last executing test programs: 13.043312122s ago: executing program 4 (id=383): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_X86_SET_MCE(r2, 0x4040ae9e, &(0x7f0000000240)={0x0, 0x8000000, 0xffffffff, 0x7, 0x20}) 12.797136298s ago: executing program 4 (id=385): setreuid(0xee01, 0xee01) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000280)={0xa, 0x4e22, 0x9, @loopback, 0x6}, 0x1c) socket$inet6(0xa, 0x80002, 0x0) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x4e, &(0x7f0000000000)=0x6, 0x4) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0xfe1d, @loopback={0xe0}, 0x9371}, 0x1c) stat(0x0, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20004000, &(0x7f0000000080)={0xa, 0x4e22, 0x40000000, @empty, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x23, @loopback, 0x23}, 0x1c) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000480)=[{&(0x7f0000000000)="580000001400192340835b80040d8c560a067fbc45ff620500000000070058000b480400945f640094272d7008070000000000000000008000f0fffeffe809000000ffd9dd00000010000100030808004149224e06040800", 0x58}], 0x1) 11.912804067s ago: executing program 4 (id=389): r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f00000000c0)={[{0x2b, 'pids'}]}, 0x6) 11.765276331s ago: executing program 4 (id=390): syz_mount_image$vfat(&(0x7f00000000c0), &(0x7f00000002c0)='./file0\x00', 0x2048c5, &(0x7f0000000300)={[{@fat=@fmask={'fmask', 0x3d, 0x7f}}, {@shortname_mixed}, {@fat=@time_offset={'time_offset', 0x3d, 0x48a}}, {@utf8no}, {@uni_xlate}, {@utf8}, {@utf8}, {@fat=@flush}, {@rodir}, {@numtail}, {@shortname_win95}, {@shortname_winnt}, {@shortname_win95}]}, 0x0, 0x2b2, &(0x7f0000002c80)="$eJzs3MFr024YwPFn7bZ2HVt7GD/4CeKDXvQStvoXFNlALChzFfUgZC7V0tiUpFYq4nbz6t8xPHpSUP+BXbx5Fy9DELzsIEbWJlvXRVenM936/cDIu/fJk7zhTcaTwN7Nm88fVMueUTYbkkirJETWZEskt90KjATbRLs9Lt3W5MLk1w+nr9+6faVQLM4vqi4Uli7mVXX6zJtHT16cfdeYvPFy+nVKNnJ3Nr/kP278t/H/5vel8OiOiKnLjtMwl21LVype1VC9ZlumZ2ml5lluQ011w3jZdur1lpq1lalM3bU8T81aS6tWSxuONtyWmvfMSk0Nw9CpjAyb5G9nlNYXF83CkQwGcZiI6nTdgpmMDJbW/8WgAADAYImr/r9f8bTiac3Zru9/Uf8npDt+QP0vMtT1/2HVfx6KrCdxvGzX/5ng+d2L+h8AAAAAAAAAAAAAAAAAAAAAgONgy/ezvu9nw234kxKRtIiEv8c9ThwN5n+4df3jXlrEftYsNUudbSdeKEtFbLFkdkzkW/t+CHTaC5eL87PalpO39mqQv9osJSUV5ody0flznXztzl+VMcl0nz8vWZmJzs9H5DdL43L+nJ8KzmyJIVl5f1ccsWWlfV/v5j+dU710tdiTP9HeDwAAAACAk8DQHfve39txQ8NlQ3rinc7d7wOSPeD7QM/79aicGo3vugEAAAAAGCbeuFRN27Zcr/X4pDfCxWz/ygFF4r6cdL87j4pI0PNqUOain0ZCRHpDY/t6ohvJP5vlzyJ7n4uZ2Kf70A0/uXOvfnrYeQL6SY/zrxIAAACAoxAW/SNxDwQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgCHW7ypi4f6HWYSs63TJeK4SAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAw/AgAA//9crBNs") r0 = syz_open_procfs(0x0, &(0x7f0000000540)='mounts\x00') mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000500)='./file0\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1333404, 0x0) mount$bind(&(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='./file0/file0\x00', 0x0, 0x13481, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1005848, 0x0) read$FUSE(r0, &(0x7f0000000840)={0x2020}, 0x2020) 11.441231768s ago: executing program 4 (id=396): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x440, 0x0) timer_create(0x7, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000001100)=0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') socket$inet6_tcp(0xa, 0x1, 0x0) read$FUSE(r3, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) preadv(r1, &(0x7f0000001040)=[{&(0x7f0000000040)=""/4096, 0x1000}], 0x1, 0x6, 0x0) 10.959965589s ago: executing program 4 (id=397): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendto$packet(r1, &(0x7f00000002c0)="05031c00d1fd140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) 10.918161979s ago: executing program 32 (id=397): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendto$packet(r1, &(0x7f00000002c0)="05031c00d1fd140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) 9.06095609s ago: executing program 3 (id=403): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0401273, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) 7.811759408s ago: executing program 3 (id=409): r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x9, 0x8, 0x0, 0xffffffffffffffff, 0x2}, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffe) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x129942, 0x18) syz_clone(0x28280000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) fcntl$setlease(r1, 0x400, 0x1) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x400040, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/locks\x00', 0x0, 0x0) pread64(r2, 0x0, 0x0, 0x1) r3 = socket$unix(0x1, 0x2, 0x0) r4 = socket$unix(0x1, 0x2, 0x0) connect$unix(r3, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r5 = dup(r3) mount$9p_fd(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESDEC=r4, @ANYBLOB=',wfdno=', @ANYRESHEX=r5]) 6.508699246s ago: executing program 3 (id=415): r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) pipe2(&(0x7f00000000c0)={0xffffffffffffffff}, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, 0x0, 0x0) write$binfmt_script(r5, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r5, 0x0) preadv(r5, &(0x7f00000015c0)=[{0x0}], 0x1, 0x8, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x2, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) 5.616365666s ago: executing program 3 (id=418): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0401273, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) 4.726019016s ago: executing program 3 (id=421): syz_usb_connect$uac2(0x5, 0xa6, &(0x7f0000000040)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x40, 0x4fa, 0x4201, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x94, 0x3, 0x1, 0x7, 0x60, 0xb, {0x8, 0xb, 0x1, 0x1, 0x1, 0xff, 0x20, 0x5}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x8001, 0xb, 0x15, 0x7}, [@output_terminal={0xc, 0x24, 0x3, 0x5, 0x301, 0x5d, 0x2, 0x0, 0x8b, 0x3}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x0, 0x3e}, @as_header={0x10, 0x24, 0x1, 0x5, 0x1, 0x3, 0x3, 0x3, 0x9, 0xcd}]}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0x24, 0x2, 0xd, {0x8, 0x25, 0x1, 0x81, 0xc, 0x2, 0xfffe}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x8, 0x3, 0xb}]}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x4, 0x10, 0xfc, {0x8, 0x25, 0x1, 0x82, 0xc, 0x4, 0x7}}}}}}}}]}}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0}) 2.609878402s ago: executing program 3 (id=433): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000001200)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x14, 0x6, 0x1, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20040014, &(0x7f0000000280)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) r2 = syz_usb_connect$cdc_ncm(0x2, 0x76, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902640002010000000904010001020d0000052406000105240000000d240f0100000000000000000006241a00000008241c0000000800090581030002000000"], 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000003540)={@local, @multicast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "ff00f5", 0x14, 0x6, 0x0, @dev={0xfe, 0x80, '\x00', 0x34}, @local, {[], {{0x2, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc2, 0xffff}}}}}}}, 0x0) 1.074932156s ago: executing program 1 (id=458): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0x7fffe, {0x0, 0x0, 0x0, r4, {0x0, 0x2}, {0xb, 0xb}, {0x0, 0x1}}, [@qdisc_kind_options=@q_codel={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x404c800}, 0x400c000) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r2, &(0x7f00000002c0)="05031620d3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @multicast}, 0x14) 997.703458ms ago: executing program 1 (id=464): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='freezer.self_freezing\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_int(r1, 0x29, 0x7, 0x0, 0x0) 948.270699ms ago: executing program 1 (id=466): socket$packet(0x11, 0x2, 0x300) r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3f9, 0x8, 0x70bd25, 0x25dfdbfc}, 0x10}}, 0x40000) 931.911879ms ago: executing program 1 (id=468): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = dup(r0) setsockopt$bt_BT_SECURITY(r1, 0x112, 0x4, 0x0, 0x0) 911.064319ms ago: executing program 2 (id=470): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_GET_EXTENDED_ERROR(r0, 0xc00c6211, &(0x7f0000000000)) 839.866721ms ago: executing program 5 (id=472): r0 = syz_open_dev$loop(&(0x7f0000000000), 0x1, 0x20) ioctl$BLKREPORTZONE(r0, 0xc0101282, 0x0) 839.750831ms ago: executing program 1 (id=473): r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000440)={[0x3ff, 0x2, 0x3, 0x7fffffffffffffff, 0x58f24867, 0x0, 0x7f, 0x80000002, 0x9, 0x0, 0x6, 0x1, 0x2, 0x4, 0x8, 0x1], 0x54000, 0x100204}) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4400ae8f, &(0x7f0000000140)=@x86={0x1, 0xc, 0x6, 0x0, 0xffffffaf, 0x9, 0x5, 0x40, 0x8, 0x4, 0x2, 0x87, 0x0, 0xffff, 0x649, 0x4, 0xb, 0x9, 0x7, '\x00', 0x5, 0x6}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 839.717591ms ago: executing program 2 (id=474): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_GET(r0, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) 832.748881ms ago: executing program 2 (id=475): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newtfilter={0x438, 0x11, 0x1, 0x0, 0x0, {0x0, 0x0, 0x74, 0x0, {0x3}, {0x1}, {0x10, 0x13}}, [@filter_kind_options=@f_bpf={{0x8}, {0x40c, 0x2, [@TCA_BPF_POLICE={0x408, 0x2, [@TCA_POLICE_RATE={0x404, 0x2, [0x7fff, 0xff, 0x2, 0x1, 0xe, 0x7, 0x7, 0x68b5ee50, 0xfc, 0x1, 0x36, 0x6, 0x4, 0x2, 0x100, 0x81, 0xb00a, 0x3, 0x0, 0xfff, 0xd084, 0x6, 0xbb2, 0x1, 0x0, 0xd6, 0x5, 0x9, 0x7, 0x1a65, 0x6, 0x400, 0x3, 0x900000, 0x81, 0x7, 0x1000, 0x3, 0x1000, 0x100, 0x3, 0xff800000, 0xd, 0x6, 0xcb, 0x101, 0x1, 0xf7dc, 0x1000, 0x80000000, 0x3, 0x2, 0x7587, 0xff, 0x80000001, 0x6, 0x1, 0x1, 0x9, 0x8, 0x2, 0xa2f, 0x6, 0x3, 0x7ab29300, 0x0, 0xfffffff9, 0x5, 0x2, 0x8, 0xffff920d, 0xcb2, 0x8c, 0x5, 0x78b, 0x3, 0x3edb, 0x7fffffff, 0x9, 0x0, 0x4, 0x0, 0xa59e, 0xde, 0x3fd, 0x81, 0xb, 0x6, 0x6, 0x100000, 0x3, 0xf7b, 0x9, 0xffffffff, 0x8000, 0x40, 0xfffffffc, 0x5, 0x40, 0x0, 0xffff9789, 0xfffffff5, 0x3, 0x800, 0x6, 0x1, 0x5, 0xffffffe5, 0x9, 0x45a, 0xffff0000, 0x5, 0xe, 0x80000001, 0x81, 0xe, 0x3b, 0x16, 0xffffffff, 0x800, 0xfe, 0x7, 0xffffffff, 0x3, 0x1, 0x3, 0x5cf, 0x7, 0x1, 0x0, 0x80000000, 0x8, 0x9, 0x4, 0x3, 0xdea9, 0x8, 0x7, 0x4, 0x5, 0x6, 0xfffffff8, 0x2400, 0x8000, 0x2, 0xfb, 0x4, 0xb0d, 0x7, 0x1, 0xeb, 0x42d, 0x800, 0x3, 0x6, 0x4, 0x2, 0x5, 0x1, 0x9, 0x3, 0x4, 0xea, 0x8, 0x5, 0x0, 0x7, 0x1, 0x800, 0x405d, 0x60, 0xfffffbff, 0xb, 0x4, 0x1, 0x6, 0xff, 0x6466, 0x7, 0x9, 0x8, 0xfffeffff, 0xa, 0x4, 0x0, 0x6, 0x7, 0x9, 0x8, 0x0, 0xfffffffb, 0x37, 0x10000, 0x7, 0xfffffe00, 0x3, 0xfffffffa, 0x2, 0xf0e4, 0xdcff, 0x7, 0x8, 0x8, 0x3, 0x8000000, 0x3, 0xfffffffe, 0x2, 0x1, 0x9, 0xe, 0x1, 0x80000000, 0x3, 0xc35, 0x1, 0x5, 0x7fff, 0x4, 0x5, 0xc, 0x7, 0x2, 0x6, 0x9, 0x800, 0x8, 0xfffffff9, 0x88, 0x4, 0xfffffffe, 0x8, 0x4, 0x9, 0x4, 0x0, 0x80000000, 0x0, 0x0, 0xff, 0x4, 0xfffffff5, 0x4, 0x8000, 0xe1, 0x10001, 0xfff, 0x0, 0x6, 0x6, 0x10, 0x4, 0x400, 0x6, 0x4, 0x6e]}]}]}}]}, 0x438}, 0x1, 0xf0ffffffffffff, 0x0, 0x40080c5}, 0x4004044) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x8924, &(0x7f00000002c0)={'batadv0\x00', @random="0100061f8145"}) 827.768192ms ago: executing program 5 (id=476): r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x1fffe, 0x40600) ioctl$EVIOCSREP(r0, 0x40084503, 0x0) 817.278872ms ago: executing program 2 (id=477): llistxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/102, 0x66) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'veth0_vlan\x00'}) connect$pppl2tp(0xffffffffffffffff, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCBRDELBR(r1, 0x89a2, &(0x7f0000000200)='bridge0\x00') 752.043083ms ago: executing program 5 (id=479): syz_clone(0xbc4040, 0x0, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) unshare(0x8040480) bpf$ITER_CREATE(0x21, 0x0, 0x0) 751.786594ms ago: executing program 1 (id=481): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text32={0x20, &(0x7f00000000c0)="f365670fafebc744240200050000e8442426000004000f0114240fa02cd8d8200000000f22d866ed64360f0866b85e000f1a9d67737c8fc978c3602c0ffe0c96c7442402c8000000c744f22406000000c744240000180000c7442402fa000000c7442406000000000f0114240114240f20d60f641f", 0x96}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 722.565504ms ago: executing program 2 (id=482): r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x0, 0x0) getdents64(r0, &(0x7f00000000c0)=""/185, 0xb9) getdents(r0, 0x0, 0x0) 619.982066ms ago: executing program 2 (id=484): sendmsg(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) r0 = syz_usb_connect$hid(0x4, 0x36, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r2 = openat$cgroup_procs(r1, &(0x7f0000000580)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000001c0), 0x12) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x0) write$cgroup_int(r3, &(0x7f0000000040)=0x8000000001cb, 0x12) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0x57e, 0x2019, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x1, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0xf49, 0xfb, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0xf8, 0x7d, 0xbb}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io(r4, &(0x7f00000003c0)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="000d5c000000280083efb930e61842562348d180df827ff0478fa22a61a5e30008000010fdff0000000000000e00"], 0x0, 0x0, 0x0, 0x0}, 0x0) 581.986037ms ago: executing program 0 (id=487): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'bond0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000740)=@newlink={0x4c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x215}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6}]}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8}]}, 0x4c}, 0x1, 0xba01}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x44b, 0x0, 0x0, {0x7a, 0x0, 0x0, r2}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_VLAN_FILTERING={0x5, 0x7, 0x7}]}}}]}, 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) 469.96587ms ago: executing program 0 (id=488): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0x7fffffffffffffff, 0x0, 0x1000, 0xc, 0x215}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r4) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r5) r6 = socket$unix(0x1, 0x5, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000004c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r9, {0x0, 0xd}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_FLOW_MAX_RATE={0x8, 0x7, 0x80000001}]}}]}, 0x38}}, 0x4890) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r10, {0x0, 0xb}, {0xffff, 0xffff}, {0xffff, 0xfffc}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0x7, 0x8005, 0x5, 0xfffffdff, 0x4006}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x9, 0x9, 0x5, 0x96, 0xfff, 0xc}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x240080c1}, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 373.379932ms ago: executing program 0 (id=489): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000240)={"cdcc57e116579e6fcfe159c6c0e4f3f11d5cc6b33635603ac61f211d6722dbf32fc6b0b0a920c6570dc310eca9ae44bb0e3475f2c2376cc3912444dce5fe9c616bd090aa866c3e74e7ef1e513de55b5ea0372dee5eae4cae48a1b8147b497b44ed6a601f978255b4ad54d2cbff9bd41f8f9c0298b42605e78c25d5a3c1685c87dcf878ef11a5fcaa419f5917f5b4ae5d5ea8c70eccb2747bff16aca555931fc73f3812dc018f2b314d1c7bc5f260c563cab761489385247f72d49257d436b307cde87a3c30819d4ff993a8d092a074fb2c0be97bc8614cf97597fd81ff8ee4007c3691d3f6028ccd5b506b4134069f856c61c33d994462a3758b6e0068ba2497934d31135de709c290bf2b0eb15f197ccb9a2860b8add0dbd1fb179102750fec29a70a07c22cc71a69177187c39d6742404623061a6d3f3c66e2df9a0a6eb051991a3dbec59e5449f7c4e6c47ac238efb9e2eaad3231f58984ea47e1446a541bd791b00b0b768f58da8d37135288a2034d4e0691b706b7bfe4e183ff4871bb24692f4c868e721b70a490ea4492cab81dd15fad0ccf6781c7490002c0e0cd0b1637872aba91e63e7a93f95d41fad89bcb83d199a40e989394e98306f471fda7a687026b4978b9f74666cf5caeb7e88bf09bfbcfa8393108ea724f7949345e3519fcf50d33688a55d35e400cc0bbc27db6233308279837c76d2f7efc579a9e281d10febce294b6d5b301db210cf745d163b58a4ce49be8e8109b5088c1003ee774f02e96a8e96519748aea2b2879be786833adf1d11d87b45eb2e9aad3910196b3b10850852740899d9f830149f5b4b12ac3d6d9521c029bf413125c2f9be40005bc11c30005d1a1c56adeb008c5385b72779d44e7416bb05578fcaa9e352e7cd1cafdfeb0b17d5ec482f5ce2dad8d2cca59df210ebefb36ad95e86dcf432f2c24ed620a33780edc69b668523fa63b2bac4d65768868de94871b4c0dd98a761d8936e3f13126644d41e9bc4f0590461c36438a9b1f707da0846b3b731d17136f68e914ebe04d36db4989cc666efde3bb93c1c404dae6dd0554e90be66153db89bdef360f09b6c369158aaa44eeb76002f3d471475067b93648889333f643ab4d9f4b2fc77d663837e1a444201b617539137fd9aa5f0a365e8e0b886c2bb65ebef59fc481e8d4aa5510af1e2bdfd9308702157445eaca8ae3ff290e8369031a4b4577f4ea363926c52cb33f200d8eb461cca0e5727caed5ac72c08270b37ed524851981a4061308861a6ce9836e3b9d70bc17ed04191ef1bac4a7628fd99c5ddec6e4979ee6ac13442d717cade8927c1fe606d80f3c656e976053fe4a97a9fa57033dfe7081fef7366f14526060612d7a6ad73c75a937dd2431226cbc98774c6b86668f1029918cee4414558006e8cf3141c89621bb47cefd25498c8c473c09f9f3"}) r3 = dup(r2) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000100)=@arm64={0x44, 0x8, 0x7f, '\x00', 0xb}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 212.718955ms ago: executing program 0 (id=490): r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r1, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000000)={0x42}, 0x10) sendmsg$tipc(r2, &(0x7f00000008c0)={&(0x7f0000000600)=@name, 0x10, 0x0, 0x0, 0x0, 0x0, 0x81}, 0x80) 139.953487ms ago: executing program 0 (id=491): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x88840, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) syz_kvm_setup_cpu$x86(r2, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, 0x0}], 0x1, 0x3, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00000ce000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f0000000080)="66450fc7746e0a0fb51ef2ab400f79ac680080000066bba100ed0fc77310c4427d988c170500000074492e942e94fb70190c190c75a854ff048fa800b6c3f9", 0x3f}], 0x1, 0x39, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000003680)=@vmx={0x3, 0x0, 0x2080, {0x0, 0x0, {}, 0x0, 0x5}, {'\x00', "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008bc584c800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001f6f38740000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a4900"}}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 108.248717ms ago: executing program 5 (id=492): mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='veth0_to_team\x00', 0x10) 89.130548ms ago: executing program 0 (id=493): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffffdfc, {0x0, 0x0, 0x0, r4, {0xffff}, {0xffff, 0xffff}, {0x2, 0x8}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0xc, [0xc, 0x5, 0xd, 0x8b, 0xd, 0x82, 0x4, 0x2, 0xa, 0x7, 0x3, 0x7, 0x5, 0x4, 0x10, 0x4], 0x0, [0xb, 0x3, 0xad1c, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xc, 0x100], [0xfff1, 0x5, 0xffff, 0x4, 0x4, 0x8, 0x1, 0x9, 0x5, 0x2, 0x40c, 0x4, 0xfffc, 0x3, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffe00, {0x0, 0x0, 0x0, r6, {0x8}, {0xffff}, {0xfff2, 0xffe1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x5, [0xf, 0x5, 0x0, 0xf, 0x10, 0x2, 0x5, 0x2, 0xf, 0x6, 0x6, 0x1, 0x8, 0x4, 0x10, 0x4], 0x3, [0xb, 0x5, 0x7fff, 0x401, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x8000, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0x67bd, 0x5, 0xfffe, 0xfff5, 0x4, 0x8, 0x7, 0x9, 0x5, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x1, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000400)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r9, {0x4}, {0xffff, 0xffff}, {0x2, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) 15.93142ms ago: executing program 5 (id=494): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x2, @dev}, 0x2, 0x0, 0x2}}, 0x2e) close(r0) socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r0, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e22, @empty}, 0x2, 0x0, 0x8, 0x2}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, 0x0) 0s ago: executing program 5 (id=495): r0 = socket$inet6(0xa, 0x3, 0x7) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x3a, 0x23, 0x0, 0x0) kernel console output (not intermixed with test programs): rocess permissive=1 [ 19.554947][ T30] audit: type=1400 audit(1784549922.152:63): avc: denied { siginh } for pid=222 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.136' (ED25519) to the list of known hosts. [ 26.878415][ T30] audit: type=1400 audit(1784549929.592:64): avc: denied { mounton } for pid=276 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 26.879542][ T276] cgroup: Unknown subsys name 'net' [ 26.910222][ T30] audit: type=1400 audit(1784549929.592:65): avc: denied { mount } for pid=276 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.951697][ T30] audit: type=1400 audit(1784549929.632:66): avc: denied { unmount } for pid=276 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.951918][ T276] cgroup: Unknown subsys name 'devices' [ 27.100067][ T276] cgroup: Unknown subsys name 'hugetlb' [ 27.108782][ T276] cgroup: Unknown subsys name 'rlimit' [ 27.243914][ T30] audit: type=1400 audit(1784549929.952:67): avc: denied { setattr } for pid=276 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 27.286824][ T30] audit: type=1400 audit(1784549929.952:68): avc: denied { mounton } for pid=276 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 27.294554][ T278] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 27.340487][ T30] audit: type=1400 audit(1784549929.952:69): avc: denied { mount } for pid=276 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 27.393349][ T30] audit: type=1400 audit(1784549930.062:70): avc: denied { relabelto } for pid=278 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 27.436590][ T30] audit: type=1400 audit(1784549930.062:71): avc: denied { write } for pid=278 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 27.481365][ T30] audit: type=1400 audit(1784549930.192:72): avc: denied { read } for pid=276 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 27.524969][ T30] audit: type=1400 audit(1784549930.192:73): avc: denied { open } for pid=276 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 27.525016][ T276] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 28.154027][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.167952][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.180609][ T286] device bridge_slave_0 entered promiscuous mode [ 28.192323][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.204181][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.219368][ T285] device bridge_slave_0 entered promiscuous mode [ 28.234587][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.247079][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.268622][ T285] device bridge_slave_1 entered promiscuous mode [ 28.290857][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.300784][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.318918][ T286] device bridge_slave_1 entered promiscuous mode [ 28.412015][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.429500][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.442950][ T287] device bridge_slave_0 entered promiscuous mode [ 28.468543][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.478431][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.492123][ T287] device bridge_slave_1 entered promiscuous mode [ 28.549104][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.561518][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.575372][ T288] device bridge_slave_0 entered promiscuous mode [ 28.587705][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.597309][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.611782][ T288] device bridge_slave_1 entered promiscuous mode [ 28.676937][ T284] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.695762][ T284] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.706789][ T284] device bridge_slave_0 entered promiscuous mode [ 28.722339][ T284] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.732693][ T284] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.747393][ T284] device bridge_slave_1 entered promiscuous mode [ 28.852915][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.862110][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.870738][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.881752][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.894361][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.905896][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.915374][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.924563][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.936941][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.948379][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.958190][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.966341][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.047752][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.055192][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.062986][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.070509][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.091141][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.101096][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.111086][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.121086][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.131336][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.143115][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.160097][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.172600][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.190223][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 