last executing test programs: 13.907084527s ago: executing program 4 (id=1309): r0 = msgget$private(0x0, 0x40) msgsnd(r0, &(0x7f0000000880)=ANY=[@ANYBLOB="030000000000000089f5bf4221b4eab8e298f075c26c0cee0bc1d744d03563e5105826c5b448a570e8505e081bd6e43d0fa36a526b55d54827544e2d3bf1d3aa057eab761386e4dc8e26df007aa9c6cdf0c6f2d37e0a12237de7bfbe6f6c42ec589a67618e0a27466cfd63a1b331cf52016dff5962f5b59352b2ead223b2436172b16a41dd41f20e6a6f099dbcb49ea1e4ec8568c964528b13b718a9ba38ce734ddaec68bc10f4e9d04b8c72699f9db48e778b41b19d2ce5e2133c3ec2a9812dac22e5c78992d87a3428f6565cfa7dc32dfad20fdd056f85869178e90c59a926bab2148185745f25da0e7d4593d886ec9c2b29bc522e95c2c8217622cc6728f30d7b8a99ba11a03f3ebe00d9d9f2c62bfdf1b97e2ac940fdf746c9a1564f81cfbfbdcfb23be65db7c8240c36f2ef7d4baa1b47b4debb2169d8c2918618bca2a9a2d1904055618ce9780c18195b09c9fa33232e4ca4cb261bbb0cc9921f58d3c870021bd8c918ac41ae6ee3c2a66b808d581b19569babc985c6dee6f1b567d0696e9d4de4b0f178948bbefe058aec79dd8c8a515cc6eff215178c917b99e5974075297fcc8f673366d97bbfad559320a5a76ad03b4935a0c1ec91c2ae5151d49c6e9985f6d4c5aba86f82d3f041a6e396db191eca9cd2d086859cb62d35e476bd867022d0ade6c9961130f997d025b6d5a4b71e5942096ede936ce3fa1bfa250343cb3eecbac08c0c3575f7b32d95fdc214d8bfcb60ead6c0c0aae54aa486a82edb1ece5bd41a4b4a1df4e05df84f8ee6e5c3834ef1da2ef1e622a9fae7fd989a22f9833b04ef8dbe3820ddbbb47c60f65da6ec978da1c1f678c552c8bd0f510f9fa3ecddfb1e72af117b4feb470a11b6616077dd44d506b80385b3b4f8095090e57ee1ce9e401bb2d624e702c899a5df0cd9f0b93a863aa0e8d9ec39f75d967f5b370065e2aacb803bf78d0b2560b2880667fdfed7a28bb14d99392f19978078400ecb5e46707c0dbe503376e021a3d60a6df2e7eb8959fd5b5a55f7a385075547455bfc0c8fe03af58e3a73e2d4865baa0cd8ec350072dd4d29dab4d09e9803af9120db6a36f33f2a20df4c99b9afb37ace0cf08ae6a56f1f72b4ba5daec3aae4f9a0485e38640be9b70042442249d628ad2eac61449fd1db95deedb7a1764998f94408c250ff08ff63683dd26eea34c54bb6d56999b159dfae43a923dd6f6d72e740a7a92ee100b4799e2bbb833b4e01582216a63b1c6af6da1da53bc9d9d0733113b3c4a18ccedc10bba5a47655faac2d33bf89c0aaf47568aaffbe6a4348b09c19461bc66fb2ad00f34743c058caa28a83a53108c5878d048aad64f928228a223fc71683e4391f315cdf9b9a25d9945a65670910f642eba541e8deb08a12735852a3d9641ee4bc595fdfe31c6294df99a221ecfea4f8c7870ad4587914fb84d24172018d943695c44b22f4e422eb814e4962fb281cff747c6f8e05f1b38cabbdc93cbc9888"], 0x401, 0x0) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, &(0x7f0000000440)={'filter\x00', 0xb001, 0x4, 0x3f0, 0x0, 0xe8, 0x0, 0x308, 0x308, 0x308, 0x7fffffe, 0x0, {[{{@arp={@multicast1, @broadcast, 0xff000000, 0xff, 0x9, 0x12, {@empty, {[0x0, 0x0, 0x0, 0xff, 0xff]}}, {@empty, {[0xff, 0xff, 0x0, 0xff, 0xff]}}, 0x0, 0x3, 0x3, 0xa90a, 0x6, 0x3ff, 'veth0_vlan\x00', 'wg2\x00', {0xff}, {0xff}, 0x0, 0x71}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1f8}}, {{@arp={@empty, @loopback, 0x0, 0xffffffff, 0xe, 0x2, {@mac=@local, {[0xff, 0xff, 0x0, 0xff, 0xff]}}, {@mac=@random="8e932bc3db22", {[0x0, 0xff, 0x0, 0xff]}}, 0x0, 0x0, 0x400, 0x4fd9, 0x0, 0x98dc, 'team_slave_1\x00', 'macsec0\x00', {0xff}, {0xff}, 0x0, 0x280}, 0xc0, 0x110, 0x0, {0x0, 0x1e03}}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @multicast2, @loopback, 0xf, 0x1}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x35}, @loopback, @multicast1, 0xf}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x440) r2 = socket$unix(0x1, 0x5, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x60, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, 0x0, 0x0) syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x80) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2000001, 0x11, 0xffffffffffffffff, 0xc10c3000) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000580)="d4fa0c511aad03aa5ed217677bc41c027d9c830c439c7f821ddd78b6915cb170e7603acf9e433c2903bb6773f4b0130668a1e5b5e08d21d0b69c28ca3455aed65855c86f3d1e5789d26375a0d85eaf5e92e19c9affcf76e7a94e76556d2b104ebf645747fadc91460f4b3c94e1a89b51be4a6aa4c65285f988329a8163b69c51b801500a5bacd0463976e2960e2679ef2feee5e6ce6bb78a51fb0e15820d13e4a5aa9e0742a6f8d677ad28fea356657bb550c8311b682d9003c82267a15aa7334bc53b65b9119a1a7d905c7dd365b85c230bbad0d5d0a79819e112637819d9a187cfdf782c6127d2d4281926ab0e22f7346b616fe28ed0b9f4a0c9fdac6d3a90a9c38b5e31448a45546388c95045bc22fe88c43b82a0a5d3eb61c238a5159ea98db9c00aeef644ae98a8cb8dffff3b7ba14d7971910b559623af8295", 0x13c}], 0x2, 0x0, 0x48}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000400)="14", 0x2, 0x0, 0x4}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8b18, &(0x7f0000000000)={'wlan0\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@newlink={0x3c, 0x10, 0x1, 0x70bd28, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x153da}, [@IFLA_VFINFO_LIST={0x8, 0x16, 0x0, 0x1, [{0x4, 0x3f}]}, @IFLA_IFNAME={0x14, 0x3, 'wlan0\x00'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000880}, 0xc094) socket$xdp(0x2c, 0x3, 0x0) unshare(0x6a040000) msgctl$IPC_RMID(r0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0xf, 0x4, 0x4, 0x812}, 0x50) 10.344249356s ago: executing program 4 (id=1314): openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x88002, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x0, 0x0, &(0x7f0000000200)={0x7f, 0x4, 0x7, 0x9, 0x5, 0x6c8, 0x100000000, 0x1}, &(0x7f00000002c0)={0x9, 0x9, 0x8, 0xfff, 0xf5, 0x0, 0x5c11, 0x7}, &(0x7f0000000300)={0x77359400}, &(0x7f00000003c0)={&(0x7f0000000380)={[0x9]}, 0x8}) setsockopt$inet6_tcp_int(r0, 0x6, 0x22, &(0x7f0000001680)=0x1, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_open_dev$loop(&(0x7f0000000180), 0x75d, 0x2480) bind$inet6(r0, &(0x7f0000000240)={0xa, 0x4e20, 0x9, @loopback, 0x5}, 0x1c) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000040)={0x2, 0x4, @dev={0xac, 0x14, 0x14, 0x12}}, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000400)={'vlan0\x00'}) sendmmsg$inet(r4, &(0x7f00000051c0)=[{{&(0x7f0000000280)={0x2, 0x4e21, @multicast2}, 0x10, &(0x7f00000050c0)=[{&(0x7f0000000340)="67d628c20f6a631cc7", 0xffe3}], 0x1}}], 0x1, 0x0) (fail_nth: 7) sendmmsg$inet6(r0, &(0x7f0000000140)=[{{&(0x7f0000000100)={0xa, 0x4e20, 0x2, @empty, 0xfffffffe}, 0x1c, &(0x7f0000000b40)=[{&(0x7f0000000a40)="fb", 0x1}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x20080058) 10.165676312s ago: executing program 2 (id=1315): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x800000000, 0xf, &(0x7f0000006680)) (async) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x800000000, 0xf, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c00000004000000000000000000000f04"], 0x0, 0x28, 0x0, 0x0, 0x9}, 0x28) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) chroot(&(0x7f0000000000)='./file0\x00') 9.71033296s ago: executing program 0 (id=1317): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) r1 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r1, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x1c) syz_emit_ethernet(0x36, &(0x7f0000001800)={@link_local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x64, 0x0, 0xa, 0x2, 0x0, @empty=0x2000000, @multicast2}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x10001}}}}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) close_range(r0, 0xffffffffffffffff, 0x200000000000000) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x104, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x1, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, 0x0, &(0x7f0000000500)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x80000, 0x1000000, 0x33d, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffffff, 0x20, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6a6c, 0x6449, 0x0, 0xfffffffd, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0x40, 0x2, 0xffffffff}}], 0x1, 0x0, 0x0) 9.248141165s ago: executing program 0 (id=1318): openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x40, &(0x7f0000000200)={0x11, 0xd, 0x0, 0x1, 0x0, 0x6, @random="180008000001"}, 0x14) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) socket$xdp(0x2c, 0x3, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_open_dev$MSR(&(0x7f00000000c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) capset(&(0x7f0000000100)={0x20071026}, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) write$sndseq(r2, 0x0, 0x0) write$P9_RVERSION(0xffffffffffffffff, 0x0, 0x500) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r3) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x1d) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, 0x0) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(0xffffffffffffffff, 0x7a5, &(0x7f0000000180)={{@my=0x0}, 0x0, 0x1, 0x1}) ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(0xffffffffffffffff, 0x7a6, &(0x7f0000000040)={0xc, 0xe, 0x200000, 0x4, 0x6, 0x7}) dup2(0xffffffffffffffff, 0xffffffffffffffff) 8.931652544s ago: executing program 4 (id=1320): connect$unix(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) syz_open_dev$video(&(0x7f0000000000), 0x8, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x6, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0x1, 0xffffd3f4, 0x7fffffff, 0x2, 0x80007, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x5, 0x3, 0x0, 0x5, 0x24, 0x1, 0x0, 0x3c5b, 0x1, 0x24, 0x6, 0x1, 0x5, 0xffffffff, 0xe661, 0x4, 0x7, 0x89d2, 0x8, 0x4c74, 0x80000000, 0x40000, 0x3, 0x0, 0x0, 0x80008071, 0x7, 0x17, 0xd, 0x407, 0x5, 0x3a, 0x8f, 0x4006, 0x6, 0x80000000, 0x0, 0x4, 0x8, 0x400, 0x80, 0x0, 0x4, 0x7, 0x8, 0x4, 0xfffffffe, 0x40], [0x10000007, 0xf0000000, 0x8000012f, 0x8004, 0x5, 0x6, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0x10, 0x315, 0xd, 0xea4, 0xffffffff, 0x4, 0x7, 0x7fff, 0x5a7c, 0x420, 0x401, 0x6, 0x0, 0xff, 0x1, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x20009, 0x8, 0x9, 0x9, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0xfffffffe, 0x7, 0x9, 0x5, 0x3, 0x4, 0x1, 0x3, 0x6c0, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x1, 0x8004, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x5, 0x9, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x10000, 0x3, 0x5, 0x2, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x4, 0x800003, 0x200, 0x7e, 0x7, 0x4, 0x2950bfaf, 0xffe, 0xa2, 0x7, 0xa9, 0x5, 0x9, 0xac8, 0x2000af, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0x0, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2004, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0x8000b, 0x8, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0x9, 0x2, 0x57, 0x451, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0xffff, 0x2000a620, 0x2, 0x5, 0x1, 0x2, 0x5, 0xe7, 0x6, 0x16, 0xfffffffe, 0x80000003, 0x6, 0x4, 0xc8, 0x29, 0xfffff000, 0x10003, 0x3, 0x7e, 0xfd, 0x9602, 0x7, 0xaf, 0x8, 0x6, 0xffffffff, 0x5, 0x5, 0x8, 0x30b1d693, 0x5, 0xf40, 0x7, 0x1, 0x1000, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfffd, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='clear_refs\x00') writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) 7.860834778s ago: executing program 0 (id=1322): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000180)=0x1000000, 0x4) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000500)={{{@in=@multicast2, @in=@broadcast, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x2}, {0x0, 0x0, 0xfffffffffffffffc, 0x101}, 0x0, 0x0, 0x1, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@multicast1, 0x0, 0x2, 0x3, 0xbb, 0xfffffffe, 0x7}}, 0xe8) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x1c) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4000c}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BR_GROUP_ADDR={0xa, 0x14, @broadcast}]}}}]}, 0x40}}, 0x4040) 7.541462375s ago: executing program 2 (id=1323): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="c4000000190001002dbd700000000000fe88fffa000000000000000000000001ac14142500000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32], 0xc4}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd2d, 0x25dfdbfe, {{@in6=@local, @in6=@local, 0x0, 0x0, 0x0, 0x102, 0xa, 0x20, 0x30, 0x3a, 0x0, 0xffffffffffffffff}, {0x2, 0xc, 0x0, 0x9, 0x4, 0xffffffffffffffff}, {0x0, 0x800000000000a00, 0x80000003, 0x800000000000002}, 0x0, 0x0, 0x1, 0x1, 0x2}}, 0xb8}}, 0x0) r2 = socket$kcm(0xa, 0x5, 0x0) sendmsg$kcm(r2, &(0x7f00000003c0)={&(0x7f0000000040)=@in6={0xa, 0x4e23, 0xd, @local, 0x7}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000000)="f1", 0x1}], 0x1}, 0x40040) 7.390243654s ago: executing program 1 (id=1325): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000002000), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000002180)={0x0, 0x0, &(0x7f0000002140)={&(0x7f00000004c0)={0x28, r1, 0x47918d5eb2b4e5e9, 0x70bd28, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x40884) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_PMKSA(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x58, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_PMKID={0x14, 0x55, "f7f8e05e18006b5c49148e65e7766136"}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x8f52}, @NL80211_ATTR_PMK={0x14, 0xfe, "5d2463cbe777bbcfd783c11f7597206c"}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}]}, 0x58}}, 0x0) 6.933582814s ago: executing program 2 (id=1326): socket$pppoe(0x18, 0x1, 0x0) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_emit_ethernet(0x1f, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaab284aaaa00000000420300404000000062cf00bc6ebd7c39"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r0 = socket(0x9, 0xa, 0x3) accept(r0, 0x0, &(0x7f00000003c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_emit_ethernet(0x4e, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x0) syz_open_dev$vbi(&(0x7f0000000040), 0x0, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0a000000040000000600000080"], 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x6, r2}, 0x38) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$F2FS_IOC_RESERVE_COMPRESS_BLOCKS(r3, 0x4008af25, &(0x7f00000000c0)) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x10, 0x4, 0x8, 0x5}, 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001f40)={0xb, 0xc, &(0x7f00000006c0)=ANY=[@ANYBLOB="1800000000000000000000004b0778d418110000eb757e2cb881f263303202377e1eaa33fc95407cf4b91b18e7435bae06c377c7c09c8a64384635c37dee9f", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095", @ANYRES8=r1], &(0x7f0000000180)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7cd85a90}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r4}, &(0x7f0000000080), &(0x7f0000000240)=r5}, 0x20) r6 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000140)={0xffffffffffffffff}, 0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000400)={r6, 0x18000000000002a0, 0xe, 0x0, &(0x7f00000005c0)="b9ff03076804268c989e140500c9", 0x0, 0x1, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xa}, 0x50) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) process_vm_writev(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mount(0x0, 0x0, &(0x7f00000000c0)='nfs\x00', 0x0, &(0x7f0000000280)='\x02\x00\x00\x00\x04\xb0\xfe\x98\x9a!s\x91]\xab\xc9\xa2IV\xb6-\xbfS\x16 \x04\r\xcd\xdb\x9a\xd4\xaf\r\x11\xa0\xd7\xd7\xb6\x9bz\x99\xaf\xfd\x87fN\xad\x90U\xb4A\xdf\xabB\xbba\x7f\xb8\x96\x1a\xe7\xc1\xab\x16\x02\x00\xfaC\x93\xc0S\xaf\f\x1a\fEik\x86\x15\xab\x909\xf8i\xc0\xa7\xa9\xb1\xbe\xc7\x1d\xe0\x18\xd2\xbaG|\xd5fC\x8d\t\x00/I\x8b\xbf\x94\xf4\x96[us\x96\x90\x8d\x9d\xfb\xdc\x7f0&\xab\x17@)\xf1\xc3Q\xb2M :\xaa\x99G\xdd\xa9E6A]@>\f\xb1n\x1a\x8c\xc6e7{@\x90\x8fz\xfcf\x88\x15A\x0e\xbf\xb8\xff\xa8\xb9\xab\x83>\xf9I0\xdd\x93#\x1e\x00\xed#\xc9\xd0Uk\xa6b\xa6/\x15\x92\xc6,p\xc9\xce\xe1\xc3\xd5\x89Lw\x17\x16\x18\xddh\xc8\x81w\x1e\x7f\xc7\x16\xe5\x96\x03\t\xc3\x94\xc7\xeb\xd6.\xfa\xb3\xe0\x1f\xa9\x19\xfaS\x1f[T\x1e\xc5nX\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00=0\xc3\xbc\xfd\xce~\xe3\xcaO\"\xbb\xd1\x15\xf2y\xb91\x1d\xab\xeaO\x19\rH4\xc2\xe4\x922~K^K`55\xb7\xd1\n\xba\xb7,\xdb\xc2\x86\xc30bnc\x06\x06q\xe9\x97\fHA<\x94`\xf7H?\x86\xb8C9\b\x18vFWRdNee\xf1A\x06\x8f\x97\x99\xa5A\xfa\x94IfB\xa9\xf5\xd8\x83\xc5\b\x0eL\\Z\x80](f6D\x1a\xf7si\xa4l\xa8\x0f\xcc\xa1\xef\x1bCq\x0e\xf87\xfc\xce\x96cm\x83\x05S\x01Zj`dP:d\xba\x02\x14\xaa\x051\xd7\x87\x1b\xcb\xa2.\x89\x16CRx\x9b\x04\x1f\x8fA\t<\x99/\'tk\xcb\xd7|\x0f\xc9m\x95\x9a\n\v&\xca\xcd\x11\xec\xfd\x17a$.\xe9\x14\x8f\n\x15\x8d\rJ\x99\x8a\x87\x81\xc4S\x85L\xe5w\xa1\xbf\x91Q&6\x8e\xd1\x02\x19K\xd3\xab\xe5\xdc\xac\x05\x8dQ\xf4\x1aa\x86\xbc6\\\x06\xdf\x84\x00+F|\xa6\xc4\xab\x00G\xd0\x14N+\xf9\x84i?C\x81\x8eu\xd3\xcbg\xb7\a\xd9\x9a*\x17>\xac\x9d\x9d\xf6\t\xd8b\x19\x8a\x1e&\xde\x87-%\xf3\x8a2L\x1cQ2\f\x94\xf7\xf9\xadI\xedU\xabr\xe2\xe1\xc2{\b\xa8\xc2\n4\x0f\'\xed\xcc\xd7qG\xa7p\x8ct\xe3/l\v\x93\x8a\x95R\xd6\x19L\x85\x80\x18\x15\xcezn\xa8,i\xf1\x91@\xc0\xb1\a\xfd\xec\x95>\b(\xfa~O\xfd\xe2\a6b\x97\xc6$?;\x8eJ/P\x9d\x17\xaaU\xc4\b') r7 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) r8 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/stat\x00', 0x0, 0x0) sendfile(r7, r8, 0x0, 0x20000023896) 6.857939246s ago: executing program 1 (id=1327): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x46d, 0xc295, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xb0, 0xa, "", [{{0x9, 0x4, 0x0, 0xfe, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x83, 0x5, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x8, 0xc1, 0xe}}}}}]}}]}}, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) futex(&(0x7f0000000000), 0x8c, 0x1, 0x0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="200328"], 0x0, 0x0, 0x0, 0x0}, 0x0) 4.819483486s ago: executing program 2 (id=1330): r0 = syz_open_dev$sndpcmp(&(0x7f0000002000), 0x5d5d, 0x0) ioctl$SNDRV_PCM_IOCTL_DRAIN(r0, 0x4144, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x6d) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000f80)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x70b, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x7}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_TYPE={0x8}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x64}, 0x1, 0x0, 0x0, 0x4054}, 0x4040000) (fail_nth: 2) 4.720966281s ago: executing program 3 (id=1331): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000580)) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000480)={0x24, r1, 0x1, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x8}]}, 0x24}}, 0x80) 3.887751554s ago: executing program 3 (id=1332): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x200000}, 0x1c) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000240), 0x400000) sendto$inet6(r0, &(0x7f0000000500)='O', 0xfe6a, 0x80, &(0x7f0000000280)={0xa, 0x0, 0xfffffffe, @private2={0xfc, 0x2, '\x00', 0x1}, 0x1}, 0x1c) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b142b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c04594282423424d00", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) shutdown(r0, 0x1) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000000)={0x0, 0x3}, 0x8) socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r1, 0x0, 0x0) syz_usb_control_io$rtl8150(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$rtl8150(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$rtl8150(0xffffffffffffffff, 0x0, 0x0) ioctl$CEC_TRANSMIT(0xffffffffffffffff, 0xc0386105, &(0x7f0000000100)={0xfffffffffffffbf6, 0x458, 0x2, 0xe6fe, 0x4, 0x7ffe, "7f2c01000000e8ff00", 