last executing test programs: 5m36.296787853s ago: executing program 32 (id=337): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000080)=0xa0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000000)={@my=0x0, 0x1}) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r0, 0x7ab, &(0x7f0000000280)={&(0x7f0000000780)={{@my=0x0}, {@my=0x0, 0x800000}, 0x400, "884fbe2726aa0a32f3e65f909acda971a093228292456e0332e6c11577b514f0bb8db731789d860e9589c4cbdd60b7a851a8a3c55ada2f90c5fe68bf4a5c3e32296535dc838ef00dc18a32a79118dc858628f741f107552021e5a81d38e4374a8a717a7ca9015083cfff5d16156ef9cabf4f60c0da46870a10bf520cc5abcf9e3a437761ea75776763139fadd55c46daf5338870951822f6a803ccfbab9c3f507672d7c39ea9ccf81d9bc2b4649e7b44ed9fd7cb9bd389240cd41c415113d1caac4536f05c07e596d6addad2a4d27ba21a3b655753c508caedcc812ca235a7cd1686426b208bdecf8a4265ba8f6824aa60306e2d623481eed301b6dc21041fa8b6592be00bb74de1989a45a5aa32c189e9f5a5bb878281d0129afcfb8410cd1fa5acd080993d2d084213130a9b8d517d13251e6605a03d9b8faf507e820205a1f471af7b261419e79e09c547f7c10fd3f1ad876f59fdcc5e07d0ff4dee6ea2e3856616a352d648b9b5261b6263020fc3ae8eb404bc25703b3d3b83172d07ff22907d6631d226c8247c92c1826ff814590dfe8c7fc54dfb265e906f756846546316b20e0105e2a5355a210b2b7f5db61d8f90bb783b41ce368233bd08044e9283531fffe49e3d305ecfb16075a047557f57bb7baf8ba58502975ad0d60ed8de9cb8adc9f667bc6826cbea8e260e4bff28a5ec19d38d1fc019db3cfaf310e764d78619cb27fb17af05a0e8ae831ce8413721e71138e62cc4ad8e7974d1506b4fb581c549a3dd7b7ef44ac37201aa3bce6f37f648d781bcb4f329fd45ffa640f1b04efb38a36e0ed0e2abcb07e4ad88ae3edfb6d840d75340204243d0e1c1c3139823b0d5ad196430bf4566619a1a97df4376a7e9a9e9c1d97b9f773c921778f2cb5165c02da1423305c502076177e4af50cb3343c10b01b78e3fe5520bdfae2b3dbe42db0f0eb55bbcb19038018d45ccdb8b0df400085a02c61b033f430fb6a7408e090c65798bc49d35e049d276fd1952d2b3dfd92a2548411e21be26216fe68fc3cf1c6625031260153708a53255b3d3d0411d5f0e8ab2102a97e539c34e9c769a7dafb87c5918deb59ef05e928c2c52775de467fa843cbcdabc290097eeb2ee7c58d86e3fccc39a5b694c18a4cc0d6af1e61d9c69e6466bc0cbef15365109e4f67a6268625f8c3f358fb7d567cbea52e1bc309bd8effda4e362a729e8cd3064970b97e3f72535d9ba88e97a14834cfd8dc86b5d2f9b35425a4162e6abe8b785ef462883e716c91b8eb281d81f68f606f16fcbc5cddfdec3b515818a647d86a4c17bae6ad525e95598052c49cdee821ceb45b2350dda13628db0dd266f30285241a2b147d65113b8ed3665a3451f7a56cf430ec98aeac702d9b9f776d97520a9d039e5b2fff34ac4d4e0a32e1f35c8f38e4f4fe1b3212a70f185ad71ec86b8c9"}, 0x418}) ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r0, 0x7a6, &(0x7f0000000180)={0x4d7, 0x7, 0x7143, 0x2, 0x0, 0x100}) 5m11.282512465s ago: executing program 33 (id=621): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870f500090582020002"], 0x0) syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f000001b7c0)=[{{&(0x7f0000000040)={0x2, 0x4e21, @multicast1}, 0x10, 0x0, 0x0, 0x0, 0x30}}], 0x1, 0x4008804) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xa8, &(0x7f0000000040)=ANY=[@ANYBLOB="6b0ee0b3d41b1b"]) 3m47.104911139s ago: executing program 34 (id=1745): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_pidfd_open(r0, 0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000400)={0x2000200d}) waitid(0x0, 0x0, 0x0, 0xe, 0x0) 2m22.98600756s ago: executing program 6 (id=2765): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) futex(0x0, 0xd, 0x1, 0x0, 0x0, 0x1) 2m22.755399546s ago: executing program 6 (id=2767): r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) bind$can_raw(r0, &(0x7f00000001c0)={0x1d, r1}, 0x10) sendmsg$can_raw(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000580)=@can={{0x4, 0x0, 0x0, 0x1}, 0x5, 0x1, 0x0, 0x0, "71949a1857e8bcf3"}, 0x10}, 0x1, 0x0, 0x0, 0x40}, 0xd209f6d81082d3d6) recvmmsg(r0, &(0x7f0000003700)=[{{0x0, 0x0, 0x0}, 0xd4}], 0x40000000000031b, 0x40000043, 0x0) 2m22.529700561s ago: executing program 6 (id=2768): r0 = syz_ublk_setup_io_uring(0x2261, &(0x7f0000000300)={0x0, 0xd58c, 0x80, 0x2, 0x30b}, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000980)=@IORING_OP_TIMEOUT={0xb, 0x12, 0x0, 0x0, 0xffffffffffffffff, &(0x7f00000000c0), 0x1, 0x40, 0x1}) r4 = eventfd(0xe467) io_uring_register$IORING_REGISTER_EVENTFD(r0, 0x4, &(0x7f0000000080)=r4, 0x1) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f00000003c0)={0x2e, 0x5, 0x21, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, 0x0) 2m21.511432294s ago: executing program 6 (id=2774): mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount$bind(&(0x7f0000000c40)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101090, 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') mount(0x0, &(0x7f0000000d40)='./file0/../file0/../file0\x00', &(0x7f00000002c0)='sysfs\x00', 0x0, 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') 2m21.351896718s ago: executing program 6 (id=2777): openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./tracing/uprobe_events\x00', 0x401, 0x0) write(r0, &(0x7f0000000300)='p:_est/_vent1 ./file0:0x0 _rg2=%', 0x20) 2m20.382766161s ago: executing program 6 (id=2781): ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000780)={0x0, 0x4, 0x0, [0x806f, 0x0, 0x2d5, 0x2, 0x1], [0x6, 0x7, 0x1, 0x9, 0x8002, 0x0, 0x5, 0x2, 0x0, 0x802, 0x9, 0x2000200000100, 0x3, 0xfffffffffffffff4, 0x4a, 0x5, 0x100, 0x6290, 0xdd, 0x1, 0x1, 0x2a8, 0x3, 0xc39, 0x8, 0x0, 0xffff, 0x2, 0x7b1, 0x8, 0x401, 0x3, 0x7, 0x10000000000, 0x81, 0x100, 0x5, 0x92e, 0xfe, 0x3, 0x8001, 0x8000000000000000, 0x7, 0x7ff, 0x8, 0x8, 0x6aa, 0xfff, 0x1, 0x83, 0x538a, 0x9, 0xfffffffffffffff7, 0x50ae, 0x0, 0x4, 0x5, 0x40008, 0x6, 0x7ffffffffffffffe, 0x4, 0xfffffffffffffffc, 0xfffffffffffffffd, 0x5bc, 0x1, 0x80000000, 0x4, 0x3ff, 0x3ff, 0x6, 0x7, 0x6, 0x82c, 0x8000, 0xe000000000000, 0xe4, 0x11, 0x0, 0x8, 0x6, 0xffffffffffffffff, 0x7, 0x1, 0x8000000000000000, 0x2000000009, 0x25c, 0x0, 0x9, 0xfffffffffffffffa, 0x7, 0x100000002, 0x4, 0x4, 0x8, 0x7, 0x7, 0x9, 0x1, 0x16d, 0x6, 0x68d, 0xffffffffffff43b0, 0x8, 0xa, 0xb, 0x0, 0x0, 0x0, 0x10000000004, 0x7, 0x3, 0xfffffffffffffff7, 0x5, 0x5, 0x0, 0x6, 0x40, 0x7fffffff, 0x0, 0x3, 0x4]}) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000a40)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01040000000000000000020000000900010073797a30000000002c000000030a01040000000000000000020000000900010073797a30000000000900030073797a300000000098000000060a01040000000000000000020000000900010073797a30000000000900020073797a30000000006c000480680001800a0001006d61746368000000580002800e000100686173686c696d697400000008000240000000013c0003"], 0x10c}}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10048047}, 0x4000050) 2m20.064798139s ago: executing program 35 (id=2781): ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000780)={0x0, 0x4, 0x0, [0x806f, 0x0, 0x2d5, 0x2, 0x1], [0x6, 0x7, 0x1, 0x9, 0x8002, 0x0, 0x5, 0x2, 0x0, 0x802, 0x9, 0x2000200000100, 0x3, 0xfffffffffffffff4, 0x4a, 0x5, 0x100, 0x6290, 0xdd, 0x1, 0x1, 0x2a8, 0x3, 0xc39, 0x8, 0x0, 0xffff, 0x2, 0x7b1, 0x8, 0x401, 0x3, 0x7, 0x10000000000, 0x81, 0x100, 0x5, 0x92e, 0xfe, 0x3, 0x8001, 0x8000000000000000, 0x7, 0x7ff, 0x8, 0x8, 0x6aa, 0xfff, 0x1, 0x83, 0x538a, 0x9, 0xfffffffffffffff7, 0x50ae, 0x0, 0x4, 0x5, 0x40008, 0x6, 0x7ffffffffffffffe, 0x4, 0xfffffffffffffffc, 0xfffffffffffffffd, 0x5bc, 0x1, 0x80000000, 0x4, 0x3ff, 0x3ff, 0x6, 0x7, 0x6, 0x82c, 0x8000, 0xe000000000000, 0xe4, 0x11, 0x0, 0x8, 0x6, 0xffffffffffffffff, 0x7, 0x1, 0x8000000000000000, 0x2000000009, 0x25c, 0x0, 0x9, 0xfffffffffffffffa, 0x7, 0x100000002, 0x4, 0x4, 0x8, 0x7, 0x7, 0x9, 0x1, 0x16d, 0x6, 0x68d, 0xffffffffffff43b0, 0x8, 0xa, 0xb, 0x0, 0x0, 0x0, 0x10000000004, 0x7, 0x3, 0xfffffffffffffff7, 0x5, 0x5, 0x0, 0x6, 0x40, 0x7fffffff, 0x0, 0x3, 0x4]}) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000a40)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01040000000000000000020000000900010073797a30000000002c000000030a01040000000000000000020000000900010073797a30000000000900030073797a300000000098000000060a01040000000000000000020000000900010073797a30000000000900020073797a30000000006c000480680001800a0001006d61746368000000580002800e000100686173686c696d697400000008000240000000013c0003"], 0x10c}}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10048047}, 0x4000050) 1m52.852354142s ago: executing program 3 (id=3002): r0 = syz_open_dev$vim2m(&(0x7f0000001880), 0x2, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000040)={0x8, 0x1, 0x1}) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000001c0)=@mmap={0x0, 0x1, 0x4, 0x20, 0x0, {0x77359400}, {0x4, 0x0, 0x1, 0x1, 0x0, 0x1}, 0x291d}) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000100)=0x1) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r1, 0xffffffffffffffff, 0x0) 1m51.906422171s ago: executing program 3 (id=3010): r0 = epoll_create1(0x0) r1 = fcntl$dupfd(r0, 0x406, r0) r2 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000080)={0xb086b159625429af}) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000100)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f0000000040)={0x20000010}) 1m51.324979418s ago: executing program 3 (id=3017): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4000000000000007910900000000000620000000000000095000000000000009e574bffff1729aba9b39a58e3cd8757e44cf3611b8e327a0279acba1f7791408d1efa421239728e2e5cc319b58520609dfd4a1a021d000000000000efffff75c3d894d99aef659f8b0000c515d8c219fbd9da31fc3ce3e9a2653000aec385a84a3d3f466bba30ac1486a70037fb03adef1a427fb0f4cb3072182da7c30000000000000000000000000000000000000000000000000000297e9fed660213ecb576987ad0972f18fbb7c9ecc03901f028b15b30ecf3205f90c9684ddc80d13bf37afc00e5efd686e6fb5ef4ee00b66126f773434a5c0d2ad3526bc484a6b94396117615f78f97637d8f8838aa75efb657ddafb15b88d97e47731cc3f55ce4e6a42562e6fb1f0000003030249c350044b09c36d10549a5949ff21418f1517508fb13540a82b5030cd9bb1bb066ca833c1fef6cefa28543ee520e46a3e96aca0d5a5f8cb34ad9c54c3a9a698f835bb83bcfd81ac5cfa18ce0740717994b5152cd0fa735433e50dccee16a208245b4366d44bb7ebd169b9e3a66d0cb29291a50f642ae4cb007540c806cd1cf88fdcaa393d1e1a697649401a802b474e374c767cb1ce52fd917d6af3de547be8429540de37f868a7f25d47c4b710836436008d4e8c8b42aeee84629d06d75ef09e0260b41de1f750480e492b6822d6275b7ccda1141707069cdb21de7a98dc37efdd806cc3619ad0659998bdd90b008c1aed04ee682b8ffd25741abbd9c6482ca45b82b6b7f25f71280cd6ba8bbb1e32dfe84831d1fc132755ce9aaf1952cb6829e9d6f4cbd8a07dc0cebcad512b3e0f2daa622bc805d2e152e0765b20cd6c8e2f4fff81e1458a43f35d36b25225dc0fbaf3b8131f5a8ae73e8badc519350edf048d5f56617"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000dc0)=ANY=[@ANYBLOB="04000000040000000400000010"], 0x50) close(0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0x8, &(0x7f0000000300)=ANY=[@ANYBLOB="18120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7030000f2717ca8bfa400000000000007040000f8ffffffb705000000000000850000001900000095"], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x6, '\x00', 0x0, @fallback=0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x300, &(0x7f00000002c0)="f57b0bb7994307a7ac95a7c71016", 0x0, 0x0, 0x0, 0x0, 0x38, 0x0, &(0x7f0000000180)="b8"}, 0x3a) 1m51.145776986s ago: executing program 3 (id=3019): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r1, 0x10e, 0x2, &(0x7f0000000040)=0x4000051, 0x4) 1m51.013969668s ago: executing program 3 (id=3021): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x10012, r0, 0x0) r1 = userfaultfd(0x1) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) ioctl$UFFDIO_POISON(r1, 0xc020aa08, &(0x7f0000000380)={{&(0x7f0000ffe000/0x2000)=nil, 0x2000}}) 1m50.885287201s ago: executing program 3 (id=3023): r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x12, r0, 0x108000) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r1, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) sendmsg$tipc(r2, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) 1m35.822341376s ago: executing program 36 (id=3023): r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x12, r0, 0x108000) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r1, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) sendmsg$tipc(r2, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) 55.277012434s ago: executing program 8 (id=3590): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x29) write(r0, &(0x7f0000000000)='7', 0x1) mmap$IORING_OFF_PBUF_RING(0x0, 0xfffffffa, 0x4, 0x100010, r0, 0x847c760f) syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0xae99, 0x80, 0x2, 0x1e5}, 0x0, 0x0, 0x0) 54.968997006s ago: executing program 8 (id=3592): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x4}, {0xffff, 0xffff}, {0xf}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0xf, "0000000000000000000100000e00"}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYRES32], 0x50) sendmmsg$inet(r0, &(0x7f0000005200)=[{{0x0, 0x4b, &(0x7f0000000000), 0x1}}], 0x1, 0x0) 54.446525604s ago: executing program 8 (id=3599): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00000000c0)={0x6}) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000180)={0x20, 0x4, 0x4, 0x0, 0x0, 0x80, 0x0, 0x2, 0xfe, 0x3, 0xff, 0x2, 0xd9, 0x93}, 0xe) sendto$inet6(r0, &(0x7f0000000300)="8b", 0x34000, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c) shutdown(r0, 0x1) 54.18887357s ago: executing program 5 (id=3603): timer_create(0x0, 0x0, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000080)=@req3={0x7, 0x0, 0x3, 0x1567, 0x3ff, 0x50ae, 0x4}, 0x1c) 54.184090483s ago: executing program 8 (id=3604): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='tracefs\x00', 0x1214040, 0x0) mount$bind(&(0x7f0000000300)='.\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x185093, 0x0) mount$tmpfs(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x20000, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x11050ca, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) 54.090523798s ago: executing program 8 (id=3606): r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000040)=0x91, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e26, 0x8, @mcast2, 0xa}, 0x1c) setsockopt$SO_BINDTODEVICE_wg(r0, 0x1, 0x19, 0x0, 0x0) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000140)=0x7, 0x4) 53.860289525s ago: executing program 8 (id=3608): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000001000/0x1000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000400)={0x2, 0x4e20, @empty}, 0x10) ioctl(r2, 0x4048aecb, &(0x7f0000000400)) 53.56948798s ago: executing program 37 (id=3608): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000001000/0x1000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000400)={0x2, 0x4e20, @empty}, 0x10) ioctl(r2, 0x4048aecb, &(0x7f0000000400)) 53.539430766s ago: executing program 5 (id=3610): ioctl$TUNSETDEBUG(0xffffffffffffffff, 0x400454c9, 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40010021, 0x0) ioctl$SYNC_IOC_MERGE(0xffffffffffffffff, 0xc0303e03, 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000001c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x54c, 0x24b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x30, 0x4, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0xfffb, 0xcb, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00221c0000000501150095ff0904965d61"], 0x0}, 0x0) 50.400435764s ago: executing program 5 (id=3634): openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/uprobe_events\x00', 0x401, 0x0) write(r0, &(0x7f00000002c0)="723a732f70202e2f66696c65303a309e2225", 0x12) 50.310829978s ago: executing program 5 (id=3635): r0 = landlock_create_ruleset(&(0x7f0000000080)={0x10}, 0x10, 0x0) landlock_restrict_self(r0, 0x0) r1 = landlock_create_ruleset(&(0x7f00000000c0)={0x9153, 0x3}, 0x30, 0x0) landlock_restrict_self(r1, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000140), 0x28000, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r2, 0xc004500a, 0x0) 50.175255836s ago: executing program 5 (id=3637): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) pwrite64(r0, &(0x7f0000000100)='U', 0x1, 0x1fe) pwrite64(r0, &(0x7f0000000100)='\x00', 0x1, 0x1e8133) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) 50.104444408s ago: executing program 5 (id=3638): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='tcp 2049\n', 0x9) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x0, 0x0) read(r1, &(0x7f0000000180)=""/100, 0x64) 37.601425476s ago: executing program 1 (id=3727): r0 = fanotify_init(0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x0, 0x124) fanotify_mark(r0, 0x1, 0x1023, r1, 0x0) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) fanotify_mark(r0, 0x455, 0x19, r2, 0x0) fanotify_mark(r0, 0x80, 0x1000, r1, 0x0) 37.396091069s ago: executing program 1 (id=3729): r0 = socket$inet_smc(0x2b, 0x1, 0x0) socket$kcm(0x2, 0x200000000000001, 0x106) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0xfffffffffffffdf1) sendto$inet(r0, 0x0, 0x0, 0x20000090, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) close(0x3) 37.227931922s ago: executing program 1 (id=3731): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x6}]}, 0x10) bind$bt_hci(r0, &(0x7f0000000140)={0x1f, 0xffff, 0x2}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000040)="2e000000010000", 0x7) 37.065037091s ago: executing program 1 (id=3732): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000380)='./file0/file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x185093, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000040)='./file0/../file0\x00', 0x0, 0x11050ca, 0x0) umount2(&(0x7f00000002c0)='./file0/file0\x00', 0x8) 36.949162379s ago: executing program 1 (id=3734): r0 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) sched_getscheduler(0x0) 36.401597952s ago: executing program 1 (id=3738): syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_clone(0x8100411, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r0, 0x0, 0x0) tee(r0, r0, 0x8000, 0x5) 36.065723291s ago: executing program 38 (id=3738): syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_clone(0x8100411, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r0, 0x0, 0x0) tee(r0, r0, 0x8000, 0x5) 34.69231426s ago: executing program 39 (id=3638): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='tcp 2049\n', 0x9) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x0, 0x0) read(r1, &(0x7f0000000180)=""/100, 0x64) 6.651962502s ago: executing program 4 (id=3931): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sec\x00', &(0x7f00000000c0)='securityfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/query\x00', 0x2, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000180), 0x2000090, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r0]) 5.53380558s ago: executing program 4 (id=3942): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000006000/0x2000)=nil, &(0x7f000000d000/0x4000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff3000/0x3000)=nil, &(0x7f0000ff6000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc8a2, 0xc000, 0x1, 0xf3}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@deltfilter={0xe, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x3}, {0x0, 0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x8010}, 0x0) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000000)={0xc, &(0x7f0000000100)=[{0x1, 0x36, 0x5, 0x537}, {0x27, 0x8, 0x9}, {0xe49, 0x2, 0xfa, 