last executing test programs: 18.629483712s ago: executing program 3 (id=50): r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000640)={0x28, 0x0, 0x2710}, 0x10) r2 = accept(r0, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="120000000200000004000000a4"], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r3, 0x0, &(0x7f00000002c0)=@tcp=r2}, 0x20) recvmsg$can_bcm(r2, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x10060) 18.345557503s ago: executing program 3 (id=54): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) recvmmsg(r0, &(0x7f0000004480)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000180)=""/157, 0x9d}, {&(0x7f0000000040)=""/185, 0xb9}, {&(0x7f0000000700)=""/79, 0x4f}, {&(0x7f00000027c0)=""/4133, 0x1025}], 0x4}, 0xd}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, 0x0}, 0x402}, {{0x0, 0x0, 0x0}}], 0x4, 0x40000100, 0x0) 17.881886781s ago: executing program 3 (id=55): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="120100003d37d840890457e00000000000010902240003000000000904"], 0x0) syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000980)={0x1c, &(0x7f00000000c0)=ANY=[@ANYBLOB="9a6e45c6be66c17a53742827ad8c11620ab4db87db285ce4741940aa4fbdac48aa426839a223d625597af8928a1dce672add2d6c784879ee4947587742cdb660876c08968742291e65"], 0x0, 0x0}) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x2000800001000088}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) sched_setaffinity(0x0, 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) r2 = eventfd2(0x51cc, 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000e72000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000b30000/0x400000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0x0, r2}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x24, &(0x7f0000000040)={0x0, 0x73e9, 0x1f410, 0x0, 0x19c}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x183c81) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/net/rpc/auth.rpcsec.context/channel\x00', 0x1, 0x0) write(r5, &(0x7f0000000140)="012031303030303030303030203020302030206b726235200020757365720a", 0x23) 16.895393246s ago: executing program 4 (id=59): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) socket$rds(0x15, 0x5, 0x0) io_submit(0x0, 0x1, &(0x7f0000000500)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x40}]) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x22d3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x8000) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) removexattr(0x0, &(0x7f0000000000)=@known='security.apparmor\x00') sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) r2 = open(&(0x7f00009e1000)='./file0\x00', 0x448101, 0x0) fcntl$setlease(r2, 0x400, 0x1) fcntl$getflags(r2, 0x401) read$msr(r1, &(0x7f0000019300)=""/102392, 0x18ff8) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, 0x0, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r4, &(0x7f0000000040)={0xa, 0x4001, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) r5 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r5, &(0x7f0000000280)=[{&(0x7f00000005c0)="580000001400192340834b80040d8c560a06ffffff7f070000000000000058000b480400945f64009400050038923944000000800000008004000000ff0109000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r6, 0x2000000, 0x4, 0x0, &(0x7f0000000600)="c9f7b986", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r7 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOC_WATCH_QUEUE_SET_FILTER(0xffffffffffffffff, 0x5761, &(0x7f00000001c0)=ANY=[@ANYRESHEX=r4]) ioctl$RTC_ALM_READ(r7, 0x40187013, &(0x7f0000000080)) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) 15.356540821s ago: executing program 3 (id=60): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000c00)={@cgroup=r3, 0xf, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) write(r3, &(0x7f0000000140)='1', 0x1) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TIOCSSOFTCAR(r4, 0x5453, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r3, 0xc0189378, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0) write(r5, &(0x7f0000000240)='10', 0x2) close(r3) socket$packet(0x11, 0x3, 0x300) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x528, &(0x7f0000000300)={0x0, 0x3cb1, 0x10, 0x0, 0x20002f7, 0x0, r3}) r6 = creat(&(0x7f0000000000)='./file0\x00', 0xc9a9c042ad77c5e5) close(r6) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mount(&(0x7f0000000080)=@filename='./file0\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x23010, 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x2000031, 0x0) 15.06659036s ago: executing program 4 (id=64): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000c00)={@cgroup=r3, 0xf, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) write(r3, &(0x7f0000000140)='1', 0x1) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TIOCSSOFTCAR(r4, 0x5453, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r3, 0xc0189378, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0) write(r5, &(0x7f0000000240)='10', 0x2) close(r3) socket$packet(0x11, 0x3, 0x300) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x528, &(0x7f0000000300)={0x0, 0x3cb1, 0x10, 0x0, 0x20002f7, 0x0, r3}) r6 = creat(&(0x7f0000000000)='./file0\x00', 0xc9a9c042ad77c5e5) close(r6) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mount(&(0x7f0000000080)=@filename='./file0\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x23010, 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x2000031, 0x0) 8.517383414s ago: executing program 3 (id=68): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000c00)={@cgroup=r3, 0xf, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) write(r3, &(0x7f0000000140)='1', 0x1) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TIOCSSOFTCAR(r4, 0x5453, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r3, 0xc0189378, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0) write(r5, &(0x7f0000000240)='10', 0x2) close(r3) socket$packet(0x11, 0x3, 0x300) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x528, &(0x7f0000000300)={0x0, 0x3cb1, 0x10, 0x0, 0x20002f7, 0x0, r3}) r6 = creat(&(0x7f0000000000)='./file0\x00', 0xc9a9c042ad77c5e5) close(r6) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mount(&(0x7f0000000080)=@filename='./file0\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x23010, 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x2000031, 0x0) 7.82637044s ago: executing program 0 (id=71): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="120100003d37d840890457e00000000000010902240003000000000904"], 0x0) syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000980)={0x1c, &(0x7f00000000c0)=ANY=[@ANYBLOB="9a6e45c6be66c17a53742827ad8c11620ab4db87db285ce4741940aa4fbdac48aa426839a223d625597af8928a1dce672add2d6c784879ee4947587742cdb660876c08968742291e65195d25a2db9e1bb96a6d5f245c24df709e44d796b16fd37591127d97ac1121a45786f66cd7"], 0x0, 0x0}) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x2000800001000088}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) sched_setaffinity(0x0, 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) r2 = eventfd2(0x51cc, 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000e72000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000b30000/0x400000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0x0, r2}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x24, &(0x7f0000000040)={0x0, 0x73e9, 0x1f410, 0x0, 0x19c}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sysctl, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x183c81) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/net/rpc/auth.rpcsec.context/channel\x00', 0x1, 0x0) write(r5, &(0x7f0000000140)="012031303030303030303030203020302030206b726235200020757365720a", 0x23) 7.79058703s ago: executing program 4 (id=72): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8090}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a50000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000240004802000018007000100637400001400028008000140000000130800024000000010140000001100010000000000000000000000000a6d34ca9009e1cdb38e04ccfdd773c710158a2088cfc65bb9d7912fc4c85cd92fc170295e2a018664d9476db54fc40ac5864fd4000042a25313"], 0x78}, 0x1, 0x0, 0x0, 0x40000}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x0, 0x0, @private2}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r4, 0x84, 0x85, &(0x7f0000000000)={r5, @in={{0x2, 0x0, @empty}}, 0x0, 0x7ffe}, 0x90) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000340)={r5, @in={{0x2, 0x4e21, @rand_addr=0x64010101}}, 0x800000f, 0x8003, 0x20000, 0x0, 0xcd, 0x0, 0x4}, 0x9c) syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) r6 = accept(r1, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x2400c840}, 0x0) connect$unix(r6, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket(0x2, 0x1, 0x6) bind(r7, &(0x7f00000000c0)=@in={0x2, 0x3039, @loopback}, 0x10) listen(r7, 0x1) r8 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r8, 0x6, 0x0, 0x0, 0x0) accept(r7, 0x0, 0x0) 7.566104947s ago: executing program 3 (id=74): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB="3800000020000100ecc2000000000000020020000000000100000000140003006c6f00000000000000000000000000000800"], 0x38}, 0x1, 0x0, 0x0, 0x4044800}, 0x20000076) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8c}, 0x0) bind$802154_raw(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102384, 0x18ff0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f000000b7c0)={0x18, 0x44, 0x1, 0x70bd29, 0x4, {0x2}, [@nested={0x4, 0x48}]}, 0x18}, 0x1, 0x0, 0x0, 0x200048d5}, 0x4008094) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x21) r5 = dup(r4) ioctl$KVM_CHECK_EXTENSION_VM(r5, 0xae03, 0x81) r6 = add_key(&(0x7f0000001340)='keyring\x00', &(0x7f0000001380)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r6, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f00000002c0), 0x3265418f5ec1340, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private1}], 0x1c) r7 = socket(0x2, 0x80805, 0x0) brk(0x200000ffc000) getsockopt$bt_hci(r7, 0x84, 0x0, &(0x7f0000000000)=""/4087, &(0x7f0000001000)=0xff7) 6.482793244s ago: executing program 2 (id=76): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r0 = socket$rds(0x15, 0x5, 0x0) io_submit(0x0, 0x0, 0x0) epoll_create1(0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x22d3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x8000) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) removexattr(0x0, &(0x7f0000000000)=@known='security.apparmor\x00') sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) r3 = open(&(0x7f00009e1000)='./file0\x00', 0x448101, 0x0) fcntl$setlease(r3, 0x400, 0x1) fcntl$getflags(r3, 0x401) read$msr(r2, &(0x7f0000019300)=""/102392, 0x18ff8) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, 0x0, 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4001, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) r6 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r6, &(0x7f0000000280)=[{&(0x7f00000005c0)="580000001400192340834b80040d8c560a06ffffff7f070000000000000058000b480400945f64009400050038923944000000800000008004000000ff0109000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r7, 0x2000000, 0x4, 0x0, &(0x7f0000000600)="c9f7b986", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r8 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOC_WATCH_QUEUE_SET_FILTER(0xffffffffffffffff, 0x5761, &(0x7f00000001c0)=ANY=[@ANYRESHEX=r5]) ioctl$RTC_ALM_READ(r8, 0x40187013, &(0x7f0000000080)) sendmsg$inet(r0, &(0x7f0000000480)={&(0x7f0000000000)={0x2, 0x4e22, @multicast1}, 0x10, 0x0}, 0x0) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) 6.222216906s ago: executing program 4 (id=77): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB="3800000020000100ecc2000000000000020020000000000100000000140003006c6f00000000000000000000000000000800"], 0x38}, 0x1, 0x0, 0x0, 0x4044800}, 0x20000076) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8c}, 0x0) bind$802154_raw(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102384, 0x18ff0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f000000b7c0)={0x18, 0x44, 0x1, 0x70bd29, 0x4, {0x2}, [@nested={0x4, 0x48}]}, 0x18}, 0x1, 0x0, 0x0, 0x200048d5}, 0x4008094) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x21) r5 = dup(r4) ioctl$KVM_CHECK_EXTENSION_VM(r5, 0xae03, 0x81) r6 = add_key(&(0x7f0000001340)='keyring\x00', &(0x7f0000001380)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r6, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f00000002c0), 0x3265418f5ec1340, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private1}], 0x1c) r7 = socket(0x2, 0x80805, 0x0) brk(0x200000ffc000) getsockopt$bt_hci(r7, 0x84, 0x0, &(0x7f0000000000)=""/4087, &(0x7f0000001000)=0xff7) 5.427063541s ago: executing program 1 (id=79): syz_usb_connect$uac3(0x0, 0x9f, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000000000040ba0d001040000102030109028d000301635006080b00ff010130020904000000"], 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4c0000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="ef00000000000000140012800b0001006970766c616e00000400028008000500", @ANYRES32], 0x4c}, 0x1, 0x0, 0x0, 0x8001}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$USBDEVFS_CONTROL(0xffffffffffffffff, 0xc0105500, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(0xffffffffffffffff, 0x400455c8, 0x2) socket(0x2, 0x800, 0x0) sendmsg(r1, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000300)="aa44b6f71da8d25c6c72f71b2f0d3aa48fc963b24588c3b60ea4b2d46fd94a38b2829231072ecbbcd2ba6f35846b14e662257e1ec14955f8d123d19e8d681a8d8854f837d16383479d3c18c8e02de6", 0x4f}, {&(0x7f0000000380)="e596d96e267015cc2ba8cec398e459e2fc39afed8d6d9922cf073ca5732b8fd611005bd84275c04bb497324c0238a97455c391601fe9deba8347fd", 0x3b}, {&(0x7f00000003c0)="3e188a59c7421bf370a71126d0f7c2247571b455bd3dfbc1f6b8cb3d23df18a3ca67778398e6ddf11cc53514ac8a3e488b3b120c34ce10a3d542b12a1a6689102791103095b7ade03d765d8fc0e7f98864c2afeb1a180a305efc451232522db7c584b6968baa9be9cc31c202152584140b67ae23fcd4efc9d997010b6ef128926021be3793c87b7ba9f7cd62457a64144ec84644d9e2ea063b1e6fafeddb5c", 0x9f}], 0x3, &(0x7f0000000600)=[{0x110, 0x102, 0x56a, "89bfa55e0a64ea00cd2253981a24d53b43d7e2bb392349de5a6be2d3e882b255b543277ee5497c33cab380eba4647a144a25d39bca8814fe6aa503ccaf22abb01e4f1942cdf1060ad728fd2b1534d5134384a3f9556f21552b7ad2ace64d5ab246cd8b08b0466f82d4579b31899ff9f9de3461459be77199841fbbe919bf5da1cf3e13ad3b430cee43bf63d0492339f9f09b9960abc0958b5f24ea81fd6c3906057b2d9d872fe17547665b819a86124de7d05e72c3588bd229b5c13256743e02f3fe55c45a84a90fe6d3bb63323cba61ed732fa09ba851e541478a468e8514f2c6fe24975c73370fa13621a75dc44063da0873a830cf7d11d48e"}, {0xd0, 0x10a, 0x24b7, "358c649efa910a189d3be80274583749923bd1bf3ee92c25e5878edad8e2f5a64acc63fd03f6bd56e47ea7dac36e0d33416e66545b7dafb3c7ccb704a3f954d0d0241438511a36921244ce38041647fedbfafa9bb97d4f639b977cdbcab9f369f368929a8d1434c24881b222e11f6cdf97a18243ff4c37dd52c0319af58974df33a7efc325bf338830a6501408148682ae8e73fb02952671a364f05cf20be07e691aa7317ff563d8441e058764ca4ad4e6ef788152924936c35984b42f01534c"}, {0x70, 0x10d, 0x0, "75d95d40629a2bac08cf10bc7a02ec28863cd469b9f5bb84f8b561f50f2419580e552d1420174d1894b16844bec8c79cb85fc249d9ad70d1d48b06ef28464b425605a9cc81dd8c674f66b31f151e2405ea0bff484700222a3cdc2e"}], 0x250}, 0x0) socket$inet6(0xa, 0xa, 0x7fff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) r5 = fsopen(&(0x7f0000000080)='binfmt_misc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/diskstats\x00', 0x0, 0x0) close(r6) statx(r6, 0x0, 0x1000, 0xf0cb2f4a0c2cfc5d, 0x0) fsmount(r5, 0x0, 0x1) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL80211_CMD_TRIGGER_SCAN(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)={0x1c, r7, 0x1, 0x0, 0x0, {{0x8}, {@val={0x8, 0x3, r4}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 5.327465439s ago: executing program 2 (id=80): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000c00)=@bpf_tracing={0x1a, 0x3, &(0x7f0000000480)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4}}, 0x0, 0x5, 0x0, 0x0, 0x41100, 0x2, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x13b02, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xd}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000005a0000008500000022000000180100002020702500000000002020200100000000000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000095"], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x20000840) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioprio_set$pid(0x1, 0x0, 0x0) io_submit(0x0, 0x0, &(0x7f0000000840)) r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000080)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x3163, '\x00', 0x0, 0x0}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r4, 0xffffffffffffffff}, &(0x7f0000000140), &(0x7f0000000180)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x6, 0x14, &(0x7f0000001740)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r5}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1ab92b}, {0x85, 0x0, 0x0, 0x8}, {0x4}}, {{0x5, 0x0, 0x4, 0x9, 0x0, 0x1, 0x2000}}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r6}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x9}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000080), 0x900, 0x0) ioctl$FBIO_WAITFORVSYNC(r7, 0x40044620, 0x0) ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f0000000200)=@add_del={0x2, &(0x7f0000000180)='veth0_to_batadv\x00'}) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x16, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000"], 0x0, 0x100, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet_tcp(0x2, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x1, 0x2) 5.313079739s ago: executing program 4 (id=81): r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000900)="880100"/64) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000e00)='./sys\x00', &(0x7f0000000f00)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001000)='./sys/devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/adsl_state\x00', 0x2, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) 4.360795916s ago: executing program 2 (id=82): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) socket$rds(0x15, 0x5, 0x0) io_submit(0x0, 0x1, &(0x7f0000000500)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x40}]) epoll_create1(0x0) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) removexattr(0x0, &(0x7f0000000000)=@known='security.apparmor\x00') sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) fcntl$getflags(0xffffffffffffffff, 0x401) read$msr(r0, &(0x7f0000019300)=""/102392, 0x18ff8) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, 0x0, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4001, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) r3 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r3, &(0x7f0000000280)=[{&(0x7f00000005c0)="580000001400192340834b80040d8c560a06ffffff7f070000000000000058000b480400945f64009400050038923944000000800000008004000000ff0109000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r4, 