last executing test programs: 1.48878094s ago: executing program 0 (id=424): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xffff}, 0x50) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb010018000000000000001800000018000000040000000200"], 0x0, 0x34}, 0x28) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) r3 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r3) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0xf, &(0x7f00000002c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8792}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000180)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x19, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r2, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) bpf$OBJ_PIN_PROG(0x11, 0x0, 0x0) bpf$OBJ_PIN_PROG(0x11, 0x0, 0x0) 1.48808138s ago: executing program 0 (id=426): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r0, &(0x7f0000000180)={@void, @val={0x6, 0x0, 0x6488, 0x8, 0x14}, @ipv4=@generic={{0x5, 0x4, 0x2, 0x2, 0x14, 0x66, 0x0, 0x5, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0x35}, @broadcast}}}, 0x1e) 1.272131085s ago: executing program 0 (id=432): socket$inet_icmp(0x2, 0x2, 0x1) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(0xffffffffffffffff) landlock_create_ruleset(0xfffffffffffffffe, 0x5c, 0x0) socket$kcm(0x2, 0xa, 0x2) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @tid=r0}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0xfb17d000) r3 = socket$kcm(0x23, 0x5, 0x0) listen(r3, 0x800) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000f00)=[{&(0x7f0000000200)="5c00000014006b05c84e21000ab16d6e230675f811000000440002005817d30461bc24eeb556a7ef595105ea1698fa51f60a64c9f408000000e786a6d0bdbdc3d44bd70011b6c0504bb9189d9193e9bd00"/92, 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x240040c4) r5 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r5, &(0x7f0000000040)={0x23, 0x0, 0x58}, 0x10) sendto$phonet(r5, 0x0, 0x0, 0x80, 0x0, 0x0) accept4(r3, 0x0, 0x0, 0x80000) r6 = timerfd_create(0x1, 0x0) read(r6, &(0x7f0000002180)=""/262, 0x106) socket$nl_netfilter(0x10, 0x3, 0xc) openat(0xffffffffffffff9c, 0x0, 0x20842, 0x63) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$PPPIOCGIDLE(r1, 0x8010743f, 0x0) ptrace(0x10, r0) 1.251540188s ago: executing program 1 (id=434): ioctl$sock_bt_hci(0xffffffffffffffff, 0x800448d5, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={0x0}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x68080, 0x0) ioctl$SNAPSHOT_FREE(r0, 0x3305) ioctl$SNAPSHOT_PLATFORM_SUPPORT(r0, 0x330f, 0x2) ioctl$SNAPSHOT_S2RAM(r0, 0x330b) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f00000024c0), 0xffffffffffffffff) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5c0000000206030000000000000000000000000005000100070000000900020073797a31000000000c00078008000640000007010500050002000000050004000000000016000300686173683a6e65742c706f7274"], 0x5c}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="50000000090601020000ffff00000000020000000900020073797a31000000000500010007000000280007800c00018008000140ffffffff0500070011000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x20000880) 1.06148943s ago: executing program 3 (id=441): socket$inet_tcp(0x2, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4048aec9, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x44, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}]}, 0x44}}, 0x8000000) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="44000000090601020000000000000000000000000900020073797a310000000005000100070000001c00078018000180"], 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) 1.000672748s ago: executing program 3 (id=443): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000880), 0x0, 0x4) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, 0x0, 0x0) r2 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000240)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0x3c, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_FLOW_MODE={0x8, 0x5, 0x2}]}}]}, 0x3c}}, 0x20000004) socket$pppoe(0x18, 0x1, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) epoll_create(0x6) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'wlan0\x00'}) sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=@newlink={0x20, 0x10, 0xffffffffffffffff, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x42, 0x2021}}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) r4 = socket$inet6_udp(0xa, 0x2, 0x0) sendto$inet6(r4, &(0x7f0000000200)='pin', 0x3, 0x0, &(0x7f0000000300)={0xa, 0x1f90, 0x0, @loopback}, 0x1c) 1.000288945s ago: executing program 3 (id=444): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a05000000000000000000050000030900010073797a30000000002c000000030a01020000000000000000050000040900010073797a30000000000900030073797a30000000004c000000060a010400000000000000000500000008000b4000000000240004802000018008000100667764001400ba641fdf024000000009080001400000000b0900010073797a30"], 0xc0}}, 0x850) 911.935148ms ago: executing program 3 (id=446): mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) mount$bpf(0x20000000f9fd, &(0x7f0000000440)='./file0/../file0\x00', &(0x7f0000000000), 0x40, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0xbe9bac6d2d0f4e0b) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_ro(r0, &(0x7f0000000900)='blkio.bfq.io_service_bytes\x00', 0x26e1, 0x0) 911.755194ms ago: executing program 2 (id=447): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000600)=ANY=[@ANYBLOB="3c000000240005040200"/20, @ANYRES32=r0, @ANYBLOB="00000100ffffffff000000000c00010063616b655f6d71"], 0x3c}}, 0x0) 842.027419ms ago: executing program 3 (id=448): r0 = socket(0x10, 0x2, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x81, 0xffffffff, 0x20000}, 0x10) recvmmsg$unix(r0, &(0x7f0000006440)=[{{0x0, 0x0, 0x0}}], 0x11, 0x10002, 0x0) 359.291651ms ago: executing program 0 (id=449): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000700)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a30000000060a010400000000000000000a00000109da076200010080797a310000000004000480090002"], 