last executing test programs: 15.015131526s ago: executing program 3 (id=1202): socket$inet_tcp(0x2, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x1fe, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) r4 = socket$kcm(0x10, 0x2, 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="00240000000000000002000000200000f8ff0000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000002780)=[{&(0x7f0000002580)="89000000120081ae08060cdc030000007f03e3f7000000026ee2ffca1b1f1400000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec001210000140090c0c00bdad446b9bbc7a46e39882a5dcdf12741308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20f", 0x86}, {&(0x7f0000002700)="d6f4de", 0x3}], 0x2, 0x0, 0x0, 0xff0f0000}, 0x0) ioctl$DRM_IOCTL_MODE_CURSOR(r2, 0xc01c64d0, &(0x7f0000000280)={0x2, r3, 0x800, 0x0, 0xfffffffd, 0x0, 0x2}) 14.122671799s ago: executing program 4 (id=1204): ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) r0 = mq_open(&(0x7f0000000040)='\xa3\\@.@{/!),^\x00', 0x2, 0x102, &(0x7f0000000080)={0x1fd, 0x7, 0x4}) mq_timedreceive(r0, &(0x7f00000000c0)=""/175, 0xaf, 0x7, &(0x7f0000000180)={0x77359400}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x24, r2, 0x20, 0x70bd28, 0x80000000, {}, [@NL80211_ATTR_WIPHY_TX_POWER_SETTING={0x8, 0x61, 0xc00000}, @NL80211_ATTR_TXQ_QUANTUM={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x40086}, 0x0) sendmsg$NL80211_CMD_SET_COALESCE(r1, &(0x7f0000000200)={0x0, 0xffffffffffffff8c, &(0x7f0000000b00)={&(0x7f0000000040)={0x28, r2, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r4}, @void}}}, 0x28}}, 0x0) r5 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) sched_setaffinity(0x0, 0xfffffffffffffdb1, &(0x7f0000000280)=0x6) r6 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000025300)=""/102392, 0x18ff8) r8 = creat(&(0x7f0000000000)='./file1\x00', 0xf8) r9 = fanotify_init(0xf00, 0x1) fanotify_mark(r9, 0x105, 0x40009975, r8, 0x0) r10 = syz_genetlink_get_family_id$gtp(&(0x7f00000002c0), r1) sendmsg$GTP_CMD_ECHOREQ(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r10, 0x20, 0x70bd2a, 0x25dfdbfc, {}, [@GTPA_NET_NS_FD={0x8, 0x7, r5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x81) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r6, 0x0) 13.163120716s ago: executing program 4 (id=1209): r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x1) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x8) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) mprotect(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2) mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x42, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x2f00020b, 0x0, 0x0, 0x0, 0x0, 0x7515, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x4d) openat$audio(0xffffffffffffff9c, 0x0, 0x109842, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) syz_open_dev$vim2m(0x0, 0x0, 0x2) sched_setaffinity(0x0, 0xffffffffffffff15, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f00000007c0)={0x28, 0x4, 0x0, 0x0, &(0x7f0000561000/0x1000)=nil, 0x1000, 0x1004000}) r4 = syz_open_dev$vim2m(&(0x7f0000000080), 0x2, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000040)={0xc0, 0x1, 0x4, 0x0, 0x9}) ioctl$vim2m_VIDIOC_ENUM_FMT(r4, 0xc0405668, &(0x7f0000000140)={0x9, 0x1, 0x1, "0000087aba10fdfffffbe30b51751bc53051a30000000000000016ebffffff00", 0x34565559}) write$sndseq(0xffffffffffffffff, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='fd=', @ANYRESDEC=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) faccessat2(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x4, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 12.750921356s ago: executing program 0 (id=1210): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000400)='ramfs\x00', 0x2000000, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], &(0x7f00000001c0)='GPL\x00'}, 0x90) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_9p2000}]}}) write$P9_RVERSION(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r1, @ANYRESHEX=r2], 0x15) chdir(&(0x7f0000000140)='./file0\x00') creat(&(0x7f0000000240)='./bus\x00', 0x21) r3 = open(&(0x7f00000000c0)='./bus\x00', 0x1c113e, 0x40) r4 = open(&(0x7f0000000000)='./file0\x00', 0x143042, 0xfe) ftruncate(r4, 0x2008002) sendfile(r3, r4, 0x0, 0x80000001) 11.733816077s ago: executing program 0 (id=1214): add_key$fscrypt_provisioning(&(0x7f0000000280), 0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x8b}, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r2, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f0000000440)={r4, 0x0, 0x0, 0x0, 0x0, [0x0]}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000080)={r5, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r6}) syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x0) r7 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x22001) ioctl$BLKBSZSET(r7, 0x40081271, 0x0) 11.565937229s ago: executing program 1 (id=1216): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt$SO_J1939_PROMISC(r1, 0x6b, 0x2, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000340)={0x1d, r2, 0x0, {0x0, 0x0, 0x4}, 0xfe}, 0x18) r3 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r3, &(0x7f0000000340)={0x1d, 0x0, 0x1000, {0x2, 0xff, 0x4}, 0xfe}, 0x18) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) connect$can_j1939(r3, &(0x7f0000000100)={0x1d, 0x0, 0x3, {0x0, 0xf0, 0x2}, 0xfe}, 0x18) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmsg$inet(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000540)="81b641f1f3843704b6", 0x9}], 0x1}, 0x4048081) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@newtfilter={0x34, 0x11, 0x1, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x74, r2, {0x3, 0x8}, {0xfff1, 0xa}, {0x2, 0x8}}, [@TCA_CHAIN={0x8, 0xb, 0x9}, @TCA_RATE={0x6, 0x5, {0x8, 0x8}}]}, 0x34}, 0x1, 0xf0ffffffffffff, 0x0, 0x2400c840}, 0x4000850) 11.397386411s ago: executing program 3 (id=1217): connect$bt_rfcomm(0xffffffffffffffff, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(0x0, 0x0, 0x0) r0 = memfd_create(&(0x7f00000005c0)=' \xc76\xbe\x91\x8d\x182)!\x9a%\xa2\xd28\xd6\x06\a\x0e\xfc\xfe\x12\x8f&\x13\xae%@T\xa3\xb0>\\\xec\xa9\xf9Q@6A\x10\x8cn|\x00\x00\x00\x00\x00\x00\x00\x00r\xbb\xdd\xe8\x87\x05=\xfb\x8b}\xfc\x1d\x03\xe1\xfcm\x9b\xf7fo\"i\xa1hk\x1f\xf5z\xc1\x7f\xa4\\]\xc4\xbe3\xf9\xa8\t?:\xd8\xda\x84\xeepI[\x1c\x00\x00\x00\x00\xf9v\x00\x00\x00\x00\x00T\xb6\xbe\x0f~\xc0\x92\xe9O{\xa8\x81(\x01\x14\xfc\x83\xf9\xfb\x05\x94T\x81@Lq]\xf9\x15zj\x87\xc4\x8e\xe8/\xb9-&R\x8e\xb2\xb3bBx\x1e1\x18\x8f\x19\xf7]#\xed,\xc7\x11\tp\xf4\xa3\xee\x00\x00\x00\x00\'}\x18\xe8O\xa8#K\xb6\xe4U\x92\xd2\x9d\xb8?2\xc8\xe7kovd\xa4\x1bl+\x14\x17\x14\x17C2! U\x04:\xd93F\xb9\xfc\x1b\xfd}\x05\xf9\x11\xf3)>q\x10\xd3\xf0\xaf>\xf8t(bX\xe3g\x05\xfe\b\xbcy\x95*\xca\a\xaf\xbb\xf9\xc3Y\xa2\x91\x90.\xc8\xbe\xb0\xa6\xbd\xbd\xfd\xfaf*\xb2&\x82\xa0\x17\xe7)\xf5\xa2\xccv\n\x1b\xd4\xf4\x11*\xc9\xc6*\xa4.\x94[$\xb8\xb3Q\xde\xd8A\xa4~c,`\x02\xb8\x01r\x89\x82\x13\xd0}C7\xfb\xf2\tM\x1e\xe9\xa5\v\xc5\xba(\x89\xb0l\x92H\x1cR\x1f>\xc4ie\xe0B\xf0[\xe2\xe1\x12\x1d\x8fR&\xd1\xa6#\xda.\x0f\xd7\xd7\xa4\x90\x14\x92I\xf82&\x16<\xf2RR\xc2\x02.Q\xef\x85\xef\xf9\xe5\x00\xe9\xca\xb1\x8c\x11\x11l\x9f\xc8\b\xf7A\xa6\x81\xad\xdc\x95\xc8\xef\x102\xa8\x87\x01\x00\\\xfee \n0F\xbc\x85\xc5C\xd0\x99\xe4\t\xab`\'t\xc2\xe9\x13\xcag\xea\xb3\xb5\x92\x00J\xc6y\x05\xcc\xde\xa0\xf6\xb9 \xe5\xdd\f\x18\xfc\xe0\xc3(\xd8\xeb\x1a6\xe6\xfa\x93\xc07R\x0f-\x9e\xf3\x87E\xa3\xd5o\x1bA\x88L/\xe7>45Q?\be\x7f\xa9\x9a\xcae\xd8Y\xdf]\x1bS\x825\xcb\x00\xa4}\x97\x84T\xad\x9b\x1e!\x8a\xbc\x02+#Q\xa9 \xe9\x05r\xe1\xec\x0f\xa7\xe6Of\x95\x02{', 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x6, 0xc, &(0x7f00000008c0)=ANY=[@ANYBLOB], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x0, 0x0, 0x0, &(0x7f0000000100), 0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x9}, 0x50) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = accept4(r3, 0x0, 0x0, 0x0) ioctl$int_in(r4, 0x5452, &(0x7f0000000500)=0xd0) recvmsg$can_raw(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000780)=""/4096, 0x1000}], 0x1}, 0x40000003) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ftruncate(r0, 0x400000) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) syz_open_dev$MSR(&(0x7f0000000140), 0x0, 0x0) 11.062676188s ago: executing program 4 (id=1218): fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000080)) sendmsg$key(0xffffffffffffffff, &(0x7f0000000000)={0x400000000000000, 0x0, &(0x7f0000000080)={&(0x7f0000001280)=ANY=[@ANYBLOB], 0xd0}}, 0x0) ioperm(0x1, 0x9, 0x4) prctl$PR_SET_SECCOMP(0x16, 0xe7, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[], 0x2c}, 0x1, 0x0, 0x0, 0x40001}, 0x20008000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb4e02000) r0 = syz_clone(0x2000, 0x0, 0xff36, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, 0x0) ioctl$SYNC_IOC_MERGE(0xffffffffffffffff, 0xc0303e03, &(0x7f0000000040)={"6538535a2270f2bfb7a7624449262a0d764e59779d15ef996f25c5c3f2c04f8d"}) mount$nfs(0x0, &(0x7f0000000640)='.\x00', &(0x7f0000000680), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='ac', @ANYRES32]) mremap(&(0x7f0000000000/0x9000)=nil, 0x600a00, 0x200000, 0x3, &(0x7f0000a00000/0x600000)=nil) 10.634704422s ago: executing program 1 (id=1220): ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) r0 = mq_open(&(0x7f0000000040)='\xa3\\@.@{/!),^\x00', 0x2, 0x102, &(0x7f0000000080)={0x1fd, 0x7, 0x4}) mq_timedreceive(r0, &(0x7f00000000c0)=""/175, 0xaf, 0x7, &(0x7f0000000180)={0x77359400}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x24, r2, 0x20, 0x70bd28, 0x80000000, {}, [@NL80211_ATTR_WIPHY_TX_POWER_SETTING={0x8, 0x61, 0xc00000}, @NL80211_ATTR_TXQ_QUANTUM={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x40086}, 0x0) sendmsg$NL80211_CMD_SET_COALESCE(r1, &(0x7f0000000200)={0x0, 0xffffffffffffff8c, &(0x7f0000000b00)={&(0x7f0000000040)={0x28, r2, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r4}, @void}}}, 0x28}}, 0x0) r5 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) sched_setaffinity(0x0, 0xfffffffffffffdb1, &(0x7f0000000280)=0x6) r6 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000025300)=""/102392, 0x18ff8) r8 = creat(&(0x7f0000000000)='./file1\x00', 0xf8) fanotify_mark(0xffffffffffffffff, 0x105, 0x40009975, r8, 0x0) fallocate(r6, 0x0, 0x1000000, 0x3) r9 = syz_genetlink_get_family_id$gtp(&(0x7f00000002c0), r1) sendmsg$GTP_CMD_ECHOREQ(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r9, 0x20, 0x70bd2a, 0x25dfdbfc, {}, [@GTPA_NET_NS_FD={0x8, 0x7, r5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x81) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r6, 0x0) 10.161810206s ago: executing program 2 (id=1221): ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) mmap$fb(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x13, r2, 0xd8000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x4b, 0x0, &(0x7f0000000440)="97713b46fbaa2b1044f2d408ffca802db4d770eb9874f493e0ef367e4bde497c403b450c72ff2417d079bb892435a1e107fa5c0ecd207d9e6f2a209bf148e6bc56955cb53347d149909748"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000600)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000ac0)={0xc4, 0x0, &(0x7f00000008c0)=[@exit_looper, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000680)={@flat=@weak_handle={0x77682a85, 0x1, 0x1}, @fda={0x66646185, 0x8, 0x0, 0x27}, @fda={0x66646185, 0x3, 0x1, 0x7}}, &(0x7f00000005c0)={0x0, 0x18, 0x38}}, 0x40}, @clear_death={0x400c630f, 0x3}, @reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000800)={@fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x4, 0x1, 0x32}, @ptr={0x70742a85, 0x0, &(0x7f0000000700)=""/222, 0xde, 0x2, 0x2e}}, &(0x7f0000000880)={0x0, 0x18, 0x38}}}, @enter_looper], 0xf9, 0x0, &(0x7f00000009c0)="96b9006dcccdb5eeab4dd902ed97cf1bb46034cef24f60bf130daee1dd6d1e36e6e1d969ac868f1d000f3ab37e42845e627d4e3940424bfc7e87a509ea4ea54648806573f9f057bd3a73700c30f60db9ae5338052e518251e4d931981a6495d3d3603121c7cb3fd83ac63066888ea5d4ee90d9c2207b820b53a8ccdfda3574cfb86d1f3aba4224fc85d27c824e7355bb298d0c30f0403dd493483354fd422f2ab45c271dadfe07f898978530bd74221117f2576c28e93ca5a369736aad457377248a50e7412ca178ad5c6f5133fcb967a7aaab6af9bc75b485189a77cf994a27e93f25418ff7cb6069b510fb55f06a7e632180699efa31c439"}) 9.854836301s ago: executing program 3 (id=1222): r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x1) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x8) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) mprotect(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2) mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x42, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x2f00020b, 0x0, 0x0, 0x0, 0x0, 0x7515, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x4d) openat$audio(0xffffffffffffff9c, 0x0, 0x109842, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0xffffffffffffff15, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f00000007c0)={0x28, 0x4, 0x0, 0x0, &(0x7f0000561000/0x1000)=nil, 0x1000, 0x1004000}) r4 = syz_open_dev$vim2m(&(0x7f0000000080), 0x2, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000040)={0xc0, 0x1, 0x4, 0x0, 0x9}) ioctl$vim2m_VIDIOC_ENUM_FMT(r4, 0xc0405668, &(0x7f0000000140)={0x9, 0x1, 0x1, "0000087aba10fdfffffbe30b51751bc53051a30000000000000016ebffffff00", 0x34565559}) write$sndseq(0xffffffffffffffff, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='fd=', @ANYRESDEC=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) faccessat2(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x4, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 9.748944451s ago: executing program 4 (id=1223): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2381, 0x0) r0 = openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VIDIOC_S_SELECTION(0xffffffffffffffff, 0xc040565f, 0x0) unshare(0x28000600) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) pipe2(&(0x7f0000001040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RGETLOCK(r2, &(0x7f0000000140)=ANY=[], 0x553bd56e) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000480)=ANY=[@ANYRESDEC], 0x27) write$binfmt_script(r2, &(0x7f0000001d80)={'#! ', './file0'}, 0xb) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000000100)={{@local, 0x1fc}, @my=0x0, 0x2, 0xfbb, 0x100000001, 0x1, 0x8, 0x8001}) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) ppoll(&(0x7f0000000300)=[{0xffffffffffffffff, 0xc226}], 0x1, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000020c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000002100), 0x13f, 0x9}}, 0x20) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2, 0x40010, r3, 0x6d530000) 9.38300566s ago: executing program 0 (id=1224): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000400)='ramfs\x00', 0x2000000, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], &(0x7f00000001c0)='GPL\x00'}, 0x90) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_9p2000}]}}) write$P9_RVERSION(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r1, @ANYRESHEX=r2], 0x15) chdir(&(0x7f0000000140)='./file0\x00') creat(&(0x7f0000000240)='./bus\x00', 0x21) r3 = open(&(0x7f00000000c0)='./bus\x00', 0x1c113e, 0x40) r4 = open(&(0x7f0000000000)='./file0\x00', 0x143042, 0xfe) ftruncate(r4, 0x2008002) sendfile(r3, r4, 0x0, 0x80000001) 9.379496126s ago: executing program 2 (id=1225): r0 = socket$can_bcm(0x1d, 0x2, 0x2) close_range(r0, r0, 0x0) io_setup(0x9, &(0x7f0000000240)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x16, 0x16, &(0x7f0000000c80)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf67000000000000150700000fff07003506000002000000170600000ee50000bf250000000000002d35ffff000000006507000002000000070700004c0001fa0f75000000000000bf54000000000000070400000400f9ff3d1401000000000095000000000000000500000000000000950007000000000001722fabb733a0c857c7c4e704000000000000a04d1ffc187fa1a2ba7ba0c0d507b92de00435fd233cc0f0d9b2c312b68856656ca9caa2ee4dc258d72e690098804de235cf020e35245c9f5526d35df627a64ac7efde50fd7f1d8bae66ea38541a7cd29032de94983dfab0e5043daf1b46bef5135c65377bdbe65d525743d88ef4b2ee62652b07f8a4b6e6155cecc13a5ddfab726eca91bd5fecb254ab358488c400330171128be291297947d474c570a385a459db8e7ada8ee987cc0000f6f902b261848d74096636ab6d8c63c8d62861cbc38d1e6bef45e672ac3d3d5243b85b3b15c7499ff39a3dadcbfbea9e050fb6940344dfbeebbf3e7e37d0a9a387518f926fba75479eacd4f51aeb28b6c56a75144ef6df55a275799897ca000000000000000000a514ad9d503919cfea82333ab7ff531d96c8d0d65f162f858995"], &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, &(0x7f0000000040), 0x1f1, 0x10, &(0x7f0000000400)={0x5}, 0x19f, 0x0, 0xffffffffffffffff, 0xfffffffffffffdcb}, 0x48) bind$bt_hci(r2, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r2, &(0x7f0000000040)=ANY=[], 0x6) 9.161867998s ago: executing program 2 (id=1226): openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000700), 0x2, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r0, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, 0xffffffffffffffff, 0x0}]) 8.960085025s ago: executing program 1 (id=1227): socket$inet_tcp(0x2, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x1fe, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) r4 = socket$kcm(0x10, 0x2, 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="00240000000000000002000000200000f8ff0000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000002780)=[{&(0x7f0000002580)="89000000120081ae08060cdc030000007f03e3f7000000026ee2ffca1b1f1400000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec001210000140090c0c00bdad446b9bbc7a46e39882a5dcdf12741308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20f", 0x86}, {&(0x7f0000002700)="d6f4de", 0x3}], 0x2, 0x0, 0x0, 0xff0f0000}, 0x0) ioctl$DRM_IOCTL_MODE_CURSOR(r2, 0xc01c64d0, &(0x7f0000000280)={0x2, r3, 0x800, 0x0, 0xfffffffd, 0x0, 0x2}) 8.927626438s ago: executing program 3 (id=1228): r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00'}) io_uring_setup(0x68f4, &(0x7f00000002c0)={0x0, 0x48c7, 0x1008, 0x0, 0x1000168}) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000006040), 0x0, 0x0) socket$netlink(0x10, 0x3, 0x4) ioprio_set$uid(0x3, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x100) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r2 = open(&(0x7f0000000280)='./file0\x00', 0x1e5242, 0x1df2a23c5997fa0b) write$FUSE_CREATE_OPEN(r2, &(0x7f0000000180)={0xa0, 0x0, 0x0, {{0x4, 0x0, 0xfb0, 0x3, 0x3, 0xfffffffd, {0x400000080001, 0xfd, 0x20ff, 0x8, 0xe, 0xd615, 0x9, 0x3, 0xfffffffc, 0x6000, 0x0, 0x0, 0x0, 0x5, 0x7}}, {0x0, 0x13}}}, 0xa0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r1, 0xc01864c1, &(0x7f0000001300)={0x0, 0x1, 0xffffffffffffffff}) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r2, 0xc018937d, &(0x7f0000001380)={{0x1, 0x1, 0x18, r3}, './file2\x00'}) r4 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0301, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r4, 0xc004500a, &(0x7f0000001340)) ioctl$SNDCTL_DSP_CHANNELS(r4, 0xc0045006, &(0x7f0000000180)=0x6f) sendfile(r2, r2, &(0x7f0000000080), 0x7f03) 8.683688863s ago: executing program 2 (id=1229): socket(0x400000000010, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYRES32], 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet(0x2b, 0x801, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r4 = dup(r3) r5 = syz_io_uring_setup(0x239, &(0x7f0000000740)={0x0, 0x1c2a, 0x10100, 0x0, 0x0, 0x0, r4}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r3, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r5, 0x2ded, 0x4000, 0x0, 0x0, 0x0) msgrcv(0x0, 0x0, 0x0, 0x1, 0x3000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) 8.527499412s ago: executing program 3 (id=1230): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000101e040031000022000001090224000100000000090400000103000000092100000001220500090581030002"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x24008004) prlimit64(0x0, 0xe, &(0x7f0000000300)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) msgsnd(0x0, &(0x7f0000001180)=ANY=[@ANYBLOB="0102000000070000"], 0x8, 0x0) r2 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) ioctl$DVB_DEMUX_DMX_ADD_PID(r2, 