0x1, 0x56, 0x9, 0xfa, 0x9, 0x1}) fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) r2 = socket(0x2a, 0x2, 0x0) getsockname$packet(r2, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xd}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x1, 0x2, 0x3, 0xfffffff9, 0x9, 0x101, 0x2, 0xffff}}}}]}, 0x58}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd2d, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {0xe, 0x6}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_basic={{0xa}, {0x8, 0x2, [@TCA_BASIC_POLICE={0x4}]}}]}, 0x38}}, 0x34004800) r4 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$L2TP_CMD_SESSION_GET(r4, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x4c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0xf394}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x8001}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x14000804}, 0x10) sendmsg$IPSET_CMD_DESTROY(r5, &(0x7f00000001c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f00000003c0)={0x3c, 0x3, 0x6, 0x301, 0x0, 0x0, {0x7, 0x0, 0x6}, [@IPSET_ATTR_SETNAME={0x0, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8c0}, 0x20004054) sendmsg$NFT_BATCH(r5, &(0x7f0000000580)={0x0, 0x58, &(0x7f0000000040)={&(0x7f0000000740)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a70000000060a010400000000000000000200000344000480400001800e000100627974656f726465720000002c0002800800014000000001080002400000000a080004400000009b080003400000001108000540000000020900010073797a30000000000900020073797a32"], 0x98}, 0x1, 0x0, 0x0, 0x24080}, 0x44000) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000200)={0x1, &(0x7f00000002c0)=[{0x3684, 0x7, 0x4, 0x9}]}) close_range(r6, 0xffffffffffffffff, 0x0) 3.793969516s ago: executing program 0 (id=1333): socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x8}, 0x48) socket$igmp(0x2, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000780)={0x60, 0x887}, 0x0) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fcntl$notify(r2, 0x402, 0x22) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fcntl$notify(r3, 0x402, 0x40000000) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1\x00', 0x40) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1a0) mount$overlay(0x0, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b7030000000000fd850000007100000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$FE_READ_UNCORRECTED_BLOCKS(r9, 0x80046f49, &(0x7f00000001c0)) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000bc0)={r8, 0x0, 0x0}, 0x10) r10 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r1, @ANYBLOB="00000000100000001c001a80080002802d07420008000200", @ANYBLOB="358749"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) 3.761786713s ago: executing program 4 (id=1334): r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) write$cgroup_int(r0, &(0x7f0000000440)=0x4, 0x12) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x3, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) r2 = msgget$private(0x0, 0x4d2) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) msgctl$IPC_INFO(r2, 0x3, &(0x7f0000002e00)=""/4096) ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, &(0x7f00000019c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_COPY(0xffffffffffffffff, 0x3b83, &(0x7f0000001a00)={0x28, 0x4, 0x0, r3, 0x6, 0x1, 0x8}) r4 = getpid() mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xc0) mount(0x0, 0x0, 0x0, 0x1214040, 0x0) getdents64(0xffffffffffffffff, &(0x7f0000001dc0)=""/4106, 0x100a) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x4200, 0x0) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x20000023896) ptrace$setregs(0xd, r4, 0x5, &(0x7f0000000080)="2f40fd5826f0a61617757e94eb418b75ece63269e52a8e4446698ffe894b70380196a8dc6c6818c640fc39d511ec772df13dd2ad9a461ca8a244a1e7fb18828992f8f026f9cde4e4ed3d0ed63a7bbbc27ab84f0855fd5229f53ec218402ed1699c16e50ec225e66656476e317ccdc4862645980fa0b1ce777aec6830ddf9f6735071e84f6e4fd4db88baae0d7599e77d57d84d28ece362c179004e8c349c3c75cb64a3238e2e6ede08e36eaf27a76ca5e617f04b0cded4d62e021f4911868aad40d48dc4427b21d744a7b30b93b40ee6070ff2e3e57f3cc1da3f4c") 3.354210821s ago: executing program 1 (id=1335): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_CREATE(0x0, 0x0, 0x48) ioprio_set$pid(0x1, 0x0, 0x0) io_submit(0x0, 0x2000000000000211, &(0x7f0000000840)=[&(0x7f00000004c0)={0x0, 0x0, 0x0, 0x8, 0x9, 0xffffffffffffffff, 0x0}]) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x6, 0xe, &(0x7f0000000380)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x9}, [@call={0x85, 0x0, 0x0, 0xc1}, @exit, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x9}}]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000080), 0x900, 0x0) ioctl$FBIO_WAITFORVSYNC(r3, 0x40044620, 0x0) 2.547849112s ago: executing program 0 (id=1336): r0 = syz_open_dev$sndpcmp(&(0x7f0000002000), 0x5d5d, 0x0) ioctl$SNDRV_PCM_IOCTL_DRAIN(r0, 0x4144, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x6d) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000f80)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x70b, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x7}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_TYPE={0x8}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x64}, 0x1, 0x0, 0x0, 0x4054}, 0x4040000) 2.441435067s ago: executing program 4 (id=1337): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="c4000000190001002dbd700000000000fe88fffa000000000000000000000001ac14142500000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0xc4}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd2d, 0x25dfdbfe, {{@in6=@local, @in6=@local, 0x0, 0x0, 0x0, 0x102, 0xa, 0x20, 0x30, 0x3a, 0x0, 0xffffffffffffffff}, {0x2, 0xc, 0x0, 0x9, 0x4, 0xffffffffffffffff}, {0x0, 0x800000000000a00, 0x80000003, 0x800000000000002}, 0x0, 0x0, 0x1, 0x1, 0x2}}, 0xb8}}, 0x0) r2 = socket$kcm(0xa, 0x5, 0x0) sendmsg$kcm(r2, &(0x7f00000003c0)={&(0x7f0000000040)=@in6={0xa, 0x4e23, 0xd, @local, 0x7}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000000)="f1", 0x1}], 0x1}, 0x40040) 2.282560207s ago: executing program 1 (id=1338): syz_open_dev$mouse(&(0x7f0000000000), 0x0, 0x30140) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40008d0}, 0x40) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000600)=@deltfilter={0x24, 0x2d, 0x300, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x9, 0xe}, {0x8, 0xffe0}}}, 0x24}}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={0x0}}, 0x20004015) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r2, 0x84, 0x1e, &(0x7f0000000180), &(0x7f0000000380)=0x4) r3 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000200)) r4 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$inet6_opts(r4, 0x29, 0x37, &(0x7f0000000140)=@fragment={0xb6, 0x0, 0x92, 0x0, 0x0, 0x1b, 0x65}, 0x8) sendto$inet6(r4, 0x0, 0x0, 0x40000844, &(0x7f0000000040)={0xa, 0x4e23, 0xffffff7b, @loopback, 0xf}, 0x1c) sendmsg$TIPC_NL_MEDIA_GET(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)={0x54, 0x0, 0x8, 0x70bd2c, 0x25dfdbfb, {}, [@TIPC_NLA_MEDIA={0x40, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x24f7}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x80}, 0x54) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) r5 = dup2(r3, r3) getrlimit(0x5, &(0x7f00000003c0)) ioctl$VHOST_VSOCK_SET_RUNNING(r5, 0x4004af61, &(0x7f0000000000)=0x5) 2.282131425s ago: executing program 3 (id=1339): r0 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@getqdisc={0x28, 0x26, 0x55791b1837eb8b3d, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x5, 0xfffd}, {0x10012, 0xe}, {0x10, 0xfff1}}, [{0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x10}, 0x10) 1.988414146s ago: executing program 3 (id=1340): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000047000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a876d839240d29c035055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7e8dc34f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bb44b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334583239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd713089856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bf4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff22dc508afc9ffc2cc788bee1b47683db01a469398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd360000000000000000ae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae526aca54183fb01c73f979ca9857399537f5831808b0dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c97a088a22e8b15c3e233db00002e30d46a0024d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e4845535a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c29c5c0ed5bcdf510c3c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9003f07000099d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ced92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f68fa8d7c2dfb28e1f05e46b0933c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d588afd80e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a93466ae595c6a8cda6900002a070886df42b27098773b45198b4a34ac97febd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d63521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a8639034a75f4c7df3ea8fc2018d07afef12ef060cd4403a099f32468f658000b4082d43e12186195cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea209b53b230ef0f2ab85cbdac0000000000000000ca06f256c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bd3339403004b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab900000000000000000000d71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdbf24a0c5441ce046078492b53467cfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89cb349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce1d9bc7ef3e3f40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb15f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c00c57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137df47257f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b558982016b0679b5d6fccbecfae5553d9950d48c774eaa35b24fce69a20d8b49e3d0168bf7eac90529cd6af061c9e53addddc620ce73c5d177e3d097159f2768636fc10276c6a0adc57483b3f7083f66b87ef296ee85a3009a5d30f479e293a3302e11350ea857b37e76ca3f50378e4092ce2c574ad278b9b7b717c571afb2077b019fd9d89efd59b41f051ec5a8ff87ecc8df917a1e386d849fcd10e2f9ca52e02339c2f4666b0c8ffe0d508dcee3070e8b42ac38545e25f1cd62421c28d25994be0cff7271a0dee38d7ac4ac736b090e1d29f98117919472b61b20026d7e646174b55d251f7f8ca5ccc22a5efb33b217eff5597a3c3a5f3a9bb54abb40e54593e1a7ce4cfa17b3c3fe91c06363496341eae20dcc59b6179b32ddddef5c34000096a54c0c571a91878f61f74912e2299e5501d4d6943bfd74c856511726f0ac8f7d17f1c6b4451c1bcdc6b6e1700e4cd87709d97afc5423c96fa981873d4369b04bbf1fb9f68f17991540868e408201ad1a74179e489aa61f021a437a3fa935588be2068f7ff9b253106326fde795e530b93626cc68e06e602198724249b4444e69902e4d8f5da4e94cc36794258fd4032de7ab36bc24000000000000000000000000000000000000cd3211b3842b68a4eddca2eae28529e97a98d7ec3fd902df1ba8fc2ad2377e72d4e7aeacbbccef5614cd965511558f40720025c022bc9c213e407f6bc4b673c55aa8e729299a37fd6339acd906ac861ba56c9fa9b8b12b5e68a3cdadb906355e1f1d336a243172affe50d0fb36c3718a7498eed3d398f405a34d494414e87ef1ce1845510d43d00171d6b4b762f89564c22d542a119878709cd6822c3a3eb47a849b0737929fe9e1eecd1bff5a2b9880e2a6d8a3b3b7e88a673c96cda4455eff1c530db0e6598a2686aa09aeaf0f1aed95aeb8b0a2cc5ca31c0f56285cc05f7090a0e0583cf540d18cd8817e685c7b4ff176178ac1234f23e54445ec20b2689832d78409897a0307e89ebcd5f4ba042a3d10237a5a8a9a6eda36d2f337dc54537b80e8433341b135b4c5bb0173ffde46ccd260e1d4f2c51e8b07bb256f1317912cb1fc9e491e0bb9109e475cc795c23ad9f4f0042c5e9c655a4d865bc4a266e6a1d3d2b7ee53be9efb33a98933b5ba74ee3ac8d34b6af8c1fdbffade3abc80842b74354162f5b994ab5254cb068bc5e2ae242a1d37d0d49947c9317fa1a46c9e259ce0e1f9db992c53f7830a5e8f4fac6b187eb9f15ba61f730f86d7d7b63bbc7a1d9ff37e87a90a14e0655304da069f9009b62717649b6c6af94fcba713f8ee6fcce25aef44d009966614b61be9369ffc589a79051b0a0000000000000003ebd34c41afe268c33c9322c3a783772aec998f51a6e70fb932a8019e72ef5ab127bb30c79ebfd867441083546305fb39449c40a166ea389a6b77b7c87f66e8bf5806726b8fc50b943627314803a12c33312dce0a10f852da3e000000"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x7}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001b80)={r0, 0x18000000000002a0, 0xf, 0x0, &(0x7f0000001640)="0c007f00e0ffffff007fb6adc76cec", 0x0, 0x127, 0x60000009, 0x0, 0x0, 0x0, 0x0}, 0x50) (fail_nth: 7) 1.6536494s ago: executing program 4 (id=1341): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) dup(0xffffffffffffffff) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x8801}, 0x0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f0000000240)={'mangle\x00', 0x0, [0x9, 0x9, 0x80000000, 0xff, 0x3ff]}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() syz_emit_ethernet(0x5a, &(0x7f0000000000)={@broadcast, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0xe0, 0x0, 0xe000, {0xc, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty=0xac1414aa, @rand_addr, {[@timestamp_prespec={0x44, 0x1c, 0x0, 0x3, 0x0, [{@private}, {@local}, {@remote}]}]}}}}}}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) connect$unix(r3, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = syz_init_net_socket$llc(0x1a, 0x802, 0x0) close(r4) removexattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)=@random={'os2.', '\x00'}) 973.83787ms ago: executing program 2 (id=1342): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000580)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000480)={0x24, r1, 0x1, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x8}]}, 0x24}}, 0x80) 968.700022ms ago: executing program 3 (id=1343): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @remote}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r1 = memfd_secret(0x80000) openat(r1, &(0x7f0000000080)='./file0\x00', 0x402000, 0x10) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getpid() prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102400, 0x19000) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) flock(0xffffffffffffffff, 0x6) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_SET(r4, 0x4b6a, &(0x7f0000000040)={0x200f, 0x200d, 0x2000d, 0x7, 0x200c, 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@getqdisc={0x28, 0x26, 0x55791b1837eb8b3d, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x5, 0xfffd}, {0x10012, 0xe}, {0x10, 0xfff1}}, [{0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x10}, 0x10) bind$bt_hci(r2, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r2, &(0x7f0000000000), 0xd) 938.500247ms ago: executing program 2 (id=1344): connect$unix(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) syz_open_dev$video(&(0x7f0000000000), 0x8, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x6, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0x1, 0xffffd3f4, 0x7fffffff, 0x2, 0x80007, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x5, 0x3, 0x0, 0x5, 0x24, 0x1, 0x0, 0x3c5b, 0x1, 0x24, 0x6, 0x1, 0x5, 0xffffffff, 0xe661, 0x4, 0x7, 0x89d2, 0x8, 0x4c74, 0x80000000, 0x40000, 0x3, 0x0, 0x0, 0x80008071, 0x7, 0x17, 0xd, 0x407, 0x5, 0x3a, 0x8f, 0x4006, 0x6, 0x80000000, 0x0, 0x4, 0x8, 0x400, 0x80, 0x0, 0x4, 0x7, 0x8, 0x4, 0xfffffffe, 0x40], [0x10000007, 0xf0000000, 0x8000012f, 0x8004, 0x5, 0x6, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0x10, 0x315, 0xd, 0xea4, 0xffffffff, 0x4, 0x7, 0x7fff, 0x5a7c, 0x420, 0x401, 0x6, 0x0, 0xff, 0x1, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x20009, 0x8, 0x9, 0x9, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0xfffffffe, 0x7, 0x9, 0x5, 0x3, 0x4, 0x1, 0x3, 0x6c0, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x1, 0x8004, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x5, 0x9, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x10000, 0x3, 0x5, 0x2, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x4, 0x800003, 0x200, 0x7e, 0x7, 0x4, 0x2950bfaf, 0xffe, 0xa2, 0x7, 0xa9, 0x5, 0x9, 0xac8, 0x2000af, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0x0, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2004, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0x8000b, 0x8, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0x9, 0x2, 0x57, 0x451, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0xffff, 0x2000a620, 0x2, 0x5, 0x1, 0x2, 0x5, 0xe7, 0x6, 0x16, 0xfffffffe, 0x80000003, 0x6, 0x4, 0xc8, 0x29, 0xfffff000, 0x10003, 0x3, 0x7e, 0xfd, 0x9602, 0x7, 0xaf, 0x8, 0x6, 0xffffffff, 0x5, 0x5, 0x8, 0x30b1d693, 0x5, 0xf40, 0x7, 0x1, 0x1000, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfffd, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='clear_refs\x00') writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) 892.874421ms ago: executing program 1 (id=1345): syz_usb_connect(0x3, 0x36, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="900000", @ANYBLOB="010026bd7000000000003b00000008000300", @ANYRES32=r1, @ANYBLOB="0600cd00000000006c00"], 0x90}, 0x1, 0x0, 0x0, 0xc0}, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, 0x0) r2 = socket(0x11, 0x2, 0x0) setsockopt(r2, 0x108, 0x1, &(0x7f00000001c0)="17c20000000040000000", 0xa) r3 = userfaultfd(0x801) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000300)={{0x0, 0x2, 0x3}}) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x183c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f0000000340)={0x750, 0x0, 0x0, 'queue0\x00', 0x5}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r4, 0x40605346, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(0xffffffffffffffff, 0x54a0) ioctl$RFKILL_IOCTL_NOINPUT(0xffffffffffffffff, 0x5201) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000001c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r3, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000779000/0x1000)=nil, 0x400000, 0x4000, 0x2}) 458.715767ms ago: executing program 0 (id=1346): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x8}, 0x48) socket$igmp(0x2, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000780)={0x60, 0x887}, 0x0) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fcntl$notify(r3, 0x402, 0x22) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fcntl$notify(r4, 0x402, 0x40000000) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1\x00', 0x40) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1a0) mount$overlay(0x0, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b7030000000000fd850000007100000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$FE_READ_UNCORRECTED_BLOCKS(r10, 0x80046f49, &(0x7f00000001c0)) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000bc0)={r9, 0x0, 0x0}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r2, @ANYBLOB="00000000100000001c001a80080002802d07420008000200", @ANYBLOB="358749"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) write(r0, &(0x7f0000000000)="2400000011005f0414f9f40700090400810000000d0000000000000008000f0001000000", 0x24) 177.608341ms ago: executing program 1 (id=1347): clock_settime(0x0, &(0x7f0000000040)={0x77359400}) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/drivers\x00', 0x0, 0x0) read$rfkill(r0, &(0x7f0000000080), 0x8) r1 = syz_clone(0x84840400, &(0x7f00000000c0)="46789a38cdf2b14e2abd87a080799ea0524b454a6602d29124caada7726cabcbbba78d18d8951aa376044297a52249d9e11e04b1ccf1abb61321f8118cdbf8e89a17bad2fc49475049", 