last executing test programs: 1m9.086848954s ago: executing program 4 (id=272): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b000100627269646765000018000280050019"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB, @ANYRES32=0x0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) 1m9.044653415s ago: executing program 4 (id=274): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x28100, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x2) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0xe) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) syz_usb_connect(0x5, 0x2d, &(0x7f00000001c0)=ANY=[@ANYRES8=r0, @ANYBLOB="e774fc5663af43abc2fcd326bf97f18896ffb0a7db0ba08591e8ec70ce4ff337a44bc7c5ecb1dcfbc66ad3b93bb82ab2e888f993885798b224231dae8b65c3793389cb3a5b88e9582288aaf83013e76e9c7854ceb105b261e00086f7b553cc466c1bfaae12bb72b3779453c0ed7c0c5cee3561278078dc28e249c6787ce3d24f358b44d3385091c3b3c60bf4874a29c533284aac0f19", @ANYRES32=r1], 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) writev(r2, &(0x7f0000000180)=[{&(0x7f00000000c0)='A', 0xa}, {&(0x7f0000000000)='^', 0x1}], 0x2) close(0x3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x3d, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x3}, @exit]}, &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) 1m5.901105179s ago: executing program 4 (id=287): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSETELEM={0x3c, 0xc, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x8, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x84}}, 0x0) 1m5.658538211s ago: executing program 4 (id=290): mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='dir0/per_cpu/cpu0/trace_pipe\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x79, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000040)={0x3, 0x0, 0x9, 0xb5e}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x30, &(0x7f0000000400)=0x0) io_submit(r1, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r0, 0x0}]) 1m5.028818231s ago: executing program 4 (id=296): r0 = signalfd(0xffffffffffffffff, &(0x7f0000000040)={[0x3ff]}, 0x8) poll(&(0x7f0000000080)=[{r0, 0x1000}], 0x1, 0xfffffff9) signalfd4(r0, &(0x7f00000003c0)={[0x4]}, 0x8, 0x80000) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x7, 0x0, 0x0, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) ioctl$TIOCGSID(r2, 0x5429, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x20000011) sendmsg$NL80211_CMD_CONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000740)=ANY=[@ANYBLOB="5000000008021100000108021100000008021100000000000000000000000000640001000006020202020202010882848b960c1218245774281aaf9477ff610b40d168cb879927d9a58edbc0fe4b50f6711ff73d87431ef2acf76b1a365e2b19026b7ff38a90889b2e66f9643e8e627081361e1e429ceb4c0584c984b784c7fdfaa94d1d853db07242b27ba36564181d5c30ff9759866fd81c41b01cf763bfd25b90cd1e2a2c2de27ab2999c4a0c66df91d043d0303ade7487e4954a0bf690cf267f81712b8c4a3537738a95bb0620850c9d621dde3c8f7c0b26dfe815e4095b958feb0de18dd8a285b635b5c697"], 0x36) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380)) syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e) nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, &(0x7f0000000480)) syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28) r5 = syz_usb_connect$hid(0xa1c7a9bee845ee69, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="1201d804000000ff711e20204000022d0001a0937c6d9d903abbecd60107f00e09040006010301020809210800000122940009058103100000dc7709050203"], &(0x7f0000000640)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x201, 0x7, 0x7f, 0x0, 0x40, 0x8}, 0x19, &(0x7f0000000540)={0x5, 0xf, 0x19, 0x1, [@ss_container_id={0x14, 0x10, 0x4, 0xff, "8c789a31d2e03d43958d85b53ba2255f"}]}, 0x3, [{0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x810}}, {0x4, &(0x7f00000005c0)=@lang_id={0x4, 0x3, 0x6048}}, {0xf, &(0x7f0000000700)=@string={0xf, 0x3, "4cdb968f8530a32166cca17e34"}}]}) syz_usb_ep_read(r5, 0x4, 0x6b, &(0x7f0000000680)=""/107) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) setsockopt$inet6_tcp_TLS_TX(r7, 0x11a, 0x1, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, 0x0) socket$inet6(0xa, 0x4, 0x7) r8 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_DONE(r8, 0x0, 0xc9, 0x0, 0x0) 1m4.354702274s ago: executing program 4 (id=299): mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='dir0/per_cpu/cpu0/trace_pipe\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x79, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000040)={0x3, 0x0, 0x9, 0xb5e}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x30, &(0x7f0000000400)=0x0) io_submit(r1, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r0, 0x0}]) (fail_nth: 3) 1m3.92170453s ago: executing program 32 (id=299): mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='dir0/per_cpu/cpu0/trace_pipe\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x79, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000040)={0x3, 0x0, 0x9, 0xb5e}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x30, &(0x7f0000000400)=0x0) io_submit(r1, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r0, 0x0}]) (fail_nth: 3) 9.808933235s ago: executing program 3 (id=504): r0 = accept4$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80000) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x200105}, 0x1c) sched_setscheduler(0x0, 0x1, 0x0) r1 = syz_open_dev$mtd(&(0x7f0000000900), 0x46, 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, 0x0, 0x0, 0x0) recvmmsg(r3, 0x0, 0x0, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = shmget(0x1, 0x4000, 0xa20, &(0x7f0000ffb000/0x4000)=nil) shmat(r5, &(0x7f0000ffd000/0x2000)=nil, 0x4000) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mq_unlink(0x0) ioctl$MEMREADOOB64(r1, 0x1269, &(0x7f00000000c0)={0x1}) r6 = socket$inet_udp(0x2, 0x2, 0x0) sendmmsg$inet(r6, &(0x7f00000004c0)=[{{&(0x7f0000000040)={0x2, 0x4e24, @empty}, 0x10, 0x0, 0x0, &(0x7f0000000380)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x2}}, @ip_ttl={{0x14, 0x0, 0x2, 0x8}}], 0x30}}], 0x1, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x2000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4000041}, 0x48884) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r7, 0x1, 0x2e, &(0x7f0000000040)=0x5, 0x4) bind$inet(r7, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) connect$inet(r7, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) 8.823075182s ago: executing program 2 (id=508): openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r0, &(0x7f0000000280)='0', 0x1) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x5c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x94}, @NFTA_SET_DESC={0x18, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0x14, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}]}, {0x4}]}]}]}, @NFT_MSG_NEWSETELEM={0x44, 0xc, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x10, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0xc, 0x1, 'H\x00\x00\x00\x00\x00\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xe8}}, 0x0) 8.663345419s ago: executing program 3 (id=509): r0 = syz_usb_connect(0x3, 0x50, &(0x7f0000000780)=ANY=[@ANYBLOB="1201000200000040ca08100100010102030109023e0001010080fa0904000002ff00000007058302000200070504020002"], 0x0) r1 = epoll_create1(0x0) r2 = fcntl$dupfd(r1, 0x2, 0xffffffffffffffff) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000040)='GPL\x00'}, 0x80) r4 = epoll_create1(0x0) r5 = fcntl$dupfd(r4, 0x2, 0xffffffffffffffff) syz_usb_connect$printer(0x4, 0x2d, &(0x7f0000000180)={{0x12, 0x1, 0x250, 0x7, 0x1, 0x1, 0x40, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x4, 0x40, 0xa, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, "", {{{0x9, 0x5, 0x1, 0x2, 0x400, 0x5, 0xcd, 0xf}}}}}]}}]}}, &(0x7f0000002040)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x201, 0x0, 0x9, 0x8, 0x20, 0x9}, 0x33, &(0x7f0000000480)={0x5, 0xf, 0x33, 0x4, [@ext_cap={0x7, 0x10, 0x2, 0x10, 0xf, 0x5, 0x1}, @ext_cap={0x7, 0x10, 0x2, 0x8, 0x8, 0x1, 0x1}, @ssp_cap={0x14, 0x10, 0xa, 0x3, 0x2, 0x2, 0xf000, 0xfffb, [0xffc01e, 0xff0000]}, @ssp_cap={0xc, 0x10, 0xa, 0x62, 0x0, 0x1caf65c, 0xf, 0x14c3}]}, 0x2, [{0xab, &(0x7f0000001f40)=@string={0xab, 0x3, "63276462c439bcfe2ec80b2a824b76da9bb3d381c1427b48aa440fa227315dbb80e859655cfad9e8a6cc7fdd2ee0f94ddd907726c0f4ea777a74406cf8e60415a24a6cfc1cd731f453cfe6a5a9709ddd84415b5f477d196e7cfcabb9de5dbe94a52cf2333cca1c4998342e0a46d8c9964ba238387c166b38447fd6a91d32c49f37162b9149ed2a1d5271f2403685864f96c7af875568a4a0d84fcd8b03e3b633b3e64e605d345fcc86"}}, {0x4, &(0x7f0000002000)=@lang_id={0x4, 0x3, 0xc09}}]}) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000140)={@cgroup=r5, r3, 0x11, 0x0, r5}, 0x14) bpf$BPF_PROG_ATTACH(0x9, &(0x7f0000000140)={@cgroup=r2, r3, 0x11, 0x0, r2}, 0x11) unshare(0x100000) syz_usb_ep_write(r0, 0x83, 0x0, 0x0) openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/fs/binfmt_misc/syz3\x00', 0x2, 0x0) syz_usb_ep_read(r0, 0x4, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@ipv4_newnexthop={0x28, 0x68, 0x401, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x1}, @NHA_OIF={0x8, 0x5, 0x1}]}, 0x38}}, 0x0) add_key(&(0x7f0000000000)='rxrpc\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="0100000002000000ffffffff0100"/24, 0x18, 0xfffffffffffffffd) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) setsockopt$RXRPC_SECURITY_KEY(0xffffffffffffffff, 0x110, 0x1, &(0x7f0000000040)='syz\x00', 0x4) 8.610276074s ago: executing program 2 (id=510): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000002280)=[{&(0x7f0000000000)=@in6={0xa, 0x4e23, 0x5, @loopback, 0x5}, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x20040040}], 0x1, 0x50) getsockopt$inet6_mptcp_buf(0xffffffffffffffff, 0x11c, 0x2, 0x0, &(0x7f0000000000)) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120100008e88052086800095d89301020301090212000100000000090401"], 0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x10000) ioctl$XFS_IOC_AG_GEOMETRY(0xffffffffffffffff, 0xc080583d, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000440)={0x34, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) getpgid(0x0) r1 = socket(0x10, 0x803, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0xff04, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) socket(0x400000000010, 0x3, 0x0) r2 = syz_open_dev$mtd(&(0x7f0000000100), 0x48a99fbe, 0x10b241) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000880)=ANY=[@ANYBLOB="e00000000002010300000000000000000700001078000a8008000140000000016c00028006000340000100000c00028056000100060000000c000280050e1806e898d32000010011000000060003400000000006000340000200000c00028005000100110000000c00028005000100110000000c000280050001000000000014000180080001007f00000108000200ffffffff540002800c000280050001003a000000060003400004000014000180080001000000000008000200ac1e000114000180080001000a010100080002007f0000010c000280050001003a0000000600034000010000"], 0xe0}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0x0, 0x2}, 0x6) r4 = socket(0x10, 0x803, 0x0) sendto(r4, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) recvmmsg(r4, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0) ioctl$MEMERASE(r2, 0x40084d02, &(0x7f0000000000)={0x7, 0xe}) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x6, 0x4, 0x8, 0x9}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x80, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffb}, 0x94) r5 = getpgid(0xffffffffffffffff) sched_setscheduler(r5, 0x3, &(0x7f0000000000)) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000080)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) 7.135800873s ago: executing program 5 (id=515): r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x2c) r1 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r1, 0x1, 0x3c, &(0x7f0000000340)={0x1, 0x4}, 0x8) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000780), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_GET_ADDR(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f00000003c0)=ANY=[@ANYBLOB="149d0120", @ANYRES16=r3, @ANYBLOB="ffff2abd7000fcdbdf2503000000"], 0x14}, 0x1, 0x0, 0x0, 0x400c9}, 0x20000000) syz_genetlink_get_family_id$smc(&(0x7f0000000280), r2) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000000200)=0x499b, 0x4) sendmmsg$inet6(r1, &(0x7f00000002c0)=[{{&(0x7f0000000000)={0xa, 0x4e25, 0x0, @mcast2}, 0x1c, 0x0}}], 0x1, 0x4004800) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x40980, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r4, 0x800455ca, 0x1) getdents64(r0, &(0x7f0000000100)=""/111, 0x6f) r5 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7, 0x2) ioctl$vim2m_VIDIOC_G_FMT(r5, 0xc0285628, &(0x7f0000000080)={0x3, @win={{0x7, 0x4, 0x9, 0x4}, 0x2, 0x401a, &(0x7f00000021c0)={{0x6, 0x2, 0x5, 0x40}}, 0x3317, 0x0, 0x8}}) mprotect(&(0x7f0000233000/0x2000)=nil, 0x2000, 0x2000007) ioctl$vim2m_VIDIOC_G_FMT(r5, 0xc0285629, &(0x7f0000000080)={0x0, @pix={0x8, 0x10000, 0x59565955, 0x7, 0x6, 0x10001, 0xb, 0x8, 0x0, 0x6, 0x0, 0x7}}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@ipv6_newaddr={0x2c, 0x14, 0x601, 0x0, 0x0, {0xa, 0x40, 0x80, 0x0, 0x1}, [@IFA_ADDRESS={0x14, 0x1, @loopback}]}, 0x2c}}, 0x0) r7 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x20002, 0x207, 0xa}, 0x18) r8 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ioctl$SNDCTL_TMR_STOP(r8, 0x5403) getdents64(r7, 0x0, 0x0) getdents(r0, 0x0, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) r10 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r10, 0xc0145608, &(0x7f0000000040)={0x1b, 0xa, 0x2}) ioctl$VIDIOC_REQBUFS(r10, 0xc0585609, &(0x7f0000000280)={0x20, 0xa, 0x2}) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01060000000000000000020000000900010073797a30000000002c000000030a01060000000000000000020000000900010073797a30000000000900030073797a300000000044000000090a01060000000000000000020000000900010073797a30000000000900020073797a300000000008000a40000000010800054000000004080003400000002060000000060a01060000000000000000020000000900010073797a30000000000900020073797a300000000034000480300001800b00010064796e7365740000200002800900010073797a30000000000800034000000000080004", @ANYRES16=0x0, @ANYRESHEX=r0, @ANYRES64=r0, @ANYRES64=0x0], 0x118}, 0x1, 0x0, 0x0, 0x8006}, 0x20) fcntl$setlease(0xffffffffffffffff, 0x400, 0x2) 6.905319121s ago: executing program 0 (id=516): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x0, 0x0, &(0x7f0000000440)={0x0, 0x0, 0x5, &(0x7f0000000180)={0x5, 0xf, 0x5}}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, &(0x7f0000000100)) 6.379285934s ago: executing program 1 (id=517): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x14, 0x9, 0xa, 0x401, 0x0, 0x0, {0x2}}, @NFT_MSG_NEWSETELEM={0x44, 0xc, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x10, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0xc, 0x1, 'H\x00\x00\x00\x00\x00\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x80}}, 0x0) 6.299560299s ago: executing program 1 (id=518): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x4e20, @empty}}, 0x5, 0x0, 0x3fc, 0x3, 0x32}, 0x9c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x1, 0x20}, 0xc) kcmp$KCMP_EPOLL_TFD(0x0, 0x0, 0x7, r0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x11c0, 0x0) r3 = inotify_init1(0x0) inotify_add_watch(r3, &(0x7f0000000140)='./file0\x00', 0xa4000061) inotify_add_watch(r3, &(0x7f0000000000)='.\x00', 0xc100092e) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2, 0x8) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='new user:syz 000000000000000020'], 0x2a, 0xfffffffffffffffc) add_key(&(0x7f0000000300)='rxrpc_s\x00', &(0x7f0000000180)={'syz', 0x1}, &(0x7f0000000200)="9ac88e0b2c0250ec660d69ed11f82606d7768ec80e5cf88926f09d705a8419f1ea193d677b7fd76349c878e67c3d0a89f147252fb377c461a3eab17c6eeb90d797380e39e8e9877628a03fd3fdac6e91bfde9aa83e439c8fa0d2aaad64167e64172d08aca51c20f9ab8313fc0f7d440e1b5d8b308bed468de7461e4411c91b33dafb7011d1d04b", 0x87, 0xfffffffffffffffe) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000640)={0x0, @in6={{0xa, 0x0, 0x0, @empty, 0x9}}, 0x0, 0xc00, 0x0, 0x0, 0x8a}, 0x9c) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="6e657720757365723a73797a203030303030303030a72cfa0b303030303430393300"], 0x2a, 0x0) add_key(&(0x7f0000000140)='encrypted\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) bind$inet6(r2, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) socket$nl_generic(0x10, 0x3, 0x10) sendto$inet6(r2, &(0x7f0000000700)="00ece16eb7004c870ebd68d5640baee9aac92a2b473848491e2708a4e263ec8a160f93ae307f691f17ec0b2be2d8dd0a4fd5cc0735fd18106e5e9733c38af5cf5b301641a3209402f5dbf173024b8477373c11e684a57c0c4a5defde4df628e90600c246986f000047b6284ba3a1d68521b0c6bab3c9b89166ea3b0500a45d2762f5d3060cc20aadfaece73ca5433b039cfcbec75593f8ec61774d08d00f35ef00439f21b5c5e511b26c305cf089b5ea249add23cce257cdb796447c67c5dfb4894fdc5fe5ad4cf389a7db0154eb6f9e19a07696d59c75bc00c13269e4e21939ecc351ac4b9bef76ea76eb5eb4b70069cbe178d573064f4f", 0xf8, 0x400c054, &(0x7f0000000340)={0xa, 0x4e23, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x100, 0x0, 0x0, 0x0, 0x54, 0x4, 0x73}, 0x9c) openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/net/ipv6/conf/all/forwarding\x00', 0x1, 0x0) 6.221656941s ago: executing program 5 (id=519): r0 = accept4$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80000) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x200105}, 0x1c) sched_setscheduler(0x0, 0x1, 0x0) r1 = syz_open_dev$mtd(&(0x7f0000000900), 0x46, 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r5 = shmget(0x1, 0x4000, 0xa20, &(0x7f0000ffb000/0x4000)=nil) shmat(r5, &(0x7f0000ffd000/0x2000)=nil, 0x4000) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mq_unlink(0x0) ioctl$MEMREADOOB64(r1, 0x1269, &(0x7f00000000c0)={0x1}) r6 = socket$inet_udp(0x2, 0x2, 0x0) sendmmsg$inet(r6, &(0x7f00000004c0)=[{{&(0x7f0000000040)={0x2, 0x4e24, @empty}, 0x10, 0x0, 0x0, &(0x7f0000000380)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x2}}, @ip_ttl={{0x14, 0x0, 0x2, 0x8}}], 0x30}}], 0x1, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x2000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4000041}, 0x48884) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r7, 0x1, 0x2e, &(0x7f0000000040)=0x5, 0x4) bind$inet(r7, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) connect$inet(r7, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) 4.23110216s ago: executing program 0 (id=520): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f0000000040)="5766b1b827f6003300", 0x10) syz_usb_connect(0x3, 0x24, &(0x7f0000000380)=ANY=[@ANYBLOB="12010002c2138940e3050205026b0000009da44143e1eb227205160109021200010100e1"], 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) listen(r0, 0x5) r1 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) syz_usb_connect$hid(0x6, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x251, 0x0, 0x0, 0x0, 0x8, 0x18d1, 0x5030, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x2, 0x80, 0x7, "", [{{0x9, 0x4, 0x0, 0x9, 0x1, 0x3, 0x1, 0x1, 0x3, {0x9, 0x21, 0x0, 0x9, 0x1, {0x22, 0x574}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x6, 0x85, 0x3}}, [{{0x9, 0x5, 0x2, 0x3, 0x200, 0xfc, 0x9, 0x9}}]}}}]}}]}}, &(0x7f0000000300)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x110, 0x6, 0x7, 0x1, 0x20, 0x3}, 0x80, &(0x7f0000000100)={0x5, 0xf, 0x80, 0x1, [@generic={0x7b, 0x10, 0x4, "d4d0b0e4cb7a9e1faa3d9842782e61fc36ff42e8bcd691ac0abeb48eba67d67a5099c2e02d93a56ae9da59888f646a24e43a3b53334239c994f551aad9fa2abda4562f507b5696578d22fdcb4da7b2b6ca831caaaa817d897dc280f05a6741d4f68e7fe1f9d7cf96dd7757f3f91f60c86a65bb84ef743667"}]}, 0x4, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0xfcff}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x447}}, {0x89, &(0x7f0000000200)=@string={0x89, 0x3, "e12193e7d717df1af424201ae93464484d151f355ed610ec93d72955c76a2311f9173124a4766ecd2e120e9887a63b9f2a244213b607f4df846f3bf04b885a30bec932cac5b917e4b97290330d203abbf8551e24dfae9c07f595f0baeeb6482d59b2e1c59e794d2cb58a7bd24739141b6dc0c19c2f9bdb9ef728faf4c95e6714b3767883db6575"}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x458}}]}) shutdown(r0, 0x0) 4.230585048s ago: executing program 1 (id=521): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x24000804) 4.175789004s ago: executing program 2 (id=522): r0 = syz_usb_connect(0x2, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000751c0110e60f00989ad1010203010902240001000000000904290202b48cbb0009050402100000fa000905820240"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000280)={@mcast1, 0x800, 0x0, 0x103, 0x9}, 0x20) memfd_create(&(0x7f00000009c0)='&(:\x00', 