last executing test programs: 5.077703643s ago: executing program 4 (id=91): socket(0x1d, 0x6, 0x10441) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="090d2000000000f0ff000700000008000300", @ANYRES32=r2, @ANYBLOB="0800051d000000001400060076657468115f746f5f7465616d0000000400cc0008000500090000001400040073"], 0x58}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000010024bd7000fc0ddf2500000000", @ANYRES32=0x0, @ANYBLOB="1b0b04000300000008001b"], 0x28}, 0x1, 0x0, 0x0, 0x68010}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r4, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) 4.979728725s ago: executing program 1 (id=93): unshare(0x22020600) r0 = socket(0x10, 0x803, 0x0) write(r0, &(0x7f0000000340)="2600000022004701050007108980e8ff06006d20002b1ffec0e90101c7bb0000b00000000000", 0x26) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000d9bffc), 0x4) sendto(r0, &(0x7f0000000380)="120000001200e7ef007b00000000000000a1", 0x12, 0x20000090, 0x0, 0x0) recvmmsg(r0, 0x0, 0x0, 0x10301, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 4.925538695s ago: executing program 4 (id=94): socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x800, &(0x7f00000000c0)={[{@i_version}]}, 0x26, 0x777, &(0x7f0000000b00)="$eJzs3M1rXFUbAPDn3mSSfuR9Jy+84MdCxBZaKJ0kzaZdSOPGXaFQcFtDMgkhN5mQmdROLNi6FmqzURBEXbt0K5T6B7iTgoJ7QbTGhbgZuZNkamImnTRJJ6a/H9zMOffjPM+TuZzMhZwJ4Ln1av4jiRiIiKsRUVzfn0ZEX7N1LOL22nmrj25N5FsSjca1X5L8slhtFFtjJeuvJ6N5SbwYEQ8KEefe/2fcan15djzLyovr/aHa3MJQtb58fmZufLo8XZ4fGb00fHF09OLw6BNreKHDWk+/den4vW/fXFn57qva3Vd6zycx1qw71mvrcJhdWfudFGJsy/75gwjWRUm3EwAAoCP55/yeiOhtfkotRk+zBQAAABwljf4GAAAAcOQl0e0MAAAAgIO18X8AG2t7D2odbDs/vxERg9vF722uIY44FoWIOLGabFqZkKxdBnty+05E3B/bev99kd9ht/c49vCW/uY10n17HJ39cD+ff8Za80/0teaftDX/xDbzT+/GdyfsUfv573H8njbz39UOY3z96UuFtvHvRLzcu138pBU/aRP/7b8P9Hr7+HdXPrjX7ljj84gz2/79STbF2uH7IcamZrKkuZCtjQd/nn24U/0n2sVPdq5/oX3ITd5d/W223VySxz97auf3f7v4+T3x4Xoeeen31l/z/sqWGKfmvv9mp/onIxpP8/5/1mH9P37Zf7PDUwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKApjYiBSNJSq52mpVLEyYj4f5xIs0q1dm6qsjQ/mR+LGIxCOjWTlYcjorjWT/L+SLP9uH9hS380Iv73w/G1oDNZuTRRySa7XTwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAtJyNiIJK0FBFpRPxeTNNSKaK3g2v7n0F+AAAAwD4Z7HYCAAAAwIHz/A8AAABH39M+/yf7nAcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwpF29ciXfGquPbk3k/ckb9aXZyo3zk+XqbGluaaI0UVlcKE1XKtNZuTRRmXvSeFmlsjByKZZuDtXK1dpQtb58fa6yNF+7PjM3Pl2+Xi7E3deu9DyT0gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANiFgeaWpKWISJvtNC2VIv4TEYNRSKZmsvJwRPw3Ih4WC/15f6TbSQMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALDvqvXl2fEsKy8e/UYSye5LPh6HI/l/R2Pjrjos+RzexnsRcQjS2KHRzVkJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIBuqdaXZ8ezrLxY7XYmAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdFf6UxIR+XameHpg69G+5I9i8zUi3vnk2kc3x2u1xZF8/6+t/bWP1/df6Eb+AAAA8Fy4vJuTN57TN57jAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOlWtL8+OZ1l5cW+Ny1FfbiRtzul2jQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwNP5KwAA//9iD79Z") userfaultfd(0x1) socket$inet6(0xa, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) socket$inet6(0x10, 0x3, 0x0) r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x0, 0x80) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = userfaultfd(0x801) syz_usb_connect$uac1(0x3, 0xdc, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c240208000103000000ff000924060506020100000924030003030005490c240206", @ANYRES8=r1, @ANYBLOB="0741bc23e0fe44"], 0x0) 4.087930288s ago: executing program 1 (id=96): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001700)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWRULE={0x20, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x48}}, 0x0) 4.087776718s ago: executing program 1 (id=97): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@newsa={0x138, 0x10, 0xad0107152c5a2e33, 0x0, 0x0, {{@in=@dev, @in6=@private2}, {@in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x6c}, @in6=@remote, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0) 4.087671858s ago: executing program 1 (id=98): syz_usb_connect$uac1(0x1, 0x90, &(0x7f0000000240)=ANY=[@ANYBLOB="12010102000000086307802040000102030109027e0003018160030904000000010100000a24010900280002"], &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) 3.098499443s ago: executing program 4 (id=102): unshare(0x22020400) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$FUSE_DEV_IOC_CLONE(r1, 0x8004e500, &(0x7f0000000140)=r0) 2.822357727s ago: executing program 4 (id=106): r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) bind$can_raw(r0, &(0x7f00000001c0)={0x1d, r1}, 0x10) setsockopt$CAN_RAW_RECV_OWN_MSGS(r0, 0x65, 0x4, &(0x7f0000000040)=0x1, 0x4) sendmsg$can_raw(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=@can={{0x3}, 0x3, 0x2, 0x0, 0x0, "ee0d702fac00008a"}, 0x10}, 0x1, 0x0, 0x0, 0x801}, 0xd209f6d83486bb56) recvmmsg(r0, &(0x7f0000002480)=[{{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, &(0x7f0000004500)=[{&(0x7f0000001400)=""/26, 0x1a}], 0x1}, 0x2fa}], 0x2, 0x2, 0x0) 2.396148603s ago: executing program 0 (id=112): ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x11) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x800, &(0x7f0000000000), 0x26, 0x76b, &(0x7f0000000d40)="$eJzs3M1rHGUYAPBnptmmaVM3guDHQYQWWijdJM2lPTVevBUKBa81JJsQMsmG7KZ2Y8HWs1Cbi4Ig6tmjV6HUP8CbFBS8C6I1HsTLymw2qY3Z7babdEv6+8F03nc+3ud5doe3O5CZAF5Yb+X/JBHDEXE5Ioqt7WlEHG62jkTc3Dxu48GN6XxJotG48nuSnxYbjeL2WElrfSyap8RrEXGvEHHmo//HrdbXFqayrLzS6o/WFpdHq/W1s/OLU3PlufLS+MSFsfMTE+fHJh5bw6td1nry3QtDd354Z339x29rt98cOJvEZLPuaNXW5TBPZPMzKcTkju1L+xGsj5J+JwAAQFfy3/mHImKg+Su1GIeaLQAAAOAgaQw2enA8ejkbAAAAeFYS9/AAAABwwG39HcDWs7379RxsO7+9HREju8UfaD5DHHEkChFxdCNpPaOwKdk8DXpy81ZE3J3cef19nV9hN3sce2xH/9FnpA/3ODp74W4+/0zuNv+k2/NP/Gf+2TKw9e6EHrWf/x7GP7RL/KT1voZufPfF64W28W9FvDGwW/xkO37SJv57Xca/vf7xnXb7Gl9FnNr1/5/kkVgd3g8xOTufdXz9wL1/Tt/vVP/RdvGTzvUvd1n/Bxt/LrSbS/L4p090/v53i59fE5+08kgj4k5rnffXd8Q4sfjT953qn4loPM33/2WX9f/yzeD1Lg8FAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACApjQihiNJS9vtNC2VIo5FxCtxNM0q1dqZ2crq0ky+L2IkCunsfFYei4jiZj/J++PN9sP+uR39iYh4+eehzaDzWbk0Xclm+l08AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA245FxHAkaSki0oj4q5impVLEQBfnDj6D/AAAAIA9MtLvBAAAAIB95/4fAAAADr6nvf9P9jgPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4EC7fOlSvjQ2HtyYzvsz1+qrC5VrZ2fK1YXS4up0abqyslyaq1TmsnJpurL4uPGySmV5/EKsXh+tlau10Wp97epiZXWpdnV+cWqufLVceCZVAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8KSGm0uSliIibbbTtFSKOB4RI1FIZuez8lhEvBQR94uFwbw/3u+kAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2HPV+trCVJaVVzQOVCNpbOp5wKF9yXAonpcPqk+NDyPiOUijQ6PfMxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP1Qra8tTGVZeaXa70wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADor/TXJCLy5VTx5PDOvYeTv4vNdUS8//mVT69P1Wor4/n2P7a31z5rbT/Xj/wBAADghXDxSQ7euk/fuo8HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADoVrW+tjCVZeWV3hoXo77WSNoc0+8aAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAp/NvAAAA//9r5ceD") chdir(&(0x7f0000000240)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x10) 2.231865336s ago: executing program 0 (id=113): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x8fff, 0x0) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4b, &(0x7f0000000100)=0x401, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_int(r1, 0x29, 0x46, 0x0, 0x0) setsockopt$inet6_int(r1, 0x29, 0x42, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x3, @loopback={0x100000}, 0x6}, 0x1c) 2.222933696s ago: executing program 0 (id=114): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="6000000002060103000000000000000000000004050001000700000013000300686173683a6e65742c696661636500000900020073797a30000000000500040000000000050005000a0000001400078005001500"], 0x60}}, 0x0) 2.211234597s ago: executing program 0 (id=115): r0 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$TIOCMBIS(r0, 0x5416, 0x0) 2.144173987s ago: executing program 0 (id=116): syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000000)={0x2, {0xc, 0xa00, 0xffff, 0x181, 0x100}}) syz_open_procfs(r0, 0x0) connect$pptp(0xffffffffffffffff, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0xc400, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040)={0x0, r1}, 0x8) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x5, 0x5, 0xa01, 0x85, 0x41}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x8, 0x6, &(0x7f0000006680)) process_madvise(0xffffffffffffffff, 0x0, 0x0, 0x14, 0x20000) bpf$MAP_LOOKUP_BATCH(0x19, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000680), 0x0, 0x6c, r4}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x7, 0x4, &(0x7f0000000300)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xab}, [@exit], {0x95, 0x0, 0x5a5}}, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x94) syz_emit_ethernet(0x56, 0x0, 0x0) 2.136114548s ago: executing program 1 (id=117): capset(0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) clock_nanosleep(0x9, 0x1, 0x0, 0x0) syz_usb_connect(0x0, 