last executing test programs: 58.216933963s ago: executing program 2 (id=190): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x6a3, 0x621, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x1, 0x3, 0x0, 0xcc28163f40625b84, 0x0, {0x9, 0x21, 0x9, 0xb, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x80, 0x2, 0x87}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = socket$inet6(0x10, 0x6, 0x9) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) 56.439537144s ago: executing program 2 (id=206): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={0x0}}, 0x0) r0 = socket(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x28, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x1, 0x0, &(0x7f00000002c0)=[{0x5, 0x2, 0xc, 0xa}], 0x10, 0x7fb}, 0x94) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="480000001c00110c0000001400000f0007000000", @ANYRES32=r2, @ANYBLOB="800202000a000200577f0000aabb000020000e80050001008f000000050001000100000004000200050001"], 0x48}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000140), 0x4924b68, 0x0) 56.226205668s ago: executing program 2 (id=209): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb3209000) r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r0, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000000300)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) 55.967130679s ago: executing program 2 (id=216): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000380)='./file0/file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x185093, 0x0) umount2(&(0x7f0000000140)='./file0\x00', 0x0) 55.903171873s ago: executing program 2 (id=218): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x29, &(0x7f0000000140)=0x1, 0x4) setsockopt$inet6_int(r0, 0x29, 0x3c, &(0x7f0000311ffc)=0x1, 0x4) setsockopt$inet6_buf(r0, 0x29, 0x3e, &(0x7f00002cef88)="d84f7398", 0x4) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x1d, &(0x7f0000000000)=0x4, 0x4) sendto$inet6(r0, &(0x7f0000000800)="51e251578851f74182a74b89b27df427aeef44966d202e4138b5a18e75a0424e7fe93b0d32c7abba87b65f97aba1c26a06b6d94c4aefd8fdca10e744391062c8e612721c20051608d9aa6dacf61e1eb331a4daad402b9885599d56130f7149fb1111fa116e94324d585a0569fbd311dad54cb4e32ff7f02216844ec3d526c878d5135ad1c9262239339c18885e2a0a95854d6cde3dd2feeaa50216af6c5760923413af81199a65a6332b02ec7bbf79d557c033cbe032fdc44f66a5c59cc4a3c5d218f5896b359d1efd60baf98df6396567478f7b817ce6e11d59a7def452a068e9607f57f626a5b8d476636ef1ee76307524009ae49be402000000000000001e80fed632155e14da1f7324d97bc61a3c1edc4431ee8a6caa2ed9f85cea5a2a9b263630c7d6fc35dda6002da571a2e51917e7c1019d8ce21a608147e408074c7c5f444fab931bda86d977d7c9ccefd881e5ef05b287f41eea526862885881c2cdc687dfff01a9b70a9b08734ac4d62c7f34465c34aa9e9f136c7f796d9eea41aa37f61830508338bb1f887089070567a1dd96cd700e7a098dabedb60f31acd17d487bc8be1a3101d2b5ac1715003793596c6daa93a27f4adb4d6fbea5669cabc206c944317ea18a2c762457f1bc945fec8f849641d44e7e2a24faeee28f3f266395fe18b0dce20c1f64e8896c8ff0e4a44a116fb32462471a0fcde143e551723d57339722765673b4163d66f473ac10f988cb252f106632f9884a47866d284b4efc6bb1aa74ed48d4a6535795f0873a99907ebc22be2337364cf9acc063e32f7d2e02fad64d04aa405d2dbdee1128ab1e4761d2dd30885ad37dd168478f10789d172feef4c817a5cd372caade57f23300e45f47e001e3ea093680ffffff802477368b9910f4e24037c871cb8251568c792287a6f49fa61b7c2600accaa0e7b40c59d88a29af5886c1f5dfc6837c58aaef12a9e100225c70441144ffa82927fa4802ed9ebb03eea8e945af5f4993f21a7f53baf7ec5bb6cc96b917dde82c18840c3500e9565f68f687b1c73d834c0d99d4acb002dc5682dbcdb1217a98f6c3ef8318b7fa93894e8a097b4511ba5c035e27c9fe8bfe7754741ac21bbc0303b81672e3117e5590fe2d92f912759b9937f64204ec5caa92e2cccb31016b13ed8d7bcabb03e176b1c9bda3bf1c1256ab74ab6f42ed9bafbbd0096263be1a7da1e1c88deec55a653d170e1e13c77dacaa60a37a6ba2383e661ebc9f13dbaade2dd884c9951819fb4608e19e70cd2496ccfb12f24c71f496cfe90400fe1bbea1e9a24b1d4664fb0776aca6269b396779680e52f86877d9209988d12ccb137be01ab7496d00547a7d4849d365a18dbb55c429cde87d33c4b74ad2273cdfee88b5418866ef327f25e9cbcd5a64d97107339f7e4cb5f8de171d2779c0f68884ae835e398f982d5749f085628d3608986656ea04b721f828202e9342bd7d19dfa091e772aebf9718030167a8c029df7c58b7f40029d7cfcaf26fd1900d8775ef373e8e2c5bf3525f907add3be426cd5a079c49abffe933e9ee213a3baf34f932d1299312691e1c53e6247ae0989ad66070d51fad22856a8b6b28954e7d41189b11c5321789eec8670de9e8db0b0473ba2e02731e60e7222697d61e052c18d4bcc6d1572fdf426f7b2fee6c1dee66c85c497b90facaf63b8ec5cde4a73400f9180bcfc0f81eca9580a7c81462a077f9034026bf72aa7c6de4b3c15d4a2dbd6fd7d87084aea9f25fb4bf5ec83eb56874a760533792dff2695407ccdd6a7375e0007230fd3f6501c152f1c1ff279b1d67cc95f2820762b7927659368e41657bdef2dd15b63498a93b787bdb26809d734aaf98b86fcf9fc643a34d03ebbe072820662d20d4774d66c5ae270adade5b8f6242a059b926221ee3d677487471c432b0d6d64dad030703475bb3ecac39b204a814f5ece5961621358e36f8a2cf7196c76959824bbb475a7cad8f57853fe05f59f341b5207cc9bb8d686982c2f158e0d8f5c7ec6cbfd500"/1453, 0x5ad, 0x0, &(0x7f0000000080)={0xa, 0x5e20, 0x3, @mcast2}, 0x1c) recvmmsg(r0, &(0x7f0000006600)=[{{0x0, 0x0, 0x0}, 0x6}], 0x1, 0x40010163, 0x0) 55.590526506s ago: executing program 2 (id=225): bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffff9}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000100)=@bpf_ext={0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41100, 0x50, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1313f, 0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000), 0x10, 0x3}, 0x94) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x80000, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r0, 0x4010744d, &(0x7f0000000180)) 55.348843443s ago: executing program 32 (id=225): bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffff9}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000100)=@bpf_ext={0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41100, 0x50, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1313f, 0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000), 0x10, 0x3}, 0x94) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x80000, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r0, 0x4010744d, &(0x7f0000000180)) 5.671459763s ago: executing program 3 (id=639): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x80, &(0x7f0000000000)=""/4090, &(0x7f00000010c0)=0xffa) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000005c0)={[0x4000000000000008, 0x7, 0x48, 0x4000000000000e52, 0x800000000004, 0x5479, 0x1041, 0x6, 0x0, 0x400000002, 0x1, 0x100000000, 0x200000000000002, 0x40000000005, 0x8000000000085, 0x800040068], 0xf000, 0x557c1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 5.022495339s ago: executing program 3 (id=649): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) setns(0xc9, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000240)={0x0, 0x0, 0x20}, 0xc) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x7fff, @empty}, 0x1c) sendto$inet6(r1, &(0x7f0000000180)="1a", 0x34000, 0x0, &(0x7f0000000480)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$sock(r1, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)="11", 0xfffd}], 0x1}}], 0x1, 0x8015) close_range(r0, 0xffffffffffffffff, 0x0) 4.649107678s ago: executing program 3 (id=651): openat$vmci(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) fsetxattr(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x1c0000000000000, 0x100000001, &(0x7f0000006680)=0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f0000000100)={0x9, 0x8000000000000, 0x0, 0x80000000000, 0x0, 0xfffffffffffff30a, 0x5}, &(0x7f0000000000)={0x1f, 0xfffffffffffffffd, 0xfffffffffffffffe, 0x0, 0x6, 0x0, 0x5, 0xc}, 0x0, 0x0, 0x0) 4.195527425s ago: executing program 3 (id=659): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x1c, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}]}, 0x1c}}, 0x0) write$nci(r0, &(0x7f00000006c0)=@NCI_OP_CORE_INTF_ERROR_NTF={0x0, 0x1, 0x3, 0x8, 0x1, {0x1, 0x1}}, 0x5) sendto(0xffffffffffffffff, 0x0, 0x0, 0x4044084, 0x0, 0x0) socket(0x2b, 0x1, 0x0) 3.8895365s ago: executing program 0 (id=663): r0 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000100)={0x20000014}) epoll_wait(r0, &(0x7f0000000000)=[{}], 0x1, 0x400) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) 3.547568037s ago: executing program 1 (id=666): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x2, 0x0) ioctl(r0, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000500") openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r0, 0x400c0930, 0x0) 3.392476401s ago: executing program 1 (id=667): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @any, 0x7ff}, 0xe) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x0) r1 = landlock_create_ruleset(&(0x7f00000002c0)={0x7f6e}, 0x18, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r2, &(0x7f0000000100), 0x0) landlock_restrict_self(r1, 0xe) 2.761826819s ago: executing program 1 (id=674): prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x9) syz_clone(0x840c0200, 0x0, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r1 = memfd_secret(0x80000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x13, r1, 0x0) 1.865947543s ago: executing program 1 (id=677): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x0, 0x3}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x0, 0x1}, 0x10) sendmsg$tipc(r1, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81}, 0x80) r2 = dup3(r0, r1, 0x0) write$P9_RREADDIR(r2, 0x0, 0x0) 1.46474296s ago: executing program 4 (id=679): r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) listen(r0, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) connect$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) r2 = socket$unix(0x1, 0x1, 0x0) connect$unix(r2, &(0x7f0000000400)=@file={0x1, './file0\x00'}, 0x6e) close(0x3) 1.303593157s ago: executing program 4 (id=680): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, &(0x7f0000000100)={@ipv4={'\x00', '\xff\xff', @multicast2}, 0x56, r2}) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c00000010000305000000000007000000000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) 1.168395855s ago: executing program 4 (id=681): socket$inet6(0xa, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x50}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x64, 0x30, 0x0, 0x0, 0x0, {0x9}, [{0x50, 0x1, [@m_mpls={0x4c, 0xd, 0x0, 0x0, {{0x9}, {0xc, 0x2, 0x0, 0x1, [@TCA_MPLS_LABEL={0x8, 0x5, 0x9727a}]}, {0x15, 0x6, "c2cca64ae9666f0039e5c256ca605ef66f"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x3, 0x1}}}}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x24040005}, 0x20040000) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}}, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f0000000000), 0x400000000000235, 0x0) 949.073269ms ago: executing program 3 (id=682): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x100, 0x1, 0x25dfdbfb, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@loopback, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x80, 0x1, 0x0, 0xee01}, {0x9, 0x2, 0x0, 0x2000000000000, 0x40, 0xfffffffffffffdfd, 0x50, 0x6b4d}, {0x5}, 0x6, 0x40000000, 0x0, 0x1, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e"], 0xb8}}, 0x20004000) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000020000000000fc0000000000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x80c0}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="b80000001300e9990500000000000000fc000000000000000000000000000000fc00000000000000000000000000000000000000000000000a0030"], 0xb8}}, 0x4000) 918.108984ms ago: executing program 5 (id=683): mkdirat(0xffffffffffffff9c, &(0x7f0000004000)='./mnt\x00', 0x1ff) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0xc0406618, 0x0) 893.262401ms ago: executing program 3 (id=684): r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000001000)=ANY=[@ANYBLOB="1201000200000040501d4d610001000000010902200001010080320904000002ff00000007050102"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000100)=ANY=[@ANYBLOB="20c81e0000004d61501d0100000000000000100000040000800700000000000038"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000200)=ANY=[@ANYBLOB="403f0100000080"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000d80)={0x34, &(0x7f0000000a80)=ANY=[@ANYBLOB="401605"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000740)={0x34, &(0x7f0000000600)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000400)={0x2c, &(0x7f0000000280)={0x0, 0x31, 0x1, "e1"}, 0x0, 0x0, 0x0, 0x0}) 814.545587ms ago: executing program 4 (id=685): r0 = socket$netlink(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xffeffffffffffffe}, {0x0, 0x2000000000000}, 0x0, 0x0, 0x1, 0x0, 0x2}, {{@in6=@ipv4={'\x00', '\xff\xff', @multicast1}, 0x0, 0x32}, 0x0, @in=@broadcast, 0x10000, 0x0, 0x2, 0xb7, 0xc4, 0xfffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x1c) syz_genetlink_get_family_id$SEG6(0x0, r0) 799.2915ms ago: executing program 5 (id=686): r0 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r0, 0x0) r1 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r1, &(0x7f0000000080), 0x10) r2 = accept4$unix(r0, 0x0, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[], 0x20}}, 0x44) recvfrom$unix(r2, &(0x7f00000004c0)=""/249, 0xf9, 0x10022, 0x0, 0x0) 732.660364ms ago: executing program 0 (id=687): openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0xfffffe14) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x8, 0x10208, 0x83, 0xffff, 0x4, 0xabe6, 0x0, 0x0, 0x8, 0x8001}}, 0x50) syz_fuse_handle_req(r0, &(0x7f000000e3c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20c01, 0x0) ioctl$HIDIOCGRDESC(r2, 0x90044802, 0x0) 663.725727ms ago: executing program 0 (id=688): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000041000501010000000000000001010000000000001c0001000600060008000000100007007f0000017f000001910040001400020010000c00090009"], 0x48}, 0x1, 0x0, 0x0, 0x4044850}, 0xc040) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r1) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bond_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="4400000010000100"/20, @ANYRES32=r2, @ANYBLOB="000024000000000024001200140001006272696467655f736c617665800000000c00050008"], 0x3}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) splice(r0, 0x0, r1, 0x0, 0x10500, 0x0) 652.27925ms ago: executing program 5 (id=689): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) getsockname$packet(r2, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000005c0)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@delchain={0x24, 0x2e, 0x501, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r3, {}, {0x1, 0xffff}, {0x0, 0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 520.263683ms ago: executing program 5 (id=690): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}, 0x2, 0x1}}, 0x2e) mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) setsockopt$pppl2tp_PPPOL2TP_SO_RECVSEQ(r2, 0x111, 0x2, 0x0, 0x4) 511.358519ms ago: executing program 4 (id=691): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0) getdents64(r0, 0x0, 0x0) 499.630892ms ago: executing program 0 (id=692): r0 = syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) socket$xdp(0x2c, 0x3, 0x0) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x0, 0x10000, 0x0, 0x40055}, &(0x7f0000000300)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x2011}}) io_uring_enter(r1, 0x1000001, 0xfffffffa, 0x4b, 0x0, 0x0) read$midi(r0, 0x0, 0x3b) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x80383, 0x0) ioctl$SNDCTL_SEQ_RESET(r5, 0x5100) 372.123993ms ago: executing program 4 (id=693): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r3, @ANYBLOB="00001000252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, r3, 0x90646, 0x800}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_PRIMARY={0x8, 0xb, r3}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40e95}, 0x20048040) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c00000010001ffffcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800b0001006772657461700000240002800800070064010100060003001008000008001500700f0d0008000700ac1414bb08000a00", @ANYRES32=r3], 0x5c}}, 0x40) 363.244902ms ago: executing program 5 (id=694): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x2702, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000280)={0x2}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000600)={0x0, 0x0, @pic={0x0, 0x3, 0x6, 0x10, 0x5, 0x6, 0x6, 0x7, 0x3, 0x9, 0xff, 0x7, 0x64, 0xf6, 0x3, 0x9}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0xc9, 0x200000000d, 0x1, 0x6d, 0x2, 0x1002, 0xf1, 0x8, 0x7fffffffffff8, 0x8d, 0xfffffffffffffffe, 0x1, 0xfffffffffffffffe, 0x5, 0x3, 0xbde], 0x1000, 0x67a64fa265d09613}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 360.771201ms ago: executing program 1 (id=695): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'veth0_macvtap\x00', 0x0}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x12, 0x0, 0x0) setsockopt$inet6_mreq(r1, 0x29, 0x14, &(0x7f0000000100)={@mcast2, r2}, 0x14) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000004c0)=@newtfilter={0x24, 0x11, 0xd27, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x74, r2, {0x4, 0xfff2}, {0xafabc05531515610, 0xd}, {0x8, 0x2}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x1c005}, 0x24048004) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r3, 0xffffffffffffffff, 0x0) 320.435263ms ago: executing program 0 (id=696): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b0000"], 0x48) r0 = socket(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001400b59500000000000000000a000000", @ANYRES32=r2, @ANYBLOB="14000200fe8000000000000000000000000000aa080009003f0c0000140001"], 0x48}}, 0x0) sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)=ANY=[], 0x50}}, 0x0) rename(&(0x7f00000000c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) 74.904772ms ago: executing program 5 (id=697): io_uring_setup(0x3bc, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x8800}, 0x20044884) r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'pcl812\x00', [0x100, 0x4, 0x302, 0xd, 0xe, 0x5, 0x79, 0x3, 0x80008, 0x0, 0x2, 0x1000006c, 0x7, 0x8, 0x1, 0xfd, 0xfffffffb, 0x9, 0x3, 0x7fffffff, 