0x49, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="fdec500bf654bbce7c6831786ce35cd2e71319727562ac3b2560a39ea36dd25aaf65911bf77a0a5d3aac090fb43c80e82ccaf1a54c") ptrace$ARCH_GET_UNTAG_MASK(0x1e, r1, &(0x7f0000000200), 0x4001) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r3 = fanotify_init(0xf00, 0x0) fanotify_mark(r3, 0x1, 0x5000003a, r2, 0x0) mknodat(0xffffffffffffffff, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x10000) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) symlink(&(0x7f0000002040)='./file0\x00', &(0x7f0000000080)='./file0\x00') unlink(&(0x7f00000001c0)='./file0\x00') symlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='./file0\x00') syz_open_dev$usbfs(&(0x7f0000000140), 0x77, 0x3501) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, 0x0, 0x0) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, &(0x7f0000000140)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x1, 0x30, 0x30, 0x0, @in6={0x1b, 0x4000, 0x0, @loopback, 0x10000bff}, @ib={0x1b, 0xd9, 0x100fff, {"4a50abf0c8ed50f638facd57de629163"}, 0x8000000000000001, 0x2, 0x3}}}, 0x118) getresgid(&(0x7f0000002980), &(0x7f00000029c0), 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=@newsa={0x16c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in=@rand_addr=0x64010102, @in6=@rand_addr=' \x01\x00', 0x0, 0x2, 0x4e21, 0x2, 0x2, 0x20, 0x0, 0x73}, {@in6=@private1={0xfc, 0x1, '\x00', 0xfc}, 0xfe, 0x32}, @in=@remote, {0x0, 0x0, 0xfffffffffffffffd, 0x8, 0x1, 0x9, 0x0, 0x2000000543}, {0x20000000004, 0x7fffffffffffffff}, {0x3}, 0x70bd2c, 0x3500, 0xa, 0x1, 0x0, 0x50}, [@encap={0x1c, 0x4, {0x0, 0x4e24, 0x4e20, @in6=@loopback}}, @algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "210466d38547aa140db9a200000000c538c7cb7a"}}]}, 0x16c}}, 0x48080) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) openat(r0, &(0x7f0000000040)='./file2\x00', 0x22000, 0xa) 0s ago: executing program 3 (id=1348): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x8}, 0x48) socket$igmp(0x2, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000780)={0x60, 0x887}, 0x0) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fcntl$notify(r3, 0x402, 0x22) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fcntl$notify(r4, 0x402, 0x40000000) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1\x00', 0x40) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1a0) mount$overlay(0x0, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r8 = bpf$MAP_CREATE(0x0, 0x0, 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b7030000000000fd850000007100000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$FE_READ_UNCORRECTED_BLOCKS(r10, 0x80046f49, &(0x7f00000001c0)) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000bc0)={r9, 0x0, 0x0}, 0x10) r11 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r2, @ANYBLOB="00000000100000001c001a80080002802d07420008000200", @ANYBLOB="358749"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) write(r0, &(0x7f0000000000)="2400000011005f0414f9f40700090400810000000d0000000000000008000f0001000000", 0x24) kernel console output (not intermixed with test programs): rialNumber=0 [ 383.231866][ T806] usb 1-1: config 0 descriptor?? [ 383.538297][ T30] audit: type=1400 audit(1784570900.265:460): avc: denied { module_request } for pid=9505 comm="syz.1.863" kmod=6E65742D636C732D88 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 384.331720][ T806] ath6kl: Failed to submit usb control message: -110 [ 384.350634][ T806] ath6kl: unable to send the bmi data to the device: -110 [ 384.378604][ T806] ath6kl: Unable to send get target info: -110 [ 384.426318][ T806] ath6kl: Failed to init ath6kl core: -110 [ 384.470122][ T806] ath6kl_usb 1-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 384.540129][ T30] audit: type=1400 audit(1784570901.265:461): avc: denied { name_bind } for pid=9515 comm="syz.2.865" src=17 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 385.502098][ T806] usb 1-1: USB disconnect, device number 22 [ 387.055361][ T9541] binder: 9540:9541 ioctl c0306201 0 returned -14 [ 387.279008][ T30] audit: type=1400 audit(1784570904.005:462): avc: denied { connect } for pid=9546 comm="syz.3.875" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 387.320362][ T30] audit: type=1400 audit(1784570904.015:463): avc: denied { ioctl } for pid=9546 comm="syz.3.875" path="socket:[20193]" dev="sockfs" ino=20193 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 387.458717][ T9553] netlink: 8 bytes leftover after parsing attributes in process `syz.3.875'. [ 387.489428][ T9553] netlink: 12 bytes leftover after parsing attributes in process `syz.3.875'. [ 387.504108][ T30] audit: type=1400 audit(1784570904.085:464): avc: denied { write } for pid=9546 comm="syz.3.875" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 387.642131][ T9557] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 387.683419][ T9557] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 387.727536][ T9557] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 387.762456][ T9557] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 387.832882][ T30] audit: type=1400 audit(1784570904.565:465): avc: denied { bind } for pid=9546 comm="syz.3.875" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 388.594111][ T9569] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 390.245572][ T9585] macsec1: entered promiscuous mode [ 390.861547][ T9590] binder: 9587:9590 ioctl c0306201 0 returned -14 [ 390.987379][ T30] audit: type=1400 audit(1784570907.715:466): avc: denied { bind } for pid=9594 comm="syz.3.888" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 391.148286][ T9599] netlink: 40 bytes leftover after parsing attributes in process `syz.3.888'. [ 391.155952][ T9596] trusted_key: encrypted_key: insufficient parameters specified [ 391.446580][ T9609] loop6: detected capacity change from 0 to 2640 [ 391.501061][ T5631] Buffer I/O error on dev loop6, logical block 0, async page read [ 391.543490][ T5631] Buffer I/O error on dev loop6, logical block 0, async page read [ 391.582274][ T5631] Buffer I/O error on dev loop6, logical block 0, async page read [ 391.618652][ T5631] Buffer I/O error on dev loop6, logical block 0, async page read [ 391.678043][ T5631] Buffer I/O error on dev loop6, logical block 0, async page read [ 392.084792][ T30] audit: type=1400 audit(1784570908.815:467): avc: denied { setopt } for pid=9604 comm="syz.4.890" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 392.177191][ T30] audit: type=1400 audit(1784570908.845:468): avc: denied { getopt } for pid=9604 comm="syz.4.890" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 393.980888][ T30] audit: type=1400 audit(1784570910.695:469): avc: denied { map } for pid=9622 comm="syz.3.894" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 394.430705][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 394.494242][ T30] audit: type=1400 audit(1784570911.055:470): avc: denied { ioctl } for pid=9622 comm="syz.3.894" path="/dev/nullb0" dev="devtmpfs" ino=696 ioctlcmd=0x7a0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 394.769261][ T30] audit: type=1400 audit(1784570911.495:471): avc: denied { accept } for pid=9629 comm="syz.0.895" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 396.356615][ T9647] binder: 9646:9647 ioctl c0306201 0 returned -14 [ 397.054243][ T9660] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 398.779808][ T9653] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 398.945813][ T30] audit: type=1400 audit(1784570915.675:472): avc: denied { write } for pid=9667 comm="syz.4.904" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 398.956539][ T9668] ieee802154 phy0 wpan0: encryption failed: -22 [ 399.097501][ T30] audit: type=1400 audit(1784570915.825:473): avc: denied { setopt } for pid=9661 comm="syz.1.903" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 399.106263][ T30] audit: type=1400 audit(1784570915.835:474): avc: denied { bind } for pid=9661 comm="syz.1.903" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 399.134468][ T30] audit: type=1400 audit(1784570915.865:475): avc: denied { read } for pid=9661 comm="syz.1.903" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 399.408044][ T30] audit: type=1400 audit(1784570916.105:476): avc: denied { write } for pid=9661 comm="syz.1.903" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 401.832108][ T9690] gfs2: not a GFS2 filesystem [ 402.034924][ T30] audit: type=1400 audit(1784570918.765:477): avc: denied { connect } for pid=9691 comm="syz.1.912" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 402.416577][ T9697] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=528 sclass=netlink_route_socket pid=9697 comm=syz.3.913 [ 404.384620][ T5713] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 404.854460][ T5713] usb 3-1: Using ep0 maxpacket: 32 [ 405.001876][ T5713] usb 3-1: config index 0 descriptor too short (expected 27632, got 27) [ 405.054541][ T5713] usb 3-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 405.113035][ T5713] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 405.639818][ T30] audit: type=1400 audit(1784570921.895:478): avc: denied { shutdown } for pid=9722 comm="syz.3.921" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 405.667647][ T5713] usb 3-1: config 1 has no interface number 0 [ 405.676804][ T9730] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 405.688699][ T5713] usb 3-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 405.700541][ T5713] usb 3-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 405.714115][ T5713] usb 3-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 405.743703][ T30] audit: type=1400 audit(1784570922.455:479): avc: denied { connect } for pid=9722 comm="syz.3.921" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 405.855451][ T5713] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 405.904910][ T5713] snd_usb_pod 3-1:1.1: Line 6 Pocket POD found [ 405.944912][ T9733] netlink: 44 bytes leftover after parsing attributes in process `syz.3.921'. [ 406.079555][ T30] audit: type=1400 audit(1784570922.805:480): avc: denied { name_bind } for pid=9738 comm="syz.0.923" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 406.177200][ T5713] snd_usb_pod 3-1:1.1: Line 6 Pocket POD now attached [ 406.363942][ T806] usb 4-1: new full-speed USB device number 19 using dummy_hcd [ 406.741297][ T9746] ======================================================= [ 406.741297][ T9746] WARNING: The mand mount option has been deprecated and [ 406.741297][ T9746] and is ignored by this kernel. Remove the mand [ 406.741297][ T9746] option from the mount to silence this warning. [ 406.741297][ T9746] ======================================================= [ 406.878585][ T806] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 406.880329][ T9745] netlink: 8 bytes leftover after parsing attributes in process `syz.4.925'. [ 406.935135][ T806] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 406.980573][ T806] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 407.011909][ T806] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 407.258680][ T9749] vlan3: entered promiscuous mode [ 407.264016][ T9749] batadv0: entered promiscuous mode [ 407.425340][ T10] snd_usb_pod 3-1:1.1: line6_send_raw_message_async_part: usb_submit_urb failed (-22) [ 407.429769][ T806] usb 4-1: usb_control_msg returned -32 [ 407.457784][ T806] usbtmc 4-1:16.0: can't read capabilities [ 407.471733][ T5720] usb 3-1: USB disconnect, device number 18 [ 407.496834][ T5720] snd_usb_pod 3-1:1.1: Line 6 Pocket POD now disconnected [ 407.765719][ T30] audit: type=1400 audit(1784570924.495:481): avc: denied { read } for pid=9752 comm="syz.0.928" name="file0" dev="fuse" ino=64 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 407.835682][ T30] audit: type=1400 audit(1784570924.495:482): avc: denied { open } for pid=9752 comm="syz.0.928" path="/193/file0/file0" dev="fuse" ino=64 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 407.930523][ T9736] Bluetooth: hci0: command 0x0406 tx timeout [ 408.091670][ T9756] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 408.180978][ T9756] block device autoloading is deprecated and will be removed. [ 408.973116][ T30] audit: type=1400 audit(1784570925.595:483): avc: denied { create } for pid=9757 comm="syz.4.930" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 409.072779][ T9] usb 4-1: USB disconnect, device number 19 [ 410.225745][ T9770] fuse: Bad value for 'fd' [ 410.233188][ T9770] fuseblk: Bad value for 'fd' [ 410.297529][ T9775] netlink: 'syz.0.935': attribute type 2 has an invalid length. [ 410.346004][ T30] audit: type=1400 audit(1784570927.025:484): avc: denied { getattr } for pid=9774 comm="syz.0.935" path="/" dev="nsfs" ino=4026532790 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 410.479833][ T10] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 410.750683][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 410.873716][ T10] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 411.058352][ T10] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 96 [ 411.183378][ T10] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 411.279910][ T10] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 411.443793][ T10] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 411.536348][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 411.551454][ T10] usb 2-1: SerialNumber: syz [ 411.559671][ T9772] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 411.590541][ T9772] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 411.616239][ T10] hub 2-1:1.0: bad descriptor, ignoring hub [ 411.622898][ T10] hub 2-1:1.0: probe with driver hub failed with error -5 [ 411.867750][ T9772] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 411.885724][ T9772] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 412.028032][ T9802] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 412.116168][ T9772] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 412.133206][ T9772] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 412.260498][ T9789] usb 5-1: new full-speed USB device number 17 using dummy_hcd [ 412.338690][ T9804] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 412.467445][ T9789] usb 5-1: unable to get BOS descriptor or descriptor too short [ 412.513467][ T9789] usb 5-1: not running at top speed; connect to a high speed hub [ 412.546263][ T9789] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice=53.b2 [ 412.558479][ T10] cdc_ether 2-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.1-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 412.574121][ T9789] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 412.596315][ T9789] usb 5-1: Product: syz [ 412.600770][ T9789] usb 5-1: Manufacturer: syz [ 412.605434][ T9789] usb 5-1: SerialNumber: syz [ 412.631205][ T10] usb 2-1: USB disconnect, device number 20 [ 412.641530][ T10] cdc_ether 2-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.1-1, CDC Ethernet Device [ 412.735147][ T30] audit: type=1400 audit(1784570929.465:485): avc: denied { read } for pid=5271 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 412.920481][ T30] audit: type=1400 audit(1784570929.655:486): avc: denied { write } for pid=9810 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 412.976203][ T30] audit: type=1400 audit(1784570929.705:487): avc: denied { write } for pid=9821 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 413.571520][ T9789] usbtest 5-1:255.0: couldn't get endpoints, -22 [ 413.858302][ T9789] usbtest 5-1:255.0: probe with driver usbtest failed with error -22 [ 413.873198][ T9789] usb 5-1: USB disconnect, device number 17 [ 414.105658][ T9838] netlink: 8 bytes leftover after parsing attributes in process `syz.3.945'. [ 414.120858][ T9838] netlink: 8 bytes leftover after parsing attributes in process `syz.3.945'. [ 414.493731][ T30] audit: type=1400 audit(1784570931.225:488): avc: denied { write } for pid=9823 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 414.586689][ T9851] syzkaller0: entered promiscuous mode [ 414.695694][ T9851] syzkaller0: entered allmulticast mode [ 416.379748][ T30] audit: type=1400 audit(1784570933.105:489): avc: denied { write } for pid=9862 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 416.854498][ T9879] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 416.963993][ T30] audit: type=1400 audit(1784570933.695:490): avc: denied { append } for pid=9869 comm="syz.0.954" name="sg0" dev="devtmpfs" ino=750 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 419.351724][ T9904] 9pnet_fd: p9_fd_create_unix (9904): address too long: ./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 419.357614][ T9904] netlink: 12 bytes leftover after parsing attributes in process `syz.4.962'. [ 419.849536][ T9910] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 420.190529][ T9783] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 420.477951][ T9783] usb 3-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 421.138569][ T30] audit: type=1400 audit(1784570937.785:491): avc: denied { bind } for pid=9919 comm="syz.0.967" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 421.291159][ T9924] syzkaller0: entered promiscuous mode [ 421.291182][ T9924] syzkaller0: entered allmulticast mode [ 421.292620][ T9783] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 421.297006][ T9783] usb 3-1: config 0 descriptor?? [ 421.306984][ T9783] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 421.849151][ T10] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 421.911310][ T9939] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 422.602648][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 422.636043][ T10] usb 4-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 422.672060][ T10] usb 4-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 422.715120][ T10] usb 4-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 422.784960][ T10] usb 4-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 422.861528][ T10] usb 4-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 422.893858][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 422.923368][ T10] usb 4-1: Product: syz [ 422.945427][ T10] usb 4-1: Manufacturer: syz [ 422.968928][ T9783] usb 3-1: USB disconnect, device number 19 [ 422.988552][ T10] usb 4-1: SerialNumber: syz [ 423.378272][ C0] imon 4-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 423.459658][ T30] audit: type=1400 audit(1784570940.185:492): avc: denied { create } for pid=9946 comm="syz.0.974" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 423.482830][ T9930] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 423.513370][ T10] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:155.0/input/input24 [ 423.527924][ T9930] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 423.631783][ T30] audit: type=1400 audit(1784570940.365:493): avc: denied { read } for pid=4961 comm="acpid" name="mouse1" dev="devtmpfs" ino=3083 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 424.112731][ T10] imon 4-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 