last executing test programs: 3m40.485327477s ago: executing program 3 (id=176): capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000080)={0x6, 0x6, 0xd, 0x85, 0xffffffff, 0x2}) socket$phonet_pipe(0x23, 0x5, 0x2) 3m40.365865933s ago: executing program 3 (id=177): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000ac0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r1, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)={0x20, r2, 0x1, 0x70bd27, 0x25dedbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_SCAN_SUPP_RATES={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x46b2d3ba8e12a610}, 0x4048840) bind$bt_sco(r0, &(0x7f0000000000)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x8) r4 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000240)={'vxcan0\x00', 0x0}) connect$can_bcm(r4, &(0x7f0000000080)={0x1d, r5}, 0x10) sendmsg$can_bcm(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="05"], 0x48}, 0x1, 0x0, 0x0, 0x48850}, 0x0) sendmsg$can_bcm(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="05"], 0x48}}, 0x4) 3m40.232327834s ago: executing program 3 (id=178): mknod(&(0x7f0000000080)='./bus\x00', 0x400, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) chdir(&(0x7f00000001c0)='./file0\x00') r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='.\x00', 0x20000, 0x1f6) r1 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000100)={'ip6_vti0\x00', &(0x7f0000000140)=@ethtool_gstrings={0x1b, 0x6}}) syz_usb_connect$uac1(0x0, 0xaa, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902980003010000000904000000010100000a2401000000020102132406040006030000000000000000000000000924030000010000ff0924050000f8431cfd0924030604030204001b240404020904", @ANYBLOB='\n'], 0x0) r2 = fanotify_init(0x200, 0x0) fanotify_mark(r2, 0x1, 0x8000026, r0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x200, 0xa) 3m38.249746538s ago: executing program 3 (id=183): syz_io_uring_setup(0x235, &(0x7f0000000140)={0x0, 0x4532, 0x10100, 0xfffffffd, 0x24c}, &(0x7f0000000680), 0x0, 0x0) syz_clone3(&(0x7f0000000600)={0x44000080, &(0x7f00000004c0), &(0x7f0000000300), &(0x7f0000000380), {0x34}, &(0x7f00000006c0)=""/54, 0x36, &(0x7f0000000700)=""/142, &(0x7f00000005c0)=[0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0], 0x6}, 0x82) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2c040, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000280)='./file1/file0\x00', 0x0, 0x1085408, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000002c0)) chdir(&(0x7f00000001c0)='./bus\x00') r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="18020000000000020000000000000000850000001700000095"], &(0x7f00000005c0)='GPL\x00'}, 0x94) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000000)={0xe, 0x18, 0xfa00, @id_tos={0x0, 0xffffffffffffffff, 0x0, 0x3}}, 0x20) r3 = socket(0x10, 0x803, 0x8) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="067c3058d11cbb97eb2000070dc7f9092800000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000200"/28], 0x50) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) r4 = socket$netlink(0x10, 0x3, 0x0) getsockname$packet(r3, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r5, @ANYBLOB="00001000252155b21c0012000c000100626f6e64"], 0x3c}}, 0x40000) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000001c0)={r2, r5, 0x25, 0x0, @val=@netkit={@void, @value=r2}}, 0x1c) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32, @ANYBLOB="46ff0f00000000001c00128009000100626f6e64000000000c000280050001"], 0x3c}, 0x1, 0x0, 0x0, 0x690}, 0x20048040) close_range(r1, 0xffffffffffffffff, 0x0) 3m37.002102733s ago: executing program 3 (id=185): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/devices/system/clocksource/clocksource0/current_clocksource\x00', 0x2, 0x0) write(r0, &(0x7f00000000c0)='jiffies', 0xfdef) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) mmap(&(0x7f0000800000)=nil, 0x1000, 0x3, 0x11, r3, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) syz_clone(0xca700, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$ETHTOOL_MSG_FEATURES_SET(r1, &(0x7f0000001b80)={0x0, 0x0, &(0x7f0000001b40)={&(0x7f0000000300)={0x18, r2, 0x1, 0x70bd28, 0x25dfdbfe, {}, [@ETHTOOL_A_FEATURES_HEADER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000}, 0x8000) 3m36.23668785s ago: executing program 3 (id=191): socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x5b) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) sendmsg$key(0xffffffffffffffff, 0x0, 0x10) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x40e0, 0x0) pipe(&(0x7f0000000140)) r2 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000340), &(0x7f00000001c0)=0xc) sendmsg$nl_generic(r2, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40001}, 0xc000) r3 = socket$rds(0x15, 0x5, 0x0) bind$rds(r3, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r4, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x25, &(0x7f0000000180)=0x62b8, 0x4) sendmsg$rds(r3, &(0x7f00000001c0)={&(0x7f0000000080)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000880)=""/4092, 0xffc}], 0x1, 0x0, 0x0, 0x20000800}, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x22004001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) r5 = openat$vicodec0(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VIDIOC_TRY_FMT(r5, 0xc0d05640, &(0x7f00000000c0)={0xa, @pix={0x0, 0x0, 0x34565348, 0x0, 0x0, 0x0, 0x25}}) syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) r6 = syz_open_dev$video(&(0x7f0000000280), 0x101, 0xab02) ioctl$VIDIOC_S_INPUT(r6, 0xc0045627, &(0x7f0000000180)=0x1) ioctl$AUTOFS_IOC_EXPIRE(0xffffffffffffffff, 0x810c9365, &(0x7f0000000480)={{0xfd, 0x2}, 0x100, './file0\x00'}) 3m20.555732422s ago: executing program 32 (id=191): socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x5b) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) sendmsg$key(0xffffffffffffffff, 0x0, 0x10) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x40e0, 0x0) pipe(&(0x7f0000000140)) r2 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000340), &(0x7f00000001c0)=0xc) sendmsg$nl_generic(r2, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40001}, 0xc000) r3 = socket$rds(0x15, 0x5, 0x0) bind$rds(r3, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r4, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x25, &(0x7f0000000180)=0x62b8, 0x4) sendmsg$rds(r3, &(0x7f00000001c0)={&(0x7f0000000080)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000880)=""/4092, 0xffc}], 0x1, 0x0, 0x0, 0x20000800}, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x22004001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) r5 = openat$vicodec0(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VIDIOC_TRY_FMT(r5, 0xc0d05640, &(0x7f00000000c0)={0xa, @pix={0x0, 0x0, 0x34565348, 0x0, 0x0, 0x0, 0x25}}) syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) r6 = syz_open_dev$video(&(0x7f0000000280), 0x101, 0xab02) ioctl$VIDIOC_S_INPUT(r6, 0xc0045627, &(0x7f0000000180)=0x1) ioctl$AUTOFS_IOC_EXPIRE(0xffffffffffffffff, 0x810c9365, &(0x7f0000000480)={{0xfd, 0x2}, 0x100, './file0\x00'}) 3.282798755s ago: executing program 5 (id=1327): mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000300)='./my_sysfs\x00', 0x1ff) mkdir(&(0x7f0000000600)='./my_dev\x00', 0x1ff) mount(0x0, &(0x7f0000000700)='./my_dev\x00', &(0x7f0000000800)='devtmpfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000900)='./my_configfs/dlm/cluster1\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000b00)='cluster1\x00', 0x9) mkdir(&(0x7f0000000d00)='./my_configfs/dlm/cluster1/comms/1\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000f00)='1\x00', 0x2) openat(0xffffffffffffff9c, &(0x7f0000001000)='./my_configfs/dlm/cluster1/comms/1/addr\x00', 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001400)='./my_configfs/dlm/cluster1/scan_secs\x00', 0x2, 0x0) write(r0, &(0x7f0000001500), 0x0) mkdir(&(0x7f0000001700)='./my_configfs/dlm/cluster1/spaces/ls1\x00', 0x1ff) mkdir(&(0x7f0000001900)='./my_configfs/dlm/cluster1/spaces/ls1/nodes/1\x00', 0x1ff) 2.931217678s ago: executing program 5 (id=1332): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = syz_open_dev$dvb_frontend(0x0, 0x0, 0x40002) ioctl$FE_SET_PROPERTY(r2, 0x40106f52, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000007200)=ANY=[@ANYBLOB="1201500200000020c016e17540000102035003090300040203010005092104003c01221a090905810300020401750000000000000000"], 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x3b, 0x0, &(0x7f0000000240)=0x24) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/oops_count', 0x3a5800, 0x88) ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f0000000180)={0xbc, 0x0, 0x1}) setrlimit(0xf, &(0x7f0000000000)={0x1, 0x5}) ioctl$USBDEVFS_CONTROL(r4, 0xc0185500, &(0x7f0000000080)={0x40, 0x17, 0x5, 0x4, 0x42, 0x5ff2, 0x0}) bind$can_raw(0xffffffffffffffff, &(0x7f0000000080), 0x10) syz_emit_ethernet(0x1a, 0x0, 0x0) 1.915787547s ago: executing program 1 (id=1347): openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./tracing/uprobe_events\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='p:s/_ ./file0:0', 0xf) 1.843803634s ago: executing program 0 (id=1348): openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0x8000) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./ffs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='functionfs\x00', 0x1ff) mount(&(0x7f0000000280)=@filename='usb0\x00', &(0x7f0000000200)='./ffs\x00', &(0x7f0000000240), 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000002c0)='./ffs/ep0\x00', 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000b, 0x28011, r0, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f00004c7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f00002da000/0x1000)=nil, &(0x7f0000081000/0x11000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f000076e000/0x1000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r1 = io_uring_setup(0x524, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) 1.668397065s ago: executing program 1 (id=1352): r0 = socket(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'macvlan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000180)=ANY=[@ANYBLOB="680000001000030400"/20, @ANYRES32=r2, @ANYBLOB="0000000000000000400012800c0001006d6163766c616e00300002800800010010"], 0x68}}, 0x64000004) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x50, 0x10, 0x40d, 0x70bd2a, 0x1, {0x0, 0x0, 0x0, 0x0, 0x470c0, 0x40}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x2}]}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'macvlan0\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x24060080}, 0x8000) 1.530714692s ago: executing program 2 (id=1354): syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f000054e000/0x400000)=nil) syz_clone(0x0, 0x0, 0xfffffffffffffead, 0x0, 0x0, 0x0) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000180)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00003ab000/0x2000)=nil, 0x400000, 0x3, 0x2}) 1.489703236s ago: executing program 1 (id=1355): r0 = socket(0x1, 0x803, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) recvmmsg(r1, &(0x7f0000002e80)=[{{0x0, 0x0, 0x0}, 0x3fffff}, {{0x0, 0x0, 0x0}, 0x6}, {{0x0, 0x0, &(0x7f0000003a40)=[{&(0x7f0000000ac0)=""/4096, 0x1000}, {&(0x7f0000000180)=""/33, 0x21}, {&(0x7f0000003740)=""/195, 0xc3}, {&(0x7f0000003840)=""/172, 0xac}, {&(0x7f0000003900)=""/151, 0x97}, {&(0x7f0000000280)=""/101, 0x65}], 0x6}, 0x9}, {{0x0, 0x0, 0x0}, 0xb91b}, {{0x0, 0x0, 0x0}, 0x8}], 0x5, 0x0, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r2 = socket$inet6(0xa, 0x1, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000080)={0x15, 0x0, 0x2000a, 0x9}) write$bt_hci(r4, &(0x7f0000000080)=ANY=[], 0x6) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000380)=@mangle={'mangle\x00', 0x2, 0x6, 0x640, 0x4a0, 0x4a0, 0x3b0, 0x3b0, 0x2e0, 0x570, 0x570, 0x570, 0x570, 0x570, 0x6, 0x0, {[{{@ipv6={@private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, [0xff, 0xffffffff, 0x0, 0x1fe000000], [0xffffff00, 0xff000000, 0xffffffff, 0xffffff00], 'ip6erspan0\x00', 'veth0_to_team\x00', {0xff}, {0xff}, 0x11, 0x2, 0x4}, 0x0, 0x188, 0x1b0, 0x0, {0x7a00000010000000}, [@common=@srh1={{0x90}, {0x2f, 0x4, 0x0, 0x0, 0x0, @empty, @mcast2, @private2, [], [0x0, 0xffffffff], [], 0x0, 0x10}}, @common=@inet=@multiport={{0x50}, {0x0, 0xc, [0x0, 0x0, 0x0, 0x4e21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffc], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}}]}, @HL={0x28}}, {{@ipv6={@mcast2, @dev={0xfe, 0x80, '\x00', 0x2}, [0x0, 0x0, 0x0, 0xff], [], 'bridge0\x00', 'veth1_vlan\x00'}, 0x0, 0xf8, 0x130, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x2}}, @inet=@rpfilter={{0x28}, {0xc}}]}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{}, {0x0, 0x2}, {0x0, 0xfd}, 0x300, 0x4}}}, {{@ipv6={@ipv4, @dev={0xfe, 0x80, '\x00', 0x32}, [], [], 'nicvf0\x00', 'bond_slave_0\x00', {0xff}, {}, 0x0, 0x2}, 0x0, 0xa8, 0xd0, 0x48000000}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x0, 0x1, 0x7ff}}}, {{@ipv6={@loopback, @local, [0xffffff00, 0x0, 0xff, 0xff000000], [0xff000000, 0xff000000, 0xffffffff, 0xffffff00], 'macvlan0\x00', 'veth1_to_bridge\x00', {0xff}, {0xff}, 0x8, 0x81, 0x1, 0x36}, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4=@rand_addr=0x8, @ipv6=@private1, 0x1d, 0x35}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x6a0) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000940)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r9, {0xf000, 0xffff}, {}, {0x7, 0xa}}, [@filter_kind_options=@f_route={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r11, {0xf000, 0xffff}, {}, {0x7, 0xa}}, [@filter_kind_options=@f_route={{0xa}, {0x14, 0x2, [@TCA_ROUTE4_FROM={0x8, 0x3, 0xa0}, @TCA_ROUTE4_CLASSID={0x2, 0x1, {0xfff3, 0xfff2}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f00000000c0)={@local, 0x0, 0x0, 0x1, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000380)={@private1, 0x9c940000, 0x0, 0x3, 0x8, 0x1, 0xfffe}, 0x20) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="30000000410007012bbd70000000000003"], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x40) 1.301760847s ago: executing program 2 (id=1357): mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_configfs\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./my_sysfs\x00', 0x1ff) mkdir(&(0x7f0000000600)='./my_dev\x00', 0x1ff) mount(0x0, &(0x7f0000000700)='./my_dev\x00', &(0x7f0000000800)='devtmpfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000900)='./my_configfs/dlm/cluster1\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000b00)='cluster1\x00', 0x9) mkdir(&(0x7f0000000d00)='./my_configfs/dlm/cluster1/comms/1\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000f00)='1\x00', 0x2) openat(0xffffffffffffff9c, &(0x7f0000001000)='./my_configfs/dlm/cluster1/comms/1/addr\x00', 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001400)='./my_configfs/dlm/cluster1/scan_secs\x00', 0x2, 0x0) write(r0, &(0x7f0000001500), 0x0) mkdir(&(0x7f0000001700)='./my_configfs/dlm/cluster1/spaces/ls1\x00', 0x1ff) mkdir(&(0x7f0000001900)='./my_configfs/dlm/cluster1/spaces/ls1/nodes/1\x00', 0x1ff) 1.249929758s ago: executing program 0 (id=1358): socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x3, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r0 = syz_open_dev$video(&(0x7f0000000040), 0x4, 0x0) ioctl$VIDIOC_S_FMT(r0, 0xc0d05640, &(0x7f00000006c0)={0x1, @pix={0x0, 0x0, 0x34565348, 0x0, 0x0, 0x0, 0x9, 0xfeedcafe, 0x0, 0xffffff80, 0x1, 0x7}}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$vim2m(&(0x7f00000002c0), 0x2000000f5, 0x2) openat$nvme_fabrics(0xffffffffffffff9c, 0x0, 0x121202, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCSPGRP(0xffffffffffffffff, 0x8902, 0x0) socket(0x20, 0x6, 0x438) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) mount(&(0x7f0000000000)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='efs\x00', 0x1214891, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffffffffffff87}}, 0x880) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x140, 0x1a0) fanotify_init(0x2, 0x8000) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@local, @random="0000ea0700", @val={@void, {0x8100, 0x0, 0x0, 0x1}}, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x2d, 0x2c, 0x0, 0x0, 0xa3, 0x6, 0x0, @remote, @local}, {{0x4e22, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x4000, {[@fastopen={0x22, 0x2}]}}}}}}}, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e0605250c"], 0x9) unshare(0x8040480) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, 0x0) fsopen(0x0, 0x0) fchdir(0xffffffffffffffff) 1.171618693s ago: executing program 4 (id=1359): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000000)=0x6, 0x4) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010000304000020000000000000000000", @ANYRES32=0x0, @ANYBLOB="8020010042000000200012800800010067747000140002800800030002000000", @ANYRES32=r1], 0x40}, 0x1, 0xba01}, 0x0) 1.134706428s ago: executing program 1 (id=1360): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01020000000000100000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000a14000000110001"], 0x64}}, 0x0) syz_emit_ethernet(0x32, &(0x7f00000000c0)={@local, @dev, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x84, 0x0, @remote={0xac, 0x24}, @remote}, "f2dfbc81cfe0ca1b360883fff0380bc5"}}}}, 0x0) 1.03843317s ago: executing program 5 (id=1361): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0xe, 0x0, 0x0) mount$overlay(0x0, 0x0, &(0x7f0000000080), 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1.018423828s ago: executing program 2 (id=1362): openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./tracing/uprobe_events\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='p:s/_ ./file0:0', 0xf) 916.386915ms ago: executing program 4 (id=1363): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000750000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000e000000"], 0x0, 0xfffffffe, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r2, r1, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x2dc2d, &(0x7f0000000300)=ANY=[], 0x0) 911.191508ms ago: executing program 1 (id=1364): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f00000002c0), 0xc804, &(0x7f0000000500)=ANY=[]) chdir(&(0x7f0000000240)='./file0\x00') umount2(&(0x7f0000000000)='./file0\x00', 0x1) chdir(&(0x7f0000000400)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') 