last executing test programs: 3.780065s ago: executing program 1 (id=29): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x7dc) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x20) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'veth1_to_hsr\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x20, r3, 0x333, 0x0, 0xfffffffe, {0x1c}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000040}, 0x8880) write(r2, &(0x7f0000000280)='0', 0x1) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) r6 = userfaultfd(0x801) socket(0x400000000010, 0x3, 0x0) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) socket$nl_route(0x10, 0x3, 0x0) unshare(0x62040200) 3.650551213s ago: executing program 1 (id=32): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20048890}, 0x24000000) write(0xffffffffffffffff, &(0x7f0000000040)="3c00000058001f000307f4f9002304000a04d649080001000201000204000380050000009ddb973b91aa05797251725df7", 0x31) syz_usb_connect(0x1, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000305bfdd082e0c0007f4d40102030109022400016406200b0904ad8e02df30059e09050e124000fafa01090583"], &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1de) mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./dev/ttyUSB0\x00', 0x5002, 0x0) 3.455932608s ago: executing program 4 (id=36): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt_trace\x00', 0xd7) mount(0x0, &(0x7f0000001040)='./mnt_trace\x00', &(0x7f0000001080)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001100)='./mnt_trace/trace\x00', 0x40000, 0xa) lseek(r0, 0x100000001, 0x1) 3.455866377s ago: executing program 4 (id=37): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0xe2682, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, &(0x7f0000000000)="2e41d16cd5f466b822000f00d0460f06f245dd48f526263ef2a585f6b92e030000b800000000ba008000000f3041ab0fc73a0fc71f", 0x35}], 0x1, 0x70, &(0x7f0000000200)=[@vmwrite={0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x81a00000c}], 0x1) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 3.208068443s ago: executing program 4 (id=39): bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{0x1}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/net/dummy0/carrier\x00', 0x1, 0x0) write(r0, &(0x7f0000000000)='!', 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x18, 0x15, &(0x7f0000000280)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xfffffe01, 0x0, 0x0, 0x0, 0x8}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@tail_call, @call={0x85, 0x0, 0x0, 0x93}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000340)='syzkaller\x00', 0x5, 0x0, 0x0, 0x40f00, 0x1a, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000380)={0x2, 0x1}, 0x8, 0x10, &(0x7f00000003c0)={0x0, 0xc, 0x0, 0xc48}, 0x10, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440), 0x10, 0x7}, 0x94) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8922, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) setresgid(0xee00, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl(r6, 0x4048aec9, &(0x7f0000000100)="01") ioctl(r6, 0x4048aec9, &(0x7f0000000200)) 2.53615563s ago: executing program 4 (id=42): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000062c0)=@newtaction={0x4c, 0x32, 0xffff, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x38, 0x1, [@m_tunnel_key={0x34, 0x1, 0x0, 0x0, {{0xf}, {0x4}, {0x4}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x6}}}}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) 2.440175902s ago: executing program 2 (id=45): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x15c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in=@multicast1, @in6=@mcast2, 0x4, 0x0, 0x4e21, 0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0xee00}, {@in6=@private1, 0x4d6, 0x32}, @in=@multicast2, {0x0, 0x0, 0x0, 0x9, 0xffffffff00000001, 0x0, 0x80000001, 0x543}, {0x4, 0x7fffffffffffffff, 0x0, 0x1}, {}, 0x70bd2c, 0x3500, 0x2, 0x0, 0x0, 0x50}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x40, "210466d38547aa140db9a200000000c538c7cb7a"}}, @offload={0xc, 0x1c, {0x0, 0x3}}]}, 0x15c}, 0x1, 0x0, 0x0, 0x880}, 0x2014) 2.440036732s ago: executing program 2 (id=46): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TCXONC(r0, 0x540a, 0x7e0f611c8948c046) 2.439960002s ago: executing program 2 (id=47): r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x0, 0x0, 0x5}, 0x10) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) sendmmsg(r1, &(0x7f00000030c0)=[{{0x0, 0x0, &(0x7f0000000400)=[{0x0}], 0x1}}], 0x1, 0x9200000000000000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) 2.386877583s ago: executing program 4 (id=48): bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) mkdir(&(0x7f0000000100)='mnt\x00', 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000080)={0x0, &(0x7f0000000040)}, 0x10) ioctl$KVM_TDX_INIT_VCPU(0xffffffffffffffff, 0xc008aeba, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) symlinkat(&(0x7f0000000440)='./config/nvmet/ports/1\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1/subsystems/testnqn\x00') 2.371994894s ago: executing program 4 (id=49): r0 = syz_usb_connect(0x2, 0x3f, &(0x7f00000007c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0xffffffffffffffa9, 0x0, 0x1, 0x70bd26, 0x25dfdbfb, {{}, {0x0, 0x410c}}}, 0x1c}, 0x1, 0x0, 0x0, 0x400c015}, 0x8000) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f00000003c0)={0x20, 0xe, 0x3, "671a64"}, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0xc0105b08, &(0x7f0000000040)) 1.643294701s ago: executing program 3 (id=50): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)=@newsa={0x180, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@local, 0x1, 0x714, 0x4e23, 0x4, 0x0, 0x0, 0x0, 0x67}, {@in6=@mcast2, 0x4d8, 0x6c}, @in=@local, {0x0, 0x192, 0x6, 0xffff, 0x400008253c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x800, 0x1}, {0x3, 0x8}, 0x70bd2a, 0x4003504, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @algo_crypt={0x48, 0x2, {{'cbc(des3_ede)\x00'}}}]}, 0x180}, 0x1, 0x0, 0x0, 0x24008881}, 0x20040000) 1.642786291s ago: executing program 3 (id=51): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x14, 0x27, 0x9, 0x70bd25, 0x25dfdbfd, {0x11}}, 0x14}, 0x1, 0x0, 0x0, 0x4000002}, 0x4000080) 1.503983054s ago: executing program 3 (id=52): r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) bind$can_raw(r0, &(0x7f0000000180)={0x1d, r1}, 0x10) setsockopt$CAN_RAW_RECV_OWN_MSGS(r0, 0x65, 0x4, &(0x7f0000000040)=0x1, 0x4) sendmsg$can_raw(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=@can={{0x3}, 0x3, 0x2, 0x0, 0x0, "ee0d702fac00008a"}, 0x10}}, 0xd209f6d83486bb56) recvmmsg(r0, &(0x7f0000001640)=[{{0x0, 0x0, 0x0}, 0x2fa}, {{0x0, 0x0, 0x0}, 0x511800}], 0x2, 0x10002, 0x0) 1.501129084s ago: executing program 2 (id=53): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000047000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000002b000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a876d839240d29c035055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7e8dc34f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bb44b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334583239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd713089856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bf4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff22dc508afc9ffc2cc788bee1b47683db01a469398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd360000000000000000ae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae526aca54183fb01c73f979ca9857399537f5831808b0dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c97a088a22e8b15c3e233db00002e30d46a0024d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e4845535a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c29c5c0ed5bcdf510c3c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9003f07000099d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ced92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f68fa8d7c2dfb28e1f05e46b0933c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d588afd80e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a93466ae595c6a8cda6900002a070886df42b27098773b45198b4a34ac97febd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d63521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a8639034a75f4c7df3ea8fc2018d07afef12ef060cd4403a099f32468f658000b4082d43e12186195cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea209b53b230ef0f2ab85cbdac0000000000000000ca06f256c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bd3339403004b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab900000000000000000000d71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdbf24a0c5441ce046078492b53467cfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89cb349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce1d9bc7ef3e3f40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb15f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c00c57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137df47257f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b558982016b0679b5d6fccbecfae5553d9950d48c774eaa35b24fce69a20d8b49e3d0168bf7eac90529cd6af061c9e53addddc620ce73c5d177e3d097159f2768636fc10276c6a0adc57483b3f7083f66b87ef296ee85a3009a5d30f479e293a3302e11350ea857b37e76ca3f50378e4092ce2c574ad278b9b7b717c571afb2077b019fd9d89efd59b41f051ec5a8ff87ecc8df917a1e386d849fcd10e2f9ca52e02339c2f4666b0c8ffe0d508dcee3070e8b42ac38545e25f1cd62421c28d25994be0cff7271a0dee38d7ac4ac736b090e1d29f98117919472b61b20026d7e646174b55d251f7f8ca5ccc22a5efb33b217eff5597a3c3a5f3a9bb54abb40e54593e1a7ce4cfa17b3c3fe91c06363496341eae20dcc59b6179b32ddddef5c34000096a54c0c571a91878f61f74912e2299e5501d4d6943bfd74c856511726f0ac8f7d17f1c6b4451c1bcdc6b6e1700e4cd87709d97afc5423c96fa981873d4369b04bbf1fb9f68f17991540868e408201ad1a74179e489aa61f021a437a3fa935588be2068f7ff9b253106326fde795e530b93626cc68e06e602198724249b4444e69902e4d8f5da4e94cc36794258fd4032de7ab36bc24000000000000000000000000000000000000cd3211b3842b68a4eddca2eae28529e97a98d7ec3fd902df1ba8fc2ad2377e72d4e7aeacbbccef5614cd965511558f40720025c022bc9c213e407f6bc4b673c55aa8e729299a37fd6339acd906ac861ba56c9fa9b8b12b5e68a3cdadb906355e1f1d336a243172affe50d0fb36c3718a7498eed3d398f405a34d494414e87ef1ce1845510d43d00171d6b4b762f89564c22d542a119878709cd6822c3a3eb47a849b0737929fe9e1eecd1bff5a2b9880e2a6d8a3b3b7e88a673c96cda4455eff1c530db0e6598a2686aa09aeaf0f1aed95aeb8b0a2cc5ca31c0f56285cc05f7090a0e0583cf540d18cd8817e685c7b4ff176178ac1234f23e54445ec20b2689832d78409897a0307e89ebcd5f4ba042a3d10237a5a8a9a6eda36d2f337dc54537b80e8433341b135b4c5bb0173ffde46ccd260e1d4f2c51e8b07bb256f1317912cb1fc9e491e0bb9109e475cc795c23ad9f4f0042c5e9c655a4d865bc4a266e6a1d3d2b7ee53be9efb33a98933b5ba74ee3ac8d34b6af8c1fdbffade3abc80842b74354162f5b994ab5254cb068bc5e2ae242a1d37d0d49947c9317fa1a46c9e259ce0e1f9db992c53f7830a5e8f4fac6b187eb9f15ba61f730f86d7d7b63bbc7a1d9ff37e87a90a14e0655304da069f9009b62717649b6c6af94fcba713f8ee6fcce25aef44d009966614b61be9369ffc589a79051b0a0000000000000003ebd34c41afe268c33c9322c3a783772aec998f51a6e70fb932a8019e72ef5ab127bb30c79ebfd867441083546305fb39449c40a166ea389a6b77b7c87f66e8bf5806726b8fc50b943627314803a12c33312dce0a10f852da3e000000"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x7}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r0, 0x18000000000002a0, 0xe80, 0x0, &(0x7f00000000c0)="b9ffddc1559f78314d9cf313888e", 0x0, 0x600, 0x60000009, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.449484285s ago: executing program 2 (id=54): sigaltstack(0x0, 0x0) membarrier(0x2, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000480), 0x206, 0x10b481) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x80000100008b}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000a40)=@newsa={0x148, 0x10, 0x1, 0x70bc2b, 0x4000000, {{@in6=@dev={0xfe, 0x80, '\x00', 0x22}, @in=@dev={0xac, 0x14, 0x14, 0x43}, 0x0, 0x8, 0x3, 0x5, 0xa, 0x60}, {@in6=@ipv4={'\x00', '\xff\xff', @multicast1}, 0x0, 0x32}, @in=@multicast2, {0xfffffffffffffffe, 0x4, 0x3, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x89}, {0x3, 0x400804, 0x9, 0x292}, {0x1cb00000}, 0x70bd26, 0x0, 0x2, 0x4, 0x0, 0x6c}, [@algo_crypt={0x58, 0x2, {{'cbc(twofish)\x00'}, 0x80, "72f01afe02000000366a6a849a739045"}}]}, 0x148}, 0x1, 0x0, 0x0, 0x8000}, 0x4050) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) ptrace$getregset(0x4204, 0x0, 0x202, 0x0) clock_settime(0x0, &(0x7f0000000240)={0x77359400}) clock_adjtime(0x0, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x17, &(0x7f0000000080)=0x3, 0x4) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) ioctl$USBDEVFS_ALLOW_SUSPEND(r0, 0x5522) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000540)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16, @ANYBLOB, @ANYRES32, @ANYBLOB="4400028040000100240001"], 0x60}, 0x1, 0x0, 0x0, 0x4000431}, 0x0) ioctl$USBDEVFS_BULK(r0, 0x5523, 0x0) ioctl$USBDEVFS_FORBID_SUSPEND(r0, 0x5521) 1.044675185s ago: executing program 1 (id=55): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000680)={'syzkaller0\x00', 0x1}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x6}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0xffffffff}}}}]}, 0x4c}}, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc05, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0xfff0, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x240040a1}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r4, &(0x7f00000002c0)="05031c00d1fd140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 900.155369ms ago: executing program 1 (id=56): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001400)=ANY=[@ANYBLOB="01000000420000000600000008"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0c00000004000000040000000180000000000000", @ANYRES32=r0], 0x50) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x8000, r1, 0x4}, 0x38) 888.979669ms