0x58}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1002}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000900)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a8c000000000a010400000000000000000200000a0900010073797a31000000001d00060057888dea14bd24380a94baa1b992be4a21fbb5167eecd301ca00000044000600669b55b29f3dfc526565f21b265b9986de2b84a40fc10ccd9316acc8a6f2bea92afc4be17117d90c1c3a8620340156b478765a2292e8dcb2934415776ab8103b080002400000000140000000030a010400000000000000000200000a0900010073797a30000000000900030073797a300000000014000480080001400000000308000240000000004c000000060a010400000000000000000200000a0900010073797a30000000000900020073797a3000000000200004801c0001800a00010071756575650000000c0002800600014000000000140000001100010000000000000000000200000a48f00c13ba9a3d1a3749511acfe2b5"], 0x140}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000740)=ANY=[@ANYBLOB="3c00000010000500"/20, @ANYRES32=0x0, @ANYBLOB="01000000010000001400030073797a6b616c6c65723000000000000008000a00", @ANYRES32=r3], 0x3c}}, 0x0) write(r0, &(0x7f0000000700)="ffffffffffff0011223344554305000f32001800000100112233445500112233445500ff0000", 0xfdef) 358.726966ms ago: executing program 1 (id=450): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x42014}, 0x80010) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) socket$vsock_stream(0x28, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000340)=[@sack_perm, @mss={0x2, 0xffff485d}, @mss={0x2, 0x1}, @window={0x3, 0x6, 0xff81}, @window={0x3, 0x8, 0x6}, @timestamp, @mss={0x2, 0x2}, @mss={0x2, 0xffff}], 0x8) sendto$inet(r1, &(0x7f0000000000)="b8", 0x1, 0x2400a044, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r1, &(0x7f0000000380)='x', 0x1, 0x480d1, 0x0, 0x0) r2 = socket$inet6(0x10, 0x2, 0x4) sendto$inet6(r2, &(0x7f0000000080)="4c00000012001f15b9409b849ac00a00a5784002000000000000030038c88cc055c5ac27a6c5b068d0bf46d323452536005ad94a461cdbfee9bdb942352359a351d1ec0cffc8792cd8000080", 0x4c, 0x810, 0x0, 0x0) r3 = socket$vsock_stream(0x28, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) connect$vsock_stream(r3, 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) 358.645011ms ago: executing program 2 (id=451): r0 = openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/fs/binfmt_misc/syz1\x00', 0x2, 0x0) pwritev(r0, &(0x7f0000000180)=[{&(0x7f00000002c0)='1', 0x1}, {&(0x7f0000000280)="b939", 0x2}], 0x2, 0x8, 0xa) 304.03284ms ago: executing program 1 (id=452): socket$inet_tcp(0x2, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4048aec9, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x44, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}]}, 0x44}}, 0x8000000) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="44000000090601020000000000000000000000000900020073797a310000000005000100070000001c00078018000180"], 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) 303.88835ms ago: executing program 2 (id=453): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000880), 0x0, 0x4) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, 0x0, 0x0) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0x3c, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_FLOW_MODE={0x8, 0x5, 0x2}]}}]}, 0x3c}}, 0x20000004) socket$pppoe(0x18, 0x1, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) epoll_create(0x6) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'wlan0\x00'}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) sendto$inet6(r3, &(0x7f0000000200)='pin', 0x3, 0x0, &(0x7f0000000300)={0xa, 0x1f90, 0x0, @loopback}, 0x1c) 238.75214ms ago: executing program 1 (id=454): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newlink={0x58, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0xffff}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @xfrm={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_XFRM_IF_ID={0x8, 0x2, 0xea}]}}}, @IFLA_IFNAME={0x14, 0x3, 'xfrm0\x00'}, @IFLA_CARRIER={0x5, 0x21, 0x4}]}, 0x58}}, 0x0) 237.709956ms ago: executing program 2 (id=455): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x90) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000"], 0x18, 0x5}, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x40}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x8d, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) 214.16976ms ago: executing program 1 (id=456): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0) r1 = dup(r0) r2 = syz_open_procfs(0x0, &(0x7f0000000200)='attr/keycreate\x00') mount$9p_fd(0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f0000000340)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 130.584917ms ago: executing program 1 (id=457): socket$inet_icmp(0x2, 0x2, 0x1) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(0xffffffffffffffff) landlock_create_ruleset(0xfffffffffffffffe, 0x5c, 0x0) socket$kcm(0x2, 0xa, 0x2) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @tid=r0}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0xfb17d000) r3 = socket$kcm(0x23, 0x5, 0x0) listen(r3, 0x800) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000f00)=[{&(0x7f0000000200)="5c00000014006b05c84e21000ab16d6e230675f811000000440002005817d30461bc24eeb556a7ef595105ea1698fa51f60a64c9f408000000e786a6d0bdbdc3d44bd70011b6c0504bb9189d9193e9bd00"/92, 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x240040c4) r5 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r5, &(0x7f0000000040)={0x23, 0x0, 0x58}, 0x10) sendto$phonet(r5, 0x0, 0x0, 0x80, 0x0, 0x0) accept4(r3, 0x0, 0x0, 0x80000) r6 = timerfd_create(0x1, 0x0) read(r6, &(0x7f0000002180)=""/262, 0x106) socket$nl_netfilter(0x10, 0x3, 0xc) openat(0xffffffffffffff9c, 0x0, 0x20842, 0x63) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$PPPIOCGIDLE(r1, 0x8010743f, 0x0) ptrace(0x10, r0) 61.559029ms ago: executing program 2 (id=458): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000400), 0x109000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0xe) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc1101, 0x0) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000340)=0x1) pwritev(r1, &(0x7f0000000780)=[{0x0}], 0x1, 0x217, 0x7) 61.338334ms ago: executing program 2 (id=459): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a28000000000a010200000000000000000200000908000240000000030900010073797a300000000098000000160a030000000000000000000200000a6c000380180003801400010064756d6d7930000000000000000000000800014000000000400003801400010073797a6b616c6c65723100000000000014000100697036677265746170edffadf3000000140001006970366772657461703000000000000008000240000000020900020073797a31000000000900010073797a300000000014000000110001"], 0xe8}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) writev(r0, &(0x7f0000000100)=[{&(0x7f00000008c0)="2e9b3d0007e03dd65193dfb6c575963f88645d8a35879d6911adc80d60d98e2deb6dbfe485d7dc00", 0x28}], 0x1) 375.529µs ago: executing program 0 (id=460): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) 150.586µs ago: executing program 0 (id=461): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000600)=ANY=[@ANYBLOB="3c000000240005040200"/20, @ANYRES32, @ANYBLOB="00000100ffffffff000000000c00010063616b655f6d71"], 0x3c}}, 0x0) 0s ago: executing program 3 (id=462): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'batadv0\x00'}) sendto$packet(r0, &(0x7f00000002c0)="08005e0101f101ca9a70b6010800", 0xe, 0x0, 0x0, 0x0) 0s ago: executing program 2 (id=464): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/usb_gadget/naa.5001405000000001\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/nexus\x00', 0x2, 0x0) write(r0, &(0x7f0000000340)='naa.5001405000000002\n\x00', 0x16) unlinkat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x200) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:51300' (ED25519) to the list of known hosts. [ 41.816060][ T43] kauditd_printk_skb: 20 callbacks suppressed [ 41.816073][ T43] audit: type=1400 audit(1791167954.574:141): avc: denied { mounton } for pid=5715 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 41.819062][ T43] audit: type=1400 audit(1791167954.574:142): avc: denied { mount } for pid=5715 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 41.819149][ T5715] cgroup: Unknown subsys name 'net' [ 41.820274][ T43] audit: type=1400 audit(1791167954.574:143): avc: denied { unmount } for pid=5715 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 41.948696][ T5715] cgroup: Unknown subsys name 'cpuset' [ 41.952311][ T5715] cgroup: Unknown subsys name 'rlimit' [ 42.111107][ T43] audit: type=1400 audit(1791167954.864:144): avc: denied { setattr } for pid=5715 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=848 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 42.111839][ T43] audit: type=1400 audit(1791167954.864:145): avc: denied { create } for pid=5715 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 42.112182][ T43] audit: type=1400 audit(1791167954.864:146): avc: denied { write } for pid=5715 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 42.112585][ T43] audit: type=1400 audit(1791167954.864:147): avc: denied { read } for pid=5715 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 42.125305][ T43] audit: type=1400 audit(1791167954.874:148): avc: denied { mounton } for pid=5715 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 42.125351][ T43] audit: type=1400 audit(1791167954.884:149): avc: denied { mount } for pid=5715 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 42.137408][ T43] audit: type=1400 audit(1791167954.894:150): avc: denied { read } for pid=5445 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 42.166497][ T5723] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 42.981533][ T5715] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 46.987950][ T43] kauditd_printk_skb: 8 callbacks suppressed [ 46.987963][ T43] audit: type=1400 audit(1791167959.744:159): avc: denied { create } for pid=5729 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 46.988529][ T43] audit: type=1400 audit(1791167959.744:160): avc: denied { read write } for pid=5729 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 46.989126][ T43] audit: type=1400 audit(1791167959.744:161): avc: denied { open } for pid=5729 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 47.001008][ T43] audit: type=1400 audit(1791167959.754:162): avc: denied { ioctl } for pid=5729 comm="syz-executor" path="socket:[2811]" dev="sockfs" ino=2811 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 47.029851][ T5739] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 47.030862][ T5739] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 47.031467][ T5739] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 47.031712][ T5739] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 47.032130][ T5739] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 47.032377][ T5739] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 47.034645][ T5740] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 47.037171][ T5739] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 47.039369][ T5744] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 47.040126][ T43] audit: type=1400 audit(1791167959.794:163): avc: denied { read } for pid=5729 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 47.040153][ T43] audit: type=1400 audit(1791167959.794:164): avc: denied { open } for pid=5729 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 47.042980][ T5743] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 47.047919][ T5090] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 47.048752][ T5090] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 47.048799][ T43] audit: type=1400 audit(1791167959.794:165): avc: denied { mounton } for pid=5729 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 47.048842][ T43] audit: type=1400 audit(1791167959.804:166): avc: denied { module_request } for pid=5729 comm="syz-executor" kmod="netdev-nr0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 47.049143][ T5090] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 47.050076][ T5090] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 47.050416][ T5090] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 47.050656][ T5740] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 47.052157][ T5740] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 