0x0, 0x1}, 0x0) r4 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000b00)=ANY=[@ANYBLOB="380100001000070000639e4d7c390000000000000058667300000000000000000000000000000000ac1414aa0000000000000000000000004e2000000000000000000000020000004ef741cfdc927af541181aecca3a2e01b6d691f53d1c1c1eade607ff", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff010000000000000000000000000001000000002b000000fc00000000000000000000000000000003000000000000000100000000000000020000000000000009000000000000000000001000000000010000000000000000000000000000000000000000000000000000000000000002000000000000000700000000000000000000000000000000000400ffffffffe80a000000000000083500000a0002fe340000000000000014000e00fe8000000000000000000000000000bb240009008f6b0000000000000200000000000000b4000000000000000500000000000000"], 0x128}, 0x1, 0x0, 0x0, 0x1}, 0x890) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=ANY=[@ANYBLOB="0c0100001a0007002abd700000000000fe80000000000000000000000000001b40000000000000000000000000000000000300004e2200000000000002000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYRESHEX=r0], 0x10c}}, 0x8000) r6 = syz_ublk_setup_io_uring(0x5a42, &(0x7f0000000040)={0x0, 0xdaa8, 0x10, 0x1}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r10 = syz_ublk_add_dev(r6, r7, r8, r9, &(0x7f0000000200)={0x2e, 0xc, 0x0, r4, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r13 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x1, 0x11, r13, 0x0) connect$inet6(r13, &(0x7f0000000540)={0xa, 0x4e21, 0x3, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x2}, 0x1c) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r14 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x17ef, 0x6047, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x20, "", [{{0x9, 0x4, 0x0, 0x0, 0x5, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0xfd, 0xf, 0xbe}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r14, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(r14, &(0x7f0000000000)={0x2c, &(0x7f0000000500)={0x0, 0x21, 0x28, {0x28, 0x1, "f70ba381030000000000000000cb4fdca0560fb30d54f365c5b1d43ee44fbf6fc93f0808251f"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r14, 0x0, 0x0) r15 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt(r15, 0xff, 0x7, &(0x7f0000000000)="fa794bfa", 0x4) r16 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r10, 0x2) syz_ublk_setup_queues(r16, r12, &(0x7f0000000280)={0x0, 0x5a7a, 0x0, 0x2, 0x2ce, 0x0, r13}, &(0x7f0000000c80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x80072bc, 0x40, 0x0, 0x1f5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x18a7, 0x1, 0x0, 0x31e}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x468b, 0x0, 0x2, 0x39f, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9af2, 0x8000, 0x1, 0x20a, 0x0, r2}}], 0x4, &(0x7f0000000400)={0x2e, 0x6b, 0x0, r16, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xff}, 0x0, r11, '\x00', {0x3, 0xe50, 0x0, 0x0}}, &(0x7f0000000480)) 1.727001467s ago: executing program 4 (id=3001): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x17) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={r0}, 0x4) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x18, &(0x7f0000000580)=ANY=[@ANYBLOB="180200000000000000000000a8ea0000b7080000000000007b8af8ff00000000b7080000000200007b8af0ff0000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000000000085000000a5000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000002000000850000001700000095"], &(0x7f0000000080)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xe00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 1.376715546s ago: executing program 4 (id=3002): bpf$MAP_CREATE(0x0, 0x0, 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0900000004000000ff0f000003"], 0x48) close(r0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1, 0xba7e}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x17, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000001811", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r3, r2, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0xbc1, &(0x7f0000001cc0)={@multicast, @remote, @val={@void, {0x8100, 0x6, 0x1, 0x1}}, {@ipv6={0x86dd, @icmpv6={0x4, 0x6, '?5\b', 0xb87, 0x3a, 0x1, @private1={0xfc, 0x1, '\x00', 0x1}, @remote, {[], @time_exceed={0x3, 0x0, 0x0, 0x2, '\x00', {0xb, 0x6, "821276", 0x5, 0x2c, 0x1, @remote, @ipv4={'\x00', '\xff\xff', @multicast2}, [], "4cacd43d31dd7130a22b60e411ba0cacf757f923df5b11ce6f9e862ad6fb72373db509d9fa8989982f2d000a96934b6c5bafd6ccf2fcf940344acf443544a5f069d0d10aa331fc680462d328531aeb2268c7e2116060c7a292732734bc30b20251c34f073735ad74aee238ecda21439f3c401d6870c6ad250b4d19b10f056834cd026331f5e59724d49fc8795e0aa33520b123ec2d504bfac166ad92ccf5ac468575580880a2281891b080b385a40fdf6a069040c995e4212fc2982637f2a5e8d3a1a75b4a50218ea02fefeababcbf9def697e59ba1a8f3469da585d89b93b67a7db53004032064ed6298153736e95ab7b9057da76e00bdef0fafa404d28639efcaf07b11d4a0f7e6c44b41b301005bc3f29b9f736bd2a7da1b2fe6c31bb06e392c98c89406b03d83930acaaef89654bc0daa44920c12dcae97471bc00f0c8093a184085d80d57bc9fb0664929f624453be99ae84ad83ab432fff5ee9dc79248e7e8672aa613a3ed9c53e5f09ab7b806d4ce0fd3e90e8d2b39434e7e9a143ab4012d1879ac1e62225894941bc753c97b31fed468c93fc08041db02ca41b036c0ad5103716f2c1a8c6f9b3a3e032dec42a57b1dd88675772be17ed01479d13e538b40c3fc996f741ac0101f482fba051b1885c43e107bd7d834f629f294f9e880f9702431a0e7bb139c955bcc9b9712ebc342000c4a8534fef1ba1223910c65148853ce7443539291d6cce33ac327a9f3762fcc19552b7b514bbd0777308757395aa93b3a34e294e860e602d341c97ed49bb3d7ff8427a9be4b039e04cee5320e32e2e84e5737ea8c9331afbaa0ab10cdb59b2685b8b84d90e7311919a6a06970f20f26ccc5bb09dce092e307a8a973899fe00c4785b7e2128b227ebceb0ceff5bbdea7095d72a6bc59394de512e6809663d7fa0a75a55f966c27d9c9606c43334c0308789ac5a7c5e3150456e42cd29f878f6264d237ceac0096d0f76fb52f3d05f482550e33e9260d1a6bab35bd717b94a8a933c347958068dac22f4e97eed21e7bb7ba23a89fac78fd6f88fd382f09321d5c5181ece27d794a2728c248dd97601c4b81ae729dc6ae716e97c7a1ebd01b1893970a2875c1536ef21a2d68107c951d8a176a77ba1b803aa7c234f02447a2d902f554c316fec2b9448c8d7d3026afefb417318b757fe7cc5612726490ae9f89bc5f2e6215db868e72fde303490d7dbc4d44d0c837bad49b4d4a2aab5ca89aac065d8af038aa8fdffe15c2af8c06532c694cb389901b4338cd6d455058afd05f27c7ca8b3d9031caf64dd5dbefbbaea45dd217cc62ff46d37102bf85b27f1ce6eb5251d47adac4d903a11d7774b987efba087876246a00e6866aae28bb040c14c76b639b5f23695c9806bf707172a9ac2256522569ed14fcf68a8218131fd1f2e481f9e429e1877bc7b03834f8dc5b358ecc7d9b795118b4892a56ae8a82137ef4d2f6269d7f447f86e76906f57611de142c077e4236d273b722d432842802595c9b92424fee12aa2d3cbb1d701db7c60aa3dd10d7b3931e85e0239f68f468b0fbfe9d6689663af9f0e71ed77818016dfe00b3c0f3eba769c835248cf7bf3c49d6a36f4b198277dc137dd182e4b751d5e63a401ed8999191b340de418328b92a2cee735d47db1ee23c9b52785f8b92b9ad7fffb517d1c1e08497f9e6a8a557d52a158b655d493060ec18a329f6a48e43b3b00e5ab05b6da7e0ac4b9101149a943640c05a89af8d7fa272779d1e77e2b31e24de0a58b85db742abec3f06d54aa3b698fbb1bcd615eec656f7c64b5f22da6b7e47a1a90cf68cd1abdd0ad37f6cbd9a60034c4879e7e8acf9e085ec8f7795d30206e04cab99b02abca4da82891fbb11d8739cfeaa1094a305bac305a2a4ba137f4332eec8eb82332b74ea26a23a14178b8fbf8d51feba4747280137c910b331a9703a2c38d8a890b8890aa89431940508282882475a9a84f59d34098cddc660401a296799bd1f9f486df6c9869054cb3afe571c9b52d51d40be0e6732186e425d79e8dc2ea874f4aeffe326fe154f18dce114909d5f34dd679b42f32662a419faddc21f32e57eaa17c3ffd1905095a13da146053f3a6cbca25bd897544103e0e9c95075cce85aece7c3cf4deed70a7be9af1b9a898253051786dcfbb579a875ce655eb102aa86f086dba94668460e2cbc52c17b6ee5fa2eee2352c45b6e27c612d727b6495f6e525a219c8af9a43e01379e6503b60732b6e92c154c2b35411164fddd8a13a7061f251ecde2d795893b0c646c137643b3336b5f6dc782d8c9e095270810a60687e59df6b3834a48058628d00dba71b75e90fabf7e81b97246c10c876b5e54ba11bc5928215d0be63a61f3836a187a44ea5b5a65de13814d9af7a94ad60ab0bad8b540df2703d0e2136cdfc3024f1728995c138678fc276b134fcc9dd5003707286902f492022f6f38488946f744970ff8fc7c99a8b6236636d0e15c79e096d1edad9ae4df00517f6df25446102b94af24f63f5f225ae0a884897a9ec7ec5c6a07ebfefd2f82528ba4bd0134c2a7e263979f94afd14ed4abf9bf3a17031de815c6a77a8024675eefa567876d60d744c801e1caf840136cacc263e041f61e606d49dea22933eb97ceecd90d16bab49f026e5c16ec692c05b1000782ad0d790a03145f107633ec343f722ae4e27082f88eb281c623e343fbe01b078c081cb85421e11b34d44107a074841e34a986166fe95e17761c2ec402c5f9b9a526713204fc7715d0458c814e9565268768d727086a0120de4217f0148313bddc1af03b28bfb952e51d2e0d2dbc701b78f4201d5ad18c1d0737fd1fe0f5d07962b3ae9101b6af416a72622f47773171ce387815336cee2e6ba94b1119bfc1cb6b3d233fd408a3d3f62285216f2fc1616b8f2e644c90486f8641f055e4f7a59e9bc354f58c600dae629381629f6a4d3660811c435754d26903521778a862d08f31d8e22dbf9eb5e9a499462fea7628ac13fbdb80a1b47361657f24e9643f44bb3e6bc7bd5e26f3f438bf32d27314ddbc5a44297c5f04310382623b8e5b5b0685010c98bae266e10da362addce73ae253a5f20cd2c086d7ca484a216d3de285e91c123399be7508833543ff05598c01061d123ae775b72fe3753e0c0e591876fa4e90797e2d90509f1691c66138190a3b8dead461f28750b311639ee87f737d7da2e35374d86c8ee646289509051a57c4fdcccb28d5ec1209a64886e47ce16fdbbca54328d00b222f0d92ad1bf32d2ca18e6e8c3b676d65b75a6f1ead8d827e8dff4090666c74f94b63194320c51d3f2ee59208eb05855c89470b4aa4c8d63a2e93da62b31445016d4de25369f8165424d6410377dce495f449c7f326d76fffa34adae837eaa89f715f9401777408fd45f00113a920f6c587a4090e077e6cd318d35e61129225abab83a6ca997e01c38ef261e3dd83e447ab06e3761989aa9ec2949c106c400a657af47b35b83b29bb92ffd6c6d39c2cd21e709f7005b6599384b42b8b44ea8a164059a82b414ecc425adcbe12710ce01116c2f9d4c14254209644aaa32983d3a28587536a3e5d0491b12729fac25e3683040275ed98cfffd4fdea6effcf244d02e34f32c9d479e107f64393cc4c93d12b00712483c19f07ea09bb7fa9b5fb20bf4ad4887c4c69fd9ef7811f5dea38f8920083613824169697a2e193230aa2b4c6c6fbaa3a911bfa4709670bf0952003736d1798f36c29bae1c061fa80d88080b78b16cfe8635698d16a33793f34c7321826b24feae56e19a7990944f7a0092da4281b256bad71cba3349af0a2b966648eaffd9b1f72fc4e90f466d58ea37c38cdec454c126190b156b2be701cb121b36bcaf919649af880e5fafec69325f98f200adea371e3199416eec8dea7ea491c8e98a29436869c555143667579f4d8eeedb47870d5bcfb24a8c688507d64b05a9eeacfa8c0a720e2edadc35ac3b83767bab948027a4624d006f10f24567486543077215b4123ecf0dc5686bd12fadce37142923786bcdaa94378f390e09c3c4bd3d0ad7371fcbfe67b41dbd5943556c6ded829186a3e3e6d5a946eadbbf9"}}}}}}}, 0x0) 1.265324899s ago: executing program 2 (id=3003): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000940)=ANY=[@ANYBLOB="b4050000200080066110000000000000c6000000000000009500d800000000009f33ef60916e55893f1eeb0b2ae13d922e6235592ce847e2566c43d72918a897323fd0723043c47c896ce0bce66a245ad9d6817fd98cd824498949714ffaac8a6f77ef0000ca5d82054d54d53cd2b6db714e75d9bdae214fa68a0557eb2c5ca683a4b6fcfcff0bffffffffffd47042eaebfa6fa26fa7a347c7faa8e700458c60897d4a6148a1c11428427c40de60beacf871ab5c2ff88a02084e5b5271e45f00003826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174ebd9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632f7a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffabe90ac5d08dd9d4e0359c41cf3626e1230bc1cd4c02c460ceb44276e9bd94d1c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd00000000000fbf940e6652d357474ed5f816f66ac3027460ae66317f83cdd7a7eb2a7003d1a6cf5478533584961c329fcf5a43e05c92bfef0dcd28000000003f2915a3039c9a78f63b8ec7e60a0000fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc5117c024185a062acb6b8eec31c21b3af8b9eedb4660ed2deb7acf2a33a376a5cb7d4266d5b0be14488d14b473502486ad8dd600000000000000000000c7766ea7c581782c0d90f42a85303835fc291c25d29e6bead5d7360f2e1929d7736ebc8558c4506407d3046022bdf25485bd5442169e9b4c1278343581b7a06f65e8ea6b042c4fd08381e5000000000000006398d6480000001a723b91030000006480304c66b217aea0156ce9eef911fe5b7370f79987303ecb3aabc53c60014a0101ab766754f596b41da9534d12b8306a1b36cf3b03f0d790879f523eabfbee83d8bd472ef69660cf6ec897106c51e54a17497f384c4956b41f3843e7c878b1e11316d8ddae1c6c3b85aaf7a9fcaf8f5d6186c42542d68ba72682c938d3c0a2e6e10eed71b1d31c9f300b41745329bf34495c63e43fb896e4903fb0fae54a8f0fe3b48a5b29d279070647e65097c8ecf32a15080000000000000001007ba4a70a084bd994ac5e00000000000000000000000000351a30cd97f83d72631d0fe92efa974a53f4dc1eb9a86df632a6d463688123f64d42a919bcfc44a90ffd680200000091f842a91c977f6075d07e39e669b0713af0498a99bf5261cb3269d499a5202d7a08b33ade7b38829b9bd39619688d5e9af22170ef83e5b92cbb32b655c45de1c154aad81bf64351668a3f76d5afa958aff76249e0ffdf8e45155536a1a44bfcbfbfd232af000052f9002a"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x12, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000580)=ANY=[@ANYRES32=r1, @ANYRES32=r0, @ANYBLOB="05"], 0x10) close(r0) close(r1) (fail_nth: 1) 1.082523716s ago: executing program 2 (id=3004): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x35, 0x5, 0x57e, 0x330, 0x0, 0x0, "0600ff0901a101150026ff007508951f852009018102852109018102852209018102851609019102851709019102851509019102c0"}}, 0x14d) write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x3, "20009c"}}, 0x9) 1.047889737s ago: executing program 4 (id=3005): mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_clone(0x40014500, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0a000000560000004200000002"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000280), 0xffff, r0}, 0x38) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000003c0), &(0x7f00000002c0), 0x1006, r0, 0x0, 0xd88d02a0}, 0x38) 429.457787ms ago: executing program 1 (id=3006): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="0b000000080000000100010009000000"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xa000000}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000740)={r4, r3, 0x25, 0x8, @val=@perf_event={0x5}}, 0x18) syz_emit_ethernet(0x4a, &(0x7f00000011c0)=ANY=[@ANYBLOB="aaaaaaaaaaaae130aeaaba3086dd6f870600001406ff00000000000000000000000000000001fe8000000000000000000000000000bb4e224e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="51045c3044e80004"], 0x0) 0s ago: executing program 1 (id=3007): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg$NL80211_CMD_NEW_MPATH(r0, &(0x7f0000000940)={&(0x7f0000000480), 0xc, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x20004080}, 0x40048c4) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, 0x0, 0x0) socket(0x1f, 0x80000, 0x6) openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x11000) r2 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r2}, &(0x7f0000000000)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r3, 0x1, &(0x7f0000000040), 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000540)=ANY=[@ANYBLOB="0001000000000000c40000042798d946da2e1ff742855dfa9a4bfd4e6573aa940e34062b3f38ad01e52f4fd22ee401bba96f32ffc39c6aff8f3eba13c9710cced420a3ffa20a51dae7e25b76c44468781500fc2187c2e9973873918856ea91c297f972c5ae65ae2824dae7db9768d525eead386e548550b8ff90fd369c3cf2a2e25228bd06bd52219f207457578e6ad795c8efaf95649dccdb6c13135ab33ab7592f29586860f1a5222a608f67846d796243d4bda20eceab0ecf96a98ffc7026ea2dee1ab507ee4335ddc5b29154fc1f0487a3538c64f7b0926a53dc2c79b861e2bfcf4e75117314a2577eb2c2402314a2eba6e8a0c72576158d23c1f53d02839adec3733d8228c2e2bfff7488dcc18262feb977334a93d52292b848672056eea3683fdb17acdf6e25a5e1c40b4597fc76de71fcaf91b9c19ca6cd197243b0c44245e8ed18fb5aed6c4df4829819260496692119a65ef6060cab4a837721027caafafbacc362cdccb9c9bdeeaf8317ef"], 0xd) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) kernel console output (not intermixed with test programs): 607.933644][T15016] __kmalloc_cache_noprof+0x91/0x6d0 [ 607.933657][T15016] ? apply_wqattrs_prepare+0x136/0xbb0 [ 607.933672][T15016] apply_wqattrs_prepare+0x136/0xbb0 [ 607.933684][T15016] ? __alloc_workqueue+0x8ca/0x1950 [ 607.933702][T15016] apply_workqueue_attrs_locked+0x64/0xe0 [ 607.933716][T15016] __alloc_workqueue+0x9a7/0x1950 [ 607.933735][T15016] alloc_workqueue_noprof+0xc7/0x130 [ 607.933750][T15016] ? __pfx_alloc_workqueue_noprof+0x10/0x10 [ 607.933774][T15016] ieee802154_register_hw+0x1cf/0xa60 [ 607.933789][T15016] ? __pfx_ieee802154_register_hw+0x10/0x10 [ 607.933803][T15016] ? offline_pages+0x490/0x1b00 [ 607.933819][T15016] ? lockdep_init_map_type+0x5c/0x250 [ 607.933835][T15016] hwsim_add_one+0x6c7/0x13b0 [ 607.933853][T15016] ? __pfx_hwsim_add_one+0x10/0x10 [ 607.933868][T15016] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 607.933887][T15016] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 607.933909][T15016] genl_family_rcv_msg_doit+0x214/0x300 [ 607.933927][T15016] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 607.933949][T15016] ? bpf_lsm_capable+0x9/0x10 [ 607.933959][T15016] ? security_capable+0x80/0x260 [ 607.933973][T15016] ? ns_capable+0xd2/0xf0 [ 607.933987][T15016] genl_rcv_msg+0x560/0x800 [ 607.934005][T15016] ? __pfx_genl_rcv_msg+0x10/0x10 [ 607.934021][T15016] ? __lock_acquire+0x5c0/0x1f40 [ 607.934034][T15016] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 607.934050][T15016] ? __lock_acquire+0x5c0/0x1f40 [ 607.934066][T15016] netlink_rcv_skb+0x159/0x420 [ 607.934080][T15016] ? __pfx_genl_rcv_msg+0x10/0x10 [ 607.934097][T15016] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 607.934128][T15016] ? netlink_deliver_tap+0x1ae/0xcc0 [ 607.934149][T15016] genl_rcv+0x28/0x40 [ 607.934164][T15016] netlink_unicast+0x585/0x850 [ 607.934181][T15016] ? __pfx_netlink_unicast+0x10/0x10 [ 607.934200][T15016] netlink_sendmsg+0x8b0/0xda0 [ 607.934218][T15016] ? __pfx_netlink_sendmsg+0x10/0x10 [ 607.934235][T15016] ? selinux_socket_sendmsg+0x198/0x2f0 [ 607.934253][T15016] ____sys_sendmsg+0xa4d/0xbe0 [ 607.934265][T15016] ? __pfx_netlink_sendmsg+0x10/0x10 [ 607.934282][T15016] ? __pfx_____sys_sendmsg+0x10/0x10 [ 607.934302][T15016] ___sys_sendmsg+0x190/0x1e0 [ 607.934316][T15016] ? __pfx____sys_sendmsg+0x10/0x10 [ 607.934329][T15016] ? futex_wait+0x11e/0x370 [ 607.934346][T15016] ? find_held_lock+0x2b/0x80 [ 607.934372][T15016] __sys_sendmsg+0x160/0x210 [ 607.934388][T15016] ? __pfx___sys_sendmsg+0x10/0x10 [ 607.934412][T15016] do_syscall_64+0x123/0x790 [ 607.934425][T15016] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 607.934437][T15016] RIP: 0033:0x7f19fe19e159 [ 607.934447][T15016] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 607.934458][T15016] RSP: 002b:00007f19ff05d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 607.934469][T15016] RAX: ffffffffffffffda RBX: 00007f19fe425fa0 RCX: 00007f19fe19e159 [ 607.934477][T15016] RDX: 0000000020000000 RSI: 00002000000001c0 RDI: 0000000000000004 [ 607.934484][T15016] RBP: 00007f19fe23506b R08: 0000000000000000 R09: 0000000000000000 [ 607.934490][T15016] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 607.934497][T15016] R13: 00007f19fe426038 R14: 00007f19fe425fa0 R15: 00007ffceff49d28 [ 607.934512][T15016] [ 608.393042][T15014] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2732'. [ 608.543266][T15020] 9p: Bad value for 'rfdno' [ 608.757548][ T2279] SELinux: failure in sel_netif_sid_slow(), invalid network interface (103) [ 608.805182][T15031] FAULT_INJECTION: forcing a failure. [ 608.805182][T15031] name failslab, interval 1, probability 0, space 0, times 0 [ 608.805205][T15031] CPU: 0 UID: 0 PID: 15031 Comm: syz.4.2740 Tainted: G L syzkaller #0 PREEMPT(full) [ 608.805221][T15031] Tainted: [L]=SOFTLOCKUP [ 608.805225][T15031] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 608.805232][T15031] Call Trace: [ 608.805236][T15031] [ 608.805241][T15031] dump_stack_lvl+0x100/0x190 [ 608.805261][T15031] should_fail_ex.cold+0x5/0xa [ 608.805279][T15031] should_failslab+0xc2/0x120 [ 608.805298][T15031] kmem_cache_alloc_noprof+0x92/0x6a0 [ 608.805312][T15031] ? mas_prev+0xa4/0x100 [ 608.805327][T15031] ? vm_area_alloc+0x1f/0x160 [ 608.805347][T15031] vm_area_alloc+0x1f/0x160 [ 608.805363][T15031] __mmap_region+0x1025/0x32e0 [ 608.805378][T15031] ? __pfx___mmap_region+0x10/0x10 [ 608.805398][T15031] ? __lock_acquire+0x5c0/0x1f40 [ 608.805413][T15031] ? do_raw_spin_unlock+0x145/0x1e0 [ 608.805429][T15031] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 608.805448][T15031] ? rcu_is_watching+0x13/0xc0 [ 608.805477][T15031] ? rcu_is_watching+0x13/0xc0 [ 608.805493][T15031] ? trace_sched_exit_tp+0x120/0x160 [ 608.805525][T15031] ? avc_has_perm_noaudit+0x145/0x470 [ 608.805547][T15031] mmap_region+0x3db/0x6d0 [ 608.805559][T15031] ? rcu_is_watching+0x13/0xc0 [ 608.805575][T15031] ? __pfx_mmap_region+0x10/0x10 [ 608.805588][T15031] ? selinux_mmap_addr+0xe2/0x110 [ 608.805601][T15031] ? bpf_lsm_mmap_addr+0x9/0x30 [ 608.805616][T15031] ? security_mmap_addr+0x71/0x1e0 [ 608.805632][T15031] ? __get_unmapped_area+0x255/0x3e0 [ 608.805648][T15031] do_mmap+0x12c7/0x1c30 [ 608.805666][T15031] ? lock_acquire+0x1d1/0x380 [ 608.805679][T15031] ? __pfx_do_mmap+0x10/0x10 [ 608.805699][T15031] ? __pfx_down_write_killable+0x10/0x10 [ 608.805712][T15031] ? find_held_lock+0x2b/0x80 [ 608.805734][T15031] vm_mmap_pgoff+0x28d/0x470 [ 608.805750][T15031] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 608.805766][T15031] ? __pfx_do_futex+0x10/0x10 [ 608.805784][T15031] ksys_mmap_pgoff+0xe4/0x610 [ 608.805799][T15031] ? __x64_sys_futex+0x358/0x4d0 [ 608.805815][T15031] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 608.805831][T15031] ? xfd_validate_state+0x129/0x190 [ 608.805847][T15031] __x64_sys_mmap+0x125/0x190 [ 608.805862][T15031] do_syscall_64+0x123/0x790 [ 608.805875][T15031] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 608.805887][T15031] RIP: 0033:0x7f003719e159 [ 608.805896][T15031] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 608.805907][T15031] RSP: 002b:00007f00353f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 608.805919][T15031] RAX: ffffffffffffffda RBX: 00007f0037425fa0 RCX: 00007f003719e159 [ 608.805926][T15031] RDX: 0000000000000000 RSI: 0000000000c00000 RDI: 0000000000000000 [ 608.805933][T15031] RBP: 00007f003723506b R08: ffffffffffffffff R09: 0000000000000000 [ 608.805940][T15031] R10: 000000000401d031 R11: 0000000000000246 R12: 0000000000000000 [ 608.805946][T15031] R13: 00007f0037426038 R14: 00007f0037425fa0 R15: 00007ffe8ad7bce8 [ 608.805961][T15031] [ 609.028135][ T2279] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 609.034430][ T5712] usb 3-1: new full-speed USB device number 56 using dummy_hcd [ 609.159784][T15031] netlink: 'syz.4.2740': attribute type 1 has an invalid length. [ 609.159799][T15031] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2740'. [ 609.196892][ T2279] usb 4-1: Using ep0 maxpacket: 32 [ 609.197819][ T5712] usb 3-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 609.198168][ T2279] usb 4-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 609.198578][ T5712] usb 3-1: config 0 has an invalid interface number: 251 but max is 0 [ 609.198591][ T5712] usb 3-1: config 0 has no interface number 0 [ 609.199066][ T2279] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 609.199079][ T2279] usb 4-1: config 0 has no interface number 0 [ 609.200396][ T5712] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 609.200408][ T5712] usb 3-1: Product: syz [ 609.200417][ T5712] usb 3-1: Manufacturer: syz [ 609.200426][ T5712] usb 3-1: SerialNumber: syz [ 609.201961][ T2279] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 609.201976][ T2279] usb 4-1: Product: syz [ 609.201984][ T2279] usb 4-1: Manufacturer: syz [ 609.201993][ T2279] usb 4-1: SerialNumber: syz [ 609.219550][ T5712] usb 3-1: config 0 descriptor?? [ 609.219847][ T2279] usb 4-1: config 0 descriptor?? [ 609.331079][ T2279] usb 4-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 609.331096][ T2279] usb 4-1: selecting invalid altsetting 1 [ 609.331105][ T2279] usb 4-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 609.363581][ T2279] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 609.363803][ T2279] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 609.363824][ T2279] usb 4-1: media controller created [ 609.406028][ T2279] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 609.535409][ T2279] usb 4-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 609.535439][ T2279] zl10353_read_register: readreg error (reg=127, ret==-71) [ 609.537146][ T2279] usb 4-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 609.614506][ T2279] usb 4-1: USB disconnect, device number 54 [ 609.706870][T15037] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 609.855151][ T5712] asix 3-1:0.251 (unnamed net_device) (uninitialized): Interface mode not supported by driver [ 609.855268][ T5712] asix 3-1:0.251: probe with driver asix failed with error -524 [ 610.060254][T15033] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[5597] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[15033] [ 610.060805][ T5712] usb 3-1: USB disconnect, device number 56 [ 610.824739][T15059] 9p: Bad value for 'rfdno' [ 610.894705][T15057] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3659427032 (29275416256 ns) > initial count (200000 ns). Using initial count to start timer. [ 610.952756][T15065] random: crng reseeded on system resumption [ 611.027245][T15068] FAULT_INJECTION: forcing a failure. [ 611.027245][T15068] name failslab, interval 1, probability 0, space 0, times 0 [ 611.027272][T15068] CPU: 0 UID: 0 PID: 15068 Comm: syz.0.2751 Tainted: G L syzkaller #0 PREEMPT(full) [ 611.027290][T15068] Tainted: [L]=SOFTLOCKUP [ 611.027295][T15068] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 611.027302][T15068] Call Trace: [ 611.027307][T15068] [ 611.027313][T15068] dump_stack_lvl+0x100/0x190 [ 611.027333][T15068] should_fail_ex.cold+0x5/0xa [ 611.027351][T15068] should_failslab+0xc2/0x120 [ 611.027369][T15068] kmem_cache_alloc_noprof+0x92/0x6a0 [ 611.027384][T15068] ? mas_prev+0xa4/0x100 [ 611.027398][T15068] ? vm_area_alloc+0x1f/0x160 [ 611.027419][T15068] vm_area_alloc+0x1f/0x160 [ 611.027439][T15068] __mmap_region+0x1025/0x32e0 [ 611.027454][T15068] ? __pfx___mmap_region+0x10/0x10 [ 611.027465][T15068] ? __lock_acquire+0x5c0/0x1f40 [ 611.027488][T15068] ? __lock_acquire+0x5c0/0x1f40 [ 611.027502][T15068] ? do_raw_spin_unlock+0x145/0x1e0 [ 611.027518][T15068] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 611.027547][T15068] ? __lock_acquire+0x5c0/0x1f40 [ 611.027567][T15068] ? hrtimer_start_range_ns_common+0x778/0x16f0 [ 611.027604][T15068] ? avc_has_perm_noaudit+0x145/0x470 [ 611.027626][T15068] mmap_region+0x3db/0x6d0 [ 611.027641][T15068] ? rcu_is_watching+0x13/0xc0 [ 611.027659][T15068] ? __pfx_mmap_region+0x10/0x10 [ 611.027673][T15068] ? selinux_mmap_addr+0xe2/0x110 [ 611.027685][T15068] ? bpf_lsm_mmap_addr+0x9/0x30 [ 611.027701][T15068] ? security_mmap_addr+0x71/0x1e0 [ 611.027716][T15068] ? __get_unmapped_area+0x255/0x3e0 [ 611.027733][T15068] do_mmap+0x12c7/0x1c30 [ 611.027751][T15068] ? lock_acquire+0x1d1/0x380 [ 611.027763][T15068] ? __pfx_do_mmap+0x10/0x10 [ 611.027783][T15068] ? __pfx_down_write_killable+0x10/0x10 [ 611.027799][T15068] vm_mmap_pgoff+0x28d/0x470 [ 611.027816][T15068] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 611.027832][T15068] ? __pfx_do_futex+0x10/0x10 [ 611.027851][T15068] ksys_mmap_pgoff+0xe4/0x610 [ 611.027866][T15068] ? __x64_sys_futex+0x358/0x4d0 [ 611.027887][T15068] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 611.027902][T15068] ? xfd_validate_state+0x129/0x190 [ 611.027917][T15068] __x64_sys_mmap+0x125/0x190 [ 611.027932][T15068] do_syscall_64+0x123/0x790 [ 611.027945][T15068] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 611.027959][T15068] RIP: 0033:0x7fbf91d9e159 [ 611.027969][T15068] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 611.027979][T15068] RSP: 002b:00007fbf92d02028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 611.027991][T15068] RAX: ffffffffffffffda RBX: 00007fbf92025fa0 RCX: 00007fbf91d9e159 [ 611.027999][T15068] RDX: 0000000000000000 RSI: 0000000000c00000 RDI: 0000000000000000 [ 611.028006][T15068] RBP: 00007fbf91e3506b R08: ffffffffffffffff R09: 0000000000000000 [ 611.028012][T15068] R10: 000000000401d031 R11: 0000000000000246 R12: 0000000000000000 [ 611.028019][T15068] R13: 00007fbf92026038 R14: 00007fbf92025fa0 R15: 00007ffc0155e328 [ 611.028040][T15068] [ 611.384632][T15068] netlink: 'syz.0.2751': attribute type 1 has an invalid length. [ 611.384648][T15068] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2751'. [ 612.725965][T15093] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 613.483679][T15113] ip_tables: iptables: counters copy to user failed while replacing table [ 613.540998][T15116] netlink: 'syz.3.2767': attribute type 1 has an invalid length. [ 613.541012][T15116] netlink: 224 bytes leftover after parsing attributes in process `syz.3.2767'. [ 613.684584][T15124] netlink: 'syz.4.2768': attribute type 1 has an invalid length. [ 613.684600][T15124] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2768'. [ 613.890388][T10344] hid_parser_main: 24 callbacks suppressed [ 613.890404][T10344] hid-generic 0006:0008:0008.0014: unknown main item tag 0x0 [ 613.890590][T10344] hid-generic 0006:0008:0008.0014: unknown main item tag 0x0 [ 613.890604][T10344] hid-generic 0006:0008:0008.0014: unknown main item tag 0x0 [ 613.890849][T10344] hid-generic 0006:0008:0008.0014: unknown main item tag 0x0 [ 613.890863][T10344] hid-generic 0006:0008:0008.0014: unknown main item tag 0x0 [ 613.891045][T10344] hid-generic 0006:0008:0008.0014: unknown main item tag 0x0 [ 613.891058][T10344] hid-generic 0006:0008:0008.0014: unknown main item tag 0x0 [ 613.891242][T10344] hid-generic 0006:0008:0008.0014: unknown main item tag 0x0 [ 613.891256][T10344] hid-generic 0006:0008:0008.0014: unknown main item tag 0x0 [ 613.891439][T10344] hid-generic 0006:0008:0008.0014: unknown main item tag 0x0 [ 614.094162][T10344] hid-generic 0006:0008:0008.0014: hidraw0: VIRTUAL HID v0.04 Device [syz1] on syz1 [ 614.225165][T15139] fido_id[15139]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 614.572810][ T5610] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 614.589186][ T5610] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 614.600212][ T5610] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 614.610431][ T5610] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 614.610708][ T5610] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 614.741433][ T5609] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 614.757543][ T5609] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 614.757692][ T5609] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 614.758083][ T5609] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 614.758323][ T5609] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 614.779677][ T31] kauditd_printk_skb: 9 callbacks suppressed [ 614.779688][ T31] audit: type=1400 audit(1790755309.506:2452): avc: denied { mounton } for pid=15149 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 615.214979][T15167] netlink: 'syz.0.2778': attribute type 1 has an invalid length. [ 615.214995][T15167] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2778'. [ 616.382283][ T2279] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 616.544814][ T2279] usb 3-1: New USB device found, idVendor=108c, idProduct=0159, bcdDevice= 0.01 [ 616.545594][ T2279] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 4096, setting to 1024 [ 616.545613][ T2279] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024 [ 616.547750][ T2279] usb 3-1: string descriptor 0 read error: -22 [ 616.547807][ T2279] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 616.553412][T15149] lo speed is unknown, defaulting to 1000 [ 616.554099][T15149] lo speed is unknown, defaulting to 1000 [ 616.605924][ T2279] etas_es58x 3-1:1.0: Starting (null) (null) (Serial Number (null)) [ 616.606006][ T2279] etas_es58x 3-1:1.0: could not retrieve the product info string [ 616.797467][ T5609] Bluetooth: hci5: command tx timeout [ 616.824376][T15177] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(5) [ 616.824396][T15177] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 616.824439][T15177] vhci_hcd vhci_hcd.0: Device attached [ 617.087712][T15198] vhci_hcd: connection closed [ 617.087950][ T12] vhci_hcd vhci_hcd.2: stop threads [ 617.087981][ T12] vhci_hcd vhci_hcd.2: release socket [ 617.087991][ T12] vhci_hcd vhci_hcd.2: disconnect device [ 617.089364][ T2279] usb 3-1: USB disconnect, device number 57 [ 617.090359][ T2279] etas_es58x 3-1:1.0: Disconnecting (null) (null) [ 617.237830][T15203] netlink: 'syz.0.2788': attribute type 1 has an invalid length. [ 617.237846][T15203] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2788'. [ 617.377033][ T5712] hid-generic 0006:0008:0008.0015: hidraw0: VIRTUAL HID v0.04 Device [syz1] on syz1 [ 617.508896][T15211] fido_id[15211]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 617.744815][ T2279] wiimote 0005:057E:0330.0016: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 617.744988][ T2279] wiimote 0005:057E:0330.0016: New device registered [ 618.002606][T15236] FAULT_INJECTION: forcing a failure. [ 618.002606][T15236] name failslab, interval 1, probability 0, space 0, times 0 [ 618.002631][T15236] CPU: 0 UID: 0 PID: 15236 Comm: syz.1.2794 Tainted: G L syzkaller #0 PREEMPT(full) [ 618.002649][T15236] Tainted: [L]=SOFTLOCKUP [ 618.002653][T15236] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 618.002661][T15236] Call Trace: [ 618.002666][T15236] [ 618.002671][T15236] dump_stack_lvl+0x100/0x190 [ 618.002694][T15236] should_fail_ex.cold+0x5/0xa [ 618.002710][T15236] should_failslab+0xc2/0x120 [ 618.002727][T15236] kmem_cache_alloc_noprof+0x92/0x6a0 [ 618.002740][T15236] ? mas_prev+0xa4/0x100 [ 618.002754][T15236] ? vm_area_alloc+0x1f/0x160 [ 618.002774][T15236] vm_area_alloc+0x1f/0x160 [ 618.002790][T15236] __mmap_region+0x1025/0x32e0 [ 618.002802][T15236] ? find_held_lock+0x2b/0x80 [ 618.002820][T15236] ? ima_match_policy+0x8b8/0x23e0 [ 618.002838][T15236] ? __pfx___mmap_region+0x10/0x10 [ 618.002849][T15236] ? __lock_acquire+0x5c0/0x1f40 [ 618.002869][T15236] ? __lock_acquire+0x5c0/0x1f40 [ 618.002883][T15236] ? find_held_lock+0x2b/0x80 [ 618.002899][T15236] ? process_measurement+0x4c8/0x2350 [ 618.002912][T15236] ? process_measurement+0x4c8/0x2350 [ 618.002940][T15236] ? __lock_acquire+0x5c0/0x1f40 [ 618.002961][T15236] ? hrtimer_start_range_ns_common+0x778/0x16f0 [ 618.002999][T15236] ? avc_has_perm_noaudit+0x145/0x470 [ 618.003021][T15236] mmap_region+0x3db/0x6d0 [ 618.003035][T15236] ? rcu_is_watching+0x13/0xc0 [ 618.003053][T15236] ? __pfx_mmap_region+0x10/0x10 [ 618.003068][T15236] ? selinux_mmap_addr+0xe2/0x110 [ 618.003081][T15236] ? bpf_lsm_mmap_addr+0x9/0x30 [ 618.003097][T15236] ? security_mmap_addr+0x71/0x1e0 [ 618.003112][T15236] ? __get_unmapped_area+0x255/0x3e0 [ 618.003129][T15236] do_mmap+0x12c7/0x1c30 [ 618.003146][T15236] ? lock_acquire+0x1d1/0x380 [ 618.003159][T15236] ? __pfx_do_mmap+0x10/0x10 [ 618.003181][T15236] ? __pfx_down_write_killable+0x10/0x10 [ 618.003197][T15236] vm_mmap_pgoff+0x28d/0x470 [ 618.003213][T15236] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 618.003229][T15236] ? __pfx_do_futex+0x10/0x10 [ 618.003247][T15236] ksys_mmap_pgoff+0xe4/0x610 [ 618.003262][T15236] ? __x64_sys_futex+0x358/0x4d0 [ 618.003278][T15236] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 618.003294][T15236] ? xfd_validate_state+0x129/0x190 [ 618.003309][T15236] __x64_sys_mmap+0x125/0x190 [ 618.003324][T15236] do_syscall_64+0x123/0x790 [ 618.003337][T15236] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 618.003349][T15236] RIP: 0033:0x7f04e999e159 [ 618.003362][T15236] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 618.003372][T15236] RSP: 002b:00007f04ea8ca028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 618.003384][T15236] RAX: ffffffffffffffda RBX: 00007f04e9c25fa0 RCX: 00007f04e999e159 [ 618.003392][T15236] RDX: 0000000000000000 RSI: 0000000000c00000 RDI: 0000000000000000 [ 618.003398][T15236] RBP: 00007f04e9a3506b R08: ffffffffffffffff R09: 0000000000000000 [ 618.003405][T15236] R10: 000000000401d031 R11: 0000000000000246 R12: 0000000000000000 [ 618.003412][T15236] R13: 00007f04e9c26038 R14: 00007f04e9c25fa0 R15: 00007ffc7cf99708 [ 618.003427][T15236] [ 618.372340][T15236] netlink: 'syz.1.2794': attribute type 1 has an invalid length. [ 618.372356][T15236] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2794'. [ 618.402260][T15217] wiimote 0005:057E:0330.0016: Device removed [ 618.454134][ T31] audit: type=1400 audit(1790755313.166:2453): avc: denied { write } for pid=15208 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 618.619736][T15247] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2796'. [ 618.679575][ T31] audit: type=1400 audit(1790755313.396:2454): avc: denied { write } for pid=15248 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 618.795124][ T2279] wiimote 0005:057E:0330.0016: detected device: Nintendo Wii Remote Plus (Gen 2) [ 618.848684][T15149] bridge0: port 1(bridge_slave_0) entered blocking state [ 618.848728][T15149] bridge0: port 1(bridge_slave_0) entered disabled state [ 618.848787][T15149] bridge_slave_0: entered allmulticast mode [ 618.876552][ T5609] Bluetooth: hci5: command tx timeout [ 618.981256][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 618.981288][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 619.016260][T15149] bridge_slave_0: entered promiscuous mode [ 619.025136][T15149] bridge0: port 2(bridge_slave_1) entered blocking state [ 619.025181][T15149] bridge0: port 2(bridge_slave_1) entered disabled state [ 619.443476][T15149] bridge_slave_1: entered allmulticast mode [ 619.456909][T15149] bridge_slave_1: entered promiscuous mode [ 619.489395][ T2279] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0330.0016/input/input32 [ 619.563788][ T2279] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0330.0016/input/input33 [ 619.606131][ T2279] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0330.0016/input/input31 [ 619.796108][T15149] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 619.814109][T15149] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 619.841810][T15267] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 619.911422][T15149] team0: Port device team_slave_0 added [ 619.927834][T15149] team0: Port device team_slave_1 added [ 620.002301][T15149] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 620.002313][T15149] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 620.002327][T15149] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 620.076092][T15149] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 620.076104][T15149] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 620.076119][T15149] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 620.220190][T15149] hsr_slave_0: entered promiscuous mode [ 620.222337][T15149] hsr_slave_1: entered promiscuous mode [ 620.223231][T15149] debugfs: 'hsr0' already exists in 'hsr' [ 620.223245][T15149] Cannot create hsr debugfs directory [ 620.316537][ T31] audit: type=1400 audit(1790755315.046:2455): avc: denied { write } for pid=15258 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 620.545377][ T31] audit: type=1400 audit(1790755315.266:2456): avc: denied { write } for pid=15290 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 620.954371][ T5609] Bluetooth: hci5: command tx timeout [ 620.960421][T15149] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 621.221170][T15149] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 621.349425][T15149] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 621.421195][T15149] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 621.826305][T15314] netlink: 128 bytes leftover after parsing attributes in process `syz.1.2809'. [ 622.232583][T15328] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3780442281 (7560884562 ns) > initial count (4669583980 ns). Using initial count to start timer. [ 622.301278][T15149] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 622.328441][T15149] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 622.329094][T15149] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 622.354951][T15149] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 622.356817][T15149] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 622.383583][T15149] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 622.391912][T15149] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 622.407049][T15149] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 622.524788][ T10] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 622.563214][T15149] 8021q: adding VLAN 0 to HW filter on device bond0 [ 622.597809][T15149] 8021q: adding VLAN 0 to HW filter on device team0 [ 622.612195][ T6545] bridge0: port 1(bridge_slave_0) entered blocking state [ 622.612244][ T6545] bridge0: port 1(bridge_slave_0) entered forwarding state [ 622.653870][ T6545] bridge0: port 2(bridge_slave_1) entered blocking state [ 622.653919][ T6545] bridge0: port 2(bridge_slave_1) entered forwarding state [ 622.729993][ T10] usb 1-1: unable to get BOS descriptor or descriptor too short [ 622.730022][ T10] usb 1-1: New USB device found, idVendor=8086, idProduct=0ad2, bcdDevice= 0.00 [ 622.730622][ T10] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 622.730641][ T10] usb 1-1: can't read configurations, error -71 [ 623.034812][ T5609] Bluetooth: hci5: command tx timeout [ 623.272425][T15353] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3780442281 (7560884562 ns) > initial count (4669583980 ns). Using initial count to start timer. [ 623.409634][T15149] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 623.545909][ T5697] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 623.726971][ T5697] usb 3-1: unable to get BOS descriptor or descriptor too short [ 623.726998][ T5697] usb 3-1: New USB device found, idVendor=8086, idProduct=0ad2, bcdDevice= 0.00 [ 623.728501][ T5697] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 623.728521][ T5697] usb 3-1: can't read configurations, error -71 [ 624.627175][T15149] veth0_vlan: entered promiscuous mode [ 624.652271][T15149] veth1_vlan: entered promiscuous mode [ 624.706507][T15149] veth0_macvtap: entered promiscuous mode [ 624.720929][T15149] veth1_macvtap: entered promiscuous mode [ 624.751325][T15149] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 624.776198][T15149] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 624.779166][T15380] ip_tables: iptables: counters copy to user failed while replacing table [ 624.827173][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 624.827199][ T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 624.827216][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 624.867885][ T6820] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 625.014089][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 625.014105][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 625.112013][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 625.112027][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 625.168717][ T31] audit: type=1400 audit(1790755319.886:2457): avc: denied { mounton } for pid=15149 comm="syz-executor" path="/root/syzkaller.zOxEEH/syz-tmp" dev="sda1" ino=2052 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 625.207132][ T31] audit: type=1400 audit(1790755319.926:2458): avc: denied { mounton } for pid=15149 comm="syz-executor" path="/root/syzkaller.zOxEEH/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=55938 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 625.246680][ T31] audit: type=1400 audit(1790755319.966:2459): avc: denied { mounton } for pid=15149 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2780 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 625.246715][ T31] audit: type=1400 audit(1790755319.966:2460): avc: denied { mount } for pid=15149 comm="syz-executor" name="/" dev="gadgetfs" ino=8270 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 625.309107][ T31] audit: type=1400 audit(1790755320.026:2461): avc: denied { mounton } for pid=15149 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 626.454636][T15399] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3780442281 (7560884562 ns) > initial count (4669583980 ns). Using initial count to start timer. [ 626.825462][ T2279] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 627.620538][ T2279] usb 5-1: unable to get BOS descriptor or descriptor too short [ 627.620565][ T2279] usb 5-1: New USB device found, idVendor=8086, idProduct=0ad2, bcdDevice= 0.00 [ 627.623592][ T2279] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 627.623614][ T2279] usb 5-1: can't read configurations, error -71 [ 627.756862][T15409] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2829'. [ 628.805668][T15424] FAULT_INJECTION: forcing a failure. [ 628.805668][T15424] name failslab, interval 1, probability 0, space 0, times 0 [ 628.805700][T15424] CPU: 0 UID: 0 PID: 15424 Comm: syz.4.2833 Tainted: G L syzkaller #0 PREEMPT(full) [ 628.805720][T15424] Tainted: [L]=SOFTLOCKUP [ 628.805724][T15424] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 628.805732][T15424] Call Trace: [ 628.805737][T15424] [ 628.805743][T15424] dump_stack_lvl+0x100/0x190 [ 628.805762][T15424] should_fail_ex.cold+0x5/0xa [ 628.805781][T15424] should_failslab+0xc2/0x120 [ 628.805799][T15424] __kmalloc_noprof+0xfc/0x840 [ 628.805812][T15424] ? lsm_blob_alloc+0x68/0x90 [ 628.805833][T15424] lsm_blob_alloc+0x68/0x90 [ 628.805850][T15424] security_sb_alloc+0x25/0x240 [ 628.805863][T15424] sget_fc+0x3ce/0x1f70 [ 628.805877][T15424] ? cred_has_capability.isra.0+0x186/0x300 [ 628.805893][T15424] ? __pfx_cred_has_capability.isra.0+0x10/0x10 [ 628.805909][T15424] ? kasan_save_track+0x14/0x30 [ 628.805923][T15424] ? __pfx_set_anon_super_fc+0x10/0x10 [ 628.805935][T15424] ? __pfx_sget_fc+0x10/0x10 [ 628.805946][T15424] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 628.805959][T15424] ? rcu_is_watching+0x13/0xc0 [ 628.805975][T15424] ? cap_capable+0x107/0x430 [ 628.805988][T15424] ? __pfx_proc_fill_super+0x10/0x10 [ 628.806000][T15424] get_tree_nodev+0x28/0x190 [ 628.806014][T15424] vfs_get_tree+0x92/0x320 [ 628.806024][T15424] path_mount+0x7d0/0x24c0 [ 628.806037][T15424] ? __pfx_path_mount+0x10/0x10 [ 628.806047][T15424] ? lockdep_hardirqs_on+0x7d/0x110 [ 628.806060][T15424] ? putname+0xb1/0x110 [ 628.806075][T15424] ? kmem_cache_free+0x127/0x6c0 [ 628.806091][T15424] ? __x64_sys_mount+0x293/0x310 [ 628.806101][T15424] __x64_sys_mount+0x293/0x310 [ 628.806112][T15424] ? __pfx___x64_sys_mount+0x10/0x10 [ 628.806127][T15424] do_syscall_64+0x123/0x790 [ 628.806140][T15424] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 628.806151][T15424] RIP: 0033:0x7f8fc139e159 [ 628.806161][T15424] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 628.806173][T15424] RSP: 002b:00007f8fc22fb028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 628.806186][T15424] RAX: ffffffffffffffda RBX: 00007f8fc1625fa0 RCX: 00007f8fc139e159 [ 628.806193][T15424] RDX: 0000200000000100 RSI: 0000200000000080 RDI: 0000000000000000 [ 628.806200][T15424] RBP: 00007f8fc143506b R08: 0000000000000000 R09: 0000000000000000 [ 628.806207][T15424] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 628.806214][T15424] R13: 00007f8fc1626038 R14: 00007f8fc1625fa0 R15: 00007ffda8577e08 [ 628.806228][T15424] [ 629.458725][ T2279] hid_parser_main: 24 callbacks suppressed [ 629.458740][ T2279] hid-generic 0006:0008:0008.0017: unknown main item tag 0x0 [ 629.458760][ T2279] hid-generic 0006:0008:0008.0017: unknown main item tag 0x0 [ 629.458773][ T2279] hid-generic 0006:0008:0008.0017: unknown main item tag 0x0 [ 629.458785][ T2279] hid-generic 0006:0008:0008.0017: unknown main item tag 0x0 [ 629.458797][ T2279] hid-generic 0006:0008:0008.0017: unknown main item tag 0x0 [ 629.458809][ T2279] hid-generic 0006:0008:0008.0017: unknown main item tag 0x0 [ 629.458821][ T2279] hid-generic 0006:0008:0008.0017: unknown main item tag 0x0 [ 629.458832][ T2279] hid-generic 0006:0008:0008.0017: unknown main item tag 0x0 [ 629.458845][ T2279] hid-generic 0006:0008:0008.0017: unknown main item tag 0x0 [ 629.458857][ T2279] hid-generic 0006:0008:0008.0017: unknown main item tag 0x0 [ 629.569186][ T2279] hid-generic 0006:0008:0008.0017: hidraw0: VIRTUAL HID v0.04 Device [syz1] on syz1 [ 629.749443][T15444] fido_id[15444]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 630.246889][T15459] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3780442281 (7560884562 ns) > initial count (4669583980 ns). Using initial count to start timer. [ 630.535629][T10344] usb 2-1: new high-speed USB device number 63 using dummy_hcd [ 630.791434][T10344] usb 2-1: unable to get BOS descriptor or descriptor too short [ 630.791463][T10344] usb 2-1: New USB device found, idVendor=8086, idProduct=0ad2, bcdDevice= 0.00 [ 630.794019][T10344] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 630.794040][T10344] usb 2-1: can't read configurations, error -71 [ 631.348869][T15472] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3780442281 (7560884562 ns) > initial count (4669583980 ns). Using initial count to start timer. [ 631.506927][T15474] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3780442281 (7560884562 ns) > initial count (4669583980 ns). Using initial count to start timer. [ 631.624417][ T56] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 631.795308][ T56] usb 1-1: unable to get BOS descriptor or descriptor too short [ 631.795336][ T56] usb 1-1: New USB device found, idVendor=8086, idProduct=0ad2, bcdDevice= 0.00 [ 631.797813][ T56] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 631.797833][ T56] usb 1-1: can't read configurations, error -71 [ 631.882479][T15482] loop4: detected capacity change from 0 to 7 [ 631.882904][T15482] Dev loop4: unable to read RDB block 7 [ 631.882924][T15482] loop4: unable to read partition table [ 631.883002][T15482] loop4: partition table beyond EOD, truncated [ 631.883012][T15482] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 631.936460][T15485] ptp ptp0: guarantee physical clock free running [ 631.974486][T10344] usb 2-1: new full-speed USB device number 65 using dummy_hcd [ 632.129480][T10344] usb 2-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 632.131032][T10344] usb 2-1: config 0 has an invalid interface number: 251 but max is 0 [ 632.131049][T10344] usb 2-1: config 0 has no interface number 0 [ 632.153305][T10344] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 632.153322][T10344] usb 2-1: Product: syz [ 632.153330][T10344] usb 2-1: Manufacturer: syz [ 632.153339][T10344] usb 2-1: SerialNumber: syz [ 632.169376][T10344] usb 2-1: config 0 descriptor?? [ 633.421432][T10344] asix 2-1:0.251 (unnamed net_device) (uninitialized): Interface mode not supported by driver [ 633.421551][T10344] asix 2-1:0.251: probe with driver asix failed with error -524 [ 633.618998][T15479] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[5596] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[15479] [ 633.620254][ T56] usb 2-1: USB disconnect, device number 65 [ 633.976412][T10344] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 634.020869][T15502] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 634.024370][ T2279] usb 1-1: new full-speed USB device number 49 using dummy_hcd [ 634.124693][T10344] usb 4-1: Using ep0 maxpacket: 32 [ 634.126449][T10344] usb 4-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 634.128512][T10344] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 634.128527][T10344] usb 4-1: config 0 has no interface number 0 [ 634.132458][T10344] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 634.132473][T10344] usb 4-1: Product: syz [ 634.132482][T10344] usb 4-1: Manufacturer: syz [ 634.132490][T10344] usb 4-1: SerialNumber: syz [ 634.133865][T10344] usb 4-1: config 0 descriptor?? [ 634.150746][T10344] usb 4-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 634.150762][T10344] usb 4-1: selecting invalid altsetting 1 [ 634.150771][T10344] usb 4-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 634.226640][T10344] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 634.226770][T10344] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 634.226792][T10344] usb 4-1: media controller created [ 634.264401][ T2279] usb 1-1: New USB device found, idVendor=145f, idProduct=0212, bcdDevice= 0.00 [ 634.267999][ T2279] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 634.268015][ T2279] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 634.268026][ T2279] usb 1-1: config 0 has no interface number 0 [ 634.268044][ T2279] usb 1-1: config 0 interface 1 altsetting 128 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 634.268059][ T2279] usb 1-1: config 0 interface 1 has no altsetting 0 [ 634.272482][ T2279] usb 1-1: New USB device strings: Mfr=93, Product=0, SerialNumber=0 [ 634.272498][ T2279] usb 1-1: Manufacturer: syz [ 634.302991][ T2279] usb 1-1: config 0 descriptor?? [ 634.363627][ T2279] usbhid 1-1:0.1: couldn't find an input interrupt endpoint [ 634.374441][T10344] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 635.416323][T15508] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2859'. [ 635.516831][T10344] usb 4-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 635.516872][T10344] zl10353_read_register: readreg error (reg=127, ret==-110) [ 635.641021][T10344] usb 4-1: USB disconnect, device number 55 [ 635.714137][T15514] smb3: Unknown parameter 'rdma ' [ 635.931490][T15519] netlink: 'syz.2.2863': attribute type 1 has an invalid length. [ 635.931506][T15519] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2863'. [ 635.931605][T15519] FAULT_INJECTION: forcing a failure. [ 635.931605][T15519] name failslab, interval 1, probability 0, space 0, times 0 [ 635.931623][T15519] CPU: 0 UID: 0 PID: 15519 Comm: syz.2.2863 Tainted: G L syzkaller #0 PREEMPT(full) [ 635.931640][T15519] Tainted: [L]=SOFTLOCKUP [ 635.931645][T15519] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 635.931652][T15519] Call Trace: [ 635.931657][T15519] [ 635.931663][T15519] dump_stack_lvl+0x100/0x190 [ 635.931685][T15519] should_fail_ex.cold+0x5/0xa [ 635.931705][T15519] should_failslab+0xc2/0x120 [ 635.931723][T15519] __kmalloc_cache_noprof+0x91/0x6d0 [ 635.931737][T15519] ? apply_wqattrs_prepare+0x136/0xbb0 [ 635.931753][T15519] apply_wqattrs_prepare+0x136/0xbb0 [ 635.931765][T15519] ? __alloc_workqueue+0x8ca/0x1950 [ 635.931784][T15519] apply_workqueue_attrs_locked+0x64/0xe0 [ 635.931797][T15519] __alloc_workqueue+0x9a7/0x1950 [ 635.931816][T15519] alloc_workqueue_noprof+0xc7/0x130 [ 635.931831][T15519] ? __pfx_alloc_workqueue_noprof+0x10/0x10 [ 635.931854][T15519] ieee802154_register_hw+0x10b/0xa60 [ 635.931869][T15519] ? __pfx_ieee802154_register_hw+0x10/0x10 [ 635.931884][T15519] ? offline_pages+0x490/0x1b00 [ 635.931898][T15519] ? lockdep_init_map_type+0x5c/0x250 [ 635.931914][T15519] hwsim_add_one+0x6c7/0x13b0 [ 635.931932][T15519] ? __pfx_hwsim_add_one+0x10/0x10 [ 635.931948][T15519] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 635.931966][T15519] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 635.931986][T15519] genl_family_rcv_msg_doit+0x214/0x300 [ 635.932004][T15519] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 635.932027][T15519] ? bpf_lsm_capable+0x9/0x10 [ 635.932038][T15519] ? security_capable+0x80/0x260 [ 635.932050][T15519] ? ns_capable+0xd2/0xf0 [ 635.932063][T15519] genl_rcv_msg+0x560/0x800 [ 635.932081][T15519] ? __pfx_genl_rcv_msg+0x10/0x10 [ 635.932096][T15519] ? __lock_acquire+0x5c0/0x1f40 [ 635.932109][T15519] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 635.932125][T15519] ? __lock_acquire+0x5c0/0x1f40 [ 635.932140][T15519] netlink_rcv_skb+0x159/0x420 [ 635.932155][T15519] ? __pfx_genl_rcv_msg+0x10/0x10 [ 635.932172][T15519] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 635.932192][T15519] ? netlink_deliver_tap+0x1ae/0xcc0 [ 635.932210][T15519] genl_rcv+0x28/0x40 [ 635.932225][T15519] netlink_unicast+0x585/0x850 [ 635.932242][T15519] ? __pfx_netlink_unicast+0x10/0x10 [ 635.932261][T15519] netlink_sendmsg+0x8b0/0xda0 [ 635.932278][T15519] ? __pfx_netlink_sendmsg+0x10/0x10 [ 635.932294][T15519] ? selinux_socket_sendmsg+0x198/0x2f0 [ 635.932309][T15519] ____sys_sendmsg+0xa4d/0xbe0 [ 635.932320][T15519] ? __pfx_netlink_sendmsg+0x10/0x10 [ 635.932336][T15519] ? __pfx_____sys_sendmsg+0x10/0x10 [ 635.932354][T15519] ___sys_sendmsg+0x190/0x1e0 [ 635.932367][T15519] ? __pfx____sys_sendmsg+0x10/0x10 [ 635.932380][T15519] ? futex_wait+0x11e/0x370 [ 635.932397][T15519] ? find_held_lock+0x2b/0x80 [ 635.932423][T15519] __sys_sendmsg+0x160/0x210 [ 635.932439][T15519] ? __pfx___sys_sendmsg+0x10/0x10 [ 635.932462][T15519] do_syscall_64+0x123/0x790 [ 635.932476][T15519] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 635.932488][T15519] RIP: 0033:0x7f19fe19e159 [ 635.932498][T15519] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 635.932509][T15519] RSP: 002b:00007f19ff05d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 635.932521][T15519] RAX: ffffffffffffffda RBX: 00007f19fe425fa0 RCX: 00007f19fe19e159 [ 635.932529][T15519] RDX: 0000000020000000 RSI: 00002000000001c0 RDI: 0000000000000004 [ 635.932536][T15519] RBP: 00007f19fe23506b R08: 0000000000000000 R09: 0000000000000000 [ 635.932543][T15519] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 635.932549][T15519] R13: 00007f19fe426038 R14: 00007f19fe425fa0 R15: 00007ffceff49d28 [ 635.932564][T15519] [ 636.456064][T15522] loop4: detected capacity change from 0 to 7 [ 636.456885][T15522] Dev loop4: unable to read RDB block 7 [ 636.456904][T15522] loop4: unable to read partition table [ 636.456990][T15522] loop4: partition table beyond EOD, truncated [ 636.457000][T15522] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 636.631342][T15527] ptp ptp0: guarantee physical clock free running [ 637.662682][T15537] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3780442281 (7560884562 ns) > initial count (4669583980 ns). Using initial count to start timer. [ 637.685389][ T2279] usb 2-1: new high-speed USB device number 66 using dummy_hcd [ 637.730682][T10344] usb 1-1: USB disconnect, device number 49 [ 637.962424][ T56] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 638.802656][T15542] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2871'. [ 638.837077][ T56] usb 3-1: unable to get BOS descriptor or descriptor too short [ 638.837103][ T56] usb 3-1: New USB device found, idVendor=8086, idProduct=0ad2, bcdDevice= 0.00 [ 638.837746][ T56] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 638.837764][ T56] usb 3-1: can't read configurations, error -71 [ 638.863247][ T2279] usb 2-1: unable to get BOS descriptor or descriptor too short [ 638.863273][ T2279] usb 2-1: New USB device found, idVendor=8086, idProduct=0ad2, bcdDevice= 0.00 [ 638.872141][ T2279] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 638.872159][ T2279] usb 2-1: can't read configurations, error -71 [ 639.439357][T15560] netlink: 288 bytes leftover after parsing attributes in process `syz.3.2872'. [ 639.614048][T15567] loop4: detected capacity change from 0 to 7 [ 639.614692][T15567] Dev loop4: unable to read RDB block 7 [ 639.614712][T15567] loop4: unable to read partition table [ 639.614794][T15567] loop4: partition table beyond EOD, truncated [ 639.614803][T15567] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 