841.829075ms ago: executing program 0 (id=1365): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, 0x0) unshare(0x6a040000) r0 = socket(0x8, 0x3, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), r0) 823.750097ms ago: executing program 2 (id=1366): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x50, 0x10, 0x40d, 0x70bd2a, 0x1, {0x0, 0x0, 0x0, 0x0, 0x470c0, 0x40}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x2}]}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'macvlan0\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x24060080}, 0x8000) 753.003208ms ago: executing program 5 (id=1367): ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000100)={@dev={0xfe, 0x80, '\x00', 0x23}, 0x8005d}) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x26b, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x9}, 0x1c) getsockopt$inet6_mptcp_buf(r0, 0x11c, 0x3, &(0x7f0000000100)=""/222, 0x0) 739.926091ms ago: executing program 4 (id=1368): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000c40)=ANY=[@ANYBLOB="580000001000010400000000000000000100ffff", @ANYBLOB="00000000da44000024001a8020000a8014000700fe8000000000000000020040000000000500080002000000140003007866726d30"], 0x58}}, 0x0) 710.875386ms ago: executing program 1 (id=1369): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x86, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x15}, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x64, 0x0, @wg=@response={0x2, 0x3, 0x1, "56805c734ee222c29de4125f81f6e030a5441a99f362cd24e0a1ac2291500733", "467f517bd818d5a4a8d26ae61b4cbf13", {"31ffc21d2e9bfb1eb3c03976ed837b6f", "876605ac29dcb96a8901e0711afb3db3"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x5, 0x0, 0x0, 0x60ff78ce1cb3c070}, 0x94) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) read(r0, &(0x7f0000000500)=""/167, 0xa7) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 599.555953ms ago: executing program 5 (id=1370): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x804, &(0x7f0000000080)={0x2, 0x4e22, @multicast1}, 0x10) syz_kvm_setup_cpu$x86(r2, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0xe, 0x0, 0x0) sendmsg$inet6(r2, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000080)="944cf7", 0x3}], 0x1}, 0x20000010) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 582.29709ms ago: executing program 2 (id=1371): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x82c03, 0x0) r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x4008054) write$nci(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="5001", @ANYRES8=r1, @ANYRES16], 0x14) 549.386554ms ago: executing program 4 (id=1372): mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_configfs\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./my_sysfs\x00', 0x1ff) mkdir(&(0x7f0000000600)='./my_dev\x00', 0x1ff) mount(0x0, &(0x7f0000000700)='./my_dev\x00', &(0x7f0000000800)='devtmpfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000900)='./my_configfs/dlm/cluster1\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000b00)='cluster1\x00', 0x9) mkdir(&(0x7f0000000d00)='./my_configfs/dlm/cluster1/comms/1\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000f00)='1\x00', 0x2) openat(0xffffffffffffff9c, &(0x7f0000001000)='./my_configfs/dlm/cluster1/comms/1/addr\x00', 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001400)='./my_configfs/dlm/cluster1/scan_secs\x00', 0x2, 0x0) write(r0, &(0x7f0000001500), 0x0) mkdir(&(0x7f0000001700)='./my_configfs/dlm/cluster1/spaces/ls1\x00', 0x1ff) mkdir(&(0x7f0000001900)='./my_configfs/dlm/cluster1/spaces/ls1/nodes/1\x00', 0x1ff) 433.490984ms ago: executing program 0 (id=1373): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@newlink={0x60, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x11d15}, [@IFLA_LINKINFO={0x40, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x30, 0x2, 0x0, 0x1, [@IFLA_VLAN_EGRESS_QOS={0x4}, @IFLA_VLAN_ID={0x6, 0x1, 0x2}, @IFLA_VLAN_INGRESS_QOS={0x4}, @IFLA_VLAN_INGRESS_QOS={0x1c, 0x4, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x8044, 0xffe}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x8, 0x9601}}]}]}}}]}, 0x60}, 0x1, 0x0, 0x0, 0x28001}, 0x8000) 243.846187ms ago: executing program 5 (id=1374): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f00000002c0), 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x2, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='Test Gadget\x00', 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/configs/c.1/strings/0x409/configuration\x00', 0x2, 0x0) write(r1, &(0x7f0000000500)='Conf 1\x00', 0x7) r2 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/configs/c.1\x00', 0x0, 0x0) symlinkat(0x0, r2, &(0x7f00000005c0)='midi.usb0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/configs/c.2\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/configs/c.2/strings/0x409\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.2/strings/0x409/configuration\x00', 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.2\x00', 0x0, 0x0) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi.usb0\x00', r3, &(0x7f0000000740)='midi.usb0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r4, &(0x7f00000007c0)='dummy_udc.0\x00', 0xb) r5 = openat(0xffffffffffffff9c, &(0x7f0000000840)='./sys/bus/usb/devices/2-1/bConfigurationValue\x00', 0x2, 0x0) write(r5, &(0x7f00000008c0)='2\x00', 0x2) write(r4, &(0x7f0000000920)='\n\x00', 0x1) 226.474659ms ago: executing program 4 (id=1375): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) chdir(0x0) 171.572183ms ago: executing program 0 (id=1376): openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./tracing/uprobe_events\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='p:s/_ ./file0:0', 0xf) 92.915883ms ago: executing program 4 (id=1377): ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205647, &(0x7f0000000100)={0xf030000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x9909c9, 0x10001, '\x00', @p_u16=0x0}}) r0 = syz_usb_connect(0x2, 0x3f, &(0x7f00000007c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000380)={0x1c, &(0x7f0000000280), 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) socket(0x10, 0x3, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000000)={@broadcast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x10, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x1, 0x0, 0x2}}}}}}, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0xc0105b08, &(0x7f0000000040)) 1.174107ms ago: executing program 0 (id=1378): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0xe, 0x0, 0x0) mount$overlay(0x0, 0x0, &(0x7f0000000080), 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 0s ago: executing program 2 (id=1379): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f00000002c0), 0xc804, &(0x7f0000000500)=ANY=[]) chdir(&(0x7f0000000240)='./file0\x00') umount2(&(0x7f0000000000)='./file0\x00', 0x1) chdir(&(0x7f0000000400)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') kernel console output (not intermixed with test programs): tered promiscuous mode [ 157.050249][ T6704] hsr_slave_1: entered promiscuous mode [ 157.090308][ T6704] debugfs: 'hsr0' already exists in 'hsr' [ 157.110877][ T6704] Cannot create hsr debugfs directory [ 157.632395][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 157.647675][ T10] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 157.661170][ T10] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 157.673027][ T10] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 157.722845][ T10] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 157.760859][ T10] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 157.804037][ T10] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 157.829619][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 157.851073][ T6847] netlink: 76 bytes leftover after parsing attributes in process `syz.4.274'. [ 157.862768][ T30] audit: type=1400 audit(2000000003.670:412): avc: denied { write } for pid=6846 comm="syz.4.274" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 157.978995][ T30] audit: type=1400 audit(2000000003.810:413): avc: denied { write } for pid=6833 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 158.359770][ T30] audit: type=1400 audit(2000000003.910:414): avc: denied { map } for pid=6844 comm="syz.1.273" path="socket:[14573]" dev="sockfs" ino=14573 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 158.402784][ T10] usb 3-1: usb_control_msg returned -32 [ 158.417440][ T10] usbtmc 3-1:16.0: can't read capabilities [ 158.639927][ T10] usb 1-1: USB disconnect, device number 5 [ 158.708204][ T6858] netlink: 8 bytes leftover after parsing attributes in process `syz.0.275'. [ 158.736834][ T30] audit: type=1400 audit(2000000004.560:415): avc: denied { write } for pid=6856 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 158.818657][ T6704] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 158.870261][ T6704] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 158.893395][ T5273] 8021q: adding VLAN 0 to HW filter on device eth4 [ 158.905223][ T6704] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 158.939507][ T6704] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 158.950600][ T6868] netlink: 20 bytes leftover after parsing attributes in process `syz.1.276'. [ 158.986228][ T6704] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 159.008424][ T6704] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 159.026132][ T6704] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 159.035267][ T30] audit: type=1400 audit(2000000004.870:416): avc: denied { setopt } for pid=6869 comm="syz.0.278" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 159.058331][ T6704] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 159.095757][ T30] audit: type=1326 audit(2000000004.930:417): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6864 comm="syz.1.276" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f3cecd9e019 code=0x0 [ 159.228274][ T6704] 8021q: adding VLAN 0 to HW filter on device bond0 [ 159.248722][ T6704] 8021q: adding VLAN 0 to HW filter on device team0 [ 159.261064][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 159.268264][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 159.296451][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 159.303644][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 159.402342][ T805] usb 1-1: new full-speed USB device number 6 using dummy_hcd [ 159.447111][ T30] audit: type=1400 audit(2000000005.280:418): avc: denied { write } for pid=6880 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 159.554824][ T805] usb 1-1: config 0 interface 0 has no altsetting 0 [ 159.568780][ T805] usb 1-1: New USB device found, idVendor=2006, idProduct=0118, bcdDevice= 0.00 [ 159.598460][ T805] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 159.620113][ T30] audit: type=1400 audit(2000000005.450:419): avc: denied { write } for pid=6903 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 159.624237][ T805] usb 1-1: config 0 descriptor?? [ 159.717424][ T5273] 8021q: adding VLAN 0 to HW filter on device eth3 [ 160.059325][ T6704] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 160.103044][ T805] hkems 0003:2006:0118.0003: unknown main item tag 0x6 [ 160.122779][ T805] hkems 0003:2006:0118.0003: ignoring exceeding usage max [ 160.147200][ T805] hkems 0003:2006:0118.0003: hidraw0: USB HID vcc.5e Device [HID 2006:0118] on usb-dummy_hcd.0-1/input0 [ 160.178205][ T805] hkems 0003:2006:0118.0003: no inputs found [ 160.240829][ T805] hkems 0003:2006:0118.0003: force feedback init failed [ 160.317210][ T6883] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 160.483577][ T6883] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 160.636603][ T10] usb 3-1: USB disconnect, device number 5 [ 160.667243][ T805] usb 1-1: USB disconnect, device number 6 [ 160.844287][ T6930] fido_id[6930]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 160.918820][ T6941] netlink: 8 bytes leftover after parsing attributes in process `syz.4.285'. [ 160.950258][ T30] audit: type=1400 audit(2000000006.780:420): avc: denied { write } for pid=6911 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 161.133618][ T10] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 161.146477][ T6704] veth0_vlan: entered promiscuous mode [ 161.182440][ T6704] veth1_vlan: entered promiscuous mode [ 161.256182][ T6704] veth0_macvtap: entered promiscuous mode [ 161.280284][ T6704] veth1_macvtap: entered promiscuous mode [ 161.295452][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 161.296038][ T5273] 8021q: adding VLAN 0 to HW filter on device eth2 [ 161.316837][ T10] usb 3-1: config index 0 descriptor too short (expected 74, got 45) [ 161.337511][ T6704] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 161.351733][ T10] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 161.365138][ T6704] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 161.373328][ T10] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 161.386956][ T10] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 3 [ 161.404374][ T6957] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 161.412386][ T48] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 161.424553][ T6036] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 161.447433][ T10] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 161.464985][ T6036] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 161.490750][ T10] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 161.501695][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 161.628032][ T6964] netlink: 'syz.1.288': attribute type 3 has an invalid length. [ 161.711243][ T6966] netlink: 'syz.1.288': attribute type 2 has an invalid length. [ 161.719171][ T6966] netlink: 'syz.1.288': attribute type 1 has an invalid length. [ 161.961529][ T6970] netlink: 'syz.0.290': attribute type 3 has an invalid length. [ 162.740372][ T6973] netlink: 'syz.0.290': attribute type 2 has an invalid length. [ 162.748985][ T6973] netlink: 'syz.0.290': attribute type 1 has an invalid length. [ 162.811149][ T6962] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 162.864627][ T188] Process accounting resumed [ 163.112689][ T48] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 163.130058][ T10] usb 3-1: GET_CAPABILITIES returned 0 [ 163.139093][ T10] usbtmc 3-1:16.0: can't read capabilities [ 163.241193][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 163.241695][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 163.249505][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 163.367781][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 163.535092][ C0] usbtmc 3-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 163.544635][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 163.544649][ T30] audit: type=1400 audit(2000000009.370:422): avc: denied { mounton } for pid=6704 comm="syz-executor" path="/root/syzkaller.k2lXJc/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=15148 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 163.580823][ T6935] usbtmc 3-1:16.0: Unable to send data, error -71 [ 163.745454][ T6983] syzkaller1: entered promiscuous mode [ 163.753607][ T6983] syzkaller1: entered allmulticast mode [ 163.762188][ T6981] lo speed is unknown, defaulting to 1000 [ 163.816268][ T6935] netlink: ct family unspecified [ 163.847698][ T6935] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 164.023843][ T805] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 164.106584][ T30] audit: type=1400 audit(2000000009.940:423): avc: denied { listen } for pid=7004 comm="syz.4.299" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 164.127045][ T5730] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 164.182332][ T805] usb 1-1: Using ep0 maxpacket: 8 [ 164.196409][ T805] usb 1-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 164.209104][ T7009] syzkaller1: entered promiscuous mode [ 164.213872][ T805] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 164.215161][ T7009] syzkaller1: entered allmulticast mode [ 164.224023][ T805] usb 1-1: Product: syz [ 164.234785][ T805] usb 1-1: Manufacturer: syz [ 164.252301][ T805] usb 1-1: SerialNumber: syz [ 164.259175][ T805] usb 1-1: config 0 descriptor?? [ 164.302307][ T5730] usb 2-1: Using ep0 maxpacket: 8 [ 164.317489][ T5730] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 164.328165][ T5730] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 164.338311][ T5730] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 164.348725][ T5730] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 164.359342][ T5730] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 164.372793][ T5730] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 164.384103][ T5730] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 164.471850][ T805] usb 1-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 164.560622][ T7017] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 164.709004][ T7021] netlink: 'syz.4.302': attribute type 3 has an invalid length. [ 164.731466][ T7021] netlink: 'syz.4.302': attribute type 2 has an invalid length. [ 164.739293][ T7021] netlink: 'syz.4.302': attribute type 1 has an invalid length. [ 164.925637][ T5730] usb 2-1: usb_control_msg returned -32 [ 165.454536][ T5730] usbtmc 2-1:16.0: can't read capabilities [ 165.497231][ T805] usb write operation failed. (-71) [ 165.533751][ T805] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 165.574495][ T805] dvbdev: DVB: registering new adapter (Terratec H7) [ 165.607790][ T805] usb 1-1: media controller created [ 165.632520][ T805] usb read operation failed. (-71) [ 165.649126][ T805] usb write operation failed. (-71) [ 165.684081][ T805] dvb_usb_az6007 1-1:0.0: probe with driver dvb_usb_az6007 failed with error -5 [ 165.735263][ T805] usb 1-1: USB disconnect, device number 7 [ 165.858551][ T7036] netlink: 44 bytes leftover after parsing attributes in process `syz.5.307'. [ 165.868455][ T7036] netlink: 24 bytes leftover after parsing attributes in process `syz.5.307'. [ 165.954445][ T5730] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 165.990149][ T30] audit: type=1400 audit(2000000011.820:424): avc: denied { mounton } for pid=7037 comm="syz.5.308" path="/syzcgroup/unified/syz5" dev="cgroup2" ino=259 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 166.050870][ T7039] siw: device registration error -23 [ 166.134214][ T5730] usb 5-1: Using ep0 maxpacket: 8 [ 166.171638][ T5730] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 166.206103][ T5730] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 166.259777][ T5730] usb 5-1: config 0 interface 0 has no altsetting 0 [ 166.297968][ T5730] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 166.378487][ T5730] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 166.542795][ T5730] usb 5-1: config 0 descriptor?? [ 166.865160][ T7043] netlink: 8 bytes leftover after parsing attributes in process `syz.5.310'. [ 167.268283][ T7033] tunl0: entered promiscuous mode [ 167.276286][ T7033] netlink: 'syz.4.306': attribute type 4 has an invalid length. [ 167.284002][ T7033] netlink: 9 bytes leftover after parsing attributes in process `syz.4.306'. [ 168.160020][ T7033] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (148514 ns). Using initial count to start timer. [ 168.398749][ T7033] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 168.424770][ T7033] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 168.488264][ T7060] CIFS: bad ip= option (127®0.0.1) [ 168.500347][ T5730] usbhid 5-1:0.0: can't add hid device: -71 [ 168.507215][ T5730] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 168.518029][ T5730] usb 5-1: USB disconnect, device number 6 [ 168.613950][ T7062] CIFS: Attempting to mount (null) [ 168.620788][ T7062] CIFS: VFS: Error connecting to socket. Aborting operation. [ 168.636847][ T7062] CIFS: VFS: cifs_mount failed w/return code = -111 [ 169.162983][ T5730] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 169.303378][ T7080] siw: device registration error -23 [ 169.372448][ T5730] usb 6-1: Using ep0 maxpacket: 8 [ 169.419671][ T5730] usb 6-1: config 0 has an invalid interface number: 31 but max is 0 [ 169.498818][ T5730] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 169.603742][ T5730] usb 6-1: config 0 has no interface number 0 [ 169.678828][ T5730] usb 6-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 169.731374][ T5730] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 169.748651][ T7083] CIFS: bad ip= option (127®0.0.1) [ 169.770303][ T5730] usb 6-1: Product: syz [ 169.799681][ T5730] usb 6-1: Manufacturer: syz [ 169.829272][ T5730] usb 6-1: SerialNumber: syz [ 169.939308][ T5730] usb 6-1: config 0 descriptor?? [ 170.040313][ T5730] uvcvideo 6-1:0.31: probe with driver uvcvideo failed with error -22 [ 170.071738][ T7083] CIFS: Attempting to mount (null) [ 170.079498][ T7083] CIFS: VFS: Error connecting to socket. Aborting operation. [ 170.097858][ T7083] CIFS: VFS: cifs_mount failed w/return code = -111 [ 170.214112][ T7093] netlink: 8 bytes leftover after parsing attributes in process `syz.4.322'. [ 170.295323][ T7023] usbtmc 3-1:16.0: usb_control_msg returned -110 [ 170.328042][ T5730] usb 3-1: USB disconnect, device number 6 [ 170.405200][ T805] usb 2-1: USB disconnect, device number 6 [ 171.117348][ T30] audit: type=1400 audit(2000000016.820:425): avc: denied { write } for pid=7081 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 171.201395][ T30] audit: type=1400 audit(2000000017.020:426): avc: denied { write } for pid=7115 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 171.628169][ T7120] netlink: 12 bytes leftover after parsing attributes in process `syz.0.326'. [ 171.696833][ T29] usb 6-1: USB disconnect, device number 2 [ 171.727843][ T7122] netlink: 20 bytes leftover after parsing attributes in process `syz.0.327'. [ 171.732327][ T5344] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 172.502369][ T5344] usb 2-1: Using ep0 maxpacket: 16 [ 172.731263][ T5344] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 172.742559][ T5344] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 18176, setting to 1024 [ 172.755481][ T5344] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 172.768497][ T5344] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 172.777918][ T5344] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 172.815026][ T5344] usb 2-1: config 0 descriptor?? [ 172.823376][ T7110] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 172.982420][ T5730] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 173.132337][ T5730] usb 5-1: Using ep0 maxpacket: 16 [ 173.140456][ T5730] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 173.153813][ T5730] usb 5-1: config 0 interface 0 has no altsetting 0 [ 173.163667][ T5730] usb 5-1: New USB device found, idVendor=15c2, idProduct=0041, bcdDevice=1f.20 [ 173.174656][ T5730] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 173.184777][ T5730] usb 5-1: Product: syz [ 173.188983][ T5730] usb 5-1: Manufacturer: syz [ 173.195659][ T5730] usb 5-1: SerialNumber: syz [ 173.210801][ T5730] usb 5-1: config 0 descriptor?? [ 173.224690][ T7153] netlink: 148 bytes leftover after parsing attributes in process `syz.0.336'. [ 173.254392][ T5344] input: HID 045e:07da as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:045E:07DA.0004/input/input7 [ 173.283077][ T10] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 173.296101][ T7153] netlink: 148 bytes leftover after parsing attributes in process `syz.0.336'. [ 173.332454][ T5817] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 173.425123][ T5344] microsoft 0003:045E:07DA.0004: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.1-1/input0 [ 173.442307][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 174.013710][ T7157] netlink: 108 bytes leftover after parsing attributes in process `syz.1.324'. [ 174.280743][ T7110] bond1: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 174.360546][ T7110] bond1 (unregistering): Released all slaves [ 174.497488][ T805] usb 2-1: reset high-speed USB device number 7 using dummy_hcd [ 174.569623][ T10] usb 3-1: config index 0 descriptor too short (expected 74, got 45) [ 174.984168][ T5730] input: iMON Panel, Knob and Mouse(15c2:0041) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input8 [ 174.996151][ T10] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 175.017808][ T10] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 175.031807][ T10] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 3 [ 175.044986][ T10] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 175.060474][ T10] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 175.069670][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 175.114084][ T30] audit: type=1400 audit(2000000020.940:427): avc: denied { read } for pid=4963 comm="acpid" name="mouse2" dev="devtmpfs" ino=2896 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 175.138364][ T5817] usb 6-1: Using ep0 maxpacket: 8 [ 175.143631][ T30] audit: type=1400 audit(2000000020.940:428): avc: denied { open } for pid=4963 comm="acpid" path="/dev/input/mouse2" dev="devtmpfs" ino=2896 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 175.167671][ T30] audit: type=1400 audit(2000000020.950:429): avc: denied { ioctl } for pid=4963 comm="acpid" path="/dev/input/mouse2" dev="devtmpfs" ino=2896 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 175.193523][ T30] audit: type=1400 audit(2000000021.000:430): avc: denied { listen } for pid=7132 comm="syz.4.328" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 175.213605][ T30] audit: type=1400 audit(2000000021.000:431): avc: denied { accept } for pid=7132 comm="syz.4.328" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 175.233381][ T5730] rc_core: IR keymap rc-imon-pad not found [ 175.241429][ T5730] Registered IR keymap rc-empty [ 175.246518][ T5817] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 175.255050][ T5817] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 175.265010][ T5730] imon 5-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 175.275778][ T5817] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 175.285952][ T5730] imon 5-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 175.295895][ T5817] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 175.308304][ T5817] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 175.308494][ T10] usb 3-1: GET_CAPABILITIES returned 0 [ 175.329973][ T5730] rc rc0: iMON Remote (15c2:0041) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 175.340081][ T5817] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 175.353732][ T5817] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 175.362920][ T5730] input: iMON Remote (15c2:0041) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input9 [ 175.377560][ T10] usbtmc 3-1:16.0: can't read capabilities [ 175.399239][ T5730] imon 5-1:0.0: iMON device (15c2:0041, intf0) on usb<5:7> initialized [ 175.523511][ C0] usbtmc 3-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 175.535562][ T7147] usbtmc 3-1:16.0: Unable to send data, error -71 [ 175.595915][ T5817] usb 6-1: usb_control_msg returned -32 [ 175.617965][ T5817] usbtmc 6-1:16.0: can't read capabilities [ 175.629091][ T30] audit: type=1400 audit(2000000021.460:432): avc: denied { shutdown } for pid=7165 comm="syz.0.337" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 175.631312][ T7166] 9p: Bad value for 'wfdno' [ 175.690725][ T7147] lo speed is unknown, defaulting to 1000 [ 175.696642][ T30] audit: type=1400 audit(2000000021.460:433): avc: denied { read } for pid=7165 comm="syz.0.337" dev="sockfs" ino=16345 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 175.880272][ T5344] usb 2-1: USB disconnect, device number 7 [ 175.910794][ T7168] netlink: ct family unspecified [ 175.916428][ T7168] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 177.235271][ C0] imon 5-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 177.235629][ T29] usb 5-1: USB disconnect, device number 7 [ 177.521093][ T30] audit: type=1400 audit(2000000023.350:434): avc: denied { create } for pid=7201 comm="syz.4.342" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 177.616494][ T30] audit: type=1400 audit(2000000023.380:435): avc: denied { setopt } for pid=7201 comm="syz.4.342" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 177.644660][ T30] audit: type=1400 audit(2000000023.410:436): avc: denied { mounton } for pid=7201 comm="syz.4.342" path="cgroup:[4026532804]" dev="nsfs" ino=4026532804 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 177.741317][ T30] audit: type=1400 audit(2000000023.570:437): avc: denied { write } for pid=7167 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 178.658179][ T7221] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 179.195288][ T30] audit: type=1400 audit(2000000024.930:438): avc: denied { write } for pid=7224 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 179.579493][ T30] audit: type=1400 audit(2000000025.410:439): avc: denied { mount } for pid=7234 comm="syz.0.347" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 179.611158][ T7235] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 179.668419][ T30] audit: type=1400 audit(2000000025.440:440): avc: denied { mounton } for pid=7234 comm="syz.0.347" path="/82/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 179.777516][ T7246] CIFS: bad ip= option (127®0.0.1) [ 179.790511][ T30] audit: type=1400 audit(2000000025.500:441): avc: denied { write } for pid=7228 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 179.830088][ T30] audit: type=1400 audit(2000000025.550:442): avc: denied { write } for pid=7241 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 179.886815][ T7235] bridge0: port 2(bridge_slave_1) entered disabled state [ 179.895512][ T7235] bridge0: port 1(bridge_slave_0) entered disabled state [ 179.930101][ T7256] CIFS: Attempting to mount (null) [ 179.951117][ T7256] CIFS: VFS: Error connecting to socket. Aborting operation. [ 179.976084][ T7256] CIFS: VFS: cifs_mount failed w/return code = -111 [ 180.116081][ T7235] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 180.138409][ T7235] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 180.236130][ T7267] netlink: 8 bytes leftover after parsing attributes in process `syz.1.351'. [ 180.249636][ T30] audit: type=1400 audit(2000000026.080:443): avc: denied { create } for pid=7266 comm="syz.1.351" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 180.422484][ T1110] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 180.482592][ T1110] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 180.510549][ T1110] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 180.543527][ T1110] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 181.326973][ T7181] usbtmc 3-1:16.0: usb_control_msg returned -110 [ 181.418247][ T5716] usb 3-1: USB disconnect, device number 7 [ 181.537463][ T7261] usb 6-1: USB disconnect, device number 3 [ 181.622307][ T188] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 181.755063][ T7311] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 181.893877][ T188] usb 5-1: unable to get BOS descriptor or descriptor too short [ 182.717071][ T188] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 32 [ 182.730403][ T188] usb 5-1: New USB device found, idVendor=09e8, idProduct=0062, bcdDevice= 0.40 [ 182.739578][ T188] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 182.747991][ T188] usb 5-1: Product: syz [ 182.761106][ T188] usb 5-1: Manufacturer: syz [ 182.767270][ T188] usb 5-1: SerialNumber: syz [ 182.783546][ T7310] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 183.048114][ T188] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 183.085104][ T7325] xt_TPROXY: Can be used only with -p tcp or -p udp [ 183.095339][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 183.095352][ T30] audit: type=1400 audit(2000000028.930:452): avc: denied { setopt } for pid=7323 comm="syz.2.363" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 183.276219][ T188] usb 5-1: USB disconnect, device number 8 [ 183.540681][ T5599] udevd[5599]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 184.897684][ T7361] netlink: 8 bytes leftover after parsing attributes in process `syz.4.374'. [ 185.035745][ T7368] netlink: 144 bytes leftover after parsing attributes in process `syz.5.377'. [ 186.430454][ T7376] netlink: 20 bytes leftover after parsing attributes in process `syz.5.379'. [ 186.471714][ T7376] team0 (unregistering): Port device team_slave_0 removed [ 186.595808][ T7376] team0 (unregistering): Port device team_slave_1 removed [ 188.119126][ T7400] netlink: 8 bytes leftover after parsing attributes in process `syz.4.386'. [ 190.242525][ T7429] netlink: 220 bytes leftover after parsing attributes in process `syz.1.393'. [ 190.266284][ T7431] netlink: 8 bytes leftover after parsing attributes in process `syz.0.394'. [ 190.691131][ T7449] netlink: 8 bytes leftover after parsing attributes in process `syz.1.399'. [ 190.748463][ T30] audit: type=1400 audit(2000000036.580:453): avc: denied { bind } for pid=7446 comm="syz.0.398" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 190.798353][ T7454] netlink: 28 bytes leftover after parsing attributes in process `syz.2.401'. [ 190.834033][ T5623] Bluetooth: hci4: command 0x0406 tx timeout [ 190.834469][ T5620] Bluetooth: hci3: command 0x0406 tx timeout [ 190.841444][ T5623] Bluetooth: hci2: command 0x0406 tx timeout [ 190.846350][ T5620] Bluetooth: hci0: command 0x0406 tx timeout [ 190.864057][ T30] audit: type=1400 audit(2000000036.600:454): avc: denied { listen } for pid=7446 comm="syz.0.398" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 190.994756][ T30] audit: type=1400 audit(2000000036.610:455): avc: denied { accept } for pid=7446 comm="syz.0.398" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 191.166715][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 192.718962][ T7470] netlink: 12 bytes leftover after parsing attributes in process `syz.2.405'. [ 193.155184][ T7486] netlink: 148 bytes leftover after parsing attributes in process `syz.0.411'. [ 193.889985][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.896426][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 193.961194][ T7496] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 194.419695][ T7500] netlink: 'syz.4.412': attribute type 3 has an invalid length. [ 194.505858][ T7501] netlink: 'syz.4.412': attribute type 2 has an invalid length. [ 194.513707][ T7501] netlink: 'syz.4.412': attribute type 1 has an invalid length. [ 194.546371][ T7486] netlink: 148 bytes leftover after parsing attributes in process `syz.0.411'. [ 197.908068][ T7515] netlink: 12 bytes leftover after parsing attributes in process `syz.2.416'. [ 198.574135][ T7536] netlink: 12 bytes leftover after parsing attributes in process `syz.2.425'. [ 199.619834][ T30] audit: type=1400 audit(2000000045.090:456): avc: denied { read write } for pid=7550 comm="syz.2.430" name="file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 199.730591][ T30] audit: type=1400 audit(2000000045.090:457): avc: denied { open } for pid=7550 comm="syz.2.430" path="/74/file0/file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 199.900103][ T30] audit: type=1400 audit(2000000045.550:458): avc: denied { getopt } for pid=7557 comm="syz.0.431" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 199.946829][ T7566] netlink: 8 bytes leftover after parsing attributes in process `syz.5.435'. [ 199.970861][ T30] audit: type=1400 audit(2000000045.560:459): avc: denied { write } for pid=7557 comm="syz.0.431" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 200.134321][ T30] audit: type=1400 audit(2000000045.970:460): avc: denied { associate } for pid=7574 comm="syz.1.439" name="syz1" dev="tmpfs" ino=2 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:systemd_logind_exec_t:s0" [ 200.152101][ T7581] netlink: 12 bytes leftover after parsing attributes in process `syz.4.440'. [ 200.336169][ T30] audit: type=1400 audit(2000000046.160:461): avc: denied { module_request } for pid=7586 comm="syz.2.443" kmod="netdev-wpan3" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 200.444177][ T30] audit: type=1400 audit(2000000046.280:462): avc: denied { getopt } for pid=7586 comm="syz.2.443" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 200.545353][ T24] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 200.660005][ T7607] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 200.671738][ T7609] netlink: 220 bytes leftover after parsing attributes in process `syz.2.449'. [ 200.712279][ T24] usb 6-1: Using ep0 maxpacket: 8 [ 200.727457][ T24] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 200.740574][ T24] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 200.762297][ T24] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 200.792296][ T24] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 200.810244][ T24] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 200.859913][ T24] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 200.877536][ T24] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 200.919574][ T7618] sg_write: data in/out 186/126 bytes for SCSI command 0x0-- guessing data in; [ 200.919574][ T7618] program syz.1.453 not setting count and/or reply_len properly [ 201.135847][ T24] usb 6-1: usb_control_msg returned -32 [ 201.164068][ T24] usbtmc 6-1:16.0: can't read capabilities [ 201.336870][ T30] audit: type=1400 audit(2000000047.170:463): avc: denied { read } for pid=7630 comm="syz.0.457" path="socket:[19921]" dev="sockfs" ino=19921 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 202.171685][ T7642] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 203.686641][ T188] Process accounting resumed [ 203.726953][ T7646] netlink: 'syz.2.460': attribute type 2 has an invalid length. [ 203.734805][ T7646] netlink: 'syz.2.460': attribute type 1 has an invalid length. [ 203.927012][ T7270] usb 6-1: USB disconnect, device number 4 [ 204.474067][ T7660] siw: device registration error -23 [ 207.486159][ T7673] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 208.701788][ T30] audit: type=1400 audit(2000000054.530:464): avc: denied { read write } for pid=7695 comm="syz.2.475" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 208.725639][ T30] audit: type=1400 audit(2000000054.530:465): avc: denied { open } for pid=7695 comm="syz.2.475" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 208.784498][ T7698] tmpfs: Bad value for 'grpquota_block_hardlimit' [ 208.998061][ T30] audit: type=1400 audit(2000000054.760:466): avc: denied { connect } for pid=7695 comm="syz.2.475" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 210.176537][ T7720] netlink: 'syz.0.480': attribute type 3 has an invalid length. [ 210.198642][ T7711] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 210.250599][ T7270] Process accounting resumed [ 210.262536][ T7711] netlink: 'syz.0.480': attribute type 2 has an invalid length. [ 210.270264][ T7711] netlink: 'syz.0.480': attribute type 1 has an invalid length. [ 210.663538][ T7712] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 214.290071][ T7742] netlink: 8 bytes leftover after parsing attributes in process `syz.5.485'. [ 214.440806][ T7745] netlink: 220 bytes leftover after parsing attributes in process `syz.0.486'. [ 214.464645][ T7722] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 215.167575][ T7756] netlink: 36 bytes leftover after parsing attributes in process `syz.0.489'. [ 215.446633][ T7765] No such timeout policy "syz1" [ 215.457214][ T7765] netlink: 256 bytes leftover after parsing attributes in process `syz.4.493'. [ 215.498471][ T7765] kvm: kvm [7764]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0x4000006f) = 0x1000000400004 [ 218.286325][ T7779] netlink: 36 bytes leftover after parsing attributes in process `syz.1.497'. [ 218.338698][ T7781] geneve2: entered promiscuous mode [ 218.439787][ T7776] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 220.096599][ T30] audit: type=1400 audit(2000000065.930:467): avc: denied { getopt } for pid=7789 comm="syz.5.500" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 220.117861][ T30] audit: type=1400 audit(2000000065.950:468): avc: denied { mount } for pid=7789 comm="syz.5.500" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 220.172327][ T30] audit: type=1400 audit(2000000065.990:469): avc: denied { search } for pid=7789 comm="syz.5.500" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 220.202509][ T30] audit: type=1400 audit(2000000065.990:470): avc: denied { search } for pid=7789 comm="syz.5.500" name="events" dev="tracefs" ino=1079 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 220.228324][ T30] audit: type=1400 audit(2000000066.000:471): avc: denied { search } for pid=7789 comm="syz.5.500" name="task" dev="tracefs" ino=20245 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 220.285150][ T30] audit: type=1400 audit(2000000066.000:472): avc: denied { search } for pid=7789 comm="syz.5.500" name="task_rename" dev="tracefs" ino=20247 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 220.325019][ T7794] netlink: 12 bytes leftover after parsing attributes in process `syz.2.504'. [ 220.345456][ T7799] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 220.351375][ T30] audit: type=1400 audit(2000000066.000:473): avc: denied { write } for pid=7789 comm="syz.5.500" name="filter" dev="tracefs" ino=19680823 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 220.351421][ T30] audit: type=1400 audit(2000000066.000:474): avc: denied { open } for pid=7789 comm="syz.5.500" path="/42/my_tracefs/events/task/task_rename/filter" dev="tracefs" ino=19680823 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 220.351462][ T30] audit: type=1400 audit(2000000066.080:475): avc: denied { unmount } for pid=6704 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 220.504186][ T7807] netlink: 'syz.0.503': attribute type 3 has an invalid length. [ 221.295833][ T30] audit: type=1400 audit(2000000067.120:476): avc: denied { listen } for pid=7815 comm="syz.5.508" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 221.388098][ T7819] process 'syz.5.508' launched './file2' with NULL argv: empty string added [ 221.509636][ T7824] netlink: 32 bytes leftover after parsing attributes in process `syz.1.509'. [ 221.762311][ T24] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 222.648830][ T7830] syz.4.511 uses obsolete (PF_INET,SOCK_PACKET) [ 222.767251][ T7839] lo speed is unknown, defaulting to 1000 [ 222.784759][ T24] usb 1-1: Using ep0 maxpacket: 8 [ 222.796605][ T24] usb 1-1: config index 0 descriptor too short (expected 74, got 45) [ 222.806450][ T24] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 222.817780][ T24] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 222.828075][ T24] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 3 [ 222.838167][ T24] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 222.851360][ T24] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 222.861195][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 222.869368][ T5716] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 222.998914][ T7848] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 223.043106][ T5716] usb 3-1: Using ep0 maxpacket: 8 [ 223.074376][ T5716] usb 3-1: config index 0 descriptor too short (expected 74, got 45) [ 223.172450][ T7851] netlink: 'syz.4.516': attribute type 3 has an invalid length. [ 223.192145][ T5716] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 223.258451][ T7853] netlink: 'syz.4.516': attribute type 2 has an invalid length. [ 223.266776][ T7853] netlink: 'syz.4.516': attribute type 1 has an invalid length. [ 223.280629][ T24] usb 1-1: GET_CAPABILITIES returned 0 [ 223.324577][ T5716] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 223.342865][ T24] usbtmc 1-1:16.0: can't read capabilities [ 223.424762][ T5716] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 3 [ 223.565382][ T5716] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 223.672167][ T5716] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 223.798805][ T5716] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 224.054683][ T7857] netlink: ct family unspecified [ 224.063999][ T7857] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 224.147164][ T7862] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 224.292303][ T7262] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 224.310916][ T5716] usb 3-1: GET_CAPABILITIES returned 0 [ 224.316741][ T5716] usbtmc 3-1:16.0: can't read capabilities [ 224.338303][ T7864] netlink: 'syz.5.520': attribute type 3 has an invalid length. [ 224.432500][ T7262] usb 2-1: device descriptor read/64, error -71 [ 224.520824][ C0] usbtmc 1-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 224.538084][ T7834] usbtmc 1-1:16.0: Unable to send data, error -71 [ 224.606437][ T7866] FAULT_INJECTION: forcing a failure. [ 224.606437][ T7866] name failslab, interval 1, probability 0, space 0, times 0 [ 224.636255][ T7866] CPU: 0 UID: 0 PID: 7866 Comm: syz.4.521 Tainted: G L syzkaller #0 PREEMPT(full) [ 224.636286][ T7866] Tainted: [L]=SOFTLOCKUP [ 224.636293][ T7866] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 224.636303][ T7866] Call Trace: [ 224.636309][ T7866] [ 224.636316][ T7866] dump_stack_lvl+0x100/0x190 [ 224.636344][ T7866] should_fail_ex.cold+0x5/0xa [ 224.636368][ T7866] should_failslab+0xc2/0x120 [ 224.636393][ T7866] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 224.636417][ T7866] ? __alloc_skb+0x140/0x710 [ 224.636446][ T7866] __alloc_skb+0x140/0x710 [ 224.636464][ T7866] ? __alloc_skb+0x5b7/0x710 [ 224.636483][ T7866] ? __pfx___alloc_skb+0x10/0x10 [ 224.636503][ T7866] ? finish_task_switch.isra.0+0x2c5/0x10c0 [ 224.636531][ T7866] ? finish_task_switch.isra.0+0x3b6/0x10c0 [ 224.636558][ T7866] alloc_skb_with_frags+0xdd/0x760 [ 224.636581][ T7866] ? trace_sched_exit_tp+0x120/0x160 [ 224.636609][ T7866] ? __schedule+0x126e/0x6730 [ 224.636632][ T7866] sock_alloc_send_pskb+0x801/0x980 [ 224.636660][ T7866] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 224.636678][ T7866] ? __pfx___schedule+0x10/0x10 [ 224.636697][ T7866] ? preempt_schedule_irq+0x7b/0x90 [ 224.636718][ T7866] ? irqentry_exit+0x24d/0xa00 [ 224.636743][ T7866] hci_sock_sendmsg+0x1c7/0x2620 [ 224.636768][ T7866] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 224.636791][ T7866] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 224.636810][ T7866] ? sock_write_iter+0x298/0x5b0 [ 224.636839][ T7866] sock_write_iter+0x53a/0x5b0 [ 224.636864][ T7866] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 224.636885][ T7866] ? __pfx_sock_write_iter+0x10/0x10 [ 224.636918][ T7866] ? bpf_lsm_file_permission+0x9/0x10 [ 224.636945][ T7866] ? security_file_permission+0x76/0x210 [ 224.636964][ T7866] ? rw_verify_area+0xce/0x6d0 [ 224.636991][ T7866] vfs_write+0x6ac/0x1050 [ 224.637019][ T7866] ? __pfx_sock_write_iter+0x10/0x10 [ 224.637047][ T7866] ? __pfx_vfs_write+0x10/0x10 [ 224.637072][ T7866] ? find_held_lock+0x2b/0x80 [ 224.637103][ T7866] ksys_write+0x1f8/0x250 [ 224.637131][ T7866] ? __pfx_ksys_write+0x10/0x10 [ 224.637164][ T7866] do_syscall_64+0x115/0x870 [ 224.637189][ T7866] ? clear_bhb_loop+0x40/0x90 [ 224.637210][ T7866] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 224.637229][ T7866] RIP: 0033:0x7f4a2b79e019 [ 224.637245][ T7866] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 224.637261][ T7866] RSP: 002b:00007f4a2c604028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 224.637278][ T7866] RAX: ffffffffffffffda RBX: 00007f4a2ba25fa0 RCX: 00007f4a2b79e019 [ 224.637290][ T7866] RDX: 0000000000000007 RSI: 0000200000000040 RDI: 0000000000000006 [ 224.637300][ T7866] RBP: 00007f4a2c604090 R08: 0000000000000000 R09: 0000000000000000 [ 224.637310][ T7866] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 224.637321][ T7866] R13: 00007f4a2ba26038 R14: 00007f4a2ba25fa0 R15: 00007ffc70abbee8 [ 224.637344][ T7866] [ 225.024752][ T7869] netlink: ct family unspecified [ 225.029749][ T7869] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 225.070655][ T7826] lo speed is unknown, defaulting to 1000 [ 225.154309][ T30] kauditd_printk_skb: 11 callbacks suppressed [ 225.154324][ T30] audit: type=1400 audit(2000000070.990:488): avc: denied { ioctl } for pid=7874 comm="syz.4.523" path="/dev/binderfs/binder1" dev="binder" ino=17 ioctlcmd=0x6205 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 225.154377][ T7875] binder: 7874:7875 ioctl 40046205 0 returned -22 [ 225.209139][ T7834] lo speed is unknown, defaulting to 1000 [ 225.252348][ T7262] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 225.290199][ T7879] netlink: 20 bytes leftover after parsing attributes in process `syz.5.524'. [ 225.562312][ T7262] usb 2-1: device descriptor read/64, error -71 [ 226.252589][ T7262] usb usb2-port1: attempt power cycle [ 226.338021][ T7888] netlink: 8 bytes leftover after parsing attributes in process `syz.4.527'. [ 226.339400][ T5709] usb 3-1: USB disconnect, device number 8 [ 226.444056][ T24] usb 1-1: USB disconnect, device number 8 [ 226.522202][ T7894] FAULT_INJECTION: forcing a failure. [ 226.522202][ T7894] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 226.547342][ T7894] CPU: 1 UID: 0 PID: 7894 Comm: syz.4.529 Tainted: G L syzkaller #0 PREEMPT(full) [ 226.547372][ T7894] Tainted: [L]=SOFTLOCKUP [ 226.547378][ T7894] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 226.547388][ T7894] Call Trace: [ 226.547393][ T7894] [ 226.547400][ T7894] dump_stack_lvl+0x100/0x190 [ 226.547427][ T7894] should_fail_ex.cold+0x5/0xa [ 226.547450][ T7894] _copy_from_user+0x2e/0xd0 [ 226.547479][ T7894] sock_copy_user_timeval+0x3f0/0x490 [ 226.547502][ T7894] ? __pfx_sock_copy_user_timeval+0x10/0x10 [ 226.547526][ T7894] ? __local_bh_enable_ip+0x9e/0x120 [ 226.547552][ T7894] vsock_connectible_setsockopt+0x4ee/0x890 [ 226.547602][ T7894] ? __pfx_vsock_connectible_setsockopt+0x10/0x10 [ 226.547622][ T7894] ? find_held_lock+0x2b/0x80 [ 226.547638][ T7894] ? __fget_files+0x215/0x3d0 [ 226.547658][ T7894] ? selinux_socket_setsockopt+0x6a/0x80 [ 226.547684][ T7894] ? __pfx_vsock_connectible_setsockopt+0x10/0x10 [ 226.547707][ T7894] do_sock_setsockopt+0xf3/0x1d0 [ 226.547735][ T7894] __sys_setsockopt+0x195/0x220 [ 226.547760][ T7894] __x64_sys_setsockopt+0xbd/0x160 [ 226.547779][ T7894] ? do_syscall_64+0x90/0x870 [ 226.547797][ T7894] ? lockdep_hardirqs_on+0x78/0x100 [ 226.547816][ T7894] do_syscall_64+0x115/0x870 [ 226.547835][ T7894] ? clear_bhb_loop+0x40/0x90 [ 226.547857][ T7894] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 226.547874][ T7894] RIP: 0033:0x7f4a2b79e019 [ 226.547889][ T7894] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 226.547905][ T7894] RSP: 002b:00007f4a2c604028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 226.547923][ T7894] RAX: ffffffffffffffda RBX: 00007f4a2ba25fa0 RCX: 00007f4a2b79e019 [ 226.547934][ T7894] RDX: 0000000000000006 RSI: 0000000000000028 RDI: 0000000000000003 [ 226.547944][ T7894] RBP: 00007f4a2c604090 R08: 0000000000000010 R09: 0000000000000000 [ 226.547954][ T7894] R10: 00002000000002c0 R11: 0000000000000246 R12: 0000000000000001 [ 226.547964][ T7894] R13: 00007f4a2ba26038 R14: 00007f4a2ba25fa0 R15: 00007ffc70abbee8 [ 226.547988][ T7894] [ 226.766933][ T7262] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 226.806108][ T7262] usb 2-1: device descriptor read/8, error -71 [ 226.887860][ T7897] syzkaller1: entered promiscuous mode [ 226.893301][ T7904] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 226.897266][ T7897] syzkaller1: entered allmulticast mode [ 226.909303][ T7903] vivid-000: disconnect [ 227.073286][ T5709] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 227.120220][ T7909] netlink: 'syz.4.532': attribute type 3 has an invalid length. [ 227.263546][ T5709] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 227.263579][ T5709] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 227.263599][ T5709] usb 3-1: Product: syz [ 227.263614][ T5709] usb 3-1: Manufacturer: syz [ 227.263629][ T5709] usb 3-1: SerialNumber: syz [ 227.751570][ T7270] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 227.771456][ T7899] vivid-000: reconnect [ 228.326284][ T7262] usb 3-1: USB disconnect, device number 9 [ 229.323081][ T7270] usb 3-1: Service connection timeout for: 256 [ 229.330773][ T7270] ath9k_htc 3-1:1.0: ath9k_htc: Unable to initialize HTC services [ 229.392170][ T7270] ath9k_htc: Failed to initialize the device [ 229.798489][ T7942] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 229.906292][ T7262] usb 3-1: ath9k_htc: USB layer deinitialized [ 230.037912][ T7946] netlink: 'syz.5.542': attribute type 3 has an invalid length. [ 230.136844][ T24] Process accounting resumed [ 230.177507][ T7947] netlink: 'syz.5.542': attribute type 2 has an invalid length. [ 230.185352][ T7947] netlink: 'syz.5.542': attribute type 1 has an invalid length. [ 230.433542][ T7948] netlink: 20 bytes leftover after parsing attributes in process `syz.4.543'. [ 230.677520][ T7951] netlink: 8 bytes leftover after parsing attributes in process `syz.1.545'. [ 231.417449][ T7948] team0 (unregistering): Port device team_slave_0 removed [ 231.450143][ T7959] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 231.464980][ T7948] team0 (unregistering): Port device team_slave_1 removed [ 231.638097][ T7966] netlink: 'syz.2.546': attribute type 3 has an invalid length. [ 232.389414][ T7977] netlink: 148 bytes leftover after parsing attributes in process `syz.4.551'. [ 232.449578][ T30] audit: type=1400 audit(2000000078.280:489): avc: denied { create } for pid=7976 comm="syz.4.551" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_dnrt_socket permissive=1 [ 232.536788][ T7977] netlink: 148 bytes leftover after parsing attributes in process `syz.4.551'. [ 232.788275][ T30] audit: type=1400 audit(2000000078.550:490): avc: denied { name_bind } for pid=7976 comm="syz.4.551" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 233.260013][ T7993] netlink: 148 bytes leftover after parsing attributes in process `syz.1.555'. [ 233.301127][ T7987] lo speed is unknown, defaulting to 1000 [ 233.723560][ T7993] netlink: 148 bytes leftover after parsing attributes in process `syz.1.555'. [ 235.080418][ T8004] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 235.103048][ T8004] netlink: 'syz.2.558': attribute type 3 has an invalid length. [ 235.170107][ T24] Process accounting resumed [ 235.249420][ T8010] netlink: 'syz.2.558': attribute type 2 has an invalid length. [ 235.258438][ T8010] netlink: 'syz.2.558': attribute type 1 has an invalid length. [ 235.816837][ T8014] lo speed is unknown, defaulting to 1000 [ 237.084923][ T8024] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 237.691028][ T8050] netlink: 24 bytes leftover after parsing attributes in process `syz.2.566'. [ 237.880597][ T8046] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 238.320135][ T8050] lo speed is