0x4) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) dup(0xffffffffffffffff) epoll_create1(0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a010400000000000000000200000708000240000000020900010073797a31000000004c000000030a01040000000000000000020000070900010073797a31000000000900030073797a320000000014000480080001000000000308000200000000000b00070066696c746572000084000000060a01040000000000000000020000070900010073797a31000000000900020073797a320000000058000480540001800a0001006d61746368000000440002800b0001006e6661636374000008000200000000002c00030073797a300000000000000000000000000000000000000000000000000000000000000000000000001400000011000100"], 0x120}}, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000000500), 0x8, 0x0) syz_io_uring_setup(0x77a, &(0x7f0000000580)={0x0, 0x8b2, 0x13500, 0xfffffffe, 0x304}, &(0x7f0000000240), &(0x7f0000001880), &(0x7f0000000000)) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/block/nullb0/queue/nr_requests\x00', 0x2, 0x0) write(r5, &(0x7f00000001c0)='1', 0x1) setsockopt$inet6_int(r1, 0x29, 0x1000000000021, &(0x7f0000000040)=0x5, 0x4) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff, 0x24049c5ab4f788a9, 0x0, @val=@perf_event={0x75bbff9f}}, 0x18) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) 4.139806906s ago: executing program 3 (id=523): openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r0, &(0x7f0000000280)='0', 0x1) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x58, 0x9, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x94}, @NFTA_SET_DESC={0x14, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}]}]}]}]}, @NFT_MSG_NEWSETELEM={0x44, 0xc, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x10, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0xc, 0x1, 'H\x00\x00\x00\x00\x00\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xe4}}, 0x0) 4.107506182s ago: executing program 1 (id=524): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) ftruncate(r0, 0x200000) pwrite64(r0, &(0x7f0000000100), 0x0, 0x1be) pwrite64(r0, &(0x7f0000000100)="55aa", 0x2, 0x1fe) pwrite64(r0, &(0x7f0000000100)='PRIVHEAD', 0x8, 0xc00) pwrite64(r0, &(0x7f0000000100)="0002000b", 0x4, 0xc0c) pwrite64(r0, &(0x7f0000000100)='12345678-1234-1234-1234-123456789612', 0x24, 0xc30) pwrite64(r0, &(0x7f0000000100)="0000000000000001", 0x8, 0xd1b) pwrite64(r0, &(0x7f0000000100)="00000000000007ff", 0x8, 0xd23) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\b', 0x7, 0xd2b) pwrite64(r0, &(0x7f0000000100)='PRIVHEAD', 0x8, 0x1e8000) pwrite64(r0, &(0x7f0000000100)="0002000b", 0x4, 0x1e800c) pwrite64(r0, &(0x7f0000000100)='12345678-1234-1234-1234-123456789612', 0x24, 0x1e8030) pwrite64(r0, &(0x7f0000000100)="00000000000007ff", 0x8, 0x1e8123) pwrite64(r0, &(0x7f00000000c0)="da3d3800", 0x4, 0x1e812b) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', '\x00', '\x00', [0x0, 0x3]}) 3.775958785s ago: executing program 3 (id=525): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) ftruncate(r0, 0x200000) pwrite64(r0, 0x0, 0x0, 0x1be) pwrite64(r0, &(0x7f0000000100)="55aa", 0x2, 0x1fe) pwrite64(r0, &(0x7f0000000100)='PRIVHEAD', 0x8, 0xc00) pwrite64(r0, &(0x7f0000000100)="0002000b", 0x4, 0xc0c) pwrite64(r0, &(0x7f0000000100)='12345678-1234-1234-1234-123456789612', 0x24, 0xc30) pwrite64(r0, &(0x7f0000000100)="0000000000000001", 0x8, 0xd1b) pwrite64(r0, &(0x7f0000000100)="00000000000007ff", 0x8, 0xd23) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\b', 0x7, 0xd2b) pwrite64(r0, &(0x7f0000000100)='PRIVHEAD', 0x8, 0x1e8000) pwrite64(r0, &(0x7f0000000100)="0002000b", 0x4, 0x1e800c) pwrite64(r0, &(0x7f0000000100)='12345678-1234-1234-1234-123456789612', 0x24, 0x1e8030) pwrite64(r0, &(0x7f0000000100)="00000000000007ff", 0x8, 0x1e8123) pwrite64(r0, &(0x7f00000000c0)="da3d3800", 0x4, 0x1e812b) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', '\x00', '\x00', [0x0, 0x3]}) 3.704695852s ago: executing program 1 (id=526): syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b36"], 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='fdinfo\x00') socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8b05, &(0x7f0000000200)={'wlan1\x00'}) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) linkat(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, 0x0, 0x1000) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x1}) capset(&(0x7f0000000000)={0x20071026}, &(0x7f0000000080)={0x7, 0x3ff, 0x2, 0x800, 0x3, 0x9}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x0) move_mount(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, 0x0, 0x145) getdents64(r0, 0x0, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x181603, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r3, 0x40085112, &(0x7f0000000040)=@e={0xff, 0xa, 0x5, 0x88, @generic=0x6, 0x2, 0x70, 0xb5}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002a02040095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000015c0)=ANY=[@ANYRES32=r6, @ANYRES32=r7, @ANYBLOB="05"], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r6}, &(0x7f00000006c0), &(0x7f0000000700)=r5}, 0x20) sendmsg$inet(r4, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1}, 0x3) 3.556022192s ago: executing program 3 (id=527): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000003c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r2 = accept4(r1, 0x0, 0x0, 0x80000) sendmsg$alg(r2, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x80}, 0x4004080) syz_genetlink_get_family_id$batadv(&(0x7f0000000180), r2) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(r2, &(0x7f0000000d40)={0x0, 0x0, &(0x7f0000000d00)={&(0x7f0000001480)={0x64, 0x0, 0x2, 0x70bd26, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x47, 0x2a, [@rann={0x7e, 0x15, {{0x1, 0x7}, 0x81, 0xe, @broadcast, 0x6, 0x9}}, @mesh_chsw={0x76, 0x6, {0x5f, 0x91, 0x20, 0x3}}, @perr={0x84, 0x22, {0xf7, 0x2, [{{0x0, 0x1}, @broadcast, 0x8001, @value, 0x17}, {{}, @device_b, 0x0, @void, 0x2f}]}}]}]}, 0x64}, 0x1, 0x0, 0x0, 0xc004050}, 0x8000) sendmsg$NL80211_CMD_UPDATE_CONNECT_PARAMS(r2, &(0x7f00000026c0)={0x0, 0x0, &(0x7f0000002680)={&(0x7f0000001540)={0x28c, 0x0, 0x400, 0x70bd29, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@fils_params=[@NL80211_ATTR_FILS_ERP_USERNAME={0x4}], @fils_params=[@NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM={0x6, 0xfb, 0x8000}, @NL80211_ATTR_FILS_ERP_USERNAME={0x4}, @NL80211_ATTR_FILS_ERP_RRK={0xf1, 0xfc, "8cfb4e521f87c4f4f9af695006813e0ef9561e1369ed43465744011a59063170a85737be79d2d35bc44c619094431f6e2a7fefdd168e89c4899aaf25a71e5b6f4726a8319ebc36eff6d2a32d0f3b69bc4551a39937091b6f5e2ee91e02d7073981db33c8b57883f4855b1267853504681bf6b34b4b2ef595f398018d67341e6393b636fe467a4c90a7443efa324b6a506f7e7388525a7c5fdeda194edff496dda5cccf3520a00167340d6a8220762afc8f82142b983bdc34071280990bee319671ea0ea677699065cceb659f49e7c00ba7db3da72511f2628d83c416c65af8f171d8c9767fd233d8e7fa45b3b3"}, @NL80211_ATTR_FILS_ERP_REALM={0x169, 0xfa, "635d24719928083bee086edb4431e019b5fb3eade28d7fa1472ba63fa5c4a42874e275463581f03ae70759600994e52e8252e7630b6b88e2460408c1d23afa06fd5c3142edebdaa5d43392ca42171a01787706d281c0937a62f67e91c3a273c25513dbc927a14634e41b8a2c596dbe7a45bbaa0e656cc25b7988bdc4251178f5545b290a562069d316c46e0ac8f3b7ad4aa86db81236fa47114b6426b0b1bc64faa8bc881a283580b523652e198a998c58f10e5ded8fc26a4c5b0be4f33eec2d37ce089d9d4e1ed19a176c79bd4dafd1128bcedbd370e97fb3a0c5308cc5be24b2d750b4a951fdf979b8f70a12821c95ff73e3ec840eff5b46f4d6e91c57576f62090b72ec826728797a1ca94fdebf3c35244e06296580427d85333f2830271d9a05c5db732a0b4640bffde4a29be831130c4157a0e9cb18c016c200483bb9d990a0c2c542a9744a945e558c6cbce0c403caf167c138a24f662718636ef8874df204735425"}]]}, 0x28c}, 0x1, 0x0, 0x0, 0x94}, 0x4) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010008020000001800006600000008000300", @ANYRES32=r5, @ANYBLOB="08002600940900000800b70099"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="90000000", @ANYRES16=r6, @ANYBLOB="010026bd7000000000003b00000008000300", @ANYRES32=r5, @ANYBLOB="0600cd00000000006c003300802009000802110000010802110000005050505050505f00ff"], 0x90}, 0x1, 0x0, 0x0, 0xc0}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r2, &(0x7f0000000240)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x20, r6, 0x300, 0x70bd25, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) r8 = socket(0x10, 0x803, 0x0) r9 = syz_genetlink_get_family_id$devlink(&(0x7f00000002c0), r4) sendmsg$DEVLINK_CMD_RATE_GET(r4, &(0x7f0000000580)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000540)={&(0x7f0000000440)={0x8c, r9, 0x100, 0x70bd2b, 0x25dfdbff, {}, [@DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @DEVLINK_ATTR_RATE_NODE_NAME={0xf, 0xa8, @name2}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x10}, 0x4000085) ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x8914, &(0x7f0000000000)={'vxcan1\x00', 0x800}) r10 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r10, &(0x7f0000000680)='dummy_udc.0', 0xb) ioctl$sock_bt_bnep_BNEPCONNADD(r10, 0x400442c8, &(0x7f0000000600)={0xffffffffffffffff, 0xfffffffd, 0x8001, "fbeabd5e03e31303632d0610fcb6e347dbbfc1ed6215098bdb3bead18b25eafdb5f76672efadefe03e155c1936d1e0f9e842d3213a8596611cba73e38eb47a7822facfc6dcddb0668c9f9c047110ff9dc6545831da39d83f78a946465a6fb856adf8ad9a04830e69751d6fd478bdbafa553c0f7d408583bd7fc60ab75f38d0ed99680e565b5ba93b6ee7bd183f3f615af40e9a8f85a19f4f6a50547e2e5923382227bba8d595273cfea00fccdb286e9078df580f27b75ee562a67ffed76d823669fa128b53e0f07a905fb59a3e63895a74c83509531bf22e7531d7a6429697b4afdfc68613a4c0fc95272b3c94"}) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), r8) getsockname$packet(r8, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000005c0)=0x44) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000300)=ANY=[@ANYBLOB="800000001000390400000000fbdbdf2500000000", @ANYRES32=r11, @ANYBLOB="01990000419a0400600012800b000100697036746e6c000050000280060010000200000014000300fe8000000000000000000000000000aa0500060005000000080008002e"], 0x80}}, 0x0) sendto$packet(r0, &(0x7f0000000400)="05d936277c6f5422007f83477ca1b278e3e4018a34e7bfd3de1a00ad6762646c95c716727eb53bcc", 0x28, 0x40880, &(0x7f0000000200)={0x11, 0x86dd, r11, 0x1, 0x4, 0x6, @local}, 0x14) 3.394182241s ago: executing program 0 (id=528): mmap(&(0x7f0000400000/0x3000)=nil, 0x3000, 0x2000009, 0x4d032, 0xffffffffffffffff, 0xf5bc2000) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='numa_maps\x00') r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001300), 0x40, 0x0) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x24020000) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0xa4, 0x9, 0x6, 0x5, 0x0, 0x0, {0x3, 0x0, 0x3}, [@IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x4}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x67}, @IPSET_ATTR_SKBQUEUE={0x6}]}, @IPSET_ATTR_ADT={0x10, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e20}}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_ADT={0x58, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x2}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_NAME={0x9, 0x12, 'syz2\x00'}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x1ff}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_PACKETS={0xc, 0x19, 0x1, 0x0, 0x80000000}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x1}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x20008080}, 0x4090) r4 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = syz_pidfd_open(r4, 0x0) setns(r5, 0x24020000) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x1102) ioctl$sock_SIOCGPGRP(r6, 0x8904, &(0x7f0000000240)=0x0) prlimit64(r7, 0x2, &(0x7f0000000280)={0x4, 0xffffffffffffffff}, &(0x7f00000002c0)) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = open(&(0x7f0000000280)='.\x00', 0x0, 0x4) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r10 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000001780)=@delsa={0x28, 0x11, 0x10, 0x70bd2b, 0x25dfdbfe, {@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4d5, 0x2, 0x6c}}, 0x28}, 0x1, 0x0, 0x0, 0x20000115}, 0x48000) writev(r10, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r11 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42f82, 0x0) ioctl$SNDCTL_DSP_SPEED(r11, 0xc0045002, &(0x7f0000000040)=0x200) write$dsp(r11, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) syz_genetlink_get_family_id$nl80211(&(0x7f0000001880), 0xffffffffffffffff) sendmsg$NL80211_CMD_DEL_PMK(r9, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x400c000}, 0x4040001) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000240), r8) setresuid(0xee00, 0xee00, 0x0) 3.166696944s ago: executing program 5 (id=529): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r0, 0x11c, 0x4, 0x0, &(0x7f00000000c0)=0x28) r1 = add_key(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000300)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r1, &(0x7f0000000040)='asymmetric\x00', 0x0) 2.614859539s ago: executing program 0 (id=530): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x0, 0x0, &(0x7f0000000440)={0x0, 0x0, 0x5, &(0x7f0000000180)={0x5, 0xf, 0x5}}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, &(0x7f0000000100)) 2.512400213s ago: executing program 5 (id=531): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000480)=@nat={'nat\x00', 0x670, 0x5, 0x408, 0x2b8, 0x2b8, 0xfeffffff, 0x200, 0xf0, 0x370, 0x370, 0xffffffff, 0x370, 0x370, 0x5, 0x0, {[{{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 'veth0_to_bond\x00', 'veth1_to_team\x00', {}, {0xff}, 0x6, 0x2, 0x21}, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@tcpmss={{0x28}, {0x1e6, 0x1e6}}, @common=@addrtype={{0x30}, {0x8, 0x68a, 0x0, 0x1}}]}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x0, 0xf, 0x1}}}, {{@uncond, 0x0, 0xd8, 0x110, 0x0, {}, [@common=@set={{0x40}, {{0x0, [0x4000000, 0x4000000, 0x1000000, 0x4000003]}}}, @common=@ttl={{0x28}, {0x1, 0xa2}}]}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x0, @broadcast, @remote, @icmp_id=0x68, @icmp_id=0x67}}}}, {{@ip={@dev={0xac, 0x14, 0x14, 0x6a}, @dev={0xac, 0x14, 0x14, 0x14}, 0x0, 0x0, 'lo\x00', 'ip6tnl0\x00', {}, {}, 0x5c}, 0x0, 0x70, 0xb8}, @unspec=@DNAT1={0x48, 'DNAT\x00', 0x1, {0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @local}, @ipv6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @port=0x4e20, @icmp_id=0x68}}}, {{@ip={@remote, @private=0xa010101, 0x0, 0x0, 'pim6reg0\x00', 'netpci0\x00', {0xff}, {}, 0x0, 0x3}, 0x0, 0x70, 0xb8}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x0, @ipv4=@remote, @ipv4=@broadcast, @port, @gre_key=0x4}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x468) 2.468579696s ago: executing program 3 (id=532): ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000000200)={0xffffffffffffffff, 0x0, 0x8000, 0x0, 0x7, 0x0, &(0x7f0000000140)=0x6}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000080)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000140)={'syzkaller0\x00', 0x1}) r2 = socket$inet_sctp(0x2, 0x1, 0x84) bind(r2, &(0x7f0000000000)=@in={0x2, 0x3210, @rand_addr=0xac140001}, 0x10) r3 = syz_open_procfs(0x0, &(0x7f0000000240)='net/netstat\x00') ioctl$TUNGETFILTER(r0, 0x801054db, &(0x7f0000000540)=""/231) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000000000/0x1000)=nil, 0x1000, &(0x7f0000000100)='maps\x00') syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000041c0)={&(0x7f0000000080)={0x50, 0x0, 0x0, {0x7, 0x29, 0x7, 0x12510421, 0x0, 0xc, 0x1, 0x56, 0x0, 0x0, 0x2}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = syz_usb_connect(0x0, 0x32, &(0x7f0000001000)=ANY=[@ANYBLOB="1201000200000040501d4d610001000000010902200001010080320904000002ff00000007050102"], 0x0) syz_usb_control_io(r4, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000100)={0x20, 0x90069109b15ef6c8, 0x1e, "4d61501d0100000000000000100000000000800700000000000038040000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r4, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000200)=ANY=[@ANYBLOB="40400101000080"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r4, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r4, 0x0, &(0x7f0000000d80)={0x34, &(0x7f0000000a80)=ANY=[@ANYBLOB="401605"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000240)={0x20, 0x80, 0x1c, {0xa, 0x7, 0xa, 0x7, 0x5, 0x3, 0x7, 0x47, 0x14, 0x9, 0x4, 0x2}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r4, 0x0, &(0x7f0000000480)={0x2c, &(0x7f0000000240)=ANY=[@ANYBLOB="200f14"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r4, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000300)=ANY=[@ANYBLOB="e1094101000084"], 0x0, 0x0, 0x0, 0x0}) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0xc0686611, &(0x7f0000000040)={0x68, 0x0, 0x17, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) listen(r2, 0x5) write$tun(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="00000800010000000000140008004500003c000000004084ca2502020202ac14000104d2321000000000000000000a"], 0x4a) socket$nl_rdma(0x10, 0x3, 0x14) symlinkat(&(0x7f0000000180)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) setxattr$trusted_overlay_redirect(&(0x7f0000000100)='./file1\x00', &(0x7f0000000300), 0x0, 0x0, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000480)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@userxattr}]}) chdir(&(0x7f00000003c0)='./bus\x00') 1.921646813s ago: executing program 5 (id=533): r0 = syz_usb_connect(0x3, 0x50, &(0x7f0000000780)=ANY=[@ANYBLOB="1201000200000040ca08100100010102030109023e0001010080fa0904000002ff00000007058302000200070504020002"], 0x0) r1 = epoll_create1(0x0) r2 = fcntl$dupfd(r1, 0x2, 0xffffffffffffffff) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000040)='GPL\x00'}, 0x80) r4 = epoll_create1(0x0) r5 = fcntl$dupfd(r4, 0x2, 0xffffffffffffffff) syz_usb_connect$printer(0x4, 0x2d, &(0x7f0000000180)={{0x12, 0x1, 0x250, 0x7, 0x1, 0x1, 0x40, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x4, 0x40, 0xa, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, "", {{{0x9, 0x5, 0x1, 0x2, 0x400, 0x5, 0xcd, 0xf}}}}}]}}]}}, &(0x7f0000002040)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x201, 0x0, 0x9, 0x8, 0x20, 0x9}, 0x33, &(0x7f0000000480)={0x5, 0xf, 0x33, 0x4, [@ext_cap={0x7, 0x10, 0x2, 0x10, 0xf, 0x5, 0x1}, @ext_cap={0x7, 0x10, 0x2, 0x8, 0x8, 0x1, 0x1}, @ssp_cap={0x14, 0x10, 0xa, 0x3, 0x2, 0x2, 0xf000, 0xfffb, [0xffc01e, 0xff0000]}, @ssp_cap={0xc, 0x10, 0xa, 0x62, 0x0, 0x1caf65c, 0xf, 0x14c3}]}, 0x2, [{0xab, &(0x7f0000001f40)=@string={0xab, 0x3, "63276462c439bcfe2ec80b2a824b76da9bb3d381c1427b48aa440fa227315dbb80e859655cfad9e8a6cc7fdd2ee0f94ddd907726c0f4ea777a74406cf8e60415a24a6cfc1cd731f453cfe6a5a9709ddd84415b5f477d196e7cfcabb9de5dbe94a52cf2333cca1c4998342e0a46d8c9964ba238387c166b38447fd6a91d32c49f37162b9149ed2a1d5271f2403685864f96c7af875568a4a0d84fcd8b03e3b633b3e64e605d345fcc86"}}, {0x4, &(0x7f0000002000)=@lang_id={0x4, 0x3, 0xc09}}]}) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000140)={@cgroup=r5, r3, 0x11, 0x0, r5}, 0x14) bpf$BPF_PROG_ATTACH(0x9, &(0x7f0000000140)={@cgroup=r2, r3, 0x11, 0x0, r2}, 0x11) unshare(0x100000) syz_usb_ep_write(r0, 0x83, 0x0, 0x0) openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/fs/binfmt_misc/syz3\x00', 0x2, 0x0) syz_usb_ep_read(r0, 0x4, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@ipv4_newnexthop={0x28, 0x68, 0x401, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x1}, @NHA_OIF={0x8, 0x5, 0x1}]}, 0x38}}, 0x0) r7 = socket$rxrpc(0x21, 0x2, 0x2) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) setsockopt$RXRPC_SECURITY_KEY(r7, 0x110, 0x1, &(0x7f0000000040)='syz\x00', 0x4) 1.061230009s ago: executing program 0 (id=534): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x24000804) 940.035766ms ago: executing program 2 (id=535): openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r0, &(0x7f0000000280)='0', 0x1) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x58, 0x9, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x94}, @NFTA_SET_DESC={0x14, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}]}]}]}]}, @NFT_MSG_NEWSETELEM={0x44, 0xc, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x10, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0xc, 0x1, 'H\x00\x00\x00\x00\x00\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xe4}}, 0x0) 788.785913ms ago: executing program 2 (id=536): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) ftruncate(r0, 0x200000) pwrite64(r0, &(0x7f0000000100), 0x0, 0x1be) pwrite64(r0, &(0x7f0000000100)="55aa", 0x2, 0x1fe) pwrite64(r0, &(0x7f0000000100)='PRIVHEAD', 0x8, 0xc00) pwrite64(r0, &(0x7f0000000100)="0002000b", 0x4, 0xc0c) pwrite64(r0, &(0x7f0000000100)='12345678-1234-1234-1234-123456789612', 0x24, 0xc30) pwrite64(r0, &(0x7f0000000100)="0000000000000001", 0x8, 0xd1b) pwrite64(r0, &(0x7f0000000100)="00000000000007ff", 0x8, 0xd23) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\b', 0x7, 0xd2b) pwrite64(r0, &(0x7f0000000100)='PRIVHEAD', 0x8, 