0x6b, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000385352608f20446b76e8e01020301090259000104e9000909049300000e0100ff0a2401020005028a010209240603040001a53011240606040508000400050006000100050924030506030501f909240702020005cbad092403060101"], &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x41}) 1.933533101s ago: executing program 4 (id=118): symlink(&(0x7f0000001780)='./file0/../file0\x00', &(0x7f00000017c0)='./file0\x00') listxattr(&(0x7f0000005580)='./file0\x00', 0x0, 0x0) 1.768176053s ago: executing program 4 (id=119): sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x802}, 0x400c0dc) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) write$binfmt_aout(r0, &(0x7f0000000180)=ANY=[], 0xff2e) syz_usb_connect(0x0, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000772904202404019957c2010203010902"], 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000140)={0x0, 0x0, 0xfffffff9, 0x7fff, 0x16, "0062ba7d82000000000000000000f7ffffff00"}) r1 = syz_open_pts(r0, 0xc0000) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000100)=0x12) 1.33348078s ago: executing program 0 (id=125): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000100)=@name={0x1e, 0x2, 0x2, {{0x42}, 0x4}}, 0x10) bind$tipc(r1, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) bind$tipc(r1, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x3, {0x42, 0x0, 0xffffffff}}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r2, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000040)={0x10000042, 0x3}, 0x10) bind$tipc(r0, 0x0, 0x0) close(r0) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x10, 0x5ac, 0x232, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x1, 0x30, 0x66, "", [{{0x9, 0x4, 0x0, 0x5, 0x1, 0x3, 0x1, 0x2, 0x2, {0x9, 0x21, 0x1, 0x5, 0x1, {0x22, 0x46a5}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x3, 0xc, 0x9}}}}}]}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0}) 1.29060667s ago: executing program 3 (id=126): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) ptrace(0x10, r0) ptrace$peeksig(0x4209, r0, &(0x7f0000000140)={0x0, 0x0, 0x1}, &(0x7f00000013c0)=[{}]) 827.588978ms ago: executing program 2 (id=132): r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) ioctl$RTC_SET_TIME(r0, 0x40187014, &(0x7f0000000100)={0x2b, 0x22, 0x0, 0x2, 0x7, 0xa9, 0x5, 0x2, 0x1}) 817.162917ms ago: executing program 2 (id=133): r0 = syz_open_procfs(0x0, &(0x7f0000000300)='task\x00') getdents64(r0, &(0x7f0000000040)=""/35, 0x23) getdents(r0, 0xffffffffffffffff, 0x7a) 790.570968ms ago: executing program 2 (id=134): bpf$PROG_LOAD(0x5, &(0x7f0000001c40)={0x14, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f0000000040)=0x9, 0x4) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r0, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x46, 0x0, 0x0) setsockopt$inet6_int(r0, 0x29, 0x42, &(0x7f0000000100)=0x5, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) 727.914499ms ago: executing program 2 (id=135): r0 = socket$inet_udp(0x2, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000180)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$inet_udp_int(r0, 0x11, 0x67, &(0x7f0000000000)=0x507, 0x4) sendmmsg$inet(r0, &(0x7f0000000600)=[{{&(0x7f0000000080)={0x2, 0x4e20, @local}, 0x10, 0x0}}], 0x1, 0x2000c844) r2 = socket$netlink(0x10, 0x3, 0x0) writev(r2, &(0x7f00000003c0)=[{&(0x7f0000000280)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) sendto$inet(r0, &(0x7f00000000c0)="8689d46205a34100bf2bbe11a5ce7839edaf02afe39ead95913e9c4f8cf31440606769ebdf12cfacae8e8c03f5db079da7d9ecda75e2a7d49d5cbcb370c4d789390a328ba42c9c60cf2154d1b659aa709e8980a522cfb72f23ad87fb7019706ccae98cfe7c4fd23e8297b8cabc46ede1ac3da78f1b488c6357e7edfcd417df6660af20a54ecdcb02f689ae15ee655d4b7b1ea733e88ee9f53669388dff487c1c49953f3bc142112bd4b582b29b35d43962ed245c2cd5d5df40a3e0ed6beaf3b641e84b0f0dfa121a9efe05269f9f4a0e9bcbf43c7a90a711f453668c730c3badedca687b71a9c27bab9e724cc4a4918713031596ea6fd01124f973f257ccd9665aee7df4a9d64f079d176abc00000000d7af3e2dd4396f72373fb0a787a6129ca41181f5087fb843212550b58e3707d5a0399de36c2503836cbe2133de4f574e9e05c96788b0de1bd13e390445433d96737b964fa8af2ac4b2f0f9390ca93d8d3d810044d024359e067c4553230ab748947d33f8fc115ce9a49e6571c45a05d786cbd49342c236537dbbeec666b07baab917252113a5b9a77283189b518f356debe42d80cf2d0687b9c64d0253a6a09286fded6e4f8557b8fb4f25ca4fb138af8945c74bbc98748eaaa030be5317646f195e6e085ac6ddb29542e3581961259987241f7e7061526a7afec8962e74215fea43703a4e543ee9d1a3c3f5f2a41977ece8fdadcf89ce331ce59bebae5f53513d0e10485d7ddbda60513bf339602510b3a23ea29a0d5d03a61e34d12942ea4a847c884b27b5344a456d02a55f8929cc567e7c792c01fab7a7b32780a14c361000609b817dd91507b04d875279527946fdb8fb92a512485e234d092c28f1d0a0498731ccc0eb10515d510e8945839307b46512ceca6f495fdd2c6ae5eb2ef3b2a40ebdc7edf0048e3fb5e3d97a9ea5113a6b70d20ad5c43f0df95d88c0f121a1884da21a21f0ba47420f8391a97921cc51871dbb272e43710fe71d5e342c3afd10608a8b02f00e8fbd8d570b6faace86c494ecea8913233391e7b7cec3d571bb3032181ed58e1b513e511f79ee562c8cde9b3b74c2e95dcde7fadb5a666bdc0c1684794620ce8cf0c0aee8e90b3ef6e7160d3f055cb4d1ced32e4edc15e7d102952d3237e6c02c591a95a182bf190c0124abc7f1225332ff1c5e1b94e4e9bf02c1a18bd7bfce20707f7298da322560bc1a4cf298d46f5bf8ff41da21e25aa17f65f9ee43ca890b5ef6a3ccf3efedf3ca60a9acef1352ad0c43e6cf375108cf0974ce89a99adba7e6a3f8949dc573440fafe0e3abdd0066057a2d868e8386080f18a421568d8e7a89536a4173861bd55245c8fcf7dcba18edce36d2e85b9630fbc218db9ebd16abb11ac06fdbf2bc3e6394d4c6e7ae71813d30772d487743a2856348fee09989ce03331e7848770fc91e62191c20fe5f4a73c5dae467dd612bdb63b1e50921d38271305d7412103d5a6214d6d534d1d530b9169f882b6926bbd338f0282a8bd9a44603934e5249e83f1d0947b39f82a7843d2b6f796d8abf7ff3e66cfd4519324d71cebbf6580dffc10d555e479e9acaa12c3c59e3732c181aa4223d0fcdac514e9d7c7963c2634964520286b028f60a4ae612b8e6049315139e884cbffd6836253094ad023329183496cf663366ad4d7f7f5f1bd2db9b0d33f106c041fba4494c7da404d45d8955e5459ca4a62862721ec1fa534fd95e262c5814426816e60000000000000000001aa4fb6f40ec24f42f6949cc28d2a0d4eb61cb1664627582d962523586539445b81e9759321652280ecb", 0xffe3, 0x6000000000000000, 0x0, 0x0) 571.880091ms ago: executing program 2 (id=136): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000040)='./file2\x00', 0x8000, &(0x7f0000000740)={[{@resgid}]}, 0x3, 0x542, &(0x7f0000000cc0)="$eJzs3dFrJHcdAPDvTHYvubucSdUHLViLVu6q3ubSeG3woSqIPhXUiq91TTYhZHN7JJv2EopN8Q8QRLTgiz75IvgHCNIX30Uo6LuoKFKv+qDQdmRmZ3u5vd3k4HYzsPl8YG7mNzM73+9v9uaX329n2A3g3HoyIq5FxExEPB0RC+X6tJziqDfl+71z99W1fEoiy158O4mkXNc/1mw5v1y+bC4ivvX1iO8lD8bdOzjcbrbbrd2yvNTdSd7NssPrWzvNzdZm69bKyvKzq8+t3ly9MZZ6LkbE81/9209++MuvPf/bz7/y55f+ce37eVr/y7LXYqAe49Srer04F321iNidRLCK1Ioa9tysOBcAAE6W9/c/HBGfKvr/CzFT9OYAAACAaZJ9aT7eTSIyAAAAYGqlETEfSdoon/edjzRtNHrP8H40LqXtzl73cxud/Vvr+baIxainG1vt1o3y2YHFqCd5ebl8xrZffmagvBIRj0XEjxcuFuXGWqe9XvWHHwAAAHBOXB4Y//9noTf+LxxVnBwAAAAwPotVJwAAAABMnPE/AAAATD/jfwAAAJhq33jhhXzK+r9/vf7ywf525+Xr66297cbO/lpjrbN7u7HZ6WwW39m3c9rx2p3O7S/Erf07S93WXndp7+DwpZ3OfvFb4XNnUiEAAADgAY998s0/JRFx9MWLxZS7UG6rR2Qzx3euVZEhMCnpkHUzo3b+62RzAc7W8Wv9YoV5AGdPlx7Or3rVCQCVS07ZPvLhnd+PPxcAAGAyrn589P3/tzcqTQ2YsPL+f3La+B+YPiOf9TludvJ5AGevd//v/axn2B56BjCt6if1AFz6MPXS8dz/P+VRwkSDAgAAFZsvpiRtlOOA+UjTRiPiSvGzAPVkY6vduhERH4qIPy7UZ/PycvHKRG8eAAAAAAAAAAAAAAAAAAAAAAAAAB5SliWRAQAAAFMtIv17/5e5ri48NT/4+cCF5L8LxTwiXvnZiz+90+x2d5fz9f/6YH33jXL9M1V8ggEAAAAM6o/T++N4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABind+6+utafzjLuP78SEYvD4tdirpjPRT0iLv07idqx1yURMTOG+EevR8THhsVP8rRisczivvgXItKIuDiu+EPP/wnxoxf/8hjiw3n2Zt7+fHnY9ZfGk8V8+PVXK6dHNbr9Sz9o/2ZGtH9XRh20fn/x8bd+vTQy/usRj9eGtz/9+El+vCHxP/2Qdfzutw8PR23LfhFxdVj7l9wfa6m7c3tp7+Dw+tZOc7O12bq1srL87OpzqzdXbyxtbLVb5b9DY/zoE795/17pvQfqf+mE9reo/4jz/9QJdZ49tvzeW3fufqS3OPDORD1+niW1ofHT3uyzD8bv/+37TLlXXs7PYfrGd4bm8sSv/vDEqDzz+q+PqP/cKfW/dkL9j3v6mz/4y0PuCgCcgb2Dw+1mu93atVDxQlL2eB/lOP1PRE7d+cqj5pz3O6s+Y60kkthutmfjvk3N6hPrLbxWvhvNdv9qG9ORf1f+V5lk8mfdEAEAABN3r9M/uOXeDRj3mQEAAAAAAAAAAAAAAAAAAGCyTv0asFGb0oh4yK8TG4x5VE1VAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABO9P8AAAD//xQlyxg=") stat(&(0x7f00000001c0)='./file2\x00', 0x0) 406.548584ms ago: executing program 3 (id=137): r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000140)={0x18, 0x2, {0xffde, @local}}, 0x1e) connect$pptp(r0, &(0x7f0000000080)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0001, 