639.696823][T15569] ptp ptp0: guarantee physical clock free running [ 640.545675][T15581] FAULT_INJECTION: forcing a failure. [ 640.545675][T15581] name failslab, interval 1, probability 0, space 0, times 0 [ 640.545698][T15581] CPU: 0 UID: 0 PID: 15581 Comm: syz.1.2883 Tainted: G L syzkaller #0 PREEMPT(full) [ 640.545715][T15581] Tainted: [L]=SOFTLOCKUP [ 640.545720][T15581] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 640.545727][T15581] Call Trace: [ 640.545734][T15581] [ 640.545740][T15581] dump_stack_lvl+0x100/0x190 [ 640.545760][T15581] should_fail_ex.cold+0x5/0xa [ 640.545777][T15581] should_failslab+0xc2/0x120 [ 640.545794][T15581] __kmalloc_noprof+0xfc/0x840 [ 640.545809][T15581] ? lsm_blob_alloc+0x68/0x90 [ 640.545829][T15581] lsm_blob_alloc+0x68/0x90 [ 640.545846][T15581] security_sb_alloc+0x25/0x240 [ 640.545859][T15581] sget_fc+0x3ce/0x1f70 [ 640.545873][T15581] ? cred_has_capability.isra.0+0x186/0x300 [ 640.545888][T15581] ? __pfx_cred_has_capability.isra.0+0x10/0x10 [ 640.545902][T15581] ? kasan_save_track+0x14/0x30 [ 640.545916][T15581] ? __pfx_set_anon_super_fc+0x10/0x10 [ 640.545928][T15581] ? __pfx_sget_fc+0x10/0x10 [ 640.545940][T15581] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 640.545954][T15581] ? rcu_is_watching+0x13/0xc0 [ 640.545970][T15581] ? cap_capable+0x107/0x430 [ 640.545983][T15581] ? __pfx_proc_fill_super+0x10/0x10 [ 640.545995][T15581] get_tree_nodev+0x28/0x190 [ 640.546009][T15581] vfs_get_tree+0x92/0x320 [ 640.546019][T15581] path_mount+0x7d0/0x24c0 [ 640.546032][T15581] ? __pfx_path_mount+0x10/0x10 [ 640.546042][T15581] ? lockdep_hardirqs_on+0x7d/0x110 [ 640.546055][T15581] ? putname+0xb1/0x110 [ 640.546070][T15581] ? kmem_cache_free+0x127/0x6c0 [ 640.546086][T15581] ? __x64_sys_mount+0x293/0x310 [ 640.546096][T15581] __x64_sys_mount+0x293/0x310 [ 640.546107][T15581] ? __pfx___x64_sys_mount+0x10/0x10 [ 640.546122][T15581] do_syscall_64+0x123/0x790 [ 640.546134][T15581] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 640.546147][T15581] RIP: 0033:0x7f04e999e159 [ 640.546156][T15581] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 640.546167][T15581] RSP: 002b:00007f04ea8ca028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 640.546180][T15581] RAX: ffffffffffffffda RBX: 00007f04e9c25fa0 RCX: 00007f04e999e159 [ 640.546187][T15581] RDX: 0000200000000100 RSI: 0000200000000080 RDI: 0000000000000000 [ 640.546195][T15581] RBP: 00007f04e9a3506b R08: 0000000000000000 R09: 0000000000000000 [ 640.546202][T15581] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 640.546209][T15581] R13: 00007f04e9c26038 R14: 00007f04e9c25fa0 R15: 00007ffc7cf99708 [ 640.546224][T15581] [ 640.960534][T15581] FAULT_INJECTION: forcing a failure. [ 640.960534][T15581] name fail_futex, interval 1, probability 0, space 0, times 0 [ 640.960557][T15581] CPU: 0 UID: 0 PID: 15581 Comm: syz.1.2883 Tainted: G L syzkaller #0 PREEMPT(full) [ 640.960574][T15581] Tainted: [L]=SOFTLOCKUP [ 640.960579][T15581] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 640.960586][T15581] Call Trace: [ 640.960591][T15581] [ 640.960595][T15581] dump_stack_lvl+0x100/0x190 [ 640.960615][T15581] should_fail_ex.cold+0x5/0xa [ 640.960632][T15581] get_futex_key+0x1d0/0x14f0 [ 640.960651][T15581] ? __pfx_get_futex_key+0x10/0x10 [ 640.960668][T15581] ? wakeup_preempt_fair+0x5c3/0xdc0 [ 640.960685][T15581] ? tracing_record_taskinfo_sched_switch+0xac/0x560 [ 640.960703][T15581] futex_wait_setup+0x91/0x540 [ 640.960719][T15581] __futex_wait+0x19f/0x300 [ 640.960731][T15581] ? __pfx___futex_wait+0x10/0x10 [ 640.960742][T15581] ? __pfx_try_to_wake_up+0x10/0x10 [ 640.960755][T15581] ? futex_hash+0x311/0x400 [ 640.960773][T15581] ? __pfx_futex_wake_mark+0x10/0x10 [ 640.960788][T15581] ? find_held_lock+0x2b/0x80 [ 640.960804][T15581] ? futex_wake+0x4ea/0x5e0 [ 640.960818][T15581] futex_wait+0xe6/0x370 [ 640.960830][T15581] ? __pfx_futex_wait+0x10/0x10 [ 640.960845][T15581] ? __pfx_avc_has_perm+0x10/0x10 [ 640.960863][T15581] ? commit_creds+0x750/0x10e0 [ 640.960875][T15581] do_futex+0x265/0x440 [ 640.960892][T15581] ? __pfx_do_futex+0x10/0x10 [ 640.960907][T15581] ? __seccomp_filter+0x896/0x1130 [ 640.960928][T15581] __x64_sys_futex+0x34f/0x4d0 [ 640.960946][T15581] ? __pfx___x64_sys_futex+0x10/0x10 [ 640.960968][T15581] do_syscall_64+0x123/0x790 [ 640.960983][T15581] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 640.960995][T15581] RIP: 0033:0x7f04e999e159 [ 640.961006][T15581] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 640.961018][T15581] RSP: 002b:00007f04ea8ca0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 640.961031][T15581] RAX: ffffffffffffffda RBX: 00007f04e9c25fa8 RCX: 00007f04e999e159 [ 640.961039][T15581] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f04e9c25fa8 [ 640.961047][T15581] RBP: 00007f04e9c25fa0 R08: 0000000000000000 R09: 0000000000000000 [ 640.961055][T15581] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 640.961063][T15581] R13: 00007f04e9c26038 R14: 00007ffc7cf99620 R15: 00007ffc7cf99708 [ 640.961078][T15581] [ 641.285731][T15583] netlink: 'syz.2.2884': attribute type 1 has an invalid length. [ 641.285748][T15583] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2884'. [ 641.534645][T15593] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2887'. [ 641.534661][T15593] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2887'. [ 642.826836][ T31] audit: type=1400 audit(1790755337.556:2462): avc: denied { shutdown } for pid=15604 comm="syz.2.2893" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 656.850565][T15618] syz.3.2898 (15618) used obsolete PPPIOCDETACH ioctl [ 657.114903][ T5610] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 657.123328][ T5610] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 657.132626][ T5610] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 657.154538][ T5610] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 657.154820][ T5610] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 657.304500][T15637] netlink: 'syz.0.2902': attribute type 1 has an invalid length. [ 657.304515][T15637] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2902'. [ 657.334035][ T2279] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 657.497150][ T2279] usb 5-1: New USB device found, idVendor=108c, idProduct=0159, bcdDevice= 0.01 [ 657.500291][ T2279] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 4096, setting to 1024 [ 657.500312][ T2279] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024 [ 657.535654][ T2279] usb 5-1: string descriptor 0 read error: -22 [ 657.535717][ T2279] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 657.539391][ T2279] etas_es58x 5-1:1.0: Starting (null) (null) (Serial Number (null)) [ 657.539469][ T2279] etas_es58x 5-1:1.0: could not retrieve the product info string [ 657.889590][T15649] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(5) [ 657.889608][T15649] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 657.889645][T15649] vhci_hcd vhci_hcd.0: Device attached [ 657.931700][T15625] etas_es58x 5-1:1.0 can0: bit-timing not yet defined [ 657.931743][ C0] etas_es58x 5-1:1.0 can0: es58x_write_bulk_callback: error -EPROTO [ 657.931912][ C0] etas_es58x 5-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 657.958610][ C0] etas_es58x 5-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 657.968765][ C0] etas_es58x 5-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 657.969215][ C0] etas_es58x 5-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 657.969388][ C0] etas_es58x 5-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 657.969464][T15625] etas_es58x 5-1:1.0 can0: es58x_open: Could not open the network device: -EINVAL [ 658.014827][ T56] usb 2-1: new full-speed USB device number 68 using dummy_hcd [ 658.039997][T15650] vhci_hcd: connection closed [ 658.040358][ T2279] usb 5-1: USB disconnect, device number 54 [ 658.041409][ T2279] etas_es58x 5-1:1.0: Disconnecting (null) (null) [ 658.043259][ T12] vhci_hcd vhci_hcd.4: stop threads [ 658.043283][ T12] vhci_hcd vhci_hcd.4: release socket [ 658.043310][ T12] vhci_hcd vhci_hcd.4: disconnect device [ 658.094473][ T5712] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 658.165482][ T56] usb 2-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 658.167781][ T56] usb 2-1: config 0 has an invalid interface number: 251 but max is 0 [ 658.167799][ T56] usb 2-1: config 0 has no interface number 0 [ 658.198905][ T56] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 658.198921][ T56] usb 2-1: Product: syz [ 658.198929][ T56] usb 2-1: Manufacturer: syz [ 658.198938][ T56] usb 2-1: SerialNumber: syz [ 658.232767][ T56] usb 2-1: config 0 descriptor?? [ 658.423222][ T43] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 658.548551][T15627] lo speed is unknown, defaulting to 1000 [ 658.549366][T15627] lo speed is unknown, defaulting to 1000 [ 658.712619][ T43] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 658.754512][ T5698] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 658.805618][ T43] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 658.882748][ T43] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 658.898587][T15666] fuse: Unknown parameter 'grou00000000000000000000' [ 658.901090][ T56] asix 2-1:0.251 (unnamed net_device) (uninitialized): Interface mode not supported by driver [ 658.901208][ T56] asix 2-1:0.251: probe with driver asix failed with error -524 [ 658.924921][ T5698] usb 1-1: Using ep0 maxpacket: 32 [ 658.939600][ T5698] usb 1-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 658.953257][ T5698] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 658.953275][ T5698] usb 1-1: config 0 has no interface number 0 [ 658.972400][ T5698] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 658.972421][ T5698] usb 1-1: Product: syz [ 658.972433][ T5698] usb 1-1: Manufacturer: syz [ 658.972441][ T5698] usb 1-1: SerialNumber: syz [ 658.973797][ T5698] usb 1-1: config 0 descriptor?? [ 659.002745][ T5698] usb 1-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 659.002761][ T5698] usb 1-1: selecting invalid altsetting 1 [ 659.002770][ T5698] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 659.041958][ T5698] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 659.042088][ T5698] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 659.042108][ T5698] usb 1-1: media controller created [ 659.102698][ T5698] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 659.136297][T15643] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[5596] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[15643] [ 659.142489][ T5712] usb 2-1: USB disconnect, device number 68 [ 659.194427][ T5609] Bluetooth: hci4: command tx timeout [ 659.236630][ T5698] usb 1-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 659.236658][ T5698] zl10353_read_register: readreg error (reg=127, ret==-71) [ 659.238087][ T5698] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 659.338763][ T5698] usb 1-1: USB disconnect, device number 50 [ 659.462549][T15673] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 659.462574][T15673] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 659.462587][T15673] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 659.813008][ T43] pim6reg: left allmulticast mode [ 660.365621][ T31] audit: type=1400 audit(1790755355.086:2463): avc: denied { recv } for pid=15693 comm="syz.4.2915" saddr=10.128.0.169 src=36412 daddr=10.128.0.172 dest=22 netif=eth0 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unlabeled_t tclass=peer permissive=1 [ 661.216350][ T31] audit: type=1400 audit(1790755355.936:2464): avc: denied { write } for pid=15683 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 661.274386][ T5610] Bluetooth: hci4: command tx timeout [ 661.291191][ T31] audit: type=1400 audit(1790755356.006:2465): avc: denied { create } for pid=15698 comm="syz.3.2916" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 661.336315][ T31] audit: type=1400 audit(1790755356.056:2466): avc: denied { write } for pid=15698 comm="syz.3.2916" path="socket:[58394]" dev="sockfs" ino=58394 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 661.536068][ T31] audit: type=1400 audit(1790755356.256:2467): avc: denied { write } for pid=15708 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 661.843150][ T43] bond0 (unregistering): (slave 30): Releasing backup interface [ 661.872909][ T43] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 661.883163][ T43] bond0 (unregistering): Released all slaves [ 661.897332][ T43] bond1 (unregistering): Released all slaves [ 661.930650][ T43] bond2 (unregistering): (slave team0): Removing an active aggregator [ 661.931032][ T43] bond2 (unregistering): (slave team0): Releasing backup interface [ 661.932506][ T43] bond2 (unregistering): Released all slaves [ 661.989613][T15701] FAULT_INJECTION: forcing a failure. [ 661.989613][T15701] name failslab, interval 1, probability 0, space 0, times 0 [ 661.989638][T15701] CPU: 0 UID: 0 PID: 15701 Comm: syz.3.2916 Tainted: G L syzkaller #0 PREEMPT(full) [ 661.989656][T15701] Tainted: [L]=SOFTLOCKUP [ 661.989661][T15701] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 661.989668][T15701] Call Trace: [ 661.989673][T15701] [ 661.989679][T15701] dump_stack_lvl+0x100/0x190 [ 661.989699][T15701] should_fail_ex.cold+0x5/0xa [ 661.989714][T15701] ? ____sys_sendmsg+0xa4d/0xbe0 [ 661.989727][T15701] should_failslab+0xc2/0x120 [ 661.989744][T15701] __kmalloc_cache_noprof+0x91/0x6d0 [ 661.989757][T15701] ? nsim_fib_event_nb+0x1b4/0xe50 [ 661.989776][T15701] nsim_fib_event_nb+0x1b4/0xe50 [ 661.989789][T15701] ? lock_acquire+0x1d1/0x380 [ 661.989802][T15701] ? atomic_notifier_call_chain+0x2f/0x1c0 [ 661.989820][T15701] notifier_call_chain+0x99/0x3f0 [ 661.989839][T15701] atomic_notifier_call_chain+0x71/0x1c0 [ 661.989856][T15701] call_fib_notifiers+0x33/0x70 [ 661.989873][T15701] fib_notify_alias_delete+0x2b6/0x390 [ 661.989890][T15701] ? __pfx_fib_notify_alias_delete+0x10/0x10 [ 661.989904][T15701] ? __kfree_rcu_sheaf+0x1ad/0x870 [ 661.989921][T15701] ? lockdep_rtnl_is_held+0x26/0x40 [ 661.989935][T15701] ? fib_find_node+0x209/0x280 [ 661.989949][T15701] fib_table_delete+0x5b8/0x8e0 [ 661.989969][T15701] ? __pfx_fib_table_delete+0x10/0x10 [ 661.989984][T15701] ? find_held_lock+0x2b/0x80 [ 661.990000][T15701] ? fib_magic+0x1a7/0x5c0 [ 661.990017][T15701] ? fib_new_table+0x109/0x5d0 [ 661.990037][T15701] fib_magic+0x362/0x5c0 [ 661.990056][T15701] ? __pfx_fib_magic+0x10/0x10 [ 661.990078][T15701] ? netlink_broadcast_filtered+0x40d/0xf20 [ 661.990096][T15701] fib_del_ifaddr+0xf52/0x14d0 [ 661.990108][T15701] ? inetaddr_event+0xf3/0x150 [ 661.990122][T15701] ? __pfx_inetaddr_event+0x10/0x10 [ 661.990136][T15701] fib_inetaddr_event+0xb9/0x270 [ 661.990149][T15701] notifier_call_chain+0x99/0x3f0 [ 661.990168][T15701] blocking_notifier_call_chain+0x69/0xa0 [ 661.990186][T15701] __inet_del_ifa+0x3df/0xf40 [ 661.990214][T15701] inetdev_event+0x40e/0x17f0 [ 661.990234][T15701] ? ib_netdevice_event+0xfc/0x330 [ 661.990251][T15701] ? __pfx_inetdev_event+0x10/0x10 [ 661.990269][T15701] ? cfg802154_netdev_notifier_call+0x17a/0xad0 [ 661.990284][T15701] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 661.990303][T15701] notifier_call_chain+0x99/0x3f0 [ 661.990324][T15701] call_netdevice_notifiers_info+0xbe/0x110 [ 661.990337][T15701] netif_set_mtu_ext+0x48b/0x7b0 [ 661.990354][T15701] ? __pfx_netif_set_mtu_ext+0x10/0x10 [ 661.990371][T15701] ? __pfx_validate_linkmsg+0x10/0x10 [ 661.990388][T15701] ? find_held_lock+0x2b/0x80 [ 661.990403][T15701] ? finish_task_switch.isra.0+0x2bd/0x10d0 [ 661.990421][T15701] do_setlink.isra.0+0x7f9/0x3e60 [ 661.990441][T15701] ? __pfx_do_setlink.isra.0+0x10/0x10 [ 661.990459][T15701] ? __lock_acquire+0x5c0/0x1f40 [ 661.990476][T15701] ? do_raw_spin_lock+0x128/0x260 [ 661.990492][T15701] ? find_held_lock+0x2b/0x80 [ 661.990508][T15701] ? debug_mutex_remove_waiter+0xa0/0x320 [ 661.990524][T15701] ? debug_mutex_remove_waiter+0xa0/0x320 [ 661.990543][T15701] ? mark_held_locks+0x40/0x70 [ 661.990555][T15701] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 661.990572][T15701] ? __mutex_lock+0x829/0x1bd0 [ 661.990583][T15701] ? lockdep_hardirqs_on+0x7d/0x110 [ 661.990595][T15701] ? __mutex_lock+0x829/0x1bd0 [ 661.990606][T15701] ? __mutex_lock+0x26c/0x1bd0 [ 661.990617][T15701] ? rtnl_newlink+0xac3/0x2620 [ 661.990636][T15701] ? __pfx___mutex_lock+0x10/0x10 [ 661.990648][T15701] ? rcu_is_watching+0x13/0xc0 [ 661.990664][T15701] ? cap_capable+0x107/0x430 [ 661.990684][T15701] rtnl_newlink+0x13c1/0x2620 [ 661.990706][T15701] ? __pfx_rtnl_newlink+0x10/0x10 [ 661.990721][T15701] ? avc_has_perm_noaudit+0x56/0x470 [ 661.990739][T15701] ? find_held_lock+0x2b/0x80 [ 661.990755][T15701] ? avc_has_perm_noaudit+0x11e/0x470 [ 661.990772][T15701] ? avc_has_perm_noaudit+0x11e/0x470 [ 661.990796][T15701] ? __lock_acquire+0x5c0/0x1f40 [ 661.990815][T15701] ? lock_acquire+0x1d1/0x380 [ 661.990827][T15701] ? rtnetlink_rcv_msg+0x1f6/0xe90 [ 661.990844][T15701] ? find_held_lock+0x2b/0x80 [ 661.990860][T15701] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 661.990876][T15701] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 661.990894][T15701] ? __pfx_rtnl_newlink+0x10/0x10 [ 661.990911][T15701] rtnetlink_rcv_msg+0x95e/0xe90 [ 661.990929][T15701] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 661.990949][T15701] ? __lock_acquire+0x5c0/0x1f40 [ 661.990962][T15701] ? __netlink_lookup+0xa9/0x900 [ 661.990977][T15701] netlink_rcv_skb+0x159/0x420 [ 661.990992][T15701] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 661.991010][T15701] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 661.991030][T15701] ? netlink_deliver_tap+0x1ae/0xcc0 [ 661.991046][T15701] netlink_unicast+0x585/0x850 [ 661.991063][T15701] ? __pfx_netlink_unicast+0x10/0x10 [ 661.991082][T15701] netlink_sendmsg+0x8b0/0xda0 [ 661.991099][T15701] ? __pfx_netlink_sendmsg+0x10/0x10 [ 661.991115][T15701] ? selinux_socket_sendmsg+0x198/0x2f0 [ 661.991131][T15701] ____sys_sendmsg+0xa4d/0xbe0 [ 661.991142][T15701] ? __pfx_netlink_sendmsg+0x10/0x10 [ 661.991157][T15701] ? __pfx_____sys_sendmsg+0x10/0x10 [ 661.991176][T15701] ___sys_sendmsg+0x190/0x1e0 [ 661.991189][T15701] ? __pfx____sys_sendmsg+0x10/0x10 [ 661.991202][T15701] ? futex_wait+0x11e/0x370 [ 661.991228][T15701] ? find_held_lock+0x2b/0x80 [ 661.991256][T15701] __sys_sendmsg+0x160/0x210 [ 661.991273][T15701] ? __pfx___sys_sendmsg+0x10/0x10 [ 661.991298][T15701] do_syscall_64+0x123/0x790 [ 661.991313][T15701] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 661.991325][T15701] RIP: 0033:0x7f85a9b9e159 [ 661.991337][T15701] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 661.991348][T15701] RSP: 002b:00007f85a7df6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 661.991360][T15701] RAX: ffffffffffffffda RBX: 00007f85a9e25fa0 RCX: 00007f85a9b9e159 [ 661.991368][T15701] RDX: 0000000000000000 RSI: 0000200000000940 RDI: 0000000000000005 [ 661.991375][T15701] RBP: 00007f85a9c3506b R08: 0000000000000000 R09: 0000000000000000 [ 661.991383][T15701] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 661.991390][T15701] R13: 00007f85a9e26038 R14: 00007f85a9e25fa0 R15: 00007ffe7e4ae638 [ 661.991406][T15701] [ 662.108176][ T2279] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 662.401427][T15701] netlink: 128 bytes leftover after parsing attributes in process `syz.3.2916'. [ 662.401945][T15701] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 662.438907][ T2279] usb 5-1: New USB device found, idVendor=108c, idProduct=0159, bcdDevice= 0.01 [ 662.452078][ T5262] 8021q: adding VLAN 0 to HW