0x2000000, 0x4, 0x0, &(0x7f0000000600)="c9f7b986", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$IOC_WATCH_QUEUE_SET_FILTER(0xffffffffffffffff, 0x5761, &(0x7f00000001c0)=ANY=[@ANYRESHEX=r2]) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) 3.880720416s ago: executing program 2 (id=83): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='config\x00', 0x1ff) mount(0x0, 0x0, &(0x7f00000000e0)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='config\x00', 0x0, 0x0) r1 = openat(r0, &(0x7f0000000180)='usb_gadget/g1\x00', 0x0, 0x0) r2 = openat(r1, &(0x7f0000000250)='webusb/use\x00', 0x2, 0x0) write(r2, &(0x7f0000000290)='1', 0x1) mkdirat(r1, &(0x7f00000004c0)='functions/Loopback.usb0\x00', 0x1ff) mkdirat(r1, &(0x7f0000000500)='configs/c.1\x00', 0x1ff) r3 = openat(r1, &(0x7f0000000540)='configs/c.1\x00', 0x0, 0x0) symlinkat(&(0x7f0000000680)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', r3, &(0x7f0000000700)='Loopback.usb0\x00') r4 = openat(r1, &(0x7f0000000740)='UDC\x00', 0x2, 0x0) write(r4, &(0x7f0000000780)='usbip-vudc.0\n', 0xd) 3.694941931s ago: executing program 2 (id=84): mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff) mkdir(&(0x7f0000000100)='./dev\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='none\x00', &(0x7f0000000300)='./sys\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000600)='./dev\x00', &(0x7f0000000700)='devtmpfs\x00', 0x0, 0x0) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000140), 0x10800, 0x0) renameat(0xffffffffffffffff, 0x0, r0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='file0\x00', 0x42, 0x1ff) ftruncate(r1, 0x1000000) ftruncate(0xffffffffffffffff, 0x1000000) r2 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) r3 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) ftruncate(r3, 0x1000000) r4 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev/loop0\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r4, 0x4c00, r1) r5 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$LOOP_SET_FD(r5, 0x4c00, r2) r6 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r6, &(0x7f0000001100)='md0', 0x3) r7 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./dev/md0\x00', 0x2, 0x0) ioctl(r7, 0x40140921, &(0x7f0000001500)) 3.690077786s ago: executing program 0 (id=85): r0 = openat2(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={0x280, 0x100, 0x14}, 0x18) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, 0x0, 0x4048012) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002280)=ANY=[@ANYBLOB="100a"], 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x20040040) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) write$binfmt_aout(r1, &(0x7f00000001c0)=ANY=[], 0xff2e) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0xa, "0062ba7d82000000160000000000f738096304"}) r2 = syz_open_pts(r1, 0x900) dup3(r2, r1, 0x80000) getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0xf, 0x100}, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r6, 0x11, 0x67, &(0x7f0000000080)=0x9, 0x4) connect$inet6(r6, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) sendmmsg$inet6(r6, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) ioctl$IOMMU_IOAS_COPY$syz(r7, 0x3b83, &(0x7f0000000040)={0x28, 0x8, 0x0, 0x0, 0x9ec4b, 0x9, 0x3, 0x3da64}) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), r8) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f00000002c0)={'wlan0\x00'}) 3.238170015s ago: executing program 2 (id=86): r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000a00)="880100"/64) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000e00)='./sys\x00', &(0x7f0000000f00)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000001200)='stop', 0x4) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) 2.556985126s ago: executing program 0 (id=87): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8090}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a50000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000240004802000018007000100637400001400028008000140000000130800024000000010140000001100010000000000000000000000000a6d34ca9009e1cdb38e04ccfdd773c710158a2088cfc65bb9d7912fc4c85cd92fc170295e2a018664d9476db54fc40ac5864fd4000042a25313"], 0x78}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r5, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r5, 0x84, 0x85, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x7ffe}, 0x90) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100ffffffff0000400001000000050007000000000008000900000000101400200000000000000000000000ffff0000000008000a000000000014001f0000000000000000000000000000000000060002000000000006001b004e200000050021"], 0x6c}, 0x1, 0x620b}, 0x0) r7 = accept(r1, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x2400c840}, 0x0) connect$unix(r7, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) socket$nl_netfilter(0x10, 0x3, 0xc) r8 = socket(0x2, 0x1, 0x6) bind(r8, &(0x7f00000000c0)=@in={0x2, 0x3039, @loopback}, 0x10) listen(r8, 0x1) r9 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r9, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r9, 0x6, 0x0, 0x0, 0x0) accept(r8, 0x0, 0x0) 1.968774776s ago: executing program 1 (id=88): socket$rds(0x15, 0x5, 0x0) io_submit(0x0, 0x0, 0x0) epoll_create1(0x0) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x50) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x8000) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) removexattr(0x0, &(0x7f0000000000)=@known='security.apparmor\x00') sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) r1 = open(&(0x7f00009e1000)='./file0\x00', 0x448101, 0x0) fcntl$setlease(r1, 0x400, 0x1) fcntl$getflags(r1, 0x401) read$msr(r0, &(0x7f0000019300)=""/102392, 0x18ff8) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, 0x0, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x4001, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) r4 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r4, &(0x7f0000000280)=[{&(0x7f00000005c0)="580000001400192340834b80040d8c560a06ffffff7f070000000000000058000b480400945f64009400050038923944000000800000008004000000ff0109000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={0xffffffffffffffff, 0x2000000, 0x4, 0x0, &(0x7f0000000600)="c9f7b986", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOC_WATCH_QUEUE_SET_FILTER(0xffffffffffffffff, 0x5761, &(0x7f00000001c0)=ANY=[@ANYRESHEX=r3]) ioctl$RTC_ALM_READ(r5, 0x40187013, &(0x7f0000000080)) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) 1.310695279s ago: executing program 0 (id=89): socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'lo\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, 0x0, &(0x7f0000000340)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x18000000000002a0, 0xe80, 0x6000, &(0x7f0000000640)="b9ff03076844268cb89e14f088a847e088641100050000210283ac141440e0", 0x0, 0x11, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x48) 1.211804196s ago: executing program 1 (id=90): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a3100000000090003007379"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x5c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_EXPR={0x20, 0x11, 0x0, 0x1, @connlimit={{0xe}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_COUNT={0x8, 0x1, 0x1, 0x0, 0xfffff274}]}}}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) syz_emit_ethernet(0x4e, &(0x7f0000000080)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x11, 0x0, 0x3, {[@window={0x3, 0x3}]}}}}}}}}, 0x0) 1.000363196s ago: executing program 1 (id=91): r0 = openat$dir(0xffffffffffffff9c, 0x0, 0x101000, 0x108) mkdirat(r0, &(0x7f0000002000)='./file0\x00', 0x10) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x84022, &(0x7f0000000340)=ANY=[@ANYBLOB='nr_inodes=5,size=4']) 939.751891ms ago: executing program 0 (id=92): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) socket$rds(0x15, 0x5, 0x0) io_submit(0x0, 0x1, &(0x7f0000000500)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x40}]) epoll_create1(0x0) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x50) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x8000) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) removexattr(0x0, &(0x7f0000000000)=@known='security.apparmor\x00') sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) r1 = open(&(0x7f00009e1000)='./file0\x00', 0x448101, 0x0) fcntl$setlease(r1, 0x400, 0x1) fcntl$getflags(r1, 0x401) read$msr(r0, &(0x7f0000019300)=""/102392, 0x18ff8) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, 0x0, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x4001, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) r4 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r4, &(0x7f0000000280)=[{&(0x7f00000005c0)="580000001400192340834b80040d8c560a06ffffff7f070000000000000058000b480400945f64009400050038923944000000800000008004000000ff0109000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r5, 0x2000000, 0x4, 0x0, &(0x7f0000000600)="c9f7b986", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOC_WATCH_QUEUE_SET_FILTER(0xffffffffffffffff, 0x5761, &(0x7f00000001c0)=ANY=[@ANYRESHEX=r3]) ioctl$RTC_ALM_READ(r6, 0x40187013, &(0x7f0000000080)) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) 840.991073ms ago: executing program 4 (id=93): r0 = syz_open_dev$media(&(0x7f0000000040), 0x7fdffffe, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r0, 0x80047c05, 0x0) syz_ublk_setup_io_uring(0x22cf, &(0x7f0000000240)={0x0, 0xd58c, 0x10, 0x3, 0x108}, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, 0x0, 0x1a}, 0x28) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$radio(0x0, 0x3, 0x2) socket(0x2b, 0x1, 0x1) syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x4, 0xf, 0x80000006}, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000000)={0xf010000, 0x0, 0x10000, 0xffffffffffffffff, 0x0, 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0x5, &(0x7f0000000a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@jmp={0x6, 0x0, 0xb, 0x0, 0x0, 0x1, 0x8}, @exit]}, &(0x7f0000000100)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', r3, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r4 = syz_open_dev$usbfs(&(0x7f0000000480), 0x76, 0x160341) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, &(0x7f0000000200)) 840.378887ms ago: executing program 1 (id=94): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='config\x00', 0x1ff) mount(0x0, 0x0, &(0x7f00000000e0)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='config\x00', 0x0, 0x0) r1 = openat(r0, &(0x7f0000000180)='usb_gadget/g1\x00', 0x0, 0x0) r2 = openat(r1, &(0x7f0000000250)='webusb/use\x00', 0x2, 0x0) write(r2, &(0x7f0000000290)='1', 0x1) mkdirat(r1, &(0x7f00000004c0)='functions/Loopback.usb0\x00', 0x1ff) mkdirat(r1, &(0x7f0000000500)='configs/c.1\x00', 0x1ff) r3 = openat(r1, &(0x7f0000000540)='configs/c.1\x00', 0x0, 0x0) symlinkat(&(0x7f0000000680)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', r3, &(0x7f0000000700)='Loopback.usb0\x00') r4 = openat(r1, &(0x7f0000000740)='UDC\x00', 0x2, 0x0) write(r4, &(0x7f0000000780)='usbip-vudc.0\n', 0xd) 122.776042ms ago: executing program 1 (id=95): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) socket$rds(0x15, 0x5, 0x0) io_submit(0x0, 0x1, &(0x7f0000000500)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x40}]) epoll_create1(0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x22d3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) removexattr(0x0, &(0x7f0000000000)=@known='security.apparmor\x00') sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) fcntl$getflags(0xffffffffffffffff, 0x401) read$msr(r0, &(0x7f0000019300)=""/102392, 0x18ff8) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, 0x0, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4001, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) r3 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r3, &(0x7f0000000280)=[{&(0x7f00000005c0)="580000001400192340834b80040d8c560a06ffffff7f070000000000000058000b480400945f64009400050038923944000000800000008004000000ff0109000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r4, 0x2000000, 0x4, 0x0, &(0x7f0000000600)="c9f7b986", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$IOC_WATCH_QUEUE_SET_FILTER(0xffffffffffffffff, 0x5761, &(0x7f00000001c0)=ANY=[@ANYRESHEX=r2]) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) 0s ago: executing program 0 (id=96): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000440)={'veth1_to_hsr\x00', 0x0}) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x4a88, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0xfffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xfffbffff, {0x0, 0x0, 0x0, r1, {0x0, 0x8}, {0xffff, 0xffff}, {0x10, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x4080) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x80402, 0x0) syz_open_procfs(0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$x86(r4, &(0x7f0000c00000/0x400000)=nil) r6 = syz_kvm_add_vcpu$x86(r5, &(0x7f0000000080)={0x0, 0x0}) r7 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_int(r7, 0x29, 0x19, &(0x7f0000000000)=0x84, 0xfde1) sendto$inet6(r7, 0x0, 0x0, 0x200cc0c5, &(0x7f0000000080)={0xa, 0x4c20, 0x0, @loopback={0xff00000000000000}}, 0x1c) sendto$inet6(r7, &(0x7f0000001cc0)="2501d77b330b7e73d6b1d1b8a473ff7420b4b43ce0861f000000714fa228ee1f5b48", 0xfffffffffffffe57, 0x8000, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r6, 0x4008ae90, &(0x7f0000000140)={0x2, 0x0, [{0x40000001, 0x7fff, 0x4, 0x31237648, 0x6, 0x2, 0x80}, {0x40000003, 0x80000000, 0x1, 0xffff, 0xffffffff, 0x5b}]}) ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(r6, 0x4068aea3, &(0x7f00000000c0)={0xc7, 0x0, 0x1}) r8 = syz_open_dev$amidi(&(0x7f0000000140), 0x2, 0x20000) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r8, 0x40045731, &(0x7f0000000000)) r9 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) syz_kvm_setup_syzos_vm$x86(r10, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$x86(r5, &(0x7f0000000080)={0x0, &(0x7f0000000580)=[@rdmsr={0x66, 0x18, {0x40000001}}], 0x18}) ioctl$KVM_RUN(r6, 0xae80, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) r11 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r11, &(0x7f0000000040)={0x0, 0x0, &(0x7f000000d379)={&(0x7f0000000380)={0x18, 0x14, 0x609, 0x0, 0x0, {0x1e}, [@generic="c1"]}, 0x18}}, 0xc044) futex_waitv(&(0x7f0000001640)=[{0x7de, &(0x7f0000000240)=0x7fffffffffffffff, 0x82}, {0x5, &(0x7f0000000280)=0x3, 0x2}, {0x8000000000000001, &(0x7f0000000640), 0x2}, {0x401, &(0x7f0000000680)=0x9, 0x80}, {0x5, &(0x7f00000006c0)=0xfffffffffffffffd, 0x82}, {0xfffffffffffffff9, &(0x7f0000000700)=0x85, 0x82}, {0x5, &(0x7f0000000740)=0x1, 0x2}, {0x7be, &(0x7f0000000780)=0xac7b, 0x82}, {0x8001, &(0x7f00000007c0)=0x8, 0x2}, {0x100000001, &(0x7f0000000800)=0x7, 0xd45305bf8da1abaa}, {0x4, &(0x7f0000000840)=0x1, 0x80}, {0x1, &(0x7f0000000880)=0xa, 0x82}, {0x7, &(0x7f00000008c0), 0x2}, {0x10000, &(0x7f0000000900)=0x3, 0x2}, {0xffffffffffffff8f, &(0x7f0000000940), 0x82}, {0x58, &(0x7f0000000980)=0x46ac, 0x2}, {0x7ff, &(0x7f0000000a80)=0x3, 0x2}, {0x2, &(0x7f0000000ac0)=0x8, 0x2}, {0x1, &(0x7f0000000b00), 0x82}, {0xffff, &(0x7f0000000b40)=0x7, 0x82}, {0x40, &(0x7f0000000b80)=0x7fffffffffffffff, 0x82}, {0xfffffffffffffffa, &(0x7f0000000bc0)=0x99, 0x2}, {0x2, &(0x7f0000000c00)=0x3, 0x82}, {0x2, &(0x7f0000000c40)=0xffffffffffffffff, 0x2}, {0x43, &(0x7f0000000c80)=0x4, 0x3}, {0x8fea, &(0x7f0000000cc0)=0x2, 0x82}, {0xfffffffffffffffd, &(0x7f0000000d00)=0xf, 0x82}, {0x9, &(0x7f0000000d40)=0x8, 0x82}, {0xa, &(0x7f0000000d80)=0x5, 0x2}, {0x401, &(0x7f0000000dc0)=0x2, 0x2}, {0x7, &(0x7f0000000e00)=0x200, 0x2}, {0x1, &(0x7f0000000e40)=0x7fffffffffffffff, 0x82}, {0x7, &(0x7f0000000e80)=0x5, 0x2}, {0x48b, &(0x7f0000000ec0)=0x7667, 0x82}, {0x0, &(0x7f0000000f00)=0x7, 0x82}, {0x0, &(0x7f0000000f40)=0x4, 0x82}, {0x8, &(0x7f0000000f80)=0x2, 0x82}, {0xc3c, &(0x7f0000000fc0)=0x6}, {0x4, &(0x7f0000001000), 0x82}, {0x6655, &(0x7f0000001040)=0x1, 0x2}, {0x40000, &(0x7f0000001080)=0x538b, 0x2}, {0x4, &(0x7f00000010c0)=0xd, 0x6}, {0x9, &(0x7f0000001100)=0x9, 0x82}, {0x0, &(0x7f0000001140)=0xfffffffffffffffb, 0x2}, {0x1, &(0x7f0000001180)=0x3, 0x82}, {0x1, &(0x7f00000011c0)=0xff, 0x2}, {0x8000000000000000, &(0x7f0000001200)=0x7, 0x82}, {0x101, &(0x7f0000001240)=0x9, 0x2}, {0x5, &(0x7f0000001280)=0x5, 0x82}, {0x3, &(0x7f0000001300)=0x8, 0x2}, {0x7, &(0x7f0000001340)=0x4, 0x82}, {0x1d3, &(0x7f0000001380)=0x1, 0x2}, {0x2, &(0x7f00000013c0)=0x6, 0x82}, {0x54, &(0x7f0000001400)=0x1c, 0x82}, {0x0, &(0x7f0000001440)=0x2, 0x2}, {0x0, &(0x7f0000001480)=0x8, 0x2}, {0x7, &(0x7f00000014c0)=0x13, 0x82}, {0x10001, &(0x7f0000001500)=0x2, 0x2}, {0x2, &(0x7f0000001540)=0xfffffffffffffffd, 0x2}, {0x9, &(0x7f0000001580)=0xa, 0x2}, {0x9, &(0x7f00000015c0)=0x7fff, 0x82}, {0x7fff, &(0x7f0000001600)=0x1, 0x82}], 0x3e, 0x0, &(0x7f0000001c40), 0x1) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f00000009c0)={0x84, &(0x7f0000000440)={0x40, 0x31}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(0xffffffffffffffff, 0x0, &(0x7f0000000440)={0x2c, &(0x7f00000002c0)={0x40, 0x15}, 0x0, 0x0, 0x0, 0x0}) kernel console output (not intermixed with test programs): [ 55.129758][ T29] audit: type=1400 audit(1785419212.762:112): avc: denied { write } for pid=5470 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 56.298736][ T29] kauditd_printk_skb: 7 callbacks suppressed [ 56.298752][ T29] audit: type=1400 audit(1785419213.932:120): avc: denied { write } for pid=5526 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 56.479243][ T29] audit: type=1400 audit(1785419214.112:121): avc: denied { write } for pid=5529 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 56.523611][ T29] audit: type=1400 audit(1785419214.152:122): avc: denied { write } for pid=5540 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 56.699023][ T29] audit: type=1400 audit(1785419214.332:123): avc: denied { write } for pid=5543 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 56.750823][ T29] audit: type=1400 audit(1785419214.382:124): avc: denied { write } for pid=5554 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 56.919573][ T29] audit: type=1400 audit(1785419214.552:125): avc: denied { write } for pid=5557 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 56.965808][ T29] audit: type=1400 audit(1785419214.602:126): avc: denied { write } for pid=5568 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 57.303563][ T29] audit: type=1400 audit(1785419214.932:127): avc: denied { write } for pid=5572 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 57.346396][ T29] audit: type=1400 audit(1785419214.982:128): avc: denied { write } for pid=5583 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '10.128.1.47' (ED25519) to the list of known hosts. [ 62.634757][ T29] audit: type=1400 audit(1785419220.272:129): avc: denied { mounton } for pid=5594 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 62.658674][ T29] audit: type=1400 audit(1785419220.292:130): avc: denied { mount } for pid=5594 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 62.661583][ T5594] cgroup: Unknown subsys name 'net' [ 62.688510][ T29] audit: type=1400 audit(1785419220.322:131): avc: denied { unmount } for pid=5594 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 62.846876][ T5594] cgroup: Unknown subsys name 'cpuset' [ 62.854730][ T5594] cgroup: Unknown subsys name 'rlimit' [ 63.013393][ T29] audit: type=1400 audit(1785419220.642:132): avc: denied { setattr } for pid=5594 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=821 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 63.037714][ T29] audit: type=1400 audit(1785419220.642:133): avc: denied { create } for pid=5594 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 63.058475][ T29] audit: type=1400 audit(1785419220.642:134): avc: denied { write } for pid=5594 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 63.080600][ T29] audit: type=1400 audit(1785419220.642:135): avc: denied { read } for pid=5594 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 63.101366][ T29] audit: type=1400 audit(1785419220.672:136): avc: denied { mounton } for pid=5594 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 63.133911][ T29] audit: type=1400 audit(1785419220.672:137): avc: denied { mount } for pid=5594 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 63.164837][ T5596] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 63.174099][ T29] audit: type=1400 audit(1785419220.802:138): avc: denied { relabelto } for pid=5596 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 64.189938][ T5594] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 66.441408][ T5615] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 66.448742][ T5612] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 66.457279][ T5612] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 66.466176][ T5626] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 66.471113][ T5612] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 66.479819][ T5615] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 66.481830][ T5612] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 66.488266][ T5626] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 66.495757][ T5612] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 66.502927][ T5615] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 66.517407][ T5629] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 66.525611][ T5612] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 66.526285][ T5615] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 66.534385][ T5629] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 66.540421][ T5626] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 66.553196][ T5612] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 66.555270][ T5626] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 66.563293][ T5629] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 66.568782][ T5626] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 66.576304][ T5612] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 66.583503][ T5615] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 66.591474][ T5629] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 66.599361][ T5615] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 66.610875][ T5626] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 66.619227][ T5623] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 67.539760][ T5606] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.546954][ T5606] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.554128][ T5606] bridge_slave_0: entered allmulticast mode [ 67.561054][ T5606] bridge_slave_0: entered promiscuous mode [ 67.572757][ T5606] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.580002][ T5606] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.587275][ T5606] bridge_slave_1: entered allmulticast mode [ 67.593915][ T5606] bridge_slave_1: entered promiscuous mode [ 67.646639][ T5606] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 67.674153][ T5606] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 67.752155][ T5606] team0: Port device team_slave_0 added [ 67.779636][ T5606] team0: Port device team_slave_1 added [ 67.846279][ T5606] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 67.853272][ T5606] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.881722][ T5606] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 67.916292][ T5606] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 67.923595][ T5606] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.950834][ T5606] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 68.087775][ T5606] hsr_slave_0: entered promiscuous mode [ 68.094621][ T5606] hsr_slave_1: entered promiscuous mode [ 68.111116][ T5610] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.118536][ T5610] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.125737][ T5610] bridge_slave_0: entered allmulticast mode [ 68.132441][ T5610] bridge_slave_0: entered promiscuous mode [ 68.160303][ T5610] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.167537][ T5610] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.174689][ T5610] bridge_slave_1: entered allmulticast mode [ 68.181366][ T5610] bridge_slave_1: entered promiscuous mode [ 68.211834][ T5609] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.219060][ T5609] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.226604][ T5609] bridge_slave_0: entered allmulticast mode [ 68.233338][ T5609] bridge_slave_0: entered promiscuous mode [ 68.263808][ T5609] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.271059][ T5609] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.278254][ T5609] bridge_slave_1: entered allmulticast mode [ 68.285020][ T5609] bridge_slave_1: entered promiscuous mode [ 68.298052][ T5610] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.307254][ T5608] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.314640][ T5608] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.321763][ T5608] bridge_slave_0: entered allmulticast mode [ 68.328548][ T5608] bridge_slave_0: entered promiscuous mode [ 68.353302][ T5610] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 68.362499][ T5608] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.369723][ T5608] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.376878][ T5608] bridge_slave_1: entered allmulticast mode [ 68.383639][ T5608] bridge_slave_1: entered promiscuous mode [ 68.429777][ T5609] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.456526][ T5607] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.463712][ T5607] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.470964][ T5607] bridge_slave_0: entered allmulticast mode [ 68.478291][ T5607] bridge_slave_0: entered promiscuous mode [ 68.487019][ T5609] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 68.501947][ T5610] team0: Port device team_slave_0 added [ 68.509811][ T5608] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.519153][ T5607] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.526324][ T5607] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.533445][ T5607] bridge_slave_1: entered allmulticast mode [ 68.540226][ T5607] bridge_slave_1: entered promiscuous mode [ 68.560161][ T5610] team0: Port device team_slave_1 added [ 68.567551][ T5608] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 68.627156][ T5609] team0: Port device team_slave_0 added [ 68.635180][ T5624] Bluetooth: hci2: command tx timeout [ 68.635182][ T5611] Bluetooth: hci1: command tx timeout [ 68.639198][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 68.653017][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 68.679042][ T5610] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 68.691447][ T5608] team0: Port device team_slave_0 added [ 68.699502][ T5607] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.711013][ T5609] team0: Port device team_slave_1 added [ 68.716983][ T5624] Bluetooth: hci3: command tx timeout [ 68.717083][ T5624] Bluetooth: hci0: command tx timeout [ 68.717134][ T5624] Bluetooth: hci4: command tx timeout [ 68.732461][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 68.740842][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 68.766763][ T5610] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 68.778885][ T5608] team0: Port device team_slave_1 added [ 68.786234][ T5607] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 68.863348][ T5609] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 68.870423][ T5609] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 68.896612][ T5609] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 68.908614][ T5609] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 68.915844][ T5609] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 68.941819][ T5609] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 68.958996][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 68.966131][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 68.993101][ T5608] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.005914][ T5607] team0: Port device team_slave_0 added [ 69.030123][ T5610] hsr_slave_0: entered promiscuous mode [ 69.036235][ T5610] hsr_slave_1: entered promiscuous mode [ 69.042193][ T5610] debugfs: 'hsr0' already exists in 'hsr' [ 69.048149][ T5610] Cannot create hsr debugfs directory [ 69.055052][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.062011][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.087936][ T5608] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.100032][ T5607] team0: Port device team_slave_1 added [ 69.156239][ T5609] hsr_slave_0: entered promiscuous mode [ 69.162269][ T5609] hsr_slave_1: entered promiscuous mode [ 69.168384][ T5609] debugfs: 'hsr0' already exists in 'hsr' [ 69.174093][ T5609] Cannot create hsr debugfs directory [ 69.187512][ T5607] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.194714][ T5607] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.220633][ T5607] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.254553][ T5607] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.261520][ T5607] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.287405][ T5607] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.360178][ T5608] hsr_slave_0: entered promiscuous mode [ 69.366323][ T5608] hsr_slave_1: entered promiscuous mode [ 69.372185][ T5608] debugfs: 'hsr0' already exists in 'hsr' [ 69.378272][ T5608] Cannot create hsr debugfs directory [ 69.401674][ T5606] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 69.412766][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 69.443901][ T5606] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 69.453955][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 69.465262][ T5607] hsr_slave_0: entered promiscuous mode [ 69.471428][ T5607] hsr_slave_1: entered promiscuous mode [ 69.477604][ T5607] debugfs: 'hsr0' already exists in 'hsr' [ 69.483345][ T5607] Cannot create hsr debugfs directory [ 69.511220][ T5606] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 69.520769][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 69.528711][ T5606] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 69.537481][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 69.769287][ T5610] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 69.778892][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 69.786787][ T5610] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 69.797098][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 69.805389][ T5610] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 69.814483][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 69.837471][ T5610] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 69.847502][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 69.917552][ T5609] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 69.929571][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 69.938402][ T5609] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 69.947951][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 69.961939][ T5609] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 69.971482][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 69.979461][ T5609] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 69.988933][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 70.034946][ T5606] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.086073][ T5606] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.106412][ T5608] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 70.115595][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 70.123395][ T5608] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 70.133293][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 70.149024][ T5608] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 70.158903][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 70.168884][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.176433][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.186344][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.193410][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.209363][ T5608] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 70.219723][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 70.307808][ T5607] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 70.319106][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 70.328170][ T5607] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 70.337720][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 70.346321][ T5607] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 70.355907][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 70.363578][ T5607] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 70.373021][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 70.391581][ T5610] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.458091][ T5610] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.487287][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.494450][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.510516][ T5609] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.533418][ T1051] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.540605][ T1051] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.590460][ T5609] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.613418][ T1051] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.620515][ T1051] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.648391][ T5608] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.662907][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.670015][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.714480][ T5615] Bluetooth: hci1: command tx timeout [ 70.720667][ T5624] Bluetooth: hci2: command tx timeout [ 70.752391][ T5608] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.778370][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.785552][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.795871][ T5624] Bluetooth: hci4: command tx timeout [ 70.801992][ T5611] Bluetooth: hci3: command tx timeout [ 70.804388][ T5615] Bluetooth: hci0: command tx timeout [ 70.838590][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.845826][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.861550][ T5607] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.941602][ T5607] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.984094][ T1167] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.991269][ T1167] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.024512][ T5606] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.039650][ T1167] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.042483][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.046795][ T1167] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.063352][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.242308][ T5606] veth0_vlan: entered promiscuous mode [ 71.268855][ T5606] veth1_vlan: entered promiscuous mode [ 71.382261][ T5606] veth0_macvtap: entered promiscuous mode [ 71.410327][ T5606] veth1_macvtap: entered promiscuous mode [ 71.458563][ T5606] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.492350][ T5606] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.517137][ T5610] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.577509][ T1051] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.615859][ T1051] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.634970][ T1051] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.666605][ T1051] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.720604][ T5609] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.913000][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.925415][ T5609] veth0_vlan: entered promiscuous mode [ 71.940719][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.029762][ T5607] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.037131][ T5609] veth1_vlan: entered promiscuous mode [ 72.050927][ T1051] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.054020][ T5608] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.063510][ T1051] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.084128][ T29] kauditd_printk_skb: 13 callbacks suppressed [ 72.084143][ T29] audit: type=1400 audit(1785419229.712:152): avc: denied { mounton } for pid=5606 comm="syz-executor" path="/root/syzkaller.FMA8qZ/syz-tmp" dev="sda1" ino=2042 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 72.107844][ T5607] veth0_vlan: entered promiscuous mode [ 72.137777][ T29] audit: type=1400 audit(1785419229.752:153): avc: denied { mount } for pid=5606 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 72.172042][ T29] audit: type=1400 audit(1785419229.752:154): avc: denied { mounton } for pid=5606 comm="syz-executor" path="/root/syzkaller.FMA8qZ/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 72.212070][ T5606] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 72.226534][ T5607] veth1_vlan: entered promiscuous mode [ 72.229465][ T29] audit: type=1400 audit(1785419229.752:155): avc: denied { mount } for pid=5606 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 72.239252][ T5610] veth0_vlan: entered promiscuous mode [ 72.260937][ T29] audit: type=1400 audit(1785419229.752:156): avc: denied { mounton } for pid=5606 comm="syz-executor" path="/root/syzkaller.FMA8qZ/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 72.271312][ T5609] veth0_macvtap: entered promiscuous mode [ 72.290052][ T29] audit: type=1400 audit(1785419229.762:157): avc: denied { mounton } for pid=5606 