0x4}, {0x5b6, 0x8, 0x1, 0x2}, {0x2, 0xe, 0x80, 0x1000003}, {0x1ff, 0x5, 0x10, 0xf}, {0x2, 0x0, 0x1, 0x9}]}) 4.46595991s ago: executing program 4 (id=3950): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120141014813442024040075ee69010203010902240001000010000904b8070259d1ca000905060200020d0006090582020002"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000001140)={0x44, &(0x7f0000000f40)={0x0, 0xb, 0x4, "94a291d5"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f0000000180)={0x20, 0x15, 0x4, "2b9a8a16"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f00000003c0)={0x34, &(0x7f0000000140)={0x40, 0x30, 0x4, "e1137020"}, 0x0, 0x0, 0x0, 0x0, 0x0}) 2.641564022s ago: executing program 7 (id=3965): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd26, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x13, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0xc, 0x0, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x14, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x16, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40090}, 0x4048801) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@deltfilter={0x24, 0x2d, 0x100, 0x70bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x4, 0xa}, {0x1, 0x10}, {0xfff2, 0x6}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 2.449327463s ago: executing program 2 (id=3967): bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x2, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7}, [@printk={@llx, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x72}}, @call={0x85, 0x0, 0x0, 0x5}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000800)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r2, r1, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x36, &(0x7f0000000f40)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}, @remote, @val={@void, {0x8100, 0x5, 0x0, 0x4}}, {@ipv4={0x800, @dccp={{0x5, 0x4, 0x3, 0x5, 0x24, 0x8, 0x0, 0x1, 0x21, 0x0, @dev={0xac, 0x14, 0x14, 0x33}, @initdev={0xac, 0x1e, 0x0, 0x0}}, {{0x4e21, 0x4e23, 0x4, 0x1, 0x7, 0x0, 0x0, 0x3, 0x2, "76c237", 0x6c, "2815ea"}}}}}}, 0x0) 2.307665776s ago: executing program 9 (id=3968): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c"], 0x54}}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd0500560008005400000060"], 0xfdef) 2.148050956s ago: executing program 7 (id=3969): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) migrate_pages(0x0, 0x3, &(0x7f0000000040)=0x7f, &(0x7f0000000300)=0xa) 1.72489341s ago: executing program 7 (id=3971): bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180200000000000000000000000000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000b70000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000007808500000075"], 0x0, 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r1, 0x0, 0x0}, 0x10) 1.630427423s ago: executing program 2 (id=3972): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x1c, r2, 0x1ffd1684a4a9b69d, 0x70bd25, 0x25dfdbff, {}, [@FOU_ATTR_TYPE={0x5, 0x4, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x40010) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x24, r2, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@FOU_ATTR_TYPE={0x5, 0x4, 0x2}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @remote}]}, 0x24}, 0x1, 0x0, 0x0, 0x84}, 0x4000000) sendmsg$FOU_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000340)={0x24, r2, 0x1, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_TYPE={0x5, 0x4, 0x2}, @FOU_ATTR_AF={0x5, 0x2, 0xa}]}, 0x24}, 0x1, 0x0, 0x0, 0x40040021}, 0x40080) 1.468121482s ago: executing program 7 (id=3974): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="19000000040000000400000002"], 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r1, &(0x7f00000000c0), &(0x7f0000000000)=""/3, 0x2}, 0x20) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c0000001a00010001000000fbdb5f250a108000000000000000000070f4033ea6d964882647504e9a5d755e33240d4933c2a34b2c66ed390122fbf37bd6041c6a293e48e4f99ba5041225fdd96239897bcd1d904c2972d97cc9520243ca02a7b61c09fb6bbe269fe5f03323fcf0aed8b2de1ce656c0bb0c92a34e52576b5a3d8c993a563b7c949cb2c4e9ad84d2ff402a36db7e23ac069b0a5aab63e4c2"], 0x1c}, 0x1, 0x0, 0x0, 0x4004084}, 0x20000004) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r1, &(0x7f0000000140), &(0x7f0000000000)=""/6, 0x2}, 0x20) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000011008108090f9becdb4cb92e264831371900000069bd6efb2502eaf60d002700020400bf050005001201", 0x2e}], 0x1}, 0x0) 1.391423155s ago: executing program 0 (id=3975): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000001180), 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000080)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x13, r1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x1d8, 0x120, 0x1000000, 0xffffffff, 0x1c0, 0xffffffff, 0x1c0, 0xffffffff, 0xffffffff, 0x1c0, 0xffffffff, 0x3, 0x0, {[{{@ip={@rand_addr=0x64010101, @rand_addr=0x640100ff, 0xffffffff, 0x0, 'bond_slave_1\x00', 'geneve1\x00', {}, {}, 0x4, 0x0, 0x28}, 0x0, 0x70, 0xa0, 0x0, {0x0, 0x1c8}}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x9, 0x4, 0x3ff, 0xc15ac56b9c76af00}}}, {{@ip={@loopback, @rand_addr=0x64010101, 0xff, 0xffffff00, 'veth0_to_team\x00', 'vcan0\x00', {}, {0xff}, 0x32, 0x3}, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x9, 0x3, 0x3, 0x55367656ae40811c}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x64}}}}, 0x238) 1.337979852s ago: executing program 4 (id=3976): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x8) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @local}, 0x1c) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @remote}, 0x1c) syz_emit_ethernet(0x90, &(0x7f0000000140)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd60090000005a0600fe8000000000000000000000000000bbfe8000000000000000000000000000aa4e224e22", @ANYRES32=0x41424344, @ANYBLOB="5002000090"], 0x0) 1.244790193s ago: executing program 9 (id=3977): r0 = socket$inet_sctp(0x2, 0x5, 0x84) close(r0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000300)={0x0, 0x10, &(0x7f0000000280)=[@in={0x2, 0x4e24, @private=0xa010100}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) sendmsg$inet_sctp(r0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[@sndinfo={0x20, 0x84, 0x2, {0xa, 0x4, 0x28, 0x200800b, r2}}], 0x20, 0x2400e044}, 0x0) 1.21314917s ago: executing program 2 (id=3978): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x8080, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x4, 0x0, 0x1}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=@newqdisc={0x170, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x140, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x1000, 0xa, 0x64, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x1, 0x1, 0xfe, 0x1}}, @TCA_GRED_STAB={0x104}]}}]}, 0x170}}, 0x0) 1.171805688s ago: executing program 4 (id=3979): r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x298}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000040)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00005cf000/0x4000)=nil, 0x400000, 0x2, 0x2}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3) 982.642233ms ago: executing program 0 (id=3980): r0 = socket$inet6(0xa, 0x2, 0x0) close(r0) r1 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000080)={@remote, 0x800, 0x0, 0x3, 0x1, 0x8}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000040)=0x2005, 0x4) sendmsg$inet6(r1, &(0x7f0000000140)={&(0x7f0000000100)={0xa, 0x4e60, 0x80000, @dev={0xfe, 0x80, '\x00', 0x3d}, 0xffffbffb}, 0x1b, 0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="68000000000000002929000036000000ff09000000000000c204000000070726000000000e1901000200000000000000450900000000000001000000000000000500000000000000000000000000000003000000000000000100000000000000050202b20000000050"], 0xb8}, 0x3400c8d4) 971.840394ms ago: executing program 7 (id=3981): r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x298}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000040)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00005cf000/0x4000)=nil, 0x400000, 0x2, 0x2}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) 874.797426ms ago: executing program 9 (id=3982): setns(0xc9, 0x0) r0 = socket(0x8, 0x5, 0x5) setuid(0xee01) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x6e24, @empty}, 0x10) ioctl$VFAT_IOCTL_READDIR_BOTH(r0, 0x400261f2, &(0x7f0000000000)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x5, 0x0, 0x0, 0x10000}]}) 854.505892ms ago: executing program 0 (id=3983): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a6970"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x801, 0x0, 0x0, {0xa, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000005}, 0x80) 822.489765ms ago: executing program 2 (id=3984): r0 = socket$kcm(0x21, 0x2, 0xa) io_uring_setup(0x8e8, &(0x7f00000001c0)={0x0, 0x185e, 0x8, 0x1, 0x7}) sendmsg$kcm(r0, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x0, 0x4, @dev, 0x8000000}}, 0x80, 0x0, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000100100000100000000000000000000001000000000000000100100000b"], 0x28}, 0xfc40) r1 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x0, 0x4, @dev, 0x8000000}}, 0x80, 0x0, 0x0, &(0x7f00000002c0)=ANY=[], 0x28}, 0xfc40) close(0x4) 575.840506ms ago: executing program 9 (id=3985): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0x9}, 0x8) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000040)={0x0, 0x9, 0x2}, &(0x7f00000000c0)=0x8) 565.01041ms ago: executing program 0 (id=3986): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="01000000420000000600000008"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0xc, 0x4, 0x4, 0x8001, 0x0, r0, 0x80000}, 0x50) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x8000, r1}, 0x38) 535.377819ms ago: executing program 4 (id=3987): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f0000000440)=ANY=[@ANYBLOB="0000891f0180c2000002bbbbbbbbbbbb08004500001c006760000384"], 0x2e) 505.322341ms ago: executing program 2 (id=3988): socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f0000000140)={@val={0x3, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x14}, @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x8016, 0x1400, 0x0, 0x0, 0x1, 0x0, @private=0xa010100, @local}, @dest_unreach={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x11, 0x0, @local, @loopback}}}}, 0xfdef) 366.222525ms ago: executing program 9 (id=3989): mkdirat(0xffffffffffffff9c, &(0x7f0000000780)='./file0\x00', 0xd6) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xf, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x3f00000000000000) 181.326992ms ago: executing program 7 (id=3990): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f00000002c0)={0x0, 0x3}, 0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000b00)={0x0, 0x5}, &(0x7f0000000b40)=0x8) 170.718784ms ago: executing program 0 (id=3991): ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000780)={0x0, 0x1, 0x1, [0x806f, 0x0, 0x2d5, 0x2, 0x6], [0x9, 0x2, 0xd20, 0x3, 0xfffffffffffffffe, 0x0, 0x9, 0x2, 0x0, 0x802, 0x2000000009, 0x100, 0x3, 0x4, 0x4a, 0x5, 0x100, 0xd, 0xe1, 0x5, 0x6, 0x2aa, 0x7, 0xc39, 0x8000008, 0x8, 0x0, 0x2, 0xa51, 0x401, 0x80401, 0x3, 0x7, 0xfffffffffffffffa, 0x81, 0x100, 0x5, 0x933, 0x101, 0x3, 0x8001, 0x8000000000000400, 0x680, 0x0, 0x8, 0x8, 0x6aa, 0x100, 0x40, 0x83, 0x538a, 0x9, 0xdb, 0x5, 0x0, 0x14, 0x800000000000005, 0x7, 0x8000, 0x8000000000000000, 0x2, 0xfffffffffffffffd, 0x1000000000014, 0x0, 0x1, 0x7fffffff, 0x4, 0x2000008000, 0x9, 0xfffffffffffffffd, 0x6, 0x1, 0x82c, 0x7ff, 0xffff, 0x1fcc, 0x6, 0x5b, 0xd, 0x22, 0xffffffffffffffff, 0x7, 0xfffffffffffffffd, 0x8000000000000000, 0x4, 0x8, 0x0, 0x6, 0x26, 0x9, 0x100000002, 0x0, 0x4, 0x3, 0xf, 0x4, 0x9, 0x1001, 0x16d, 0x6, 0x68d, 0xfffffffffff743ac, 0x8, 0x50000000000000, 0xe, 0x0, 0x0, 0x2400000003, 0x4, 0x8, 0x6, 0x3, 0x8, 0x2000000000000005, 0x0, 0x3, 0x40, 0x80000000, 0x7, 0xa, 0x3]}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff8000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff0000/0x3000)=nil, &(0x7f0000ff8000/0x1000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x1b80, &(0x7f0000000040)={0x0, 0x8970, 0x1f280, 0x0, 0x8000399}) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaa"], 0x0) io_uring_enter(r0, 0x8ae, 0xfbb9, 0x1f, 0x0, 0x0) 160.143775ms ago: executing program 9 (id=3992): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="12011f00abbe6740e9174e8b089c000000010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="20b52c020000065f"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0) syz_usb_disconnect(r0) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, 0x0) 17.707416ms ago: executing program 2 (id=3993): connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) msync(&(0x7f000051b000/0x3000)=nil, 0x3000, 0x4) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1, 0x0, 0x1, 0x2) 0s ago: executing program 0 (id=3994): r0 = socket(0x10, 0x803, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@ipv6_newnexthop={0x18, 0x68, 0x1, 0x70bd21, 0x25dfdbff}, 0x18}, 0x1, 0x0, 0x0, 0xc000}, 0xc802) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r0) getsockname$packet(r0, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000000)=0x14) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x11, &(0x7f00000002c0)={&(0x7f0000000100)=@newlink={0x48, 0x10, 0x437, 0x4, 0x0, {0x0, 0x0, 0x0, r2, 0x50483}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, r2, 0x4400, 0x8002}}}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x9005}, 0x4000000) kernel console output (not intermixed with test programs): 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 363.300792][T14882] RSP: 002b:00007f3b7903e0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 363.300813][T14882] RAX: ffffffffffffffda RBX: 00007f3b78425fa8 RCX: 00007f3b7819e159 [ 363.300827][T14882] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f3b78425fac [ 363.300841][T14882] RBP: 00007f3b78425fa0 R08: 0000000000000001 R09: 0000000000000000 [ 363.300854][T14882] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 363.300867][T14882] R13: 00007f3b78426038 R14: 00007ffe4ed7f450 R15: 00007ffe4ed7f538 [ 363.300895][T14882] [ 363.471729][ T5704] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 363.622611][ T5704] usb 1-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 363.625702][ T5704] usb 1-1: config 1 has an invalid interface number: 3 but max is 0 [ 363.625731][ T5704] usb 1-1: config 1 has no interface number 0 [ 363.629216][ T5704] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 363.629245][ T5704] usb 1-1: Product: syz [ 363.629261][ T5704] usb 1-1: Manufacturer: syz [ 363.629276][ T5704] usb 1-1: SerialNumber: syz [ 363.651853][ T5704] usb 1-1: 3:0 : does not exist [ 363.651879][ T5704] usb 1-1: 3:0 : does not exist [ 363.848700][T14896] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 364.094909][ T5704] usb 1-1: USB disconnect, device number 42 [ 365.132915][T14930] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3467'. [ 365.316585][T14942] netlink: 'syz.0.3471': attribute type 10 has an invalid length. [ 365.316806][T14942] bridge0: port 2(bridge_slave_1) entered disabled state [ 365.317250][T14942] bridge0: port 1(bridge_slave_0) entered disabled state [ 365.322683][T14942] bridge0: port 2(bridge_slave_1) entered blocking state [ 365.322793][T14942] bridge0: port 2(bridge_slave_1) entered forwarding state [ 365.323026][T14942] bridge0: port 1(bridge_slave_0) entered blocking state [ 365.323126][T14942] bridge0: port 1(bridge_slave_0) entered forwarding state [ 365.330611][T14942] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 365.344324][T14942] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3471'. [ 365.344399][T14942] bridge_slave_1: left allmulticast mode [ 365.344425][T14942] bridge_slave_1: left promiscuous mode [ 365.344656][T14942] bridge0: port 2(bridge_slave_1) entered disabled state [ 365.395838][T14942] bridge_slave_0: left allmulticast mode [ 365.395867][T14942] bridge_slave_0: left promiscuous mode [ 365.396095][T14942] bridge0: port 1(bridge_slave_0) entered disabled state [ 365.450488][T14942] bond0: (slave bridge0): Releasing backup interface [ 365.668424][ T31] kauditd_printk_skb: 69 callbacks suppressed [ 365.668445][ T31] audit: type=1800 audit(1789570799.857:2518): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15500 res=0 errno=0 [ 365.727963][ T31] audit: type=1800 audit(1789570799.917:2519): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15992 res=0 errno=0 [ 365.734479][T14949] nbd9: detected capacity change from 0 to 1 [ 365.742298][ T5808] buffer_io_error: 5 callbacks suppressed [ 365.742331][ T5808] Buffer I/O error on dev nbd9, logical block 0, async page read [ 365.742363][ T5808] Buffer I/O error on dev nbd9, logical block 0, async page read [ 365.742413][ T5808] Buffer I/O error on dev nbd9, logical block 0, async page read [ 365.742451][ T5808] Buffer I/O error on dev nbd9, logical block 0, async page read [ 365.742476][ T5808] Buffer I/O error on dev nbd9, logical block 0, async page read [ 365.742497][ T5808] ldm_validate_partition_table(): Disk read failed. [ 365.742557][ T5808] Buffer I/O error on dev nbd9, logical block 0, async page read [ 365.742584][ T5808] Buffer I/O error on dev nbd9, logical block 0, async page read [ 365.742609][ T5808] Buffer I/O error on dev nbd9, logical block 0, async page read [ 365.742634][ T5808] Buffer I/O error on dev nbd9, logical block 0, async page read [ 365.742648][ T5808] Dev nbd9: unable to read RDB block 0 [ 365.742671][ T5808] Buffer I/O error on dev nbd9, logical block 0, async page read [ 365.742714][ T5808] nbd9: unable to read partition table [ 365.742943][ T5808] nbd9: partition table beyond EOD, truncated [ 365.753314][ T31] audit: type=1800 audit(1789570799.937:2520): pid=5808 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=20000 res=0 errno=0 [ 365.900303][ T31] audit: type=1800 audit(1789570800.087:2521): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15746 res=0 errno=0 [ 365.926809][T14950] nbd9: detected capacity change from 1 to 0 [ 366.560026][ T5599] block nbd9: Receive control failed (result -32) [ 366.579788][T14949] block nbd9: shutting down sockets [ 366.597788][ T31] audit: type=1800 audit(1789570800.787:2522): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=20000 res=0 errno=0 [ 366.636569][ T31] audit: type=1800 audit(1789570800.827:2523): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15992 res=0 errno=0 [ 366.727529][ T31] audit: type=1800 audit(1789570800.917:2524): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15500 res=0 errno=0 [ 367.154492][ T52] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 367.689940][ T31] audit: type=1800 audit(1789570801.877:2525): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15869 res=0 errno=0 [ 368.498410][ T31] audit: type=1800 audit(1789570802.687:2526): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15746 res=0 errno=0 [ 368.557828][T14967] netlink: 64 bytes leftover after parsing attributes in process `syz.9.3481'. [ 368.560536][ T31] audit: type=1800 