0x0) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000340)=0x1) write$ppp(r1, &(0x7f0000000700)="b068aaecceb2e09fe89ecdc28df660f8a14343ef3f0d0a162489b51488f7a0ddfa4ee93820643716f43de437bc7104ae235f620a1a2b7c6221960e26af2b4b21ab840f27be28ffa01901f197600d8004c3212da8c2be7f2f748adf44664e3cc4e291067a86cf5d74e91631da4d3b0f5db69cc8eeb683858c203b35b7ebf3a523e5bc6d46be4c7fc4536148a3371ea2f9e47abf14aa4a0465f9f62d82d8184f4f6e53a73503883d68edd18fcd1d55aabefc97abebd657d4d5f40947c56c77134d61d07bf8e5602ab705ba81a260a1a5506c320aedca5b82ea7f78e0480716c21c6383becd1d7f3650fa63cd268081ab3f68129aae34c686c943ac9e652beda965f2fd599a152f18cb0b1ce1d87cabb63ce23abf38815099a83f56df5b230a4aa40a3e3854b830a30992db68445b114a0321772a0abe4304bfda9256dcc5995fa2fdd14c56064995bd494171c21b62f11a13e664c2056db18bdf25255b8489ebdb67ab70cf13990c0709b02b6f32c50a641a9a25966024b8b7bb2c7193da92dbcc43336ef337532604fd296fb60425dc13c84cbf7c8ffe87fe9ec160f966383418adebd3ee582321071dddc49fafbd1f52be3fd0dcdc10d791c112d008ba10d057677c5b37a282ff2ebde7c3fd2c673cc2c714e0ec0fc0f35971bb51135f30483df02cb85eab26d8ad34aa68fe634d274367769544b84f28b5c7a2b5d569299153e602147e806f9e17ecda3808bf5ed382f3ec221dce473577893a91d7467fcbb5796238bbf00e3ab1e6c9d8dc1a1fc571f7e57174dd9df9f435110133824b8f1d9c07b772fdfdd12217fb6d59814f233b9559e0d166bd54b8f069ab33762736a182bdd23275e60d9a29ade7b251e5818d1eaa9bafdc1eb03191bfc4b366d2a205b303d346fb973aacf59f642e05de41ff2ca63d891eb4b6489a0c4f1ee150478798d8737ea58e9fa1ff9059c007e63cf83adb9496acd7539592fd222aeeeb8101e4c5b956ab3a85c1a8f2ec1e43ca6e86f32f6b11bb270f206af39faef1d28b227f345b9e388f8546bbb95e893102292db8b04063a9b08cd2a4612d4016b39c95970eab98ccf5b71587576fd32b14e78eeb92eeead654449221339fa47fd3ab35526ee4087ef9ff3b310addf179eccf38e78350031673f9ba2ac712dff2dd3c28f5b6b28ff413eef357033882b52d8af73037b5eb3983c714cfb56098472bb41638eff3f5007f895fd5d14127df2c6319dc41f553830f8e4cf008080bbd9c8a8bcb57ff54e07f27430cf90420c4b0d5c37cdd0e918a0057153f4b7c29c765813ed078fc43d2b371ff890cce6a80d36a5b6dfd9b79ec57197ec625ebde4af3c1a3a3abaaa830b9df5c46bd6c54eff94f9c9c0a5b197a64f240ed1986c7b01f96b2b96223a265e22b0c49d9a9a3d4cde6546e3fb1ea9dc08d24081bb3c4c1661bd7198c9f9987cab7a9af6801dcfe36065bd467eb88a8a4867927575f2ae4fb6b4e0a47ca916dd5830279e430cc0bbc95734a335af4c8715270f6831d3d22c22ac064a0e2fb29ee212e6492c6762c1920a39f8afb6bdf1cc9b6950dd8a1ab468170fa45b5355bd79bb3ef07bd20f61bada7025b0dc23d36f6129a66a888a6abe2dd7b15fce662bdc07516c8e4232a820e81713dcbdcf1d9745d540e2d866b54ce72ca34500c8e5b226e11aca5fe78eba11798b04a6301266b6268343f4492b674ec184030105ff9f1432cadd83dc3cc81e04e3f5b87c6e0eb701c0a70d32692fe02a06f5157b1b510e7e052478ba5f11ec358f7eb41571b2ac61899f88bf41c557f2ce2bd56793d618db461dcbbabfe5e55b2ae234c70da604aa6d192f0c78038eb208ebd96c32d652e6b1476a3f452815e7e755885b97cf6edf61993229e97de15a7a5d293834db80e2a550c4f3f4befe371a5048babb5c1c58f91d3dc29c9aeb8b24b23c7609731500d05e003b592d46d03e9308c8aa069bde68fac3cf3a2500015e7648bbb3c72281d7858227476e3c961cb18135a5b77ea3d28a8d70066ab033824cdbfefe0cdcc618c90e2b3f54cfeaa802089905570f2237144ec292c01da078ba64ae28a864033a95c1f71f6cf512e0e93b31fee45e14b34b895d94d584c374d933b07ee24f86a202a3583fc557ae0af00db5709cb50335c7c0ff12730ef3b553abdf4c81bb4d2e703785e5e77c37dc75ba9ad93bc27b29f3f26ae6da102015d5653064f36a607132582e9171dd4f57ca738fab56e5348f2db26c38b043ac0a118bd68e48940c7a0bc68ef85eb4d5459906f531171c02ade1aceb55a22096f113e8b56635f702d916dd1133025831f9dd4cc6ce61059a86d2fc4ff20e1deb4cd7a9e610da2e3a1165bb8f888159a3370db2cfc0ead69ab3ab57ae49f37486a43c641027b89dc7d039ed5f0210a4b8e338facdcb99663d93a2e3b283566464360b57b602c0860fae0923b07d7d40436144ee481d99d20a7dc3103ca53d34b662bf5f671e0645caa3058e318e8cfc98a032984157b4c780697a6958a526e20af30bc8f377a77ddfcd85bf5fa923fc89f", 0x711) 397.693474ms ago: executing program 2 (id=138): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="580000000206010800000000000000000300000009000200"], 0x58}, 0x1, 0x0, 0x0, 0x20008000}, 0x10) syz_usb_connect$cdc_ecm(0x5, 0x5a, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000020000202505a1a4400000000101090248000101006015090400001a02020000052406000005240004000d240f01800000000100fcff500424020209058103ff03000306090582020000020d030905", @ANYBLOB="1c0a"], 0x0) 311.789325ms ago: executing program 3 (id=139): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r0, &(0x7f00000062c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000080)={0x50, 0x0, r1, {0x7, 0x29, 0x9, 0xffffffff90adedc4, 0x0, 0x3, 0x0, 0x4, 0x0, 0x0, 0x10}}, 0x50) syz_fuse_handle_req(r0, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000006c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2004a8c5}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="20000000000000000100000001000000de63e51537c76d99d199ac4634236a"], 0x20, 0x8000}}], 0x2, 0x4000000) llistxattr(&(0x7f0000002300)='./file0\x00', 0x0, 0xfffffdf3) 226.588676ms ago: executing program 3 (id=140): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r0) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="f5af27bd7000000000000e000000080003003083"], 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x700) 213.318117ms ago: executing program 3 (id=141): capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffff9}) r0 = socket$inet6(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f0000000600)={&(0x7f0000000080)={0xa, 0xce21, 0x280000, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, 0xfffbffff}, 0x1c, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1400000000000000010000000c0000002b0000000000000718"], 0x30}, 0x4000010) 144.266028ms ago: executing program 3 (id=142): pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_COALESCE(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000000)={0x30, r5, 0x1, 0x70bd2b, 0x0, {{0x2}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x9, 0x44}}}}, [@NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x2400c891}, 0x0) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x200000000622c, 0x0) 0s ago: executing program 1 (id=143): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7001}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x104, 0xe}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newtfilter={0x84, 0x2c, 0xd2f, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0x3}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x8, 0x40, 0x5, 0x7, 0xffffffff}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x24008084}, 0x20000000) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 14.744254][ T24] kauditd_printk_skb: 31 callbacks suppressed [ 14.744267][ T24] audit: type=1400 audit(1782399298.080:59): avc: denied { transition } for pid=217 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.756042][ T24] audit: type=1400 audit(1782399298.080:60): avc: denied { noatsecure } for pid=217 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.764599][ T24] audit: type=1400 audit(1782399298.090:61): avc: denied { write } for pid=217 comm="sh" path="pipe:[14468]" dev="pipefs" ino=14468 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 14.787393][ T24] audit: type=1400 audit(1782399298.100:62): avc: denied { rlimitinh } for pid=217 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.806599][ T24] audit: type=1400 audit(1782399298.100:63): avc: denied { siginh } for pid=217 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.0' (ED25519) to the list of known hosts. [ 22.461605][ T24] audit: type=1400 audit(1782399305.800:64): avc: denied { mounton } for pid=271 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.465700][ T271] cgroup: Unknown subsys name 'net' [ 22.484415][ T24] audit: type=1400 audit(1782399305.800:65): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.511677][ T24] audit: type=1400 audit(1782399305.830:66): avc: denied { unmount } for pid=271 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.512234][ T271] cgroup: Unknown subsys name 'devices' [ 22.658440][ T271] cgroup: Unknown subsys name 'hugetlb' [ 22.664093][ T271] cgroup: Unknown subsys name 'rlimit' [ 22.779496][ T24] audit: type=1400 audit(1782399306.120:67): avc: denied { setattr } for pid=271 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.802774][ T24] audit: type=1400 audit(1782399306.120:68): avc: denied { mounton } for pid=271 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.827687][ T24] audit: type=1400 audit(1782399306.120:69): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.849759][ T273] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 22.859918][ T24] audit: type=1400 audit(1782399306.200:70): avc: denied { relabelto } for pid=273 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.885429][ T24] audit: type=1400 audit(1782399306.200:71): avc: denied { write } for pid=273 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.949271][ T24] audit: type=1400 audit(1782399306.290:72): avc: denied { read } for pid=271 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.975055][ T24] audit: type=1400 audit(1782399306.290:73): avc: denied { open } for pid=271 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.001313][ T271] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.571476][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.578780][ T280] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.586720][ T280] device bridge_slave_0 entered promiscuous mode [ 23.593855][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.600969][ T280] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.608471][ T280] device bridge_slave_1 entered promiscuous mode [ 23.668881][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.675959][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.683524][ T283] device bridge_slave_0 entered promiscuous mode [ 23.690403][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.697576][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.704976][ T282] device bridge_slave_0 entered promiscuous mode [ 23.713321][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.720404][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.727969][ T282] device bridge_slave_1 entered promiscuous mode [ 23.734731][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.741995][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.749478][ T283] device bridge_slave_1 entered promiscuous mode [ 23.801962][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.809117][ T279] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.816745][ T279] device bridge_slave_0 entered promiscuous mode [ 23.826462][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.833527][ T279] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.841075][ T279] device bridge_slave_1 entered promiscuous mode [ 23.853720][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.861031][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.868607][ T281] device bridge_slave_0 entered promiscuous mode [ 23.878131][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.885196][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.892961][ T281] device bridge_slave_1 entered promiscuous mode [ 24.050005][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.057127][ T279] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.064502][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.071580][ T279] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.082579][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.089777][ T280] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.097109][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.104155][ T280] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.115640][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.122747][ T282] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.130066][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.137136][ T282] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.166610][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.173714][ T283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.181060][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.188248][ T283] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.206208][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.213718][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.221424][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.229236][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.237022][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.244202][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.251482][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.259228][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.266573][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.284599][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.293066][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.300187][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.330202][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.339136][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.346248][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.353774][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.362386][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.384628][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.392296][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.400369][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.408206][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.417137][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.424231][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.431960][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.460186][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.469080][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.476166][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.483656][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.493495][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.500939][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.509186][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.517534][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.524595][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.532211][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.540413][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.547510][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.554980][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.563301][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.570350][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.577829][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.585830][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.593928][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.603104][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.611331][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.641959][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.651220][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.660196][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.667836][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.675411][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.684330][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.692594][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.701138][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.709402][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.716708][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.724166][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.732643][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.740763][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.749094][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.757474][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.764521][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.772128][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.780269][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.788677][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.796410][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.814340][ T279] device veth0_vlan entered promiscuous mode [ 24.823603][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.832029][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.841354][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.851362][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.860060][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.868724][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.888637][ T282] device veth0_vlan entered promiscuous mode [ 24.895933][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.904665][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.913248][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.921887][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.930340][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.938511][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.946977][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.954482][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.962263][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.970084][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.978708][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.987262][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.999409][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.007868][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.023458][ T279] device veth1_macvtap entered promiscuous mode [ 25.030711][ T283] device veth0_vlan entered promiscuous mode [ 25.038020][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.046046][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.055693][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.068039][ T280] device veth0_vlan entered promiscuous mode [ 25.075311][ T281] device veth0_vlan entered promiscuous mode [ 25.084687][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.092891][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.101168][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.109629][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.118155][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.125657][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.133534][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.141392][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.155264][ T282] device veth1_macvtap entered promiscuous mode [ 