ago: executing program 1 (id=58): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ed) mount(0x0, &(0x7f0000000300)='./proc\x00', &(0x7f0000000400)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000b00)='./proc/net/rpc/auth.unix.ip/content\x00', 0x0, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa05, 0x0) close(0x3) 884.624318ms ago: executing program 2 (id=59): r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) 833.03584ms ago: executing program 0 (id=60): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0) preadv(r0, &(0x7f0000001e80)=[{&(0x7f00000023c0)=""/4107, 0x100b}], 0x1, 0x33, 0x0) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x190) fcntl$setlease(r1, 0x400, 0x0) 832.4008ms ago: executing program 0 (id=61): openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x42902, 0x0) r0 = socket(0x400000000010, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f00000002c0)={0xd, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x1000000000a) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000025300)=""/102392, 0x18ff8) get_robust_list(0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, 0x0, 0x0, 0xffffffffffffffff) r2 = syz_open_procfs(0x0, &(0x7f0000000180)='fdinfo\x00') getdents(r2, &(0x7f0000000000)=""/43, 0x2b) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x6, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/mpls/platform_labels\x00', 0x2, 0x0) sendfile(r3, r3, 0x0, 0x23d1) r4 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000a80), 0x440, 0x0) ioctl$int_in(r4, 0x5452, &(0x7f0000000b40)=0x3) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) socket(0x28, 0x801, 0x0) write$binfmt_register(0xffffffffffffffff, &(0x7f0000000680)={0x3a, 'syz3', 0x3a, 'E', 0x3a, 0x800000100000003, 0x3a, 'U\x01\x8e\xa1\xff\xd6\xecF\x8e\x00\x00\x00\x00\x00\x00\x00\xedJIh\x9b\x1a\xde*\xb0d.', 0x3a, '\xda\xb8\xfd\xcd\x9a$\xb6\xc9\x0f\xff}\xcc\x92\xba\xafp\xa3\xbd\xf9\xc7\xb6\x8aG\x845\x95YC\xfc\r-dont_appB\xcf&\xd7*\xab\xb6\xde\xcd8\xcc\xe6\x1eG\xb8D\xcd\xfc~Uv\xfc\xd6\x16\x0e\xc5\xcc\xadab5\xf2\x85\xc0\x9e\x9b\x1a\x85v4\x83\xc6\xcb\x83\xbd\xda\xfe\xe8yP[\t\xdd\xab\xbd\xd9\xd2m\xf9o#\x18\xbf\xb9\xd0\xb8\fR7\x9f\xcb\xc7\xf9=w\"8\x1b\xa0\xado=N\xe7(9\xf2\xa2\r\n{\x01BT\xed!\xac#\x95#Hl\x1cV\b\x852\xe0m\xd0t\x15N\x13\bG\xd8\x8d\xb9)\xd2/\xf9\xb8#0\x14m\x83f\xb2\xab\xe3\xc8$$\v\x17]\x7f\xd5\x84\xf4:y\xcf\xbf\xacN!\n8\xd3\x88\xba4\x8c\x02.F\xdfY\xaf!\xf8\xe1!Q2l*\xeca\\\xc5\xeb\xb5CpT[v\x1f2\x12kq\xf0\xf2\xc7XZ_[\x16\x81\xd1a\xad\x18L#<\x85\xc36\x00\f\xafD\xbc\xd5HPs\x90B#B\xdeQ\xd2\xec\xc1\x80\xf1\xf7\x1d\xe5\x9dE:<\xfd\xf8\xe6\x05\x92\xc9&0\xc5\x82\xa0\xffd\x8d1\xa3\x94h\x8f&\x85\x99QP\xf3u\xb9a\xa6\x90\x01\xe8\xbcJ#\xbf\xe8\xb9\xfcEd_\x7f\x06\x94\x195z\xbf\x1f_\xbd\x90n\xcb\x15\xd2A\xb0\xe8\x92\x9e*\x160\xd2V\xe3\x8a\xa4!\xb4\xba\xa6>\x8d\xcc\xc1\xd5\x9aI\x1f%\xf07\xe7\xd4\x80\xc0\xd6\x13I*\xa4E\xac\xc8\xf9-1\xd0\x92\xc6\xde\x10\xed\v]\x13\xf6\\\xbe\x11\xe0\xfe\x8bJ\x17\x96B\xdf_\xad\t\xd2p\xe0\x9f\x9bOs\xdd\'W\xf62b\x02\xce%)Sv\x9e\r_5x<\x18C9\xe1\x18U\x126\xf5|\x1f\xe97x\x1e\x7fr\xb9\x99\xbe\x85\x1cX\xfe\xe6\x99\xa9(q\xab\xef]c-}\x0fnU\xfa\xbfb)\xba\nyI\xd0\x0fb\xbe\xa4\xc3\xe8.\x82\xdf\xff^\x84S\xdf\x12\x93A\xe4\x85I\xce\x8b\x9dX\xa8\'\x0e\xcay\xb6\xb2\xd6%\xeeh\xe3O\x06<\x91\xce\xa6o\x8b^\x96\xd4\xfbT\xfd\x1e\xa6\xaf\xc1\xc9a\xdf\x02\xfe\xfa\xdb\x1fm\x10xJ\x00\xf6\x9b\xb2', 0x3a, './file0'}, 0x25c) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x9, 0x1, 0x64}]}, &(0x7f0000000080)='syzkaller\x00', 0x5}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000000000ff000700000a400000000e0a050000000000000000000a0000050900010073797a3100000000140003800c0000800800034000000002040000800900020073797a3100000000140000001100010000000000000000000500000a"], 0x68}, 0x1, 0x0, 0x0, 0x8080}, 0x24008040) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=@newtfilter={0x24, 0x2c, 0x200, 0x870b525, 0x8000, {0x0, 0x0, 0x0, 0x0, {0x8, 0xc}, {}, {0xa, 0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x2204402c}, 0x0) 635.520735ms ago: executing program 3 (id=62): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x28) syz_usb_connect$hid(0x5, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000000080)=@req3={0x8000, 0x200, 0x80, 0x20000, 0x0, 0x0, 0x8}, 0x1c) mremap(&(0x7f0000000000/0x9000)=nil, 0x600600, 0x200000, 0x3, &(0x7f0000a00000/0x600000)=nil) mmap(&(0x7f0000568000/0x2000)=nil, 0x1000000, 0x0, 0x11, r1, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, 0x94) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x0, &(0x7f0000000180)}) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000780)={0x0, 0x1, 0x0, [0x806f, 0x0, 0x2d5, 0x5, 0x6], [0x9d8, 0x5, 0x1, 0x9, 0x8002, 0x0, 0x5, 0x1, 0x0, 0x802, 0x9, 0x200000100, 0x3, 0xfffffffffffffff4, 0x4a, 0x5, 0x100, 0xd, 0xdd, 0x5, 0x1, 0x2a9, 0x3, 0xc3c, 0x3, 0x8, 0x100000000, 0x2, 0xa51, 0x8, 0x401, 0x800000000000003, 0x7, 0xfffffffffffffffa, 0x81, 0x100, 0x5, 0x931, 0x4, 0x3, 0x8001, 0x8000000000000000, 0x7, 0x1, 0x8, 0x8, 0x6aa, 0x102, 0x1, 0x83, 0x538a, 0x9, 0xfffffffffffffffb, 0x4, 0x0, 0x4, 0x5, 0x8, 0x8000, 0x8000000000000000, 0x4, 0xfffffffffffffffc, 0x14, 0x5bc, 0x1, 0x7ffffffb, 0x4, 0x8000, 0xc9, 0x7, 0x6, 0x9, 0x82c, 0x7ff, 0xe000000000000, 0xe4, 0xf, 0x0, 0x8, 0x22, 0xffffffffffffffff, 0x7, 0x1, 0x8000000000000000, 0x2000000009, 0x7, 0x0, 0x6, 0x6, 0xb, 0x100000002, 0x4, 0x4, 0x7, 0x7, 0x7, 0x8, 0x1, 0x16d, 0x6, 0x68d, 0xffffffffffff43b0, 0x8, 0x50000000000000, 0xe, 0x0, 0x0, 0x100000003, 0x4, 0x7, 0x406, 0x3, 0x6, 0x2, 0x0, 0x3, 0x40, 0x7fffffff, 0x7, 0xe, 0x3]}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r3, &(0x7f0000000d00)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0xd0, 0x1, 0x2, 0x706, 0x0, 0x0, {0x2, 0x0, 0x8}, [@CTA_EXPECT_ID={0x8, 0x5, 0x1, 0x0, 0x6}, @CTA_EXPECT_MASTER={0x20, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}]}, @CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0xfff}, @CTA_EXPECT_NAT={0x14, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_DIR={0x8}]}, @CTA_EXPECT_ZONE={0x6, 0x7, 0x1, 0x0, 0x2}, @CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x8}, @CTA_EXPECT_TUPLE={0x44, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private2}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}, @CTA_EXPECT_MASK={0x24, 0x3, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}]}, 0xd0}, 0x1, 0x0, 0x0, 0x4000190}, 0x4008053) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup(r4) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r2, &(0x7f0000000500)={@void, @void, @eth={@broadcast, @link_local, @val={@void, {0x8100, 0x0, 0x0, 0x3}}, {@ipv4={0x800, @generic={{0x5, 0x4, 0x1, 0x6, 0xee, 0x67, 0x0, 0x7, 0x4, 0x0, @initdev={0xac, 0x1e, 0xfd, 