unknown, defaulting to 1000 [ 238.358404][ T8053] lo speed is unknown, defaulting to 1000 [ 238.587714][ T8060] syzkaller1: entered promiscuous mode [ 238.593406][ T8060] syzkaller1: entered allmulticast mode [ 238.977822][ T8074] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 239.122895][ T8076] netlink: 'syz.5.573': attribute type 3 has an invalid length. [ 239.171314][ T10] Process accounting resumed [ 239.243507][ T8078] netlink: 'syz.5.573': attribute type 2 has an invalid length. [ 239.251229][ T8078] netlink: 'syz.5.573': attribute type 1 has an invalid length. [ 240.395771][ T8085] netlink: 36 bytes leftover after parsing attributes in process `syz.2.576'. [ 240.511772][ T30] audit: type=1400 audit(2000000086.290:491): avc: denied { getopt } for pid=8079 comm="syz.4.574" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 240.855895][ T8094] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2569 sclass=netlink_route_socket pid=8094 comm=syz.0.578 [ 240.869963][ T8094] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2572 sclass=netlink_route_socket pid=8094 comm=syz.0.578 [ 240.911324][ T8094] netlink: 8 bytes leftover after parsing attributes in process `syz.0.578'. [ 240.921330][ T8094] netlink: 12 bytes leftover after parsing attributes in process `syz.0.578'. [ 241.013728][ T36] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 241.077308][ T8094] netlink: 8 bytes leftover after parsing attributes in process `syz.0.578'. [ 241.086789][ T8094] netlink: 12 bytes leftover after parsing attributes in process `syz.0.578'. [ 241.142766][ T36] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 241.321209][ T36] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 241.529997][ T36] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 242.963772][ T8112] siw: device registration error -23 [ 243.590076][ T8116] syzkaller1: entered promiscuous mode [ 243.611975][ T8116] syzkaller1: entered allmulticast mode [ 243.822407][ T24] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 244.043398][ T24] usb 6-1: Using ep0 maxpacket: 8 [ 244.071956][ T24] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 244.150978][ T24] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 244.239614][ T24] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 244.271642][ T24] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 244.300686][ T24] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 244.337559][ T24] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 244.368593][ T24] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 244.590507][ T24] usb 6-1: usb_control_msg returned -32 [ 244.606073][ T24] usbtmc 6-1:16.0: can't read capabilities [ 245.668392][ T8152] netlink: 20 bytes leftover after parsing attributes in process `syz.2.593'. [ 245.686932][ T8157] usbtmc 6-1:16.0: INDICATOR_PULSE returned 0 [ 245.745430][ T8152] team0 (unregistering): Port device team_slave_0 removed [ 245.798197][ T8152] team0 (unregistering): Port device team_slave_1 removed [ 245.816357][ T30] audit: type=1400 audit(2000000091.650:492): avc: denied { map } for pid=8159 comm="syz.4.595" path="socket:[21115]" dev="sockfs" ino=21115 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 245.942475][ T30] audit: type=1400 audit(2000000091.670:493): avc: denied { read write } for pid=8159 comm="syz.4.595" path="socket:[21115]" dev="sockfs" ino=21115 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 246.083570][ T8167] netlink: 4 bytes leftover after parsing attributes in process `syz.4.595'. [ 246.783423][ T8178] netlink: 36 bytes leftover after parsing attributes in process `syz.0.598'. [ 246.903996][ T30] audit: type=1400 audit(2000000092.560:494): avc: denied { listen } for pid=8176 comm="syz.1.599" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 246.915710][ T5709] usb 6-1: USB disconnect, device number 5 [ 246.988148][ T30] audit: type=1400 audit(2000000092.620:495): avc: denied { create } for pid=8170 comm="syz.0.598" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 247.031027][ T7261] IPVS: starting estimator thread 0... [ 247.285568][ T8182] IPVS: using max 76 ests per chain, 182400 per kthread [ 247.881973][ T8195] CIFS: bad ip= option (127®0.0.1) [ 247.992430][ T5709] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 248.050133][ T8195] CIFS: Attempting to mount (null) [ 248.091935][ T30] audit: type=1400 audit(2000000093.920:496): avc: denied { listen } for pid=8196 comm="syz.0.604" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 248.113259][ T8195] CIFS: VFS: Error connecting to socket. Aborting operation. [ 248.154743][ T5709] usb 2-1: Using ep0 maxpacket: 16 [ 248.164467][ T8195] CIFS: VFS: cifs_mount failed w/return code = -111 [ 248.208287][ T5709] usb 2-1: config 0 has an invalid interface number: 41 but max is 0 [ 248.226360][ T5709] usb 2-1: config 0 has no interface number 0 [ 248.248457][ T5709] usb 2-1: config 0 interface 41 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 248.275320][ T5709] usb 2-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 248.302893][ T5709] usb 2-1: config 0 interface 41 has no altsetting 0 [ 248.327440][ T5709] usb 2-1: New USB device found, idVendor=0fe6, idProduct=9700, bcdDevice=d1.9a [ 248.344002][ T5709] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 248.382335][ T5709] usb 2-1: Product: syz [ 248.396747][ T5709] usb 2-1: Manufacturer: syz [ 248.435740][ T5709] usb 2-1: SerialNumber: syz [ 248.476238][ T5709] usb 2-1: config 0 descriptor?? [ 248.494136][ T8186] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 248.511155][ T8186] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 249.107014][ T8226] netlink: 36 bytes leftover after parsing attributes in process `syz.2.612'. [ 249.342862][ T8177] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 249.376150][ T8177] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 249.623166][ T30] audit: type=1400 audit(2000000095.440:497): avc: denied { connect } for pid=8176 comm="syz.1.599" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 249.687362][ T5709] sr9700 2-1:0.41 (unnamed net_device) (uninitialized): Error reading MAC address [ 249.861209][ T5709] usb 2-1: USB disconnect, device number 12 [ 250.801254][ T8230] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 251.399455][ T8260] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 251.596715][ T8262] netlink: 'syz.1.620': attribute type 3 has an invalid length. [ 251.687563][ T8263] netlink: 'syz.1.620': attribute type 2 has an invalid length. [ 251.695437][ T8263] netlink: 'syz.1.620': attribute type 1 has an invalid length. [ 251.993296][ T8255] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 253.723588][ T8266] syz_tun: entered allmulticast mode [ 253.944096][ T8268] FAULT_INJECTION: forcing a failure. [ 253.944096][ T8268] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 253.965782][ T8268] CPU: 0 UID: 0 PID: 8268 Comm: syz.5.622 Tainted: G L syzkaller #0 PREEMPT(full) [ 253.965817][ T8268] Tainted: [L]=SOFTLOCKUP [ 253.965823][ T8268] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 253.965832][ T8268] Call Trace: [ 253.965837][ T8268] [ 253.965844][ T8268] dump_stack_lvl+0x100/0x190 [ 253.965871][ T8268] should_fail_ex.cold+0x5/0xa [ 253.965892][ T8268] _copy_from_user+0x2e/0xd0 [ 253.965917][ T8268] move_addr_to_kernel+0x65/0x170 [ 253.965945][ T8268] __sys_bind+0x11d/0x260 [ 253.965962][ T8268] ? __pfx___sys_bind+0x10/0x10 [ 253.965977][ T8268] ? __fget_files+0x21f/0x3d0 [ 253.966002][ T8268] ? __pfx_ksys_write+0x10/0x10 [ 253.966034][ T8268] __x64_sys_bind+0x72/0xb0 [ 253.966049][ T8268] ? lockdep_hardirqs_on+0x78/0x100 [ 253.966070][ T8268] do_syscall_64+0x115/0x870 [ 253.966090][ T8268] ? clear_bhb_loop+0x40/0x90 [ 253.966112][ T8268] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 253.966130][ T8268] RIP: 0033:0x7f401e39e019 [ 253.966145][ T8268] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 253.966162][ T8268] RSP: 002b:00007f401f2f7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 253.966180][ T8268] RAX: ffffffffffffffda RBX: 00007f401e625fa0 RCX: 00007f401e39e019 [ 253.966191][ T8268] RDX: 000000000000000e RSI: 0000200000002080 RDI: 0000000000000004 [ 253.966201][ T8268] RBP: 00007f401f2f7090 R08: 0000000000000000 R09: 0000000000000000 [ 253.966211][ T8268] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 253.966221][ T8268] R13: 00007f401e626038 R14: 00007f401e625fa0 R15: 00007ffccaac2858 [ 253.966244][ T8268] [ 254.490605][ T8285] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 254.629528][ T8289] netlink: 'syz.5.629': attribute type 3 has an invalid length. [ 254.707312][ T5709] Process accounting resumed [ 254.782103][ T8288] netlink: 'syz.5.629': attribute type 2 has an invalid length. [ 254.789912][ T8288] netlink: 'syz.5.629': attribute type 1 has an invalid length. [ 255.292835][ T8295] netlink: 160 bytes leftover after parsing attributes in process `syz.4.631'. [ 255.316340][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.322690][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.875968][ T30] audit: type=1400 audit(2000000102.710:498): avc: denied { map } for pid=8304 comm="syz.0.633" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 256.902361][ T30] audit: type=1400 audit(2000000102.730:499): avc: denied { execute } for pid=8304 comm="syz.0.633" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 257.135435][ T30] audit: type=1400 audit(2000000102.970:500): avc: denied { write } for pid=8311 comm="syz.4.635" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 257.292652][ T5709] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 257.449495][ T5709] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 257.483091][ T5709] usb 1-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 257.496124][ T5709] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 257.506691][ T5709] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 257.543135][ T8309] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 257.560435][ T5709] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 257.825854][ T7262] usb 1-1: USB disconnect, device number 9 [ 272.752334][ T5617] Bluetooth: hci5: command 0x0406 tx timeout [ 284.864055][ T30] audit: type=1400 audit(2000000130.690:501): avc: denied { create } for pid=8326 comm="syz.2.642" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 284.955492][ T30] audit: type=1400 audit(2000000130.690:502): avc: denied { setopt } for pid=8326 comm="syz.2.642" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 287.949211][ T8365] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 288.177874][ T8371] netlink: 'syz.5.651': attribute type 3 has an invalid length. [ 288.367197][ T5709] Process accounting resumed [ 288.387161][ T8372] netlink: 'syz.5.651': attribute type 2 has an invalid length. [ 288.395751][ T8372] netlink: 'syz.5.651': attribute type 1 has an invalid length. [ 289.241640][ T8379] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 290.477219][ T8384] netlink: 'syz.4.654': attribute type 3 has an invalid length. [ 290.768099][ T5709] Process accounting resumed [ 290.775632][ T8386] netlink: 'syz.4.654': attribute type 2 has an invalid length. [ 290.783394][ T8386] netlink: 'syz.4.654': attribute type 1 has an invalid length. [ 293.471598][ T7270] IPVS: starting estimator thread 0... [ 293.845569][ T8423] IPVS: using max 76 ests per chain, 182400 per kthread [ 294.627587][ T30] audit: type=1400 audit(2000000140.460:503): avc: denied { create } for pid=8436 comm="syz.0.670" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 294.649486][ T30] audit: type=1400 audit(2000000140.470:504): avc: denied { bind } for pid=8436 comm="syz.0.670" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 294.710653][ T10] Process accounting resumed [ 294.781256][ T30] audit: type=1400 audit(2000000140.480:505): avc: denied { write } for pid=8436 comm="syz.0.670" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 294.842344][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 294.951394][ T8440] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(14) [ 294.958260][ T8440] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 294.967682][ T8440] vhci_hcd vhci_hcd.0: Device attached [ 295.205503][ T10] vhci_hcd vhci_hcd.0: vhci_device speed not set [ 295.362435][ T10] usb 33-1: new full-speed USB device number 2 using vhci_hcd [ 295.706335][ T8444] vhci_hcd: connection reset by peer [ 295.882792][ T13] vhci_hcd vhci_hcd.0: stop threads [ 295.889741][ T8448] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 295.951900][ T13] vhci_hcd vhci_hcd.0: release socket [ 296.049604][ T13] vhci_hcd vhci_hcd.0: disconnect device [ 296.195265][ T8450] netlink: 'syz.2.672': attribute type 3 has an invalid length. [ 296.240903][ T8450] netlink: 'syz.2.672': attribute type 2 has an invalid length. [ 296.248675][ T8450] netlink: 'syz.2.672': attribute type 1 has an invalid length. [ 296.628225][ T8454] netlink: 20 bytes leftover after parsing attributes in process `syz.4.673'. [ 297.534014][ T8470] netlink: 60 bytes leftover after parsing attributes in process `syz.0.679'. [ 297.549448][ T8470] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 297.558020][ T8470] UDF-fs: Scanning with blocksize 512 failed [ 297.564968][ T8470] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 297.573896][ T8470] UDF-fs: Scanning with blocksize 1024 failed [ 297.581511][ T8470] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 297.589446][ T8470] UDF-fs: Scanning with blocksize 2048 failed [ 297.597427][ T8470] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 297.605278][ T8470] UDF-fs: Scanning with blocksize 4096 failed [ 298.187635][ T805] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 298.345026][ T8455] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 298.614592][ T5709] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 298.918256][ T5709] usb 6-1: Using ep0 maxpacket: 8 [ 298.956931][ T5709] usb 6-1: config index 0 descriptor too short (expected 74, got 45) [ 299.056033][ T5709] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 299.220521][ T5709] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 299.312035][ T5709] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 3 [ 299.371458][ T5709] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 299.403850][ T5709] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 299.503557][ T805] usb 3-1: Using ep0 maxpacket: 8 [ 299.515044][ T8487] siw: device registration error -23 [ 299.543520][ T805] usb 3-1: config index 0 descriptor too short (expected 74, got 45) [ 299.582512][ T805] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 299.659300][ T805] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 299.750185][ T805] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 3 [ 300.022959][ T805] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 300.137679][ T805] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 300.214805][ T805] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 300.293192][ T8490] netlink: 160 bytes leftover after parsing attributes in process `syz.4.685'. [ 300.295965][ T5709] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 300.518566][ T5709] usb 6-1: GET_CAPABILITIES returned 0 [ 300.540791][ T5709] usbtmc 6-1:16.0: can't read capabilities [ 300.623055][ T10] vhci_hcd vhci_hcd.0: vhci_device speed not set [ 301.762596][ T805] usb 3-1: usb_control_msg returned -71 [ 302.372430][ T805] usbtmc 3-1:16.0: can't read capabilities [ 302.432398][ T7272] usb 6-1: USB disconnect, device number 6 [ 302.445094][ T8509] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 302.586863][ T7261] Process accounting resumed [ 302.700211][ T8529] netlink: 'syz.5.692': attribute type 3 has an invalid length. [ 302.815274][ T10] Process accounting resumed [ 302.849557][ T8530] netlink: 'syz.5.692': attribute type 2 has an invalid length. [ 302.857549][ T8530] netlink: 'syz.5.692': attribute type 1 has an invalid length. [ 303.134095][ T8521] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(14) [ 303.140721][ T8521] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 303.149189][ T8521] vhci_hcd vhci_hcd.0: Device attached [ 303.541795][ T8527] vhci_hcd: connection closed [ 304.131420][ T6036] vhci_hcd vhci_hcd.1: stop threads [ 304.341867][ T805] usb 3-1: USB disconnect, device number 10 [ 304.358143][ T24] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 304.903426][ T24] usb 35-1: new full-speed USB device number 2 using vhci_hcd [ 305.214533][ T6036] vhci_hcd vhci_hcd.1: release socket [ 305.221508][ T6036] vhci_hcd vhci_hcd.1: disconnect device [ 305.462649][ T30] audit: type=1400 audit(2000000151.300:506): avc: denied { read } for pid=8541 comm="syz.5.696" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 305.560196][ T30] audit: type=1400 audit(2000000151.320:507): avc: denied { open } for pid=8541 comm="syz.5.696" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 305.618393][ T30] audit: type=1400 audit(2000000151.440:508): avc: denied { mount } for pid=8548 comm="syz.0.698" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 305.661341][ T30] audit: type=1400 audit(2000000151.450:509): avc: denied { write } for pid=8548 comm="syz.0.698" name="dlm" dev="configfs" ino=1117 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 305.705089][ T30] audit: type=1400 audit(2000000151.450:510): avc: denied { write } for pid=8548 comm="syz.0.698" name="comms" dev="configfs" ino=23931 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 305.746979][ T30] audit: type=1400 audit(2000000151.450:511): avc: denied { read write } for pid=8548 comm="syz.0.698" name="local" dev="configfs" ino=23933 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 305.772009][ T30] audit: type=1400 audit(2000000151.450:512): avc: denied { open } for pid=8548 comm="syz.0.698" path="/151/my_configfs/dlm/cluster1/comms/1/local" dev="configfs" ino=23933 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 305.799770][ T7272] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 305.810072][ T8551] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 305.831445][ T30] audit: type=1800 audit(2000000151.480:513): pid=8549 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.698" name="local" dev="configfs" ino=23933 res=0 errno=0 [ 305.857404][ T30] audit: type=1800 audit(2000000151.480:514): pid=8549 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.698" name="scan_secs" dev="configfs" ino=23934 res=0 errno=0 [ 305.898348][ T30] audit: type=1400 audit(2000000151.480:515): avc: denied { write } for pid=8548 comm="syz.0.698" name="spaces" dev="configfs" ino=23930 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 305.962341][ T7272] usb 2-1: Using ep0 maxpacket: 16 [ 305.984628][ T7272] usb 2-1: config 0 has an invalid interface number: 41 but max is 0 [ 306.006791][ T7272] usb 2-1: config 0 has no interface number 0 [ 306.018708][ T8561] netlink: 12 bytes leftover after parsing attributes in process `syz.5.704'. [ 306.021726][ T7272] usb 2-1: config 0 interface 41 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 306.045001][ T7272] usb 2-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 306.057074][ T7272] usb 2-1: config 0 interface 41 has no altsetting 0 [ 306.069708][ T7272] usb 2-1: New USB device found, idVendor=0fe6, idProduct=9700, bcdDevice=d1.9a [ 306.080723][ T7272] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 306.111022][ T7272] usb 2-1: Product: syz [ 306.127975][ T7272] usb 2-1: Manufacturer: syz [ 306.142879][ T7272] usb 2-1: SerialNumber: syz [ 306.169305][ T7272] usb 2-1: config 0 descriptor?? [ 306.187260][ T8543] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 306.195007][ T8543] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 306.443205][ T8543] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 306.466737][ T8543] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 306.535894][ T8577] lo speed is unknown, defaulting to 1000 [ 306.708119][ T8587] netlink: 'syz.5.714': attribute type 49 has an invalid length. [ 307.026200][ T8596] netlink: 'syz.0.717': attribute type 1 has an invalid length. [ 307.104829][ T8587] ip6gretap0: entered promiscuous mode [ 307.123776][ T8587] ip6gretap0: entered allmulticast mode [ 307.214688][ T8602] netlink: 'syz.0.717': attribute type 10 has an invalid length. [ 307.259596][ T8596] 8021q: adding VLAN 0 to HW filter on device bond1 [ 307.298034][ T8602] netlink: 40 bytes leftover after parsing attributes in process `syz.0.717'. [ 307.400289][ T8599] bond1: (slave gretap1): making interface the new active one [ 307.455889][ T8599] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 307.607019][ T8600] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 307.672830][ T8602] dummy0: entered promiscuous mode [ 307.703643][ T7272] sr9700 2-1:0.41 (unnamed net_device) (uninitialized): Error reading MAC address [ 307.750467][ T8602] bond1: (slave dummy0): Releasing active interface [ 307.750491][ T7272] usb 2-1: USB disconnect, device number 13 [ 307.778269][ T8602] gretap1: entered promiscuous mode [ 307.965399][ T8632] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 308.162781][ T8643] netlink: 24 bytes leftover after parsing attributes in process `syz.4.729'. [ 308.326728][ T8651] sch_tbf: burst 88 is lower than device veth3 mtu (1514) ! [ 308.966715][ T8693] netlink: 4 bytes leftover after parsing attributes in process `syz.5.749'. [ 309.020497][ T8696] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 309.028826][ T8696] IPv6: NLM_F_CREATE should be set when creating new route [ 309.145633][ T8698] netlink: 12 bytes leftover after parsing attributes in process `syz.1.753'. [ 309.555588][ T8715] netlink: 'syz.2.759': attribute type 1 has an invalid length. [ 309.604934][ T8715] 8021q: adding VLAN 0 to HW filter on device bond6 [ 309.661313][ T8715] bond6: (slave gretap1): Enslaving as a backup interface with an up link [ 309.664633][ T8720] netlink: 144 bytes leftover after parsing attributes in process `syz.1.760'. [ 309.713094][ T142] bond6: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 309.728218][ T8715] bond6: (slave dummy0): Enslaving as a backup interface with an up link [ 309.730609][ T5709] IPVS: starting estimator thread 0... [ 309.749837][ T8725] netlink: 'syz.2.759': attribute type 10 has an invalid length. [ 309.776444][ T8725] netlink: 40 bytes leftover after parsing attributes in process `syz.2.759'. [ 309.803065][ T8725] dummy0: entered promiscuous mode [ 309.836564][ T8725] bond6: (slave dummy0): Releasing backup interface [ 309.852732][ T8724] IPVS: using max 51 ests per chain, 122400 per kthread [ 309.884700][ T36] bond6: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 310.113386][ T24] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 310.395677][ T8758] netlink: 12 bytes leftover after parsing attributes in process `syz.4.776'. [ 310.520834][ T8763] tipc: Started in network mode [ 310.532502][ T8763] tipc: Node identity 0e726af2b9d, cluster identity 4711 [ 310.541110][ T8763] tipc: Enabled bearer , priority 0 [ 310.550800][ T8763] syzkaller0: entered promiscuous mode [ 310.556668][ T8763] syzkaller0: entered allmulticast mode [ 310.581815][ T8763] tipc: Resetting bearer [ 310.598319][ T8768] netlink: 'syz.4.780': attribute type 1 has an invalid length. [ 310.606554][ T8768] netlink: 756 bytes leftover after parsing attributes in process `syz.4.780'. [ 310.616286][ T8762] tipc: Resetting bearer [ 310.652643][ T8762] tipc: Disabling bearer [ 310.878542][ T8780] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 311.028004][ T8772] syzkaller0: entered promiscuous mode [ 311.050773][ T8772] syzkaller0: entered allmulticast mode [ 311.114984][ T8796] netlink: 12 bytes leftover after parsing attributes in process `syz.5.791'. [ 311.258305][ T30] kauditd_printk_skb: 14 callbacks suppressed [ 311.258321][ T30] audit: type=1400 audit(2000000157.090:530): avc: denied { listen } for pid=8799 comm="syz.2.793" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 311.302273][ T30] audit: type=1400 audit(2000000157.120:531): avc: denied { shutdown } for pid=8799 comm="syz.2.793" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 311.351013][ T30] audit: type=1400 audit(2000000157.120:532): avc: denied { getopt } for pid=8799 comm="syz.2.793" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 313.252773][ T30] audit: type=1800 audit(2000000159.080:533): pid=8837 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.802" name="cluster_name" dev="configfs" ino=23428 res=0 errno=0 [ 313.290849][ T8842] netlink: 8 bytes leftover after parsing attributes in process `syz.5.804'. [ 313.366908][ T8846] openvswitch: netlink: nsh attr 1 has unexpected len 16 expected 8 [ 313.527469][ T30] audit: type=1400 audit(2000000159.360:534): avc: denied { write } for pid=8853 comm="syz.2.812" name="cluster" dev="configfs" ino=1138 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 313.584558][ T30] audit: type=1400 audit(2000000159.360:535): avc: denied { write } for pid=8853 comm="syz.2.812" name="node" dev="configfs" ino=23454 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 313.699035][ T30] audit: type=1400 audit(2000000159.530:536): avc: denied { nlmsg_read } for pid=8859 comm="syz.2.814" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 315.281228][ T30] audit: type=1800 audit(2000000161.110:537): pid=8901 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.822" name="toss_secs" dev="configfs" ino=24541 res=0 errno=0 [ 315.541624][ T30] audit: type=1400 audit(2000000161.370:538): avc: denied { relabelfrom } for pid=8883 comm="syz.1.821" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 315.622134][ T30] audit: type=1400 audit(2000000161.370:539): avc: denied { relabelto } for pid=8883 comm="syz.1.821" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 315.676490][ T8911] veth0: entered promiscuous mode [ 315.843943][ T8918] syzkaller0: entered promiscuous mode [ 315.864286][ T8918] syzkaller0: entered allmulticast mode [ 315.953533][ T8927] netlink: 'syz.1.831': attribute type 10 has an invalid length. [ 316.009166][ T8927] bridge0: port 2(bridge_slave_1) entered disabled state [ 316.016680][ T8927] bridge0: port 1(bridge_slave_0) entered disabled state [ 316.112892][ T8927] bridge0: port 2(bridge_slave_1) entered blocking state [ 316.120137][ T8927] bridge0: port 2(bridge_slave_1) entered forwarding state [ 316.128567][ T8927] bridge0: port 1(bridge_slave_0) entered blocking state [ 316.135694][ T8927] bridge0: port 1(bridge_slave_0) entered forwarding state [ 316.205955][ T8927] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 316.244905][ T8910] veth0: left promiscuous mode [ 316.274346][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 316.274362][ T30] audit: type=1400 audit(2000000162.110:541): avc: denied { connect } for pid=8946 comm="syz.0.836" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 316.360994][ T8927] netlink: 5 bytes leftover after parsing attributes in process `syz.1.831'. [ 316.387947][ T30] audit: type=1400 audit(2000000162.190:542): avc: denied { read } for pid=8946 comm="syz.0.836" lport=35237 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 316.444740][ T8935] lo speed is unknown, defaulting to 1000 [ 316.466270][ T30] audit: type=1400 audit(2000000162.260:543): avc: denied { write } for pid=8925 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 316.490221][ T805] lo speed is unknown, defaulting to 1000 [ 316.638455][ T30] audit: type=1400 audit(2000000162.470:544): avc: denied { write } for pid=8961 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 316.768118][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 316.788454][ T5273] veth0_vlan: left promiscuous mode [ 316.811341][ T5344] veth0_vlan: entered promiscuous mode [ 316.815589][ T30] audit: type=1400 audit(2000000162.640:545): avc: denied { bind } for pid=8970 comm="syz.2.842" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 317.030911][ T8981] netlink: 32 bytes leftover after parsing attributes in process `syz.2.842'. [ 317.108363][ T30] audit: type=1400 audit(2000000162.940:546): avc: denied { write } for pid=8978 comm="syz.1.843" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 317.271164][ T8983] lo speed is unknown, defaulting to 1000 [ 317.352003][ T30] audit: type=1800 audit(2000000163.180:547): pid=8996 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.844" name="toss_secs" dev="configfs" ino=25730 res=0 errno=0 [ 317.555490][ T8971] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 317.572301][ T30] audit: type=1400 audit(2000000163.400:548): avc: denied { write } for pid=8974 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 317.589931][ T9007] netlink: 8 bytes leftover after parsing attributes in process `syz.0.846'. [ 317.641217][ T9003] tipc: Enabling of bearer rejected, failed to enable media [ 317.746057][ T30] audit: type=1400 audit(2000000163.570:549): avc: denied { write } for pid=9010 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 317.855717][ T8971] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 317.873517][ T30] audit: type=1400 audit(2000000163.710:550): avc: denied { bind } for pid=9014 comm="syz.5.848" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 317.912395][ T9005] vlan2: entered promiscuous mode [ 317.917624][ T9005] bridge0: entered promiscuous mode [ 317.940828][ T9007] dummy0: left promiscuous mode [ 318.145674][ T8971] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 318.223911][ T6036] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 318.252756][ T6036] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 318.308619][ T8971] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 318.332389][ T3392] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 318.368357][ T3392] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 318.607572][ T6036] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 318.722483][ T3392] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 318.753949][ T3392] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 318.784893][ T3392] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 319.517771][ T9080] netlink: 8 bytes leftover after parsing attributes in process `syz.5.870'. [ 319.808905][ T9075] Cannot find add_set index 0 as target [ 320.315670][ T9107] netlink: 'syz.4.881': attribute type 25 has an invalid length. [ 320.344087][ T9099] syz.5.879 (9099) used greatest stack depth: 19768 bytes left [ 320.955559][ T9139] netlink: 'syz.4.892': attribute type 25 has an invalid length. [ 321.169888][ T9152] SET target dimension over the limit! [ 321.204684][ T9152] netlink: 8 bytes leftover after parsing attributes in process `syz.1.896'. [ 321.227255][ T9152] netlink: 24 bytes leftover after parsing attributes in process `syz.1.896'. [ 321.266602][ T9152] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 321.352946][ T9158] mac80211_hwsim hwsim3 syzkaller0: entered promiscuous mode [ 321.369298][ T9158] mac80211_hwsim hwsim3 syzkaller0: entered allmulticast mode [ 321.422926][ T30] kauditd_printk_skb: 13 callbacks suppressed [ 321.422941][ T30] audit: type=1400 audit(2000000167.260:564): avc: denied { write } for pid=9148 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 321.460094][ T9173] netlink: 8 bytes leftover after parsing attributes in process `syz.4.901'. [ 321.577366][ T9173] vlan2: entered promiscuous mode [ 321.596926][ T9173] bridge0: entered promiscuous mode [ 321.677233][ T30] audit: type=1400 audit(2000000167.510:565): avc: denied { write } for pid=9182 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 321.829419][ T9195] netlink: 12 bytes leftover after parsing attributes in process `syz.4.908'. [ 321.892477][ T30] audit: type=1400 audit(2000000167.720:566): avc: denied { write } for pid=9199 comm="syz.2.910" name="functions" dev="configfs" ino=13960 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 322.009806][ T9209] netlink: 8 bytes leftover after parsing attributes in process `syz.0.914'. [ 322.047991][ T30] audit: type=1400 audit(2000000167.880:567): avc: denied { write } for pid=9199 comm="syz.2.910" name="ss" dev="configfs" ino=25121 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 322.072981][ T6036] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 322.095684][ T6036] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 322.104988][ T6036] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 322.114085][ T30] audit: type=1400 audit(2000000167.900:568): avc: denied { write } for pid=9199 comm="syz.2.910" name="fs" dev="configfs" ino=25120 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 322.136806][ T6036] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 322.147713][ T30] audit: type=1400 audit(2000000167.950:569): avc: denied { write } for pid=9199 comm="syz.2.910" name="uncompressed" dev="configfs" ino=25125 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 322.179346][ T30] audit: type=1400 audit(2000000168.010:570): avc: denied { write } for pid=9199 comm="syz.2.910" name="header" dev="configfs" ino=25124 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 322.209432][ T30] audit: type=1400 audit(2000000168.010:571): avc: denied { write } for pid=9199 comm="syz.2.910" name="h" dev="configfs" ino=25209 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 322.236249][ T30] audit: type=1400 audit(2000000168.010:572): avc: denied { write } for pid=9199 comm="syz.2.910" name="h" dev="configfs" ino=25209 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 322.288462][ T30] audit: type=1400 audit(2000000168.040:573): avc: denied { write } for pid=9199 comm="syz.2.910" name="fs" dev="configfs" ino=25131 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 322.706704][ T9244] netlink: 4 bytes leftover after parsing attributes in process `syz.2.928'. [ 323.410393][ T9286] syzkaller0: entered promiscuous mode [ 323.423089][ T9286] syzkaller0: entered allmulticast mode [ 323.760386][ T9306] netlink: 28 bytes leftover after parsing attributes in process `syz.5.953'. [ 323.796645][ T9306] netlink: 'syz.5.953': attribute type 7 has an invalid length. [ 323.825025][ T9311] netlink: 'syz.5.953': attribute type 1 has an invalid length. [ 323.840537][ T9306] netlink: 'syz.5.953': attribute type 8 has an invalid length. [ 323.881285][ T9311] netlink: 224 bytes leftover after parsing attributes in process `syz.5.953'. [ 323.889567][ T9306] netlink: 4 bytes leftover after parsing attributes in process `syz.5.953'. [ 324.110810][ T9321] lo speed is unknown, defaulting to 1000 [ 324.936219][ T9368] netlink: 8 bytes leftover after parsing attributes in process `syz.1.975'. [ 325.128543][ T9373] netlink: 24 bytes leftover after parsing attributes in process `syz.0.981'. [ 325.548075][ T9400] netlink: 24 bytes leftover after parsing attributes in process `syz.0.993'. [ 326.125189][ T9432] tipc: Started in network mode [ 326.144474][ T9420] device-mapper: ioctl: dm_ctl_ioctl: unknown command 0xc138fd30 [ 326.168243][ T9432] tipc: Node identity aa981b7643a2, cluster identity 4711 [ 326.197007][ T9432] tipc: Enabled bearer , priority 0 [ 326.317198][ T9430] tipc: Disabling bearer [ 326.842079][ T9476] lo speed is unknown, defaulting to 1000 [ 327.025762][ T9485] tipc: Enabled bearer , priority 0 [ 327.054567][ T9491] syzkaller0: entered promiscuous mode [ 327.074523][ T9491] syzkaller0: entered allmulticast mode [ 327.216093][ T9491] tipc: Resetting bearer [ 327.243204][ T9483] tipc: Resetting bearer [ 327.305321][ T9483] tipc: Disabling bearer [ 327.315994][ T9497] tipc: Started in network mode [ 327.332252][ T9497] tipc: Node identity 080211000001, cluster identity 4711 [ 327.340991][ T9497] tipc: Enabled bearer , priority 0 [ 327.357241][ T9506] netlink: 'syz.2.1034': attribute type 1 has an invalid length. [ 327.368132][ T9507] tipc: Resetting bearer [ 327.368998][ T9506] __nla_validate_parse: 1 callbacks suppressed [ 327.369011][ T9506] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1034'. [ 327.850038][ T30] kauditd_printk_skb: 31 callbacks suppressed [ 327.850053][ T30] audit: type=1400 audit(2000000173.680:605): avc: denied { connect } for pid=9536 comm="syz.0.1047" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 328.013485][ T30] audit: type=1400 audit(2000000173.840:606): avc: denied { set_context_mgr } for pid=9544 comm="syz.0.1051" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 328.069058][ T9545] binder: 9544:9545 ioctl c0306201 0 returned -14 [ 328.092300][ T30] audit: type=1400 audit(2000000173.840:607): avc: denied { write } for pid=9546 comm="syz.1.1052" name="fs" dev="configfs" ino=25120 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 