last executing test programs: 19.214536029s ago: executing program 3 (id=128): syz_emit_ethernet(0x0, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x94) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) socket$nl_netfilter(0x10, 0x3, 0xc) close(r2) socket$l2tp6(0xa, 0x2, 0x73) shutdown(r2, 0x0) recvmmsg(r2, &(0x7f00000055c0), 0x400023c, 0x300, 0x0) 17.403140268s ago: executing program 4 (id=133): mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000140)='4\x00', 0x2) r1 = userfaultfd(0x1) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x280}) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000c9b20141710000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x94) syz_emit_ethernet(0x42, &(0x7f0000000100)=ANY=[], 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x6382c1, 0x0) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f000001b700)=""/102392, 0x18ff8) socket$netlink(0x10, 0x3, 0x0) ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, &(0x7f0000000040)={0x82, 0x3, 0x0, 0x717e387b, 0x3d, "1a004e0078768000", 0x4, 0x2}) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000000)=0x15) ioctl$TCSETS(r4, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400000, 0x14, "3eccd8000000000000000010000000040100"}) 15.682487997s ago: executing program 0 (id=136): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1e00000000000000"], 0x48) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x2f) capget(&(0x7f0000000100)={0x20080522, r0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x15, 0x1c, &(0x7f0000000000)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {0x7, 0x0, 0xb, 0x6, 0x0, 0x0, 0x5}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0x6, 0x9}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x5, 0x1, 0xa, 0x9, 0x9}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {0x7, 0x0, 0xc}, {0x18, 0x6, 0x2, 0x0, r3}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect(0x0, 0x24, 0x0, 0x0) 13.27370359s ago: executing program 2 (id=140): syz_usb_disconnect(0xffffffffffffffff) syz_usb_connect(0x3, 0x2d, &(0x7f00000002c0)=ANY=[@ANYBLOB="12011003faff82083910012181250102030109021b00028c4400600904"], &(0x7f00000011c0)={0x0, 0x0, 0x0, 0x0}) r0 = socket(0x23, 0x3, 0x1) socket(0x3, 0x3, 0x0) sendto$rose(r0, 0x0, 0x0, 0x4000000, &(0x7f0000000040)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, 0x1, @default}, 0x1c) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x9}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$TIOCL_SETVESABLANK(0xffffffffffffffff, 0x541c, &(0x7f0000000200)) r2 = syz_io_uring_setup(0x5c2, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x8003}, &(0x7f0000000240)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffff0, 0x0, 0x4) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000180)={0x48}) r5 = socket$phonet_pipe(0x23, 0x5, 0x2) syz_io_uring_submit(r3, r4, &(0x7f00000004c0)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x0, 0x11, r5, 0x0, 0x0, 0x0, 0x1, 0x1, {0x3}}) io_uring_enter(r2, 0x68be, 0x5002, 0x4, 0x0, 0x0) 12.995393196s ago: executing program 3 (id=141): ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000faff0000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000007100000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r3, 0x0, 0x5}, 0x18) r4 = syz_open_dev$evdev(&(0x7f0000000040), 0x2, 0x0) ioctl$EVIOCGRAB(r4, 0x40044590, 0x0) close(r4) r5 = io_uring_setup(0x2f00, &(0x7f0000000700)={0x0, 0xe8e2, 0x400, 0x20001, 0x2d6}) io_uring_register$IORING_REGISTER_BUFFERS(r5, 0x0, 0x0, 0x0) io_uring_setup(0x7625, &(0x7f0000000600)={0x0, 0x653f, 0x0, 0x0, 0x28e, 0x0, r5}) bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) 12.542340392s ago: executing program 0 (id=142): prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xa, 0x0, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000080)={0x84, @local, 0x15, 0x3, 'sh\x00', 0x19, 0x5, 0x71}, 0x2c) r2 = socket$kcm(0xa, 0x2, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r3, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e24, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x10000, 0xc, 0x2}}, 0x44) sendmsg$sock(r2, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) sendmsg$sock(r2, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e23, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0xfffffffc}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)={0x1c, 0x1a, 0x1, 0x0, 0x0, "", [@typed={0xa, 0x3ffc, 0x0, 0x0, @str=':*^${\x00'}]}, 0x1c}], 0x1}, 0x0) 12.51512072s ago: executing program 4 (id=143): syz_emit_vhci(&(0x7f0000001240)=@HCI_EVENT_PKT={0x4, @hci_ev_simple_pair_complete={{0x36, 0x7}, {0x3, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}}}, 0xa) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x20000, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x2, 0x0) r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x1) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x8) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) mprotect(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, 0x0, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$qrtrtun(r0, &(0x7f0000000380)="ca091cc2e088", 0xffe3) process_vm_readv(0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x0}], 0x1, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=[0x7, 0x5], &(0x7f0000000240), 0x0, 0x2}}, 0x40) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) mremap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000001000/0x1000)=nil) memfd_create(&(0x7f0000000400)='\xaa\xaa\xaa\xaa\xaa', 0x2cb0b06e54de6bea) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) 11.931739277s ago: executing program 3 (id=145): timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, 0x0) rt_sigtimedwait(0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) getpid() mmap(&(0x7f0000769000/0x2000)=nil, 0x2000, 0xb635773f06ebbee8, 0x8031, r0, 0x0) r3 = syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000032680)=""/102400, 0x19000) socket$unix(0x1, 0x1, 0x0) socket$unix(0x1, 0x1, 0x0) write$cgroup_pid(r2, &(0x7f0000000000), 0xffffff98) splice(r1, 0x0, r0, 0x0, 0x100000004, 0x0) 11.025747307s ago: executing program 4 (id=146): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x8031, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x5c}) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000700)={{0x12, 0x1, 0x201, 0xd6, 0x90, 0x22, 0x40, 0xb48, 0x1009, 0x6806, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xe, 0xc, 0xa0, 0x32, [{{0x9, 0x4, 0x33, 0xfb, 0x0, 0xad, 0x55, 0x17, 0x2}}]}}]}}, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0}) fspick(0xffffffffffffff9c, 0x0, 0xf) syz_usb_disconnect(r1) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000600), 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x40000) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000010000/0x1000)=nil, 0x1000}, 0x1}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) close(r0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000900000000000000213f0000c50000000e800000850000000e00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='mmap_lock_acquire_returned\x00', r2}, 0x10) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xa, 0x31, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00304, 0x17) 10.646142176s ago: executing program 0 (id=147): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) ioctl$KVM_GET_IRQCHIP(0xffffffffffffffff, 0xc208ae62, 0x0) timer_settime(0x0, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x1) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x10}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000bfe000/0x400000)=nil) r2 = socket(0xa, 0x5, 0x0) setsockopt$inet6_buf(r2, 0x29, 0x32, &(0x7f0000000140), 0x0) close_range(r0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r3, 0x40045532, &(0x7f00000000c0)=0x2) openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_G_DV_TIMINGS(0xffffffffffffffff, 0xc0845658, &(0x7f0000000180)={0x0, @reserved}) 10.079471456s ago: executing program 3 (id=148): r0 = getpgrp(0x0) sched_setaffinity(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000002000)=""/102400, 0x19000) close(0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'veth1_virt_wifi\x00', 0x0}) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x100}}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', r4, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000a00)={r5, r4, 0x25, 0x8, @val=@netkit={@void, @value=r5}}, 0x1c) 9.625504426s ago: executing program 1 (id=149): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) dup(0xffffffffffffffff) io_uring_setup(0xd71, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4048854}, 0x40010) r1 = gettid() timer_create(0x0, &(0x7f0000000180)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)=0x0) timer_settime(r2, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000940)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r5, 0x0, 0xf3a, 0x0) ioctl$sock_SIOCINQ(r4, 0x541b, &(0x7f00000003c0)) r6 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r6, 0x107, 0x7, &(0x7f0000000100)=0x4000200, 0x4) setsockopt$packet_tx_ring(r6, 0x107, 0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4040c00) 9.379460803s ago: executing program 2 (id=150): openat$nullb(0xffffffffffffff9c, 0x0, 0x147c40, 0x0) keyctl$clear(0x5, 0xffffffffffffffff) r0 = getpid() syz_pidfd_open(r0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=@newtaction={0x5c, 0x30, 0x301, 0x0, 0x0, {}, [{0x48, 0x1, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xffffffff}}]}, {0x5b}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x5c}}, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, &(0x7f0000000300)={0x6a, {{0x2, 0x4e22, @broadcast}}}, 0x88) r4 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r4, 0x0, 0x0) ioctl$SIOCPNENABLEPIPE(r4, 0x89ed, 0x0) 9.183005937s ago: executing program 0 (id=151): ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_SET_SIGNAL_MASK(0xffffffffffffffff, 0x4004ae8b, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) r1 = socket$xdp(0x2c, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) gettid() setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/59, 0x312000, 0x800, 0x0, 0x5}, 0x20) ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) 8.535437217s ago: executing program 1 (id=152): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000140)={0xc, 0x8b}, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2c, 0x0, 0x0) pipe(&(0x7f0000000040)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r5, 0x0, 0x0, 0x0) recvmmsg(r4, 0x0, 0x0, 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000440)='B'}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000540)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f00000004c0)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r3}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 8.403313691s ago: executing program 2 (id=153): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = syz_open_procfs(r1, &(0x7f0000000300)='net/dev\x00') preadv(r4, &(0x7f0000000700)=[{&(0x7f0000000140)=""/82, 0x52}], 0x1, 0x4782, 0x7) write$UHID_CREATE2(0xffffffffffffffff, 0x0, 0x118) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) 7.286955378s ago: executing program 2 (id=154): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0x3, &(0x7f0000000740)=@framed, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x18) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) io_setup(0x2004, 0x0) tkill(0x0, 0x16) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x123f41, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000040)=0xd) write$binfmt_aout(r4, &(0x7f0000000280)=ANY=[], 0xff2e) ioctl$TCFLSH(r4, 0x540b, 0x1) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) 6.475478097s ago: executing