424.121687][ T10] (id 0x00) [ 424.179363][ T30] audit: type=1400 audit(1784570940.365:494): avc: denied { open } for pid=4961 comm="acpid" path="/dev/input/mouse1" dev="devtmpfs" ino=3083 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 424.214515][ T9956] FAULT_INJECTION: forcing a failure. [ 424.214515][ T9956] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 424.216952][ T30] audit: type=1400 audit(1784570940.365:495): avc: denied { ioctl } for pid=4961 comm="acpid" path="/dev/input/mouse1" dev="devtmpfs" ino=3083 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 424.252743][ T9956] CPU: 1 UID: 0 PID: 9956 Comm: syz.1.973 Tainted: G L syzkaller #0 PREEMPT(full) [ 424.252771][ T9956] Tainted: [L]=SOFTLOCKUP [ 424.252776][ T9956] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 424.252784][ T9956] Call Trace: [ 424.252790][ T9956] [ 424.252797][ T9956] dump_stack_lvl+0x100/0x190 [ 424.252822][ T9956] should_fail_ex.cold+0x5/0xa [ 424.252845][ T9956] _copy_to_user+0x32/0xd0 [ 424.252869][ T9956] sk_getsockopt+0xcf9/0x3160 [ 424.252892][ T9956] ? avc_has_perm_noaudit+0x145/0x3b0 [ 424.252914][ T9956] ? __pfx_sk_getsockopt+0x10/0x10 [ 424.252936][ T9956] ? __pfx_avc_has_perm+0x10/0x10 [ 424.252961][ T9956] ? find_held_lock+0x2b/0x80 [ 424.252986][ T9956] ? __might_fault+0xc5/0x140 [ 424.253018][ T9956] ? __might_fault+0xc5/0x140 [ 424.253051][ T9956] ? _copy_from_user+0x59/0xd0 [ 424.253073][ T9956] ? copy_from_sockptr_offset.constprop.0+0xe2/0x150 [ 424.253098][ T9956] ? __pfx_copy_from_sockptr_offset.constprop.0+0x10/0x10 [ 424.253129][ T9956] do_sock_getsockopt+0x60e/0x6e0 [ 424.253152][ T9956] ? __lock_acquire+0x49f/0x1a40 [ 424.253175][ T9956] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 424.253198][ T9956] ? rcu_read_lock_any_held+0x6a/0xa0 [ 424.253230][ T9956] ? find_held_lock+0x2b/0x80 [ 424.253262][ T9956] ? __fget_files+0x21f/0x3d0 [ 424.253284][ T9956] __sys_getsockopt+0x148/0x260 [ 424.253310][ T9956] ? __x64_sys_getsockopt+0xbd/0x160 [ 424.253326][ T9956] __x64_sys_getsockopt+0xbd/0x160 [ 424.253344][ T9956] ? do_syscall_64+0x90/0x870 [ 424.253360][ T9956] ? lockdep_hardirqs_on+0x78/0x100 [ 424.253386][ T9956] do_syscall_64+0x115/0x870 [ 424.253402][ T9956] ? clear_bhb_loop+0x40/0x90 [ 424.253424][ T9956] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 424.253442][ T9956] RIP: 0033:0x7f2c9259de99 [ 424.253457][ T9956] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 424.253474][ T9956] RSP: 002b:00007f2c907d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 424.253492][ T9956] RAX: ffffffffffffffda RBX: 00007f2c92826180 RCX: 00007f2c9259de99 [ 424.253503][ T9956] RDX: 000000000000002c RSI: 0000000000000001 RDI: 0000000000000007 [ 424.253512][ T9956] RBP: 00007f2c907d5090 R08: 0000200000019240 R09: 0000000000000000 [ 424.253523][ T9956] R10: 0000200000019140 R11: 0000000000000246 R12: 0000000000000001 [ 424.253533][ T9956] R13: 00007f2c92826218 R14: 00007f2c92826180 R15: 00007ffc3b011848 [ 424.253557][ T9956] [ 424.290360][ T10] rc_core: IR keymap rc-imon-pad not found [ 424.341725][ T9961] FAULT_INJECTION: forcing a failure. [ 424.341725][ T9961] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 424.389060][ T10] Registered IR keymap rc-empty [ 424.481596][ T9963] openvswitch: netlink: Flow actions attr not present in new flow. [ 424.485524][ T9961] CPU: 0 UID: 0 PID: 9961 Comm: syz.2.975 Tainted: G L syzkaller #0 PREEMPT(full) [ 424.485552][ T9961] Tainted: [L]=SOFTLOCKUP [ 424.485557][ T9961] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 424.485566][ T9961] Call Trace: [ 424.485571][ T9961] [ 424.485577][ T9961] dump_stack_lvl+0x100/0x190 [ 424.485602][ T9961] should_fail_ex.cold+0x5/0xa [ 424.485622][ T9961] _copy_from_user+0x2e/0xd0 [ 424.485641][ T9961] kstrtouint_from_user+0xd6/0x1d0 [ 424.485664][ T9961] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 424.485686][ T9961] ? __lock_acquire+0x49f/0x1a40 [ 424.485713][ T9961] proc_fail_nth_write+0x83/0x220 [ 424.485735][ T9961] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 424.485761][ T9961] vfs_write+0x2aa/0x1050 [ 424.485783][ T9961] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 424.485805][ T9961] ? __pfx_vfs_write+0x10/0x10 [ 424.485826][ T9961] ? __fget_files+0x215/0x3d0 [ 424.485845][ T9961] ? __fget_files+0x21f/0x3d0 [ 424.485866][ T9961] ksys_write+0x12a/0x250 [ 424.485887][ T9961] ? __pfx_ksys_write+0x10/0x10 [ 424.485913][ T9961] do_syscall_64+0x115/0x870 [ 424.485928][ T9961] ? clear_bhb_loop+0x40/0x90 [ 424.485946][ T9961] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 424.485961][ T9961] RIP: 0033:0x7fe18ef5e6ce [ 424.485975][ T9961] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 424.485988][ T9961] RSP: 002b:00007fe18d1f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 424.486004][ T9961] RAX: ffffffffffffffda RBX: 00007fe18d1f66c0 RCX: 00007fe18ef5e6ce [ 424.486014][ T9961] RDX: 0000000000000001 RSI: 00007fe18d1f60a0 RDI: 0000000000000004 [ 424.486023][ T9961] RBP: 00007fe18d1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 424.486032][ T9961] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 424.486041][ T9961] R13: 00007fe18f226128 R14: 00007fe18f226090 R15: 00007fffbf8c2168 [ 424.486061][ T9961] [ 424.492820][ T10] imon 4-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 424.825011][ T10] imon 4-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 424.837402][ T10] imon:send_packet: packet tx failed (-71) [ 424.864825][ T10] imon 4-1:155.0: remote input dev register failed [ 424.873570][ T10] imon 4-1:155.0: imon_init_intf0: rc device setup failed [ 424.960772][ T29] usb 1-1: new full-speed USB device number 23 using dummy_hcd [ 425.174349][ T29] usb 1-1: New USB device found, idVendor=0403, idProduct=6010, bcdDevice=c9.98 [ 425.259717][ T29] usb 1-1: New USB device strings: Mfr=1, Product=0, SerialNumber=0 [ 425.328856][ T29] usb 1-1: Manufacturer: syz [ 425.388772][ T29] usb 1-1: config 0 descriptor?? [ 425.704077][ T29] ftdi_sio 1-1:0.0: FTDI USB Serial Device converter detected [ 425.975278][ T29] ftdi_sio ttyUSB0: unknown device type: 0xc998 [ 426.321417][ T9979] netlink: 20 bytes leftover after parsing attributes in process `syz.0.978'. [ 426.717399][ T9987] netlink: 68 bytes leftover after parsing attributes in process `syz.3.983'. [ 427.500216][ T9976] dvmrp31: entered allmulticast mode [ 427.513467][ T10] imon 4-1:155.0: unable to initialize intf0, err 0 [ 427.528168][ T10] imon:imon_probe: failed to initialize context! [ 427.535337][ T10] imon 4-1:155.0: unable to register, err -19 [ 427.549368][ T10] usb 4-1: USB disconnect, device number 20 [ 427.560835][ T5631] udevd[5631]: setting mode of /dev/bus/usb/004/020 to 020664 failed: No such file or directory [ 427.620198][ T5631] udevd[5631]: setting owner of /dev/bus/usb/004/020 to uid=0, gid=0 failed: No such file or directory [ 427.812006][ T9995] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 427.988847][ T9783] usb 1-1: USB disconnect, device number 23 [ 428.007809][ T9783] ftdi_sio 1-1:0.0: device disconnected [ 428.018266][ T30] audit: type=1400 audit(1784570944.745:496): avc: denied { write } for pid=9990 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 428.018286][T10010] vlan2: entered allmulticast mode [ 428.063638][T10010] bond0: entered allmulticast mode [ 428.071986][ T10] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 428.074192][T10010] bond_slave_0: entered allmulticast mode [ 428.103279][T10010] bond_slave_1: entered allmulticast mode [ 428.111592][ T30] audit: type=1400 audit(1784570944.835:497): avc: denied { remount } for pid=9996 comm="syz.2.985" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 428.162013][T10013] bond0: (slave bond_slave_0): Releasing backup interface [ 428.183173][T10013] bond_slave_0: left allmulticast mode [ 428.193677][ T30] audit: type=1400 audit(1784570944.925:498): avc: denied { write } for pid=10015 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 428.218772][T10013] bond0: (slave bond_slave_1): Releasing backup interface [ 428.235256][T10013] bond_slave_1: left allmulticast mode [ 428.252338][ T10] usb 4-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 428.257405][T10013] team0: Port device team_slave_0 removed [ 428.275662][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 428.282550][T10013] team0: Port device team_slave_1 removed [ 428.303800][ T10] usb 4-1: config 0 descriptor?? [ 428.316442][T10013] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 428.322942][ T10] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 428.334225][T10018] netlink: 5 bytes leftover after parsing attributes in process `syz.2.988'. [ 428.341855][T10013] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 428.433782][T10013] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 428.448690][T10013] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 428.488583][T10013] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 428.595044][T10007] bond0 (unregistering): Released all slaves [ 428.632903][ T30] audit: type=1400 audit(1784570945.355:499): avc: denied { write } for pid=10019 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 429.101595][T10018] netlink: 5 bytes leftover after parsing attributes in process `syz.2.988'. [ 429.151106][ T30] audit: type=1400 audit(1784570945.885:500): avc: denied { write } for pid=10039 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 429.219224][ T30] audit: type=1400 audit(1784570945.935:501): avc: denied { connect } for pid=10037 comm="syz.0.990" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 429.444051][ T30] audit: type=1400 audit(1784570946.175:502): avc: denied { setopt } for pid=10047 comm="syz.2.993" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 429.454038][ T10] usb 4-1: USB disconnect, device number 21 [ 429.529286][ T30] audit: type=1400 audit(1784570946.255:503): avc: denied { getopt } for pid=10037 comm="syz.0.990" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 429.677777][ T30] audit: type=1400 audit(1784570946.395:504): avc: denied { write } for pid=10042 comm="syz.4.991" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 430.756101][T10055] netlink: 8 bytes leftover after parsing attributes in process `syz.1.995'. [ 430.848149][T10064] syzkaller0: entered promiscuous mode [ 430.860703][T10064] syzkaller0: entered allmulticast mode [ 431.399878][T10076] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 431.427604][ T30] audit: type=1400 audit(1784570948.155:505): avc: denied { read } for pid=10067 comm="syz.0.998" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 431.472366][ T29] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 431.650495][ T29] usb 2-1: Using ep0 maxpacket: 16 [ 431.660096][ T29] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 431.690447][ T29] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 431.711223][ T29] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 431.722163][ T29] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 431.749639][ T29] usb 2-1: SerialNumber: syz [ 431.765572][ T29] usb 2-1: 0:2 : does not exist [ 432.000485][ T10] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 432.058401][T10100] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 432.184722][ T10] usb 5-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 432.200643][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 432.218388][T10109] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1005'. [ 432.235084][ T10] usb 5-1: config 0 descriptor?? [ 432.259000][ T10] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 433.325274][ T29] usb 2-1: 5:0: cannot get min/max values for control 5 (id 5) [ 433.404462][ C0] raw-gadget.1 gadget.4: ignoring, device is not running [ 433.412800][ C0] raw-gadget.1 gadget.4: ignoring, device is not running [ 433.415938][ T29] usb 2-1: 5:0: cannot get min/max values for control 5 (id 5) [ 433.422334][ T10] usb 5-1: USB disconnect, device number 18 [ 433.439606][T10122] syzkaller0: entered promiscuous mode [ 433.445559][ T29] usb 2-1: USB disconnect, device number 21 [ 433.458883][T10122] syzkaller0: entered allmulticast mode [ 433.495350][T10125] FAULT_INJECTION: forcing a failure. [ 433.495350][T10125] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 433.522016][ T5631] udevd[5631]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 433.561515][T10125] CPU: 0 UID: 0 PID: 10125 Comm: syz.2.1008 Tainted: G L syzkaller #0 PREEMPT(full) [ 433.561558][T10125] Tainted: [L]=SOFTLOCKUP [ 433.561564][T10125] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 433.561574][T10125] Call Trace: [ 433.561580][T10125] [ 433.561587][T10125] dump_stack_lvl+0x100/0x190 [ 433.561612][T10125] should_fail_ex.cold+0x5/0xa [ 433.561634][T10125] _copy_from_iter+0x1f4/0x1690 [ 433.561660][T10125] ? __pfx__copy_from_iter+0x10/0x10 [ 433.561679][T10125] ? _parse_integer_limit+0x1ac/0x220 [ 433.561709][T10125] ? _kstrtoull+0x13c/0x1f0 [ 433.561733][T10125] ? __pfx__kstrtoull+0x10/0x10 [ 433.561759][T10125] tun_get_user+0x265/0x3c20 [ 433.561788][T10125] ? __lock_acquire+0x49f/0x1a40 [ 433.561811][T10125] ? __pfx_tun_get_user+0x10/0x10 [ 433.561838][T10125] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 433.561874][T10125] ? find_held_lock+0x2b/0x80 [ 433.561898][T10125] ? tun_get+0x191/0x370 [ 433.561920][T10125] ? tun_get+0x191/0x370 [ 433.561949][T10125] tun_chr_write_iter+0xdc/0x200 [ 433.561975][T10125] vfs_write+0x6ac/0x1050 [ 433.562000][T10125] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 433.562028][T10125] ? __pfx_vfs_write+0x10/0x10 [ 433.562051][T10125] ? find_held_lock+0x2b/0x80 [ 433.562089][T10125] ksys_write+0x12a/0x250 [ 433.562113][T10125] ? __pfx_ksys_write+0x10/0x10 [ 433.562143][T10125] do_syscall_64+0x115/0x870 [ 433.562158][T10125] ? clear_bhb_loop+0x40/0x90 [ 433.562180][T10125] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 433.562197][T10125] RIP: 0033:0x7fe18ef9de99 [ 433.562211][T10125] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 433.562228][T10125] RSP: 002b:00007fe18d1f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 433.562245][T10125] RAX: ffffffffffffffda RBX: 00007fe18f226090 RCX: 00007fe18ef9de99 [ 433.562256][T10125] RDX: 000000000000ffdd RSI: 0000200000000200 RDI: 0000000000000005 [ 433.562266][T10125] RBP: 00007fe18d1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 433.562276][T10125] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 433.562286][T10125] R13: 00007fe18f226128 R14: 00007fe18f226090 R15: 00007fffbf8c2168 [ 433.562308][T10125] [ 434.494181][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 434.631285][T10153] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1015'. [ 434.750014][T10151] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 434.918174][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 434.918190][ T30] audit: type=1400 audit(1784570951.645:512): avc: denied { write } for pid=10131 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 434.988034][ T30] audit: type=1400 audit(1784570951.685:513): avc: denied { setcurrent } for pid=10161 comm="syz.1.1016" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 435.028226][T10169] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 435.080845][T10169] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 435.085422][ T30] audit: type=1400 audit(1784570951.745:514): avc: denied { cmd } for pid=10161 comm="syz.1.1016" path="/dev/ublk-control" dev="devtmpfs" ino=697 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=io_uring permissive=1 [ 435.278216][ T30] audit: type=1400 audit(1784570951.755:515): avc: denied { write } for pid=10166 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 435.315439][ T5802] usb 4-1: new full-speed USB device number 22 using dummy_hcd [ 435.493045][ T30] audit: type=1400 audit(1784570951.845:516): avc: denied { map } for pid=10161 comm="syz.1.1016" path="/dev/ublkc0" dev="devtmpfs" ino=3096 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 435.687783][ T30] audit: type=1400 audit(1784570952.285:517): avc: denied { wake_alarm } for pid=10187 comm="syz.1.1018" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 436.804458][T10199] set match dimension is over the limit! [ 437.547047][ T30] audit: type=1400 audit(1784570954.235:518): avc: denied { write } for pid=10178 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 438.778101][ T30] audit: type=1400 audit(1784570955.505:519): avc: denied { write } for pid=10209 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 438.944627][ T30] audit: type=1400 audit(1784570955.675:520): avc: denied { bind } for pid=10213 comm="syz.1.1025" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 440.217451][T10223] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1027'. [ 440.229951][T10223] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1027'. [ 440.239072][ T30] audit: type=1400 audit(1784570956.955:521): avc: denied { ioctl } for pid=10222 comm="syz.1.1027" path="socket:[22100]" dev="sockfs" ino=22100 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 440.332876][T10223] veth1_to_team: entered promiscuous mode [ 440.389157][T10223] gretap0: entered promiscuous mode [ 440.434408][T10231] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 440.449149][T10223] hsr1: entered promiscuous mode [ 440.642636][T10233] overlayfs: failed lookup in lower (newroot/222, name='file0', err=-40): overlapping layers [ 441.335918][T10233] overlayfs: failed lookup in lower (newroot/222, name='file0', err=-40): overlapping layers [ 441.353440][ T30] audit: type=1400 audit(1784570958.065:523): avc: denied { append } for pid=10232 comm="syz.3.1030" name="ptp0" dev="devtmpfs" ino=1266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 441.387705][T10234] team0 (unregistering): Port device team_slave_0 removed [ 441.410606][ T30] audit: type=1804 audit(1784570958.055:522): pid=10234 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.3.1030" name="/newroot/222/bus/file1" dev="overlay" ino=1216 res=1 errno=0 [ 441.488334][T10234] team0 (unregistering): Port device team_slave_1 removed [ 441.850699][ T806] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 442.070352][ T806] usb 4-1: Using ep0 maxpacket: 32 [ 442.095684][ T806] usb 4-1: config 0 has an invalid interface number: 151 but max is 0 [ 442.171706][ T806] usb 4-1: config 0 has no interface number 0 [ 442.232101][ T806] usb 4-1: config 0 interface 151 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 442.382937][ T806] usb 4-1: config 0 interface 151 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 442.679821][ T806] usb 4-1: New USB device found, idVendor=0499, idProduct=6bb7, bcdDevice=68.2f [ 442.744773][ T806] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 442.790121][ T806] usb 4-1: Product: syz [ 442.813622][ T806] usb 4-1: Manufacturer: syz [ 442.834990][ T806] usb 4-1: SerialNumber: syz [ 442.869738][ T806] usb 4-1: config 0 descriptor?? [ 442.915022][ T30] audit: type=1400 audit(1784570959.645:524): avc: denied { setopt } for pid=10264 comm="syz.0.1038" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 