comm="syz-executor" path="/root/syzkaller.FMA8qZ/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=7529 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 72.321208][ T29] audit: type=1400 audit(1785419229.762:158): avc: denied { unmount } for pid=5606 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 72.342964][ T29] audit: type=1400 audit(1785419229.802:159): avc: denied { mounton } for pid=5606 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2784 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 72.368046][ T29] audit: type=1400 audit(1785419229.802:160): avc: denied { mount } for pid=5606 comm="syz-executor" name="/" dev="gadgetfs" ino=7532 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 72.375064][ T5608] veth0_vlan: entered promiscuous mode [ 72.396254][ T29] audit: type=1400 audit(1785419229.802:161): avc: denied { mount } for pid=5606 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 72.414316][ T5607] veth0_macvtap: entered promiscuous mode [ 72.436971][ T5609] veth1_macvtap: entered promiscuous mode [ 72.465656][ T5610] veth1_vlan: entered promiscuous mode [ 72.472646][ T5607] veth1_macvtap: entered promiscuous mode [ 72.504172][ T5608] veth1_vlan: entered promiscuous mode [ 72.528128][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.563269][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.597633][ T36] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.609894][ T5607] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.632250][ T36] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.641773][ T36] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.659213][ T5801] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 72.662528][ T5607] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.694145][ T5801] CIFS: Attempting to mount //127.0.0.1/share [ 72.698091][ T36] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.721520][ T5801] CIFS: VFS: Error connecting to socket. Aborting operation. [ 72.729196][ T5801] CIFS: VFS: cifs_mount failed w/return code = -111 [ 72.732140][ T5610] veth0_macvtap: entered promiscuous mode [ 72.746276][ T5608] veth0_macvtap: entered promiscuous mode [ 72.759213][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.768874][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.778031][ T5610] veth1_macvtap: entered promiscuous mode [ 72.794961][ T5615] Bluetooth: hci2: command tx timeout [ 72.795100][ T5624] Bluetooth: hci1: command tx timeout [ 72.807776][ T5608] veth1_macvtap: entered promiscuous mode [ 72.822783][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.832471][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.874946][ T5624] Bluetooth: hci4: command tx timeout [ 72.875011][ T5615] Bluetooth: hci3: command tx timeout [ 72.880357][ T5611] Bluetooth: hci0: command tx timeout [ 72.886942][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.902367][ T168] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.914879][ T168] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.941513][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.967633][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.999852][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.010857][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 73.028148][ T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.038364][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.056626][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.057076][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.067476][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.076049][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.096241][ T168] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.105261][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.109936][ T168] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.125593][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.160294][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.251025][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.261488][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.287797][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.313630][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.460101][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.488174][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.533189][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.567168][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.658874][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.679201][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.775408][ T5711] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 74.874992][ T5615] Bluetooth: hci1: command tx timeout [ 74.878686][ T5624] Bluetooth: hci2: command tx timeout [ 74.954919][ T5624] Bluetooth: hci4: command tx timeout [ 74.955246][ T5615] Bluetooth: hci0: command tx timeout [ 74.960427][ T5611] Bluetooth: hci3: command tx timeout [ 74.969803][ T5711] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 75.010501][ T5711] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 75.049444][ T5711] usb 2-1: New USB device found, idVendor=0489, idProduct=e057, bcdDevice= 0.00 [ 75.093143][ T5711] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 75.157963][ T5711] usb 2-1: config 0 descriptor?? [ 75.500526][ T5711] Bluetooth: Can't get state to change to load ram patch err [ 75.521622][ T5711] Bluetooth: Loading patch file failed [ 75.536206][ T5711] ath3k 2-1:0.0: probe with driver ath3k failed with error -121 [ 75.589178][ T5823] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8'. [ 75.817601][ T5830] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3'. [ 76.482453][ T5844] netlink: 'syz.4.12': attribute type 10 has an invalid length. [ 76.583900][ T5844] netlink: 40 bytes leftover after parsing attributes in process `syz.4.12'. [ 76.654076][ T5844] dummy0: entered promiscuous mode [ 76.655421][ T5845] netlink: 20 bytes leftover after parsing attributes in process `syz.4.12'. [ 76.774980][ T5844] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1025 sclass=netlink_route_socket pid=5844 comm=syz.4.12 [ 77.967762][ T5845] team0 (unregistering): Port device team_slave_0 removed [ 78.018774][ T5845] team0 (unregistering): Port device team_slave_1 removed [ 78.032249][ T5711] usb 2-1: USB disconnect, device number 2 [ 78.069265][ T29] kauditd_printk_skb: 39 callbacks suppressed [ 78.069282][ T29] audit: type=1400 audit(1785419235.702:201): avc: denied { create } for pid=5859 comm="syz.3.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 78.421170][ T29] audit: type=1400 audit(1785419235.742:202): avc: denied { map_create } for pid=5859 comm="syz.3.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 78.469629][ T29] audit: type=1400 audit(1785419235.742:203): avc: denied { map_read map_write } for pid=5859 comm="syz.3.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 78.566179][ T29] audit: type=1400 audit(1785419235.952:204): avc: denied { read write } for pid=5859 comm="syz.3.17" name="rtc0" dev="devtmpfs" ino=922 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 78.676685][ T29] audit: type=1400 audit(1785419235.952:205): avc: denied { open } for pid=5859 comm="syz.3.17" path="/dev/rtc0" dev="devtmpfs" ino=922 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 78.703466][ T29] audit: type=1400 audit(1785419235.972:206): avc: denied { ioctl } for pid=5859 comm="syz.3.17" path="/dev/rtc0" dev="devtmpfs" ino=922 ioctlcmd=0x7013 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 78.728556][ T24] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 79.168304][ T29] audit: type=1400 audit(1785419235.982:207): avc: denied { write } for pid=5859 comm="syz.3.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 79.189358][ T29] audit: type=1400 audit(1785419236.002:208): avc: denied { mount } for pid=5859 comm="syz.3.17" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 79.250171][ T29] audit: type=1400 audit(1785419236.082:209): avc: denied { unmount } for pid=5610 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 79.321937][ T29] audit: type=1400 audit(1785419236.852:210): avc: denied { mount } for pid=5864 comm="syz.0.19" name="/" dev="configfs" ino=44 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 79.485733][ T24] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 79.516488][ T24] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 80.268691][ T9] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 80.351336][ T24] usb 3-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 80.361552][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 80.369711][ T24] usb 3-1: Product: syz [ 80.374812][ T24] usb 3-1: Manufacturer: syz [ 80.379488][ T24] usb 3-1: SerialNumber: syz [ 80.961472][ T5858] netlink: 16 bytes leftover after parsing attributes in process `syz.2.16'. [ 80.976758][ T9] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 80.988612][ T9] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 81.003303][ T9] usb 5-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 81.013466][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 81.024497][ T9] usb 5-1: Product: syz [ 81.031322][ T9] usb 5-1: Manufacturer: syz [ 81.054099][ T9] usb 5-1: SerialNumber: syz [ 81.613220][ T5879] netlink: 16 bytes leftover after parsing attributes in process `syz.4.23'. [ 83.395121][ T24] usb 3-1: USB disconnect, device number 2 [ 83.430563][ T29] kauditd_printk_skb: 30 callbacks suppressed [ 83.430580][ T29] audit: type=1400 audit(1785419241.062:241): avc: denied { create } for pid=5916 comm="syz.0.30" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 83.473097][ T29] audit: type=1400 audit(1785419241.092:242): avc: denied { connect } for pid=5916 comm="syz.0.30" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 83.513475][ T5625] udevd[5625]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 83.549690][ T29] audit: type=1400 audit(1785419241.092:243): avc: denied { write } for pid=5916 comm="syz.0.30" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 83.613206][ T9] usb 5-1: USB disconnect, device number 2 [ 84.239948][ T5627] udevd[5627]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 84.574461][ T29] audit: type=1400 audit(1785419242.202:244): avc: denied { write } for pid=5916 comm="syz.0.30" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 86.423179][ T2173] cfg80211: failed to load regulatory.db [ 86.604329][ T9] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 86.720888][ T29] audit: type=1400 audit(1785419244.352:245): avc: denied { remount } for pid=5956 comm="syz.4.39" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 86.829179][ T9] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 86.850626][ T9] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 86.873571][ T9] usb 3-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 86.886824][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 86.903145][ T9] usb 3-1: Product: syz [ 86.919527][ T9] usb 3-1: Manufacturer: syz [ 86.935376][ T9] usb 3-1: SerialNumber: syz [ 87.112530][ T29] audit: type=1400 audit(1785419244.742:246): avc: denied { mount } for pid=5961 comm="syz.3.41" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 87.166445][ T29] audit: type=1400 audit(1785419244.752:247): avc: denied { write } for pid=5963 comm="syz.1.42" name="functions" dev="configfs" ino=8921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 87.223398][ T5962] loop0: detected capacity change from 0 to 32768 [ 87.549490][ T5962] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 87.681055][ T29] audit: type=1400 audit(1785419245.312:248): avc: denied { unmount } for pid=5607 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 87.986091][ T9] usb 3-1: USB disconnect, device number 3 [ 88.325032][ T5920] udevd[5920]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 88.940755][ T29] audit: type=1400 audit(1785419246.562:249): avc: denied { create } for pid=5987 comm="syz.4.47" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 89.279597][ T29] audit: type=1400 audit(1785419246.562:250): avc: denied { write } for pid=5987 comm="syz.4.47" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 89.374687][ T9] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 89.382923][ T5733] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 89.536393][ T29] audit: type=1400 audit(1785419247.162:251): avc: denied { create } for pid=5997 comm="syz.3.50" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 89.556353][ T5733] usb 3-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 89.567566][ T9] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 89.578567][ T5733] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 89.586664][ T9] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 89.601135][ T29] audit: type=1400 audit(1785419247.232:252): avc: denied { bind } for pid=5997 comm="syz.3.50" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 89.645299][ T9] usb 2-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 89.646070][ T6001] netlink: 8 bytes leftover after parsing attributes in process `syz.4.51'. [ 89.656456][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.685007][ T29] audit: type=1400 audit(1785419247.252:253): avc: denied { listen } for pid=5997 comm="syz.3.50" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 89.707422][ T9] usb 2-1: Product: syz [ 89.724104][ T9] usb 2-1: Manufacturer: syz [ 89.729156][ T9] usb 2-1: SerialNumber: syz [ 89.733951][ T29] audit: type=1400 audit(1785419247.252:254): avc: denied { connect } for pid=5997 comm="syz.3.50" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 89.783831][ T29] audit: type=1400 audit(1785419247.282:255): avc: denied { accept } for pid=5997 comm="syz.3.50" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 89.809622][ T29] audit: type=1400 audit(1785419247.282:256): avc: denied { read } for pid=5997 comm="syz.3.50" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 89.829150][ T29] audit: type=1400 audit(1785419247.352:257): avc: denied { unmount } for pid=5609 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 90.203791][ T5991] netlink: 16 bytes leftover after parsing attributes in process `syz.1.48'. [ 90.545557][ T2173] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 90.695104][ T5733] cxacru 3-1:1.0: invalid response length to cm 0x84: 0 [ 90.708413][ T5733] ATM dev 0: cxacru_atm_start: CHIP_ADSL_LINE_START returned -5 [ 90.835836][ T2173] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 90.868192][ T2173] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 90.894756][ T5733] ATM dev 0: ADSL state: running [ 90.897585][ T2173] usb 4-1: New USB device found, idVendor=0489, idProduct=e057, bcdDevice= 0.00 [ 90.901031][ T5733] ATM dev 0: ADSL line: down [ 90.926760][ T9] usb 2-1: USB disconnect, device number 3 [ 90.939015][ T2173] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 90.992731][ T2173] usb 4-1: config 0 descriptor?? [ 91.055502][ T6021] CIFS: Attempting to mount //127.0.0.1/share [ 91.078380][ T6021] CIFS: VFS: Error connecting to socket. Aborting operation. [ 91.090659][ T6021] CIFS: VFS: cifs_mount failed w/return code = -111 [ 91.227890][ T2173] Bluetooth: Can't get state to change to load ram patch err [ 91.236086][ T2173] Bluetooth: Loading patch file failed [ 91.241663][ T2173] ath3k 4-1:0.0: probe with driver ath3k failed with error -121 [ 92.736901][ T5733] usb 4-1: USB disconnect, device number 2 [ 92.831830][ T2173] usb 3-1: USB disconnect, device number 4 [ 94.157825][ T29] kauditd_printk_skb: 7 callbacks suppressed [ 94.157841][ T29] audit: type=1400 audit(1785419251.792:261): avc: denied { mount } for pid=6039 comm="syz.4.64" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 94.195999][ T5625] FAULT_INJECTION: forcing a failure. [ 94.195999][ T5625] name failslab, interval 1, probability 1, space 0, times 1 [ 94.197547][ T6041] FAULT_INJECTION: forcing a failure. [ 94.197547][ T6041] name failslab, interval 1, probability 1, space 0, times 1 [ 94.208868][ T5625] CPU: 1 UID: 0 PID: 5625 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) [ 94.208894][ T5625] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 94.208903][ T5625] Call Trace: [ 94.208911][ T5625] [ 94.208918][ T5625] dump_stack_lvl+0x100/0x190 [ 94.208945][ T5625] should_fail_ex.cold+0x5/0xa [ 94.208967][ T5625] should_failslab+0xc2/0x120 [ 94.208987][ T5625] __kmalloc_noprof+0xfc/0x820 [ 94.209005][ T5625] ? rcu_is_watching+0x12/0xc0 [ 94.209029][ T5625] ? tomoyo_realpath_from_path+0xb6/0x690 [ 94.209050][ T5625] tomoyo_realpath_from_path+0xb6/0x690 [ 94.209070][ T5625] tomoyo_path_number_perm+0x23c/0x580 [ 94.209091][ T5625] ? tomoyo_path_number_perm+0x22e/0x580 [ 94.209114][ T5625] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 94.209144][ T5625] ? __lock_acquire+0x49f/0x1a40 [ 94.209173][ T5625] ? current_check_access_path+0x269/0x430 [ 94.209195][ T5625] ? __pfx_current_check_access_path+0x10/0x10 [ 94.209217][ T5625] ? d_alloc_parallel+0x9ed/0x14b0 [ 94.209245][ T5625] tomoyo_path_mknod+0x164/0x190 [ 94.209262][ T5625] ? __pfx_tomoyo_path_mknod+0x10/0x10 [ 94.209281][ T5625] ? __d_lookup+0x25c/0x4a0 [ 94.209301][ T5625] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 94.209324][ T5625] security_path_mknod+0x161/0x300 [ 94.209343][ T5625] may_o_create+0x30/0x3a0 [ 94.209368][ T5625] path_openat+0x2e42/0x4280 [ 94.209393][ T5625] ? __pfx_path_openat+0x10/0x10 [ 94.209415][ T5625] do_file_open+0x20e/0x430 [ 94.209433][ T5625] ? __pfx_do_file_open+0x10/0x10 [ 94.209465][ T5625] ? alloc_fd+0x471/0x7a0 [ 94.209484][ T5625] ? do_getname+0x191/0x390 [ 94.209505][ T5625] do_sys_openat2+0x10f/0x1e0 [ 94.209526][ T5625] ? __pfx_do_sys_openat2+0x10/0x10 [ 94.209553][ T5625] __x64_sys_openat+0x12d/0x210 [ 94.209572][ T5625] ? __pfx___x64_sys_openat+0x10/0x10 [ 94.209600][ T5625] do_syscall_64+0x115/0x870 [ 94.209618][ T5625] ? clear_bhb_loop+0x40/0x90 [ 94.209637][ T5625] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.209653][ T5625] RIP: 0033:0x7f2efb4a7407 [ 94.209667][ T5625] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 94.209681][ T5625] RSP: 002b:00007fff2d772520 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 94.209702][ T5625] RAX: ffffffffffffffda RBX: 00007f2efbbfc880 RCX: 00007f2efb4a7407 [ 94.209712][ T5625] RDX: 0000000000080241 RSI: 00007fff2d772a80 RDI: ffffffffffffff9c [ 94.209721][ T5625] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000 [ 94.209729][ T5625] R10: 00000000000001b6 R11: 0000000000000202 R12: 00005597d5182dfc [ 94.209739][ T5625] R13: 00005597d5182dfc R14: 0000000000000001 R15: 00005597d519d140 [ 94.209759][ T5625] [ 94.209766][ T5625] ERROR: Out of memory at tomoyo_realpath_from_path. [ 94.528405][ T6046] FAULT_INJECTION: forcing a failure. [ 94.528405][ T6046] name failslab, interval 1, probability 1, space 0, times 10 [ 94.534388][ T6041] CPU: 0 UID: 0 PID: 6041 Comm: syz.4.64 