filter on device eth1 [ 662.533075][ T2279] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 4096, setting to 1024 [ 662.533119][ T2279] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024 [ 662.814662][ T2279] usb 5-1: string descriptor 0 read error: -22 [ 662.814724][ T2279] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 662.842617][ T2279] etas_es58x 5-1:1.0: Starting (null) (null) (Serial Number (null)) [ 662.842694][ T2279] etas_es58x 5-1:1.0: could not retrieve the product info string [ 662.909416][T15721] fuse: Unknown parameter 'grou00000000000000000000' [ 663.136409][T15726] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(5) [ 663.136426][T15726] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 663.137188][T15726] vhci_hcd vhci_hcd.0: Device attached [ 663.285164][T15627] bridge0: port 1(bridge_slave_0) entered blocking state [ 663.285215][T15627] bridge0: port 1(bridge_slave_0) entered disabled state [ 663.285303][T15627] bridge_slave_0: entered allmulticast mode [ 663.286234][T15627] bridge_slave_0: entered promiscuous mode [ 663.315216][T15713] etas_es58x 5-1:1.0 can0: bit-timing not yet defined [ 663.315274][ C0] etas_es58x 5-1:1.0 can0: es58x_write_bulk_callback: error -EPROTO [ 663.315443][ C0] etas_es58x 5-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 663.315615][ C0] etas_es58x 5-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 663.315785][ C0] etas_es58x 5-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 663.315953][ C0] etas_es58x 5-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 663.316121][ C0] etas_es58x 5-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 663.316158][T15713] etas_es58x 5-1:1.0 can0: es58x_open: Could not open the network device: -EINVAL [ 663.316478][T15627] bridge0: port 2(bridge_slave_1) entered blocking state [ 663.318426][T10344] usb 5-1: USB disconnect, device number 55 [ 663.319384][T10344] etas_es58x 5-1:1.0: Disconnecting (null) (null) [ 663.322347][T15727] vhci_hcd: connection closed [ 663.322836][ T60] vhci_hcd vhci_hcd.4: stop threads [ 663.322857][ T60] vhci_hcd vhci_hcd.4: release socket [ 663.322881][ T60] vhci_hcd vhci_hcd.4: disconnect device [ 663.323148][T15627] bridge0: port 2(bridge_slave_1) entered disabled state [ 663.323228][T15627] bridge_slave_1: entered allmulticast mode [ 663.354709][ T5610] Bluetooth: hci4: command tx timeout [ 663.380700][ T2279] usb 41-1: new high-speed USB device number 3 using vhci_hcd [ 663.380735][ T2279] usb 41-1: enqueue for inactive port 0 [ 663.428517][T15627] bridge_slave_1: entered promiscuous mode [ 663.448218][ T2279] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 663.569530][T15627] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 663.575828][T15627] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 663.641078][T15627] team0: Port device team_slave_0 added [ 663.653005][T15627] team0: Port device team_slave_1 added [ 663.701549][T15627] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 663.701560][T15627] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 663.701574][T15627] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 663.703731][T15627] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 663.703740][T15627] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 663.703753][T15627] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 663.710296][ T31] audit: type=1400 audit(1790755358.436:2468): avc: denied { write } for pid=15725 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 663.912425][T15627] hsr_slave_0: entered promiscuous mode [ 663.926369][T15627] hsr_slave_1: entered promiscuous mode [ 663.944372][T15627] debugfs: 'hsr0' already exists in 'hsr' [ 663.944388][T15627] Cannot create hsr debugfs directory [ 664.008307][ T31] audit: type=1400 audit(1790755358.726:2469): avc: denied { write } for pid=15739 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 664.121484][ T5262] 8021q: adding VLAN 0 to HW filter on device eth2 [ 664.166807][ T43] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 664.166843][ T43] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 664.167289][ T43] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 664.167299][ T43] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 664.216091][ T43] veth1_macvtap: left promiscuous mode [ 664.216131][ T43] veth0_macvtap: left promiscuous mode [ 664.216295][ T43] veth1_vlan: left promiscuous mode [ 664.216326][ T43] veth0_vlan: left promiscuous mode [ 664.423179][ T43] team0 (unregistering): Port device team_slave_1 removed [ 664.441577][ T43] team0 (unregistering): Port device team_slave_0 removed [ 665.091305][ T31] audit: type=1400 audit(1790755359.816:2470): avc: denied { write } for pid=15742 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 665.255930][ T31] audit: type=1400 audit(1790755359.966:2471): avc: denied { write } for pid=15753 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 665.437798][ T5610] Bluetooth: hci4: command tx timeout [ 665.518727][ T43] IPVS: stop unused estimator thread 0... [ 665.736077][T15627] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 665.742013][T15627] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 665.760758][T15627] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 665.762233][T15627] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 665.762920][T15627] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 665.787405][T15627] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 665.787946][T15627] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 665.816017][T15627] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 665.876900][ T31] audit: type=1400 audit(1790755360.596:2472): avc: denied { write } for pid=15755 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 665.933326][T15627] 8021q: adding VLAN 0 to HW filter on device bond0 [ 665.957107][T15627] 8021q: adding VLAN 0 to HW filter on device team0 [ 665.963950][ T6545] bridge0: port 1(bridge_slave_0) entered blocking state [ 665.964004][ T6545] bridge0: port 1(bridge_slave_0) entered forwarding state [ 665.991791][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 665.991838][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 666.050741][ T31] audit: type=1400 audit(1790755360.766:2473): avc: denied { write } for pid=15772 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 666.426150][ T31] audit: type=1400 audit(1790755361.146:2474): avc: denied { write } for pid=15776 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 666.491550][T15627] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 666.542967][T15627] veth0_vlan: entered promiscuous mode [ 666.560356][ T31] audit: type=1400 audit(1790755361.276:2475): avc: denied { write } for pid=15795 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 666.560569][T15627] veth1_vlan: entered promiscuous mode [ 666.618409][T15627] veth0_macvtap: entered promiscuous mode [ 666.622129][T15627] veth1_macvtap: entered promiscuous mode [ 666.660383][T15627] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 666.672727][T15627] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 666.756728][ T6545] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 666.756984][ T6545] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 666.757005][ T6545] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 666.765788][ T6545] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 666.878347][ T6545] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 666.878363][ T6545] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 666.962387][ T9397] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 666.962403][ T9397] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 667.120185][ T31] audit: type=1400 audit(1790755361.836:2476): avc: denied { write } for pid=15797 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 667.189164][ T31] audit: type=1400 audit(1790755361.906:2477): avc: denied { write } for pid=15810 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 669.294585][ T31] audit: type=1400 audit(1790755364.016:2478): avc: denied { ioctl } for pid=15814 comm="syz.4.2925" path="socket:[59175]" dev="sockfs" ino=59175 ioctlcmd=0x89ee scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 669.428944][T15822] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 669.460854][T15825] ip_tables: iptables: counters copy to user failed while replacing table [ 669.534889][ T56] usb 2-1: new full-speed USB device number 69 using dummy_hcd [ 669.685684][ T56] usb 2-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 669.686845][ T56] usb 2-1: config 0 has an invalid interface number: 251 but max is 0 [ 669.686860][ T56] usb 2-1: config 0 has no interface number 0 [ 669.689481][ T56] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 669.689498][ T56] usb 2-1: Product: syz [ 669.689507][ T56] usb 2-1: Manufacturer: syz [ 669.689516][ T56] usb 2-1: SerialNumber: syz [ 669.719897][ T5698] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 669.728177][ T56] usb 2-1: config 0 descriptor?? [ 669.753600][ T2279] usb 1-1: new full-speed USB device number 51 using dummy_hcd [ 669.917143][ T5698] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice= 1.00 [ 669.918031][ T5698] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 669.918056][ T5698] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 669.919545][ T5698] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 669.919571][ T5698] usb 5-1: Product: syz [ 669.919581][ T5698] usb 5-1: Manufacturer: syz [ 669.919589][ T5698] usb 5-1: SerialNumber: syz [ 669.990569][ T2279] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 669.991980][ T2279] usb 1-1: config 1 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 669.992001][ T2279] usb 1-1: config 1 interface 0 altsetting 64 endpoint 0x3 has invalid maxpacket 320, setting to 64 [ 669.992016][ T2279] usb 1-1: config 1 interface 0 altsetting 64 has 3 endpoint descriptors, different from the interface descriptor's value: 23 [ 669.992037][ T2279] usb 1-1: config 1 interface 0 has no altsetting 0 [ 669.993029][ T2279] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 669.993043][ T2279] usb 1-1: SerialNumber: syz [ 670.070442][T15825] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 670.084763][ T2279] hub 1-1:1.0: bad descriptor, ignoring hub [ 670.084779][ T2279] hub 1-1:1.0: probe with driver hub failed with error -5 [ 670.086914][ T2279] cdc_acm 1-1:1.0: Control and data interfaces are not separated! [ 670.202667][ T5698] usb 5-1: USB disconnect, device number 56 [ 670.253743][T15827] FAULT_INJECTION: forcing a failure. [ 670.253743][T15827] name failslab, interval 1, probability 0, space 0, times 0 [ 670.253768][T15827] CPU: 0 UID: 0 PID: 15827 Comm: syz.4.2927 Tainted: G L syzkaller #0 PREEMPT(full) [ 670.253785][T15827] Tainted: [L]=SOFTLOCKUP [ 670.253789][T15827] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 670.253797][T15827] Call Trace: [ 670.253801][T15827] [ 670.253807][T15827] dump_stack_lvl+0x100/0x190 [ 670.253827][T15827] should_fail_ex.cold+0x5/0xa [ 670.253846][T15827] should_failslab+0xc2/0x120 [ 670.253863][T15827] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 670.253879][T15827] ? __alloc_skb+0x140/0x710 [ 670.253896][T15827] __alloc_skb+0x140/0x710 [ 670.253910][T15827] ? __alloc_skb+0x5b7/0x710 [ 670.253924][T15827] ? __pfx___alloc_skb+0x10/0x10 [ 670.253938][T15827] ? skb_zerocopy_clone+0x2d4/0x6c0 [ 670.253954][T15827] ? __asan_memcpy+0x3c/0x60 [ 670.253968][T15827] skb_segment+0x9ab/0x4270 [ 670.253991][T15827] __udp_gso_segment+0x14e0/0x2a50 [ 670.254004][T15827] ? __pfx_sock_wfree+0x10/0x10 [ 670.254031][T15827] udp4_ufo_fragment+0x52a/0x710 [ 670.254045][T15827] ? __pfx_udp4_ufo_fragment+0x10/0x10 [ 670.254058][T15827] inet_gso_segment+0x5cc/0x11e0 [ 670.254075][T15827] skb_mac_gso_segment+0x2a5/0x640 [ 670.254088][T15827] ? __pfx_inet_gso_segment+0x10/0x10 [ 670.254100][T15827] ? __pfx_skb_mac_gso_segment+0x10/0x10 [ 670.254113][T15827] ? ip_mc_output+0x466/0xd70 [ 670.254125][T15827] ? __pfx_netif_skb_features+0x10/0x10 [ 670.254141][T15827] __skb_gso_segment+0x3c9/0x770 [ 670.254157][T15827] validate_xmit_skb+0x9ab/0x16b0 [ 670.254173][T15827] ? __lock_acquire+0x5c0/0x1f40 [ 670.254187][T15827] validate_xmit_skb_list+0xcd/0x160 [ 670.254202][T15827] sch_direct_xmit+0x480/0xc70 [ 670.254214][T15827] ? lock_acquire+0x1d1/0x380 [ 670.254229][T15827] ? __pfx_sch_direct_xmit+0x10/0x10 [ 670.254240][T15827] ? do_raw_spin_lock+0x1b0/0x260 [ 670.254260][T15827] __dev_queue_xmit+0x27ac/0x4970 [ 670.254274][T15827] ? avc_has_perm_noaudit+0x11e/0x470 [ 670.254295][T15827] ? __pfx___dev_queue_xmit+0x10/0x10 [ 670.254319][T15827] ? __ip_finish_output.part.0+0x444/0x6f0 [ 670.254340][T15827] ip_finish_output2+0xf4a/0x2400 [ 670.254360][T15827] ? __pfx_ip_finish_output2+0x10/0x10 [ 670.254377][T15827] ? skb_gso_transport_seglen+0x1a5/0x3b0 [ 670.254392][T15827] __ip_finish_output.part.0+0x444/0x6f0 [ 670.254411][T15827] ip_mc_output+0x466/0xd70 [ 670.254422][T15827] ? __pfx_ip_mc_output+0x10/0x10 [ 670.254432][T15827] ? ip_make_skb+0x1f4/0x310 [ 670.254445][T15827] ? __pfx_ip_finish_output+0x10/0x10 [ 670.254463][T15827] ? __pfx_ip_make_skb+0x10/0x10 [ 670.254473][T15827] ? csum_tcpudp_nofold+0x24/0x50 [ 670.254487][T15827] ? __pfx_ip_mc_output+0x10/0x10 [ 670.254504][T15827] ip_send_skb+0x24c/0x2a0 [ 670.254518][T15827] udp_send_skb+0xa38/0xfc0 [ 670.254540][T15827] udp_sendmsg+0x1760/0x2710 [ 670.254560][T15827] ? __pfx_udp_sendmsg+0x10/0x10 [ 670.254579][T15827] ? do_raw_spin_lock+0x128/0x260 [ 670.254601][T15827] ? rcu_is_watching+0x13/0xc0 [ 670.254625][T15827] ? finish_task_switch.isra.0+0x2bd/0x10d0 [ 670.254639][T15827] ? finish_task_switch.isra.0+0x2bd/0x10d0 [ 670.254655][T15827] udpv6_sendmsg+0x1420/0x2c20 [ 670.254666][T15827] ? avc_has_perm_noaudit+0x56/0x470 [ 670.254688][T15827] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 670.254700][T15827] ? avc_has_perm_noaudit+0x145/0x470 [ 670.254720][T15827] ? __pfx_avc_has_perm+0x10/0x10 [ 670.254739][T15827] ? avc_has_perm_noaudit+0x145/0x470 [ 670.254757][T15827] ? sock_has_perm+0x25a/0x2f0 [ 670.254778][T15827] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 670.254791][T15827] ? inet6_sendmsg+0x105/0x140 [ 670.254803][T15827] inet6_sendmsg+0x105/0x140 [ 670.254816][T15827] sock_write_iter+0x41a/0x5b0 [ 670.254828][T15827] ? __pfx_sock_write_iter+0x10/0x10 [ 670.254843][T15827] ? bpf_lsm_file_permission+0x9/0x10 [ 670.254858][T15827] ? security_file_permission+0x76/0x210 [ 670.254874][T15827] ? rw_verify_area+0xce/0x6d0 [ 670.254886][T15827] vfs_write+0x6af/0x1050 [ 670.254899][T15827] ? __pfx_sock_write_iter+0x10/0x10 [ 670.254911][T15827] ? __pfx_vfs_write+0x10/0x10 [ 670.254923][T15827] ? find_held_lock+0x2b/0x80 [ 670.254947][T15827] ksys_write+0x1f8/0x250 [ 670.254960][T15827] ? __pfx_ksys_write+0x10/0x10 [ 670.254977][T15827] do_syscall_64+0x123/0x790 [ 670.254990][T15827] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 670.255002][T15827] RIP: 0033:0x7f8fc139e159 [ 670.255013][T15827] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 670.255030][T15827] RSP: 002b:00007f8fc22fb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 670.255044][T15827] RAX: ffffffffffffffda RBX: 00007f8fc1625fa0 RCX: 00007f8fc139e159 [ 670.255051][T15827] RDX: 0000000000003f80 RSI: 0000200000000300 RDI: 0000000000000003 [ 670.255059][T15827] RBP: 00007f8fc143506b R08: 0000000000000000 R09: 0000000000000000 [ 670.255066][T15827] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 670.255074][T15827] R13: 00007f8fc1626038 R14: 00007f8fc1625fa0 R15: 00007ffda8577e08 [ 670.255090][T15827] [ 670.470576][ T56] asix 2-1:0.251 (unnamed net_device) (uninitialized): Interface mode not supported by driver [ 670.470711][ T56] asix 2-1:0.251: probe with driver asix failed with error -524 [ 670.606670][ T2279] cdc_acm 1-1:1.0: ttyACM0: USB ACM device [ 670.898148][ T2279] usb 1-1: USB disconnect, device number 51 [ 670.918126][T15820] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[5596] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[15820] [ 670.969418][ T5698] wiimote 0005:057E:0330.0018: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 670.969600][ T5698] wiimote 0005:057E:0330.0018: New device registered [ 670.995665][ T5698] usb 2-1: USB disconnect, device number 69 [ 671.048530][T15833] wiimote 0005:057E:0330.0018: Device removed [ 671.124737][T15841] fido_id[15841]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 671.184493][ T5697] usb 5-1: new full-speed USB device number 57 using dummy_hcd [ 671.337032][ T5697] usb 5-1: not running at top speed; connect to a high speed hub [ 671.337052][ T5697] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice= 0.40 [ 671.337838][ T5697] usb 5-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 671.339339][ T5697] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 671.339353][ T5697] usb 5-1: Product: ì’´ [ 671.339361][ T5697] usb 5-1: Manufacturer: Ó¿ [ 671.394463][ T5712] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 671.544755][ T5712] usb 3-1: New USB device found, idVendor=108c, idProduct=0159, bcdDevice= 0.01 [ 671.545520][ T5712] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 4096, setting to 1024 [ 671.545551][ T5712] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024 [ 671.548491][ T5712] usb 3-1: string descriptor 0 read error: -22 [ 671.548566][ T5712] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 671.576996][ T5712] etas_es58x 3-1:1.0: Starting (null) (null) (Serial Number (null)) [ 671.577098][ T5712] etas_es58x 3-1:1.0: could not retrieve the product info string [ 671.742021][ T5697] usb 5-1: USB disconnect, device number 57 [ 671.841161][T15655] udevd[15655]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 671.864993][ T5712] usb 2-1: new high-speed USB device number 70 using dummy_hcd [ 671.912955][T15843] etas_es58x 3-1:1.0 can0: bit-timing not yet defined [ 671.913004][ C0] etas_es58x 3-1:1.0 can0: es58x_write_bulk_callback: error -EPROTO [ 671.913196][ C0] etas_es58x 3-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 671.941053][ C0] etas_es58x 3-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 671.941236][ C0] etas_es58x 3-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 671.941409][ C0] etas_es58x 3-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 671.941579][ C0] etas_es58x 3-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 671.941620][T15843] etas_es58x 3-1:1.0 can0: es58x_open: Could not open the network device: -EINVAL [ 671.996329][ T56] wiimote 0005:057E:0330.0018: detected device: Nintendo Wii Remote Plus (Gen 2) [ 672.022544][ T5712] usb 2-1: New USB device found, idVendor=108c, idProduct=0159, bcdDevice= 0.01 [ 672.034568][ T5712] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 4096, setting to 1024 [ 672.034587][ T5712] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024 [ 672.035523][T15843] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(5) [ 672.035537][T15843] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 672.035576][T15843] vhci_hcd vhci_hcd.0: Device attached [ 672.037009][ T5712] usb 2-1: string descriptor 0 read error: -22 [ 672.037065][ T5712] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 672.116067][ T5712] etas_es58x 2-1:1.0: Starting (null) (null) (Serial Number (null)) [ 672.116151][ T5712] etas_es58x 2-1:1.0: could not retrieve the product info string [ 672.198914][T15851] vhci_hcd: connection closed [ 672.199134][ T6545] vhci_hcd vhci_hcd.2: stop threads [ 672.199154][ T6545] vhci_hcd vhci_hcd.2: release socket [ 672.199165][ T6545] vhci_hcd