443.052840][T10267] netlink: 144 bytes leftover after parsing attributes in process `syz.1.1037'. [ 443.189704][ T5631] udevd[5631]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.151/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 443.444750][ T5802] usb 4-1: USB disconnect, device number 23 [ 445.153536][T10292] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 445.159509][T10292] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 445.180933][ T806] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 445.294237][ T29] usb 4-1: new full-speed USB device number 24 using dummy_hcd [ 445.360553][ T806] usb 2-1: Using ep0 maxpacket: 8 [ 445.457395][ T806] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 445.466625][ T806] usb 2-1: config 179 has no interface number 0 [ 445.473034][ T806] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 445.484198][ T806] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 445.495467][ T806] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 445.506646][ T806] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 445.745470][ T29] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 445.758423][ T806] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 445.828763][ T29] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 445.926505][ T806] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 445.960779][ T29] usb 4-1: New USB device found, idVendor=0c70, idProduct=f00b, bcdDevice= 0.00 [ 445.972015][ T806] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 445.987801][ T29] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 446.000419][T10290] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 446.018064][ T29] usb 4-1: config 0 descriptor?? [ 446.035721][T10307] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 446.602098][T10317] syzkaller0: entered promiscuous mode [ 446.622373][T10317] syzkaller0: entered allmulticast mode [ 446.729874][T10317] tipc: Started in network mode [ 446.745214][T10317] tipc: Node identity 1eedf1a753c, cluster identity 4711 [ 446.786551][T10317] tipc: Enabled bearer , priority 0 [ 446.876185][ T29] aquacomputer_d5next 0003:0C70:F00B.0002: unknown main item tag 0x0 [ 447.003035][T10320] tipc: Resetting bearer [ 447.122875][T10316] tipc: Resetting bearer [ 447.278935][T10316] tipc: Disabling bearer [ 447.374169][ T29] aquacomputer_d5next 0003:0C70:F00B.0002: unknown main item tag 0x0 [ 447.382823][ T29] aquacomputer_d5next 0003:0C70:F00B.0002: unknown main item tag 0x0 [ 447.391080][ T29] aquacomputer_d5next 0003:0C70:F00B.0002: unknown main item tag 0x0 [ 447.399317][ T29] aquacomputer_d5next 0003:0C70:F00B.0002: unknown main item tag 0x0 [ 447.407907][ T29] aquacomputer_d5next 0003:0C70:F00B.0002: unknown main item tag 0x0 [ 447.416158][ T29] aquacomputer_d5next 0003:0C70:F00B.0002: unknown main item tag 0x0 [ 447.428241][ T29] aquacomputer_d5next 0003:0C70:F00B.0002: unknown main item tag 0x0 [ 447.437106][ T10] usb 2-1: USB disconnect, device number 22 [ 447.437216][ C1] xpad 2-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 447.451604][ C1] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 447.465468][ T29] aquacomputer_d5next 0003:0C70:F00B.0002: unknown main item tag 0x0 [ 447.473666][ T29] aquacomputer_d5next 0003:0C70:F00B.0002: unknown main item tag 0x0 [ 448.742089][ T29] aquacomputer_d5next 0003:0C70:F00B.0002: hidraw0: USB HID v0.20 Device [HID 0c70:f00b] on usb-dummy_hcd.3-1/input0 [ 448.766916][ T30] audit: type=1400 audit(1784570964.605:525): avc: denied { kexec_image_load } for pid=10326 comm="syz.2.1051" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 448.989606][T10334] netlink: 136 bytes leftover after parsing attributes in process `syz.4.1052'. [ 449.016274][ T30] audit: type=1400 audit(1784570965.745:526): avc: denied { listen } for pid=10324 comm="syz.0.1050" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 449.020529][ T29] usb 4-1: USB disconnect, device number 24 [ 449.963987][T10342] overlayfs: failed to resolve './file1': -2 [ 450.359664][T10342] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1054'. [ 450.395535][ T30] audit: type=1400 audit(1784570967.125:527): avc: denied { create } for pid=10333 comm="syz.4.1052" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 451.436921][T10371] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 453.120961][T10391] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1063'. [ 453.130189][T10391] bridge_slave_1: left allmulticast mode [ 453.135940][T10391] bridge_slave_1: left promiscuous mode [ 453.142314][T10391] bridge0: port 2(bridge_slave_1) entered disabled state [ 453.846825][ T30] audit: type=1400 audit(1784570970.545:528): avc: denied { name_bind } for pid=10388 comm="syz.3.1066" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=udp_socket permissive=1 [ 453.985457][ T30] audit: type=1400 audit(1784570970.715:529): avc: denied { mounton } for pid=10383 comm="syz.4.1064" path="/proc/722/task" dev="proc" ino=22435 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 454.457189][T10391] bridge_slave_0: left allmulticast mode [ 454.469119][T10391] bridge_slave_0: left promiscuous mode [ 454.474914][T10391] bridge0: port 1(bridge_slave_0) entered disabled state [ 454.649200][ T30] audit: type=1400 audit(1784570971.375:530): avc: denied { listen } for pid=10401 comm="syz.3.1068" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 455.526437][T10402] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1068'. [ 456.037877][ T30] audit: type=1400 audit(1784570972.765:531): avc: denied { write } for pid=10380 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 456.140324][ T5695] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 456.155755][ T30] audit: type=1400 audit(1784570972.885:532): avc: denied { write } for pid=10433 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 456.292123][ T5695] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 456.307100][ T5695] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 456.337137][ T5695] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 456.346996][ T5695] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 456.364393][ T5695] usb 4-1: Product: syz [ 456.387862][ T5695] usb 4-1: Manufacturer: syz [ 456.398134][ T5695] usb 4-1: SerialNumber: syz [ 456.487123][ T5695] cdc_mbim 4-1:1.0: skipping garbage [ 456.631037][T10402] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 457.766305][T10402] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 457.850230][ T5695] cdc_mbim 4-1:1.0: setting tx_max = 16384 [ 457.932764][ T5695] cdc_mbim 4-1:1.0: cdc-wdm0: USB WDM device [ 457.948157][ T5695] wwan wwan0: port wwan0mbim0 attached [ 457.967656][ T5695] cdc_mbim 4-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.3-1, CDC MBIM, e2:b5:2a:bd:be:bb [ 458.054181][ T30] audit: type=1400 audit(1784570974.785:533): avc: denied { getopt } for pid=10453 comm="syz.1.1078" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 458.149578][ T30] audit: type=1400 audit(1784570974.875:534): avc: denied { mounton } for pid=10453 comm="syz.1.1078" path="/syzcgroup/unified/syz1" dev="afs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=dir permissive=1 [ 458.255442][ T5802] usb 4-1: USB disconnect, device number 25 [ 458.284098][ T5802] cdc_mbim 4-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.3-1, CDC MBIM [ 460.078561][T10474] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1081'. [ 460.455420][ T5802] wwan wwan0: port wwan0mbim0 disconnected [ 460.537542][T10455] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 460.713567][T10479] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1079'. [ 460.726638][T10479] netlink: 'syz.0.1079': attribute type 7 has an invalid length. [ 460.743449][T10479] netlink: 'syz.0.1079': attribute type 8 has an invalid length. [ 460.757289][T10479] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1079'. [ 460.790168][T10484] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 460.942420][T10493] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1079'. [ 461.032193][T10493] netlink: 'syz.0.1079': attribute type 7 has an invalid length. [ 461.040076][T10493] netlink: 'syz.0.1079': attribute type 8 has an invalid length. [ 461.051988][T10493] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1079'. [ 461.347184][ T30] audit: type=1400 audit(1784570978.065:535): avc: denied { write } for pid=10466 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 461.728835][ T30] audit: type=1400 audit(1784570978.455:536): avc: denied { write } for pid=10504 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 462.109132][ T5695] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 463.290275][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 463.300267][ T0] NOHZ tick-stop error: local softirq work is pending, handler #04!!! [ 463.360271][ T0] NOHZ tick-stop error: local softirq work is pending, handler #04!!! [ 463.720368][ T5695] usb 4-1: Using ep0 maxpacket: 32 [ 463.890277][ T0] NOHZ tick-stop error: local softirq work is pending, handler #06!!! [ 463.950276][ T0] NOHZ tick-stop error: local softirq work is pending, handler #06!!! [ 464.284918][T10518] FAULT_INJECTION: forcing a failure. [ 464.284918][T10518] name failslab, interval 1, probability 0, space 0, times 0 [ 464.297830][T10518] CPU: 0 UID: 0 PID: 10518 Comm: syz.2.1088 Tainted: G L syzkaller #0 PREEMPT(full) [ 464.297858][T10518] Tainted: [L]=SOFTLOCKUP [ 464.297864][T10518] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 464.297873][T10518] Call Trace: [ 464.297880][T10518] [ 464.297886][T10518] dump_stack_lvl+0x100/0x190 [ 464.297912][T10518] should_fail_ex.cold+0x5/0xa [ 464.297934][T10518] should_failslab+0xc2/0x120 [ 464.297954][T10518] __kmalloc_node_track_caller_noprof+0xf9/0x830 [ 464.297975][T10518] ? landlock_restrict_sibling_threads+0x4f5/0x1490 [ 464.298002][T10518] krealloc_node_align_noprof+0x321/0x3e0 [ 464.298024][T10518] landlock_restrict_sibling_threads+0x4f5/0x1490 [ 464.298050][T10518] ? __pfx_landlock_restrict_sibling_threads+0x10/0x10 [ 464.298093][T10518] ? __pfx___might_resched+0x10/0x10 [ 464.298114][T10518] ? landlock_merge_ruleset+0x213/0x8b0 [ 464.298144][T10518] __do_sys_landlock_restrict_self+0x5d2/0x9e0 [ 464.298173][T10518] do_syscall_64+0x115/0x870 [ 464.298189][T10518] ? clear_bhb_loop+0x40/0x90 [ 464.298209][T10518] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 464.298226][T10518] RIP: 0033:0x7fe18ef9de99 [ 464.298240][T10518] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 464.298255][T10518] RSP: 002b:00007fe18d1f6028 EFLAGS: 00000246 ORIG_RAX: 00000000000001be [ 464.298271][T10518] RAX: ffffffffffffffda RBX: 00007fe18f226090 RCX: 00007fe18ef9de99 [ 464.298282][T10518] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 0000000000000006 [ 464.298292][T10518] RBP: 00007fe18d1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 464.298301][T10518] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 464.298310][T10518] R13: 00007fe18f226128 R14: 00007fe18f226090 R15: 00007fffbf8c2168 [ 464.298333][T10518] [ 465.458083][ T5695] usb 4-1: unable to read config index 0 descriptor/all [ 465.497499][T10521] binder: BINDER_SET_CONTEXT_MGR already set [ 465.515462][ T5695] usb 4-1: can't read configurations, error -71 [ 465.543623][T10521] binder: 10520:10521 ioctl 4018620d 200000000040 returned -16 [ 465.649696][T10525] binder: 10520:10525 ioctl c0306201 0 returned -14 [ 466.782592][T10540] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1094'. [ 468.946764][T10574] FAULT_INJECTION: forcing a failure. [ 468.946764][T10574] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 469.861725][T10578] trusted_key: encrypted_key: insufficient parameters specified [ 470.369059][ T30] audit: type=1400 audit(1784570986.605:537): avc: denied { setopt } for pid=10575 comm="syz.0.1100" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 470.400349][T10574] CPU: 0 UID: 0 PID: 10574 Comm: syz.3.1099 Tainted: G L syzkaller #0 PREEMPT(full) [ 470.400378][T10574] Tainted: [L]=SOFTLOCKUP [ 470.400384][T10574] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 470.400394][T10574] Call Trace: [ 470.400400][T10574] [ 470.400406][T10574] dump_stack_lvl+0x100/0x190 [ 470.400432][T10574] should_fail_ex.cold+0x5/0xa [ 470.400453][T10574] _copy_from_user+0x2e/0xd0 [ 470.400474][T10574] restore_altstack+0x98/0x170 [ 470.400499][T10574] ? __pfx_restore_altstack+0x10/0x10 [ 470.400525][T10574] ? _raw_spin_unlock_irq+0x23/0x50 [ 470.400548][T10574] ? lockdep_hardirqs_on+0x78/0x100 [ 470.400573][T10574] ? _raw_spin_unlock_irq+0x2e/0x50 [ 470.400598][T10574] __do_sys_rt_sigreturn+0x1ab/0x2c0 [ 470.400616][T10574] ? __pfx___ia32_sys_rt_sigreturn+0x10/0x10 [ 470.400645][T10574] do_syscall_64+0x115/0x870 [ 470.400660][T10574] ? clear_bhb_loop+0x40/0x90 [ 470.400680][T10574] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 470.400697][T10574] RIP: 0033:0x7ff57613f219 [ 470.400711][T10574] Code: 11 06 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 c7 c0 0f 00 00 00 0f 05 <0f> 1f 80 00 00 00 00 48 81 ec 48 01 00 00 49 89 d0 64 48 8b 0c 25 [ 470.400727][T10574] RSP: 002b:00007ff577060300 EFLAGS: 00000206 ORIG_RAX: 000000000000000f [ 470.400743][T10574] RAX: ffffffffffffffda RBX: 00007ff5770616c0 RCX: 00007ff57613f219 [ 470.400754][T10574] RDX: 00007ff577060300 RSI: 00007ff577060430 RDI: 0000000000000021 [ 470.400764][T10574] RBP: 00007ff577061090 R08: 0000000000000000 R09: 0000000000000000 [ 470.400774][T10574] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000003 [ 470.400784][T10574] R13: 00007ff576426038 R14: 00007ff576425fa0 R15: 00007ffdffbccae8 [ 470.400808][T10574] [ 470.721432][ T30] audit: type=1400 audit(1784570987.455:538): avc: denied { write } for pid=10534 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 471.176531][ T30] audit: type=1400 audit(1784570987.905:539): avc: denied { write } for pid=10593 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 473.059236][T10616] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1109'. [ 473.360218][ T30] audit: type=1400 audit(1784570990.085:540): avc: denied { execute } for pid=10631 comm="syz.2.1114" path=2F6D656D66643A024CBB7B9BA2C913372560202864656C6574656429 dev="hugetlbfs" ino=23460 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 473.991057][T10638] input: syz1 as /devices/virtual/input/input27 [ 474.014065][ T30] audit: type=1400 audit(1784570990.715:541): avc: denied { getopt } for pid=10639 comm="syz.4.1115" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 474.235099][ T30] audit: type=1400 audit(1784570990.715:542): avc: denied { node_bind } for pid=10639 comm="syz.4.1115" saddr=fc02:: src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 474.544724][ T30] audit: type=1400 audit(1784570991.225:543): avc: denied { append } for pid=10642 comm="syz.3.1116" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 474.610322][T10637] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 474.782596][ T30] audit: type=1400 audit(1784570991.315:544): avc: denied { mount } for pid=10642 comm="syz.3.1116" name="/" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 474.868408][ T30] audit: type=1400 audit(1784570991.375:545): avc: denied { remount } for pid=10642 comm="syz.3.1116" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 475.057244][ T30] audit: type=1400 audit(1784570991.465:546): avc: denied { map } for pid=10642 comm="syz.3.1116" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 475.940686][ T30] audit: type=1400 audit(1784570991.465:547): avc: denied { write execute } for pid=10642 comm="syz.3.1116" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 476.698725][ T30] audit: type=1400 audit(1784570993.425:548): avc: denied { unmount } for pid=5607 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 477.724002][T10667] tap0: tun_chr_ioctl cmd 1074025678 [ 477.741374][T10667] tap0: group set to 0 [ 477.818381][T10674] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 478.746658][ T30] audit: type=1400 audit(1784570995.475:549): avc: denied { read write } for pid=10683 comm="syz.2.1125" name="file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 478.931388][ T30] audit: type=1400 audit(1784570995.475:550): avc: denied { open } for pid=10683 comm="syz.2.1125" path="/202/file0/file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 480.707798][ T30] audit: type=1400 audit(1784570997.435:551): avc: denied { create } for pid=10710 comm="syz.2.1130" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 480.772922][ T30] audit: type=1400 audit(1784570997.435:552): avc: denied { connect } for pid=10710 comm="syz.2.1130" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 481.000407][ T5695] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 481.150437][ T9] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 481.170351][ T5695] usb 5-1: Using ep0 maxpacket: 32 [ 481.177361][ T5695] usb 5-1: too many endpoints for config 0 interface 0 altsetting 254: 33, using maximum allowed: 30 [ 481.193410][ T5695] usb 5-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid maxpacket 1056, setting to 1024 [ 481.209708][ T5695] usb 5-1: config 0 interface 0 altsetting 254 has 1 endpoint descriptor, different from the interface descriptor's value: 33 [ 481.223335][ T5695] usb 5-1: config 0 interface 0 has no altsetting 0 [ 481.234465][ T5695] usb 5-1: New USB device found, idVendor=172f, idProduct=0502, bcdDevice= 0.00 [ 481.243908][ T5695] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 481.268718][ T5695] usb 5-1: config 0 descriptor?? [ 481.276836][T10714] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 481.352687][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 242, changing to 11 [ 481.366463][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 481.380307][ T9] usb 3-1: New USB device found, idVendor=07b5, idProduct=0312, bcdDevice= 0.00 [ 481.389460][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 481.412417][ T9] usb 3-1: config 0 descriptor?? [ 481.811073][ T5695] hid_parser_main: 28 callbacks suppressed [ 481.811095][ T5695] waltop 0003:172F:0502.0003: unknown main item tag 0x0 [ 481.842699][ T5695] waltop 0003:172F:0502.0003: unknown main item tag 0x0 [ 481.860716][ T5695] waltop 0003:172F:0502.0003: unknown main item tag 0x0 [ 481.879658][ T5695] waltop 0003:172F:0502.0003: unknown main item tag 0x0 [ 481.900541][ T5695] waltop 0003:172F:0502.0003: unknown main item tag 0x0 [ 481.917021][ T5695] waltop 0003:172F:0502.0003: unknown main item tag 0x0 [ 481.957601][ T5695] waltop 0003:172F:0502.0003: unknown main item tag 0x0 [ 481.966589][ T5695] waltop 0003:172F:0502.0003: unknown main item tag 0x0 [ 481.973909][ T5695] waltop 0003:172F:0502.0003: unknown main item tag 0x0 [ 481.981711][ T5695] waltop 0003:172F:0502.0003: unknown main item tag 0x0 [ 481.998258][ T5695] waltop 0003:172F:0502.0003: hidraw0: USB HID v20.01 Device [HID 172f:0502] on usb-dummy_hcd.4-1/input0 [ 482.482564][ T24] usb 5-1: USB disconnect, device number 19 [ 482.591799][T10724] fido_id[10724]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/5-1/report_descriptor': No