0x40026f33, &(0x7f0000000100)=0x808c) r3 = add_key(&(0x7f0000000300)='id_legacy\x00', &(0x7f0000000180)={'syz', 0x1}, &(0x7f0000000200)='u', 0x1, 0xfffffffffffffffe) keyctl$read(0xb, r3, &(0x7f0000000240)=""/112, 0x349b7f55) r4 = syz_usb_connect$printer(0x5, 0x36, &(0x7f0000000200)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x5, 0x0, 0x1, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x7, 0x1, 0x3, 0x7, "", {{{0x9, 0x5, 0x1, 0x2, 0x40, 0x10, 0xa4, 0x7}}, [{{0x9, 0x5, 0x82, 0x2, 0x40, 0x4, 0xa, 0xc}}]}}}]}}]}}, &(0x7f0000000b40)={0xa, &(0x7f0000000340)={0xa, 0x6, 0x201, 0x0, 0x6, 0x1, 0x20, 0x8}, 0x4a, &(0x7f0000000580)={0x5, 0xf, 0x4a, 0x5, [@wireless={0xb, 0x10, 0x1, 0x8, 0x2, 0x1, 0x7, 0xfa, 0x8e}, @wireless={0xb, 0x10, 0x1, 0xc, 0x42, 0x4, 0xf8, 0xa, 0x4}, @ss_container_id={0x14, 0x10, 0x4, 0x8, "5e3d52d5ead54273333945d5e9630a7b"}, @ss_container_id={0x14, 0x10, 0x4, 0x6, "f7ce93308177a68ae9d7fb66905d0681"}, @ext_cap={0x7, 0x10, 0x2, 0x4, 0x5, 0x4, 0xdab}]}, 0x9, [{0x40, &(0x7f0000000380)=@string={0x40, 0x3, "50cc2e624ee3c26143d04db9469349fbb37470b7c27e0239aef3cc57437a6148cd2d8cfcf79648fe5cddefad859bd4de1abadd06646fd2b444ebcbf64800"}}, {0xed, &(0x7f0000000600)=@string={0xed, 0x3, "77dfdba1d0575669898ce2bbe5a6335c47e9cb2a59c5e01ccc7ff9b0a70dcf531459bb85c857f132a9001b5b1b7513d8ba1628d208b783d895d452e24ab8d08857662e058a7a59df3de4a6b9fbd593951ef38a1df3c5f089098e447e96c278370f01ccb717a6fac296fdb663841ef92df668b6d34d2bc00845a9a570c8996d2b2874d52208bc336f4526eb5c4bea6aafdfe3de6cb870f57cb42432966f0688971e83a6a481336ba9d5f9161b6028429ad360ad0a42a09464725a2f5fd7321829717b016ce19c383f64c25a2090957450404ef8f46df0707fd9b7d4a862fa7c674478d07b89da1989ac83b6"}}, {0x4, &(0x7f0000000700)=@lang_id={0x4, 0x3, 0x44a}}, {0xae, &(0x7f0000000740)=@string={0xae, 0x3, "86978bc2327565f734835554c421629bd1ebea2834fbad70147fc70806f6e58442cd3c79f47753597b0b37fc0e58f724200b0ab65ea8907c7d59c13527eee5d8674c32c4557fd9dc6b6fe0d0d961728877379ed1b5eac99d6e90c0c2065a85a9b2a3dc9c402748c554aec0d6d1ed7150ea5a8bef3578c3fb7e87f3d14fb21ab3dd789186943f6410c79452cabd9b7669bc37dee78d31be8cd29b3c115ccf4c52351adde48b1380710ee9fccb"}}, {0xdb, &(0x7f0000000800)=@string={0xdb, 0x3, "96761758a160cae776d16f7409407e50189c120774a65dc202f0a21b61d26e33c5f5d1cb78b7d92de5c8304aa9cc16f4f498c8dcbdc300adf67a6bb7c474873ec957547bfa08adc625509b6cdc3c4764ab0b51bf13955bb22537951829eea72f263c10b71b3badc484aff5fc5050ee70536ae089fd3a64c87a644cf66b54d9a7e5859e8a323a0b9d542e80a8b3d1d7f95ecfffd60ea123f1c44b874e311e842dd6c3292172db1baebb8529bdd73ed1443cbc2369c8fdeaa4805d8637a2e1fc5600080c662922e22e6b880b08bf9d18ca15ca76586f2e286a08"}}, {0x77, &(0x7f0000000900)=@string={0x77, 0x3, "0a38e30bcfab3a87af9b7f85da6d0ce0e56e7e203f0f74bce0130845a22493788bd5d6cd8ffa1ac932cd7b46a27f1abe87193fec86ff21e7e6df61a9ee097f75d6f796f6125fa9052a09e2e0fc1e998417a5bb5f85fd16751e27a1c752f359bf7eef1eb127080e02a81f4b98612a4a9aa3e03faebf"}}, {0x3e, &(0x7f0000000980)=ANY=[@ANYBLOB="3e039e1dccaee7baf082e1c89817b40c002ab1bcdb68d26979d7f9ead0baa083114b9a5af79dd9667751bccf0c8baa454b575bf55eeeb58c446449469856"]}, {0xe6, &(0x7f00000009c0)=@string={0xe6, 0x3, "e26d97d196c420844c60d47758ab5ac460ca29d6f27a2e93410bc462865c97d8d34f3111daeede39d9a22f27e55864756efe2447668d2d87663e243d8200de7c7c5d39a3851a60b6c138d62081d400ffaaa6c4ca8302f610e39f2f3d9301ba618b06ef66ab466e536de6b6be11c55e857d819806652aeefe34887aaa2c3a4111f8212a067850072fd8039977763599abe15de89dc058318f89d50e8899f3e8693bd17632c6db34fa8162f33d6c8b4833aafa3d04634f290cd124398e0c942183192e35942c2747e6c977b5c61775696a1415ee3c22f0fb6ed3f964ab1f28cd16ecb4ad7e"}}, {0x5e, &(0x7f0000000ac0)=@string={0x5e, 0x3, "0abee0a285193beb797f4d28e782338e46b067d56768084b045170caa57a01cca2139decd1ff80efcd07bd333d720068e9f86c25376b41b6768602bfef1c69d6c36747d519a297449d57ff260d2b3ecdaa2c0d0fb0e292c93ee86370"}}]}) syz_usb_control_io$printer(r4, &(0x7f0000000dc0)={0x14, &(0x7f0000000c00)={0x40, 0x9, 0xff, {0xff, 0x22, "eb38b01f08d5f78f7624f16ff14b19b4217a3dba63595f06ddd60f478c182382843f97aaa2d928dac3482afddf1f3e070ceb5434918611555d244063aa360f37ed1ffaedce10cfe564c115eaabc4a4eb63697395a4b9c320a383e9c1abe33fa7c1a379a1a203b2296b5b3bf09c6197dcdafee39fb433a9d5c6eeff60d1b4aeebaf6026b6fdb5e7ff5b48ccbe04f7bb97c7f204ca0bc4542453d7f8ccb0cb17084ce1a36943ddb8fa37628d40d24082a70122acf7d870e36a1128979cb39a143f1de10b50d271f5712c1f0c9ab5a5ee2df5e130810f204cf095f27252eed52869f362c19321e7582aed31c995f5d88d857dfa9cb7b8b755fc3aeebf9dd7"}}, &(0x7f0000000d40)={0x0, 0x3, 0x69, @string={0x69, 0x3, "4dc7a2c93a09bb1d57b1a2227e6cbd3899849760815254d6ee1a45e4c647486286021ceab5f6deb0254058670602bc5ee2c7d188318d5031474e4445ac6b8f722a78711387efd2d9817a072f506feeaf58d00d50e5d0e40e67dab52ec69afb4609a2d238bb7d82"}}}, &(0x7f0000001000)={0x34, &(0x7f0000000e00)={0x40, 0x13, 0xfffffffffffffd10, "c810aee8dcd4f6028b86da0f875d49e06eeae7be1029674905b61a87"}, &(0x7f0000000e40)={0x0, 0xa, 0x1, 0x4}, &(0x7f0000000e80)={0x0, 0x8, 0x1, 0xf3}, &(0x7f0000000ec0)={0x20, 0x0, 0xd, {0x91, "1352a4b83d8e8fa86eff76a74c02cd4497a7b068012ee25cca443690abb3d347e686e40404ed2b57cc31dfc25b26e758c116eae75fdc4134fbd6d896e99cc8da952d2e491a0681a61fd071096451fe21a135a601941667b116bddc5bc113c3ab038c1f1f5d473e402f677c93fe4ed73eebb474c9baf9882415e5e0947fd4a63005aacecbc208cb5cf1da34002f1e0cc9ce"}}, &(0x7f0000000f80)={0x20, 0x1, 0x1, 0x8}, &(0x7f0000000fc0)={0x20, 0x0, 0x1, 0x10}}) 8.423678465s ago: executing program 4 (id=1231): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) recvmmsg(0xffffffffffffffff, &(0x7f0000001080)=[{{0x0, 0x0, &(0x7f0000000c40)=[{0x0}, {&(0x7f0000000b40)=""/36, 0x24}, {0x0}, {0x0}], 0x4}}], 0x1, 0x40, 0x0) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424d", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1d19cb307b3472ab9cdb042d2", "643fcbb2c5a57df67d074af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x5, 0x0, 0x0, 0x60ff78ce1cb3c070}, 0x94) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x4) r3 = syz_io_uring_setup(0x497, &(0x7f0000000000)={0x0, 0x708a, 0x800, 0x20000003, 0x37d}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_STATX={0x15, 0x40, 0x0, 0xffffffffffffffff, &(0x7f0000000980), &(0x7f0000000a80)='./file0\x00', 0x800, 0x2000, 0x1}) io_uring_enter(r3, 0x3516, 0x0, 0x0, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000200)={r1, r2, 0x25, 0x6, @void}, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) recvmmsg(r0, &(0x7f0000000940)=[{{0x0, 0x0, &(0x7f0000000540), 0x2}, 0x3}], 0x4000048, 0x0, 0x0) 7.965722598s ago: executing program 0 (id=1232): r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00'}) io_uring_setup(0x68f4, &(0x7f00000002c0)={0x0, 0x48c7, 0x1008, 0x0, 0x1000168}) openat$rfkill(0xffffffffffffff9c, &(0x7f0000006040), 0x0, 0x0) socket$netlink(0x10, 0x3, 0x4) ioprio_set$uid(0x3, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x100) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r1 = open(&(0x7f0000000280)='./file0\x00', 0x1e5242, 0x1df2a23c5997fa0b) write$FUSE_CREATE_OPEN(r1, &(0x7f0000000180)={0xa0, 0x0, 0x0, {{0x4, 0x0, 0xfb0, 0x3, 0x3, 0xfffffffd, {0x400000080001, 0xfd, 0x20ff, 0x8, 0xe, 0xd615, 0x9, 0x3, 0xfffffffc, 0x6000, 0x0, 0x0, 0x0, 0x5, 0x7}}, {0x0, 0x13}}}, 0xa0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r1, 0xc018937d, &(0x7f0000001380)={{0x1, 0x1, 0x18}, './file2\x00'}) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0301, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r3, 0xc004500a, &(0x7f0000001340)) ioctl$SNDCTL_DSP_CHANNELS(r3, 0xc0045006, &(0x7f0000000180)=0x6f) read$dsp(0xffffffffffffffff, &(0x7f00000002c0)=""/4096, 0x1000) write$dsp(r3, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb62", 0x1c) pselect6(0x40, &(0x7f0000000240)={0x4bf, 0x0, 0x1ff, 0x7d, 0x9979, 0x8000, 0x1000, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x3, 0x0, 0x2400000000000000, 0x80000006}, 0x0, 0x0) sendfile(r1, r1, &(0x7f0000000080), 0x7f03) 7.432764924s ago: executing program 2 (id=1233): fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000080)) sendmsg$key(0xffffffffffffffff, &(0x7f0000000000)={0x400000000000000, 0x0, &(0x7f0000000080)={&(0x7f0000001280)=ANY=[@ANYBLOB], 0xd0}}, 0x0) ioperm(0x1, 0x9, 0x4) prctl$PR_SET_SECCOMP(0x16, 0xe7, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[], 0x2c}, 0x1, 0x0, 0x0, 0x40001}, 0x20008000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb4e02000) r0 = syz_clone(0x2000, 0x0, 0xff36, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, 0x0) ioctl$SYNC_IOC_MERGE(0xffffffffffffffff, 0xc0303e03, &(0x7f0000000040)={"6538535a2270f2bfb7a7624449262a0d764e59779d15ef996f25c5c3f2c04f8d"}) mount$nfs(0x0, &(0x7f0000000640)='.\x00', &(0x7f0000000680), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='ac', @ANYRES32]) mremap(&(0x7f0000000000/0x9000)=nil, 0x600a00, 0x200000, 0x3, &(0x7f0000a00000/0x600000)=nil) 7.271790735s ago: executing program 0 (id=1234): add_key$fscrypt_provisioning(&(0x7f0000000280), 0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x8b}, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r2, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f0000000440)={r4, 0x0, 0x0, 0x0, 0x0, [0x0]}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000080)={r5, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r6}) syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x0) r7 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x22001) ioctl$BLKBSZSET(r7, 0x40081271, 0x0) 7.271147671s ago: executing program 1 (id=1235): ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) mmap$fb(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x13, r2, 0xd8000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x4e, 0x0, &(0x7f0000000440)="97713b46fbaa2b1044f2d408ffca802db4d770eb9874f493e0ef367e4bde497c403b450c72ff2417d079bb892435a1e107fa5c0ecd207d9e6f2a209bf148e6bc56955cb53347d1499097488fcad7"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000600)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000ac0)={0xc4, 0x0, &(0x7f00000008c0)=[@exit_looper, @acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000680)={@flat=@weak_handle={0x77682a85, 0x1, 0x1}, @fda={0x66646185, 0x8, 0x0, 0x27}, @fda={0x66646185, 0x3, 0x1, 0x7}}, &(0x7f00000005c0)={0x0, 0x18, 0x38}}, 0x40}, @clear_death={0x400c630f, 0x3}, @reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000800)={@fd={0x66642a85, 0x0, r1}, @fda={0x66646185, 0x4, 0x1, 0x32}, @ptr={0x70742a85, 0x0, &(0x7f0000000700)=""/222, 0xde, 0x2, 0x2e}}, &(0x7f0000000880)={0x0, 0x18, 0x38}}}, @enter_looper], 0xf9, 0x0, &(0x7f00000009c0)="96b9006dcccdb5eeab4dd902ed97cf1bb46034cef24f60bf130daee1dd6d1e36e6e1d969ac868f1d000f3ab37e42845e627d4e3940424bfc7e87a509ea4ea54648806573f9f057bd3a73700c30f60db9ae5338052e518251e4d931981a6495d3d3603121c7cb3fd83ac63066888ea5d4ee90d9c2207b820b53a8ccdfda3574cfb86d1f3aba4224fc85d27c824e7355bb298d0c30f0403dd493483354fd422f2ab45c271dadfe07f898978530bd74221117f2576c28e93ca5a369736aad457377248a50e7412ca178ad5c6f5133fcb967a7aaab6af9bc75b485189a77cf994a27e93f25418ff7cb6069b510fb55f06a7e632180699efa31c439"}) 7.148177619s ago: executing program 1 (id=1236): r0 = socket$can_bcm(0x1d, 0x2, 0x2) close_range(r0, r0, 0x0) io_setup(0x9, &(0x7f0000000240)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x16, 0x16, &(0x7f0000000c80)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf67000000000000150700000fff07003506000002000000170600000ee50000bf250000000000002d35ffff000000006507000002000000070700004c0001fa0f75000000000000bf54000000000000070400000400f9ff3d1401000000000095000000000000000500000000000000950007000000000001722fabb733a0c857c7c4e704000000000000a04d1ffc187fa1a2ba7ba0c0d507b92de00435fd233cc0f0d9b2c312b68856656ca9caa2ee4dc258d72e690098804de235cf020e35245c9f5526d35df627a64ac7efde50fd7f1d8bae66ea38541a7cd29032de94983dfab0e5043daf1b46bef5135c65377bdbe65d525743d88ef4b2ee62652b07f8a4b6e6155cecc13a5ddfab726eca91bd5fecb254ab358488c400330171128be291297947d474c570a385a459db8e7ada8ee987cc0000f6f902b261848d74096636ab6d8c63c8d62861cbc38d1e6bef45e672ac3d3d5243b85b3b15c7499ff39a3dadcbfbea9e050fb6940344dfbeebbf3e7e37d0a9a387518f926fba75479eacd4f51aeb28b6c56a75144ef6df55a275799897ca000000000000000000a514ad9d503919cfea82333ab7ff531d96c8d0d65f162f858995"], &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, &(0x7f0000000040), 0x1f1, 0x10, &(0x7f0000000400)={0x5}, 0x19f, 0x0, 0xffffffffffffffff, 0xfffffffffffffdcb}, 0x48) bind$bt_hci(r2, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r2, &(0x7f0000000040)=ANY=[], 0x6) 7.057456928s ago: executing program 4 (id=1237): r0 = syz_open_dev$video(&(0x7f0000000000), 0x485, 0x40000) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) r1 = socket$kcm(0x2, 0x200000000000001, 0x106) prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(0xffffffffffffffff, 0x0, 0x4040800) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$kcm(0x29, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001000)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef42d430f6296b72a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed40000000022278d00031e5388ee5c867ddd58211d6ece3ccb0cd2b6d3cffd962867a3a2f624f992daa94a6a556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff020000000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409e011f1264d43f153b3d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7000026a4e739c60f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf3f704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eedd9068ca1457870eb30d219e23ccc8e06dddeb61799257ab5000013c86ba99523d61a00000000c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb8629aeec90e6d1857da822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae200f279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522e8dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87995b51cb6febd5f34a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724be3733c26f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be10ba7dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2db484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b00ffffff7f000000000801f71d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cf0d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67856ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e2b8e7370baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b09000000d31df213c802d74797056fd3bca8b2d6cb134437cba0193ba4360bdcc98aad2560aa48291c4eb9d4e08ad7a9c5f04be1ab597124d84dfc7bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b8dd4221fff0f0000705d7257ff7f76c78ba0b44ec0bdfa0d32d7042059b13a079639f14f9032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e0caac037209d2f14fcddd00000000000000000000000000000000e609893bdce015e8ccfb36399844db61f6171b0b0e845e48728450c6ba4f7098f8e000676b59ab9f851f3ab77847ce05c89411277ec69c409b7ec50a3337a78675f38a568612c235ab5f2cd6d035d5f5f6a693c381adbbf7b37e37292783b2c7efe7d3a067906552f76d419e0300000000000000000000008f3a20b49fe7636806867283e35cff8d00e7b251bab3cf6377a24f8e8d4bda7503674bc94bf7f4d2fa6f25944bf0a186436d9f6831995976328a1fdc78492c65c1434855dc35c3cf7cf9610c5387794443c99b304799114132362849c3fa85d6379729ff9094933db0cfbe8887c50b87e1469fdf454cef4cbc5f7bf384000000000000a4e8c1a25f47c440144a9776be6cb40aafdb9d3cc8f6a6050974e1c4000000000000008b753f4e1bef9556efcc087a99dbf231167013a4b2eaf6338a0b100c"], 0x0}, 0x94) ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x89e0, 0x0) sendmsg$kcm(r1, &(0x7f0000001900)={0x0, 0x0, 0x0}, 0x20040000) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) sendmsg$inet(r1, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @local}, 0xfc, 0x0}, 0x30004001) accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x100000) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000002400010026bd7000fcdbdf5fcad1086311af22be00"/39], 0x14}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) ioctl$VIDIOC_S_INPUT(r0, 0xc0045627, &(0x7f0000000080)=0x2) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r5, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000380)=@ethtool_dump={0x3e, 0x7f, 0xb5d, 0xad, "63d43c664d9dff384fd1041b95e850c76af58b02433eb98788fe7cc75f0b337a8df438064aefaa4da1333ae999f7fbbffe5488237db51cdb3ea17ac5d69ef1a14242c48f45d287af6c9587b59937e9747991346043144ce6280e8cd7980a89992dee0881431dbe35aa0de9f7cadcd4f8937460126c5e2994138fbfb718d19efd06e608d790709ca294b03701cb49772a552fe8070f7e10bb9fdeebdfc6bd401e413941f91012d4cf2a86d42b0a"}}) r6 = getpgrp(0x0) sched_setaffinity(r6, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) syz_io_uring_complete(0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) 6.649499477s ago: executing program 1 (id=1238): ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) r0 = mq_open(&(0x7f0000000040)='\xa3\\@.@{/!),^\x00', 0x2, 0x102, &(0x7f0000000080)={0x1fd, 0x7, 0x4}) mq_timedreceive(r0, &(0x7f00000000c0)=""/175, 0xaf, 0x7, &(0x7f0000000180)={0x77359400}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x24, r2, 0x20, 0x70bd28, 0x80000000, {}, [@NL80211_ATTR_WIPHY_TX_POWER_SETTING={0x8, 0x61, 0xc00000}, @NL80211_ATTR_TXQ_QUANTUM={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x40086}, 0x0) sendmsg$NL80211_CMD_SET_COALESCE(r1, &(0x7f0000000200)={0x0, 0xffffffffffffff8c, &(0x7f0000000b00)={&(0x7f0000000040)={0x28, r2, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r4}, @void}}}, 0x28}}, 0x0) r5 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) sched_setaffinity(0x0, 0xfffffffffffffdb1, &(0x7f0000000280)=0x6) r6 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000025300)=""/102392, 0x18ff8) r8 = creat(&(0x7f0000000000)='./file1\x00', 0xf8) fanotify_mark(0xffffffffffffffff, 0x105, 0x40009975, r8, 0x0) fallocate(r6, 0x0, 0x1000000, 0x3) r9 = syz_genetlink_get_family_id$gtp(&(0x7f00000002c0), r1) sendmsg$GTP_CMD_ECHOREQ(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r9, 0x20, 0x70bd2a, 0x25dfdbfc, {}, [@GTPA_NET_NS_FD={0x8, 0x7, r5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x81) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r6, 0x0) 6.610924722s ago: executing program 2 (id=1239): openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000700), 0x2, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r0, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, 0xffffffffffffffff, 0x0}]) 5.675589989s ago: executing program 0 (id=1240): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) pivot_root(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000400)='./file0\x00') recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet6(0xa, 0x400000000001, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20004048, &(0x7f00000001c0)={0xa, 0x4e20, 0x80000, @ipv4={'\x00', '\xff\xff', @loopback}, 0x4}, 0x1c) getsockopt$inet6_int(r2, 0x29, 0x18, 0x0, &(0x7f0000000040)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$vimc1(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=@gettaction={0x84, 0x32, 0x1, 0x70bd29, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x30, 0x1, [{0x10, 0x5, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'csum\x00'}}, {0x10, 0x17, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}, {0xc, 0x7, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x478000}}]}, @action_gd=@TCA_ACT_TAB={0x40, 0x1, [{0xc, 0x1, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0x10, 0x8, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'csum\x00'}}, {0xc, 0x25, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0x14, 0x4, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}]}]}, 0x84}}, 0x0) listen(0xffffffffffffffff, 0x0) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r6, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x4040}, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r5, 0xc04064a0, &(0x7f0000000040)={0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0xfffffd52, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR(r3, 0xc01c64a3, &(0x7f0000000280)={0x3, r7, 0x1, 0xffff, 0xa, 0x1ff, 0x1}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1, 0x4, &(0x7f00000000c0)=ANY=[], &(0x7f0000000040)='GPL\x00'}, 0x94) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x2, 0x0) sendmsg$unix(r9, &(0x7f0000000480)={&(0x7f0000000040)=@abs={0x0, 