0x89, 0xca9f, 0x1000000, 0x268, 0xffffffff, 0xf39e, 0x6, 0x8, 0xa6b5, 0x0, 0xfffffffc]}) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x40400, 0x0) ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000022a00)={0x4000000, 0x28, 0x0, 0x0, 0x2}) write$UHID_CREATE2(0xffffffffffffffff, 0x0, 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, 0xffffffffffffffff, 0x0) 45.798845ms ago: executing program 0 (id=698): ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0xe45, 0x9, 0xfffffffffffffffd, 0x10000000, 0x10000, 0x3, 0x4002004c2, 0x7ff, 0x1, 0x0, 0x400, 0x40, 0x88, 0x0, 0x8, 0x8d], 0xfec00000, 0x240046}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 0s ago: executing program 1 (id=699): socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000180)={0xd, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xe}, 0x94) prlimit64(0x0, 0x7, &(0x7f0000000140)={0x4, 0xc4}, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x899, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1c, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="2ff000fea0"], 0x0, 0xb, 0x0, 0x0, 0x41100, 0x6e, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) kernel console output (not intermixed with test programs): oot:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 99.269427][ T31] audit: type=1400 audit(1791436873.856:628): avc: denied { ioctl } for pid=6448 comm="syz.0.201" path="/46/file0" dev="tmpfs" ino=268 ioctlcmd=0x5451 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 99.397676][ T31] audit: type=1400 audit(1791436873.996:629): avc: denied { watch } for pid=6450 comm="syz.1.204" path="/50/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="tmpfs" ino=290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 99.397742][ T31] audit: type=1400 audit(1791436873.996:630): avc: denied { watch_sb watch_reads } for pid=6450 comm="syz.1.204" path="/50/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="tmpfs" ino=290 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 99.736025][ T6464] dvmrp0: entered allmulticast mode [ 99.774586][ T6467] dummy0: entered allmulticast mode [ 100.174969][ T5730] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 100.334610][ T5730] usb 4-1: New USB device found, idVendor=04d8, idProduct=0082, bcdDevice= 1.00 [ 100.345870][ T5730] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59391, setting to 1024 [ 100.345911][ T5730] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x2 has invalid maxpacket 65535, setting to 1024 [ 100.345933][ T5730] usb 4-1: config 1 interface 1 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024 [ 100.345954][ T5730] usb 4-1: config 1 interface 1 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 255 [ 100.345987][ T5730] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 100.356494][ T6478] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 100.659082][ T3335] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.711128][ T6499] capability: warning: `syz.0.227' uses 32-bit capabilities (legacy support in use) [ 100.771868][ T5609] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 100.775361][ T5609] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 100.787770][ T5730] ims_pcu 4-1:1.0: GET_INFO command failed, error: -71 [ 100.795518][ T5730] ims_pcu 4-1:1.0: probe with driver ims_pcu failed with error -71 [ 100.804554][ T5609] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 100.823822][ T5609] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 100.828395][ T5609] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 100.922946][ T3335] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.997523][ T5730] usb 4-1: USB disconnect, device number 8 [ 101.138329][ T3335] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 101.327038][ T3335] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 101.592758][ T3335] bridge_slave_1: left allmulticast mode [ 101.592800][ T3335] bridge_slave_1: left promiscuous mode [ 101.595642][ T3335] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.628779][ T3335] bridge_slave_0: left allmulticast mode [ 101.628805][ T3335] bridge_slave_0: left promiscuous mode [ 101.629016][ T3335] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.715079][ T5793] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 101.751308][ T6532] Invalid auth_tok structure returned from key query [ 101.751326][ T6532] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 101.751336][ T6532] One or more global auth toks could not properly register; rc = [-22] [ 101.751363][ T6532] Error validating options; rc = [-22] [ 101.865728][ T5793] usb 5-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 101.866632][ T5793] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 101.866681][ T5793] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 101.909962][ T5793] keyspan 5-1:1.0: Keyspan 2 port adapter converter detected [ 101.910182][ T5793] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 81 [ 101.910249][ T5793] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 1 [ 101.915495][ T5793] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 84 [ 101.923278][ T5793] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 2 [ 101.963155][ T5793] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 101.964584][ T5793] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 88 [ 101.964651][ T5793] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 6 [ 101.999228][ T5793] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 102.161759][ T5702] usb 5-1: USB disconnect, device number 3 [ 102.243324][ T3335] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 102.275650][ T3335] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 102.279775][ T3335] bond0 (unregistering): Released all slaves [ 102.493989][ T5702] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 102.526183][ T5702] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 102.526797][ T5702] keyspan 5-1:1.0: device disconnected [ 102.917592][ T4928] Bluetooth: hci3: command tx timeout [ 103.243319][ T3335] hsr_slave_0: left promiscuous mode [ 103.259183][ T3335] hsr_slave_1: left promiscuous mode [ 103.260054][ T3335] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 103.260087][ T3335] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 103.274600][ T3335] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 103.274620][ T3335] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 103.324359][ T3335] veth1_macvtap: left promiscuous mode [ 103.324508][ T3335] veth0_macvtap: left promiscuous mode [ 103.325560][ T3335] veth1_vlan: left promiscuous mode [ 103.342167][ T3335] veth0_vlan: left promiscuous mode [ 103.401614][ T31] kauditd_printk_skb: 33 callbacks suppressed [ 103.401632][ T31] audit: type=1400 audit(1791436877.996:664): avc: denied { write } for pid=6548 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 103.542841][ T1622] usb 5-1: new full-speed USB device number 4 using dummy_hcd [ 103.618912][ T5703] usb 4-1: new full-speed USB device number 9 using dummy_hcd [ 103.685605][ T31] audit: type=1400 audit(1791436878.276:665): avc: denied { write } for pid=6594 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 103.700187][ T1622] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 103.703007][ T1622] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 103.743456][ T1622] usb 5-1: config 0 descriptor?? [ 103.752248][ T1622] cp210x 5-1:0.0: cp210x converter detected [ 103.768789][ T5703] usb 4-1: not running at top speed; connect to a high speed hub [ 103.768841][ T5703] usb 4-1: New USB device found, idVendor=225a, idProduct=e1d4, bcdDevice=a7.ad [ 103.773476][ T5703] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 103.780552][ T5703] usb 4-1: New USB device strings: Mfr=245, Product=210, SerialNumber=0 [ 103.780584][ T5703] usb 4-1: Product: syz [ 103.780598][ T5703] usb 4-1: Manufacturer: syz [ 103.834141][ T5703] uvcvideo 4-1:1.0: Found UVC 1.00 device syz (225a:e1d4) [ 103.834247][ T5703] uvcvideo 4-1:1.0: No streaming interface found for terminal 32770. [ 103.973387][ T3335] team0 (unregistering): Port device team_slave_1 removed [ 103.995875][ T3335] team0 (unregistering): Port device team_slave_0 removed [ 104.144150][ T5275] 8021q: adding VLAN 0 to HW filter on device eth1 [ 104.167761][ T1622] cp210x 5-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 104.341789][ T6599] FAULT_INJECTION: forcing a failure. [ 104.341789][ T6599] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 104.341826][ T6599] CPU: 0 UID: 0 PID: 6599 Comm: syz.1.249 Not tainted syzkaller #0 PREEMPT(full) [ 104.341855][ T6599] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 104.341870][ T6599] Call Trace: [ 104.341878][ T6599] [ 104.341888][ T6599] dump_stack_lvl+0x100/0x190 [ 104.341932][ T6599] should_fail_ex.cold+0x5/0xa [ 104.341961][ T6599] ? prepare_alloc_pages+0x16d/0x5b0 [ 104.341998][ T6599] should_fail_alloc_page+0xeb/0x140 [ 104.342034][ T6599] prepare_alloc_pages+0x1f0/0x5b0 [ 104.342070][ T6599] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 104.342100][ T6599] ? folio_batch_move_lru+0x37c/0xc00 [ 104.342134][ T6599] ? folio_batch_move_lru+0x341/0xc00 [ 104.342162][ T6599] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 104.342190][ T6599] ? folio_batch_move_lru+0x3a9/0xc00 [ 104.342224][ T6599] ? __pfx_lru_add+0x10/0x10 [ 104.342257][ T6599] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 104.342282][ T6599] ? __pfx_folio_batch_move_lru+0x10/0x10 [ 104.342325][ T6599] ? __lock_acquire+0x5c0/0x1f40 [ 104.342355][ T6599] ? __lock_acquire+0x5c0/0x1f40 [ 104.342390][ T6599] ? __css_rstat_updated+0x1ce/0x590 [ 104.342430][ T6599] ? lock_acquire+0x1d1/0x380 [ 104.342455][ T6599] ? page_table_check_set+0x11d/0x580 [ 104.342486][ T6599] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 104.342515][ T6599] ? policy_nodemask+0xed/0x4f0 [ 104.342546][ T6599] alloc_pages_mpol+0x201/0x550 [ 104.342575][ T6599] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 104.342603][ T6599] ? __page_table_check_ptes_set+0x1d5/0x530 [ 104.342637][ T6599] folio_alloc_mpol_noprof+0x36/0x260 [ 104.342659][ T6599] vma_alloc_folio_noprof+0xed/0x1d0 [ 104.342679][ T6599] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 104.342701][ T6599] ? rcu_read_unlock+0x2d/0xb0 [ 104.342732][ T6599] do_anonymous_page+0xac9/0x2050 [ 104.342779][ T6599] ? __pfx_do_anonymous_page+0x10/0x10 [ 104.342814][ T6599] ? rcu_read_unlock+0x2d/0xb0 [ 104.342836][ T6599] ? rcu_read_unlock+0x2d/0xb0 [ 104.342855][ T6599] ? __pte_offset_map+0x179/0x310 [ 104.342890][ T6599] __handle_mm_fault+0x1ff3/0x2f60 [ 104.342927][ T6599] ? __pfx___handle_mm_fault+0x10/0x10 [ 104.342960][ T6599] ? __pfx_mt_find+0x10/0x10 [ 104.343009][ T6599] ? find_vma+0xbf/0x140 [ 104.343038][ T6599] ? __pfx_find_vma+0x10/0x10 [ 104.343069][ T6599] handle_mm_fault+0x363/0xa20 [ 104.343094][ T6599] do_user_addr_fault+0x745/0x12f0 [ 104.343137][ T6599] exc_page_fault+0x6f/0xd0 [ 104.343164][ T6599] asm_exc_page_fault+0x26/0x30 [ 104.343188][ T6599] RIP: 0010:rep_movs_alternative+0x4a/0xa0 [ 104.343223][ T6599] Code: cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 e9 3f b2 04 00 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 104.343246][ T6599] RSP: 0018:ffffc90004a4fbe8 EFLAGS: 00050206 [ 104.343267][ T6599] RAX: 0000000000000001 RBX: 0000000000001000 RCX: 0000000000000238 [ 104.343281][ T6599] RDX: 0000000000000001 RSI: ffff88807c6bcdc8 RDI: 0000200000021000 [ 104.343295][ T6599] RBP: 0000200000020238 R08: 0000000000000000 R09: ffffed100f8d79ff [ 104.343309][ T6599] R10: ffff88807c6bcfff R11: 0000000000000000 R12: ffff88807c6bc000 [ 104.343323][ T6599] R13: 0000200000021238 R14: 00007ffffffff000 R15: 0000000000000000 [ 104.343357][ T6599] _copy_to_user+0xa4/0xd0 [ 104.343398][ T6599] pagemap_read+0x51b/0x830 [ 104.343436][ T6599] ? __pfx_pagemap_read+0x10/0x10 [ 104.343471][ T6599] ? rw_verify_area+0xce/0x6d0 [ 104.343496][ T6599] ? __pfx_pagemap_read+0x10/0x10 [ 104.343528][ T6599] vfs_read+0x1e4/0xb40 [ 104.343552][ T6599] ? lock_acquire+0x1d1/0x380 [ 104.343578][ T6599] ? __fget_files+0x34/0x3d0 [ 104.343610][ T6599] ? __pfx_vfs_read+0x10/0x10 [ 104.343633][ T6599] ? find_held_lock+0x2b/0x80 [ 104.343660][ T6599] ? __fget_files+0x215/0x3d0 [ 104.343684][ T6599] ? __fget_files+0x215/0x3d0 [ 104.343715][ T6599] ? __fget_files+0x21f/0x3d0 [ 104.343749][ T6599] __x64_sys_pread64+0x1eb/0x250 [ 104.343776][ T6599] ? __pfx___x64_sys_pread64+0x10/0x10 [ 104.343811][ T6599] do_syscall_64+0x123/0x790 [ 104.343842][ T6599] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.343865][ T6599] RIP: 0033:0x7f7ef199e199 [ 104.343886][ T6599] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 104.343908][ T6599] RSP: 002b:00007f7ef2790028 EFLAGS: 00000246 ORIG_RAX: 0000000000000011 [ 104.343930][ T6599] RAX: ffffffffffffffda RBX: 00007f7ef1c25fa0 RCX: 00007f7ef199e199 [ 104.343945][ T6599] RDX: 0000000000019000 RSI: 000020000001a240 RDI: 0000000000000004 [ 104.343959][ T6599] RBP: 00007f7ef1a358e0 R08: 0000000000000000 R09: 0000000000000000 [ 104.343972][ T6599] R10: 0000000000100008 R11: 0000000000000246 R12: 0000000000000000 [ 104.343986][ T6599] R13: 00007f7ef1c26038 R14: 00007f7ef1c25fa0 R15: 00007ffdad0d4ad8 [ 104.344021][ T6599] [ 104.861341][ T1622] usb 5-1: cp210x converter now attached to ttyUSB0 [ 104.863892][ T1622] usb 5-1: USB disconnect, device number 4 [ 104.864944][ T862] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 104.925699][ T1622] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 104.926204][ T1622] cp210x 5-1:0.0: device disconnected [ 104.996138][ T4928] Bluetooth: hci3: command tx timeout [ 105.015765][ T862] usb 2-1: Using ep0 maxpacket: 32 [ 105.026825][ T862] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 105.042231][ T862] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 105.042257][ T862] usb 2-1: config 0 has no interface number 0 [ 105.042302][ T862] usb 2-1: config 0 interface 184 has no altsetting 0 [ 105.044087][ T862] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 105.044111][ T862] usb 2-1: Product: syz [ 105.044125][ T862] usb 2-1: Manufacturer: syz [ 105.044138][ T862] usb 2-1: SerialNumber: syz [ 105.054374][ T862] usb 2-1: config 0 descriptor?? [ 105.099247][ T6500] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.099357][ T6500] bridge0: port 1(bridge_slave_0) entered disabled state [ 105.099498][ T6500] bridge_slave_0: entered allmulticast mode [ 105.113933][ T6500] bridge_slave_0: entered promiscuous mode [ 105.132808][ T6500] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.132916][ T6500] bridge0: port 2(bridge_slave_1) entered disabled state [ 105.133070][ T6500] bridge_slave_1: entered allmulticast mode [ 105.138764][ T6500] bridge_slave_1: entered promiscuous mode [ 105.232930][ T6500] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 105.254681][ T6500] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 105.292524][ T31] audit: type=1400 audit(1791436879.886:666): avc: denied { write } for pid=6602 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 105.363937][ T31] audit: type=1400 audit(1791436879.956:667): avc: denied { setopt } for pid=6620 comm="syz.0.252" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 105.367849][ T6500] team0: Port device team_slave_0 added [ 105.378994][ T6500] team0: Port device team_slave_1 added [ 105.513041][ T6500] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 105.513060][ T6500] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 105.513101][ T6500] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 105.522300][ T6500] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 105.522315][ T6500] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 105.522353][ T6500] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 105.634312][ T31] audit: type=1400 audit(1791436880.226:668): avc: denied { write } for pid=6622 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 105.658133][ T6500] hsr_slave_0: entered promiscuous mode [ 105.667440][ T6500] hsr_slave_1: entered promiscuous mode [ 105.671511][ T6500] debugfs: 'hsr0' already exists in 'hsr' [ 105.671534][ T6500] Cannot create hsr debugfs directory [ 105.781451][ T5275] 8021q: adding VLAN 0 to HW filter on device eth2 [ 106.127761][ T6500] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 106.148535][ T6500] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 106.151773][ T6500] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 106.177722][ T6500] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 106.249618][ T6500] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 106.260473][ T5793] usb 4-1: USB disconnect, device number 9 [ 106.279320][ T6500] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 106.280228][ T6500] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 106.304784][ T6500] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 106.445521][ T6500] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.508566][ T6500] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.516405][ T862] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000040: -71 [ 106.516439][ T862] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Error writing E2P_CMD [ 106.541035][ T862] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 106.541068][ T862] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 106.541088][ T862] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 106.541125][ T862] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 106.541603][ T862] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -71 [ 106.564178][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.564269][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.572177][ T862] usb 2-1: USB disconnect, device number 5 [ 106.599284][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.599375][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.951897][ T31] audit: type=1400 audit(1791436881.546:669): avc: denied { write } for pid=6641 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 