such file or directory [ 483.169753][T10731] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1136'. [ 483.803449][ T9] usbhid 3-1:0.0: can't add hid device: -71 [ 483.820866][ T9] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 483.853058][ T9] usb 3-1: USB disconnect, device number 20 [ 485.534706][ T30] audit: type=1400 audit(1784571002.265:553): avc: denied { setopt } for pid=10747 comm="syz.0.1140" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 485.563357][T10752] overlayfs: missing 'workdir' [ 486.265513][ T30] audit: type=1400 audit(1784571002.995:554): avc: denied { read } for pid=10758 comm="syz.2.1143" lport=34174 faddr=::ffff:10.1.1.2 fport=20001 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 486.405105][T10767] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 486.548875][ T30] audit: type=1400 audit(1784571003.275:555): avc: denied { mount } for pid=10765 comm="syz.3.1147" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 486.623180][ T30] audit: type=1400 audit(1784571003.345:556): avc: denied { mounton } for pid=10765 comm="syz.3.1147" path="/244/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 486.963673][T10767] program syz.3.1147 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 487.028469][ T30] audit: type=1400 audit(1784571003.695:557): avc: denied { write } for pid=10765 comm="syz.3.1147" name="file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 487.082676][ T30] audit: type=1400 audit(1784571003.815:558): avc: denied { unmount } for pid=5607 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 487.460656][ T30] audit: type=1400 audit(1784571004.185:559): avc: denied { watch watch_reads } for pid=10776 comm="syz.2.1150" path="/" dev="ramfs" ino=24825 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=dir permissive=1 [ 488.582444][ T30] audit: type=1800 audit(1784571005.315:560): pid=10778 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.2.1150" name="bus" dev="ramfs" ino=24826 res=0 errno=0 [ 489.383734][T10803] vivid-000: kernel_thread() failed [ 492.709201][T10858] overlayfs: missing 'lowerdir' [ 492.827171][T10859] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1169'. [ 493.003918][T10862] netlink: 'syz.3.1171': attribute type 1 has an invalid length. [ 493.130080][T10862] 8021q: adding VLAN 0 to HW filter on device bond1 [ 493.176529][T10861] bond1: (slave veth3): Enslaving as an active interface with a down link [ 493.232925][T10870] overlayfs: missing 'lowerdir' [ 493.416939][T10872] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1170'. [ 493.710112][ T5695] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 493.945667][ T5695] usb 2-1: Using ep0 maxpacket: 8 [ 493.962265][ T5695] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 493.980307][ T5695] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 494.115720][ T5695] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 494.462956][ T5695] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 494.496885][ T5695] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 494.509912][ T5695] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 494.654375][ T5695] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 494.675828][ T5695] usb 2-1: config 168 interface 0 has no altsetting 0 [ 494.684387][ T5695] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 494.692239][ T5695] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 494.706775][ T5695] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 494.733240][ T5695] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 494.745360][ T5695] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 494.756794][ T5695] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 494.908492][ T5695] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 495.002890][ T5695] usb 2-1: config 168 interface 0 has no altsetting 0 [ 495.048301][ T5695] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 495.075767][ T5695] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 495.123771][ T5695] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 495.176910][ T5695] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 495.218977][ T5695] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 495.269295][ T5695] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 495.324877][ T5695] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 495.379989][ T5695] usb 2-1: config 168 interface 0 has no altsetting 0 [ 495.417871][ T5695] usb 2-1: string descriptor 0 read error: -22 [ 495.425419][ T5695] usb 2-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 495.695789][ T5695] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 495.944098][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 496.342869][ T5695] usb 2-1: can't set config #168, error -71 [ 496.432982][ T5695] usb 2-1: USB disconnect, device number 23 [ 497.328936][T10920] faux_driver vgem: [drm] Unknown color mode 3; guessing buffer size. [ 497.407715][ T30] audit: type=1400 audit(1784571014.135:561): avc: denied { map } for pid=10917 comm="syz.3.1185" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 499.920147][ T30] audit: type=1400 audit(1784571016.645:562): avc: denied { watch watch_reads } for pid=10929 comm="syz.3.1189" path="/" dev="hugetlbfs" ino=26012 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=dir permissive=1 [ 501.500460][T10950] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 501.582580][T10958] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1194'. [ 502.070320][ T9783] usb 4-1: new full-speed USB device number 28 using dummy_hcd [ 502.180504][ T5695] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 502.231918][ T9783] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 502.249552][ T9783] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 502.277671][ T9783] usb 4-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 502.304003][ T9783] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 502.319619][T10976] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1195'. [ 502.335946][ T9783] usb 4-1: config 0 descriptor?? [ 502.352832][ T9783] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 502.368316][ T9783] dvb-usb: bulk message failed: -22 (3/0) [ 502.368466][ T5695] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 502.411821][ T5695] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 502.428188][ T9783] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 502.438880][ T5695] usb 1-1: Product: syz [ 502.462079][ T5695] usb 1-1: Manufacturer: syz [ 502.478244][ T9783] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 502.497106][ T5695] usb 1-1: SerialNumber: syz [ 502.529461][T10962] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 502.556827][ T5695] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 502.567928][ T9783] usb 4-1: media controller created [ 502.580599][ T9783] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 502.662992][ T9783] dvb-usb: bulk message failed: -22 (6/0) [ 502.682654][ T30] audit: type=1400 audit(1784571019.405:563): avc: denied { firmware_load } for pid=9789 comm="kworker/0:6" path="/lib/firmware/ath9k_htc/htc_9271-1.4.0.fw" dev="sda1" ino=313 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 502.727954][ T9783] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 503.216282][T10977] A link change request failed with some changes committed already. Interface veth1_to_hsr may have been left with an inconsistent configuration, please check. [ 503.235958][ T9789] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 503.250943][ T9783] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input29 [ 503.279699][ T9783] dvb-usb: schedule remote query interval to 150 msecs. [ 503.288013][ T9783] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 503.357900][T10981] ceph: No mds server is up or the cluster is laggy [ 503.442705][ T9783] dvb-usb: bulk message failed: -22 (1/0) [ 503.481123][ T9783] dvb-usb: error while querying for an remote control event. [ 503.732451][T10968] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 503.762010][ T9783] dvb-usb: bulk message failed: -22 (1/0) [ 503.775306][ T9783] dvb-usb: error while querying for an remote control event. [ 503.806291][T10968] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 504.101888][ T9783] dvb-usb: bulk message failed: -22 (1/0) [ 504.109394][ T9783] dvb-usb: error while querying for an remote control event. [ 504.139243][ T29] usb 1-1: USB disconnect, device number 24 [ 504.243750][ T9783] usb 4-1: USB disconnect, device number 28 [ 504.311069][ T9783] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 504.332290][ T9789] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 504.348605][ T9789] ath9k_htc: Failed to initialize the device [ 504.364529][ T29] usb 1-1: ath9k_htc: USB layer deinitialized [ 505.213518][T11000] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 505.889317][ T30] audit: type=1400 audit(1784571022.615:564): avc: denied { mounton } for pid=11001 comm="syz.0.1205" path="/proc/818/net/netfilter" dev="proc" ino=4026533007 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=dir permissive=1 [ 506.230316][ T9789] usb 1-1: new low-speed USB device number 25 using dummy_hcd [ 506.750208][ T9789] usb 1-1: unable to get BOS descriptor or descriptor too short [ 506.831718][ T9789] usb 1-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 506.944209][ T9789] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 507.072699][ T9789] usb 1-1: too many endpoints for config 1 interface 1 altsetting 255: 255, using maximum allowed: 30 [ 507.206678][ T9789] usb 1-1: config 1 interface 1 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 507.319904][ T9789] usb 1-1: config 1 interface 1 has no altsetting 0 [ 507.337105][T11013] overlayfs: upperdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 507.381076][ T9] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 507.394821][ T9789] usb 1-1: string descriptor 0 read error: -22 [ 507.411128][ T9789] usb 1-1: New USB device found, idVendor=1235, idProduct=8208, bcdDevice= 0.40 [ 507.430422][T11013] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 507.450521][ T9789] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 507.622171][ T9789] usb 1-1: Focusrite Clarett USB Mixer Driver enabled (pid=0x8208); report any issues to https://github.com/geoffreybennett/scarlett-gen2/issues [ 507.642631][ T9789] usb 1-1: Error initialising Clarett USB Mixer Driver: -22 [ 507.683480][ T9] usb 3-1: config 1 has an invalid interface number: 7 but max is 0 [ 507.703523][ T9] usb 3-1: config 1 has no interface number 0 [ 507.735112][ T9] usb 3-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 507.794731][ T9] usb 3-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 507.813296][ T9789] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 507.825089][ T9] usb 3-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 507.854303][ T9] usb 3-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 507.865891][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 507.875901][ T9789] usb 1-1: USB disconnect, device number 25 [ 507.900109][ T9] usb 3-1: Product: syz [ 507.906793][ T9] usb 3-1: Manufacturer: syz [ 507.912102][ T9] usb 3-1: SerialNumber: syz [ 507.923893][T11011] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 508.267967][T11011] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 508.569291][T11011] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 508.688792][T11011] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 508.804784][ T9] sierra_net 3-1:1.7 wwan0: register 'sierra_net' at usb-dummy_hcd.2-1, Sierra Wireless USB-to-WWAN Modem, 00:00:00:00:01:07 [ 509.401641][ T9789] usb 3-1: USB disconnect, device number 21 [ 509.504259][ T9789] sierra_net 3-1:1.7 wwan0: unregister 'sierra_net' usb-dummy_hcd.2-1, Sierra Wireless USB-to-WWAN Modem [ 509.602771][ T9789] sierra_net 3-1:1.7 wwan0 (unregistered): usb_control_msg failed, status -19 [ 509.691041][ T9] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 509.860478][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 509.874280][ T9] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 509.899357][ T9] usb 2-1: New USB device found, idVendor=1235, idProduct=800c, bcdDevice= 0.40 [ 509.911199][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 509.943957][ T9] usb 2-1: Product: syz [ 509.956807][ T9] usb 2-1: Manufacturer: syz [ 509.979462][ T9] usb 2-1: SerialNumber: syz [ 510.171333][T11042] FAULT_INJECTION: forcing a failure. [ 510.171333][T11042] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 510.478174][ T9] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 510.488386][T11042] CPU: 0 UID: 0 PID: 11042 Comm: syz.0.1218 Tainted: G L syzkaller #0 PREEMPT(full) [ 510.488414][T11042] Tainted: [L]=SOFTLOCKUP [ 510.488420][T11042] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 510.488438][T11042] Call Trace: [ 510.488444][T11042] [ 510.488451][T11042] dump_stack_lvl+0x100/0x190 [ 510.488479][T11042] should_fail_ex.cold+0x5/0xa [ 510.488501][T11042] _copy_from_user+0x2e/0xd0 [ 510.488524][T11042] kstrtouint_from_user+0xd6/0x1d0 [ 510.488551][T11042] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 510.488589][T11042] proc_fail_nth_write+0x83/0x220 [ 510.488613][T11042] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 510.488643][T11042] vfs_write+0x2aa/0x1050 [ 510.488670][T11042] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 510.488696][T11042] ? __pfx_vfs_write+0x10/0x10 [ 510.488717][T11042] ? __fget_files+0x215/0x3d0 [ 510.488738][T11042] ? __fget_files+0x21f/0x3d0 [ 510.488759][T11042] ksys_write+0x12a/0x250 [ 510.488782][T11042] ? __pfx_ksys_write+0x10/0x10 [ 510.488814][T11042] do_syscall_64+0x115/0x870 [ 510.488831][T11042] ? clear_bhb_loop+0x40/0x90 [ 510.488852][T11042] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 510.488868][T11042] RIP: 0033:0x7f52c3b5e6ce [ 510.488882][T11042] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 510.488898][T11042] RSP: 002b:00007f52c4adffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 510.488916][T11042] RAX: ffffffffffffffda RBX: 00007f52c4ae06c0 RCX: 00007f52c3b5e6ce [ 510.488926][T11042] RDX: 0000000000000001 RSI: 00007f52c4ae00a0 RDI: 0000000000000004 [ 510.488936][T11042] RBP: 00007f52c4ae0090 R08: 0000000000000000 R09: 0000000000000000 [ 510.488946][T11042] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 510.488956][T11042] R13: 00007f52c3e26038 R14: 00007f52c3e25fa0 R15: 00007ffdd4643d58 [ 510.488981][T11042] [ 510.511269][T11046] binder: 11045:11046 ioctl c0306201 2000000001c0 returned -14 [ 510.518872][ T30] audit: type=1400 audit(1784571027.225:565): avc: denied { execute } for pid=11045 comm="syz.2.1219" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 510.880004][T11052] tmpfs: Bad value for 'mpol' [ 511.041183][ T30] audit: type=1326 audit(1784571027.515:566): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11047 comm="syz.3.1220" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7ff57619de99 code=0x0 [ 511.375206][ T30] audit: type=1400 audit(1784571027.535:567): avc: denied { unmount } for pid=5606 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 511.584156][ T30] audit: type=1400 audit(1784571027.565:568): avc: denied { setopt } for pid=11047 comm="syz.3.1220" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 511.890296][ T30] audit: type=1400 audit(1784571028.015:569): avc: denied { write } for pid=11055 comm="syz.2.1222" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 512.530434][ T5695] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 512.578437][T11078] binder: 11077:11078 ioctl c0306201 0 returned -14 [ 512.611316][T11078] FAULT_INJECTION: forcing a failure. [ 512.611316][T11078] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 512.630154][T11078] CPU: 0 UID: 0 PID: 11078 Comm: syz.0.1227 Tainted: G L syzkaller #0 PREEMPT(full) [ 512.630182][T11078] Tainted: [L]=SOFTLOCKUP [ 512.630188][T11078] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 512.630197][T11078] Call Trace: [ 512.630203][T11078] [ 512.630213][T11078] dump_stack_lvl+0x100/0x190 [ 512.630238][T11078] should_fail_ex.cold+0x5/0xa [ 512.630258][T11078] _copy_to_user+0x32/0xd0 [ 512.630281][T11078] simple_read_from_buffer+0xcb/0x170 [ 512.630311][T11078] proc_fail_nth_read+0x1af/0x230 [ 512.630336][T11078] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 512.630361][T11078] ? rw_verify_area+0xce/0x6d0 [ 512.630383][T11078] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 512.630406][T11078] vfs_read+0x1e4/0xb40 [ 512.630432][T11078] ? __pfx_vfs_read+0x10/0x10 [ 512.630455][T11078] ? __fget_files+0x215/0x3d0 [ 512.630476][T11078] ? __fget_files+0x21f/0x3d0 [ 512.630499][T11078] ksys_read+0x12a/0x250 [ 512.630522][T11078] ? __pfx_ksys_read+0x10/0x10 [ 512.630552][T11078] do_syscall_64+0x115/0x870 [ 512.630567][T11078] ? clear_bhb_loop+0x40/0x90 [ 512.630588][T11078] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 512.630605][T11078] RIP: 0033:0x7f52c3b5e6ce [ 512.630619][T11078] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 512.630635][T11078] RSP: 002b:00007f52c4adffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 512.630652][T11078] RAX: ffffffffffffffda RBX: 00007f52c4ae06c0 RCX: 00007f52c3b5e6ce [ 512.630662][T11078] RDX: 000000000000000f RSI: 00007f52c4ae00a0 RDI: 0000000000000005 [ 512.630672][T11078] RBP: 00007f52c4ae0090 R08: 0000000000000000 R09: 0000000000000000 [ 512.630682][T11078] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 512.630691][T11078] R13: 00007f52c3e26038 R14: 00007f52c3e25fa0 R15: 00007ffdd4643d58 [ 512.630714][T11078] [ 512.846023][ T5695] usb 4-1: Using ep0 maxpacket: 32 [ 512.860348][ T5695] usb 4-1: unable to get BOS descriptor or descriptor too short [ 512.874230][ T5695] usb 4-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 512.886996][ T5695] usb 4-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 512.896454][ T5695] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 512.908010][ T5695] usb 4-1: Product: syz [ 512.912228][ T5695] usb 4-1: Manufacturer: syz [ 512.916831][ T5695] usb 4-1: SerialNumber: syz [ 512.961157][ T29] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 513.870261][ T5695] usb 4-1: Cannot retrieve CPort count: -110 [ 513.877900][ T5695] usb 4-1: Cannot retrieve CPort count: -110 [ 513.898420][ T5695] es2_ap_driver 4-1:7.0: probe with driver es2_ap_driver failed with error -110 [ 514.000458][ T29] usb 3-1: device descriptor read/64, error -71 [ 514.163591][ T9] usb 2-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 514.240461][ T29] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 514.267101][ T9] usb 2-1: USB disconnect, device number 24 [ 514.380439][ T29] usb 3-1: device descriptor read/64, error -71   /dev/fusefd=0x0000000000000004,rootmode=00000000000000000040000,user_id=00000000000000000000,group_id=00000000000000000000P)F@s [ 514.512815][ T30] audit: type=1400 audit(1784571031.245:570): avc: denied { getopt } for pid=11069 comm="syz.3.1224" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 