29.203232][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.239532][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 29.248430][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.262162][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 29.276828][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.288385][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.297568][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.308855][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 29.318724][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.333175][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.349194][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.365794][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 29.379828][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.402937][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.415964][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.433316][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 29.456787][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.471842][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.486072][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.522395][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 29.537417][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.578145][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 29.587731][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.602831][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 29.621961][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.641341][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 29.655360][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.673108][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 29.684274][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.697335][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 29.708062][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.719724][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.730340][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.745728][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 29.758773][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.769427][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.779611][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.806953][ T285] device veth0_vlan entered promiscuous mode [ 29.818496][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 29.827958][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.837814][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 29.849378][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.860312][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 29.872595][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.882022][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 29.895810][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 29.911459][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 29.926397][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 29.941090][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 29.954575][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 29.970869][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 29.979897][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.992020][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 30.001615][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 30.019428][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 30.029763][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 30.045565][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.058901][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.078604][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 30.089466][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 30.100292][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.108472][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.120275][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 30.132102][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 30.147327][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 30.158497][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 30.177479][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.196216][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.213706][ T286] device veth0_vlan entered promiscuous mode [ 30.231123][ T287] device veth0_vlan entered promiscuous mode [ 30.240670][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 30.248889][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 30.260690][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 30.269643][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 30.279111][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 30.293675][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 30.307464][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 30.329613][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 30.348272][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 30.367368][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.380536][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.399591][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 30.431285][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 30.445837][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 30.460806][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 30.486122][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 30.500802][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 30.516089][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 30.535092][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 30.549679][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 30.566956][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 30.593285][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 30.604621][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 30.632686][ T285] device veth1_macvtap entered promiscuous mode [ 30.643851][ T288] device veth0_vlan entered promiscuous mode [ 30.658565][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 30.671122][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 30.689125][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 30.700283][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 30.720007][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 30.749489][ T287] device veth1_macvtap entered promiscuous mode [ 30.766031][ T286] device veth1_macvtap entered promiscuous mode [ 30.778125][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 30.799250][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 30.825273][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 30.838575][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 30.855830][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 30.883949][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 30.906616][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 30.916707][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 30.931006][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 30.945160][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 30.972331][ T288] device veth1_macvtap entered promiscuous mode [ 30.988983][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 31.019762][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 31.043946][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 31.062312][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 31.078412][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 31.095563][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 31.113037][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 31.125831][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 31.143760][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 31.187261][ T285] request_module fs-gadgetfs succeeded, but still no fs? [ 31.207565][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 31.222178][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 31.235689][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 31.252090][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 31.267785][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 31.283597][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 31.305136][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 31.318296][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 31.352782][ T284] device veth0_vlan entered promiscuous mode [ 31.363208][ T310] loop4: detected capacity change from 0 to 512 [ 31.388082][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 31.418430][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 31.459951][ T321] mmap: syz.3.6 (321) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 31.474154][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 31.484053][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 31.525996][ T284] device veth1_macvtap entered promiscuous mode [ 31.574135][ T332] loop4: detected capacity change from 0 to 256 [ 31.597926][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 31.606493][ T334] loop3: detected capacity change from 0 to 512 [ 31.613865][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 31.625245][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 31.638288][ T332] ======================================================= [ 31.638288][ T332] WARNING: The mand mount option has been deprecated and [ 31.638288][ T332] and is ignored by this kernel. Remove the mand [ 31.638288][ T332] option from the mount to silence this warning. [ 31.638288][ T332] ======================================================= [ 31.698238][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 31.712938][ T334] EXT4-fs (loop3): Test dummy encryption mode enabled [ 31.722539][ T334] EXT4-fs (loop3): dax option not supported [ 31.735748][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 31.750523][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 31.761068][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 31.841543][ T346] Zero length message leads to an empty skb [ 32.280155][ T30] kauditd_printk_skb: 41 callbacks suppressed [ 32.280171][ T30] audit: type=1400 audit(1784549934.992:115): avc: denied { ioctl } for pid=360 comm="syz.3.21" path="socket:[15625]" dev="sockfs" ino=15625 ioctlcmd=0x54da scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 32.482294][ T30] audit: type=1400 audit(1784549935.152:116): avc: denied { name_bind } for pid=364 comm="syz.3.23" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 32.797056][ T30] audit: type=1400 audit(1784549935.152:117): avc: denied { node_bind } for pid=364 comm="syz.3.23" saddr=255.255.255.255 src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 32.908719][ T30] audit: type=1400 audit(1784549935.292:118): avc: denied { read } for pid=351 comm="syz.1.17" name="msr" dev="devtmpfs" ino=85 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 34.357099][ T30] audit: type=1400 audit(1784549935.292:119): avc: denied { open } for pid=351 comm="syz.1.17" path="/dev/cpu/0/msr" dev="devtmpfs" ino=85 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 34.472189][ T394] tipc: Started in network mode [ 34.478308][ T30] audit: type=1400 audit(1784549935.352:120): avc: denied { create } for pid=351 comm="syz.1.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 34.483376][ T394] tipc: Node identity 26d2de10eaf1, cluster identity 4711 [ 34.543669][ T30] audit: type=1400 audit(1784549935.692:121): avc: denied { create } for pid=375 comm="syz.0.29" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 34.601137][ T394] tipc: Enabled bearer , priority 0 [ 34.696786][ T387] tipc: Resetting bearer [ 34.706725][ T30] audit: type=1400 audit(1784549935.692:122): avc: denied { write } for pid=375 comm="syz.0.29" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 34.746357][ T387] tipc: Disabling bearer [ 34.789383][ T30] audit: type=1400 audit(1784549936.082:123): avc: denied { prog_load } for pid=373 comm="syz.3.