0x1e8000) pwrite64(r0, &(0x7f0000000100)="0002000b", 0x4, 0x1e800c) pwrite64(r0, &(0x7f0000000100)='12345678-1234-1234-1234-123456789612', 0x24, 0x1e8030) pwrite64(r0, &(0x7f0000000100)="00000000000007ff", 0x8, 0x1e8123) pwrite64(r0, &(0x7f00000000c0)="da3d3800", 0x4, 0x1e812b) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', '\x00', '\x00', [0x0, 0x3]}) 757.574746ms ago: executing program 0 (id=537): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0600000004000000080000000a"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0xb, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000004c0)={'syzkaller1\x00', 0x0}) openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000180), 0x12500, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xd}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r9 = socket$unix(0x1, 0x1, 0x0) r10 = socket$kcm(0x11, 0x3, 0x0) r11 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x20a201, 0x0) close(r11) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000a80)=@newtfilter={0xb4, 0x2c, 0xd27, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x0, 0x4}, {}, {0x8, 0xfff2}}, [@filter_kind_options=@f_matchall={{0xd}, {0x80, 0x2, [@TCA_MATCHALL_ACT={0x7c, 0x2, [@m_tunnel_key={0x78, 0x1, 0x0, 0x0, {{0xf}, {0x48, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0x5, @empty}, @TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @ipv4={'\x00', '\xff\xff', @remote}}, @TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x3, 0x8, 0x20000000, 0x7fff, 0x7}, 0x1}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}}]}, 0xb4}, 0x1, 0x0, 0x0, 0x8080}, 0x20000000) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r10, 0x107, 0xf, &(0x7f0000000600), 0x10) sendmsg$kcm(r10, &(0x7f0000000280)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r12, 0x36}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000000)="27030200000214000e00002fb96dffff1144ee163cddcb000000800000827600000000000000", 0x26}, {&(0x7f0000000640)="442ea407603a16ff", 0x8}], 0x2}, 0x20000085) syz_io_uring_setup(0x53a, 0x0, 0x0, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000200)={r2, r4, 0x25, 0x4, @void}, 0x10) writev(r0, &(0x7f0000000a80)=[{&(0x7f0000000440)="2e9b3d0007e03dd65193dfb6c575963f88a8", 0x12}], 0x1) 498.407282ms ago: executing program 2 (id=538): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = gettid() timer_create(0x8, &(0x7f00000000c0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x40001, 0x0) ioctl$BLKZEROOUT(r3, 0x127f, &(0x7f0000000240)={0x600, 0x1000000}) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="4400000010000104a5270b7357000000925e4a44", @ANYRES32, @ANYBLOB="0dfa130016000000240012000c00010000000000000000000c0002f60800000001180000080001"], 0x44}}, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000280)={r1, 0x7, 0x104, 0x3}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB='H'], 0x48}, 0x1, 0x0, 0x0, 0x20004810}, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[@ANYBLOB="b4000000190001002abd7000ffdbdf251d0109005000118049003780d237a5562658dec4cf9e08a3b19be99e74ce70b4e220a9e627302801adb664d0a5f023189527c0db80dc95bf7fb4bfd92396de768f8b5d8e1c994b69895cdb44211156f2840000004d0012803b6f2811032d68bea0610f2044f47c2842b277eb4bc53070416c6050e46d2e0d055c97c9e7f9bf0bafe4af56eba9024644942e3645a3e6db0d1191744909497df00d71d2273b51a037"], 0xb4}, 0x1, 0x0, 0x0, 0x4004001}, 0x0) 314.701496ms ago: executing program 1 (id=539): r0 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r2, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc) r3 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r3, &(0x7f0000000280)={0x10, 0x0, 0x0, 0x800000}, 0xc) r4 = socket$netlink(0x10, 0x3, 0x2) bind$netlink(r4, &(0x7f0000000200)={0x10, 0x0, 0x0, 0x100000}, 0xc) r5 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r5, &(0x7f0000000080)={0x10, 0x0, 0xfffffffc, 0x8}, 0xc) r6 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r6, &(0x7f0000000280)={0x10, 0x0, 0x25dfdbfb, 0x80}, 0xc) r7 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r7, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x22ffffffff}, 0xc) r8 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r8, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x400}, 0xc) r9 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r9, 0x0, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r10, &(0x7f0000000340)={0x10, 0x0, 0x25dfdbfe, 0x100000}, 0xc) socket$netlink(0x10, 0x3, 0xc) r11 = socket$netlink(0x10, 0x3, 0x14) bind$netlink(r11, &(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000000}, 0xc) r12 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r12, &(0x7f0000000280)={0x10, 0x0, 0x0, 0x100000}, 0xc) bind$netlink(r1, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x80020000}, 0x48) r13 = socket$netlink(0x10, 0x3, 0x4) writev(r13, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e422000000000100804824cabecc4b381eaadc28f23457e792945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff", 0x58}], 0x1) 0s ago: executing program 5 (id=540): pipe(&(0x7f0000002680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f00000005c0)='fd', 0x0, r0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x2) fchdir(r2) open(&(0x7f0000000000)='.\x00', 0x0, 0x244) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="08819c028b1dd0c2074cc75ae3a14757c95c618338271b0044b4c0725ca2cf9da71feff3d005d5a769b0fbd153757abda7ad8b110d071f5b97c7"], 0x7) socket$kcm(0x10, 0x2, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4, &(0x7f0000006680)) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000940)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$kvm(0xffffffffffffff9c, 0x0, 0x40201, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, 0x0) syz_usb_control_io$uac2(0xffffffffffffffff, 0x0, 0x0) openat$kvm(0xffffff9c, 0x0, 0x800, 0x0) r3 = socket(0x10, 0x3, 0x0) write(r3, &(0x7f0000000000)="2400000011005f0414f9f40700090400810000000d0000000000000008000f0001000000", 0x24) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r3, 0xd000943e, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r4, 0x6, 0x2, &(0x7f0000000040)=0x200, 0x4) setsockopt$inet_int(r4, 0x0, 0xf, &(0x7f0000000000)=0x1001, 0x4) r5 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r5, 0xab00, r6) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) kernel console output (not intermixed with test programs): [ 103.205282][ T6337] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 103.334048][ T31] audit: type=1400 audit(1787751393.826:354): avc: denied { setopt } for pid=6340 comm="syz.4.147" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 103.416151][ T6344] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6344 comm=syz.2.149 [ 103.502380][ T31] audit: type=1400 audit(1787751394.006:355): avc: denied { ioctl } for pid=6340 comm="syz.4.147" path="socket:[11475]" dev="sockfs" ino=11475 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 103.504501][ T31] audit: type=1400 audit(1787751394.006:356): avc: denied { ioctl } for pid=6345 comm="syz.1.148" path="socket:[11474]" dev="sockfs" ino=11474 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 103.522484][ T6348] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 103.656539][ T6348] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 103.710309][ T6348] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 103.762343][ T5693] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 103.912360][ T5693] usb 5-1: Using ep0 maxpacket: 16 [ 103.919165][ T5693] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 103.929545][ T5693] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 103.940673][ T5693] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 103.950566][ T5693] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 103.963735][ T5693] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 103.978352][ T5693] usb 5-1: config 0 descriptor?? [ 104.312161][ T5785] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 104.462849][ T5785] usb 4-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 104.463729][ T5785] usb 4-1: config 1 has an invalid interface number: 7 but max is 0 [ 104.463748][ T5785] usb 4-1: config 1 has no interface number 0 [ 104.463776][ T5785] usb 4-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 104.463797][ T5785] usb 4-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 104.463817][ T5785] usb 4-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 104.465478][ T5785] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 104.465511][ T5785] usb 4-1: Product: syz [ 104.465523][ T5785] usb 4-1: Manufacturer: syz [ 104.465535][ T5785] usb 4-1: SerialNumber: syz [ 104.478330][ T6356] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 104.615141][ T6341] 9p: Bad value for 'rfdno' [ 104.617818][ T6341] netlink: 14 bytes leftover after parsing attributes in process `syz.4.147'. [ 104.683322][ T6356] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 104.711213][ T5693] usbhid 5-1:0.0: can't add hid device: -71 [ 104.711315][ T5693] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 104.716972][ T5693] usb 5-1: USB disconnect, device number 7 [ 104.906173][ T5785] sierra_net 4-1:1.7 wwan0: register 'sierra_net' at usb-dummy_hcd.3-1, Sierra Wireless USB-to-WWAN Modem, 00:00:00:00:01:07 [ 105.100783][ T6356] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 105.101188][ T6356] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 105.607100][ T5785] usb 4-1: USB disconnect, device number 4 [ 105.618367][ T5785] sierra_net 4-1:1.7 wwan0: unregister 'sierra_net' usb-dummy_hcd.3-1, Sierra Wireless USB-to-WWAN Modem [ 105.683971][ T5785] sierra_net 4-1:1.7 wwan0 (unregistered): usb_control_msg failed, status -19 [ 105.752179][ T1704] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 105.913301][ T1704] usb 5-1: Using ep0 maxpacket: 8 [ 105.920290][ T1704] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 105.935388][ T1704] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 105.935453][ T1704] usb 5-1: Product: syz [ 105.935480][ T1704] usb 5-1: Manufacturer: syz [ 105.935493][ T1704] usb 5-1: SerialNumber: syz [ 105.941478][ T1704] usb 5-1: config 0 descriptor?? [ 106.181613][ T1704] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 106.494666][ T6403] loop6: detected capacity change from 0 to 2640 [ 106.495050][ T6403] Buffer I/O error on dev loop6, logical block 0, async page read [ 106.495104][ T6403] Buffer I/O error on dev loop6, logical block 0, async page read [ 106.495122][ T6403] Buffer I/O error on dev loop6, logical block 0, async page read [ 106.495149][ T6403] Buffer I/O error on dev loop6, logical block 0, async page read [ 106.495200][ T6403] Buffer I/O error on dev loop6, logical block 0, async page read [ 106.495235][ T6403] Buffer I/O error on dev loop6, logical block 0, async page read [ 106.495267][ T6403] Buffer I/O error on dev loop6, logical block 0, async page read [ 106.495285][ T6403] Buffer I/O error on dev loop6, logical block 0, async page read [ 106.495305][ T6403] ldm_validate_partition_table(): Disk read failed. [ 106.495339][ T6403] Buffer I/O error on dev loop6, logical block 0, async page read [ 106.495366][ T6403] Buffer I/O error on dev loop6, logical block 0, async page read [ 106.495413][ T6403] Dev loop6: unable to read RDB block 0 [ 106.495550][ T6403] loop6: unable to read partition table [ 106.495695][ T6403] loop_reread_partitions: partition scan of loop6 (3Ÿ ¾‚³˜) failed (rc=-5) [ 106.611088][ T6372] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 106.671121][ T31] kauditd_printk_skb: 12 callbacks suppressed [ 106.671187][ T31] audit: type=1400 audit(1787751397.046:369): avc: denied { read write } for pid=6401 comm="syz.0.160" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 106.710704][ T31] audit: type=1400 audit(1787751397.046:370): avc: denied { open } for pid=6401 comm="syz.0.160" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 106.971203][ T6372] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 108.382917][ T31] audit: type=1400 audit(1787751398.876:371): avc: denied { write } for pid=6386 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 108.532587][ T6416] loop0: detected capacity change from 0 to 4096 [ 108.604017][ T6416] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 108.604057][ T6416] ldm_parse_privhead(): PRIVHEAD disk size doesn't match real disk size [ 108.604069][ T6416] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 108.604106][ T6416] loop0: [ 108.688544][ T31] audit: type=1400 audit(1787751399.186:372): avc: denied { write } for pid=6418 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 108.906971][ T31] audit: type=1400 audit(1787751399.406:373): avc: denied { write } for pid=6425 comm="syz.3.165" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 108.922151][ T5785] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 109.028778][ T31] audit: type=1400 audit(1787751399.526:374): avc: denied { bind } for pid=6429 comm="syz.0.167" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 109.051554][ T31] audit: type=1400 audit(1787751399.546:375): avc: denied { map } for pid=6429 comm="syz.0.167" path="socket:[11583]" dev="sockfs" ino=11583 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 109.051610][ T31] audit: type=1400 audit(1787751399.546:376): avc: denied { read write } for pid=6429 comm="syz.0.167" path="socket:[11583]" dev="sockfs" ino=11583 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 109.059925][ T6430] jffs2: notice: (6430) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 109.081608][ T31] audit: type=1400 audit(1787751399.576:377): avc: denied { mount } for pid=6429 comm="syz.0.167" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 109.083735][ T5785] usb 2-1: unable to get BOS descriptor or descriptor too short [ 109.084132][ T5785] usb 2-1: not running at top speed; connect to a high speed hub [ 109.084154][ T5785] usb 2-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 109.084935][ T5785] usb 2-1: config 14 has an invalid interface number: 57 but max is 1 [ 109.084953][ T5785] usb 2-1: config 14 has an invalid interface number: 228 but max is 1 [ 109.084970][ T5785] usb 2-1: config 14 has no interface number 0 [ 109.084983][ T5785] usb 2-1: config 14 has no interface number 1 [ 109.085023][ T5785] usb 2-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 109.085041][ T5785] usb 2-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0x1B, changing to 0xB [ 109.085061][ T5785] usb 2-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 109.085081][ T5785] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 62089, setting to 64 [ 109.085102][ T5785] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 0, changing to 10 [ 109.085123][ T5785] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x9 has invalid wMaxPacketSize 0 [ 109.085141][ T5785] usb 2-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 109.085162][ T5785] usb 2-1: config 14 interface 57 has no altsetting 0 [ 109.085177][ T5785] usb 2-1: config 14 interface 228 has no altsetting 0 [ 109.086766][ T5785] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 109.086784][ T5785] usb 2-1: Product: syz [ 109.086796][ T5785] usb 2-1: Manufacturer: syz [ 109.086808][ T5785] usb 2-1: SerialNumber: syz [ 109.092869][ T31] audit: type=1400 audit(1787751399.586:378): avc: denied { search } for pid=6429 comm="syz.0.167" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=dir permissive=1 [ 109.264024][ T6372] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 109.264379][ T6372] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 109.385729][ T1704] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 109.401129][ T1704] usb 5-1: USB disconnect, device number 8 [ 109.548082][ T5785] legousbtower 2-1:14.57: interrupt endpoints not found [ 109.761619][ T6446] loop6: detected capacity change from 0 to 2640 [ 109.772996][ T6446] ldm_validate_partition_table(): Disk read failed. [ 109.780231][ T6446] Dev loop6: unable to read RDB block 0 [ 109.786712][ T6446] loop6: unable to read partition table [ 109.786905][ T6446] loop_reread_partitions: partition scan of loop6 (3Ÿ ¾‚³˜) failed (rc=-5) [ 109.803205][ T5599] Bluetooth: hci3: link tx timeout [ 109.803302][ T5599] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 109.950518][ T5785] legousbtower 2-1:14.228: LEGO USB Tower firmware version is 228.166 build 40507 [ 109.979147][ T5785] legousbtower 2-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 111.372084][ T0] NOHZ tick-stop error: local softirq work is pending, handler #206!!! [ 111.479016][ T6474] netlink: 4 bytes leftover after parsing attributes in process `syz.1.164'. [ 111.766217][ T31] kauditd_printk_skb: 17 callbacks suppressed [ 111.772722][ T31] audit: type=1400 audit(1787751402.266:396): avc: denied { kexec_image_load } for pid=6479 comm="syz.4.182" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 111.799598][ T31] audit: type=1400 audit(1787751402.296:397): avc: denied { firmware_load } for pid=6420 comm="syz.1.164" path="/lib/firmware/regulatory.db" dev="sda1" ino=448 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 111.841285][ T4919] Bluetooth: hci3: command 0x0406 tx timeout [ 112.216841][ C0] usb 2-1: tower_interrupt_in_callback: usb_submit_urb failed (-1) [ 112.223688][ T5724] usb 2-1: USB disconnect, device number 5 [ 112.273462][ T5724] legousbtower 2-1:14.228: LEGO USB Tower #-160 now disconnected [ 112.668609][ T31] audit: type=1400 audit(1787751403.166:398): avc: denied { unmount } for pid=5614 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 112.806891][ T6474] syz.1.164 (6474) used greatest stack depth: 16888 bytes left [ 113.131581][ T6492] netlink: 'syz.4.188': attribute type 10 has an invalid length. [ 113.141638][ T6492] syz_tun: entered promiscuous mode [ 113.153533][ T6492] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 113.165050][ T5932] bond0: (slave bond_slave_0): interface is now down [ 113.165104][ T5932] bond0: (slave bond_slave_1): interface is now down [ 113.165135][ T5932] bond0: (slave syz_tun): interface is now down [ 113.182936][ T5932] bond0: (slave bond_slave_0): interface is now down [ 113.182966][ T5932] bond0: (slave bond_slave_1): interface is now down [ 113.182977][ T5932] bond0: (slave syz_tun): interface is now down [ 113.207258][ T1105] bond0: (slave bond_slave_0): interface is now down [ 113.207291][ T1105] bond0: (slave bond_slave_1): interface is now down [ 113.207317][ T1105] bond0: (slave syz_tun): interface is now down [ 113.226791][ T1105] bond0: (slave bond_slave_0): interface is now down [ 113.226821][ T1105] bond0: (slave bond_slave_1): interface is now down [ 113.226846][ T1105] bond0: (slave syz_tun): interface is now down [ 113.244447][ T5909] bond0: (slave bond_slave_0): interface is now down [ 113.244476][ T5909] bond0: (slave bond_slave_1): interface is now down [ 113.244487][ T5909] bond0: (slave syz_tun): interface is now down [ 113.266723][ T5932] bond0: (slave bond_slave_0): interface is now down [ 113.266751][ T5932] bond0: (slave bond_slave_1): interface is now down [ 113.266762][ T5932] bond0: (slave syz_tun): interface is now down [ 113.282588][ T5932] bond0: (slave bond_slave_0): interface is now down [ 113.282617][ T5932] bond0: (slave bond_slave_1): interface is now down [ 113.282627][ T5932] bond0: (slave syz_tun): interface is now down [ 113.309645][ T5909] bond0: (slave bond_slave_0): interface is now down [ 113.309679][ T5909] bond0: (slave bond_slave_1): interface is now down [ 113.309715][ T5909] bond0: (slave syz_tun): interface is now down [ 113.341337][ T5909] bond0: now running without any active interface! [ 113.353229][ T6497] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 113.362419][ T6497] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 113.437223][ T6499] netlink: 64 bytes leftover after parsing attributes in process `syz.2.189'. [ 113.817178][ T6508] 0x000000000006-0x000000020000 : "" [ 114.438158][ T6508] ftl_cs: FTL header corrupt! [ 115.010177][ T6514] zswap: compressor z not available [ 115.017495][ T6519] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 115.577744][ T31] audit: type=1400 audit(1787751406.076:399): avc: denied { append } for pid=6532 comm="syz.3.197" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 115.921094][ T31] audit: type=1400 audit(1787751406.416:400): avc: denied { setopt } for pid=6537 comm="syz.4.198" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 116.368037][ T31] audit: type=1400 audit(1787751406.866:401): avc: denied { name_bind } for pid=6537 comm="syz.4.198" src=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 116.942353][ T5714] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 117.103497][ T5714] usb 3-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 117.113884][ T5714] usb 3-1: config 0 has an invalid interface number: 41 but max is 0 [ 117.113917][ T5714] usb 3-1: config 0 has no interface number 0 [ 117.113964][ T5714] usb 3-1: config 0 interface 41 has no altsetting 0 [ 117.137765][ T5714] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.137797][ T5714] usb 3-1: Product: syz [ 117.137819][ T5714] usb 3-1: Manufacturer: syz [ 117.137837][ T5714] usb 3-1: SerialNumber: syz [ 117.170891][ T5714] usb 3-1: config 0 descriptor?? [ 117.494254][ T5724] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 118.332133][ T5724] usb 4-1: Using ep0 maxpacket: 8 [ 118.370892][ T6546] xt_nfacct: accounting object `syz0' does not exist [ 118.716669][ T5599] Bluetooth: hci0: command 0x0406 tx timeout [ 118.722951][ T9] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 118.827059][ T5714] CoreChips 3-1:0.41: probe with driver CoreChips failed with error -71 [ 118.844192][ T5714] usb 3-1: USB disconnect, device number 8 [ 118.889557][ T6570] loop0: detected capacity change from 0 to 4096 [ 118.896180][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 118.903027][ T9] usb 5-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 118.915468][ T9] usb 5-1: config 0 interface 0 altsetting 128 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 118.915504][ T9] usb 5-1: config 0 interface 0 has no altsetting 0 [ 118.915542][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 118.934650][ T6570] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 118.935544][ T6570] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 118.935853][ T6570] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 118.935865][ T6570] ldm_validate_privheads(): Cannot find PRIVHEAD 3. [ 118.935889][ T6570] ldm_validate_privheads(): Primary and backup PRIVHEADs don't match. [ 118.935967][ T6570] loop0: [ 118.992496][ T9] usb 5-1: config 0 descriptor?? [ 119.696654][ T6578] FAULT_INJECTION: forcing a failure. [ 119.696654][ T6578] name failslab, interval 1, probability 0, space 0, times 1 [ 119.696696][ T6578] CPU: 0 UID: 0 PID: 6578 Comm: syz.2.212 Not tainted syzkaller #0 PREEMPT(full) [ 119.696717][ T6578] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 119.696727][ T6578] Call Trace: [ 119.696733][ T6578] [ 119.696740][ T6578] dump_stack_lvl+0x100/0x190 [ 119.696770][ T6578] should_fail_ex.cold+0x5/0xa [ 119.696796][ T6578] should_failslab+0xc2/0x120 [ 119.696816][ T6578] kmem_cache_alloc_noprof+0x92/0x6a0 [ 119.696835][ T6578] ? dst_alloc+0x99/0x1a0 [ 119.696859][ T6578] ? __pfx_ip6_dst_gc+0x10/0x10 [ 119.696887][ T6578] dst_alloc+0x99/0x1a0 [ 119.696910][ T6578] ip6_pol_route+0x9fd/0x1310 [ 119.696936][ T6578] ? __pfx_ip6_pol_route+0x10/0x10 [ 119.696958][ T6578] ? kasan_save_track+0x14/0x30 [ 119.696975][ T6578] ? __kasan_slab_alloc+0x89/0x90 [ 119.696992][ T6578] ? kmem_cache_alloc_lru_noprof+0x265/0x6a0 [ 119.697009][ T6578] ? xas_create+0x75a/0x14e0 [ 119.697035][ T6578] ? __xa_insert+0x16b/0x320 [ 119.697051][ T6578] ? cma_alloc_port+0x2a7/0x5f0 [ 119.697075][ T6578] ? rdma_bind_addr_dst+0x2702/0x2c70 [ 119.697093][ T6578] ? vfs_writev+0x5ed/0xdd0 [ 119.697116][ T6578] ? do_writev+0x28a/0x340 [ 119.697137][ T6578] ? do_syscall_64+0x123/0x790 [ 119.697160][ T6578] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.697183][ T6578] ? __pfx_ip6_pol_route_output+0x10/0x10 [ 119.697206][ T6578] fib6_rule_lookup+0x24c/0x720 [ 119.697226][ T6578] ? __lock_acquire+0x4c5/0x1ec0 [ 119.697246][ T6578] ? __pfx_fib6_rule_lookup+0x10/0x10 [ 119.697277][ T6578] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 119.697301][ T6578] ip6_route_output_flags+0x1d0/0x650 [ 119.697324][ T6578] ip6_dst_lookup_tail.constprop.0+0x95b/0x2110 [ 119.697357][ T6578] ? __pfx_ip6_dst_lookup_tail.constprop.0+0x10/0x10 [ 119.697385][ T6578] ? do_raw_spin_lock+0x128/0x260 [ 119.697407][ T6578] ? find_held_lock+0x2b/0x80 [ 119.697442][ T6578] ip6_dst_lookup_flow+0x122/0x240 [ 119.697466][ T6578] ? __pfx_ip6_dst_lookup_flow+0x10/0x10 [ 119.697492][ T6578] ? __lock_acquire+0x4c5/0x1ec0 [ 119.697513][ T6578] addr6_resolve.constprop.0+0x1e0/0x430 [ 119.697540][ T6578] ? __pfx_addr6_resolve.constprop.0+0x10/0x10 [ 119.697572][ T6578] ? do_raw_spin_lock+0x128/0x260 [ 119.697598][ T6578] addr_resolve+0x2c6/0x1f40 [ 119.697635][ T6578] ? lockdep_hardirqs_on+0x7d/0x110 [ 119.697659][ T6578] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 119.697683][ T6578] ? __debug_object_init+0x2de/0x3d0 [ 119.697711][ T6578] ? __pfx_addr_resolve+0x10/0x10 [ 119.697742][ T6578] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 119.697766][ T6578] ? lockdep_init_map_type+0x5c/0x250 [ 119.697786][ T6578] ? timer_init_key+0x150/0x310 [ 119.697809][ T6578] rdma_resolve_ip+0x44f/0x6b0 [ 119.697832][ T6578] ? __pfx_addr_handler+0x10/0x10 [ 119.697852][ T6578] rdma_resolve_addr+0x357/0x20e0 [ 119.697870][ T6578] ? xa_load+0x153/0x2c0 [ 119.697886][ T6578] ? __pfx_xa_load+0x10/0x10 [ 119.697910][ T6578] ? __pfx_rdma_resolve_addr+0x10/0x10 [ 119.697930][ T6578] ? __pfx_ucma_get_ctx+0x10/0x10 [ 119.697960][ T6578] ? ucma_resolve_ip+0x161/0x220 [ 119.697982][ T6578] ucma_resolve_ip+0x161/0x220 [ 119.698006][ T6578] ? __pfx_ucma_resolve_ip+0x10/0x10 [ 119.698038][ T6578] ? __pfx_ucma_resolve_ip+0x10/0x10 [ 119.698062][ T6578] ucma_write+0x1fb/0x330 [ 119.698084][ T6578] ? __pfx_ucma_write+0x10/0x10 [ 119.698107][ T6578] ? bpf_lsm_file_permission+0x9/0x10 [ 119.698127][ T6578] ? security_file_permission+0x76/0x210 [ 119.698153][ T6578] ? rw_verify_area+0xce/0x6d0 [ 119.698178][ T6578] ? __pfx_ucma_write+0x10/0x10 [ 119.698198][ T6578] vfs_writev+0x5ed/0xdd0 [ 119.698220][ T6578] ? get_pid_task+0x106/0x250 [ 119.698249][ T6578] ? __pfx_vfs_writev+0x10/0x10 [ 119.698274][ T6578] ? rcu_read_lock_any_held+0x6a/0x90 [ 119.698312][ T6578] ? __fget_files+0x21f/0x3d0 [ 119.698338][ T6578] ? do_writev+0x28a/0x340 [ 119.698360][ T6578] do_writev+0x28a/0x340 [ 119.698385][ T6578] ? __pfx_do_writev+0x10/0x10 [ 119.698415][ T6578] do_syscall_64+0x123/0x790 [ 119.698449][ T6578] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.698467][ T6578] RIP: 0033:0x7f04af59e0d9 [ 119.698482][ T6578] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 119.698497][ T6578] RSP: 002b:00007f04b040d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 119.698515][ T6578] RAX: ffffffffffffffda RBX: 00007f04af825fa0 RCX: 00007f04af59e0d9 [ 119.698526][ T6578] RDX: 0000000000000002 RSI: 0000200000000040 RDI: 0000000000000003 [ 119.698536][ T6578] RBP: 00007f04b040d090 R08: 0000000000000000 R09: 0000000000000000 [ 119.698547][ T6578] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 119.698557][ T6578] R13: 00007f04af826038 R14: 00007f04af825fa0 R15: 00007ffc04fdd028 [ 119.698581][ T6578] [ 119.944914][ T5714] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 120.058201][ T6581] bridge0: port 3(syz_tun) entered blocking state [ 120.058396][ T6581] bridge0: port 3(syz_tun) entered disabled state [ 120.068812][ T6581] syz_tun: entered allmulticast mode [ 120.083589][ T6581] syz_tun: entered promiscuous mode [ 120.088452][ T6581] bridge0: port 3(syz_tun) entered blocking state [ 120.088936][ T6581] bridge0: port 3(syz_tun) entered forwarding state [ 120.167429][ T5714] usb 2-1: Using ep0 maxpacket: 8 [ 120.183759][ T5714] usb 2-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 120.208242][ T5714] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 120.257182][ T5714] usb 2-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 120.265487][ T5714] usb 2-1: Product: syz [ 120.269725][ T5714] usb 2-1: Manufacturer: syz [ 120.274492][ T5714] usb 2-1: SerialNumber: syz [ 120.283633][ T9] hid_parser_main: 4 callbacks suppressed [ 120.289974][ T9] corsair-cpro 0003:1B1C:0C10.0002: unknown main item tag 0x0 [ 120.298351][ T9] corsair-cpro 0003:1B1C:0C10.0002: unknown main item tag 0x0 [ 120.305970][ T9] corsair-cpro 0003:1B1C:0C10.0002: unknown main item tag 0x0 [ 120.305994][ T9] corsair-cpro 0003:1B1C:0C10.0002: unknown main item tag 0x0 [ 120.306015][ T9] corsair-cpro 0003:1B1C:0C10.0002: unknown main item tag 0x0 [ 120.343733][ T9] corsair-cpro 0003:1B1C:0C10.0002: hidraw0: USB HID v4.06 Device [HID 1b1c:0c10] on usb-dummy_hcd.4-1/input0 [ 120.653325][ T5714] usb 2-1: palm_os_3_probe - error -110 getting connection information [ 120.653403][ T5714] visor 2-1:1.0: probe with driver visor failed with error -110 [ 120.754413][ T9] corsair-cpro 0003:1B1C:0C10.0002: probe with driver corsair-cpro failed with error -110 [ 120.768256][ T9] usb 5-1: USB disconnect, device number 9 [ 120.980510][ T5724] usb 4-1: unable to get BOS descriptor or descriptor too short [ 120.980609][ T5724] usb 4-1: New USB device found, idVendor=097b, idProduct=61f6, bcdDevice=d4.9a [ 120.986908][ T5724] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 120.986962][ T5724] usb 4-1: can't read configurations, error -71 [ 121.162086][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 121.172546][ T0] NOHZ tick-stop error: local softirq work is pending, handler #44!!! [ 121.222084][ T0] NOHZ tick-stop error: local softirq work is pending, handler #06!!! [ 122.103100][ T31] audit: type=1400 audit(1787751412.606:402): avc: denied { getopt } for pid=6575 comm="syz.1.211" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 122.289381][ T6596] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 122.289733][ T6596] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 122.539041][ T6600] netlink: 64 bytes leftover after parsing attributes in process `syz.3.218'. [ 123.216480][ T31] audit: type=1400 audit(1787751413.636:403): avc: denied { accept } for pid=6604 comm="syz.3.220" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 123.772730][ T1704] usb 2-1: USB disconnect, device number 6 [ 124.021193][ T6616] netlink: 'syz.3.223': attribute type 1 has an invalid length. [ 124.110368][ T6616] bond1: entered promiscuous mode [ 124.114465][ T6616] 8021q: adding VLAN 0 to HW filter on device bond1 [ 124.262889][ T6616] 8021q: adding VLAN 0 to HW filter on device bond1 [ 124.263187][ T6616] bond1: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 124.263202][ T6616] bond1: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 124.281465][ T6616] bond1: (slave ip6gre1): making interface the new active one [ 124.281483][ T6616] ip6gre1: entered promiscuous mode [ 124.320431][ T6616] bond1: (slave ip6gre1): Enslaving as an active interface with an up link [ 124.324793][ T31] audit: type=1400 audit(1787751414.816:404): avc: denied { read write } for pid=6627 comm="syz.4.226" name="vhost-net" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 124.324830][ T31] audit: type=1400 audit(1787751414.816:405): avc: denied { open } for pid=6627 comm="syz.4.226" path="/dev/vhost-net" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 124.340055][ T31] audit: type=1400 audit(1787751414.836:406): avc: denied { write } for pid=6627 comm="syz.4.226" name="ip6_tables_names" dev="proc" ino=4026532906 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 124.633379][ T5714] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 124.787376][ T5714] usb 5-1: Using ep0 maxpacket: 16 [ 124.787944][ T5714] usb 5-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 124.788790][ T5714] usb 5-1: config 0 has an invalid interface number: 105 but max is 0 [ 124.788809][ T5714] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 124.788824][ T5714] usb 5-1: config 0 has no interface number 0 [ 124.790453][ T5714] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 124.790471][ T5714] usb 5-1: Product: syz [ 124.790483][ T5714] usb 5-1: Manufacturer: syz [ 124.790496][ T5714] usb 5-1: SerialNumber: syz [ 124.828227][ T5714] usb 5-1: config 0 descriptor?? [ 124.844732][ T5714] uvcvideo 5-1:0.105: Found UVC 0.00 device syz (046d:08f3) [ 124.844757][ T5714] uvcvideo 5-1:0.105: No valid video chain found. [ 124.964605][ T31] audit: type=1400 audit(1787751415.466:407): avc: denied { getopt } for pid=6640 comm="syz.2.227" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 125.732603][ T5714] usb 5-1: USB disconnect, device number 10 [ 125.813694][ T6654] netlink: 8 bytes leftover after parsing attributes in process `syz.1.229'. [ 125.813737][ T6654] netlink: 12 bytes leftover after parsing attributes in process `syz.1.229'. [ 125.815989][ T6654] netlink: 8 bytes leftover after parsing attributes in process `syz.1.229'. [ 125.816008][ T6654] netlink: 12 bytes leftover after parsing attributes in process `syz.1.229'. [ 126.643945][ T6673] all: renamed from bridge_slave_0 (while UP) [ 126.856977][ T6674] netlink: 24 bytes leftover after parsing attributes in process `syz.4.234'. [ 127.197937][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 127.197998][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 129.025703][ T6681] netlink: 52 bytes leftover after parsing attributes in process `syz.0.236'. [ 129.136561][ T31] audit: type=1400 audit(1787751419.636:408): avc: denied { mount } for pid=6680 comm="syz.0.236" name="/" dev="ramfs" ino=12915 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 129.272848][ T31] audit: type=1400 audit(1787751419.716:409): avc: denied { write } for pid=6680 comm="syz.0.236" name="demux0" dev="devtmpfs" ino=926 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 129.272917][ T31] audit: type=1400 audit(1787751419.716:410): avc: denied { open } for pid=6680 comm="syz.0.236" path="/dev/dvb/adapter0/demux0" dev="devtmpfs" ino=926 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 129.272966][ T31] audit: type=1400 audit(1787751419.726:411): avc: denied { ioctl } for pid=6680 comm="syz.0.236" path="socket:[12260]" dev="sockfs" ino=12260 ioctlcmd=0x5872 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 129.273162][ T31] audit: type=1400 audit(1787751419.726:412): avc: denied { ioctl } for pid=6680 comm="syz.0.236" path="/dev/dvb/adapter0/demux0" dev="devtmpfs" ino=926 ioctlcmd=0x6f2c scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 129.572276][ T5714] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 129.740052][ T5714] usb 4-1: unable to get BOS descriptor or descriptor too short [ 129.740112][ T5714] usb 4-1: New USB device found, idVendor=06cb, idProduct=73f6, bcdDevice= 0.40 [ 129.764470][ T5714] usb 4-1: config 1 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 129.778781][ T5714] usb 4-1: config 1 interface 0 has no altsetting 0 [ 129.790194][ T5714] usb 4-1: string descriptor 0 read error: -22 [ 129.799407][ T5714] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 129.920157][ T6690] netlink: 32 bytes leftover after parsing attributes in process `syz.1.240'. [ 130.303738][ T5714] itetech 0003:06CB:73F6.0003: unknown main item tag 0x0 [ 130.319050][ T5714] itetech 0003:06CB:73F6.0003: unknown main item tag 0x0 [ 130.326424][ T5714] itetech 0003:06CB:73F6.0003: unknown main item tag 0x0 [ 130.334136][ T5714] itetech 0003:06CB:73F6.0003: unknown main item tag 0x0 [ 130.341360][ T5714] itetech 0003:06CB:73F6.0003: unknown main item tag 0x0 [ 130.348587][ T5714] itetech 0003:06CB:73F6.0003: unknown main item tag 0x0 [ 130.355822][ T5714] itetech 0003:06CB:73F6.0003: unknown main item tag 0x0 [ 130.363187][ T5714] itetech 0003:06CB:73F6.0003: unknown main item tag 0x0 [ 130.370417][ T5714] itetech 0003:06CB:73F6.0003: unknown main item tag 0x0 [ 130.378347][ T5714] itetech 0003:06CB:73F6.0003: unknown main item tag 0x0 [ 130.431463][ T5714] itetech 0003:06CB:73F6.0003: hidraw0: USB HID vff.7f Device [HID 06cb:73f6] on usb-dummy_hcd.3-1/input0 [ 131.842789][ T6720] kvm: MWAIT instruction emulated as NOP! [ 131.988017][ T6722] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 132.143503][ T31] audit: type=1400 audit(1787751422.646:413): avc: denied { read } for pid=6731 comm="syz.4.249" name="frontend0" dev="devtmpfs" ino=925 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 132.184235][ T31] audit: type=1400 audit(1787751422.686:414): avc: denied { read write } for pid=6731 comm="syz.4.249" name="uhid" dev="devtmpfs" ino=1270 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 132.184330][ T31] audit: type=1400 audit(1787751422.686:415): avc: denied { open } for pid=6731 comm="syz.4.249" path="/dev/uhid" dev="devtmpfs" ino=1270 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 132.203460][ T1704] usb 4-1: USB disconnect, device number 7 [ 132.360935][ T6722] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 132.388057][ T6734] loop0: detected capacity change from 0 to 4096 [ 132.448227][ T6734] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 132.448278][ T6734] ldm_parse_privhead(): PRIVHEAD contains an invalid GUID. [ 132.448290][ T6734] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 132.448355][ T6734] loop0: [ 132.626427][ T6740] hpfs: Bad magic ... probably not HPFS [ 132.728169][ T6722] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 134.301898][ T6722] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 135.369423][ T6763] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 135.675503][ T31] audit: type=1400 audit(1787751426.176:416): avc: denied { create } for pid=6769 comm="syz.0.260" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 135.706341][ T31] audit: type=1400 audit(1787751426.206:417): avc: denied { setopt } for pid=6769 comm="syz.0.260" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 135.857298][ T6763] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 136.046025][ T6763] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 136.192189][ T5785] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 136.299232][ T6763] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 136.342157][ T5785] usb 4-1: Using ep0 maxpacket: 32 [ 136.347761][ T5785] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 136.358663][ T5785] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 136.815541][ T5785] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 136.815603][ T5785] usb 4-1: Product: syz [ 136.825037][ T5785] usb 4-1: Manufacturer: syz [ 136.825065][ T5785] usb 4-1: SerialNumber: syz [ 136.906329][ T5785] usb 4-1: config 0 descriptor?? [ 136.916278][ T6780] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 136.932868][ T5785] hub 4-1:0.0: bad descriptor, ignoring hub [ 136.945389][ T5785] hub 4-1:0.0: probe with driver hub failed with error -5 [ 137.042393][ T4919] Bluetooth: hci2: command 0x0406 tx timeout [ 137.293503][ T5910] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 137.302563][ T5910] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 137.371572][ T31] audit: type=1400 audit(1787751427.866:418): avc: denied { accept } for pid=6795 comm="syz.2.269" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 137.450074][ T6797] netlink: 12 bytes leftover after parsing attributes in process `syz.2.269'. [ 137.653647][ T5916] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 137.789198][ T5599] Bluetooth: hci0: unexpected event for opcode 0x040d [ 138.010782][ T6801] loop0: detected capacity change from 0 to 4096 [ 138.072858][ T5930] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 138.099862][ T6801] loop0: [ 138.134750][ T5916] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 138.192424][ T5930] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 138.192551][ T5930] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 138.192591][ T5930] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 138.352873][ T6804] tipc: Started in network mode [ 138.359008][ T6804] tipc: Node identity 6ec91994a116, cluster identity 4711 [ 138.359252][ T6804] tipc: Enabled bearer , priority 0 [ 138.374737][ T6804] syzkaller0: entered promiscuous mode [ 138.380280][ T6804] syzkaller0: entered allmulticast mode [ 138.431958][ T6804] tipc: Resetting bearer [ 138.469693][ T6812] netlink: 'syz.2.275': attribute type 1 has an invalid length. [ 138.513205][ T6812] 8021q: adding VLAN 0 to HW filter on device bond1 [ 138.523656][ T6803] tipc: Resetting bearer [ 138.532169][ T5785] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 138.551599][ T6803] tipc: Disabling bearer [ 138.577358][ T6814] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 138.588164][ T6812] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 138.641915][ T6815] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 138.664901][ T5785] usb 5-1: device descriptor read/64, error -71 [ 138.701492][ T6814] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 138.954075][ T31] audit: type=1400 audit(1787751429.446:419): avc: denied { write } for pid=6818 