program 4 (id=155): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r4, 0xfffffffc) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000180)={0x1}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000002000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000040)="0f01cb650f741065666765f36f0f330f09660f3a0cb9000000752066b9800000c00f326635004000000f300f01d7ba4100ed", 0x32}], 0x1, 0x4498bda7e2139f51, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_PIT(r3, 0x8048ae66, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000000)={0x1, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f00000003c0)={[0x0, 0x0, 0x8000, 0x40, 0x0, 0x0, 0x2004cb, 0x0, 0xfffffffffffffffe, 0x5, 0x7fff, 0x1000200004, 0x4, 0x2, 0x0, 0x1], 0x8080000}) ioctl$KVM_RUN(r5, 0xae80, 0x0) 6.211538202s ago: executing program 2 (id=156): r0 = socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0xc000001, &(0x7f0000000a00), 0x0, 0x12}) r3 = fsmount(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000240)={'veth1_to_bond\x00', {0x2, 0x4e23, @multicast2}}) openat$cgroup_int(r3, &(0x7f00000001c0)='cgroup.max.descendants\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000000)={0x40000000, 0x0, 0x0}, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast2, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0xfffffffffffffffc, 0xff}, 0x0, 0x0, 0x1, 0x0, 0x2}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe8) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x1c) 6.066925979s ago: executing program 1 (id=157): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1805000000000000000000004b64ffec8500000075000000040000000700000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f00000010c0)={@in6={{0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @broadcast}}}, 0x0, 0x0, 0xc, 0x0, "61a1ed8439cde8054f2ada6fcd5fe76b933e8bb0ac60081e33dffa150835f7519d5f73b4e1d80eb4881a5b98cb9fb96d225d602392f816d0bdcc09b5063087117502d8c24f1fe97f61fd27a06d6a38a7"}, 0xd8) mkdir(&(0x7f0000000200)='./file0\x00', 0x28e08a7aa33ba155) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) r5 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) r6 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r6, 0xc004500a, &(0x7f0000000000)) ioctl$SNDCTL_DSP_SPEED(r6, 0xc0045002, &(0x7f00000001c0)) ioctl$SNDCTL_DSP_CHANNELS(r6, 0xc0045006, &(0x7f0000000040)=0xc) ioctl$SNDCTL_DSP_SETFMT(r6, 0xc0045005, &(0x7f0000000640)=0x10) close(r6) 5.756468326s ago: executing program 0 (id=158): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r2 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000380)={'wlan1\x00', 0x8000}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)={0x24, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB], 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x28, r1, 0x5, 0x3, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}]}, 0x28}}, 0x0) r8 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r8, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) r9 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r9, &(0x7f0000000600)={0x0, 0xc, &(0x7f0000000000)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) r10 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r10, &(0x7f0000000040)={0x18, 0x0, {0x3, @random="00ff00", 'bond0\x00'}}, 0x1e) sendmmsg(r10, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}}], 0x3e8, 0x0) 4.840529304s ago: executing program 1 (id=159): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000002, 0x1010, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(0xffffffffffffffff, 0xc02064b9, &(0x7f0000000dc0)={0x0, &(0x7f0000000200)}) ioctl$DRM_IOCTL_MODE_ATOMIC(0xffffffffffffffff, 0xc03864bc, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000004c00)=""/102392, 0x18ff8) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000001640)=@mangle={'mangle\x00', 0x44, 0x6, 0x3e0, 0x2a8, 0x98, 0x2a8, 0x130, 0x1f0, 0x370, 0x370, 0x370, 0x370, 0x370, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'batadv_slave_1\x00', 'veth1_virt_wifi\x00', {}, {}, 0x11, 0x0, 0x69}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@ttl={{0x28}, {0x2, 0xa}}]}, @unspec=@CHECKSUM={0x28}}, {{@ip={@loopback, @empty, 0x0, 0x0, 'syzkaller0\x00', 'dvmrp1\x00', {}, {}, 0x6}, 0x0, 0x70, 0xb8}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz0\x00', 0x1, 0x3, {0x5}}}}, {{@ip={@broadcast, @dev={0xac, 0x14, 0x14, 0x18}, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x440) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000240)=@newqdisc={0x60, 0x24, 0xd0f, 0x3, 0x0, {0x60, 0x0, 0x0, r4, {0x0, 0x3}, {0xffff, 0xffff}, {0x4, 0xffe0}}, [@TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xd, 0x5, 0x8, 0x800, 0x0, 0x1aa2, 0xc, 0x1}}, {0x6, 0x2, [0x8]}}]}, @qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x60}, 0x1, 0x0, 0x0, 0x1d4}, 0x8840) 4.431575382s ago: executing program 3 (id=160): openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000340)={@in={{0x2, 0x4e22, @local}}, 0x0, 0x0, 0x33, 0x0, "cebd7ceedb7b0ad952e966bbe242b92b746b023df2cb59e32e10366456deac64e782206bd4aee372005a52a40b7161161a8b2749fe184fb0d08bc63f90010a1ed2bf603d2c3fcc250c30136f9ef2ef8b"}, 0xd8) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x47fa, 0x2}) r2 = syz_io_uring_setup(0x497, &(0x7f00000000c0)={0x0, 0x7079, 0x400, 0x1, 0x288}, &(0x7f0000000140)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r5 = socket(0x200000000000011, 0x2, 0x1) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000300)={'sit0\x00', 0x0}) bind$packet(r5, &(0x7f0000000080)={0x11, 0xd, r6, 0x1, 0x0, 0x6, @remote}, 0x14) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd=r5, 0x0, 0x0}) io_uring_enter(r2, 0x3516, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_MM(0x23, 0x7, &(0x7f0000ffd000/0x1000)=nil) getpid() socket$inet6(0xa, 0x2, 0x0) 4.189170108s ago: executing program 4 (id=161): r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r2, 0x3ba0, &(0x7f0000000440)={0x48, 0x1, r3, 0x0, 0x0, 0x7fffffe}) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_io_uring_setup(0xcaf, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f0000000140)={0x28, 0x6, r3, 0x0, &(0x7f0000ff6000/0xa000)=nil, 0xa000}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r2, 0x3ba0, &(0x7f0000000180)={0x48, 0x2, r3}) ioctl$SIOCSIFHWADDR(r1, 0x8b2b, &(0x7f0000000040)={'wlan1\x00', @random="010000000002"}) ioctl(r0, 0x8b2a, &(0x7f0000000040)) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f0000000080), &(0x7f00000000c0)=0x30) ioctl$USBDEVFS_GET_CAPABILITIES(0xffffffffffffffff, 0x8004551a, &(0x7f0000000180)) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000400)={0xffffffffffffffff, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140), ""/16, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, &(0x7f0000000340)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000240), 0x0, 0x26, &(0x7f0000000200), 0x0, 0x10, &(0x7f0000000200), &(0x7f0000000280), 0x8, 0x93, 0x8, 0x8, &(0x7f00000002c0)}}, 0x10) 4.187663828s ago: executing program 1 (id=162): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000240), 0x2, 0x40102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x20000000000000cc) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000740)={'wlan1\x00'}) sendmsg$NL80211_CMD_REGISTER_FRAME(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=ANY=[], 0x28}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={0x0}}, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r3 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x20080, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r3, 0xc004500a, &(0x7f0000000080)=0x80000003) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x42031, 0xffffffffffffffff, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)={0xb0, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfd, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ip6tnl0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'xfrm0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'vxcan1\x00'}}]}, 0xb0}, 0x1, 0x0, 0x0, 0x4000001}, 0x20c4) r4 = dup2(r3, r3) read$FUSE(r4, &(0x7f00000063c0)={0x2020}, 0x2020) syz_usb_connect(0x1, 0x2d, 0x0, 0x0) 4.05235152s ago: executing program 2 (id=163): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x802, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89101) r2 = openat$cgroup_ro(r1, &(0x7f00000002c0)='blkio.throttle.io_serviced_recursive\x00', 0x275a, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x220401, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x3, 0x0) socket$inet6(0xa, 0x3, 0x8000000003c) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$kcm(0x2, 0xa, 0x2) socket$inet6(0xa, 0x80002, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) clock_adjtime(0x0, &(0x7f00000001c0)={0x8b8d, 0x1000000000000, 0x512, 0x7, 0x0, 0xfffffffffffffffd, 0xe00, 0x8000000000, 0x80, 0xffc99a3b, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x1, 0x10007f, 0x0, 0x0, 0x0, 0x60d2, 0x0, 0x5, 0x1, 0x2}) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x0) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000000200)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2407000005000000000000000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r1, @ANYBLOB="05", @ANYRES8=r0, @ANYRES8, @ANYRES16=r2, @ANYRES16=r3], 0x0) 179.607722ms ago: executing program 1 (id=164): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = syz_io_uring_setup(0xa0, &(0x7f0000000100)={0x0, 0x200089bd, 0x80, 0x1, 0x385}, &(0x7f0000000240)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000300)=0xfffffffc, 0x0, 0x4) io_uring_register$IORING_REGISTER_PERSONALITY(r4, 0x9, 0x0, 0x0) syz_io_uring_submit(r5, r6, 0x0) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 119.655062ms ago: executing program 4 (id=165): r0 = socket(0x10, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_emit_ethernet(0x383, 0x0, 0x0) memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f00000000c0)={0x4, 0x5, 0x2, 0x6, 0x11, "cc4b3607a71aa44e0663ec52de35c6b2f9bde7"}) r4 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r4, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @dev={0xac, 0x14, 0x14, 0x32}}, 0xc) r5 = syz_open_procfs(0x0, &(0x7f0000002180)='net/mcfilter\x00') preadv(r5, &(0x7f0000000040)=[{&(0x7f0000000140)=""/79, 0x4f}], 0x1, 0x1, 0xffffff7d) 82.25263ms ago: executing program 3 (id=166): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) keyctl$set_reqkey_keyring(0xf, 0xfffffffb) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r4, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) connect$inet6(r4, &(0x7f0000000340)={0x2, 0x4e21, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, 0x1c) r5 = socket$netlink(0x10, 0x3, 0x4) writev(r5, &(0x7f0000000000)=[{&(0x7f00000001c0)="580000001500add427323b472545b45602117fffffff81000e224e217f000001925aa80020007b00090080007f000001e809000000ff0000f03ac71036000000ffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1) 0s ago: executing program 0 (id=167): socketpair$unix(0x1, 0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) connect$inet6(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r3, 0x0, r5, 0x0, 0x88000cc, 0x1000000000000000) fcntl$setpipe(r4, 0x407, 0x1000000300007) write$eventfd(r4, &(0x7f0000000240), 0xffffff14) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.196' (ED25519) to the list of known hosts. [ 56.675424][ T30] audit: type=1400 audit(1765140026.503:62): avc: denied { mounton } for pid=5799 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 56.699036][ T30] audit: type=1400 audit(1765140026.523:63): avc: denied { mount } for pid=5799 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 56.701450][ T5799] cgroup: Unknown subsys name 'net' [ 56.728094][ T30] audit: type=1400 audit(1765140026.553:64): avc: denied { unmount } for pid=5799 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 56.844810][ T5799] cgroup: Unknown subsys name 'cpuset' [ 56.852728][ T5799] cgroup: Unknown subsys name 'rlimit' [ 57.071917][ T30] audit: type=1400 audit(1765140026.893:65): avc: denied { setattr } for pid=5799 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=820 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 57.104205][ T30] audit: type=1400 audit(1765140026.903:66): avc: denied { create } for pid=5799 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 57.130403][ T30] audit: type=1400 audit(1765140026.903:67): avc: denied { write } for pid=5799 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 57.162084][ T30] audit: type=1400 audit(1765140026.903:68): avc: denied { read } for pid=5799 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 57.182614][ T30] audit: type=1400 audit(1765140026.913:69): avc: denied { mounton } for pid=5799 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 57.200563][ T5803] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 57.207763][ T30] audit: type=1400 audit(1765140026.913:70): avc: denied { mount } for pid=5799 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 57.239821][ T30] audit: type=1400 audit(1765140027.063:71): avc: denied { relabelto } for pid=5803 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 58.193530][ T5799] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 60.048068][ T5816] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 60.061825][ T5815] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 60.070900][ T5815] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 60.078384][ T5815] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 60.083014][ T5822] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 60.086143][ T5815] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 60.094596][ T5822] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 60.100196][ T5815] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 60.106802][ T5822] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 60.121728][ T5822] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 60.130812][ T5818] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 60.132242][ T5824] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 60.145572][ T5824] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 60.146378][ T5822] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 60.152816][ T5818] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 60.160927][ T5822] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 60.168430][ T5818] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 60.174779][ T5822] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 60.181808][ T5818] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 60.195591][ T5818] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 60.217090][ T5822] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 60.227172][ T5822] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 60.234641][ T5816] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 60.254184][ T5816] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 60.262312][ T5816] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 60.654911][ T5819] chnl_net:caif_netlink_parms(): no params data found [ 60.757930][ T5811] chnl_net:caif_netlink_parms(): no params data found [ 60.774401][ T5817] chnl_net:caif_netlink_parms(): no params data found [ 60.873792][ T5825] chnl_net:caif_netlink_parms(): no params data found [ 60.886565][ T5812] chnl_net:caif_netlink_parms(): no params data found [ 60.928928][ T5819] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.936681][ T5819] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.944017][ T5819] bridge_slave_0: entered allmulticast mode [ 60.950683][ T5819] bridge_slave_0: entered promiscuous mode [ 60.991735][ T5819] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.998895][ T5819] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.006228][ T5819] bridge_slave_1: entered allmulticast mode [ 61.013031][ T5819] bridge_slave_1: entered promiscuous mode [ 61.030436][ T5811] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.037804][ T5811] bridge0: port 1(bridge_slave_0) entered disabled state [ 61.045204][ T5811] bridge_slave_0: entered allmulticast mode [ 61.051793][ T5811] bridge_slave_0: entered promiscuous mode [ 61.080086][ T5811] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.087170][ T5811] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.094345][ T5811] bridge_slave_1: entered allmulticast mode [ 61.100990][ T5811] bridge_slave_1: entered promiscuous mode [ 61.107644][ T5817] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.114777][ T5817] bridge0: port 1(bridge_slave_0) entered disabled state [ 61.121860][ T5817] bridge_slave_0: entered allmulticast mode [ 61.128659][ T5817] bridge_slave_0: entered promiscuous mode [ 61.156484][ T5817] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.163633][ T5817] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.170709][ T5817] bridge_slave_1: entered allmulticast mode [ 61.177597][ T5817] bridge_slave_1: entered promiscuous mode [ 61.185987][ T5819] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 61.222183][ T5819] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 61.248164][ T5811] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 61.279354][ T5825] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.286648][ T5825] bridge0: port 1(bridge_slave_0) entered disabled state [ 61.293879][ T5825] bridge_slave_0: entered allmulticast mode [ 61.300513][ T5825] bridge_slave_0: entered promiscuous mode [ 61.309091][ T5811] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 61.319829][ T5817] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 61.336397][ T5812] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.343504][ T5812] bridge0: port 1(bridge_slave_0) entered disabled state [ 61.350616][ T5812] bridge_slave_0: entered allmulticast mode [ 61.357731][ T5812] bridge_slave_0: entered promiscuous mode [ 61.364690][ T5825] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.371765][ T5825] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.379119][ T5825] bridge_slave_1: entered allmulticast mode [ 61.385884][ T5825] bridge_slave_1: entered promiscuous mode [ 61.401452][ T5817] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 61.411898][ T5819] team0: Port device team_slave_0 added [ 61.417681][ T5812] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.425144][ T5812] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.432862][ T5812] bridge_slave_1: entered allmulticast mode [ 61.439463][ T5812] bridge_slave_1: entered promiscuous mode [ 61.474633][ T5819] team0: Port device team_slave_1 added [ 61.496046][ T5811] team0: Port device team_slave_0 added [ 61.517641][ T5812] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 61.528638][ T5825] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 61.539852][ T5811] team0: Port device team_slave_1 added [ 61.547386][ T5817] team0: Port device team_slave_0 added [ 61.561434][ T5812] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 61.573019][ T5825] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 61.590319][ T5817] team0: Port device team_slave_1 added [ 61.596576][ T5819] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 61.603674][ T5819] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 61.629642][ T5819] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 61.674258][ T5819] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 61.681203][ T5819] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 61.707455][ T5819] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 61.735387][ T5811] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 61.742428][ T5811] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 61.768366][ T5811] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 61.791918][ T5812] team0: Port device team_slave_0 added [ 61.799090][ T5825] team0: Port device team_slave_0 added [ 61.805572][ T5811] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 61.813117][ T5811] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 61.839046][ T5811] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 61.850635][ T5817] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 61.857794][ T5817] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 61.883840][ T5817] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 61.897130][ T5812] team0: Port device team_slave_1 added [ 61.903986][ T5825] team0: Port device team_slave_1 added [ 61.914935][ T5817] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 61.921880][ T5817] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 61.948219][ T5817] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 62.023628][ T5812] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 62.030579][ T5812] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 62.057055][ T5812] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 62.068527][ T5825] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 62.075794][ T5825] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 62.101704][ T5825] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 62.116095][ T5811] hsr_slave_0: entered promiscuous mode [ 62.122318][ T5811] hsr_slave_1: entered promiscuous mode [ 62.131583][ T5819] hsr_slave_0: entered promiscuous mode [ 62.137676][ T5819] hsr_slave_1: entered promiscuous mode [ 62.143748][ T5819] debugfs: 'hsr0' already exists in 'hsr' [ 62.149518][ T5819] Cannot create hsr debugfs directory [ 62.156454][ T5812] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 62.163441][ T5812] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 62.189326][ T5812] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 62.201322][ T5825] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 62.209131][ T5825] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 62.236355][ T5818] Bluetooth: hci2: command tx timeout [ 62.242079][ T5825] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 62.282680][ T5818] Bluetooth: hci4: command tx timeout [ 62.282682][ T5816] Bluetooth: hci1: command tx timeout [ 62.293766][ T5822] Bluetooth: hci0: command tx timeout [ 62.299810][ T5818] Bluetooth: hci3: command tx timeout [ 62.325792][ T5817] hsr_slave_0: entered promiscuous mode [ 62.331831][ T5817] hsr_slave_1: entered promiscuous mode [ 62.337924][ T5817] debugfs: 'hsr0' already exists in 'hsr' [ 62.343871][ T5817] Cannot create hsr debugfs directory [ 62.423823][ T5812] hsr_slave_0: entered promiscuous mode [ 62.429851][ T5812] hsr_slave_1: entered promiscuous mode [ 62.436308][ T5812] debugfs: 'hsr0' already exists in 'hsr' [ 62.442180][ T5812] Cannot create hsr debugfs directory [ 62.454017][ T5825] hsr_slave_0: entered promiscuous mode [ 62.460142][ T5825] hsr_slave_1: entered promiscuous mode [ 62.466184][ T5825] debugfs: 'hsr0' already exists in 'hsr' [ 62.471906][ T5825] Cannot create hsr debugfs directory [ 62.766837][ T5811] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 62.780208][ T5811] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 62.803864][ T5811] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 62.819244][ T5811] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 62.851551][ T5819] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 62.862814][ T5819] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 62.890687][ T5819] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 62.901895][ T5819] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 62.937060][ T5817] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 62.951369][ T5817] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 62.962651][ T5817] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 62.974399][ T5817] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 63.045964][ T5812] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 63.070560][ T5812] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 63.080754][ T5812] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 63.090754][ T5812] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 63.171522][ T5825] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 63.181695][ T5825] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 63.196550][ T5825] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 63.206449][ T5825] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 63.219383][ T5811] 8021q: adding VLAN 0 to HW filter on device bond0 [ 63.285355][ T5811] 8021q: adding VLAN 0 to HW filter on device team0 [ 63.304956][ T5817] 8021q: adding VLAN 0 to HW filter on device bond0 [ 63.327758][ T62] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.335033][ T62] bridge0: port 1(bridge_slave_0) entered forwarding state [ 63.345440][ T62] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.352559][ T62] bridge0: port 2(bridge_slave_1) entered forwarding state [ 63.380747][ T5819] 8021q: adding VLAN 0 to HW filter on device bond0 [ 63.397534][ T5817] 8021q: adding VLAN 0 to HW filter on device team0 [ 63.420087][ T5812] 8021q: adding VLAN 0 to HW filter on device bond0 [ 63.432850][ T4153] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.440015][ T4153] bridge0: port 1(bridge_slave_0) entered forwarding state [ 63.464686][ T4153] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.471755][ T4153] bridge0: port 2(bridge_slave_1) entered forwarding state [ 63.481702][ T5819] 8021q: adding VLAN 0 to HW filter on device team0 [ 63.506843][ T4153] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.513934][ T4153] bridge0: port 1(bridge_slave_0) entered forwarding state [ 63.536506][ T5812] 8021q: adding VLAN 0 to HW filter on device team0 [ 63.547964][ T3445] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.555143][ T3445] bridge0: port 2(bridge_slave_1) entered forwarding state [ 63.576499][ T62] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.583593][ T62] bridge0: port 1(bridge_slave_0) entered forwarding state [ 63.613724][ T4153] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.620849][ T4153] bridge0: port 2(bridge_slave_1) entered forwarding state [ 63.681462][ T30] kauditd_printk_skb: 12 callbacks suppressed [ 63.681477][ T30] audit: type=1400 audit(1765140033.503:84): avc: denied { sys_module } for pid=5811 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 63.726760][ T5825] 8021q: adding VLAN 0 to HW filter on device bond0 [ 63.767686][ T5825] 8021q: adding VLAN 0 to HW filter on device team0 [ 63.835477][ T1084] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.842633][ T1084] bridge0: port 1(bridge_slave_0) entered forwarding state [ 63.876603][ T1084] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.883760][ T1084] bridge0: port 2(bridge_slave_1) entered forwarding state [ 64.005906][ T5811] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 64.016368][ T5817] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 64.147750][ T5811] veth0_vlan: entered promiscuous mode [ 64.168015][ T5817] veth0_vlan: entered promiscuous mode [ 64.184061][ T5819] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 64.193443][ T5812] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 64.221735][ T5811] veth1_vlan: entered promiscuous mode [ 64.249403][ T5817] veth1_vlan: entered promiscuous mode [ 64.273890][ T5811] veth0_macvtap: entered promiscuous mode [ 64.293136][ T5818] Bluetooth: hci2: command tx timeout [ 64.304610][ T5811] veth1_macvtap: entered promiscuous mode [ 64.362842][ T5822] Bluetooth: hci3: command tx timeout [ 64.362894][ T5816] Bluetooth: hci0: command tx timeout [ 64.368257][ T5138] Bluetooth: hci4: command tx timeout [ 64.374677][ T5818] Bluetooth: hci1: command tx timeout [ 64.391900][ T5811] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 64.408518][ T5819] veth0_vlan: entered promiscuous mode [ 64.421299][ T5811] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 64.431872][ T5817] veth0_macvtap: entered promiscuous mode [ 64.465643][ T5817] veth1_macvtap: entered promiscuous mode [ 64.472846][ T4153] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.494902][ T5825] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 64.501894][ T4153] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.512737][ T4153] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.526146][ T4153] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.536067][ T5819] veth1_vlan: entered promiscuous mode [ 64.597952][ T5817] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 64.635620][ T5817] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 64.666498][ T5819] veth0_macvtap: entered promiscuous mode [ 64.667094][ T2122] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.689251][ T62] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.692086][ T2122] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.710445][ T5812] veth0_vlan: entered promiscuous mode [ 64.720180][ T62] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.731392][ T5819] veth1_macvtap: entered promiscuous mode [ 64.755850][ T62] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.767004][ T5825] veth0_vlan: entered promiscuous mode [ 64.781598][ T62] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.805644][ T5812] veth1_vlan: entered promiscuous mode [ 64.813937][ T1084] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.833904][ T1084] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.853485][ T30] audit: type=1400 audit(1765140034.683:85): avc: denied { mounton } for pid=5811 comm="syz-executor" path="/root/syzkaller.o97u9v/syz-tmp" dev="sda1" ino=2041 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 64.879050][ T30] audit: type=1400 audit(1765140034.703:86): avc: denied { mount } for pid=5811 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 64.885828][ T5819] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 64.908776][ T30] audit: type=1400 audit(1765140034.703:87): avc: denied { mounton } for pid=5811 comm="syz-executor" path="/root/syzkaller.o97u9v/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 64.949433][ T5825] veth1_vlan: entered promiscuous mode [ 64.975153][ T30] audit: type=1400 audit(1765140034.703:88): avc: denied { mount } for pid=5811 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 64.995792][ T5825] veth0_macvtap: entered promiscuous mode [ 65.002530][ T62] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.006837][ T5825] veth1_macvtap: entered promiscuous mode [ 65.010358][ T62] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.026212][ T5811] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 65.027178][ T5819] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 65.049557][ T30] audit: type=1400 audit(1765140034.703:89): avc: denied { mounton } for pid=5811 comm="syz-executor" path="/root/syzkaller.o97u9v/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 65.077361][ T30] audit: type=1400 audit(1765140034.703:90): avc: denied { mounton } for pid=5811 comm="syz-executor" path="/root/syzkaller.o97u9v/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=6969 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 65.101638][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.113935][ T30] audit: type=1400 audit(1765140034.763:91): avc: denied { unmount } for pid=5811 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 65.121859][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.138294][ T30] audit: type=1400 audit(1765140034.773:92): avc: denied { mounton } for pid=5811 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2784 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 65.164450][ T30] audit: type=1400 audit(1765140034.773:93): avc: denied { mount } for pid=5811 comm="syz-executor" name="/" dev="gadgetfs" ino=7589 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 65.196584][ T1084] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.206010][ T1084] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.251329][ T1084] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.270608][ T1084] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.286834][ T5812] veth0_macvtap: entered promiscuous mode [ 65.297359][ T5825] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 65.319986][ T5812] veth1_macvtap: entered promiscuous mode [ 65.350259][ T5825] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 65.414445][ T4153] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.429520][ T4153] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.453402][ T4153] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.473117][ T4153] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.505052][ T5812] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 65.513361][ T3746] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.521183][ T3746] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.569604][ T5812] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 65.586751][ T3746] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.595331][ T3746] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.619538][ T3746] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.628504][ T3746] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.660870][ T3746] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.670325][ T977] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 65.687557][ T3746] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.845481][ T1084] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.899740][ T977] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 65.927804][ T1084] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.940131][ T977] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 66.016788][ T977] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 66.029867][ T1084] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.051239][ T977] usb 4-1: config 1 has no interface number 1 [ 66.058237][ T1084] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.065900][ T977] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 66.081757][ T977] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 66.093471][ T977] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 66.103915][ T977] usb 4-1: Product: syz [ 66.108185][ T977] usb 4-1: Manufacturer: syz [ 66.116364][ T977] usb 4-1: SerialNumber: syz [ 66.121518][ T1084] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.145765][ T1084] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.204207][ T62] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.234054][ T62] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.362900][ T5818] Bluetooth: hci2: command tx timeout [ 66.442226][ T5816] Bluetooth: hci0: command tx timeout [ 66.448650][ T5138] Bluetooth: hci3: command tx timeout [ 66.448660][ T5822] Bluetooth: hci4: command tx timeout [ 66.452056][ T5818] Bluetooth: hci1: command tx timeout [ 66.555895][ T5929] Zero length message leads to an empty skb [ 66.792117][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 66.896495][ T5947] ======================================================= [ 66.896495][ T5947] WARNING: The mand mount option has been deprecated and [ 66.896495][ T5947] and is ignored by this kernel. Remove the mand [ 66.896495][ T5947] option from the mount to silence this warning. [ 66.896495][ T5947] ======================================================= [ 66.965871][ T5945] syzkaller0: entered promiscuous mode [ 66.993681][ T5945] syzkaller0: entered allmulticast mode [ 