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 34.818584][ T30] audit: type=1400 audit(1784549936.082:124): avc: denied { bpf } for pid=373 comm="syz.3.28" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 35.028034][ T289] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 35.268044][ T289] usb 1-1: Using ep0 maxpacket: 16 [ 35.337510][ T424] loop4: detected capacity change from 0 to 1024 [ 35.386543][ T427] loop3: detected capacity change from 0 to 16 [ 35.391420][ T424] EXT4-fs (loop4): mounted filesystem without journal. Opts: dioread_lock,noblock_validity,lazytime,noblock_validity,,errors=continue. Quota mode: none. [ 35.412266][ T427] erofs: (device loop3): mounted with root inode @ nid 36. [ 35.435279][ T289] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 35.458514][ T289] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 96 [ 35.459523][ T424] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1176: group 0, [ 35.476070][ T289] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 35.476100][ T289] usb 1-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 35.508645][ T425] attempt to access beyond end of device [ 35.508645][ T425] loop3: rw=524288, want=1348712416, limit=16 [ 35.521015][ T424] block bitmap and bg descriptor inconsistent: 25 vs 4278190105 free clusters [ 35.528772][ T424] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 35.537522][ T425] attempt to access beyond end of device [ 35.537522][ T425] loop3: rw=0, want=1348712296, limit=16 [ 35.549588][ T430] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 16 with max blocks 4 with error 28 [ 35.562240][ T425] attempt to access beyond end of device [ 35.562240][ T425] loop3: rw=0, want=1348712296, limit=16 [ 35.575511][ T424] EXT4-fs (loop4): This should not happen!! Data will be lost [ 35.575511][ T424] [ 35.588621][ T289] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 35.602586][ T430] EXT4-fs (loop4): This should not happen!! Data will be lost [ 35.602586][ T430] [ 35.613034][ T425] attempt to access beyond end of device [ 35.613034][ T425] loop3: rw=0, want=1348712296, limit=16 [ 35.623256][ T424] EXT4-fs (loop4): Total free blocks count 0 [ 35.632970][ T289] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 35.632995][ T289] usb 1-1: SerialNumber: syz [ 35.634272][ T425] attempt to access beyond end of device [ 35.634272][ T425] loop3: rw=0, want=1348712296, limit=16 [ 35.649062][ T430] EXT4-fs (loop4): Total free blocks count 0 [ 35.665345][ T427] attempt to access beyond end of device [ 35.665345][ T427] loop3: rw=0, want=1348712296, limit=16 [ 35.666081][ T399] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 35.674122][ T427] attempt to access beyond end of device [ 35.674122][ T427] loop3: rw=0, want=1348712296, limit=16 [ 35.687934][ T430] EXT4-fs (loop4): Free/Dirty block details [ 35.694477][ T432] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 35.708077][ T399] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 35.714157][ T424] EXT4-fs (loop4): Free/Dirty block details [ 35.727138][ T430] EXT4-fs (loop4): free_blocks=68451041280 [ 35.734727][ T427] attempt to access beyond end of device [ 35.734727][ T427] loop3: rw=0, want=1348712296, limit=16 [ 35.752938][ T430] EXT4-fs (loop4): dirty_blocks=80 [ 35.769478][ T289] hub 1-1:1.0: bad descriptor, ignoring hub [ 35.799006][ T427] attempt to access beyond end of device [ 35.799006][ T427] loop3: rw=0, want=1348712296, limit=16 [ 35.801695][ T289] hub: probe of 1-1:1.0 failed with error -5 [ 35.838005][ T425] attempt to access beyond end of device [ 35.838005][ T425] loop3: rw=0, want=1348712296, limit=16 [ 35.906378][ T436] loop4: detected capacity change from 0 to 16 [ 35.915037][ T436] erofs: (device loop4): mounted with root inode @ nid 36. [ 35.945806][ T439] 9pnet_virtio: no channels available for device syz [ 36.002013][ T399] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 36.012128][ T399] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 36.278177][ T289] cdc_ether: probe of 1-1:1.0 failed with error -71 [ 36.319704][ T289] usb 1-1: USB disconnect, device number 2 [ 36.348100][ T39] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 36.618170][ T39] usb 3-1: Using ep0 maxpacket: 8 [ 36.738188][ T39] usb 3-1: config 0 has an invalid interface number: 122 but max is 0 [ 36.750796][ T39] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 36.765715][ T39] usb 3-1: config 0 has no interface number 0 [ 36.774076][ T39] usb 3-1: config 0 interface 122 altsetting 0 endpoint 0xA has invalid maxpacket 512, setting to 64 [ 36.790804][ T39] usb 3-1: config 0 interface 122 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 8 [ 36.818063][ T39] usb 3-1: config 0 interface 122 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 8 [ 37.008244][ T39] usb 3-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice= 5.b7 [ 37.018699][ T39] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.027233][ T39] usb 3-1: Product: syz [ 37.031699][ T39] usb 3-1: Manufacturer: syz [ 37.036532][ T39] usb 3-1: SerialNumber: syz [ 37.042753][ T39] usb 3-1: config 0 descriptor?? [ 37.068159][ T447] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 37.290328][ T30] kauditd_printk_skb: 32 callbacks suppressed [ 37.290346][ T30] audit: type=1400 audit(1784549940.002:157): avc: denied { ioctl } for pid=446 comm="syz.2.53" path="socket:[16791]" dev="sockfs" ino=16791 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 37.330338][ T39] usb 3-1: USB disconnect, device number 2 [ 37.698779][ T474] loop0: detected capacity change from 0 to 256 [ 37.734011][ T474] exFAT-fs (loop0): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 37.755771][ T30] audit: type=1400 audit(1784549940.462:158): avc: denied { write } for pid=473 comm="syz.0.62" name="file2" dev="loop0" ino=1048595 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 37.756967][ T474] exFAT-fs (loop0): hint_cluster is invalid (17) [ 37.785124][ T307] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 37.817177][ T30] audit: type=1400 audit(1784549940.462:159): avc: denied { open } for pid=473 comm="syz.0.62" name="file2" dev="loop0" ino=1048595 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 37.843099][ T30] audit: type=1400 audit(1784549940.522:160): avc: denied { mount } for pid=475 comm="syz.4.64" name="/" dev="pstore" ino=14629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pstore_t tclass=filesystem permissive=1 [ 37.880965][ T30] audit: type=1400 audit(1784549940.582:161): avc: denied { read } for pid=473 comm="syz.0.62" name="file2" dev="loop0" ino=1048595 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 37.910557][ T30] audit: type=1400 audit(1784549940.612:162): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 38.012221][ T30] audit: type=1400 audit(1784549940.722:163): avc: denied { write } for pid=485 comm="syz.0.66" name="kvm" dev="devtmpfs" ino=82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 38.266750][ T30] audit: type=1400 audit(1784549940.972:164): avc: denied { read } for pid=492 comm="syz.0.68" dev="nsfs" ino=4026532457 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 38.297354][ T30] audit: type=1400 audit(1784549940.982:165): avc: denied { open } for pid=492 comm="syz.0.68" path="net:[4026532457]" dev="nsfs" ino=4026532457 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 38.328660][ T30] audit: type=1400 audit(1784549941.002:166): avc: denied { ioctl } for pid=492 comm="syz.0.68" path="socket:[15895]" dev="sockfs" ino=15895 ioctlcmd=0x48de scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 38.392275][ T502] bridge0: port 3(syz_tun) entered blocking state [ 38.400712][ T502] bridge0: port 3(syz_tun) entered disabled state [ 38.408928][ T502] device syz_tun entered promiscuous mode [ 38.415480][ T502] bridge0: port 3(syz_tun) entered blocking state [ 38.424469][ T502] bridge0: port 3(syz_tun) entered forwarding state [ 38.553684][ T514] bridge0: port 3(syz_tun) entered blocking state [ 38.563359][ T514] bridge0: port 3(syz_tun) entered disabled state [ 38.563448][ T307] usb 4-1: unable to get BOS descriptor or descriptor too short [ 38.572742][ T514] device syz_tun entered promiscuous mode [ 38.588476][ T514] bridge0: port 3(syz_tun) entered blocking state [ 38.597243][ T514] bridge0: port 3(syz_tun) entered forwarding state [ 38.638071][ T307] usb 4-1: not running at top speed; connect to a high speed hub [ 38.758107][ T307] usb 4-1: config 13 has an invalid interface number: 165 but max is 1 [ 38.774491][ T307] usb 4-1: config 13 has an invalid interface number: 165 but max is 1 [ 38.785010][ T307] usb 4-1: config 13 has 1 interface, different from the descriptor's value: 2 [ 38.799445][ T307] usb 4-1: config 13 has no interface number 0 [ 38.809082][ T307] usb 4-1: config 13 interface 165 has no altsetting 0 [ 38.821257][ T307] usb 4-1: config 13 interface 165 has no altsetting 1 [ 38.963132][ T528] loop2: detected capacity change from 0 to 40427 [ 39.008161][ T307] usb 4-1: New USB device found, idVendor=d5f0, idProduct=cb11, bcdDevice=a4.09 [ 39.020200][ T528] F2FS-fs (loop2): fault_injection options not supported [ 39.020231][ T307] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.037119][ T528] F2FS-fs (loop2): fault_type options not supported [ 39.037399][ T307] usb 4-1: Product: syz [ 39.049830][ T307] usb 4-1: Manufacturer: syz [ 39.050301][ T528] F2FS-fs (loop2): invalid crc value [ 39.055254][ T307] usb 4-1: SerialNumber: syz [ 39.064224][ T528] F2FS-fs (loop2): Found nat_bits in checkpoint [ 39.091194][ T528] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 39.374886][ T307] usb 4-1: USB disconnect, device number 2 [ 39.523425][ T574] loop1: detected capacity change from 0 to 128 [ 39.551505][ T574] EXT4-fs (loop1): mounting ext2 file system using the ext4 subsystem [ 39.561245][ T574] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 39.572573][ T574] ext2 filesystem being mounted at /15/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 39.635882][ T574] EXT4-fs error (device loop1): make_indexed_dir:2333: inode #2: block 63: comm syz.1.102: bad entry in directory: rec_len is smaller than minimal - offset=36, inode=0, rec_len=5, size=1000 fake=1 [ 39.672183][ T574] EXT4-fs warning (device loop1): dx_probe:893: inode #2: comm syz.1.102: dx entry: limit 0 != root limit 125 [ 39.686366][ T574] EXT4-fs warning (device loop1): dx_probe:966: inode #2: comm syz.1.102: Corrupt directory, running e2fsck is recommended [ 40.136022][ T595] netlink: 8 bytes leftover after parsing attributes in process `syz.4.110'. [ 41.114560][ T634] netlink: 16 bytes leftover after parsing attributes in process `syz.0.125'. [ 41.274351][ T636] device sit0 entered promiscuous mode [ 41.296102][ T636] netlink: 'syz.0.126': attribute type 1 has an invalid length. [ 41.313665][ T636] netlink: 1 bytes leftover after parsing attributes in process `syz.0.126'. [ 41.565673][ T659] device syzkaller0 entered promiscuous mode [ 41.587165][ T659] tipc: Started in network mode [ 41.600384][ T659] tipc: Node identity f6f830cb19fb, cluster identity 4711 [ 41.621647][ T659] tipc: Enabled bearer , priority 0 [ 41.652049][ T659] tipc: Resetting bearer [ 41.681362][ T658] tipc: Resetting bearer [ 41.700763][ T658] tipc: Disabling bearer [ 41.810222][ T627] loop2: detected capacity change from 0 to 131072 [ 41.828366][ T627] F2FS-fs (loop2): Unrecognized mount option "age_extent_cache" or missing value [ 41.969312][ T680] tipc: Can't bind to reserved service type 0 [ 42.285434][ T692] netlink: 12 bytes leftover after parsing attributes in process `syz.4.148'. [ 42.302088][ T30] kauditd_printk_skb: 23 callbacks suppressed [ 42.302152][ T30] audit: type=1400 audit(1784549945.012:190): avc: denied { bind } for pid=691 comm="syz.4.148" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 42.347108][ T692] syz.4.148 (692) used greatest stack depth: 22112 bytes left [ 42.349930][ T30] audit: type=1400 audit(1784549945.052:191): avc: denied { listen } for pid=695 comm="syz.4.151" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 42.361379][ T694] tmpfs: Unknown parameter 'grpquota' [ 42.376442][ T30] audit: type=1400 audit(1784549945.052:192): avc: denied { accept } for pid=695 comm="syz.4.151" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 42.581379][ T709] overlayfs: missing 'lowerdir' [ 42.710082][ T30] audit: type=1400 audit(1784549945.422:193): avc: denied { sys_module } for pid=713 comm="syz.3.156" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 42.740061][ T30] audit: type=1400 audit(1784549945.422:194): avc: denied { read write } for pid=713 comm="syz.3.156" name="ppp" dev="devtmpfs" ino=154 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 42.767513][ T30] audit: type=1400 audit(1784549945.422:195): avc: denied { open } for pid=713 comm="syz.3.156" path="/dev/ppp" dev="devtmpfs" ino=154 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 42.796645][ T30] audit: type=1400 audit(1784549945.422:196): avc: denied { ioctl } for pid=713 comm="syz.3.156" path="/dev/ppp" dev="devtmpfs" ino=154 ioctlcmd=0x7438 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 42.827358][ T30] audit: type=1400 audit(1784549945.422:197): avc: denied { create } for pid=715 comm="syz.3.157" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 42.859691][ T30] audit: type=1400 audit(1784549945.532:198): avc: denied { create } for pid=719 comm="syz.3.159" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_dnrt_socket permissive=1 [ 42.887819][ T30] audit: type=1400 audit(1784549945.532:199): avc: denied { create } for pid=719 comm="syz.3.159" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 43.025667][ T724] process 'syz.1.160' launched './file0' with NULL argv: empty string added [ 43.334103][ T737] overlayfs: missing 'lowerdir' [ 43.438064][ T578] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 43.631012][ T746] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 43.655785][ T746] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 43.706134][ T750] loop2: detected capacity change from 0 to 8192 [ 43.967588][ T578] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 43.980660][ T578] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 43.993381][ T578] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 44.014622][ T578] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 44.024077][ T578] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 44.025655][ T770] loop2: detected capacity change from 0 to 256 [ 44.034287][ T578] usb 2-1: config 0 descriptor?? [ 44.104294][ T770] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0x36dfe6b4, utbl_chksum : 0xe619d30d) [ 44.214598][ T775] overlayfs: missing 'lowerdir' [ 44.528063][ T26] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 44.549382][ T578] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 44.558786][ T578] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 44.567051][ T578] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 44.574848][ T578] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 44.582940][ T578] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 44.591325][ T578] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 44.599341][ T578] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 44.607053][ T578] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 44.622706][ T578] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 44.630823][ T578] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 44.693978][ T578] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 44.702850][ T578] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 44.710557][ T578] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 44.718862][ T578] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 44.728294][ T578] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 44.738198][ T578] plantronics 0003:047F:FFFF.0001: No inputs registered, leaving [ 44.753193][ T578] plantronics 0003:047F:FFFF.0001: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 44.767793][ T578] usb 2-1: USB disconnect, device number 2 [ 44.851054][ T797] fido_id[797]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 44.929199][ T26] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 44.940103][ T26] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 45.108150][ T26] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 45.117811][ T26] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 45.128065][ T26] usb 3-1: Product: syz [ 45.133744][ T26] usb 3-1: Manufacturer: syz [ 45.141702][ T26] usb 3-1: SerialNumber: syz [ 45.219895][ T26] usb 3-1: selecting invalid altsetting 1 [ 45.322799][ T808] overlayfs: missing 'lowerdir' [ 45.488019][ T578] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 45.638164][ T26] cdc_mbim 3-1:1.0: failed GET_NTB_PARAMETERS [ 45.645823][ T26] cdc_mbim 3-1:1.0: bind() failure [ 45.658351][ T26] usb 3-1: USB disconnect, device number 3 [ 45.758009][ T578] usb 5-1: Using ep0 maxpacket: 16 [ 45.878102][ T578] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 45.890263][ T578] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 45.901180][ T578] usb 5-1: New USB device found, idVendor=1b1c, idProduct=1b02, bcdDevice= 0.00 [ 45.910967][ T578] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 45.920646][ T578] usb 5-1: config 0 descriptor?? [ 46.394622][ T578] hid-generic 0003:1B1C:1B02.0002: unknown main item tag 0x0 [ 46.428197][ T578] hid-generic 0003:1B1C:1B02.0002: unknown main item tag 0x0 [ 46.859561][ T578] hid-generic 0003:1B1C:1B02.0002: unknown main item tag 0x0 [ 46.871265][ T578] hid-generic 0003:1B1C:1B02.0002: unknown main item tag 0x0 [ 47.948370][ T578] hid-generic 0003:1B1C:1B02.0002: unknown main item tag 0x0 [ 47.959964][ T578] hid-generic 0003:1B1C:1B02.0002: hidraw0: USB HID v0.00 Device [HID 1b1c:1b02] on usb-dummy_hcd.4-1/input0 [ 48.093806][ T838] loop0: detected capacity change from 0 to 256 [ 48.105109][ T841] overlayfs: missing 'lowerdir' [ 48.141546][ T838] exfat: Unknown parameter 'sys_tz' [ 48.249388][ T26] usb 5-1: USB disconnect, device number 2 [ 48.401742][ T30] kauditd_printk_skb: 20 callbacks suppressed [ 48.401770][ T30] audit: type=1400 audit(1784549951.092:220): avc: denied { create } for pid=858 comm="syz.4.208" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 48.780242][ T30] audit: type=1400 audit(1784549951.492:221): avc: denied { ioctl } for pid=870 comm="syz.3.212" path="socket:[18941]" dev="sockfs" ino=18941 ioctlcmd=0xae79 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 48.892906][ T876] overlayfs: missing 'lowerdir' [ 48.982054][ T30] audit: type=1400 audit(1784549951.692:222): avc: denied { read } for pid=868 comm="syz.4.211" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 49.832827][ T907] overlayfs: missing 'lowerdir' [ 49.865313][ T910] overlayfs: missing 'workdir' [ 51.103281][ T30] audit: type=1400 audit(1784549953.812:223): avc: denied { execute_no_trans } for pid=939 comm="syz.2.235" path=2F6D656D66643A5B0BDB58AE5B1AA9FDFAADD16D64C8854858A9250C1A65E0202864656C6574656429 dev="tmpfs" ino=28 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 51.487601][ T948] overlayfs: missing 'lowerdir' [ 51.614124][ T30] audit: type=1400 audit(1784549954.322:224): avc: denied { write } for pid=949 comm="syz.1.238" name="001" dev="devtmpfs" ino=175 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 51.711746][ T30] audit: type=1400 audit(1784549954.362:225): avc: denied { map } for pid=949 comm="syz.1.238" path="/dev/bus/usb/006/001" dev="devtmpfs" ino=175 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 51.902905][ T30] audit: type=1400 audit(1784549954.612:226): avc: denied { read write } for pid=966 comm="syz.1.245" name="rtc0" dev="devtmpfs" ino=259 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 52.072223][ T30] audit: type=1400 audit(1784549954.652:227): avc: denied { open } for pid=966 comm="syz.1.245" path="/dev/rtc0" dev="devtmpfs" ino=259 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 52.406094][ T30] audit: type=1400 audit(1784549954.652:228): avc: denied { ioctl } for pid=966 comm="syz.1.245" path="/dev/rtc0" dev="devtmpfs" ino=259 ioctlcmd=0x700b scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 52.476908][ T30] audit: type=1400 audit(1784549954.652:229): avc: denied { read } for pid=966 comm="syz.1.245" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 52.703399][ T986] syz.0.252 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 52.785544][ T988] pimreg0: tun_chr_ioctl cmd 1074025681 [ 52.850185][ T289] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 53.228313][ T289] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 53.374698][ T289] usb 2-1: New USB device found, idVendor=0b05, idProduct=1abe, bcdDevice= 0.00 [ 53.409750][ T997] loop4: detected capacity change from 0 to 256 [ 53.638336][ T289] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 53.666621][ T289] usb 2-1: config 0 descriptor?? [ 53.678046][ T30] audit: type=1400 audit(1784549956.382:230): avc: denied { read } for pid=1000 comm="syz.2.258" name="binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 53.716731][ T997] exFAT-fs (loop4): failed to load upcase table (idx : 0x00011f1c, chksum : 0x850fc7e5, utbl_chksum : 0xe619d30d) [ 53.740606][ T1001] binder: 1000:1001 ioctl 4018620d 0 returned -22 [ 53.768149][ T979] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 53.808600][ T30] audit: type=1400 audit(1784549956.382:231): avc: denied { open } for pid=1000 comm="syz.2.258" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 53.926400][ T30] audit: type=1400 audit(1784549956.452:232): avc: denied { ioctl } for pid=1000 comm="syz.2.258" path="/dev/binderfs/binder0" dev="binder" ino=13 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 54.181281][ T725] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 54.266271][ T289] hid-generic 0003:0B05:1ABE.0003: unknown main item tag 0x0 [ 54.278005][ T308] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 54.299318][ T289] hid-generic 0003:0B05:1ABE.0003: unknown main item tag 0x0 [ 54.325602][ T289] hid-generic 0003:0B05:1ABE.0003: unknown main item tag 0x0 [ 54.354703][ T289] hid-generic 0003:0B05:1ABE.0003: unknown main item tag 0x0 [ 54.385548][ T289] hid-generic 0003:0B05:1ABE.0003: unknown main item tag 0x0 [ 54.394598][ T289] hid-generic 0003:0B05:1ABE.0003: unknown main item tag 0x0 [ 54.402265][ T289] hid-generic 0003:0B05:1ABE.0003: unknown main item tag 0x0 [ 54.411601][ T289] hid-generic 0003:0B05:1ABE.0003: unexpected long global item [ 54.420332][ T289] hid-generic: probe of 0003:0B05:1ABE.0003 failed with error -22 [ 54.506258][ T289] usb 2-1: USB disconnect, device number 3 [ 54.568329][ T725] usb 4-1: config 1 has an invalid descriptor of length 108, skipping remainder of the config [ 54.598540][ T725] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 54.640865][ T725] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 54.678147][ T308] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 54.700335][ T308] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 54.730959][ T308] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 54.765748][ T308] usb 1-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 54.789890][ T308] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 54.814966][ T308] usb 1-1: config 0 descriptor?? [ 54.878120][ T725] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 54.898067][ T725] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 54.916686][ T725] usb 4-1: Product: syz [ 54.921435][ T725] usb 4-1: Manufacturer: syz [ 54.935333][ T725] usb 4-1: SerialNumber: syz [ 54.978714][ T725] cdc_ncm 4-1:1.0: CDC Union missing and no IAD found [ 54.986494][ T725] cdc_ncm 4-1:1.0: bind() failure [ 55.095874][ T20] usb 1-1: USB disconnect, device number 3 [ 55.208284][ T307] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 55.297530][ T1022] loop1: detected capacity change from 0 to 512 [ 55.359981][ T1022] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 55.417214][ T1022] EXT4-fs error (device loop1): ext4_validate_block_bitmap:429: comm syz.1.265: bg 0: block 4: invalid block bitmap [ 55.432826][ T1022] EXT4-fs error (device loop1) in ext4_mb_clear_bb:6191: Corrupt filesystem [ 55.444823][ T1022] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #11: comm syz.1.265: invalid indirect mapped block 1 (level 1) [ 55.460905][ T1022] EXT4-fs (loop1): 1 truncate cleaned up [ 55.471552][ T1022] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 55.518229][ T307] usb 5-1: Using ep0 maxpacket: 8 [ 55.572051][ T1020] syz.2.264 (1020) used greatest stack depth: 21040 bytes left [ 55.684580][ T1034] netlink: 8 bytes leftover after parsing attributes in process `syz.2.269'. [ 55.698047][ T307] usb 5-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 55.722427][ T307] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 55.737014][ T307] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 55.754400][ T307] usb 5-1: config 168 interface 0 altsetting 188 has 1 endpoint descriptor, different from the interface