comm="syz.2.277" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 138.969569][ T6780] raw-gadget.0 gadget.3: failed to queue resume event [ 139.033418][ T6825] smbdirect: ib_dev[syz5]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 139.033518][ T6825] smbdirect: ib_dev[syz5]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 139.033580][ T6825] smbdirect: ib_dev[syz5]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 139.070511][ T6825] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 139.175211][ T97] raw-gadget.0 gadget.3: failed to queue suspend event [ 139.180326][ T6825] infiniband syz5: RDMA CMA: cma_listen_on_dev, error -98 [ 139.194287][ T5785] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 139.261269][ T6780] raw-gadget.0 gadget.3: failed to queue resume event [ 139.289265][ T31] audit: type=1400 audit(1787751429.746:420): avc: denied { mount } for pid=6816 comm="syz.1.276" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 139.376682][ T5910] raw-gadget.0 gadget.3: failed to queue suspend event [ 139.452591][ T6822] netlink: 196 bytes leftover after parsing attributes in process `syz.2.277'. [ 139.461738][ T6822] netlink: 196 bytes leftover after parsing attributes in process `syz.2.277'. [ 139.461833][ T6822] netlink: 19 bytes leftover after parsing attributes in process `syz.2.277'. [ 139.599059][ T5785] usb 5-1: device descriptor read/64, error -71 [ 139.769377][ T5785] usb usb5-port1: attempt power cycle [ 140.180657][ T6780] raw-gadget.0 gadget.3: failed to queue disconnect event [ 140.262187][ T5785] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 140.292596][ T1704] usb 4-1: USB disconnect, device number 8 [ 140.298549][ T5785] usb 5-1: device descriptor read/8, error -71 [ 140.336338][ T6834] netlink: 'syz.3.281': attribute type 5 has an invalid length. [ 140.351329][ T6834] ip6erspan0: entered promiscuous mode [ 140.761269][ T5785] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 140.782665][ T5785] usb 5-1: device descriptor read/8, error -71 [ 140.893771][ T5785] usb usb5-port1: unable to enumerate USB device [ 141.090846][ T6850] loop0: detected capacity change from 0 to 3904 [ 141.144067][ T6850] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 141.144139][ T6850] ldm_validate_privheads(): Disk read failed. [ 141.144546][ T6850] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 141.144561][ T6850] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 141.144584][ T6850] ldm_validate_tocblocks(): Disk read failed for TOCBLOCK 2. [ 141.144609][ T6850] ldm_validate_tocblocks(): Disk read failed for TOCBLOCK 3. [ 141.144620][ T6850] ldm_validate_tocblocks(): Failed to find a valid TOCBLOCK. [ 141.144676][ T6850] loop0: [ 141.144689][ T6850] loop0: partition table partially beyond EOD, truncated [ 141.744643][ T31] audit: type=1400 audit(1787751432.246:421): avc: denied { cmd } for pid=6855 comm="iou-wrk-6867" path="socket:[13211]" dev="sockfs" ino=13211 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 141.840771][ T31] audit: type=1400 audit(1787751432.336:422): avc: denied { mount } for pid=6874 comm="syz.4.290" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 142.202544][ T31] audit: type=1400 audit(1787751432.696:423): avc: denied { unmount } for pid=5604 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 142.202599][ T31] audit: type=1400 audit(1787751432.706:424): avc: denied { read } for pid=5604 comm="syz-executor" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 142.246629][ T31] audit: type=1400 audit(1787751432.706:425): avc: denied { open } for pid=5604 comm="syz-executor" path="/55/dir0" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 142.286358][ T31] audit: type=1400 audit(1787751432.786:426): avc: denied { read } for pid=5604 comm="syz-executor" name="instances" dev="tracefs" ino=1892 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 142.312237][ T31] audit: type=1400 audit(1787751432.796:427): avc: denied { write } for pid=5604 comm="syz-executor" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 142.363423][ T31] audit: type=1400 audit(1787751432.866:428): avc: denied { read } for pid=5604 comm="syz-executor" name="instances" dev="tracefs" ino=1892 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 142.366548][ T31] audit: type=1400 audit(1787751432.866:429): avc: denied { setattr } for pid=5604 comm="syz-executor" path="/55/dir0/instances" dev="tracefs" ino=1892 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 142.376937][ T31] audit: type=1400 audit(1787751432.876:430): avc: denied { write } for pid=5604 comm="syz-executor" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 142.555877][ T6902] netlink: 16 bytes leftover after parsing attributes in process `syz.0.292'. [ 142.786847][ T6909] netlink: 4 bytes leftover after parsing attributes in process `syz.0.292'. [ 142.815474][ T5604] bond0: (slave syz_tun): Releasing backup interface [ 143.000361][ T5916] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 143.179709][ T5916] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 143.308784][ T6915] 0x000000000006-0x000000020000 : "" [ 143.318093][ T6915] ftl_cs: FTL header corrupt! [ 143.477404][ T5916] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 143.645638][ T5916] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 143.657373][ T6913] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 143.783542][ T4919] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 143.791229][ T4919] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 143.799475][ T4919] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 143.809394][ T4919] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 143.810105][ T4919] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 143.852314][ T5335] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 144.016797][ T5335] usb 2-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 144.028430][ T5335] usb 2-1: config 0 has an invalid interface number: 41 but max is 0 [ 144.028467][ T5335] usb 2-1: config 0 has no interface number 0 [ 144.028504][ T5335] usb 2-1: config 0 interface 41 has no altsetting 0 [ 144.066369][ T5335] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 144.066407][ T5335] usb 2-1: Product: syz [ 144.066432][ T5335] usb 2-1: Manufacturer: syz [ 144.066448][ T5335] usb 2-1: SerialNumber: syz [ 144.101448][ T5335] usb 2-1: config 0 descriptor?? [ 144.430275][ T5916] bridge_slave_1: left allmulticast mode [ 144.430849][ T5916] bridge_slave_1: left promiscuous mode [ 144.432779][ T5916] bridge0: port 2(bridge_slave_1) entered disabled state [ 144.543876][ T5916] bridge_slave_0: left allmulticast mode [ 144.574472][ T5916] bridge_slave_0: left promiscuous mode [ 144.574691][ T5916] bridge0: port 1(bridge_slave_0) entered disabled state [ 144.600375][ T6934] capability: warning: `syz.3.305' uses 32-bit capabilities (legacy support in use) [ 144.726681][ T6940] netlink: 8 bytes leftover after parsing attributes in process `syz.0.306'. [ 144.726728][ T6940] netlink: 12 bytes leftover after parsing attributes in process `syz.0.306'. [ 144.773972][ T6942] netlink: 8 bytes leftover after parsing attributes in process `syz.0.306'. [ 144.774018][ T6942] netlink: 12 bytes leftover after parsing attributes in process `syz.0.306'. [ 144.863156][ T6944] netlink: 48 bytes leftover after parsing attributes in process `syz.2.307'. [ 144.958486][ T5335] CoreChips 2-1:0.41: probe with driver CoreChips failed with error -71 [ 144.970653][ T5335] usb 2-1: USB disconnect, device number 7 [ 144.978130][ T5916] batman_adv: batadv0: Removing interface: gretap1 [ 145.049688][ T5916] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 145.061075][ T5916] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 145.071760][ T5916] bond0 (unregistering): Released all slaves [ 145.152376][ T5785] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 145.210411][ T5916] tipc: Disabling bearer [ 145.210570][ T5916] tipc: Left network mode [ 145.321984][ T5785] usb 3-1: Using ep0 maxpacket: 16 [ 145.333161][ T5785] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 145.337133][ T5785] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 145.337153][ T5785] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 145.347261][ T5785] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 145.347283][ T5785] usb 3-1: Product: syz [ 145.347297][ T5785] usb 3-1: Manufacturer: syz [ 145.347310][ T5785] usb 3-1: SerialNumber: syz [ 145.393629][ T5785] usb 3-1: 0:2 : does not exist [ 145.834097][ T4919] Bluetooth: hci2: command tx timeout [ 145.861018][ T5916] hsr_slave_0: left promiscuous mode [ 145.871638][ T5916] hsr_slave_1: left promiscuous mode [ 145.872701][ T5916] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 145.872726][ T5916] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 145.878535][ T5916] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 145.878568][ T5916] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 145.903092][ T5916] veth1_macvtap: left promiscuous mode [ 145.903149][ T5916] veth0_macvtap: left promiscuous mode [ 145.903247][ T5916] veth1_vlan: left promiscuous mode [ 145.903326][ T5916] veth0_vlan: left promiscuous mode [ 145.955276][ T5785] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 145.987146][ T6978] trusted_key: encrypted_key: key user:syz not found [ 146.058606][ T5785] usb 3-1: USB disconnect, device number 9 [ 146.167292][ T5805] udevd[5805]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 146.380427][ T6983] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 146.397711][ T6983] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 146.407568][ T6983] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 146.419574][ T6983] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 146.479938][ T5916] team0 (unregistering): Port device team_slave_1 removed [ 146.489861][ T5916] team0 (unregistering): Port device team_slave_0 removed [ 146.673366][ T5264] 8021q: adding VLAN 0 to HW filter on device eth1 [ 146.999165][ T31] kauditd_printk_skb: 212 callbacks suppressed [ 146.999230][ T31] audit: type=1400 audit(1787751437.496:643): avc: denied { create } for pid=6990 comm="syz.3.314" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 147.049630][ T31] audit: type=1400 audit(1787751437.536:644): avc: denied { create } for pid=6990 comm="syz.3.314" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 147.974861][ T4919] Bluetooth: hci2: command tx timeout [ 148.222959][ T7001] loop0: detected capacity change from 0 to 4096 [ 148.288294][ T7001] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 148.288327][ T7001] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 148.288378][ T7001] loop0: [ 149.063033][ T6921] bridge0: port 1(bridge_slave_0) entered blocking state [ 149.063433][ T31] audit: type=1400 audit(1787751439.566:645): avc: denied { write } for pid=7024 comm="syz.1.319" name="mtd0" dev="devtmpfs" ino=702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 149.065831][ T6921] bridge0: port 1(bridge_slave_0) entered disabled state [ 149.065916][ T6921] bridge_slave_0: entered allmulticast mode [ 149.069634][ T6921] bridge_slave_0: entered promiscuous mode [ 149.077073][ T6921] bridge0: port 2(bridge_slave_1) entered blocking state [ 149.078760][ T6921] bridge0: port 2(bridge_slave_1) entered disabled state [ 149.078841][ T6921] bridge_slave_1: entered allmulticast mode [ 149.081591][ T6921] bridge_slave_1: entered promiscuous mode [ 149.147822][ T31] audit: type=1400 audit(1787751439.566:646): avc: denied { open } for pid=7024 comm="syz.1.319" path="/dev/mtd0" dev="devtmpfs" ino=702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 149.319873][ T6921] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 149.345884][ T6921] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 149.359217][ T31] audit: type=1400 audit(1787751439.856:647): avc: denied { write } for pid=6999 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 149.369356][ T7030] 0x000000000006-0x000000020000 : "" [ 149.372145][ T31] audit: type=1400 audit(1787751439.866:648): avc: denied { ioctl } for pid=7024 comm="syz.1.319" path="/dev/mtd0" dev="devtmpfs" ino=702 ioctlcmd=0x1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 149.384381][ T7030] ftl_cs: FTL header corrupt! [ 149.574429][ T6921] team0: Port device team_slave_0 added [ 149.609222][ T6921] team0: Port device team_slave_1 added [ 149.675717][ T31] audit: type=1400 audit(1787751440.166:649): avc: denied { create } for pid=7033 comm="syz.3.321" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 149.803470][ T31] audit: type=1400 audit(1787751440.166:650): avc: denied { write } for pid=7033 comm="syz.3.321" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 149.992212][ T4919] Bluetooth: hci2: command tx timeout [ 150.037219][ T6921] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 150.037248][ T6921] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 150.037280][ T6921] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 150.053166][ T6921] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 150.053177][ T6921] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 150.053196][ T6921] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 150.082169][ T31] audit: type=1400 audit(1787751440.566:651): avc: denied { write } for pid=7038 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 150.237026][ T6921] hsr_slave_0: entered promiscuous mode [ 150.237692][ T6921] hsr_slave_1: entered promiscuous mode [ 150.298991][ T5264] 8021q: adding VLAN 0 to HW filter on device eth2 [ 150.805907][ T7049] jffs2: notice: (7049) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 150.920133][ T6921] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 150.946378][ T6921] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 150.956512][ T6921] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 150.976795][ T6921] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 150.986794][ T6921] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 151.006027][ T6921] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 151.015915][ T6921] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 151.038825][ T6921] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 152.072519][ T4919] Bluetooth: hci2: command tx timeout [ 152.868183][ T31] audit: type=1400 audit(1787751443.366:652): avc: denied { write } for pid=7046 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 152.903605][ T7077] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 152.903971][ T7077] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 152.935884][ T31] audit: type=1400 audit(1787751443.436:653): avc: denied { write } for pid=7078 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 152.968160][ T6921] 8021q: adding VLAN 0 to HW filter on device bond0 [ 153.006915][ T6921] 8021q: adding VLAN 0 to HW filter on device team0 [ 153.034540][ T5909] bridge0: port 1(bridge_slave_0) entered blocking state [ 153.034610][ T5909] bridge0: port 1(bridge_slave_0) entered forwarding state [ 153.065214][ T5909] bridge0: port 2(bridge_slave_1) entered blocking state [ 153.065355][ T5909] bridge0: port 2(bridge_slave_1) entered forwarding state [ 153.100215][ T5264] 8021q: adding VLAN 0 to HW filter on device eth3 [ 153.586797][ T7103] netlink: 8 bytes leftover after parsing attributes in process `syz.2.333'. [ 153.586839][ T7103] netlink: 'syz.2.333': attribute type 19 has an invalid length. [ 153.586863][ T7103] netlink: 4 bytes leftover after parsing attributes in process `syz.2.333'. [ 153.660217][ T7104] comedi comedi3: comedi_test: 256 microvolt, 100000 microsecond waveform attached [ 153.674292][ T5909] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 153.674339][ T5909] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 153.674378][ T5909] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 153.674406][ T5909] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 153.934649][ T31] audit: type=1400 audit(1787751444.436:654): avc: denied { create } for pid=7107 comm="syz.3.335" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 153.947190][ T31] audit: type=1400 audit(1787751444.446:655): avc: denied { connect } for pid=7107 comm="syz.3.335" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 154.105754][ T31] audit: type=1400 audit(1787751444.606:656): avc: denied { write } for pid=7092 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 154.301525][ T7125] nfs: Unknown parameter 'uid' [ 154.309926][ T6921] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 154.367606][ T31] audit: type=1400 audit(1787751444.866:657): avc: denied { write } for pid=7127 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 154.402401][ T5714] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 154.526996][ T5264] 8021q: adding VLAN 0 to HW filter on device eth4 [ 154.536261][ T5724] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 154.563500][ T5714] usb 3-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 154.564330][ T5714] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 154.565963][ T5714] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 154.565983][ T5714] usb 3-1: Product: syz [ 154.565996][ T5714] usb 3-1: Manufacturer: syz [ 154.566008][ T5714] usb 3-1: SerialNumber: syz [ 154.583849][ T5714] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 154.699946][ T5724] usb 4-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 154.712784][ T5724] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 154.733560][ T5724] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 154.733622][ T5724] usb 4-1: Product: syz [ 154.733659][ T5724] usb 4-1: Manufacturer: syz [ 154.733690][ T5724] usb 4-1: SerialNumber: syz [ 154.790701][ T5724] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 154.819672][ T7141] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 154.832463][ T7141] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 155.093585][ T5714] gspca_mr97310a: reg write [21] error -110 [ 155.093734][ T5714] mr97310a 3-1:1.0: probe with driver mr97310a failed with error -110 [ 155.191370][ T7141] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 155.216016][ T6921] veth0_vlan: entered promiscuous mode [ 155.221908][ T7141] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 155.332211][ T5724] gspca_mr97310a: reg write [21] error -110 [ 155.332336][ T5724] mr97310a 4-1:1.0: probe with driver mr97310a failed with error -110 [ 155.350826][ T6921] veth1_vlan: entered promiscuous mode [ 155.451087][ T6921] veth0_macvtap: entered promiscuous mode [ 155.470905][ T6921] veth1_macvtap: entered promiscuous mode [ 155.513644][ T6921] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 155.540127][ T6921] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 155.840559][ T31] audit: type=1400 audit(1787751446.336:658): avc: denied { setopt } for pid=7120 comm="syz.2.336" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 155.863204][ T31] audit: type=1400 audit(1787751446.366:659): avc: denied { write } for pid=7120 comm="syz.2.336" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 155.905848][ T4851] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 155.925064][ T4851] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 155.925164][ T4851] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 155.925211][ T4851] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 156.048870][ T5909] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 156.048902][ T5909] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 156.859249][ T5909] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 156.875508][ T5909] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 156.946718][ T31] audit: type=1400 audit(1787751447.446:660): avc: denied { mounton } for pid=6921 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 156.951233][ T31] audit: type=1400 audit(1787751447.446:661): avc: denied { mount } for pid=6921 comm="syz-executor" name="/" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 157.207458][ T7172] netlink: 12 bytes leftover after parsing attributes in process `syz.0.346'. [ 157.223554][ T7172] netlink: 8 bytes leftover after parsing attributes in process `syz.0.346'. [ 157.738513][ T5785] usb 4-1: USB disconnect, device number 9 [ 157.768419][ T5724] usb 3-1: USB disconnect, device number 10 [ 157.874595][ T31] audit: type=1400 audit(1787751448.376:662): avc: denied { bind } for pid=7177 comm="syz.3.347" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 158.045418][ T31] audit: type=1400 audit(1787751448.546:663): avc: denied { create } for pid=7183 comm="syz.0.349" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 