25.165510][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.174208][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.183772][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.193131][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.201574][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.209369][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.217787][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.232735][ T281] device veth1_macvtap entered promiscuous mode [ 25.243507][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.252056][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.264799][ T283] device veth1_macvtap entered promiscuous mode [ 25.278016][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.286766][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.287363][ T279] request_module fs-gadgetfs succeeded, but still no fs? [ 25.296103][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.311105][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.319552][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.327257][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.335844][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.349749][ T280] device veth1_macvtap entered promiscuous mode [ 25.358930][ T279] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 25.370146][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.384167][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.393442][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.401395][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.410509][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.419548][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.428362][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.437100][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.445382][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.458293][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.466728][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.518413][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.526941][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.559818][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.590944][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.671218][ T316] ====================================================== [ 25.671218][ T316] WARNING: the mand mount option is being deprecated and [ 25.671218][ T316] will be removed in v5.15! [ 25.671218][ T316] ====================================================== [ 25.704215][ T323] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 25.789726][ T316] exFAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 25.800731][ T316] exFAT-fs (loop1): Medium has reported failures. Some data may be lost. [ 25.825414][ T316] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0x5817f139, utbl_chksum : 0xe619d30d) [ 25.869760][ T312] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 26.026623][ T20] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 26.277898][ T288] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 26.626797][ T20] usb 1-1: Using ep0 maxpacket: 16 [ 26.766718][ T20] usb 1-1: config 1 interface 0 altsetting 129 endpoint 0x1 has invalid maxpacket 1048, setting to 1024 [ 26.803324][ T20] usb 1-1: config 1 interface 0 altsetting 129 bulk endpoint 0x1 has invalid maxpacket 1024 [ 26.841745][ T339] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8'. [ 26.858410][ T20] usb 1-1: config 1 interface 0 altsetting 129 bulk endpoint 0x82 has invalid maxpacket 64 [ 26.880203][ T20] usb 1-1: config 1 interface 0 has no altsetting 0 [ 26.945436][ T288] usb 2-1: Using ep0 maxpacket: 16 [ 27.046487][ T20] usb 1-1: New USB device found, idVendor=03f0, idProduct=0004, bcdDevice= 0.40 [ 27.055805][ T20] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.064110][ T25] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 27.071846][ T288] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 27.082839][ T20] usb 1-1: Product: syz [ 27.087296][ T20] usb 1-1: Manufacturer: syz [ 27.091905][ T20] usb 1-1: SerialNumber: syz [ 27.096924][ T288] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 27.146651][ T322] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 27.153750][ T322] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 27.166608][ T342] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 27.256676][ T5] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 27.266641][ T288] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 27.275894][ T288] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.284062][ T288] usb 2-1: Product: syz [ 27.288436][ T288] usb 2-1: Manufacturer: syz [ 27.293034][ T288] usb 2-1: SerialNumber: syz [ 27.406804][ T342] usb 5-1: Using ep0 maxpacket: 32 [ 27.446507][ T25] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 27.457105][ T20] usblp0: Disabling reads from problematic bidirectional printer [ 27.464981][ T25] usb 3-1: config 0 has no interfaces? [ 27.470528][ T25] usb 3-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 27.480156][ T25] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.489103][ T20] usblp 1-1:1.0: usblp0: USB Unidirectional printer dev 2 if 0 alt 129 proto 2 vid 0x03F0 pid 0x0004 [ 27.501087][ T25] usb 3-1: config 0 descriptor?? [ 27.507909][ T20] usb 1-1: USB disconnect, device number 2 [ 27.518172][ T20] usblp0: removed [ 27.536481][ T342] usb 5-1: config 0 has an invalid interface number: 67 but max is 0 [ 27.544744][ T342] usb 5-1: config 0 has no interface number 0 [ 27.616616][ T288] usb 2-1: 0:2 : does not exist [ 27.698366][ T288] usb 2-1: USB disconnect, device number 2 [ 27.706503][ T342] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 27.715938][ T342] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.724952][ T342] usb 5-1: Product: syz [ 27.729357][ T342] usb 5-1: Manufacturer: syz [ 27.733983][ T342] usb 5-1: SerialNumber: syz [ 27.741522][ T342] usb 5-1: config 0 descriptor?? [ 27.800397][ T342] smsc95xx v2.0.0 [ 27.827008][ T5] usb 4-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 27.836084][ T5] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.844200][ T5] usb 4-1: Product: syz [ 27.848403][ T5] usb 4-1: Manufacturer: syz [ 27.852989][ T5] usb 4-1: SerialNumber: syz [ 27.858569][ T5] usb 4-1: config 0 descriptor?? [ 28.261584][ T324] udevd[324]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 28.281980][ T24] kauditd_printk_skb: 52 callbacks suppressed [ 28.282001][ T24] audit: type=1400 audit(1782399311.620:126): avc: denied { block_suspend } for pid=348 comm="syz.0.11" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 28.767633][ T24] audit: type=1400 audit(1782399311.860:127): avc: denied { unmount } for pid=279 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 28.971569][ T24] audit: type=1400 audit(1782399311.870:128): avc: denied { create } for pid=348 comm="syz.0.11" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 29.006357][ T288] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 29.088203][ T24] audit: type=1400 audit(1782399312.430:129): avc: denied { ioctl } for pid=361 comm="syz.0.14" path="socket:[15249]" dev="sockfs" ino=15249 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 29.120188][ T24] audit: type=1400 audit(1782399312.430:130): avc: denied { write } for pid=361 comm="syz.0.14" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 29.140226][ T24] audit: type=1400 audit(1782399312.430:131): avc: denied { read } for pid=361 comm="syz.0.14" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 29.168146][ T364] device syzkaller0 entered promiscuous mode [ 29.176051][ T24] audit: type=1400 audit(1782399312.510:132): avc: denied { write } for pid=363 comm="syz.0.15" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 29.236583][ T24] audit: type=1400 audit(1782399312.580:133): avc: denied { read append } for pid=365 comm="syz.0.16" name="rtc0" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 29.260232][ T24] audit: type=1400 audit(1782399312.580:134): avc: denied { open } for pid=365 comm="syz.0.16" path="/dev/rtc0" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 29.288007][ T24] audit: type=1400 audit(1782399312.580:135): avc: denied { ioctl } for pid=365 comm="syz.0.16" path="/dev/rtc0" dev="devtmpfs" ino=258 ioctlcmd=0x700a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 29.366585][ T342] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 29.377827][ T342] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 29.394356][ T357] usb 4-1: USB disconnect, device number 2 [ 29.466435][ T288] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 29.476713][ T288] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 29.485856][ T288] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.497463][ T288] usb 2-1: config 0 descriptor?? [ 30.184766][ T5] usb 3-1: USB disconnect, device number 2 [ 30.256350][ T308] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 30.395329][ T400] netlink: 