0x0, 0x4e20}, 0x6e, &(0x7f0000000240)=[{0x0}, {&(0x7f00000002c0)="c7934c2b8cb65b8c23a498c85d99e9882c0d3f090eb7b6464a188a6ca1063ebadb5174c27bc50eb4371c14763aa6c0f112a8cc72189a784b87bae2d958275336903661a0a591032beaf89091f5891cdfd0665e179b3314318cc59e9cfb071cc1d619147383bf86365e5983ca5d62e9ce64e72b100f3b2da44e33f9a23e71824a9d61afa13b6047a6a58eb2941cab19beefc368799df927217159207eb522fac33985454af74673e3e7fc20c6d29fc50e0723f9e0b92118dc7b6626c632c11dc5feffeb954570970df8f835580fd6", 0xce}, {&(0x7f00000001c0)="e7d80a430bd1407c7af58bfe09ff3e85b5409b1a718914c0196bb94b10e8b9f51a09dffd38f7e180465edefc1f68c436536dfee9b29796cf256dd33da3ad9417e5551481a27d31b24ea84362356695bf37b4d85ad1124b", 0x57}, {&(0x7f00000003c0)="96b773bf2015cb898f690deabd19147918e364b75cf349916c1331ff5f4e6600ba6aaca9d6f0f69db5b97b272c1c55c7695fe4b5ec690f81c7a0997697d8c23dbdbc1c5f2575232acda013c3b2b6ee882444320d55ca0f6abc658a45cb33", 0x5e}], 0x4, 0x0, 0x0, 0x20000000}, 0x80) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="6c00000010004b0429bd7000faffffff7a000000", @ANYRES32=0x0, @ANYBLOB="08b0010006820000400012800b0001006272696467650000300002800c002200000000040000000005002400010000000600080088a80000080005000100000005002b00050000000a000100aa"], 0x6c}, 0x1, 0x0, 0x0, 0x40001}, 0x20000000) 0s ago: executing program 3 (id=1241): syz_open_dev$sndpcmp(0x0, 0x0, 0xa2c65) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100002eab5a40401c3405cc6d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000004c0)={0x1c, &(0x7f0000000400)={0x40, 0x12, 0x4, "dd3e97d5"}, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f0000000200)={0x40, 0x11}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0xfd}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000340)={0x20, 0x81, 0x1, "84"}, &(0x7f0000000380)={0x20, 0x82, 0x2, "6fa8"}, &(0x7f00000003c0)={0x20, 0x83, 0x2, "9d6b"}, &(0x7f0000000440)={0x20, 0x84, 0x3, "fb8f7b"}, &(0x7f0000000480)={0x20, 0x85, 0x3, "31e0ec"}}) kernel console output (not intermixed with test programs): pid=8534 comm="syz.1.665" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fbd6c19c42b code=0x7ffc0000 [ 270.817393][ T8574] 9pnet: p9_errstr2errno: server reported unknown error 0x00000000 [ 270.834892][ T5816] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 271.661222][ T8594] binder: BINDER_SET_CONTEXT_MGR already set [ 271.667418][ T8594] binder: 8593:8594 ioctl 4018620d 2000000000c0 returned -16 [ 271.675065][ T9] usb 1-1: new full-speed USB device number 18 using dummy_hcd [ 271.684870][ T8594] binder: BINDER_SET_CONTEXT_MGR already set [ 271.691029][ T8594] binder: 8593:8594 ioctl 4018620d 200000000040 returned -16 [ 271.704447][ T8594] binder: 8593:8594 ioctl c0306201 200000000240 returned -11 [ 271.746158][ T5797] buffer_io_error: 38 callbacks suppressed [ 271.746174][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 271.765595][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 271.784933][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 271.794345][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 271.802880][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 271.810947][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 271.819111][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 271.827292][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 271.839470][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 271.848487][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 271.870163][ T792] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 271.878822][ T29] audit: type=1400 audit(1772469042.271:530): avc: denied { write } for pid=8597 comm="syz.3.682" name="file0" dev="fuse" ino=64 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 271.903108][ T8598] mtd partition "" doesn't have enough space: 0x20003 < 0x2001f, disabled [ 271.915015][ T9] usb 1-1: config 0 has an invalid interface number: 3 but max is 2 [ 271.920609][ T8598] ftl_cs: FTL header not found. [ 271.934455][ T9] usb 1-1: config 0 has an invalid interface number: 176 but max is 2 [ 271.960763][ T9] usb 1-1: config 0 has no interface number 1 [ 271.967151][ T29] audit: type=1400 audit(1772469042.271:531): avc: denied { open } for pid=8597 comm="syz.3.682" path="/147/file0/file0" dev="fuse" ino=64 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 271.981027][ T9] usb 1-1: config 0 has no interface number 2 [ 272.010454][ T29] audit: type=1400 audit(1772469042.291:532): avc: denied { ioctl } for pid=8597 comm="syz.3.682" path="/147/file0/file0" dev="fuse" ino=64 ioctlcmd=0x1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 272.067165][ T9] usb 1-1: New USB device found, idVendor=05c6, idProduct=9205, bcdDevice=29.ac [ 272.077414][ T792] usb 5-1: Using ep0 maxpacket: 8 [ 272.097092][ T792] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 272.109003][ T792] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 272.121166][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 272.144270][ T792] pvrusb2: Hardware description: Terratec Grabster AV400 [ 272.152448][ T792] pvrusb2: ********** [ 272.156548][ T9] usb 1-1: config 0 descriptor?? [ 272.168282][ T792] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 272.179670][ T792] pvrusb2: Important functionality might not be entirely working. [ 272.190379][ T792] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 272.202398][ T792] pvrusb2: ********** [ 272.245303][ T8604] netlink: 4 bytes leftover after parsing attributes in process `syz.3.684'. [ 272.312685][ T5885] usb 2-1: USB disconnect, device number 16 [ 272.904895][ T9] usb 1-1: Could not set interface, error -71 [ 272.914806][ T2341] pvrusb2: Invalid write control endpoint [ 272.935939][ T9] usb 1-1: USB disconnect, device number 18 [ 273.028365][ T2341] pvrusb2: Invalid write control endpoint [ 273.039419][ T2341] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 273.076079][ T2341] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 273.089774][ T2341] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 273.120392][ T2341] pvrusb2: Device being rendered inoperable [ 273.135834][ T2341] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 273.306691][ T2341] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 273.761443][ T2341] pvrusb2: Attached sub-driver cx25840 [ 273.823418][ T5885] libceph: connect (1)[c::]:6789 error -101 [ 273.837250][ T5885] libceph: mon0 (1)[c::]:6789 connect error [ 273.919017][ T2341] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 273.960489][ T2341] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 275.109253][ T5885] libceph: connect (1)[c::]:6789 error -101 [ 275.115983][ T5885] libceph: mon0 (1)[c::]:6789 connect error [ 275.193668][ T8616] ceph: No mds server is up or the cluster is laggy [ 275.361982][ T5885] usb 5-1: USB disconnect, device number 23 [ 275.476345][ T8635] syzkaller0: entered promiscuous mode [ 275.481923][ T8635] syzkaller0: entered allmulticast mode [ 275.565098][ T29] kauditd_printk_skb: 2 callbacks suppressed [ 275.565110][ T29] audit: type=1400 audit(1772469045.951:535): avc: denied { write } for pid=8634 comm="syz.1.690" name="nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 275.714594][ T29] audit: type=1400 audit(1772469045.981:536): avc: denied { open } for pid=8634 comm="syz.1.690" path="/dev/nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 276.241485][ T1222] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 276.387097][ T8656] tmpfs: Bad value for 'grpquota_inode_hardlimit' [ 276.421716][ T1222] usb 3-1: Using ep0 maxpacket: 8 [ 276.433342][ T1222] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 276.758937][ T1222] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 276.776024][ T1222] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 276.787455][ T1222] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 276.799713][ T1222] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 276.816187][ T1222] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 276.828737][ T1222] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 276.863368][ T8658] binder: 8657:8658 ioctl 4018620d 0 returned -22 [ 276.872308][ T8658] binder: 8657:8658 ioctl c0306201 200000000240 returned -11 [ 277.046105][ T1222] usb 3-1: GET_CAPABILITIES returned 0 [ 277.051802][ T1222] usbtmc 3-1:16.0: can't read capabilities [ 277.114613][ T5797] buffer_io_error: 38 callbacks suppressed [ 277.114629][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 277.152139][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 277.186139][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 277.204764][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 277.223351][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 277.258967][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 277.268228][ T1222] usb 5-1: new full-speed USB device number 24 using dummy_hcd [ 277.282250][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 277.315942][ T5885] usb 3-1: USB disconnect, device number 21 [ 278.261240][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 278.272925][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 278.281639][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 278.311697][ T9] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 278.412687][ T1222] usb 5-1: config 0 has an invalid interface number: 3 but max is 2 [ 278.420689][ T1222] usb 5-1: config 0 has an invalid interface number: 176 but max is 2 [ 278.431532][ T1222] usb 5-1: config 0 has no interface number 1 [ 278.437615][ T1222] usb 5-1: config 0 has no interface number 2 [ 278.444295][ T1222] usb 5-1: New USB device found, idVendor=05c6, idProduct=9205, bcdDevice=29.ac [ 278.453405][ T1222] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 278.533308][ T1222] usb 5-1: config 0 descriptor?? [ 278.551502][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 278.569181][ T9] usb 4-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 278.590341][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 278.591092][ T8679] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 278.601397][ T9] usb 4-1: Product: syz [ 278.615712][ T9] usb 4-1: Manufacturer: syz [ 278.620388][ T9] usb 4-1: SerialNumber: syz [ 278.782366][ T9] usb 4-1: config 0 descriptor?? [ 280.266940][ T9] RobotFuzz Open Source InterFace, OSIF 4-1:0.0: failure sending bit rate [ 280.305893][ T9] RobotFuzz Open Source InterFace, OSIF 4-1:0.0: probe with driver RobotFuzz Open Source InterFace, OSIF failed with error -71 [ 280.333215][ T9] usb 4-1: USB disconnect, device number 20 [ 280.850205][ T1222] usb 5-1: Could not set interface, error -71 [ 280.904605][ T29] audit: type=1800 audit(1772469051.291:537): pid=8690 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.3.707" name="file0" dev="overlay" ino=816 res=0 errno=0 [ 280.928490][ T1222] usb 5-1: USB disconnect, device number 24 [ 281.793434][ T8692] nfs: Unknown parameter 'acÿÿÿÿ' [ 282.262137][ T5794] buffer_io_error: 22 callbacks suppressed [ 282.262149][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 282.321315][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 282.362079][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 282.426575][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 282.444912][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 282.481508][ T1222] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 282.500289][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 282.530238][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 282.561617][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 282.593541][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 282.627160][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 282.653760][ T1222] usb 5-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 282.681529][ T1222] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 282.713698][ T1222] usb 5-1: Product: syz [ 282.727355][ T1222] usb 5-1: Manufacturer: syz [ 282.750626][ T1222] usb 5-1: SerialNumber: syz [ 282.779035][ T1222] usb 5-1: config 0 descriptor?? [ 282.818302][ T1222] i2c-tiny-usb 5-1:0.0: version 6d.cc found at bus 005 address 025 [ 283.120062][ T8688] xt_hashlimit: max too large, truncated to 1048576 [ 283.228098][ T1222] (null): failure reading functionality [ 283.249264][ T1222] i2c i2c-1: connected i2c-tiny-usb device [ 283.304589][ T29] audit: type=1800 audit(1772469053.691:538): pid=8709 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.2.709" name="file0" dev="overlay" ino=747 res=0 errno=0 [ 283.620956][ T1222] usb 5-1: USB disconnect, device number 25 [ 286.078227][ T8730] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 287.311974][ T29] audit: type=1400 audit(1772469057.681:539): avc: denied { ioctl } for pid=8739 comm="syz.4.720" path="socket:[21026]" dev="sockfs" ino=21026 ioctlcmd=0x586c scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 287.750174][ T5794] buffer_io_error: 38 callbacks suppressed [ 287.750191][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 287.807916][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 287.842793][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 287.879706][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 287.994576][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 288.087964][ T8755] tmpfs: Bad value for 'grpquota_inode_hardlimit' [ 288.477099][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 288.517073][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 288.545067][ T8758] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 288.558993][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 289.562128][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 289.601738][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 289.907839][ T8772] netlink: 76 bytes leftover after parsing attributes in process `syz.4.720'. [ 291.861559][ T5885] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 292.042502][ T5885] usb 5-1: Using ep0 maxpacket: 16 [ 292.051675][ T5885] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 292.066216][ T5885] usb 5-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 292.086388][ T5885] usb 5-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 292.095117][ T5885] usb 5-1: Manufacturer: syz [ 292.137969][ T5885] usb 5-1: config 0 descriptor?? [ 292.225265][ T29] audit: type=1400 audit(1772469062.611:540): avc: denied { setopt } for pid=8789 comm="syz.2.731" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 292.577881][ T29] audit: type=1400 audit(1772469062.961:541): avc: denied { unmount } for pid=5803 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 292.581460][ T5878] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 292.728723][ T8798] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 292.741342][ T8798] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 292.931656][ T5886] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 292.997086][ T29] audit: type=1400 audit(1772469063.371:542): avc: denied { append } for pid=8799 comm="syz.0.733" name="card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 293.020363][ T5878] usb 3-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 293.029596][ T5878] usb 3-1: New USB device strings: Mfr=241, Product=2, SerialNumber=3 [ 293.138758][ T5878] usb 3-1: Product: syz [ 293.148134][ T5885] usbhid 5-1:0.0: can't add hid device: -71 [ 293.148845][ T5878] usb 3-1: Manufacturer: syz [ 293.154372][ T5885] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 293.166898][ T5878] usb 3-1: SerialNumber: syz [ 293.188045][ T5878] usb 3-1: config 0 descriptor?? [ 293.211511][ T5886] usb 4-1: Using ep0 maxpacket: 32 [ 293.215576][ T5878] ch341 3-1:0.0: ch341-uart converter detected [ 293.220009][ T5886] usb 4-1: config 157 has too many interfaces: 246, using maximum allowed: 32 [ 293.228801][ T8805] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 293.288136][ T5885] usb 5-1: USB disconnect, device number 26 [ 293.438790][ T5886] usb 4-1: config 157 has 1 interface, different from the descriptor's value: 246 [ 293.552792][ T5886] usb 4-1: config 157 has no interface number 0 [ 294.652460][ T5886] usb 4-1: config 157 interface 224 has no altsetting 0 [ 294.653576][ T5878] usb 3-1: failed to receive control message: -110 [ 294.661068][ T5886] usb 4-1: New USB device found, idVendor=1039, idProduct=2120, bcdDevice= 2.a7 [ 294.702947][ T5878] ch341-uart ttyUSB0: probe with driver ch341-uart failed with error -110 [ 294.752717][ T5886] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 294.854625][ T5886] usb 4-1: Product: syz [ 294.858821][ T5886] usb 4-1: Manufacturer: syz [ 294.864672][ T5886] usb 4-1: SerialNumber: syz [ 294.960882][ T8813] tmpfs: Bad value for 'grpquota_inode_hardlimit' [ 295.283393][ T5886] usb 4-1: [ueagle-atm] ADSL device founded vid (0X1039) pid (0X2120) Rev (0X2A7): Eagle II [ 295.993385][ T5886] usb 4-1: reset high-speed USB device number 21 using dummy_hcd [ 296.101768][ T5878] usb 3-1: USB disconnect, device number 22 [ 296.109465][ T5878] ch341 3-1:0.0: device disconnected [ 296.146244][ T8817] binder: BINDER_SET_CONTEXT_MGR already set [ 296.166776][ T8817] binder: 8816:8817 ioctl 4018620d 200000000040 returned -16 [ 296.217546][ T8817] binder: 8816:8817 ioctl c0306201 200000000240 returned -11 [ 296.847301][ T8831] NFSD: Failed to start, no listeners configured. [ 297.479695][ T5886] usb 4-1: failed to restore interface 224 altsetting 169 (error=-71) [ 297.501894][ T5886] ueagle-atm 4-1:157.224: usbatm_usb_probe: bind failed: -19! [ 297.548433][ T5794] buffer_io_error: 38 callbacks suppressed [ 297.548449][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 297.551066][ T5886] usb 4-1: USB disconnect, device number 21 [ 297.590737][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 297.619254][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 297.623460][ T8842] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 297.633711][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 297.772655][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 297.780935][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 297.982860][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 297.999959][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 298.950792][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 298.963606][ T8850] syzkaller0: entered promiscuous mode [ 298.969064][ T8850] syzkaller0: entered allmulticast mode [ 299.012694][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 299.213914][ T29] audit: type=1800 audit(1772469069.591:543): pid=8855 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.2.750" name="file0" dev="overlay" ino=792 res=0 errno=0 [ 300.206248][ T29] audit: type=1800 audit(1772469070.591:544): pid=8863 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.4.752" name="file0" dev="overlay" ino=778 res=0 errno=0 [ 301.414637][ T29] audit: type=1800 audit(1772469071.801:545): pid=8878 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.1.749" name="file0" dev="overlay" ino=894 res=0 errno=0 [ 301.591528][ T5878] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 302.405252][ T8886] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 303.502203][ T5878] usb 1-1: Using ep0 maxpacket: 8 [ 303.523025][ T5878] usb 1-1: config 179 has an invalid interface number: 65 but max is 0 [ 303.532743][ T5878] usb 1-1: config 179 has no interface number 0 [ 303.539037][ T5878] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 303.560064][ T5878] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 303.581440][ T5878] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 303.614998][ T5878] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 303.621470][ T5885] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 303.637399][ T5878] usb 1-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 303.691483][ T5878] usb 1-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 303.710780][ T5878] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 303.734041][ T8876] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 303.781545][ T5885] usb 4-1: Using ep0 maxpacket: 32 [ 303.788359][ T5885] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 303.807713][ T5885] usb 4-1: config 0 has no interface number 0 [ 303.819861][ T5885] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 303.839413][ T5885] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 303.849517][ T5885] usb 4-1: Product: syz [ 303.859814][ T5885] usb 4-1: Manufacturer: syz [ 303.869748][ T5885] usb 4-1: SerialNumber: syz [ 303.890963][ T5885] usb 4-1: config 0 descriptor?? [ 303.903936][ T5885] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 303.945660][ T8876] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 303.956079][ T8876] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 303.968231][ T8876] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 303.998886][ T8876] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 304.031320][ T8876] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 304.060650][ T8876] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 304.114174][ T8876] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 304.124717][ T5885] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 304.152353][ T8876] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 304.154724][ T5885] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 304.181453][ T8876] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 304.313585][ T8876] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 304.482931][ T792] usb 1-1: USB disconnect, device number 19 [ 304.482995][ C0] xpad 1-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 304.483038][ C0] xpad 1-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 304.904546][ C1] usb 4-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 304.913499][ T5885] usb 4-1: USB disconnect, device number 22 [ 304.920741][ T8905] overlayfs: option "index=on" is useless in a non-upper mount, ignore [ 304.929172][ T8905] overlayfs: overlapping lowerdir path [ 304.941588][ T5885] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 304.968707][ T5885] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 304.984916][ T5885] quatech2 4-1:0.51: device disconnected [ 307.138861][ T5794] buffer_io_error: 54 callbacks suppressed [ 307.138877][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 307.250393][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 307.528981][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 307.547120][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 307.562809][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 307.587559][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 307.874624][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 307.889844][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 307.935666][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 307.945066][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 308.083632][ T792] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 308.102473][ T8946] netlink: 4 bytes leftover after parsing attributes in process `syz.3.777'. [ 308.124901][ T8949] overlayfs: option "index=on" is useless in a non-upper mount, ignore [ 308.134808][ T8949] overlayfs: overlapping lowerdir path [ 308.422263][ T792] usb 3-1: Using ep0 maxpacket: 8 [ 308.477609][ T792] usb 3-1: New USB device found, idVendor=0c45, idProduct=8003, bcdDevice=f9.64 [ 308.557441][ T792] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=67 [ 308.614040][ T792] usb 3-1: Product: syz [ 308.621577][ T792] usb 3-1: Manufacturer: syz [ 308.685694][ T792] usb 3-1: SerialNumber: syz [ 308.695939][ T792] usb 3-1: config 0 descriptor?? [ 308.752186][ T792] gspca_main: sn9c2028-2.14.0 probing 0c45:8003 [ 309.171145][ T792] gspca_sn9c2028: read1 error -71 [ 309.183089][ T792] gspca_sn9c2028: read1 error -71 [ 309.191560][ T792] sn9c2028 3-1:0.0: probe with driver sn9c2028 failed with error -71 [ 309.254990][ T5808] Bluetooth: hci4: command 0x0406 tx timeout [ 309.274625][ T792] usb 3-1: USB disconnect, device number 23 [ 309.660998][ T8968] wlan0 speed is unknown, defaulting to 1000 [ 309.668146][ T8968] wlan0 speed is unknown, defaulting to 1000 [ 309.688483][ T8968] wlan0 speed is unknown, defaulting to 1000 [ 309.713951][ T8968] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 310.024724][ T8968] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 310.159343][ T8968] wlan0 speed is unknown, defaulting to 1000 [ 310.265651][ T8968] wlan0 speed is unknown, defaulting to 1000 [ 310.287411][ T8968] wlan0 speed is unknown, defaulting to 1000 [ 310.299044][ T8968] wlan0 speed is unknown, defaulting to 1000 [ 310.328396][ T8968] wlan0 speed is unknown, defaulting to 1000 [ 310.410982][ T8979] FAULT_INJECTION: forcing a failure. [ 310.410982][ T8979] name failslab, interval 1, probability 0, space 0, times 0 [ 310.468887][ T8979] CPU: 1 UID: 0 PID: 8979 Comm: syz.3.784 Tainted: G L syzkaller #0 PREEMPT(full) [ 310.468916][ T8979] Tainted: [L]=SOFTLOCKUP [ 310.468922][ T8979] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 310.468931][ T8979] Call Trace: [ 310.468937][ T8979] [ 310.468944][ T8979] dump_stack_lvl+0x100/0x190 [ 310.468975][ T8979] should_fail_ex.cold+0x5/0xa [ 310.468997][ T8979] should_failslab+0xc2/0x120 [ 310.469024][ T8979] kmem_cache_alloc_node_noprof+0x81/0x6f0 [ 310.469041][ T8979] ? __alloc_skb+0x140/0x710 [ 310.469054][ T8979] __alloc_skb+0x140/0x710 [ 310.469063][ T8979] ? __pfx___alloc_skb+0x10/0x10 [ 310.469079][ T8979] ? find_held_lock+0x2b/0x80 [ 310.469093][ T8979] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 310.469107][ T8979] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 310.469124][ T8979] tcp_stream_alloc_skb+0x34/0x660 [ 310.469139][ T8979] tcp_sendmsg_locked+0x133b/0x45f0 [ 310.469161][ T8979] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 310.469177][ T8979] ? do_raw_spin_lock+0x128/0x260 [ 310.469188][ T8979] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 310.469203][ T8979] ? __local_bh_enable_ip+0x9e/0x120 [ 310.469218][ T8979] tcp_sendmsg+0x2e/0x50 [ 310.469231][ T8979] ? __pfx_tcp_sendmsg+0x10/0x10 [ 310.469244][ T8979] inet_sendmsg+0xb9/0x140 [ 310.469259][ T8979] __sys_sendto+0x467/0x520 [ 310.469276][ T8979] ? __pfx___sys_sendto+0x10/0x10 [ 310.469304][ T8979] ? ksys_write+0x1ac/0x250 [ 310.469319][ T8979] ? __pfx_ksys_write+0x10/0x10 [ 310.469340][ T8979] __x64_sys_sendto+0xe0/0x1c0 [ 310.469357][ T8979] ? do_syscall_64+0x95/0xf80 [ 310.469368][ T8979] ? lockdep_hardirqs_on+0x78/0x100 [ 310.469379][ T8979] do_syscall_64+0x106/0xf80 [ 310.469389][ T8979] ? clear_bhb_loop+0x40/0x90 [ 310.469402][ T8979] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 310.469413][ T8979] RIP: 0033:0x7ff91319c799 [ 310.469423][ T8979] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 310.469433][ T8979] RSP: 002b:00007ff914114028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 310.469444][ T8979] RAX: ffffffffffffffda RBX: 00007ff913415fa0 RCX: 00007ff91319c799 [ 310.469450][ T8979] RDX: ffffffffffffff94 RSI: 0000200000000000 RDI: 0000000000000003 [ 310.469456][ T8979] RBP: 00007ff914114090 R08: 0000000000000000 R09: 0000000000000012 [ 310.469462][ T8979] R10: 0000000000000012 R11: 0000000000000246 R12: 0000000000000001 [ 310.469468][ T8979] R13: 00007ff913416038 R14: 00007ff913415fa0 R15: 00007ffe82198948 [ 310.469482][ T8979] [ 310.861798][ T29] audit: type=1400 audit(1772469081.121:546): avc: denied { write } for pid=8976 comm="syz.1.785" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 310.880738][ T29] audit: type=1400 audit(1772469081.121:547): avc: denied { mount } for pid=8976 comm="syz.1.785" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 310.904142][ T29] audit: type=1400 audit(1772469081.131:548): avc: denied { mounton } for pid=8976 comm="syz.1.785" path="/171/file0" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=dir permissive=1 [ 310.960116][ T29] audit: type=1800 audit(1772469081.341:549): pid=8983 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.4.786" name="file0" dev="overlay" ino=819 res=0 errno=0 [ 311.556567][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 311.888025][ T29] audit: type=1800 audit(1772469082.271:550): pid=8987 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.0.787" name="file0" dev="overlay" ino=842 res=0 errno=0 [ 312.213440][ T5794] buffer_io_error: 38 callbacks suppressed [ 312.213452][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 312.267197][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 312.301766][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 312.340394][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 312.352904][ T9] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 312.382804][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 312.415535][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 312.453753][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 312.497638][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 312.521517][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 312.546492][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 312.556980][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 312.590777][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 312.610395][ T9] usb 5-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 312.632543][ T9] usb 5-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 312.661530][ T9] usb 5-1: Manufacturer: syz [ 312.681947][ T9] usb 5-1: config 0 descriptor?? [ 312.747888][ T9002] netlink: 4 bytes leftover after parsing attributes in process `syz.0.793'. [ 313.175627][ T9007] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 313.187340][ T9007] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 313.472938][ T9] usbhid 5-1:0.0: can't add hid device: -71 [ 313.484635][ T9] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 313.528727][ T9] usb 5-1: USB disconnect, device number 27 [ 313.701536][ T5878] usb 3-1: new full-speed USB device number 24 using dummy_hcd [ 313.789891][ T29] audit: type=1400 audit(1772469084.151:551): avc: denied { unmount } for pid=5810 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 314.339940][ T9012] input: syz1 as /devices/virtual/input/input12 [ 314.391044][ T5878] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 314.427671][ T9013] nfs: Unknown parameter 'acÿÿÿÿ' [ 314.435277][ T5878] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 13961, setting to 64 [ 314.754203][ T5878] usb 3-1: New USB device found, idVendor=04d9, idProduct=a0c2, bcdDevice= 0.00 [ 314.771437][ T5878] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 314.772102][ T29] audit: type=1400 audit(1772469085.151:552): avc: denied { setopt } for pid=9017 comm="syz.4.797" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 314.870990][ T5878] usb 3-1: config 0 descriptor?? [ 314.881756][ T9006] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 314.899702][ T29] audit: type=1400 audit(1772469085.161:553): avc: denied { write } for pid=9017 comm="syz.4.797" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 314.951044][ T9019] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 315.053396][ T9021] netlink: 20 bytes leftover after parsing attributes in process `syz.1.798'. [ 315.325066][ T5878] holtek_mouse 0003:04D9:A0C2.0007: unknown main item tag 0x0 [ 315.333812][ T5878] holtek_mouse 0003:04D9:A0C2.0007: unknown main item tag 0x0 [ 315.341690][ T5878] holtek_mouse 0003:04D9:A0C2.0007: unknown main item tag 0x0 [ 315.351652][ T5878] holtek_mouse 0003:04D9:A0C2.0007: unknown main item tag 0x0 [ 315.359240][ T5878] holtek_mouse 0003:04D9:A0C2.0007: unknown main item tag 0x0 [ 315.368987][ T5878] holtek_mouse 0003:04D9:A0C2.0007: unknown main item tag 0x0 [ 315.810542][ T5816] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 315.889398][ T29] audit: type=1400 audit(1772469086.271:554): avc: denied { map_create } for pid=9005 comm="syz.2.794" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 315.908755][ T5878] holtek_mouse 0003:04D9:A0C2.0007: unknown main item tag 0x0 [ 315.916624][ T5878] holtek_mouse 0003:04D9:A0C2.0007: unknown main item tag 0x0 [ 315.925058][ T5878] holtek_mouse 0003:04D9:A0C2.0007: unknown main item tag 0x0 [ 315.933178][ T5878] holtek_mouse 0003:04D9:A0C2.0007: unknown main item tag 0x0 [ 315.948619][ T5878] holtek_mouse 0003:04D9:A0C2.0007: hidraw0: USB HID v7f.fd Device [HID 04d9:a0c2] on usb-dummy_hcd.2-1/input0 [ 316.003236][ T29] audit: type=1400 audit(1772469086.301:555): avc: denied { read write } for pid=9005 comm="syz.2.794" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 316.151880][ T29] audit: type=1400 audit(1772469086.301:556): avc: denied { open } for pid=9005 comm="syz.2.794" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 316.163042][ T9006] netlink: 8 bytes leftover after parsing attributes in process `syz.2.794'. [ 316.195833][ T29] audit: type=1400 audit(1772469086.301:557): avc: denied { ioctl } for pid=9005 comm="syz.2.794" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae05 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 316.264009][ T29] audit: type=1400 audit(1772469086.351:558): avc: denied { read write } for pid=5812 comm="syz-executor" name="loop4" dev="devtmpfs" ino=651 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 316.352016][ T976] usb 3-1: USB disconnect, device number 24 [ 316.376484][ T29] audit: type=1400 audit(1772469086.351:559): avc: denied { open } for pid=5812 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=651 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 316.452667][ T29] audit: type=1400 audit(1772469086.351:560): avc: denied { recv } for pid=5794 comm="udevd" saddr=10.128.0.169 src=30006 daddr=10.128.0.85 dest=48636 netif=eth0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=peer permissive=1 [ 316.538455][ T9043] tmpfs: Bad value for 'grpquota_inode_hardlimit' [ 316.571527][ T5885] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 316.613984][ T29] audit: type=1400 audit(1772469086.361:561): avc: denied { ioctl } for pid=5812 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=651 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 316.761463][ T5885] usb 1-1: Using ep0 maxpacket: 16 [ 316.779289][ T5885] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 316.793369][ T29] audit: type=1400 audit(1772469086.361:562): avc: denied { create } for pid=9027 comm="syz.0.801" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 316.836480][ T5885] usb 1-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 316.856386][ T5885] usb 1-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 316.871860][ T29] audit: type=1400 audit(1772469086.381:563): avc: denied { read write } for pid=9027 comm="syz.0.801" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 316.896147][ T5885] usb 1-1: Manufacturer: syz [ 316.901887][ T5878] usb 5-1: new full-speed USB device number 28 using dummy_hcd [ 316.917297][ T5885] usb 1-1: config 0 descriptor?? [ 317.157025][ T5878] usb 5-1: config 0 has an invalid interface number: 3 but max is 2 [ 317.199864][ T5878] usb 5-1: config 0 has an invalid interface number: 176 but max is 2 [ 317.222616][ T9047] xt_hashlimit: max too large, truncated to 1048576 [ 317.231110][ T9047] No such timeout policy "syz1" [ 317.270577][ T9047] binder: 9044:9047 ioctl c0306201 2000000001c0 returned -22 [ 317.416647][ T5878] usb 5-1: config 0 has no interface number 1 [ 317.646334][ T5878] usb 5-1: config 0 has no interface number 2 [ 317.701750][ T5959] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 317.731879][ T9] usb 2-1: new full-speed USB device number 17 using dummy_hcd [ 317.766366][ T5878] usb 5-1: New USB device found, idVendor=05c6, idProduct=9205, bcdDevice=29.ac [ 317.805757][ T9050] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 317.824216][ T9050] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 317.908290][ T5878] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 317.927152][ T5878] usb 5-1: config 0 descriptor?? [ 318.072096][ T5959] usb 4-1: Using ep0 maxpacket: 32 [ 318.081068][ T5959] usb 4-1: New USB device found, idVendor=04e8, idProduct=6601, bcdDevice=81.9b [ 318.090329][ T5959] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 318.092870][ T5885] usbhid 1-1:0.0: can't add hid device: -71 [ 318.098456][ T5959] usb 4-1: Product: syz [ 318.109260][ T5959] usb 4-1: Manufacturer: syz [ 318.112812][ T5885] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 318.114705][ T5959] usb 4-1: SerialNumber: syz [ 318.128341][ T5885] usb 1-1: USB disconnect, device number 20 [ 318.153908][ T9] usb 2-1: config 0 has an invalid interface number: 3 but max is 2 [ 318.164624][ T9] usb 2-1: config 0 has an invalid interface number: 176 but max is 2 [ 318.173806][ T9] usb 2-1: config 0 has no interface number 1 [ 318.179896][ T9] usb 2-1: config 0 has no interface number 2 [ 318.186499][ T9] usb 2-1: New USB device found, idVendor=05c6, idProduct=9205, bcdDevice=29.ac [ 318.196480][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 318.207166][ T9] usb 2-1: config 0 descriptor?? [ 318.423219][ T5878] usb 5-1: Could not set interface, error -71 [ 318.518008][ T5959] usb 4-1: palm_os_4_probe - error -110 getting connection info [ 318.693875][ T5959] visor 4-1:1.0: Handspring Visor / Palm OS converter detected [ 319.821125][ T5878] usb 5-1: USB disconnect, device number 28 [ 319.830350][ T5959] usb 4-1: Handspring Visor / Palm OS converter now attached to ttyUSB0 [ 319.844419][ T9] usb 2-1: Could not set interface, error -71 [ 319.857884][ T5959] usb 4-1: Handspring Visor / Palm OS converter now attached to ttyUSB1 [ 319.917315][ T9] usb 2-1: USB disconnect, device number 17 [ 320.125633][ T5886] usb 4-1: USB disconnect, device number 23 [ 320.354085][ T9066] overlay: ./file0 is not a directory [ 320.585484][ T5886] visor ttyUSB0: Handspring Visor / Palm OS converter now disconnected from ttyUSB0 [ 320.602586][ T5886] visor ttyUSB1: Handspring Visor / Palm OS converter now disconnected from ttyUSB1 [ 320.603536][ T9064] bond1 (unregistering): Released all slaves [ 320.612601][ T5886] visor 4-1:1.0: device disconnected [ 320.727675][ T5959] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 320.741752][ T9070] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9070 comm=syz.0.811 [ 320.817632][ T5796] buffer_io_error: 38 callbacks suppressed [ 320.817649][ T5796] Buffer I/O error on dev loop3, logical block 0, async page read [ 320.833197][ T5796] Buffer I/O error on dev loop3, logical block 0, async page read [ 320.955654][ T5796] Buffer I/O error on dev loop3, logical block 0, async page read [ 320.964949][ T5796] Buffer I/O error on dev loop3, logical block 0, async page read [ 320.997254][ T29] kauditd_printk_skb: 50 callbacks suppressed [ 320.997521][ T29] audit: type=1400 audit(1772469091.381:614): avc: denied { read } for pid=9060 comm="syz.0.811" dev="sockfs" ino=22305 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 321.026573][ T5959] usb 3-1: Using ep0 maxpacket: 16 [ 321.054237][ T5796] Buffer I/O error on dev loop3, logical block 0, async page read [ 321.072920][ T9070] 9p: Bad value for 'wfdno' [ 321.107816][ T5959] usb 3-1: config 1 interface 0 altsetting 5 bulk endpoint 0x1 has invalid maxpacket 64 [ 321.145444][ T5886] usb 4-1: new full-speed USB device number 24 using dummy_hcd [ 321.156420][ T5959] usb 3-1: config 1 interface 0 altsetting 5 bulk endpoint 0x82 has invalid maxpacket 64 [ 321.172829][ T5959] usb 3-1: config 1 interface 0 has no altsetting 0 [ 321.173711][ T5796] Buffer I/O error on dev loop3, logical block 0, async page read [ 321.214106][ T5796] Buffer I/O error on dev loop3, logical block 0, async page read [ 321.250580][ T5796] Buffer I/O error on dev loop3, logical block 0, async page read [ 321.260794][ T29] audit: type=1400 audit(1772469091.641:615): avc: denied { map } for pid=9071 comm="syz.1.813" path="/dev/binderfs/binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 