Not tainted syzkaller #0 PREEMPT(full) [ 94.534412][ T6041] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 94.534422][ T6041] Call Trace: [ 94.534429][ T6041] [ 94.534435][ T6041] dump_stack_lvl+0x100/0x190 [ 94.534461][ T6041] should_fail_ex.cold+0x5/0xa [ 94.534482][ T6041] should_failslab+0xc2/0x120 [ 94.534505][ T6041] __kmalloc_cache_noprof+0x91/0x6c0 [ 94.534532][ T6041] ? __lock_acquire+0x49f/0x1a40 [ 94.534552][ T6041] ? tty_open+0x139/0xfa0 [ 94.534575][ T6041] ? __pfx_tty_open+0x10/0x10 [ 94.534594][ T6041] tty_open+0x139/0xfa0 [ 94.534618][ T6041] ? __pfx_tty_open+0x10/0x10 [ 94.534636][ T6041] ? chrdev_open+0x589/0x6a0 [ 94.534652][ T6041] ? chrdev_open+0x589/0x6a0 [ 94.534671][ T6041] ? __pfx_tty_open+0x10/0x10 [ 94.534689][ T6041] chrdev_open+0x234/0x6a0 [ 94.534707][ T6041] ? __pfx_chrdev_open+0x10/0x10 [ 94.534725][ T6041] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 94.534749][ T6041] do_dentry_open+0x6ab/0x14d0 [ 94.534764][ T6041] ? __pfx_chrdev_open+0x10/0x10 [ 94.534785][ T6041] vfs_open+0x82/0x3f0 [ 94.534807][ T6041] path_openat+0x2873/0x4280 [ 94.534833][ T6041] ? __pfx_path_openat+0x10/0x10 [ 94.534855][ T6041] do_file_open+0x20e/0x430 [ 94.534873][ T6041] ? __pfx_do_file_open+0x10/0x10 [ 94.534905][ T6041] ? alloc_fd+0x471/0x7a0 [ 94.534924][ T6041] ? do_getname+0x191/0x390 [ 94.534948][ T6041] do_sys_openat2+0x10f/0x1e0 [ 94.534968][ T6041] ? __pfx_do_sys_openat2+0x10/0x10 [ 94.534988][ T6041] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 94.535013][ T6041] __x64_sys_openat+0x12d/0x210 [ 94.535041][ T6041] ? __pfx___x64_sys_openat+0x10/0x10 [ 94.535068][ T6041] do_syscall_64+0x115/0x870 [ 94.535086][ T6041] ? clear_bhb_loop+0x40/0x90 [ 94.535111][ T6041] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.535127][ T6041] RIP: 0033:0x7f0e41b9df99 [ 94.535142][ T6041] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.535157][ T6041] RSP: 002b:00007f0e42a89028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 94.535173][ T6041] RAX: ffffffffffffffda RBX: 00007f0e41e25fa0 RCX: 00007f0e41b9df99 [ 94.535183][ T6041] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: ffffffffffffff9c [ 94.535193][ T6041] RBP: 00007f0e41c34ec4 R08: 0000000000000000 R09: 0000000000000000 [ 94.535202][ T6041] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.535211][ T6041] R13: 00007f0e41e26038 R14: 00007f0e41e25fa0 R15: 00007ffe421c94a8 [ 94.535232][ T6041] [ 94.576133][ T1051] FAULT_INJECTION: forcing a failure. [ 94.576133][ T1051] name failslab, interval 1, probability 1, space 0, times 8 [ 94.576936][ T57] FAULT_INJECTION: forcing a failure. [ 94.576936][ T57] name failslab, interval 1, probability 1, space 0, times 8 [ 94.591726][ T1051] CPU: 0 UID: 0 PID: 1051 Comm: kworker/u8:7 Not tainted syzkaller #0 PREEMPT(full) [ 94.591750][ T1051] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 94.591761][ T1051] Workqueue: writeback wb_workfn (flush-8:0) [ 94.591784][ T1051] Call Trace: [ 94.591789][ T1051] [ 94.591795][ T1051] dump_stack_lvl+0x100/0x190 [ 94.591816][ T1051] should_fail_ex.cold+0x5/0xa [ 94.591836][ T1051] should_failslab+0xc2/0x120 [ 94.591857][ T1051] kmem_cache_alloc_noprof+0x91/0x6a0 [ 94.591876][ T1051] ? ext4_init_io_end+0x24/0x170 [ 94.591900][ T1051] ext4_init_io_end+0x24/0x170 [ 94.591919][ T1051] ext4_do_writepages+0x9cf/0x3ed0 [ 94.591935][ T1051] ? mark_held_locks+0x40/0x70 [ 94.591969][ T1051] ? __pfx_ext4_do_writepages+0x10/0x10 [ 94.592001][ T1051] ? ext4_writepages+0x347/0x750 [ 94.592015][ T1051] ext4_writepages+0x347/0x750 [ 94.592032][ T1051] ? __pfx_ext4_writepages+0x10/0x10 [ 94.592054][ T1051] ? do_writepages+0x4b5/0x600 [ 94.592072][ T1051] ? do_writepages+0x4b5/0x600 [ 94.592092][ T1051] ? __pfx_ext4_writepages+0x10/0x10 [ 94.592114][ T1051] do_writepages+0x278/0x600 [ 94.592134][ T1051] ? __pfx_do_writepages+0x10/0x10 [ 94.592157][ T1051] __writeback_single_inode+0x164/0x1300 [ 94.592182][ T1051] ? find_held_lock+0x2b/0x80 [ 94.592208][ T1051] ? __pfx___writeback_single_inode+0x10/0x10 [ 94.592232][ T1051] ? do_raw_spin_unlock+0x145/0x1e0 [ 94.592258][ T1051] writeback_sb_inodes+0x766/0x1c50 [ 94.592292][ T1051] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 94.592343][ T1051] ? _raw_spin_unlock+0x28/0x50 [ 94.592367][ T1051] ? move_expired_inodes+0x5ea/0x8f0 [ 94.592394][ T1051] __writeback_inodes_wb+0xf8/0x2d0 [ 94.592422][ T1051] ? __pfx___writeback_inodes_wb+0x10/0x10 [ 94.592446][ T1051] ? queue_io+0x287/0x530 [ 94.592468][ T1051] wb_writeback+0x6f6/0xb50 [ 94.592488][ T1051] ? __pfx_wb_writeback+0x10/0x10 [ 94.592506][ T1051] ? get_nr_inodes+0x100/0x150 [ 94.592525][ T1051] ? _raw_spin_unlock_irq+0x23/0x50 [ 94.592542][ T1051] wb_workfn+0x93f/0xc80 [ 94.592559][ T1051] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 94.592575][ T1051] ? __pfx_wb_workfn+0x10/0x10 [ 94.592597][ T1051] ? rcu_is_watching+0x12/0xc0 [ 94.592624][ T1051] process_one_work+0xa23/0x1940 [ 94.592651][ T1051] ? __pfx_process_one_work+0x10/0x10 [ 94.592674][ T1051] ? __pfx_wb_workfn+0x10/0x10 [ 94.592691][ T1051] worker_thread+0x5ef/0xe50 [ 94.592717][ T1051] ? kthread+0x13a/0x450 [ 94.592730][ T1051] ? __pfx_worker_thread+0x10/0x10 [ 94.592745][ T1051] kthread+0x370/0x450 [ 94.592759][ T1051] ? __pfx_kthread+0x10/0x10 [ 94.592776][ T1051] ret_from_fork+0x72b/0xd50 [ 94.592799][ T1051] ? __pfx_ret_from_fork+0x10/0x10 [ 94.592820][ T1051] ? __switch_to+0x800/0x10f0 [ 94.592838][ T1051] ? __pfx_kthread+0x10/0x10 [ 94.592854][ T1051] ret_from_fork_asm+0x1a/0x30 [ 94.592891][ T1051] [ 94.593321][ T29] audit: type=1400 audit(1785419252.162:262): avc: denied { create } for pid=6039 comm="syz.4.64" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 94.598973][ T4966] FAULT_INJECTION: forcing a failure. [ 94.598973][ T4966] name failslab, interval 1, probability 1, space 0, times 7 [ 94.644404][ T6046] CPU: 0 UID: 0 PID: 6046 Comm: syz.0.65 Not tainted syzkaller #0 PREEMPT(full) [ 94.644429][ T6046] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 94.644439][ T6046] Call Trace: [ 94.644446][ T6046] [ 94.644452][ T6046] dump_stack_lvl+0x100/0x190 [ 94.644479][ T6046] should_fail_ex.cold+0x5/0xa [ 94.644501][ T6046] should_failslab+0xc2/0x120 [ 94.644524][ T6046] __kmalloc_flags_noprof+0x122/0x8b0 [ 94.644555][ T6046] ? alloc_slab_obj_exts+0x5a/0x160 [ 94.644575][ T6046] alloc_slab_obj_exts+0x5a/0x160 [ 94.644593][ T6046] __memcg_slab_post_alloc_hook+0x3d4/0x1160 [ 94.644625][ T6046] ? kasan_save_track+0x14/0x30 [ 94.644645][ T6046] kmem_cache_alloc_noprof+0x587/0x6a0 [ 94.644665][ T6046] ? fib_insert_alias+0x43e/0xe30 [ 94.644692][ T6046] fib_insert_alias+0x43e/0xe30 [ 94.644716][ T6046] ? lockdep_rtnl_is_held+0x26/0x40 [ 94.644732][ T6046] ? fib_find_node+0x209/0x280 [ 94.644755][ T6046] fib_trie_unmerge+0x289/0xbd0 [ 94.644783][ T6046] ? __pfx_fib_trie_unmerge+0x10/0x10 [ 94.644807][ T6046] ? __pfx___mutex_lock+0x10/0x10 [ 94.644833][ T6046] fib_unmerge+0xee/0x510 [ 94.644849][ T6046] ? netdev_name_node_lookup+0x107/0x150 [ 94.644868][ T6046] fib4_rule_configure+0x383/0x10c0 [ 94.644892][ T6046] fib_newrule+0x356/0x1ed0 [ 94.644919][ T6046] ? __ww_mutex_check_waiters+0x81/0x440 [ 94.644940][ T6046] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 94.644959][ T6046] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 94.644979][ T6046] ? __pfx_fib_newrule+0x10/0x10 [ 94.645002][ T6046] ? avc_has_perm_noaudit+0xf0/0x3b0 [ 94.645040][ T6046] ? find_held_lock+0x2b/0x80 [ 94.645062][ T6046] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 94.645082][ T6046] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 94.645103][ T6046] ? __pfx_fib_nl_newrule+0x10/0x10 [ 94.645132][ T6046] rtnetlink_rcv_msg+0x95e/0xe90 [ 94.645154][ T6046] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 94.645181][ T6046] ? ref_tracker_free+0x37e/0x6c0 [ 94.645206][ T6046] netlink_rcv_skb+0x159/0x420 [ 94.645224][ T6046] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 94.645248][ T6046] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 94.645272][ T6046] ? netlink_deliver_tap+0x1ae/0xcc0 [ 94.645301][ T6046] netlink_unicast+0x585/0x850 [ 94.645320][ T6046] ? __pfx_netlink_unicast+0x10/0x10 [ 94.645342][ T6046] netlink_sendmsg+0x8b0/0xda0 [ 94.645362][ T6046] ? __pfx_netlink_sendmsg+0x10/0x10 [ 94.645380][ T6046] ? selinux_socket_sendmsg+0x198/0x2f0 [ 94.645407][ T6046] ____sys_sendmsg+0xa4d/0xbe0 [ 94.645430][ T6046] ? __pfx_netlink_sendmsg+0x10/0x10 [ 94.645447][ T6046] ? __pfx_____sys_sendmsg+0x10/0x10 [ 94.645480][ T6046] ___sys_sendmsg+0x190/0x1e0 [ 94.645506][ T6046] ? __pfx____sys_sendmsg+0x10/0x10 [ 94.645528][ T6046] ? __lock_acquire+0x49f/0x1a40 [ 94.645573][ T6046] __sys_sendmsg+0x160/0x210 [ 94.645593][ T6046] ? __pfx___sys_sendmsg+0x10/0x10 [ 94.645624][ T6046] do_syscall_64+0x115/0x870 [ 94.645641][ T6046] ? clear_bhb_loop+0x40/0x90 [ 94.645663][ T6046] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.645680][ T6046] RIP: 0033:0x7f2419f9df99 [ 94.645694][ T6046] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.645708][ T6046] RSP: 002b:00007f241ae14028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 94.645724][ T6046] RAX: ffffffffffffffda RBX: 00007f241a225fa0 RCX: 00007f2419f9df99 [ 94.645734][ T6046] RDX: 0000000020000076 RSI: 00002000000002c0 RDI: 0000000000000003 [ 94.645744][ T6046] RBP: 00007f241a034ec4 R08: 0000000000000000 R09: 0000000000000000 [ 94.645753][ T6046] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.645761][ T6046] R13: 00007f241a226038 R14: 00007f241a225fa0 R15: 00007fff7afc3498 [ 94.645783][ T6046] [ 94.646053][ T6046] FAULT_INJECTION: forcing a failure. [ 94.646053][ T6046] name failslab, interval 1, probability 1, space 0, times 6 [ 94.650723][ T57] CPU: 1 UID: 0 PID: 57 Comm: kworker/u8:4 Not tainted syzkaller #0 PREEMPT(full) [ 94.650746][ T57] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 94.650756][ T57] Workqueue: events_unbound cfg80211_wiphy_work [ 94.650782][ T57] Call Trace: [ 94.650788][ T57] [ 94.650794][ T57] dump_stack_lvl+0x100/0x190 [ 94.650816][ T57] should_fail_ex.cold+0x5/0xa [ 94.650837][ T57] should_failslab+0xc2/0x120 [ 94.650857][ T57] __kmalloc_noprof+0xfc/0x820 [ 94.650876][ T57] ? cfg80211_inform_single_bss_data+0x557/0x1dc0 [ 94.650901][ T57] cfg80211_inform_single_bss_data+0x557/0x1dc0 [ 94.650922][ T57] ? unwind_next_frame+0x3be/0x2090 [ 94.650944][ T57] ? __pfx_cfg80211_inform_single_bss_data+0x10/0x10 [ 94.650964][ T57] ? ret_from_fork_asm+0x1a/0x30 [ 94.651002][ T57] ? stack_trace_save+0x8e/0xc0 [ 94.651018][ T57] ? __pfx_stack_trace_save+0x10/0x10 [ 94.651038][ T57] ? cfg80211_inform_bss_data+0x230/0x3b60 [ 94.651058][ T57] cfg80211_inform_bss_data+0x230/0x3b60 [ 94.651079][ T57] ? __kmalloc_noprof+0x322/0x820 [ 94.651094][ T57] ? ieee802_11_parse_elems_full+0x17c/0x3bc0 [ 94.651118][ T57] ? cfg80211_wiphy_work+0x2b7/0x550 [ 94.651138][ T57] ? process_one_work+0xa23/0x1940 [ 94.651153][ T57] ? worker_thread+0x5ef/0xe50 [ 94.651168][ T57] ? kthread+0x370/0x450 [ 94.651182][ T57] ? ret_from_fork+0x72b/0xd50 [ 94.651202][ T57] ? ret_from_fork_asm+0x1a/0x30 [ 94.651229][ T57] ? __pfx_cfg80211_inform_bss_data+0x10/0x10 [ 94.651254][ T57] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 94.651274][ T57] ? _ieee802_11_parse_elems_full+0x687/0x5200 [ 94.651301][ T57] ? __lock_acquire+0x49f/0x1a40 [ 94.651321][ T57] ? __lock_acquire+0x49f/0x1a40 [ 94.651348][ T57] ? __lock_acquire+0x49f/0x1a40 [ 94.651366][ T57] ? find_held_lock+0x2b/0x80 [ 94.651389][ T57] ? ieee80211_update_sta_info.isra.0+0x5fd/0x1230 [ 94.651411][ T57] ? ieee80211_update_sta_info.isra.0+0x5fd/0x1230 [ 94.651439][ T57] cfg80211_inform_bss_frame_data+0x245/0x7c0 [ 94.651466][ T57] ieee80211_bss_info_update+0x310/0xab0 [ 94.651491][ T57] ? __pfx_ieee80211_bss_info_update+0x10/0x10 [ 94.651519][ T57] ? rcu_is_watching+0x12/0xc0 [ 94.651542][ T57] ? ieee80211_get_channel_khz+0x14a/0x1e0 [ 94.651562][ T57] ieee80211_ibss_rx_queued_mgmt+0xe04/0x1c70 [ 94.651587][ T57] ? __pfx_ieee80211_ibss_rx_queued_mgmt+0x10/0x10 [ 94.651625][ T57] ieee80211_iface_work+0xa9a/0x1070 [ 94.651653][ T57] cfg80211_wiphy_work+0x2b7/0x550 [ 94.651677][ T57] process_one_work+0xa23/0x1940 [ 94.651703][ T57] ? __pfx_process_one_work+0x10/0x10 [ 94.651726][ T57] ? __pfx_cfg80211_wiphy_work+0x10/0x10 [ 94.651750][ T57] worker_thread+0x5ef/0xe50 [ 94.651772][ T57] ? __pfx_worker_thread+0x10/0x10 [ 94.651789][ T57] ? kthread+0x13a/0x450 [ 94.651802][ T57] ? __pfx_worker_thread+0x10/0x10 [ 94.651818][ T57] kthread+0x370/0x450 [ 94.651835][ T57] ? __pfx_kthread+0x10/0x10 [ 94.651852][ T57] ret_from_fork+0x72b/0xd50 [ 94.651873][ T57] ? __pfx_ret_from_fork+0x10/0x10 [ 94.651896][ T57] ? __switch_to+0x800/0x10f0 [ 94.651912][ T57] ? __pfx_kthread+0x10/0x10 [ 94.651928][ T57] ret_from_fork_asm+0x1a/0x30 [ 94.651962][ T57] [ 94.654780][ T4966] CPU: 1 UID: 0 PID: 4966 Comm: klogd Not tainted syzkaller #0 PREEMPT(full) [ 94.654801][ T4966] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 94.654811][ T4966] Call Trace: [ 94.654816][ T4966] [ 94.654826][ T4966] dump_stack_lvl+0x100/0x190 [ 94.654850][ T4966] should_fail_ex.cold+0x5/0xa [ 94.654872][ T4966] should_failslab+0xc2/0x120 [ 94.654895][ T4966] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 94.654915][ T4966] ? __alloc_skb+0x5b7/0x710 [ 94.654935][ T4966] ? __alloc_skb+0x140/0x710 [ 94.654958][ T4966] __alloc_skb+0x140/0x710 [ 94.654976][ T4966] ? __alloc_skb+0x5b7/0x710 [ 94.654994][ T4966] ? __pfx___alloc_skb+0x10/0x10 [ 94.655020][ T4966] alloc_skb_with_frags+0xdd/0x760 [ 94.655042][ T4966] ? find_held_lock+0x2b/0x80 [ 94.655068][ T4966] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 94.655087][ T4966] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 94.655110][ T4966] sock_alloc_send_pskb+0x801/0x980 [ 94.655131][ T4966] ? avc_has_perm+0x135/0x1e0 [ 94.655149][ T4966] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 94.655165][ T4966] ? selinux_socket_getpeersec_dgram+0x1a4/0x380 [ 94.655188][ T4966] ? __pfx_selinux_socket_getpeersec_dgram+0x10/0x10 [ 94.655211][ T4966] ? sock_def_readable+0x1d2/0x600 [ 94.655234][ T4966] unix_dgram_sendmsg+0x3c7/0x1810 [ 94.655258][ T4966] ? __pfx_syslog_print+0x10/0x10 [ 94.655277][ T4966] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 94.655299][ T4966] ? selinux_socket_sendmsg+0x198/0x2f0 [ 94.655325][ T4966] __sys_sendto+0x48b/0x4e0 [ 94.655341][ T4966] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 94.655359][ T4966] ? __pfx___sys_sendto+0x10/0x10 [ 94.655381][ T4966] ? do_syslog+0x18c/0x6d0 [ 94.655416][ T4966] __x64_sys_sendto+0xe0/0x1c0 [ 94.655432][ T4966] ? do_syscall_64+0x90/0x870 [ 94.655449][ T4966] ? lockdep_hardirqs_on+0x78/0x100 [ 94.655466][ T4966] do_syscall_64+0x115/0x870 [ 94.655482][ T4966] ? clear_bhb_loop+0x40/0x90 [ 94.655501][ T4966] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.655517][ T4966] RIP: 0033:0x7f8c6cd2d407 [ 94.655530][ T4966] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 94.655544][ T4966] RSP: 002b:00007ffee5ec4f50 EFLAGS: 00000202 ORIG_RAX: 000000000000002c [ 94.655559][ T4966] RAX: ffffffffffffffda RBX: 00007f8c6cbddc80 RCX: 00007f8c6cd2d407 [ 94.655569][ T4966] RDX: 000000000000004c RSI: 00007ffee5ec5090 RDI: 0000000000000003 [ 94.655578][ T4966] RBP: 00007ffee5ec54c0 R08: 0000000000000000 R09: 0000000000000000 [ 94.655587][ T4966] R10: 0000000000004000 R11: 0000000000000202 R12: 00007ffee5ec54d8 [ 94.655596][ T4966] R13: 00007ffee5ec5090 R14: 0000000000000031 R15: 00007ffee5ec5090 [ 94.655621][ T4966] [ 94.766041][ C0] FAULT_INJECTION: forcing a failure. [ 94.766041][ C0] name failslab, interval 1, probability 1, space 0, times 4 [ 94.766158][ C0] CPU: 0 UID: 0 PID: 6046 Comm: syz.0.65 Not tainted syzkaller #0 PREEMPT(full) [ 94.766179][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 94.766189][ C0] Call Trace: [ 94.766194][ C0] [ 94.766200][ C0] dump_stack_lvl+0x100/0x190 [ 94.766226][ C0] should_fail_ex.cold+0x5/0xa [ 94.766248][ C0] should_failslab+0xc2/0x120 [ 94.766271][ C0] __kmalloc_noprof+0xfc/0x820 [ 94.766292][ C0] ? ieee802_11_parse_elems_full+0x17c/0x3bc0 [ 94.766325][ C0] ieee802_11_parse_elems_full+0x17c/0x3bc0 [ 94.766355][ C0] ? kasan_save_stack+0x3f/0x50 [ 94.766375][ C0] ? kasan_save_stack+0x30/0x50 [ 94.766395][ C0] ? __kasan_kmalloc+0xaa/0xb0 [ 94.766414][ C0] ? __kmalloc_noprof+0x322/0x820 [ 94.766436][ C0] ? lock_acquire+0x1b9/0x370 [ 94.766459][ C0] ? find_held_lock+0x2b/0x80 [ 94.766485][ C0] ? __kfree_rcu_sheaf+0x195/0x730 [ 94.766506][ C0] ? __kfree_rcu_sheaf+0x195/0x730 [ 94.766527][ C0] ? __pfx_ieee802_11_parse_elems_full+0x10/0x10 [ 94.766562][ C0] ? kvfree_call_rcu+0x1be/0x4f0 [ 94.766591][ C0] ? __asan_memcpy+0x3c/0x60 [ 94.766611][ C0] ieee80211_inform_bss+0x159/0x1170 [ 94.766641][ C0] ? __pfx_ieee80211_inform_bss+0x10/0x10 [ 94.766671][ C0] ? cfg80211_inform_single_bss_data+0x557/0x1dc0 [ 94.766698][ C0] ? __pfx_ieee80211_inform_bss+0x10/0x10 [ 94.766723][ C0] cfg80211_inform_single_bss_data+0x898/0x1dc0 [ 94.766745][ C0] ? __lock_acquire+0x49f/0x1a40 [ 94.766772][ C0] ? __pfx_cfg80211_inform_single_bss_data+0x10/0x10 [ 94.766812][ C0] ? bpf_ksym_find+0x128/0x1c0 [ 94.766838][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 94.766859][ C0] ? is_bpf_text_address+0x94/0x1a0 [ 94.766887][ C0] ? cfg80211_inform_bss_data+0x230/0x3b60 [ 94.766909][ C0] cfg80211_inform_bss_data+0x230/0x3b60 [ 94.766940][ C0] ? __lock_acquire+0x49f/0x1a40 [ 94.766964][ C0] ? __pfx_cfg80211_inform_bss_data+0x10/0x10 [ 94.766987][ C0] ? __lock_acquire+0x49f/0x1a40 [ 94.767015][ C0] ? lock_acquire+0x1b9/0x370 [ 94.767035][ C0] ? find_held_lock+0x2b/0x80 [ 94.767059][ C0] ? is_bpf_text_address+0x8a/0x1a0 [ 94.767080][ C0] ? is_bpf_text_address+0x8a/0x1a0 [ 94.767101][ C0] ? bpf_ksym_find+0x128/0x1c0 [ 94.767140][ C0] ? __lock_acquire+0x49f/0x1a40 [ 94.767173][ C0] cfg80211_inform_bss_frame_data+0x245/0x7c0 [ 94.767202][ C0] ieee80211_bss_info_update+0x310/0xab0 [ 94.767229][ C0] ? __pfx_ieee80211_bss_info_update+0x10/0x10 [ 94.767261][ C0] ? __pfx_debug_object_activate+0x10/0x10 [ 94.767285][ C0] ? _raw_spin_lock_irqsave+0x52/0x60 [ 94.767315][ C0] ? ieee80211_get_channel_khz+0x14a/0x1e0 [ 94.767337][ C0] ieee80211_scan_rx+0x4e6/0xb60 [ 94.767362][ C0] ? __lock_acquire+0x49f/0x1a40 [ 94.767385][ C0] __ieee80211_rx_handle_packet+0xbab/0xfc0 [ 94.767418][ C0] ? __pfx___ieee80211_rx_handle_packet+0x10/0x10 [ 94.767446][ C0] ? do_raw_spin_lock+0x128/0x260 [ 94.767477][ C0] ? lockdep_hardirqs_on+0x78/0x100 [ 94.767498][ C0] ? ieee80211_clean_skb+0x1a7/0x740 [ 94.767525][ C0] ieee80211_rx_list+0xf19/0x2160 [ 94.767560][ C0] ? lock_acquire+0x1b9/0x370 [ 94.767582][ C0] ? __pfx_ieee80211_rx_list+0x10/0x10 [ 94.767614][ C0] ieee80211_rx_napi+0xdc/0x400 [ 94.767640][ C0] ? __pfx_ieee80211_rx_napi+0x10/0x10 [ 94.767668][ C0] ? lockdep_hardirqs_on+0x78/0x100 [ 94.767687][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 94.767708][ C0] ieee80211_handle_queued_frames+0xc8/0x120 [ 94.767735][ C0] tasklet_action_common+0x2de/0x3d0 [ 94.767765][ C0] handle_softirqs+0x1ea/0x9b0 [ 94.767792][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 94.767815][ C0] ? _raw_spin_unlock+0x28/0x50 [ 94.767841][ C0] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 94.767863][ C0] __irq_exit_rcu+0x162/0x210 [ 94.767886][ C0] irq_exit_rcu+0x9/0x30 [ 94.767909][ C0] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 94.767928][ C0] [ 94.767933][ C0] [ 94.767940][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 94.767961][ C0] RIP: 0010:console_flush_one_record+0xac3/0xe50 [ 94.767991][ C0] Code: 00 e8 91 24 2a 00 9c 5d 81 e5 00 02 00 00 31 ff 48 89 ee e8 df d0 21 00 48 85 ed 0f 85 d7 01 00 00 e8 31 d6 21 00 fb 4c 89 e8 <48> c1 e8 03 42 80 3c 38 00 0f 85 64 03 00 00 48 8b 0c 24 48 8b 6b [ 94.768008][ C0] RSP: 0018:ffffc90002f26de8 EFLAGS: 00000246 [ 94.768023][ C0] RAX: ffffffff8f9acd98 RBX: ffffffff8f9acd40 RCX: ffffc90005cf1000 [ 94.768035][ C0] RDX: 0000000000080000 RSI: ffffffff81e88a0f RDI: ffff888052d78000 [ 94.768047][ C0] RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000 [ 94.768057][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000aef [ 94.768067][ C0] R13: ffffffff8f9acd98 R14: ffffc90002f26e68 R15: dffffc0000000000 [ 94.768087][ C0] ? console_flush_one_record+0xabf/0xe50 [ 94.768124][ C0] ? console_flush_one_record+0xabf/0xe50 [ 94.768156][ C0] ? __pfx_console_flush_one_record+0x10/0x10 [ 94.768182][ C0] ? __lock_acquire+0x49f/0x1a40 [ 94.768210][ C0] ? is_printk_cpu_sync_owner+0x32/0x40 [ 94.768233][ C0] console_unlock+0x103/0x260 [ 94.768259][ C0] ? __pfx_console_unlock+0x10/0x10 [ 94.768287][ C0] ? lock_acquire+0x100/0x370 [ 94.768318][ C0] vprintk_emit+0x407/0x6b0 [ 94.768347][ C0] ? __pfx_vprintk_emit+0x10/0x10 [ 94.768375][ C0] ? do_syscall_64+0x115/0x870 [ 94.768399][ C0] _printk+0xcf/0x110 [ 94.768417][ C0] ? __pfx__printk+0x10/0x10 [ 94.768440][ C0] ? __pfx____ratelimit+0x10/0x10 [ 94.768465][ C0] should_fail_ex+0x4e4/0x640 [ 94.768493][ C0] should_failslab+0xc2/0x120 [ 94.768516][ C0] __kmalloc_noprof+0xfc/0x820 [ 94.768536][ C0] ? trace_kmem_cache_alloc+0xdd/0x100 [ 94.768560][ C0] ? tnode_new+0x2f7/0x350 [ 94.768590][ C0] tnode_new+0x2f7/0x350 [ 94.768616][ C0] fib_insert_alias+0x6e7/0xe30 [ 94.768643][ C0] ? lockdep_rtnl_is_held+0x26/0x40 [ 94.768667][ C0] fib_trie_unmerge+0x289/0xbd0 [ 94.768699][ C0] ? __pfx_fib_trie_unmerge+0x10/0x10 [ 94.768727][ C0] ? __pfx___mutex_lock+0x10/0x10 [ 94.768756][ C0] fib_unmerge+0xee/0x510 [ 94.768775][ C0] ? netdev_name_node_lookup+0x107/0x150 [ 94.768798][ C0] fib4_rule_configure+0x383/0x10c0 [ 94.768826][ C0] fib_newrule+0x356/0x1ed0 [ 94.768871][ C0] ? __ww_mutex_check_waiters+0x81/0x440 [ 94.768894][ C0] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 94.768916][ C0] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 94.768939][ C0] ? __pfx_fib_newrule+0x10/0x10 [ 94.768966][ C0] ? avc_has_perm_noaudit+0xf0/0x3b0 [ 94.769009][ C0] ? find_held_lock+0x2b/0x80 [ 94.769036][ C0] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 94.769060][ C0] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 94.769085][ C0] ? __pfx_fib_nl_newrule+0x10/0x10 [ 94.769137][ C0] rtnetlink_rcv_msg+0x95e/0xe90 [ 94.769164][ C0] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 94.769195][ C0] ? ref_tracker_free+0x37e/0x6c0 [ 94.769225][ C0] netlink_rcv_skb+0x159/0x420 [ 94.769243][ C0] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 94.769269][ C0] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 94.769296][ C0] ? netlink_deliver_tap+0x1ae/0xcc0 [ 94.769329][ C0] netlink_unicast+0x585/0x850 [ 94.769351][ C0] ? __pfx_netlink_unicast+0x10/0x10 [ 94.769377][ C0] netlink_sendmsg+0x8b0/0xda0 [ 94.769399][ C0] ? __pfx_netlink_sendmsg+0x10/0x10 [ 94.769420][ C0] ? selinux_socket_sendmsg+0x198/0x2f0 [ 94.769451][ C0] ____sys_sendmsg+0xa4d/0xbe0 [ 94.769478][ C0] ? __pfx_netlink_sendmsg+0x10/0x10 [ 94.769498][ C0] ? __pfx_____sys_sendmsg+0x10/0x10 [ 94.769537][ C0] ___sys_sendmsg+0x190/0x1e0 [ 94.769567][ C0] ? __pfx____sys_sendmsg+0x10/0x10 [ 94.769593][ C0] ? __lock_acquire+0x49f/0x1a40 [ 94.769643][ C0] __sys_sendmsg+0x160/0x210 [ 94.769666][ C0] ? __pfx___sys_sendmsg+0x10/0x10 [ 94.769702][ C0] do_syscall_64+0x115/0x870 [ 94.769721][ C0] ? clear_bhb_loop+0x40/0x90 [ 94.769743][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.769762][ C0] RIP: 0033:0x7f2419f9df99 [ 94.769778][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.769794][ C0] RSP: 002b:00007f241ae14028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 94.769811][ C0] RAX: ffffffffffffffda RBX: 00007f241a225fa0 RCX: 00007f2419f9df99 [ 94.769822][ C0] RDX: 0000000020000076 RSI: 00002000000002c0 RDI: 0000000000000003 [ 94.769833][ C0] RBP: 00007f241a034ec4 R08: 0000000000000000 R09: 0000000000000000 [ 94.769844][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.769854][ C0] R13: 00007f241a226038 R14: 00007f241a225fa0 R15: 00007fff7afc3498 [ 94.769878][ C0] [ 94.856977][ C1] FAULT_INJECTION: forcing a failure. [ 94.856977][ C1] name failslab, interval 1, probability 1, space 0, times 3 [ 94.866687][ T168] FAULT_INJECTION: forcing a failure. [ 94.866687][ T168] name failslab, interval 1, probability 1, space 0, times 3 [ 94.872117][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) [ 94.872140][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 94.872152][ C1] Call Trace: [ 94.872159][ C1] [ 94.872165][ C1] dump_stack_lvl+0x100/0x190 [ 94.872189][ C1] should_fail_ex.cold+0x5/0xa [ 94.872208][ C1] should_failslab+0xc2/0x120 [ 94.872229][ C1] __kmalloc_noprof+0xfc/0x820 [ 94.872248][ C1] ? ieee802_11_parse_elems_full+0x17c/0x3bc0 [ 94.872277][ C1] ieee802_11_parse_elems_full+0x17c/0x3bc0 [ 94.872303][ C1] ? kasan_save_stack+0x3f/0x50 [ 94.872320][ C1] ? kasan_save_stack+0x30/0x50 [ 94.872337][ C1] ? __kasan_kmalloc+0xaa/0xb0 [ 94.872354][ C1] ? __kmalloc_noprof+0x322/0x820 [ 94.872373][ C1] ? lock_acquire+0x1b9/0x370 [ 94.872393][ C1] ? find_held_lock+0x2b/0x80 [ 94.872416][ C1] ? __kfree_rcu_sheaf+0x195/0x730 [ 94.872435][ C1] ? __kfree_rcu_sheaf+0x195/0x730 [ 94.872453][ C1] ? __pfx_ieee802_11_parse_elems_full+0x10/0x10 [ 94.872484][ C1] ? kvfree_call_rcu+0x1be/0x4f0 [ 94.872511][ C1] ? __asan_memcpy+0x3c/0x60 [ 94.872529][ C1] ieee80211_inform_bss+0x159/0x1170 [ 94.872555][ C1] ? __pfx_ieee80211_inform_bss+0x10/0x10 [ 94.872582][ C1] ? cfg80211_inform_single_bss_data+0x557/0x1dc0 [ 94.872610][ C1] ? __pfx_ieee80211_inform_bss+0x10/0x10 [ 94.872632][ C1] cfg80211_inform_single_bss_data+0x898/0x1dc0 [ 94.872652][ C1] ? __lock_acquire+0x49f/0x1a40 [ 94.872675][ C1] ? __pfx_cfg80211_inform_single_bss_data+0x10/0x10 [ 94.872711][ C1] ? lock_acquire+0x1b9/0x370 [ 94.872730][ C1] ? find_held_lock+0x2b/0x80 [ 94.872756][ C1] ? cfg80211_inform_bss_data+0x230/0x3b60 [ 94.872776][ C1] cfg80211_inform_bss_data+0x230/0x3b60 [ 94.872802][ C1] ? __lock_acquire+0x49f/0x1a40 [ 94.872824][ C1] ? __pfx_cfg80211_inform_bss_data+0x10/0x10 [ 94.872853][ C1] ? lock_acquire+0x1b9/0x370 [ 94.872871][ C1] ? find_held_lock+0x2b/0x80 [ 94.872893][ C1] ? unwind_next_frame+0x3be/0x2090 [ 94.872909][ C1] ? unwind_next_frame+0x3be/0x2090 [ 94.872935][ C1] ? __lock_acquire+0x49f/0x1a40 [ 94.872956][ C1] ? common_startup_64+0x13e/0x158 [ 94.872987][ C1] cfg80211_inform_bss_frame_data+0x245/0x7c0 [ 94.873014][ C1] ieee80211_bss_info_update+0x310/0xab0 [ 94.873038][ C1] ? __pfx_ieee80211_bss_info_update+0x10/0x10 [ 94.873061][ C1] ? __lock_acquire+0x49f/0x1a40 [ 94.873082][ C1] ? do_idle+0x3a7/0x5b0 [ 94.873101][ C1] ? cpu_startup_entry+0x4f/0x60 [ 94.873123][ C1] ? common_startup_64+0x13e/0x158 [ 94.873146][ C1] ? ieee80211_get_channel_khz+0x14a/0x1e0 [ 94.873167][ C1] ieee80211_scan_rx+0x4e6/0xb60 [ 94.873189][ C1] ? __lock_acquire+0x49f/0x1a40 [ 94.873210][ C1] __ieee80211_rx_handle_packet+0xbab/0xfc0 [ 94.873238][ C1] ? __pfx___ieee80211_rx_handle_packet+0x10/0x10 [ 94.873262][ C1] ? do_raw_spin_lock+0x128/0x260 [ 94.873290][ C1] ? lockdep_hardirqs_on+0x78/0x100 [ 94.873309][ C1] ? ieee80211_clean_skb+0x1a7/0x740 [ 94.873333][ C1] ieee80211_rx_list+0xf19/0x2160 [ 94.873363][ C1] ? lock_acquire+0x1b9/0x370 [ 94.873382][ C1] ? __pfx_ieee80211_rx_list+0x10/0x10 [ 94.873411][ C1] ieee80211_rx_napi+0xdc/0x400 [ 94.873435][ C1] ? __pfx_ieee80211_rx_napi+0x10/0x10 [ 94.873458][ C1] ? lockdep_hardirqs_on+0x78/0x100 [ 94.873475][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 94.873494][ C1] ieee80211_handle_queued_frames+0xc8/0x120 [ 94.873517][ C1] tasklet_action_common+0x2de/0x3d0 [ 94.873544][ C1] handle_softirqs+0x1ea/0x9b0 [ 94.873567][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 94.873588][ C1] ? _raw_spin_unlock+0x28/0x50 [ 94.873615][ C1] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 94.873633][ C1] __irq_exit_rcu+0x162/0x210 [ 94.873653][ C1] irq_exit_rcu+0x9/0x30 [ 94.873672][ C1] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 94.873689][ C1] [ 94.873694][ C1] [ 94.873700][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 94.873718][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 94.873735][ C1] Code: e6 8b 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 83 7f 10 00 fb f4 3c 4a 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 94.873749][ C1] RSP: 0018:ffffc90000197e00 EFLAGS: 00000242 [ 94.873763][ C1] RAX: 0000000000217683 RBX: ffff88801eaca540 RCX: ffffffff8bbb22d5 [ 94.873773][ C1] RDX: 0000000000000000 RSI: ffffffff8e1a6f32 RDI: ffffffff8c402680 [ 94.873783][ C1] RBP: ffffed1003d594a8 R08: 0000000000000001 R09: ffffed10170a678d [ 94.873792][ C1] R10: ffff8880b8533c6b R11: 0000000000000000 R12: 0000000000000000 [ 94.873801][ C1] R13: 0000000000000000 R14: 1ffff92000032fc4 R15: dffffc0000000000 [ 94.873816][ C1] ? ct_kernel_exit+0x125/0x180 [ 94.873838][ C1] default_idle+0x9/0x10 [ 94.873856][ C1] default_idle_call+0x6c/0xb0 [ 94.873874][ C1] do_idle+0x3a7/0x5b0 [ 94.873895][ C1] ? __pfx_do_idle+0x10/0x10 [ 94.873915][ C1] ? finish_task_switch.isra.0+0x14c/0x10c0 [ 94.873944][ C1] cpu_startup_entry+0x4f/0x60 [ 94.873966][ C1] start_secondary+0x21d/0x2d0 [ 94.873987][ C1] ? __pfx_start_secondary+0x10/0x10 [ 94.874011][ C1] common_startup_64+0x13e/0x158 [ 94.874045][ C1] [ 95.793233][ T6041] process 'syz.4.64' launched './file0' with NULL argv: empty string added [ 95.796189][ T168] CPU: 0 UID: 0 PID: 168 Comm: kworker/u8:6 Not tainted syzkaller #0 PREEMPT(full) [ 95.796211][ T168] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 95.796221][ T168] Workqueue: events_unbound nsim_dev_trap_report_work [ 95.796247][ T168] Call Trace: [ 95.796253][ T168] [ 95.796259][ T168] dump_stack_lvl+0x100/0x190 [ 95.796281][ T168] should_fail_ex.cold+0x5/0xa [ 95.796302][ T168] should_failslab+0xc2/0x120 [ 95.796322][ T168] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 95.796342][ T168] ? __alloc_skb+0x140/0x710 [ 95.796365][ T168] __alloc_skb+0x140/0x710 [ 95.796381][ T168] ? __alloc_skb+0x5b7/0x710 [ 95.796399][ T168] ? __pfx___alloc_skb+0x10/0x10 [ 95.796418][ T168] ? kfree_skbmem+0x19f/0x210 [ 95.796443][ T168] nsim_dev_trap_report_work+0x2af/0xd20 [ 95.796472][ T168] process_one_work+0xa23/0x1940 [ 95.796499][ T168] ? __pfx_process_one_work+0x10/0x10 [ 95.796522][ T168] ? __pfx_nsim_dev_trap_report_work+0x10/0x10 [ 95.796543][ T168] worker_thread+0x5ef/0xe50 [ 95.796569][ T168] ? kthread+0x13a/0x450 [ 95.796583][ T168] ? __pfx_worker_thread+0x10/0x10 [ 95.796598][ T168] kthread+0x370/0x450 [ 95.796612][ T168] ? __pfx_kthread+0x10/0x10 [ 95.796628][ T168] ret_from_fork+0x72b/0xd50 [ 95.796651][ T168] ? __pfx_ret_from_fork+0x10/0x10 [ 95.796673][ T168] ? __switch_to+0x800/0x10f0 [ 95.796689][ T168] ? __pfx_kthread+0x10/0x10 [ 95.796705][ T168] ret_from_fork_asm+0x1a/0x30 [ 95.796739][ T168] [ 95.952834][ T4977] FAULT_INJECTION: forcing a failure. [ 95.952834][ T4977] name failslab, interval 1, probability 1, space 0, times 10 [ 95.954733][ T29] audit: type=1400 audit(1785419253.422:263): avc: denied { execute } for pid=6039 comm="syz.4.64" name="file0" dev="tmpfs" ino=94 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 95.959865][ T4977] CPU: 0 UID: 0 PID: 4977 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) [ 95.959884][ T4977] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 95.959893][ T4977] Call Trace: [ 95.959898][ T4977] [ 95.959904][ T4977] dump_stack_lvl+0x100/0x190 [ 95.959928][ T4977] should_fail_ex.cold+0x5/0xa [ 95.959949][ T4977] should_failslab+0xc2/0x120 [ 95.959969][ T4977] kmem_cache_alloc_noprof+0x91/0x6a0 [ 95.959987][ T4977] ? putname+0xb1/0x110 [ 95.960003][ T4977] ? kmem_cache_free+0x127/0x6b0 [ 95.960016][ T4977] ? do_getname+0x35/0x390 [ 95.960039][ T4977] do_getname+0x35/0x390 [ 95.960060][ T4977] do_sys_openat2+0xc7/0x1e0 [ 95.960079][ T4977] ? __pfx_do_sys_openat2+0x10/0x10 [ 95.960106][ T4977] __x64_sys_openat+0x12d/0x210 [ 95.960125][ T4977] ? __pfx___x64_sys_openat+0x10/0x10 [ 95.960152][ T4977] do_syscall_64+0x115/0x870 [ 95.960174][ T4977] ? clear_bhb_loop+0x40/0x90 [ 95.960192][ T4977] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.960208][ T4977] RIP: 0033:0x7f2efb515c3a [ 95.960221][ T4977] Code: 41 89 f2 48 89 54 24 e0 41 83 e2 40 75 2a 89 f0 f7 d0 a9 00 00 41 00 74 1f 89 f2 b8 01 01 00 00 48 89 fe bf 9c ff ff ff 0f 05 <48> 3d 00 f0 ff ff 77 2e c3 0f 1f 44 00 00 48 8d 44 24 08 c7 44 24 [ 95.960235][ T4977] RSP: 002b:00007fff2d773078 EFLAGS: 00000206 ORIG_RAX: 0000000000000101 [ 95.960250][ T4977] RAX: ffffffffffffffda RBX: 00005597e70b8be0 RCX: 00007f2efb515c3a [ 95.960260][ T4977] RDX: 0000000000090800 RSI: 00005597e7044b30 RDI: 00000000ffffff9c [ 95.960269][ T4977] RBP: 00005597e7044b30 R08: 0000000000000000 R09: 0000000000000000 [ 95.960278][ T4977] R10: 0000000000000000 R11: 0000000000000206 R12: 00005597e7054170 [ 95.960287][ T4977] R13: 00000000000000ff R14: 00005597d5186be0 R15: 00007fff2d773300 [ 95.960307][ T4977] [ 95.961548][ T4977] FAULT_INJECTION: forcing a failure. [ 95.961548][ T4977] name failslab, interval 1, probability 1, space 0, times 9 [ 95.986543][ T29] audit: type=1400 audit(1785419253.572:264): avc: denied { execute } for pid=6048 comm="syz.3.60" name="file0" dev="tmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 95.987271][ T4977] CPU: 0 UID: 0 PID: 4977 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) [ 95.987293][ T4977] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 95.987301][ T4977] Call Trace: [ 95.987307][ T4977] [ 95.987313][ T4977] dump_stack_lvl+0x100/0x190 [ 95.987338][ T4977] should_fail_ex.cold+0x5/0xa [ 95.987358][ T4977] should_failslab+0xc2/0x120 [ 95.987379][ T4977] kmem_cache_alloc_noprof+0x91/0x6a0 [ 95.987398][ T4977] ? skb_clone+0x190/0x400 [ 95.987421][ T4977] skb_clone+0x190/0x400 [ 95.987440][ T4977] netlink_broadcast_filtered+0xb22/0xf20 [ 95.987475][ T4977] netlink_broadcast+0x39/0x50 [ 95.987500][ T4977] kobject_uevent_env+0xcdd/0x18b0 [ 95.987532][ T4977] kobject_synth_uevent+0x6f0/0x7d0 [ 95.987560][ T4977] ? __pfx_kobject_synth_uevent+0x10/0x10 [ 95.987586][ T4977] ? find_held_lock+0x2b/0x80 [ 95.987611][ T4977] ? __pfx_uevent_store+0x10/0x10 [ 95.987628][ T4977] uevent_store+0x24/0x50 [ 95.987644][ T4977] dev_attr_store+0x58/0x80 [ 95.987665][ T4977] ? __pfx_dev_attr_store+0x10/0x10 [ 95.987685][ T4977] sysfs_kf_write+0xf2/0x150 [ 95.987710][ T4977] kernfs_fop_write_iter+0x3e0/0x5f0 [ 95.987729][ T4977] ? __pfx_sysfs_kf_write+0x10/0x10 [ 95.987754][ T4977] vfs_write+0x6ac/0x1050 [ 95.987778][ T4977] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 95.987800][ T4977] ? __pfx_vfs_write+0x10/0x10 [ 95.987825][ T4977] ? __pfx___do_sys_newfstat+0x10/0x10 [ 95.987855][ T4977] ksys_write+0x12a/0x250 [ 95.987878][ T4977] ? __pfx_ksys_write+0x10/0x10 [ 95.987907][ T4977] do_syscall_64+0x115/0x870 [ 95.987923][ T4977] ? clear_bhb_loop+0x40/0x90 [ 95.987943][ T4977] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.987958][ T4977] RIP: 0033:0x7f2efb4a7407 [ 95.987971][ T4977] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 95.987985][ T4977] RSP: 002b:00007fff2d772fc0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 [ 95.988000][ T4977] RAX: ffffffffffffffda RBX: 00007f2efbbfc880 RCX: 00007f2efb4a7407 [ 95.988010][ T4977] RDX: 0000000000000007 RSI: 00005597e70b6110 RDI: 000000000000000c [ 95.988019][ T4977] RBP: 00005597e70b6110 R08: 0000000000000000 R09: 0000000000000000 [ 95.988027][ T4977] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000007 [ 95.988036][ T4977] R13: 00005597e705ab20 R14: 00007f2efb5efea0 R15: 00007fff2d773300 [ 95.988060][ T4977] [ 95.988195][ C0] FAULT_INJECTION: forcing a failure. [ 95.988195][ C0] name failslab, interval 1, probability 1, space 0, times 8 [ 96.001958][ T29] audit: type=1400 audit(1785419253.572:265): avc: denied { execute_no_trans } for pid=6048 comm="syz.3.60" path="/12/file0" dev="tmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 96.006360][ C0] CPU: 0 UID: 0 PID: 4977 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) [ 96.006383][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 96.006392][ C0] Call Trace: [ 96.006397][ C0] [ 96.006403][ C0] dump_stack_lvl+0x100/0x190 [ 96.006428][ C0] should_fail_ex.cold+0x5/0xa [ 96.006448][ C0] should_failslab+0xc2/0x120 [ 96.006470][ C0] __kmalloc_noprof+0xfc/0x820 [ 96.006488][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 96.006506][ C0] ? cfg80211_inform_single_bss_data+0x557/0x1dc0 [ 96.006532][ C0] cfg80211_inform_single_bss_data+0x557/0x1dc0 [ 96.006559][ C0] ? __pfx_cfg80211_inform_single_bss_data+0x10/0x10 [ 96.006594][ C0] ? mark_held_locks+0x40/0x70 [ 96.006616][ C0] ? mark_held_locks+0x40/0x70 [ 96.006637][ C0] ? cfg80211_inform_bss_data+0x230/0x3b60 [ 96.006657][ C0] cfg80211_inform_bss_data+0x230/0x3b60 [ 96.006684][ C0] ? __lock_acquire+0x49f/0x1a40 [ 96.006703][ C0] ? __pfx_ieee80211_rx_handlers+0x10/0x10 [ 96.006728][ C0] ? __pfx_cfg80211_inform_bss_data+0x10/0x10 [ 96.006749][ C0] ? __lock_acquire+0x49f/0x1a40 [ 96.006774][ C0] ? lock_acquire+0x1b9/0x370 [ 96.006794][ C0] ? find_held_lock+0x2b/0x80 [ 96.006817][ C0] ? is_bpf_text_address+0x8a/0x1a0 [ 96.006838][ C0] ? is_bpf_text_address+0x8a/0x1a0 [ 96.006867][ C0] ? __lock_acquire+0x49f/0x1a40 [ 96.006896][ C0] cfg80211_inform_bss_frame_data+0x245/0x7c0 [ 96.006922][ C0] ieee80211_bss_info_update+0x310/0xab0 [ 96.006948][ C0] ? __pfx_ieee80211_bss_info_update+0x10/0x10 [ 96.006977][ C0] ? ieee80211_get_channel_khz+0x14a/0x1e0 [ 96.006997][ C0] ieee80211_scan_rx+0x4e6/0xb60 [ 96.007019][ C0] ? __lock_acquire+0x49f/0x1a40 [ 96.007040][ C0] __ieee80211_rx_handle_packet+0xbab/0xfc0 [ 96.007068][ C0] ? __pfx___ieee80211_rx_handle_packet+0x10/0x10 [ 96.007092][ C0] ? do_raw_spin_lock+0x128/0x260 [ 96.007120][ C0] ? lockdep_hardirqs_on+0x78/0x100 [ 96.007137][ C0] ? ieee80211_clean_skb+0x1a7/0x740 [ 96.007167][ C0] ieee80211_rx_list+0xf19/0x2160 [ 96.007197][ C0] ? lock_acquire+0x1b9/0x370 [ 96.007215][ C0] ? __pfx_ieee80211_rx_list+0x10/0x10 [ 96.007244][ C0] ieee80211_rx_napi+0xdc/0x400 [ 96.007267][ C0] ? __pfx_ieee80211_rx_napi+0x10/0x10 [ 96.007291][ C0] ? lockdep_hardirqs_on+0x78/0x100 [ 96.007307][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 96.007326][ C0] ieee80211_handle_queued_frames+0xc8/0x120 [ 96.007349][ C0] tasklet_action_common+0x2de/0x3d0 [ 96.007375][ C0] handle_softirqs+0x1ea/0x9b0 [ 96.007398][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 96.007418][ C0] ? _raw_spin_unlock+0x28/0x50 [ 96.007441][ C0] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 96.007460][ C0] __irq_exit_rcu+0x162/0x210 [ 96.007480][ C0] irq_exit_rcu+0x9/0x30 [ 96.007499][ C0] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 96.007516][ C0] [ 96.007520][ C0] [ 96.007526][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 96.007544][ C0] RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x70 [ 96.007564][ C0] Code: 76 f1 5e 00 48 89 df 5b e9 bd 6c 64 00 be 03 00 00 00 5b e9 a2 cb 13 03 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 65 8b 05 e5 df 59 12 48 8b 34 24 65 48 8b 15 c1 df 59 [ 96.007578][ C0] RSP: 0018:ffffc900034778b0 EFLAGS: 00000293 [ 96.007592][ C0] RAX: 0000000000000000 RBX: 0000000000000200 RCX: ffffffff8174fcac [ 96.007601][ C0] RDX: ffff88807cf0ca80 RSI: ffffffff8174fcb6 RDI: ffff88807cf0ca80 [ 96.007611][ C0] RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000 [ 96.007620][ C0] R10: 0000000000000200 R11: 0000000000000001 R12: 0000000000000200 [ 96.007628][ C0] R13: ffffffff8d4eb500 R14: 0000000000000001 R15: 0000000000000000 [ 96.007643][ C0] ? dump_stack_lvl+0x16c/0x190 [ 96.007660][ C0] ? dump_stack_lvl+0x176/0x190 [ 96.007679][ C0] dump_stack_lvl+0x17c/0x190 [ 96.007698][ C0] should_fail_ex.cold+0x5/0xa [ 96.007717][ C0] should_failslab+0xc2/0x120 [ 96.007737][ C0] kmem_cache_alloc_noprof+0x91/0x6a0 [ 96.007755][ C0] ? skb_clone+0x190/0x400 [ 96.007778][ C0] skb_clone+0x190/0x400 [ 96.007798][ C0] netlink_broadcast_filtered+0xb22/0xf20 [ 96.007832][ C0] netlink_broadcast+0x39/0x50 [ 96.007857][ C0] kobject_uevent_env+0xcdd/0x18b0 [ 96.007889][ C0] kobject_synth_uevent+0x6f0/0x7d0 [ 96.007917][ C0] ? __pfx_kobject_synth_uevent+0x10/0x10 [ 96.007943][ C0] ? find_held_lock+0x2b/0x80 [ 96.007968][ C0] ? __pfx_uevent_store+0x10/0x10 [ 96.007985][ C0] uevent_store+0x24/0x50 [ 96.008001][ C0] dev_attr_store+0x58/0x80 [ 96.008022][ C0] ? __pfx_dev_attr_store+0x10/0x10 [ 96.008043][ C0] sysfs_kf_write+0xf2/0x150 [ 96.008068][ C0] kernfs_fop_write_iter+0x3e0/0x5f0 [ 96.008088][ C0] ? __pfx_sysfs_kf_write+0x10/0x10 [ 96.008112][ C0] vfs_write+0x6ac/0x1050 [ 96.008136][ C0] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 96.008163][ C0] ? __pfx_vfs_write+0x10/0x10 [ 96.008188][ C0] ? __pfx___do_sys_newfstat+0x10/0x10 [ 96.008217][ C0] ksys_write+0x12a/0x250 [ 96.008240][ C0] ? __pfx_ksys_write+0x10/0x10 [ 96.008269][ C0] do_syscall_64+0x115/0x870 [ 96.008286][ C0] ? clear_bhb_loop+0x40/0x90 [ 96.008304][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.008320][ C0] RIP: 0033:0x7f2efb4a7407 [ 96.008334][ C0] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 96.008347][ C0] RSP: 002b:00007fff2d772fc0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 [ 96.008361][ C0] RAX: ffffffffffffffda RBX: 00007f2efbbfc880 RCX: 00007f2efb4a7407 [ 96.008371][ C0] RDX: 0000000000000007 RSI: 00005597e70b6110 RDI: 000000000000000c [ 96.008380][ C0] RBP: 00005597e70b6110 R08: 0000000000000000 R09: 0000000000000000 [ 96.008393][ C0] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000007 [ 96.008402][ C0] R13: 00005597e705ab20 R14: 00007f2efb5efea0 R15: 00007fff2d773300 [ 96.008422][ C0] [ 96.008896][ T4977] FAULT_INJECTION: forcing a failure. [ 96.008896][ T4977] name failslab, interval 1, probability 1, space 0, times 6 [ 96.011517][ T29] audit: type=1400 audit(1785419253.572:266): avc: denied { mounton } for pid=6048 comm="syz.3.60" path="/12/file0" dev="tmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 96.020885][ T4977] CPU: 0 UID: 0 PID: 4977 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) [ 96.020907][ T4977] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 96.020916][ T4977] Call Trace: [ 96.020921][ T4977] [ 96.020927][ T4977] dump_stack_lvl+0x100/0x190 [ 96.020951][ T4977] should_fail_ex.cold+0x5/0xa [ 96.020971][ T4977] should_failslab+0xc2/0x120 [ 96.020993][ T4977] __kmalloc_noprof+0xfc/0x820 [ 96.021012][ T4977] ? tomoyo_encode2+0xfb/0x3c0 [ 96.021031][ T4977] tomoyo_encode2+0xfb/0x3c0 [ 96.021048][ T4977] tomoyo_encode+0x29/0x50 [ 96.021062][ T4977] tomoyo_realpath_from_path+0x18c/0x690 [ 96.021082][ T4977] tomoyo_check_open_permission+0x2af/0x3c0 [ 96.021105][ T4977] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 96.021134][ T4977] ? hook_file_open+0x24f/0x8f0 [ 96.021173][ T4977] ? path_get+0x61/0x80 [ 96.021195][ T4977] tomoyo_file_open+0x6b/0x90 [ 96.021214][ T4977] security_file_open+0xb5/0x1e0 [ 96.021232][ T4977] do_dentry_open+0x588/0x14d0 [ 96.021253][ T4977] vfs_open+0x82/0x3f0 [ 96.021275][ T4977] path_openat+0x2873/0x4280 [ 96.021301][ T4977] ? __pfx_path_openat+0x10/0x10 [ 96.021324][ T4977] do_file_open+0x20e/0x430 [ 96.021343][ T4977] ? __pfx_do_file_open+0x10/0x10 [ 96.021375][ T4977] ? alloc_fd+0x471/0x7a0 [ 96.021395][ T4977] ? do_getname+0x191/0x390 [ 96.021417][ T4977] do_sys_openat2+0x10f/0x1e0 [ 96.021436][ T4977] ? __pfx_do_sys_openat2+0x10/0x10 [ 96.021464][ T4977] __x64_sys_openat+0x12d/0x210 [ 96.021484][ T4977] ? __pfx___x64_sys_openat+0x10/0x10 [ 96.021513][ T4977] do_syscall_64+0x115/0x870 [ 96.021531][ T4977] ? clear_bhb_loop+0x40/0x90 [ 96.021550][ T4977] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.021566][ T4977] RIP: 0033:0x7f2efb4a7407 [ 96.021580][ T4977] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 96.021594][ T4977] RSP: 002b:00007fff2d76eb30 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 96.021610][ T4977] RAX: ffffffffffffffda RBX: 00007f2efbbfc880 RCX: 00007f2efb4a7407 [ 96.021620][ T4977] RDX: 0000000000080000 RSI: 00007fff2d76ecb0 RDI: ffffffffffffff9c [ 96.021630][ T4977] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 [ 96.021639][ T4977] R10: 0000000000000000 R11: 0000000000000202 R12: 00005597d51827f5 [ 96.021649][ T4977] R13: 00005597d51827f5 R14: 0000000000000001 R15: 00007fff2d773300 [ 96.021669][ T4977] [ 96.021688][ T4977] ERROR: Out of memory at tomoyo_realpath_from_path. [ 96.043539][ T6041] FAULT_INJECTION: forcing a failure. [ 96.043539][ T6041] name failslab, interval 1, probability 1, space 0, times 5 [ 96.058486][ T4977] FAULT_INJECTION: forcing a failure. [ 96.058486][ T4977] name failslab, interval 1, probability 1, space 0, times 2 [ 96.174323][ T4966] FAULT_INJECTION: forcing a failure. [ 96.174323][ T4966] name failslab, interval 1, probability 1, space 0, times 1 [ 96.179533][ T4977] CPU: 0 UID: 0 PID: 4977 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) [ 96.179553][ T4977] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 96.179562][ T4977] Call Trace: [ 96.179568][ T4977] [ 96.179574][ T4977] dump_stack_lvl+0x100/0x190 [ 96.179599][ T4977] should_fail_ex.cold+0x5/0xa [ 96.179619][ T4977] should_failslab+0xc2/0x120 [ 96.179640][ T4977] kmem_cache_alloc_lru_noprof+0x8d/0x6a0 [ 96.179661][ T4977] ? __d_alloc+0x35/0xa50 [ 96.179683][ T4977] __d_alloc+0x35/0xa50 [ 96.179703][ T4977] d_alloc+0x4a/0x1e0 [ 96.179722][ T4977] lookup_one_qstr_excl+0x171/0x250 [ 96.179742][ T4977] ? mnt_want_write+0x161/0x410 [ 96.179758][ T4977] filename_unlinkat+0x275/0x730 [ 96.179776][ T4977] ? __might_fault+0xc5/0x140 [ 96.179792][ T4977] ? __pfx_filename_unlinkat+0x10/0x10 [ 96.179819][ T4977] ? do_getname+0x191/0x390 [ 96.179840][ T4977] __x64_sys_unlink+0x46/0x70 [ 96.179858][ T4977] do_syscall_64+0x115/0x870 [ 96.179875][ T4977] ? clear_bhb_loop+0x40/0x90 [ 96.179894][ T4977] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.179910][ T4977] RIP: 0033:0x7f2efb515937 [ 96.179923][ T4977] Code: 00 00 e9 a9 fd ff ff 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 5f 00 00 00 0f 05 c3 0f 1f 84 00 00 00 00 00 b8 57 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 8b 15 91 b4 0d 00 f7 d8 64 89 02 b8 [ 96.179938][ T4977] RSP: 002b:00007fff2d7730f8 EFLAGS: 00000202 ORIG_RAX: 0000000000000057 [ 96.179953][ T4977] RAX: ffffffffffffffda RBX: 0000000000000bb8 RCX: 00007f2efb515937 [ 96.179963][ T4977] RDX: 0000000000000000 RSI: 0000000005b8d800 RDI: 00005597d518202e [ 96.179972][ T4977] RBP: 0000000000000000 R08: 0000000005b936b0 R09: 0000000000000001 [ 96.179981][ T4977] R10: 0000000000004224 R11: 0000000000000202 R12: 0000000000000000 [ 96.179989][ T4977] R13: 00005597d519d100 R14: 0000000000000001 R15: 0000000000000000 [ 96.180009][ T4977] [ 96.180062][ T4977] udevd[4977]: could not unlink /run/udev/queue: Cannot allocate memory [ 96.204031][ T4966] CPU: 1 UID: 0 PID: 4966 Comm: klogd Not tainted syzkaller #0 PREEMPT(full) [ 96.204052][ T4966] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 96.204060][ T4966] Call Trace: [ 96.204065][ T4966] [ 96.204071][ T4966] dump_stack_lvl+0x100/0x190 [ 96.204095][ T4966] should_fail_ex.cold+0x5/0xa [ 96.204115][ T4966] should_failslab+0xc2/0x120 [ 96.204136][ T4966] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 96.204155][ T4966] ? __alloc_skb+0x5b7/0x710 [ 96.204173][ T4966] ? __alloc_skb+0x140/0x710 [ 96.204193][ T4966] __alloc_skb+0x140/0x710 [ 96.204209][ T4966] ? __alloc_skb+0x5b7/0x710 [ 96.204226][ T4966] ? __pfx___alloc_skb+0x10/0x10 [ 96.204251][ T4966] alloc_skb_with_frags+0xdd/0x760 [ 96.204271][ T4966] ? find_held_lock+0x2b/0x80 [ 96.204295][ T4966] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 96.204313][ T4966] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 96.204334][ T4966] sock_alloc_send_pskb+0x801/0x980 [ 96.204355][ T4966] ? avc_has_perm+0x135/0x1e0 [ 96.204374][ T4966] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 96.204390][ T4966] ? selinux_socket_getpeersec_dgram+0x1a4/0x380 [ 96.204412][ T4966] ? __pfx_selinux_socket_getpeersec_dgram+0x10/0x10 [ 96.204434][ T4966] ? sock_def_readable+0x1d2/0x600 [ 96.204458][ T4966] unix_dgram_sendmsg+0x3c7/0x1810 [ 96.204482][ T4966] ? __pfx_syslog_print+0x10/0x10 [ 96.204501][ T4966] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 96.204523][ T4966] ? selinux_socket_sendmsg+0x198/0x2f0 [ 96.204548][ T4966] __sys_sendto+0x48b/0x4e0 [ 96.204564][ T4966] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 96.204583][ T4966] ? __pfx___sys_sendto+0x10/0x10 [ 96.204605][ T4966] ? do_syslog+0x18c/0x6d0 [ 96.204633][ T4966] ? xfd_validate_state+0x129/0x190 [ 96.204664][ T4966] __x64_sys_sendto+0xe0/0x1c0 [ 96.204681][ T4966] ? do_syscall_64+0x90/0x870 [ 96.204698][ T4966] ? lockdep_hardirqs_on+0x78/0x100 [ 96.204714][ T4966] do_syscall_64+0x115/0x870 [ 96.204730][ T4966] ? clear_bhb_loop+0x40/0x90 [ 96.204749][ T4966] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.204765][ T4966] RIP: 0033:0x7f8c6cd2d407 [ 96.204779][ T4966] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 96.204792][ T4966] RSP: 002b:00007ffee5ec4f50 EFLAGS: 00000202 ORIG_RAX: 000000000000002c [ 96.204807][ T4966] RAX: ffffffffffffffda RBX: 00007f8c6cbddc80 RCX: 00007f8c6cd2d407 [ 96.204817][ T4966] RDX: 0000000000000052 RSI: 00007ffee5ec5090 RDI: 0000000000000003 [ 96.204826][ T4966] RBP: 00007ffee5ec54c0 R08: 0000000000000000 R09: 0000000000000000 [ 96.204835][ T4966] R10: 0000000000004000 R11: 0000000000000202 R12: 00007ffee5ec54d8 [ 96.204844][ T4966] R13: 00007ffee5ec5090 R14: 0000000000000037 R15: 00007ffee5ec5090 [ 96.204864][ T4966] [ 99.576412][ T6046] CPU: 1 UID: 0 PID: 6046 Comm: syz.0.65 Not tainted syzkaller #0 PREEMPT(full) [ 99.576430][ T6046] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 99.576436][ T6046] Call Trace: [ 99.576440][ T6046] [ 99.576444][ T6046] dump_stack_lvl+0x100/0x190 [ 99.576462][ T6046] should_fail_ex.cold+0x5/0xa [ 99.576477][ T6046] should_failslab+0xc2/0x120 [ 99.576492][ T6046] __kmalloc_noprof+0xfc/0x820 [ 99.576505][ T6046] ? trace_kmem_cache_alloc+0xdd/0x100 [ 99.576520][ T6046] ? tnode_new+0x2f7/0x350 [ 99.576538][ T6046] tnode_new+0x2f7/0x350 [ 99.576555][ T6046] fib_insert_alias+0x6e7/0xe30 [ 99.576572][ T6046] ? lockdep_rtnl_is_held+0x26/0x40 [ 99.576587][ T6046] fib_trie_unmerge+0x289/0xbd0 [ 99.576607][ T6046] ? __pfx_fib_trie_unmerge+0x10/0x10 [ 99.576625][ T6046] ? __pfx___mutex_lock+0x10/0x10 [ 99.576643][ T6046] fib_unmerge+0xee/0x510 [ 99.576655][ T6046] ? netdev_name_node_lookup+0x107/0x150 [ 99.576668][ T6046] fib4_rule_configure+0x383/0x10c0 [ 99.576691][ T6046] fib_newrule+0x356/0x1ed0 [ 99.576710][ T6046] ? __ww_mutex_check_waiters+0x81/0x440 [ 99.576726][ T6046] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 99.576740][ T6046] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 99.576754][ T6046] ? __pfx_fib_newrule+0x10/0x10 [ 99.576771][ T6046] ? avc_has_perm_noaudit+0xf0/0x3b0 [ 99.576795][ T6046] ? find_held_lock+0x2b/0x80 [ 99.576812][ T6046] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 99.576827][ T6046] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 99.576845][ T6046] ? __pfx_fib_nl_newrule+0x10/0x10 [ 99.576863][ T6046] rtnetlink_rcv_msg+0x95e/0xe90 [ 99.576879][ T6046] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 99.576898][ T6046] ? ref_tracker_free+0x37e/0x6c0 [ 99.576916][ T6046] netlink_rcv_skb+0x159/0x420 [ 99.576929][ T6046] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 99.576945][ T6046] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 99.576961][ T6046] ? netlink_deliver_tap+0x1ae/0xcc0 [ 99.576981][ T6046] netlink_unicast+0x585/0x850 [ 99.576994][ T6046] ? __pfx_netlink_unicast+0x10/0x10 [ 99.577009][ T6046] netlink_sendmsg+0x8b0/0xda0 [ 99.577022][ T6046] ? __pfx_netlink_sendmsg+0x10/0x10 [ 99.577034][ T6046] ? selinux_socket_sendmsg+0x198/0x2f0 [ 99.577053][ T6046] ____sys_sendmsg+0xa4d/0xbe0 [ 99.577071][ T6046] ? __pfx_netlink_sendmsg+0x10/0x10 [ 99.577083][ T6046] ? __pfx_____sys_sendmsg+0x10/0x10 [ 99.577106][ T6046] ___sys_sendmsg+0x190/0x1e0 [ 99.577126][ T6046] ? __pfx____sys_sendmsg+0x10/0x10 [ 99.577143][ T6046] ? __lock_acquire+0x49f/0x1a40 [ 99.577173][ T6046] __sys_sendmsg+0x160/0x210 [ 99.577187][ T6046] ? __pfx___sys_sendmsg+0x10/0x10 [ 99.577208][ T6046] do_syscall_64+0x115/0x870 [ 99.577220][ T6046] ? clear_bhb_loop+0x40/0x90 [ 99.577234][ T6046] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.577246][ T6046] RIP: 0033:0x7f2419f9df99 [ 99.577256][ T6046] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 99.577267][ T6046] RSP: 002b:00007f241ae14028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 99.577278][ T6046] RAX: ffffffffffffffda RBX: 00007f241a225fa0 RCX: 00007f2419f9df99 [ 99.577285][ T6046] RDX: 0000000020000076 RSI: 00002000000002c0 RDI: 0000000000000003 [ 99.577291][ T6046] RBP: 00007f241a034ec4 R08: 0000000000000000 R09: 0000000000000000 [ 99.577298][ T6046] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 99.577304][ T6046] R13: 00007f241a226038 R14: 00007f241a225fa0 R15: 00007fff7afc3498 [ 99.577317][ T6046] [ 99.580187][ T6041] CPU: 1 UID: 0 PID: 6041 Comm: syz.4.64 Not tainted syzkaller #0 PREEMPT(full) [ 99.580215][ T6041] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 99.580227][ T6041] Call Trace: [ 99.580233][ T6041] [ 99.580240][ T6041] dump_stack_lvl+0x100/0x190 [ 99.580268][ T6041] should_fail_ex.cold+0x5/0xa [ 99.580293][ T6041] should_failslab+0xc2/0x120 [ 99.580318][ T6041] __kmalloc_noprof+0xfc/0x820 [ 99.580341][ T6041] ? tomoyo_profile+0x47/0x60 [ 99.580363][ T6041] ? tomoyo_supervisor+0x65d/0x1340 [ 99.580388][ T6041] tomoyo_supervisor+0x65d/0x1340 [ 99.580411][ T6041] ? __pfx_tomoyo_supervisor+0x10/0x10 [ 99.580440][ T6041] ? tomoyo_realpath_from_path+0xa0/0x690 [ 99.580459][ T6041] ? tomoyo_realpath_from_path+0x19c/0x690 [ 99.580483][ T6041] ? tomoyo_check_acl+0x1f7/0x410 [ 99.580510][ T6041] tomoyo_mount_acl+0x580/0x8b0 [ 99.580539][ T6041] ? is_bpf_text_address+0x8a/0x1a0 [ 99.580570][ T6041] ? __pfx_tomoyo_mount_acl+0x10/0x10 [ 99.580596][ T6041] ? kernel_text_address+0x8d/0x100 [ 99.580617][ T6041] ? unwind_get_return_address+0x59/0xa0 [ 99.580659][ T6041] ? tomoyo_domain+0xb2/0x150 [ 99.580678][ T6041] ? tomoyo_profile+0x47/0x60 [ 99.580710][ T6041] tomoyo_mount_permission+0x214/0x460 [ 99.580737][ T6041] ? tomoyo_mount_permission+0x1f6/0x460 [ 99.580766][ T6041] ? __pfx_tomoyo_mount_permission+0x10/0x10 [ 99.580808][ T6041] security_sb_mount+0xdd/0x270 [ 99.580834][ T6041] path_mount+0x158/0x23d0 [ 99.580860][ T6041] ? __pfx_path_mount+0x10/0x10 [ 99.580880][ T6041] ? lockdep_hardirqs_on+0x78/0x100 [ 99.580901][ T6041] ? putname+0xb1/0x110 [ 99.580919][ T6041] ? kmem_cache_free+0x127/0x6b0 [ 99.580943][ T6041] ? __x64_sys_mount+0x293/0x310 [ 99.580964][ T6041] __x64_sys_mount+0x293/0x310 [ 99.580988][ T6041] ? __pfx___x64_sys_mount+0x10/0x10 [ 99.581018][ T6041] do_syscall_64+0x115/0x870 [ 99.581038][ T6041] ? clear_bhb_loop+0x40/0x90 [ 99.581059][ T6041] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.581077][ T6041] RIP: 0033:0x7f0e41b9df99 [ 99.581093][ T6041] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 99.581109][ T6041] RSP: 002b:00007f0e42a89028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 99.581127][ T6041] RAX: ffffffffffffffda RBX: 00007f0e41e25fa0 RCX: 00007f0e41b9df99 [ 99.581139][ T6041] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000200000000080 [ 99.581149][ T6041] RBP: 00007f0e41c34ec4 R08: 0000000000000000 R09: 0000000000000000 [ 99.581160][ T6041] R10: 0000000000023010 R11: 0000000000000246 R12: 0000000000000000 [ 99.581171][ T6041] R13: 00007f0e41e26038 R14: 00007f0e41e25fa0 R15: 00007ffe421c94a8 [ 99.581194][ T6041] [ 100.238393][ T6052] loop0: detected capacity change from 0 to 32768 [ 100.254727][ T29] audit: type=1400 audit(1785419257.872:267): avc: denied { unmount } for pid=5607 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 100.501728][ T6052] md: could not open device unknown-block(0,0). [ 100.512989][ T6052] md: md_import_device returned -6 [ 100.684343][ T5733] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 101.070007][ T6058] CIFS: Attempting to mount //127.0.0.1/share [ 101.314329][ T6058] CIFS: VFS: Error connecting to socket. Aborting operation. [ 101.358105][ T29] audit: type=1400 audit(1785419258.982:268): avc: denied { create } for pid=6069 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 101.451686][ T6058] CIFS: VFS: cifs_mount failed w/return code = -111 [ 101.493753][ T57] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 101.538665][ T29] audit: type=1400 audit(1785419259.162:269): avc: denied { ioctl } for pid=6069 comm="syz-executor" path="socket:[9914]" dev="sockfs" ino=9914 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 101.602932][ T5611] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 101.636653][ T5611] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 101.646646][ T5611] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 101.678446][ T5611] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 101.705818][ T5611] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 102.243470][ T5733] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 102.285977][ T5733] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 102.514546][ T5733] usb 1-1: New USB device found, idVendor=0489, idProduct=e057, bcdDevice= 0.00 [ 102.597872][ T5733] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.634185][ T5733] usb 1-1: config 0 descriptor?? [ 102.708123][ T57] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 102.830502][ T29] audit: type=1400 audit(1785419260.462:270): avc: denied { create } for pid=6086 comm="syz.2.80" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 102.870621][ T5733] Bluetooth: Can't get state to change to load ram patch err [ 102.893561][ T5733] Bluetooth: Loading patch file failed [ 102.910220][ T5733] ath3k 1-1:0.0: probe with driver ath3k failed with error -121 [ 102.990347][ T29] audit: type=1400 audit(1785419260.492:271): avc: denied { setopt } for pid=6086 comm="syz.2.80" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 103.017187][ T57] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 103.044416][ T2173] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 103.158530][ T29] audit: type=1400 audit(1785419260.772:272): avc: denied { ioctl } for pid=6086 comm="syz.2.80" path="socket:[9959]" dev="sockfs" ino=9959 ioctlcmd=0x8940 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 103.201336][ T188] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 103.454117][ T57] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 103.505923][ T2173] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 103.515832][ T188] usb 5-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 103.530996][ T2173] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 103.564562][ T188] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 103.579296][ T2173] usb 2-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 103.612245][ T2173] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 103.762170][ T2173] usb 2-1: Product: syz [ 103.785706][ T2173] usb 2-1: Manufacturer: syz [ 103.820581][ T2173] usb 2-1: SerialNumber: syz [ 103.916949][ T5611] Bluetooth: hci1: command tx timeout [ 104.364560][ T6084] netlink: 16 bytes leftover after parsing attributes in process `syz.1.79'. [ 104.395886][ T57] bridge_slave_1: left allmulticast mode [ 104.410752][ T57] bridge_slave_1: left promiscuous mode [ 104.434438][ T57] bridge0: port 2(bridge_slave_1) entered disabled state [ 104.497441][ T57] bridge_slave_0: left allmulticast mode [ 104.516336][ T57] bridge_slave_0: left promiscuous mode [ 104.531616][ T6107] loop0: detected capacity change from 0 to 32768 [ 104.540044][ T57] bridge0: port 1(bridge_slave_0) entered disabled state [ 104.631590][ T29] audit: type=1400 audit(1785419262.262:273): avc: denied { read write } for pid=6106 comm="syz.2.84" name="md0" dev="devtmpfs" ino=2822 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 104.675701][ T6113] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 104.704130][ T188] cxacru 5-1:1.0: invalid response length to cm 0x84: 0 [ 104.716859][ T6107] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 104.732538][ T188] ATM dev 0: cxacru_atm_start: CHIP_ADSL_LINE_START returned -5 [ 104.745156][ T29] audit: type=1400 audit(1785419262.262:274): avc: denied { open } for pid=6106 comm="syz.2.84" path="/15/dev/md0" dev="devtmpfs" ino=2822 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 104.768119][ T6113] block device autoloading is deprecated and will be removed. [ 104.895276][ T188] ATM dev 0: ADSL state: running [ 104.906766][ T188] ATM dev 0: ADSL line: down [ 105.874319][ T24] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 105.938046][ T57] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 105.966223][ T57] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 105.992850][ T57] bond0 (unregistering): Released all slaves [ 106.004494][ T5611] Bluetooth: hci1: command tx timeout [ 106.046374][ T24] usb 3-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 106.059343][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 106.080537][ T6126] CIFS: Attempting to mount //127.0.0.1/share [ 106.141989][ T6126] CIFS: VFS: Error connecting to socket. Aborting operation. [ 106.188549][ T6126] CIFS: VFS: cifs_mount failed w/return code = -111 [ 106.589628][ C0] ATM dev 0: usbatm_complete: urb 0xffff8880360a8500 failed (-71)! [ 106.597612][ C0] ATM dev 0: usbatm_complete: urb 0xffff8880360a8b00 failed (-71)! [ 106.605561][ C0] ATM dev 0: usbatm_complete: urb 0xffff8880360a8900 failed (-71)! [ 106.613482][ C0] ATM dev 0: usbatm_complete: urb 0xffff888036531400 failed (-71)! [ 106.622347][ T5797] usb 5-1: USB disconnect, device number 3 [ 106.669072][ T2173] usb 2-1: USB disconnect, device number 4 [ 107.142401][ T24] cxacru 3-1:1.0: invalid response length to cm 0x84: 0 [ 107.158300][ T24] ATM dev 1: cxacru_atm_start: CHIP_ADSL_LINE_START returned -5 [ 107.343105][ T24] ATM dev 1: ADSL state: running [ 107.627702][ T24] ATM dev 1: ADSL line: down [ 107.958299][ T57] hsr_slave_0: left promiscuous mode [ 108.088637][ T57] hsr_slave_1: left promiscuous mode [ 108.146312][ T5611] Bluetooth: hci1: command tx timeout [ 108.262082][ T57] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 108.326466][ T57] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 108.509710][ T57] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 108.552257][ C1] ATM dev 1: usbatm_complete: urb 0xffff888036e31600 failed (-71)! [ 108.560199][ C1] ATM dev 1: usbatm_complete: urb 0xffff888036e31800 failed (-71)! [ 108.568104][ C1] ATM dev 1: usbatm_complete: urb 0xffff888036b31d00 failed (-71)! [ 108.575999][ C1] ATM dev 1: usbatm_complete: urb 0xffff888036b31c00 failed (-71)! [ 108.604372][ T57] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 108.634379][ T5711] cxacru 3-1:1.0: receive of cm 0x88 failed (-71) [ 108.650705][ T5711] ATM dev 1: poll status: error -71 [ 108.664403][ T24] usb 3-1: USB disconnect, device number 5 [ 108.674968][ T5711] ATM dev 1: polling disabled, set adsl_state to 'start' or 'poll' to resume [ 108.721666][ T5711] ================================================================== [ 108.729737][ T5711] BUG: KASAN: slab-use-after-free in __mutex_lock+0x15ca/0x1bd0 [ 108.737351][ T5711] Read of size 8 at addr ffff888078c8aa18 by task kworker/1:4/5711 [ 108.745211][ T5711] [ 108.747512][ T5711] CPU: 1 UID: 0 PID: 5711 Comm: kworker/1:4 Not tainted syzkaller #0 PREEMPT(full) [ 108.747527][ T5711] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 108.747534][ T5711] Workqueue: events cxacru_poll_status [ 108.747554][ T5711] Call Trace: [ 108.747559][ T5711] [ 108.747565][ T5711] dump_stack_lvl+0x100/0x190 [ 108.747579][ T5711] print_report+0x13d/0x4b0 [ 108.747595][ T5711] ? __virt_addr_valid+0x239/0x430 [ 108.747610][ T5711] ? __mutex_lock+0x15ca/0x1bd0 [ 108.747622][ T5711] kasan_report+0xdf/0x1c0 [ 108.747637][ T5711] ? __mutex_lock+0x15ca/0x1bd0 [ 108.747651][ T5711] __mutex_lock+0x15ca/0x1bd0 [ 108.747663][ T5711] ? cxacru_poll_status+0x55b/0xdc0 [ 108.747678][ T5711] ? preempt_schedule_common+0x42/0xc0 [ 108.747689][ T5711] ? preempt_schedule_thunk+0x16/0x40 [ 108.747701][ T5711] ? __pfx___mutex_lock+0x10/0x10 [ 108.747714][ T5711] ? __mutex_unlock_slowpath+0x6da/0x930 [ 108.747727][ T5711] ? __pfx__printk+0x10/0x10 [ 108.747738][ T5711] ? cxacru_poll_status+0x400/0xdc0 [ 108.747752][ T5711] ? cxacru_poll_status+0x4c3/0xdc0 [ 108.747768][ T5711] ? cxacru_poll_status+0x55b/0xdc0 [ 108.747782][ T5711] cxacru_poll_status+0x55b/0xdc0 [ 108.747797][ T5711] ? __pfx_cxacru_poll_status+0x10/0x10 [ 108.747814][ T5711] ? preempt_schedule_thunk+0x16/0x40 [ 108.747826][ T5711] process_one_work+0xa23/0x1940 [ 108.747840][ T5711] ? __pfx_process_one_work+0x10/0x10 [ 108.747854][ T5711] ? __pfx_cxacru_poll_status+0x10/0x10 [ 108.747869][ T5711] worker_thread+0x5ef/0xe50 [ 108.747883][ T5711] ? kthread+0x13a/0x450 [ 108.747893][ T5711] ? __pfx_worker_thread+0x10/0x10 [ 108.747905][ T5711] kthread+0x370/0x450 [ 108.747915][ T5711] ? __pfx_kthread+0x10/0x10 [ 108.747925][ T5711] ret_from_fork+0x72b/0xd50 [ 108.747942][ T5711] ? __pfx_ret_from_fork+0x10/0x10 [ 108.747957][ T5711] ? __switch_to+0x800/0x10f0 [ 108.747968][ T5711] ? __pfx_kthread+0x10/0x10 [ 108.747978][ T5711] ret_from_fork_asm+0x1a/0x30 [ 108.747998][ T5711] [ 108.748002][ T5711] [ 108.941238][ T5711] Allocated by task 24: [ 108.945364][ T5711] kasan_save_stack+0x30/0x50 [ 108.950028][ T5711] kasan_save_track+0x14/0x30 [ 108.954704][ T5711] __kasan_kmalloc+0xaa/0xb0 [ 108.959294][ T5711] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 108.964656][ T5711] cxacru_bind+0xac/0x1440 [ 108.969062][ T5711] usbatm_usb_probe+0x378/0x1b50 [ 108.973984][ T5711] cxacru_usb_probe+0x101/0x200 [ 108.978822][ T5711] usb_probe_interface+0x303/0x8f0 [ 108.983919][ T5711] really_probe+0x241/0xa60 [ 108.988397][ T5711] __driver_probe_device+0x20e/0x450 [ 108.993667][ T5711] driver_probe_device+0x4a/0x140 [ 108.998674][ T5711] __device_attach_driver+0x1df/0x320 [ 109.004020][ T5711] bus_for_each_drv+0x159/0x1e0 [ 109.008860][ T5711] __device_attach+0x1e4/0x4d0 [ 109.013626][ T5711] device_initial_probe+0xaf/0xd0 [ 109.018648][ T5711] bus_probe_device+0x64/0x160 [ 109.023400][ T5711] device_add+0x121d/0x1970 [ 109.027878][ T5711] usb_set_configuration+0xd97/0x1c60 [ 109.033234][ T5711] usb_generic_driver_probe+0xa1/0xe0 [ 109.038576][ T5711] usb_probe_device+0xef/0x400 [ 109.043337][ T5711] really_probe+0x241/0xa60 [ 109.047825][ T5711] __driver_probe_device+0x20e/0x450 [ 109.053084][ T5711] driver_probe_device+0x4a/0x140 [ 109.058079][ T5711] __device_attach_driver+0x1df/0x320 [ 109.063423][ T5711] bus_for_each_drv+0x159/0x1e0 [ 109.068254][ T5711] __device_attach+0x1e4/0x4d0 [ 109.072992][ T5711] device_initial_probe+0xaf/0xd0 [ 109.077988][ T5711] bus_probe_device+0x64/0x160 [ 109.082734][ T5711] device_add+0x121d/0x1970 [ 109.087221][ T5711] usb_new_device.cold+0x685/0x115c [ 109.092402][ T5711] hub_event+0x30a3/0x4a60 [ 109.096805][ T5711] process_one_work+0xa23/0x1940 [ 109.101714][ T5711] worker_thread+0x5ef/0xe50 [ 109.106286][ T5711] kthread+0x370/0x450 [ 109.110335][ T5711] ret_from_fork+0x72b/0xd50 [ 109.114899][ T5711] ret_from_fork_asm+0x1a/0x30 [ 109.119642][ T5711] [ 109.121940][ T5711] Freed by task 24: [ 109.125722][ T5711] kasan_save_stack+0x30/0x50 [ 109.130381][ T5711] kasan_save_track+0x14/0x30 [ 109.135041][ T5711] kasan_save_free_info+0x3b/0x70 [ 109.140053][ T5711] __kasan_slab_free+0x5f/0x80 [ 109.144817][ T5711] kfree+0x22b/0x6c0 [ 109.148699][ T5711] cxacru_unbind+0x1fc/0x3d0 [ 109.153263][ T5711] usbatm_usb_disconnect+0x449/0x7e0 [ 109.158530][ T5711] usb_unbind_interface+0x1dd/0x9e0 [ 109.163703][ T5711] device_remove+0x12a/0x180 [ 109.168273][ T5711] device_release_driver_internal+0x44e/0x620 [ 109.174317][ T5711] bus_remove_device+0x2bc/0x560 [ 109.179235][ T5711] device_del+0x376/0x9b0 [ 109.183547][ T5711] usb_disable_device+0x367/0x810 [ 109.188556][ T5711] usb_disconnect+0x2e2/0x9a0 [ 109.193218][ T5711] hub_event+0x1c4f/0x4a60 [ 109.197607][ T5711] process_one_work+0xa23/0x1940 [ 109.202529][ T5711] worker_thread+0x5ef/0xe50 [ 109.207097][ T5711] kthread+0x370/0x450 [ 109.211144][ T5711] ret_from_fork+0x72b/0xd50 [ 109.215709][ T5711] ret_from_fork_asm+0x1a/0x30 [ 109.220459][ T5711] [ 109.222767][ T5711] Last potentially related work creation: [ 109.228460][ T5711] kasan_save_stack+0x30/0x50 [ 109.233109][ T5711] kasan_record_aux_stack+0xa7/0xc0 [ 109.238284][ T5711] insert_work+0x36/0x230 [ 109.242594][ T5711] __queue_work+0x9bc/0x12b0 [ 109.247164][ T5711] call_timer_fn+0x19a/0x610 [ 109.251724][ T5711] __run_timers+0x570/0xb00 [ 109.256198][ T5711] run_timer_base+0x114/0x190 [ 109.260847][ T5711] run_timer_softirq+0x1a/0x50 [ 109.265595][ T5711] handle_softirqs+0x1ea/0x9b0 [ 109.270347][ T5711] __irq_exit_rcu+0x162/0x210 [ 109.274997][ T5711] irq_exit_rcu+0x9/0x30 [ 109.279223][ T5711] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 109.284839][ T5711] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 109.290800][ T5711] [ 109.293102][ T5711] The buggy address belongs to the object at ffff888078c8a800 [ 109.293102][ T5711] which belongs to the cache kmalloc-1k of size 1024 [ 109.307124][ T5711] The buggy address is located 536 bytes inside of [ 109.307124][ T5711] freed 1024-byte region [ffff888078c8a800, ffff888078c8ac00) [ 109.320983][ T5711] [ 109.323288][ T5711] The buggy address belongs to the physical page: [ 109.329667][ T5711] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888078c8e800 pfn:0x78c88 [ 109.339697][ T5711] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 109.348165][ T5711] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 109.356638][ T5711] page_type: f5(slab) [ 109.360601][ T5711] raw: 00fff00000000240 ffff88813fe23dc0 ffffea0001f00410 ffffea0001461c10 [ 109.369156][ T5711] raw: ffff888078c8e800 000000080010000e 00000000f5000000 0000000000000000 [ 109.377712][ T5711] head: 00fff00000000240 ffff88813fe23dc0 ffffea0001f00410 ffffea0001461c10 [ 109.386364][ T5711] head: ffff888078c8e800 000000080010000e 00000000f5000000 0000000000000000 [ 109.395011][ T5711] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 109.403653][ T5711] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 109.412300][ T5711] page dumped because: kasan: bad access detected [ 109.418679][ T5711] page_owner tracks the page as allocated [ 109.424369][ T5711] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 48, tgid 48 (kworker/u8:3), ts 71299121117, free_ts 51307600438 [ 109.444750][ T5711] post_alloc_hook+0xfd/0x120 [ 109.449408][ T5711] get_page_from_freelist+0xf48/0x3530 [ 109.454840][ T5711] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 109.460715][ T5711] new_slab+0xa2/0x640 [ 109.464769][ T5711] refill_objects+0xe3/0x410 [ 109.469342][ T5711] __pcs_replace_empty_main+0x376/0x680 [ 109.474866][ T5711] __kmalloc_noprof+0x66d/0x820 [ 109.479690][ T5711] ___neigh_create+0x1532/0x2940 [ 109.484603][ T5711] ip6_finish_output2+0xffa/0x1ce0 [ 109.489688][ T5711] __ip6_finish_output+0x357/0xdf0 [ 109.494783][ T5711] ip6_output+0x2aa/0xa60 [ 109.499093][ T5711] ndisc_send_skb+0xa85/0x1bf0 [ 109.503830][ T5711] ndisc_send_ns+0xc6/0x140 [ 109.508317][ T5711] addrconf_dad_work+0xca1/0x1360 [ 109.513324][ T5711] process_one_work+0xa23/0x1940 [ 109.518233][ T5711] worker_thread+0x5ef/0xe50 [ 109.522798][ T5711] page last free pid 5430 tgid 5430 stack trace: [ 109.529101][ T5711] __free_frozen_pages+0x79f/0x1090 [ 109.534276][ T5711] qlist_free_all+0x47/0xf0 [ 109.538750][ T5711] kasan_quarantine_reduce+0x1a0/0x1f0 [ 109.544182][ T5711] __kasan_slab_alloc+0x69/0x90 [ 109.549017][ T5711] __kmalloc_noprof+0x2bf/0x820 [ 109.553849][ T5711] tomoyo_supervisor+0x65d/0x1340 [ 109.558861][ T5711] tomoyo_path_permission+0x270/0x3b0 [ 109.564221][ T5711] tomoyo_check_open_permission+0x37f/0x3c0 [ 109.570102][ T5711] tomoyo_file_open+0x6b/0x90 [ 109.574764][ T5711] security_file_open+0xb5/0x1e0 [ 109.579675][ T5711] do_dentry_open+0x588/0x14d0 [ 109.584419][ T5711] vfs_open+0x82/0x3f0 [ 109.588460][ T5711] path_openat+0x2873/0x4280 [ 109.593021][ T5711] do_file_open+0x20e/0x430 [ 109.597505][ T5711] do_sys_openat2+0x10f/0x1e0 [ 109.602156][ T5711] __x64_sys_openat+0x12d/0x210 [ 109.606982][ T5711] [ 109.609279][ T5711] Memory state around the buggy address: [ 109.614887][ T5711] ffff888078c8a900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 109.622916][ T5711] ffff888078c8a980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 109.630946][ T5711] >ffff888078c8aa00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 109.638986][ T5711] ^ [ 109.643804][ T5711] ffff888078c8aa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 109.651844][ T5711] ffff888078c8ab00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 109.659883][ T5711] ================================================================== [ 110.126097][ T57] veth1_macvtap: left promiscuous mode [ 110.141318][ T57] veth0_macvtap: left promiscuous mode [ 110.154332][ T5611] Bluetooth: hci1: command tx timeout [ 110.163017][ T57] veth1_vlan: left promiscuous mode [ 110.201391][ T5711] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 110.208628][ T5711] CPU: 1 UID: 0 PID: 5711 Comm: kworker/1:4 Not tainted syzkaller #0 PREEMPT(full) [ 110.218015][ T5711] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 110.228079][ T5711] Workqueue: events cxacru_poll_status [ 110.233558][ T5711] Call Trace: [ 110.236831][ T5711] [ 110.239746][ T5711] dump_stack_lvl+0x100/0x190 [ 110.244428][ T5711] vpanic+0x552/0x970 [ 110.248393][ T5711] ? __pfx_vpanic+0x10/0x10 [ 110.252874][ T5711] ? __mutex_lock+0x15ca/0x1bd0 [ 110.257722][ T5711] panic+0xd1/0xe0 [ 110.261425][ T5711] ? __pfx_panic+0x10/0x10 [ 110.265828][ T5711] ? __mutex_lock+0x15ca/0x1bd0 [ 110.270662][ T5711] ? preempt_schedule_common+0x42/0xc0 [ 110.276117][ T5711] ? check_panic_on_warn+0x1f/0x90 [ 110.281210][ T5711] check_panic_on_warn.cold+0x19/0x34 [ 110.286562][ T5711] end_report.part.0+0x3a/0x90 [ 110.291313][ T5711] kasan_report.cold+0xe/0x18 [ 110.295976][ T5711] ? __mutex_lock+0x15ca/0x1bd0 [ 110.300810][ T5711] __mutex_lock+0x15ca/0x1bd0 [ 110.305483][ T5711] ? cxacru_poll_status+0x55b/0xdc0 [ 110.310666][ T5711] ? preempt_schedule_common+0x42/0xc0 [ 110.316119][ T5711] ? preempt_schedule_thunk+0x16/0x40 [ 110.321471][ T5711] ? __pfx___mutex_lock+0x10/0x10 [ 110.326478][ T5711] ? __mutex_unlock_slowpath+0x6da/0x930 [ 110.332091][ T5711] ? __pfx__printk+0x10/0x10 [ 110.336663][ T5711] ? cxacru_poll_status+0x400/0xdc0 [ 110.341845][ T5711] ? cxacru_poll_status+0x4c3/0xdc0 [ 110.347028][ T5711] ? cxacru_poll_status+0x55b/0xdc0 [ 110.352210][ T5711] cxacru_poll_status+0x55b/0xdc0 [ 110.357238][ T5711] ? __pfx_cxacru_poll_status+0x10/0x10 [ 110.362772][ T5711] ? preempt_schedule_thunk+0x16/0x40 [ 110.368126][ T5711] process_one_work+0xa23/0x1940 [ 110.373047][ T5711] ? __pfx_process_one_work+0x10/0x10 [ 110.378404][ T5711] ? __pfx_cxacru_poll_status+0x10/0x10 [ 110.383952][ T5711] worker_thread+0x5ef/0xe50 [ 110.388525][ T5711] ? kthread+0x13a/0x450 [ 110.392746][ T5711] ? __pfx_worker_thread+0x10/0x10 [ 110.397851][ T5711] kthread+0x370/0x450 [ 110.401900][ T5711] ? __pfx_kthread+0x10/0x10 [ 110.406471][ T5711] ret_from_fork+0x72b/0xd50 [ 110.411046][ T5711] ? __pfx_ret_from_fork+0x10/0x10 [ 110.416143][ T5711] ? __switch_to+0x800/0x10f0 [ 110.420800][ T5711] ? __pfx_kthread+0x10/0x10 [ 110.425370][ T5711] ret_from_fork_asm+0x1a/0x30 [ 110.430128][ T5711] [ 110.433334][ T5711] Kernel Offset: disabled [ 110.437632][ T5711] Rebooting in 86400 seconds..