4 bytes leftover after parsing attributes in process `syz.2.30'. [ 30.467178][ T404] EXT4-fs (loop2): couldn't mount as ext2 due to feature incompatibilities [ 30.579301][ T413] binder_alloc: 412: binder_alloc_buf, no vma [ 30.616582][ T308] usb 4-1: config 0 has an invalid interface number: 6 but max is 0 [ 30.620300][ T417] netlink: 156 bytes leftover after parsing attributes in process `syz.2.37'. [ 30.626517][ T308] usb 4-1: config 0 has no interface number 0 [ 30.646365][ T308] usb 4-1: New USB device found, idVendor=0bda, idProduct=0177, bcdDevice=7d.0b [ 30.666368][ T308] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.679259][ T308] usb 4-1: config 0 descriptor?? [ 30.918885][ T308] usb 4-1: USB disconnect, device number 3 [ 30.956407][ T20] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 31.026846][ T342] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000020: -71 [ 31.040062][ T342] smsc95xx: probe of 5-1:0.67 failed with error -71 [ 31.108168][ T342] usb 5-1: USB disconnect, device number 2 [ 31.316465][ T20] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 31.327487][ T20] usb 3-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xBE, skipping [ 31.339065][ T20] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 31.506681][ T20] usb 3-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 31.520171][ T20] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 31.529237][ T20] usb 3-1: Product: syz [ 31.534889][ T20] usb 3-1: Manufacturer: syz [ 31.540444][ T20] usb 3-1: SerialNumber: syz [ 31.568273][ T20] usb 3-1: config 0 descriptor?? [ 31.629159][ T20] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 31.772747][ T20] usb 2-1: USB disconnect, device number 3 [ 31.989317][ T448] EXT4-fs (loop3): mounted filesystem without journal. Opts: nogrpid,dioread_lock,nouid32,,errors=continue [ 32.001053][ T448] ext4 filesystem being mounted at /13/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 33.202273][ T504] EXT4-fs (loop1): mounted filesystem without journal. Opts: noblock_validity,bsddf,sysvgroups,resuid=0x000000000000ee01,debug_want_extra_isize=0x0000000000000080,inlinecrypt,grpid,noauto_da_alloc,nouid32,,errors=continue [ 33.376378][ T24] kauditd_printk_skb: 47 callbacks suppressed [ 33.376391][ T24] audit: type=1400 audit(1782399316.700:183): avc: denied { name_bind } for pid=516 comm="syz.1.76" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 33.408548][ T517] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.415846][ T517] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.423423][ T24] audit: type=1400 audit(1782399316.700:184): avc: denied { node_bind } for pid=516 comm="syz.1.76" saddr=172.20.20.170 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 33.568999][ T522] cgroup: Invalid name [ 33.700842][ T342] usb 3-1: USB disconnect, device number 3 [ 33.787626][ T532] netlink: 12 bytes leftover after parsing attributes in process `syz.0.82'. [ 33.796541][ T532] netlink: 24 bytes leftover after parsing attributes in process `syz.0.82'. [ 34.024123][ T53] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 34.106396][ T342] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 34.298104][ T24] audit: type=1400 audit(1782399317.640:185): avc: denied { wake_alarm } for pid=545 comm="syz.4.88" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 34.406491][ T53] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 34.418307][ T553] netlink: 'syz.4.91': attribute type 11 has an invalid length. [ 34.432388][ T53] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 34.442168][ T53] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.460188][ T53] usb 4-1: config 0 descriptor?? [ 34.460700][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 34.479868][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 34.489622][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 34.498874][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 34.507408][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 34.515889][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 34.524486][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 34.533302][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 34.588346][ T560] EXT4-fs (loop4): mounted filesystem without journal. Opts: i_version,,errors=continue [ 34.598720][ T560] ext4 filesystem being mounted at /19/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 34.618336][ T24] audit: type=1400 audit(1782399317.960:186): avc: denied { create } for pid=559 comm="syz.4.94" dev="anon_inodefs" ino=16527 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 34.640701][ T342] usb 3-1: New USB device found, idVendor=2c42, idProduct=1602, bcdDevice=da.64 [ 34.649956][ T342] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.658364][ T342] usb 3-1: Product: syz [ 34.663132][ T342] usb 3-1: Manufacturer: syz [ 34.671294][ T342] usb 3-1: SerialNumber: syz [ 34.676899][ T342] usb 3-1: config 0 descriptor?? [ 34.716857][ T342] hub 3-1:0.0: bad descriptor, ignoring hub [ 34.723009][ T342] hub: probe of 3-1:0.0 failed with error -5 [ 34.727551][ T24] audit: type=1326 audit(1782399318.060:187): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=564 comm="syz.0.95" exe="/root/ci2-android-5-10/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7f0110be59 code=0x0 [ 34.806422][ T53] usbhid 4-1:0.0: can't add hid device: -71 [ 34.812545][ T53] usbhid: probe of 4-1:0.0 failed with error -71 [ 34.819888][ T53] usb 4-1: USB disconnect, device number 4 [ 34.896373][ T308] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 35.036644][ T5] usb 3-1: USB disconnect, device number 4 [ 35.136370][ T308] usb 5-1: Using ep0 maxpacket: 16 [ 35.256776][ T308] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 35.267023][ T308] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 35.276522][ T53] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 35.426423][ T308] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 35.437522][ T308] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.445828][ T308] usb 5-1: Product: syz [ 35.450353][ T308] usb 5-1: Manufacturer: syz [ 35.455054][ T308] usb 5-1: SerialNumber: syz [ 35.678023][ T568] usb 2-1: new low-speed USB device number 4 using dummy_hcd [ 35.716661][ T53] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 35.729097][ T53] usb 4-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 35.738560][ T53] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 35.752790][ T53] usb 4-1: config 0 descriptor?? [ 35.789423][ T308] usb 5-1: 0:2 : does not exist [ 35.799814][ T24] audit: type=1400 audit(1782399319.140:188): avc: denied { execute } for pid=580 comm="syz.2.101" path="/17/bus" dev="tmpfs" ino=106 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 35.827370][ T24] audit: type=1400 audit(1782399319.140:189): avc: denied { create } for pid=580 comm="syz.2.101" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 35.948356][ T308] usb 5-1: USB disconnect, device number 3 [ 36.086713][ T568] usb 2-1: unable to get BOS descriptor or descriptor too short [ 36.200617][ T568] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 36.215140][ T568] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 36.264908][ T331] udevd[331]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 36.379395][ T24] audit: type=1400 audit(1782399319.720:190): avc: denied { unmount } for pid=283 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 36.558144][ T568] usb 2-1: string descriptor 0 read error: -22 [ 36.564499][ T568] usb 2-1: New USB device found, idVendor=0763, idProduct=2080, bcdDevice= 0.40 [ 36.574267][ T568] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.604154][ T24] audit: type=1400 audit(1782399319.940:191): avc: denied { ioctl } for pid=594 comm="syz.4.102" path="/dev/fuse" dev="devtmpfs" ino=90 ioctlcmd=0xe500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 36.629453][ T24] audit: type=1400 audit(1782399319.940:192): avc: denied { unlink } for pid=595 comm="syz.0.105" name="#1" dev="tmpfs" ino=121 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 36.666737][ T526] udc-core: couldn't find an available UDC or it's busy [ 36.673897][ T526] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 36.686404][ T53] aiptek 4-1:0.0: Aiptek using 400 ms programming speed [ 36.694578][ T53] input: Aiptek as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input4 [ 36.757798][ T607] EXT4-fs (loop0): Test dummy encryption mode enabled [ 36.765772][ T607] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a842c1a8, mo2=0003] [ 36.774074][ T607] System zones: 0-5 [ 36.779332][ T607] EXT4-fs (loop0): mounted filesystem without journal. Opts: debug,noload,inlinecrypt,errors=remount-ro,test_dummy_encryption=v1,norecovery,delalloc,nogrpid,minixdf, [ 36.851500][ T568] usb 2-1: USB disconnect, device number 4 [ 36.866329][ T343] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 