67.122553][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 67.282688][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 67.691761][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 67.692135][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 67.700375][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 67.794252][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 67.794605][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 67.802853][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 68.449652][ T5818] Bluetooth: hci2: command tx timeout [ 68.477912][ T977] usb 4-1: USB disconnect, device number 2 [ 68.522901][ T5816] Bluetooth: hci1: command tx timeout [ 68.522937][ T5138] Bluetooth: hci0: command tx timeout [ 68.528292][ T5822] Bluetooth: hci4: command tx timeout [ 68.539090][ T5818] Bluetooth: hci3: command tx timeout [ 68.793969][ T30] kauditd_printk_skb: 34 callbacks suppressed [ 68.793985][ T30] audit: type=1400 audit(1765140038.623:128): avc: denied { create } for pid=5963 comm="syz.3.11" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 68.822441][ T30] audit: type=1400 audit(1765140038.623:129): avc: denied { getopt } for pid=5963 comm="syz.3.11" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 68.845343][ T30] audit: type=1400 audit(1765140038.623:130): avc: denied { read write } for pid=5962 comm="syz.0.9" name="fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 68.868725][ T30] audit: type=1400 audit(1765140038.623:131): avc: denied { open } for pid=5962 comm="syz.0.9" path="/dev/fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 68.920975][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 68.932696][ T30] audit: type=1400 audit(1765140038.703:132): avc: denied { mounton } for pid=5962 comm="syz.0.9" path="/1/file0" dev="tmpfs" ino=30 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 69.003566][ T30] audit: type=1400 audit(1765140038.733:133): avc: denied { read } for pid=5963 comm="syz.3.11" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 69.055622][ T5968] netlink: 48 bytes leftover after parsing attributes in process `syz.3.11'. [ 69.072089][ T30] audit: type=1400 audit(1765140038.733:134): avc: denied { open } for pid=5963 comm="syz.3.11" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 69.208882][ T5973] netlink: 'syz.3.11': attribute type 1 has an invalid length. [ 69.320793][ T5973] bond1: entered promiscuous mode [ 69.335460][ T5973] 8021q: adding VLAN 0 to HW filter on device bond1 [ 69.632126][ T30] audit: type=1400 audit(1765140039.393:135): avc: denied { create } for pid=5977 comm="syz.4.13" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 70.063003][ T5978] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 70.073918][ T5978] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 70.123216][ T30] audit: type=1400 audit(1765140039.533:136): avc: denied { bind } for pid=5977 comm="syz.4.13" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 70.147478][ T30] audit: type=1400 audit(1765140039.543:137): avc: denied { getopt } for pid=5977 comm="syz.4.13" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 70.646828][ T5984] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 70.947142][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 73.090276][ T6022] netlink: 4 bytes leftover after parsing attributes in process `syz.3.22'. [ 73.229355][ T6027] netlink: 4 bytes leftover after parsing attributes in process `syz.3.22'. [ 74.667629][ T30] kauditd_printk_skb: 22 callbacks suppressed [ 74.667666][ T30] audit: type=1400 audit(1765140044.493:160): avc: denied { create } for pid=6034 comm="syz.1.25" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 75.123170][ T30] audit: type=1400 audit(1765140044.493:161): avc: denied { bind } for pid=6034 comm="syz.1.25" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 75.147343][ T30] audit: type=1400 audit(1765140044.493:162): avc: denied { setopt } for pid=6034 comm="syz.1.25" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 75.748692][ T30] audit: type=1400 audit(1765140044.493:163): avc: denied { accept } for pid=6034 comm="syz.1.25" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 75.908546][ T30] audit: type=1400 audit(1765140044.493:164): avc: denied { write } for pid=6034 comm="syz.1.25" path="socket:[7905]" dev="sockfs" ino=7905 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 75.969947][ T30] audit: type=1400 audit(1765140044.493:165): avc: denied { read } for pid=6034 comm="syz.1.25" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 76.031543][ T30] audit: type=1400 audit(1765140045.853:166): avc: denied { getopt } for pid=6045 comm="syz.1.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 76.073146][ T977] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 76.181326][ T6050] trusted_key: syz.1.28 sent an empty control message without MSG_MORE. [ 76.357859][ T30] audit: type=1400 audit(1765140045.933:167): avc: denied { append } for pid=6045 comm="syz.1.28" name="comedi2" dev="devtmpfs" ino=1278 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 76.482070][ T181] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 76.502033][ T977] usb 4-1: Using ep0 maxpacket: 32 [ 76.510604][ T977] usb 4-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 76.530129][ T977] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 76.559954][ T977] usb 4-1: Product: syz [ 76.572452][ T977] usb 4-1: Manufacturer: syz [ 76.597420][ T977] usb 4-1: SerialNumber: syz [ 76.608623][ T30] audit: type=1400 audit(1765140046.433:168): avc: denied { read write } for pid=6051 comm="syz.1.30" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 76.727477][ T181] usb 1-1: Using ep0 maxpacket: 32 [ 76.733866][ T977] usb 4-1: config 0 descriptor?? [ 76.759918][ T181] usb 1-1: config index 0 descriptor too short (expected 255, got 27) [ 76.777768][ T181] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 76.880610][ T30] audit: type=1400 audit(1765140046.433:169): avc: denied { open } for pid=6051 comm="syz.1.30" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 77.222155][ T181] usb 1-1: config 0 has no interfaces? [ 77.237490][ T977] RobotFuzz Open Source InterFace, OSIF 4-1:0.0: version d4.15 found at bus 004 address 003 [ 77.248503][ T181] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=58.16 [ 77.266714][ T6059] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 77.304574][ T181] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 77.340119][ T181] usb 1-1: Product: syz [ 77.352414][ T181] usb 1-1: Manufacturer: syz [ 77.362142][ T181] usb 1-1: SerialNumber: syz [ 77.517405][ T24] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 77.584458][ T24] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 77.666103][ T181] usb 1-1: config 0 descriptor?? [ 78.063144][ T5925] usb 1-1: USB disconnect, device number 2 [ 78.161186][ T6076] binder: 6073:6076 ioctl 400c620e 0 returned -14 [ 78.249408][ T181] usb 4-1: USB disconnect, device number 3 [ 79.784677][ T30] kauditd_printk_skb: 26 callbacks suppressed [ 79.786876][ T30] audit: type=1400 audit(1765140049.613:196): avc: denied { accept } for pid=6086 comm="syz.4.34" lport=37458 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 80.367181][ T30] audit: type=1400 audit(1765140050.183:197): avc: denied { create } for pid=6074 comm="dhcpcd-run-hook" name="resolv.conf.sl0.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 80.472052][ T30] audit: type=1400 audit(1765140050.183:198): avc: denied { write } for pid=6074 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf.sl0.link" dev="tmpfs" ino=2098 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 80.561377][ T30] audit: type=1400 audit(1765140050.183:199): avc: denied { append } for pid=6074 comm="dhcpcd-run-hook" name="resolv.conf.sl0.link" dev="tmpfs" ino=2098 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 80.655398][ T30] audit: type=1400 audit(1765140050.423:200): avc: denied { watch watch_reads } for pid=6103 comm="syz.1.38" path="/10" dev="tmpfs" ino=64 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 80.770036][ T30] audit: type=1400 audit(1765140050.563:201): avc: denied { read } for pid=6103 comm="syz.1.38" name="video3" dev="devtmpfs" ino=934 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 80.866693][ T30] audit: type=1400 audit(1765140050.563:202): avc: denied { open } for pid=6103 comm="syz.1.38" path="/dev/video3" dev="devtmpfs" ino=934 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 80.956527][ T30] audit: type=1400 audit(1765140050.563:203): avc: denied { ioctl } for pid=6103 comm="syz.1.38" path="/dev/video3" dev="devtmpfs" ino=934 ioctlcmd=0x5613 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 81.053599][ T30] audit: type=1400 audit(1765140050.853:204): avc: denied { unlink } for pid=6113 comm="rm" name="resolv.conf.sl0.link" dev="tmpfs" ino=2098 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 81.166254][ T49] cfg80211: failed to load regulatory.db [ 81.438453][ T6126] syzkaller0: entered promiscuous mode [ 81.497896][ T6126] syzkaller0: entered allmulticast mode [ 81.535529][ T30] audit: type=1400 audit(1765140051.363:205): avc: denied { write } for pid=6120 comm="syz.0.37" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 81.607561][ T6122] kvm: kvm [6120]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x800 [ 81.691860][ T6122] kvm: kvm [6120]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x800 [ 81.936435][ T6140] netlink: 20 bytes leftover after parsing attributes in process `syz.2.43'. [ 83.328466][ T6156] blkio.reset_stats is deprecated [ 83.804877][ T6159] tipc: Started in network mode [ 83.832857][ T6159] tipc: Node identity 522649e88fe3, cluster identity 4711 [ 83.850689][ T6159] tipc: Enabled bearer , priority 0 [ 83.895270][ T6164] syzkaller0: entered promiscuous mode [ 83.900765][ T6164] syzkaller0: entered allmulticast mode [ 85.147735][ T6170] tipc: Resetting bearer [ 85.192223][ T6158] tipc: Resetting bearer [ 85.297013][ T6158] tipc: Disabling bearer [ 85.303069][ T30] kauditd_printk_skb: 38 callbacks suppressed [ 85.303097][ T30] audit: type=1400 audit(1765140055.123:244): avc: denied { mounton } for pid=6174 comm="syz.4.51" path="/13/file0" dev="tmpfs" ino=85 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 85.593119][ T30] audit: type=1400 audit(1765140055.133:245): avc: denied { mount } for pid=6174 comm="syz.4.51" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 85.676383][ T30] audit: type=1400 audit(1765140055.493:246): avc: denied { unmount } for pid=5812 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 85.707273][ T6054] tipc: Node number set to 3720694248 [ 85.780490][ T30] audit: type=1400 audit(1765140055.553:247): avc: denied { connect } for pid=6178 comm="syz.2.52" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 85.812009][ T6185] syz.4.54 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 85.858514][ T30] audit: type=1400 audit(1765140055.553:248): avc: denied { setopt } for pid=6178 comm="syz.2.52" laddr=::1 lport=1 faddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 85.858559][ T30] audit: type=1400 audit(1765140055.553:249): avc: denied { write } for pid=6178 comm="syz.2.52" laddr=::1 lport=1 faddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 85.858595][ T30] audit: type=1400 audit(1765140055.683:250): avc: denied { create } for pid=6184 comm="syz.4.54" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 85.859452][ T30] audit: type=1400 audit(1765140055.683:251): avc: denied { connect } for pid=6184 comm="syz.4.54" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 85.910860][ T30] audit: type=1400 audit(1765140055.733:252): avc: denied { write } for pid=6184 comm="syz.4.54" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 