vhci_hcd.2: disconnect device [ 672.279207][ T5698] usb 3-1: USB disconnect, device number 62 [ 672.280199][ T5698] etas_es58x 3-1:1.0: Disconnecting (null) (null) [ 672.362388][T15857] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 672.362406][T15857] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 672.362452][T15857] vhci_hcd vhci_hcd.0: Device attached [ 672.415154][T15858] vhci_hcd: connection closed [ 672.415376][ T6545] vhci_hcd vhci_hcd.1: stop threads [ 672.415396][ T6545] vhci_hcd vhci_hcd.1: release socket [ 672.415407][ T6545] vhci_hcd vhci_hcd.1: disconnect device [ 672.455683][ T56] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0330.0018/input/input35 [ 672.461955][ T5712] usb 2-1: USB disconnect, device number 70 [ 672.487592][ T5712] etas_es58x 2-1:1.0: Disconnecting (null) (null) [ 672.534896][ T56] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0330.0018/input/input36 [ 672.560595][T15863] jffs2: notice: (15863) jffs2_build_xattr_subsystem: complete building xattr subsystem, 4 of xdatum (3 unchecked, 1 orphan) and 4 of xref (0 dead, 1 orphan) found. [ 672.562398][ T56] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0330.0018/input/input34 [ 672.667653][ T31] audit: type=1400 audit(1790755367.386:2479): avc: denied { write } for pid=15861 comm="syz.4.2934" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 672.667686][ T31] audit: type=1400 audit(1790755367.386:2480): avc: denied { map } for pid=15861 comm="syz.4.2934" path="/29/file0/cgroup.stat" dev="jffs2" ino=6 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 672.749280][T15863] lo speed is unknown, defaulting to 1000 [ 672.751521][T15863] lo speed is unknown, defaulting to 1000 [ 676.149186][ T31] audit: type=1400 audit(1790755370.866:2481): avc: denied { write } for pid=15850 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 677.297893][ T31] audit: type=1400 audit(1790755372.016:2482): avc: denied { write } for pid=15893 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 677.332584][T15900] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 678.664861][ T5712] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 678.829187][ T5712] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 678.851879][ T5712] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 678.851897][ T5712] usb 3-1: Product: syz [ 678.851905][ T5712] usb 3-1: Manufacturer: syz [ 678.851914][ T5712] usb 3-1: SerialNumber: syz [ 678.974196][ T31] audit: type=1400 audit(1790755373.686:2483): avc: denied { write } for pid=15910 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 679.259846][ T31] audit: type=1400 audit(1790755373.976:2484): avc: denied { nlmsg_write } for pid=15942 comm="syz.4.2950" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 679.282945][ T5712] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 679.295991][ T31] audit: type=1400 audit(1790755374.026:2485): avc: denied { write } for pid=15941 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 679.341036][ T10] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 679.439588][ T5712] usb 2-1: New USB device found, idVendor=108c, idProduct=0159, bcdDevice= 0.01 [ 679.441293][ T5712] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 4096, setting to 1024 [ 679.441317][ T5712] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024 [ 679.444910][ T5712] usb 2-1: string descriptor 0 read error: -22 [ 679.444969][ T5712] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 679.501554][ T5712] etas_es58x 2-1:1.0: Starting (null) (null) (Serial Number (null)) [ 679.501634][ T5712] etas_es58x 2-1:1.0: could not retrieve the product info string [ 679.719467][T15936] etas_es58x 2-1:1.0 can0: bit-timing not yet defined [ 679.719533][ C0] etas_es58x 2-1:1.0 can0: es58x_write_bulk_callback: error -EPROTO [ 679.719700][ C0] etas_es58x 2-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 679.719874][ C0] etas_es58x 2-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 679.720045][ C0] etas_es58x 2-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 679.720214][ C0] etas_es58x 2-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 679.720382][ C0] etas_es58x 2-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 679.720452][T15936] etas_es58x 2-1:1.0 can0: es58x_open: Could not open the network device: -EINVAL [ 679.806891][T15936] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 679.806908][T15936] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 679.806949][T15936] vhci_hcd vhci_hcd.0: Device attached [ 679.839294][T15950] vhci_hcd: connection closed [ 679.840747][ T56] usb 2-1: USB disconnect, device number 71 [ 679.843158][ T60] vhci_hcd vhci_hcd.1: stop threads [ 679.843178][ T60] vhci_hcd vhci_hcd.1: release socket [ 679.843216][ T60] vhci_hcd vhci_hcd.1: disconnect device [ 679.843857][ T56] etas_es58x 2-1:1.0: Disconnecting (null) (null) [ 679.925685][T10344] usb 3-1: USB disconnect, device number 63 [ 680.148348][T15960] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2952'. [ 680.403422][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 680.403454][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 680.427975][ T10] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 680.428097][ T10] ath9k_htc: Failed to initialize the device [ 680.450278][ T31] audit: type=1400 audit(1790755375.176:2486): avc: denied { write } for pid=15949 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 680.480126][ T5698] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 680.489033][T10344] usb 3-1: ath9k_htc: USB layer deinitialized [ 680.636312][ T5698] usb 5-1: Using ep0 maxpacket: 8 [ 680.636739][ T5698] usb 5-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=c3.de [ 680.637469][ T5698] usb 5-1: config index 0 descriptor too short (expected 1307, got 27) [ 680.637492][ T5698] usb 5-1: config 0 has an invalid interface number: 149 but max is -1 [ 680.637504][ T5698] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 680.637514][ T5698] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 680.637526][ T5698] usb 5-1: config 0 has no interface number 0 [ 680.637539][ T5698] usb 5-1: too many endpoints for config 0 interface 149 altsetting 215: 148, using maximum allowed: 30 [ 680.637571][ T5698] usb 5-1: config 0 interface 149 altsetting 215 has 0 endpoint descriptors, different from the interface descriptor's value: 148 [ 680.637585][ T5698] usb 5-1: config 0 interface 149 has no altsetting 0 [ 680.649772][ T5698] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 680.649787][ T5698] usb 5-1: Product: syz [ 680.649796][ T5698] usb 5-1: Manufacturer: syz [ 680.649805][ T5698] usb 5-1: SerialNumber: syz [ 680.660664][ T5698] usb 5-1: config 0 descriptor?? [ 680.692325][ T5698] hub 5-1:0.149: bad descriptor, ignoring hub [ 680.692341][ T5698] hub 5-1:0.149: probe with driver hub failed with error -5 [ 680.800350][T15960] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 680.886305][ T31] audit: type=1400 audit(1790755375.616:2487): avc: denied { write } for pid=15977 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 681.107895][T15976] could not allocate digest TFM handle crct10dif-arm64-neon [ 681.691300][T15960] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 681.789495][ T31] audit: type=1400 audit(1790755376.506:2488): avc: denied { write } for pid=15986 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 682.275976][ T31] audit: type=1400 audit(1790755376.996:2489): avc: denied { write } for pid=16010 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 682.523970][T15960] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 682.686164][ T31] audit: type=1400 audit(1790755377.406:2490): avc: denied { shutdown } for pid=16020 comm="syz.3.2961" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 683.539010][T15960] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 683.633291][T16028] netlink: 288 bytes leftover after parsing attributes in process `syz.2.2957'. [ 684.849629][ T5697] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 685.285238][ T5698] usb 5-1: USB disconnect, device number 58 [ 685.407202][ T5697] usb 1-1: New USB device found, idVendor=108c, idProduct=0159, bcdDevice= 0.01 [ 685.408476][ T5697] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 4096, setting to 1024 [ 685.408495][ T5697] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024 [ 685.410538][ T5697] usb 1-1: string descriptor 0 read error: -22 [ 685.410596][ T5697] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 685.467417][ T5697] etas_es58x 1-1:1.0: Starting (null) (null) (Serial Number (null)) [ 685.467493][ T5697] etas_es58x 1-1:1.0: could not retrieve the product info string [ 685.745355][T16041] etas_es58x 1-1:1.0 can0: bit-timing not yet defined [ 685.745408][ C0] etas_es58x 1-1:1.0 can0: es58x_write_bulk_callback: error -EPROTO [ 685.745603][ C0] etas_es58x 1-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 685.748749][ C0] etas_es58x 1-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 685.749880][ C0] etas_es58x 1-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 685.749981][T16047] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2966'. [ 685.750056][ C0] etas_es58x 1-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 685.750223][ C0] etas_es58x 1-1:1.0: es58x_read_bulk_callback: error -ENOENT [ 685.767369][T16041] etas_es58x 1-1:1.0 can0: es58x_open: Could not open the network device: -EINVAL [ 685.856569][T16041] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(5) [ 685.856588][T16041] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 685.856627][T16041] vhci_hcd vhci_hcd.0: Device attached [ 685.918954][T16054] vhci_hcd: connection closed [ 685.919108][ T5697] usb 1-1: USB disconnect, device number 52 [ 685.920096][ T5697] etas_es58x 1-1:1.0: Disconnecting (null) (null) [ 685.929302][ T6820] vhci_hcd vhci_hcd.0: stop threads [ 685.929324][ T6820] vhci_hcd vhci_hcd.0: release socket [ 685.929335][ T6820] vhci_hcd vhci_hcd.0: disconnect device [ 686.131722][ T10] wiimote 0005:057E:0330.0019: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 686.131998][ T10] wiimote 0005:057E:0330.0019: New device registered [ 686.228580][T16057] wiimote 0005:057E:0330.0019: Device removed [ 686.352173][T16061] fido_id[16061]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 686.427589][ T5697] wiimote 0005:057E:0330.001A: hidraw1: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 686.427772][ T5697] wiimote 0005:057E:0330.001A: New device registered [ 686.529466][T16064] wiimote 0005:057E:0330.001A: Device removed [ 686.592701][T16068] fido_id[16068]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 686.763061][ T31] audit: type=1400 audit(1790755381.476:2491): avc: denied { write } for pid=16056 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 686.953370][ T31] audit: type=1400 audit(1790755381.666:2492): avc: denied { read write } for pid=16084 comm="syz.4.2974" name="mtrr" dev="proc" ino=4026531995 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 686.953566][ T31] audit: type=1400 audit(1790755381.666:2493): avc: denied { open } for pid=16084 comm="syz.4.2974" path="/37/proc/mtrr" dev="proc" ino=4026531995 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 687.007909][T16085] size and base must be multiples of 4 kiB [ 687.007923][T16085] CPU: 0 UID: 0 PID: 16085 Comm: syz.4.2974 Tainted: G L syzkaller #0 PREEMPT(full) [ 687.007941][T16085] Tainted: [L]=SOFTLOCKUP [ 687.007945][T16085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 687.007951][T16085] Call Trace: [ 687.007956][T16085] [ 687.007961][T16085] dump_stack_lvl+0x100/0x190 [ 687.007982][T16085] mtrr_del.cold+0x72/0x85 [ 687.007995][T16085] mtrr_ioctl+0xbc8/0xcf0 [ 687.008007][T16085] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 687.008024][T16085] ? __pfx_mtrr_ioctl+0x10/0x10 [ 687.008034][T16085] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 687.008052][T16085] ? __fget_files+0x34/0x3d0 [ 687.008073][T16085] ? __pfx_mtrr_ioctl+0x10/0x10 [ 687.008084][T16085] proc_reg_unlocked_ioctl+0x229/0x320 [ 687.008096][T16085] ? __pfx_proc_reg_unlocked_ioctl+0x10/0x10 [ 687.008109][T16085] __x64_sys_ioctl+0x18e/0x210 [ 687.008124][T16085] do_syscall_64+0x123/0x790 [ 687.008137][T16085] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 687.008149][T16085] RIP: 0033:0x7f8fc139e159 [ 687.008158][T16085] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 687.008169][T16085] RSP: 002b:00007f8fc22fb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 687.008181][T16085] RAX: ffffffffffffffda RBX: 00007f8fc1625fa0 RCX: 00007f8fc139e159 [ 687.008188][T16085] RDX: 0000200000000140 RSI: 0000000040104d04 RDI: 0000000000000004 [ 687.008195][T16085] RBP: 00007f8fc143506b R08: 0000000000000000 R09: 0000000000000000 [ 687.008202][T16085] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 687.008209][T16085] R13: 00007f8fc1626038 R14: 00007f8fc1625fa0 R15: 00007ffda8577e08 [ 687.008223][T16085] [ 687.008255][ T31] audit: type=1400 audit(1790755381.726:2494): avc: denied { ioctl } for pid=16084 comm="syz.4.2974" path="/37/proc/mtrr" dev="proc" ino=4026531995 ioctlcmd=0x4d04 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 687.106953][ T56] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 687.113137][ T31] audit: type=1400 audit(1790755381.836:2495): avc: denied { write } for pid=16083 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 687.264688][ T10] wiimote 0005:057E:0330.0019: detected device: Nintendo Wii Remote Plus (Gen 2) [ 687.305884][ T10] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0330.0019/input/input38 [ 687.337356][ T10] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0330.0019/input/input39 [ 687.344303][ T56] usb 3-1: Using ep0 maxpacket: 16 [ 687.369129][ T56] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 687.369881][ T56] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 687.404714][ T56] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 687.404734][ T56] usb 3-1: Product: syz [ 687.404743][ T56] usb 3-1: Manufacturer: syz [ 687.404751][ T56] usb 3-1: SerialNumber: syz [ 687.443158][ T5697] wiimote 0005:057E:0330.001A: detected device: Nintendo Wii Remote Plus (Gen 2) [ 687.443385][ T5697] sysfs: cannot create duplicate filename '/class/power_supply/wiimote_battery_syz0' [ 687.443399][ T5697] CPU: 0 UID: 0 PID: 5697 Comm: kworker/0:4 Tainted: G L syzkaller #0 PREEMPT(full) [ 687.443414][ T5697] Tainted: [L]=SOFTLOCKUP [ 687.443419][ T5697] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 687.443426][ T5697] Workqueue: events wiimote_init_worker [ 687.443447][ T5697] Call Trace: [ 687.443451][ T5697] [ 687.443457][ T5697] dump_stack_lvl+0x100/0x190 [ 687.443475][ T5697] sysfs_warn_dup.cold+0x1c/0x28 [ 687.443493][ T5697] sysfs_do_create_link_sd+0x113/0x140 [ 687.443511][ T5697] sysfs_create_link+0x61/0xc0 [ 687.443528][ T5697] device_add+0x675/0x1970 [ 687.443549][ T5697] ? __pfx_device_add+0x10/0x10 [ 687.443567][ T5697] ? lockdep_init_map_type+0x5c/0x250 [ 687.443582][ T5697] ? __raw_spin_lock_init+0x3a/0x110 [ 687.443600][ T5697] __power_supply_register.part.0+0x9b5/0x1390 [ 687.443616][ T5697] ? __pfx___power_supply_register.part.0+0x10/0x10 [ 687.443636][ T5697] ? __pfx_wiimod_battery_probe+0x10/0x10 [ 687.443648][ T5697] ? kasprintf+0xc7/0x100 [ 687.443662][ T5697] ? __pfx_kasprintf+0x10/0x10 [ 687.443677][ T5697] ? trace_kmalloc+0xeb/0x110 [ 687.443692][ T5697] ? __kasan_kmalloc+0xaa/0xb0 [ 687.443709][ T5697] power_supply_register+0xce/0x110 [ 687.443723][ T5697] wiimod_battery_probe+0x21e/0x370 [ 687.443735][ T5697] ? __pfx_wiimod_battery_probe+0x10/0x10 [ 687.443747][ T5697] ? input_ff_create+0x256/0x310 [ 687.443762][ T5697] ? __pfx_wiimod_rumble_play+0x10/0x10 [ 687.443781][ T5697] ? __pfx_wiimod_battery_probe+0x10/0x10 [ 687.443792][ T5697] wiimote_init_worker+0xd55/0x2730 [ 687.443814][ T5697] ? __pfx_wiimote_init_worker+0x10/0x10 [ 687.443832][ T5697] ? lock_acquire+0x1d1/0x380 [ 687.443844][ T5697] ? process_one_work+0xa2c/0x1b10 [ 687.443862][ T5697] ? process_one_work+0x906/0x1b10 [ 687.443880][ T5697] ? process_one_work+0x906/0x1b10 [ 687.443899][ T5697] process_one_work+0xac7/0x1b10 [ 687.443923][ T5697] ? __pfx_process_one_work+0x10/0x10 [ 687.443941][ T5697] ? lock_acquire+0x1d1/0x380 [ 687.443958][ T5697] ? __pfx_wiimote_init_worker+0x10/0x10 [ 687.443977][ T5697] worker_thread+0x5ef/0xe50 [ 687.443993][ T5697] ? kthread+0x13a/0x450 [ 687.444008][ T5697] ? __pfx_worker_thread+0x10/0x10 [ 687.444025][ T5697] kthread+0x373/0x450 [ 687.444040][ T5697] ? __pfx_kthread+0x10/0x10 [ 687.444057][ T5697] ret_from_fork+0x730/0xd60 [ 687.444071][ T5697] ? __pfx_ret_from_fork+0x10/0x10 [ 687.444085][ T5697] ? __switch_to+0x800/0x10f0 [ 687.444101][ T5697] ? __pfx_kthread+0x10/0x10 [ 687.444118][ T5697] ret_from_fork_asm+0x1a/0x30 [ 687.444137][ T5697] [ 687.510565][ T10] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0330.0019/input/input37 [ 687.892481][ T5697] wiimote 0005:057E:0330.001A: cannot register battery device [ 687.911863][ T31] audit: type=1400 audit(1790755382.636:2496): avc: denied { create } for pid=16088 comm="syz.4.2976" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 687.943914][ T31] audit: type=1400 audit(1790755382.666:2497): avc: denied { write } for pid=16088 comm="syz.4.2976" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 688.140808][T10344] usb 3-1: USB disconnect, device number 64 [ 688.220879][ T5609] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 688.237289][ T5609] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 688.238998][ T5609] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 688.240491][ T5609] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 688.242365][ T5609] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 688.366341][ T56] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 688.666770][ T31] audit: type=1400 audit(1790755383.386:2498): avc: denied { write } for pid=16091 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 688.905706][ T31] audit: type=1400 audit(1790755383.626:2499): avc: denied { write } for pid=16116 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 688.994331][ T56] usb 5-1: device descriptor read/64, error -71 [ 689.234417][ T56] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 689.242186][T16096] lo speed is unknown, defaulting to 1000 [ 689.242876][T16096] lo speed is unknown, defaulting to 1000 [ 689.394436][ T56] usb 5-1: Using ep0 maxpacket: 32 [ 689.395546][ T56] usb 5-1: New USB device found, idVendor=133e, idProduct=0815, bcdDevice= 0.40 [ 689.396291][ T56] usb 5-1: config 1 interface 1 has no altsetting 0 [ 689.397752][ T56] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 689.397766][ T56] usb 5-1: Product: syz [ 689.397774][ T56] usb 5-1: Manufacturer: syz [ 689.397783][ T56] usb 5-1: SerialNumber: syz [ 690.500981][ T5609] Bluetooth: hci3: command tx timeout [ 690.574040][ T56] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 690.595255][ T56] usb 5-1: USB disconnect, device number 60 [ 691.167410][ T43] bridge_slave_1: left allmulticast mode [ 691.167429][ T43] bridge_slave_1: left promiscuous mode [ 691.170440][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 691.201620][ T43] bridge_slave_0: left allmulticast mode [ 691.201639][ T43] bridge_slave_0: left promiscuous mode [ 691.201764][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 691.236991][ T43] lo: left allmulticast mode [ 692.246423][T16141] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2982'. [ 692.500589][ T31] audit: type=1400 audit(1790755387.216:2500): avc: denied { write } for