audit(1789570802.747:2527): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15500 res=0 errno=0 [ 368.982267][T14987] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 368.987257][T14989] netlink: 12 bytes leftover after parsing attributes in process `syz.8.3489'. [ 369.147719][T14995] netlink: 'syz.9.3491': attribute type 10 has an invalid length. [ 369.147951][T14995] bridge0: port 2(bridge_slave_1) entered disabled state [ 369.148464][T14995] bridge0: port 1(bridge_slave_0) entered disabled state [ 369.187502][T14995] bridge0: port 2(bridge_slave_1) entered blocking state [ 369.187602][T14995] bridge0: port 2(bridge_slave_1) entered forwarding state [ 369.187859][T14995] bridge0: port 1(bridge_slave_0) entered blocking state [ 369.187970][T14995] bridge0: port 1(bridge_slave_0) entered forwarding state [ 369.234477][T14997] netlink: 4 bytes leftover after parsing attributes in process `syz.9.3491'. [ 369.244325][T14998] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3492'. [ 369.244355][T14998] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3492'. [ 369.264745][T15000] FAULT_INJECTION: forcing a failure. [ 369.264745][T15000] name failslab, interval 1, probability 0, space 0, times 0 [ 369.264801][T15000] CPU: 1 UID: 0 PID: 15000 Comm: syz.7.3493 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 369.264846][T15000] Tainted: [L]=SOFTLOCKUP [ 369.264855][T15000] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 369.264872][T15000] Call Trace: [ 369.264880][T15000] [ 369.264889][T15000] dump_stack_lvl+0x100/0x190 [ 369.264926][T15000] should_fail_ex.cold+0x5/0xa [ 369.264954][T15000] should_failslab+0xc2/0x120 [ 369.264982][T15000] __kmalloc_noprof+0xfc/0x840 [ 369.265006][T15000] ? lsm_blob_alloc+0x68/0x90 [ 369.265037][T15000] lsm_blob_alloc+0x68/0x90 [ 369.265065][T15000] security_sk_alloc+0x2d/0x290 [ 369.265089][T15000] sk_prot_alloc+0x1d1/0x2a0 [ 369.265119][T15000] sk_alloc+0x36/0xe80 [ 369.265142][T15000] unix_create1+0xa6/0x700 [ 369.265167][T15000] unix_stream_connect+0x36e/0x1a40 [ 369.265192][T15000] ? security_socket_post_create+0x85/0x270 [ 369.265235][T15000] p9_fd_create_unix+0x280/0x350 [ 369.265261][T15000] ? __pfx_p9_fd_create_unix+0x10/0x10 [ 369.265299][T15000] ? lockdep_init_map_type+0x5c/0x250 [ 369.265327][T15000] p9_client_create+0x563/0xd40 [ 369.265359][T15000] ? __pfx_p9_client_create+0x10/0x10 [ 369.265395][T15000] ? lockdep_init_map_type+0x5c/0x250 [ 369.265419][T15000] ? __raw_spin_lock_init+0x3a/0x110 [ 369.265448][T15000] v9fs_session_init+0x3c/0xdd0 [ 369.265474][T15000] ? v9fs_get_tree+0x9c/0xb50 [ 369.265514][T15000] v9fs_get_tree+0xb8/0xb50 [ 369.265544][T15000] ? rcu_is_watching+0x13/0xc0 [ 369.265574][T15000] ? __pfx_v9fs_get_tree+0x10/0x10 [ 369.265610][T15000] ? bpf_lsm_capable+0x9/0x10 [ 369.265637][T15000] ? security_capable+0x80/0x260 [ 369.265668][T15000] vfs_get_tree+0x92/0x320 [ 369.265698][T15000] path_mount+0x7d0/0x24c0 [ 369.265730][T15000] ? __pfx_path_mount+0x10/0x10 [ 369.265757][T15000] ? lockdep_hardirqs_on+0x7d/0x110 [ 369.265788][T15000] ? putname+0xb1/0x110 [ 369.265811][T15000] ? kmem_cache_free+0x127/0x6c0 [ 369.265850][T15000] ? __x64_sys_mount+0x293/0x310 [ 369.265878][T15000] __x64_sys_mount+0x293/0x310 [ 369.265906][T15000] ? __pfx___x64_sys_mount+0x10/0x10 [ 369.265943][T15000] do_syscall_64+0x123/0x790 [ 369.265971][T15000] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 369.265993][T15000] RIP: 0033:0x7fd3ce79e159 [ 369.266010][T15000] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 369.266033][T15000] RSP: 002b:00007fd3cf69b028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 369.266064][T15000] RAX: ffffffffffffffda RBX: 00007fd3cea25fa0 RCX: 00007fd3ce79e159 [ 369.266080][T15000] RDX: 0000200000000180 RSI: 0000200000000100 RDI: 0000200000000040 [ 369.266095][T15000] RBP: 00007fd3ce83506b R08: 0000200000000440 R09: 0000000000000000 [ 369.266109][T15000] R10: 0000000000208002 R11: 0000000000000246 R12: 0000000000000000 [ 369.266122][T15000] R13: 00007fd3cea26038 R14: 00007fd3cea25fa0 R15: 00007ffd31882df8 [ 369.266151][T15000] [ 369.267407][T15000] 9pnet_fd: p9_fd_create_unix (15000): problem connecting socket: ./proc: -12 [ 369.359178][T14995] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 369.429056][T14997] bridge_slave_1: left allmulticast mode [ 369.429111][T14997] bridge_slave_1: left promiscuous mode [ 369.429304][T14997] bridge0: port 2(bridge_slave_1) entered disabled state [ 369.484327][T14997] bridge_slave_0: left allmulticast mode [ 369.484354][T14997] bridge_slave_0: left promiscuous mode [ 369.484594][T14997] bridge0: port 1(bridge_slave_0) entered disabled state [ 369.567426][T14997] bond0: (slave bridge0): Releasing backup interface [ 369.867701][T15018] bond0: (slave geneve1): Enslaving as an active interface with an up link [ 369.897855][T15018] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 369.900497][T15018] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 369.923993][T15018] bond0 (unregistering): (slave geneve1): Releasing backup interface [ 369.925699][T15018] bond0 (unregistering): Released all slaves [ 370.697840][ T31] kauditd_printk_skb: 17 callbacks suppressed [ 370.697860][ T31] audit: type=1800 audit(1789570804.887:2545): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15869 res=0 errno=0 [ 370.824203][ T31] audit: type=1800 audit(1789570805.017:2546): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15869 res=0 errno=0 [ 371.018398][ T31] audit: type=1800 audit(1789570805.207:2547): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15746 res=0 errno=0 [ 371.120998][T15056] FAULT_INJECTION: forcing a failure. [ 371.120998][T15056] name failslab, interval 1, probability 0, space 0, times 0 [ 371.121037][T15056] CPU: 0 UID: 0 PID: 15056 Comm: syz.7.3516 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 371.121068][T15056] Tainted: [L]=SOFTLOCKUP [ 371.121076][T15056] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 371.121089][T15056] Call Trace: [ 371.121100][T15056] [ 371.121109][T15056] dump_stack_lvl+0x100/0x190 [ 371.121147][T15056] should_fail_ex.cold+0x5/0xa [ 371.121186][T15056] should_failslab+0xc2/0x120 [ 371.121216][T15056] kmem_cache_alloc_noprof+0x92/0x6a0 [ 371.121240][T15056] ? do_timer_create+0x209/0x1460 [ 371.121271][T15056] do_timer_create+0x209/0x1460 [ 371.121300][T15056] ? do_futex+0x190/0x440 [ 371.121325][T15056] ? __pfx_do_timer_create+0x10/0x10 [ 371.121349][T15056] ? __pfx_do_futex+0x10/0x10 [ 371.121377][T15056] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 371.121412][T15056] __x64_sys_timer_create+0x199/0x1d0 [ 371.121444][T15056] ? __pfx___x64_sys_timer_create+0x10/0x10 [ 371.121475][T15056] ? xfd_validate_state+0x129/0x190 [ 371.121510][T15056] do_syscall_64+0x123/0x790 [ 371.121540][T15056] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 371.121562][T15056] RIP: 0033:0x7fd3ce79e159 [ 371.121581][T15056] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 371.121600][T15056] RSP: 002b:00007fd3cf69b028 EFLAGS: 00000246 ORIG_RAX: 00000000000000de [ 371.121621][T15056] RAX: ffffffffffffffda RBX: 00007fd3cea25fa0 RCX: 00007fd3ce79e159 [ 371.121636][T15056] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffffff600005 [ 371.121649][T15056] RBP: 00007fd3ce83506b R08: 0000000000000000 R09: 0000000000000000 [ 371.121662][T15056] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 371.121675][T15056] R13: 00007fd3cea26038 R14: 00007fd3cea25fa0 R15: 00007ffd31882df8 [ 371.121699][T15056] ? _end+0x63791005/0x0 [ 371.121725][T15056] [ 371.735484][T15048] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 371.735582][T15048] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 371.766293][T15048] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 371.773173][T15048] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 371.773256][T15048] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 371.814788][T15048] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 371.830863][T15048] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 371.830926][T15048] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 371.856382][ T31] audit: type=1800 audit(1789570806.037:2548): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15500 res=0 errno=0 [ 371.897589][T15048] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 371.907229][T15073] netlink: 'syz.5.3524': attribute type 1 has an invalid length. [ 371.945627][T15073] 8021q: adding VLAN 0 to HW filter on device bond2 [ 372.005633][ T31] audit: type=1800 audit(1789570806.197:2549): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15869 res=0 errno=0 [ 372.029495][T15073] bond2: (slave geneve2): making interface the new active one [ 372.046396][T15073] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 372.048350][ T31] audit: type=1400 audit(1789570806.247:2550): avc: denied { create } for pid=15078 comm="syz.8.3526" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 372.079938][ T31] audit: type=1400 audit(1789570806.247:2551): avc: denied { write } for pid=15078 comm="syz.8.3526" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 372.149169][ T31] audit: type=1800 audit(1789570806.337:2552): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15500 res=0 errno=0 [ 372.173038][ T5704] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 372.321470][ T5704] usb 1-1: Using ep0 maxpacket: 8 [ 372.323111][ T5704] usb 1-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 372.324231][ T5704] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 372.328551][ T31] audit: type=1800 audit(1789570806.517:2553): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=210412 res=0 errno=0 [ 372.337229][ T31] audit: type=1800 audit(1789570806.527:2554): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="descriptors" dev="sysfs" ino=210441 res=0 errno=0 [ 372.398832][ T5704] pvrusb2: Hardware description: Terratec Grabster AV400 [ 372.398850][ T5704] pvrusb2: ********** [ 372.398857][ T5704] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 372.398869][ T5704] pvrusb2: Important functionality might not be entirely working. [ 372.398878][ T5704] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 372.398889][ T5704] pvrusb2: ********** [ 372.537146][ T2352] pvrusb2: Invalid write control endpoint [ 372.625494][ T2352] pvrusb2: Invalid write control endpoint [ 372.625509][ T2352] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 372.625518][ T2352] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 372.625525][ T2352] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 372.625534][ T2352] pvrusb2: Device being rendered inoperable [ 372.625583][ T2352] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 372.625620][ T2352] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 372.637842][ T2352] pvrusb2: Attached sub-driver cx25840 [ 372.637857][ T2352] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 372.637865][ T2352] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 372.671641][ T52] Bluetooth: hci6: command 0x1003 tx timeout [ 372.671759][ T5599] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 372.757204][T15063] pvrusb2: Attempted to execute control transfer when device not ok [ 372.762179][ T5712] usb 1-1: USB disconnect, device number 43 [ 372.883601][T15090] loop2: detected capacity change from 0 to 7 [ 372.902960][T15090] Dev loop2: unable to read RDB block 7 [ 372.903012][T15090] loop2: AHDI p1 p2 p3 [ 372.903039][T15090] loop2: partition table partially beyond EOD, truncated [ 372.903308][T15090] loop2: p1 start 1601398130 is beyond EOD, truncated [ 372.903327][T15090] loop2: p2 start 1702059890 is beyond EOD, truncated [ 373.039139][T15093] jffs2: notice: (15093) jffs2_build_xattr_subsystem: complete building xattr subsystem, 6 of xdatum (0 unchecked, 1 orphan) and 7 of xref (0 dead, 1 orphan) found. [ 373.073456][ T5599] Bluetooth: hci3: command 0x0c1a tx timeout [ 373.153467][ T1309] ieee802154 phy0 wpan0: encryption failed: -22 [ 373.153523][ T1309] ieee802154 phy1 wpan1: encryption failed: -22 [ 373.428872][T15107] kvm [15106]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x9d00 [ 373.429061][T15107] kvm [15106]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x9d00 [ 373.741799][ T7737] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 373.799023][ T5599] Bluetooth: hci4: command 0x0c1a tx timeout [ 373.883009][ T5599] Bluetooth: hci5: command 0x0c1a tx timeout [ 373.912779][ T7737] usb 9-1: Using ep0 maxpacket: 32 [ 373.914118][ T7737] usb 9-1: New USB device found, idVendor=133e, idProduct=0815, bcdDevice= 0.40 [ 373.916462][ T7737] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 373.916480][ T7737] usb 9-1: Product: syz [ 373.916490][ T7737] usb 9-1: Manufacturer: syz [ 373.916499][ T7737] usb 9-1: SerialNumber: syz [ 374.131916][ T25] usb 1-1: new full-speed USB device number 44 using dummy_hcd [ 374.138449][ T7737] snd-usb-audio 9-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 374.154600][ T7737] usb 9-1: USB disconnect, device number 8 [ 374.284617][ T25] usb 1-1: unable to get BOS descriptor or descriptor too short [ 374.285097][ T25] usb 1-1: not running at top speed; connect to a high speed hub [ 374.285127][ T25] usb 1-1: New USB device found, idVendor=046d, idProduct=c286, bcdDevice= 0.40 [ 374.286040][ T25] usb 1-1: config 1 interface 0 has no altsetting 0 [ 374.288566][ T25] usb 1-1: string descriptor 0 read error: -22 [ 374.288700][ T25] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 374.552421][T15142] SELinux: failed to load policy [ 374.618513][T15144] FAULT_INJECTION: forcing a failure. [ 374.618513][T15144] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 374.618540][T15144] CPU: 1 UID: 0 PID: 15144 Comm: syz.9.3550 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 374.618560][T15144] Tainted: [L]=SOFTLOCKUP [ 374.618565][T15144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 374.618574][T15144] Call Trace: [ 374.618579][T15144] [ 374.618584][T15144] dump_stack_lvl+0x100/0x190 [ 374.618607][T15144] should_fail_ex.cold+0x5/0xa [ 374.618623][T15144] ? prepare_alloc_pages+0x16d/0x5b0 [ 374.618640][T15144] should_fail_alloc_page+0xeb/0x140 [ 374.618656][T15144] prepare_alloc_pages+0x1f0/0x5b0 [ 374.618674][T15144] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 374.618705][T15144] ? __lock_acquire+0x5c0/0x1f40 [ 374.618728][T15144] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 374.618752][T15144] ? __css_rstat_updated+0x1ce/0x590 [ 374.618773][T15144] ? lock_acquire+0x1d1/0x380 [ 374.618786][T15144] ? do_raw_spin_lock+0x128/0x260 [ 374.618802][T15144] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 374.618817][T15144] ? find_held_lock+0x2b/0x80 [ 374.618838][T15144] ? __lock_acquire+0x5c0/0x1f40 [ 374.618855][T15144] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 374.618870][T15144] ? policy_nodemask+0xed/0x4f0 [ 374.618898][T15144] alloc_pages_mpol+0x201/0x550 [ 374.618923][T15144] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 374.618950][T15144] ? __folio_batch_add_and_move+0x5e5/0xc60 [ 374.618971][T15144] folio_alloc_mpol_noprof+0x36/0x260 [ 374.618989][T15144] shmem_alloc_folio+0x135/0x160 [ 374.619005][T15144] shmem_alloc_and_add_folio+0x371/0xd40 [ 374.619025][T15144] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 374.619043][T15144] ? shmem_allowable_huge_orders+0x2bd/0x400 [ 374.619064][T15144] shmem_get_folio_gfp+0x75b/0x1980 [ 374.619084][T15144] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 374.619107][T15144] shmem_write_begin+0x1a4/0x420 [ 374.619125][T15144] ? __pfx_shmem_write_begin+0x10/0x10 [ 374.619143][T15144] ? balance_dirty_pages_ratelimited_flags+0x91/0x1170 [ 374.619164][T15144] generic_perform_write+0x292/0xa40 [ 374.619186][T15144] ? __pfx_generic_perform_write+0x10/0x10 [ 374.619202][T15144] ? file_update_time_flags+0x38c/0x520 [ 374.619221][T15144] ? __pfx_shmem_file_write_iter+0x10/0x10 [ 374.619232][T15144] shmem_file_write_iter+0x10e/0x140 [ 374.619246][T15144] __kernel_write_iter+0x2ac/0x930 [ 374.619259][T15144] ? __pfx___kernel_write_iter+0x10/0x10 [ 374.619279][T15144] kernel_write+0x1f4/0x680 [ 374.619292][T15144] ? __pfx_kernel_write+0x10/0x10 [ 374.619305][T15144] ? __shmem_file_setup+0x296/0x460 [ 374.619322][T15144] ? big_key_preparse+0x2b7/0x5a0 [ 374.619340][T15144] big_key_preparse+0x390/0x5a0 [ 374.619367][T15144] ? __pfx_big_key_preparse+0x10/0x10 [ 374.619382][T15144] ? __pfx_down_read+0x10/0x10 [ 374.619403][T15144] ? __pfx_big_key_preparse+0x10/0x10 [ 374.619420][T15144] __key_create_or_update+0x463/0xe30 [ 374.619436][T15144] ? __pfx___key_create_or_update+0x10/0x10 [ 374.619451][T15144] ? lookup_user_key+0x3f3/0x1300 [ 374.619465][T15144] ? lockdep_hardirqs_on+0x7d/0x110 [ 374.619481][T15144] ? irqentry_exit+0x24d/0xa10 [ 374.619499][T15144] ? __pfx_lookup_user_key_possessed+0x10/0x10 [ 374.619515][T15144] key_create_or_update+0x42/0x60 [ 374.619532][T15144] __do_sys_add_key+0x2e8/0x460 [ 374.619549][T15144] ? __pfx___do_sys_add_key+0x10/0x10 [ 374.619564][T15144] ? ksys_write+0x1ac/0x250 [ 374.619582][T15144] do_syscall_64+0x123/0x790 [ 374.619598][T15144] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 374.619611][T15144] RIP: 0033:0x7fed62f9e159 [ 374.619623][T15144] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 374.619635][T15144] RSP: 002b:00007fed63e41028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 374.619648][T15144] RAX: ffffffffffffffda RBX: 00007fed63225fa0 RCX: 00007fed62f9e159 [ 374.619656][T15144] RDX: 0000200000000400 RSI: 0000200000000280 RDI: 0000200000000180 [ 374.619664][T15144] RBP: 00007fed6303506b R08: fffffffffffffffe R09: 0000000000000000 [ 374.619672][T15144] R10: 00000000000fffff R11: 0000000000000246 R12: 0000000000000000 [ 374.619680][T15144] R13: 00007fed63226038 R14: 00007fed63225fa0 R15: 00007ffc31f84528 [ 374.619697][T15144] [ 374.876034][T15150] netlink: 'syz.8.3553': attribute type 1 has an invalid length. [ 375.061344][T15150] 8021q: adding VLAN 0 to HW filter on device bond4 [ 375.075448][ T25] hid_parser_main: 223 callbacks suppressed [ 375.075472][ T25] logitech 0003:046D:C286.0027: unknown main item tag 0x0 [ 375.075502][ T25] logitech 0003:046D:C286.0027: unknown main item tag 0x0 [ 375.075542][ T25] logitech 0003:046D:C286.0027: unknown main item tag 0x0 [ 375.075567][ T25] logitech 0003:046D:C286.0027: unknown main item tag 0x0 [ 375.075590][ T25] logitech 0003:046D:C286.0027: unknown main item tag 0x0 [ 375.075613][ T25] logitech 0003:046D:C286.0027: unknown main item tag 0x0 [ 375.075637][ T25] logitech 0003:046D:C286.0027: unknown main item tag 0x0 [ 375.075685][ T25] logitech 0003:046D:C286.0027: unknown main item tag 0x0 [ 375.075709][ T25] logitech 0003:046D:C286.0027: unknown main item tag 0x0 [ 375.075734][ T25] logitech 0003:046D:C286.0027: unknown main item tag 0x0 [ 375.164228][ T5599] Bluetooth: hci3: command 0x0c1a tx timeout [ 375.198799][ T25] logitech 0003:046D:C286.0027: hidraw0: USB HID v0.0a Device [HID 046d:c286] on usb-dummy_hcd.0-1/input0 [ 375.198856][ T25] logitech 0003:046D:C286.0027: no inputs found [ 375.236653][ T25] usb 1-1: USB