514.640609][ T9] usb 2-1: new high-speed USB device number 25 using dummy_hcd @ [ 514.816584][ T9] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 514.845323][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 514.885046][ T9] usb 2-1: Product: syz [ 514.926769][ T29] usb usb3-port1: attempt power cycle [ 514.932666][ T9] usb 2-1: Manufacturer: syz [ 514.953723][ T9] usb 2-1: SerialNumber: syz [ 515.657256][ T9] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 515.725222][ T9] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 515.739728][ T5695] usb 4-1: USB disconnect, device number 29 [ 515.942730][T11102] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1234'. [ 516.005537][ T9] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00000010. ret = -EPROTO [ 516.047069][ T9] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 516.088282][ T9] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 516.137855][ T9] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -71 [ 516.177557][ T9] usb 2-1: USB disconnect, device number 25 [ 516.445927][T11112] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 517.449163][T11123] overlayfs: missing 'workdir' [ 517.558903][T11124] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1239'. [ 518.259678][T11136] Bluetooth: MGMT ver 1.23 [ 518.274180][T11137] lo: entered allmulticast mode [ 518.305971][T11134] lo: left allmulticast mode [ 519.322831][T11150] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1248'. [ 519.353949][ T30] audit: type=1800 audit(1784571036.085:571): pid=11129 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.2.1242" name="bus" dev="ramfs" ino=25384 res=0 errno=0 [ 519.610560][ T5695] usb 2-1: new full-speed USB device number 26 using dummy_hcd [ 519.972149][ T5695] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 519.972180][ T5695] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 519.972216][ T5695] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 519.972238][ T5695] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 520.188052][T11159] netlink: 'syz.0.1252': attribute type 18 has an invalid length. [ 520.279869][T11159] RGB/YUV Input: ================= START STATUS ================= [ 520.279907][T11159] RGB/YUV Input: Test Pattern: 75% Colorbar [ 520.281934][T11159] RGB/YUV Input: Show Information: All [ 520.282193][T11159] RGB/YUV Input: Vertical Flip: false [ 520.282235][T11159] RGB/YUV Input: Horizontal Flip: false [ 520.282268][T11159] RGB/YUV Input: Brightness: 128 [ 520.282301][T11159] RGB/YUV Input: Contrast: 128 [ 520.282386][T11159] RGB/YUV Input: Hue: 0 [ 520.282425][T11159] RGB/YUV Input: Saturation: 128 [ 520.282495][T11159] RGB/YUV Input: Pixel Rate: 160000000 [ 520.282551][T11159] RGB/YUV Input: Horizontal Blanking: 800 [ 520.282587][T11159] RGB/YUV Input: Vertical Blanking: 3223 [ 520.282660][T11159] RGB/YUV Input: ================== END STATUS ================== [ 520.406207][ T76] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 520.412244][ T12] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 520.418013][ T76] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 520.418070][ T76] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 520.778639][ T5695] usb 2-1: usb_control_msg returned -32 [ 520.778679][ T5695] usbtmc 2-1:16.0: can't read capabilities [ 521.082954][T11171] overlayfs: missing 'workdir' [ 521.110213][T11171] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1254'. [ 521.962269][T11181] gfs2: not a GFS2 filesystem [ 521.972287][ T30] audit: type=1400 audit(1784571038.695:572): avc: denied { connect } for pid=11182 comm="syz.0.1257" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 522.817707][ T24] usb 2-1: USB disconnect, device number 26 [ 525.440327][ T9] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 525.626160][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 525.726061][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 525.750967][ T9] usb 2-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 526.076961][ T9] usb 2-1: New USB device found, idVendor=046d, idProduct=08f6, bcdDevice= 0.40 [ 526.106566][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 526.135468][ T9] usb 2-1: Product: syz [ 526.152694][ T9] usb 2-1: Manufacturer: syz [ 526.373795][ T9] usb 2-1: SerialNumber: syz [ 526.684044][ T9] usb 2-1: can't set config #1, error -71 [ 526.702765][ T9] usb 2-1: USB disconnect, device number 27 [ 526.905631][T11216] FAULT_INJECTION: forcing a failure. [ 526.905631][T11216] name failslab, interval 1, probability 0, space 0, times 0 [ 526.985077][T11216] CPU: 1 UID: 0 PID: 11216 Comm: syz.1.1265 Tainted: G L syzkaller #0 PREEMPT(full) [ 526.985111][T11216] Tainted: [L]=SOFTLOCKUP [ 526.985117][T11216] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 526.985127][T11216] Call Trace: [ 526.985134][T11216] [ 526.985141][T11216] dump_stack_lvl+0x100/0x190 [ 526.985169][T11216] should_fail_ex.cold+0x5/0xa [ 526.985192][T11216] should_failslab+0xc2/0x120 [ 526.985213][T11216] __kmalloc_noprof+0xfc/0x820 [ 526.985233][T11216] ? tomoyo_encode2+0xfb/0x3c0 [ 526.985264][T11216] tomoyo_encode2+0xfb/0x3c0 [ 526.985293][T11216] tomoyo_encode+0x29/0x50 [ 526.985318][T11216] tomoyo_realpath_from_path+0x18c/0x690 [ 526.985349][T11216] tomoyo_mount_acl+0x1b6/0x8b0 [ 526.985373][T11216] ? is_bpf_text_address+0x8a/0x1a0 [ 526.985396][T11216] ? bpf_ksym_find+0x128/0x1c0 [ 526.985420][T11216] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 526.985449][T11216] ? __pfx_tomoyo_mount_acl+0x10/0x10 [ 526.985472][T11216] ? kernel_text_address+0x8d/0x100 [ 526.985491][T11216] ? unwind_get_return_address+0x59/0xa0 [ 526.985542][T11216] ? tomoyo_domain+0xb2/0x150 [ 526.985559][T11216] ? tomoyo_profile+0x47/0x60 [ 526.985578][T11216] tomoyo_mount_permission+0x214/0x460 [ 526.985602][T11216] ? tomoyo_mount_permission+0x1f6/0x460 [ 526.985628][T11216] ? __pfx_tomoyo_mount_permission+0x10/0x10 [ 526.985667][T11216] security_sb_mount+0xdd/0x270 [ 526.985692][T11216] path_mount+0x158/0x23d0 [ 526.985718][T11216] ? __pfx_path_mount+0x10/0x10 [ 526.985736][T11216] ? lockdep_hardirqs_on+0x78/0x100 [ 526.985767][T11216] ? putname+0xb1/0x110 [ 526.985783][T11216] ? kmem_cache_free+0x127/0x6b0 [ 526.985819][T11216] ? __x64_sys_mount+0x293/0x310 [ 526.985838][T11216] __x64_sys_mount+0x293/0x310 [ 526.985860][T11216] ? __pfx___x64_sys_mount+0x10/0x10 [ 526.985887][T11216] do_syscall_64+0x115/0x870 [ 526.985903][T11216] ? clear_bhb_loop+0x40/0x90 [ 526.985924][T11216] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 526.985947][T11216] RIP: 0033:0x7f2c9259de99 [ 526.985962][T11216] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 526.985978][T11216] RSP: 002b:00007f2c93398028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 526.985997][T11216] RAX: ffffffffffffffda RBX: 00007f2c92825fa0 RCX: 00007f2c9259de99 [ 526.986008][T11216] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000200000000000 [ 526.986018][T11216] RBP: 00007f2c93398090 R08: 0000000000000000 R09: 0000000000000000 [ 526.986029][T11216] R10: 0000000000802000 R11: 0000000000000246 R12: 0000000000000001 [ 526.986039][T11216] R13: 00007f2c92826038 R14: 00007f2c92825fa0 R15: 00007ffc3b011848 [ 526.986063][T11216] [ 526.986241][T11216] ERROR: Out of memory at tomoyo_realpath_from_path. [ 527.507705][T11221] overlayfs: missing 'lowerdir' [ 527.633370][T11223] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1266'. [ 528.151730][ T30] audit: type=1400 audit(1784571044.885:573): avc: denied { bind } for pid=11227 comm="syz.4.1267" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 528.195785][T11230] FAULT_INJECTION: forcing a failure. [ 528.195785][T11230] name failslab, interval 1, probability 0, space 0, times 0 [ 528.264678][ T30] audit: type=1400 audit(1784571044.985:574): avc: denied { listen } for pid=11227 comm="syz.4.1267" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 528.315313][T11230] CPU: 1 UID: 0 PID: 11230 Comm: syz.1.1269 Tainted: G L syzkaller #0 PREEMPT(full) [ 528.315342][T11230] Tainted: [L]=SOFTLOCKUP [ 528.315348][T11230] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 528.315359][T11230] Call Trace: [ 528.315365][T11230] [ 528.315371][T11230] dump_stack_lvl+0x100/0x190 [ 528.315398][T11230] should_fail_ex.cold+0x5/0xa [ 528.315422][T11230] should_failslab+0xc2/0x120 [ 528.315445][T11230] kmem_cache_alloc_noprof+0x91/0x6a0 [ 528.315462][T11230] ? d_instantiate+0x8a/0xb0 [ 528.315483][T11230] ? d_instantiate+0x8a/0xb0 [ 528.315501][T11230] ? alloc_empty_file+0x5b/0x1c0 [ 528.315526][T11230] alloc_empty_file+0x5b/0x1c0 [ 528.315545][T11230] alloc_file_pseudo+0x183/0x290 [ 528.315565][T11230] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 528.315587][T11230] ? _raw_spin_unlock+0x28/0x50 [ 528.315611][T11230] ? alloc_fd+0x471/0x7a0 [ 528.315630][T11230] __anon_inode_getfile+0xe8/0x280 [ 528.315657][T11230] __anon_inode_getfd+0x5c/0xe0 [ 528.315684][T11230] __x64_sys_fsopen+0x190/0x220 [ 528.315708][T11230] do_syscall_64+0x115/0x870 [ 528.315724][T11230] ? clear_bhb_loop+0x40/0x90 [ 528.315746][T11230] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 528.315764][T11230] RIP: 0033:0x7f2c9259de99 [ 528.315780][T11230] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 528.315796][T11230] RSP: 002b:00007f2c93398028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 528.315814][T11230] RAX: ffffffffffffffda RBX: 00007f2c92825fa0 RCX: 00007f2c9259de99 [ 528.315831][T11230] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000001e80 [ 528.315841][T11230] RBP: 00007f2c93398090 R08: 0000000000000000 R09: 0000000000000000 [ 528.315851][T11230] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 528.315861][T11230] R13: 00007f2c92826038 R14: 00007f2c92825fa0 R15: 00007ffc3b011848 [ 528.315886][T11230] [ 528.651319][ T30] audit: type=1400 audit(1784571044.995:575): avc: denied { connect } for pid=11227 comm="syz.4.1267" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 529.372130][ T30] audit: type=1400 audit(1784571045.315:576): avc: denied { accept } for pid=11227 comm="syz.4.1267" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 530.482564][ T30] audit: type=1400 audit(1784571047.215:577): avc: denied { read } for pid=11227 comm="syz.4.1267" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 530.629860][T11239] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 530.770287][ T30] audit: type=1400 audit(1784571047.495:578): avc: denied { read write } for pid=11249 comm="syz.2.1274" name="usbmon8" dev="devtmpfs" ino=741 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 530.795639][T11251] usb usb8: usbfs: process 11251 (syz.2.1274) did not claim interface 0 before use [ 530.827922][ T30] audit: type=1400 audit(1784571047.495:579): avc: denied { open } for pid=11249 comm="syz.2.1274" path="/dev/usbmon8" dev="devtmpfs" ino=741 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 531.196271][ T30] audit: type=1400 audit(1784571047.925:580): avc: denied { accept } for pid=11257 comm="syz.1.1277" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 532.150659][T11265] overlayfs: missing 'lowerdir' [ 532.202081][T11266] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1278'. [ 532.339593][T11268] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1280'. [ 533.673722][ T9783] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 533.773519][ T30] audit: type=1800 audit(1784571050.495:581): pid=11273 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.1281" name="bus" dev="ramfs" ino=26889 res=0 errno=0 [ 533.853041][ T9783] usb 2-1: Using ep0 maxpacket: 32 [ 533.859996][ T9783] usb 2-1: config 3 has an invalid interface number: 79 but max is 0 [ 533.893823][ T9783] usb 2-1: config 3 has no interface number 0 [ 533.910666][ T9783] usb 2-1: config 3 interface 79 altsetting 5 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 533.961912][ T9783] usb 2-1: config 3 interface 79 has no altsetting 0 [ 534.032206][ T9783] usb 2-1: New USB device found, idVendor=0d46, idProduct=0081, bcdDevice=fc.21 [ 534.073359][ T9783] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 534.105397][ T9783] usb 2-1: Product: syz [ 534.129907][ T9783] usb 2-1: Manufacturer: syz [ 534.156711][ T9783] usb 2-1: SerialNumber: syz [ 534.234258][T11294] orangefs_devreq_open: device cannot be opened in blocking mode [ 535.023823][T11291] orangefs_mount: mount request failed with -4 [ 535.123106][ T9783] kobil_sct 2-1:3.79: KOBIL USB smart card terminal converter detected [ 535.174311][ T9783] usb 2-1: KOBIL USB smart card terminal converter now attached to ttyUSB0 [ 535.251820][ T9783] usb 2-1: USB disconnect, device number 28 [ 535.295498][ T9783] kobil ttyUSB0: KOBIL USB smart card terminal converter now disconnected from ttyUSB0 [ 535.345899][ T9783] kobil_sct 2-1:3.79: device disconnected [ 535.564743][T11306] FAULT_INJECTION: forcing a failure. [ 535.564743][T11306] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 535.605581][T11306] CPU: 1 UID: 0 PID: 11306 Comm: syz.0.1288 Tainted: G L syzkaller #0 PREEMPT(full) [ 535.605602][T11306] Tainted: [L]=SOFTLOCKUP [ 535.605606][T11306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 535.605613][T11306] Call Trace: [ 535.605617][T11306] [ 535.605621][T11306] dump_stack_lvl+0x100/0x190 [ 535.605639][T11306] should_fail_ex.cold+0x5/0xa [ 535.605652][T11306] _copy_from_user+0x2e/0xd0 [ 535.605666][T11306] copy_msghdr_from_user+0x9f/0x4c0 [ 535.605683][T11306] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 535.605705][T11306] ___sys_sendmsg+0x106/0x1e0 [ 535.605721][T11306] ? __pfx____sys_sendmsg+0x10/0x10 [ 535.605735][T11306] ? __lock_acquire+0x49f/0x1a40 [ 535.605748][T11306] ? get_pid_task+0x106/0x250 [ 535.605778][T11306] __sys_sendmsg+0x160/0x210 [ 535.605791][T11306] ? __pfx___sys_sendmsg+0x10/0x10 [ 535.605810][T11306] do_syscall_64+0x115/0x870 [ 535.605820][T11306] ? clear_bhb_loop+0x40/0x90 [ 535.605834][T11306] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 535.605844][T11306] RIP: 0033:0x7f52c3b9de99 [ 535.605854][T11306] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 535.605865][T11306] RSP: 002b:00007f52c4ae0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 535.605876][T11306] RAX: ffffffffffffffda RBX: 00007f52c3e25fa0 RCX: 00007f52c3b9de99 [ 535.605883][T11306] RDX: 0000000004008000 RSI: 0000200000000040 RDI: 0000000000000003 [ 535.605890][T11306] RBP: 00007f52c4ae0090 R08: 0000000000000000 R09: 0000000000000000 [ 535.605896][T11306] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 535.605902][T11306] R13: 00007f52c3e26038 R14: 00007f52c3e25fa0 R15: 00007ffdd4643d58 [ 535.605916][T11306] [ 536.623108][T11317] IPVS: set_ctl: invalid protocol: 51 127.0.0.1:20000 [ 537.945640][ T30] audit: type=1400 audit(1784571054.675:582): avc: denied { read append } for pid=11320 comm="syz.0.1293" name="btrfs-control" dev="devtmpfs" ino=1315 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 538.063077][T11330] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1294'. [ 538.072187][T11330] netlink: 90 bytes leftover after parsing attributes in process `syz.4.1294'. [ 538.173403][T11330] netlink: 90 bytes leftover after parsing attributes in process `syz.4.1294'. [ 538.175245][ T30] audit: type=1400 audit(1784571054.725:583): avc: denied { open } for pid=11320 comm="syz.0.1293" path="/dev/btrfs-control" dev="devtmpfs" ino=1315 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 539.133103][T11214] syz.3.1264 (11214): drop_caches: 3 [ 539.685715][ T30] audit: type=1400 audit(1784571056.415:584): avc: denied { append } for pid=11349 comm="syz.1.1302" name="001" dev="devtmpfs" ino=737 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 539.857286][ T30] audit: type=1400 audit(1784571056.585:585): avc: denied { setopt } for pid=11349 comm="syz.1.1302" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 540.581815][ T30] audit: type=1326 audit(1784571056.655:586): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11348 comm="syz.0.1300" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f52c3b9de99 code=0x7ffc0000 [ 540.842223][ T30] audit: type=1326 audit(1784571056.655:587): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11348 comm="syz.0.1300" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f52c3b9de99 code=0x7ffc0000 [ 540.908693][ T30] audit: type=1326 audit(1784571056.655:588): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11348 comm="syz.0.1300" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f52c3b9de99 code=0x7ffc0000 [ 541.065329][ T30] audit: type=1326 audit(1784571056.685:589): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11348 comm="syz.0.1300" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f52c3b9de99 code=0x7ffc0000 [ 541.255013][ T30] audit: type=1326 audit(1784571056.685:590): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11348 comm="syz.0.1300" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f52c3b9de99 code=0x7ffc0000 [ 541.940422][ T30] audit: type=1326 audit(1784571056.685:591): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11348 comm="syz.0.1300" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f52c3b9de99 code=0x7ffc0000 [ 542.279267][ T30] audit: type=1326 audit(1784571056.685:592): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11348 comm="syz.0.1300" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f52c3b9de99 code=0x7ffc0000 [ 542.362928][T11371] FAULT_INJECTION: forcing a failure. [ 542.362928][T11371] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 542.376229][T11371] CPU: 0 UID: 0 PID: 11371 Comm: syz.0.1306 Tainted: G L syzkaller #0 PREEMPT(full) [ 542.376256][T11371] Tainted: [L]=SOFTLOCKUP [ 542.376262][T11371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 542.376272][T11371] Call Trace: [ 542.376278][T11371] [ 542.376286][T11371] dump_stack_lvl+0x100/0x190 [ 542.376313][T11371] should_fail_ex.cold+0x5/0xa [ 542.376330][T11371] ? prepare_alloc_pages+0x16d/0x5f0 [ 542.376354][T11371] should_fail_alloc_page+0xeb/0x140 [ 542.376377][T11371] prepare_alloc_pages+0x1f0/0x5f0 [ 542.376398][T11371] ? stack_depot_save_flags+0x479/0x9d0 [ 542.376425][T11371] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 542.376455][T11371] ? stack_depot_save_flags+0x479/0x9d0 [ 542.376482][T11371] ? kasan_save_stack+0x3f/0x50 [ 542.376499][T11371] ? kasan_save_stack+0x30/0x50 [ 542.376516][T11371] ? kasan_save_track+0x14/0x30 [ 542.376533][T11371] ? __kasan_krealloc+0xf9/0x160 [ 542.376551][T11371] ? krealloc_node_align_noprof+0x269/0x3e0 [ 542.376570][T11371] ? slab_build_skb+0xa3/0x400 [ 542.376585][T11371] ? bpf_prog_test_run_skb+0x505/0x3540 [ 542.376609][T11371] ? __sys_bpf+0x2a12/0x4e80 [ 542.376633][T11371] ? __x64_sys_bpf+0xce/0x140 [ 542.376648][T11371] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 542.376701][T11371] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 542.376723][T11371] ? policy_nodemask+0xed/0x4f0 [ 542.376746][T11371] alloc_pages_mpol+0x1fb/0x540 [ 542.376769][T11371] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 542.376790][T11371] ? krealloc_node_align_noprof+0x269/0x3e0 [ 