87.087812][ T30] audit: type=1400 audit(1765140056.913:253): avc: denied { ioctl } for pid=6193 comm="syz.1.56" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=8103 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 87.442089][ T6054] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 87.621219][ T6054] usb 2-1: config 0 has no interfaces? [ 87.628439][ T6054] usb 2-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 87.638476][ T6054] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.661804][ T6054] usb 2-1: config 0 descriptor?? [ 88.375195][ T5925] usb 2-1: USB disconnect, device number 2 [ 88.696340][ T49] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 88.848256][ T6211] faux_driver vgem: [drm] Unknown color mode 181; guessing buffer size. [ 89.061178][ T49] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 89.070328][ T49] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.106286][ T49] usb 3-1: Product: syz [ 89.110593][ T49] usb 3-1: Manufacturer: syz [ 89.117485][ T49] usb 3-1: SerialNumber: syz [ 89.177273][ T49] usb 3-1: config 0 descriptor?? [ 89.193481][ T6215] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 89.448231][ T49] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 90.213598][ T6215] netlink: 204 bytes leftover after parsing attributes in process `syz.1.62'. [ 91.069167][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 91.069178][ T30] audit: type=1400 audit(1765140060.893:259): avc: denied { read write } for pid=6233 comm="syz.3.67" name="file0" dev="tmpfs" ino=63 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 91.109114][ T30] audit: type=1400 audit(1765140060.933:260): avc: denied { open } for pid=6233 comm="syz.3.67" path="/9/file0" dev="tmpfs" ino=63 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 91.701038][ T49] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 91.790189][ T49] usb 3-1: USB disconnect, device number 2 [ 92.798641][ T30] audit: type=1400 audit(1765140062.623:261): avc: denied { create } for pid=6248 comm="syz.2.71" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 92.916129][ T6251] netlink: 20 bytes leftover after parsing attributes in process `syz.4.70'. [ 93.369976][ T30] audit: type=1326 audit(1765140062.733:262): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6246 comm="syz.4.70" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5d2698f749 code=0x7ffc0000 [ 93.393175][ T30] audit: type=1326 audit(1765140062.733:263): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6246 comm="syz.4.70" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5d2698f749 code=0x7ffc0000 [ 93.418139][ T30] audit: type=1326 audit(1765140062.733:264): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6246 comm="syz.4.70" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f5d2698f749 code=0x7ffc0000 [ 93.447633][ T30] audit: type=1326 audit(1765140062.733:265): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6246 comm="syz.4.70" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5d2698f749 code=0x7ffc0000 [ 93.478785][ T30] audit: type=1326 audit(1765140062.733:266): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6246 comm="syz.4.70" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5d2698f749 code=0x7ffc0000 [ 93.505443][ T30] audit: type=1326 audit(1765140062.733:267): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6246 comm="syz.4.70" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f5d2698f749 code=0x7ffc0000 [ 93.896961][ T30] audit: type=1326 audit(1765140062.743:268): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6246 comm="syz.4.70" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5d2698f749 code=0x7ffc0000 [ 93.929132][ T6054] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 94.029291][ T6054] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz0 [ 94.050586][ T6261] xt_TCPMSS: Only works on TCP SYN packets [ 94.135643][ T6264] kAFS: unable to lookup cell '(' [ 95.061610][ T6266] fido_id[6266]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 95.252495][ T6270] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 97.750655][ T30] kauditd_printk_skb: 27 callbacks suppressed [ 97.750671][ T30] audit: type=1400 audit(1765140067.573:296): avc: denied { create } for pid=6284 comm="syz.0.79" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 97.963267][ T30] audit: type=1400 audit(1765140067.793:297): avc: denied { write } for pid=6280 comm="syz.1.78" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 98.781940][ T6293] orangefs_mount: mount request failed with -4 [ 98.871247][ T30] audit: type=1400 audit(1765140067.793:298): avc: denied { open } for pid=6280 comm="syz.1.78" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 98.894375][ T30] audit: type=1400 audit(1765140067.823:299): avc: denied { ioctl } for pid=6280 comm="syz.1.78" path="/dev/nullb0" dev="devtmpfs" ino=696 ioctlcmd=0x127f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 100.169191][ T30] audit: type=1400 audit(1765140069.883:300): avc: denied { mount } for pid=6301 comm="syz.4.84" name="/" dev="rpc_pipefs" ino=10611 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:rpc_pipefs_t tclass=filesystem permissive=1 [ 101.252023][ T6310] 0: reclassify loop, rule prio 0, protocol 800 [ 103.912641][ T30] audit: type=1400 audit(1765140073.743:301): avc: denied { read } for pid=6327 comm="syz.0.90" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 103.972045][ T30] audit: type=1400 audit(1765140073.773:302): avc: denied { open } for pid=6327 comm="syz.0.90" path="/dev/autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 104.132982][ T30] audit: type=1400 audit(1765140073.793:303): avc: denied { setopt } for pid=6327 comm="syz.0.90" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 104.439305][ T30] audit: type=1400 audit(1765140074.163:304): avc: denied { shutdown } for pid=6327 comm="syz.0.90" lport=39662 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 104.562095][ T935] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 104.750074][ T6338] capability: warning: `syz.1.93' uses deprecated v2 capabilities in a way that may be insecure [ 104.864848][ T935] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 104.879043][ T6338] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 104.887522][ T6338] tipc: Enabled bearer , priority 10 [ 104.894106][ T935] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 105.052958][ T30] audit: type=1400 audit(1765140074.883:305): avc: denied { write } for pid=6337 comm="syz.1.93" name="rtc0" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 105.052984][ T935] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 105.086404][ T935] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.682962][ T6332] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 105.703510][ T6345] syz.4.92: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 105.719044][ T30] audit: type=1400 audit(1765140075.513:306): avc: denied { create } for pid=6333 comm="syz.4.92" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 105.728250][ T935] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 105.740307][ T6345] CPU: 0 UID: 0 PID: 6345 Comm: syz.4.92 Tainted: G L syzkaller #0 PREEMPT(full) [ 105.740334][ T6345] Tainted: [L]=SOFTLOCKUP [ 105.740340][ T6345] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 105.740350][ T6345] Call Trace: [ 105.740355][ T6345] [ 105.740362][ T6345] dump_stack_lvl+0x16c/0x1f0 [ 105.740398][ T6345] warn_alloc+0x248/0x3a0 [ 105.740416][ T6345] ? __pfx_warn_alloc+0x10/0x10 [ 105.740431][ T6345] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 105.740454][ T6345] ? lockdep_hardirqs_on+0x7c/0x110 [ 105.740479][ T6345] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 105.740508][ T6345] ? kasan_save_stack+0x42/0x60 [ 105.740526][ T6345] ? kasan_save_stack+0x33/0x60 [ 105.740544][ T6345] ? kasan_save_track+0x14/0x30 [ 105.740564][ T6345] ? xskq_create+0xfb/0x1d0 [ 105.740586][ T6345] __vmalloc_node_range_noprof+0x12c2/0x16b0 [ 105.740617][ T6345] ? xskq_create+0xfb/0x1d0 [ 105.740640][ T6345] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 105.740672][ T6345] ? xskq_create+0xfb/0x1d0 [ 105.740690][ T6345] vmalloc_user_noprof+0x9e/0xe0 [ 105.740712][ T6345] ? xskq_create+0xfb/0x1d0 [ 105.740730][ T6345] xskq_create+0xfb/0x1d0 [ 105.740750][ T6345] xsk_setsockopt+0x932/0xc00 [ 105.740769][ T6345] ? __pfx_xsk_setsockopt+0x10/0x10 [ 105.740794][ T6345] ? selinux_socket_setsockopt+0x6a/0x80 [ 105.740819][ T6345] ? __pfx_xsk_setsockopt+0x10/0x10 [ 105.740838][ T6345] do_sock_setsockopt+0xf3/0x1d0 [ 105.740864][ T6345] __sys_setsockopt+0x1a0/0x230 [ 105.740887][ T6345] __x64_sys_setsockopt+0xbd/0x160 [ 105.740904][ T6345] ? do_syscall_64+0x9a/0xf80 [ 105.740928][ T6345] do_syscall_64+0xcd/0xf80 [ 105.740952][ T6345] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.740968][ T6345] RIP: 0033:0x7f5d2698f749 [ 105.740982][ T6345] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 105.740996][ T6345] RSP: 002b:00007f5d27806038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 105.741012][ T6345] RAX: ffffffffffffffda RBX: 00007f5d26be6180 RCX: 00007f5d2698f749 [ 105.741023][ T6345] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000007 [ 105.741032][ T6345] RBP: 00007f5d26a13f91 R08: 0000000000000004 R09: 0000000000000000 [ 105.741041][ T6345] R10: 0000200000000100 R11: 0000000000000246 R12: 0000000000000000 [ 105.741051][ T6345] R13: 00007f5d26be6218 R14: 00007f5d26be6180 R15: 00007ffcc1e68b08 [ 105.741073][ T6345] [ 105.741079][ T6345] Mem-Info: [ 106.053016][ T6346] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 106.070989][ T30] audit: type=1400 audit(1765140075.523:307): avc: denied { setopt } for pid=6333 comm="syz.4.92" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 106.112036][ T6345] active_anon:15106 inactive_anon:0 isolated_anon:0 [ 106.112036][ T6345] active_file:21252 inactive_file:40623 isolated_file:0 [ 106.112036][ T6345] unevictable:768 dirty:243 writeback:0 [ 106.112036][ T6345] slab_reclaimable:11691 slab_unreclaimable:96947 [ 106.112036][ T6345] mapped:32907 shmem:7516 pagetables:1143 [ 106.112036][ T6345] sec_pagetables:0 bounce:0 [ 106.112036][ T6345] kernel_misc_reclaimable:0 [ 106.112036][ T6345] free:1269920 free_pcp:39102 free_cma:0 [ 106.122504][ T6346] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 106.237028][ T935] usb 4-1: USB disconnect, device number 4 [ 106.257139][ T6345] Node 0 active_anon:55224kB inactive_anon:0kB active_file:85008kB inactive_file:162288kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:131728kB dirty:968kB writeback:0kB shmem:23128kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12580kB pagetables:4444kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 106.300702][ T6345] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:128kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 106.330725][ T6345] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 106.453062][ T6345] lowmem_reserve[]: 0 2481 2483 2483 2483 [ 106.458818][ T6345] Node 0 DMA32 free:1181256kB boost:0kB min:34092kB low:42612kB high:51132kB reserved_highatomic:0KB free_highatomic:0KB active_anon:64260kB inactive_anon:0kB active_file:85008kB inactive_file:162288kB unevictable:1536kB writepending:1032kB zspages:0kB present:3129332kB managed:2540948kB mlocked:0kB bounce:0kB free_pcp:125036kB local_pcp:86380kB free_cma:0kB [ 106.678660][ T6345] lowmem_reserve[]: 0 0 1 1 1 [ 106.982061][ T6345] Node 0 Normal free:0kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 107.199185][ T30] audit: type=1400 audit(1765140077.023:308): avc: denied { create } for pid=6355 comm="syz.2.89" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 107.429273][ T6345] lowmem_reserve[]: 0 0 0 0 0 [ 