disconnect, device number 44 [ 375.254851][T15156] bond4: (slave gretap1): making interface the new active one [ 375.344627][T15165] fido_id[15165]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 375.376801][T15156] bond4: (slave gretap1): Enslaving as an active interface with an up link [ 375.755486][ T31] kauditd_printk_skb: 36 callbacks suppressed [ 375.755507][ T31] audit: type=1800 audit(1789570809.947:2591): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15869 res=0 errno=0 [ 375.755949][T15185] geneve3: entered promiscuous mode [ 375.755969][T15185] geneve3: entered allmulticast mode [ 375.765651][ T25] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 375.871857][ T5599] Bluetooth: hci4: command 0x0c1a tx timeout [ 375.892217][ T31] audit: type=1800 audit(1789570810.087:2592): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15869 res=0 errno=0 [ 375.952789][ T25] usb 10-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 375.954184][ T25] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 375.954218][ T25] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 375.954241][ T25] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 375.954278][ T25] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 375.954290][ T5599] Bluetooth: hci5: command 0x0c1a tx timeout [ 375.956944][ T25] usb 10-1: config 0 descriptor?? [ 375.960681][ T31] audit: type=1800 audit(1789570810.147:2593): pid=5808 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=211305 res=0 errno=0 [ 376.057266][ T31] audit: type=1800 audit(1789570810.247:2594): pid=5808 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="descriptors" dev="sysfs" ino=211334 res=0 errno=0 [ 376.058416][ T31] audit: type=1800 audit(1789570810.247:2595): pid=5808 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="idVendor" dev="sysfs" ino=211312 res=0 errno=0 [ 376.059528][ T31] audit: type=1800 audit(1789570810.247:2596): pid=5808 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="idProduct" dev="sysfs" ino=211313 res=0 errno=0 [ 376.060909][ T31] audit: type=1800 audit(1789570810.247:2597): pid=5808 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="bcdDevice" dev="sysfs" ino=211314 res=0 errno=0 [ 376.085647][ T31] audit: type=1800 audit(1789570810.257:2598): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15500 res=0 errno=0 [ 376.161653][ T31] audit: type=1800 audit(1789570810.347:2599): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15500 res=0 errno=0 [ 376.167315][ T31] audit: type=1800 audit(1789570810.347:2600): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=211354 res=0 errno=0 [ 376.270100][T15201] FAULT_INJECTION: forcing a failure. [ 376.270100][T15201] name failslab, interval 1, probability 0, space 0, times 0 [ 376.270136][T15201] CPU: 1 UID: 0 PID: 15201 Comm: syz.7.3571 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 376.270164][T15201] Tainted: [L]=SOFTLOCKUP [ 376.270172][T15201] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 376.270184][T15201] Call Trace: [ 376.270190][T15201] [ 376.270199][T15201] dump_stack_lvl+0x100/0x190 [ 376.270236][T15201] should_fail_ex.cold+0x5/0xa [ 376.270279][T15201] should_failslab+0xc2/0x120 [ 376.270319][T15201] __kmalloc_noprof+0xfc/0x840 [ 376.270350][T15201] ? sk_prot_alloc+0x10b/0x2a0 [ 376.270397][T15201] sk_prot_alloc+0x10b/0x2a0 [ 376.270440][T15201] sk_alloc+0x36/0xe80 [ 376.270478][T15201] pppol2tp_create+0x32/0x250 [ 376.270556][T15201] pppox_create+0x15c/0x2c0 [ 376.270603][T15201] __sock_create+0x339/0x860 [ 376.270655][T15201] __sys_socket+0x14d/0x260 [ 376.270685][T15201] ? __pfx___sys_socket+0x10/0x10 [ 376.270740][T15201] __x64_sys_socket+0x72/0xb0 [ 376.270767][T15201] ? lockdep_hardirqs_on+0x7d/0x110 [ 376.270807][T15201] do_syscall_64+0x123/0x790 [ 376.270851][T15201] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 376.270875][T15201] RIP: 0033:0x7fd3ce79e159 [ 376.270893][T15201] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 376.270915][T15201] RSP: 002b:00007fd3cf69b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 376.270935][T15201] RAX: ffffffffffffffda RBX: 00007fd3cea25fa0 RCX: 00007fd3ce79e159 [ 376.270948][T15201] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 0000000000000018 [ 376.270958][T15201] RBP: 00007fd3ce83506b R08: 0000000000000000 R09: 0000000000000000 [ 376.270969][T15201] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 376.270980][T15201] R13: 00007fd3cea26038 R14: 00007fd3cea25fa0 R15: 00007ffd31882df8 [ 376.271005][T15201] [ 376.468175][T15205] FAULT_INJECTION: forcing a failure. [ 376.468175][T15205] name failslab, interval 1, probability 0, space 0, times 0 [ 376.468216][T15205] CPU: 0 UID: 0 PID: 15205 Comm: syz.0.3572 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 376.468248][T15205] Tainted: [L]=SOFTLOCKUP [ 376.468257][T15205] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 376.468270][T15205] Call Trace: [ 376.468279][T15205] [ 376.468288][T15205] dump_stack_lvl+0x100/0x190 [ 376.468326][T15205] should_fail_ex.cold+0x5/0xa [ 376.468356][T15205] should_failslab+0xc2/0x120 [ 376.468383][T15205] __kvmalloc_node_noprof+0x113/0x9b0 [ 376.468409][T15205] ? do_raw_spin_lock+0x128/0x260 [ 376.468435][T15205] ? alloc_fdtable+0x17f/0x2d0 [ 376.468464][T15205] alloc_fdtable+0x17f/0x2d0 [ 376.468488][T15205] dup_fd+0x995/0xd10 [ 376.468514][T15205] ? do_raw_spin_unlock+0x145/0x1e0 [ 376.468539][T15205] ? _raw_spin_unlock+0x28/0x50 [ 376.468563][T15205] ? copy_fs_struct+0x2a0/0x340 [ 376.468588][T15205] ksys_unshare+0x7c7/0xa70 [ 376.468613][T15205] ? __pfx_ksys_unshare+0x10/0x10 [ 376.468646][T15205] __x64_sys_unshare+0x31/0x40 [ 376.468670][T15205] do_syscall_64+0x123/0x790 [ 376.468699][T15205] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 376.468721][T15205] RIP: 0033:0x7eff4f99e159 [ 376.468739][T15205] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 376.468758][T15205] RSP: 002b:00007eff508b6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 376.468779][T15205] RAX: ffffffffffffffda RBX: 00007eff4fc25fa0 RCX: 00007eff4f99e159 [ 376.468793][T15205] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000022020600 [ 376.468806][T15205] RBP: 00007eff4fa3506b R08: 0000000000000000 R09: 0000000000000000 [ 376.468818][T15205] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 376.468830][T15205] R13: 00007eff4fc26038 R14: 00007eff4fc25fa0 R15: 00007ffd6fb06df8 [ 376.468858][T15205] [ 376.686181][ T25] plantronics 0003:047F:FFFF.0028: reserved main item tag 0xd [ 376.834510][ T25] plantronics 0003:047F:FFFF.0028: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.9-1/input0 [ 377.060184][ T7740] usb 10-1: USB disconnect, device number 4 [ 377.231598][ T52] Bluetooth: hci3: command 0x0c1a tx timeout [ 377.635773][T15253] FAULT_INJECTION: forcing a failure. [ 377.635773][T15253] name failslab, interval 1, probability 0, space 0, times 0 [ 377.635814][T15253] CPU: 1 UID: 0 PID: 15253 Comm: syz.8.3590 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 377.635842][T15253] Tainted: [L]=SOFTLOCKUP [ 377.635850][T15253] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 377.635862][T15253] Call Trace: [ 377.635870][T15253] [ 377.635880][T15253] dump_stack_lvl+0x100/0x190 [ 377.635918][T15253] should_fail_ex.cold+0x5/0xa [ 377.635947][T15253] should_failslab+0xc2/0x120 [ 377.635976][T15253] __kmalloc_cache_noprof+0x91/0x6d0 [ 377.636008][T15253] ? percpu_ref_init+0xec/0x3f0 [ 377.636047][T15253] ? __pfx_io_ring_ctx_ref_free+0x10/0x10 [ 377.636087][T15253] percpu_ref_init+0xec/0x3f0 [ 377.636119][T15253] io_uring_setup.cold+0x2be/0x1cde [ 377.636141][T15253] ? lock_acquire+0x1d1/0x380 [ 377.636163][T15253] ? avc_has_perm_noaudit+0x56/0x3b0 [ 377.636193][T15253] ? __pfx_io_uring_setup+0x10/0x10 [ 377.636213][T15253] ? find_held_lock+0x2b/0x80 [ 377.636238][T15253] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 377.636262][T15253] ? avc_has_perm_noaudit+0x11e/0x3b0 [ 377.636303][T15253] ? xfd_validate_state+0x129/0x190 [ 377.636322][T15253] ? exit_to_user_mode_loop+0x166/0x700 [ 377.636349][T15253] __x64_sys_io_uring_setup+0xc2/0x170 [ 377.636377][T15253] do_syscall_64+0x123/0x790 [ 377.636410][T15253] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 377.636433][T15253] RIP: 0033:0x7f50c0f9e159 [ 377.636451][T15253] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 377.636472][T15253] RSP: 002b:00007f50c1ea4fb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 377.636492][T15253] RAX: ffffffffffffffda RBX: 0000200000000080 RCX: 00007f50c0f9e159 [ 377.636507][T15253] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000020 [ 377.636519][T15253] RBP: 00007f50c103506b R08: 0000000000000000 R09: 0000000000000000 [ 377.636530][T15253] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 377.636543][T15253] R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffc71a42ef8 [ 377.636583][T15253] [ 377.862230][T15256] netlink: 4 bytes leftover after parsing attributes in process `syz.9.3591'. [ 377.956945][ T52] Bluetooth: hci4: command 0x0c1a tx timeout [ 378.043096][ T52] Bluetooth: hci5: command 0x0c1a tx timeout [ 378.460375][T15271] input: syz0 as /devices/virtual/input/input52 [ 379.156313][ T59] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 379.431714][ T59] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 379.490844][ T52] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 379.508337][ T52] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 379.520918][ T52] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 379.536630][ T52] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 379.539983][ T52] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 379.697368][ T59] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 379.797985][ T59] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 379.988711][T15310] syzkaller1: entered promiscuous mode [ 379.988736][T15310] syzkaller1: entered allmulticast mode [ 380.114649][ T52] Bluetooth: hci5: command 0x0c1a tx timeout [ 380.787839][ T59] bond4 (unregistering): (slave gretap1): Releasing active interface [ 380.822285][ T59] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 380.852549][ T59] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 380.855153][ T59] bond0 (unregistering): Released all slaves [ 380.878000][ T59] bond1 (unregistering): (slave lo): Releasing backup interface [ 380.881049][ T59] bond1 (unregistering): (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 380.892130][ T59] bond1 (unregistering): Released all slaves [ 380.922478][ T59] bond2 (unregistering): Released all slaves [ 380.942330][ T59] bond3 (unregistering): Released all slaves [ 380.962284][ T59] bond4 (unregistering): Released all slaves [ 381.326757][ T31] kauditd_printk_skb: 56 callbacks suppressed [ 381.326774][ T31] audit: type=1800 audit(1789570815.517:2657): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=213711 res=0 errno=0 [ 381.632317][ T52] Bluetooth: hci3: command tx timeout [ 381.638722][ T31] audit: type=1400 audit(1789570815.827:2658): avc: denied { write } for pid=15334 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 381.831766][ T31] audit: type=1400 audit(1789570816.027:2659): avc: denied { write } for pid=15359 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 382.019182][ T5263] 8021q: adding VLAN 0 to HW filter on device eth13 [ 382.038536][ T59] hsr_slave_0: left promiscuous mode [ 382.039892][ T59] hsr_slave_1: left promiscuous mode [ 382.040651][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 382.040672][ T59] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 382.046015][ T59] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 382.046035][ T59] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 382.073296][ T59] batman_adv: batadv0: Removing interface: ipvlan0 [ 382.119859][ T59] veth1_macvtap: left promiscuous mode [ 382.119897][ T59] veth0_macvtap: left promiscuous mode [ 382.119980][ T59] veth1_vlan: left promiscuous mode [ 382.120055][ T59] veth0_vlan: left promiscuous mode [ 382.208743][T15376] could not open pipe file descriptor [ 382.328541][ T31] audit: type=1804 audit(1789570816.517:2660): pid=15381 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.7.3632" name="/newroot/372/file0" dev="tmpfs" ino=1954 res=1 errno=0 [ 382.411189][ T31] audit: type=1800 audit(1789570816.597:2661): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15500 res=0 errno=0 [ 382.550713][ T59] team0 (unregistering): Port device team_slave_1 removed [ 382.575708][ T31] audit: type=1800 audit(1789570816.767:2662): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15500 res=0 errno=0 [ 382.611950][ T59] team0 (unregistering): Port device team_slave_0 removed [ 382.620467][T15387] netlink: 16 bytes leftover after parsing attributes in process `syz.7.3636'. [ 382.678215][ T31] audit: type=1800 audit(1789570816.867:2663): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15500 res=0 errno=0 [ 382.750040][ T31] audit: type=1800 audit(1789570816.937:2664): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15500 res=0 errno=0 [ 382.869905][ T31] audit: type=1804 audit(1789570817.057:2665): pid=15394 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.5.3638" name="/newroot/613/nfsd/portlist" dev="nfsd" ino=13 res=1 errno=0 [ 382.949720][T15296] bridge0: port 1(bridge_slave_0) entered blocking state [ 382.949778][T15296] bridge0: port 1(bridge_slave_0) entered disabled state [ 382.949881][T15296] bridge_slave_0: entered allmulticast mode [ 382.950817][T15296] bridge_slave_0: entered promiscuous mode [ 382.954008][T15296] bridge0: port 2(bridge_slave_1) entered blocking state [ 382.954090][T15296] bridge0: port 2(bridge_slave_1) entered disabled state [ 382.954216][T15296] bridge_slave_1: entered allmulticast mode [ 382.955667][T15296] bridge_slave_1: entered promiscuous mode [ 383.099756][T15296] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 383.133853][T15296] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 383.169118][T15296] team0: Port device team_slave_0 added [ 383.178092][T15296] team0: Port device team_slave_1 added [ 383.264668][T15296] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 383.264686][T15296] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 383.264708][T15296] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 383.266903][T15296] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 383.266920][T15296] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 383.266944][T15296] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 383.406229][T15296] hsr_slave_0: entered promiscuous mode [ 383.407050][T15296] hsr_slave_1: entered promiscuous mode [ 383.407628][T15296] debugfs: 'hsr0' already exists in 'hsr' [ 383.407647][T15296] Cannot create hsr debugfs directory [ 383.712114][ T52] Bluetooth: hci3: command tx timeout [ 383.725830][ T31] audit: type=1800 audit(1789570817.917:2666): pid=15296 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz-executor" name="del_device" dev="sysfs" ino=24523 res=0 errno=0 [ 384.469443][T15441] all: renamed from macvtap0 (while UP) [ 384.498382][ T5263] 8021q: adding VLAN 0 to HW filter on device eth14 [ 384.653789][ T5704] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 384.803141][ T5704] usb 1-1: Using ep0 maxpacket: 16 [ 384.805208][ T5704] usb 1-1: New USB device found, idVendor=0c70, idProduct=f00d, bcdDevice= 0.00 [ 384.808059][ T5704] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 384.808092][ T5704] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 384.810183][ T5704] usb 1-1: config 0 descriptor?? [ 384.815660][T15429] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 385.310670][ T5704] hid_parser_main: 3543 callbacks suppressed [ 385.310695][ T5704] aquacomputer_d5next 0003:0C70:F00D.0029: unknown main item tag 0x0 [ 385.310725][ T5704] aquacomputer_d5next 0003:0C70:F00D.0029: unknown main item tag 0x0 [ 385.310749][ T5704] aquacomputer_d5next 0003:0C70:F00D.0029: unknown main item tag 0x0 [ 385.310773][ T5704] aquacomputer_d5next 0003:0C70:F00D.0029: unknown main item tag 0x0 [ 385.310796][ T5704] aquacomputer_d5next 0003:0C70:F00D.0029: unknown main item tag 0x0 [ 385.310820][ T5704] aquacomputer_d5next 0003:0C70:F00D.0029: unknown main item tag 0x0 [ 385.310882][ T5704] aquacomputer_d5next 0003:0C70:F00D.0029: unknown main item tag 0x0 [ 385.310908][ T5704] aquacomputer_d5next 0003:0C70:F00D.0029: unknown main item tag 0x0 [ 385.310928][ T5704] aquacomputer_d5next 0003:0C70:F00D.0029: unknown main item tag 0x0 [ 385.310951][ T5704] aquacomputer_d5next 0003:0C70:F00D.0029: unknown main item tag 0x0 [ 385.403358][ T5704] aquacomputer_d5next 0003:0C70:F00D.0029: hidraw0: USB HID v0.08 Device [HID 0c70:f00d] on usb-dummy_hcd.0-1/input0 [ 385.560247][ T5263] 8021q: adding VLAN 0 to HW filter on device eth15 [ 385.635393][ T5704] usb 1-1: USB disconnect, device number 45 [ 385.680107][T15296] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 385.694622][T15296] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 385.695437][T15296] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 385.727692][T15296] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 385.728872][T15296] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 385.736142][T15296] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 385.738912][T15296] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 385.783956][T15296] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 385.797917][ T52] Bluetooth: hci3: command tx timeout [ 385.953378][T15495] netlink: 'syz.7.3664': attribute type 7 has an invalid length. [ 385.974310][T15495] netlink: 'syz.7.3664': attribute type 7 has an invalid length. [ 386.016694][T15296] 8021q: adding VLAN 0 to HW filter on device bond0 [ 386.041377][ T178] netdevsim netdevsim7 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 386.042563][ T43] netdevsim netdevsim7 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 386.042593][ T43] netdevsim netdevsim7 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 386.042613][ T43] netdevsim netdevsim7 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 386.096642][T15296] 8021q: adding VLAN 0 to HW filter on device team0 [ 386.115106][ T178] bridge0: port 1(bridge_slave_0) entered blocking state [ 386.115196][ T178] bridge0: port 1(bridge_slave_0) entered forwarding state [ 386.184586][ T178] bridge0: port 2(bridge_slave_1) entered blocking state [ 386.184680][ T178] bridge0: port 2(bridge_slave_1) entered forwarding state [ 386.258054][T15500] loop5: detected capacity change from 0 to 4095 [ 386.634275][ T31] kauditd_printk_skb: 26 callbacks suppressed [ 386.634294][ T31] audit: type=1400 audit(1789570820.817:2693): avc: denied { write } for pid=15492 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 386.744955][T15507] buffer_io_error: 4 callbacks suppressed [ 386.744975][T15507] Buffer I/O error on dev loop5, logical block 511, async page read [ 386.771602][ T31] audit: type=1400 audit(1789570820.957:2694): avc: denied { write } for pid=15518 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 386.773101][ T6646] Buffer