321.261409][ T9072] binder: BINDER_SET_CONTEXT_MGR already set [ 321.300989][ T9072] binder: 9071:9072 ioctl 4018620d 200000000040 returned -16 [ 321.301681][ T5796] Buffer I/O error on dev loop3, logical block 0, async page read [ 321.319771][ T5886] usb 4-1: config 0 has an invalid interface number: 3 but max is 2 [ 321.338120][ T5886] usb 4-1: config 0 has an invalid interface number: 176 but max is 2 [ 321.342500][ T9072] binder: 9071:9072 ioctl c0306201 200000000240 returned -11 [ 321.349512][ T5796] Buffer I/O error on dev loop3, logical block 0, async page read [ 321.371521][ T5886] usb 4-1: config 0 has no interface number 1 [ 321.384756][ T5886] usb 4-1: config 0 has no interface number 2 [ 321.401128][ T5886] usb 4-1: New USB device found, idVendor=05c6, idProduct=9205, bcdDevice=29.ac [ 321.443984][ T5886] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 321.506369][ T5886] usb 4-1: config 0 descriptor?? [ 321.534916][ T29] audit: type=1400 audit(1772469091.921:616): avc: denied { call } for pid=9077 comm="syz.4.815" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 321.777973][ T29] audit: type=1400 audit(1772469092.161:617): avc: denied { read } for pid=9084 comm="syz.4.819" name="video0" dev="devtmpfs" ino=932 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 321.874404][ T9088] tmpfs: Bad value for 'grpquota_inode_hardlimit' [ 322.781984][ T5886] usb 4-1: Could not set interface, error -71 [ 322.901591][ T5886] usb 4-1: USB disconnect, device number 24 [ 322.928040][ T29] audit: type=1400 audit(1772469093.311:618): avc: denied { setopt } for pid=9092 comm="syz.1.820" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 323.094466][ T9099] netlink: 20 bytes leftover after parsing attributes in process `syz.1.820'. [ 323.128159][ T29] audit: type=1400 audit(1772469093.311:619): avc: denied { module_request } for pid=9092 comm="syz.1.820" kmod="netdev-vcan0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 323.578543][ T5959] usb 3-1: string descriptor 0 read error: -71 [ 323.667271][ T29] audit: type=1400 audit(1772469093.321:620): avc: denied { unlink } for pid=9091 comm="syz.0.818" name="#1d" dev="tmpfs" ino=880 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 323.709352][ T5959] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 323.718500][ T5959] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 323.731528][ T5959] usb 3-1: can't set config #1, error -71 [ 323.738720][ T5959] usb 3-1: USB disconnect, device number 25 [ 323.942367][ T29] audit: type=1400 audit(1772469093.321:621): avc: denied { mount } for pid=9091 comm="syz.0.818" name="/" dev="overlay" ino=874 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 324.102930][ T29] audit: type=1800 audit(1772469093.321:622): pid=9093 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.0.818" name="file0" dev="overlay" ino=882 res=0 errno=0 [ 324.181546][ T29] audit: type=1400 audit(1772469093.471:623): avc: denied { connect } for pid=9092 comm="syz.1.820" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 324.291549][ T5886] usb 1-1: new full-speed USB device number 21 using dummy_hcd [ 324.293898][ T9117] overlayfs: option "index=on" is useless in a non-upper mount, ignore [ 324.312179][ T9117] overlayfs: overlapping lowerdir path [ 324.517016][ T9116] binder: BINDER_SET_CONTEXT_MGR already set [ 324.526926][ T9116] binder: 9115:9116 ioctl 4018620d 200000000040 returned -16 [ 324.599633][ T9116] binder: 9115:9116 ioctl c0306201 200000000240 returned -11 [ 324.630607][ T5886] usb 1-1: config 0 has an invalid interface number: 3 but max is 2 [ 324.644925][ T5886] usb 1-1: config 0 has an invalid interface number: 176 but max is 2 [ 324.681515][ T5886] usb 1-1: config 0 has no interface number 1 [ 324.701462][ T5886] usb 1-1: config 0 has no interface number 2 [ 324.748345][ T5886] usb 1-1: New USB device found, idVendor=05c6, idProduct=9205, bcdDevice=29.ac [ 324.773886][ T5886] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 324.832886][ T5886] usb 1-1: config 0 descriptor?? [ 325.134280][ T9133] tmpfs: Bad value for 'grpquota_inode_hardlimit' [ 326.211038][ T29] kauditd_printk_skb: 6 callbacks suppressed [ 326.211054][ T29] audit: type=1400 audit(1772469096.591:630): avc: denied { read } for pid=9130 comm="syz.4.831" name="card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 326.787654][ T5886] usb 1-1: Could not set interface, error -71 [ 326.817743][ T5886] usb 1-1: USB disconnect, device number 21 [ 326.825494][ T29] audit: type=1400 audit(1772469096.591:631): avc: denied { open } for pid=9130 comm="syz.4.831" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 326.960026][ T29] audit: type=1400 audit(1772469096.631:632): avc: denied { ioctl } for pid=9130 comm="syz.4.831" path="/dev/dri/card1" dev="devtmpfs" ino=628 ioctlcmd=0x64a0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 327.262306][ T24] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 327.421796][ T24] usb 3-1: Using ep0 maxpacket: 16 [ 327.428583][ T24] usb 3-1: config 1 interface 0 altsetting 5 bulk endpoint 0x1 has invalid maxpacket 64 [ 327.439480][ T29] audit: type=1400 audit(1772469097.811:633): avc: denied { read write } for pid=9142 comm="syz.1.835" name="fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 327.465719][ T24] usb 3-1: config 1 interface 0 altsetting 5 bulk endpoint 0x82 has invalid maxpacket 64 [ 327.476288][ T24] usb 3-1: config 1 interface 0 has no altsetting 0 [ 327.483275][ T29] audit: type=1400 audit(1772469097.811:634): avc: denied { open } for pid=9142 comm="syz.1.835" path="/dev/fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 327.598380][ T29] audit: type=1800 audit(1772469097.851:635): pid=9141 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.4.834" name="file0" dev="overlay" ino=892 res=0 errno=0 [ 327.641764][ T29] audit: type=1400 audit(1772469097.871:636): avc: denied { mounton } for pid=9142 comm="syz.1.835" path="/184/file0" dev="tmpfs" ino=1008 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 327.667584][ T29] audit: type=1400 audit(1772469097.871:637): avc: denied { mount } for pid=9142 comm="syz.1.835" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 328.275033][ T9148] loop5: detected capacity change from 0 to 7 [ 328.956815][ T9148] Dev loop5: unable to read RDB block 7 [ 328.963271][ T9148] loop5: unable to read partition table [ 328.995096][ T9148] loop5: partition table beyond EOD, truncated [ 329.001304][ T9148] loop_reread_partitions: partition scan of loop5 (úùƒWå¡™‰ü¾Ã½¸*‹ºÐ œëÜ%õ«µ4FLQkÝŠ5) failed (rc=-5) [ 329.121651][ T9161] binder: BINDER_SET_CONTEXT_MGR already set [ 329.128733][ T9161] binder: 9160:9161 ioctl 4018620d 200000000040 returned -16 [ 329.144514][ T9161] binder: 9160:9161 ioctl c0306201 200000000240 returned -11 [ 329.157389][ T5797] buffer_io_error: 22 callbacks suppressed [ 329.157399][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 329.211120][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 329.221124][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 329.232967][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 329.245315][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 329.461514][ T29] audit: type=1400 audit(1772469099.811:638): avc: denied { create } for pid=9164 comm="syz.0.841" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 329.584916][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 329.595922][ T9157] nfs: Unknown parameter 'acÿÿÿÿ' [ 329.605617][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 329.624373][ T29] audit: type=1400 audit(1772469099.811:639): avc: denied { setopt } for pid=9164 comm="syz.0.841" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 329.624890][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 329.662199][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 329.673943][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 329.828123][ T24] usb 3-1: string descriptor 0 read error: -71 [ 329.834567][ T24] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 329.841457][ T9] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 329.855797][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 329.878487][ T24] usb 3-1: can't set config #1, error -71 [ 329.892947][ T9176] netlink: 52 bytes leftover after parsing attributes in process `syz.2.844'. [ 329.904729][ T24] usb 3-1: USB disconnect, device number 26 [ 329.917335][ T9176] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9176 comm=syz.2.844 [ 330.011661][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 330.013369][ T9179] netlink: 4 bytes leftover after parsing attributes in process `syz.1.843'. [ 330.018185][ T9] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 330.040876][ T9] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 330.065581][ T9] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 330.078657][ T9] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 330.251314][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 330.306599][ T9] usb 5-1: Product: syz [ 330.313759][ T9] usb 5-1: Manufacturer: syz [ 330.318532][ T9] usb 5-1: SerialNumber: syz [ 330.469931][ T24] usb 3-1: new full-speed USB device number 27 using dummy_hcd [ 330.655015][ T24] usb 3-1: config 0 has an invalid interface number: 3 but max is 2 [ 331.747105][ T24] usb 3-1: config 0 has an invalid interface number: 176 but max is 2 [ 331.769048][ T24] usb 3-1: config 0 has no interface number 1 [ 331.790066][ T24] usb 3-1: config 0 has no interface number 2 [ 331.810257][ T24] usb 3-1: New USB device found, idVendor=05c6, idProduct=9205, bcdDevice=29.ac [ 331.860408][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 331.909999][ T24] usb 3-1: config 0 descriptor?? [ 331.956112][ T9] usb 5-1: 0:2 : does not exist [ 332.727405][ T24] usb 3-1: Could not set interface, error -71 [ 332.751427][ T9192] nfs: Unknown parameter 'acÿÿÿÿ' [ 332.939411][ T24] usb 3-1: USB disconnect, device number 27 [ 333.095965][ T9200] netlink: 8 bytes leftover after parsing attributes in process `syz.0.850'. [ 333.392897][ T9] usb 5-1: 1:0: failed to get current value for ch 0 (-22) [ 333.592414][ T9] usb 5-1: USB disconnect, device number 29 [ 334.070026][ T29] kauditd_printk_skb: 9 callbacks suppressed [ 334.070047][ T29] audit: type=1400 audit(1772469104.451:649): avc: denied { ioctl } for pid=9214 comm="syz.1.855" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=23586 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 334.271507][ T976] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 334.363502][ T9216] netlink: 8 bytes leftover after parsing attributes in process `syz.1.855'. [ 334.372882][ T9221] netlink: 4 bytes leftover after parsing attributes in process `syz.1.855'. [ 334.534399][ T976] usb 4-1: Using ep0 maxpacket: 16 [ 334.545167][ T976] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 334.584983][ T976] usb 4-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 334.608122][ T976] usb 4-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 334.671706][ T29] audit: type=1400 audit(1772469105.021:650): avc: denied { append } for pid=9223 comm="syz.0.857" name="comedi4" dev="devtmpfs" ino=1280 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 334.705154][ T9225] FAULT_INJECTION: forcing a failure. [ 334.705154][ T9225] name failslab, interval 1, probability 0, space 0, times 0 [ 334.717895][ T9225] CPU: 0 UID: 0 PID: 9225 Comm: syz.0.857 Tainted: G L syzkaller #0 PREEMPT(full) [ 334.717922][ T9225] Tainted: [L]=SOFTLOCKUP [ 334.717928][ T9225] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 334.717937][ T9225] Call Trace: [ 334.717943][ T9225] [ 334.717950][ T9225] dump_stack_lvl+0x100/0x190 [ 334.717980][ T9225] should_fail_ex.cold+0x5/0xa [ 334.718002][ T9225] should_failslab+0xc2/0x120 [ 334.718027][ T9225] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 334.718045][ T9225] ? skb_clone+0x190/0x400 [ 334.718063][ T9225] skb_clone+0x190/0x400 [ 334.718074][ T9225] netlink_deliver_tap+0xaed/0xcc0 [ 334.718089][ T9225] netlink_unicast+0x650/0x870 [ 334.718103][ T9225] ? __pfx_netlink_unicast+0x10/0x10 [ 334.718114][ T9225] ? __asan_memset+0x23/0x50 [ 334.718127][ T9225] ? __build_skb_around+0x278/0x390 [ 334.718145][ T9225] netlink_sendmsg+0x8b0/0xda0 [ 334.718160][ T9225] ? __pfx_netlink_sendmsg+0x10/0x10 [ 334.718177][ T9225] __sys_sendto+0x4aa/0x520 [ 334.718193][ T9225] ? __pfx___sys_sendto+0x10/0x10 [ 334.718221][ T9225] ? ksys_write+0x1ac/0x250 [ 334.718236][ T9225] ? __pfx_ksys_write+0x10/0x10 [ 334.718253][ T9225] __x64_sys_sendto+0xe0/0x1c0 [ 334.718269][ T9225] ? do_syscall_64+0x95/0xf80 [ 334.718280][ T9225] ? lockdep_hardirqs_on+0x78/0x100 [ 334.718290][ T9225] do_syscall_64+0x106/0xf80 [ 334.718300][ T9225] ? clear_bhb_loop+0x40/0x90 [ 334.718313][ T9225] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 334.718325][ T9225] RIP: 0033:0x7f95d7d9c799 [ 334.718334][ T9225] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 334.718345][ T9225] RSP: 002b:00007f95d8cf8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 334.718355][ T9225] RAX: ffffffffffffffda RBX: 00007f95d8016090 RCX: 00007f95d7d9c799 [ 334.718362][ T9225] RDX: 000000000000ff3b RSI: 0000200000000140 RDI: 0000000000000008 [ 334.718368][ T9225] RBP: 00007f95d8cf8090 R08: 0000000000000000 R09: 0000000000000000 [ 334.718374][ T9225] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 334.718379][ T9225] R13: 00007f95d8016128 R14: 00007f95d8016090 R15: 00007ffec104f578 [ 334.718398][ T9225] [ 334.939601][ T976] usb 4-1: Manufacturer: syz [ 335.350270][ T976] usb 4-1: config 0 descriptor?? [ 336.438565][ T9241] sd 0:0:1:0: device reset [ 336.501512][ T29] audit: type=1400 audit(1772469106.811:651): avc: denied { create } for pid=9237 comm="syz.0.861" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 336.869279][ T9242] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 336.879865][ T9242] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 337.163807][ T29] audit: type=1400 audit(1772469106.811:652): avc: denied { listen } for pid=9237 comm="syz.0.861" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 337.263449][ T29] audit: type=1400 audit(1772469106.821:653): avc: denied { read } for pid=9237 comm="syz.0.861" name="sg0" dev="devtmpfs" ino=803 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 337.313887][ T976] usbhid 4-1:0.0: can't add hid device: -71 [ 337.352627][ T976] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 337.376312][ T29] audit: type=1400 audit(1772469106.821:654): avc: denied { open } for pid=9237 comm="syz.0.861" path="/dev/sg0" dev="devtmpfs" ino=803 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 337.455285][ T29] audit: type=1400 audit(1772469106.821:655): avc: denied { ioctl } for pid=9237 comm="syz.0.861" path="/dev/sg0" dev="devtmpfs" ino=803 ioctlcmd=0x2284 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 337.483833][ T976] usb 4-1: USB disconnect, device number 25 [ 337.641589][ T24] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 337.878370][ T9253] netlink: 44 bytes leftover after parsing attributes in process `syz.2.863'. [ 338.069001][ T5959] usb 5-1: new full-speed USB device number 30 using dummy_hcd [ 338.087319][ T24] usb 2-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 338.098683][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 338.107419][ T24] usb 2-1: Product: syz [ 338.111723][ T24] usb 2-1: Manufacturer: syz [ 338.116419][ T24] usb 2-1: SerialNumber: syz [ 338.130345][ T24] usb 2-1: config 0 descriptor?? [ 338.142398][ T24] i2c-tiny-usb 2-1:0.0: version 6d.cc found at bus 002 address 018 [ 338.243091][ T5959] usb 5-1: config 0 has an invalid interface number: 3 but max is 2 [ 338.338366][ T5959] usb 5-1: config 0 has an invalid interface number: 176 but max is 2 [ 338.358552][ T5959] usb 5-1: config 0 has no interface number 1 [ 338.369201][ T5959] usb 5-1: config 0 has no interface number 2 [ 338.387752][ T5959] usb 5-1: New USB device found, idVendor=05c6, idProduct=9205, bcdDevice=29.ac [ 338.428314][ T5959] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 338.469961][ T5959] usb 5-1: config 0 descriptor?? [ 338.480802][ T5796] buffer_io_error: 54 callbacks suppressed [ 338.480814][ T5796] Buffer I/O error on dev loop3, logical block 0, async page read [ 338.559982][ T5796] Buffer I/O error on dev loop3, logical block 0, async page read [ 338.577401][ T24] (null): failure reading functionality [ 338.612967][ T5796] Buffer I/O error on dev loop3, logical block 0, async page read [ 338.621189][ T5796] Buffer I/O error on dev loop3, logical block 0, async page read [ 338.659426][ T5796] Buffer I/O error on dev loop3, logical block 0, async page read [ 338.690431][ T5796] Buffer I/O error on dev loop3, logical block 0, async page read [ 338.724495][ T5796] Buffer I/O error on dev loop3, logical block 0, async page read [ 338.755966][ T5796] Buffer I/O error on dev loop3, logical block 0, async page read [ 338.776200][ T5796] Buffer I/O error on dev loop3, logical block 0, async page read [ 338.778823][ T24] i2c i2c-1: connected i2c-tiny-usb device [ 339.007626][ T5959] usb 5-1: Could not set interface, error -71 [ 339.058908][ T5796] Buffer I/O error on dev loop3, logical block 0, async page read [ 339.423208][ T5959] usb 5-1: USB disconnect, device number 30 [ 339.431709][ T24] usb 2-1: USB disconnect, device number 18 [ 339.506288][ T29] audit: type=1400 audit(1772469109.891:656): avc: denied { create } for pid=9254 comm="syz.2.865" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 340.138227][ T29] audit: type=1400 audit(1772469109.931:657): avc: denied { bind } for pid=9254 comm="syz.2.865" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 340.184373][ T29] audit: type=1400 audit(1772469110.071:658): avc: denied { mount } for pid=9256 comm="syz.3.866" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 340.257245][ T29] audit: type=1400 audit(1772469110.101:659): avc: denied { mounton } for pid=9256 comm="syz.3.866" path="/176/file0" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=dir permissive=1 [ 340.282597][ T9264] xt_hashlimit: max too large, truncated to 1048576 [ 340.555622][ T29] audit: type=1400 audit(1772469110.671:660): avc: denied { setopt } for pid=9254 comm="syz.2.865" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 340.597014][ T29] audit: type=1400 audit(1772469110.751:661): avc: denied { bind } for pid=9254 comm="syz.2.865" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 340.673134][ T29] audit: type=1400 audit(1772469110.751:662): avc: denied { write } for pid=9254 comm="syz.2.865" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 340.711073][ T29] audit: type=1400 audit(1772469111.061:663): avc: denied { unmount } for pid=5804 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 341.126685][ T9284] xt_hashlimit: max too large, truncated to 1048576 [ 341.399523][ T9294] netlink: 20 bytes leftover after parsing attributes in process `syz.4.875'. [ 342.238676][ T29] audit: type=1800 audit(1772469111.801:664): pid=9292 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.3.874" name="file0" dev="overlay" ino=968 res=0 errno=0 [ 342.602156][ T9297] netlink: 4 bytes leftover after parsing attributes in process `syz.2.876'. [ 342.609212][ T29] audit: type=1400 audit(1772469112.991:665): avc: denied { create } for pid=9299 comm="syz.1.877" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 343.719340][ T5797] buffer_io_error: 70 callbacks suppressed [ 343.719355][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 344.250380][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 344.332908][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 344.827659][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 344.839776][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 344.849931][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 344.858810][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 344.867972][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 