106.995231][ T31] audit: type=1400 audit(1791436881.586:670): avc: denied { mount } for pid=6672 comm="syz.0.264" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 107.085184][ T4928] Bluetooth: hci3: command tx timeout [ 107.150637][ T31] audit: type=1400 audit(1791436881.746:671): avc: denied { write } for pid=6676 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 107.278144][ T6667] printk: console [ttyS0] disabled [ 108.079638][ T6673] printk: console [ttyS0] enabled [ 108.348137][ T6500] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.452332][ T31] kauditd_printk_skb: 6 callbacks suppressed [ 108.452350][ T31] audit: type=1400 audit(1791436883.046:680): avc: denied { search } for pid=6719 comm="getty" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:getty_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 108.453531][ T31] audit: type=1400 audit(1791436883.046:681): avc: denied { read write } for pid=6719 comm="getty" name="utmp" dev="tmpfs" ino=2 scontext=system_u:system_r:getty_t tcontext=system_u:object_r:init_tmpfs_t tclass=file permissive=1 [ 108.454015][ T31] audit: type=1400 audit(1791436883.046:682): avc: denied { open } for pid=6719 comm="getty" path="/run/utmp" dev="tmpfs" ino=2 scontext=system_u:system_r:getty_t tcontext=system_u:object_r:init_tmpfs_t tclass=file permissive=1 [ 108.457891][ T31] audit: type=1400 audit(1791436883.056:683): avc: denied { lock } for pid=6719 comm="getty" path="/run/utmp" dev="tmpfs" ino=2 scontext=system_u:system_r:getty_t tcontext=system_u:object_r:init_tmpfs_t tclass=file permissive=1 [ 108.623504][ T31] audit: type=1400 audit(1791436883.216:684): avc: denied { write } for pid=6729 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 108.799173][ T6736] capability: warning: `syz.4.277' uses deprecated v2 capabilities in a way that may be insecure [ 108.831315][ T5275] 8021q: adding VLAN 0 to HW filter on device eth4 [ 109.045913][ T5703] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 109.149355][ T31] audit: type=1400 audit(1791436883.746:685): avc: denied { name_connect } for pid=6745 comm="syz.3.278" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 109.150989][ T6500] veth0_vlan: entered promiscuous mode [ 109.154903][ T4928] Bluetooth: hci3: command tx timeout [ 109.173285][ T6500] veth1_vlan: entered promiscuous mode [ 109.196286][ T5703] usb 5-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 109.197227][ T5703] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 109.197270][ T5703] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 109.197315][ T5703] usb 5-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 109.197351][ T5703] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 109.320999][ T6500] veth0_macvtap: entered promiscuous mode [ 109.346426][ T6500] veth1_macvtap: entered promiscuous mode [ 109.406579][ T31] audit: type=1400 audit(1791436884.006:686): avc: denied { create } for pid=6735 comm="syz.4.277" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 109.424001][ T6500] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.458301][ T6500] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.525307][ T31] audit: type=1400 audit(1791436884.116:687): avc: denied { watch } for pid=6757 comm="syz.1.281" path="/69" dev="tmpfs" ino=385 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 109.533818][ T31] audit: type=1400 audit(1791436884.126:688): avc: denied { watch_reads } for pid=6757 comm="syz.1.281" path="/69" dev="tmpfs" ino=385 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 109.536250][ T3263] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.536565][ T3263] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.536853][ T3263] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.536916][ T3263] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.621418][ T31] audit: type=1400 audit(1791436884.216:689): avc: denied { ioctl } for pid=6735 comm="syz.4.277" path="socket:[15727]" dev="sockfs" ino=15727 ioctlcmd=0x6153 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 109.624220][ T5703] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -71 [ 109.624242][ T5703] ATM dev 0: usbatm_atm_init: atm_start failed: -71! [ 109.675920][ T5703] cxacru 5-1:1.0: probe with driver cxacru failed with error -71 [ 109.680988][ T5703] usb 5-1: USB disconnect, device number 5 [ 109.888758][ T3263] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.888778][ T3263] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.930070][ T6765] erspan1: entered allmulticast mode [ 109.990542][ T3315] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.990563][ T3315] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.543098][ T6806] syz_tun: entered allmulticast mode [ 110.617000][ T6804] syz_tun: left allmulticast mode [ 111.864018][ T3287] IPVS: starting estimator thread 0... [ 111.957776][ T6846] IPVS: using max 32 ests per chain, 76800 per kthread [ 112.145327][ T6861] netlink: 'syz.3.303': attribute type 1 has an invalid length. [ 112.239190][ T6861] bond1: entered promiscuous mode [ 112.239643][ T6861] 8021q: adding VLAN 0 to HW filter on device bond1 [ 112.700475][ T6861] 8021q: adding VLAN 0 to HW filter on device bond1 [ 112.731860][ T6861] bond1: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 112.731885][ T6861] bond1: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 112.766345][ T6861] bond1: (slave ip6gre1): making interface the new active one [ 112.766373][ T6861] ip6gre1: entered promiscuous mode [ 112.781955][ T6861] bond1: (slave ip6gre1): Enslaving as an active interface with an up link [ 113.032940][ T6886] jffs2: notice: (6886) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 113.658022][ T31] kauditd_printk_skb: 8 callbacks suppressed [ 113.658041][ T31] audit: type=1400 audit(1791436888.256:697): avc: denied { watch_sb } for pid=6905 comm="syz.4.315" path="/56" dev="tmpfs" ino=312 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 114.838779][ T6928] netlink: 'syz.0.322': attribute type 1 has an invalid length. [ 114.906274][ T6928] 8021q: adding VLAN 0 to HW filter on device bond1 [ 114.983126][ T6930] bond1: (slave erspan0): making interface the new active one [ 115.001685][ T6930] bond1: (slave erspan0): Enslaving as an active interface with an up link [ 115.128423][ T6934] netlink: 24 bytes leftover after parsing attributes in process `syz.5.324'. [ 115.407857][ T6939] af_packet: packet size is too long (4294967085 > 2016) [ 115.628913][ T6854] IPVS: starting estimator thread 0... [ 115.715071][ T6950] IPVS: using max 45 ests per chain, 108000 per kthread [ 115.754680][ T31] audit: type=1400 audit(1791436890.346:698): avc: denied { create } for pid=6952 comm="syz.1.333" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 115.780196][ T31] audit: type=1400 audit(1791436890.376:699): avc: denied { ioctl } for pid=6952 comm="syz.1.333" path="socket:[16614]" dev="sockfs" ino=16614 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 115.780240][ T31] audit: type=1400 audit(1791436890.376:700): avc: denied { write } for pid=6952 comm="syz.1.333" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 115.872126][ T31] audit: type=1400 audit(1791436890.466:701): avc: denied { append } for pid=6954 comm="syz.3.332" name="nullb0" dev="devtmpfs" ino=694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 116.119311][ T31] audit: type=1400 audit(1791436890.716:702): avc: denied { create } for pid=6967 comm="syz.4.338" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 116.150853][ T6966] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 116.160868][ T31] audit: type=1400 audit(1791436890.756:703): avc: denied { connect } for pid=6967 comm="syz.4.338" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 116.182953][ T31] audit: type=1400 audit(1791436890.776:704): avc: denied { setopt } for pid=6967 comm="syz.4.338" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 116.458173][ T6978] bridge0: port 3(syz_tun) entered blocking state [ 116.458484][ T6978] bridge0: port 3(syz_tun) entered disabled state [ 116.458624][ T6978] syz_tun: entered allmulticast mode [ 116.462870][ T6978] syz_tun: entered promiscuous mode [ 116.464316][ T6978] bridge0: port 3(syz_tun) entered blocking state [ 116.464450][ T6978] bridge0: port 3(syz_tun) entered forwarding state [ 116.563423][ T31] audit: type=1400 audit(1791436891.156:705): avc: denied { ioctl } for pid=6977 comm="syz.5.342" path="/dev/dvb/adapter0/frontend0" dev="devtmpfs" ino=920 ioctlcmd=0x6f52 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 116.785390][ T5766] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 116.787218][ T6991] gadgetfs: bound to dummy_udc driver [ 116.868004][ T31] audit: type=1400 audit(1791436891.466:706): avc: denied { unmount } for pid=6500 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 116.940853][ T5766] usb 2-1: Using ep0 maxpacket: 8 [ 116.950325][ T5766] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 116.956331][ T5766] usb 2-1: config index 0 descriptor too short (expected 74, got 45) [ 116.956374][ T5766] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 116.956400][ T5766] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 116.956425][ T5766] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 116.956449][ T5766] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 116.956472][ T5766] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 116.956508][ T5766] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 117.199326][ T5766] usb 2-1: GET_CAPABILITIES returned 0 [ 117.199366][ T5766] usbtmc 2-1:16.0: can't read capabilities [ 117.502315][ T5793] usb 2-1: USB disconnect, device number 6 [ 119.026134][ T31] kauditd_printk_skb: 6 callbacks suppressed [ 119.026153][ T31] audit: type=1400 audit(1791436893.626:713): avc: denied { name_bind } for pid=7073 comm="syz.3.374" src=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=sctp_socket permissive=1 [ 119.031918][ T31] audit: type=1400 audit(1791436893.626:714): avc: denied { node_bind } for pid=7073 comm="syz.3.374" src=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 119.042337][ T31] audit: type=1400 audit(1791436893.636:715): avc: denied { name_connect } for pid=7073 comm="syz.3.374" dest=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=sctp_socket permissive=1 [ 119.494210][ T7084] FAULT_INJECTION: forcing a failure. [ 119.494210][ T7084] name failslab, interval 1, probability 0, space 0, times 0 [ 119.494245][ T7084] CPU: 0 UID: 0 PID: 7084 Comm: syz.4.376 Not tainted syzkaller #0 PREEMPT(full) [ 119.494273][ T7084] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 119.494286][ T7084] Call Trace: [ 119.494293][ T7084] [ 119.494301][ T7084] dump_stack_lvl+0x100/0x190 [ 119.494355][ T7084] should_fail_ex.cold+0x5/0xa [ 119.494393][ T7084] should_failslab+0xc2/0x120 [ 119.494425][ T7084] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 119.494455][ T7084] ? key_alloc+0x423/0x1310 [ 119.494487][ T7084] kmemdup_noprof+0x29/0x60 [ 119.494511][ T7084] key_alloc+0x423/0x1310 [ 119.494551][ T7084] ? __pfx_key_alloc+0x10/0x10 [ 119.494578][ T7084] ? __pfx_sprintf+0x10/0x10 [ 119.494607][ T7084] keyring_alloc+0x44/0xc0 [ 119.494639][ T7084] call_sbin_request_key+0x380/0xd90 [ 119.494673][ T7084] ? __pfx_call_sbin_request_key+0x10/0x10 [ 119.494698][ T7084] ? key_instantiate_and_link+0x39d/0x4b0 [ 119.494725][ T7084] ? key_alloc+0xbb4/0x1310 [ 119.494752][ T7084] ? __pfx_key_instantiate_and_link+0x10/0x10 [ 119.494799][ T7084] ? request_key_auth_new+0x732/0xb50 [ 119.494824][ T7084] ? __pfx_request_key_auth_new+0x10/0x10 [ 119.494854][ T7084] ? __pfx_call_sbin_request_key+0x10/0x10 [ 119.494878][ T7084] request_key_and_link+0x1115/0x1330 [ 119.494905][ T7084] ? __pfx_request_key_and_link+0x10/0x10 [ 119.494926][ T7084] ? __pfx___might_resched+0x10/0x10 [ 119.494948][ T7084] ? __pfx_asymmetric_key_cmp_partial+0x10/0x10 [ 119.494968][ T7084] ? __pfx_keyring_search_iterator+0x10/0x10 [ 119.494996][ T7084] ? _copy_from_user+0x59/0xd0 [ 119.495025][ T7084] __do_sys_request_key+0x2a2/0x3c0 [ 119.495047][ T7084] ? __pfx___do_sys_request_key+0x10/0x10 [ 119.495076][ T7084] do_syscall_64+0x123/0x790 [ 119.495103][ T7084] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.495125][ T7084] RIP: 0033:0x7f7e4859e199 [ 119.495152][ T7084] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 119.495171][ T7084] RSP: 002b:00007f7e49416028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f9 [ 119.495189][ T7084] RAX: ffffffffffffffda RBX: 00007f7e48825fa0 RCX: 00007f7e4859e199 [ 119.495203][ T7084] RDX: 0000200000001fee RSI: 0000200000001ffb RDI: 0000200000000040 [ 119.495216][ T7084] RBP: 00007f7e486358e0 R08: 0000000000000000 R09: 0000000000000000 [ 119.495228][ T7084] R10: fffffffffffffffe R11: 0000000000000246 R12: 0000000000000000 [ 119.495240][ T7084] R13: 00007f7e48826038 R14: 00007f7e48825fa0 R15: 00007fff99e1da08 [ 119.495270][ T7084] [ 119.503316][ T7085] netlink: 'syz.1.377': attribute type 1 has an invalid length. [ 119.654713][ T7085] 8021q: adding VLAN 0 to HW filter on device bond1 [ 119.778742][ T7090] FAULT_INJECTION: forcing a failure. [ 119.778742][ T7090] name failslab, interval 1, probability 0, space 0, times 0 [ 119.778785][ T7090] CPU: 0 UID: 0 PID: 7090 Comm: syz.5.378 Not tainted syzkaller #0 PREEMPT(full) [ 119.778810][ T7090] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 119.778823][ T7090] Call Trace: [ 119.778830][ T7090] [ 119.778838][ T7090] dump_stack_lvl+0x100/0x190 [ 119.778878][ T7090] should_fail_ex.cold+0x5/0xa [ 119.778908][ T7090] should_failslab+0xc2/0x120 [ 119.778936][ T7090] kmem_cache_alloc_bulk_noprof+0x77/0x890 [ 119.778962][ T7090] ? __pfx___cant_migrate+0x10/0x10 [ 119.778997][ T7090] xdp_test_run_batch.constprop.0+0x1561/0x1ca0 [ 119.779035][ T7090] ? __pfx_xdp_test_run_batch.constprop.0+0x10/0x10 [ 119.779059][ T7090] ? lock_acquire+0x1d1/0x380 [ 119.779082][ T7090] ? find_held_lock+0x2b/0x80 [ 119.779122][ T7090] ? ktime_get+0x23e/0x320 [ 119.779145][ T7090] ? ktime_get+0x1a4/0x320 [ 119.779174][ T7090] bpf_test_run_xdp_live+0x367/0x760 [ 119.779200][ T7090] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 119.779226][ T7090] ? lock_acquire+0x1d1/0x380 [ 119.779253][ T7090] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 119.779276][ T7090] ? find_held_lock+0x2b/0x80 [ 119.779303][ T7090] ? bpf_dispatcher_change_prog+0x6c3/0xa50 [ 119.779341][ T7090] ? __pfx_wait_rcu_exp_gp+0x10/0x10 [ 119.779366][ T7090] ? 0xffffffffa04047c0 [ 119.779384][ T7090] ? 0xffffffffa04047c0 [ 119.779401][ T7090] ? bpf_dispatcher_change_prog+0x2de/0xa50 [ 119.779428][ T7090] bpf_prog_test_run_xdp+0xd86/0x1670 [ 119.779464][ T7090] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 119.779499][ T7090] ? fput+0x7c/0x100 [ 119.779525][ T7090] ? __bpf_prog_get+0x97/0x290 [ 119.779552][ T7090] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 119.779578][ T7090] __sys_bpf+0x2265/0x4a30 [ 119.779598][ T7090] ? plist_check_list+0x1b8/0x280 [ 119.779631][ T7090] ? plist_check_list+0x190/0x280 [ 119.779658][ T7090] ? __pfx___sys_bpf+0x10/0x10 [ 119.779677][ T7090] ? find_held_lock+0x2b/0x80 [ 119.779704][ T7090] ? futex_wake+0x4ea/0x5e0 [ 119.779727][ T7090] ? futex_private_hash_put.part.0+0xdc/0x180 [ 119.779762][ T7090] ? futex_private_hash_put+0x24/0x30 [ 119.779796][ T7090] ? __pfx_futex_wake+0x10/0x10 [ 119.779821][ T7090] ? rcu_read_lock_any_held+0x6a/0x90 [ 119.779853][ T7090] ? find_held_lock+0x2b/0x80 [ 119.779882][ T7090] ? ksys_write+0x190/0x250 [ 119.779903][ T7090] ? ksys_write+0x190/0x250 [ 119.779944][ T7090] ? __x64_sys_futex+0x34f/0x4d0 [ 119.779970][ T7090] ? __x64_sys_futex+0x358/0x4d0 [ 119.780000][ T7090] ? xfd_validate_state+0x129/0x190 [ 119.780027][ T7090] ? __x64_sys_bpf+0xce/0x140 [ 119.780048][ T7090] __x64_sys_bpf+0xce/0x140 [ 119.780070][ T7090] ? do_syscall_64+0xae/0x790 [ 119.780092][ T7090] do_syscall_64+0x123/0x790 [ 119.780117][ T7090] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.780138][ T7090] RIP: 0033:0x7f312ef9e199 [ 119.780154][ T7090] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 119.780172][ T7090] RSP: 002b:00007f312fdd0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 119.780192][ T7090] RAX: ffffffffffffffda RBX: 00007f312f225fa0 RCX: 00007f312ef9e199 [ 119.780206][ T7090] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 119.780219][ T7090] RBP: 00007f312f0358e0 R08: 0000000000000000 R09: 0000000000000000 [ 119.780231][ T7090] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 119.780243][ T7090] R13: 00007f312f226038 R14: 00007f312f225fa0 R15: 00007ffd624d6008 [ 119.780270][ T7090] [ 119.990896][ T7088] bond1: (slave geneve2): making interface the new active one [ 120.044555][ T7088] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 120.371059][ T31] audit: type=1400 audit(1791436894.966:716): avc: denied { write } for pid=7072 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 120.530928][ T31] audit: type=1400 audit(1791436895.126:717): avc: denied { write } for pid=7118 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 120.559551][ T7120] jffs2: notice: (7120) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 120.582166][ T5702] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 120.617153][ T5703] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 120.633422][ T7122] kvm: emulating exchange as write [ 120.735020][ T5702] usb 5-1: Using ep0 maxpacket: 16 [ 120.738263][ T5702] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 120.739931][ T5702] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 120.742293][ T5702] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 120.742320][ T5702] usb 5-1: Product: syz [ 120.742336][ T5702] usb 5-1: Manufacturer: syz [ 120.742351][ T5702] usb 5-1: SerialNumber: syz [ 120.792126][ T7133] syzkaller1: entered promiscuous mode [ 120.792148][ T7133] syzkaller1: entered allmulticast mode [ 120.809335][ T5703] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 120.814209][ T5702] usb 5-1: config 0 