I/O error on dev loop5, logical block 511, async page read [ 386.875981][ T5263] 8021q: adding VLAN 0 to HW filter on device eth16 [ 387.015082][ T31] audit: type=1800 audit(1789570821.207:2695): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15500 res=0 errno=0 [ 387.440276][T15296] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 387.559057][T15296] veth0_vlan: entered promiscuous mode [ 387.588978][T15296] veth1_vlan: entered promiscuous mode [ 387.659769][T15296] veth0_macvtap: entered promiscuous mode [ 387.679876][T15296] veth1_macvtap: entered promiscuous mode [ 387.706637][ T31] audit: type=1400 audit(1789570821.897:2696): avc: denied { write } for pid=15524 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 387.708614][T15296] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 387.748885][T15296] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 387.833115][ T165] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 387.833470][ T165] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 387.833507][ T165] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 387.833540][ T165] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 387.882682][ T52] Bluetooth: hci3: command tx timeout [ 387.980050][ T31] audit: type=1400 audit(1789570822.167:2697): avc: denied { write } for pid=15557 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 388.054332][ T31] audit: type=1800 audit(1789570822.247:2698): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=218920 res=0 errno=0 [ 388.293028][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 388.293062][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 388.301405][ T31] audit: type=1800 audit(1789570822.487:2699): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=219046 res=0 errno=0 [ 388.465145][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 388.465168][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 388.641756][ T7736] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 388.780108][ T31] audit: type=1800 audit(1789570822.967:2700): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=219180 res=0 errno=0 [ 388.783239][ T7738] usb 6-1: Failed to load image "edgeport/boot.fw" err -110 [ 388.803036][ T31] audit: type=1800 audit(1789570822.977:2701): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=219209 res=0 errno=0 [ 388.815959][ T31] audit: type=1800 audit(1789570822.997:2702): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=219190 res=0 errno=0 [ 388.816152][ T7736] usb 1-1: Using ep0 maxpacket: 32 [ 388.825777][ T7736] usb 1-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 388.827467][ T7736] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 388.827494][ T7736] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 388.827533][ T7736] usb 1-1: too many endpoints for config 1 interface 1 altsetting 239: 255, using maximum allowed: 30 [ 388.827569][ T7736] usb 1-1: config 1 interface 1 altsetting 239 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 388.827610][ T7736] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 388.827666][ T7736] usb 1-1: config 1 interface 1 has no altsetting 0 [ 388.832433][ T7736] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 388.832460][ T7736] usb 1-1: Product: syz [ 388.832474][ T7736] usb 1-1: Manufacturer: syz [ 388.832487][ T7736] usb 1-1: SerialNumber: syz [ 388.909739][ T7738] usb 6-1: EPiC device converter now attached to ttyUSB0 [ 389.066048][ T7738] usb 6-1: USB disconnect, device number 25 [ 389.192382][ T7738] epic ttyUSB0: EPiC device converter now disconnected from ttyUSB0 [ 389.193003][ T7738] io_edgeport 6-1:160.168: device disconnected [ 389.204407][ T7736] usb 1-1: selecting invalid altsetting 0 [ 389.399468][T15593] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 389.440471][ T7736] usb 1-1: 1:1: cannot get freq (v2/v3): err -32 [ 389.602659][ T178] IPVS: starting estimator thread 0... [ 389.650902][ T7736] usb 1-1: 1:1: cannot get freq (v2/v3): err -71 [ 389.692027][T15598] IPVS: using max 49 ests per chain, 117600 per kthread [ 389.956984][ T7736] usb 1-1: USB disconnect, device number 46 [ 390.144274][ T5589] udevd[5589]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 391.018191][T15644] device-mapper: table: 248:0: zero-length target [ 391.018209][T15644] device-mapper: ioctl: error adding target to table [ 391.657537][ T31] kauditd_printk_skb: 29 callbacks suppressed [ 391.657556][ T31] audit: type=1400 audit(1789570825.847:2732): avc: denied { write } for pid=15677 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 392.071164][ T31] audit: type=1400 audit(1789570826.257:2733): avc: denied { write } for pid=15681 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 392.189300][ T31] audit: type=1400 audit(1789570826.377:2734): avc: denied { write } for pid=15695 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 392.566287][ T31] audit: type=1400 audit(1789570826.757:2735): avc: denied { write } for pid=15697 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 392.684955][ T31] audit: type=1400 audit(1789570826.877:2736): avc: denied { write } for pid=15708 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 393.080755][ T31] audit: type=1400 audit(1789570827.267:2737): avc: denied { write } for pid=15710 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 393.185314][ T31] audit: type=1400 audit(1789570827.377:2738): avc: denied { write } for pid=15721 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 393.520928][ T31] audit: type=1400 audit(1789570827.707:2739): avc: denied { write } for pid=15725 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 393.674119][ T31] audit: type=1400 audit(1789570827.867:2740): avc: denied { write } for pid=15748 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 393.845969][T15759] FAULT_INJECTION: forcing a failure. [ 393.845969][T15759] name failslab, interval 1, probability 0, space 0, times 0 [ 393.846010][T15759] CPU: 1 UID: 0 PID: 15759 Comm: syz.9.3710 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 393.846047][T15759] Tainted: [L]=SOFTLOCKUP [ 393.846055][T15759] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 393.846067][T15759] Call Trace: [ 393.846075][T15759] [ 393.846085][T15759] dump_stack_lvl+0x100/0x190 [ 393.846130][T15759] should_fail_ex.cold+0x5/0xa [ 393.846163][T15759] should_failslab+0xc2/0x120 [ 393.846190][T15759] kmem_cache_alloc_noprof+0x92/0x6a0 [ 393.846216][T15759] ? __mpol_dup+0x74/0x390 [ 393.846248][T15759] __mpol_dup+0x74/0x390 [ 393.846275][T15759] ? __pfx___mpol_dup+0x10/0x10 [ 393.846313][T15759] __do_sys_set_mempolicy_home_node+0x324/0x710 [ 393.846354][T15759] ? __pfx___do_sys_set_mempolicy_home_node+0x10/0x10 [ 393.846386][T15759] ? __x64_sys_futex+0x34f/0x4d0 [ 393.846413][T15759] ? __x64_sys_futex+0x358/0x4d0 [ 393.846460][T15759] do_syscall_64+0x123/0x790 [ 393.846495][T15759] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 393.846517][T15759] RIP: 0033:0x7fed62f9e159 [ 393.846534][T15759] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 393.846553][T15759] RSP: 002b:00007fed63e41028 EFLAGS: 00000246 ORIG_RAX: 00000000000001c2 [ 393.846575][T15759] RAX: ffffffffffffffda RBX: 00007fed63225fa0 RCX: 00007fed62f9e159 [ 393.846590][T15759] RDX: 0000000000000000 RSI: 0000000000004000 RDI: 0000200000ffa000 [ 393.846603][T15759] RBP: 00007fed6303506b R08: 0000000000000000 R09: 0000000000000000 [ 393.846617][T15759] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 393.846630][T15759] R13: 00007fed63226038 R14: 00007fed63225fa0 R15: 00007ffc31f84528 [ 393.846660][T15759] [ 394.067011][T15765] ip_tables: iptables: counters copy to user failed while replacing table [ 394.183050][ T31] audit: type=1400 audit(1789570828.377:2741): avc: denied { write } for pid=15754 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 394.404220][T15663] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 394.796050][T15797] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 395.211434][ T7740] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 395.361504][ T7740] usb 1-1: Using ep0 maxpacket: 8 [ 395.362300][ T7740] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 395.363591][ T7740] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 395.363639][ T7740] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 395.366284][ T7740] usb 1-1: config 0 descriptor?? [ 395.578501][ T7740] iowarrior 1-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 396.036922][ T5704] usb 1-1: USB disconnect, device number 47 [ 396.804012][T15625] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 396.888352][T15878] IPv4: Oversized IP packet from 172.20.20.24 [ 396.894708][ C1] IPv4: Oversized IP packet from 172.20.20.24 [ 396.894959][ C1] IPv4: Oversized IP packet from 172.20.20.24 [ 396.906612][ T31] kauditd_printk_skb: 27 callbacks suppressed [ 396.906632][ T31] audit: type=1800 audit(1789570831.097:2769): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=219889 res=0 errno=0 [ 396.959919][ T31] audit: type=1800 audit(1789570831.147:2770): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=219900 res=0 errno=0 [ 397.027967][T15882] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 397.046748][T15882] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 397.079050][T15882] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 397.099072][T15882] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 397.110331][T15882] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 397.197112][ T31] audit: type=1800 audit(1789570831.387:2771): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=219919 res=0 errno=0 [ 397.261493][ T31] audit: type=1800 audit(1789570831.447:2772): pid=15887 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.3742" name="remove" dev="sysfs" ino=2659 res=0 errno=0 [ 397.269288][ T31] audit: type=1800 audit(1789570831.457:2773): pid=15891 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.3742" name="rescan" dev="sysfs" ino=1652 res=0 errno=0 [ 397.306247][ T31] audit: type=1800 audit(1789570831.467:2774): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=219930 res=0 errno=0 [ 397.462432][T15625] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.499528][T15896] Could not find key with description: [syz0] [ 397.499541][T15896] process_request_key_err: No key [ 397.499549][T15896] Could not find valid key in user session keyring for sig specified in mount option: [syz0] [ 397.499556][T15896] One or more global auth toks could not properly register; rc = [-2] [ 397.499589][T15896] Error validating options; rc = [-2] [ 397.753623][ T31] audit: type=1400 audit(1789570831.947:2775): avc: denied { write } for pid=15880 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 397.875568][T15625] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.921630][ T31] audit: type=1400 audit(1789570832.117:2776): avc: denied { write } for pid=15915 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 398.056406][T15625] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 398.380802][ T31] audit: type=1800 audit(1789570832.567:2777): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=220804 res=0 errno=0 [ 398.408974][ T31] audit: type=1800 audit(1789570832.597:2778): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=220815 res=0 errno=0 [ 398.451485][T15882] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 398.471494][T15882] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 398.474888][T15882] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 398.477676][T15882] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 398.478412][T15882] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 399.051122][T15954] vxlan0: entered allmulticast mode [ 399.161493][ T52] Bluetooth: hci2: command tx timeout [ 399.275230][ T165] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 399.275573][ T165] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 399.275608][ T165] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 399.275638][ T165] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 399.309656][T15625] bridge_slave_1: left allmulticast mode [ 399.309680][T15625] bridge_slave_1: left promiscuous mode [ 399.309875][T15625] bridge0: port 2(bridge_slave_1) entered disabled state [ 399.331176][T15625] bridge_slave_0: left allmulticast mode [ 399.331201][T15625] bridge_slave_0: left promiscuous mode [ 399.333944][T15625] bridge0: port 1(bridge_slave_0) entered disabled state [ 399.341518][T15858] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 399.791898][T15625] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 399.812829][T15625] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 399.833683][T15625] bond0 (unregistering): Released all slaves [ 399.854195][T15981] jffs2: notice: (15981) jffs2_build_xattr_subsystem: complete building xattr subsystem, 7 of xdatum (6 unchecked, 1 orphan) and 8 of xref (0 dead, 1 orphan) found. [ 399.961947][T15986] overlay: filesystem on ./file0 not supported [ 400.277653][T15996] netlink: 'syz.7.3759': attribute type 1 has an invalid length. [ 400.439320][T15879] bridge0: port 1(bridge_slave_0) entered blocking state [ 400.439447][T15879] bridge0: port 1(bridge_slave_0) entered disabled state [ 400.439590][T15879] bridge_slave_0: entered allmulticast mode [ 400.441022][T15879] bridge_slave_0: entered promiscuous mode [ 400.601138][ T52] Bluetooth: hci3: command tx timeout [ 400.765805][T15879] bridge0: port 2(bridge_slave_1) entered blocking state [ 400.765895][T15879] bridge0: port 2(bridge_slave_1) entered disabled state [ 400.766029][T15879] bridge_slave_1: entered allmulticast mode [ 400.775475][T15879] bridge_slave_1: entered promiscuous mode [ 400.975080][T15879] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 401.036117][ T25] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 401.182951][ T25] usb 10-1: Using ep0 maxpacket: 8 [ 401.184940][ T25] usb 10-1: New USB device found, idVendor=0d46, idProduct=2011, bcdDevice= 1.00 [ 401.188253][ T25] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 401.188284][ T25] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 401.188317][ T25] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 401.190242][T15625] hsr_slave_0: left promiscuous mode [ 401.209388][ T25] kobil_sct 10-1:1.0: KOBIL USB smart card terminal converter detected [ 401.222393][ T25] usb 10-1: KOBIL USB smart card terminal converter now attached to ttyUSB0 [ 401.231454][ T52] Bluetooth: hci2: command tx timeout [ 401.270825][T15625] hsr_slave_1: left promiscuous mode [ 401.271852][T15625] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 401.271871][T15625] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 401.285692][T15625] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 401.285715][T15625] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 401.330473][T15625] veth1_macvtap: left promiscuous mode [ 401.330510][T15625] veth0_macvtap: left promiscuous mode [ 401.330606][T15625] veth1_vlan: left promiscuous mode [ 401.330666][T15625] veth0_vlan: left promiscuous mode [ 401.950816][ T31] kauditd_printk_skb: 42 callbacks suppressed [ 401.950837][ T31] audit: type=1400 audit(1789570836.137:2821): avc: denied { write } for pid=16052 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 401.994823][T15625] team0 (unregistering): Port device team_slave_1 removed [ 402.026112][T15625] team0 (unregistering): Port device team_slave_0 removed [ 402.265650][ T25] usb 10-1: USB disconnect, device number 5 [ 402.285014][ T25] kobil ttyUSB0: KOBIL USB smart card terminal converter now disconnected from ttyUSB0 [ 402.285559][ T25] kobil_sct 10-1:1.0: device disconnected [ 402.286932][T15879] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 402.409006][T15879] team0: Port device team_slave_0 added [ 402.460692][T15879] team0: Port device team_slave_1 added [ 402.461583][ T988] usb 1-1: new full-speed USB device number 48 using dummy_hcd [ 402.567306][T15879] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 402.567324][T15879] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 402.567349][T15879] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 402.569566][T15879] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 402.569581][T15879] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 402.569602][T15879] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 402.624654][ T31] audit: type=1400 audit(1789570836.807:2822): avc: denied { write } for pid=16057 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 402.626217][ T988] usb 1-1: not running at top speed; connect to a high speed hub [ 402.626253][ T988] usb 1-1: New USB device found, idVendor=225a, idProduct=e1d4, bcdDevice=a7.ad [ 402.638941][ T988] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 402.645675][ T988] usb 1-1: New USB device strings: Mfr=245, Product=210, SerialNumber=0 [ 402.645704][ T988] usb 1-1: Product: syz [ 402.645725][ T988] usb 1-1: Manufacturer: syz [ 402.671478][ T52] Bluetooth: hci3: command tx timeout [ 402.681784][ T31] audit: type=1800 audit(1789570836.867:2823): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=225403 res=0 errno=0 [ 402.688531][ T31] audit: type=1800 audit(1789570836.877:2824): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="descriptors" dev="sysfs" ino=225434 res=0 errno=0 [ 402.691334][ T31] audit: type=1800 audit(1789570836.877:2825): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="idVendor" dev="sysfs" ino=225410 res=0 errno=0 [ 402.694583][ T31] audit: type=1800 audit(1789570836.887:2826): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="idProduct" dev="sysfs" ino=225411 res=0 errno=0 [ 402.740028][ T988] uvcvideo 1-1:1.0: Found UVC 1.00 device syz (225a:e1d4) [ 402.740103][ T988] uvcvideo 1-1:1.0: No streaming interface found for terminal 32770. [ 402.786538][ T31] audit: type=1800 audit(1789570836.977:2827): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="manufacturer" dev="sysfs" ino=225432 res=0 errno=0 [ 402.786590][ T31] audit: type=1800 audit(1789570836.977:2828): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="product" dev="sysfs" ino=225433 res=0 errno=0 [ 402.790013][ T31] audit: type=1800 audit(1789570836.977:2829): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="bcdDevice" dev="sysfs" ino=225412 res=0 errno=0 [ 402.827212][T15879] hsr_slave_0: entered promiscuous mode [ 402.866385][T15879] hsr_slave_1: entered promiscuous mode [ 402.867009][T15879] debugfs: 'hsr0' already exists in 'hsr' [ 402.867029][T15879] Cannot create hsr debugfs directory [ 402.894066][ T31] audit: type=1800 audit(1789570837.087:2830): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=225454 res=0 errno=0 [ 403.007467][ T5334] usb 1-1: USB disconnect, device number 48 [ 403.085570][T16077] netlink: 60 bytes leftover after parsing attributes in process `syz.7.3776'. [ 403.139322][T15625] IPVS: stop unused estimator thread 0... [ 403.190694][T16079] netlink: 60 bytes leftover after parsing attributes in process `syz.7.3776'. [ 403.200878][T16077] netlink: 500 bytes leftover after parsing attributes in process `syz.7.3776'. [ 