0x0}, @local}, "215030a1614b1c53f585572e5e1692adbe4830fb4ecbfbca735cc1cc0e35f78f76c3b65eccbc7ee66a920e533ea29f252382110499ac8ef1231529bde91c8d362b30ab0dd374ab1da9547e4bf26505657a463439126b1b9ff255074a5b852266cae8a66e49d9e9871eccb72f5dc6932a285ad774d22a4297a3177705553abf242cedb3999a343b689214fc17d3b8fe47081e9333b213e695dcd4a887c4502b84f6065c9a8f56fbd559def987805b4d3c9dae96e9265917b077f791af889f45a05b5f58810111798e0b5d5becbcb23f7167c8c5172cad64087f28"}}}}}, 0x100) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) io_uring_enter(0xffffffffffffffff, 0x2219, 0x7721, 0x16, 0x0, 0x2f) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000340)={0x1b, 0x0, 0x0, 0x0, 0x0, 0x1, 0x5, '\x00', 0x0, r0, 0x1, 0x4, 0x2}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000000)={0x6, 0x10, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000009000000000000007f000000181100", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09000000000000550901000000006684a50027000019a8f6fffcffffffbf91000000000000b7020000000000008500000085000000b7000000000000009500"/107], &(0x7f0000000280)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x25, r0, 0x8, 0x0, 0x0, 0x7ffffff, &(0x7f00000004c0)={0x0, 0xf}, 0x10}, 0x94) syz_clone(0x20002000, &(0x7f00000000c0)="b8ceb434d703e8a7cc1f174aee6dee1f2ee0", 0x12, &(0x7f0000000100), &(0x7f0000000200), &(0x7f00000002c0)="ce48c37f5968d0d1d672765a4556c7e3129cd6f88104f3eb458c555acd311a4437558ecb0b0d9807d3893863cbde95241f5510a4d5f1dac8090ed3b436b033166e78fb12554713c7cda24776f28509c4d16214811bd3e17a2d34edc05f230b4aeb69c9028bfe95577fa8ab89b2e197634eeba91f005034672ff4d7") 541.314477ms ago: executing program 0 (id=63): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreq(r1, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, 0x0) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000000740)={0x1, 0x0, 0x0, 0x5, @vifc_lcl_addr=@remote, @empty}, 0x10) syz_emit_ethernet(0x3e, &(0x7f0000000040)={@local, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x20, 0xfc, 0x2, 0x0, @rand_addr=0x1c, @multicast1=0xe0000300}, @dest_unreach={0x3, 0x6, 0x0, 0x0, 0xfa, 0x9, {0x5, 0x4, 0x0, 0x3d, 0xfff6, 0x65, 0x5, 0x1, 0x4, 0x3, @private=0xa010102, @local}}}}}}, 0x0) setsockopt$MRT_ADD_MFC_PROXY(r0, 0x0, 0xd2, &(0x7f00000000c0)={@multicast1=0x1c, @empty=0xe0000300, 0x0, "8a79348df081496d0420922f45a71c1daa8b610468cd140526c41efcd3a4a422", 0x3, 0x1, 0x85}, 0x3c) 527.759707ms ago: executing program 0 (id=64): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000e001400400000004000000041"], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000058c0)={0x0, 0x0, &(0x7f0000000140), &(0x7f0000000680), 0x1006, r0}, 0x38) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000000b80)={r0, 0x0, &(0x7f0000000100)=""/31}, 0x20) 275.818703ms ago: executing program 1 (id=65): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x2c, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0xe2, 0x0, 0x7fc000fd}]}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = syz_usb_connect$cdc_ncm(0x6, 0x0, 0x0, &(0x7f00000009c0)={0x0, 0x0, 0x0, 0x0, 0x4, [{0x0, 0x0}, {0x4, &(0x7f0000000900)=@lang_id={0x4, 0x3, 0x1404}}, {0x0, 0x0}, {0x0, 0x0}]}) syz_usb_control_io$cdc_ncm(r1, &(0x7f0000000b00)={0x14, 0x0, 0x0}, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$USBDEVFS_SETINTERFACE(r2, 0x80045510, 0x0) socket$nl_route(0x10, 0x3, 0x0) write$tun(0xffffffffffffffff, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000001080)) 105.923728ms ago: executing program 0 (id=66): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='attr/sockcreate\x00') r0 = socket$inet(0x2, 0x3, 0xd) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r1, 0x1, 0x3b, 0x0, &(0x7f0000000000)) getsockopt$inet_mreqsrc(r0, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f0000000040)=0x28) 80.877908ms ago: executing program 0 (id=67): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000540)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x1001, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x40, 0x2, [@TCA_TBF_PRATE64={0xc, 0x5, 0xc2240edb8ac75ac7}, @TCA_TBF_BURST={0x8, 0x6, 0xff}, @TCA_TBF_PARMS={0x28, 0x1, {{0x5a, 0x2, 0x84a, 0x9, 0x1, 0x800}, {0x8c, 0x1, 0xfffc, 0x7fff, 0x4, 0xb}, 0x5, 0x34, 0x91f}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x50) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x67, 0x0, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r7, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8, 0x3, 0x6, 0x1, 0x1, 0xd, 0xfff, 0xfffffffa, 0x8}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 156.13µs ago: executing program 3 (id=68): r0 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r1 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r0) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000000000)={r1, 0x700}, &(0x7f0000000780)=ANY=[], 0x0, 0x0) 0s ago: executing program 3 (id=69): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfa0c, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000004c0)=@newtfilter={0x8c, 0x2c, 0xd27, 0x470bd28, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0x0, 0x4}, {}, {0xfff2}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x6a, 0x3, 0xffffffffffffffff, 0x3ff, 0x7}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x10}, 0x0) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 8.798736][ T110] udevd (110) used greatest stack depth: 22888 bytes left [ 14.462900][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 14.462915][ T30] audit: type=1400 audit(1787301511.295:59): avc: denied { transition } for pid=223 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.473620][ T30] audit: type=1400 audit(1787301511.295:60): avc: denied { noatsecure } for pid=223 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.481680][ T30] audit: type=1400 audit(1787301511.305:61): avc: denied { write } for pid=223 comm="sh" path="pipe:[14920]" dev="pipefs" ino=14920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 14.505813][ T30] audit: type=1400 audit(1787301511.305:62): avc: denied { rlimitinh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.525365][ T30] audit: type=1400 audit(1787301511.305:63): avc: denied { siginh } for pid=223 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.48' (ED25519) to the list of known hosts. [ 21.583685][ T30] audit: type=1400 audit(1787301518.425:64): avc: denied { mounton } for pid=277 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.584769][ T277] cgroup: Unknown subsys name 'net' [ 21.607402][ T30] audit: type=1400 audit(1787301518.425:65): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.636180][ T30] audit: type=1400 audit(1787301518.445:66): avc: denied { unmount } for pid=277 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.636352][ T277] cgroup: Unknown subsys name 'devices' [ 21.745760][ T277] cgroup: Unknown subsys name 'hugetlb' [ 21.751506][ T277] cgroup: Unknown subsys name 'rlimit' [ 21.858457][ T30] audit: type=1400 audit(1787301518.695:67): avc: denied { setattr } for pid=277 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.882702][ T30] audit: type=1400 audit(1787301518.695:68): avc: denied { mounton } for pid=277 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 21.888641][ T280] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 21.908371][ T30] audit: type=1400 audit(1787301518.695:69): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 21.940797][ T30] audit: type=1400 audit(1787301518.755:70): avc: denied { relabelto } for pid=280 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.967023][ T30] audit: type=1400 audit(1787301518.755:71): avc: denied { write } for pid=280 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.002958][ T30] audit: type=1400 audit(1787301518.835:72): avc: denied { read } for pid=277 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.030079][ T30] audit: type=1400 audit(1787301518.835:73): avc: denied { open } for pid=277 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.030299][ T277] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.568163][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.575547][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.583897][ T287] device bridge_slave_0 entered promiscuous mode [ 22.610053][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.617326][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.624810][ T287] device bridge_slave_1 entered promiscuous mode [ 22.654818][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.662098][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.669708][ T286] device bridge_slave_0 entered promiscuous mode [ 22.679583][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.686911][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.694362][ T286] device bridge_slave_1 entered promiscuous mode [ 22.737334][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.744562][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.752158][ T288] device bridge_slave_0 entered promiscuous mode [ 22.760657][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.768339][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.775861][ T288] device bridge_slave_1 entered promiscuous mode [ 22.852298][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.859703][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.867584][ T289] device bridge_slave_0 entered promiscuous mode [ 22.877006][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.884159][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.891739][ T289] device bridge_slave_1 entered promiscuous mode [ 22.898520][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.905682][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.912972][ T290] device bridge_slave_0 entered promiscuous mode [ 22.946267][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.954233][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.961605][ T290] device bridge_slave_1 entered promiscuous mode [ 23.038424][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.045512][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.052873][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.059941][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.091998][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.099065][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.106492][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.113630][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.141482][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.148911][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.156373][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.163492][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.192882][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.200162][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.207491][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.214569][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.229262][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.236936][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.244321][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.251536][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.268799][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.276130][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.283989][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.291439][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.299126][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.306988][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.315023][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.322442][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.329778][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.337021][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.344702][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.352240][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.362912][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.370679][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.392548][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.401060][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.408318][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.416613][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.425035][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.432077][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.448935][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.457162][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.466951][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.479036][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.489748][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.498298][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.505379][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.512876][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.521568][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.528757][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.557858][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.575051][ T287] device veth0_vlan entered promiscuous mode [ 