37.126340][ T343] usb 3-1: Using ep0 maxpacket: 32 [ 37.165284][ T617] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 37.176612][ T617] ext4 filesystem being mounted at /25/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 37.236154][ T622] process 'syz.0.113' launched './file0' with NULL argv: empty string added [ 37.266446][ T343] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 37.456373][ T343] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 37.466175][ T343] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 37.474621][ T343] usb 3-1: Product: syz [ 37.479375][ T343] usb 3-1: Manufacturer: syz [ 37.484223][ T343] usb 3-1: SerialNumber: syz [ 37.521205][ T343] usb 3-1: config 0 descriptor?? [ 37.606632][ T591] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 37.629446][ T343] hub 3-1:0.0: bad descriptor, ignoring hub [ 37.637843][ T343] hub: probe of 3-1:0.0 failed with error -5 [ 37.706482][ T53] usb 4-1: USB disconnect, device number 5 [ 37.767191][ T644] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 37.780404][ T644] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 37.791736][ T644] EXT4-fs (loop3): 1 truncate cleaned up [ 37.797656][ T644] EXT4-fs (loop3): mounted filesystem without journal. Opts: i_version,resgid=0x0000000000000000,,errors=continue [ 37.806527][ T568] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 37.937631][ T648] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue [ 37.946686][ T648] ext4 filesystem being mounted at /24/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 37.961314][ T648] EXT4-fs error (device loop3): ext4_map_blocks:742: inode #15: block 3: comm syz.3.123: lblock 3 mapped to illegal pblock 3 (length 3) [ 37.975593][ T587] usb 3-1: USB disconnect, device number 5 [ 37.975693][ T648] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 3 with error 117 [ 37.993950][ T648] EXT4-fs (loop3): This should not happen!! Data will be lost [ 37.993950][ T648] [ 38.003764][ T343] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 38.007455][ T648] EXT4-fs error (device loop3): ext4_map_blocks:742: inode #15: block 8: comm syz.3.123: lblock 8 mapped to illegal pblock 8 (length 4) [ 38.025448][ T648] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 8 with max blocks 4 with error 117 [ 38.037875][ T648] EXT4-fs (loop3): This should not happen!! Data will be lost [ 38.037875][ T648] [ 38.053027][ T637] EXT4-fs error (device loop3): ext4_validate_block_bitmap:438: comm kworker/u4:4: bg 0: block 112: padding at end of block bitmap is not set [ 38.068802][ T637] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 16 with max blocks 51 with error 28 [ 38.082084][ T637] EXT4-fs (loop3): This should not happen!! Data will be lost [ 38.082084][ T637] [ 38.083310][ T568] usb 2-1: Using ep0 maxpacket: 8 [ 38.093280][ T637] EXT4-fs (loop3): Total free blocks count 0 [ 38.103336][ T637] EXT4-fs (loop3): Free/Dirty block details [ 38.109556][ T637] EXT4-fs (loop3): free_blocks=0 [ 38.114588][ T637] EXT4-fs (loop3): dirty_blocks=64 [ 38.168498][ T654] tipc: Failed to remove local publication {66,0,0}/3298963020 [ 38.176124][ T654] tipc: Failed to remove local publication {66,0,0}/3298963019 [ 38.186774][ T654] tipc: Failed to remove local publication {66,0,0}/3298963020 [ 38.194490][ T654] tipc: Failed to remove local publication {66,0,0}/3298963019 [ 38.266360][ T343] usb 5-1: Using ep0 maxpacket: 32 [ 38.266472][ T568] usb 2-1: unable to get BOS descriptor or descriptor too short [ 38.357865][ T568] usb 2-1: config 4 has an invalid interface number: 147 but max is 0 [ 38.366117][ T568] usb 2-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 38.376446][ T568] usb 2-1: config 4 has no interface number 0 [ 38.396422][ T343] usb 5-1: config 0 has no interfaces? [ 38.466354][ T587] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 38.510317][ T24] kauditd_printk_skb: 16 callbacks suppressed [ 38.510329][ T24] audit: type=1400 audit(1782399321.850:209): avc: denied { mount } for pid=668 comm="syz.2.131" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 38.512340][ T669] SELinux: (dev overlay, type overlay) has no security xattr handler [ 38.516956][ T24] audit: type=1400 audit(1782399321.850:210): avc: denied { mounton } for pid=668 comm="syz.2.131" path="/23/file0" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 38.569416][ T24] audit: type=1400 audit(1782399321.900:211): avc: denied { remount } for pid=668 comm="syz.2.131" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 38.593078][ T24] audit: type=1400 audit(1782399321.930:212): avc: denied { unmount } for pid=282 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 38.615210][ T343] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 38.624332][ T343] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.632391][ T343] usb 5-1: Product: syz [ 38.636627][ T568] usb 2-1: string descriptor 0 read error: -22 [ 38.636715][ T568] usb 2-1: New USB device found, idVendor=04f2, idProduct=b746, bcdDevice=8e.6e [ 38.652263][ T343] usb 5-1: Manufacturer: syz [ 38.657297][ T343] usb 5-1: SerialNumber: syz [ 38.662761][ T343] usb 5-1: config 0 descriptor?? [ 38.668035][ T568] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.706421][ T587] usb 1-1: Using ep0 maxpacket: 16 [ 38.717617][ T568] uvcvideo: Found UVC 0.02 device (04f2:b746) [ 38.724972][ T568] uvcvideo: No streaming interface found for terminal 6. [ 38.805812][ T679] netlink: 'syz.2.135': attribute type 4 has an invalid length. [ 38.886471][ T587] usb 1-1: unable to get BOS descriptor or descriptor too short [ 38.898872][ T681] EXT4-fs (loop2): revision level too high, forcing read-only mode [ 38.909253][ T681] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 38.917806][ T681] System zones: 0-1, 15-15, 18-18, 34-34 [ 38.923627][ T343] usb 2-1: USB disconnect, device number 5 [ 38.930221][ T681] EXT4-fs (loop2): orphan cleanup on readonly fs [ 38.936714][ T681] Quota error (device loop2): v2_read_header: Failed header read: expected=8 got=0 [ 38.946161][ T681] EXT4-fs warning (device loop2): ext4_enable_quotas:6495: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 38.960966][ T681] EXT4-fs (loop2): Cannot turn on quotas: error -22 [ 38.967859][ T681] EXT4-fs error (device loop2): ext4_orphan_get:1427: comm syz.2.136: bad orphan inode 16 [ 38.978028][ T681] ext4_test_bit(bit=15, block=18) = 1 [ 38.983432][ T681] is_bad_inode(inode)=0 [ 38.986752][ T587] usb 1-1: config 1 interface 0 has no altsetting 0 [ 38.987765][ T681] NEXT_ORPHAN(inode)=0 [ 38.998346][ T681] max_ino=32 [ 39.001562][ T681] i_nlink=2 [ 39.004735][ T681] EXT4-fs (loop2): mounted filesystem without journal. Opts: resgid=0x0000000000000000,,errors=continue [ 39.030810][ T24] audit: type=1400 audit(1782399322.370:213): avc: denied { read } for pid=680 comm="syz.2.136" name="file2" dev="loop2" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 39.030819][ T681] fscrypt (loop2, inode 16): Error -61 getting encryption context [ 39.032742][ T337] usb 5-1: USB disconnect, device number 4 [ 39.080351][ T24] audit: type=1400 audit(1782399322.420:214): avc: denied { bind } for pid=685 comm="syz.3.137" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 39.104480][ T24] audit: type=1400 audit(1782399322.420:215): avc: denied { connect } for pid=685 comm="syz.3.137" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 39.125030][ T24] audit: type=1400 audit(1782399322.420:216): avc: denied { write } for pid=685 comm="syz.3.137" name="ppp" dev="devtmpfs" ino=153 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 39.147698][ T24] audit: type=1400 audit(1782399322.420:217): avc: denied { open } for pid=685 comm="syz.3.137" path="/dev/ppp" dev="devtmpfs" ino=153 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 39.216453][ T587] usb 1-1: New USB device found, idVendor=05ac, idProduct=0232, bcdDevice= 0.40 [ 39.225652][ T587] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.233716][ T587] usb 1-1: Product: syz [ 39.238123][ T587] usb 1-1: Manufacturer: syz [ 39.242771][ T587] usb 1-1: SerialNumber: syz [ 39.266111][ T695] capability: warning: `syz.3.141' uses deprecated v2 capabilities in a way that may be insecure [ 39.386394][ T568] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 39.482285][ T700] ================================================================== [ 39.490541][ T700] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0x875/0x3330 [ 39.498690][ T700] Read of size 8 at addr ffff888113472ac0 by task syz.1.143/700 [ 39.506439][ T700] [ 39.508829][ T700] CPU: 1 PID: 700 Comm: syz.1.143 Not tainted syzkaller #0 [ 39.516260][ T700] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 39.526385][ T700] Call Trace: [ 39.529714][ T700] __dump_stack+0x21/0x24 [ 39.534084][ T700] dump_stack_lvl+0x1a7/0x208 [ 39.538769][ T700] ? show_regs_print_info+0x18/0x18 [ 39.543977][ T700] ? thaw_kernel_threads+0x220/0x220 [ 39.549271][ T700] print_address_description+0x7f/0x2c0 [ 39.554839][ T700] ? tc_setup_flow_action+0x875/0x3330 [ 39.561289][ T700] kasan_report+0x100/0x140 [ 39.565834][ T700] ? flow_action_cookie_create+0x28/0x90 [ 39.571494][ T700] ? tc_setup_flow_action+0x875/0x3330 [ 39.576983][ T700] __asan_report_load8_noabort+0x14/0x20 [ 39.582647][ T700] tc_setup_flow_action+0x875/0x3330 [ 39.588052][ T700] ? __kmalloc+0x19f/0x330 [ 39.592508][ T700] ? tcf_exts_num_actions+0x28b/0x2b0 [ 39.597916][ T700] mall_replace_hw_filter+0x2db/0x8c0 [ 39.603438][ T700] ? pcpu_block_update_hint_alloc+0x8b7/0xc50 [ 39.609543][ T700] ? mall_set_parms+0x450/0x450 [ 39.614437][ T700] ? tcf_exts_destroy+0xb0/0xb0 [ 39.619332][ T700] ? pcpu_alloc+0xf8d/0x16c0 [ 39.623971][ T700] ? mall_set_parms+0x1a0/0x450 [ 39.626500][ T568] usb 3-1: Using ep0 maxpacket: 32 [ 39.628884][ T700] mall_change+0x546/0x770 [ 39.628908][ T700] ? __kasan_check_write+0x14/0x20 [ 39.628960][ T700] ? mall_get+0xa0/0xa0 [ 39.647788][ T700] ? tcf_chain_tp_insert_unique+0x946/0xa70 [ 39.653849][ T700] tc_new_tfilter+0x1487/0x1ab0 [ 39.658739][ T700] ? mall_get+0xa0/0xa0 [ 39.662932][ T700] ? tcf_gate_entry_destructor+0x20/0x20 [ 39.668605][ T700] ? 