403.311496][ T52] Bluetooth: hci2: command tx timeout [ 403.798114][T16100] futex_wake_op: syz.7.3779 tries to shift op by -1; fix this program [ 403.890064][T15879] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 404.190592][T15879] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 404.227224][T15931] bridge0: port 1(bridge_slave_0) entered blocking state [ 404.227321][T15931] bridge0: port 1(bridge_slave_0) entered disabled state [ 404.227498][T15931] bridge_slave_0: entered allmulticast mode [ 404.230737][T15931] bridge_slave_0: entered promiscuous mode [ 404.236887][T15931] bridge0: port 2(bridge_slave_1) entered blocking state [ 404.236975][T15931] bridge0: port 2(bridge_slave_1) entered disabled state [ 404.237127][T15931] bridge_slave_1: entered allmulticast mode [ 404.240204][T15931] bridge_slave_1: entered promiscuous mode [ 404.246968][ T5263] 8021q: adding VLAN 0 to HW filter on device eth1 [ 404.341778][T16117] bridge1: entered promiscuous mode [ 404.341827][T16117] bridge1: entered allmulticast mode [ 404.453178][T15879] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 404.588330][T15931] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 404.612858][T15931] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 404.752490][ T52] Bluetooth: hci3: command tx timeout [ 404.793402][T16136] FAULT_INJECTION: forcing a failure. [ 404.793402][T16136] name failslab, interval 1, probability 0, space 0, times 0 [ 404.793439][T16136] CPU: 0 UID: 0 PID: 16136 Comm: syz.0.3788 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 404.793466][T16136] Tainted: [L]=SOFTLOCKUP [ 404.793474][T16136] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 404.793485][T16136] Call Trace: [ 404.793493][T16136] [ 404.793502][T16136] dump_stack_lvl+0x100/0x190 [ 404.793538][T16136] should_fail_ex.cold+0x5/0xa [ 404.793569][T16136] should_failslab+0xc2/0x120 [ 404.793596][T16136] __kmalloc_noprof+0xfc/0x840 [ 404.793618][T16136] ? rcu_is_watching+0x13/0xc0 [ 404.793643][T16136] ? tomoyo_realpath_from_path+0xb6/0x690 [ 404.793674][T16136] tomoyo_realpath_from_path+0xb6/0x690 [ 404.793709][T16136] tomoyo_path_perm+0x276/0x460 [ 404.793728][T16136] ? tomoyo_path_perm+0x262/0x460 [ 404.793751][T16136] ? __pfx_tomoyo_path_perm+0x10/0x10 [ 404.793803][T16136] ? hook_file_truncate+0xba/0x280 [ 404.793826][T16136] ? lock_acquire+0x1d1/0x380 [ 404.793848][T16136] ? __fget_files+0x34/0x3d0 [ 404.793876][T16136] security_file_truncate+0xb5/0x1e0 [ 404.793903][T16136] do_ftruncate+0x216/0x8a0 [ 404.793941][T16136] ? __pfx_do_ftruncate+0x10/0x10 [ 404.793987][T16136] ksys_ftruncate+0x61/0xb0 [ 404.794014][T16136] __x64_sys_ftruncate+0x55/0x80 [ 404.794040][T16136] do_syscall_64+0x123/0x790 [ 404.794071][T16136] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 404.794093][T16136] RIP: 0033:0x7eff4f99e159 [ 404.794112][T16136] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 404.794131][T16136] RSP: 002b:00007eff508b6028 EFLAGS: 00000246 ORIG_RAX: 000000000000004d [ 404.794150][T16136] RAX: ffffffffffffffda RBX: 00007eff4fc25fa0 RCX: 00007eff4f99e159 [ 404.794166][T16136] RDX: 0000000000000000 RSI: 0000000008008976 RDI: 0000000000000003 [ 404.794180][T16136] RBP: 00007eff4fa3506b R08: 0000000000000000 R09: 0000000000000000 [ 404.794194][T16136] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 404.794207][T16136] R13: 00007eff4fc26038 R14: 00007eff4fc25fa0 R15: 00007ffd6fb06df8 [ 404.794235][T16136] [ 404.794244][T16136] ERROR: Out of memory at tomoyo_realpath_from_path. [ 405.070749][T15879] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 405.103804][T15931] team0: Port device team_slave_0 added [ 405.115065][T15931] team0: Port device team_slave_1 added [ 405.178125][T15931] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 405.178142][T15931] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 405.178164][T15931] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 405.183912][T15931] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 405.188514][T15931] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 405.188549][T15931] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 405.292848][ T7737] usb 10-1: new low-speed USB device number 6 using dummy_hcd [ 405.336092][T15931] hsr_slave_0: entered promiscuous mode [ 405.337005][T15931] hsr_slave_1: entered promiscuous mode [ 405.337571][T15931] debugfs: 'hsr0' already exists in 'hsr' [ 405.337590][T15931] Cannot create hsr debugfs directory [ 405.392662][ T52] Bluetooth: hci2: command tx timeout [ 405.456290][ T7737] usb 10-1: New USB device found, idVendor=0c70, idProduct=f0b6, bcdDevice= 0.00 [ 405.461506][ T7737] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 405.461540][ T7737] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 405.461574][ T7737] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 405.506804][ T7737] usb 10-1: config 0 descriptor?? [ 405.698411][ T5263] 8021q: adding VLAN 0 to HW filter on device eth2 [ 405.965716][ T7737] aquacomputer_d5next 0003:0C70:F0B6.002A: hidraw0: USB HID v0.00 Device [HID 0c70:f0b6] on usb-dummy_hcd.9-1/input0 [ 405.971217][T15879] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 406.010486][T15879] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 406.033508][T15879] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 406.046129][T15879] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 406.046894][T15879] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 406.088794][T15879] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 406.089571][T15879] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 406.153621][T16173] nbd0: detected capacity change from 0 to 63 [ 406.165013][T15879] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 406.198740][ T52] block nbd0: Receive control failed (result -104) [ 406.793067][ T5334] usb 10-1: USB disconnect, device number 6 [ 406.831595][ T52] Bluetooth: hci3: command tx timeout [ 406.848298][T15879] 8021q: adding VLAN 0 to HW filter on device bond0 [ 406.883030][T15879] 8021q: adding VLAN 0 to HW filter on device team0 [ 406.956845][ T165] bridge0: port 1(bridge_slave_0) entered blocking state [ 406.957005][ T165] bridge0: port 1(bridge_slave_0) entered forwarding state [ 406.964335][T15625] bridge0: port 2(bridge_slave_1) entered blocking state [ 406.964428][T15625] bridge0: port 2(bridge_slave_1) entered forwarding state [ 406.982594][ T5704] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 407.145098][ T5704] usb 1-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 407.148103][ T5704] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 407.148136][ T5704] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 255 [ 407.160855][ T5704] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 407.160903][ T5704] usb 1-1: Product: syz [ 407.160919][ T5704] usb 1-1: Manufacturer: syz [ 407.160934][ T5704] usb 1-1: SerialNumber: syz [ 407.172607][ T5704] usb 1-1: config 0 descriptor?? [ 407.176607][T16200] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 407.176878][T16200] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 407.205577][ T31] kauditd_printk_skb: 35 callbacks suppressed [ 407.205597][ T31] audit: type=1800 audit(1789570841.397:2866): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=232905 res=0 errno=0 [ 407.210682][ T31] audit: type=1800 audit(1789570841.397:2867): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="descriptors" dev="sysfs" ino=232937 res=0 errno=0 [ 407.210736][ T31] audit: type=1800 audit(1789570841.397:2868): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="idVendor" dev="sysfs" ino=232912 res=0 errno=0 [ 407.210774][ T31] audit: type=1800 audit(1789570841.397:2869): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="idProduct" dev="sysfs" ino=232913 res=0 errno=0 [ 407.318406][ T31] audit: type=1800 audit(1789570841.477:2870): pid=15931 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz-executor" name="new_device" dev="sysfs" ino=24522 res=0 errno=0 [ 407.338397][ T31] audit: type=1800 audit(1789570841.527:2871): pid=5590 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=232973 res=0 errno=0 [ 407.439526][T16200] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 407.439623][T16200] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 407.485710][ T31] audit: type=1400 audit(1789570841.677:2872): avc: denied { write } for pid=16203 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 407.742996][ T31] audit: type=1400 audit(1789570841.927:2873): avc: denied { write } for pid=16224 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 407.854789][ T5704] dm9601: No valid MAC address in EEPROM, using 00:00:00:00:00:00 [ 407.965631][ T5263] 8021q: adding VLAN 0 to HW filter on device eth3 [ 408.208417][T15931] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 408.225709][T15931] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 408.230226][T15931] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 408.246387][T15931] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 408.249594][T15931] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 408.263366][T15931] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 408.268847][T15931] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 408.281772][T15931] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 408.286661][T15879] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 408.472924][ T5704] dm9601 1-1:0.0 (unnamed net_device) (uninitialized): Error reading MODE_CTRL [ 408.476746][ T31] audit: type=1800 audit(1789570842.667:2874): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="manufacturer" dev="sysfs" ino=232934 res=0 errno=0 [ 408.476790][ T31] audit: type=1800 audit(1789570842.667:2875): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="product" dev="sysfs" ino=232935 res=0 errno=0 [ 408.538183][ T5704] usb 1-1: USB disconnect, device number 49 [ 408.783275][T15931] 8021q: adding VLAN 0 to HW filter on device bond0 [ 408.810581][T15931] 8021q: adding VLAN 0 to HW filter on device team0 [ 408.824619][ T153] bridge0: port 1(bridge_slave_0) entered blocking state [ 408.824689][ T153] bridge0: port 1(bridge_slave_0) entered forwarding state [ 408.861825][ T153] bridge0: port 2(bridge_slave_1) entered blocking state [ 408.861926][ T153] bridge0: port 2(bridge_slave_1) entered forwarding state [ 409.031120][T14342] cxacru 8-1:1.0: firmware (cxacru-fw.bin) unavailable (system misconfigured?) [ 409.299709][T15879] veth0_vlan: entered promiscuous mode [ 409.324245][T16262] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 409.340222][T15879] veth1_vlan: entered promiscuous mode [ 409.438457][T15879] veth0_macvtap: entered promiscuous mode [ 409.466952][T15879] veth1_macvtap: entered promiscuous mode [ 409.549540][T15879] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 409.574111][T15879] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 409.658651][ T5263] 8021q: adding VLAN 0 to HW filter on device eth4 [ 409.662607][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 409.662650][ T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 409.662682][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 409.662713][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 409.982261][ T7735] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 410.142155][T15621] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 410.142177][T15621] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 410.169276][ T7735] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 410.170350][ T7735] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 410.170381][ T7735] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 410.170405][ T7735] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 410.170445][ T7735] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 410.244985][ T7735] usb 1-1: config 0 descriptor?? [ 410.470697][ T52] Bluetooth: hci6: setting up ROME/QCA6390 Hü[ 410.557587][T15621] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 410.557608][T15621] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 410.581161][ T7735] usbhid 1-1:0.0: can't add hid device: -71 [ 410.581363][ T7735] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 410.610423][ T7735] usb 1-1: USB disconnect, device number 50 ü[ 410.798783][T15931] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 411.009126][T16307] FAULT_INJECTION: forcing a failure. [ 411.009126][T16307] name failslab, interval 1, probability 0, space 0, times 0 [ 411.009164][T16307] CPU: 0 UID: 0 PID: 16307 Comm: syz.4.3739 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 411.009194][T16307] Tainted: [L]=SOFTLOCKUP [ 411.009203][T16307] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 411.009215][T16307] Call Trace: [ 411.009222][T16307] [ 411.009231][T16307] dump_stack_lvl+0x100/0x190 [ 411.009268][T16307] should_fail_ex.cold+0x5/0xa [ 411.009299][T16307] should_failslab+0xc2/0x120 [ 411.009324][T16307] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 411.009362][T16307] ? setup_ipc_sysctls+0x5e/0x300 [ 411.009393][T16307] kmemdup_noprof+0x29/0x60 [ 411.009422][T16307] setup_ipc_sysctls+0x5e/0x300 [ 411.009449][T16307] copy_ipcs+0x57a/0x7e0 [ 411.009469][T16307] create_new_namespaces+0x20a/0xac0 [ 411.009491][T16307] ? security_capable+0x80/0x260 [ 411.009523][T16307] unshare_nsproxy_namespaces+0xf2/0x220 [ 411.009547][T16307] ksys_unshare+0x4a2/0xa70 [ 411.009571][T16307] ? __pfx_ksys_unshare+0x10/0x10 [ 411.009603][T16307] __x64_sys_unshare+0x31/0x40 [ 411.009626][T16307] do_syscall_64+0x123/0x790 [ 411.009656][T16307] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 411.009677][T16307] RIP: 0033:0x7f62bed9e159 [ 411.009694][T16307] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 411.009712][T16307] RSP: 002b:00007f62bfcb0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 411.009732][T16307] RAX: ffffffffffffffda RBX: 00007f62bf025fa0 RCX: 00007f62bed9e159 [ 411.009746][T16307] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000008040600 [ 411.009758][T16307] RBP: 00007f62bee3506b R08: 0000000000000000 R09: 0000000000000000 [ 411.009770][T16307] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 411.009783][T16307] R13: 00007f62bf026038 R14: 00007f62bf025fa0 R15: 00007ffea6aa0c68 [ 411.009810][T16307] [ 411.111189][T15931] veth0_vlan: entered promiscuous mode [ 411.220182][T15931] veth1_vlan: entered promiscuous mode [ 411.443789][T15931] veth0_macvtap: entered promiscuous mode [ 411.470705][T15931] veth1_macvtap: entered promiscuous mode [ 411.556220][T15931] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 411.600789][T15931] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 411.697097][T15624] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 411.697393][T15624] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 411.697530][T15624] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 411.697882][T15624] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 412.031971][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 412.031996][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 412.064624][T16331] FAULT_INJECTION: forcing a failure. [ 412.064624][T16331] name failslab, interval 1, probability 0, space 0, times 0 [ 412.064661][T16331] CPU: 1 UID: 0 PID: 16331 Comm: syz.9.3821 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 412.064701][T16331] Tainted: [L]=SOFTLOCKUP [ 412.064710][T16331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 412.064723][T16331] Call Trace: [ 412.064730][T16331] [ 412.064739][T16331] dump_stack_lvl+0x100/0x190 [ 412.064773][T16331] should_fail_ex.cold+0x5/0xa [ 412.064808][T16331] should_failslab+0xc2/0x120 [ 412.064834][T16331] __kmalloc_cache_noprof+0x91/0x6d0 [ 412.064865][T16331] ? do_inotify_init+0xa4/0x5e0 [ 412.064887][T16331] do_inotify_init+0xa4/0x5e0 [ 412.064908][T16331] __x64_sys_inotify_init1+0x30/0x40 [ 412.064929][T16331] do_syscall_64+0x123/0x790 [ 412.064957][T16331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 412.064978][T16331] RIP: 0033:0x7fed62f9e159 [ 412.064996][T16331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 412.065014][T16331] RSP: 002b:00007fed63e41028 EFLAGS: 00000246 ORIG_RAX: 0000000000000126 [ 412.065033][T16331] RAX: ffffffffffffffda RBX: 00007fed63225fa0 RCX: 00007fed62f9e159 [ 412.065048][T16331] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000080800 [ 412.065062][T16331] RBP: 00007fed6303506b R08: 0000000000000000 R09: 0000000000000000 [ 412.065074][T16331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 412.065085][T16331] R13: 00007fed63226038 R14: 00007fed63225fa0 R15: 00007ffc31f84528 [ 412.065108][T16331] [ 412.310927][ T31] kauditd_printk_skb: 29 callbacks suppressed [ 412.310946][ T31] audit: type=1800 audit(1789570846.497:2905): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15377 res=0 errno=0 [ 412.396521][T15624] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 412.396544][T15624] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 412.549456][T16344] FAULT_INJECTION: forcing a failure. [ 412.549456][T16344] name failslab, interval 1, probability 0, space 0, times 0 [ 412.549495][T16344] CPU: 0 UID: 0 PID: 16344 Comm: syz.0.3824 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 412.549527][T16344] Tainted: [L]=SOFTLOCKUP [ 412.549536][T16344] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 412.549549][T16344] Call Trace: [ 412.549557][T16344] [ 412.549567][T16344] dump_stack_lvl+0x100/0x190 [ 412.549605][T16344] should_fail_ex.cold+0x5/0xa [ 412.549636][T16344] should_failslab+0xc2/0x120 [ 412.549663][T16344] kmem_cache_alloc_noprof+0x92/0x6a0 [ 412.549686][T16344] ? mas_preallocate+0xc22/0xee0 [ 412.549721][T16344] mas_preallocate+0xc22/0xee0 [ 412.549754][T16344] ? __pfx_mas_preallocate+0x10/0x10 [ 412.549795][T16344] ? anon_vma_name+0x5a/0x250 [ 412.549830][T16344] __split_vma+0x2f8/0x1de0 [ 412.549866][T16344] ? __pfx___split_vma+0x10/0x10 [ 412.549917][T16344] vma_modify+0x1ef4/0x29b0 [ 412.549961][T16344] ? __pfx_vma_modify+0x10/0x10 [ 412.550013][T16344] vma_modify_name+0x29c/0x380 [ 412.550047][T16344] ? __pfx_vma_modify_name+0x10/0x10 [ 412.550093][T16344] ? find_held_lock+0x2b/0x80 [ 412.550122][T16344] ? is_bpf_text_address+0x8a/0x1a0 [ 412.550148][T16344] ? is_bpf_text_address+0x8a/0x1a0 [ 412.550190][T16344] madvise_update_vma+0x572/0xd30 [ 412.550223][T16344] ? __pfx_madvise_update_vma+0x10/0x10 [ 412.550249][T16344] ? arch_stack_walk+0xa6/0xf0 [ 412.550281][T16344] ? mas_prev_slot+0x768/0x11b0 [ 412.550308][T16344] madvise_vma_behavior+0x2d5/0x2350 [ 412.550337][T16344] ? mas_prev+0xa4/0x100 [ 412.550356][T16344] ? __pfx_madvise_vma_behavior+0x10/0x10 [ 412.550385][T16344] ? mas_walk+0x260/0x310 [ 412.550411][T16344] ? find_vma_prev+0xd8/0x150 [ 412.550435][T16344] ? __pfx_find_vma_prev+0x10/0x10 [ 412.550475][T16344] madvise_walk_vmas+0x30e/0xc50 [ 412.550507][T16344] ? __pfx_madvise_walk_vmas+0x10/0x10 [ 412.550538][T16344] ? down_write_killable+0x152/0x240 [ 412.550568][T16344] ? __pfx_down_write_killable+0x10/0x10 [ 412.550598][T16344] ? set_anon_vma_name+0x1e0/0x4c0 [ 