328.186944][ T9557] 9pnet_virtio: no channels available for device syz [ 328.187911][ T30] audit: type=1400 audit(2000000173.840:608): avc: denied { write } for pid=9546 comm="syz.1.1052" name="fs" dev="configfs" ino=25120 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 328.264179][ T30] audit: type=1400 audit(2000000173.850:609): avc: denied { write } for pid=9546 comm="syz.1.1052" name="ss" dev="configfs" ino=25121 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 328.312886][ T5616] Bluetooth: hci4: unexpected event 0x03 length: 1 < 11 [ 328.352900][ T30] audit: type=1400 audit(2000000173.850:610): avc: denied { write } for pid=9546 comm="syz.1.1052" name="ss" dev="configfs" ino=25121 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 328.383676][ T30] audit: type=1400 audit(2000000173.900:611): avc: denied { map } for pid=9544 comm="syz.0.1051" path="/dev/binderfs/binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 328.394735][ T7262] tipc: Node number set to 134418688 [ 328.408700][ T30] audit: type=1400 audit(2000000173.920:612): avc: denied { call } for pid=9544 comm="syz.0.1051" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 328.445868][ T9570] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1063'. [ 328.610194][ T30] audit: type=1400 audit(2000000174.440:613): avc: denied { write } for pid=9581 comm="syz.4.1066" name="fs" dev="configfs" ino=25120 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 328.676707][ T30] audit: type=1400 audit(2000000174.470:614): avc: denied { write } for pid=9581 comm="syz.4.1066" name="fs" dev="configfs" ino=25120 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 328.689898][ T9586] mac80211_hwsim hwsim3 syzkaller0: left promiscuous mode [ 328.712577][ T9586] mac80211_hwsim hwsim3 syzkaller0: left allmulticast mode [ 328.740993][ T9586] tipc: Resetting bearer [ 328.784803][ T9589] xt_hashlimit: size too large, truncated to 1048576 [ 328.858896][ T9598] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1073'. [ 328.981828][ T9601] nbd: must specify an index to disconnect [ 329.187303][ T9611] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1076'. [ 329.531992][ T9632] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1084'. [ 329.791954][ T9649] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1089'. [ 329.939965][ T9657] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1092'. [ 329.975713][ T9657] l2tp_ppp: sess 2/0: no socket in recv [ 330.022651][ T9664] xt_hashlimit: size too large, truncated to 1048576 [ 330.320535][ T9682] vlan2: entered promiscuous mode [ 330.341881][ T9682] bridge0: entered promiscuous mode [ 330.543520][ T9699] netlink: 56 bytes leftover after parsing attributes in process `syz.4.1104'. [ 330.574469][ T7270] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 330.580387][ T9698] Cannot find add_set index 0 as target [ 330.670666][ T9706] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1103'. [ 330.680527][ T9706] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 330.746796][ T7270] usb 6-1: Using ep0 maxpacket: 32 [ 330.766656][ T7270] usb 6-1: config index 0 descriptor too short (expected 15270, got 18) [ 330.826871][ T7270] usb 6-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 330.840924][ T7270] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 330.868590][ T7270] usb 6-1: Product: syz [ 330.878416][ T7270] usb 6-1: Manufacturer: syz [ 330.890966][ T7270] usb 6-1: SerialNumber: syz [ 330.911122][ T7270] usb 6-1: config 0 descriptor?? [ 330.926439][ T7262] usb 5-1: new full-speed USB device number 9 using dummy_hcd [ 330.930467][ T7270] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 330.959458][ T7270] dvb-usb: bulk message failed: -22 (4/0) [ 330.992104][ T7270] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 331.016074][ T7270] dvb-usb: bulk message failed: -22 (5/0) [ 331.024796][ T7270] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 331.044298][ T7270] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 331.054671][ T7270] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 331.085277][ T7270] usb 6-1: media controller created [ 331.113253][ T7262] usb 5-1: not running at top speed; connect to a high speed hub [ 331.140467][ T7270] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 331.147116][ T7262] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 331.170330][ T7262] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 331.181432][ T7262] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 331.198314][ T7262] usb 5-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 331.209028][ T7262] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 331.231290][ T7262] keyspan 5-1:1.0: Keyspan 2 port adapter converter detected [ 331.254556][ T7262] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 84 [ 331.254896][ T7270] usb 6-1: selecting invalid altsetting 3 [ 331.284820][ T7262] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 2 [ 331.287854][ T7270] ttusb2: set interface to alts=3 failed [ 331.309309][ T9730] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1115'. [ 331.333479][ T7262] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 331.354469][ T7262] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 88 [ 331.370399][ T7262] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 6 [ 331.374744][ T7270] DVB: Unable to find symbol tda10086_attach() [ 331.385734][ T7270] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 331.395204][ T7270] dvb-usb: bulk message failed: -22 (4/0) [ 331.415922][ T7262] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 331.435379][ T7270] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 331.465466][ T7270] dvb-usb: bulk message failed: -22 (5/0) [ 331.485890][ T7270] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 331.498797][ T9736] syzkaller0: entered promiscuous mode [ 331.515268][ T9736] syzkaller0: entered allmulticast mode [ 331.517207][ T7270] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 331.551255][ T7270] usb 6-1: USB disconnect, device number 7 [ 331.607977][ T8361] udevd[8361]: setting owner of /dev/dvb/adapter1/demux0 to uid=0, gid=28 failed: No such file or directory [ 331.649524][ T7270] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully deinitialized and disconnected. [ 331.654437][ T7262] usb 5-1: USB disconnect, device number 9 [ 331.725163][ T9739] lo speed is unknown, defaulting to 1000 [ 331.745028][ T7262] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 331.784799][ T7262] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 331.836397][ T7262] keyspan 5-1:1.0: device disconnected [ 331.874082][ T9745] comedi comedi2: comedi_test: 320 microvolt, 100000 microsecond waveform attached [ 332.543104][ T9781] netlink: 'syz.4.1134': attribute type 25 has an invalid length. [ 332.642884][ T9787] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 333.098097][ T30] kauditd_printk_skb: 20 callbacks suppressed [ 333.098112][ T30] audit: type=1800 audit(2000000178.930:635): pid=9812 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.5.1147" name="cluster_name" dev="configfs" ino=29245 res=0 errno=0 [ 333.415877][ T9827] __nla_validate_parse: 2 callbacks suppressed [ 333.415894][ T9827] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1156'. [ 333.623654][ T30] audit: type=1800 audit(2000000179.460:636): pid=9838 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.1161" name="cluster_name" dev="configfs" ino=29275 res=0 errno=0 [ 333.627425][ T9841] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1538 sclass=netlink_route_socket pid=9841 comm=syz.0.1163 [ 333.692933][ T30] audit: type=1400 audit(2000000179.520:637): avc: denied { bind } for pid=9843 comm="syz.5.1164" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 333.702032][ T9841] 9pnet_virtio: no channels available for device syz [ 333.751556][ T30] audit: type=1400 audit(2000000179.560:638): avc: denied { connect } for pid=9843 comm="syz.5.1164" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 333.759067][ T9841] overlayfs: failed to resolve './file2': -2 [ 333.772397][ T30] audit: type=1400 audit(2000000179.580:639): avc: denied { read } for pid=9843 comm="syz.5.1164" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 333.805107][ T30] audit: type=1400 audit(2000000179.640:640): avc: denied { read } for pid=9849 comm="syz.2.1166" name="g1" dev="configfs" ino=13959 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 333.827749][ T30] audit: type=1400 audit(2000000179.640:641): avc: denied { read open } for pid=9849 comm="syz.2.1166" path="/219/my_configfs/usb_gadget/g1" dev="configfs" ino=13959 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 333.833583][ T9847] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1165'. [ 333.858224][ T9850] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 333.895676][ T9847] netlink: 'syz.4.1165': attribute type 7 has an invalid length. [ 333.903862][ T9854] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1167'. [ 333.934705][ T9855] netlink: 'syz.4.1165': attribute type 1 has an invalid length. [ 333.949234][ T9855] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1165'. [ 333.966320][ T9847] netlink: 'syz.4.1165': attribute type 8 has an invalid length. [ 333.977784][ T9847] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1165'. [ 334.219198][ T9870] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1173'. [ 334.453382][ T30] audit: type=1800 audit(2000000180.290:642): pid=9881 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.4.1178" name="toss_secs" dev="configfs" ino=29332 res=0 errno=0 [ 334.694977][ T9886] Cannot find add_set index 0 as target [ 334.719534][ T9886] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1179'. [ 334.749147][ T9886] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 334.855633][ T9900] netlink: 'syz.4.1184': attribute type 25 has an invalid length. [ 334.925999][ T9902] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1186'. [ 335.022131][ T9908] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1188'. [ 335.377715][ T9918] syzkaller0: entered promiscuous mode [ 335.390170][ T9918] syzkaller0: entered allmulticast mode [ 335.521609][ T9937] netlink: 144 bytes leftover after parsing attributes in process `syz.2.1197'. [ 335.553765][ T9936] netlink: 'syz.4.1198': attribute type 25 has an invalid length. [ 336.046762][ T30] audit: type=1800 audit(2000000181.870:643): pid=9960 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.4.1208" name="idVendor" dev="configfs" ino=30396 res=0 errno=0 [ 336.088569][ T30] audit: type=1800 audit(2000000181.880:644): pid=9960 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.4.1208" name="idProduct" dev="configfs" ino=30397 res=0 errno=0 [ 336.187743][ T9965] configfs-gadget.g1 gadget.32: uvc: uvc_function_unbind() [ 338.404551][T10008] syzkaller0: entered promiscuous mode [ 338.417387][T10008] syzkaller0: entered allmulticast mode [ 338.424125][T10010] netlink: 'syz.5.1227': attribute type 25 has an invalid length. [ 338.688762][T10026] openvswitch: netlink: Flow key attr not present in new flow. [ 338.819723][T10030] Cannot find add_set index 0 as target [ 338.820152][T10031] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 338.849398][T10030] __nla_validate_parse: 2 callbacks suppressed [ 338.849414][T10030] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1236'. [ 338.892360][T10030] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 339.096464][T10053] netlink: 144 bytes leftover after parsing attributes in process `syz.1.1243'. [ 339.233781][T10057] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1244'. [ 339.262534][T10060] mac80211_hwsim hwsim3 syzkaller0: entered promiscuous mode [ 339.280845][T10060] mac80211_hwsim hwsim3 syzkaller0: entered allmulticast mode [ 339.285798][T10065] netlink: 'syz.2.1244': attribute type 1 has an invalid length. [ 339.290832][T10057] netlink: 'syz.2.1244': attribute type 7 has an invalid length. [ 339.321669][T10060] tipc: Resetting bearer [ 339.323491][T10065] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1244'. [ 339.364414][T10057] netlink: 'syz.2.1244': attribute type 8 has an invalid length. [ 339.391458][T10057] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1244'. [ 339.480354][T10076] netlink: 144 bytes leftover after parsing attributes in process `syz.1.1252'. [ 339.484083][ T30] kauditd_printk_skb: 12 callbacks suppressed [ 339.484098][ T30] audit: type=1800 audit(2000000185.310:657): pid=10077 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.1253" name="local" dev="configfs" ino=31922 res=0 errno=0 [ 339.569286][ T30] audit: type=1800 audit(2000000185.350:658): pid=10077 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.1253" name="scan_secs" dev="configfs" ino=31924 res=0 errno=0 [ 339.681675][ T30] audit: type=1400 audit(2000000185.500:659): avc: denied { write } for pid=10086 comm="syz.5.1259" name="fs" dev="configfs" ino=25120 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 339.736973][ T30] audit: type=1400 audit(2000000185.500:660): avc: denied { write } for pid=10086 comm="syz.5.1259" name="fs" dev="configfs" ino=25120 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 339.820449][ T30] audit: type=1400 audit(2000000185.500:661): avc: denied { write } for pid=10086 comm="syz.5.1259" name="ss" dev="configfs" ino=25121 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 339.847181][T10099] netlink: 144 bytes leftover after parsing attributes in process `syz.1.1260'. [ 339.915455][ T30] audit: type=1400 audit(2000000185.500:662): avc: denied { write } for pid=10086 comm="syz.5.1259" name="ss" dev="configfs" ino=25121 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 339.986061][T10105] binder: BINDER_SET_CONTEXT_MGR already set [ 340.018007][ T30] audit: type=1400 audit(2000000185.850:663): avc: denied { write } for pid=10106 comm="syz.1.1266" name="configs" dev="configfs" ino=13961 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 340.054137][T10105] binder: 10104:10105 ioctl 4018620d 200000004a80 returned -16 [ 340.208159][T10114] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1269'. [ 340.220830][ T30] audit: type=1400 audit(2000000186.040:664): avc: denied { write } for pid=10119 comm="syz.2.1271" name="fs" dev="configfs" ino=25120 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 340.253476][T10114] netlink: 'syz.1.1269': attribute type 7 has an invalid length. [ 340.272018][T10122] netlink: 'syz.1.1269': attribute type 1 has an invalid length. [ 340.291210][T10114] netlink: 'syz.1.1269': attribute type 8 has an invalid length. [ 340.298160][ T30] audit: type=1400 audit(2000000186.040:665): avc: denied { write } for pid=10119 comm="syz.2.1271" name="fs" dev="configfs" ino=25120 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 340.343600][T10122] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1269'. [ 340.343732][T10114] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1269'. [ 340.391887][ T30] audit: type=1400 audit(2000000186.040:666): avc: denied { write } for pid=10119 comm="syz.2.1271" name="ss" dev="configfs" ino=25121 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 340.569083][T10135] lo speed is unknown, defaulting to 1000 [ 340.952565][T10160] xt_hashlimit: size too large, truncated to 1048576 [ 341.129191][T10156] lo speed is unknown, defaulting to 1000 [ 341.209295][T10168] netlink: 'syz.5.1289': attribute type 7 has an invalid length. [ 341.225895][T10168] netlink: 'syz.5.1289': attribute type 8 has an invalid length. [ 341.274181][T10171] netlink: 'syz.5.1289': attribute type 1 has an invalid length. [ 341.761572][T10195] Cannot find add_set index 0 as target [ 341.784746][T10195] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 341.969144][T10206] lo speed is unknown, defaulting to 1000 [ 341.980456][T10208] xt_hashlimit: size too large, truncated to 1048576 [ 342.639243][T10237] SET target dimension over the limit! [ 342.648778][T10237] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 342.736005][T10239] binder: BINDER_SET_CONTEXT_MGR already set [ 342.757727][T10239] binder: 10238:10239 ioctl 4018620d 200000004a80 returned -16 [ 343.084477][T10245] syzkaller0: entered promiscuous mode [ 343.121250][T10245] syzkaller0: entered allmulticast mode [ 343.389557][T10266] syz.0.1325: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 343.431267][T10268] kAFS: No cell specified [ 343.445991][T10266] CPU: 1 UID: 0 PID: 10266 Comm: syz.0.1325 Tainted: G L syzkaller #0 PREEMPT(full) [ 343.446025][T10266] Tainted: [L]=SOFTLOCKUP [ 343.446032][T10266] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 343.446043][T10266] Call Trace: [ 343.446050][T10266] [ 343.446058][T10266] dump_stack_lvl+0x100/0x190 [ 343.446089][T10266] warn_alloc.cold+0x94/0xa8 [ 343.446110][T10266] ? __pfx_warn_alloc+0x10/0x10 [ 343.446130][T10266] ? register_lock_class+0x40/0x560 [ 343.446157][T10266] ? kasan_save_stack+0x3f/0x50 [ 343.446179][T10266] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 343.446209][T10266] ? xskq_create+0x52/0x1d0 [ 343.446225][T10266] ? xsk_setsockopt+0x743/0xab0 [ 343.446251][T10266] ? do_sock_setsockopt+0xf3/0x1d0 [ 343.446277][T10266] ? __sys_setsockopt+0x195/0x220 [ 343.446298][T10266] ? __x64_sys_setsockopt+0xbd/0x160 [ 343.446320][T10266] ? do_syscall_64+0x115/0x870 [ 343.446339][T10266] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 343.446364][T10266] ? xskq_create+0xfb/0x1d0 [ 343.446384][T10266] __vmalloc_node_range_noprof+0x136c/0x1630 [ 343.446421][T10266] ? xskq_create+0xfb/0x1d0 [ 343.446446][T10266] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 343.446478][T10266] ? kasan_save_track+0x14/0x30 [ 343.446504][T10266] ? __kasan_kmalloc+0xaa/0xb0 [ 343.446526][T10266] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 343.446557][T10266] ? xskq_create+0xfb/0x1d0 [ 343.446576][T10266] vmalloc_user_noprof+0x9e/0xe0 [ 343.446603][T10266] ? xskq_create+0xfb/0x1d0 [ 343.446622][T10266] xskq_create+0xfb/0x1d0 [ 343.446642][T10266] xsk_setsockopt+0x743/0xab0 [ 343.446670][T10266] ? __pfx_xsk_setsockopt+0x10/0x10 [ 343.446698][T10266] ? find_held_lock+0x2b/0x80 [ 343.446713][T10266] ? __fget_files+0x215/0x3d0 [ 343.446736][T10266] ? selinux_socket_setsockopt+0x6a/0x80 [ 343.446763][T10266] ? __pfx_xsk_setsockopt+0x10/0x10 [ 343.446791][T10266] do_sock_setsockopt+0xf3/0x1d0 [ 343.446819][T10266] __sys_setsockopt+0x195/0x220 [ 343.446848][T10266] __x64_sys_setsockopt+0xbd/0x160 [ 343.446870][T10266] ? trace_syscall_enter+0xe3/0x110 [ 343.446896][T10266] do_syscall_64+0x115/0x870 [ 343.446917][T10266] ? clear_bhb_loop+0x40/0x90 [ 343.446940][T10266] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 343.446959][T10266] RIP: 0033:0x7fb5a3f9e019 [ 343.446975][T10266] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 343.446991][T10266] RSP: 002b:00007fb5a21f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 343.447010][T10266] RAX: ffffffffffffffda RBX: 00007fb5a4225fa0 RCX: 00007fb5a3f9e019 [ 343.447024][T10266] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 343.447035][T10266] RBP: 00007fb5a403500c R08: 0000000000000029 R09: 0000000000000000 [ 343.447047][T10266] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 343.447059][T10266] R13: 00007fb5a4226038 R14: 00007fb5a4225fa0 R15: 00007ffc236e1bf8 [ 343.447086][T10266] [ 343.448685][T10266] Mem-Info: [ 343.661201][T10275] input: syz0 as /devices/virtual/input/input10 [ 343.757056][T10266] active_anon:19699 inactive_anon:6 isolated_anon:0 [ 343.757056][T10266] active_file:21 inactive_file:58277 isolated_file:0 [ 343.757056][T10266] unevictable:768 dirty:406 writeback:0 [ 343.757056][T10266] slab_reclaimable:12068 slab_unreclaimable:100243 [ 343.757056][T10266] mapped:30433 shmem:12049 pagetables:1563 [ 343.757056][T10266] sec_pagetables:0 bounce:0 [ 343.757056][T10266] kernel_misc_reclaimable:0 [ 343.757056][T10266] free:1284952 free_pcp:9934 free_cma:0 [ 343.757144][T10266] Node 0 active_anon:78796kB inactive_anon:24kB active_file:84kB inactive_file:232908kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:121732kB dirty:1624kB writeback:0kB shmem:46660kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13308kB pagetables:6120kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 343.757193][T10266] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:132kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 343.757240][T10266] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 343.757293][T10266] lowmem_reserve[]: 0 2472 2473 2473 2473 [ 343.952779][T10266] Node 0 DMA32 free:1186000kB boost:0kB min:34012kB low:42512kB high:51012kB reserved_highatomic:0KB free_highatomic:0KB active_anon:78996kB inactive_anon:24kB active_file:84kB inactive_file:232908kB unevictable:1536kB writepending:1624kB zspages:0kB present:3129332kB managed:2532116kB mlocked:0kB bounce:0kB free_pcp:40052kB local_pcp:14308kB free_cma:0kB [ 344.078239][T10266] lowmem_reserve[]: 0 0 0 0 0 [ 344.105780][T10266] Node 0 Normal free:0kB boost:0kB min:4kB low:4kB high:4kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:376kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 344.237397][T10266] lowmem_reserve[]: 0 0 0 0 0 [ 344.242313][T10266] Node 1 Normal free:3938448kB boost:0kB min:55880kB low:69848kB high:83816kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 344.290608][T10266] lowmem_reserve[]: 0 0 0 0 0 [ 344.290745][T10295] kAFS: No cell specified [ 344.295426][T10266] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 344.295549][T10266] Node 0 DMA32: 104*4kB (UE) 236*8kB (UM) 23*16kB (UM) 597*32kB (UME) 142*64kB (UME) 17*128kB (U) 22*256kB (UM) 15*512kB (UME) 3*1024kB (ME) 7*2048kB (ME) 274*4096kB (UM) = 1186064kB [ 344.295707][T10266] Node 0 [ 344.332329][ T7270] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 344.343645][T10266] Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 344.369567][T10266] Node 1 Normal: 2*4kB (UM) 7*8kB (UM) 5*16kB (UM) 6*32kB (UM) 7*64kB (UM) 3*128kB (UM) 4*256kB (UM) 2*512kB (M) 1*1024kB (M) 1*2048kB (U) 960*4096kB (M) = 3938448kB [ 344.390975][T10266] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 344.400957][T10266] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 344.408242][T10300] __nla_validate_parse: 12 callbacks suppressed [ 344.408257][T10300] netlink: 144 bytes leftover after parsing attributes in process `syz.2.1339'. [ 344.413623][T10266] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 344.436358][T10266] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 344.445789][T10266] 70345 total pagecache pages [ 344.450547][T10266] 2 pages in swap cache [ 344.454946][T10266] Free swap = 124988kB [ 344.459100][T10266] Total swap = 124996kB [ 344.463617][T10266] 2097051 pages RAM [ 344.467490][T10266] 0 pages HighMem/MovableOnly [ 344.472209][T10266] 432313 pages reserved [ 344.476438][T10266] 0 pages cma reserved [ 344.513074][ T7270] usb 6-1: Using ep0 maxpacket: 32 [ 344.761859][T10318] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1345'. [ 344.990254][ T7270] usb 6-1: unable to get BOS descriptor or descriptor too short [ 345.005096][ T7270] usb 6-1: too many configurations: 80, using maximum allowed: 8 [ 345.053795][ T7270] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 345.089837][ T7270] usb 6-1: can't read configurations, error -71 [ 345.103380][T10332] kAFS: No cell specified [ 345.117417][T10334] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1352'. [ 345.133406][T10336] input: syz0 as /devices/virtual/input/input11 [ 345.139864][T10334] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1352'. [ 345.334906][T10343] SET target dimension over the limit! [ 345.365241][T10343] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1355'. [ 345.384522][T10343] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 345.623791][ T30] kauditd_printk_skb: 23 callbacks suppressed [ 345.623805][ T30] audit: type=1400 audit(2000000191.460:690): avc: denied { create } for pid=10349 comm="syz.0.1358" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=iucv_socket permissive=1 [ 345.642696][T10353] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1359'. [ 345.765391][ T5616] Bluetooth: hci0: unexpected event for opcode 0x0c25 [ 345.897980][T10369] kAFS: No cell specified [ 346.021869][T10377] validate_nla: 3 callbacks suppressed [ 346.021886][T10377] netlink: 'syz.4.1368': attribute type 10 has an invalid length. [ 346.031285][T10372] lo speed is unknown, defaulting to 1000 [ 346.065292][T10377] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1368'. [ 346.546350][ T30] audit: type=1800 audit(2000000192.380:691): pid=10398 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.5.1374" name="idVendor" dev="configfs" ino=33872 res=0 errno=0 [ 346.606299][ T30] audit: type=1800 audit(2000000192.390:692): pid=10398 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.5.1374" name="idProduct" dev="configfs" ino=33874 res=0 errno=0 [ 346.663016][ T30] audit: type=1800 audit(2000000192.440:693): pid=10398 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.5.1374" name="manufacturer" dev="configfs" ino=33877 res=0 errno=0 [ 346.692037][T10398] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 346.738571][T10398] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 346.760200][ T30] audit: type=1800 audit(2000000192.440:694): pid=10398 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.5.1374" name="configuration" dev="configfs" ino=33878 res=0 errno=0 [ 346.782363][T10398] ================================================================== [ 346.782381][T10398] BUG: KASAN: slab-out-of-bounds in dummy_free_request+0x8a/0x90 [ 346.782418][T10398] Read of size 8 at addr ffff88802737d9f0 by task syz.5.1374/10398 [ 346.782434][T10398] [ 346.782448][T10398] CPU: 1 UID: 0 PID: 10398 Comm: syz.5.1374 Tainted: G L syzkaller #0 PREEMPT(full) [ 346.782482][T10398] Tainted: [L]=SOFTLOCKUP [ 346.782488][T10398] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 346.782499][T10398] Call Trace: [ 346.782506][T10398] [ 346.782511][T10398] dump_stack_lvl+0x100/0x190 [ 346.782531][T10398] print_report+0x13d/0x4b0 [ 346.782558][T10398] ? __virt_addr_valid+0x239/0x430 [ 346.782580][T10398] ? dummy_free_request+0x8a/0x90 [ 346.782601][T10398] kasan_report+0xdf/0x1c0 [ 346.782622][T10398] ? dummy_free_request+0x8a/0x90 [ 346.782645][T10398] dummy_free_request+0x8a/0x90 [ 346.782666][T10398] uvc_function_bind+0x181a/0x1939 [ 346.782688][T10398] ? __pfx_uvc_function_bind+0x10/0x10 [ 346.782707][T10398] usb_add_function+0x219/0x890 [ 346.782729][T10398] configfs_composite_bind+0xd83/0x1960 [ 346.782753][T10398] gadget_bind_driver+0x28c/0xbf0 [ 346.782777][T10398] ? __pfx_dummy_udc_set_speed+0x10/0x10 [ 346.782797][T10398] ? __pfx_gadget_bind_driver+0x10/0x10 [ 346.782821][T10398] really_probe+0x241/0xa60 [ 346.782841][T10398] __driver_probe_device+0x20e/0x450 [ 346.782862][T10398] driver_probe_device+0x4a/0x140 [ 346.782881][T10398] __driver_attach+0x21f/0x5b0 [ 346.782900][T10398] ? __pfx___driver_attach+0x10/0x10 [ 346.782918][T10398] bus_for_each_dev+0x13e/0x1d0 [ 346.782933][T10398] ? __pfx_bus_for_each_dev+0x10/0x10 [ 346.782947][T10398] ? bus_add_driver+0x2b5/0x5b0 [ 346.782966][T10398] bus_add_driver+0x305/0x5b0 [ 346.782983][T10398] driver_register+0x1e2/0x360 [ 346.783004][T10398] usb_gadget_register_driver_owner+0x132/0x210 [ 346.783029][T10398] gadget_dev_desc_UDC_store+0x1b0/0x2e0 [ 346.783048][T10398] configfs_write_iter+0x302/0x4e0 [ 346.783068][T10398] vfs_write+0x6ac/0x1050 [ 346.783092][T10398] ? __pfx_configfs_write_iter+0x10/0x10 [ 346.783110][T10398] ? __pfx_vfs_write+0x10/0x10 [ 346.783138][T10398] ksys_write+0x12a/0x250 [ 346.783161][T10398] ? __pfx_ksys_write+0x10/0x10 [ 346.783183][T10398] ? trace_syscall_enter+0xd9/0x110 [ 346.783207][T10398] do_syscall_64+0x115/0x870 [ 346.783225][T10398] ? clear_bhb_loop+0x40/0x90 [ 346.783242][T10398] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 346.783259][T10398] RIP: 0033:0x7f401e39e019 [ 346.783275][T10398] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 346.783293][T10398] RSP: 002b:00007f401f2f7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 346.783311][T10398] RAX: ffffffffffffffda RBX: 00007f401e625fa0 RCX: 00007f401e39e019 [ 346.783323][T10398] RDX: 000000000000000b RSI: 00002000000007c0 RDI: 000000000000000a [ 346.783333][T10398] RBP: 00007f401e43500c R08: 0000000000000000 R09: 0000000000000000 [ 346.783343][T10398] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 346.783353][T10398] R13: 00007f401e626038 R14: 00007f401e625fa0 R15: 00007ffccaac2858 [ 346.783368][T10398] [ 346.783374][T10398] [ 347.097200][T10398] Allocated by task 9850: [ 347.101505][T10398] kasan_save_stack+0x30/0x50 [ 347.106169][T10398] kasan_save_track+0x14/0x30 [ 347.110824][T10398] __kasan_kmalloc+0xaa/0xb0 [ 347.115394][T10398] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 347.120752][T10398] kthread_create_worker_on_node+0xe2/0x220 [ 347.126630][T10398] uvcg_video_init+0x278/0x6e0 [ 347.131372][T10398] uvc_function_bind+0x136e/0x1939 [ 347.136469][T10398] usb_add_function+0x219/0x890 [ 347.141302][T10398] configfs_composite_bind+0xd83/0x1960 [ 347.146828][T10398] gadget_bind_driver+0x28c/0xbf0 [ 347.151838][T10398] really_probe+0x241/0xa60 [ 347.156323][T10398] __driver_probe_device+0x20e/0x450 [ 347.161587][T10398] driver_probe_device+0x4a/0x140 [ 347.166608][T10398] __driver_attach+0x21f/0x5b0 [ 347.171353][T10398] bus_for_each_dev+0x13e/0x1d0 [ 347.176195][T10398] bus_add_driver+0x305/0x5b0 [ 347.180850][T10398] driver_register+0x1e2/0x360 [ 347.185597][T10398] usb_gadget_register_driver_owner+0x132/0x210 [ 347.191822][T10398] gadget_dev_desc_UDC_store+0x1b0/0x2e0 [ 347.197434][T10398] configfs_write_iter+0x302/0x4e0 [ 347.202529][T10398] vfs_write+0x6ac/0x1050 [ 347.206842][T10398] ksys_write+0x12a/0x250 [ 347.211167][T10398] do_syscall_64+0x115/0x870 [ 347.215739][T10398] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 347.221608][T10398] [ 347.223908][T10398] The buggy address belongs to the object at ffff88802737d900 [ 347.223908][T10398] which belongs to the cache kmalloc-128 of size 128 [ 347.237944][T10398] The buggy address is located 120 bytes to the right of [ 347.237944][T10398] allocated 120-byte region [ffff88802737d900, ffff88802737d978) [ 347.252583][T10398] [ 347.254885][T10398] The buggy address belongs to the physical page: [ 347.261269][T10398] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802737da00 pfn:0x2737d [ 347.271308][T10398] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff) [ 347.279351][T10398] page_type: f5(slab) [ 347.283312][T10398] raw: 00fff00000000200 ffff88813fe23a00 ffffea0001454290 ffffea0001df2cd0 [ 347.291875][T10398] raw: ffff88802737da00 0000000800100002 00000000f5000000 0000000000000000 [ 347.300431][T10398] page dumped because: kasan: bad access detected [ 347.306820][T10398] page_owner tracks the page as allocated [ 347.312510][T10398] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 9046, tgid 9044 (syz.2.860), ts 319649292643, free_ts 317855241576 [ 347.333151][T10398] post_alloc_hook+0xfd/0x120 [ 347.337817][T10398] get_page_from_freelist+0xf48/0x3530 [ 347.343255][T10398] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 347.349136][T10398] new_slab+0xa2/0x640 [ 347.353190][T10398] refill_objects+0xe3/0x410 [ 347.357757][T10398] __pcs_replace_empty_main+0x376/0x680 [ 347.363295][T10398] __kmalloc_noprof+0x66d/0x820 [ 347.368124][T10398] hash_ipportnet6_resize+0xe2a/0x1eb0 [ 347.373577][T10398] call_ad.isra.0+0x36d/0x940 [ 347.378235][T10398] ip_set_ad.isra.0+0x3eb/0x8a0 [ 347.383069][T10398] nfnetlink_rcv_msg+0x9d5/0x11e0 [ 347.388073][T10398] netlink_rcv_skb+0x159/0x420 [ 347.392812][T10398] nfnetlink_rcv+0x1b3/0x440 [ 347.397380][T10398] netlink_unicast+0x585/0x850 [ 347.402119][T10398] netlink_sendmsg+0x8b0/0xda0 [ 347.406857][T10398] ____sys_sendmsg+0xa4d/0xbe0 [ 347.411606][T10398] page last free pid 9013 tgid 9013 stack trace: [ 347.417905][T10398] __free_frozen_pages+0x79f/0x1090 [ 347.423092][T10398] qlist_free_all+0x47/0xf0 [ 347.427573][T10398] kasan_quarantine_reduce+0x1a0/0x1f0 [ 347.433009][T10398] __kasan_slab_alloc+0x69/0x90 [ 347.437841][T10398] kmem_cache_alloc_noprof+0x26b/0x6a0 [ 347.443279][T10398] vm_area_alloc+0x1f/0x160 [ 347.447765][T10398] __mmap_region+0x1033/0x2db0 [ 347.452505][T10398] mmap_region+0x35d/0x620 [ 347.456909][T10398] do_mmap+0xc63/0x12f0 [ 347.461056][T10398] vm_mmap_pgoff+0x29e/0x470 [ 347.465626][T10398] ksys_mmap_pgoff+0xe4/0x610 [ 347.470297][T10398] __x64_sys_mmap+0x125/0x190 [ 347.474957][T10398] do_syscall_64+0x115/0x870 [ 347.479528][T10398] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 347.485403][T10398] [ 347.487709][T10398] Memory state around the buggy address: [ 347.493313][T10398] ffff88802737d880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 347.501350][T10398] ffff88802737d900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 347.509386][T10398] >ffff88802737d980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 347.517419][T10398] ^ [ 347.525108][T10398] ffff88802737da00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 347.533144][T10398] ffff88802737da80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 347.541178][T10398] ================================================================== [ 347.559883][T10398] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 347.567113][T10398] CPU: 1 UID: 0 PID: 10398 Comm: syz.5.1374 Tainted: G L syzkaller #0 PREEMPT(full) [ 347.578052][T10398] Tainted: [L]=SOFTLOCKUP [ 347.582397][T10398] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 347.592439][T10398] Call Trace: [ 347.595714][T10398] [ 347.598624][T10398] dump_stack_lvl+0x100/0x190 [ 347.603290][T10398] vpanic+0x552/0x970 [ 347.607255][T10398] ? __pfx_vpanic+0x10/0x10 [ 347.611736][T10398] ? mark_held_locks+0x40/0x70 [ 347.616482][T10398] ? dummy_free_request+0x8a/0x90 [ 347.621492][T10398] panic+0xd1/0xe0 [ 347.625195][T10398] ? __pfx_panic+0x10/0x10 [ 347.629589][T10398] ? dummy_free_request+0x8a/0x90 [ 347.634598][T10398] ? preempt_schedule_common+0x42/0xc0 [ 347.640040][T10398] check_panic_on_warn.cold+0x19/0x34 [ 347.645391][T10398] end_report.part.0+0x3a/0x90 [ 347.650153][T10398] kasan_report.cold+0xe/0x18 [ 347.654817][T10398] ? dummy_free_request+0x8a/0x90 [ 347.659829][T10398] dummy_free_request+0x8a/0x90 [ 347.664662][T10398] uvc_function_bind+0x181a/0x1939 [ 347.669759][T10398] ? __pfx_uvc_function_bind+0x10/0x10 [ 347.675198][T10398] usb_add_function+0x219/0x890 [ 347.680035][T10398] configfs_composite_bind+0xd83/0x1960 [ 347.685568][T10398] gadget_bind_driver+0x28c/0xbf0 [ 347.690580][T10398] ? __pfx_dummy_udc_set_speed+0x10/0x10 [ 347.696199][T10398] ? __pfx_gadget_bind_driver+0x10/0x10 [ 347.701750][T10398] really_probe+0x241/0xa60 [ 347.706238][T10398] __driver_probe_device+0x20e/0x450 [ 347.711519][T10398] driver_probe_device+0x4a/0x140 [ 347.716528][T10398] __driver_attach+0x21f/0x5b0 [ 347.721275][T10398] ? __pfx___driver_attach+0x10/0x10 [ 347.726542][T10398] bus_for_each_dev+0x13e/0x1d0 [ 347.731370][T10398] ? __pfx_bus_for_each_dev+0x10/0x10 [ 347.736717][T10398] ? bus_add_driver+0x2b5/0x5b0 [ 347.741561][T10398] bus_add_driver+0x305/0x5b0 [ 347.746219][T10398] driver_register+0x1e2/0x360 [ 347.750969][T10398] usb_gadget_register_driver_owner+0x132/0x210 [ 347.757209][T10398] gadget_dev_desc_UDC_store+0x1b0/0x2e0 [ 347.762826][T10398] configfs_write_iter+0x302/0x4e0 [ 347.767921][T10398] vfs_write+0x6ac/0x1050 [ 347.772238][T10398] ? __pfx_configfs_write_iter+0x10/0x10 [ 347.777855][T10398] ? __pfx_vfs_write+0x10/0x10 [ 347.782613][T10398] ksys_write+0x12a/0x250 [ 347.786938][T10398] ? __pfx_ksys_write+0x10/0x10 [ 347.791775][T10398] ? trace_syscall_enter+0xd9/0x110 [ 347.796961][T10398] do_syscall_64+0x115/0x870 [ 347.801532][T10398] ? clear_bhb_loop+0x40/0x90 [ 347.806190][T10398] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 347.812079][T10398] RIP: 0033:0x7f401e39e019 [ 347.816474][T10398] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 347.836062][T10398] RSP: 002b:00007f401f2f7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 347.844456][T10398] RAX: ffffffffffffffda RBX: 00007f401e625fa0 RCX: 00007f401e39e019 [ 347.852415][T10398] RDX: 000000000000000b RSI: 00002000000007c0 RDI: 000000000000000a [ 347.860366][T10398] RBP: 00007f401e43500c R08: 0000000000000000 R09: 0000000000000000 [ 347.868315][T10398] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 347.876264][T10398] R13: 00007f401e626038 R14: 00007f401e625fa0 R15: 00007ffccaac2858 [ 347.884219][T10398] [ 347.887423][T10398] Kernel Offset: disabled [ 347.891741][T10398] Rebooting in 86400 seconds..