descriptor?? [ 120.829195][ T5703] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 120.829228][ T5703] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 120.829347][ T5703] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 120.829368][ T5703] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 120.829413][ T5703] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 120.903173][ T5703] usb 4-1: config 0 descriptor?? [ 120.905319][ T5702] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 120.905356][ T5702] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 121.021793][ T7141] af_packet: tpacket_rcv: packet too big, clamped from 28 to 4294967272. macoff=96 [ 121.081610][ T31] audit: type=1400 audit(1791436895.676:718): avc: denied { write } for pid=7129 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 121.180855][ T7147] FAULT_INJECTION: forcing a failure. [ 121.180855][ T7147] name failslab, interval 1, probability 0, space 0, times 0 [ 121.180889][ T7147] CPU: 0 UID: 0 PID: 7147 Comm: syz.1.392 Not tainted syzkaller #0 PREEMPT(full) [ 121.180915][ T7147] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 121.180928][ T7147] Call Trace: [ 121.180936][ T7147] [ 121.180944][ T7147] dump_stack_lvl+0x100/0x190 [ 121.180980][ T7147] should_fail_ex.cold+0x5/0xa [ 121.181010][ T7147] should_failslab+0xc2/0x120 [ 121.181038][ T7147] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 121.181066][ T7147] ? nfs_get_client+0x87b/0x1230 [ 121.181094][ T7147] ? nfs4_set_client+0x3f6/0x640 [ 121.181124][ T7147] ? nfs4_init_server.isra.0+0x5ad/0xf60 [ 121.181153][ T7147] ? kstrdup_const+0x63/0x80 [ 121.181179][ T7147] kstrdup+0x51/0xe0 [ 121.181199][ T7147] kstrdup_const+0x63/0x80 [ 121.181219][ T7147] __kernfs_new_node+0x9b/0xa10 [ 121.181244][ T7147] ? __pfx___kernfs_new_node+0x10/0x10 [ 121.181268][ T7147] ? lock_acquire+0x1d1/0x380 [ 121.181290][ T7147] ? kernfs_root+0x23/0x2a0 [ 121.181318][ T7147] ? find_held_lock+0x2b/0x80 [ 121.181344][ T7147] ? kernfs_root+0xee/0x2a0 [ 121.181373][ T7147] ? kernfs_root+0xee/0x2a0 [ 121.181408][ T7147] kernfs_create_dir_ns+0xa6/0x2b0 [ 121.181436][ T7147] sysfs_create_dir_ns+0x13a/0x2b0 [ 121.181465][ T7147] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 121.181493][ T7147] ? find_held_lock+0x2b/0x80 [ 121.181521][ T7147] ? kobject_add_internal+0x25f/0x930 [ 121.181548][ T7147] ? kobject_add_internal+0x25f/0x930 [ 121.181578][ T7147] ? rpc_sysfs_xprt_switch_namespace+0xd/0x40 [ 121.181606][ T7147] kobject_add_internal+0x2c8/0x930 [ 121.181640][ T7147] kobject_init_and_add+0x121/0x180 [ 121.181670][ T7147] ? __pfx_kobject_init_and_add+0x10/0x10 [ 121.181707][ T7147] ? __kasan_kmalloc+0xaa/0xb0 [ 121.181736][ T7147] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 121.181759][ T7147] ? rpc_sysfs_xprt_switch_setup+0xe0/0x370 [ 121.181792][ T7147] rpc_sysfs_xprt_switch_setup+0x189/0x370 [ 121.181820][ T7147] xprt_switch_alloc+0x28e/0x3c0 [ 121.181851][ T7147] rpc_create_xprt+0x2dc/0x440 [ 121.181872][ T7147] rpc_create+0x46e/0x7f0 [ 121.181891][ T7147] ? lock_acquire+0x1d1/0x380 [ 121.181915][ T7147] ? __pfx_rpc_create+0x10/0x10 [ 121.181966][ T7147] ? net_generic+0xea/0x2a0 [ 121.181993][ T7147] ? net_generic+0xea/0x2a0 [ 121.182028][ T7147] nfs_create_rpc_client+0x6a1/0x8f0 [ 121.182058][ T7147] ? __pfx_nfs_create_rpc_client+0x10/0x10 [ 121.182099][ T7147] ? lockdep_init_map_type+0x5c/0x250 [ 121.182125][ T7147] ? lockdep_init_map_type+0x5c/0x250 [ 121.182154][ T7147] nfs4_alloc_client+0x8f0/0xd70 [ 121.182187][ T7147] ? __pfx_nfs4_alloc_client+0x10/0x10 [ 121.182217][ T7147] ? __lock_acquire+0x5c0/0x1f40 [ 121.182241][ T7147] ? stack_trace_save+0x8e/0xc0 [ 121.182262][ T7147] ? __pfx_stack_trace_save+0x10/0x10 [ 121.182285][ T7147] ? lock_acquire+0x1d1/0x380 [ 121.182303][ T7147] ? net_generic+0x25/0x2a0 [ 121.182329][ T7147] ? nfs_get_client+0x849/0x1230 [ 121.182354][ T7147] ? nfs_get_client+0x849/0x1230 [ 121.182386][ T7147] nfs_get_client+0x87b/0x1230 [ 121.182414][ T7147] ? do_raw_spin_lock+0x128/0x260 [ 121.182446][ T7147] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 121.182471][ T7147] nfs4_set_client+0x3f6/0x640 [ 121.182500][ T7147] nfs4_init_server.isra.0+0x5ad/0xf60 [ 121.182529][ T7147] ? __pfx___debug_object_init+0x10/0x10 [ 121.182558][ T7147] ? __pfx_nfs4_init_server.isra.0+0x10/0x10 [ 121.182606][ T7147] ? __rpc_init_priority_wait_queue+0x38a/0x500 [ 121.182638][ T7147] nfs4_create_server+0x185/0x2b0 [ 121.182660][ T7147] nfs4_try_get_tree+0x93/0x140 [ 121.182690][ T7147] nfs_get_tree+0xa61/0x1450 [ 121.182725][ T7147] vfs_get_tree+0x92/0x320 [ 121.182746][ T7147] path_mount+0x7d0/0x24c0 [ 121.182769][ T7147] ? __pfx_path_mount+0x10/0x10 [ 121.182786][ T7147] ? lockdep_hardirqs_on+0x7d/0x110 [ 121.182812][ T7147] ? putname+0xb1/0x110 [ 121.182836][ T7147] ? kmem_cache_free+0x127/0x6c0 [ 121.182865][ T7147] ? __x64_sys_mount+0x293/0x310 [ 121.182884][ T7147] __x64_sys_mount+0x293/0x310 [ 121.182903][ T7147] ? __pfx___x64_sys_mount+0x10/0x10 [ 121.182932][ T7147] do_syscall_64+0x123/0x790 [ 121.182957][ T7147] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 121.182976][ T7147] RIP: 0033:0x7f7ef199e199 [ 121.182993][ T7147] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 121.183011][ T7147] RSP: 002b:00007f7ef2790028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 121.183031][ T7147] RAX: ffffffffffffffda RBX: 00007f7ef1c25fa0 RCX: 00007f7ef199e199 [ 121.183046][ T7147] RDX: 0000200000000100 RSI: 00002000000000c0 RDI: 0000200000000080 [ 121.183060][ T7147] RBP: 00007f7ef1a358e0 R08: 0000200000000140 R09: 0000000000000000 [ 121.183073][ T7147] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 121.183086][ T7147] R13: 00007f7ef1c26038 R14: 00007f7ef1c25fa0 R15: 00007ffdad0d4ad8 [ 121.183116][ T7147] [ 121.189332][ T7147] kobject: kobject_add_internal failed for switch-0 (error: -12 parent: xprt-switches) [ 121.395370][ T5702] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 121.414393][ T31] audit: type=1400 audit(1791436896.006:719): avc: denied { write } for pid=7148 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 121.501817][ T31] audit: type=1400 audit(1791436896.096:720): avc: denied { accept } for pid=7153 comm="syz.5.396" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 121.772940][ T5702] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 121.772989][ T5702] em28xx 5-1:0.0: board has no eeprom [ 121.795261][ T5703] plantronics 0003:047F:FFFF.0002: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 121.885936][ T5702] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 121.885968][ T5702] em28xx 5-1:0.0: dvb set to bulk mode. [ 121.888342][ T5703] em28xx 5-1:0.0: Binding DVB extension [ 121.934928][ T5702] usb 5-1: USB disconnect, device number 6 [ 121.936246][ T5702] em28xx 5-1:0.0: Disconnecting em28xx [ 122.082150][ T5703] em28xx 5-1:0.0: Registering input extension [ 122.082788][ T5702] em28xx 5-1:0.0: Closing input extension [ 122.187970][ T5702] em28xx: Freeing device [ 122.224473][ T31] audit: type=1400 audit(1791436896.816:721): avc: denied { create } for pid=7182 comm="syz.0.404" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 122.324711][ T4928] Bluetooth: hci4: status 0xff [ 122.334964][ T5793] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 122.381443][ T31] audit: type=1400 audit(1791436896.976:722): avc: denied { setopt } for pid=7189 comm="syz.5.407" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 122.487103][ T5793] usb 2-1: New USB device found, idVendor=12ba, idProduct=0100, bcdDevice= 0.00 [ 122.488140][ T5793] usb 2-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 122.488171][ T5793] usb 2-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 122.488198][ T5793] usb 2-1: config 0 interface 0 has no altsetting 0 [ 122.488228][ T5793] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 122.492537][ T5793] usb 2-1: config 0 descriptor?? [ 122.967088][ T5793] input: HID 12ba:0100 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:12BA:0100.0003/input/input10 [ 123.107273][ T5793] sony 0003:12BA:0100.0003: input,hiddev1,hidraw1: USB HID v0.03 Device [HID 12ba:0100] on usb-dummy_hcd.1-1/input0 [ 123.352405][ T5766] usb 2-1: USB disconnect, device number 7 [ 123.540384][ T7243] fuse: fd is not a fuse device [ 123.825951][ T5702] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 123.849076][ T5702] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 124.004069][ T5793] usb 4-1: USB disconnect, device number 10 [ 124.062019][ T31] kauditd_printk_skb: 18 callbacks suppressed [ 124.062034][ T31] audit: type=1400 audit(1791436898.656:741): avc: denied { unmount } for pid=5617 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 124.115974][ T5703] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 124.335186][ T7277] netlink: 'syz.4.431': attribute type 1 has an invalid length. [ 124.361284][ T7278] FAULT_INJECTION: forcing a failure. [ 124.361284][ T7278] name failslab, interval 1, probability 0, space 0, times 0 [ 124.361318][ T7278] CPU: 1 UID: 0 PID: 7278 Comm: syz.5.432 Not tainted syzkaller #0 PREEMPT(full) [ 124.361343][ T7278] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 124.361357][ T7278] Call Trace: [ 124.361364][ T7278] [ 124.361373][ T7278] dump_stack_lvl+0x100/0x190 [ 124.361410][ T7278] should_fail_ex.cold+0x5/0xa [ 124.361440][ T7278] should_failslab+0xc2/0x120 [ 124.361469][ T7278] __kmalloc_noprof+0xfc/0x840 [ 124.361495][ T7278] ? nft_trans_alloc+0x1d/0x2d0 [ 124.361527][ T7278] nft_trans_alloc+0x1d/0x2d0 [ 124.361554][ T7278] nft_del_setelem+0xd47/0x1140 [ 124.361594][ T7278] ? __pfx_nft_del_setelem+0x10/0x10 [ 124.361626][ T7278] ? insert_tree+0x130/0xe50 [ 124.361690][ T7278] ? nla_strcmp+0xff/0x130 [ 124.361714][ T7278] ? nla_strcmp+0xff/0x130 [ 124.361737][ T7278] nf_tables_delsetelem+0x6ea/0xf50 [ 124.361780][ T7278] ? __pfx_nf_tables_delsetelem+0x10/0x10 [ 124.361811][ T7278] ? __pfx___nla_validate_parse+0x10/0x10 [ 124.361838][ T7278] ? lock_acquire+0x1d1/0x380 [ 124.361862][ T7278] ? net_generic+0x25/0x2a0 [ 124.361890][ T7278] ? __nla_parse+0x40/0x60 [ 124.361915][ T7278] nfnetlink_rcv_batch+0x1410/0x2880 [ 124.361955][ T7278] ? __pfx_nfnetlink_rcv_batch+0x10/0x10 [ 124.361982][ T7278] ? lock_acquire+0x1d1/0x380 [ 124.362005][ T7278] ? avc_has_perm_noaudit+0x56/0x470 [ 124.362038][ T7278] ? avc_has_perm_noaudit+0x145/0x470 [ 124.362092][ T7278] ? __nla_parse+0x40/0x60 [ 124.362119][ T7278] nfnetlink_rcv+0x3bd/0x440 [ 124.362140][ T7278] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 124.362170][ T7278] netlink_unicast+0x585/0x850 [ 124.362202][ T7278] ? __pfx_netlink_unicast+0x10/0x10 [ 124.362239][ T7278] netlink_sendmsg+0x8b0/0xda0 [ 124.362271][ T7278] ? __pfx_netlink_sendmsg+0x10/0x10 [ 124.362302][ T7278] ? selinux_socket_sendmsg+0x198/0x2f0 [ 124.362333][ T7278] ____sys_sendmsg+0xa4d/0xbe0 [ 124.362354][ T7278] ? __pfx_netlink_sendmsg+0x10/0x10 [ 124.362384][ T7278] ? __pfx_____sys_sendmsg+0x10/0x10 [ 124.362414][ T7278] ? plist_check_list+0x1b8/0x280 [ 124.362443][ T7278] ? plist_del+0x308/0x510 [ 124.362475][ T7278] ___sys_sendmsg+0x190/0x1e0 [ 124.362503][ T7278] ? __pfx____sys_sendmsg+0x10/0x10 [ 124.362528][ T7278] ? futex_wake+0x220/0x5e0 [ 124.362562][ T7278] ? find_held_lock+0x2b/0x80 [ 124.362612][ T7278] __sys_sendmsg+0x160/0x210 [ 124.362643][ T7278] ? __pfx___sys_sendmsg+0x10/0x10 [ 124.362690][ T7278] do_syscall_64+0x123/0x790 [ 124.362717][ T7278] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.362739][ T7278] RIP: 0033:0x7f312ef9e199 [ 124.362757][ T7278] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 124.362783][ T7278] RSP: 002b:00007f312fdd0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 124.362805][ T7278] RAX: ffffffffffffffda RBX: 00007f312f225fa0 RCX: 00007f312ef9e199 [ 124.362819][ T7278] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000004 [ 124.362829][ T7278] RBP: 00007f312f0358e0 R08: 0000000000000000 R09: 0000000000000000 [ 124.362839][ T7278] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 124.362850][ T7278] R13: 00007f312f226038 R14: 00007f312f225fa0 R15: 00007ffd624d6008 [ 124.362880][ T7278] [ 124.608196][ T7253] ceph: No mds server is up or the cluster is laggy [ 124.636232][ T5703] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 124.865883][ T31] audit: type=1400 audit(1791436899.456:742): avc: denied { sqpoll } for pid=7283 comm="syz.4.434" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 125.367510][ T31] audit: type=1400 audit(1791436899.966:743): avc: denied { mount } for pid=7288 comm="syz.5.435" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 125.904293][ T7306] FAULT_INJECTION: forcing a failure. [ 125.904293][ T7306] name failslab, interval 1, probability 0, space 0, times 0 [ 125.904331][ T7306] CPU: 1 UID: 0 PID: 7306 Comm: syz.1.440 Not tainted syzkaller #0 PREEMPT(full) [ 125.904358][ T7306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 125.904372][ T7306] Call Trace: [ 125.904379][ T7306] [ 125.904388][ T7306] dump_stack_lvl+0x100/0x190 [ 125.904427][ T7306] should_fail_ex.cold+0x5/0xa [ 125.904458][ T7306] should_failslab+0xc2/0x120 [ 125.904488][ T7306] __kmalloc_cache_noprof+0x91/0x6d0 [ 125.904512][ T7306] ? percpu_ref_init+0xec/0x3f0 [ 125.904537][ T7306] ? __pfx_no_op+0x10/0x10 [ 125.904566][ T7306] percpu_ref_init+0xec/0x3f0 [ 125.904591][ T7306] mddev_init+0xae/0x820 [ 125.904624][ T7306] md_alloc+0xc7/0x10a0 [ 125.904652][ T7306] md_alloc_and_put+0x16/0xb0 [ 125.904674][ T7306] add_named_array+0x27d/0x3a0 [ 125.904706][ T7306] ? __pfx_add_named_array+0x10/0x10 [ 125.904750][ T7306] param_attr_store+0x199/0x300 [ 125.904777][ T7306] ? __pfx_param_attr_store+0x10/0x10 [ 125.904799][ T7306] module_attr_store+0x58/0x80 [ 125.904815][ T7306] ? __pfx_module_attr_store+0x10/0x10 [ 125.904831][ T7306] sysfs_kf_write+0xf2/0x150 [ 125.904857][ T7306] kernfs_fop_write_iter+0x3e0/0x5f0 [ 125.904877][ T7306] ? __pfx_sysfs_kf_write+0x10/0x10 [ 125.904904][ T7306] vfs_write+0x6af/0x1050 [ 125.904928][ T7306] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 125.904955][ T7306] ? __pfx_vfs_write+0x10/0x10 [ 125.904976][ T7306] ? find_held_lock+0x2b/0x80 [ 125.905025][ T7306] ksys_write+0x12a/0x250 [ 125.905049][ T7306] ? __pfx_ksys_write+0x10/0x10 [ 125.905082][ T7306] do_syscall_64+0x123/0x790 [ 125.905109][ T7306] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.905141][ T7306] RIP: 0033:0x7f7ef199e199 [ 125.905160][ T7306] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 125.905179][ T7306] RSP: 002b:00007f7ef2790028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 125.905199][ T7306] RAX: ffffffffffffffda RBX: 00007f7ef1c25fa0 RCX: 00007f7ef199e199 [ 125.905214][ T7306] RDX: 0000000000000003 RSI: 0000200000000280 RDI: 0000000000000003 [ 125.905227][ T7306] RBP: 00007f7ef1a358e0 R08: 0000000000000000 R09: 0000000000000000 [ 125.905240][ T7306] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 125.905253][ T7306] R13: 00007f7ef1c26038 R14: 00007f7ef1c25fa0 R15: 00007ffdad0d4ad8 [ 125.905284][ T7306] [ 125.914774][ T7306] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 126.119535][ T31] audit: type=1400 audit(1791436900.706:744): avc: denied { name_bind } for pid=7310 comm="syz.3.442" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 126.452257][ T7326] netlink: 32 bytes leftover after parsing attributes in process `syz.3.448'. [ 126.495790][ T7329] netlink: 32 bytes leftover after parsing attributes in process `syz.4.447'. [ 126.649603][ T31] audit: type=1400 audit(1791436901.246:745): avc: denied { listen } for pid=7335 comm="syz.0.450" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 126.650639][ T31] audit: type=1400 audit(1791436901.246:746): avc: denied { write } for pid=7335 comm="syz.0.450" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 126.674956][ T31] audit: type=1400 audit(1791436901.256:747): avc: denied { accept } for pid=7335 comm="syz.0.450" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 126.747637][ T31] audit: type=1400 audit(1791436901.346:748): avc: denied { getopt } for pid=7340 comm="syz.5.455" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 126.762114][ T7344] netlink: 48 bytes leftover after parsing attributes in process `syz.1.456'. [ 126.815617][ T7341] kvm: Disabled LAPIC found during irq injection [ 126.834551][ T7348] netlink: 48 bytes leftover after parsing attributes in process `syz.1.456'. [ 126.867245][ T7344] bond2: peer notification delay (2365) is not a multiple of miimon (80), value rounded to 2320 ms [ 126.867595][ T7348] bond2: peer notification delay (2365) is not a multiple of miimon (80), value rounded to 2320 ms [ 126.875604][ T5703] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 127.045791][ T5703] usb 5-1: Using ep0 maxpacket: 32 [ 127.046572][ T5703] usb 5-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 127.047542][ T5703] usb 5-1: config index 0 descriptor too short (expected 29220, got 36) [ 127.047567][ T5703] usb 5-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 127.047588][ T5703] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 127.047630][ T5703] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 127.047652][ T5703] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 127.047676][ T5703] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 127.047712][ T5703] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 127.069687][ T5703] usb 5-1: config 0 descriptor?? [ 127.311321][ T7360] FAULT_INJECTION: forcing a failure. [ 127.311321][ T7360] name failslab, interval 1, probability 0, space 0, times 0 [ 127.311354][ T7360] CPU: 0 UID: 0 PID: 7360 Comm: syz.1.461 Not tainted syzkaller #0 PREEMPT(full) [ 127.311378][ T7360] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 127.311389][ T7360] Call Trace: [ 127.311396][ T7360] [ 127.311404][ T7360] dump_stack_lvl+0x100/0x190 [ 127.311439][ T7360] should_fail_ex.cold+0x5/0xa [ 127.311467][ T7360] should_failslab+0xc2/0x120 [ 127.311504][ T7360] __kmalloc_noprof+0xfc/0x840 [ 127.311530][ T7360] ? trace_kmalloc+0xeb/0x110 [ 127.311556][ T7360] ? lsm_blob_alloc+0x68/0x90 [ 127.311582][ T7360] lsm_blob_alloc+0x68/0x90 [ 127.311603][ T7360] security_sk_alloc+0x2d/0x290 [ 127.311628][ T7360] sk_prot_alloc+0x12a/0x2a0 [ 127.311655][ T7360] sk_alloc+0x36/0xe80 [ 127.311685][ T7360] __netlink_create+0x5e/0x2c0 [ 127.311707][ T7360] ? __wake_up+0x3f/0x60 [ 127.311728][ T7360] netlink_create+0x29b/0x610 [ 127.311753][ T7360] ? __pfx_rtnetlink_bind+0x10/0x10 [ 127.311786][ T7360] __sock_create+0x339/0x860 [ 127.311815][ T7360] __sys_socket+0x14d/0x260 [ 127.311838][ T7360] ? __pfx___sys_socket+0x10/0x10 [ 127.311869][ T7360] __x64_sys_socket+0x72/0xb0 [ 127.311890][ T7360] ? lockdep_hardirqs_on+0x7d/0x110 [ 127.311914][ T7360] do_syscall_64+0x123/0x790 [ 127.311938][ T7360] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.311958][ T7360] RIP: 0033:0x7f7ef199e199 [ 127.311974][ T7360] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 127.311995][ T7360] RSP: 002b:00007f7ef2790028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 127.312015][ T7360] RAX: ffffffffffffffda RBX: 00007f7ef1c25fa0 RCX: 00007f7ef199e199 [ 127.312030][ T7360] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000010 [ 127.312042][ T7360] RBP: 00007f7ef1a358e0 R08: 0000000000000000 R09: 0000000000000000 [ 127.312054][ T7360] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 127.312066][ T7360] R13: 00007f7ef1c26038 R14: 00007f7ef1c25fa0 R15: 00007ffdad0d4ad8 [ 127.312095][ T7360] [ 127.316798][ T5703] usblp 5-1:0.0: usblp0: USB Bidirectional printer dev 7 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 127.341808][ T5703] usb 5-1: USB disconnect, device number 7 [ 127.371382][ T5703] usblp0: removed [ 127.492142][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 [ 127.492195][ T1307] ieee802154 phy1 wpan1: encryption failed: -22 [ 127.914941][ T5703] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 127.965624][ T4941] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 128.065922][ T5703] usb 5-1: Using ep0 maxpacket: 32 [ 128.069170][ T5703] usb 5-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 128.070427][ T5703] usb 5-1: config index 0 descriptor too short (expected 29220, got 36) [ 128.070454][ T5703] usb 5-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 128.070475][ T5703] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 128.070516][ T5703] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 128.070537][ T5703] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 128.070585][ T5703] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 128.070624][ T5703] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 128.078506][ T5703] usb 5-1: config 0 descriptor?? [ 128.128225][ T4941] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 128.129229][ T4941] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 128.132651][ T4941] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 128.132694][ T4941] usb 4-1: Product: syz [ 128.132710][ T4941] usb 4-1: Manufacturer: syz [ 128.132724][ T4941] usb 4-1: SerialNumber: syz [ 128.355966][ T5703] usblp 5-1:0.0: usblp0: USB Bidirectional printer dev 8 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 128.699869][ T31] audit: type=1400 audit(1791436903.296:749): avc: denied { read write } for pid=7334 comm="syz.4.453" name="lp0" dev="devtmpfs" ino=2928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 128.700154][ T31] audit: type=1400 audit(1791436903.296:750): avc: denied { open } for pid=7334 comm="syz.4.453" path="/dev/usb/lp0" dev="devtmpfs" ino=2928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 128.973171][ T2259] usb 5-1: USB disconnect, device number 8 [ 128.984960][ T2259] usblp0: removed [ 129.223090][ T4941] cdc_ncm 4-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 129.223114][ T4941] cdc_ncm 4-1:1.0: dwNtbInMaxSize=16 is too small. Using 2048 [ 129.223127][ T4941] cdc_ncm 4-1:1.0: setting rx_max = 2048 [ 129.299844][ T31] kauditd_printk_skb: 6 callbacks suppressed [ 129.299862][ T31] audit: type=1326 audit(1791436903.896:757): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7417 comm="syz.5.484" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f312ef9e199 code=0x7ffc0000 [ 129.299980][ T31] audit: type=1326 audit(1791436903.896:758): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7417 comm="syz.5.484" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f312ef9e199 code=0x7ffc0000 [ 129.369513][ T31] audit: type=1326 audit(1791436903.946:759): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7417 comm="syz.5.484" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=131 compat=0 ip=0x7f312ef9e199 code=0x7ffc0000 [ 129.369562][ T31] audit: type=1326 audit(1791436903.946:760): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7417 comm="syz.5.484" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f312ef9e199 code=0x7ffc0000 [ 129.369604][ T31] audit: type=1326 audit(1791436903.946:761): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7417 comm="syz.5.484" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f312ef9e199 code=0x7ffc0000 [ 129.369644][ T31] audit: type=1326 audit(1791436903.946:762): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7417 comm="syz.5.484" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=186 compat=0 ip=0x7f312ef9e199 code=0x7ffc0000 [ 129.369682][ T31] audit: type=1326 audit(1791436903.946:763): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7417 comm="syz.5.484" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f312ef9e199 code=0x7ffc0000 [ 129.369737][ T31] audit: type=1326 audit(1791436903.946:764): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7417 comm="syz.5.484" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f312ef9e199 code=0x7ffc0000 [ 129.369778][ T31] audit: type=1326 audit(1791436903.946:765): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7417 comm="syz.5.484" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=222 compat=0 ip=0x7f312ef9e199 code=0x7ffc0000 [ 129.369820][ T31] audit: type=1326 audit(1791436903.946:766): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7417 comm="syz.5.484" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f312ef9e199 code=0x7ffc0000 [ 129.641926][ T4941] cdc_ncm 4-1:1.0: setting tx_max = 88 [ 129.757054][ T4941] cdc_ncm 4-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.3-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 129.772194][ T4941] usb 4-1: USB disconnect, device number 11 [ 129.777834][ T4941] cdc_ncm 4-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.3-1, CDC NCM (NO ZLP) [ 130.207048][ T862] input: syz0 as /devices/virtual/misc/uhid/0005:FFFD057E:0305.0004/input/input11 [ 130.258161][ T862] hid-generic 0005:FFFD057E:0305.0004: input,hidraw0: BLUETOOTH HID v0.03 Gamepad [syz0] on syz0 [ 130.362938][ C1] vcan0: j1939_tp_rxtimer: 0xffff888055ffa400: rx timeout, send abort [ 130.365227][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff888055ffa400: 0x3ff02: (3) A timeout occurred and this is the connection abort to close the session. [ 130.367726][ C1] vcan0: j1939_tp_rxtimer: 0xffff888055c54000: rx timeout, send abort [ 130.367936][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff888055c54000: 0x40000: (3) A timeout occurred and this is the connection abort to close the session. [ 130.454894][ T2259] usb 2-1: new full-speed USB device number 8 using dummy_hcd [ 130.630075][ T2259] usb 2-1: unable to get BOS descriptor or descriptor too short [ 130.630831][ T2259] usb 2-1: New USB device found, idVendor=0025, idProduct=0000, bcdDevice= 0.00 [ 130.630869][ T2259] usb 2-1: no configurations [ 130.630882][ T2259] usb 2-1: can't read configurations, error -22 [ 131.009050][ T7447] FAULT_INJECTION: forcing a failure. [ 131.009050][ T7447] name failslab, interval 1, probability 0, space 0, times 0 [ 131.009084][ T7447] CPU: 1 UID: 0 PID: 7447 Comm: syz.4.494 Not tainted syzkaller #0 PREEMPT(full) [ 131.009110][ T7447] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 131.009122][ T7447] Call Trace: [ 131.009130][ T7447] [ 131.009138][ T7447] dump_stack_lvl+0x100/0x190 [ 131.009175][ T7447] should_fail_ex.cold+0x5/0xa [ 131.009204][ T7447] should_failslab+0xc2/0x120 [ 131.009235][ T7447] __kmalloc_node_noprof+0xff/0x880 [ 131.009264][ T7447] ? crypto_create_tfm_node+0x8d/0x3b0 [ 131.009302][ T7447] crypto_create_tfm_node+0x8d/0x3b0 [ 131.009337][ T7447] crypto_alloc_tfm_node+0x102/0x260 [ 131.009362][ T7447] init_skcipher_req.constprop.0+0x1d/0x180 [ 131.009384][ T7447] derived_key_encrypt.constprop.0+0x10f/0x6b0 [ 131.009412][ T7447] ? __pfx_derived_key_encrypt.constprop.0+0x10/0x10 [ 131.009438][ T7447] ? kasan_quarantine_put+0x104/0x240 [ 131.009462][ T7447] ? lockdep_hardirqs_on+0x7d/0x110 [ 131.009495][ T7447] ? __kasan_check_byte+0x13/0x50 [ 131.009529][ T7447] ? get_derived_key+0x11b/0x140 [ 131.009569][ T7447] encrypted_read+0x389/0x850 [ 131.009599][ T7447] ? lock_acquire+0x1d1/0x380 [ 131.009625][ T7447] ? keyctl_read_key+0x227/0x510 [ 131.009649][ T7447] ? __pfx_encrypted_read+0x10/0x10 [ 131.009672][ T7447] ? __pfx___might_resched+0x10/0x10 [ 131.009700][ T7447] ? down_read+0x13b/0x4c0 [ 131.009725][ T7447] ? __pfx_down_read+0x10/0x10 [ 131.009749][ T7447] ? keyctl_read_key+0x2ac/0x510 [ 131.009769][ T7447] ? keyctl_read_key+0x2ac/0x510 [ 131.009790][ T7447] ? keyctl_read_key+0x427/0x510 [ 131.009817][ T7447] keyctl_read_key+0x29a/0x510 [ 131.009843][ T7447] __do_sys_keyctl+0x36d/0x5a0 [ 131.009867][ T7447] do_syscall_64+0x123/0x790 [ 131.009895][ T7447] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 131.009918][ T7447] RIP: 0033:0x7f7e4859e199 [ 131.009936][ T7447] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 131.009957][ T7447] RSP: 002b:00007f7e49416028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 131.009979][ T7447] RAX: ffffffffffffffda RBX: 00007f7e48825fa0 RCX: 00007f7e4859e199 [ 131.009993][ T7447] RDX: 0000200000000240 RSI: 0000000021ee6c5a RDI: 000000000000000b [ 131.010007][ T7447] RBP: 00007f7e486358e0 R08: 0000000000000000 R09: 0000000000000000 [ 131.010019][ T7447] R10: 00000000349b7f55 R11: 0000000000000246 R12: 0000000000000000 [ 131.010033][ T7447] R13: 00007f7e48826038 R14: 00007f7e48825fa0 R15: 00007fff99e1da08 [ 131.010063][ T7447] [ 131.013139][ T7447] trusted_key: encrypted_key: failed to load cbc(aes) transform (-12) [ 131.263771][ T7451] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 131.856574][ T5703] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 132.013327][ T5703] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 132.014264][ T5703] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 132.014311][ T5703] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 132.017162][ T5703] usb 6-1: config 0 descriptor?? [ 132.023233][ T5703] pwc: Askey VC010 type 2 USB webcam detected. [ 132.242578][ T5703] pwc: send_video_command error -71 [ 132.242595][ T5703] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 132.242684][ T5703] Philips webcam 6-1:0.0: probe with driver Philips webcam failed with error -71 [ 132.247795][ T5703] usb 6-1: USB disconnect, device number 2 [ 132.803217][ T5703] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 132.975838][ T5703] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 132.983704][ T5703] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 132.983754][ T5703] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 132.987165][ T5703] usb 6-1: config 0 descriptor?? [ 132.996294][ T5703] pwc: Askey VC010 type 2 USB webcam detected. [ 133.428945][ T5703] pwc: recv_control_msg error -32 req 02 val 2b00 [ 133.430026][ T5703] pwc: recv_control_msg error -32 req 02 val 2700 [ 133.430720][ T5703] pwc: recv_control_msg error -32 req 02 val 2c00 [ 133.633282][ T5703] pwc: recv_control_msg error -71 req 04 val 1300 [ 133.634713][ T5703] pwc: recv_control_msg error -71 req 04 val 1400 [ 133.636669][ T5703] pwc: recv_control_msg error -71 req 02 val 2000 [ 133.637061][ T5703] pwc: recv_control_msg error -71 req 02 val 2100 [ 133.637424][ T5703] pwc: recv_control_msg error -71 req 04 val 1500 [ 133.637956][ T5703] pwc: recv_control_msg error -71 req 02 val 2500 [ 133.638322][ T5703] pwc: recv_control_msg error -71 req 02 val 2400 [ 133.638677][ T5703] pwc: recv_control_msg error -71 req 02 val 2600 [ 133.639047][ T5703] pwc: recv_control_msg error -71 req 02 val 2900 [ 133.639396][ T5703] pwc: recv_control_msg error -71 req 02 val 2800 [ 133.639998][ T5703] pwc: recv_control_msg error -71 req 04 val 1100 [ 133.640375][ T5703] pwc: recv_control_msg error -71 req 04 val 1200 [ 133.689864][ T5703] pwc: Registered as video103. [ 133.719883][ T5703] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input12 [ 133.756934][ T5703] usb 6-1: USB disconnect, device number 3 [ 133.844739][ T7519] FAULT_INJECTION: forcing a failure. [ 133.844739][ T7519] name failslab, interval 1, probability 0, space 0, times 0 [ 133.844770][ T7519] CPU: 0 UID: 0 PID: 7519 Comm: syz.4.510 Not tainted syzkaller #0 PREEMPT(full) [ 133.844795][ T7519] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 133.844808][ T7519] Call Trace: [ 133.844816][ T7519] [ 133.844827][ T7519] dump_stack_lvl+0x100/0x190 [ 133.844875][ T7519] should_fail_ex.cold+0x5/0xa [ 133.844919][ T7519] should_failslab+0xc2/0x120 [ 133.844962][ T7519] __kmalloc_cache_noprof+0x91/0x6d0 [ 133.844988][ T7519] ? kasan_save_track+0x14/0x30 [ 133.845027][ T7519] ? ovl_init_fs_context+0x96/0x630 [ 133.845071][ T7519] ovl_init_fs_context+0x96/0x630 [ 133.845114][ T7519] alloc_fs_context+0x60c/0xf40 [ 133.845151][ T7519] path_mount+0xdbd/0x24c0 [ 133.845185][ T7519] ? __pfx_path_mount+0x10/0x10 [ 133.845212][ T7519] ? lockdep_hardirqs_on+0x7d/0x110 [ 133.845245][ T7519] ? putname+0xb1/0x110 [ 133.845292][ T7519] ? kmem_cache_free+0x127/0x6c0 [ 133.845334][ T7519] ? __x64_sys_mount+0x293/0x310 [ 133.845364][ T7519] __x64_sys_mount+0x293/0x310 [ 133.845396][ T7519] ? __pfx___x64_sys_mount+0x10/0x10 [ 133.845435][ T7519] do_syscall_64+0x123/0x790 [ 133.845472][ T7519] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 133.845503][ T7519] RIP: 0033:0x7f7e4859e199 [ 133.845524][ T7519] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 133.845548][ T7519] RSP: 002b:00007f7e49416028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 133.845575][ T7519] RAX: ffffffffffffffda RBX: 00007f7e48825fa0 RCX: 00007f7e4859e199 [ 133.845596][ T7519] RDX: 0000200000000180 RSI: 0000200000000140 RDI: 0000000000000000 [ 133.845614][ T7519] RBP: 00007f7e486358e0 R08: 0000000000000000 R09: 0000000000000000 [ 133.845632][ T7519] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 133.845650][ T7519] R13: 00007f7e48826038 R14: 00007f7e48825fa0 R15: 00007fff99e1da08 [ 133.845686][ T7519] [ 134.325027][ T862] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 134.397737][ T31] kauditd_printk_skb: 2716 callbacks suppressed [ 134.397756][ T31] audit: type=1400 audit(1791436908.996:3483): avc: denied { listen } for pid=7531 comm="syz.4.514" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 134.403344][ T31] audit: type=1400 audit(1791436908.996:3484): avc: denied { read } for pid=7531 comm="syz.4.514" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 134.458842][ T31] audit: type=1400 audit(1791436909.056:3485): avc: denied { setopt } for pid=7534 comm="syz.0.515" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 134.485535][ T31] audit: type=1400 audit(1791436909.086:3486): avc: denied { write } for pid=7506 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 134.513831][ T862] usb 2-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 134.525943][ T862] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 134.525988][ T862] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 134.526010][ T862] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 134.526034][ T862] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 134.526072][ T862] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 134.598716][ T5703] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 134.742351][ T31] audit: type=1400 audit(1791436909.336:3487): avc: denied { write } for pid=7541 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 134.761348][ T5703] usb 6-1: New USB device found, idVendor=0711, idProduct=0210, bcdDevice= 1.02 [ 134.763834][ T5703] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 134.763876][ T5703] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 134.771948][ T7525] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 134.799832][ T5703] mct_u232 6-1:1.0: MCT U232 converter detected [ 134.826322][ T5703] usb 6-1: MCT U232 converter now attached to ttyUSB0 [ 134.842742][ T7545] netlink: 'syz.4.518': attribute type 12 has an invalid length. [ 134.854551][ T31] audit: type=1400 audit(1791436909.446:3488): avc: denied { connect } for pid=7544 comm="syz.4.518" lport=256 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 134.876250][ T31] audit: type=1400 audit(1791436909.476:3489): avc: denied { write } for pid=7544 comm="syz.4.518" laddr=172.20.20.170 lport=256 faddr=172.20.20.170 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 135.527958][ T31] audit: type=1400 audit(1791436910.126:3490): avc: denied { read } for pid=7559 comm="syz.3.523" name="binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 135.529767][ T31] audit: type=1400 audit(1791436910.126:3491): avc: denied { open } for pid=7559 comm="syz.3.523" path="/dev/binderfs/binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 135.634055][ T5703] usb 6-1: USB disconnect, device number 4 [ 135.723764][ T5703] mct_u232 ttyUSB0: MCT U232 converter now disconnected from ttyUSB0 [ 135.724382][ T5703] mct_u232 6-1:1.0: device disconnected [ 135.752936][ T862] [drm] Initialized gud 1.0.0 for 2-1:1.0 on minor 1 [ 135.910712][ T7569] FAULT_INJECTION: forcing a failure. [ 135.910712][ T7569] name failslab, interval 1, probability 0, space 0, times 0 [ 135.910748][ T7569] CPU: 1 UID: 0 PID: 7569 Comm: syz.3.525 Not tainted syzkaller #0 PREEMPT(full) [ 