47.056103][ T5734] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 47.060779][ T5734] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 47.061687][ T5090] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 47.087542][ T43] audit: type=1400 audit(1791167959.844:167): avc: denied { sys_module } for pid=5736 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 47.841772][ T5736] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.842385][ T5736] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.842493][ T5736] bridge_slave_0: entered allmulticast mode [ 47.843908][ T5736] bridge_slave_0: entered promiscuous mode [ 47.878359][ T5736] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.878440][ T5736] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.878544][ T5736] bridge_slave_1: entered allmulticast mode [ 47.879972][ T5736] bridge_slave_1: entered promiscuous mode [ 47.967815][ T5729] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.967881][ T5729] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.967970][ T5729] bridge_slave_0: entered allmulticast mode [ 47.969216][ T5729] bridge_slave_0: entered promiscuous mode [ 47.972369][ T5729] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.972515][ T5729] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.972610][ T5729] bridge_slave_1: entered allmulticast mode [ 47.974022][ T5729] bridge_slave_1: entered promiscuous mode [ 47.991179][ T5736] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.002850][ T5738] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.002921][ T5738] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.003013][ T5738] bridge_slave_0: entered allmulticast mode [ 48.004262][ T5738] bridge_slave_0: entered promiscuous mode [ 48.043696][ T5736] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.056844][ T5738] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.056957][ T5738] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.057665][ T5738] bridge_slave_1: entered allmulticast mode [ 48.059255][ T5738] bridge_slave_1: entered promiscuous mode [ 48.073595][ T5729] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.106942][ T5729] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.119655][ T5738] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.119872][ T5730] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.119946][ T5730] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.120041][ T5730] bridge_slave_0: entered allmulticast mode [ 48.121745][ T5730] bridge_slave_0: entered promiscuous mode [ 48.124764][ T5730] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.125131][ T5730] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.125227][ T5730] bridge_slave_1: entered allmulticast mode [ 48.126586][ T5730] bridge_slave_1: entered promiscuous mode [ 48.129801][ T5736] team0: Port device team_slave_0 added [ 48.163317][ T5738] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.165322][ T5730] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.167112][ T5736] team0: Port device team_slave_1 added [ 48.179016][ T5729] team0: Port device team_slave_0 added [ 48.200798][ T5730] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.202530][ T5729] team0: Port device team_slave_1 added [ 48.212514][ T5736] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.212528][ T5736] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.212551][ T5736] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.252989][ T5736] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.253007][ T5736] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.253026][ T5736] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.255191][ T5730] team0: Port device team_slave_0 added [ 48.256876][ T5738] team0: Port device team_slave_0 added [ 48.258265][ T5730] team0: Port device team_slave_1 added [ 48.275286][ T5738] team0: Port device team_slave_1 added [ 48.286817][ T5729] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.286831][ T5729] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.286851][ T5729] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.288995][ T5729] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.289007][ T5729] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.289026][ T5729] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.329349][ T5738] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.329365][ T5738] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.329385][ T5738] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.331305][ T5738] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.331319][ T5738] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.331340][ T5738] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.333503][ T5730] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.333516][ T5730] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.333533][ T5730] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.334960][ T5730] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.334970][ T5730] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.334986][ T5730] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.370130][ T5736] hsr_slave_0: entered promiscuous mode [ 48.371006][ T5736] hsr_slave_1: entered promiscuous mode [ 48.376962][ T5729] hsr_slave_0: entered promiscuous mode [ 48.377469][ T5729] hsr_slave_1: entered promiscuous mode [ 48.377796][ T5729] debugfs: 'hsr0' already exists in 'hsr' [ 48.377848][ T5729] Cannot create hsr debugfs directory [ 48.444722][ T5738] hsr_slave_0: entered promiscuous mode [ 48.445556][ T5738] hsr_slave_1: entered promiscuous mode [ 48.446088][ T5738] debugfs: 'hsr0' already exists in 'hsr' [ 48.446106][ T5738] Cannot create hsr debugfs directory [ 48.461801][ T5730] hsr_slave_0: entered promiscuous mode [ 48.462561][ T5730] hsr_slave_1: entered promiscuous mode [ 48.463076][ T5730] debugfs: 'hsr0' already exists in 'hsr' [ 48.463091][ T5730] Cannot create hsr debugfs directory [ 48.754836][ T5736] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 48.760583][ T5736] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.762437][ T5736] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 48.764741][ T5736] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.765303][ T5736] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 48.771532][ T5736] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.781429][ T5736] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 48.783328][ T5736] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.821235][ T5730] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 48.823101][ T5730] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.824039][ T5730] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 48.825777][ T5730] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.829164][ T5730] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 48.832190][ T5730] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.844033][ T5730] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 48.846289][ T5730] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.895047][ T5738] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 48.897530][ T5738] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.898066][ T5738] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 48.899552][ T5738] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.899921][ T5738] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 48.901867][ T5738] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.902864][ T5738] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 48.906711][ T5738] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.998078][ T5729] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 49.000170][ T5729] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 49.000557][ T5729] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 49.004030][ T5729] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 49.008104][ T5729] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 49.012732][ T5729] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 49.013338][ T5729] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 49.016016][ T5729] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 49.029125][ T5736] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.072649][ T5736] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.076480][ T5730] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.085461][ T5742] Bluetooth: hci3: command tx timeout [ 49.085601][ T5742] Bluetooth: hci2: command tx timeout [ 49.085677][ T5090] Bluetooth: hci1: command tx timeout [ 49.094424][ T207] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.094614][ T5090] Bluetooth: hci0: command tx timeout [ 49.094640][ T207] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.108304][ T207] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.108382][ T207] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.123720][ T5730] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.125361][ T5738] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.130842][ T70] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.130886][ T70] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.146377][ T70] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.146429][ T70] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.165098][ T5738] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.173708][ T70] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.173763][ T70] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.189684][ T70] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.189772][ T70] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.230325][ T5729] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.264199][ T5729] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.281335][ T70] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.281422][ T70] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.296543][ T70] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.297193][ T70] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.511131][ T5736] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.546955][ T5736] veth0_vlan: entered promiscuous mode [ 49.553073][ T5736] veth1_vlan: entered promiscuous mode [ 49.577909][ T5736] veth0_macvtap: entered promiscuous mode [ 49.583784][ T5736] veth1_macvtap: entered promiscuous mode [ 49.606107][ T5736] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.611922][ T5730] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.623314][ T5736] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.665597][ T5779] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.665746][ T5779] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.665788][ T5779] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.665818][ T5779] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.685871][ T5729] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.690646][ T5730] veth0_vlan: entered promiscuous mode [ 49.693077][ T5738] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.706975][ T5730] veth1_vlan: entered promiscuous mode [ 49.743547][ T1164] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.743565][ T1164] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.791209][ T5738] veth0_vlan: entered promiscuous mode [ 49.791426][ T1164] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.791440][ T1164] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.792816][ T5730] veth0_macvtap: entered promiscuous mode [ 49.807838][ T5730] veth1_macvtap: entered promiscuous mode [ 49.809763][ T5738] veth1_vlan: entered promiscuous mode [ 49.815705][ T43] audit: type=1400 audit(1791167962.574:168): avc: denied { mount } for pid=5736 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 49.818971][ T5729] veth0_vlan: entered promiscuous mode [ 49.825496][ T5729] veth1_vlan: entered promiscuous mode [ 49.845546][ T5730] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.849114][ T5730] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.850698][ T5738] veth0_macvtap: entered promiscuous mode [ 49.860282][ T5736] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 49.861025][ T5738] veth1_macvtap: entered promiscuous mode [ 49.881820][ T5738] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.902171][ T5738] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.902757][ T5729] veth0_macvtap: entered promiscuous mode [ 49.912496][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.913268][ T5729] veth1_macvtap: entered promiscuous mode [ 49.959536][ T70] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.959557][ T70] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.971204][ T5729] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.988436][ T5878] ======================================================= [ 49.988436][ T5878] WARNING: The mand mount option has been deprecated and [ 49.988436][ T5878] and is ignored by this kernel. Remove the mand [ 49.988436][ T5878] option from the mount to silence this warning. [ 49.988436][ T5878] ======================================================= [ 49.989574][ T5729] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 50.008711][ T70] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.008732][ T70] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.035656][ T5779] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.036350][ T70] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.036368][ T70] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.077990][ T70] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.078011][ T70] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.086268][ T5779] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.086298][ T5779] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.086327][ T5779] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.086358][ T5779] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.086387][ T5779] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.086416][ T5779] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.086446][ T5779] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.086477][ T5779] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.086500][ T5779] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.115034][ T75] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.115052][ T75] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.125852][ T5779] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.143025][ T70] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.143045][ T70] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.240033][ T5889] gadgetfs: bound to dummy_udc driver [ 50.494610][ T35] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 50.495388][ C3] gadgetfs: connected [ 50.495660][ T35] gadgetfs: disconnected [ 50.679382][ T5902] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 50.679513][ T5902] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 50.689774][ T5902] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 50.702043][ T5902] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 50.702131][ T5902] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 50.705683][ T5902] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 50.716078][ T5902] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 50.716128][ T5902] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 50.718605][ T5902] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 50.720288][ T5902] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 50.720321][ T5902] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 50.721614][ T5902] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 50.765719][ T9] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 50.860344][ T5909] oom_control is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 50.937648][ T9] usb 6-1: Using ep0 maxpacket: 16 [ 50.938664][ T9] usb 6-1: New USB device found, idVendor=0572, idProduct=cb00, bcdDevice=bb.c9 [ 50.941142][ T9] usb 6-1: config 251 has an invalid descriptor of length 0, skipping remainder of the config [ 50.943405][ T9] usb 6-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 50.943424][ T9] usb 6-1: Product: syz [ 50.943437][ T9] usb 6-1: SerialNumber: syz [ 51.103043][ T5916] random: crng reseeded on system resumption [ 51.159293][ T9] cxacru 6-1:251.0: usbatm_usb_probe: bind failed: -19! [ 51.162801][ T9] usb 6-1: USB disconnect, device number 2 [ 51.558383][ T5929] Console: switching to colour dummy device 80x25 [ 51.621962][ T5090] Bluetooth: hci1: unexpected subevent 0x06 length: 30 > 10 [ 51.817506][ T5944] Config c/1 of g1 needs at least one function. [ 51.817707][ T5944] udc dummy_udc.0: failed to start g1: -22 [ 51.817727][ T5944] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 51.821983][ T5944] UDC core: g1: couldn't find an available UDC or it's busy [ 51.898640][ T5946] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 52.003350][ T43] kauditd_printk_skb: 88 callbacks suppressed [ 52.003367][ T43] audit: type=1400 audit(1791167964.754:257): avc: denied { unmount } for pid=5736 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 52.026539][ T43] audit: type=1400 audit(1791167964.784:258): avc: denied { unmount } for pid=5736 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 52.174384][ T5952] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.475872][ T5933] pci 0000:00:01.0: [1af4:1050] type 00 class 0x030000 conventional PCI endpoint [ 52.488024][ T5933] pci 0000:00:01.0: BAR 0 [mem 0xfe000000-0xfe7fffff pref] [ 52.488187][ T5933] pci 0000:00:01.0: BAR 2 [mem 0x380800000000-0x380800003fff 64bit pref] [ 52.488244][ T5933] pci 0000:00:01.0: BAR 4 [mem 0xfeaf4000-0xfeaf4fff] [ 52.488366][ T5933] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 52.488830][ T5933] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 52.508536][ T5933] pci 0000:00:01.0: Adding to iommu group 1 [ 52.512041][ T5933] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 52.512054][ T5933] pci 0000:00:01.0: vgaarb: bridge control possible [ 52.512062][ T5933] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 52.527753][ T5933] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x807fffff pref]: assigned [ 52.530611][ T5933] pci 0000:00:01.0: BAR 2 [mem 0x380800000000-0x380800003fff 