pid=16139 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 692.556187][ T5609] Bluetooth: hci3: command tx timeout [ 692.683849][ T31] audit: type=1400 audit(1790755387.396:2501): avc: denied { map } for pid=16159 comm="syz.2.2985" path="/16/tracing/per_cpu/cpu0/trace_pipe_raw" dev="tracefs" ino=4092 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 692.724192][ T43] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 692.776845][ T43] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 692.777659][ T43] bond0 (unregistering): Released all slaves [ 692.781357][ T31] audit: type=1400 audit(1790755387.496:2502): avc: denied { write } for pid=16161 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 693.065197][T16171] sctp: [Deprecated]: syz.2.2987 (pid 16171) Use of struct sctp_assoc_value in delayed_ack socket option. [ 693.065197][T16171] Use struct sctp_sack_info instead [ 693.085918][ T5262] 8021q: adding VLAN 0 to HW filter on device eth1 [ 693.219953][T16096] bridge0: port 1(bridge_slave_0) entered blocking state [ 693.219999][T16096] bridge0: port 1(bridge_slave_0) entered disabled state [ 693.220082][T16096] bridge_slave_0: entered allmulticast mode [ 693.220832][T16096] bridge_slave_0: entered promiscuous mode [ 693.256876][T16096] bridge0: port 2(bridge_slave_1) entered blocking state [ 693.256919][T16096] bridge0: port 2(bridge_slave_1) entered disabled state [ 693.256983][T16096] bridge_slave_1: entered allmulticast mode [ 693.260916][T16096] bridge_slave_1: entered promiscuous mode [ 693.433168][T16096] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 693.457862][T16096] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 693.602696][T16096] team0: Port device team_slave_0 added [ 693.621335][T16096] team0: Port device team_slave_1 added [ 693.871457][T16096] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 693.871469][T16096] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 693.871482][T16096] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 693.968402][ T43] hsr_slave_0: left promiscuous mode [ 693.981576][ T43] hsr_slave_1: left promiscuous mode [ 694.586963][ T31] audit: type=1400 audit(1790755389.196:2503): avc: denied { ioctl } for pid=16178 comm="syz.2.2989" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 ioctlcmd=0x540f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 694.634478][ T5609] Bluetooth: hci3: command tx timeout [ 694.674354][ T56] usb 2-1: new high-speed USB device number 72 using dummy_hcd [ 694.837328][ T31] audit: type=1400 audit(1790755389.556:2504): avc: denied { write } for pid=16181 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 694.861230][ T56] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 694.882101][ T56] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 694.882120][ T56] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 694.904666][ T56] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=67 [ 694.904684][ T56] usb 2-1: SerialNumber: syz [ 694.946477][T16201] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=256 sclass=netlink_route_socket pid=16201 comm=syz.4.2992 [ 695.055518][ T31] audit: type=1400 audit(1790755389.776:2505): avc: denied { write } for pid=16202 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 695.223930][ T31] audit: type=1400 audit(1790755389.936:2506): avc: denied { load_policy } for pid=16187 comm="syz.1.2991" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 695.225990][T16188] SELinux: ebitmap: empty map [ 695.226028][T16188] SELinux: failed to load policy [ 695.348454][ T43] team0 (unregistering): Port device team_slave_1 removed [ 695.373763][ T43] team0 (unregistering): Port device team_slave_0 removed [ 695.392941][ T56] usb 2-1: 0:2 : does not exist [ 695.466739][ T56] usb 2-1: USB disconnect, device number 72 [ 695.508965][T15629] udevd[15629]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 695.571145][T16206] FAULT_INJECTION: forcing a failure. [ 695.571145][T16206] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 695.571169][T16206] CPU: 0 UID: 0 PID: 16206 Comm: syz.4.2993 Tainted: G L syzkaller #0 PREEMPT(full) [ 695.571185][T16206] Tainted: [L]=SOFTLOCKUP [ 695.571189][T16206] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 695.571196][T16206] Call Trace: [ 695.571200][T16206] [ 695.571205][T16206] dump_stack_lvl+0x100/0x190 [ 695.571227][T16206] should_fail_ex.cold+0x5/0xa [ 695.571244][T16206] _copy_from_user+0x2e/0xd0 [ 695.571259][T16206] move_addr_to_kernel+0x65/0x170 [ 695.571274][T16206] __sys_sendto+0x1b8/0x4e0 [ 695.571290][T16206] ? __pfx___sys_sendto+0x10/0x10 [ 695.571308][T16206] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 695.571327][T16206] ? ksys_write+0x1ac/0x250 [ 695.571340][T16206] ? __pfx_ksys_write+0x10/0x10 [ 695.571354][T16206] __x64_sys_sendto+0xe0/0x1c0 [ 695.571369][T16206] ? do_syscall_64+0xae/0x790 [ 695.571380][T16206] ? lockdep_hardirqs_on+0x7d/0x110 [ 695.571391][T16206] do_syscall_64+0x123/0x790 [ 695.571404][T16206] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 695.571416][T16206] RIP: 0033:0x7f8fc139e159 [ 695.571426][T16206] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 695.571438][T16206] RSP: 002b:00007f8fc22fb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 695.571450][T16206] RAX: ffffffffffffffda RBX: 00007f8fc1625fa0 RCX: 00007f8fc139e159 [ 695.571457][T16206] RDX: 0000000000000019 RSI: 0000200000000300 RDI: 0000000000000004 [ 695.571464][T16206] RBP: 00007f8fc22fb090 R08: 0000200000000400 R09: 0000000000000010 [ 695.571471][T16206] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 695.571478][T16206] R13: 00007f8fc1626038 R14: 00007f8fc1625fa0 R15: 00007ffda8577e08 [ 695.571492][T16206] [ 695.929507][T16096] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 695.929519][T16096] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 695.929534][T16096] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 695.938660][T16193] lo speed is unknown, defaulting to 1000 [ 695.939339][T16193] lo speed is unknown, defaulting to 1000 [ 696.106813][ T5262] 8021q: adding VLAN 0 to HW filter on device eth2 [ 697.389799][ T5609] Bluetooth: hci3: command tx timeout [ 699.429133][T16096] hsr_slave_0: entered promiscuous mode [ 699.537622][T16096] hsr_slave_1: entered promiscuous mode [ 700.707571][ T31] audit: type=1400 audit(1790755395.416:2507): avc: denied { write } for pid=16217 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 700.825543][T16229] netlink: 288 bytes leftover after parsing attributes in process `syz.1.2996'. [ 701.050358][ T31] audit: type=1400 audit(1790755395.766:2508): avc: denied { write } for pid=16240 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 701.145713][T16243] FAULT_INJECTION: forcing a failure. [ 701.145713][T16243] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 701.145736][T16243] CPU: 0 UID: 0 PID: 16243 Comm: syz.3.2999 Tainted: G L syzkaller #0 PREEMPT(full) [ 701.145752][T16243] Tainted: [L]=SOFTLOCKUP [ 701.145756][T16243] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 701.145763][T16243] Call Trace: [ 701.145768][T16243] [ 701.145772][T16243] dump_stack_lvl+0x100/0x190 [ 701.145793][T16243] should_fail_ex.cold+0x5/0xa [ 701.145809][T16243] _copy_from_user+0x2e/0xd0 [ 701.145824][T16243] copy_msghdr_from_user+0x9f/0x4c0 [ 701.145838][T16243] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 701.145854][T16243] ? lock_acquire+0x1d1/0x380 [ 701.145867][T16243] ? get_pid_task+0x2a/0x250 [ 701.145883][T16243] ___sys_sendmsg+0x106/0x1e0 [ 701.145897][T16243] ? __pfx____sys_sendmsg+0x10/0x10 [ 701.145909][T16243] ? get_pid_task+0x106/0x250 [ 701.145929][T16243] ? find_held_lock+0x2b/0x80 [ 701.145954][T16243] __sys_sendmsg+0x160/0x210 [ 701.145971][T16243] ? __pfx___sys_sendmsg+0x10/0x10 [ 701.145994][T16243] do_syscall_64+0x123/0x790 [ 701.146007][T16243] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 701.146019][T16243] RIP: 0033:0x7f85a9b9e159 [ 701.146029][T16243] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 701.146040][T16243] RSP: 002b:00007f85a7df6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 701.146052][T16243] RAX: ffffffffffffffda RBX: 00007f85a9e25fa0 RCX: 00007f85a9b9e159 [ 701.146059][T16243] RDX: 0000000024000864 RSI: 0000200000002580 RDI: 0000000000000003 [ 701.146066][T16243] RBP: 00007f85a7df6090 R08: 0000000000000000 R09: 0000000000000000 [ 701.146073][T16243] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 701.146080][T16243] R13: 00007f85a9e26038 R14: 00007f85a9e25fa0 R15: 00007ffe7e4ae638 [ 701.146094][T16243] [ 701.588800][T16245] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3000'. [ 701.651171][ T31] audit: type=1400 audit(1790755396.366:2509): avc: denied { cmd } for pid=16244 comm="iou-wrk-16245" path="/dev/ublk-control" dev="devtmpfs" ino=695 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=io_uring permissive=1 [ 702.272907][ T56] wiimote 0005:057E:0330.001B: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 702.273093][ T56] wiimote 0005:057E:0330.001B: New device registered [ 702.311493][T16266] wiimote 0005:057E:0330.001B: Device removed [ 702.470014][T16270] fido_id[16270]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 702.495214][ T5698] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 702.585426][ T31] audit: type=1400 audit(1790755397.306:2510): avc: denied { write } for pid=16255 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 702.647219][ T5698] usb 4-1: Using ep0 maxpacket: 8 [ 702.649108][ T5698] usb 4-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 702.649857][ T5698] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 702.649876][ T5698] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 702.649898][ T5698] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 702.706928][ T5698] usb 4-1: config 0 descriptor?? [ 702.863581][ T31] audit: type=1400 audit(1790755397.576:2511): avc: denied { write } for pid=16277 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 703.149042][ T5698] hid_parser_main: 7 callbacks suppressed [ 703.163019][ T5698] lenovo 0003:17EF:6047.001C: unknown main item tag 0x0 [ 703.163054][ T5698] lenovo 0003:17EF:6047.001C: unknown main item tag 0x0 [ 703.163067][ T5698] lenovo 0003:17EF:6047.001C: unknown main item tag 0x0 [ 703.163080][ T5698] lenovo 0003:17EF:6047.001C: unknown main item tag 0x0 [ 703.163093][ T5698] lenovo 0003:17EF:6047.001C: unknown main item tag 0x0 [ 703.163106][ T5698] lenovo 0003:17EF:6047.001C: unknown main item tag 0x0 [ 703.163118][ T5698] lenovo 0003:17EF:6047.001C: unknown main item tag 0x0 [ 703.163130][ T5698] lenovo 0003:17EF:6047.001C: unknown main item tag 0x0 [ 703.224612][ T5698] lenovo 0003:17EF:6047.001C: hidraw1: USB HID v0.00 Device [HID 17ef:6047] on usb-dummy_hcd.3-1/input0 [ 703.354557][ T56] wiimote 0005:057E:0330.001B: detected device: Nintendo Wii Remote Plus (Gen 2) [ 703.385490][T16096] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 808.404188][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 808.411148][ C0] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P56/1:b..l P16165/1:b..l P16279/1:b..l [ 808.421298][ C0] rcu: (detected by 0, t=10502 jiffies, g=150977, q=537 ncpus=1) [ 808.429071][ C0] task:syz.4.3005 state:R running task stack:28584 pid:16279 tgid:16272 ppid:15149 task_flags:0x400040 flags:0x00080000 [ 808.442517][ C0] Call Trace: [ 808.445772][ C0] [ 808.448681][ C0] __schedule+0x1259/0x6920 [ 808.453181][ C0] ? irqentry_exit+0x24d/0xa10 [ 808.457926][ C0] ? __pfx___schedule+0x10/0x10 [ 808.462755][ C0] ? rcu_is_watching+0x13/0xc0 [ 808.467509][ C0] preempt_schedule_irq+0x4e/0x90 [ 808.472518][ C0] irqentry_exit+0x205/0xa10 [ 808.477081][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 808.483035][ C0] RIP: 0010:lock_is_held_type+0xf5/0x140 [ 808.488649][ C0] Code: ff ff ff ff 65 0f c1 15 f1 e5 ba 08 83 fa 01 8b 44 24 04 75 2d 9c 5a 80 e6 02 75 47 41 f7 c5 00 02 00 00 74 01 fb 48 83 c4 08 <5b> 5d 41 5c 41 5d 41 5e 41 5f e9 4c 46 03 00 e9 47 46 03 00 31 c0 [ 808.508238][ C0] RSP: 0018:ffffc90004097800 EFLAGS: 00000296 [ 808.514291][ C0] RAX: 0000000000000001 RBX: ffffffff8edec5a0 RCX: 0000000000000001 [ 808.522234][ C0] RDX: 0000000000000046 RSI: ffffffff8e3684a0 RDI: ffffffff8c623980 [ 808.530182][ C0] RBP: ffff888029e88000 R08: 0000000000000005 R09: 0000000000000010 [ 808.538126][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: 00000000ffffffff [ 808.546079][ C0] R13: 0000000000000246 R14: ffff888029e88bb0 R15: 0000000000000000 [ 808.554045][ C0] __htab_lru_percpu_map_update_elem+0xe5/0xc80 [ 808.560265][ C0] ? __pfx___htab_lru_percpu_map_update_elem+0x10/0x10 [ 808.567107][ C0] ? bpf_percpu_hash_update+0xf3/0x240 [ 808.572570][ C0] ? bpf_percpu_hash_update+0xf3/0x240 [ 808.578024][ C0] bpf_percpu_hash_update+0x128/0x240 [ 808.583386][ C0] bpf_map_update_value+0x967/0xff0 [ 808.588566][ C0] ? __might_fault+0xc5/0x140 [ 808.593302][ C0] ? __pfx_bpf_map_update_value+0x10/0x10 [ 808.599014][ C0] generic_map_update_batch+0x570/0x860 [ 808.604537][ C0] ? __pfx_generic_map_update_batch+0x10/0x10 [ 808.610592][ C0] ? __pfx_generic_map_update_batch+0x10/0x10 [ 808.616633][ C0] bpf_map_do_batch+0x66f/0x6d0 [ 808.621472][ C0] __sys_bpf+0x4ce/0x4a30 [ 808.625780][ C0] ? __pfx___sys_bpf+0x10/0x10 [ 808.630520][ C0] ? find_held_lock+0x2b/0x80 [ 808.635179][ C0] ? futex_wake+0x4ea/0x5e0 [ 808.639673][ C0] ? __x64_sys_futex+0x34f/0x4d0 [ 808.644593][ C0] ? __x64_sys_futex+0x358/0x4d0 [ 808.649529][ C0] ? xfd_validate_state+0x129/0x190 [ 808.654713][ C0] ? __x64_sys_bpf+0xce/0x140 [ 808.659370][ C0] __x64_sys_bpf+0xce/0x140 [ 808.663863][ C0] ? do_syscall_64+0xae/0x790 [ 808.668526][ C0] do_syscall_64+0x123/0x790 [ 808.673093][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 808.678958][ C0] RIP: 0033:0x7f8fc139e159 [ 808.683345][ C0] RSP: 002b:00007f8fc22da028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 808.691732][ C0] RAX: ffffffffffffffda RBX: 00007f8fc1626090 RCX: 00007f8fc139e159 [ 808.699676][ C0] RDX: 0000000000000038 RSI: 0000200000000200 RDI: 000000000000001a [ 808.707623][ C0] RBP: 00007f8fc143506b R08: 0000000000000000 R09: 0000000000000000 [ 808.715576][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 808.723521][ C0] R13: 00007f8fc1626128 R14: 00007f8fc1626090 R15: 00007ffda8577e08 [ 808.731482][ C0] [ 808.734477][ C0] task:syz.4.2983 state:R running task stack:22888 pid:16165 tgid:16165 ppid:15149 task_flags:0x400640 flags:0x00080000 [ 808.747920][ C0] Call Trace: [ 808.751173][ C0] [ 808.754080][ C0] __schedule+0x1259/0x6920 [ 808.758576][ C0] ? irqentry_exit+0x24d/0xa10 [ 808.763315][ C0] ? __pfx___schedule+0x10/0x10 [ 808.768158][ C0] ? mark_held_locks+0x40/0x70 [ 808.772918][ C0] preempt_schedule_irq+0x4e/0x90 [ 808.777941][ C0] irqentry_exit+0x205/0xa10 [ 808.782520][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 808.788485][ C0] RIP: 0010:lock_release+0x19e/0x310 [ 808.793759][ C0] Code: ff 65 0f c1 05 9b db a5 12 83 f8 01 0f 85 27 01 00 00 9c 58 f6 c4 02 0f 85 12 01 00 00 41 f7 c6 00 02 00 00 0f 85 c8 00 00 00 <48> 8b 44 24 10 65 48 2b 05 9d 94 a5 12 0f 85 4d 01 00 00 48 83 c4 [ 808.813485][ C0] RSP: 0018:ffffc9000550e248 EFLAGS: 00000206 [ 808.819539][ C0] RAX: 0000000000000046 RBX: ffffffff8edec5a0 RCX: ffffc9000550e254 [ 808.827498][ C0] RDX: 0000000000000000 RSI: ffffffff8e3684a0 RDI: ffffffff8c623980 [ 808.835444][ C0] RBP: ffffffff81b9b54e R08: 0000000000000001 R09: 0000000000000007 [ 808.843404][ C0] R10: 0000000000000200 R11: 000000000001716f R12: ffff888035862580 [ 808.851360][ C0] R13: ffffc9000550e300 R14: 0000000000000202 R15: 0000000000000003 [ 808.859324][ C0] ? unwind_next_frame+0x3be/0x2090 [ 808.864512][ C0] unwind_next_frame+0x3c3/0x2090 [ 808.869530][ C0] ? get_page_from_freelist+0x110d/0x35d0 [ 808.875230][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 808.881365][ C0] arch_stack_walk+0x94/0xf0 [ 808.885953][ C0] ? __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 808.891999][ C0] stack_trace_save+0x8e/0xc0 [ 808.896649][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 808.901995][ C0] ? lock_acquire+0x1d1/0x380 [ 808.906657][ C0] save_stack+0x162/0x1e0 [ 808.910982][ C0] ? __pfx_save_stack+0x10/0x10 [ 808.915819][ C0] ? post_alloc_hook+0xfd/0x120 [ 808.920641][ C0] ? get_page_from_freelist+0x110d/0x35d0 [ 808.926356][ C0] ? __lock_acquire+0x5c0/0x1f40 [ 808.931286][ C0] __set_page_owner+0x8c/0x540 [ 808.936031][ C0] ? __pfx___set_page_owner+0x10/0x10 [ 808.941381][ C0] ? bad_range+0x257/0x3f0 [ 808.945776][ C0] ? lockdep_hardirqs_on+0x7d/0x110 [ 808.950955][ C0] ? get_page_from_freelist+0x10e6/0x35d0 [ 808.956656][ C0] post_alloc_hook+0xfd/0x120 [ 808.961323][ C0] get_page_from_freelist+0x110d/0x35d0 [ 808.966951][ C0] ? __next_zones_zonelist+0x63/0x160 [ 808.972304][ C0] ? __pfx_get_page_from_freelist+0x10/0x10 [ 808.978171][ C0] ? prepare_alloc_pages+0x438/0x5b0 [ 808.983455][ C0] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 808.989326][ C0] ? page_table_check_set+0x11d/0x580 [ 808.994678][ C0] ? find_held_lock+0x2b/0x80 [ 808.999342][ C0] ? page_table_check_set+0x30f/0x580 [ 809.004691][ C0] ? page_table_check_set+0x30f/0x580 [ 809.010053][ C0] ? __lock_acquire+0x5c0/0x1f40 [ 809.014976][ C0] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 809.021277][ C0] ? __lock_acquire+0x5c0/0x1f40 [ 809.026191][ C0] ? lock_acquire+0x1d1/0x380 [ 809.030846][ C0] ? do_raw_spin_lock+0x128/0x260 [ 809.035849][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 809.041196][ C0] ? find_held_lock+0x2b/0x80 [ 809.045856][ C0] ? __lock_acquire+0x5c0/0x1f40 [ 809.050777][ C0] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 809.056658][ C0] ? policy_nodemask+0xed/0x4f0 [ 809.061498][ C0] alloc_pages_mpol+0x201/0x550 [ 809.066344][ C0] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 809.071692][ C0] ? __folio_batch_add_and_move+0x5e5/0xc60 [ 809.077567][ C0] folio_alloc_mpol_noprof+0x36/0x260 [ 809.082924][ C0] shmem_alloc_folio+0x135/0x160 [ 809.087907][ C0] shmem_alloc_and_add_folio+0x371/0xd40 [ 809.093555][ C0] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 809.099784][ C0] ? shmem_allowable_huge_orders+0x1d7/0x470 [ 809.105771][ C0] shmem_get_folio_gfp+0x75b/0x1980 [ 809.110974][ C0] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 809.116695][ C0] ? vm_normal_page+0x1d1/0x380 [ 809.121526][ C0] ? __pfx_vm_normal_page+0x10/0x10 [ 809.126701][ C0] shmem_write_begin+0x1a4/0x420 [ 809.131614][ C0] ? __pfx_shmem_write_begin+0x10/0x10 [ 809.137050][ C0] ? balance_dirty_pages_ratelimited_flags+0x91/0x1170 [ 809.143876][ C0] generic_perform_write+0x292/0xa40 [ 809.149136][ C0] ? __pfx_shmem_file_write_iter+0x10/0x10 [ 809.154916][ C0] ? __pfx_generic_perform_write+0x10/0x10 [ 809.160699][ C0] ? file_update_time_flags+0x38c/0x520 [ 809.166227][ C0] ? __pfx_shmem_file_write_iter+0x10/0x10 [ 809.172006][ C0] shmem_file_write_iter+0x10e/0x140 [ 809.177265][ C0] __kernel_write_iter+0x2ac/0x930 [ 809.182355][ C0] ? __pfx___kernel_write_iter+0x10/0x10 [ 809.187967][ C0] ? __up_read+0x333/0x980 [ 809.192369][ C0] ? dump_user_range+0x65e/0xad0 [ 809.197287][ C0] dump_user_range+0x3f9/0xad0 [ 809.202045][ C0] ? __pfx_dump_user_range+0x10/0x10 [ 809.207308][ C0] ? __pfx_writenote+0x10/0x10 [ 809.212046][ C0] ? elf_core_dump+0x1f25/0x3d20 [ 809.216958][ C0] elf_core_dump+0x2d68/0x3d20 [ 809.221701][ C0] ? __pfx_elf_core_dump+0x10/0x10 [ 809.226782][ C0] ? kasan_save_stack+0x3f/0x50 [ 809.231617][ C0] ? kasan_save_stack+0x30/0x50 [ 809.236443][ C0] ? kasan_save_track+0x14/0x30 [ 809.241272][ C0] ? __kasan_kmalloc+0xaa/0xb0 [ 809.246008][ C0] ? vfs_coredump+0x21f6/0x54a0 [ 809.250828][ C0] ? get_signal+0x1f2a/0x21e0 [ 809.255482][ C0] ? arch_do_signal_or_restart+0x91/0x7e0 [ 809.261182][ C0] ? 