412.550625][T16344] ? set_anon_vma_name+0x21f/0x4c0 [ 412.550656][T16344] ? kfree+0x22b/0x6d0 [ 412.550684][T16344] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 412.550713][T16344] set_anon_vma_name+0x333/0x4c0 [ 412.550739][T16344] ? __pfx_set_anon_vma_name+0x10/0x10 [ 412.550764][T16344] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 412.550790][T16344] ? static_key_count+0x5a/0x70 [ 412.550817][T16344] ? security_task_prctl+0x11c/0x160 [ 412.550850][T16344] __do_sys_prctl+0xb41/0x2270 [ 412.550882][T16344] ? __pfx___do_sys_prctl+0x10/0x10 [ 412.550920][T16344] do_syscall_64+0x123/0x790 [ 412.550948][T16344] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 412.550969][T16344] RIP: 0033:0x7eff4f99e159 [ 412.550989][T16344] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 412.551008][T16344] RSP: 002b:00007eff508b6028 EFLAGS: 00000246 ORIG_RAX: 000000000000009d [ 412.551040][T16344] RAX: ffffffffffffffda RBX: 00007eff4fc25fa0 RCX: 00007eff4f99e159 Hü[ 412.551052][T16344] RDX: 0000200000ffb000 RSI: 0000000000000000 RDI: 0000000053564d41 [ 412.551066][T16344] RBP: 00007eff4fa3506b R08: 0000200000000000 R09: 0000000000000000 [ 412.551079][T16344] R10: 00000000fffffd00 R11: 0000000000000246 R12: 0000000000000000 [ 412.551092][T16344] R13: 00007eff4fc26038 R14: 00007eff4fc25fa0 R15: 00007ffd6fb06df8 [ 412.551121][T16344] [ 412.605245][ T31] audit: type=1800 audit(1789570846.797:2906): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15377 res=0 errno=0 [ 412.636085][ T31] audit: type=1400 audit(1789570846.827:2907): avc: denied { write } for pid=16313 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 412.854916][T15882] Bluetooth: hci6: command 0xfc00 tx timeout [ 412.860748][ T52] Bluetooth: hci6: Reading QCA version information failed (-110) [ 412.860820][ T52] Bluetooth: hci6: Retry BT power ON:0 [ 413.006783][ T31] audit: type=1800 audit(1789570847.197:2908): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15131 res=0 errno=0 [ 413.075794][ T31] audit: type=1400 audit(1789570847.267:2909): avc: denied { write } for pid=16356 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 ü[ 413.264139][ T31] audit: type=1800 audit(1789570847.457:2910): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15131 res=0 errno=0 [ 413.516463][ T31] audit: type=1800 audit(1789570847.707:2911): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15131 res=0 errno=0 [ 413.552537][ T31] audit: type=1400 audit(1789570847.747:2912): avc: denied { ioctl } for pid=16376 comm="syz.9.3835" path="socket:[65611]" dev="sockfs" ino=65611 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 413.679909][T16380] Bluetooth: ISO socket layer initialized [ 413.882775][ T31] audit: type=1400 audit(1789570848.077:2913): avc: denied { write } for pid=16362 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 413.890456][ T31] audit: type=1800 audit(1789570848.077:2914): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15377 res=0 errno=0 [ 414.290165][T16407] device-mapper: ioctl: Unable to rename non-existent device, to j [ 415.205090][T16442] FAULT_INJECTION: forcing a failure. [ 415.205090][T16442] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 415.205136][T16442] CPU: 0 UID: 0 PID: 16442 Comm: syz.2.3854 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 415.205169][T16442] Tainted: [L]=SOFTLOCKUP [ 415.205178][T16442] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 415.205192][T16442] Call Trace: [ 415.205200][T16442] [ 415.205210][T16442] dump_stack_lvl+0x100/0x190 [ 415.205249][T16442] should_fail_ex.cold+0x5/0xa Hü[ 415.205275][T16442] ? prepare_alloc_pages+0x16d/0x5b0 [ 415.205304][T16442] should_fail_alloc_page+0xeb/0x140 [ 415.205334][T16442] prepare_alloc_pages+0x1f0/0x5b0 [ 415.205366][T16442] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 415.205391][T16442] ? __asan_memset+0x23/0x50 [ 415.205414][T16442] ? folios_put_refs+0x58a/0xaa0 [ 415.205451][T16442] ? __lock_acquire+0x5c0/0x1f40 [ 415.205476][T16442] ? __css_rstat_updated+0x1ce/0x590 [ 415.205503][T16442] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 415.205537][T16442] ? rcu_is_watching+0x13/0xc0 [ 415.205564][T16442] ? __mod_memcg_lruvec_state+0x18c/0x5b0 [ 415.205591][T16442] ? find_held_lock+0x2b/0x80 [ 415.205627][T16442] ? __lock_acquire+0x5c0/0x1f40 [ 415.205650][T16442] ? rcu_is_watching+0x13/0xc0 [ 415.205676][T16442] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 415.205702][T16442] ? policy_nodemask+0xed/0x4f0 [ 415.205732][T16442] alloc_pages_mpol+0x201/0x550 [ 415.205761][T16442] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 415.205789][T16442] ? filemap_get_entry+0x22d/0x450 [ 415.205814][T16442] ? filemap_get_entry+0x22d/0x450 [ 415.205841][T16442] folio_alloc_noprof+0x22/0x250 [ 415.205876][T16442] filemap_alloc_folio_noprof.part.0+0x3db/0x440 [ 415.205915][T16442] ? __pfx_filemap_alloc_folio_noprof.part.0+0x10/0x10 [ 415.205944][T16442] ? rcu_is_watching+0x13/0xc0 [ 415.205975][T16442] ? trace_kmalloc+0xeb/0x110 [ 415.206007][T16442] __filemap_get_folio_mpol+0x653/0x1280 [ 415.206043][T16442] ioctx_alloc+0x7e1/0x21a0 [ 415.206080][T16442] ? __pfx_ioctx_alloc+0x10/0x10 [ 415.206112][T16442] __x64_sys_io_setup+0xc9/0x220 [ 415.206146][T16442] do_syscall_64+0x123/0x790 [ 415.206180][T16442] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 415.206205][T16442] RIP: 0033:0x7fc6a1b9e159 [ 415.206225][T16442] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 415.206247][T16442] RSP: 002b:00007fc6a29b9028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ce [ 415.206271][T16442] RAX: ffffffffffffffda RBX: 00007fc6a1e25fa0 RCX: 00007fc6a1b9e159 [ 415.206288][T16442] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 00000000000005ff [ 415.206303][T16442] RBP: 00007fc6a1c3506b R08: 0000000000000000 R09: 0000000000000000 [ 415.206319][T16442] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 415.206333][T16442] R13: 00007fc6a1e26038 R14: 00007fc6a1e25fa0 R15: 00007fff5c9d9568 [ 415.206366][T16442] [ 415.244707][T15882] Bluetooth: hci6: command 0xfc00 tx timeout [ 415.244777][ T52] Bluetooth: hci6: Reading QCA version information failed (-110) [ 415.244794][ T52] Bluetooth: hci6: Retry BT power ON:1 ü[ 415.719450][T16451] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3857'. [ 416.046799][T16429] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3852'. [ 416.373571][ T7736] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 416.529009][ T7736] usb 1-1: unable to get BOS descriptor or descriptor too short [ 416.529056][ T7736] usb 1-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 416.530006][ T7736] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 416.564796][ T7736] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 416.564835][ T7736] usb 1-1: Product: syz [ 416.564852][ T7736] usb 1-1: Manufacturer: syz [ 416.564867][ T7736] usb 1-1: SerialNumber: syz [ 416.868094][ T7736] usb 1-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 417.473483][T16513] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 417.479394][ T31] kauditd_printk_skb: 29 callbacks suppressed [ 417.479413][ T31] audit: type=1800 audit(1789570851.667:2944): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15131 res=0 errno=0 Hü[ 417.632214][T15882] Bluetooth: hci6: command 0xfc00 tx timeout [ 417.632289][ T52] Bluetooth: hci6: Reading QCA version information failed (-110) [ 417.632306][ T52] Bluetooth: hci6: Retry BT power ON:2 [ 417.668218][ T7736] usb 1-1: failed to enable PITCH for EP 0x82 [ 417.668658][ T7736] usb 1-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 417.668683][ T7736] usb 1-1: clock source 0 is not valid, cannot use [ 417.669066][ T7736] usb 1-1: 2:1: cannot get freq (v2/v3): err -71 [ 417.669572][ T7736] usb 1-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 417.792112][ T31] audit: type=1800 audit(1789570851.987:2945): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="manufacturer" dev="sysfs" ino=235198 res=0 errno=0 [ 417.793199][ T31] audit: type=1800 audit(1789570851.987:2946): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="product" dev="sysfs" ino=235199 res=0 errno=0 [ 417.793684][ T7736] usb 1-1: USB disconnect, device number 51 [ 417.934992][ T31] audit: type=1800 audit(1789570852.127:2947): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15131 res=0 errno=0 ü[ 417.941089][T16523] virtio_blk virtio3: 1/0/0 default/read/poll queues [ 417.946443][T16523] virtio_blk virtio3: [vda] 262144 512-byte logical blocks (134 MB/128 MiB) [ 418.020612][ T31] audit: type=1800 audit(1789570852.207:2948): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=235442 res=0 errno=0 [ 418.054678][ T31] audit: type=1800 audit(1789570852.247:2949): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=235586 res=0 errno=0 [ 418.092081][ T31] audit: type=1800 audit(1789570852.287:2950): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=235455 res=0 errno=0 [ 418.134576][ T31] audit: type=1800 audit(1789570852.327:2951): pid=5590 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=235473 res=0 errno=0 [ 418.175760][ T31] audit: type=1800 audit(1789570852.367:2952): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="bcdDevice" dev="sysfs" ino=235178 res=0 errno=0 [ 418.276951][ T31] audit: type=1800 audit(1789570852.467:2953): pid=5590 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="serial" dev="sysfs" ino=235508 res=0 errno=0 [ 418.362236][T16531] udevd[16531]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 418.768116][T16541] team0: Port device team_slave_0 removed [ 418.796677][T16541] team0: Port device team_slave_1 removed [ 418.799278][T16541] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 418.799301][T16541] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 418.837881][T16541] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 418.837910][T16541] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 418.860192][T16541] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 419.005154][T16543] team0: Mode changed to "loadbalance" [ 419.195814][T16552] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3883'. [ 419.653986][T16566] FAULT_INJECTION: forcing a failure. [ 419.653986][T16566] name failslab, interval 1, probability 0, space 0, times 0 [ 419.654024][T16566] CPU: 1 UID: 0 PID: 16566 Comm: syz.4.3887 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 419.654054][T16566] Tainted: [L]=SOFTLOCKUP [ 419.654061][T16566] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 419.654075][T16566] Call Trace: [ 419.654082][T16566] [ 419.654090][T16566] dump_stack_lvl+0x100/0x190 [ 419.654128][T16566] should_fail_ex.cold+0x5/0xa [ 419.654157][T16566] should_failslab+0xc2/0x120 [ 419.654185][T16566] __kvmalloc_node_noprof+0x113/0x9b0 [ 419.654206][T16566] ? trace_contention_end+0x126/0x160 [ 419.654235][T16566] ? io_rsrc_data_alloc+0x2c/0xa0 [ 419.654268][T16566] io_rsrc_data_alloc+0x2c/0xa0 [ 419.654294][T16566] io_alloc_file_tables+0x27/0xb0 [ 419.654327][T16566] io_sqe_files_register+0x186/0x970 [ 419.654357][T16566] ? __pfx_io_sqe_files_register+0x10/0x10 [ 419.654397][T16566] __do_sys_io_uring_register+0xf69/0x1bc0 [ 419.654441][T16566] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 419.654470][T16566] ? __pfx___do_sys_io_uring_register+0x10/0x10 [ 419.654502][T16566] ? __x64_sys_futex+0x34f/0x4d0 [ 419.654531][T16566] ? __x64_sys_futex+0x358/0x4d0 [ 419.654562][T16566] ? xfd_validate_state+0x129/0x190 [ 419.654594][T16566] do_syscall_64+0x123/0x790 [ 419.654621][T16566] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 419.654642][T16566] RIP: 0033:0x7f62bed9e159 [ 419.654661][T16566] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 419.654679][T16566] RSP: 002b:00007f62bfcb0028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab [ 419.654699][T16566] RAX: ffffffffffffffda RBX: 00007f62bf025fa0 RCX: 00007f62bed9e159 [ 419.654714][T16566] RDX: 0000200000002d40 RSI: 0000000000000002 RDI: 0000000000000003 [ 419.654728][T16566] RBP: 00007f62bee3506b R08: 0000000000000000 R09: 0000000000000000 [ 419.654745][T16566] R10: 0000000000000020 R11: 0000000000000246 R12: 0000000000000000 [ 419.654758][T16566] R13: 00007f62bf026038 R14: 00007f62bf025fa0 R15: 00007ffea6aa0c68 [ 419.654787][T16566] [ 420.031461][T16483] Bluetooth: hci6: command 0xfc00 tx timeout [ 420.031993][ T52] Bluetooth: hci6: Reading QCA version information failed (-110) [ 421.791696][ T7736] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 421.942736][ T7736] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 421.943630][ T7736] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 421.943676][ T7736] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 421.943701][ T7736] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 421.945063][ T7736] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 421.945089][ T7736] usb 1-1: Product: syz [ 421.945103][ T7736] usb 1-1: Manufacturer: syz [ 421.949135][T16621] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 422.021122][ T7736] garmin_gps 1-1:1.0: Garmin GPS usb/tty converter detected [ 422.022580][ T5712] usb 10-1: new high-speed USB device number 7 using dummy_hcd [ 422.045092][ T7736] usb 1-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 422.197498][ T5712] usb 10-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 422.212154][ T5712] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 422.212202][ T5712] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 422.249453][ T25] usb 1-1: USB disconnect, device number 52 [ 422.316121][ T5712] as10x_usb: device has been detected [ 422.316811][ T5712] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 422.355445][ T25] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 422.355951][ T25] garmin_gps 1-1:1.0: device disconnected [ 422.408353][ T5712] usb 10-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 422.551995][ T31] kauditd_printk_skb: 37 callbacks suppressed [ 422.552016][ T31] audit: type=1400 audit(1789570856.737:2991): avc: denied { firmware_load } for pid=5712 comm="kworker/0:4" path="/lib/firmware/as102_data1_st.hex" dev="sda1" ino=297 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 422.559258][ T5712] as10x_usb: error during firmware upload part1 [ 422.559806][ T5712] Registered device Abilis Systems DVB-Titan [ 422.941713][ T31] audit: type=1400 audit(1789570857.127:2992): avc: denied { write } for pid=16643 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 423.039463][ T31] audit: type=1400 audit(1789570857.227:2993): avc: denied { append } for pid=16655 comm="syz.0.3904" name="ppp" dev="devtmpfs" ino=708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 423.285415][ T31] audit: type=1400 audit(1789570857.477:2994): avc: denied { write } for pid=16661 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 423.689349][T16673] gre2: entered allmulticast mode [ 423.833681][ T31] audit: type=1800 audit(1789570858.027:2995): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15377 res=0 errno=0 [ 423.981398][ T5787] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 424.150341][ T31] audit: type=1800 audit(1789570858.337:2996): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15377 res=0 errno=0 [ 424.156090][ T5787] usb 1-1: New USB device found, idVendor=056e, idProduct=010d, bcdDevice= 0.00 [ 424.158452][ T5787] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 424.158501][ T5787] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 424.161037][ T5787] usb 1-1: config 0 descriptor?? [ 424.181115][ T31] audit: type=1800 audit(1789570858.357:2997): pid=5590 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=237254 res=0 errno=0 [ 424.181160][ T31] audit: type=1800 audit(1789570858.357:2998): pid=5590 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="descriptors" dev="sysfs" ino=237283 res=0 errno=0 [ 424.181197][ T31] audit: type=1400 audit(1789570858.367:2999): avc: denied { write } for pid=16668 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 424.209907][ T31] audit: type=1800 audit(1789570858.397:3000): pid=5590 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="idVendor" dev="sysfs" ino=237261 res=0 errno=0 [ 424.214048][ T5787] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 424.284338][ T5787] usb 10-1: USB disconnect, device number 7 [ 424.731373][ T5787] Unregistered device Abilis Systems DVB-Titan [ 424.737280][ T5787] as10x_usb: device has been disconnected [ 424.905985][ T5334] usb 1-1: USB disconnect, device number 53 [ 425.094412][ T7736] usb 8-1: new high-speed USB device number 18 using dummy_hcd [ 425.243789][ T7736] usb 8-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 425.246202][ T7736] usb 8-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 425.246236][ T7736] usb 8-1: config 1 interface 0 altsetting 127 bulk endpoint 0x2 has invalid maxpacket 32 [ 425.246258][ T7736] usb 8-1: config 1 interface 0 has no altsetting 0 [ 425.295954][ T7736] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 425.295980][ T7736] usb 8-1: Product: syz [ 425.295993][ T7736] usb 8-1: Manufacturer: syz [ 425.296007][ T7736] usb 8-1: SerialNumber: syz [ 425.299926][T16708] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 425.300046][T16708] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 426.521206][ T7736] rtl8150 8-1:1.0: eth5: rtl8150 is detected [ 426.524747][T16761] tipc: Started in network mode [ 426.524774][T16761] tipc: Node identity 7f000001, cluster identity 4711 [ 426.525770][T16761] tipc: Enabled bearer , priority 10 [ 426.528838][T16761] tipc: Disabling bearer [ 426.587525][ T7736] usb 8-1: USB disconnect, device number 18 [ 426.650566][T16762] netlink: 'syz.9.3933': attribute type 4 has an invalid length. [ 427.249140][T16780] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3940'. [ 427.331633][T16784] xt_hashlimit: size too large, truncated to 1048576 [ 427.718546][T16802] input: syz0 as /devices/virtual/input/input53 [ 427.730778][ T31] kauditd_printk_skb: 90 callbacks suppressed [ 427.730795][ T31] audit: type=1800 audit(1789570861.917:3091): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=237679 res=0 errno=0 [ 427.748945][ T7725] usb 3-1: new full-speed USB device number 20 using dummy_hcd [ 427.780239][ T31] audit: type=1800 audit(1789570861.967:3092): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="ev" dev="sysfs" ino=237694 res=0 errno=0 [ 427.780287][ T31] audit: type=1800 audit(1789570861.967:3093): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="abs" dev="sysfs" ino=237697 res=0 errno=0 [ 427.793367][ T31] audit: type=1800 audit(1789570861.987:3094): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="rel" dev="sysfs" ino=237696 res=0 errno=0 [ 427.794260][ T31] audit: type=1800 audit(1789570861.987:3095): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="key" dev="sysfs" ino=237695 res=0 errno=0 [ 427.805155][ T31] audit: type=1800 audit(1789570861.997:3096): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="properties" dev="sysfs" ino=237686 res=0 errno=0 [ 427.819930][ T31] audit: type=1800 