135.910771][ T7569] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 135.910783][ T7569] Call Trace: [ 135.910788][ T7569] [ 135.910796][ T7569] dump_stack_lvl+0x100/0x190 [ 135.910833][ T7569] should_fail_ex.cold+0x5/0xa [ 135.910865][ T7569] should_failslab+0xc2/0x120 [ 135.910893][ T7569] kmem_cache_alloc_noprof+0x92/0x6a0 [ 135.910918][ T7569] ? radix_tree_node_alloc.constprop.0+0x81/0x360 [ 135.910958][ T7569] radix_tree_node_alloc.constprop.0+0x81/0x360 [ 135.910995][ T7569] idr_get_free+0x52e/0xa00 [ 135.911026][ T7569] idr_alloc_u32+0x1ac/0x320 [ 135.911048][ T7569] ? __pfx_idr_alloc_u32+0x10/0x10 [ 135.911071][ T7569] ? tcf_idr_check_alloc+0x598/0x7a0 [ 135.911096][ T7569] ? tcf_idr_check_alloc+0x598/0x7a0 [ 135.911125][ T7569] tcf_idr_check_alloc+0x136/0x7a0 [ 135.911160][ T7569] ? find_held_lock+0x2b/0x80 [ 135.911193][ T7569] ? __pfx_tcf_idr_check_alloc+0x10/0x10 [ 135.911223][ T7569] ? __nla_parse+0x40/0x60 [ 135.911249][ T7569] tcf_gact_init+0x396/0x8a0 [ 135.911277][ T7569] ? __pfx_tcf_gact_init+0x10/0x10 [ 135.911302][ T7569] ? kasan_save_track+0x14/0x30 [ 135.911334][ T7569] ? tcf_action_init_1+0x2d8/0x6c0 [ 135.911364][ T7569] ? __asan_memcpy+0x3c/0x60 [ 135.911387][ T7569] tcf_action_init_1+0x466/0x6c0 [ 135.911416][ T7569] ? __pfx_tcf_action_init_1+0x10/0x10 [ 135.911442][ T7569] ? tc_action_load_ops+0x1f5/0x3e0 [ 135.911485][ T7569] ? __nla_parse+0x40/0x60 [ 135.911510][ T7569] tcf_action_init+0x43f/0xa60 [ 135.911560][ T7569] ? __pfx_tcf_action_init+0x10/0x10 [ 135.911624][ T7569] ? __kernel_text_address+0xd/0x30 [ 135.911646][ T7569] ? unwind_get_return_address+0x59/0xa0 [ 135.911678][ T7569] ? arch_stack_walk+0xa6/0xf0 [ 135.911727][ T7569] ? __lock_acquire+0x5c0/0x1f40 [ 135.911759][ T7569] tcf_action_add+0xed/0x5c0 [ 135.911807][ T7569] ? __pfx_tcf_action_add+0x10/0x10 [ 135.911897][ T7569] ? __nla_parse+0x40/0x60 [ 135.911931][ T7569] tc_ctl_action+0x2e3/0x470 [ 135.911979][ T7569] ? __pfx_tc_ctl_action+0x10/0x10 [ 135.912034][ T7569] ? __pfx_tc_ctl_action+0x10/0x10 [ 135.912070][ T7569] rtnetlink_rcv_msg+0x3c9/0xe90 [ 135.912091][ T7569] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 135.912117][ T7569] ? ref_tracker_free+0x37e/0x6c0 [ 135.912162][ T7569] netlink_rcv_skb+0x159/0x420 [ 135.912200][ T7569] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 135.912228][ T7569] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 135.912274][ T7569] ? netlink_deliver_tap+0x1ae/0xcc0 [ 135.912310][ T7569] netlink_unicast+0x585/0x850 [ 135.912343][ T7569] ? __pfx_netlink_unicast+0x10/0x10 [ 135.912380][ T7569] netlink_sendmsg+0x8b0/0xda0 [ 135.912410][ T7569] ? __pfx_netlink_sendmsg+0x10/0x10 [ 135.912452][ T7569] ? selinux_socket_sendmsg+0x198/0x2f0 [ 135.912496][ T7569] ____sys_sendmsg+0xa4d/0xbe0 [ 135.912526][ T7569] ? __pfx_netlink_sendmsg+0x10/0x10 [ 135.912570][ T7569] ? __pfx_____sys_sendmsg+0x10/0x10 [ 135.912618][ T7569] ___sys_sendmsg+0x190/0x1e0 [ 135.912656][ T7569] ? __pfx____sys_sendmsg+0x10/0x10 [ 135.912688][ T7569] ? futex_wait+0x11e/0x370 [ 135.912723][ T7569] ? find_held_lock+0x2b/0x80 [ 135.912768][ T7569] __sys_sendmsg+0x160/0x210 [ 135.912813][ T7569] ? __pfx___sys_sendmsg+0x10/0x10 [ 135.912876][ T7569] do_syscall_64+0x123/0x790 [ 135.912914][ T7569] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.912945][ T7569] RIP: 0033:0x7ffbf879e199 [ 135.912969][ T7569] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 135.913000][ T7569] RSP: 002b:00007ffbf9697028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 135.913027][ T7569] RAX: ffffffffffffffda RBX: 00007ffbf8a25fa0 RCX: 00007ffbf879e199 [ 135.913045][ T7569] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000005 [ 135.913059][ T7569] RBP: 00007ffbf88358e0 R08: 0000000000000000 R09: 0000000000000000 [ 135.913078][ T7569] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 135.913095][ T7569] R13: 00007ffbf8a26038 R14: 00007ffbf8a25fa0 R15: 00007ffcc3b291f8 [ 135.913132][ T7569] [ 136.347729][ T862] gud 2-1:1.0: [drm] Cannot find any crtc or sizes [ 136.353938][ T862] usb 2-1: USB disconnect, device number 10 [ 136.467694][ T31] audit: type=1400 audit(1791436911.066:3492): avc: denied { mount } for pid=7577 comm="syz.4.528" name="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 136.469576][ T7578] grow_buffers: requested out-of-range block 18446744073709551615 for device sda1 [ 136.469609][ T7578] EXT4-fs warning (device sda1): ext4_resize_fs:2018: can't read last block, resize aborted [ 136.508619][ T7571] FAULT_INJECTION: forcing a failure. [ 136.508619][ T7571] name failslab, interval 1, probability 0, space 0, times 0 [ 136.508654][ T7571] CPU: 1 UID: 0 PID: 7571 Comm: syz.3.526 Not tainted syzkaller #0 PREEMPT(full) [ 136.508678][ T7571] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 136.508691][ T7571] Call Trace: [ 136.508699][ T7571] [ 136.508707][ T7571] dump_stack_lvl+0x100/0x190 [ 136.508741][ T7571] should_fail_ex.cold+0x5/0xa [ 136.508772][ T7571] should_failslab+0xc2/0x120 [ 136.508800][ T7571] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 136.508827][ T7571] ? __kasan_kmalloc+0xaa/0xb0 [ 136.508854][ T7571] ? __request_module+0x2d5/0x6a0 [ 136.508886][ T7571] kstrdup+0x51/0xe0 [ 136.508908][ T7571] __request_module+0x2d5/0x6a0 [ 136.508936][ T7571] ? __pfx___request_module+0x10/0x10 [ 136.508966][ T7571] ? rcu_is_watching+0x13/0xc0 [ 136.509016][ T7571] ? crypto_alg_lookup+0x10c/0x1e0 [ 136.509049][ T7571] ? crypto_alg_lookup+0x10c/0x1e0 [ 136.509096][ T7571] crypto_alg_mod_lookup+0x413/0x5d0 [ 136.509117][ T7571] ? do_syscall_64+0x123/0x790 [ 136.509144][ T7571] crypto_alloc_tfm_node+0xd3/0x260 [ 136.509169][ T7571] esp_init_authenc.constprop.0+0x1df/0xb50 [ 136.509207][ T7571] ? __pfx_esp_init_authenc.constprop.0+0x10/0x10 [ 136.509253][ T7571] ? find_held_lock+0x2b/0x80 [ 136.509287][ T7571] esp6_init_state+0x3a6/0x500 [ 136.509318][ T7571] __xfrm_init_state+0x842/0x1dc0 [ 136.509345][ T7571] xfrm_init_state+0x1c/0xa0 [ 136.509365][ T7571] pfkey_add+0x1c88/0x2f10 [ 136.509394][ T7571] ? __pfx_pfkey_add+0x10/0x10 [ 136.509411][ T7571] ? kfree_skbmem+0x19f/0x210 [ 136.509434][ T7571] ? sk_skb_reason_drop+0x114/0x1b0 [ 136.509466][ T7571] ? pfkey_broadcast+0x28c/0x420 [ 136.509487][ T7571] ? __pfx_pfkey_add+0x10/0x10 [ 136.509507][ T7571] pfkey_process+0x5c3/0x810 [ 136.509531][ T7571] ? __pfx_pfkey_process+0x10/0x10 [ 136.509551][ T7571] ? pfkey_sendmsg+0x41a/0x840 [ 136.509590][ T7571] ? __pfx___alloc_skb+0x10/0x10 [ 136.509625][ T7571] pfkey_sendmsg+0x428/0x840 [ 136.509651][ T7571] ____sys_sendmsg+0xa4d/0xbe0 [ 136.509671][ T7571] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 136.509694][ T7571] ? __pfx_____sys_sendmsg+0x10/0x10 [ 136.509730][ T7571] ___sys_sendmsg+0x190/0x1e0 [ 136.509754][ T7571] ? __pfx____sys_sendmsg+0x10/0x10 [ 136.509778][ T7571] ? futex_wait+0x11e/0x370 [ 136.509811][ T7571] ? find_held_lock+0x2b/0x80 [ 136.509858][ T7571] __sys_sendmsg+0x160/0x210 [ 136.509886][ T7571] ? __pfx___sys_sendmsg+0x10/0x10 [ 136.509930][ T7571] do_syscall_64+0x123/0x790 [ 136.509955][ T7571] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.509975][ T7571] RIP: 0033:0x7ffbf879e199 [ 136.509993][ T7571] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 136.510011][ T7571] RSP: 002b:00007ffbf9697028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 136.510031][ T7571] RAX: ffffffffffffffda RBX: 00007ffbf8a25fa0 RCX: 00007ffbf879e199 [ 136.510044][ T7571] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004 [ 136.510057][ T7571] RBP: 00007ffbf88358e0 R08: 0000000000000000 R09: 0000000000000000 [ 136.510069][ T7571] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 136.510087][ T7571] R13: 00007ffbf8a26038 R14: 00007ffbf8a25fa0 R15: 00007ffcc3b291f8 [ 136.510117][ T7571] [ 136.864956][ T7515] IPVS: starting estimator thread 0... [ 136.908266][ T7590] netlink: 24 bytes leftover after parsing attributes in process `syz.4.532'. [ 136.955093][ T7587] IPVS: using max 48 ests per chain, 115200 per kthread [ 137.279812][ T7608] netlink: 'syz.3.538': attribute type 1 has an invalid length. [ 137.327158][ T7608] 8021q: adding VLAN 0 to HW filter on device bond2 [ 137.467362][ T7608] 8021q: adding VLAN 0 to HW filter on device bond2 [ 137.473440][ T7608] bond2: (slave wireguard0): The slave device specified does not support setting the MAC address [ 137.474267][ T7608] bond2: (slave wireguard0): Error -95 calling set_mac_address [ 137.579243][ T7612] mac80211_hwsim hwsim7 wlan1: entered promiscuous mode [ 137.581184][ T7612] bond2: (slave wlan1): dev_set_mac_address on slave failed! ALB mode requires that the base driver support setting the hw address also when the network device's interface is open [ 140.791587][ T7687] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 140.836265][ T7687] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 141.028552][ T7688] erspan0: entered promiscuous mode [ 141.029632][ T7688] netlink: 8 bytes leftover after parsing attributes in process `syz.0.564'. [ 141.088399][ T31] kauditd_printk_skb: 7 callbacks suppressed [ 141.088414][ T31] audit: type=1400 audit(1791436915.686:3500): avc: denied { bind } for pid=7693 comm="syz.3.566" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 141.200873][ T59] bond1: (slave erspan0): link status definitely down, disabling slave [ 141.201352][ T59] bond1: now running without any active interface! [ 141.231192][ T7694] ip_tables: iptables: counters copy to user failed while replacing table [ 141.259490][ T7694] netlink: 76 bytes leftover after parsing attributes in process `syz.3.566'. [ 141.771386][ T4928] Bluetooth: hci1: unexpected event for opcode 0x0c03 [ 141.771486][ T4928] Bluetooth: hci1: unexpected event for opcode 0x1003 [ 141.771561][ T4928] Bluetooth: hci1: unexpected cc 0x1001 length: 10 > 9 [ 141.771581][ T4928] Bluetooth: hci1: unexpected event for opcode 0x1001 [ 142.271874][ T31] audit: type=1400 audit(1791436916.866:3501): avc: denied { create } for pid=7719 comm="syz.3.575" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 142.301780][ T31] audit: type=1400 audit(1791436916.896:3502): avc: denied { write } for pid=7719 comm="syz.3.575" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 142.366090][ T7720] FAULT_INJECTION: forcing a failure. [ 142.366090][ T7720] name failslab, interval 1, probability 0, space 0, times 0 [ 142.366127][ T7720] CPU: 0 UID: 0 PID: 7720 Comm: syz.3.575 Not tainted syzkaller #0 PREEMPT(full) [ 142.366154][ T7720] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 142.366167][ T7720] Call Trace: [ 142.366174][ T7720] [ 142.366183][ T7720] dump_stack_lvl+0x100/0x190 [ 142.366219][ T7720] should_fail_ex.cold+0x5/0xa [ 142.366249][ T7720] should_failslab+0xc2/0x120 [ 142.366278][ T7720] kmem_cache_alloc_noprof+0x92/0x6a0 [ 142.366304][ T7720] ? sk_prot_alloc+0x60/0x2a0 [ 142.366332][ T7720] sk_prot_alloc+0x60/0x2a0 [ 142.366355][ T7720] sk_alloc+0x36/0xe80 [ 142.366384][ T7720] inet6_create+0x385/0x12b0 [ 142.366414][ T7720] ? inet6_create+0x7f/0x12b0 [ 142.366442][ T7720] __sock_create+0x339/0x860 [ 142.366471][ T7720] udp_sock_create6+0xc7/0x6a0 [ 142.366523][ T7720] ? __pfx_udp_sock_create6+0x10/0x10 [ 142.366564][ T7720] rxe_setup_udp_tunnel.constprop.0+0x1e6/0x7e0 [ 142.366588][ T7720] ? __pfx_rxe_setup_udp_tunnel.constprop.0+0x10/0x10 [ 142.366619][ T7720] ? lock_acquire+0x1d1/0x380 [ 142.366642][ T7720] ? rxe_ns_pernet_sk6+0x36/0x270 [ 142.366667][ T7720] ? rxe_ns_pernet_sk6+0xd0/0x270 [ 142.366697][ T7720] rxe_net_init+0x1c2/0x2a0 [ 142.366719][ T7720] rxe_newlink+0x6d/0x160 [ 142.366747][ T7720] nldev_newlink+0x3b0/0x630 [ 142.366773][ T7720] ? __pfx_nldev_newlink+0x10/0x10 [ 142.366878][ T7720] ? cred_has_capability.isra.0+0x186/0x300 [ 142.366908][ T7720] ? __pfx_cred_has_capability.isra.0+0x10/0x10 [ 142.366934][ T7720] ? lock_acquire+0x1d1/0x380 [ 142.366967][ T7720] ? cap_capable+0x107/0x430 [ 142.366992][ T7720] ? security_capable+0x80/0x260 [ 142.367016][ T7720] ? ns_capable+0xd2/0xf0 [ 142.367036][ T7720] ? __pfx_nldev_newlink+0x10/0x10 [ 142.367062][ T7720] rdma_nl_rcv_msg+0x392/0x6f0 [ 142.367090][ T7720] ? __pfx_rdma_nl_rcv_msg+0x10/0x10 [ 142.367119][ T7720] ? __lock_acquire+0x5c0/0x1f40 [ 142.367143][ T7720] ? __netlink_lookup+0xa9/0x900 [ 142.367173][ T7720] rdma_nl_rcv_skb.constprop.0.isra.0+0x2cb/0x410 [ 142.367204][ T7720] ? __pfx_rdma_nl_rcv_skb.constprop.0.isra.0+0x10/0x10 [ 142.367242][ T7720] ? netlink_deliver_tap+0x1ae/0xcc0 [ 142.367274][ T7720] netlink_unicast+0x585/0x850 [ 142.367306][ T7720] ? __pfx_netlink_unicast+0x10/0x10 [ 142.367341][ T7720] netlink_sendmsg+0x8b0/0xda0 [ 142.367372][ T7720] ? __pfx_netlink_sendmsg+0x10/0x10 [ 142.367402][ T7720] ? selinux_socket_sendmsg+0x198/0x2f0 [ 142.367436][ T7720] ____sys_sendmsg+0xa4d/0xbe0 [ 142.367457][ T7720] ? __pfx_netlink_sendmsg+0x10/0x10 [ 142.367497][ T7720] ? __pfx_____sys_sendmsg+0x10/0x10 [ 142.367538][ T7720] ___sys_sendmsg+0x190/0x1e0 [ 142.367565][ T7720] ? __pfx____sys_sendmsg+0x10/0x10 [ 142.367591][ T7720] ? futex_wait+0x11e/0x370 [ 142.367626][ T7720] ? find_held_lock+0x2b/0x80 [ 142.367675][ T7720] __sys_sendmsg+0x160/0x210 [ 142.367705][ T7720] ? __pfx___sys_sendmsg+0x10/0x10 [ 142.367751][ T7720] do_syscall_64+0x123/0x790 [ 142.367778][ T7720] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 142.367799][ T7720] RIP: 0033:0x7ffbf879e199 [ 142.367817][ T7720] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 142.367837][ T7720] RSP: 002b:00007ffbf9697028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 142.367856][ T7720] RAX: ffffffffffffffda RBX: 00007ffbf8a25fa0 RCX: 00007ffbf879e199 [ 142.367870][ T7720] RDX: 0000000020000800 RSI: 00002000000000c0 RDI: 0000000000000004 [ 142.367882][ T7720] RBP: 00007ffbf88358e0 R08: 0000000000000000 R09: 0000000000000000 [ 142.367895][ T7720] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 142.367906][ T7720] R13: 00007ffbf8a26038 R14: 00007ffbf8a25fa0 R15: 00007ffcc3b291f8 [ 142.367934][ T7720] [ 142.536534][ T7720] rdma_rxe: Failed to create IPv6 UDP tunnel [ 142.961958][ T7733] xt_hashlimit: size too large, truncated to 1048576 [ 143.115539][ T7716] netlink: 'syz.0.573': attribute type 4 has an invalid length. [ 143.532543][ T7749] netlink: 'syz.5.584': attribute type 10 has an invalid length. [ 143.538507][ T7747] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 143.547973][ T7747] batman_adv: batadv0: Adding interface: gretap1 [ 143.547991][ T7747] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 143.548021][ T7747] batman_adv: batadv0: Interface activated: gretap1 [ 143.559472][ T7749] syz_tun: entered promiscuous mode [ 143.574587][ T7749] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 143.641843][ T7733] xt_hashlimit: size too large, truncated to 1048576 [ 143.737427][ T7749] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 143.737470][ T7749] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 143.737515][ T7749] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 143.787694][ T7749] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 143.821828][ T7754] fuse: fd is not a fuse device [ 143.849743][ T7749] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 143.959737][ T7707] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 144.212789][ T31] audit: type=1400 audit(1791436918.806:3503): avc: denied { ioctl } for pid=7760 comm="syz.3.589" path="socket:[19201]" dev="sockfs" ino=19201 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 144.424850][ T31] audit: type=1400 audit(1791436919.016:3504): avc: denied { ioctl } for pid=7765 comm="syz.3.591" path="/dev/vhost-vsock" dev="devtmpfs" ino=1272 ioctlcmd=0xaf07 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 144.600276][ T7769] netlink: 'syz.3.593': attribute type 4 has an invalid length. [ 144.600753][ T7769] netlink: 'syz.3.593': attribute type 4 has an invalid length. [ 144.653032][ T7771] FAULT_INJECTION: forcing a failure. [ 144.653032][ T7771] name failslab, interval 1, probability 0, space 0, times 0 [ 144.653069][ T7771] CPU: 1 UID: 0 PID: 7771 Comm: syz.1.592 Not tainted syzkaller #0 PREEMPT(full) [ 144.653095][ T7771] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 144.653107][ T7771] Call Trace: [ 144.653114][ T7771] [ 144.653121][ T7771] dump_stack_lvl+0x100/0x190 [ 144.653154][ T7771] should_fail_ex.cold+0x5/0xa [ 144.653181][ T7771] should_failslab+0xc2/0x120 [ 144.653204][ T7771] __kmalloc_cache_noprof+0x91/0x6d0 [ 144.653224][ T7771] ? vcs_write+0x143/0xda0 [ 144.653246][ T7771] vcs_write+0x143/0xda0 [ 144.653264][ T7771] ? find_held_lock+0x2b/0x80 [ 144.653297][ T7771] ? avc_policy_seqno+0x9/0x20 [ 144.653314][ T7771] ? __pfx_vcs_write+0x10/0x10 [ 144.653333][ T7771] ? bpf_lsm_file_permission+0x9/0x10 [ 144.653356][ T7771] ? security_file_permission+0x76/0x210 [ 144.653379][ T7771] ? rw_verify_area+0xce/0x6d0 [ 144.653398][ T7771] vfs_write+0x2aa/0x1050 [ 144.653417][ T7771] ? __pfx_vcs_write+0x10/0x10 [ 144.653434][ T7771] ? lock_acquire+0x1d1/0x380 [ 144.653451][ T7771] ? __fget_files+0x34/0x3d0 [ 144.653472][ T7771] ? __pfx_vfs_write+0x10/0x10 [ 144.653489][ T7771] ? find_held_lock+0x2b/0x80 [ 144.653512][ T7771] ? __fget_files+0x215/0x3d0 [ 144.653532][ T7771] ? __fget_files+0x215/0x3d0 [ 144.653557][ T7771] ? __fget_files+0x21f/0x3d0 [ 144.653585][ T7771] ksys_write+0x12a/0x250 [ 144.653604][ T7771] ? __pfx_ksys_write+0x10/0x10 [ 144.653629][ T7771] do_syscall_64+0x123/0x790 [ 144.653658][ T7771] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 144.653677][ T7771] RIP: 0033:0x7f7ef199e199 [ 144.653692][ T7771] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 144.653710][ T7771] RSP: 002b:00007f7ef2790028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 144.653727][ T7771] RAX: ffffffffffffffda RBX: 00007f7ef1c25fa0 RCX: 00007f7ef199e199 [ 144.653738][ T7771] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 144.653748][ T7771] RBP: 00007f7ef1a358e0 R08: 0000000000000000 R09: 0000000000000000 [ 144.653758][ T7771] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 144.653768][ T7771] R13: 00007f7ef1c26038 