23.581952][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.591072][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.598142][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.605833][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.614455][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.621493][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.629096][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.637582][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.644847][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.652278][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.660672][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.667797][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.675453][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.683327][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.691476][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.699775][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.708267][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.715372][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.722870][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.731740][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.740236][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.747289][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.754688][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.763396][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.772088][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.780269][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.788616][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.796965][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.805368][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.812946][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.831859][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.840179][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.848850][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.857626][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.865956][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.883160][ T287] device veth1_macvtap entered promiscuous mode [ 23.900339][ T286] device veth0_vlan entered promiscuous mode [ 23.907572][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.916722][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.925029][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.933209][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.941632][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.950148][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.958806][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.967531][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.975737][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.984514][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.993327][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.001786][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.010382][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.018154][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.028552][ T289] device veth0_vlan entered promiscuous mode [ 24.038802][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.049588][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.057246][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.070537][ T286] device veth1_macvtap entered promiscuous mode [ 24.079425][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.088632][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.098852][ T290] device veth0_vlan entered promiscuous mode [ 24.112611][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.120706][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.129046][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.137977][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.147086][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.155505][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.164269][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.171991][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.181042][ T289] device veth1_macvtap entered promiscuous mode [ 24.194679][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.202994][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.211526][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.220302][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.232178][ T290] device veth1_macvtap entered promiscuous mode [ 24.246675][ T287] request_module fs-gadgetfs succeeded, but still no fs? [ 24.255778][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.264631][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.273290][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.282429][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.290842][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.304260][ T288] device veth0_vlan entered promiscuous mode [ 24.323104][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.334916][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.343289][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.351958][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.360829][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.369653][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.378573][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.386538][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.415946][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.425292][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.508735][ T288] device veth1_macvtap entered promiscuous mode [ 24.516465][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.525030][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.533185][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.612109][ T315] device syzkaller0 entered promiscuous mode [ 24.636098][ T313] tipc: Started in network mode [ 24.641287][ T313] tipc: Node identity 66b2cee3b46c, cluster identity 4711 [ 24.655319][ T313] tipc: Enabled bearer , priority 0 [ 24.662632][ T312] tipc: Resetting bearer [ 24.670673][ T279] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 24.676909][ T312] tipc: Disabling bearer [ 24.697179][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.708181][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.719649][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.728441][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.781413][ T326] usb usb7: usbfs: process 326 (syz.2.3) did not claim interface 0 before use [ 24.887509][ T330] UDC core: couldn't find an available UDC or it's busy: -19 [ 24.894652][ T333] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.043719][ T279] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 25.073849][ T279] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 25.085188][ T279] usb 4-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice= 0.00 [ 25.094647][ T279] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.464129][ T279] usb 4-1: USB disconnect, device number 2 [ 25.570237][ T352] netlink: 32 bytes leftover after parsing attributes in process `syz.4.15'. [ 26.003906][ T359] 9pnet: Could not find request transport: rdma [ 26.533606][ T20] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 26.773634][ T20] usb 1-1: Using ep0 maxpacket: 8 [ 26.893724][ T20] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 26.920600][ T20] usb 1-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 26.935301][ T30] kauditd_printk_skb: 80 callbacks suppressed [ 26.935317][ T30] audit: type=1400 audit(1787301523.775:154): avc: denied { create } for pid=391 comm="syz.1.29" dev="anon_inodefs" ino=16199 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 