158.082447][ T31] audit: type=1400 audit(1787751448.586:664): avc: denied { setopt } for pid=7183 comm="syz.0.349" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 158.107944][ T31] audit: type=1400 audit(1787751448.606:665): avc: denied { read } for pid=7181 comm="syz.3.351" name="binder0" dev="binder" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 158.127895][ T31] audit: type=1400 audit(1787751448.606:666): avc: denied { create } for pid=7183 comm="syz.0.349" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=appletalk_socket permissive=1 [ 158.130725][ T31] audit: type=1400 audit(1787751448.636:667): avc: denied { open } for pid=7181 comm="syz.3.351" path="/dev/binderfs/binder0" dev="binder" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 158.477251][ T31] audit: type=1400 audit(1787751448.976:668): avc: denied { setopt } for pid=7197 comm="syz.5.352" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 158.505938][ T31] audit: type=1400 audit(1787751449.006:669): avc: denied { write } for pid=7197 comm="syz.5.352" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 158.568433][ T31] audit: type=1400 audit(1787751449.066:670): avc: denied { read } for pid=7197 comm="syz.5.352" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 159.189238][ T31] audit: type=1400 audit(1787751449.686:671): avc: denied { write } for pid=7203 comm="syz.2.355" name="qw_sign" dev="configfs" ino=16313 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 159.584452][ T7214] syz.3.358 uses obsolete (PF_INET,SOCK_PACKET) [ 159.719442][ T7221] netlink: 12 bytes leftover after parsing attributes in process `syz.1.359'. [ 159.739504][ T7219] tipc: Started in network mode [ 159.739539][ T7219] tipc: Node identity 00000000ff0000000000000000000001, cluster identity 4711 [ 159.739602][ T7219] tipc: Enabling of bearer rejected, failed to enable media [ 159.768304][ T7221] netlink: 'syz.1.359': attribute type 15 has an invalid length. [ 159.798479][ T7221] vxlan1: entered promiscuous mode [ 159.813764][ T1105] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 256 - 0 [ 159.814745][ T1105] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 256 - 0 [ 159.814785][ T1105] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 256 - 0 [ 159.814824][ T1105] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 256 - 0 [ 160.008739][ T5785] libceph: connect (1)[c::]:6789 error -101 [ 160.009119][ T5785] libceph: mon0 (1)[c::]:6789 connect error [ 160.104043][ T7224] ceph: No mds server is up or the cluster is laggy [ 160.190172][ T5785] libceph: connect (1)[c::]:6789 error -101 [ 160.190335][ T5785] libceph: mon0 (1)[c::]:6789 connect error [ 160.199815][ T7230] ceph: No mds server is up or the cluster is laggy [ 160.241165][ T7228] FAULT_INJECTION: forcing a failure. [ 160.241165][ T7228] name fail_futex, interval 1, probability 0, space 0, times 1 [ 160.241209][ T7228] CPU: 1 UID: 0 PID: 7228 Comm: syz.5.361 Not tainted syzkaller #0 PREEMPT(full) [ 160.241232][ T7228] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 160.241241][ T7228] Call Trace: [ 160.241245][ T7228] [ 160.241259][ T7228] dump_stack_lvl+0x100/0x190 [ 160.241280][ T7228] should_fail_ex.cold+0x5/0xa [ 160.241296][ T7228] get_futex_key+0x293/0x14f0 [ 160.241312][ T7228] ? __pfx_get_futex_key+0x10/0x10 [ 160.241326][ T7228] ? __mutex_unlock_slowpath+0x35d/0x930 [ 160.241346][ T7228] futex_wake+0xf4/0x5e0 [ 160.241365][ T7228] ? __pfx_futex_wake+0x10/0x10 [ 160.241380][ T7228] ? __lock_acquire+0x4c5/0x1ec0 [ 160.241398][ T7228] do_futex+0x2b2/0x440 [ 160.241413][ T7228] ? __pfx_do_futex+0x10/0x10 [ 160.241426][ T7228] ? __might_fault+0xc5/0x140 [ 160.241446][ T7228] mm_exit_exec_release+0x256/0x2f0 [ 160.241460][ T7228] do_exit+0x707/0x2ae0 [ 160.241476][ T7228] ? __pfx_do_exit+0x10/0x10 [ 160.241490][ T7228] ? do_raw_spin_lock+0x128/0x260 [ 160.241504][ T7228] ? find_held_lock+0x2b/0x80 [ 160.241520][ T7228] ? get_signal+0x7e0/0x21e0 [ 160.241533][ T7228] do_group_exit+0xd5/0x2a0 [ 160.241549][ T7228] get_signal+0x1ec7/0x21e0 [ 160.241565][ T7228] ? __pfx_get_signal+0x10/0x10 [ 160.241583][ T7228] arch_do_signal_or_restart+0x91/0x7e0 [ 160.241611][ T7228] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 160.241633][ T7228] ? fput+0x7c/0x100 [ 160.241648][ T7228] exit_to_user_mode_loop+0x139/0x700 [ 160.241662][ T7228] ? rcu_is_watching+0x13/0xc0 [ 160.241677][ T7228] do_syscall_64+0x661/0x790 [ 160.241694][ T7228] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 160.241706][ T7228] RIP: 0033:0x7f8a33b9e0d9 [ 160.241716][ T7228] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 160.241727][ T7228] RSP: 002b:00007f8a34a98028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 160.241738][ T7228] RAX: 0000000000000001 RBX: 00007f8a33e25fa0 RCX: 00007f8a33b9e0d9 [ 160.241744][ T7228] RDX: 0000000000000001 RSI: 0000200000000100 RDI: 0000000000000006 [ 160.241751][ T7228] RBP: 00007f8a34a98090 R08: 0000000000000000 R09: 0000000000000000 [ 160.241757][ T7228] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 160.241763][ T7228] R13: 00007f8a33e26038 R14: 00007f8a33e25fa0 R15: 00007ffd38105938 [ 160.241777][ T7228] [ 160.268345][ T9] libceph: connect (1)[c::]:6789 error -101 [ 160.268495][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 160.467243][ T7237] netlink: 140 bytes leftover after parsing attributes in process `syz.2.362'. [ 160.682062][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 160.742061][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 160.862076][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 161.234482][ T5785] libceph: connect (1)[c::]:6789 error -101 [ 161.234634][ T5785] libceph: mon0 (1)[c::]:6789 connect error [ 161.553418][ T4805] IPVS: starting estimator thread 0... [ 161.570298][ T7247] TCP: request_sock_subflow_v6: Possible SYN flooding on port [fe80::aa]:20002. Sending cookies. [ 161.643190][ T7248] IPVS: using max 39 ests per chain, 93600 per kthread [ 161.747273][ T7255] netlink: 'syz.5.369': attribute type 8 has an invalid length. [ 161.760766][ T7255] netlink: 4 bytes leftover after parsing attributes in process `syz.5.369'. [ 161.849417][ T7259] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 161.850212][ T7259] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 163.304033][ T31] kauditd_printk_skb: 6 callbacks suppressed [ 163.304070][ T31] audit: type=1400 audit(1787751453.806:678): avc: denied { create } for pid=7260 comm="syz.2.371" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 163.342554][ T31] audit: type=1400 audit(1787751453.846:679): avc: denied { listen } for pid=7260 comm="syz.2.371" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 163.345977][ T31] audit: type=1400 audit(1787751453.846:680): avc: denied { accept } for pid=7260 comm="syz.2.371" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 163.523012][ T5714] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 163.764529][ T7270] 0x000000000006-0x000000020000 : "" [ 163.777002][ T7270] ftl_cs: FTL header corrupt! [ 163.822182][ T31] audit: type=1400 audit(1787751454.306:681): avc: denied { name_bind } for pid=7269 comm="syz.5.373" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 164.085432][ T7276] netlink: 12 bytes leftover after parsing attributes in process `syz.1.374'. [ 164.113787][ T7277] netlink: 8 bytes leftover after parsing attributes in process `syz.5.375'. [ 164.113827][ T7277] netlink: 12 bytes leftover after parsing attributes in process `syz.5.375'. [ 164.143171][ T7276] netlink: 'syz.1.374': attribute type 15 has an invalid length. [ 166.313700][ T5785] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 166.462123][ T5785] usb 6-1: Using ep0 maxpacket: 8 [ 166.463088][ T5785] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 166.463914][ T5785] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 166.463933][ T5785] usb 6-1: config 0 has no interface number 0 [ 166.463965][ T5785] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 166.463984][ T5785] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 166.464004][ T5785] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 166.464025][ T5785] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 166.464056][ T5785] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 166.472580][ T5785] usb 6-1: config 0 descriptor?? [ 166.494747][ T5785] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 166.566777][ T31] audit: type=1400 audit(1787751457.066:682): avc: denied { write } for pid=7286 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 166.645892][ T7309] loop0: detected capacity change from 0 to 4096 [ 166.712443][ T31] audit: type=1400 audit(1787751457.206:683): avc: denied { write } for pid=7310 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 166.765889][ T7309] loop0: [ 167.019448][ T5724] usb 6-1: USB disconnect, device number 2 [ 167.019466][ C0] ldusb 6-1:0.55: usb_submit_urb failed (-19) [ 167.088718][ T7288] ldusb: No device or device unplugged -19 [ 167.088720][ T5724] ldusb 6-1:0.55: LD USB Device #0 now disconnected [ 167.368894][ T7320] netlink: 8 bytes leftover after parsing attributes in process `syz.1.386'. [ 167.368944][ T7320] netlink: 12 bytes leftover after parsing attributes in process `syz.1.386'. [ 167.682583][ T7326] random: crng reseeded on system resumption [ 167.761103][ T31] audit: type=1400 audit(1787751458.256:684): avc: denied { name_bind } for pid=7325 comm="syz.2.388" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 167.761155][ T31] audit: type=1400 audit(1787751458.256:685): avc: denied { node_bind } for pid=7325 comm="syz.2.388" saddr=::ffff:0.0.0.0 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 167.862162][ T1704] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 168.038260][ T1704] usb 6-1: Using ep0 maxpacket: 8 [ 168.044554][ T1704] usb 6-1: New USB device found, idVendor=05e1, idProduct=0893, bcdDevice=fd.5b [ 168.061727][ T1704] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 168.080564][ T1704] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 168.104116][ T1704] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 168.112882][ T1704] usb 6-1: Product: syz [ 168.117566][ T1704] usb 6-1: Manufacturer: syz [ 168.122709][ T1704] usb 6-1: SerialNumber: syz [ 168.146387][ T1704] usb 6-1: config 0 descriptor?? [ 168.223508][ T5724] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 168.304811][ T31] audit: type=1400 audit(1787751458.806:686): avc: denied { write } for pid=7321 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 168.416602][ T5724] usb 4-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 168.430368][ T5724] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 168.471764][ T5724] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 168.482992][ T5724] usb 4-1: Product: syz [ 168.487626][ T5724] usb 4-1: Manufacturer: syz [ 168.492741][ T5724] usb 4-1: SerialNumber: syz [ 168.511372][ T5724] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 168.557994][ T31] audit: type=1326 audit(1787751459.056:687): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7323 comm="syz.5.387" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f8a33b9e0d9 code=0x0 [ 168.629341][ T7358] netlink: 40 bytes leftover after parsing attributes in process `syz.0.392'. [ 168.647717][ T31] audit: type=1400 audit(1787751459.146:688): avc: denied { write } for pid=7356 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 169.566510][ T31] audit: type=1400 audit(1787751459.956:689): avc: denied { connect } for pid=7374 comm="syz.0.397" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 169.629391][ T5724] gspca_mr97310a: reg write [19] error -110 [ 169.637194][ T5724] mr97310a 4-1:1.0: probe with driver mr97310a failed with error -110 [ 169.964712][ T31] audit: type=1400 audit(1787751460.466:690): avc: denied { write } for pid=7366 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 170.083298][ T7393] netlink: 8 bytes leftover after parsing attributes in process `syz.2.399'. [ 170.083337][ T7393] netlink: 12 bytes leftover after parsing attributes in process `syz.2.399'. [ 170.254327][ T31] audit: type=1400 audit(1787751460.756:691): avc: denied { write } for pid=7392 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 170.269468][ T7396] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 170.269776][ T7396] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 170.402374][ T7396] xt_nfacct: accounting object `syz0' does not exist [ 170.618623][ T5714] usb 6-1: USB disconnect, device number 3 [ 170.737884][ T7408] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 170.783469][ T7412] loop0: detected capacity change from 0 to 4096 [ 170.806183][ T7412] loop0: [ 170.809199][ T7413] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 170.879561][ T7413] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 171.106735][ T5714] usb 4-1: USB disconnect, device number 10 [ 171.177533][ T31] audit: type=1400 audit(1787751461.676:692): avc: denied { write } for pid=7401 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 171.371053][ T31] audit: type=1400 audit(1787751461.866:693): avc: denied { write } for pid=7425 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 171.482423][ T4805] IPVS: starting estimator thread 0... [ 171.542120][ T5714] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 171.573184][ T7429] IPVS: using max 76 ests per chain, 182400 per kthread [ 171.672288][ T5714] usb 4-1: device descriptor read/64, error -71 [ 171.697045][ T31] audit: type=1400 audit(1787751462.196:694): avc: denied { search } for pid=7433 comm="syz.1.409" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=dir permissive=1 [ 171.721211][ T31] audit: type=1400 audit(1787751462.216:695): avc: denied { read write } for pid=7433 comm="syz.1.409" name="portlist" dev="nfsd" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=file permissive=1 [ 171.747101][ T31] audit: type=1400 audit(1787751462.246:696): avc: denied { open } for pid=7433 comm="syz.1.409" path="/80/nfsd/portlist" dev="nfsd" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=file permissive=1 [ 171.913104][ T5714] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 172.044750][ T5714] usb 4-1: device descriptor read/64, error -71 [ 172.153978][ T5714] usb usb4-port1: attempt power cycle [ 172.343189][ T7450] loop0: detected capacity change from 0 to 4096 [ 172.393845][ T7450] loop0: [ 172.493128][ T5714] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 172.516247][ T5714] usb 4-1: device descriptor read/8, error -71 [ 172.722499][ T5785] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 172.752154][ T5714] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 172.773039][ T7456] 0x000000000006-0x000000020000 : "" [ 172.775621][ T7456] ftl_cs: FTL header corrupt! [ 172.862739][ T5714] usb 4-1: device descriptor read/8, error -71 [ 172.975344][ T5714] usb usb4-port1: unable to enumerate USB device [ 172.994954][ T5785] usb 6-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 172.999310][ T5785] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 173.000925][ T5785] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 173.000945][ T5785] usb 6-1: Product: syz [ 173.000957][ T5785] usb 6-1: Manufacturer: syz [ 173.000969][ T5785] usb 6-1: SerialNumber: syz [ 173.015643][ T5785] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 173.758514][ T31] kauditd_printk_skb: 2 callbacks suppressed [ 173.758573][ T31] audit: type=1400 audit(1787751464.256:699): avc: denied { create } for pid=7473 comm="syz.2.421" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 173.794682][ T31] audit: type=1400 audit(1787751464.296:700): avc: denied { bind } for pid=7473 comm="syz.2.421" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 173.830185][ T31] audit: type=1400 audit(1787751464.326:701): avc: denied { listen } for pid=7473 comm="syz.2.421" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 173.852499][ T31] audit: type=1400 audit(1787751464.336:702): avc: denied { connect } for pid=7473 comm="syz.2.421" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 173.884487][ T31] audit: type=1400 audit(1787751464.386:703): avc: denied { accept } for pid=7473 comm="syz.2.421" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 173.977332][ T31] audit: type=1400 audit(1787751464.476:704): avc: denied { execute } for pid=7469 comm="syz.0.422" path=2F6D656D66643A01FDAE2E2BA68CB63F32193994532C7C783F55655BBDE1210333BC2723FF179B25F35B642006202864656C6574656429 dev="hugetlbfs" ino=17607 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 174.034549][ T31] audit: type=1400 audit(1787751464.536:705): avc: denied { write } for pid=7473 comm="syz.2.421" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 174.123657][ T31] audit: type=1400 audit(1787751464.616:706): avc: denied { read } for pid=7473 comm="syz.2.421" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 174.418968][ T31] audit: type=1400 audit(1787751464.916:707): avc: denied { read append } for pid=7485 comm="syz.0.426" name="mtd0" dev="devtmpfs" ino=702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 174.422380][ T5785] gspca_mr97310a: reg write [21] error -110 [ 174.422439][ T5785] mr97310a 6-1:1.0: probe with driver mr97310a failed with error -110 [ 174.910304][ T7498] tipc: Started in network mode [ 174.918865][ T7498] tipc: Node identity 26fd4e9dd0bd, cluster identity 4711 [ 174.930175][ T7498] tipc: Enabled bearer , priority 0 [ 174.962277][ T7498] syzkaller0: entered promiscuous mode [ 174.962311][ T7498] syzkaller0: entered allmulticast mode [ 174.995738][ T7498] tipc: Resetting bearer [ 175.003872][ T7497] tipc: Resetting bearer [ 175.024715][ T7497] tipc: Disabling bearer [ 175.049617][ T7502] tipc: Started in network mode [ 175.049656][ T7502] tipc: Node identity 6a8a92db805f, cluster identity 4711 [ 175.049761][ T7502] tipc: Enabled bearer , priority 0 [ 175.050234][ T7502] syzkaller0: entered promiscuous mode [ 175.050248][ T7502] syzkaller0: entered allmulticast mode [ 175.061457][ T7502] tipc: Resetting bearer [ 175.071935][ T7500] tipc: Resetting bearer [ 175.097416][ T7500] tipc: Disabling bearer [ 175.199930][ T7507] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 175.257353][ T7511] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 175.299747][ T7512] syzkaller0: entered promiscuous mode [ 175.299782][ T7512] syzkaller0: entered allmulticast mode [ 175.310929][ T7507] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 175.385373][ T31] audit: type=1400 audit(1787751465.886:708): avc: denied { block_suspend } for pid=7510 comm="syz.0.435" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 175.617331][ T7518] netlink: 12 bytes leftover after parsing attributes in process `syz.2.437'. [ 176.207145][ T1704] usb 6-1: USB disconnect, device number 4 [ 176.243648][ T5599] Bluetooth: hci1: command 0x0406 tx timeout [ 177.174388][ T7527] netlink: 'syz.5.441': attribute type 10 has an invalid length. [ 177.237138][ T7527] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 177.244989][ T7527] team0: Port device netdevsim1 added [ 177.402575][ T9] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 178.903805][ T5714] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 179.063308][ T5714] usb 2-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 179.078102][ T5714] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 179.098043][ T5714] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 179.107033][ T5714] usb 2-1: Product: syz [ 179.107118][ T5714] usb 2-1: Manufacturer: syz [ 179.107163][ T5714] usb 2-1: SerialNumber: syz [ 179.163694][ T5714] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 180.336209][ T5714] gspca_mr97310a: reg write [21] error -110 [ 180.342266][ T5714] mr97310a 2-1:1.0: probe with driver mr97310a failed with error -110 [ 180.960881][ T31] kauditd_printk_skb: 5 callbacks suppressed [ 180.960933][ T31] audit: type=1400 audit(1787751471.456:714): avc: denied { relabelfrom } for pid=7557 comm="syz.0.451" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 180.961005][ T31] audit: type=1400 audit(1787751471.456:715): avc: denied { relabelto } for pid=7557 comm="syz.0.451" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 180.982367][ T31] audit: type=1400 audit(1787751471.476:716): avc: denied { associate } for pid=7559 comm="syz.2.453" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 181.105950][ T31] audit: type=1400 audit(1787751471.606:717): avc: denied { listen } for pid=7561 comm="syz.3.452" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 181.222269][ T25] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 