344.900785][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 345.378000][ T9331] xt_hashlimit: max too large, truncated to 1048576 [ 345.475771][ T5959] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 345.503352][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 345.703238][ T5959] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 345.714675][ T5959] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 345.727330][ T5959] usb 5-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 345.866672][ T29] kauditd_printk_skb: 11 callbacks suppressed [ 345.866686][ T29] audit: type=1400 audit(1772469116.251:677): avc: denied { create } for pid=9348 comm="syz.3.892" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 345.901459][ T5959] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 345.930346][ T5959] usb 5-1: Product: syz [ 345.934865][ T5959] usb 5-1: Manufacturer: syz [ 345.939438][ T5959] usb 5-1: SerialNumber: syz [ 346.087722][ T5959] usb 5-1: config 0 descriptor?? [ 346.314422][ T29] audit: type=1400 audit(1772469116.701:678): avc: denied { create } for pid=9351 comm="syz.3.893" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 346.347651][ T5959] usb 5-1: USB disconnect, device number 31 [ 346.981311][ T9363] netlink: 4 bytes leftover after parsing attributes in process `syz.4.898'. [ 347.205555][ T29] audit: type=1400 audit(1772469117.561:679): avc: denied { create } for pid=9351 comm="syz.3.893" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 348.311552][ T976] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 348.529206][ T29] audit: type=1800 audit(1772469118.911:680): pid=9383 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.2.903" name="file0" dev="overlay" ino=971 res=0 errno=0 [ 348.694556][ T976] usb 1-1: Using ep0 maxpacket: 16 [ 348.764888][ T976] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 348.857736][ T976] usb 1-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 348.935999][ T976] usb 1-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 348.984494][ T976] usb 1-1: Manufacturer: syz [ 349.128275][ T976] usb 1-1: config 0 descriptor?? [ 349.534561][ T29] audit: type=1800 audit(1772469119.911:681): pid=9387 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.1.905" name="file0" dev="overlay" ino=1090 res=0 errno=0 [ 349.573175][ T5797] buffer_io_error: 38 callbacks suppressed [ 349.573208][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 350.180825][ T9377] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 350.190636][ T9377] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 350.618475][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 350.660809][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 350.690988][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 350.691108][ T976] usbhid 1-1:0.0: can't add hid device: -71 [ 350.699495][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 350.713251][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 350.721788][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 350.730094][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 350.739259][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 350.747986][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 350.791492][ T976] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 350.827148][ T9397] syzkaller0: entered promiscuous mode [ 350.838809][ T9397] syzkaller0: entered allmulticast mode [ 350.847533][ T976] usb 1-1: USB disconnect, device number 22 [ 350.869887][ T29] audit: type=1400 audit(1772469121.251:682): avc: denied { mount } for pid=9398 comm="syz.1.908" name="/" dev="ramfs" ino=23951 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 350.953967][ T29] audit: type=1400 audit(1772469121.331:683): avc: denied { mounton } for pid=9398 comm="syz.1.908" path="/198/file0" dev="ramfs" ino=23951 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=dir permissive=1 [ 351.006425][ T29] audit: type=1400 audit(1772469121.381:684): avc: denied { setopt } for pid=9396 comm="syz.4.909" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 351.164965][ T9399] 9pnet: p9_errstr2errno: server reported unknown error 0x00000000 [ 351.359783][ T29] audit: type=1400 audit(1772469121.381:685): avc: denied { ioctl } for pid=9396 comm="syz.4.909" path="socket:[23943]" dev="sockfs" ino=23943 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 351.384970][ T29] audit: type=1400 audit(1772469121.381:686): avc: denied { write } for pid=9396 comm="syz.4.909" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 351.470597][ T29] audit: type=1400 audit(1772469121.851:687): avc: denied { create } for pid=9409 comm="syz.4.912" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 351.499655][ T29] audit: type=1400 audit(1772469121.851:688): avc: denied { setopt } for pid=9409 comm="syz.4.912" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 351.500985][ T9407] xt_hashlimit: max too large, truncated to 1048576 [ 351.577036][ T29] audit: type=1400 audit(1772469121.911:689): avc: denied { name_bind } for pid=9411 comm="syz.2.911" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 352.297546][ T29] audit: type=1400 audit(1772469121.911:690): avc: denied { node_bind } for pid=9411 comm="syz.2.911" saddr=::ffff:172.20.20.21 src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 352.469331][ T29] audit: type=1400 audit(1772469122.681:691): avc: denied { unmount } for pid=5810 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 352.578019][ T29] audit: type=1400 audit(1772469122.721:692): avc: denied { mounton } for pid=9422 comm="syz.2.915" path="cgroup:[4026532814]" dev="nsfs" ino=4026532814 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 353.781689][ T976] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 354.268116][ T976] usb 3-1: Using ep0 maxpacket: 16 [ 354.355894][ T976] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 354.539872][ T976] usb 3-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 354.569254][ T976] usb 3-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 354.569417][ T9463] syzkaller0: entered promiscuous mode [ 354.583160][ T9463] syzkaller0: entered allmulticast mode [ 354.611999][ T976] usb 3-1: Manufacturer: syz [ 354.632368][ T976] usb 3-1: config 0 descriptor?? [ 354.760313][ T5797] buffer_io_error: 6 callbacks suppressed [ 354.760328][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 354.776499][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 354.789676][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 354.865909][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 354.902253][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 354.924599][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 354.941303][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 354.950052][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 354.958619][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 354.967194][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 355.134748][ T9477] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 355.148111][ T9477] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 355.456146][ T976] usbhid 3-1:0.0: can't add hid device: -71 [ 355.462197][ T976] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 355.491050][ T976] usb 3-1: USB disconnect, device number 28 [ 355.548228][ T9475] 9pnet: p9_errstr2errno: server reported unknown error 0x00000000 [ 357.909683][ T5959] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 358.092890][ T5959] usb 3-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 358.103647][ T5959] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 358.128013][ T29] kauditd_printk_skb: 10 callbacks suppressed [ 358.128031][ T29] audit: type=1400 audit(1772469128.491:703): avc: denied { bind } for pid=9508 comm="syz.0.938" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 358.161939][ T5959] usb 3-1: Product: syz [ 358.170946][ T5959] usb 3-1: Manufacturer: syz [ 358.178786][ T5959] usb 3-1: SerialNumber: syz [ 358.185711][ T29] audit: type=1400 audit(1772469128.491:704): avc: denied { name_bind } for pid=9508 comm="syz.0.938" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 358.212862][ T5959] usb 3-1: config 0 descriptor?? [ 358.225797][ T5959] i2c-tiny-usb 3-1:0.0: version 6d.cc found at bus 003 address 029 [ 358.241629][ T29] audit: type=1400 audit(1772469128.491:705): avc: denied { node_bind } for pid=9508 comm="syz.0.938" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 358.314709][ T29] audit: type=1400 audit(1772469128.491:706): avc: denied { listen } for pid=9508 comm="syz.0.938" lport=20002 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 358.344438][ T29] audit: type=1400 audit(1772469128.501:707): avc: denied { write } for pid=9508 comm="syz.0.938" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 358.382280][ T29] audit: type=1400 audit(1772469128.681:708): avc: denied { nlmsg_write } for pid=9513 comm="syz.4.940" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 358.429512][ T29] audit: type=1400 audit(1772469128.801:709): avc: denied { write } for pid=9520 comm="syz.3.943" path="socket:[25051]" dev="sockfs" ino=25051 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 358.518372][ T9518] kvm: pic: non byte write [ 358.648230][ T29] audit: type=1326 audit(1772469129.031:710): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9526 comm="syz.4.946" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f2ff973db19 code=0x7ffc0000 [ 358.739405][ T29] audit: type=1326 audit(1772469129.031:711): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9526 comm="syz.4.946" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f2ff973db19 code=0x7ffc0000 [ 358.802148][ T29] audit: type=1326 audit(1772469129.031:712): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9526 comm="syz.4.946" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2ff979c799 code=0x7ffc0000 [ 358.878224][ T5959] i2c i2c-1: connected i2c-tiny-usb device [ 359.085856][ T5959] usb 3-1: USB disconnect, device number 29 [ 359.141839][ T9545] tap0: tun_chr_ioctl cmd 1074025681 [ 361.284851][ T5794] buffer_io_error: 198 callbacks suppressed [ 361.284868][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 361.367527][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 361.388806][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 361.407718][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 361.434311][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 361.458085][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 361.493737][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 361.511053][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 361.532633][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 361.551112][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 362.255957][ T9631] netlink: 148 bytes leftover after parsing attributes in process `syz.0.987'. [ 363.443717][ T29] kauditd_printk_skb: 2010 callbacks suppressed [ 363.443737][ T29] audit: type=1400 audit(1772469133.821:2723): avc: denied { mount } for pid=9664 comm="syz.3.1002" name="/" dev="mqueue" ino=4638 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 363.479701][ T9666] kernel read not supported for file /file1 (pid: 9666 comm: syz.3.1002) [ 363.516914][ T29] audit: type=1800 audit(1772469133.871:2724): pid=9666 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.3.1002" name="file1" dev="mqueue" ino=25385 res=0 errno=0 [ 363.618345][ T9670] xt_hashlimit: size too large, truncated to 1048576 [ 363.855971][ T29] audit: type=1400 audit(1772469134.241:2725): avc: denied { read } for pid=9680 comm="syz.4.1008" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 364.140438][ T29] audit: type=1400 audit(1772469134.521:2726): avc: denied { append } for pid=9671 comm="syz.1.1005" name="loop7" dev="devtmpfs" ino=654 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 364.282463][ T9693] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 364.290058][ T9693] batadv_slave_0: entered promiscuous mode [ 364.432239][ T9698] binder: BINDER_SET_CONTEXT_MGR already set [ 364.455934][ T9698] binder: 9696:9698 ioctl 4018620d 200000000040 returned -16 [ 364.493336][ T9702] binder: BINDER_SET_CONTEXT_MGR already set [ 364.503460][ T9702] binder: 9700:9702 ioctl 4018620d 2000000000c0 returned -16 [ 364.523752][ T9702] binder: BINDER_SET_CONTEXT_MGR already set [ 364.529939][ T9702] binder: 9700:9702 ioctl 4018620d 200000000040 returned -16 [ 364.781415][ T5886] usb 2-1: new full-speed USB device number 19 using dummy_hcd [ 364.923581][ T9708] nfs: Unknown parameter 'acÿÿÿÿ' [ 365.000958][ T5886] usb 2-1: config 0 has an invalid interface number: 3 but max is 2 [ 365.031113][ T5886] usb 2-1: config 0 has an invalid interface number: 176 but max is 2 [ 365.064145][ T5886] usb 2-1: config 0 has no interface number 1 [ 365.084759][ T5886] usb 2-1: config 0 has no interface number 2 [ 365.109634][ T5886] usb 2-1: New USB device found, idVendor=05c6, idProduct=9205, bcdDevice=29.ac [ 365.189696][ T5886] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 365.240012][ T5886] usb 2-1: config 0 descriptor?? [ 365.255508][ T29] audit: type=1800 audit(1772469135.641:2727): pid=9718 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.0.1022" name="file0" dev="overlay" ino=1072 res=0 errno=0 [ 366.038224][ T5886] usb 2-1: Could not set interface, error -71 [ 366.120598][ T5886] usb 2-1: USB disconnect, device number 19 [ 366.193746][ T9723] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1023'. [ 367.800497][ T5797] buffer_io_error: 134 callbacks suppressed [ 367.800515][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 367.950536][ T9737] binder: 9736:9737 ioctl c0306201 0 returned -14 [ 368.272274][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 368.280593][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 368.305957][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 368.334465][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 368.391452][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 368.484364][ T9743] binder: BINDER_SET_CONTEXT_MGR already set [ 368.490402][ T9743] binder: 9742:9743 ioctl 4018620d 200000000040 returned -16 [ 368.510101][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 368.527422][ T9741] tipc: Started in network mode [ 368.543462][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 368.568486][ T9741] tipc: Node identity e0000001, cluster identity 4711 [ 368.591445][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 368.600510][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 368.612834][ T9741] tipc: Enabling of bearer rejected, failed to enable media [ 368.882923][ T24] usb 2-1: new full-speed USB device number 20 using dummy_hcd [ 368.965381][ T9753] nfs: Unknown parameter 'acÿÿÿÿ' [ 369.116919][ T24] usb 2-1: config 0 has an invalid interface number: 3 but max is 2 [ 369.161422][ T24] usb 2-1: config 0 has an invalid interface number: 176 but max is 2 [ 369.201632][ T24] usb 2-1: config 0 has no interface number 1 [ 369.223800][ T24] usb 2-1: config 0 has no interface number 2 [ 369.246645][ T24] usb 2-1: New USB device found, idVendor=05c6, idProduct=9205, bcdDevice=29.ac [ 369.287294][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 369.328637][ T24] usb 2-1: config 0 descriptor?? [ 369.712076][ T24] usb 2-1: Could not set interface, error -71 [ 370.144967][ T24] usb 2-1: USB disconnect, device number 20 [ 370.556030][ T9772] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1037'. [ 370.801433][ T1222] usb 1-1: new full-speed USB device number 23 using dummy_hcd [ 371.353306][ T1222] usb 1-1: config 0 has an invalid interface number: 3 but max is 2 [ 371.372270][ T1222] usb 1-1: config 0 has an invalid interface number: 176 but max is 2 [ 371.385987][ T1222] usb 1-1: config 0 has no interface number 1 [ 371.394055][ T1222] usb 1-1: config 0 has no interface number 2 [ 371.404217][ T1222] usb 1-1: New USB device found, idVendor=05c6, idProduct=9205, bcdDevice=29.ac [ 371.416626][ T1222] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 371.430254][ T1222] usb 1-1: config 0 descriptor?? [ 372.178929][ T1222] usb 1-1: Could not set interface, error -71 [ 372.191035][ T1222] usb 1-1: USB disconnect, device number 23 [ 372.417476][ T9780] 9pnet: p9_errstr2errno: server reported unknown error 0x00000000 [ 372.429836][ T9786] binder: BINDER_SET_CONTEXT_MGR already set [ 372.443860][ T9786] binder: 9784:9786 ioctl 4018620d 200000000040 returned -16 [ 372.452973][ T9788] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1039'. [ 372.538205][ T9792] binder: BINDER_SET_CONTEXT_MGR already set [ 372.572855][ T9792] binder: 9789:9792 ioctl 4018620d 2000000000c0 returned -16 [ 372.587275][ T9792] binder: BINDER_SET_CONTEXT_MGR already set [ 372.594539][ T9792] binder: 9789:9792 ioctl 4018620d 200000000040 returned -16 [ 372.603731][ T9792] binder: 9789:9792 ioctl c0306201 200000000240 returned -11 [ 372.803225][ T5797] buffer_io_error: 22 callbacks suppressed [ 372.803248][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 372.885220][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 372.920687][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 372.970041][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 372.978595][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 372.998815][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 373.009932][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 373.022835][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 373.034676][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 373.046366][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 373.058472][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 373.083027][ T24] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 373.272127][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 373.298783][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 373.311115][ T24] usb 4-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 373.320598][ T24] usb 4-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 373.330348][ T24] usb 4-1: Manufacturer: syz [ 373.359320][ T24] usb 4-1: config 0 descriptor?? [ 373.641949][ T29] audit: type=1800 audit(1772469144.031:2728): pid=9808 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.0.1050" name="file0" dev="overlay" ino=1122 res=0 errno=0 [ 373.795485][ T9812] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 373.867778][ T9813] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 373.878768][ T9813] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 375.988831][ T24] usbhid 4-1:0.0: can't add hid device: -71 [ 375.991683][ T9821] binder: BINDER_SET_CONTEXT_MGR already set [ 376.003129][ T9821] binder: 9820:9821 ioctl 4018620d 2000000000c0 returned -16 [ 376.012914][ T24] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 376.016159][ T9821] binder: BINDER_SET_CONTEXT_MGR already set [ 376.029153][ T9821] binder: 9820:9821 ioctl 4018620d 200000000040 returned -16 [ 376.069170][ T24] usb 4-1: USB disconnect, device number 26 [ 377.323402][ T9844] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 378.376055][ T29] audit: type=1400 audit(1772469148.761:2729): avc: denied { bind } for pid=9843 comm="syz.0.1052" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 378.461437][ T24] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 378.469096][ T5886] usb 2-1: new full-speed USB device number 21 using dummy_hcd [ 378.492896][ T29] audit: type=1400 audit(1772469148.811:2730): avc: denied { module_load } for pid=9843 comm="syz.0.1052" path=2F6D656D66643A20C736BE918D183229219A25A2D238D606070EFCFE128F2613AE254054A3B03E5CECA9F951403641108C6E7C202864656C6574656429 dev="hugetlbfs" ino=26757 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=system permissive=1 [ 378.609303][ T9851] Invalid ELF header magic: != ELF [ 378.671807][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 378.690951][ T24] usb 4-1: unable to get BOS descriptor or descriptor too