audit(1789570862.007:3097): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="bustype" dev="sysfs" ino=237689 res=0 errno=0 [ 427.834304][ T31] audit: type=1800 audit(1789570862.027:3098): pid=6646 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="name" dev="sysfs" ino=237682 res=0 errno=0 [ 427.886425][ T31] audit: type=1800 audit(1789570862.077:3099): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=237710 res=0 errno=0 [ 427.905842][ T7725] usb 3-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 427.907984][ T7725] usb 3-1: config 0 has an invalid interface number: 251 but max is 0 [ 427.908010][ T7725] usb 3-1: config 0 has no interface number 0 [ 427.917009][ T31] audit: type=1800 audit(1789570862.107:3100): pid=5590 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="phys" dev="sysfs" ino=237683 res=0 errno=0 [ 427.917136][ T7725] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 427.917159][ T7725] usb 3-1: Product: syz [ 427.917174][ T7725] usb 3-1: Manufacturer: syz [ 427.917190][ T7725] usb 3-1: SerialNumber: syz [ 427.924123][ T7725] usb 3-1: config 0 descriptor?? [ 428.641635][ T7725] asix 3-1:0.251 (unnamed net_device) (uninitialized): Interface mode not supported by driver [ 428.641865][ T7725] asix 3-1:0.251: probe with driver asix failed with error -524 [ 428.867016][ T5704] usb 3-1: USB disconnect, device number 20 [ 429.514255][ T43] bridge_slave_1: left allmulticast mode [ 429.514282][ T43] bridge_slave_1: left promiscuous mode [ 429.514477][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 429.524678][ T43] bridge_slave_0: left allmulticast mode [ 429.524707][ T43] bridge_slave_0: left promiscuous mode [ 429.524900][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 430.192485][ T52] Bluetooth: hci4: command 0x0c1a tx timeout [ 430.195894][ T988] Bluetooth: hci4: Opcode 0x0c1a failed: -110 [ 430.195922][ T988] Bluetooth: hci4: Error when powering off device on rfkill (-110) [ 430.398093][ T43] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 430.418217][T16852] netlink: 'syz.7.3965': attribute type 20 has an invalid length. [ 430.418239][T16852] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3965'. [ 430.453945][ T43] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 430.474874][ T43] bond0 (unregistering): Released all slaves [ 430.558596][T16852] netlink: 'syz.7.3965': attribute type 20 has an invalid length. [ 430.558618][T16852] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3965'. [ 430.858902][T16859] FAULT_INJECTION: forcing a failure. [ 430.858902][T16859] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 430.858943][T16859] CPU: 1 UID: 0 PID: 16859 Comm: syz.7.3969 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 430.858974][T16859] Tainted: [L]=SOFTLOCKUP [ 430.858982][T16859] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 430.858994][T16859] Call Trace: [ 430.859001][T16859] [ 430.859009][T16859] dump_stack_lvl+0x100/0x190 [ 430.859044][T16859] should_fail_ex.cold+0x5/0xa [ 430.859067][T16859] ? prepare_alloc_pages+0x16d/0x5b0 [ 430.859096][T16859] should_fail_alloc_page+0xeb/0x140 [ 430.859124][T16859] prepare_alloc_pages+0x1f0/0x5b0 [ 430.859154][T16859] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 430.859182][T16859] ? lock_acquire+0x1d1/0x380 [ 430.859204][T16859] ? folio_lock_anon_vma_read+0x348/0xe30 [ 430.859240][T16859] ? folio_lock_anon_vma_read+0x348/0xe30 [ 430.859271][T16859] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 430.859294][T16859] ? rcu_is_watching+0x13/0xc0 [ 430.859322][T16859] ? __up_read+0x333/0x980 [ 430.859347][T16859] ? __pfx___up_read+0x10/0x10 [ 430.859371][T16859] ? rmap_walk_anon+0x6f6/0x9a0 [ 430.859395][T16859] ? rmap_walk_anon+0x6f6/0x9a0 [ 430.859448][T16859] __folio_alloc_noprof+0x16/0x260 [ 430.859469][T16859] alloc_migration_target+0x1d7/0x6d0 [ 430.859500][T16859] migrate_pages_batch+0x5c4/0x4680 [ 430.859532][T16859] ? __pfx_alloc_migration_target+0x10/0x10 [ 430.859568][T16859] ? walk_pgd_range+0x11d1/0x1e00 [ 430.859590][T16859] ? __pfx_migrate_pages_batch+0x10/0x10 [ 430.859640][T16859] migrate_pages_sync+0x12c/0x880 [ 430.859671][T16859] ? __pfx_alloc_migration_target+0x10/0x10 [ 430.859701][T16859] ? vma_migratable+0x380/0x450 [ 430.859732][T16859] ? __pfx_migrate_pages_sync+0x10/0x10 [ 430.859759][T16859] ? __pfx_queue_pages_test_walk+0x10/0x10 [ 430.859794][T16859] ? walk_page_range_mm_unsafe+0x32c/0xa10 [ 430.859823][T16859] migrate_pages+0x1a83/0x2850 [ 430.859855][T16859] ? __pfx_alloc_migration_target+0x10/0x10 [ 430.859889][T16859] ? __pfx_migrate_pages+0x10/0x10 [ 430.859930][T16859] ? queue_pages_range+0x11e/0x180 [ 430.859957][T16859] ? rcu_is_watching+0x13/0xc0 [ 430.859989][T16859] ? __up_read+0x333/0x980 [ 430.860016][T16859] ? __pfx___up_read+0x10/0x10 [ 430.860039][T16859] ? do_migrate_pages+0x451/0x740 [ 430.860069][T16859] ? do_migrate_pages+0x451/0x740 [ 430.860101][T16859] do_migrate_pages+0x488/0x740 [ 430.860137][T16859] ? __pfx_do_migrate_pages+0x10/0x10 [ 430.860166][T16859] ? lock_acquire+0x1d1/0x380 [ 430.860190][T16859] ? rcu_is_watching+0x13/0xc0 [ 430.860216][T16859] ? cap_capable+0x107/0x430 [ 430.860246][T16859] ? get_task_mm+0xc2/0xf0 [ 430.860268][T16859] ? security_capable+0xbd/0x260 [ 430.860302][T16859] kernel_migrate_pages+0x560/0x700 [ 430.860331][T16859] ? __pfx_kernel_migrate_pages+0x10/0x10 [ 430.860357][T16859] ? xfd_validate_state+0x129/0x190 [ 430.860389][T16859] __x64_sys_migrate_pages+0x96/0x100 [ 430.860416][T16859] ? lockdep_hardirqs_on+0x7d/0x110 [ 430.860445][T16859] do_syscall_64+0x123/0x790 [ 430.860475][T16859] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 430.860496][T16859] RIP: 0033:0x7fd3ce79e159 [ 430.860515][T16859] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 430.860534][T16859] RSP: 002b:00007fd3cf69b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000100 [ 430.860556][T16859] RAX: ffffffffffffffda RBX: 00007fd3cea25fa0 RCX: 00007fd3ce79e159 [ 430.860571][T16859] RDX: 0000200000000040 RSI: 0000000000000003 RDI: 0000000000000000 [ 430.860585][T16859] RBP: 00007fd3ce83506b R08: 0000000000000000 R09: 0000000000000000 [ 430.860599][T16859] R10: 0000200000000300 R11: 0000000000000246 R12: 0000000000000000 [ 430.860614][T16859] R13: 00007fd3cea26038 R14: 00007fd3cea25fa0 R15: 00007ffd31882df8 [ 430.860644][T16859] [ 431.445615][T16874] netlink: 'syz.7.3974': attribute type 39 has an invalid length. [ 432.445307][T16913] syzkaller1: entered promiscuous mode [ 432.445323][T16913] syzkaller1: entered allmulticast mode [ 432.832008][ T988] Bluetooth: hci5: Opcode 0x0c1a failed: -110 [ 432.832033][ T988] Bluetooth: hci5: Error when powering off device on rfkill (-110) [ 432.841415][ C0] ------------[ cut here ]------------ [ 432.841430][ C0] workqueue: cannot queue hci_cmd_timeout on wq hci5 [ 432.841467][ C0] WARNING: kernel/workqueue.c:2352 at __queue_work+0xdb7/0x1370, CPU#0: syz-executor/15931 [ 432.850121][ T31] kauditd_printk_skb: 21 callbacks suppressed [ 432.850139][ T31] audit: type=1800 audit(1789570867.037:3122): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=15131 res=0 errno=0 [ 432.904672][ C0] Modules linked in: [ 432.908599][ C0] CPU: 0 UID: 0 PID: 15931 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(lazy) [ 432.919769][ C0] Tainted: [L]=SOFTLOCKUP [ 432.924119][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 432.934194][ C0] RIP: 0010:__queue_work+0xdbb/0x1370 [ 432.939591][ C0] Code: 00 00 00 fc ff df 49 8d 94 24 70 01 00 00 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 84 05 00 00 48 8d 3d 29 6a 77 0f 48 8b 75 18 <67> 48 0f b9 3a 48 b8 00 00 00 00 00 fc ff df 48 89 ea 48 c1 ea 03 [ 432.959206][ C0] RSP: 0018:ffffc90000007b68 EFLAGS: 00010046 [ 432.965276][ C0] RAX: dffffc0000000000 RBX: 0000000000000100 RCX: 1ffff1100af8294e [ 432.973266][ C0] RDX: ffff8880330c6170 RSI: ffffffff8ac30d30 RDI: ffffffff91481390 [ 432.981252][ C0] RBP: ffff888057c14a58 R08: 0000000000000007 R09: 0000000000000000 [ 432.989219][ C0] R10: 0000000000000100 R11: 0000000000000001 R12: ffff8880330c6000 [ 432.997188][ C0] R13: 1ffff92000000f77 R14: 0000000000000000 R15: ffffffff81d0af30 [ 433.005158][ C0] FS: 0000555562a95500(0000) GS:ffff888123b59000(0000) knlGS:0000000000000000 [ 433.014088][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 433.020675][ C0] CR2: 00007eff507556c8 CR3: 0000000075808000 CR4: 00000000003526f0 [ 433.028646][ C0] Call Trace: [ 433.031922][ C0] [ 433.034762][ C0] ? lock_acquire+0x1d1/0x380 [ 433.039443][ C0] ? call_timer_fn+0x11d/0x5f0 [ 433.044205][ C0] ? __pfx___queue_work+0x10/0x10 [ 433.049256][ C0] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 433.055082][ C0] call_timer_fn+0x198/0x5f0 [ 433.059686][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 433.064808][ C0] ? lock_acquire+0x1d1/0x380 [ 433.069512][ C0] ? __run_timers+0x560/0xb00 [ 433.074191][ C0] ? __run_timers+0x560/0xb00 [ 433.078881][ C0] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 433.084704][ C0] __run_timers+0x570/0xb00 [ 433.089229][ C0] ? __pfx___run_timers+0x10/0x10 [ 433.094275][ C0] ? clockevents_program_event+0x23e/0x820 [ 433.100110][ C0] ? lock_acquire+0x1d1/0x380 [ 433.104799][ C0] ? _raw_spin_lock_irq+0x45/0x50 [ 433.109835][ C0] run_timer_base+0x114/0x190 [ 433.114524][ C0] ? __pfx_run_timer_base+0x10/0x10 [ 433.119732][ C0] run_timer_softirq+0x1a/0x50 [ 433.124500][ C0] handle_softirqs+0x1e6/0x9d0 [ 433.129278][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 433.134565][ C0] ? _raw_spin_unlock+0x28/0x50 [ 433.139420][ C0] ? __hrtimer_rearm_deferred+0x9b/0x7b0 [ 433.145065][ C0] __irq_exit_rcu+0x16a/0x210 [ 433.149746][ C0] irq_exit_rcu+0x9/0x30 [ 433.154027][ C0] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 433.159689][ C0] [ 433.162612][ C0] [ 433.165554][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 433.171542][ C0] RIP: 0010:write_comp_data+0x47/0xa0 [ 433.176928][ C0] Code: 00 01 00 ff 74 1e f6 c4 01 74 68 a9 00 00 00 0f 75 61 f7 c2 00 00 00 f0 75 59 8b 87 3c 17 00 00 85 c0 74 4f 8b 87 10 17 00 00 <83> f8 03 75 44 48 8b 87 18 17 00 00 8b bf 14 17 00 00 48 8b 30 48 [ 433.196555][ C0] RSP: 0018:ffffc900055e74f0 EFLAGS: 00000246 [ 433.202621][ C0] RAX: 0000000000000000 RBX: ffffea00019537c0 RCX: ffffffff82641ad4 [ 433.210588][ C0] RDX: 0000000000000002 RSI: 0000000000000000 RDI: ffff888079decb00 [ 433.218578][ C0] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 [ 433.226565][ C0] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 [ 433.234527][ C0] R13: 000000000000c00b R14: ffff888072e4a6d0 R15: ffffea00019537c0 [ 433.242500][ C0] ? copy_page_range+0x1f14/0x57c0 [ 433.247627][ C0] copy_page_range+0x1f14/0x57c0 [ 433.252598][ C0] ? __pfx_copy_page_range+0x10/0x10 [ 433.257912][ C0] ? mas_wr_store_entry+0xa4/0x1d50 [ 433.263141][ C0] ? lock_acquire+0x1d1/0x380 [ 433.267831][ C0] ? dup_mmap+0xd0a/0x2370 [ 433.272257][ C0] ? find_held_lock+0x2b/0x80 [ 433.276943][ C0] ? dup_mmap+0xe66/0x2370 [ 433.281363][ C0] ? dup_mmap+0xe66/0x2370 [ 433.285782][ C0] ? down_write+0x146/0x1f0 [ 433.290294][ C0] ? up_write+0x2dc/0x5b0 [ 433.294627][ C0] dup_mmap+0x1230/0x2370 [ 433.298971][ C0] ? __pfx_dup_mmap+0x10/0x10 [ 433.303647][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 433.309459][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 433.315284][ C0] ? __lock_acquire+0x5c0/0x1f40 [ 433.320232][ C0] ? lock_acquire+0x1d1/0x380 [ 433.324903][ C0] ? copy_process+0x4806/0x8370 [ 433.329775][ C0] copy_process+0x4811/0x8370 [ 433.334464][ C0] ? __pfx_copy_process+0x10/0x10 [ 433.339506][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 433.344910][ C0] kernel_clone+0x176/0x9d0 [ 433.349425][ C0] ? __pfx_kernel_clone+0x10/0x10 [ 433.354459][ C0] ? __might_fault+0xc5/0x140 [ 433.359146][ C0] ? find_held_lock+0x2b/0x80 [ 433.363829][ C0] ? __might_fault+0xc5/0x140 [ 433.368533][ C0] __do_sys_clone+0xd9/0x120 [ 433.373127][ C0] ? __pfx___do_sys_clone+0x10/0x10 [ 433.378352][ C0] do_syscall_64+0x123/0x790 [ 433.382955][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 433.388862][ C0] RIP: 0033:0x7fc6a1bc6bd2 [ 433.393286][ C0] Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00 [ 433.412891][ C0] RSP: 002b:00007fff5c9d9780 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 433.421313][ C0] RAX: ffffffffffffffda RBX: 00007fff5c9d9780 RCX: 00007fc6a1bc6bd2 [ 433.429278][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 433.437239][ C0] RBP: 00007fff5c9d990c R08: 0000000000000000 R09: 0000000000000001 [ 433.445203][ C0] R10: 0000555562a957d0 R11: 0000000000000246 R12: 0000000000000001 [ 433.453165][ C0] R13: 00000000000927c0 R14: 000000000006995c R15: 00007fff5c9d9960 [ 433.461147][ C0] [ 433.464156][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 433.471430][ C0] CPU: 0 UID: 0 PID: 15931 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(lazy) [ 433.482546][ C0] Tainted: [L]=SOFTLOCKUP [ 433.486953][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 433.496999][ C0] Call Trace: [ 433.500271][ C0] [ 433.503107][ C0] dump_stack_lvl+0x100/0x190 [ 433.507801][ C0] vpanic+0x553/0x970 [ 433.511781][ C0] ? __pfx_vpanic+0x10/0x10 [ 433.516288][ C0] panic+0xd1/0xe0 [ 433.520006][ C0] ? __pfx_panic+0x10/0x10 [ 433.524429][ C0] check_panic_on_warn.cold+0x19/0x34 [ 433.529806][ C0] ? __queue_work+0xdb7/0x1370 [ 433.534581][ C0] __warn.cold+0x191/0x318 [ 433.539002][ C0] __report_bug+0x30f/0x440 [ 433.543529][ C0] ? __queue_work+0xdb7/0x1370 [ 433.548312][ C0] ? __pfx___report_bug+0x10/0x10 [ 433.553340][ C0] ? __pfx_hci_cmd_timeout+0x10/0x10 [ 433.558633][ C0] ? do_raw_spin_unlock+0x145/0x1e0 [ 433.563834][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 433.569660][ C0] report_bug_entry+0xe2/0x290 [ 433.574438][ C0] ? __queue_work+0xdbb/0x1370 [ 433.579213][ C0] handle_bug+0x1cd/0x2a0 [ 433.583574][ C0] exc_invalid_op+0x17/0x50 [ 433.588086][ C0] asm_exc_invalid_op+0x1a/0x20 [ 433.592931][ C0] RIP: 0010:__queue_work+0xdbb/0x1370 [ 433.598311][ C0] Code: 00 00 00 fc ff df 49 8d 94 24 70 01 00 00 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 84 05 00 00 48 8d 3d 29 6a 77 0f 48 8b 75 18 <67> 48 0f b9 3a 48 b8 00 00 00 00 00 fc ff df 48 89 ea 48 c1 ea 03 [ 433.617916][ C0] RSP: 0018:ffffc90000007b68 EFLAGS: 00010046 [ 433.623992][ C0] RAX: dffffc0000000000 RBX: 0000000000000100 RCX: 1ffff1100af8294e [ 433.631954][ C0] RDX: ffff8880330c6170 RSI: ffffffff8ac30d30 RDI: ffffffff91481390 [ 433.639918][ C0] RBP: ffff888057c14a58 R08: 0000000000000007 R09: 0000000000000000 [ 433.647879][ C0] R10: 0000000000000100 R11: 0000000000000001 R12: ffff8880330c6000 [ 433.655843][ C0] R13: 1ffff92000000f77 R14: 0000000000000000 R15: ffffffff81d0af30 [ 433.663826][ C0] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 433.669657][ C0] ? __pfx_hci_cmd_timeout+0x10/0x10 [ 433.674945][ C0] ? __queue_work+0xd89/0x1370 [ 433.679719][ C0] ? lock_acquire+0x1d1/0x380 [ 433.684396][ C0] ? call_timer_fn+0x11d/0x5f0 [ 433.689161][ C0] ? __pfx___queue_work+0x10/0x10 [ 433.694214][ C0] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 433.700027][ C0] call_timer_fn+0x198/0x5f0 [ 433.704620][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 433.709728][ C0] ? lock_acquire+0x1d1/0x380 [ 433.714409][ C0] ? __run_timers+0x560/0xb00 [ 433.719083][ C0] ? __run_timers+0x560/0xb00 [ 433.723762][ C0] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 433.729577][ C0] __run_timers+0x570/0xb00 [ 433.734088][ C0] ? __pfx___run_timers+0x10/0x10 [ 433.739195][ C0] ? clockevents_program_event+0x23e/0x820 [ 433.745015][ C0] ? lock_acquire+0x1d1/0x380 [ 433.749701][ C0] ? _raw_spin_lock_irq+0x45/0x50 [ 433.754732][ C0] run_timer_base+0x114/0x190 [ 433.759415][ C0] ? __pfx_run_timer_base+0x10/0x10 [ 433.764618][ C0] run_timer_softirq+0x1a/0x50 [ 433.769385][ C0] handle_softirqs+0x1e6/0x9d0 [ 433.774154][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 433.779459][ C0] ? _raw_spin_unlock+0x28/0x50 [ 433.784318][ C0] ? __hrtimer_rearm_deferred+0x9b/0x7b0 [ 433.789968][ C0] __irq_exit_rcu+0x16a/0x210 [ 433.794654][ C0] irq_exit_rcu+0x9/0x30 [ 433.798899][ C0] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 433.804540][ C0] [ 433.807464][ C0] [ 433.810407][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 433.816389][ C0] RIP: 0010:write_comp_data+0x47/0xa0 [ 433.821760][ C0] Code: 00 01 00 ff 74 1e f6 c4 01 74 68 a9 00 00 00 0f 75 61 f7 c2 00 00 00 f0 75 59 8b 87 3c 17 00 00 85 c0 74 4f 8b 87 10 17 00 00 <83> f8 03 75 44 48 8b 87 18 17 00 00 8b bf 14 17 00 00 48 8b 30 48 [ 433.841365][ C0] RSP: 0018:ffffc900055e74f0 EFLAGS: 00000246 [ 433.847432][ C0] RAX: 0000000000000000 RBX: ffffea00019537c0 RCX: ffffffff82641ad4 [ 433.855432][ C0] RDX: 0000000000000002 RSI: 0000000000000000 RDI: ffff888079decb00 [ 433.863568][ C0] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 [ 433.871536][ C0] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 [ 433.879515][ C0] R13: 000000000000c00b R14: ffff888072e4a6d0 R15: ffffea00019537c0 [ 433.887498][ C0] ? copy_page_range+0x1f14/0x57c0 [ 433.892636][ C0] copy_page_range+0x1f14/0x57c0 [ 433.897614][ C0] ? __pfx_copy_page_range+0x10/0x10 [ 433.902906][ C0] ? mas_wr_store_entry+0xa4/0x1d50 [ 433.908144][ C0] ? lock_acquire+0x1d1/0x380 [ 433.912829][ C0] ? dup_mmap+0xd0a/0x2370 [ 433.917261][ C0] ? find_held_lock+0x2b/0x80 [ 433.921944][ C0] ? dup_mmap+0xe66/0x2370 [ 433.926362][ C0] ? dup_mmap+0xe66/0x2370 [ 433.930778][ C0] ? down_write+0x146/0x1f0 [ 433.935293][ C0] ? up_write+0x2dc/0x5b0 [ 433.939633][ C0] dup_mmap+0x1230/0x2370 [ 433.943984][ C0] ? __pfx_dup_mmap+0x10/0x10 [ 433.948669][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 433.954487][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 433.960323][ C0] ? __lock_acquire+0x5c0/0x1f40 [ 433.965294][ C0] ? lock_acquire+0x1d1/0x380 [ 433.969970][ C0] ? copy_process+0x4806/0x8370 [ 433.974850][ C0] copy_process+0x4811/0x8370 [ 433.979547][ C0] ? __pfx_copy_process+0x10/0x10 [ 433.984594][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 433.990002][ C0] kernel_clone+0x176/0x9d0 [ 433.994515][ C0] ? __pfx_kernel_clone+0x10/0x10 [ 433.999554][ C0] ? __might_fault+0xc5/0x140 [ 434.004241][ C0] ? find_held_lock+0x2b/0x80 [ 434.008930][ C0] ? __might_fault+0xc5/0x140 [ 434.013639][ C0] __do_sys_clone+0xd9/0x120 [ 434.018237][ C0] ? __pfx___do_sys_clone+0x10/0x10 [ 434.023459][ C0] do_syscall_64+0x123/0x790 [ 434.028071][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 434.033987][ C0] RIP: 0033:0x7fc6a1bc6bd2 [ 434.038422][ C0] Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00 [ 434.058039][ C0] RSP: 002b:00007fff5c9d9780 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 434.066468][ C0] RAX: ffffffffffffffda RBX: 00007fff5c9d9780 RCX: 00007fc6a1bc6bd2 [ 434.074439][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 434.082407][ C0] RBP: 00007fff5c9d990c R08: 0000000000000000 R09: 0000000000000001 [ 434.090379][ C0] R10: 0000555562a957d0 R11: 0000000000000246 R12: 0000000000000001 [ 434.098390][ C0] R13: 00000000000927c0 R14: 000000000006995c R15: 00007fff5c9d9960 [ 434.106390][ C0] [ 434.109692][ C0] Kernel Offset: disabled [ 434.114046][ C0] Rebooting in 86400 seconds..