0xffffffffff600000 [ 809.265325][ C0] ? lock_acquire+0x1d1/0x380 [ 809.269973][ C0] ? get_signal+0x1f2a/0x21e0 [ 809.274622][ C0] ? vfs_coredump+0x281a/0x54a0 [ 809.279444][ C0] vfs_coredump+0x281a/0x54a0 [ 809.284106][ C0] ? __pfx_vfs_coredump+0x10/0x10 [ 809.289109][ C0] ? __lock_acquire+0x5c0/0x1f40 [ 809.294028][ C0] ? __lock_acquire+0x5c0/0x1f40 [ 809.298938][ C0] ? lock_acquire+0x1d1/0x380 [ 809.303595][ C0] ? unwind_next_frame+0xbd/0x2090 [ 809.308682][ C0] ? lock_acquire+0x1d1/0x380 [ 809.313340][ C0] ? bpf_ksym_find+0x128/0x1c0 [ 809.318074][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 809.324214][ C0] ? arch_stack_walk+0xa6/0xf0 [ 809.328955][ C0] ? __sigqueue_free+0xbe/0x2a0 [ 809.333793][ C0] ? stack_trace_save+0x8e/0xc0 [ 809.338613][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 809.343965][ C0] ? stack_depot_save_flags+0x27/0x9f0 [ 809.349399][ C0] ? __lock_acquire+0x5c0/0x1f40 [ 809.354327][ C0] ? proc_coredump_connector+0x2d3/0x4f0 [ 809.359937][ C0] ? __pfx_proc_coredump_connector+0x10/0x10 [ 809.365891][ C0] ? rcu_is_watching+0x13/0xc0 [ 809.370637][ C0] get_signal+0x1f2a/0x21e0 [ 809.375119][ C0] ? __pfx_get_signal+0x10/0x10 [ 809.379946][ C0] arch_do_signal_or_restart+0x91/0x7e0 [ 809.385477][ C0] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 809.391621][ C0] irqentry_exit+0x402/0xa10 [ 809.396187][ C0] asm_exc_page_fault+0x26/0x30 [ 809.401008][ C0] RIP: 0033:0x7f8fc139e161 [ 809.405396][ C0] RSP: 002b:fffffffffffffe70 EFLAGS: 00010217 [ 809.411432][ C0] RAX: 0000000000000000 RBX: 00007f8fc1626180 RCX: 00007f8fc139e159 [ 809.419392][ C0] RDX: 0000000000000000 RSI: fffffffffffffe70 RDI: 0000000000008000 [ 809.427345][ C0] RBP: 00007f8fc143506b R08: 0000000000000000 R09: 0000000000000000 [ 809.435300][ C0] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 809.443241][ C0] R13: 00007f8fc1626218 R14: 00007f8fc1626180 R15: 00007ffda8577e08 [ 809.451199][ C0] [ 809.454192][ C0] task:kworker/0:2 state:R running task stack:23296 pid:56 tgid:56 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 809.467724][ C0] Workqueue: events wiimote_init_worker [ 809.473256][ C0] Call Trace: [ 809.476510][ C0] [ 809.479415][ C0] __schedule+0x1259/0x6920 [ 809.483989][ C0] ? irqentry_exit+0x24d/0xa10 [ 809.488736][ C0] ? __pfx___schedule+0x10/0x10 [ 809.493665][ C0] ? mark_held_locks+0x40/0x70 [ 809.498405][ C0] preempt_schedule_irq+0x4e/0x90 [ 809.503418][ C0] irqentry_exit+0x205/0xa10 [ 809.507991][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 809.513943][ C0] RIP: 0010:kernfs_root+0x8f/0x2a0 [ 809.519042][ C0] Code: ea 03 80 3c 02 00 0f 85 24 02 00 00 48 8b 5d 30 e8 26 51 0d 09 31 ff 41 89 c4 89 c6 e8 fa 1e 47 ff 45 85 e4 0f 85 75 01 00 00 7c 24 47 ff 48 85 db 48 0f 44 dd e8 70 24 47 ff 48 b8 00 00 00 [ 809.538636][ C0] RSP: 0018:ffffc9000100f4c8 EFLAGS: 00000202 [ 809.544685][ C0] RAX: 0000000000000000 RBX: ffff88805733e2d0 RCX: ffffffff82c521da [ 809.552626][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88801d314b00 [ 809.560567][ C0] RBP: ffff888075e9ae10 R08: 0000000000000005 R09: 0000000000000000 [ 809.568509][ C0] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000001 [ 809.576450][ C0] R13: ffff88801d2c7118 R14: 0000000000000000 R15: ffff88801d2c7118 [ 809.584399][ C0] ? kernfs_root+0x21a/0x2a0 [ 809.588978][ C0] ? kernfs_root+0x21a/0x2a0 [ 809.593543][ C0] kernfs_active+0x5c/0x110 [ 809.598023][ C0] kernfs_activate_one+0x99/0x290 [ 809.603023][ C0] kernfs_add_one+0x5ec/0xaa0 [ 809.607676][ C0] __kernfs_create_file+0x295/0x350 [ 809.612856][ C0] sysfs_add_file_mode_ns+0x207/0x3c0 [ 809.618206][ C0] sysfs_merge_group+0x194/0x340 [ 809.623122][ C0] ? __pfx_sysfs_merge_group+0x10/0x10 [ 809.628560][ C0] ? bus_add_device+0x2e2/0x6c0 [ 809.633385][ C0] ? __pfx_bus_add_device+0x10/0x10 [ 809.638553][ C0] ? __pfx_dev_add_physical_location+0x10/0x10 [ 809.644695][ C0] dpm_sysfs_add+0x237/0x280 [ 809.649269][ C0] device_add+0x9f4/0x1970 [ 809.653664][ C0] ? __pfx_device_add+0x10/0x10 [ 809.658490][ C0] ? kfree_const+0x5a/0x70 [ 809.662876][ C0] ? kfree+0x1e5/0x6d0 [ 809.666918][ C0] device_create_groups_vargs+0x1f8/0x270 [ 809.672624][ C0] device_create_with_groups+0xf4/0x130 [ 809.678166][ C0] ? __pfx_device_create_with_groups+0x10/0x10 [ 809.684321][ C0] ? class_find_device+0x19f/0x290 [ 809.689426][ C0] ? lockdep_init_map_type+0x5c/0x250 [ 809.694779][ C0] led_classdev_register_ext+0x4d2/0x990 [ 809.700386][ C0] ? __pfx_led_classdev_register_ext+0x10/0x10 [ 809.706514][ C0] ? __pfx_snprintf+0x10/0x10 [ 809.711179][ C0] ? wiimod_led_probe+0xa0/0x490 [ 809.716102][ C0] wiimod_led_probe+0x265/0x490 [ 809.720929][ C0] ? __pfx_wiimod_led_probe+0x10/0x10 [ 809.726276][ C0] wiimote_init_worker+0xd55/0x2730 [ 809.731457][ C0] ? __pfx_wiimote_init_worker+0x10/0x10 [ 809.737065][ C0] ? lock_acquire+0x1d1/0x380 [ 809.741719][ C0] ? process_one_work+0xa2c/0x1b10 [ 809.746811][ C0] ? process_one_work+0x906/0x1b10 [ 809.751912][ C0] ? process_one_work+0x906/0x1b10 [ 809.757014][ C0] process_one_work+0xac7/0x1b10 [ 809.761933][ C0] ? __pfx_process_one_work+0x10/0x10 [ 809.767281][ C0] ? lock_acquire+0x1d1/0x380 [ 809.771932][ C0] ? __pfx_wiimote_init_worker+0x10/0x10 [ 809.777541][ C0] worker_thread+0x5ef/0xe50 [ 809.782107][ C0] ? kthread+0x13a/0x450 [ 809.786346][ C0] ? __pfx_worker_thread+0x10/0x10 [ 809.791434][ C0] kthread+0x373/0x450 [ 809.795485][ C0] ? __pfx_kthread+0x10/0x10 [ 809.800062][ C0] ret_from_fork+0x730/0xd60 [ 809.804627][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 809.809713][ C0] ? __switch_to+0x800/0x10f0 [ 809.814377][ C0] ? __pfx_kthread+0x10/0x10 [ 809.818950][ C0] ret_from_fork_asm+0x1a/0x30 [ 809.823702][ C0] [ 809.826696][ C0] rcu: rcu_preempt kthread starved for 9682 jiffies! g150977 f0x0 RCU_GP_WAIT_FQS(5) ->state=R ->cpu=0 [ 809.837681][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 809.847805][ C0] rcu: RCU grace-period kthread stack dump: [ 809.853670][ C0] task:rcu_preempt state:R running task stack:27560 pid:17 tgid:17 ppid:2 task_flags:0x208040 flags:0x00080000 [ 809.867122][ C0] Call Trace: [ 809.870375][ C0] [ 809.873280][ C0] __schedule+0x1259/0x6920 [ 809.877762][ C0] ? irqentry_exit+0x24d/0xa10 [ 809.882500][ C0] ? __pfx___schedule+0x10/0x10 [ 809.887334][ C0] ? rcu_is_watching+0x13/0xc0 [ 809.892073][ C0] preempt_schedule_irq+0x4e/0x90 [ 809.897073][ C0] irqentry_exit+0x205/0xa10 [ 809.901637][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 809.907598][ C0] RIP: 0010:timer_delete_sync+0x0/0x20 [ 809.913037][ C0] Code: e8 95 67 db 09 eb da e8 ae ab 88 00 e9 10 ff ff ff 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 53 48 89 fb e8 c3 40 15 00 48 89 df 31 f6 5b e9 18 fe [ 809.932622][ C0] RSP: 0018:ffffc90000167ba8 EFLAGS: 00000246 [ 809.938658][ C0] RAX: 0000000000208040 RBX: 000000010000a050 RCX: 0000000000000000 [ 809.946599][ C0] RDX: 0000000000000000 RSI: ffffffff8c623900 RDI: ffffc90000167bd0 [ 809.954541][ C0] RBP: 1ffff9200002cf76 R08: 0000000000000000 R09: fffffbfff228ab4b [ 809.962482][ C0] R10: ffffffff91455a5f R11: 0000000000000000 R12: ffffc90000167bd0 [ 809.970430][ C0] R13: 1ffffffff1d41e50 R14: ffff88801f29a580 R15: dffffc0000000000 [ 809.978387][ C0] schedule_timeout+0x12f/0x280 [ 809.983222][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 809.988587][ C0] ? __pfx_process_timeout+0x10/0x10 [ 809.993872][ C0] rcu_gp_fqs_loop+0x1a9/0x8f0 [ 809.998612][ C0] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 810.003881][ C0] ? __pfx_rcu_gp_init+0x10/0x10 [ 810.008832][ C0] ? __pfx_rcu_gp_cleanup+0x10/0x10 [ 810.014003][ C0] ? rcu_is_watching+0x13/0xc0 [ 810.018749][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 810.024548][ C0] rcu_gp_kthread+0x17a/0x220 [ 810.029210][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 810.034382][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 810.040172][ C0] ? __kthread_parkme+0x18f/0x230 [ 810.045172][ C0] ? kthread+0x13a/0x450 [ 810.049390][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 810.054570][ C0] kthread+0x373/0x450 [ 810.058628][ C0] ? __pfx_kthread+0x10/0x10 [ 810.063195][ C0] ret_from_fork+0x730/0xd60 [ 810.067762][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 810.072856][ C0] ? __switch_to+0x800/0x10f0 [ 810.077520][ C0] ? __pfx_kthread+0x10/0x10 [ 810.082097][ C0] ret_from_fork_asm+0x1a/0x30 [ 810.086839][ C0] [ 810.089834][ C0] rcu: Stack dump where RCU GP kthread last ran: [ 810.096134][ C0] CPU: 0 UID: 0 PID: 16288 Comm: syz.1.3007 Tainted: G L syzkaller #0 PREEMPT(full) [ 810.107049][ C0] Tainted: [L]=SOFTLOCKUP [ 810.111346][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 810.121391][ C0] RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 [ 810.127187][ C0] Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 9a 0e 12 f6 48 89 df e8 22 65 12 f6 e8 0d 31 3f f6 fb bf 01 00 00 00 52 48 01 f6 65 48 83 3d e1 a4 b7 08 00 74 06 5b e9 11 4c 00 00 [ 810.146768][ C0] RSP: 0018:ffffc9000616fc90 EFLAGS: 00000206 [ 810.152807][ C0] RAX: 0000000009a173bb RBX: ffff88802dc065c0 RCX: 0000000000000000 [ 810.160748][ C0] RDX: 0000000000000001 RSI: ffffffff8e38e957 RDI: 0000000000000001 [ 810.168699][ C0] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 [ 810.176640][ C0] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000021 [ 810.184582][ C0] R13: ffff88802dc069c0 R14: dffffc0000000000 R15: ffff888026dd8000 [ 810.192532][ C0] FS: 00007f04ea8ca6c0(0000) GS:ffff888123b4f000(0000) knlGS:0000000000000000 [ 810.201432][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 810.207995][ C0] CR2: 0000200000000058 CR3: 000000004a9b4000 CR4: 00000000003526f0 [ 810.215939][ C0] DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000083 [ 810.223891][ C0] DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 810.231836][ C0] Call Trace: [ 810.235091][ C0] [ 810.238007][ C0] get_signal+0x195a/0x21e0 [ 810.242489][ C0] ? restore_sigcontext+0x4d3/0x6a0 [ 810.247670][ C0] ? __pfx_get_signal+0x10/0x10 [ 810.252499][ C0] arch_do_signal_or_restart+0x91/0x7e0 [ 810.258024][ C0] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 810.264161][ C0] exit_to_user_mode_loop+0x139/0x700 [ 810.269507][ C0] ? rcu_is_watching+0x13/0xc0 [ 810.274249][ C0] do_syscall_64+0x661/0x790 [ 810.278826][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 810.284693][ C0] RIP: 0033:0x7f04e999e157 [ 810.289093][ C0] Code: 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 <0f> 05 48 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 [ 810.308673][ C0] RSP: 002b:00007f04ea8ca0e8 EFLAGS: 00000246 [ 810.314711][ C0] RAX: 00000000000000ca RBX: 00007f04e9c25fa8 RCX: 00007f04e999e159 [ 810.322666][ C0] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f04e9c25fa8 [ 810.330611][ C0] RBP: 00007f04e9c25fa0 R08: 0000000000000000 R09: 0000000000000000 [ 810.338554][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 810.346509][ C0] R13: 00007f04e9c26038 R14: 00007ffc7cf99620 R15: 00007ffc7cf99708 [ 810.354461][ C0] [ 810.391204][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 810.391235][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 810.391994][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 810.392016][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 810.588361][ T5698] lenovo 0003:17EF:6047.001C: Failed to switch middle button: -110 [ 810.588648][ T5698] lenovo 0003:17EF:6047.001C: Fn-lock setting failed: -32 [ 810.609378][ T5698] lenovo 0003:17EF:6047.001C: Sensitivity setting failed: -32 SYZFAIL: failed to send rpc fd=3 want=2600 sent=0 n=-1 (errno 32: Broken pipe) [ 810.638807][ T31] audit: type=1400 audit(1790755505.356:2512): avc: denied { write } for pid=5584 comm="syz-executor" path="pipe:[5245]" dev="pipefs" ino=5245 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 810.745682][ T56] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0330.001B/input/input42 [ 810.769512][ T56] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0330.001B/input/input43 [ 810.792663][ T56] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0330.001B/input/input41 [ 810.891705][T16096] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 811.566838][ T31] audit: type=1400 audit(1790755506.286:2513): avc: denied { write } for pid=16289 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 811.634555][ T31] audit: type=1400 audit(1790755506.356:2514): avc: denied { write } for pid=16306 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 811.859166][ T31] audit: type=1400 audit(1790755506.576:2515): avc: denied { write } for pid=16312 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 811.929729][ T31] audit: type=1400 audit(1790755506.646:2516): avc: denied { write } for pid=16323 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 812.112305][ T31] audit: type=1400 audit(1790755506.826:2517): avc: denied { write } for pid=16325 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 812.187383][ T31] audit: type=1400 audit(1790755506.906:2518): avc: denied { write } for pid=16336 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 812.402066][T16291] Bluetooth: hci5: command 0x0406 tx timeout [ 812.415112][T15382] usb 4-1: USB disconnect, device number 56 [ 812.496474][ T5610] Bluetooth: hci4: command 0x0406 tx timeout [ 812.988683][ T12] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 813.091644][ T12] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 813.189366][ T12] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 813.246928][ T12] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 813.575046][ T12] bridge_slave_1: left allmulticast mode [ 813.575064][ T12] bridge_slave_1: left promiscuous mode [ 813.575247][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 813.579113][ T12] bridge_slave_0: left allmulticast mode [ 813.579129][ T12] bridge_slave_0: left promiscuous mode [ 813.579220][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 813.858457][ T31] audit: type=1400 audit(1790755508.576:2519): avc: denied { write } for pid=16339 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 813.918628][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 813.921113][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 813.923420][ T12] bond0 (unregistering): Released all slaves [ 814.039249][ T31] audit: type=1400 audit(1790755508.756:2520): avc: denied { write } for pid=16350 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 814.145807][ T5262] 8021q: adding VLAN 0 to HW filter on device eth1 [ 814.327730][ T12] hsr_slave_0: left promiscuous mode [ 814.328011][ T12] hsr_slave_1: left promiscuous mode [ 814.328373][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 814.328384][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 814.328670][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 814.328679][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 814.381794][ T12] veth1_macvtap: left promiscuous mode [ 814.381820][ T12] veth0_macvtap: left promiscuous mode [ 814.381869][ T12] veth1_vlan: left promiscuous mode [ 814.381901][ T12] veth0_vlan: left promiscuous mode [ 814.569852][ T31] audit: type=1400 audit(1790755509.286:2521): avc: denied { write } for pid=16353 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 814.719086][ T12] team0 (unregistering): Port device team_slave_1 removed [ 814.738957][ T12] team0 (unregistering): Port device team_slave_0 removed [ 814.818185][ T5262] 8021q: adding VLAN 0 to HW filter on device eth2 [ 815.202590][ T12] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 815.202614][ T12] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 815.331122][ T12] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 815.331144][ T12] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 815.378375][ T5262] 8021q: adding VLAN 0 to HW filter on device eth3 [ 815.415870][ T12] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 815.415893][ T12] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 815.492009][ T12] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 815.492032][ T12] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 815.792014][ T31] kauditd_printk_skb: 3 callbacks suppressed [ 815.792028][ T31] audit: type=1400 audit(1790755510.506:2525): avc: denied { write } for pid=16381 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 815.898056][ T12] netdevsim netdevsim10 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 815.898080][ T12] netdevsim netdevsim10 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 815.931494][ T31] audit: type=1400 audit(1790755510.656:2526): avc: denied { write } for pid=16392 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 816.019700][ T5262] 8021q: adding VLAN 0 to HW filter on device eth4 [ 816.398035][ T31] audit: type=1400 audit(1790755511.116:2527): avc: denied { write } for pid=16396 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 816.505957][ T31] audit: type=1400 audit(1790755511.226:2528): avc: denied { write } for pid=16407 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 816.580459][ T5262] 8021q: adding VLAN 0 to HW filter on device eth5 [ 816.736882][ T12] lo: left allmulticast mode [ 816.750795][ T12] bridge_slave_1: left allmulticast mode [ 816.750812][ T12] bridge_slave_1: left promiscuous mode [ 816.750948][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 816.751916][ T12] bridge_slave_0: left allmulticast mode [ 816.751927][ T12] bridge_slave_0: left promiscuous mode [ 816.752016][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 816.927006][ T12] bond3 (unregistering): (slave ip6gretap1): Removing an active aggregator [ 816.927222][ T12] bond3 (unregistering): (slave ip6gretap1): Releasing backup interface [ 816.927435][ T12] ip6gretap1 (unregistering): left allmulticast mode [ 817.044366][ T31] audit: type=1400 audit(1790755511.766:2529): avc: denied { write } for pid=16411 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 817.091368][ T12] bond1 (unregistering): (slave geneve2): Releasing active interface [ 817.135979][ T12] bond1 (unregistering): Released all slaves [ 817.158740][ T12] bond2 (unregistering): Released all slaves [ 817.173014][ T12] bond3 (unregistering): Released all slaves [ 817.182043][ T31] audit: type=1400 audit(1790755511.896:2530): avc: denied { write } for pid=16422 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 817.273930][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 817.290880][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 817.291505][ T12] bond0 (unregistering): Released all slaves [ 817.310955][ T5262] 8021q: adding VLAN 0 to HW filter on device eth6 [ 817.849058][ T12] hsr_slave_0: left promiscuous mode [ 817.849360][ T12] hsr_slave_1: left promiscuous mode [ 817.849709][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 817.849719][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 817.853021][ T12] hsr_slave_0: left promiscuous mode [ 817.853307][ T12] hsr_slave_1: left promiscuous mode [ 817.853660][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 817.853915][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 817.911842][ T31] audit: type=1400 audit(1790755512.636:2531): avc: denied { write } for pid=16426 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 817.941432][ T12] veth1_macvtap: left promiscuous mode [ 817.941456][ T12] veth0_macvtap: left promiscuous mode [ 817.941513][ T12] veth1_vlan: left promiscuous mode [ 817.941529][ T12] veth0_vlan: left promiscuous mode [ 818.055028][ T31] audit: type=1400 audit(1790755512.776:2532): avc: denied { write } for pid=16437 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1