64bit pref]: assigned [ 52.539995][ T5933] pci 0000:00:01.0: BAR 4 [mem 0x80800000-0x80800fff]: assigned [ 52.584718][ T9] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 52.595280][ T43] audit: type=1400 audit(1791167965.354:259): avc: denied { unmount } for pid=5738 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 52.620278][ T5933] [drm] pci: virtio-vga detected at 0000:00:01.0 [ 52.622821][ T5933] virtio-pci 0000:00:01.0: vgaarb: deactivate vga console [ 52.623759][ T5933] [drm] features: -virgl +edid -resource_blob -host_visible [ 52.623767][ T5933] [drm] features: -context_init -blob_alignment [ 52.639433][ T5933] [drm] number of scanouts: 1 [ 52.639494][ T5933] [drm] number of cap sets: 0 [ 52.642611][ T5933] [drm:virtio_gpu_init.cold] *ERROR* modeset init failed [ 52.684891][ T5090] Bluetooth: hci0: command 0x040f tx timeout [ 52.736164][ T9] usb 6-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice= 1.00 [ 52.737220][ T9] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 52.737241][ T9] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 52.742837][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 52.742858][ T9] usb 6-1: Product: syz [ 52.742871][ T9] usb 6-1: Manufacturer: syz [ 52.742884][ T9] usb 6-1: SerialNumber: syz [ 52.764656][ T5090] Bluetooth: hci1: command 0x040f tx timeout [ 52.766525][ T5090] Bluetooth: hci3: command 0x040f tx timeout [ 52.766557][ T5090] Bluetooth: hci2: command 0x040f tx timeout [ 52.791682][ T9] usb 6-1: NFC: intf ffff8880556b3000 id ffffffff8fe92f80 [ 52.802203][ T5933] virtio_gpu virtio0: probe with driver virtio_gpu failed with error -4 [ 52.813153][ T9] nfcmrvl 6-1:1.0: NFC: registered with nci successfully [ 52.979464][ T9] usb 6-1: USB disconnect, device number 3 [ 52.980133][ T43] audit: type=1400 audit(1791167965.734:260): avc: denied { allowed } for pid=5977 comm="syz.3.32" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 52.986178][ T9] usb 6-1: NFC: intf ffff8880556b3000 [ 53.068957][ T43] audit: type=1400 audit(1791167965.824:261): avc: denied { name_bind } for pid=5979 comm="syz.1.33" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 53.069153][ T43] audit: type=1400 audit(1791167965.824:262): avc: denied { node_bind } for pid=5979 comm="syz.1.33" saddr=224.0.0.1 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 53.144642][ T25] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 53.210524][ T5985] netlink: 16 bytes leftover after parsing attributes in process `syz.3.35'. [ 53.305064][ T25] usb 5-1: New USB device found, idVendor=0582, idProduct=003b, bcdDevice= 0.40 [ 53.307283][ T25] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 53.307296][ T25] usb 5-1: Product: syz [ 53.307303][ T25] usb 5-1: Manufacturer: syz [ 53.307310][ T25] usb 5-1: SerialNumber: syz [ 53.518123][ T25] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 53.518149][ T25] usb 5-1: MIDIStreaming interface descriptor not found [ 53.536155][ T63] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 53.552823][ T25] usb 5-1: USB disconnect, device number 3 [ 53.600290][ T5996] udevd[5996]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 53.696544][ T63] usb 6-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice= 1.00 [ 53.697802][ T63] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 53.697825][ T63] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 53.701109][ T63] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 53.701129][ T63] usb 6-1: Product: syz [ 53.701140][ T63] usb 6-1: Manufacturer: syz [ 53.701149][ T63] usb 6-1: SerialNumber: syz [ 53.709985][ T63] usb 6-1: NFC: intf ffff888055f90000 id ffffffff8fe92f80 [ 53.722330][ T63] nfcmrvl 6-1:1.0: NFC: registered with nci successfully [ 53.748466][ T43] audit: type=1400 audit(1791167966.504:263): avc: denied { read } for pid=6005 comm="syz.2.40" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 53.748843][ T43] audit: type=1400 audit(1791167966.504:264): avc: denied { open } for pid=6005 comm="syz.2.40" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 53.749358][ T43] audit: type=1400 audit(1791167966.504:265): avc: denied { map_create } for pid=6005 comm="syz.2.40" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 53.750033][ T43] audit: type=1400 audit(1791167966.504:266): avc: denied { map_read map_write } for pid=6005 comm="syz.2.40" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 53.918307][ T5830] usb 6-1: USB disconnect, device number 4 [ 53.919874][ T5830] usb 6-1: NFC: intf ffff888055f90000 [ 54.124600][ T9] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 54.275693][ T9] usb 7-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice= 1.00 [ 54.279158][ T9] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 54.279174][ T9] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 54.280821][ T9] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 54.280838][ T9] usb 7-1: Product: syz [ 54.280848][ T9] usb 7-1: Manufacturer: syz [ 54.280857][ T9] usb 7-1: SerialNumber: syz [ 54.306872][ T852] usb 5-1: new low-speed USB device number 4 using dummy_hcd [ 54.312417][ T9] usb 7-1: NFC: intf ffff8880568f8000 id ffffffff8fe92f80 [ 54.331170][ T9] nfcmrvl 7-1:1.0: NFC: registered with nci successfully [ 54.434685][ T852] usb 5-1: device descriptor read/64, error -71 [ 54.462968][ T6023] netlink: 16 bytes leftover after parsing attributes in process `syz.1.45'. [ 54.507806][ T6025] bridge0: port 3(syz_tun) entered blocking state [ 54.507914][ T6025] bridge0: port 3(syz_tun) entered disabled state [ 54.508086][ T6025] syz_tun: entered allmulticast mode [ 54.510523][ T6025] syz_tun: entered promiscuous mode [ 54.511827][ T6025] bridge0: port 3(syz_tun) entered blocking state [ 54.511912][ T6025] bridge0: port 3(syz_tun) entered forwarding state [ 54.537668][ T6025] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 54.638889][ T6027] kvm: pic: single mode not supported [ 54.638917][ T6027] kvm: pic: level sensitive irq not supported [ 54.639377][ T6027] kvm: pic: non byte read [ 54.641159][ T6027] kvm: pic: non byte read [ 54.676800][ T852] usb 