short [ 378.702889][ T24] usb 4-1: config 0 has an invalid interface number: 105 but max is 0 [ 378.712717][ T5886] usb 2-1: config 0 has an invalid interface number: 3 but max is 2 [ 378.724873][ T24] usb 4-1: config 0 has no interface number 0 [ 378.731615][ T5886] usb 2-1: config 0 has an invalid interface number: 176 but max is 2 [ 378.749957][ T24] usb 4-1: config 0 interface 105 has no altsetting 0 [ 378.763100][ T5886] usb 2-1: config 0 has no interface number 1 [ 378.777465][ T24] usb 4-1: New USB device found, idVendor=20dc, idProduct=079c, bcdDevice=a6.f5 [ 378.789645][ T5886] usb 2-1: config 0 has no interface number 2 [ 378.811450][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 378.819459][ T24] usb 4-1: Product: syz [ 378.831076][ T5886] usb 2-1: New USB device found, idVendor=05c6, idProduct=9205, bcdDevice=29.ac [ 378.851402][ T5886] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 378.860627][ T24] usb 4-1: Manufacturer: syz [ 378.865285][ T24] usb 4-1: SerialNumber: syz [ 378.870375][ T5886] usb 2-1: config 0 descriptor?? [ 378.882627][ T24] usb 4-1: config 0 descriptor?? [ 378.920708][ T9855] binder: BINDER_SET_CONTEXT_MGR already set [ 378.929195][ T9855] binder: 9854:9855 ioctl 4018620d 2000000000c0 returned -16 [ 378.971997][ T9855] binder: BINDER_SET_CONTEXT_MGR already set [ 379.002082][ T9855] binder: 9854:9855 ioctl 4018620d 200000000040 returned -16 [ 379.262894][ T5886] usb 2-1: Could not set interface, error -71 [ 379.591698][ T976] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 379.696340][ T9837] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 379.717642][ T5886] usb 2-1: USB disconnect, device number 21 [ 379.725407][ T9837] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 379.766528][ T9867] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 379.789715][ T24] usb-storage 4-1:0.105: USB Mass Storage device detected [ 380.033495][ T29] audit: type=1400 audit(1772469150.421:2731): avc: denied { name_bind } for pid=9866 comm="syz.2.1068" src=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=udp_socket permissive=1 [ 381.039089][ T24] usb 4-1: USB disconnect, device number 27 [ 381.073814][ T976] usb 5-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 381.103339][ T29] audit: type=1400 audit(1772469151.491:2732): avc: denied { write } for pid=9874 comm="syz.1.1071" name="001" dev="devtmpfs" ino=736 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 381.143866][ T976] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 381.164153][ T29] audit: type=1400 audit(1772469151.541:2733): avc: denied { map } for pid=9874 comm="syz.1.1071" path="/dev/bus/usb/006/001" dev="devtmpfs" ino=736 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 381.198688][ T976] usb 5-1: Product: syz [ 381.218488][ T976] usb 5-1: Manufacturer: syz [ 381.228187][ T976] usb 5-1: SerialNumber: syz [ 381.238016][ T9875] wlan0 speed is unknown, defaulting to 1000 [ 381.254950][ T976] usb 5-1: config 0 descriptor?? [ 381.268898][ T976] i2c-tiny-usb 5-1:0.0: version 6d.cc found at bus 005 address 032 [ 381.386623][ T5797] buffer_io_error: 54 callbacks suppressed [ 381.386638][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 381.421936][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 381.430066][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 381.473140][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 381.505116][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 381.547597][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 381.578558][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 381.607357][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 381.644042][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 381.670215][ T9886] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 381.689210][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 381.882320][ T976] i2c i2c-1: failure reading functionality [ 382.329010][ T976] i2c i2c-1: connected i2c-tiny-usb device [ 382.349121][ T976] usb 5-1: USB disconnect, device number 32 [ 383.739935][ T29] audit: type=1800 audit(1772469154.121:2734): pid=9899 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.2.1070" name="file0" dev="overlay" ino=1237 res=0 errno=0 [ 383.859002][ T9906] binder: BINDER_SET_CONTEXT_MGR already set [ 383.965779][ T9906] binder: 9905:9906 ioctl 4018620d 200000000040 returned -16 [ 385.555906][ T9920] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1082'. [ 385.785720][ T9925] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 386.133324][ T9937] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1085'. [ 386.396520][ T9940] nfs: Unknown parameter 'acÿÿÿÿ' [ 387.381446][ T9] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 387.556015][ T9] usb 3-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 387.771689][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 387.780146][ T9] usb 3-1: Product: syz [ 387.857096][ T9] usb 3-1: Manufacturer: syz [ 387.881384][ T29] audit: type=1400 audit(1772469158.231:2735): avc: denied { append } for pid=9954 comm="syz.0.1091" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 387.901401][ T9] usb 3-1: SerialNumber: syz [ 387.950730][ T9] usb 3-1: config 0 descriptor?? [ 388.290576][ T9] i2c-tiny-usb 3-1:0.0: version 6d.cc found at bus 003 address 030 [ 388.703007][ T5797] buffer_io_error: 38 callbacks suppressed [ 388.703022][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 388.781938][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 388.812201][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 388.824861][ T9964] binder: BINDER_SET_CONTEXT_MGR already set [ 388.848758][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 388.856793][ T9964] binder: 9963:9964 ioctl 4018620d 200000000040 returned -16 [ 388.872265][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 388.880632][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 388.925029][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 388.959324][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 388.982005][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 388.995105][ T9967] binder: BINDER_SET_CONTEXT_MGR already set [ 389.001147][ T9967] binder: 9966:9967 ioctl 4018620d 200000000040 returned -16 [ 389.009830][ T9] i2c i2c-1: failure reading functionality [ 389.036798][ T9967] binder: 9966:9967 ioctl c0306201 200000000240 returned -11 [ 389.059997][ T9] i2c i2c-1: connected i2c-tiny-usb device [ 389.066326][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 389.092342][ T9] usb 3-1: USB disconnect, device number 30 [ 389.106484][ T9961] xt_hashlimit: max too large, truncated to 1048576 [ 389.362591][ T9974] overlayfs: option "index=on" is useless in a non-upper mount, ignore [ 389.374482][ T9974] overlayfs: overlapping lowerdir path [ 389.975441][ T9984] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 391.771379][T10000] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1103'. [ 392.230134][T10009] binder: BINDER_SET_CONTEXT_MGR already set [ 392.391533][T10009] binder: 10006:10009 ioctl 4018620d 2000000000c0 returned -16 [ 392.503093][T10009] binder: BINDER_SET_CONTEXT_MGR already set [ 392.509104][T10009] binder: 10006:10009 ioctl 4018620d 200000000040 returned -16 [ 393.481467][ T5921] usb 2-1: new full-speed USB device number 22 using dummy_hcd [ 393.652687][ T5921] usb 2-1: config 0 has an invalid interface number: 3 but max is 2 [ 393.674375][ T5921] usb 2-1: config 0 has an invalid interface number: 176 but max is 2 [ 393.784458][ T5921] usb 2-1: config 0 has no interface number 1 [ 393.801753][ T5921] usb 2-1: config 0 has no interface number 2 [ 393.811512][ T5921] usb 2-1: New USB device found, idVendor=05c6, idProduct=9205, bcdDevice=29.ac [ 393.831559][ T5921] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 393.856062][ T5921] usb 2-1: config 0 descriptor?? [ 394.247815][ T5921] usb 2-1: Could not set interface, error -71 [ 394.711794][ T5921] usb 2-1: USB disconnect, device number 22 [ 396.233887][ T5794] buffer_io_error: 22 callbacks suppressed [ 396.233906][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 396.328875][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 396.438921][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 396.462130][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 396.471999][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 396.707505][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 396.728420][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 396.736795][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 396.762097][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 396.782346][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 396.931084][T10032] nfs: Unknown parameter 'acÿÿÿÿ' [ 397.157218][T10046] binder: BINDER_SET_CONTEXT_MGR already set [ 397.173154][T10046] binder: 10045:10046 ioctl 4018620d 200000000040 returned -16 [ 397.416601][T10050] binder: BINDER_SET_CONTEXT_MGR already set [ 397.422661][T10050] binder: 10049:10050 ioctl 4018620d 200000000040 returned -16 [ 397.432913][T10050] binder: 10049:10050 ioctl c0306201 200000000240 returned -11 [ 397.892423][ T24] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 397.940574][ T29] audit: type=1400 audit(1772469168.311:2736): avc: denied { create } for pid=10063 comm="syz.0.1124" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 398.054907][ T29] audit: type=1326 audit(1772469168.441:2737): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10068 comm="syz.2.1125" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb7e4d9c799 code=0x7ffc0000 [ 398.091114][ T24] usb 5-1: Using ep0 maxpacket: 16 [ 398.110672][ T24] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 398.134037][ T24] usb 5-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 398.154314][ T29] audit: type=1326 audit(1772469168.461:2738): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10068 comm="syz.2.1125" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb7e4d9c799 code=0x7ffc0000 [ 398.182606][ T24] usb 5-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 398.200729][ T24] usb 5-1: Manufacturer: syz [ 398.214742][ T24] usb 5-1: config 0 descriptor?? [ 398.231592][ T29] audit: type=1326 audit(1772469168.461:2739): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10068 comm="syz.2.1125" exe="/root/syz-executor" sig=0 arch=c000003e syscall=172 compat=0 ip=0x7fb7e4d9c799 code=0x7ffc0000 [ 398.261620][ T29] audit: type=1326 audit(1772469168.461:2740): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10068 comm="syz.2.1125" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb7e4d9c799 code=0x7ffc0000 [ 398.321456][ T1222] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 398.339236][ T29] audit: type=1326 audit(1772469168.461:2741): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10068 comm="syz.2.1125" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb7e4d9c799 code=0x7ffc0000 [ 398.387299][ T29] audit: type=1400 audit(1772469168.541:2742): avc: denied { create } for pid=10070 comm="syz.3.1126" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 398.408893][ T29] audit: type=1400 audit(1772469168.601:2743): avc: denied { bind } for pid=10070 comm="syz.3.1126" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 398.438082][ T29] audit: type=1400 audit(1772469168.601:2744): avc: denied { write } for pid=10070 comm="syz.3.1126" path="socket:[27841]" dev="sockfs" ino=27841 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 398.479339][ T1222] usb 3-1: Using ep0 maxpacket: 16 [ 398.479391][ T29] audit: type=1800 audit(1772469168.851:2745): pid=10075 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.0.1127" name="file0" dev="overlay" ino=1215 res=0 errno=0 [ 398.507942][ T1222] usb 3-1: config index 0 descriptor too short (expected 526, got 367) [ 398.551433][ T1222] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 398.603497][ T1222] usb 3-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=a4.96 [ 399.381525][T10083] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 399.392480][T10083] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 399.556843][ T1222] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 399.655164][ T1222] usb 3-1: Product: syz [ 399.659362][ T1222] usb 3-1: Manufacturer: syz [ 399.700810][ T1222] usb 3-1: SerialNumber: syz [ 399.741962][ T1222] usb 3-1: config 0 descriptor?? [ 399.753794][ T24] usbhid 5-1:0.0: can't add hid device: -71 [ 399.759781][ T24] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 399.798274][ T24] usb 5-1: USB disconnect, device number 33 [ 399.971638][ T5886] usb 4-1: new full-speed USB device number 28 using dummy_hcd [ 400.003258][T10069] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 400.026977][T10069] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 400.047743][ T24] usb 3-1: USB disconnect, device number 31 [ 400.133393][ T5886] usb 4-1: config 0 has an invalid interface number: 3 but max is 2 [ 400.145620][ T1222] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 400.164673][ T5886] usb 4-1: config 0 has an invalid interface number: 176 but max is 2 [ 400.181472][ T5886] usb 4-1: config 0 has no interface number 1 [ 400.187586][ T5886] usb 4-1: config 0 has no interface number 2 [ 400.208605][ T5886] usb 4-1: New USB device found, idVendor=05c6, idProduct=9205, bcdDevice=29.ac [ 400.231498][ T5886] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 400.251830][ T5886] usb 4-1: config 0 descriptor?? [ 400.311455][ T1222] usb 2-1: Using ep0 maxpacket: 16 [ 400.319138][ T1222] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 400.333049][ T1222] usb 2-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 400.347977][ T1222] usb 2-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 400.357158][ T1222] usb 2-1: Manufacturer: syz [ 400.375032][ T1222] usb 2-1: config 0 descriptor?? [ 400.605707][ T5886] usb 4-1: Could not set interface, error -71 [ 401.102411][ T5886] usb 4-1: USB disconnect, device number 28 [ 401.319351][ T24] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 401.434279][T10110] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 401.446897][T10110] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 401.701389][ T24] usb 5-1: Using ep0 maxpacket: 16 [ 401.710619][ T24] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 401.927527][ T24] usb 5-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 401.937762][ T24] usb 5-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 401.946086][ T24] usb 5-1: Manufacturer: syz [ 401.956256][ T24] usb 5-1: config 0 descriptor?? [ 401.978108][ T1222] usbhid 2-1:0.0: can't add hid device: -71 [ 401.993639][ T1222] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 402.025456][ T1222] usb 2-1: USB disconnect, device number 23 [ 402.883535][T10125] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1142'. [ 402.910430][T10103] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 402.919045][T10103] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 402.958375][ T24] usbhid 5-1:0.0: can't add hid device: -71 [ 402.972305][ T24] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 403.000663][ T24] usb 5-1: USB disconnect, device number 34 [ 403.284751][ T5794] buffer_io_error: 54 callbacks suppressed [ 403.284768][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 403.358894][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 403.528935][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 403.593123][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 403.620311][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 403.791687][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 404.751651][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 404.760889][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 404.781299][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 404.789618][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 405.730329][T10152] tmpfs: Bad value for 'grpquota_inode_hardlimit' [ 406.124399][T10151] overlayfs: option "index=on" is useless in a non-upper mount, ignore [ 406.136368][T10151] overlayfs: overlapping lowerdir path [ 406.620568][ T29] kauditd_printk_skb: 6 callbacks suppressed [ 406.620585][ T29] audit: type=1800 audit(1772469177.001:2752): pid=10160 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.0.1152" name="file0" dev="overlay" ino=1301 res=0 errno=0 [ 406.816725][T10168] binder: BINDER_SET_CONTEXT_MGR already set [ 406.823338][T10168] binder: 10166:10168 ioctl 4018620d 200000000040 returned -16 [ 406.832551][T10168] binder: 10166:10168 ioctl c0306201 200000000240 returned -11 [ 406.943312][T10173] kAFS: unable to lookup cell 'ÿ' [ 406.949848][T10173] kAFS: unable to lookup cell '(,c¾Ì' [ 406.978388][ T29] audit: type=1400 audit(1772469177.291:2753): avc: denied { mount } for pid=10162 comm="syz.1.1153" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 406.980834][T10174] FAULT_INJECTION: forcing a failure. [ 406.980834][T10174] name failslab, interval 1, probability 0, space 0, times 0 [ 407.072178][T10174] CPU: 0 UID: 0 PID: 10174 Comm: syz.0.1157 Tainted: G L syzkaller #0 PREEMPT(full) [ 407.072207][T10174] Tainted: [L]=SOFTLOCKUP [ 407.072212][T10174] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 407.072221][T10174] Call Trace: [ 407.072226][T10174] [ 407.072232][T10174] dump_stack_lvl+0x100/0x190 [ 407.072263][T10174] should_fail_ex.cold+0x5/0xa [ 407.072286][T10174] should_failslab+0xc2/0x120 [ 407.072313][T10174] __kmalloc_cache_noprof+0x7a/0x6f0 [ 407.072333][T10174] ? rtnl_newlink+0x126/0x2380 [ 407.072353][T10174] ? __pfx_rtnl_newlink+0x10/0x10 [ 407.072369][T10174] rtnl_newlink+0x126/0x2380 [ 407.072394][T10174] ? __pfx_rtnl_newlink+0x10/0x10 [ 407.072409][T10174] ? find_held_lock+0x2b/0x80 [ 407.072428][T10174] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 407.072451][T10174] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 407.072475][T10174] ? avc_has_perm_noaudit+0x145/0x3b0 [ 407.072508][T10174] ? __lock_acquire+0x4a5/0x2630 [ 407.072543][T10174] ? find_held_lock+0x2b/0x80 [ 407.072562][T10174] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 407.072578][T10174] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 407.072595][T10174] ? __pfx_rtnl_newlink+0x10/0x10 [ 407.072611][T10174] rtnetlink_rcv_msg+0x95e/0xe90 [ 407.072631][T10174] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 407.072656][T10174] ? ref_tracker_free+0x37e/0x6c0 [ 407.072685][T10174] netlink_rcv_skb+0x159/0x420 [ 407.072707][T10174] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 407.072726][T10174] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 407.072751][T10174] ? netlink_deliver_tap+0x1ae/0xcc0 [ 407.072775][T10174] netlink_unicast+0x5aa/0x870 [ 407.072799][T10174] ? __pfx_netlink_unicast+0x10/0x10 [ 407.072827][T10174] netlink_sendmsg+0x8b0/0xda0 [ 407.072851][T10174] ? __pfx_netlink_sendmsg+0x10/0x10 [ 407.072868][T10174] ? __might_fault+0x40/0x140 [ 407.072899][T10174] ____sys_sendmsg+0xa54/0xc30 [ 407.072923][T10174] ? __pfx_____sys_sendmsg+0x10/0x10 [ 407.072960][T10174] ___sys_sendmsg+0x190/0x1e0 [ 407.072984][T10174] ? __pfx____sys_sendmsg+0x10/0x10 [ 407.073035][T10174] __sys_sendmsg+0x170/0x220 [ 407.073054][T10174] ? __pfx___sys_sendmsg+0x10/0x10 [ 407.073083][T10174] do_syscall_64+0x106/0xf80 [ 407.073101][T10174] ? clear_bhb_loop+0x40/0x90 [ 407.073123][T10174] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 407.073140][T10174] RIP: 0033:0x7f95d7d9c799 [ 407.073155][T10174] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 407.073171][T10174] RSP: 002b:00007f95d8d19028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 407.073188][T10174] RAX: ffffffffffffffda RBX: 00007f95d8015fa0 RCX: 00007f95d7d9c799 [ 407.073199][T10174] RDX: 0000000008048802 RSI: 00002000000000c0 RDI: 0000000000000003 [ 407.073209][T10174] RBP: 00007f95d8d19090 R08: 0000000000000000 R09: 0000000000000000 [ 407.073218][T10174] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 