181.372553][ T25] usb 3-1: Using ep0 maxpacket: 16 [ 181.374586][ T25] usb 3-1: New USB device found, idVendor=0458, idProduct=5013, bcdDevice= 0.00 [ 181.376843][ T25] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 129, using maximum allowed: 30 [ 181.376902][ T25] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 181.376936][ T25] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 181.376967][ T25] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 129 [ 181.377011][ T25] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 181.390077][ T25] usb 3-1: config 0 descriptor?? [ 181.575169][ T7575] loop0: detected capacity change from 0 to 3904 [ 181.594620][ T7575] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 181.594718][ T7575] ldm_validate_privheads(): Disk read failed. [ 181.598430][ T7575] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 181.598461][ T7575] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 181.598491][ T7575] ldm_validate_tocblocks(): Disk read failed for TOCBLOCK 2. [ 181.598517][ T7575] ldm_validate_tocblocks(): Disk read failed for TOCBLOCK 3. [ 181.598528][ T7575] ldm_validate_tocblocks(): Failed to find a valid TOCBLOCK. [ 181.598586][ T7575] loop0: [ 181.598599][ T7575] loop0: partition table partially beyond EOD, truncated [ 181.924119][ T25] input: HID 0458:5013 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0458:5013.0004/input/input15 [ 181.943879][ T7579] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 182.020744][ T7580] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 182.087011][ T7579] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 182.150708][ T25] input: HID 0458:5013 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0458:5013.0004/input/input16 [ 182.340743][ T25] kye 0003:0458:5013.0004: input,hiddev0,hidraw0: USB HID vff.fa Device [HID 0458:5013] on usb-dummy_hcd.2-1/input0 [ 182.364760][ T25] usb 3-1: USB disconnect, device number 12 [ 182.501179][ T7584] fido_id[7584]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/3-1/report_descriptor': No such file or directory [ 182.672295][ T9] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 182.738490][ T5785] usb 2-1: USB disconnect, device number 8 [ 182.824736][ T7588] netlink: 12 bytes leftover after parsing attributes in process `syz.1.460'. [ 182.835505][ T9] usb 6-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 182.847553][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 182.847587][ T9] usb 6-1: Product: syz [ 182.847616][ T9] usb 6-1: Manufacturer: syz [ 182.847633][ T9] usb 6-1: SerialNumber: syz [ 183.034530][ T4969] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 183.034598][ T4969] ldm_validate_privheads(): Disk read failed. [ 183.035047][ T4969] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 183.035061][ T4969] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 183.035082][ T4969] ldm_validate_tocblocks(): Disk read failed for TOCBLOCK 2. [ 183.035093][ T4969] ldm_validate_tocblocks(): Disk read failed for TOCBLOCK 3. [ 183.035115][ T4969] ldm_validate_tocblocks(): Failed to find a valid TOCBLOCK. [ 183.035172][ T4969] loop0: [ 183.035186][ T4969] loop0: partition table partially beyond EOD, truncated [ 183.275805][ T7593] fuse: Bad value for 'rootmode' [ 183.326626][ T9] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 183.340193][ T9] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 183.550545][ T4969] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 183.550600][ T4969] ldm_validate_privheads(): Disk read failed. [ 183.553418][ T4969] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 183.553433][ T4969] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 183.553456][ T4969] ldm_validate_tocblocks(): Disk read failed for TOCBLOCK 2. [ 183.553466][ T4969] ldm_validate_tocblocks(): Disk read failed for TOCBLOCK 3. [ 183.553489][ T4969] ldm_validate_tocblocks(): Failed to find a valid TOCBLOCK. [ 183.553547][ T4969] loop0: [ 183.553561][ T4969] loop0: partition table partially beyond EOD, truncated [ 183.581023][ T7583] Bluetooth: MGMT ver 1.23 [ 183.627057][ T9] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00000010. ret = -EPROTO [ 183.627120][ T9] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 183.627880][ T9] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 183.663982][ T9] lan78xx 6-1:1.0: probe with driver lan78xx failed with error -71 [ 183.686243][ T9] usb 6-1: USB disconnect, device number 5 [ 183.836649][ T31] audit: type=1400 audit(1787751474.336:718): avc: denied { map } for pid=7596 comm="syz.2.464" path="pipe:[19759]" dev="pipefs" ino=19759 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 183.877181][ T31] audit: type=1400 audit(1787751474.366:719): avc: denied { ioctl } for pid=7596 comm="syz.2.464" path="socket:[19767]" dev="sockfs" ino=19767 ioctlcmd=0x6f02 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 184.973212][ T25] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 185.106485][ T25] usb 3-1: device descriptor read/64, error -71 [ 185.343014][ T25] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 185.472565][ T25] usb 3-1: device descriptor read/64, error -71 [ 185.582865][ T25] usb usb3-port1: attempt power cycle [ 185.592102][ T5599] Bluetooth: hci4: command 0x0406 tx timeout [ 185.606925][ T31] audit: type=1400 audit(1787751476.106:720): avc: denied { write } for pid=7612 comm="syz.0.469" name="functions" dev="configfs" ino=11271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 185.640737][ T31] audit: type=1400 audit(1787751476.136:721): avc: denied { setopt } for pid=7612 comm="syz.0.469" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 185.640836][ T31] audit: type=1400 audit(1787751476.136:722): avc: denied { accept } for pid=7612 comm="syz.0.469" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 185.682749][ T9] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 185.682884][ T31] audit: type=1400 audit(1787751476.176:723): avc: denied { read } for pid=7612 comm="syz.0.469" name="console" dev="configfs" ino=19993 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 185.713364][ T5785] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 185.885908][ T5785] usb 2-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 185.898381][ T5785] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 185.910525][ T5785] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 185.920210][ T5785] usb 2-1: Product: syz [ 185.924445][ T5785] usb 2-1: Manufacturer: syz [ 185.924463][ T5785] usb 2-1: SerialNumber: syz [ 185.936478][ T25] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 185.958479][ T5785] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 185.963587][ T25] usb 3-1: device descriptor read/8, error -71 [ 186.211282][ T7616] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 186.212109][ T31] kauditd_printk_skb: 1 callbacks suppressed [ 186.212147][ T31] audit: type=1400 audit(1787751476.706:725): avc: denied { create } for pid=7614 comm="syz.0.471" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 186.212190][ T31] audit: type=1400 audit(1787751476.706:726): avc: denied { lock } for pid=7614 comm="syz.0.471" path="socket:[20145]" dev="sockfs" ino=20145 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 186.212371][ T25] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 186.241495][ T25] usb 3-1: device descriptor read/8, error -71 [ 186.326544][ T7616] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 186.340098][ T7617] loop0: detected capacity change from 0 to 6 [ 186.350268][ T7616] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 186.352275][ T7616] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 186.381625][ T25] usb usb3-port1: unable to enumerate USB device [ 186.434569][ T7617] ldm_validate_privheads(): Disk read failed. [ 186.434661][ T7617] loop0: [ 186.434676][ T7617] loop0: partition table partially beyond EOD, truncated [ 186.472322][ T5785] gspca_mr97310a: reg write [21] error -110 [ 186.478367][ T5785] mr97310a 2-1:1.0: probe with driver mr97310a failed with error -110 [ 186.513380][ T4969] ldm_validate_privheads(): Disk read failed. [ 186.513456][ T4969] loop0: [ 186.513484][ T4969] loop0: partition table partially beyond EOD, truncated [ 186.986134][ T7620] 0x000000000006-0x000000020000 : "" [ 186.995760][ T7620] ftl_cs: FTL header corrupt! [ 187.198462][ T4969] ldm_validate_privheads(): Disk read failed. [ 187.204761][ T4969] loop0: [ 187.204825][ T4969] loop0: partition table partially beyond EOD, truncated [ 187.400796][ T7626] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 187.445544][ T7628] binder: 7627:7628 unknown command 0 [ 187.446740][ T31] audit: type=1400 audit(1787751477.936:727): avc: denied { map } for pid=7627 comm="syz.0.476" path="/dev/binderfs/binder0" dev="binder" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 187.446803][ T31] audit: type=1400 audit(1787751477.946:728): avc: denied { call } for pid=7627 comm="syz.0.476" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 187.446844][ T31] audit: type=1400 audit(1787751477.946:729): avc: denied { transfer } for pid=7627 comm="syz.0.476" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 187.513901][ T7628] binder: 7627:7628 ioctl c0306201 2000000001c0 returned -22 [ 187.683022][ T31] audit: type=1400 audit(1787751478.176:730): avc: denied { audit_write } for pid=7630 comm="syz.0.477" capability=29 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 188.199296][ T31] audit: type=1400 audit(1787751478.696:731): avc: denied { setopt } for pid=7630 comm="syz.0.477" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 188.290620][ T7637] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 188.369979][ T7638] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 188.421671][ T7637] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 188.641655][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 188.641715][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 188.673450][ T1704] usb 2-1: USB disconnect, device number 9 [ 190.311452][ T31] audit: type=1400 audit(1787751480.806:732): avc: denied { write } for pid=7648 comm="syz.0.483" name="ppp" dev="devtmpfs" ino=708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 190.336172][ T31] audit: type=1400 audit(1787751480.836:733): avc: denied { open } for pid=7648 comm="syz.0.483" path="/dev/ppp" dev="devtmpfs" ino=708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 190.634411][ T7653] Invalid ELF header magic: != ELF [ 190.678684][ T31] audit: type=1400 audit(1787751481.126:734): avc: denied { module_load } for pid=7648 comm="syz.0.483" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 190.853737][ T9] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 190.879874][ T7656] loop0: detected capacity change from 0 to 4096 [ 190.949709][ T7656] loop0: [ 191.010095][ T9] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 191.014778][ T9] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 191.014800][ T9] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 191.014819][ T9] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 191.025875][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 191.025896][ T9] usb 2-1: Product: syz [ 191.025908][ T9] usb 2-1: Manufacturer: syz [ 191.025921][ T9] usb 2-1: SerialNumber: syz [ 191.214499][ T7666] netlink: 12 bytes leftover after parsing attributes in process `syz.3.487'. [ 191.290418][ T9] usblp 2-1:1.0: usblp0: USB Unidirectional printer dev 10 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 191.522654][ T1704] usb 2-1: USB disconnect, device number 10 [ 191.565010][ T7670] 0x000000000006-0x000000020000 : "" [ 191.595036][ T1704] usblp0: removed [ 191.598185][ T7670] ftl_cs: FTL header corrupt! [ 191.731099][ T31] kauditd_printk_skb: 2 callbacks suppressed [ 191.739449][ T31] audit: type=1400 audit(1787751482.226:737): avc: denied { append } for pid=7675 comm="syz.0.491" name="portlist" dev="nfsd" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=file permissive=1 [ 191.765637][ T31] audit: type=1400 audit(1787751482.226:738): avc: denied { mounton } for pid=7675 comm="syz.0.491" path="/107/nfsd" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=dir permissive=1 [ 191.822348][ T5694] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 191.866683][ T31] audit: type=1400 audit(1787751482.366:739): avc: denied { ioctl } for pid=7675 comm="syz.0.491" path="socket:[21445]" dev="sockfs" ino=21445 ioctlcmd=0x662c scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 192.106894][ T5694] usb 3-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 193.890365][ T5694] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 193.951425][ T5694] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 193.951517][ T5694] usb 3-1: Product: syz [ 193.951587][ T5694] usb 3-1: Manufacturer: syz [ 193.951646][ T5694] usb 3-1: SerialNumber: syz [ 194.011427][ T5694] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 194.264347][ T7694] netlink: 64138 bytes leftover after parsing attributes in process `syz.5.496'. [ 196.135632][ T5694] gspca_mr97310a: reg write [21] error -110 [ 196.135808][ T5694] mr97310a 3-1:1.0: probe with driver mr97310a failed with error -110 [ 196.254416][ T9] usb 3-1: USB disconnect, device number 17 [ 196.992379][ T5785] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 197.047097][ T7717] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 197.056720][ T7717] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 197.148534][ T7715] gadgetfs: bound to dummy_udc driver [ 197.214045][ T5785] usb 2-1: unable to get BOS descriptor or descriptor too short [ 197.221850][ T5785] usb 2-1: New USB device found, idVendor=0471, idProduct=0602, bcdDevice=a4.95 [ 197.231949][ T5785] usb 2-1: config 66 has an invalid descriptor of length 0, skipping remainder of the config [ 197.242698][ T5785] usb 2-1: config 66 has 1 interface, different from the descriptor's value: 2 [ 197.251779][ T5785] usb 2-1: config 66 interface 0 altsetting 16 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 197.265352][ T5785] usb 2-1: config 66 interface 0 has no altsetting 0 [ 197.275653][ T5785] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 197.284389][ T5785] usb 2-1: Product: syz [ 197.288667][ T5785] usb 2-1: Manufacturer: syz [ 197.293351][ T5785] usb 2-1: SerialNumber: syz [ 197.329064][ T7720] can0: slcan on ptm0. [ 197.348844][ T31] audit: type=1400 audit(1787751487.846:740): avc: denied { read } for pid=5264 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 197.444078][ T7718] can0 (unregistered): slcan off ptm0. [ 197.503097][ T31] audit: type=1400 audit(1787751487.996:741): avc: denied { unmount } for pid=5597 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 197.538616][ T31] audit: type=1400 audit(1787751488.036:742): avc: denied { create } for pid=7704 comm="syz.1.498" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 197.559044][ T7705] IPVS: set_ctl: invalid protocol: 58 172.30.1.2:20003 [ 197.564238][ T31] audit: type=1400 audit(1787751488.066:743): avc: denied { setopt } for pid=7704 comm="syz.1.498" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 197.603584][ T5785] ati_remote2 2-1:66.0: ati_remote2_probe(): interface 0 must have an endpoint [ 197.617290][ T5785] usb 2-1: USB disconnect, device number 11 [ 197.813559][ T7735] syzkaller0: entered promiscuous mode [ 197.819188][ T7735] syzkaller0: entered allmulticast mode [ 197.882262][ T31] audit: type=1400 audit(1787751488.356:744): avc: denied { write } for pid=7723 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 197.946256][ T31] audit: type=1400 audit(1787751488.446:745): avc: denied { write } for pid=7739 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 198.159526][ T7730] 0x000000000006-0x000000020000 : "" [ 198.174890][ T7730] ftl_cs: FTL header corrupt! [ 198.522012][ T31] audit: type=1400 audit(1787751489.016:746): avc: denied { write } for pid=7741 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 198.854184][ T31] audit: type=1400 audit(1787751489.356:747): avc: denied { write } for pid=7763 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 199.013439][ T9] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 199.131935][ T7766] syz.1.511 invoked oom-killer: gfp_mask=0x402dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_ZERO|__GFP_NOWARN), order=0, oom_score_adj=1000 [ 199.145872][ T7766] CPU: 1 UID: 0 PID: 7766 Comm: syz.1.511 Not tainted syzkaller #0 PREEMPT(full) [ 199.145905][ T7766] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 199.145918][ T7766] Call Trace: [ 199.145925][ T7766] [ 199.145933][ T7766] dump_stack_lvl+0x100/0x190 [ 199.145969][ T7766] dump_header+0xfb/0x606 [ 199.145993][ T7766] oom_kill_process.cold+0xd/0x380 [ 199.146019][ T7766] out_of_memory+0x340/0x14f0 [ 199.146049][ T7766] ? __pfx_out_of_memory+0x10/0x10 [ 199.146081][ T7766] mem_cgroup_out_of_memory+0xc6/0x130 [ 199.146120][ T7766] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 199.146150][ T7766] ? find_held_lock+0x2b/0x80 [ 199.146182][ T7766] ? do_raw_spin_unlock+0x145/0x1e0 [ 199.146207][ T7766] ? _raw_spin_unlock+0x28/0x50 [ 199.146237][ T7766] try_charge_memcg+0x6e1/0xdf0 [ 199.146267][ T7766] ? __pfx_try_charge_memcg+0x10/0x10 [ 199.146293][ T7766] ? find_held_lock+0x2b/0x80 [ 199.146319][ T7766] ? rcu_read_unlock+0x17/0x60 [ 199.146346][ T7766] ? rcu_read_unlock+0x17/0x60 [ 199.146381][ T7766] obj_cgroup_charge_pages+0x22/0x1d0 [ 199.146410][ T7766] __memcg_kmem_charge_page+0x1c4/0x4d0 [ 199.146441][ T7766] __alloc_frozen_pages_noprof+0x534/0x3300 [ 199.146475][ T7766] ? lockdep_hardirqs_on+0x7d/0x110 [ 199.146503][ T7766] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 199.146529][ T7766] ? stack_depot_save_flags+0x49a/0x9f0 [ 199.146565][ T7766] ? kasan_save_stack+0x3f/0x50 [ 199.146584][ T7766] ? kasan_save_stack+0x30/0x50 [ 199.146605][ T7766] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 199.146636][ T7766] ? nft_add_set_elem+0x2fe4/0x4050 [ 199.146661][ T7766] ? nf_tables_newsetelem+0x721/0xa60 [ 199.146685][ T7766] ? nfnetlink_rcv_batch+0x1410/0x2880 [ 199.146714][ T7766] ? nfnetlink_rcv+0x3bd/0x440 [ 199.146741][ T7766] ? netlink_unicast+0x585/0x850 [ 199.146764][ T7766] ? ___sys_sendmsg+0x190/0x1e0 [ 199.146786][ T7766] ? do_syscall_64+0x123/0x790 [ 199.146818][ T7766] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 199.146852][ T7766] ? __lock_acquire+0x4c5/0x1ec0 [ 199.146872][ T7766] ? __css_rstat_updated+0x1ce/0x590 [ 199.146897][ T7766] ? __pfx___css_rstat_updated+0x10/0x10 [ 199.146922][ T7766] ? policy_nodemask+0xed/0x4f0 [ 199.146944][ T7766] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 199.146968][ T7766] ? policy_nodemask+0xed/0x4f0 [ 199.146994][ T7766] alloc_pages_mpol+0x201/0x550 [ 199.147019][ T7766] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 199.147043][ T7766] ? find_held_lock+0x2b/0x80 [ 199.147068][ T7766] ? rcu_read_unlock+0x17/0x60 [ 199.147093][ T7766] ? rcu_read_unlock+0x17/0x60 [ 199.147128][ T7766] alloc_pages_noprof+0x1a/0x160 [ 199.147155][ T7766] __vmalloc_node_range_noprof+0x8af/0x1460 [ 199.147189][ T7766] ? pipapo_resize+0x1c4/0x830 [ 199.147219][ T7766] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 199.147244][ T7766] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 199.147272][ T7766] ? rcu_is_watching+0x13/0xc0 [ 199.147303][ T7766] __kvmalloc_node_noprof+0x3da/0x9b0 [ 199.147324][ T7766] ? pipapo_resize+0x1c4/0x830 [ 199.147352][ T7766] ? pipapo_resize+0x680/0x830 [ 199.147378][ T7766] ? pipapo_resize+0x68a/0x830 [ 199.147405][ T7766] ? pipapo_resize+0x1c4/0x830 [ 199.147438][ T7766] pipapo_resize+0x1c4/0x830 [ 199.147477][ T7766] pipapo_insert+0x52/0x520 [ 199.147515][ T7766] nft_pipapo_insert+0x91d/0x1bf0 [ 199.147564][ T7766] ? __pfx_nft_pipapo_insert+0x10/0x10 [ 199.147605][ T7766] ? __kmalloc_noprof+0x350/0x840 [ 199.147625][ T7766] ? nft_trans_alloc+0x1d/0x2d0 [ 199.147654][ T7766] nft_add_set_elem+0x2fe4/0x4050 [ 199.147686][ T7766] ? find_held_lock+0x2b/0x80 [ 199.147714][ T7766] ? is_bpf_text_address+0x8a/0x1a0 [ 199.147739][ T7766] ? __pfx_nft_add_set_elem+0x10/0x10 [ 199.147768][ T7766] ? is_bpf_text_address+0x94/0x1a0 [ 199.147793][ T7766] ? kernel_text_address+0x8d/0x100 [ 199.147823][ T7766] ? __kernel_text_address+0xd/0x30 [ 199.147854][ T7766] ? arch_stack_walk+0xa6/0xf0 [ 199.147890][ T7766] ? stack_trace_save+0x8e/0xc0 [ 199.147920][ T7766] ? __pfx_stack_trace_save+0x10/0x10 [ 199.147950][ T7766] ? stack_depot_save_flags+0x27/0x9f0 [ 199.147991][ T7766] ? __nla_validate_parse+0x1e7/0x28b0 [ 199.148029][ T7766] ? nla_strcmp+0xff/0x130 [ 