0xffffffffa0002000 [ 39.672801][ T700] ? security_capable+0x87/0xb0 [ 39.677706][ T700] ? ns_capable+0x8c/0xf0 [ 39.682093][ T700] ? netlink_net_capable+0x125/0x160 [ 39.687424][ T700] ? tcf_gate_entry_destructor+0x20/0x20 [ 39.693105][ T700] rtnetlink_rcv_msg+0x811/0xca0 [ 39.698100][ T700] ? unwind_get_return_address+0x4d/0x90 [ 39.703784][ T700] ? rtnetlink_bind+0x80/0x80 [ 39.708498][ T700] ? stack_trace_save+0xa6/0xf0 [ 39.713379][ T700] ? stack_trace_snprint+0xe0/0xe0 [ 39.718531][ T700] ? avc_has_perm+0x168/0x3d0 [ 39.723253][ T700] ? memcpy+0x56/0x70 [ 39.727273][ T700] ? avc_has_perm+0x27f/0x3d0 [ 39.731974][ T700] ? __kasan_slab_alloc+0xc9/0xe0 [ 39.737025][ T700] ? avc_has_perm_noaudit+0x260/0x260 [ 39.742439][ T700] ? entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 39.746763][ T568] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 39.748540][ T700] ? selinux_nlmsg_lookup+0x398/0x430 [ 39.748592][ T700] netlink_rcv_skb+0x1e9/0x430 [ 39.764491][ T568] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 39.764912][ T700] ? rtnetlink_bind+0x80/0x80 [ 39.769974][ T568] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 39.779363][ T700] ? netlink_ack+0xb30/0xb30 [ 39.779377][ T700] ? __netlink_lookup+0x387/0x3b0 [ 39.779393][ T700] rtnetlink_rcv+0x1c/0x20 [ 39.779447][ T700] netlink_unicast+0x86c/0xa30 [ 39.784520][ T568] usb 3-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0x1C, skipping [ 39.793887][ T700] netlink_sendmsg+0x949/0xb70 [ 39.793901][ T700] ? netlink_getsockopt+0x530/0x530 [ 39.793916][ T700] ? security_socket_sendmsg+0x82/0xa0 [ 39.793948][ T700] ? netlink_getsockopt+0x530/0x530 [ 39.799082][ T568] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 26 [ 39.803590][ T700] ____sys_sendmsg+0x5be/0x8f0 [ 39.803640][ T700] ? __sys_sendmsg_sock+0x40/0x40 [ 39.867045][ T700] ? import_iovec+0x7c/0xb0 [ 39.871585][ T700] ___sys_sendmsg+0x236/0x2e0 [ 39.876326][ T700] ? __sys_sendmsg+0x280/0x280 [ 39.881132][ T700] ? alloc_file+0x82/0x580 [ 39.885768][ T700] ? __fdget+0x1a1/0x230 [ 39.890098][ T700] __x64_sys_sendmsg+0x201/0x2d0 [ 39.895157][ T700] ? __kasan_check_write+0x14/0x20 [ 39.897431][ T568] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 39.900299][ T700] ? ___sys_sendmsg+0x2e0/0x2e0 [ 39.900370][ T700] ? __kasan_check_read+0x11/0x20 [ 39.909975][ T568] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 39.914230][ T700] ? exit_to_user_mode_prepare+0x9a/0xa0 [ 39.914292][ T700] do_syscall_64+0x31/0x40 [ 39.921613][ T568] usb 3-1: SerialNumber: syz [ 39.927320][ T700] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 39.927332][ T700] RIP: 0033:0x7ff28c49be59 [ 39.927346][ T700] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 39.927378][ T700] RSP: 002b:00007ff28aef6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 39.980542][ T700] RAX: ffffffffffffffda RBX: 00007ff28c714fa0 RCX: 00007ff28c49be59 [ 39.986760][ T568] cdc_acm 3-1:1.0: Control and data interfaces are not separated! [ 39.988541][ T700] RDX: 0000000020000000 RSI: 0000200000000580 RDI: 0000000000000004 [ 39.988560][ T700] RBP: 00007ff28c531e6f R08: 0000000000000000 R09: 0000000000000000 [ 39.996882][ T568] cdc_acm 3-1:1.0: This needs exactly 3 endpoints [ 40.004373][ T700] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 40.004382][ T700] R13: 00007ff28c715038 R14: 00007ff28c714fa0 R15: 00007ffd5326ee98 [ 40.004391][ T700] [ 40.004400][ T700] Allocated by task 700: [ 40.004472][ T700] __kasan_kmalloc+0xd4/0x100 [ 40.031209][ T568] cdc_acm: probe of 3-1:1.0 failed with error -22 [ 40.034862][ T700] __kmalloc+0x19f/0x330 [ 40.034912][ T700] tcf_idr_create+0x5f/0x790 [ 40.061531][ T700] tcf_idr_create_from_flags+0x61/0x70 [ 40.067032][ T700] tcf_gact_init+0x2e6/0x560 [ 40.071683][ T700] tcf_action_init_1+0x443/0x6d0 [ 40.076660][ T700] tcf_action_init+0x227/0x780 [ 40.081553][ T700] tcf_exts_validate+0x23c/0x540 [ 40.086532][ T700] mall_set_parms+0x4a/0x450 [ 40.091161][ T700] mall_change+0x47a/0x770 [ 40.095617][ T700] tc_new_tfilter+0x1487/0x1ab0 [ 40.100514][ T700] rtnetlink_rcv_msg+0x811/0xca0 [ 40.105479][ T700] netlink_rcv_skb+0x1e9/0x430 [ 40.110258][ T700] rtnetlink_rcv+0x1c/0x20 [ 40.114688][ T700] netlink_unicast+0x86c/0xa30 [ 40.119482][ T700] netlink_sendmsg+0x949/0xb70 [ 40.124278][ T700] ____sys_sendmsg+0x5be/0x8f0 [ 40.129066][ T700] ___sys_sendmsg+0x236/0x2e0 [ 40.133739][ T700] __x64_sys_sendmsg+0x201/0x2d0 [ 40.138678][ T700] do_syscall_64+0x31/0x40 [ 40.143131][ T700] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 40.149059][ T700] [ 40.151559][ T700] The buggy address belongs to the object at ffff888113472a00 [ 40.151559][ T700] which belongs to the cache kmalloc-192 of size 192 [ 40.165804][ T700] The buggy address is located 0 bytes to the right of [ 40.165804][ T700] 192-byte region [ffff888113472a00, ffff888113472ac0) [ 40.179434][ T700] The buggy address belongs to the page: [ 40.185146][ T700] page:ffffea00044d1c80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113472 [ 40.193960][ T568] usb 3-1: USB disconnect, device number 6 [ 40.195451][ T700] flags: 0x4000000000000200(slab) [ 40.195471][ T700] raw: 4000000000000200 dead000000000100 dead000000000122 ffff888100043380 [ 40.215063][ T700] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 40.223860][ T700] page dumped because: kasan: bad access detected [ 40.230329][ T700] page_owner tracks the page as allocated [ 40.236071][ T700] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 95, ts 39476490309, free_ts 39473461143 [ 40.252155][ T700] prep_new_page+0x176/0x190 [ 40.256760][ T700] get_page_from_freelist+0x225f/0x23f0 [ 40.262321][ T700] __alloc_pages_nodemask+0x29a/0x640 [ 40.267708][ T700] new_slab+0x84/0x3f0 [ 40.271873][ T700] ___slab_alloc+0x2f8/0x4c0 [ 40.276594][ T700] __slab_alloc+0x63/0xa0 [ 40.280953][ T700] kmem_cache_alloc_trace+0x1a8/0x2e0 [ 40.286381][ T700] kernfs_fop_open+0x375/0xbb0 [ 40.291237][ T700] do_dentry_open+0x7a5/0x10a0 [ 40.296027][ T700] vfs_open+0x73/0x80 [ 40.300025][ T700] path_openat+0x26c3/0x3040 [ 40.304631][ T700] do_filp_open+0x1df/0x400 [ 40.309141][ T700] do_sys_openat2+0x19f/0x750 [ 40.313879][ T700] __x64_sys_openat+0x136/0x160 [ 40.318778][ T700] do_syscall_64+0x31/0x40 [ 40.323275][ T700] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 40.329287][ T700] page last free stack trace: [ 40.333998][ T700] free_unref_page_prepare+0x2b7/0x2d0 [ 40.339677][ T700] __free_pages+0x146/0x390 [ 40.344195][ T700] free_pages+0x82/0x90 [ 40.348356][ T700] tlb_finish_mmu+0x258/0x310 [ 40.353033][ T700] exit_mmap+0x329/0x590 [ 40.357315][ T700] __mmput+0x92/0x2d0 [ 40.361310][ T700] mmput+0x4e/0x150 [ 40.365120][ T700] do_exit+0x9d8/0x24e0 [ 40.369290][ T700] do_group_exit+0x149/0x310 [ 40.373921][ T700] __x64_sys_exit_group+0x3f/0x40 [ 40.378948][ T700] do_syscall_64+0x31/0x40 [ 40.383391][ T700] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 40.389286][ T700] [ 40.391633][ T700] Memory state around the buggy address: [ 40.397284][ T700] ffff888113472980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.405432][ T700] ffff888113472a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 40.413547][ T700] >ffff888113472a80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 40.421612][ T700] ^ [ 40.427767][ T700] ffff888113472b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.435839][ T700] ffff888113472b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 40.443996][ T700] ================================================================== [ 40.452083][ T700] Disabling lock debugging due to kernel taint [ 40.567626][ T587] usb 1-1: USB disconnect, device number 3