407.073228][T10174] R13: 00007f95d8016038 R14: 00007f95d8015fa0 R15: 00007ffec104f578 [ 407.073251][T10174] [ 407.688317][ T5959] usb 3-1: new full-speed USB device number 32 using dummy_hcd [ 408.257170][ T5959] usb 3-1: config 0 has an invalid interface number: 3 but max is 2 [ 408.265237][ T5959] usb 3-1: config 0 has an invalid interface number: 176 but max is 2 [ 408.291023][ T5959] usb 3-1: config 0 has no interface number 1 [ 408.306527][ T5959] usb 3-1: config 0 has no interface number 2 [ 408.334407][ T5959] usb 3-1: New USB device found, idVendor=05c6, idProduct=9205, bcdDevice=29.ac [ 408.346954][ T5959] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 408.373811][ T5959] usb 3-1: config 0 descriptor?? [ 408.640747][ T5794] buffer_io_error: 54 callbacks suppressed [ 408.640762][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 408.702040][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 408.717847][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 408.738745][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 409.187608][ T5959] usb 3-1: Could not set interface, error -71 [ 409.205588][ T5959] usb 3-1: USB disconnect, device number 32 [ 409.206073][T10188] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1162'. [ 409.238708][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 409.303584][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 409.371097][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 409.416799][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 409.551932][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 409.676715][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 410.127403][T10196] nfs: Unknown parameter 'acÿÿÿÿ' [ 410.459778][T10202] nfs: Unknown parameter 'acÿÿÿÿ' [ 410.584025][T10212] binder: BINDER_SET_CONTEXT_MGR already set [ 410.623589][T10212] binder: 10210:10212 ioctl 4018620d 2000000000c0 returned -16 [ 410.635456][T10214] binder: BINDER_SET_CONTEXT_MGR already set [ 410.642037][T10214] binder: 10210:10214 ioctl 4018620d 200000000040 returned -16 [ 410.662405][T10214] binder: 10210:10214 ioctl c0306201 200000000240 returned -11 [ 411.295292][ T29] audit: type=1400 audit(1772469181.681:2754): avc: denied { create } for pid=10222 comm="syz.1.1170" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 411.472399][ T29] audit: type=1400 audit(1772469181.771:2755): avc: denied { ioctl } for pid=10222 comm="syz.1.1170" path="socket:[27416]" dev="sockfs" ino=27416 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 412.049278][T10232] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1173'. [ 412.448142][T10237] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 413.711423][ T5921] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 413.861633][ T5921] usb 4-1: Using ep0 maxpacket: 16 [ 413.876878][ T5921] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 413.909366][ T5921] usb 4-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 413.933327][ T5921] usb 4-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 413.961740][ T1222] usb 1-1: new full-speed USB device number 24 using dummy_hcd [ 413.969366][ T5921] usb 4-1: Manufacturer: syz [ 414.010007][ T5921] usb 4-1: config 0 descriptor?? [ 414.154337][ T1222] usb 1-1: config 0 has an invalid interface number: 3 but max is 2 [ 414.162474][ T1222] usb 1-1: config 0 has an invalid interface number: 176 but max is 2 [ 414.200438][ T1222] usb 1-1: config 0 has no interface number 1 [ 414.236564][ T1222] usb 1-1: config 0 has no interface number 2 [ 414.272063][ T1222] usb 1-1: New USB device found, idVendor=05c6, idProduct=9205, bcdDevice=29.ac [ 414.310827][ T1222] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 414.408514][ T1222] usb 1-1: config 0 descriptor?? [ 414.505320][T10247] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 414.515127][T10247] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 414.998081][ T5921] usbhid 4-1:0.0: can't add hid device: -71 [ 415.035667][ T5921] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 415.047104][ T29] audit: type=1800 audit(1772469185.411:2756): pid=10251 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.2.1176" name="file0" dev="overlay" ino=1348 res=0 errno=0 [ 415.557601][ T1222] usb 1-1: Could not set interface, error -71 [ 415.805855][ T5921] usb 4-1: USB disconnect, device number 29 [ 416.267231][ T1222] usb 1-1: USB disconnect, device number 24 [ 416.483334][ T5797] buffer_io_error: 22 callbacks suppressed [ 416.483349][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 416.507103][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 416.534594][T10261] overlayfs: overlapping lowerdir path [ 416.545388][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 416.572957][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 416.618965][ T29] audit: type=1400 audit(1772469187.001:2757): avc: denied { read } for pid=10260 comm="syz.3.1181" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 417.077468][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 417.091973][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 417.118269][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 417.867207][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 417.893187][ T29] audit: type=1400 audit(1772469188.281:2758): avc: denied { create } for pid=10274 comm="syz.0.1184" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 418.049327][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 418.066294][ T5797] Buffer I/O error on dev loop3, logical block 0, async page read [ 418.111420][ T29] audit: type=1400 audit(1772469188.311:2759): avc: denied { getopt } for pid=10274 comm="syz.0.1184" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 418.115650][T10282] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 419.096149][T10293] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1187'. [ 419.381704][ T29] audit: type=1400 audit(1772469189.711:2760): avc: denied { ioctl } for pid=10274 comm="syz.0.1184" path="socket:[27520]" dev="sockfs" ino=27520 ioctlcmd=0x9412 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 419.937255][ T29] audit: type=1400 audit(1772469189.711:2761): avc: denied { create } for pid=10274 comm="syz.0.1184" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 420.037408][ T29] audit: type=1400 audit(1772469189.711:2762): avc: denied { connect } for pid=10274 comm="syz.0.1184" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 420.669202][ T9941] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 421.731398][ T9941] usb 3-1: Using ep0 maxpacket: 16 [ 421.738200][ T9941] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 421.986050][ T5794] buffer_io_error: 38 callbacks suppressed [ 421.986061][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 422.000059][ T9941] usb 3-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 422.032219][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 422.040477][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 422.052604][ T9941] usb 3-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 422.060696][ T9941] usb 3-1: Manufacturer: syz [ 422.342546][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 422.350893][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 422.368206][ T9941] usb 3-1: config 0 descriptor?? [ 422.404832][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 422.430806][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 422.461956][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 422.490858][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 422.512059][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 422.771607][ T24] usb 5-1: new full-speed USB device number 35 using dummy_hcd [ 422.984545][T10321] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 423.004627][T10321] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 423.183763][ T24] usb 5-1: config 0 has an invalid interface number: 3 but max is 2 [ 423.191910][ T24] usb 5-1: config 0 has an invalid interface number: 176 but max is 2 [ 423.281496][ T9941] usbhid 3-1:0.0: can't add hid device: -71 [ 423.287542][ T24] usb 5-1: config 0 has no interface number 1 [ 423.295034][ T9941] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 423.307295][ T24] usb 5-1: config 0 has no interface number 2 [ 423.323680][ T9941] usb 3-1: USB disconnect, device number 33 [ 423.332176][ T24] usb 5-1: New USB device found, idVendor=05c6, idProduct=9205, bcdDevice=29.ac [ 423.363952][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 423.623158][ T24] usb 5-1: config 0 descriptor?? [ 423.692609][T10326] 9pnet: p9_errstr2errno: server reported unknown error 0x000000000 [ 424.037472][ T24] usb 5-1: Could not set interface, error -71 [ 424.481668][ T24] usb 5-1: USB disconnect, device number 35 [ 424.672891][T10336] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1201'. [ 425.926834][T10349] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1204'. [ 426.025841][ T29] audit: type=1800 audit(1772469196.401:2763): pid=10355 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.2.1205" name="file0" dev="overlay" ino=1389 res=0 errno=0 [ 426.758491][T10364] binder: BINDER_SET_CONTEXT_MGR already set [ 426.784970][T10364] binder: 10363:10364 ioctl 4018620d 2000000000c0 returned -16 [ 426.827135][T10364] binder: BINDER_SET_CONTEXT_MGR already set [ 426.888598][T10364] binder: 10363:10364 ioctl 4018620d 200000000040 returned -16 [ 427.068623][T10370] 9pnet: p9_errstr2errno: server reported unknown error 0x000000000 [ 428.330710][T10386] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1216'. [ 428.602084][ T5794] buffer_io_error: 22 callbacks suppressed [ 428.602100][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 428.616665][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 428.625167][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 428.633981][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 428.660832][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 428.681428][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 428.693803][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 428.703431][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 428.712256][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 428.720940][ T5794] Buffer I/O error on dev loop3, logical block 0, async page read [ 429.033913][T10401] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1220'. [ 429.267152][T10403] nfs: Unknown parameter 'acÿÿÿÿ' [ 429.475047][ T29] audit: type=1800 audit(1772469199.791:2764): pid=10400 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.2.1219" name="file0" dev="overlay" ino=1423 res=0 errno=0 [ 429.559917][T10407] binder: BINDER_SET_CONTEXT_MGR already set [ 429.597850][T10407] binder: 10406:10407 ioctl 4018620d 2000000000c0 returned -16 [ 429.622453][T10407] binder: BINDER_SET_CONTEXT_MGR already set [ 429.635855][T10407] binder: 10406:10407 ioctl 4018620d 200000000040 returned -16 [ 429.671641][T10407] binder: 10406:10407 ioctl c0306201 200000000240 returned -11 [ 430.469893][T10417] 9pnet: p9_errstr2errno: server reported unknown error 0x000000000 [ 430.863336][ T29] audit: type=1800 audit(1772469201.241:2765): pid=10427 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.3.1228" name="file0" dev="overlay" ino=1315 res=0 errno=0 [ 432.000155][ T29] audit: type=1800 audit(1772469202.381:2766): pid=10444 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.0.1232" name="file0" dev="overlay" ino=1385 res=0 errno=0 [ 432.031954][ T5878] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 432.291416][ T5878] usb 4-1: Using ep0 maxpacket: 16 [ 432.323077][ T5878] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 432.395288][ T5878] usb 4-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 432.416512][ T5878] usb 4-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 432.450140][ T5878] usb 4-1: Manufacturer: syz [ 432.614734][ T5878] usb 4-1: config 0 descriptor?? [ 432.731402][T10448] nfs: Unknown parameter 'acÿÿÿÿ' [ 433.420345][T10460] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 433.761689][T10460] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 433.986135][T10465] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1238'. [ 434.229972][ T5878] usbhid 4-1:0.0: can't add hid device: -71 [ 434.246801][ T5878] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 434.432110][ T5878] usb 4-1: USB disconnect, device number 30 [ 434.432237][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.441336][ C0] sched: DL replenish lagged too much [ 496.020118][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.341284][ C1] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 563.348245][ C1] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P10470/1:b..l [ 563.356576][ C1] rcu: (detected by 1, t=10503 jiffies, g=35897, q=1106962 ncpus=2) [ 563.364640][ C1] task:syz.0.1240 state:R running task stack:26456 pid:10470 tgid:10467 ppid:5803 task_flags:0x400040 flags:0x00080000 [ 563.378898][ C1] Call Trace: [ 563.382156][ C1] [ 563.385074][ C1] __schedule+0xfee/0x6120 [ 563.389476][ C1] ? rcu_is_watching+0x12/0xc0 [ 563.394210][ C1] ? trace_sched_exit_tp+0x13a/0x180 [ 563.399483][ C1] ? __pfx___schedule+0x10/0x10 [ 563.404306][ C1] ? mark_held_locks+0x40/0x70 [ 563.409043][ C1] preempt_schedule_irq+0x50/0x90 [ 563.414034][ C1] irqentry_exit+0x17b/0x670 [ 563.418595][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 563.424543][ C1] RIP: 0010:lock_acquire+0x5e/0x380 [ 563.429712][ C1] Code: 05 7b d2 28 12 83 f8 07 0f 87 f0 00 00 00 48 0f a3 05 46 a6 f4 0e 0f 82 c2 02 00 00 8b 35 2e da f4 0e 85 f6 0f 85 dd 00 00 00 <48> 8b 44 24 30 65 48 2b 05 1d d2 28 12 0f 85 02 03 00 00 48 83 c4 [ 563.449286][ C1] RSP: 0018:ffffc9000381ebe0 EFLAGS: 00000206 [ 563.455320][ C1] RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000001 [ 563.463260][ C1] RDX: 0000000000000000 RSI: ffffffff8de4ce0f RDI: ffffffff8c1af6a0 [ 563.471199][ C1] RBP: ffffffff8e7e93e0 R08: 00000000dacd92cc R09: 0000000000000007 [ 563.479144][ C1] R10: 0000000000000200 R11: 0000000000000000 R12: 0000000000000002 [ 563.487081][ C1] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 563.495025][ C1] ? unwind_next_frame+0x3be/0x1ea0 [ 563.500193][ C1] ? unwind_next_frame+0x3be/0x1ea0 [ 563.505365][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 563.511490][ C1] unwind_next_frame+0xd1/0x1ea0 [ 563.516394][ C1] ? unwind_next_frame+0xbd/0x1ea0 [ 563.521471][ C1] ? asm_exc_page_fault+0x26/0x30 [ 563.526462][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 563.532597][ C1] arch_stack_walk+0x94/0xf0 [ 563.537157][ C1] ? asm_exc_page_fault+0x26/0x30 [ 563.542149][ C1] stack_trace_save+0x8e/0xc0 [ 563.546802][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 563.552150][ C1] ? unwind_get_return_address+0x59/0xa0 [ 563.557752][ C1] save_stack+0x162/0x1e0 [ 563.562053][ C1] ? __pfx_save_stack+0x10/0x10 [ 563.566873][ C1] ? post_alloc_hook+0x153/0x170 [ 563.571779][ C1] ? get_page_from_freelist+0x111d/0x3140 [ 563.577466][ C1] ? __alloc_frozen_pages_noprof+0x27c/0x2ba0 [ 563.583516][ C1] ? alloc_pages_mpol+0x1fb/0x550 [ 563.588529][ C1] ? folio_alloc_mpol_noprof+0x36/0x340 [ 563.594053][ C1] ? vma_alloc_folio_noprof+0xed/0x1d0 [ 563.599490][ C1] ? do_wp_page+0xf28/0x4f00 [ 563.604050][ C1] ? __handle_mm_fault+0x1ac8/0x2b60 [ 563.609303][ C1] ? handle_mm_fault+0x36d/0xa20 [ 563.614210][ C1] ? do_user_addr_fault+0x74c/0x12f0 [ 563.619537][ C1] ? exc_page_fault+0x6f/0xd0 [ 563.624204][ C1] ? asm_exc_page_fault+0x26/0x30 [ 563.629240][ C1] ? __lock_acquire+0x4a5/0x2630 [ 563.634165][ C1] __set_page_owner+0x8c/0x540 [ 563.638907][ C1] ? __pfx___set_page_owner+0x10/0x10 [ 563.644253][ C1] ? bad_range+0x261/0x400 [ 563.648648][ C1] ? lockdep_hardirqs_on+0x78/0x100 [ 563.653819][ C1] post_alloc_hook+0x153/0x170 [ 563.658553][ C1] get_page_from_freelist+0x111d/0x3140 [ 563.664072][ C1] ? __pfx___might_resched+0x10/0x10 [ 563.669325][ C1] ? prepare_alloc_pages+0x16d/0x5f0 [ 563.674582][ C1] __alloc_frozen_pages_noprof+0x27c/0x2ba0 [ 563.680453][ C1] ? kernel_text_address+0xf1/0x100 [ 563.685618][ C1] ? unwind_get_return_address+0x59/0xa0 [ 563.691226][ C1] ? __pfx_native_flush_tlb_one_user+0x10/0x10 [ 563.697363][ C1] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 563.703661][ C1] ? mark_held_locks+0x40/0x70 [ 563.708396][ C1] ? lockdep_hardirqs_on+0x78/0x100 [ 563.713562][ C1] ? __pfx_flush_tlb_func+0x10/0x10 [ 563.718734][ C1] ? smp_call_function_many_cond+0x5d3/0x1500 [ 563.724774][ C1] ? __lock_acquire+0x4a5/0x2630 [ 563.729690][ C1] ? __lock_acquire+0x4a5/0x2630 [ 563.734599][ C1] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 563.740472][ C1] ? policy_nodemask+0xed/0x4f0 [ 563.745299][ C1] alloc_pages_mpol+0x1fb/0x550 [ 563.750132][ C1] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 563.755475][ C1] ? lock_acquire+0x1cf/0x380 [ 563.760124][ C1] folio_alloc_mpol_noprof+0x36/0x340 [ 563.765463][ C1] vma_alloc_folio_noprof+0xed/0x1d0 [ 563.770715][ C1] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 563.776573][ C1] ? rcu_read_unlock+0x2d/0xb0 [ 563.781306][ C1] ? rcu_read_unlock+0x2d/0xb0 [ 563.786046][ C1] ? __lock_acquire+0x4a5/0x2630 [ 563.790962][ C1] do_wp_page+0xf28/0x4f00 [ 563.795358][ C1] ? __pfx_do_wp_page+0x10/0x10 [ 563.800176][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 563.805518][ C1] __handle_mm_fault+0x1ac8/0x2b60 [ 563.810600][ C1] ? mt_find+0x45e/0x8e0 [ 563.814811][ C1] ? __pfx___handle_mm_fault+0x10/0x10 [ 563.820238][ C1] ? __pfx_mt_find+0x10/0x10 [ 563.824811][ C1] ? find_vma+0xbf/0x140 [ 563.829022][ C1] ? __pfx_find_vma+0x10/0x10 [ 563.833669][ C1] handle_mm_fault+0x36d/0xa20 [ 563.838404][ C1] do_user_addr_fault+0x74c/0x12f0 [ 563.843500][ C1] exc_page_fault+0x6f/0xd0 [ 563.847977][ C1] asm_exc_page_fault+0x26/0x30 [ 563.852795][ C1] RIP: 0010:__put_user_nocheck_4+0x3/0x10 [ 563.858481][ C1] Code: d9 0f 01 cb 89 01 31 c9 0f 01 ca e9 97 d0 03 00 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 01 cb <89> 01 31 c9 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 [ 563.878054][ C1] RSP: 0018:ffffc9000381f9d8 EFLAGS: 00050246 [ 563.884112][ C1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000020000022c030 [ 563.892066][ C1] RDX: 0000000000080000 RSI: ffffffff8954dbe1 RDI: ffff88802e1c4980 [ 563.900018][ C1] RBP: ffffc9000381fd78 R08: 0000000000000005 R09: 0000000000000000 [ 563.907971][ C1] R10: 0000000000000002 R11: 0000000000000000 R12: 0000000000000000 [ 563.916000][ C1] R13: 000020000022c000 R14: ffffc9000381fdbc R15: 0000000000000002 [ 563.923945][ C1] ? ____sys_recvmsg+0x2e1/0x6b0 [ 563.928860][ C1] ____sys_recvmsg+0x2ec/0x6b0 [ 563.933599][ C1] ? __pfx_____sys_recvmsg+0x10/0x10 [ 563.938858][ C1] ? ___sys_recvmsg+0x177/0x1a0 [ 563.943685][ C1] ? kfree+0x2ec/0x6b0 [ 563.947740][ C1] ? ___sys_recvmsg+0xef/0x1a0 [ 563.952491][ C1] ___sys_recvmsg+0x16a/0x1a0 [ 563.957150][ C1] ? __pfx____sys_recvmsg+0x10/0x10 [ 563.962331][ C1] ? __pfx___might_resched+0x10/0x10 [ 563.967590][ C1] do_recvmmsg+0x301/0x760 [ 563.971989][ C1] ? __pfx_do_recvmmsg+0x10/0x10 [ 563.976899][ C1] ? do_futex+0x192/0x350 [ 563.981208][ C1] ? __x64_sys_futex+0x34f/0x4d0 [ 563.986121][ C1] __x64_sys_recvmmsg+0x22a/0x280 [ 563.991114][ C1] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 563.996636][ C1] do_syscall_64+0x106/0xf80 [ 564.001196][ C1] ? clear_bhb_loop+0x40/0x90 [ 564.005842][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 564.011704][ C1] RIP: 0033:0x7f95d7d9c799 [ 564.016097][ C1] RSP: 002b:00007f95d8cf8028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 564.024484][ C1] RAX: ffffffffffffffda RBX: 00007f95d8016090 RCX: 00007f95d7d9c799 [ 564.032446][ C1] RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000003 [ 564.040400][ C1] RBP: 00007f95d7e32bd9 R08: 0000000000000000 R09: 0000000000000000 [ 564.048354][ C1] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 564.056295][ C1] R13: 00007f95d8016128 R14: 00007f95d8016090 R15: 00007ffec104f578 [ 564.064242][ C1]