26.951131][ T20] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 27.001340][ T30] audit: type=1400 audit(1787301523.805:155): avc: denied { ioctl } for pid=391 comm="syz.1.29" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=16199 ioctlcmd=0xaa00 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 27.012441][ T20] usb 1-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 27.028849][ T392] syz.1.29 (392) used greatest stack depth: 22840 bytes left [ 27.048123][ T30] audit: type=1400 audit(1787301523.825:156): avc: denied { read } for pid=396 comm="syz.3.31" dev="nsfs" ino=4026532377 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 27.070362][ T20] usb 1-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 27.081566][ T30] audit: type=1400 audit(1787301523.825:157): avc: denied { open } for pid=396 comm="syz.3.31" path="net:[4026532377]" dev="nsfs" ino=4026532377 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 27.103589][ T20] usb 1-1: config 168 interface 0 has no altsetting 0 [ 27.108145][ T30] audit: type=1400 audit(1787301523.825:158): avc: denied { mmap_zero } for pid=396 comm="syz.3.31" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 27.225567][ T30] audit: type=1400 audit(1787301524.065:159): avc: denied { mount } for pid=409 comm="syz.4.36" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 27.243633][ T20] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 27.249067][ T30] audit: type=1400 audit(1787301524.065:160): avc: denied { search } for pid=409 comm="syz.4.36" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 27.282067][ T30] audit: type=1400 audit(1787301524.065:161): avc: denied { read } for pid=409 comm="syz.4.36" name="trace" dev="tracefs" ino=13068 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 27.288706][ T20] usb 1-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 27.308031][ T30] audit: type=1400 audit(1787301524.065:162): avc: denied { open } for pid=409 comm="syz.4.36" path="/8/mnt_trace/trace" dev="tracefs" ino=13068 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 27.323194][ T20] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 27.353825][ T20] usb 1-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 27.365200][ T30] audit: type=1400 audit(1787301524.065:163): avc: denied { unmount } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 27.366957][ T20] usb 1-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 27.400724][ T20] usb 1-1: config 168 interface 0 has no altsetting 0 [ 27.503676][ T20] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 27.990067][ T309] usb 2-1: new low-speed USB device number 2 using dummy_hcd [ 28.000035][ T20] usb 1-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 28.013052][ T20] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 28.026912][ T20] usb 1-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 28.043025][ T20] usb 1-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 28.063626][ T20] usb 1-1: config 168 interface 0 has no altsetting 0 [ 28.295705][ T448] tc_dump_action: action bad kind [ 28.313665][ T20] usb 1-1: string descriptor 0 read error: -22 [ 28.320466][ T20] usb 1-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 28.331831][ T20] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.433681][ T309] usb 2-1: unable to get BOS descriptor or descriptor too short [ 28.513661][ T309] usb 2-1: config 100 has an invalid interface number: 173 but max is 0 [ 28.522407][ T309] usb 2-1: config 100 has no interface number 0 [ 28.529785][ T309] usb 2-1: config 100 interface 173 altsetting 142 endpoint 0xE is Bulk; changing to Interrupt [ 28.541655][ T309] usb 2-1: config 100 interface 173 altsetting 142 endpoint 0x83 has invalid maxpacket 1160, setting to 8 [ 28.553710][ T309] usb 2-1: config 100 interface 173 has no altsetting 0 [ 28.593608][ T60] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 28.706253][ T456] usb 1-1: USB disconnect, device number 2 [ 28.793785][ T309] usb 2-1: string descriptor 0 read error: -22 [ 28.801071][ T309] usb 2-1: New USB device found, idVendor=0c2e, idProduct=0700, bcdDevice=d4.f4 [ 28.812370][ T309] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.854000][ T402] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 28.861780][ T402] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 29.004107][ T60] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 29.014998][ T60] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 29.030734][ T60] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 29.041705][ T60] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.129149][ T456] usb 2-1: USB disconnect, device number 2 [ 29.683274][ T474] device syzkaller0 entered promiscuous mode [ 29.811141][ T480] using random self ethernet address [ 29.816992][ T480] using random host ethernet address [ 29.823027][ T480] using random self ethernet address [ 29.829814][ T480] using random host ethernet address [ 30.400882][ T309] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 30.634553][ T506] tipc: Started in network mode [ 30.639711][ T506] tipc: Node identity 9a3b720ae16e, cluster identity 4711 [ 30.659963][ T506] tipc: Enabled bearer , priority 0 [ 30.679002][ T506] device syzkaller0 entered promiscuous mode [ 30.695608][ T506] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 30.717814][ T506] tipc: Resetting bearer [ 30.742257][ T505] tipc: Resetting bearer [ 30.762392][ T505] tipc: Disabling bearer [ 30.772528][ T510] ================================================================== [ 30.780898][ T510] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0x88e/0x3200 [ 30.783687][ T309] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 30.789262][ T510] Read of size 8 at addr ffff88811444c5c0 by task syz.3.69/510 [ 30.806510][ T309] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 30.806958][ T510] [ 30.806966][ T510] CPU: 1 PID: 510 Comm: syz.3.69 Not tainted syzkaller #0 [ 30.822591][ T309] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.825636][ T510] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 30.825652][ T510] Call Trace: [ 30.825658][ T510] [ 30.825666][ T510] __dump_stack+0x21/0x30 [ 30.825690][ T510] dump_stack_lvl+0x110/0x170 [ 30.845463][ T309] usb 3-1: config 0 descriptor?? [ 30.845961][ T510] ? show_regs_print_info+0x20/0x20 [ 30.872232][ T510] ? load_image+0x3f0/0x3f0 [ 30.877000][ T510] print_address_description+0x7f/0x2c0 [ 30.882763][ T510] ? tc_setup_flow_action+0x88e/0x3200 [ 30.888438][ T510] kasan_report+0x10f/0x150 [ 30.893173][ T510] ? tc_setup_flow_action+0x88e/0x3200 [ 30.898683][ T510] __asan_report_load8_noabort+0x14/0x20 [ 30.904701][ T510] tc_setup_flow_action+0x88e/0x3200 [ 30.910024][ T510] mall_replace_hw_filter+0x2db/0x8d0 [ 30.915525][ T510] ? pcpu_block_update_hint_alloc+0x8bc/0xc50 [ 30.921810][ T510] ? mall_set_parms+0x520/0x520 [ 30.926692][ T510] ? tcf_exts_destroy+0xb0/0xb0 [ 30.931688][ T510] ? pcpu_alloc+0x1118/0x16f0 [ 30.936495][ T510] ? mall_set_parms+0x1e4/0x520 [ 30.941474][ T510] mall_change+0x544/0x760 [ 30.945924][ T510] ? __kasan_check_write+0x14/0x20 [ 30.951082][ T510] ? mall_get+0xa0/0xa0 [ 30.955276][ T510] ? tcf_chain_tp_insert_unique+0x946/0xa70 [ 30.961817][ T510] ? mall_get+0xa0/0xa0 [ 30.967310][ T510] tc_new_tfilter+0x13df/0x1990 [ 30.972379][ T510] ? tcf_gate_entry_destructor+0x20/0x20 [ 30.978306][ T510] ? security_capable+0x87/0xb0 [ 30.983269][ T510] ? ns_capable+0x8c/0xf0 [ 30.987712][ T510] ? netlink_net_capable+0x125/0x160 [ 30.993829][ T510] ? tcf_gate_entry_destructor+0x20/0x20 [ 31.000582][ T510] rtnetlink_rcv_msg+0x83c/0xcb0 [ 31.006154][ T510] ? rtnetlink_bind+0x80/0x80 [ 31.010989][ T510] ? avc_has_perm_noaudit+0x390/0x490 [ 31.016592][ T510] ? memcpy+0x56/0x70 [ 31.020784][ T510] ? avc_has_perm_noaudit+0x30a/0x490 [ 31.026188][ T510] ? arch_stack_walk+0xee/0x140 [ 31.031077][ T510] ? avc_denied+0x1b0/0x1b0 [ 31.035609][ T510] ? stack_trace_save+0xa6/0xf0 [ 31.040490][ T510] ? avc_has_perm+0x163/0x250 [ 31.045200][ T510] ? avc_has_perm_noaudit+0x490/0x490 [ 31.050704][ T510] ? x64_sys_call+0x4b/0x9a0 [ 31.055701][ T510] ? selinux_nlmsg_lookup+0x39d/0x440 [ 31.061461][ T510] netlink_rcv_skb+0x1e9/0x430 [ 31.066399][ T510] ? rtnetlink_bind+0x80/0x80 [ 31.071471][ T510] ? netlink_ack+0xb10/0xb10 [ 31.076186][ T510] ? _copy_from_iter+0x4a4/0x10a0 [ 31.081335][ T510] ? __netlink_lookup+0x387/0x3b0 [ 31.086916][ T510] rtnetlink_rcv+0x1c/0x20 [ 31.091716][ T510] netlink_unicast+0x86c/0xa30 [ 31.096604][ T510] netlink_sendmsg+0x879/0xb80 [ 31.101709][ T510] ? netlink_getsockopt+0x530/0x530 [ 31.107115][ T510] ? security_socket_sendmsg+0x82/0xa0 [ 31.112683][ T510] ? netlink_getsockopt+0x530/0x530 [ 31.118521][ T510] ____sys_sendmsg+0x5be/0x8f0 [ 31.123606][ T510] ? __sys_sendmsg_sock+0x40/0x40 [ 31.128657][ T510] ? import_iovec+0x7c/0xb0 [ 31.133237][ T510] ___sys_sendmsg+0x236/0x2e0 [ 31.138029][ T510] ? __sys_sendmsg+0x280/0x280 [ 31.142819][ T510] ? sock_show_fdinfo+0xa0/0xa0 [ 31.147936][ T510] ? __fdget+0x1a1/0x230 [ 31.152428][ T510] __x64_sys_sendmsg+0x201/0x2d0 [ 31.157386][ T510] ? ___sys_sendmsg+0x2e0/0x2e0 [ 31.162269][ T510] ? __kasan_check_write+0x14/0x20 [ 31.167419][ T510] ? switch_fpu_return+0x15d/0x2c0 [ 31.172732][ T510] x64_sys_call+0x4b/0x9a0 [ 31.177181][ T510] do_syscall_64+0x4c/0xa0 [ 31.181632][ T510] ? clear_bhb_loop+0x50/0xa0 [ 31.186368][ T510] ? clear_bhb_loop+0x50/0xa0 [ 31.191255][ T510] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 31.197198][ T510] RIP: 0033:0x7f3486f5f0d9 [ 31.201751][ T510] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 31.221587][ T510] RSP: 002b:00007f34859b8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 31.230204][ T510] RAX: ffffffffffffffda RBX: 00007f34871e6fa0 RCX: 00007f3486f5f0d9 [ 31.238562][ T510] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 0000000000000004 [ 31.246775][ T510] RBP: 00007f3486ff6024 R08: 0000000000000000 R09: 0000000000000000 [ 31.255203][ T510] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 31.263724][ T510] R13: 00007f34871e7038 R14: 00007f34871e6fa0 R15: 00007ffc6e74e408 [ 31.271793][ T510] [ 31.274823][ T510] [ 31.277371][ T510] Allocated by task 510: [ 31.281604][ T510] __kasan_kmalloc+0xd4/0x100 [ 31.286332][ T510] __kmalloc+0x13d/0x2c0 [ 31.290957][ T510] tcf_idr_create+0x5f/0x790 [ 31.295737][ T510] tcf_idr_create_from_flags+0x61/0x70 [ 31.301212][ T510] tcf_gact_init+0x342/0x570 [ 31.305799][ T510] tcf_action_init_1+0x3fd/0x6b0 [ 31.310745][ T510] tcf_action_init+0x233/0x7a0 [ 31.315550][ T510] tcf_exts_validate+0x24a/0x580 [ 31.320676][ T510] mall_set_parms+0x48/0x520 [ 31.325439][ T510] mall_change+0x478/0x760 [ 31.330023][ T510] tc_new_tfilter+0x13df/0x1990 [ 31.335042][ T510] rtnetlink_rcv_msg+0x83c/0xcb0 [ 31.340272][ T510] netlink_rcv_skb+0x1e9/0x430 [ 31.345166][ T510] rtnetlink_rcv+0x1c/0x20 [ 31.349580][ T510] netlink_unicast+0x86c/0xa30 [ 31.354337][ T510] netlink_sendmsg+0x879/0xb80 [ 31.359106][ T510] ____sys_sendmsg+0x5be/0x8f0 [ 31.363966][ T510] ___sys_sendmsg+0x236/0x2e0 [ 31.368635][ T510] __x64_sys_sendmsg+0x201/0x2d0 [ 31.373595][ T510] x64_sys_call+0x4b/0x9a0 [ 31.378109][ T510] do_syscall_64+0x4c/0xa0 [ 31.382706][ T510] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 31.389088][ T510] [ 31.391628][ T510] The buggy address belongs to the object at ffff88811444c500 [ 31.391628][ T510] which belongs to the cache kmalloc-192 of size 192 [ 31.406046][ T510] The buggy address is located 0 bytes to the right of [ 31.406046][ T510] 192-byte region [ffff88811444c500, ffff88811444c5c0) [ 31.419904][ T510] The buggy address belongs to the page: [ 31.425622][ T510] page:ffffea0004511300 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11444c [ 31.436241][ T510] flags: 0x4000000000000200(slab|zone=1) [ 31.441895][ T510] raw: 4000000000000200 ffffea0004533880 0000000800000008 ffff888100042c00 [ 31.451444][ T510] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 31.461126][ T510] page dumped because: kasan: bad access detected [ 31.467707][ T510] page_owner tracks the page as allocated [ 31.473787][ T510] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 113, ts 5446528291, free_ts 0 [ 31.489709][ T510] post_alloc_hook+0x192/0x1b0 [ 31.494742][ T510] prep_new_page+0x1c/0x110 [ 31.499462][ T510] get_page_from_freelist+0x2c3a/0x2cd0 [ 31.505038][ T510] __alloc_pages+0x1a2/0x460 [ 31.509708][ T510] new_slab+0xa0/0x4d0 [ 31.513764][ T510] ___slab_alloc+0x3ac/0x840 [ 31.518462][ T510] __slab_alloc+0x49/0x90 [ 31.522799][ T510] kmem_cache_alloc_trace+0x146/0x270 [ 31.528165][ T510] kernfs_fop_open+0x375/0xbb0 [ 31.532931][ T510] do_dentry_open+0x82a/0x1010 [ 31.537949][ T510] vfs_open+0x73/0x80 [ 31.541940][ T510] path_openat+0x26e6/0x2f80 [ 31.546531][ T510] do_filp_open+0x1df/0x400 [ 31.551027][ T510] do_sys_openat2+0x15e/0x7f0 [ 31.555705][ T510] __x64_sys_openat+0x136/0x160 [ 31.560938][ T510] x64_sys_call+0x219/0x9a0 [ 31.565450][ T510] page_owner free stack trace missing [ 31.570911][ T510] [ 31.573513][ T510] Memory state around the buggy address: [ 31.579355][ T510] ffff88811444c480: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.587710][ T510] ffff88811444c500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 31.596040][ T510] >ffff88811444c580: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 31.604129][ T510] ^ [ 31.610289][ T510] ffff88811444c600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 31.618883][ T510] ffff88811444c680: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.626941][ T510] ================================================================== [ 31.635336][ T510] Disabling lock debugging due to kernel taint [ 31.647485][ T39] usb 5-1: USB disconnect, device number 2 [ 33.127562][ T39] usb 3-1: USB disconnect, device number 2