R14: 00007f7ef1c25fa0 R15: 00007ffdad0d4ad8 [ 144.653793][ T7771] [ 144.829010][ T7769] bridge0: port 2(bridge_slave_1) entered disabled state [ 144.830069][ T7769] bridge0: port 1(bridge_slave_0) entered disabled state [ 145.002181][ T7769] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 145.017993][ T7769] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 145.410599][ T7782] r8a66597_udc pcspkr: error -EINVAL: invalid resource (null) [ 145.410641][ T7782] r8a66597_udc pcspkr: probe with driver r8a66597_udc failed with error -22 [ 145.526825][ T7514] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 145.529150][ T1260] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 145.529204][ T1260] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 145.529237][ T1260] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 145.779668][ T7797] netlink: 44 bytes leftover after parsing attributes in process `syz.4.600'. [ 146.121711][ T31] audit: type=1400 audit(1791436920.716:3505): avc: denied { getopt } for pid=7801 comm="syz.0.603" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 146.123056][ T7802] lo speed is unknown, defaulting to 1000 [ 146.123117][ T7802] lo speed is unknown, defaulting to 1000 [ 146.128710][ T7802] lo speed is unknown, defaulting to 1000 [ 146.132160][ T7802] smbdirect: ib_dev[syz_device_name_32_chars_1234567]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 146.132201][ T7802] smbdirect: ib_dev[syz_device_name_32_chars_1234567]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 146.132248][ T7802] smbdirect: ib_dev[syz_device_name_32_chars_1234567]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 146.140809][ T7802] infiniband syz_device_name_32_chars_1234567: RDMA CMA: cma_listen_on_dev, error -22 [ 146.319075][ T7802] lo speed is unknown, defaulting to 1000 [ 146.320623][ T7802] lo speed is unknown, defaulting to 1000 [ 146.322147][ T7802] lo speed is unknown, defaulting to 1000 [ 146.323607][ T7802] lo speed is unknown, defaulting to 1000 [ 146.349535][ T7802] lo speed is unknown, defaulting to 1000 [ 146.406358][ T7804] netlink: 24 bytes leftover after parsing attributes in process `syz.3.604'. [ 146.636089][ T31] audit: type=1400 audit(1791436921.236:3506): avc: denied { name_bind } for pid=7814 comm="syz.5.609" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 146.643311][ T31] audit: type=1400 audit(1791436921.236:3507): avc: denied { setopt } for pid=7812 comm="syz.1.607" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 146.665782][ T7819] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 147.095186][ T31] audit: type=1400 audit(1791436921.686:3508): avc: denied { associate } for pid=7832 comm="syz.1.614" name="core" scontext=root:object_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 147.095447][ T31] audit: type=1400 audit(1791436921.696:3509): avc: denied { ioctl } for pid=7833 comm="syz.3.616" path="socket:[19278]" dev="sockfs" ino=19278 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 147.120664][ T7834] netlink: 4 bytes leftover after parsing attributes in process `syz.3.616'. [ 147.128137][ T7834] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 147.203077][ T7839] FAULT_INJECTION: forcing a failure. [ 147.203077][ T7839] name failslab, interval 1, probability 0, space 0, times 0 [ 147.203111][ T7839] CPU: 0 UID: 0 PID: 7839 Comm: syz.1.618 Not tainted syzkaller #0 PREEMPT(full) [ 147.203136][ T7839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 147.203149][ T7839] Call Trace: [ 147.203157][ T7839] [ 147.203166][ T7839] dump_stack_lvl+0x100/0x190 [ 147.203204][ T7839] should_fail_ex.cold+0x5/0xa [ 147.203232][ T7839] should_failslab+0xc2/0x120 [ 147.203263][ T7839] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 147.203289][ T7839] ? __alloc_skb+0x5b7/0x710 [ 147.203316][ T7839] ? __alloc_skb+0x140/0x710 [ 147.203351][ T7839] __alloc_skb+0x140/0x710 [ 147.203376][ T7839] ? __alloc_skb+0x5b7/0x710 [ 147.203400][ T7839] ? __pfx___alloc_skb+0x10/0x10 [ 147.203436][ T7839] netlink_ack+0x117/0xb80 [ 147.203463][ T7839] ? nfnetlink_rcv_batch+0x1e00/0x2880 [ 147.203484][ T7839] ? nfnetlink_rcv_batch+0x1e0e/0x2880 [ 147.203513][ T7839] nfnetlink_rcv_batch+0x1d52/0x2880 [ 147.203552][ T7839] ? __pfx_nfnetlink_rcv_batch+0x10/0x10 [ 147.203578][ T7839] ? lock_acquire+0x1d1/0x380 [ 147.203601][ T7839] ? avc_has_perm_noaudit+0x56/0x470 [ 147.203633][ T7839] ? avc_has_perm_noaudit+0x145/0x470 [ 147.203684][ T7839] ? __nla_parse+0x40/0x60 [ 147.203710][ T7839] nfnetlink_rcv+0x3bd/0x440 [ 147.203731][ T7839] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 147.203761][ T7839] netlink_unicast+0x585/0x850 [ 147.203793][ T7839] ? __pfx_netlink_unicast+0x10/0x10 [ 147.203828][ T7839] netlink_sendmsg+0x8b0/0xda0 [ 147.203860][ T7839] ? __pfx_netlink_sendmsg+0x10/0x10 [ 147.203894][ T7839] ? selinux_socket_sendmsg+0x198/0x2f0 [ 147.203929][ T7839] ____sys_sendmsg+0xa4d/0xbe0 [ 147.203952][ T7839] ? __pfx_netlink_sendmsg+0x10/0x10 [ 147.203982][ T7839] ? __pfx_____sys_sendmsg+0x10/0x10 [ 147.204019][ T7839] ___sys_sendmsg+0x190/0x1e0 [ 147.204044][ T7839] ? __pfx____sys_sendmsg+0x10/0x10 [ 147.204069][ T7839] ? futex_wait+0x11e/0x370 [ 147.204102][ T7839] ? find_held_lock+0x2b/0x80 [ 147.204151][ T7839] __sys_sendmsg+0x160/0x210 [ 147.204180][ T7839] ? __pfx___sys_sendmsg+0x10/0x10 [ 147.204226][ T7839] do_syscall_64+0x123/0x790 [ 147.204253][ T7839] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 147.204276][ T7839] RIP: 0033:0x7f7ef199e199 [ 147.204294][ T7839] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 147.204314][ T7839] RSP: 002b:00007f7ef2790028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 147.204335][ T7839] RAX: ffffffffffffffda RBX: 00007f7ef1c25fa0 RCX: 00007f7ef199e199 [ 147.204353][ T7839] RDX: 0000000000040804 RSI: 0000200000002fc0 RDI: 0000000000000004 [ 147.204366][ T7839] RBP: 00007f7ef1a358e0 R08: 0000000000000000 R09: 0000000000000000 [ 147.204377][ T7839] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 147.204390][ T7839] R13: 00007f7ef1c26038 R14: 00007f7ef1c25fa0 R15: 00007ffdad0d4ad8 [ 147.204417][ T7839] [ 147.589521][ T7849] evm: overlay not supported [ 147.795391][ T5799] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 147.945658][ T5799] usb 6-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice= 1.00 [ 147.946623][ T5799] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 147.946665][ T5799] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 147.946689][ T5799] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 147.946703][ T5799] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 147.948528][ T5799] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 147.948553][ T5799] usb 6-1: Product: syz [ 147.948567][ T5799] usb 6-1: Manufacturer: syz [ 147.948582][ T5799] usb 6-1: SerialNumber: syz [ 147.953517][ T5799] usbserial_generic 6-1:1.0: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 147.953532][ T5799] usbserial_generic 6-1:1.0: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 147.953557][ T5799] usbserial_generic 6-1:1.0: generic converter detected [ 147.959831][ T5799] usb 6-1: generic converter now attached to ttyUSB0 [ 148.167687][ T7863] FAULT_INJECTION: forcing a failure. [ 148.167687][ T7863] name failslab, interval 1, probability 0, space 0, times 0 [ 148.167722][ T7863] CPU: 0 UID: 0 PID: 7863 Comm: syz.3.629 Not tainted syzkaller #0 PREEMPT(full) [ 148.167748][ T7863] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 148.167779][ T7863] Call Trace: [ 148.167787][ T7863] [ 148.167796][ T7863] dump_stack_lvl+0x100/0x190 [ 148.167833][ T7863] should_fail_ex.cold+0x5/0xa [ 148.167862][ T7863] should_failslab+0xc2/0x120 [ 148.167891][ T7863] __kvmalloc_node_noprof+0x113/0x9b0 [ 148.167923][ T7863] ? open_substream+0x311/0x970 [ 148.167950][ T7863] open_substream+0x311/0x970 [ 148.167976][ T7863] rawmidi_open_priv+0x595/0x6f0 [ 148.168006][ T7863] snd_rawmidi_open+0x4b4/0xb90 [ 148.168035][ T7863] ? __pfx_snd_rawmidi_open+0x10/0x10 [ 148.168061][ T7863] ? __pfx_default_wake_function+0x10/0x10 [ 148.168088][ T7863] ? lock_acquire+0x1d1/0x380 [ 148.168112][ T7863] ? kobject_get_unless_zero+0x156/0x200 [ 148.168144][ T7863] ? __pfx_snd_rawmidi_open+0x10/0x10 [ 148.168167][ T7863] snd_open+0x201/0x450 [ 148.168198][ T7863] ? __pfx_snd_open+0x10/0x10 [ 148.168227][ T7863] chrdev_open+0x234/0x6a0 [ 148.168255][ T7863] ? __pfx_chrdev_open+0x10/0x10 [ 148.168283][ T7863] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 148.168311][ T7863] do_dentry_open+0x6ab/0x14d0 [ 148.168335][ T7863] ? __pfx_chrdev_open+0x10/0x10 [ 148.168369][ T7863] vfs_open+0x82/0x3f0 [ 148.168412][ T7863] path_openat+0x19fa/0x2440 [ 148.168448][ T7863] ? __pfx_path_openat+0x10/0x10 [ 148.168483][ T7863] do_file_open+0x20e/0x430 [ 148.168511][ T7863] ? __pfx_do_file_open+0x10/0x10 [ 148.168558][ T7863] ? _raw_spin_unlock+0x28/0x50 [ 148.168579][ T7863] ? alloc_fd+0x471/0x7a0 [ 148.168620][ T7863] do_sys_openat2+0x10f/0x1e0 [ 148.168650][ T7863] ? __pfx_do_sys_openat2+0x10/0x10 [ 148.168678][ T7863] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 148.168716][ T7863] __x64_sys_openat+0x12d/0x210 [ 148.168746][ T7863] ? __pfx___x64_sys_openat+0x10/0x10 [ 148.168789][ T7863] do_syscall_64+0x123/0x790 [ 148.168815][ T7863] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 148.168837][ T7863] RIP: 0033:0x7ffbf875e9ce [ 148.168855][ T7863] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 148.168875][ T7863] RSP: 002b:00007ffbf9696b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 148.168896][ T7863] RAX: ffffffffffffffda RBX: 00007ffbf96976c0 RCX: 00007ffbf875e9ce [ 148.168909][ T7863] RDX: 0000000000141102 RSI: 00007ffbf9696c00 RDI: ffffffffffffff9c [ 148.168923][ T7863] RBP: 00007ffbf9696c00 R08: 0000000000000000 R09: 0000000000000000 [ 148.168936][ T7863] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 148.168951][ T7863] R13: 00007ffbf8a26038 R14: 00007ffbf8a25fa0 R15: 00007ffcc3b291f8 [ 148.168981][ T7863] [ 148.210742][ T5799] usb 6-1: USB disconnect, device number 5 [ 148.235842][ T5799] generic ttyUSB0: generic converter now disconnected from ttyUSB0 [ 148.237531][ T5799] usbserial_generic 6-1:1.0: device disconnected [ 148.713949][ T31] audit: type=1400 audit(1791436923.306:3510): avc: denied { getopt } for pid=7871 comm="syz.1.632" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 148.926677][ T7880] netlink: 52 bytes leftover after parsing attributes in process `syz.5.634'. [ 148.999539][ T7880] bridge0: port 2(bridge_slave_1) entered disabled state [ 148.999969][ T7880] bridge0: port 1(bridge_slave_0) entered disabled state [ 150.270497][ T7888] netlink: 'syz.5.638': attribute type 1 has an invalid length. [ 150.270518][ T7888] netlink: 'syz.5.638': attribute type 4 has an invalid length. [ 150.270531][ T7888] netlink: 9462 bytes leftover after parsing attributes in process `syz.5.638'. [ 150.271827][ T7888] netlink: 'syz.5.638': attribute type 1 has an invalid length. [ 150.271843][ T7888] netlink: 'syz.5.638': attribute type 4 has an invalid length. [ 150.271856][ T7888] netlink: 9462 bytes leftover after parsing attributes in process `syz.5.638'. [ 150.407745][ T31] audit: type=1400 audit(1791436925.006:3511): avc: denied { shutdown } for pid=7889 comm="syz.5.640" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 150.470370][ T31] audit: type=1326 audit(1791436925.056:3512): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7891 comm="syz.1.642" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7ef199e199 code=0x7ffc0000 [ 150.470422][ T31] audit: type=1326 audit(1791436925.066:3513): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7891 comm="syz.1.642" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7ef199e199 code=0x7ffc0000 [ 150.479832][ T31] audit: type=1326 audit(1791436925.076:3514): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7891 comm="syz.1.642" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f7ef199e199 code=0x7ffc0000 [ 150.518015][ T7896] overlayfs: failed to clone upperpath [ 150.646375][ T7899] FAULT_INJECTION: forcing a failure. [ 150.646375][ T7899] name failslab, interval 1, probability 0, space 0, times 0 [ 150.646408][ T7899] CPU: 1 UID: 0 PID: 7899 Comm: syz.4.644 Not tainted syzkaller #0 PREEMPT(full) [ 150.646433][ T7899] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 150.646446][ T7899] Call Trace: [ 150.646453][ T7899] [ 150.646462][ T7899] dump_stack_lvl+0x100/0x190 [ 150.646501][ T7899] should_fail_ex.cold+0x5/0xa [ 150.646533][ T7899] should_failslab+0xc2/0x120 [ 150.646566][ T7899] __kmalloc_cache_noprof+0x91/0x6d0 [ 150.646590][ T7899] ? snd_seq_queue_alloc+0x56/0x540 [ 150.646619][ T7899] snd_seq_queue_alloc+0x56/0x540 [ 150.646654][ T7899] snd_seq_ioctl_create_queue+0xa9/0x370 [ 150.646687][ T7899] call_seq_client_ctl+0xa3/0x130 [ 150.646720][ T7899] snd_seq_kernel_client_ctl+0x35/0x50 [ 150.646753][ T7899] alloc_seq_queue+0xdb/0x180 [ 150.646780][ T7899] ? __pfx_alloc_seq_queue+0x10/0x10 [ 150.646823][ T7899] ? find_held_lock+0x2b/0x80 [ 150.646852][ T7899] ? mark_held_locks+0x40/0x70 [ 150.646879][ T7899] snd_seq_oss_open+0x2b2/0xa10 [ 150.646912][ T7899] odev_open+0x6f/0x90 [ 150.646935][ T7899] ? __pfx_odev_open+0x10/0x10 [ 150.646962][ T7899] soundcore_open+0x2e3/0x5a0 [ 150.646993][ T7899] ? __pfx_soundcore_open+0x10/0x10 [ 150.647020][ T7899] chrdev_open+0x234/0x6a0 [ 150.647048][ T7899] ? __pfx_chrdev_open+0x10/0x10 [ 150.647075][ T7899] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 150.647104][ T7899] do_dentry_open+0x6ab/0x14d0 [ 150.647127][ T7899] ? __pfx_chrdev_open+0x10/0x10 [ 150.647160][ T7899] vfs_open+0x82/0x3f0 [ 150.647192][ T7899] path_openat+0x19fa/0x2440 [ 150.647224][ T7899] ? __pfx_path_openat+0x10/0x10 [ 150.647260][ T7899] do_file_open+0x20e/0x430 [ 150.647289][ T7899] ? __pfx_do_file_open+0x10/0x10 [ 150.647337][ T7899] ? _raw_spin_unlock+0x28/0x50 [ 150.647356][ T7899] ? alloc_fd+0x471/0x7a0 [ 150.647394][ T7899] do_sys_openat2+0x10f/0x1e0 [ 150.647424][ T7899] ? __pfx_do_sys_openat2+0x10/0x10 [ 150.647464][ T7899] __x64_sys_openat+0x12d/0x210 [ 150.647510][ T7899] ? __pfx___x64_sys_openat+0x10/0x10 [ 150.647555][ T7899] do_syscall_64+0x123/0x790 [ 150.647582][ T7899] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 150.647603][ T7899] RIP: 0033:0x7f7e4859e199 [ 150.647621][ T7899] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 150.647665][ T7899] RSP: 002b:00007f7e49416028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 150.647685][ T7899] RAX: ffffffffffffffda RBX: 00007f7e48825fa0 RCX: 00007f7e4859e199 [ 150.647699][ T7899] RDX: 0000000000000000 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 150.647710][ T7899] RBP: 00007f7e486358e0 R08: 0000000000000000 R09: 0000000000000000 [ 150.647721][ T7899] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 150.647731][ T7899] R13: 00007f7e48826038 R14: 00007f7e48825fa0 R15: 00007fff99e1da08 [ 150.647756][ T7899] [ 150.765240][ T7903] FAULT_INJECTION: forcing a failure. [ 150.765240][ T7903] name failslab, interval 1, probability 0, space 0, times 0 [ 150.765273][ T7903] CPU: 1 UID: 0 PID: 7903 Comm: syz.5.645 Not tainted syzkaller #0 PREEMPT(full) [ 150.765298][ T7903] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 150.765312][ T7903] Call Trace: [ 150.765319][ T7903] [ 150.765327][ T7903] dump_stack_lvl+0x100/0x190 [ 150.765362][ T7903] should_fail_ex.cold+0x5/0xa [ 150.765391][ T7903] should_failslab+0xc2/0x120 [ 150.765419][ T7903] __kmalloc_noprof+0xfc/0x840 [ 150.765443][ T7903] ? mpi_resize+0x1ac/0x250 [ 150.765474][ T7903] mpi_resize+0x1ac/0x250 [ 150.765501][ T7903] mpi_sub_ui+0x173/0x910 [ 150.765528][ T7903] rsa_check_payload+0x58/0xc0 [ 150.765556][ T7903] rsa_enc+0x198/0x3b0 [ 150.765581][ T7903] ? __pfx_rsa_enc+0x10/0x10 [ 150.765616][ T7903] ? __virt_addr_valid+0x239/0x430 [ 150.765639][ T7903] ? sg_init_one+0xf5/0x1b0 [ 150.765663][ T7903] rsassa_pkcs1_verify+0x4eb/0xc20 [ 150.765696][ T7903] ? __pfx_rsassa_pkcs1_verify+0x10/0x10 [ 150.765735][ T7903] ? rsa_max_size+0xd/0x70 [ 150.765759][ T7903] ? rsassa_pkcs1_set_pub_key+0x17d/0x1f0 [ 150.765791][ T7903] public_key_verify_signature+0x5ee/0x910 [ 150.765820][ T7903] ? __pfx_public_key_verify_signature+0x10/0x10 [ 150.765858][ T7903] ? asymmetric_key_generate_id+0x7e/0x180 [ 150.765884][ T7903] x509_check_for_self_signed+0x325/0x510 [ 150.765912][ T7903] x509_cert_parse+0x60c/0x910 [ 150.765939][ T7903] x509_key_preparse+0x65/0x9c0 [ 150.765969][ T7903] asymmetric_key_preparse+0xce/0x1d0 [ 150.765987][ T7903] ? __pfx_asymmetric_key_preparse+0x10/0x10 [ 150.766008][ T7903] __key_create_or_update+0x413/0xe30 [ 150.766041][ T7903] ? __pfx___key_create_or_update+0x10/0x10 [ 150.766070][ T7903] ? lookup_user_key+0x3f3/0x1300 [ 150.766108][ T7903] ? __pfx_lookup_user_key_possessed+0x10/0x10 [ 150.766135][ T7903] ? __pfx_keyring_search_iterator+0x10/0x10 [ 150.766168][ T7903] key_create_or_update+0x42/0x60 [ 150.766199][ T7903] __do_sys_add_key+0x2e8/0x460 [ 150.766222][ T7903] ? __pfx___do_sys_add_key+0x10/0x10 [ 150.766253][ T7903] do_syscall_64+0x123/0x790 [ 150.766279][ T7903] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 150.766300][ T7903] RIP: 0033:0x7f312ef9e199 [ 150.766318][ T7903] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 150.766336][ T7903] RSP: 002b:00007f312fdd0028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 150.766355][ T7903] RAX: ffffffffffffffda RBX: 00007f312f225fa0 RCX: 00007f312ef9e199 [ 150.766370][ T7903] RDX: 0000200000000200 RSI: 0000000000000000 RDI: 0000200000000000 [ 150.766384][ T7903] RBP: 00007f312f0358e0 R08: 000000002c153787 R09: 0000000000000000 [ 150.766397][ T7903] R10: 0000000000000559 R11: 0000000000000246 R12: 0000000000000000 [ 150.766410][ T7903] R13: 00007f312f226038 R14: 00007f312f225fa0 R15: 00007ffd624d6008 [ 150.766439][ T7903] [ 151.018290][ T7909] tipc: Started in network mode [ 151.018320][ T7909] tipc: Node identity 7ee669042a59, cluster identity 4711 [ 151.018600][ T7909] tipc: Enabled bearer , priority 10 [ 151.042816][ T7908] tipc: Resetting bearer [ 151.133756][ T7908] tipc: Disabling bearer [ 151.554780][ T31] kauditd_printk_skb: 22 callbacks suppressed [ 151.554851][ T31] audit: type=1400 audit(1791436926.146:3537): avc: denied { watch } for pid=7925 comm="syz.5.656" path="/90/debug/kvm" dev="debugfs" ino=1094 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 151.709000][ T31] audit: type=1400 audit(1791436926.306:3538): avc: denied { create } for pid=7930 comm="syz.4.658" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 151.715144][ T31] audit: type=1400 audit(1791436926.306:3539): avc: denied { write } for pid=7930 comm="syz.4.658" path="socket:[21574]" dev="sockfs" ino=21574 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 151.792944][ T31] audit: type=1400 audit(1791436926.386:3540): avc: denied { unmount } for pid=6500 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 152.129460][ T7952] netlink: 24 bytes leftover after parsing attributes in process `syz.5.664'. [ 152.564696][ T31] audit: type=1400 audit(1791436927.156:3541): avc: denied { connect } for pid=7959 comm="syz.1.667" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 152.618999][ T31] audit: type=1400 audit(1791436927.216:3542): avc: denied { read append } for pid=7959 comm="syz.1.667" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 152.619050][ T31] audit: type=1400 audit(1791436927.216:3543): avc: denied { open } for pid=7959 comm="syz.1.667" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 152.733064][ T7961] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 152.733183][ T7961] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 152.866381][ T7961] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 152.875379][ T7961] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 152.900454][ T7961] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 152.920112][ T7961] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 152.921248][ T7961] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 152.955050][ T7961] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 152.975042][ T7961] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 152.975324][ T7961] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 152.995959][ T7961] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 152.996083][ T31] audit: type=1400 audit(1791436927.586:3544): avc: denied { ioctl } for pid=7968 comm="syz.5.671" path="socket:[20828]" dev="sockfs" ino=20828 ioctlcmd=0x7a8 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 153.331727][ T31] audit: type=1400 audit(1791436927.926:3545): avc: denied { getopt } for pid=7983 comm="syz.5.675" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 154.620225][ T7999] netlink: 'syz.4.680': attribute type 1 has an invalid length. [ 154.644928][ T7999] bond1: entered promiscuous mode [ 154.645312][ T7999] 8021q: adding VLAN 0 to HW filter on device bond1 [ 154.687701][ T7999] bond1: (slave bridge1): making interface the new active one [ 154.687731][ T7999] bridge1: entered promiscuous mode [ 154.689172][ T7999] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 154.755344][ T5609] Bluetooth: hci1: command 0x0406 tx timeout [ 154.760057][ T8003] netlink: 28 bytes leftover after parsing attributes in process `syz.4.681'. [ 154.760095][ T8003] netlink: 'syz.4.681': attribute type 8 has an invalid length. [ 154.760119][ T8003] netlink: 16 bytes leftover after parsing attributes in process `syz.4.681'. [ 154.781051][ T8003] erspan0: entered promiscuous mode [ 154.787793][ T8003] gretap0: entered promiscuous mode [ 154.790795][ T7935] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 154.825052][ T8003] erspan0: left promiscuous mode [ 154.830417][ T8003] gretap0: left promiscuous mode [ 154.848433][ T8004] netlink: 28 bytes leftover after parsing attributes in process `syz.4.681'. [ 154.848470][ T8004] netlink: 'syz.4.681': attribute type 8 has an invalid length. [ 154.848482][ T8004] netlink: 16 bytes leftover after parsing attributes in process `syz.4.681'. [ 154.914940][ T5609] Bluetooth: hci2: command 0x0c1a tx timeout [ 154.929846][ T8004] erspan0: entered promiscuous mode [ 154.932087][ T8004] gretap0: entered promiscuous mode [ 154.944279][ T8004] erspan0: left promiscuous mode [ 154.949708][ T8004] gretap0: left promiscuous mode [ 154.994921][ T5609] Bluetooth: hci3: command 0x0405 tx timeout [ 154.994973][ T5609] Bluetooth: hci4: command 0x0c1a tx timeout [ 155.132256][ T31] audit: type=1400 audit(1791436929.726:3546): avc: denied { bind } for pid=8011 comm="syz.4.685" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 155.183444][ T8016] fuse: fd is not a fuse device [ 155.295298][ T5799] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 155.296118][ T8022] netlink: 24 bytes leftover after parsing attributes in process `syz.5.689'. [ 155.348387][ T8019] bond0: option prio: mode dependency failed, not supported in mode balance-rr(0) [ 155.445815][ T5799] usb 4-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 155.447082][ T5799] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 155.447126][ T5799] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 155.447147][ T5799] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 155.447170][ T5799] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 155.447206][ T5799] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 155.587175][ T8030] netlink: 'syz.4.693': attribute type 1 has an invalid length. [ 155.642430][ T8035] netlink: 4 bytes leftover after parsing attributes in process `syz.1.695'. [ 155.684655][ T8032] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 155.826581][ T8030] bond2: (slave gretap1): making interface the new active one [ 155.826995][ T8030] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 155.908160][ T8043] ================================================================== [ 155.908179][ T8043] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 155.908203][ T8043] Read of size 1 at addr ffff8880272fe300 by task syz.5.697/8043 [ 155.908221][ T8043] [ 155.908230][ T8043] CPU: 0 UID: 0 PID: 8043 Comm: syz.5.697 Not tainted syzkaller #0 PREEMPT(full) [ 155.908252][ T8043] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 155.908264][ T8043] Call Trace: [ 155.908271][ T8043] [ 155.908278][ T8043] dump_stack_lvl+0x100/0x190 [ 155.908310][ T8043] print_report+0x13d/0x4b0 [ 155.908338][ T8043] ? __virt_addr_valid+0x239/0x430 [ 155.908361][ T8043] ? string+0x471/0x4d0 [ 155.908375][ T8043] kasan_report+0xdf/0x1c0 [ 155.908404][ T8043] ? string+0x471/0x4d0 [ 155.908423][ T8043] string+0x471/0x4d0 [ 155.908441][ T8043] ? __pfx_string+0x10/0x10 [ 155.908471][ T8043] vsnprintf+0x422/0x1300 [ 155.908491][ T8043] ? __pfx_vsnprintf+0x10/0x10 [ 155.908508][ T8043] ? check_noncircular+0x97/0x160 [ 155.908530][ T8043] vprintk_store+0x3b3/0xbe0 [ 155.908556][ T8043] ? __pfx_vprintk_store+0x10/0x10 [ 155.908578][ T8043] ? __lock_acquire+0xe8b/0x1f40 [ 155.908604][ T8043] ? check_noncircular+0x97/0x160 [ 155.908626][ T8043] ? printk_percpu_data_ready+0x9/0x20 [ 155.908649][ T8043] ? nbcon_get_cpu_emergency_nesting+0x3b/0x50 [ 155.908677][ T8043] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 155.908698][ T8043] vprintk_emit+0x139/0x6b0 [ 155.908724][ T8043] ? __pfx_vprintk_emit+0x10/0x10 [ 155.908756][ T8043] _printk+0xcf/0x110 [ 155.908774][ T8043] ? __pfx__printk+0x10/0x10 [ 155.908791][ T8043] ? do_raw_spin_lock+0x128/0x260 [ 155.908816][ T8043] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 155.908843][ T8043] ? _raw_spin_lock_irqsave+0x52/0x60 [ 155.908876][ T8043] __setup_irq.cold+0x3be/0x3f1 [ 155.908899][ T8043] request_threaded_irq+0x261/0x3e0 [ 155.908922][ T8043] pcl812_attach+0x1b62/0x2300 [ 155.908948][ T8043] comedi_device_attach+0x40e/0x6b0 [ 155.908971][ T8043] do_devconfig_ioctl+0x1b3/0x6d0 [ 155.908997][ T8043] ? __pfx_do_devconfig_ioctl+0x10/0x10 [ 155.909029][ T8043] ? kasan_quarantine_put+0x104/0x240 [ 155.909053][ T8043] ? find_held_lock+0x2b/0x80 [ 155.909081][ T8043] comedi_unlocked_ioctl+0x860/0x3310 [ 155.909109][ T8043] ? tomoyo_path_number_perm+0x188/0x580 [ 155.909137][ T8043] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 155.909172][ T8043] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 155.909199][ T8043] ? do_vfs_ioctl+0x226/0x13e0 [ 155.909220][ T8043] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 155.909239][ T8043] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 155.909264][ T8043] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 155.909293][ T8043] ? __fget_files+0x34/0x3d0 [ 155.909324][ T8043] ? selinux_file_ioctl+0x13b/0x290 [ 155.909349][ T8043] ? selinux_file_ioctl+0xb6/0x290 [ 155.909374][ T8043] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 155.909404][ T8043] __x64_sys_ioctl+0x18e/0x210 [ 155.909428][ T8043] do_syscall_64+0x123/0x790 [ 155.909462][ T8043] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.909484][ T8043] RIP: 0033:0x7f312ef9e199 [ 155.909502][ T8043] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 155.909521][ T8043] RSP: 002b:00007f312fdd0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 155.909539][ T8043] RAX: ffffffffffffffda RBX: 00007f312f225fa0 RCX: 00007f312ef9e199 [ 155.909552][ T8043] RDX: 00002000000000c0 RSI: 0000000040946400 RDI: 0000000000000003 [ 155.909565][ T8043] RBP: 00007f312f0358e0 R08: 0000000000000000 R09: 0000000000000000 [ 155.909577][ T8043] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 155.909589][ T8043] R13: 00007f312f226038 R14: 00007f312f225fa0 R15: 00007ffd624d6008 [ 155.909608][ T8043] [ 155.909614][ T8043] [ 155.909619][ T8043] Allocated by task 5613: [ 155.909635][ T8043] kasan_save_stack+0x30/0x50 [ 155.909660][ T8043] kasan_save_track+0x14/0x30 [ 155.909685][ T8043] __kasan_kmalloc+0xaa/0xb0 [ 155.909708][ T8043] __kmalloc_node_noprof+0x342/0x880 [ 155.909731][ T8043] __vmalloc_node_range_noprof+0x3d4/0x1420 [ 155.909758][ T8043] __vmalloc_node_noprof+0xad/0xf0 [ 155.909782][ T8043] xt_counters_alloc+0x4c/0x70 [ 155.909809][ T8043] __do_replace+0x97/0x990 [ 155.909832][ T8043] do_ip6t_set_ctl+0xa5f/0xd00 [ 155.909857][ T8043] nf_setsockopt+0x8d/0xf0 [ 155.909883][ T8043] ipv6_setsockopt+0x135/0x170 [ 155.909907][ T8043] tcp_setsockopt+0xa7/0x100 [ 155.909929][ T8043] do_sock_setsockopt+0xf3/0x1d0 [ 155.909945][ T8043] __sys_setsockopt+0x195/0x220 [ 155.909972][ T8043] __x64_sys_setsockopt+0xbd/0x160 [ 155.909999][ T8043] do_syscall_64+0x123/0x790 [ 155.910020][ T8043] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.910038][ T8043] [ 155.910042][ T8043] Freed by task 5613: [ 155.910051][ T8043] kasan_save_stack+0x30/0x50 [ 155.910073][ T8043] kasan_save_track+0x14/0x30 [ 155.910096][ T8043] kasan_save_free_info+0x3b/0x70 [ 155.910114][ T8043] __kasan_slab_free+0x5f/0x80 [ 155.910135][ T8043] kfree+0x22b/0x6d0 [ 155.910151][ T8043] vfree+0x11d/0x6d0 [ 155.910173][ T8043] __do_replace+0x78f/0x990 [ 155.910196][ T8043] do_ip6t_set_ctl+0xa5f/0xd00 [ 155.910219][ T8043] nf_setsockopt+0x8d/0xf0 [ 155.910245][ T8043] ipv6_setsockopt+0x135/0x170 [ 155.910268][ T8043] tcp_setsockopt+0xa7/0x100 [ 155.910288][ T8043] do_sock_setsockopt+0xf3/0x1d0 [ 155.910303][ T8043] __sys_setsockopt+0x195/0x220 [ 155.910325][ T8043] __x64_sys_setsockopt+0xbd/0x160 [ 155.910348][ T8043] do_syscall_64+0x123/0x790 [ 155.910367][ T8043] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.910385][ T8043] [ 155.910390][ T8043] The buggy address belongs to the object at ffff8880272fe300 [ 155.910390][ T8043] which belongs to the cache kmalloc-8 of size 8 [ 155.910405][ T8043] The buggy address is located 0 bytes inside of [ 155.910405][ T8043] freed 8-byte region [ffff8880272fe300, ffff8880272fe308) [ 155.910422][ T8043] [ 155.910434][ T8043] The buggy address belongs to the physical page: [ 155.910443][ T8043] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x272fe [ 155.910471][ T8043] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 155.910492][ T8043] page_type: f5(slab) [ 155.910511][ T8043] raw: 00fff00000000000 ffff88801c031500 dead000000000100 dead000000000122 [ 155.910530][ T8043] raw: 0000000000000000 0000000000800080 00000000f5000000 0000000000000000 [ 155.910542][ T8043] page dumped because: kasan: bad access detected [ 155.910551][ T8043] page_owner tracks the page as allocated [ 155.910557][ T8043] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 4402104506 [ 155.910588][ T8043] post_alloc_hook+0xfd/0x120 [ 155.910606][ T8043] get_page_from_freelist+0x110d/0x35d0 [ 155.910627][ T8043] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 155.910649][ T8043] new_slab+0xa9/0x6e0 [ 155.910666][ T8043] refill_objects+0xe3/0x410 [ 155.910684][ T8043] __pcs_replace_empty_main+0x35e/0x650 [ 155.910703][ T8043] __kmalloc_node_track_caller_noprof+0x6a8/0x870 [ 155.910725][ T8043] kstrdup+0x51/0xe0 [ 155.910740][ T8043] kstrdup_const+0x63/0x80 [ 155.910756][ T8043] __kernfs_new_node+0x9b/0xa10 [ 155.910772][ T8043] kernfs_new_node+0x117/0x150 [ 155.910788][ T8043] kernfs_create_link+0xcc/0x240 [ 155.910810][ T8043] sysfs_do_create_link_sd+0x90/0x140 [ 155.910836][ T8043] sysfs_create_link+0x61/0xc0 [ 155.910859][ T8043] device_add+0xb62/0x1970 [ 155.910884][ T8043] tty_register_device_attr+0x388/0x810 [ 155.910906][ T8043] page_owner free stack trace missing [ 155.910912][ T8043] [ 155.910915][ T8043] Memory state around the buggy address: [ 155.910925][ T8043] ffff8880272fe200: 06 fc fc fc 05 fc fc fc 05 fc fc fc 05 fc fc fc [ 155.910936][ T8043] ffff8880272fe280: 05 fc fc fc 05 fc fc fc 05 fc fc fc 06 fc fc fc [ 155.910948][ T8043] >ffff8880272fe300: fa fc fc fc 05 fc fc fc fa fc fc fc 00 fc fc fc [ 155.910959][ T8043] ^ [ 155.910969][ T8043] ffff8880272fe380: 05 fc fc fc 00 fc fc fc fa fc fc fc fa fc fc fc [ 155.910980][ T8043] ffff8880272fe400: 04 fc fc fc 00 fc fc fc 00 fc fc fc 06 fc fc fc [ 155.910989][ T8043] ================================================================== [ 155.911005][ T8043] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 156.706192][ T8043] CPU: 0 UID: 0 PID: 8043 Comm: syz.5.697 Not tainted syzkaller #0 PREEMPT(full) [ 156.715385][ T8043] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 156.725447][ T8043] Call Trace: [ 156.728727][ T8043] [ 156.731654][ T8043] dump_stack_lvl+0x100/0x190 [ 156.736337][ T8043] vpanic+0x553/0x970 [ 156.740338][ T8043] ? __pfx_vpanic+0x10/0x10 [ 156.744830][ T8043] ? __pfx_vprintk_emit+0x10/0x10 [ 156.749855][ T8043] ? string+0x471/0x4d0 [ 156.754001][ T8043] panic+0xd1/0xe0 [ 156.757721][ T8043] ? __pfx_panic+0x10/0x10 [ 156.762127][ T8043] ? end_report.part.0+0x23/0x90 [ 156.767066][ T8043] ? rcu_is_watching+0x13/0xc0 [ 156.771834][ T8043] ? end_report.part.0+0x23/0x90 [ 156.776781][ T8043] check_panic_on_warn.cold+0x19/0x34 [ 156.782153][ T8043] end_report.part.0+0x3a/0x90 [ 156.786924][ T8043] kasan_report.cold+0xe/0x18 [ 156.791603][ T8043] ? string+0x471/0x4d0 [ 156.795764][ T8043] string+0x471/0x4d0 [ 156.799750][ T8043] ? __pfx_string+0x10/0x10 [ 156.804257][ T8043] vsnprintf+0x422/0x1300 [ 156.808598][ T8043] ? __pfx_vsnprintf+0x10/0x10 [ 156.813373][ T8043] ? check_noncircular+0x97/0x160 [ 156.818411][ T8043] vprintk_store+0x3b3/0xbe0 [ 156.823008][ T8043] ? __pfx_vprintk_store+0x10/0x10 [ 156.828124][ T8043] ? __lock_acquire+0xe8b/0x1f40 [ 156.833062][ T8043] ? check_noncircular+0x97/0x160 [ 156.838086][ T8043] ? printk_percpu_data_ready+0x9/0x20 [ 156.843542][ T8043] ? nbcon_get_cpu_emergency_nesting+0x3b/0x50 [ 156.849697][ T8043] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 156.855588][ T8043] vprintk_emit+0x139/0x6b0 [ 156.860233][ T8043] ? __pfx_vprintk_emit+0x10/0x10 [ 156.865276][ T8043] _printk+0xcf/0x110 [ 156.869260][ T8043] ? __pfx__printk+0x10/0x10 [ 156.873841][ T8043] ? do_raw_spin_lock+0x128/0x260 [ 156.878870][ T8043] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 156.884260][ T8043] ? _raw_spin_lock_irqsave+0x52/0x60 [ 156.889655][ T8043] __setup_irq.cold+0x3be/0x3f1 [ 156.894521][ T8043] request_threaded_irq+0x261/0x3e0 [ 156.899729][ T8043] pcl812_attach+0x1b62/0x2300 [ 156.904522][ T8043] comedi_device_attach+0x40e/0x6b0 [ 156.909896][ T8043] do_devconfig_ioctl+0x1b3/0x6d0 [ 156.914924][ T8043] ? __pfx_do_devconfig_ioctl+0x10/0x10 [ 156.920490][ T8043] ? kasan_quarantine_put+0x104/0x240 [ 156.925864][ T8043] ? find_held_lock+0x2b/0x80 [ 156.930544][ T8043] comedi_unlocked_ioctl+0x860/0x3310 [ 156.935924][ T8043] ? tomoyo_path_number_perm+0x188/0x580 [ 156.941555][ T8043] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 156.947459][ T8043] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 156.953356][ T8043] ? do_vfs_ioctl+0x226/0x13e0 [ 156.958118][ T8043] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 156.963134][ T8043] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 156.969636][ T8043] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 156.976491][ T8043] ? __fget_files+0x34/0x3d0 [ 156.981092][ T8043] ? selinux_file_ioctl+0x13b/0x290 [ 156.986287][ T8043] ? selinux_file_ioctl+0xb6/0x290 [ 156.991401][ T8043] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 156.997212][ T8043] __x64_sys_ioctl+0x18e/0x210 [ 157.001973][ T8043] do_syscall_64+0x123/0x790 [ 157.006558][ T8043] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 157.012445][ T8043] RIP: 0033:0x7f312ef9e199 [ 157.016885][ T8043] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 157.036495][ T8043] RSP: 002b:00007f312fdd0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 157.044903][ T8043] RAX: ffffffffffffffda RBX: 00007f312f225fa0 RCX: 00007f312ef9e199 [ 157.052868][ T8043] RDX: 00002000000000c0 RSI: 0000000040946400 RDI: 0000000000000003 [ 157.060835][ T8043] RBP: 00007f312f0358e0 R08: 0000000000000000 R09: 0000000000000000 [ 157.068802][ T8043] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 157.076770][ T8043] R13: 00007f312f226038 R14: 00007f312f225fa0 R15: 00007ffd624d6008 [ 157.084771][ T8043] [ 157.088267][ T8043] Kernel Offset: disabled [ 157.092605][ T8043] Rebooting in 86400 seconds..