descriptor's value: 100 [ 55.771872][ T307] usb 5-1: config 168 interface 0 has no altsetting 0 [ 55.908090][ T307] usb 5-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 57.038881][ T725] usb 4-1: USB disconnect, device number 3 [ 57.204128][ T30] audit: type=1400 audit(1784549959.912:233): avc: denied { create } for pid=1041 comm="syz.3.273" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 57.349355][ T30] audit: type=1400 audit(1784549959.932:234): avc: denied { setopt } for pid=1041 comm="syz.3.273" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 57.563506][ T307] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 57.577768][ T307] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 57.593375][ T307] usb 5-1: config 168 interface 0 altsetting 188 has 1 endpoint descriptor, different from the interface descriptor's value: 100 [ 57.607116][ T307] usb 5-1: config 168 interface 0 has no altsetting 0 [ 57.688097][ T307] usb 5-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 57.706966][ T307] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 57.742125][ T1052] loop2: detected capacity change from 0 to 512 [ 57.744878][ T1030] loop0: detected capacity change from 0 to 131072 [ 57.756213][ T307] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 57.770568][ T307] usb 5-1: config 168 interface 0 altsetting 188 has 1 endpoint descriptor, different from the interface descriptor's value: 100 [ 57.785081][ T307] usb 5-1: config 168 interface 0 has no altsetting 0 [ 57.800889][ T1052] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 42 vs 41 free clusters [ 57.816277][ T1052] EXT4-fs error (device loop2): ext4_do_update_inode:5260: inode #16: comm syz.2.276: corrupted inode contents [ 57.842160][ T1030] F2FS-fs (loop0): Found nat_bits in checkpoint [ 57.851428][ T1052] EXT4-fs error (device loop2): ext4_dirty_inode:6108: inode #16: comm syz.2.276: mark_inode_dirty error [ 57.887947][ T1052] EXT4-fs error (device loop2): ext4_do_update_inode:5260: inode #16: comm syz.2.276: corrupted inode contents [ 57.914428][ T1052] EXT4-fs error (device loop2): __ext4_ext_dirty:183: inode #16: comm syz.2.276: mark_inode_dirty error [ 57.928316][ T1052] EXT4-fs error (device loop2): ext4_do_update_inode:5260: inode #16: comm syz.2.276: corrupted inode contents [ 57.930614][ T1030] F2FS-fs (loop0): Mounted with checkpoint version = 753bd00b [ 57.940369][ T1052] EXT4-fs error (device loop2) in ext4_orphan_del:303: Corrupt filesystem [ 57.948066][ T307] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 57.961739][ T1052] EXT4-fs error (device loop2): ext4_do_update_inode:5260: inode #16: comm syz.2.276: corrupted inode contents [ 57.981175][ T307] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 57.997331][ T1062] loop4: detected capacity change from 0 to 512 [ 58.010896][ T307] usb 5-1: Product: syz [ 58.011987][ T30] audit: type=1400 audit(1784549960.722:235): avc: denied { create } for pid=1029 comm="syz.0.268" name="encrypted_dir" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 58.018224][ T307] usb 5-1: Manufacturer: syz [ 58.053770][ T1030] fscrypt: Adiantum using implementation "adiantum(xchacha12-simd,aes-aesni,nhpoly1305-generic)" [ 58.067342][ T307] usb 5-1: SerialNumber: syz [ 58.073557][ T1052] EXT4-fs error (device loop2): ext4_truncate:4317: inode #16: comm syz.2.276: mark_inode_dirty error [ 58.082224][ T30] audit: type=1400 audit(1784549960.752:236): avc: denied { write } for pid=1029 comm="syz.0.268" name="encrypted_dir" dev="loop0" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 58.114290][ T1052] EXT4-fs error (device loop2) in ext4_process_orphan:345: Corrupt filesystem [ 58.115852][ T307] usb 5-1: can't set config #168, error -71 [ 58.130677][ T1062] EXT4-fs (loop4): Test dummy encryption mode enabled [ 58.134416][ T307] usb 5-1: USB disconnect, device number 3 [ 58.150555][ T1052] EXT4-fs (loop2): 1 truncate cleaned up [ 58.160244][ T1062] EXT4-fs error (device loop4): ext4_orphan_get:1406: inode #15: comm syz.4.277: inode has both inline data and extents flags [ 58.163435][ T30] audit: type=1400 audit(1784549960.752:237): avc: denied { add_name } for pid=1029 comm="syz.0.268" name="file" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 58.193184][ T1052] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 58.218722][ T1062] EXT4-fs error (device loop4): ext4_orphan_get:1411: comm syz.4.277: couldn't read orphan inode 15 (err -117) [ 58.219656][ T1052] ext4 filesystem being mounted at /50/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 58.245429][ T1062] EXT4-fs (loop4): mounted filesystem without journal. Opts: test_dummy_encryption,,errors=continue. Quota mode: writeback. [ 58.462705][ T1074] loop3: detected capacity change from 0 to 1024 [ 58.486783][ T1076] device syzkaller0 entered promiscuous mode [ 58.520093][ T1076] tipc: Enabled bearer , priority 0 [ 58.536305][ T1074] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 58.565873][ T1075] tipc: Resetting bearer [ 58.588304][ T1075] tipc: Disabling bearer [ 58.595664][ T1074] EXT4-fs error (device loop3): ext4_read_inline_dir:1632: inode #12: block 7: comm syz.3.283: path /54/file1/file0: bad entry in directory: rec_len is smaller than minimal - offset=40, inode=14, rec_len=8, size=80 fake=0 [ 58.708146][ T307] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 58.988112][ T20] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 59.078150][ T307] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 59.108013][ T307] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 59.141882][ T307] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 59.198013][ T307] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 59.217999][ T307] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 59.238083][ T20] usb 1-1: Using ep0 maxpacket: 16 [ 59.249545][ T307] usb 3-1: config 0 descriptor?? [ 59.368516][ T20] usb 1-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xF3, skipping [ 59.558141][ T20] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 59.580929][ T20] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 59.598400][ T20] usb 1-1: Product: syz [ 59.608350][ T20] usb 1-1: Manufacturer: syz [ 59.613259][ T20] usb 1-1: SerialNumber: syz [ 59.642463][ T20] usb 1-1: config 0 descriptor?? [ 59.739259][ T307] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 59.757939][ T307] plantronics 0003:047F:FFFF.0004: No inputs registered, leaving [ 59.783103][ T307] plantronics 0003:047F:FFFF.0004: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 60.143532][ T1098] loop3: detected capacity change from 0 to 40427 [ 60.166219][ T1098] F2FS-fs (loop3): fault_injection options not supported [ 60.195953][ T1098] F2FS-fs (loop3): fault_type options not supported [ 60.216027][ T1098] F2FS-fs (loop3): invalid crc value [ 60.247198][ T1098] F2FS-fs (loop3): Found nat_bits in checkpoint [ 60.321215][ T1098] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 60.471830][ T287] handle_bad_sector: 10 callbacks suppressed [ 60.471852][ T287] attempt to access beyond end of device [ 60.471852][ T287] loop3: rw=2049, want=45112, limit=40427 [ 60.560926][ T1085] loop4: detected capacity change from 0 to 262144 [ 60.594850][ T1085] F2FS-fs (loop4): Mismatch valid blocks 0 vs. 2 [ 60.603228][ T1085] F2FS-fs (loop4): Failed to initialize F2FS segment manager (-117) [ 61.800148][ T578] usb 1-1: USB disconnect, device number 4 [ 62.128095][ T725] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 63.629858][ T725] usb 2-1: Using ep0 maxpacket: 16 [ 63.681384][ T1147] device syzkaller0 entered promiscuous mode [ 63.699613][ T1147] tipc: Started in network mode [ 63.704771][ T1147] tipc: Node identity 368562d39cce, cluster identity 4711 [ 63.730773][ T1147] tipc: Enabled bearer , priority 0 [ 63.766220][ T1147] tipc: Resetting bearer [ 63.780237][ T725] usb 2-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xF3, skipping [ 63.809428][ T1146] tipc: Resetting bearer [ 63.821654][ T1146] tipc: Disabling bearer [ 63.955403][ T726] usb 3-1: USB disconnect, device number 4 [ 63.955800][ T1160] loop3: detected capacity change from 0 to 512 [ 64.002306][ T1160] EXT4-fs (loop3): Ignoring removed nobh option [ 64.243957][ T1160] EXT4-fs (loop3): mounted filesystem without journal. Opts: max_dir_size_kb=0x0000000000001000,nobh,quota,,errors=continue. Quota mode: writeback. [ 64.276216][ T1160] ext4 filesystem being mounted at /65/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 64.287606][ T725] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 64.312954][ T725] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 64.322952][ T725] usb 2-1: Product: syz [ 64.329137][ T725] usb 2-1: Manufacturer: syz [ 64.335776][ T725] usb 2-1: SerialNumber: syz [ 64.355857][ T725] usb 2-1: config 0 descriptor?? [ 64.890128][ T1144] syz.2.302 (1144) used greatest stack depth: 20872 bytes left [ 66.458648][ T307] usb 2-1: USB disconnect, device number 4 [ 66.502869][ T1184] device syz_tun left promiscuous mode [ 66.508636][ T1184] bridge0: port 3(syz_tun) entered disabled state [ 66.519491][ T1184] device bridge_slave_0 left promiscuous mode [ 66.526314][ T1184] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.550998][ T1184] device bridge_slave_1 left promiscuous mode [ 66.563540][ T1184] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.763366][ T1197] device syzkaller0 entered promiscuous mode [ 66.887999][ T26] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 66.938964][ T1200] device syzkaller0 entered promiscuous mode [ 66.966332][ T1200] tipc: Enabled bearer , priority 0 [ 66.994351][ T1200] tipc: Resetting bearer [ 67.014014][ T1199] tipc: Resetting bearer [ 67.023896][ T1199] tipc: Disabling bearer [ 67.308048][ T26] usb 5-1: unable to get BOS descriptor or descriptor too short [ 67.388060][ T26] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 67.403498][ T26] usb 5-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 67.419016][ T26] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 67.528106][ T1172] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 67.552436][ T1225] loop2: detected capacity change from 0 to 512 [ 67.679846][ T26] usb 5-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 67.705583][ T26] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 67.794853][ T26] usb 5-1: Product: syz [ 67.819918][ T26] usb 5-1: Manufacturer: syz [ 67.828918][ T26] usb 5-1: SerialNumber: syz [ 67.875029][ T1225] EXT4-fs warning (device loop2): dx_probe:833: inode #2: comm syz.2.333: Unrecognised inode hash code 255 [ 67.892030][ T1225] EXT4-fs warning (device loop2): dx_probe:966: inode #2: comm syz.2.333: Corrupt directory, running e2fsck is recommended [ 67.903380][ T1231] device syzkaller0 entered promiscuous mode [ 67.908650][ T1225] EXT4-fs (loop2): Cannot turn on journaled quota: type 1: error -117 [ 67.922314][ T1225] EXT4-fs error (device loop2): ext4_iget_extra_inode:4604: inode #15: comm syz.2.333: corrupted in-inode xattr [ 67.935591][ T1225] EXT4-fs error (device loop2): ext4_orphan_get:1411: comm syz.2.333: couldn't read orphan inode 15 (err -117) [ 67.948323][ T1225] EXT4-fs (loop2): mounted filesystem without journal. Opts: minixdf,noblock_validity,abort,dioread_lock,stripe=0x00000000000000e3,grpjquota=.nouser_xattr,nolazytime,jqfmt=vfsv1,grpid,,,errors=continue. Quota mode: writeback. [ 67.974577][ T1172] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 67.986348][ T1172] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 67.997559][ T1172] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 68.010666][ T1172] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 68.022817][ T1172] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 68.037116][ T1225] EXT4-fs warning (device loop2): dx_probe:833: inode #2: comm syz.2.333: Unrecognised inode hash code 255 [ 68.050786][ T1172] usb 4-1: config 0 descriptor?? [ 68.054145][ T1225] EXT4-fs warning (device loop2): dx_probe:966: inode #2: comm syz.2.333: Corrupt directory, running e2fsck is recommended [ 68.077361][ T1235] device syzkaller0 entered promiscuous mode [ 68.077463][ T1225] EXT4-fs warning (device loop2): dx_probe:833: inode #2: comm syz.2.333: Unrecognised inode hash code 255 [ 68.098160][ T1225] EXT4-fs warning (device loop2): dx_probe:966: inode #2: comm syz.2.333: Corrupt directory, running e2fsck is recommended [ 68.099644][ T1235] tipc: Enabled bearer , priority 0 [ 68.111703][ T1225] EXT4-fs error (device loop2): ext4_readdir:263: inode #2: block 4: comm syz.2.333: path /60/file0: bad entry in directory: rec_len % 4 != 0 - offset=512, inode=4294967295, rec_len=65535, size=1024 fake=0 [ 68.147466][ T1225] EXT4-fs error (device loop2): ext4_readdir:263: inode #2: block 64: comm syz.2.333: path /60/file0: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 68.150854][ T1235] tipc: Resetting bearer [ 68.204017][ T1232] tipc: Resetting bearer [ 68.211223][ T1232] tipc: Disabling bearer [ 68.358135][ T26] usb 5-1: 2:1 : no or invalid class specific endpoint descriptor [ 68.369524][ T26] usb 5-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 68.377261][ T30] audit: type=1400 audit(1784549971.082:238): avc: denied { read } for pid=1237 comm="syz.2.337" name="event2" dev="devtmpfs" ino=268 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 68.387998][ T26] usb 5-1: found format II with max.bitrate = 4, frame size=7372 [ 68.441102][ T30] audit: type=1400 audit(1784549971.122:239): avc: denied { open } for pid=1237 comm="syz.2.337" path="/dev/input/event2" dev="devtmpfs" ino=268 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 68.491165][ T30] audit: type=1400 audit(1784549971.122:240): avc: denied { ioctl } for pid=1237 comm="syz.2.337" path="/dev/input/event2" dev="devtmpfs" ino=268 ioctlcmd=0x4503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 68.529590][ T1172] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 68.561872][ T1172] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 68.591921][ T1172] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 68.615220][ T1172] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 68.653718][ T1172] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 68.677812][ T1172] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 68.937522][ T26] usb 5-1: invalid uac2 rates [ 68.943529][ T26] usb 5-1: invalid uac2 rates [ 68.958018][ T1172] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 68.967046][ T1172] plantronics 0003:047F:FFFF.0005: No inputs registered, leaving [ 68.981442][ T26] usb 5-1: 2:1 : no or invalid class specific endpoint descriptor [ 69.008008][ T26] usb 5-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 69.016725][ T26] usb 5-1: found format II with max.bitrate = 4, frame size=7372 [ 69.039793][ T1172] plantronics 0003:047F:FFFF.0005: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 69.058175][ T26] usb 5-1: parse_audio_format_rates_v2v3(): unable to retrieve number of sample rates (clock 0) [ 69.108735][ T26] usb 5-1: USB disconnect, device number 4 [ 69.451999][ T1259] device syzkaller0 entered promiscuous mode [ 69.480995][ T30] audit: type=1400 audit(1784549972.192:241): avc: denied { write } for pid=1260 comm="syz.1.345" name="igmp6" dev="proc" ino=4026532397 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 69.592788][ T1265] device syzkaller0 entered promiscuous mode [ 69.689566][ T1271] netlink: 52 bytes leftover after parsing attributes in process `syz.4.349'. [ 69.691898][ T1270] device syzkaller0 entered promiscuous mode [ 69.710048][ T1271] netlink: 92 bytes leftover after parsing attributes in process `syz.4.349'. [ 69.723123][ T1271] tipc: Cannot configure node identity twice [ 69.735560][ T1270] tipc: Started in network mode [ 69.740834][ T1270] tipc: Node identity 52fae23acb85, cluster identity 4711 [ 69.749958][ T1270] tipc: Enabled bearer , priority 0 [ 69.769400][ T1270] tipc: Resetting bearer [ 69.782953][ T1267] tipc: Resetting bearer [ 69.820564][ T1267] tipc: Disabling bearer [ 69.901905][ T1282] netlink: 4 bytes leftover after parsing attributes in process `syz.1.353'. [ 72.120201][ T26] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 72.227190][ T292] usb 4-1: USB disconnect, device number 4 [ 72.294409][ T1294] device syzkaller0 entered promiscuous mode [ 72.439584][ T1304] device syzkaller0 entered promiscuous mode [ 72.958264][ T1311] loop1: detected capacity change from 0 to 16 [ 72.974811][ T1313] loop0: detected capacity change from 0 to 128 [ 72.987874][ T30] audit: type=1400 audit(1784549975.702:242): avc: denied { create } for pid=1314 comm="syz.2.365" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 73.022462][ T1311] erofs: (device loop1): mounted with root inode @ nid 36. [ 73.072908][ T26] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 73.081804][ T1310] attempt to access beyond end of device [ 73.081804][ T1310] loop1: rw=524288, want=536, limit=16 [ 73.093225][ T26] usb 1-1: can't read configurations, error -71 [ 73.302326][ T1313] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 74.431840][ T1313] ext4 filesystem being mounted at /81/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 74.612656][ T1335] device syzkaller0 entered promiscuous mode [ 74.887490][ T1343] loop4: detected capacity change from 0 to 128 [ 74.968688][ T878] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 78.368017][ T878] usb 3-1: Using ep0 maxpacket: 16 [ 78.448068][ T878] usb 3-1: device descriptor read/all, error -71 [ 79.135940][ T1375] capability: warning: `syz.1.381' uses deprecated v2 capabilities in a way that may be insecure [ 79.543430][ T1385] device syzkaller0 entered promiscuous mode [ 79.685998][ T1393] device syzkaller0 entered promiscuous mode [ 79.700204][ T1393] tipc: Enabled bearer , priority 0 [ 79.730313][ T1393] tipc: Resetting bearer [ 79.744605][ T1392] tipc: Resetting bearer [ 79.759770][ T1392] tipc: Disabling bearer [ 80.685754][ T1405] loop4: detected capacity change from 0 to 128 [ 80.855408][ T30] audit: type=1400 audit(1784549983.562:243): avc: denied { mounton } for pid=1404 comm="syz.4.390" path="/77/file0" dev="loop4" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=dir permissive=1 [ 80.884667][ T285] FAT-fs (loop4): error, corrupted directory (invalid entries) [ 80.919304][ T285] FAT-fs (loop4): error, corrupted directory (invalid entries) [ 81.057990][ T6] usb 1-1: new full-speed USB device number 7 using dummy_hcd [ 81.301306][ T54] tipc: Left network mode [ 81.428020][ T6] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 81.816029][ T30] audit: type=1400 audit(1784549984.522:244): avc: denied { mounton } for pid=1429 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 82.112590][ T1432] loop1: detected capacity change from 0 to 512 [ 82.159777][ T1432] FAT-fs (loop1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 82.428575][ T54] device bridge_slave_1 left promiscuous mode [ 82.442022][ T54] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.489330][ T54] device bridge_slave_0 left promiscuous mode [ 82.534733][ T54] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.589529][ T54] device veth1_macvtap left promiscuous mode [ 82.631546][ T54] device veth0_vlan left promiscuous mode [ 82.827959][ C0] sched: RT throttling activated [ 83.208072][ T6] usb 1-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 83.248029][ T6] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 83.276603][ T6] usb 1-1: Product: syz [ 83.285908][ T6] usb 1-1: Manufacturer: syz [ 83.299204][ T6] usb 1-1: SerialNumber: syz [ 83.316001][ T6] usb 1-1: config 0 descriptor?? [ 83.590421][ T1429] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.598329][ T1429] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.614828][ T1429] device bridge_slave_0 entered promiscuous mode [ 83.637379][ T1429] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.645908][ T1429] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.665336][ T1429] device bridge_slave_1 entered promiscuous mode [ 83.706416][ T6] usb 1-1: USB disconnect, device number 7 [ 84.060475][ T1429] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.067586][ T1429] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.074926][ T1429] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.081993][ T1429] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.162287][ T54] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.172260][ T54] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.183789][ T54] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 84.193018][ T54] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 84.255377][ T54] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 84.277743][ T54] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.289418][ T54] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.315191][ T54] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 84.324768][ T54] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.331880][ T54] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.433663][ T1429] device veth0_vlan entered promiscuous mode [ 84.452282][ T1429] device veth1_macvtap entered promiscuous mode [ 84.472658][ T30] audit: type=1400 audit(1784549987.182:245): avc: denied { mounton } for pid=1429 comm="syz-executor" path="/root/syzkaller.gDgZFR/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 84.523584][ T54] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 84.550542][ T54] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 84.566441][ T54] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 84.587202][ T54] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 84.610101][ T54] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 84.627933][ T54] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 84.637032][ T54] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 84.646045][ T54] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 84.655313][ T54] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 86.548068][ T26] usb 1-1: new full-speed USB device number 8 using dummy_hcd [ 87.038066][ T26] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 87.148016][ T292] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 87.268036][ T26] usb 1-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 87.277574][ T26] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 87.285968][ T26] usb 1-1: Product: syz [ 87.290441][ T26] usb 1-1: Manufacturer: syz [ 87.295144][ T26] usb 1-1: SerialNumber: syz [ 87.302127][ T26] usb 1-1: config 0 descriptor?? [ 87.388000][ T292] usb 2-1: Using ep0 maxpacket: 16 [ 87.508164][ T292] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 87.519344][ T292] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 87.532525][ T292] usb 2-1: New USB device found, idVendor=05ac, idProduct=027c, bcdDevice= 0.00 [ 87.542324][ T292] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.551778][ T292] usb 2-1: config 0 descriptor?? [ 87.611127][ T6] usb 1-1: USB disconnect, device number 8 [ 87.898057][ T1346] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 88.029231][ T292] hid-generic 0003:05AC:027C.0006: unknown main item tag 0x3 [ 88.038794][ T292] hid-generic 0003:05AC:027C.0006: unknown main item tag 0x0 [ 88.048974][ T292] hid-generic 0003:05AC:027C.0006: unknown main item tag 0x2 [ 88.058566][ T292] hid-generic 0003:05AC:027C.0006: unbalanced delimiter at end of report description [ 88.068305][ T292] hid-generic: probe of 0003:05AC:027C.0006 failed with error -22 [ 88.231114][ T26] usb 2-1: USB disconnect, device number 5 [ 88.298066][ T1346] usb 4-1: unable to get BOS descriptor or descriptor too short [ 88.378245][ T1346] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 36, changing to 7 [ 88.548049][ T39] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 88.555486][ T1346] usb 4-1: New USB device found, idVendor=04fa, idProduct=4201, bcdDevice= 0.40 [ 88.566747][ T1346] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 88.601924][ T1346] usb 4-1: Product: syz [ 88.606514][ T1346] usb 4-1: Manufacturer: syz [ 88.611529][ T1346] usb 4-1: SerialNumber: syz [ 89.079550][ T39] usb 1-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 89.142514][ T39] usb 1-1: config 220 has 2 interfaces, different from the descriptor's value: 3 [ 89.216668][ T39] usb 1-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 89.264861][ T39] usb 1-1: config 220 interface 0 has no altsetting 0 [ 89.274046][ T1536] loop1: detected capacity change from 0 to 256 [ 89.281170][ T39] usb 1-1: config 220 interface 1 has no altsetting 0 [ 89.477664][ T39] usb 1-1: New USB device found, idVendor=8086, idProduct=0b03, bcdDevice=6c.b9 [ 89.587070][ T39] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.743118][ T39] usb 1-1: Product: syz [ 89.761356][ C1] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 89.776492][ T39] usb 1-1: Manufacturer: syz [ 89.782137][ T39] usb 1-1: SerialNumber: syz [ 89.939114][ T30] audit: type=1400 audit(1784549992.652:246): avc: denied { getopt } for pid=1544 comm="syz.1.434" lport=141 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 90.188630][ T39] usb 1-1: selecting invalid altsetting 0 [ 90.234229][ T39] usb 1-1: USB disconnect, device number 9 [ 90.248073][ T30] audit: type=1400 audit(1784549992.872:247): avc: denied { name_bind } for pid=1548 comm="syz.1.435" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 90.348654][ T1346] usb 4-1: 1:1 : sample bitwidth 62 in over sample bytes 0 [ 90.356712][ T1346] usb 4-1: 1:1 : unsupported sample bitwidth 62 in 0 bytes [ 90.366765][ T1346] usb 4-1: parse_audio_format_rates_v2v3(): unable to find clock source (clock -22) [ 90.510677][ T1346] usb 4-1: unit 2 not found! [ 90.516030][ T1346] usb 4-1: unit 0 not found! [ 90.596036][ T1346] usb 4-1: USB disconnect, device number 5 [ 91.059572][ T30] audit: type=1400 audit(1784549993.772:248): avc: denied { append } for pid=1575 comm="syz.0.448" name="event2" dev="devtmpfs" ino=268 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 91.106245][ T1580] device syzkaller0 entered promiscuous mode [ 91.147161][ T30] audit: type=1400 audit(1784549993.852:249): avc: denied { write } for pid=1585 comm="syz.2.452" name="uinput" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 91.178444][ T1346] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 91.264178][ T1602] device syzkaller0 entered promiscuous mode [ 91.295393][ T1607] device syzkaller1 entered promiscuous mode [ 91.352307][ T30] audit: type=1400 audit(1784549994.062:250): avc: denied { nlmsg_tty_audit } for pid=1616 comm="syz.1.466" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 91.372415][ T1619] device syzkaller0 entered promiscuous mode [ 91.419453][ T30] audit: type=1400 audit(1784549994.132:251): avc: denied { setopt } for pid=1621 comm="syz.1.468" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 91.452207][ T1627] binder: 1624:1627 ioctl c00c6211 200000000000 returned -22 [ 91.464553][ T30] audit: type=1400 audit(1784549994.132:252): avc: denied { write } for pid=1625 comm="syz.5.471" name="binder-control" dev="binder" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 91.537557][ T1642] bridge0: port 3(veth0_vlan) entered blocking state [ 91.545904][ T1642] bridge0: port 3(veth0_vlan) entered disabled state [ 91.565982][ T1642] bridge0: port 3(veth0_vlan) entered blocking state [ 91.574583][ T1642] bridge0: port 3(veth0_vlan) entered forwarding state [ 91.618143][ T1346] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 91.654409][ T1346] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 91.663126][ T30] audit: type=1400 audit(1784549994.372:253): avc: denied { getopt } for pid=1654 comm="syz.0.483" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 91.709381][ T1346] usb 4-1: config 1 has no interface number 0 [ 91.717516][ T1346] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 91.748227][ T1661] block device autoloading is deprecated and will be removed. [ 91.761194][ T1346] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 91.882274][ T1666] device syzkaller0 entered promiscuous mode [ 91.928080][ T1346] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 91.968180][ T1346] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 91.977788][ T1346] usb 4-1: Product: syz [ 91.989598][ T30] audit: type=1400 audit(1784549994.702:254): avc: denied { append } for pid=1667 comm="syz.0.489" name="kvm" dev="devtmpfs" ino=82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 92.018669][ T1346] usb 4-1: Manufacturer: syz [ 92.035344][ T1346] usb 4-1: SerialNumber: syz [ 92.040312][ T20] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 92.049619][ T1668] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=419753239 (3358025912 ns) > initial count (891553992 ns). Using initial count to start timer. [ 92.078095][ T1542] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 92.098667][ T1346] usb 4-1: selecting invalid altsetting 1 [ 92.289992][ T30] audit: type=1400 audit(1784549995.002:255): avc: denied { connect } for pid=1679 comm="syz.5.494" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 92.311782][ T20] usb 3-1: Using ep0 maxpacket: 16 [ 92.338393][ C1] ================================================================== [ 92.346974][ C1] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x6c/0xb0 [ 92.354983][ C1] Read of size 8 at addr ffff888128fd4590 by task ksoftirqd/1/25 [ 92.363399][ C1] [ 92.368160][ C1] CPU: 1 PID: 25 Comm: ksoftirqd/1 Not tainted syzkaller #0 [ 92.375926][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 92.385177][ T1542] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 92.387527][ C1] Call Trace: [ 92.387541][ C1] [ 92.402754][ C1] __dump_stack+0x21/0x30 [ 92.407830][ C1] dump_stack_lvl+0x110/0x170 [ 92.412999][ C1] ? show_regs_print_info+0x20/0x20 [ 92.420004][ C1] ? load_image+0x3f0/0x3f0 [ 92.425197][ C1] print_address_description+0x7f/0x2c0 [ 92.428125][ T20] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 248, changing to 11 [ 92.431298][ C1] ? rcu_cblist_dequeue+0x6c/0xb0 [ 92.448283][ C1] kasan_report+0x10f/0x150 [ 92.452998][ T20] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 92.453804][ C1] ? rcu_cblist_dequeue+0x6c/0xb0 [ 92.477379][ C1] __asan_report_load8_noabort+0x14/0x20 [ 92.484034][ C1] rcu_cblist_dequeue+0x6c/0xb0 [ 92.491460][ C1] rcu_do_batch+0x47d/0xbf0 [ 92.497861][ C1] ? local_bh_enable+0x20/0x20 [ 92.502977][ C1] ? __kasan_check_write+0x14/0x20 [ 92.507785][ T20] usb 3-1: New USB device found, idVendor=057e, idProduct=2019, bcdDevice= 0.00 [ 92.513606][ C1] ? _raw_spin_lock+0xf0/0xf0 [ 92.513652][ C1] ? _raw_spin_unlock_irqrestore+0x5b/0x80 [ 92.513669][ C1] ? rcu_report_qs_rnp+0x2bc/0x390 [ 92.513690][ C1] rcu_core+0x4a3/0xef0 [ 92.513707][ C1] ? rcu_cpu_kthread_park+0x90/0x90 [ 92.513725][ C1] ? __this_cpu_preempt_check+0x13/0x20 [ 92.545895][ T20] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 92.546576][ C1] ? rcu_softirq_qs+0xd7/0x2f0 [ 92.559457][ T20] usb 3-1: config 0 descriptor?? [ 92.562471][ C1] ? rcu_get_gp_kthreads_prio+0x10/0x10 [ 92.592390][ C1] ? irqtime_account_irq+0x76/0x390 [ 92.599656][ C1] rcu_core_si+0x9/0x10 [ 92.604690][ C1] handle_softirqs+0x250/0x560 [ 92.610390][ C1] ? ksoftirqd_should_run+0x20/0x20 [ 92.617146][ C1] run_ksoftirqd+0x28/0x40 [ 92.621783][ C1] smpboot_thread_fn+0x446/0x880 [ 92.627151][ C1] kthread+0x3f5/0x4f0 [ 92.628056][ T1346] cdc_ncm 4-1:1.1: failed GET_NTB_PARAMETERS [ 92.631295][ C1] ? cpu_report_death+0x1b0/0x1b0 [ 92.648288][ C1] ? kthread_blkcg+0xd0/0xd0 [ 92.654053][ C1] ret_from_fork+0x1f/0x30 [ 92.658895][ C1] [ 92.662114][ C1] [ 92.664567][ C1] Allocated by task 1680: [ 92.668031][ T1346] cdc_ncm 4-1:1.1: bind() failure [ 92.669995][ C1] __kasan_kmalloc+0xd4/0x100 [ 92.681166][ C1] __kmalloc+0x13d/0x2c0 [ 92.685684][ C1] l2tp_session_create+0x39/0xb60 [ 92.691269][ C1] pppol2tp_connect+0xbf5/0x1640 [ 92.697006][ C1] __sys_connect+0x3cb/0x450 [ 92.698308][ T1355] udevd[1355]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 92.707240][ C1] __x64_sys_connect+0x7a/0x90 [ 92.707270][ C1] x64_sys_call+0x7c/0x9a0 [ 92.707287][ C1] do_syscall_64+0x4c/0xa0 [ 92.707303][ C1] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 92.749345][ C1] [ 92.751817][ C1] Freed by task 54: [ 92.756362][ C1] kasan_set_track+0x4a/0x70 [ 92.761635][ C1] kasan_set_free_info+0x23/0x40 [ 92.766829][ C1] ____kasan_slab_free+0x125/0x160 [ 92.772239][ C1] __kasan_slab_free+0x11/0x20 [ 92.777313][ C1] slab_free_freelist_hook+0xc2/0x190 [ 92.783841][ C1] kfree+0xc4/0x270 [ 92.787932][ C1] l2tp_session_put+0xaf/0x1a0 [ 92.793327][ C1] l2tp_session_delete+0x3a9/0x4a0 [ 92.798562][ C1] l2tp_tunnel_del_work+0x180/0x3d0 [ 92.804184][ C1] process_one_work+0x6c8/0xbb0 [ 92.809319][ C1] worker_thread+0xaa0/0x1250 [ 92.814330][ C1] kthread+0x3f5/0x4f0 [ 92.818443][ C1] ret_from_fork+0x1f/0x30 [ 92.822960][ C1] [ 92.825394][ C1] Last potentially related work creation: [ 92.831276][ C1] kasan_save_stack+0x3a/0x60 [ 92.836864][ C1] __kasan_record_aux_stack+0xd2/0x100 [ 92.842526][ C1] kasan_record_aux_stack_noalloc+0xb/0x10 [ 92.851066][ C1] call_rcu+0x10b/0xf60 [ 92.855449][ C1] pppol2tp_release+0x1e3/0x2b0 [ 92.860331][ C1] sock_close+0xb8/0x200 [ 92.864594][ C1] __fput+0x22b/0x900 [ 92.868595][ C1] ____fput+0x15/0x20 [ 92.872819][ C1] task_work_run+0x127/0x190 [ 92.878073][ C1] exit_to_user_mode_loop+0xd0/0xe0 [ 92.884715][ C1] exit_to_user_mode_prepare+0x87/0xd0 [ 92.891811][ C1] syscall_exit_to_user_mode+0x1a/0x30 [ 92.900867][ C1] do_syscall_64+0x58/0xa0 [ 92.905761][ C1] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 92.913248][ C1] [ 92.915707][ C1] Second to last potentially related work creation: [ 92.922423][ C1] kasan_save_stack+0x3a/0x60 [ 92.928254][ C1] __kasan_record_aux_stack+0xd2/0x100 [ 92.934326][ C1] kasan_record_aux_stack_noalloc+0xb/0x10 [ 92.940522][ C1] call_rcu+0x10b/0xf60 [ 92.950141][ C1] addrconf_permanent_addr+0x302/0x940 [ 92.956202][ C1] addrconf_notify+0x752/0xe00 [ 92.961772][ C1] raw_notifier_call_chain+0x90/0x100 [ 92.968375][ C1] __dev_notify_flags+0x2f4/0x5b0 [ 92.974991][ C1] dev_change_flags+0xe3/0x1a0 [ 92.980170][ C1] do_setlink+0xc95/0x2970 [ 92.984912][ C1] rtnl_newlink+0x1598/0x1900 [ 92.990256][ C1] rtnetlink_rcv_msg+0x9fd/0xcb0 [ 92.995574][ C1] netlink_rcv_skb+0x1e9/0x430 [ 93.000775][ C1] rtnetlink_rcv+0x1c/0x20 [ 93.005814][ C1] netlink_unicast+0x86c/0xa30 [ 93.010929][ C1] netlink_sendmsg+0x879/0xb80 [ 93.016641][ C1] __sys_sendto+0x46d/0x620 [ 93.021264][ C1] __x64_sys_sendto+0xe5/0x100 [ 93.027693][ C1] x64_sys_call+0x178/0x9a0 [ 93.032354][ C1] do_syscall_64+0x4c/0xa0 [ 93.037152][ C1] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 93.043236][ C1] [ 93.045588][ C1] The buggy address belongs to the object at ffff888128fd4400 [ 93.045588][ C1] which belongs to the cache kmalloc-512 of size 512 [ 93.062236][ C1] The buggy address is located 400 bytes inside of [ 93.062236][ C1] 512-byte region [ffff888128fd4400, ffff888128fd4600) [ 93.078841][ C1] The buggy address belongs to the page: [ 93.085234][ C1] page:ffffea0004a3f500 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x128fd4 [ 93.097182][ C1] head:ffffea0004a3f500 order:2 compound_mapcount:0 compound_pincount:0 [ 93.106607][ C1] flags: 0x4000000000010200(slab|head|zone=1) [ 93.113350][ C1] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100042f00 [ 93.123698][ C1] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 93.132845][ C1] page dumped because: kasan: bad access detected [ 93.140028][ C1] page_owner tracks the page as allocated [ 93.146290][ C1] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 286, ts 30239048110, free_ts 0 [ 93.168417][ C1] post_alloc_hook+0x192/0x1b0 [ 93.174241][ C1] prep_new_page+0x1c/0x110 [ 93.179314][ C1] get_page_from_freelist+0x2c3a/0x2cd0 [ 93.185861][ C1] __alloc_pages+0x1a2/0x460 [ 93.190829][ C1] new_slab+0xa0/0x4d0 [ 93.195217][ C1] ___slab_alloc+0x3ac/0x840 [ 93.199939][ C1] __slab_alloc+0x49/0x90 [ 93.204415][ C1] __kmalloc_track_caller+0x169/0x2c0 [ 93.210064][ C1] __alloc_skb+0x210/0x730 [ 93.214497][ C1] netlink_sendmsg+0x611/0xb80 [ 93.219389][ C1] __sys_sendto+0x46d/0x620 [ 93.224322][ C1] __x64_sys_sendto+0xe5/0x100 [ 93.230576][ C1] x64_sys_call+0x178/0x9a0 [ 93.235502][ C1] do_syscall_64+0x4c/0xa0 [ 93.240526][ C1] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 93.246567][ C1] page_owner free stack trace missing [ 93.252319][ C1] [ 93.254838][ C1] Memory state around the buggy address: [ 93.260918][ C1] ffff888128fd4480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 93.269167][ C1] ffff888128fd4500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 93.277371][ C1] >ffff888128fd4580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 93.286600][ C1] ^ [ 93.291946][ C1] ffff888128fd4600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 93.300830][ C1] ffff888128fd4680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 93.310083][ C1] ================================================================== [ 93.318488][ C1] Disabling lock debugging due to kernel taint [ 93.326566][ T1346] usb 4-1: USB disconnect, device number 6 [ 93.549108][ T20] hid-generic 0003:057E:2019.0007: unknown main item tag 0x0 [ 93.560442][ T20] hid-generic 0003:057E:2019.0007: unknown main item tag 0x4 [ 93.567881][ T20] hid-generic 0003:057E:2019.0007: unknown main item tag 0xd [ 93.576592][ T20] hid-generic 0003:057E:2019.0007: unknown main item tag 0xe [ 93.584373][ T20] hid-generic 0003:057E:2019.0007: unknown main item tag 0x1 [ 93.595273][ T20] hid-generic 0003:057E:2019.0007: item fetching failed at offset 30/40 [ 93.607974][ T20] hid-generic: probe of 0003:057E:2019.0007 failed with error -22 [ 93.752515][ T20] usb 3-1: USB disconnect, device number 7