199.148052][ T7766] ? nft_set_lookup_global+0x163/0x390 [ 199.148077][ T7766] nf_tables_newsetelem+0x721/0xa60 [ 199.148113][ T7766] ? __pfx_nf_tables_newsetelem+0x10/0x10 [ 199.148146][ T7766] ? __nla_parse+0x40/0x60 [ 199.148172][ T7766] nfnetlink_rcv_batch+0x1410/0x2880 [ 199.148216][ T7766] ? __pfx_nfnetlink_rcv_batch+0x10/0x10 [ 199.148247][ T7766] ? find_held_lock+0x2b/0x80 [ 199.148288][ T7766] ? avc_has_perm_noaudit+0x145/0x3b0 [ 199.148337][ T7766] ? __nla_parse+0x40/0x60 [ 199.148362][ T7766] nfnetlink_rcv+0x3bd/0x440 [ 199.148391][ T7766] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 199.148428][ T7766] netlink_unicast+0x585/0x850 [ 199.148458][ T7766] ? __pfx_netlink_unicast+0x10/0x10 [ 199.148490][ T7766] netlink_sendmsg+0x8b0/0xda0 [ 199.148520][ T7766] ? __pfx_netlink_sendmsg+0x10/0x10 [ 199.148547][ T7766] ? selinux_socket_sendmsg+0x198/0x2f0 [ 199.148579][ T7766] ____sys_sendmsg+0xa4d/0xbe0 [ 199.148597][ T7766] ? __pfx_netlink_sendmsg+0x10/0x10 [ 199.148623][ T7766] ? __pfx_____sys_sendmsg+0x10/0x10 [ 199.148656][ T7766] ___sys_sendmsg+0x190/0x1e0 [ 199.148680][ T7766] ? __pfx____sys_sendmsg+0x10/0x10 [ 199.148702][ T7766] ? futex_wait+0x11e/0x370 [ 199.148742][ T7766] ? find_held_lock+0x2b/0x80 [ 199.148787][ T7766] __sys_sendmsg+0x160/0x210 [ 199.148815][ T7766] ? __pfx___sys_sendmsg+0x10/0x10 [ 199.148857][ T7766] do_syscall_64+0x123/0x790 [ 199.148890][ T7766] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 199.148910][ T7766] RIP: 0033:0x7f81fb39e0d9 [ 199.148929][ T7766] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 199.148948][ T7766] RSP: 002b:00007f81fc1ed028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 199.148969][ T7766] RAX: ffffffffffffffda RBX: 00007f81fb625fa0 RCX: 00007f81fb39e0d9 [ 199.148982][ T7766] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000004 [ 199.148993][ T7766] RBP: 00007f81fb435024 R08: 0000000000000000 R09: 0000000000000000 [ 199.149005][ T7766] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 199.149017][ T7766] R13: 00007f81fb626038 R14: 00007f81fb625fa0 R15: 00007ffd9973def8 [ 199.149045][ T7766] [ 199.163852][ T7766] memory: usage 96kB, limit 96kB, failcnt 34 [ 199.163911][ T7766] memory+swap: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 199.163949][ T7766] kmem: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 199.163985][ T7766] Memory cgroup stats for /syz1/test: [ 199.164449][ T7766] cache 0 [ 199.164501][ T7766] rss 0 [ 199.164535][ T7766] rss_huge 0 [ 199.164567][ T7766] shmem 0 [ 199.164601][ T7766] mapped_file 0 [ 199.164632][ T7766] dirty 0 [ 199.164667][ T7766] writeback 0 [ 199.164699][ T7766] workingset_refault_anon 0 [ 199.164733][ T7766] workingset_refault_file 0 [ 199.164767][ T7766] swap 0 [ 199.164799][ T7766] swapcached 0 [ 199.164832][ T7766] pgpgin 0 [ 199.164865][ T7766] pgpgout 0 [ 199.164898][ T7766] pgfault 12 [ 199.164931][ T7766] pgmajfault 0 [ 199.164964][ T7766] inactive_anon 0 [ 199.165002][ T7766] active_anon 0 [ 199.165061][ T7766] inactive_file 0 [ 199.165095][ T7766] active_file 0 [ 199.165166][ T7766] unevictable 0 [ 199.165222][ T7766] hierarchical_memory_limit 98304 [ 199.165257][ T7766] hierarchical_memsw_limit 9223372036854771712 [ 199.165293][ T7766] total_cache 0 [ 199.165328][ T7766] total_rss 0 [ 199.165386][ T7766] total_rss_huge 0 [ 199.165421][ T7766] total_shmem 0 [ 199.165456][ T7766] total_mapped_file 0 [ 199.165498][ T7766] total_dirty 0 [ 199.165563][ T7766] total_writeback 0 [ 199.165620][ T7766] total_workingset_refault_anon 0 [ 199.165686][ T7766] total_workingset_refault_file 0 [ 199.165746][ T7766] total_swap 0 [ 199.165782][ T7766] total_swapcached 0 [ 199.165819][ T7766] total_pgpgin 0 [ 199.173813][ T7766] total_pgpgout 0 [ 199.176036][ T7766] total_pgfault 12 [ 199.176072][ T7766] total_pgmajfault 0 [ 199.176110][ T7766] total_inactive_anon 0 [ 199.176143][ T7766] total_active_anon 0 [ 199.176180][ T7766] total_inactive_file 0 [ 199.176232][ T7766] total_active_file 0 [ 199.176266][ T7766] total_unevictable 0 [ 199.176299][ T7766] anon_cost 0 [ 199.176333][ T7766] file_cost 0 [ 199.176367][ T7766] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz1/test,task_memcg=/syz1/test,task=syz.1.511,pid=7764,uid=0 [ 199.198754][ T7766] Memory cgroup out of memory: Killed process 7764 (syz.1.511) total-vm:102252kB, anon-rss:1424kB, file-rss:22672kB, shmem-rss:0kB, UID:0 pgtables:128kB oom_score_adj:1000 [ 199.282126][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 199.282612][ T9] usb 3-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 199.283564][ T9] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 199.283582][ T9] usb 3-1: config 0 has no interface number 0 [ 199.287346][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 199.287367][ T9] usb 3-1: Product: syz [ 199.287381][ T9] usb 3-1: Manufacturer: syz [ 199.287394][ T9] usb 3-1: SerialNumber: syz [ 199.324520][ T1704] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 199.524809][ T31] audit: type=1400 audit(1787751489.896:748): avc: denied { getopt } for pid=7769 comm="syz.5.503" lport=135 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 199.525924][ T31] audit: type=1400 audit(1787751489.936:749): avc: denied { ioctl } for pid=7769 comm="syz.5.503" path="socket:[22079]" dev="sockfs" ino=22079 ioctlcmd=0x89f0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 199.611740][ T7773] loop0: detected capacity change from 0 to 3904 [ 199.621657][ T9] usb 3-1: config 0 descriptor?? [ 199.629312][ T9] usb 3-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 199.629331][ T9] usb 3-1: selecting invalid altsetting 1 [ 199.629344][ T9] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 199.667254][ T9] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 199.667509][ T9] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 199.667540][ T9] usb 3-1: media controller created [ 199.740724][ T7777] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 199.742130][ T7777] ldm_parse_privhead(): PRIVHEAD disk size doesn't match real disk size [ 199.742144][ T7777] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 199.742185][ T7777] loop0: [ 199.745483][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 199.886406][ T1704] usb 4-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 199.955023][ T7785] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 199.955362][ T7785] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 199.956603][ T1704] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 200.136436][ T7786] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 200.137063][ T7786] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 200.145971][ T1704] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 200.146033][ T1704] usb 4-1: Product: syz [ 200.146069][ T1704] usb 4-1: Manufacturer: syz [ 200.146109][ T1704] usb 4-1: SerialNumber: syz [ 200.236738][ T1704] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 200.708879][ T7794] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 200.717988][ T7794] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 200.725897][ T9] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 200.742374][ T1704] gspca_mr97310a: reg write [21] error -110 [ 200.742505][ T1704] mr97310a 4-1:1.0: probe with driver mr97310a failed with error -110 [ 200.801432][ T9] usb 3-1: USB disconnect, device number 19 [ 200.944151][ T7794] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 200.955593][ T7794] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 203.185794][ T5724] usb 4-1: USB disconnect, device number 17 [ 203.317232][ T7808] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 203.317586][ T7808] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 203.320043][ T31] kauditd_printk_skb: 10 callbacks suppressed [ 203.320100][ T31] audit: type=1400 audit(1787751493.816:760): avc: denied { connect } for pid=7806 comm="syz.0.520" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 203.382519][ T7807] 0x000000000000-0x000000020000 : "" [ 203.391340][ T7807] ftl_cs: FTL header not found. [ 203.508090][ T7813] loop0: detected capacity change from 0 to 4096 [ 203.555008][ T7813] loop0: [ 203.702162][ T9] usb 3-1: new full-speed USB device number 20 using dummy_hcd [ 203.859839][ T9] usb 3-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 203.861023][ T9] usb 3-1: config 0 has an invalid interface number: 41 but max is 0 [ 203.861044][ T9] usb 3-1: config 0 has no interface number 0 [ 203.861072][ T9] usb 3-1: config 0 interface 41 has no altsetting 0 [ 203.862869][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 203.862887][ T9] usb 3-1: Product: syz [ 203.862900][ T9] usb 3-1: Manufacturer: syz [ 203.862912][ T9] usb 3-1: SerialNumber: syz [ 203.873681][ T9] usb 3-1: config 0 descriptor?? [ 203.933954][ T5785] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 203.965564][ T7823] netlink: 32 bytes leftover after parsing attributes in process `syz.3.527'. [ 204.082946][ T5785] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 204.094679][ T5785] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 204.106193][ T5785] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 204.106259][ T5785] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 204.106294][ T5785] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 204.139134][ T31] audit: type=1400 audit(1787751494.466:761): avc: denied { create } for pid=7824 comm="syz.0.528" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 204.139226][ T31] audit: type=1400 audit(1787751494.536:762): avc: denied { sys_admin } for pid=7824 comm="syz.0.528" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 204.232805][ T5785] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 204.382223][ T7825] mmap: syz.0.528 (7825): VmData 35500032 exceed data ulimit 4. Update limits or use boot option ignore_rlimit_data. [ 204.590294][ T7819] warning: `syz.1.526' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 204.678144][ T7819] capability: warning: `syz.1.526' uses deprecated v2 capabilities in a way that may be insecure [ 204.715023][ T5785] snd-usb-audio 2-1:27.0: probe with driver snd-usb-audio failed with error -12 [ 204.896429][ T7812] xt_nfacct: accounting object `syz0' does not exist [ 205.289152][ T7837] Cannot find set identified by id 0 to match [ 205.417395][ T7842] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 205.434538][ T7842] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 205.667673][ T7842] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 205.679227][ T7842] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 205.715494][ T9] CoreChips 3-1:0.41: probe with driver CoreChips failed with error -71 [ 205.737415][ T9] usb 3-1: USB disconnect, device number 20 [ 205.782622][ T5785] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 205.802144][ T5714] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 205.932880][ T5785] usb 6-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 205.944928][ T5785] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 205.956127][ T5714] usb 4-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 205.968081][ T5714] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 205.968157][ T5714] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 205.968198][ T5714] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 205.968227][ T5714] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 205.968296][ T5714] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 206.022976][ T5785] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 206.031079][ T5785] usb 6-1: Product: syz [ 206.031095][ T5785] usb 6-1: Manufacturer: syz [ 206.031110][ T5785] usb 6-1: SerialNumber: syz [ 206.072209][ T5785] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 206.532184][ T5785] gspca_mr97310a: reg write [19] error -71 [ 206.532296][ T5785] mr97310a 6-1:1.0: probe with driver mr97310a failed with error -71 [ 206.560878][ T5785] usb 6-1: USB disconnect, device number 6 [ 206.733210][ T7852] loop0: detected capacity change from 0 to 4096 [ 206.777263][ T7852] loop0: [ 206.836643][ T7850] syzkaller0: entered promiscuous mode [ 206.836751][ T7850] syzkaller0: entered allmulticast mode [ 206.866819][ T31] audit: type=1400 audit(1787751497.366:763): avc: denied { wake_alarm } for pid=7854 comm="syz.2.538" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 206.866949][ T31] audit: type=1400 audit(1787751497.366:764): avc: denied { ioctl } for pid=7854 comm="syz.2.538" path="/dev/nullb0" dev="devtmpfs" ino=694 ioctlcmd=0x127f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 206.945968][ T5694] usb 2-1: USB disconnect, device number 12 [ 206.986871][ T7850] 0: reclassify loop, rule prio 0, protocol 800 [ 206.999893][ T7856] netlink: 4 bytes leftover after parsing attributes in process `syz.2.538'. [ 207.131668][ T7856] 8021q: adding VLAN 0 to HW filter on device team1 [ 207.356746][ T5714] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI [ 207.368840][ T5714] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] [ 207.377242][ T5714] CPU: 0 UID: 0 PID: 5714 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT(full) [ 207.386594][ T5714] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 207.396636][ T5714] Workqueue: usb_hub_wq hub_event [ 207.401665][ T5714] RIP: 0010:drm_object_attach_property+0x85/0x3b0 [ 207.408085][ T5714] Code: 0f b6 04 02 84 c0 74 08 3c 03 0f 8e 93 02 00 00 49 8d 7c 24 60 49 63 5d 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 a2 02 00 00 48 8d 7d 04 4d 8b 74 24 60 48 b8 00 [ 207.427692][ T5714] RSP: 0018:ffffc900043aeda8 EFLAGS: 00010206 [ 207.433747][ T5714] RAX: dffffc0000000000 RBX: 0000000000000007 RCX: ffffc90019f05000 [ 207.441699][ T5714] RDX: 000000000000000c RSI: ffffffff85d1c372 RDI: 0000000000000060 [ 207.449654][ T5714] RBP: ffff88803671e040 R08: 0000000000000007 R09: fffffffffffff000 [ 207.457608][ T5714] R10: ffff88803671ecf4 R11: ffffffff827e8a44 R12: 0000000000000000 [ 207.465563][ T5714] R13: ffff88803671e230 R14: ffff88803671ecf4 R15: 0000000000000000 [ 207.473516][ T5714] FS: 0000000000000000(0000) GS:ffff888123b6d000(0000) knlGS:0000000000000000 [ 207.482434][ T5714] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 207.489001][ T5714] CR2: 0000001b32724224 CR3: 000000002b9db000 CR4: 00000000003526f0 [ 207.496955][ T5714] Call Trace: [ 207.500218][ T5714] [ 207.503129][ T5714] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 207.509013][ T5714] gud_get_connectors+0x86e/0x1700 [ 207.514110][ T5714] gud_probe+0x17aa/0x1c20 [ 207.518525][ T5714] ? __pfx_gud_probe+0x10/0x10 [ 207.523278][ T5714] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 207.529074][ T5714] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 207.534866][ T5714] ? __pm_runtime_set_status+0x13c/0x970 [ 207.540487][ T5714] usb_probe_interface+0x386/0x9b0 [ 207.545585][ T5714] ? __pfx_usb_probe_interface+0x10/0x10 [ 207.551201][ T5714] ? kernfs_put+0x3f/0x60 [ 207.555523][ T5714] ? sysfs_create_link+0x68/0xc0 [ 207.560445][ T5714] ? __pfx_usb_probe_interface+0x10/0x10 [ 207.566059][ T5714] really_probe+0x241/0xa60 [ 207.570550][ T5714] __driver_probe_device+0x210/0x460 [ 207.575822][ T5714] driver_probe_device+0x4a/0x140 [ 207.580835][ T5714] __device_attach_driver+0x1df/0x320 [ 207.586196][ T5714] ? __pfx___device_attach_driver+0x10/0x10 [ 207.592078][ T5714] bus_for_each_drv+0x159/0x1e0 [ 207.596920][ T5714] ? __pfx_bus_for_each_drv+0x10/0x10 [ 207.602281][ T5714] ? lockdep_hardirqs_on+0x7d/0x110 [ 207.607470][ T5714] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 207.613282][ T5714] __device_attach+0x1e4/0x4d0 [ 207.618036][ T5714] ? __pfx___device_attach+0x10/0x10 [ 207.623307][ T5714] ? do_raw_spin_unlock+0x145/0x1e0 [ 207.628496][ T5714] device_initial_probe+0xaf/0xd0 [ 207.633513][ T5714] bus_probe_device+0x64/0x160 [ 207.638265][ T5714] device_add+0x121d/0x1970 [ 207.642760][ T5714] ? __pfx_device_add+0x10/0x10 [ 207.647602][ T5714] ? mark_held_locks+0x40/0x70 [ 207.652346][ T5714] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 207.658142][ T5714] usb_set_configuration+0xd97/0x1c60 [ 207.663509][ T5714] ? __pfx_usb_generic_driver_probe+0x10/0x10 [ 207.669566][ T5714] usb_generic_driver_probe+0xa1/0xe0 [ 207.674926][ T5714] usb_probe_device+0xef/0x400 [ 207.679674][ T5714] ? __pfx_usb_probe_device+0x10/0x10 [ 207.685031][ T5714] really_probe+0x241/0xa60 [ 207.689526][ T5714] __driver_probe_device+0x210/0x460 [ 207.694799][ T5714] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 207.700595][ T5714] driver_probe_device+0x4a/0x140 [ 207.705608][ T5714] __device_attach_driver+0x1df/0x320 [ 207.710981][ T5714] ? __pfx___device_attach_driver+0x10/0x10 [ 207.716867][ T5714] bus_for_each_drv+0x159/0x1e0 [ 207.721700][ T5714] ? __pfx_bus_for_each_drv+0x10/0x10 [ 207.727056][ T5714] ? lockdep_hardirqs_on+0x7d/0x110 [ 207.732242][ T5714] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 207.738035][ T5714] __device_attach+0x1e4/0x4d0 [ 207.742784][ T5714] ? __pfx___device_attach+0x10/0x10 [ 207.748067][ T5714] ? do_raw_spin_unlock+0x145/0x1e0 [ 207.753261][ T5714] device_initial_probe+0xaf/0xd0 [ 207.758287][ T5714] bus_probe_device+0x64/0x160 [ 207.763055][ T5714] device_add+0x121d/0x1970 [ 207.767564][ T5714] ? __pfx_device_add+0x10/0x10 [ 207.772406][ T5714] ? usb_detect_static_quirks+0x335/0x3e0 [ 207.778121][ T5714] usb_new_device.part.0+0xcc2/0x1686 [ 207.783488][ T5714] ? do_raw_spin_lock+0x128/0x260 [ 207.788505][ T5714] ? __pfx_usb_new_device.part.0+0x10/0x10 [ 207.794309][ T5714] ? mark_held_locks+0x40/0x70 [ 207.799059][ T5714] hub_event.cold+0x1e3/0xe90 [ 207.803737][ T5714] ? __pfx_hub_event+0x10/0x10 [ 207.808484][ T5714] ? __lock_acquire+0x12e0/0x1ec0 [ 207.813500][ T5714] ? process_one_work+0x906/0x1b10 [ 207.818621][ T5714] ? process_one_work+0x906/0x1b10 [ 207.823735][ T5714] process_one_work+0xac7/0x1b10 [ 207.828668][ T5714] ? __pfx_process_one_work+0x10/0x10 [ 207.834034][ T5714] ? __pfx_hub_event+0x10/0x10 [ 207.838785][ T5714] worker_thread+0x5ef/0xe50 [ 207.843370][ T5714] ? __pfx_worker_thread+0x10/0x10 [ 207.848475][ T5714] ? kthread+0x13a/0x450 [ 207.852706][ T5714] ? __pfx_worker_thread+0x10/0x10 [ 207.857807][ T5714] kthread+0x373/0x450 [ 207.861866][ T5714] ? __pfx_kthread+0x10/0x10 [ 207.866447][ T5714] ret_from_fork+0x730/0xd60 [ 207.871023][ T5714] ? __pfx_ret_from_fork+0x10/0x10 [ 207.876126][ T5714] ? __switch_to+0x800/0x10f0 [ 207.880797][ T5714] ? __pfx_kthread+0x10/0x10 [ 207.885380][ T5714] ret_from_fork_asm+0x1a/0x30 [ 207.890134][ T5714] [ 207.893133][ T5714] Modules linked in: [ 207.897589][ T5714] ---[ end trace 0000000000000000 ]--- [ 207.917732][ T5714] RIP: 0010:drm_object_attach_property+0x85/0x3b0 [ 207.969623][ T31] audit: type=1400 audit(1787751498.456:765): avc: denied { read } for pid=4951 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 207.969694][ T31] audit: type=1400 audit(1787751498.456:766): avc: denied { search } for pid=4951 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 207.969730][ T31] audit: type=1400 audit(1787751498.456:767): avc: denied { write search } for pid=4951 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 207.969766][ T31] audit: type=1400 audit(1787751498.456:768): avc: denied { add_name } for pid=4951 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 207.969800][ T31] audit: type=1400 audit(1787751498.456:769): avc: denied { create } for pid=4951 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 207.997458][ T7840] overlayfs: missing 'lowerdir' [ 208.084043][ T5714] Code: 0f b6 04 02 84 c0 74 08 3c 03 0f 8e 93 02 00 00 49 8d 7c 24 60 49 63 5d 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 a2 02 00 00 48 8d 7d 04 4d 8b 74 24 60 48 b8 00 [ 208.104040][ T5714] RSP: 0018:ffffc900043aeda8 EFLAGS: 00010206 [ 208.110401][ T5714] RAX: dffffc0000000000 RBX: 0000000000000007 RCX: ffffc90019f05000 [ 208.118486][ T5714] RDX: 000000000000000c RSI: ffffffff85d1c372 RDI: 0000000000000060 [ 208.127276][ T5714] RBP: ffff88803671e040 R08: 0000000000000007 R09: fffffffffffff000 [ 208.135333][ T5714] R10: ffff88803671ecf4 R11: ffffffff827e8a44 R12: 0000000000000000 [ 208.143379][ T5714] R13: ffff88803671e230 R14: ffff88803671ecf4 R15: 0000000000000000 [ 208.151415][ T5714] FS: 0000000000000000(0000) GS:ffff888123b6d000(0000) knlGS:0000000000000000 [ 208.160466][ T5714] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 208.167807][ T5714] CR2: 00007f055168c000 CR3: 000000007dfcc000 CR4: 00000000003526f0 [ 208.175863][ T5714] Kernel panic - not syncing: Fatal exception [ 208.182133][ T5714] Kernel Offset: disabled [ 208.186444][ T5714] Rebooting in 86400 seconds..