107.590450][ T6345] Node 1 Normal free:3890212kB boost:0kB min:55784kB low:69728kB high:83672kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:19584kB local_pcp:7840kB free_cma:0kB [ 108.484203][ T6345] lowmem_reserve[]: 0 0 0 0 0 [ 108.496339][ T6345] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 108.521205][ T6364] tipc: Started in network mode [ 108.529389][ T6364] tipc: Node identity ae65370ec64c, cluster identity 4711 [ 108.539589][ T6364] tipc: Enabled bearer , priority 0 [ 108.571873][ T6365] syzkaller0: entered promiscuous mode [ 108.620331][ T6345] Node 0 DMA32: 983*4kB (UM) 760*8kB (UM) 387*16kB (UME) 343*32kB (UM) 149*64kB (UME) 171*128kB (UME) 28*256kB (M) 26*512kB (ME) 3*1024kB (UM) 0*2048kB 277*4096kB (M) = 1216748kB [ 108.690987][ T6365] syzkaller0: entered allmulticast mode [ 108.824353][ T6345] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 108.886366][ T6365] tipc: Resetting bearer [ 108.912056][ T6345] Node 1 Normal: 195*4kB (UME) 55*8kB (UME) 44*16kB (UME) 65*32kB (UME) 18*64kB (UME) 10*128kB (UME) 3*256kB (UM) 4*512kB (UM) 2*1024kB (ME) 2*2048kB (UE) 946*4096kB (M) = 3890212kB [ 108.931535][ T6363] tipc: Resetting bearer [ 109.069036][ T6363] tipc: Disabling bearer [ 109.072542][ T6345] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 109.125038][ T30] audit: type=1400 audit(1765140078.953:309): avc: denied { create } for pid=6367 comm="syz.1.100" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 109.154705][ T6345] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 109.290182][ T6345] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 109.377369][ T6345] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 109.800347][ T6345] 66118 total pagecache pages [ 109.818860][ T6345] 0 pages in swap cache [ 109.823165][ T6345] Free swap = 124996kB [ 109.827618][ T6345] Total swap = 124996kB [ 109.831803][ T6345] 2097051 pages RAM [ 109.875463][ T6345] 0 pages HighMem/MovableOnly [ 109.877468][ T49] IPVS: starting estimator thread 0... [ 109.887589][ T6385] netlink: 'syz.3.102': attribute type 27 has an invalid length. [ 109.902179][ T6345] 429788 pages reserved [ 109.916203][ T6345] 0 pages cma reserved [ 110.042130][ T6387] IPVS: using max 74 ests per chain, 177600 per kthread [ 111.841431][ T30] audit: type=1400 audit(1765140081.223:310): avc: denied { read append } for pid=6394 comm="syz.1.105" name="sg0" dev="devtmpfs" ino=750 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 112.087210][ T30] audit: type=1400 audit(1765140081.223:311): avc: denied { open } for pid=6394 comm="syz.1.105" path="/dev/sg0" dev="devtmpfs" ino=750 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 112.262106][ T30] audit: type=1400 audit(1765140081.233:312): avc: denied { name_bind } for pid=6394 comm="syz.1.105" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 112.358333][ T30] audit: type=1400 audit(1765140081.723:313): avc: denied { write } for pid=6393 comm="syz.2.106" name="vbi8" dev="devtmpfs" ino=1006 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 112.518725][ T30] audit: type=1400 audit(1765140082.303:314): avc: denied { create } for pid=6403 comm="syz.4.110" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 112.675629][ T30] audit: type=1400 audit(1765140082.343:315): avc: denied { ioctl } for pid=6403 comm="syz.4.110" path="socket:[9572]" dev="sockfs" ino=9572 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 115.624065][ T30] audit: type=1400 audit(1765140085.453:316): avc: denied { create } for pid=6425 comm="syz.4.114" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 116.358685][ T30] audit: type=1400 audit(1765140086.183:317): avc: denied { bind } for pid=6434 comm="syz.2.116" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 116.385153][ T6436] pim6reg0: tun_chr_ioctl cmd 1074812118 [ 116.406725][ T6435] Bluetooth: MGMT ver 1.23 [ 116.425990][ T30] audit: type=1400 audit(1765140086.213:318): avc: denied { write } for pid=6434 comm="syz.2.116" path="socket:[10986]" dev="sockfs" ino=10986 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 116.484317][ T30] audit: type=1400 audit(1765140086.213:319): avc: denied { setopt } for pid=6425 comm="syz.4.114" lport=60 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 116.504803][ T6437] netlink: 4 bytes leftover after parsing attributes in process `syz.2.116'. [ 116.572763][ T30] audit: type=1400 audit(1765140086.253:320): avc: denied { connect } for pid=6434 comm="syz.2.116" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 116.592649][ T30] audit: type=1400 audit(1765140086.253:321): avc: denied { ioctl } for pid=6434 comm="syz.2.116" path="socket:[9605]" dev="sockfs" ino=9605 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 116.617850][ T30] audit: type=1400 audit(1765140086.253:322): avc: denied { listen } for pid=6434 comm="syz.2.116" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 117.277565][ T6437] bridge_slave_1: left allmulticast mode [ 117.698791][ T6437] bridge_slave_1: left promiscuous mode [ 117.913971][ T6437] bridge0: port 2(bridge_slave_1) entered disabled state [ 118.232067][ T30] audit: type=1400 audit(1765140087.863:323): avc: denied { write } for pid=6447 comm="syz.3.119" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 118.265604][ T6437] bridge_slave_0: left allmulticast mode [ 118.271262][ T6437] bridge_slave_0: left promiscuous mode [ 118.302457][ T6437] bridge0: port 1(bridge_slave_0) entered disabled state [ 118.456669][ T30] audit: type=1400 audit(1765140088.283:324): avc: denied { mount } for pid=6450 comm="syz.1.113" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 118.546136][ T30] audit: type=1400 audit(1765140088.373:325): avc: denied { read write } for pid=6450 comm="syz.1.113" name="file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 118.672729][ T6451] [ 120.329058][ T6466] input input5: cannot allocate more than FF_MAX_EFFECTS effects [ 120.817190][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 120.817207][ T30] audit: type=1400 audit(1765140090.643:331): avc: denied { mount } for pid=6467 comm="syz.3.125" name="/" dev="overlay" ino=137 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 120.954312][ T30] audit: type=1400 audit(1765140090.733:332): avc: denied { link } for pid=6467 comm="syz.3.125" name="#5" dev="tmpfs" ino=145 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 120.981749][ T30] audit: type=1400 audit(1765140090.733:333): avc: denied { rename } for pid=6467 comm="syz.3.125" name="#6" dev="tmpfs" ino=145 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 121.053496][ T30] audit: type=1400 audit(1765140090.743:334): avc: denied { unmount } for pid=5819 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 121.121595][ T6473] syz.4.127 uses obsolete (PF_INET,SOCK_PACKET) [ 121.633442][ T30] audit: type=1400 audit(1765140090.883:335): avc: denied { getopt } for pid=6467 comm="syz.3.125" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 121.678442][ T30] audit: type=1400 audit(1765140090.933:336): avc: denied { ioctl } for pid=6467 comm="syz.3.125" path="socket:[11049]" dev="sockfs" ino=11049 ioctlcmd=0x8916 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 121.733210][ T30] audit: type=1400 audit(1765140091.333:337): avc: denied { write } for pid=6474 comm="syz.0.120" name="sg0" dev="devtmpfs" ino=750 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 121.788045][ T30] audit: type=1400 audit(1765140091.333:338): avc: denied { ioctl } for pid=6474 comm="syz.0.120" path="/dev/sg0" dev="devtmpfs" ino=750 ioctlcmd=0x5393 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 121.841680][ T30] audit: type=1400 audit(1765140091.443:339): avc: denied { connect } for pid=6472 comm="syz.4.127" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 121.902658][ T30] audit: type=1400 audit(1765140091.443:340): avc: denied { write } for pid=6472 comm="syz.4.127" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 122.302549][ T6488] infiniband syz1: set active [ 122.307536][ T6488] infiniband syz1: added syz_tun [ 122.350245][ T6488] RDS/IB: syz1: added [ 122.355599][ T6488] smc: adding ib device syz1 with port count 1 [ 122.362329][ T6488] smc: ib device syz1 port 1 has no pnetid [ 122.698266][ T6499] openvswitch: netlink: Unexpected mask (mask=1040, allowed=10048) [ 123.180443][ T5818] Bluetooth: hci1: command 0x0406 tx timeout [ 128.380031][ T935] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 128.509900][ T5920] IPVS: starting estimator thread 0... [ 128.562619][ T935] usb 3-1: Using ep0 maxpacket: 8 [ 128.581198][ T935] usb 3-1: unable to get BOS descriptor or descriptor too short [ 128.693877][ T935] usb 3-1: config 140 has an invalid descriptor of length 0, skipping remainder of the config [ 128.693899][ T6546] IPVS: using max 43 ests per chain, 103200 per kthread [ 128.821601][ T935] usb 3-1: config 140 has 1 interface, different from the descriptor's value: 2 [ 128.978244][ T935] usb 3-1: New USB device found, idVendor=1039, idProduct=2101, bcdDevice=25.81 [ 129.002255][ T935] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 129.011685][ T935] usb 3-1: Product: syz [ 129.027097][ T935] usb 3-1: Manufacturer: syz [ 129.044604][ T935] usb 3-1: SerialNumber: syz [ 129.136523][ T30] kauditd_printk_skb: 14 callbacks suppressed [ 129.136563][ T30] audit: type=1400 audit(1765140098.963:355): avc: denied { create } for pid=6550 comm="syz.1.144" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 129.881374][ T30] audit: type=1400 audit(1765140099.023:356): avc: denied { bind } for pid=6550 comm="syz.1.144" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 130.370700][ T30] audit: type=1400 audit(1765140099.703:357): avc: denied { create } for pid=6534 comm="syz.2.140" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 131.473449][ T935] usb 3-1: [ueagle-atm] ADSL device founded vid (0X1039) pid (0X2101) Rev (0X2581): Eagle I [ 131.592741][ T30] audit: type=1400 audit(1765140101.423:358): avc: denied { setopt } for pid=6563 comm="syz.1.149" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 131.884397][ T30] audit: type=1400 audit(1765140101.703:359): avc: denied { connect } for pid=6567 comm="syz.2.150" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 132.257061][ T24] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 132.282392][ T30] audit: type=1400 audit(1765140101.713:360): avc: denied { ioctl } for pid=6567 comm="syz.2.150" path="socket:[11262]" dev="sockfs" ino=11262 ioctlcmd=0x89ed scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 132.369117][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.424675][ T24] usb 5-1: unable to get BOS descriptor or descriptor too short [ 132.445384][ T24] usb 5-1: config 14 has an invalid interface number: 51 but max is 0 [ 132.501050][ T30] audit: type=1400 audit(1765140102.323:361): avc: denied { set_context_mgr } for pid=6577 comm="syz.1.152" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 132.501320][ T24] usb 5-1: config 14 has no interface number 0 [ 132.534661][ T30] audit: type=1400 audit(1765140102.363:362): avc: denied { map } for pid=6577 comm="syz.1.152" path="/dev/binderfs/binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 132.674768][ T935] usb 3-1: [ueagle-atm] pre-firmware device, uploading firmware [ 132.685776][ T24] usb 5-1: config 14 interface 51 has no altsetting 0 [ 132.698984][ T935] usb 3-1: [ueagle-atm] loading firmware ueagle-atm/eagleI.fw [ 132.708267][ T5892] usb 3-1: Direct firmware load for ueagle-atm/eagleI.fw failed with error -2 [ 132.723015][ T24] usb 5-1: New USB device found, idVendor=0b48, idProduct=1009, bcdDevice=68.06 [ 132.738017][ T5892] usb 3-1: Falling back to sysfs fallback for: ueagle-atm/eagleI.fw [ 132.742027][ T30] audit: type=1400 audit(1765140102.563:363): avc: denied { firmware_load } for pid=5892 comm="kworker/1:5" scontext=system_u:system_r:kernel_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 132.751139][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 132.908432][ T935] usb 3-1: USB disconnect, device number 3 [ 133.887254][ T24] usb 5-1: Product: syz [ 133.891546][ T24] usb 5-1: Manufacturer: syz [ 133.902028][ T24] usb 5-1: SerialNumber: syz [ 134.470303][ T24] ttusb_dec_send_command: command bulk message failed: error -22 [ 134.516891][ T24] ttusb-dec 5-1:14.51: probe with driver ttusb-dec failed with error -22 [ 134.546084][ T30] audit: type=1400 audit(1765140104.373:364): avc: denied { call } for pid=6577 comm="syz.1.152" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 134.678496][ T24] usb 5-1: USB disconnect, device number 2 [ 135.883609][ T30] audit: type=1400 audit(1765140105.703:365): avc: denied { ioctl } for pid=6609 comm="syz.0.158" path="socket:[10017]" dev="sockfs" ino=10017 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 136.117027][ T6610] netlink: 'syz.0.158': attribute type 10 has an invalid length. [ 136.135304][ T30] audit: type=1400 audit(1765140105.943:366): avc: denied { name_bind } for pid=6609 comm="syz.0.158" src=3618 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 136.138571][ T6610] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 136.593889][ T30] audit: type=1400 audit(1765140106.403:367): avc: denied { write } for pid=6609 comm="syz.0.158" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 136.908517][ T6622] warning: `syz.4.161' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 245.879571][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 245.886570][ C0] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P6625/1:b..l P5812/1:b..l [ 245.895923][ C0] rcu: (detected by 0, t=10505 jiffies, g=11457, q=1334 ncpus=2) [ 245.903715][ C0] task:syz-executor state:R running task stack:23704 pid:5812 tgid:5812 ppid:5810 task_flags:0x400140 flags:0x00080000 [ 245.917484][ C0] Call Trace: [ 245.920757][ C0] [ 245.923710][ C0] ? __schedule+0x10b9/0x6150 [ 245.928386][ C0] __schedule+0x1139/0x6150 [ 245.932899][ C0] ? __pfx___schedule+0x10/0x10 [ 245.937752][ C0] ? preempt_schedule_thunk+0x16/0x30 [ 245.943118][ C0] preempt_schedule_common+0x44/0xc0 [ 245.948400][ C0] preempt_schedule_thunk+0x16/0x30 [ 245.953600][ C0] _raw_spin_unlock+0x3e/0x50 [ 245.958275][ C0] copy_page_range+0x22d0/0x6780 [ 245.963239][ C0] ? __pfx_copy_page_range+0x10/0x10 [ 245.968533][ C0] ? __pfx___might_resched+0x10/0x10 [ 245.973804][ C0] ? __pfx_mas_store+0x10/0x10 [ 245.978578][ C0] ? dup_mmap+0xba4/0x20e0 [ 245.982990][ C0] ? down_write+0x14d/0x200 [ 245.987482][ C0] ? up_write+0x282/0x4e0 [ 245.991812][ C0] dup_mmap+0xbea/0x20e0 [ 245.996072][ C0] ? __pfx_dup_mmap+0x10/0x10 [ 246.000759][ C0] copy_process+0x3b9f/0x7430 [ 246.005434][ C0] ? do_wp_page+0x1c04/0x5010 [ 246.010115][ C0] ? __pfx_copy_process+0x10/0x10 [ 246.015136][ C0] ? do_raw_spin_lock+0x12c/0x2b0 [ 246.020174][ C0] kernel_clone+0xfc/0x910 [ 246.024603][ C0] ? __pfx_kernel_clone+0x10/0x10 [ 246.029632][ C0] __do_sys_clone+0xce/0x120 [ 246.034219][ C0] ? __pfx___do_sys_clone+0x10/0x10 [ 246.039419][ C0] ? count_memcg_events+0x122/0x290 [ 246.044646][ C0] ? do_user_addr_fault+0x843/0x1370 [ 246.049969][ C0] do_syscall_64+0xcd/0xf80 [ 246.054489][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 246.060385][ C0] RIP: 0033:0x7f5d26985e93 [ 246.064788][ C0] RSP: 002b:00007ffcc1e68d88 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 246.074057][ C0] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5d26985e93 [ 246.082025][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 246.089982][ C0] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001 [ 246.097943][ C0] R10: 00005555889377d0 R11: 0000000000000246 R12: 0000000000000000 [ 246.105905][ C0] R13: 00000000000927c0 R14: 0000000000021677 R15: 00007ffcc1e68f20 [ 246.114312][ C0] [ 246.117318][ C0] task:kworker/0:10 state:R running task stack:30264 pid:6625 tgid:6625 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 246.130895][ C0] Workqueue: events_power_efficient gc_worker [ 246.136955][ C0] Call Trace: [ 246.140220][ C0] [ 246.143150][ C0] ? __schedule+0x10b9/0x6150 [ 246.147827][ C0] __schedule+0x1139/0x6150 [ 246.152340][ C0] ? __pfx___schedule+0x10/0x10 [ 246.157191][ C0] ? mark_held_locks+0x49/0x80 [ 246.161951][ C0] preempt_schedule_irq+0x51/0x90 [ 246.166972][ C0] irqentry_exit+0x1d8/0x8c0 [ 246.171567][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 246.177540][ C0] RIP: 0010:gc_worker+0x2d5/0x16e0 [ 246.182642][ C0] Code: 00 00 48 c7 c7 a8 a4 88 90 e8 07 e8 06 f8 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 a5 d4 2b f8 58 48 85 db 0f 85 d4 0f 00 00 c6 d9 2b f8 8b 1d f0 99 f5 06 41 89 dc 31 ff 41 83 e4 01 44 89 [ 246.202325][ C0] RSP: 0018:ffffc9000519fad8 EFLAGS: 00000293 [ 246.208385][ C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff899315e9 [ 246.216344][ C0] RDX: ffff88804ea8a4c0 RSI: ffffffff899315f8 RDI: 0000000000000007 [ 246.224309][ C0] RBP: ffffffff9b08f72c R08: 0000000000000007 R09: 0000000000000000 [ 246.232268][ C0] R10: 0000000000000000 R11: ffff88804ea8aff0 R12: ffff888149800000 [ 246.240226][ C0] R13: 0000000000040000 R14: dffffc0000000000 R15: 00000000000016c7 [ 246.248193][ C0] ? gc_worker+0xe19/0x16e0 [ 246.252740][ C0] ? gc_worker+0xe28/0x16e0 [ 246.257265][ C0] ? gc_worker+0xe28/0x16e0 [ 246.261762][ C0] ? debug_object_deactivate+0x1ec/0x3a0 [ 246.267405][ C0] ? __pfx_gc_worker+0x10/0x10 [ 246.272166][ C0] ? rcu_is_watching+0x12/0xc0 [ 246.276926][ C0] process_one_work+0x9ba/0x1b20 [ 246.281871][ C0] ? __pfx_nsim_dev_hwstats_traffic_work+0x10/0x10 [ 246.288370][ C0] ? __pfx_process_one_work+0x10/0x10 [ 246.293744][ C0] ? assign_work+0x1a0/0x250 [ 246.298330][ C0] worker_thread+0x6c8/0xf10 [ 246.302937][ C0] ? __kthread_parkme+0x19e/0x250 [ 246.307955][ C0] ? __pfx_worker_thread+0x10/0x10 [ 246.313060][ C0] kthread+0x3c5/0x780 [ 246.317129][ C0] ? __pfx_kthread+0x10/0x10 [ 246.321712][ C0] ? rcu_is_watching+0x12/0xc0 [ 246.326468][ C0] ? __pfx_kthread+0x10/0x10 [ 246.331053][ C0] ret_from_fork+0x983/0xb10 [ 246.335639][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 246.340743][ C0] ? __switch_to+0x7af/0x10d0 [ 246.345426][ C0] ? __pfx_kthread+0x10/0x10 [ 246.350012][ C0] ret_from_fork_asm+0x1a/0x30 [ 246.354787][ C0] [ 246.357826][ C0] rcu: rcu_preempt kthread starved for 10491 jiffies! g11457 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0 [ 246.369006][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 246.378962][ C0] rcu: RCU grace-period kthread stack dump: [ 246.384831][ C0] task:rcu_preempt state:R running task stack:28584 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 [ 246.398311][ C0] Call Trace: [ 246.401633][ C0] [ 246.404576][ C0] ? __schedule+0x10b9/0x6150 [ 246.409265][ C0] __schedule+0x1139/0x6150 [ 246.413772][ C0] ? __lock_acquire+0x436/0x2890 [ 246.418712][ C0] ? __mod_timer+0x8f2/0xd30 [ 246.423307][ C0] ? __pfx___schedule+0x10/0x10 [ 246.428148][ C0] ? find_held_lock+0x2b/0x80 [ 246.432821][ C0] ? schedule+0x2d7/0x3a0 [ 246.437255][ C0] schedule+0xe7/0x3a0 [ 246.441321][ C0] schedule_timeout+0x123/0x290 [ 246.446163][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 246.452049][ C0] ? __pfx_process_timeout+0x10/0x10 [ 246.457336][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 246.463138][ C0] ? prepare_to_swait_event+0xf5/0x480 [ 246.468592][ C0] rcu_gp_fqs_loop+0x1ea/0xaf0 [ 246.473354][ C0] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 246.478640][ C0] ? lockdep_hardirqs_on+0x7c/0x110 [ 246.483841][ C0] ? __pfx_rcu_gp_init+0x10/0x10 [ 246.488781][ C0] ? rcu_gp_cleanup+0x7c1/0xe90 [ 246.493722][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 246.499537][ C0] rcu_gp_kthread+0x26d/0x380 [ 246.504204][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 246.509392][ C0] ? rcu_is_watching+0x12/0xc0 [ 246.514142][ C0] ? lockdep_hardirqs_on+0x7c/0x110 [ 246.519431][ C0] ? __kthread_parkme+0x19e/0x250 [ 246.524449][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 246.529641][ C0] kthread+0x3c5/0x780 [ 246.533704][ C0] ? __pfx_kthread+0x10/0x10 [ 246.538287][ C0] ? rcu_is_watching+0x12/0xc0 [ 246.543036][ C0] ? __pfx_kthread+0x10/0x10 [ 246.547631][ C0] ret_from_fork+0x983/0xb10 [ 246.552212][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 246.557663][ C0] ? __switch_to+0x7af/0x10d0 [ 246.562332][ C0] ? __pfx_kthread+0x10/0x10 [ 246.566914][ C0] ret_from_fork_asm+0x1a/0x30 [ 246.571693][ C0] [ 246.575218][ C0] rcu: Stack dump where RCU GP kthread last ran: [ 246.581531][ C0] CPU: 0 UID: 0 PID: 2122 Comm: kworker/u8:8 Tainted: G L syzkaller #0 PREEMPT(full) [ 246.592639][ C0] Tainted: [L]=SOFTLOCKUP [ 246.596969][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 246.607018][ C0] Workqueue: events_unbound toggle_allocation_gate [ 246.613515][ C0] RIP: 0010:smp_call_function_many_cond+0xdfd/0x15e0 [ 246.620194][ C0] Code: 57 48 8b 54 24 10 4c 89 74 24 10 49 89 d5 48 89 d5 48 89 54 24 18 49 c1 ed 03 83 e5 07 4d 01 e5 83 c5 03 e8 b5 5a 0c 00 f3 90 <41> 0f b6 45 00 40 38 c5 7c 08 84 c0 0f 85 b6 05 00 00 8b 43 08 31 [ 246.639789][ C0] RSP: 0018:ffffc9000532f808 EFLAGS: 00000293 [ 246.645846][ C0] RAX: 0000000000000000 RBX: ffff8880b8540cc0 RCX: ffffffff81b289e1 [ 246.653804][ C0] RDX: ffff88802b5d8000 RSI: ffffffff81b289bb RDI: 0000000000000005 [ 246.661765][ C0] RBP: 0000000000000003 R08: 0000000000000005 R09: 0000000000000000 [ 246.669738][ C0] R10: 0000000000000001 R11: ffff88802b5d8b30 R12: dffffc0000000000 [ 246.677700][ C0] R13: ffffed10170a8199 R14: 0000000000000001 R15: 0000000000000001 [ 246.685656][ C0] FS: 0000000000000000(0000) GS:ffff888124909000(0000) knlGS:0000000000000000 [ 246.694658][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 246.701254][ C0] CR2: 0000001b30115ff8 CR3: 000000000e184000 CR4: 00000000003526f0 [ 246.709217][ C0] Call Trace: [ 246.712485][ C0] [ 246.715414][ C0] ? __pfx_do_sync_core+0x10/0x10 [ 246.720439][ C0] ? kmem_cache_alloc_from_sheaf_noprof+0x3e/0x1b0 [ 246.726934][ C0] ? __pfx_smp_call_function_many_cond+0x10/0x10 [ 246.733253][ C0] ? __pfx_text_poke_memcpy+0x10/0x10 [ 246.738627][ C0] ? __pfx___text_poke+0x10/0x10 [ 246.743580][ C0] ? __pfx_do_sync_core+0x10/0x10 [ 246.748601][ C0] on_each_cpu_cond_mask+0x40/0x90 [ 246.753854][ C0] ? kmem_cache_alloc_from_sheaf_noprof+0x3e/0x1b0 [ 246.760383][ C0] smp_text_poke_batch_finish+0x27b/0xdb0 [ 246.766124][ C0] ? __pfx_smp_text_poke_batch_finish+0x10/0x10 [ 246.772378][ C0] ? arch_jump_label_transform_queue+0xc0/0x120 [ 246.778634][ C0] ? find_held_lock+0x2b/0x80 [ 246.783324][ C0] arch_jump_label_transform_apply+0x1c/0x30 [ 246.789315][ C0] jump_label_update+0x376/0x550 [ 246.794252][ C0] static_key_enable_cpuslocked+0x1b7/0x270 [ 246.800138][ C0] static_key_enable+0x1a/0x20 [ 246.804894][ C0] toggle_allocation_gate+0xfa/0x280 [ 246.810172][ C0] ? __pfx_toggle_allocation_gate+0x10/0x10 [ 246.816065][ C0] ? rcu_is_watching+0x12/0xc0 [ 246.820818][ C0] process_one_work+0x9ba/0x1b20 [ 246.825757][ C0] ? __pfx_cfg80211_wiphy_work+0x10/0x10 [ 246.831571][ C0] ? __pfx_process_one_work+0x10/0x10 [ 246.836952][ C0] ? assign_work+0x1a0/0x250 [ 246.841545][ C0] worker_thread+0x6c8/0xf10 [ 246.846146][ C0] ? __pfx_worker_thread+0x10/0x10 [ 246.851942][ C0] kthread+0x3c5/0x780 [ 246.856009][ C0] ? __pfx_kthread+0x10/0x10 [ 246.860607][ C0] ? rcu_is_watching+0x12/0xc0 [ 246.865358][ C0] ? __pfx_kthread+0x10/0x10 [ 246.869942][ C0] ret_from_fork+0x983/0xb10 [ 246.874542][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 246.879651][ C0] ? __switch_to+0x7af/0x10d0 [ 246.884326][ C0] ? __pfx_kthread+0x10/0x10 [ 246.888909][ C0] ret_from_fork_asm+0x1a/0x30 [ 246.893682][ C0]