542.376814][T11371] alloc_pages_noprof+0x1a/0x160 [ 542.376838][T11371] bpf_prog_test_run_skb+0x2887/0x3540 [ 542.376872][T11371] ? __fget_files+0x131/0x3d0 [ 542.376894][T11371] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 542.376922][T11371] ? fput+0x79/0x100 [ 542.376942][T11371] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 542.376967][T11371] __sys_bpf+0x2a12/0x4e80 [ 542.376992][T11371] ? mark_held_locks+0x40/0x70 [ 542.377016][T11371] ? __pfx___sys_bpf+0x10/0x10 [ 542.377041][T11371] ? __rcu_read_unlock+0x26a/0x5e0 [ 542.377062][T11371] ? rcu_is_watching+0x12/0xc0 [ 542.377087][T11371] ? __rcu_read_unlock+0x27f/0x5e0 [ 542.377112][T11371] ? find_held_lock+0x2b/0x80 [ 542.377142][T11371] ? rcu_read_lock_any_held+0x6a/0xa0 [ 542.377168][T11371] ? find_held_lock+0x2b/0x80 [ 542.377191][T11371] ? ksys_write+0x190/0x250 [ 542.377210][T11371] ? ksys_write+0x190/0x250 [ 542.377249][T11371] ? fput+0x79/0x100 [ 542.377272][T11371] ? __x64_sys_bpf+0xce/0x140 [ 542.377288][T11371] __x64_sys_bpf+0xce/0x140 [ 542.377304][T11371] ? do_syscall_64+0x90/0x870 [ 542.377322][T11371] do_syscall_64+0x115/0x870 [ 542.377337][T11371] ? clear_bhb_loop+0x40/0x90 [ 542.377357][T11371] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 542.377374][T11371] RIP: 0033:0x7f52c3b9de99 [ 542.377389][T11371] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 542.377405][T11371] RSP: 002b:00007f52c4a9e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 542.377422][T11371] RAX: ffffffffffffffda RBX: 00007f52c3e26180 RCX: 00007f52c3b9de99 [ 542.377432][T11371] RDX: 0000000000000050 RSI: 0000200000001a00 RDI: 000000000000000a [ 542.377442][T11371] RBP: 00007f52c4a9e090 R08: 0000000000000000 R09: 0000000000000000 [ 542.377452][T11371] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 542.377462][T11371] R13: 00007f52c3e26218 R14: 00007f52c3e26180 R15: 00007ffdd4643d58 [ 542.377485][T11371] [ 543.082819][ T30] audit: type=1326 audit(1784571056.685:593): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11348 comm="syz.0.1300" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=97 compat=0 ip=0x7f52c3b9de99 code=0x7ffc0000 [ 543.250583][ T24] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 543.604525][ T24] usb 2-1: Using ep0 maxpacket: 32 [ 544.013688][ T29] usb 1-1: new full-speed USB device number 26 using dummy_hcd [ 544.043710][ T24] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 544.213700][ T24] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 544.225130][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 544.240792][ T24] usb 2-1: Product: syz [ 544.251278][ T24] usb 2-1: Manufacturer: syz [ 544.983004][ T24] usb 2-1: SerialNumber: syz [ 544.999033][ T29] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 545.012099][ T29] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 545.024306][ T29] usb 1-1: Product: syz [ 545.032467][ T29] usb 1-1: Manufacturer: syz [ 545.037676][ T29] usb 1-1: SerialNumber: syz [ 545.047169][ T24] usb 2-1: config 0 descriptor?? [ 545.068865][ T29] usb 1-1: config 0 descriptor?? [ 545.079224][ T24] quatech2 2-1:0.0: Quatech 2nd gen USB to Serial Driver converter detected [ 545.140066][ T24] usb 2-1: qt2_attach - failed to power on unit: -71 [ 545.150728][ T24] quatech2 2-1:0.0: probe with driver quatech2 failed with error -71 [ 545.185657][ T24] usb 2-1: USB disconnect, device number 29 [ 545.287362][ T29] usb 1-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 546.114922][ T29] dvb_usb_rtl28xxu 1-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 546.743075][ T29] usb 1-1: USB disconnect, device number 26 [ 547.264206][ T30] kauditd_printk_skb: 14 callbacks suppressed [ 547.264246][ T30] audit: type=1400 audit(1784571063.995:608): avc: denied { append } for pid=11400 comm="syz.4.1314" name="loop5" dev="devtmpfs" ino=652 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 549.701566][T11436] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1323'. [ 550.810507][ T9] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 551.031331][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 551.274646][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 551.327781][ T9] usb 2-1: New USB device found, idVendor=046d, idProduct=c295, bcdDevice= 0.00 [ 551.433366][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 551.461829][ T30] audit: type=1400 audit(1784571068.195:609): avc: denied { ioctl } for pid=11448 comm="syz.3.1329" path="/dev/fuse" dev="devtmpfs" ino=99 ioctlcmd=0xe503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 551.496361][ T9] usb 2-1: config 0 descriptor?? [ 551.871609][ T30] audit: type=1400 audit(1784571068.575:610): avc: denied { mounton } for pid=11448 comm="syz.3.1329" path="/276/file0" dev="tmpfs" ino=1515 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=sock_file permissive=1 [ 552.319289][ T9] hid_parser_main: 29 callbacks suppressed [ 552.319310][ T9] logitech 0003:046D:C295.0004: unknown main item tag 0x0 [ 552.452501][ T9] logitech 0003:046D:C295.0004: unknown main item tag 0x0 [ 552.459713][ T9] logitech 0003:046D:C295.0004: unknown main item tag 0x0 [ 552.468750][ T9] logitech 0003:046D:C295.0004: unknown main item tag 0x0 [ 552.480582][ T9] logitech 0003:046D:C295.0004: unknown main item tag 0x0 [ 552.487751][ T9] logitech 0003:046D:C295.0004: unknown main item tag 0x0 [ 552.506156][ T9] logitech 0003:046D:C295.0004: unknown main item tag 0x0 [ 552.531344][ T9] logitech 0003:046D:C295.0004: unknown main item tag 0x0 [ 552.675098][ T9] logitech 0003:046D:C295.0004: unknown main item tag 0x0 [ 552.682436][ T9] logitech 0003:046D:C295.0004: unknown main item tag 0x0 [ 552.697343][ T9] logitech 0003:046D:C295.0004: hidraw0: USB HID v0.83 Device [HID 046d:c295] on usb-dummy_hcd.1-1/input0 [ 552.730510][ T9] logitech 0003:046D:C295.0004: no inputs found [ 552.757984][ T9] usb 2-1: USB disconnect, device number 30 [ 552.795434][T11464] FAULT_INJECTION: forcing a failure. [ 552.795434][T11464] name failslab, interval 1, probability 0, space 0, times 0 [ 552.810892][T11464] CPU: 1 UID: 0 PID: 11464 Comm: syz.2.1330 Tainted: G L syzkaller #0 PREEMPT(full) [ 552.810921][T11464] Tainted: [L]=SOFTLOCKUP [ 552.810927][T11464] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 552.810937][T11464] Call Trace: [ 552.810943][T11464] [ 552.810950][T11464] dump_stack_lvl+0x100/0x190 [ 552.810978][T11464] should_fail_ex.cold+0x5/0xa [ 552.810999][T11464] should_failslab+0xc2/0x120 [ 552.811020][T11464] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 552.811041][T11464] ? __alloc_skb+0x5b7/0x710 [ 552.811058][T11464] ? __alloc_skb+0x140/0x710 [ 552.811079][T11464] __alloc_skb+0x140/0x710 [ 552.811095][T11464] ? __alloc_skb+0x5b7/0x710 [ 552.811112][T11464] ? __pfx___alloc_skb+0x10/0x10 [ 552.811128][T11464] ? __pfx_selinux_socket_getpeersec_dgram+0x10/0x10 [ 552.811153][T11464] ? sock_has_perm+0x25a/0x2f0 [ 552.811180][T11464] ? __pfx_sock_has_perm+0x10/0x10 [ 552.811203][T11464] netlink_alloc_large_skb+0x69/0x150 [ 552.811232][T11464] netlink_sendmsg+0x680/0xda0 [ 552.811262][T11464] ? __pfx_netlink_sendmsg+0x10/0x10 [ 552.811291][T11464] ? selinux_socket_sendmsg+0x198/0x2f0 [ 552.811318][T11464] ____sys_sendmsg+0xa4d/0xbe0 [ 552.811340][T11464] ? __pfx_netlink_sendmsg+0x10/0x10 [ 552.811369][T11464] ? __pfx_____sys_sendmsg+0x10/0x10 [ 552.811404][T11464] ___sys_sendmsg+0x190/0x1e0 [ 552.811431][T11464] ? __pfx____sys_sendmsg+0x10/0x10 [ 552.811454][T11464] ? __lock_acquire+0x49f/0x1a40 [ 552.811474][T11464] ? get_pid_task+0x106/0x250 [ 552.811528][T11464] __sys_sendmsg+0x160/0x210 [ 552.811548][T11464] ? __pfx___sys_sendmsg+0x10/0x10 [ 552.811581][T11464] do_syscall_64+0x115/0x870 [ 552.811598][T11464] ? clear_bhb_loop+0x40/0x90 [ 552.811619][T11464] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 552.811637][T11464] RIP: 0033:0x7fe18ef9de99 [ 552.811652][T11464] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 552.811668][T11464] RSP: 002b:00007fe18d1d5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 552.811686][T11464] RAX: ffffffffffffffda RBX: 00007fe18f226180 RCX: 00007fe18ef9de99 [ 552.811697][T11464] RDX: 0000000004040000 RSI: 0000200000000240 RDI: 0000000000000007 [ 552.811708][T11464] RBP: 00007fe18d1d5090 R08: 0000000000000000 R09: 0000000000000000 [ 552.811718][T11464] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 552.811728][T11464] R13: 00007fe18f226218 R14: 00007fe18f226180 R15: 00007fffbf8c2168 [ 552.811753][T11464] [ 553.325616][T11462] fido_id[11462]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 553.813025][T11468] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=11468 comm=syz.3.1332 [ 553.833965][T11468] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1332'. [ 553.887460][T11475] overlayfs: missing 'lowerdir' [ 554.934109][T11484] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1337'. [ 555.063425][T11489] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1338'. [ 555.072602][T11489] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1338'. [ 555.082841][T11489] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1338'. [ 555.091835][T11489] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1338'. [ 555.403778][T11490] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1336'. [ 555.609136][T11492] FAULT_INJECTION: forcing a failure. [ 555.609136][T11492] name failslab, interval 1, probability 0, space 0, times 0 [ 555.622893][T11492] CPU: 1 UID: 0 PID: 11492 Comm: syz.3.1340 Tainted: G L syzkaller #0 PREEMPT(full) [ 555.622922][T11492] Tainted: [L]=SOFTLOCKUP [ 555.622928][T11492] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 555.622938][T11492] Call Trace: [ 555.622944][T11492] [ 555.622951][T11492] dump_stack_lvl+0x100/0x190 [ 555.622979][T11492] should_fail_ex.cold+0x5/0xa [ 555.623002][T11492] should_failslab+0xc2/0x120 [ 555.623024][T11492] kmem_cache_alloc_noprof+0x91/0x6a0 [ 555.623044][T11492] ? skb_clone+0x190/0x400 [ 555.623068][T11492] skb_clone+0x190/0x400 [ 555.623088][T11492] bpf_clone_redirect+0x166/0x500 [ 555.623110][T11492] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 555.623150][T11492] bpf_prog_1939c40fbf65037b+0x5f/0x68 [ 555.623168][T11492] ? unwind_get_return_address+0x59/0xa0 [ 555.623196][T11492] ? arch_stack_walk+0xa6/0xf0 [ 555.623224][T11492] ? __lock_acquire+0x49f/0x1a40 [ 555.623247][T11492] ? __lock_acquire+0x49f/0x1a40 [ 555.623267][T11492] ? stack_trace_save+0x8e/0xc0 [ 555.623288][T11492] ? find_held_lock+0x2b/0x80 [ 555.623313][T11492] ? bpf_test_timer_enter+0xf7/0x2b0 [ 555.623339][T11492] ? ktime_get+0x22c/0x320 [ 555.623357][T11492] ? lockdep_hardirqs_on+0x78/0x100 [ 555.623385][T11492] ? ktime_get+0x23e/0x320 [ 555.623405][T11492] ? __pfx___cant_migrate+0x10/0x10 [ 555.623431][T11492] ? bpf_test_timer_enter+0xf7/0x2b0 [ 555.623455][T11492] bpf_test_run+0x39c/0xa40 [ 555.623478][T11492] ? bpf_test_run+0x1c6/0xa40 [ 555.623504][T11492] ? __pfx_bpf_test_run+0x10/0x10 [ 555.623546][T11492] ? eth_type_trans+0x2e3/0x720 [ 555.623576][T11492] bpf_prog_test_run_skb+0x15c4/0x3540 [ 555.623618][T11492] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 555.623645][T11492] ? fput+0x79/0x100 [ 555.623666][T11492] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 555.623691][T11492] __sys_bpf+0x2a12/0x4e80 [ 555.623727][T11492] ? __pfx___sys_bpf+0x10/0x10 [ 555.623753][T11492] ? find_held_lock+0x2b/0x80 [ 555.623777][T11492] ? get_pid_task+0xfc/0x250 [ 555.623800][T11492] ? get_pid_task+0xfc/0x250 [ 555.623831][T11492] ? find_held_lock+0x2b/0x80 [ 555.623861][T11492] ? rcu_read_lock_any_held+0x6a/0xa0 [ 555.623888][T11492] ? find_held_lock+0x2b/0x80 [ 555.623912][T11492] ? ksys_write+0x190/0x250 [ 555.623937][T11492] ? ksys_write+0x190/0x250 [ 555.623979][T11492] ? fput+0x79/0x100 [ 555.624002][T11492] ? __x64_sys_bpf+0xce/0x140 [ 555.624018][T11492] __x64_sys_bpf+0xce/0x140 [ 555.624035][T11492] ? do_syscall_64+0x90/0x870 [ 555.624053][T11492] do_syscall_64+0x115/0x870 [ 555.624068][T11492] ? clear_bhb_loop+0x40/0x90 [ 555.624091][T11492] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 555.624109][T11492] RIP: 0033:0x7ff57619de99 [ 555.624129][T11492] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 555.624147][T11492] RSP: 002b:00007ff577061028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 555.624164][T11492] RAX: ffffffffffffffda RBX: 00007ff576425fa0 RCX: 00007ff57619de99 [ 555.624176][T11492] RDX: 0000000000000050 RSI: 0000200000001b80 RDI: 000000000000000a [ 555.624186][T11492] RBP: 00007ff577061090 R08: 0000000000000000 R09: 0000000000000000 [ 555.624197][T11492] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 555.624207][T11492] R13: 00007ff576426038 R14: 00007ff576425fa0 R15: 00007ffdffbccae8 [ 555.624232][T11492] [ 662.240186][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 662.247157][ C0] rcu: (detected by 0, t=10506 jiffies, g=56993, q=256 ncpus=2) [ 662.254858][ C0] rcu: All QSes seen, last rcu_preempt kthread activity 10506 (4295003383-4294992877), jiffies_till_next_fqs=1, root ->qsmask 0x0 [ 662.268203][ C0] rcu: rcu_preempt kthread starved for 10506 jiffies! g56993 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1 [ 662.279379][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 662.289333][ C0] rcu: RCU grace-period kthread stack dump: [ 662.295201][ C0] task:rcu_preempt state:R running task stack:27592 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 [ 662.308680][ C0] Call Trace: [ 662.311951][ C0] [ 662.314871][ C0] __schedule+0x125c/0x6730 [ 662.319389][ C0] ? __pfx___schedule+0x10/0x10 [ 662.324234][ C0] ? find_held_lock+0x2b/0x80 [ 662.328909][ C0] ? schedule+0x225/0x2c0 [ 662.333237][ C0] schedule+0xdd/0x2c0 [ 662.337301][ C0] schedule_timeout+0x127/0x280 [ 662.342144][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 662.347508][ C0] ? __pfx_process_timeout+0x10/0x10 [ 662.352793][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 662.358591][ C0] ? prepare_to_swait_event+0xdf/0x4a0 [ 662.364050][ C0] rcu_gp_fqs_loop+0x1a9/0x900 [ 662.368807][ C0] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 662.374084][ C0] ? __pfx_rcu_gp_init+0x10/0x10 [ 662.379019][ C0] ? __pfx_rcu_gp_cleanup+0x10/0x10 [ 662.384211][ C0] ? rcu_is_watching+0x12/0xc0 [ 662.388970][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 662.394773][ C0] rcu_gp_kthread+0x179/0x230 [ 662.399439][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 662.404624][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 662.410429][ C0] ? __kthread_parkme+0x18c/0x230 [ 662.415450][ C0] ? kthread+0x13a/0x450 [ 662.419687][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 662.424873][ C0] kthread+0x370/0x450 [ 662.428937][ C0] ? __pfx_kthread+0x10/0x10 [ 662.433523][ C0] ret_from_fork+0x72b/0xd50 [ 662.438110][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 662.443214][ C0] ? __switch_to+0x800/0x10f0 [ 662.447878][ C0] ? __pfx_kthread+0x10/0x10 [ 662.452468][ C0] ret_from_fork_asm+0x1a/0x30 [ 662.457242][ C0] [ 662.460246][ C0] rcu: Stack dump where RCU GP kthread last ran: [ 662.466569][ C0] Sending NMI from CPU 0 to CPUs 1: [ 662.471760][ C1] NMI backtrace for cpu 1 [ 662.471774][ C1] CPU: 1 UID: 0 PID: 11510 Comm: syz.1.1347 Tainted: G L syzkaller #0 PREEMPT(full) [ 662.471793][ C1] Tainted: [L]=SOFTLOCKUP [ 662.471798][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 662.471806][ C1] RIP: 0010:advance_sched+0xb3/0xd20 [ 662.471822][ C1] Code: c1 ea 03 80 3c 02 00 0f 85 48 0b 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6d 00 48 8d 7d 36 48 89 fa 48 c1 ea 03 0f b6 14 02 <48> 89 f8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 8c 0a 00 00 0f [ 662.471835][ C1] RSP: 0018:ffffc90000a08de8 EFLAGS: 00000807 [ 662.471846][ C1] RAX: dffffc0000000000 RBX: ffff88807ee5b300 RCX: ffff88807ee5b280 [ 662.471855][ C1] RDX: 0000000000000000 RSI: ffffffff89c75e7e RDI: ffff88807e864036 [ 662.471864][ C1] RBP: ffff88807e864000 R08: 0000000000000001 R09: 0000000000000000 [ 662.471872][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88807ee5b300 [ 662.471880][ C1] R13: ffffffff89c75e60 R14: ffff8880b8528640 R15: ffff8880b8528690 [ 662.471889][ C1] FS: 00007f2c933986c0(0000) GS:ffff888123ee6000(0000) knlGS:0000000000000000 [ 662.471903][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 662.471912][ C1] CR2: 00007f2c93397ff8 CR3: 00000000373ea000 CR4: 00000000003526f0 [ 662.471920][ C1] Call Trace: [ 662.471925][ C1] [ 662.471931][ C1] ? find_held_lock+0x2b/0x80 [ 662.471951][ C1] ? __hrtimer_run_queues+0x37b/0x9c0 [ 662.471970][ C1] ? do_raw_spin_unlock+0x145/0x1e0 [ 662.471987][ C1] ? __pfx_advance_sched+0x10/0x10 [ 662.472000][ C1] __hrtimer_run_queues+0x462/0x9c0 [ 662.472022][ C1] hrtimer_interrupt+0x3e5/0x940 [ 662.472045][ C1] __sysvec_apic_timer_interrupt+0x109/0x470 [ 662.472065][ C1] sysvec_apic_timer_interrupt+0x9e/0xc0 [ 662.472086][ C1] [ 662.472090][ C1] [ 662.472095][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 662.472110][ C1] RIP: 0010:write_comp_data+0x0/0x90 [ 662.472124][ C1] Code: 6d fd ff ff 66 2e 0f 1f 84 00 00 00 00 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <65> 8b 05 d9 ca 59 12 49 89 f8 49 89 f1 49 89 d2 65 48 8b 3d b0 ca [ 662.472136][ C1] RSP: 0018:ffffc900044a7d38 EFLAGS: 00000202 [ 662.472146][ C1] RAX: 0000000000000002 RBX: 0000000000000008 RCX: ffffffff81fc3c94 [ 662.472154][ C1] RDX: 0000000000000001 RSI: 0000000000000008 RDI: 0000000000000005 [ 662.472162][ C1] RBP: ffffffff8bd38e40 R08: 0000000000000005 R09: 0000000000000007 [ 662.472170][ C1] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000001 [ 662.472179][ C1] R13: 000000000000000d R14: 0000000000000005 R15: 0000000000000001 [ 662.472189][ C1] ? do_futex+0x204/0x440 [ 662.472209][ C1] ? rcu_is_watching+0x12/0xc0 [ 662.472227][ C1] __sanitizer_cov_trace_switch+0x54/0x90 [ 662.472242][ C1] do_futex+0x204/0x440 [ 662.472260][ C1] ? __pfx_do_futex+0x10/0x10 [ 662.472276][ C1] ? __pfx_do_settimeofday64+0x10/0x10 [ 662.472290][ C1] ? security_capable+0x80/0x260 [ 662.472305][ C1] ? cma_modify_qp_rtr+0x19d/0x340 [ 662.472323][ C1] __x64_sys_futex+0x34f/0x4d0 [ 662.472341][ C1] ? do_sys_settimeofday64+0x1e4/0x260 [ 662.472357][ C1] ? __pfx___x64_sys_futex+0x10/0x10 [ 662.472373][ C1] ? __x64_sys_clock_settime+0x1c9/0x2a0 [ 662.472393][ C1] ? __pfx___x64_sys_clock_settime+0x10/0x10 [ 662.472412][ C1] ? kcov_ioctl+0x17a/0x750 [ 662.472427][ C1] do_syscall_64+0x115/0x870 [ 662.472440][ C1] ? clear_bhb_loop+0x40/0x90 [ 662.472455][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 662.472469][ C1] RIP: 0033:0x7f2c9259de99 [ 662.472480][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 662.472492][ C1] RSP: 002b:00007f2c933980e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 662.472505][ C1] RAX: ffffffffffffffda RBX: 00007f2c92825fa8 RCX: 00007f2c9259de99 [ 662.472513][ C1] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f2c92825fac [ 662.472522][ C1] RBP: 00007f2c92825fa0 R08: 0000000000000001 R09: 0000000000000000 [ 662.472530][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 662.472538][ C1] R13: 00007f2c92826038 R14: 00007ffc3b011760 R15: 00007ffc3b011848 [ 662.472552][ C1]