5-1: new low-speed USB device number 5 using dummy_hcd [ 54.765502][ T5090] Bluetooth: hci0: command 0x040f tx timeout [ 54.804665][ T852] usb 5-1: device descriptor read/64, error -71 [ 54.845027][ T5090] Bluetooth: hci2: command 0x040f tx timeout [ 54.845053][ T5090] Bluetooth: hci1: command 0x040f tx timeout [ 54.845067][ T5090] Bluetooth: hci3: command 0x040f tx timeout [ 54.901368][ T9] usb 7-1: USB disconnect, device number 2 [ 54.902398][ T9] usb 7-1: NFC: intf ffff8880568f8000 [ 54.915222][ T852] usb usb5-port1: attempt power cycle [ 55.012750][ T6037] syz.1.51 uses obsolete (PF_INET,SOCK_PACKET) [ 55.023190][ T6037] netlink: 'syz.1.51': attribute type 2 has an invalid length. [ 55.254554][ T852] usb 5-1: new low-speed USB device number 6 using dummy_hcd [ 55.275321][ T852] usb 5-1: device descriptor read/8, error -71 [ 55.405565][ T71] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 55.514618][ T852] usb 5-1: new low-speed USB device number 7 using dummy_hcd [ 55.535247][ T852] usb 5-1: device descriptor read/8, error -71 [ 55.566104][ T71] usb 7-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice= 1.00 [ 55.567130][ T71] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 55.567154][ T71] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 55.569262][ T71] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 55.569284][ T71] usb 7-1: Product: syz [ 55.569296][ T71] usb 7-1: Manufacturer: syz [ 55.569308][ T71] usb 7-1: SerialNumber: syz [ 55.575266][ T71] usb 7-1: NFC: intf ffff88802d4a8000 id ffffffff8fe92f80 [ 55.580747][ T71] nfcmrvl 7-1:1.0: NFC: registered with nci successfully [ 55.645032][ T852] usb usb5-port1: unable to enumerate USB device [ 55.780706][ T852] usb 7-1: USB disconnect, device number 3 [ 55.787084][ T852] usb 7-1: NFC: intf ffff88802d4a8000 [ 56.142755][ T6063] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 56.330152][ T6068] Zero length message leads to an empty skb [ 56.696744][ T6086] FAULT_INJECTION: forcing a failure. [ 56.696744][ T6086] name failslab, interval 1, probability 0, space 0, times 0 [ 56.696779][ T6086] CPU: 3 UID: 0 PID: 6086 Comm: syz.3.67 Not tainted syzkaller #0 PREEMPT(full) [ 56.696803][ T6086] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 56.696816][ T6086] Call Trace: [ 56.696823][ T6086] [ 56.696831][ T6086] dump_stack_lvl+0x100/0x190 [ 56.696866][ T6086] should_fail_ex.cold+0x5/0xa [ 56.696895][ T6086] should_failslab+0xc2/0x120 [ 56.696965][ T6086] __kmalloc_cache_noprof+0x91/0x6d0 [ 56.696988][ T6086] ? ip_vs_rht_alloc+0x56/0x710 [ 56.697043][ T6086] ip_vs_rht_alloc+0x56/0x710 [ 56.697069][ T6086] ? ip_vs_add_service+0x1659/0x2240 [ 56.697097][ T6086] ip_vs_svc_table_alloc.isra.0+0x2d/0xd0 [ 56.697129][ T6086] ip_vs_add_service+0x166e/0x2240 [ 56.697156][ T6086] ? __ip_vs_service_find+0x4d0/0x9c0 [ 56.697178][ T6086] ? find_held_lock+0x2b/0x80 [ 56.697207][ T6086] ? do_ip_vs_set_ctl+0x7e4/0xc90 [ 56.697234][ T6086] ? do_ip_vs_set_ctl+0xb86/0xc90 [ 56.697255][ T6086] do_ip_vs_set_ctl+0xb86/0xc90 [ 56.697296][ T6086] ? __pfx_do_ip_vs_set_ctl+0x10/0x10 [ 56.697318][ T6086] ? rcu_is_watching+0x13/0xc0 [ 56.697352][ T6086] ? find_held_lock+0x2b/0x80 [ 56.697381][ T6086] ? nf_sockopt_find.isra.0+0x222/0x290 [ 56.697410][ T6086] ? nf_sockopt_find.isra.0+0x222/0x290 [ 56.697450][ T6086] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 56.697512][ T6086] ? nf_setsockopt+0x8d/0xf0 [ 56.697540][ T6086] nf_setsockopt+0x8d/0xf0 [ 56.697574][ T6086] ip_setsockopt+0xcb/0xf0 [ 56.697600][ T6086] tcp_setsockopt+0xa7/0x100 [ 56.697632][ T6086] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 56.697657][ T6086] do_sock_setsockopt+0xf3/0x1d0 [ 56.697680][ T6086] __sys_setsockopt+0x195/0x220 [ 56.697714][ T6086] __x64_sys_setsockopt+0xbd/0x160 [ 56.697742][ T6086] ? do_syscall_64+0xae/0x790 [ 56.697764][ T6086] ? lockdep_hardirqs_on+0x7d/0x110 [ 56.697786][ T6086] do_syscall_64+0x123/0x790 [ 56.697810][ T6086] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 56.697830][ T6086] RIP: 0033:0x7f2dcff9e159 [ 56.697846][ T6086] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 56.697864][ T6086] RSP: 002b:00007f2dd0dfa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 56.697886][ T6086] RAX: ffffffffffffffda RBX: 00007f2dd0225fa0 RCX: 00007f2dcff9e159 [ 56.697899][ T6086] RDX: 0000000000000482 RSI: 0000000000000000 RDI: 0000000000000005 [ 56.697909][ T6086] RBP: 00007f2dd003506b R08: 000000000000002c R09: 0000000000000000 [ 56.697921][ T6086] R10: 0000200000000100 R11: 0000000000000246 R12: 0000000000000000 [ 56.697933][ T6086] R13: 00007f2dd0226038 R14: 00007f2dd0225fa0 R15: 00007ffe33615d18 [ 56.697960][ T6086] [ 56.854569][ T5742] Bluetooth: hci0: command 0x040f tx timeout [ 56.924615][ T5742] Bluetooth: hci3: command 0x040f tx timeout [ 56.924655][ T5734] Bluetooth: hci2: command 0x040f tx timeout [ 56.924776][ T5090] Bluetooth: hci1: command 0x040f tx timeout [ 57.262194][ T6099] netlink: 16 bytes leftover after parsing attributes in process `syz.1.74'. [ 57.277109][ T43] kauditd_printk_skb: 27 callbacks suppressed [ 57.277121][ T43] audit: type=1400 audit(1791167970.034:294): avc: denied { read } for pid=6101 comm="syz.2.75" name="ppp" dev="devtmpfs" ino=729 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 57.277145][ T43] audit: type=1400 audit(1791167970.034:295): avc: denied { open } for pid=6101 comm="syz.2.75" path="/dev/ppp" dev="devtmpfs" ino=729 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 57.296216][ T43] audit: type=1400 audit(1791167970.054:296): avc: denied { ioctl } for pid=6101 comm="syz.2.75" path="/dev/ppp" dev="devtmpfs" ino=729 ioctlcmd=0x7441 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 57.297853][ T6103] FAULT_INJECTION: forcing a failure. [ 57.297853][ T6103] name failslab, interval 1, probability 0, space 0, times 0 [ 57.297871][ T6103] CPU: 2 UID: 0 PID: 6103 Comm: syz.2.75 Not tainted syzkaller #0 PREEMPT(full) [ 57.297883][ T6103] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 57.297891][ T6103] Call Trace: [ 57.297895][ T6103] [ 57.297900][ T6103] dump_stack_lvl+0x100/0x190 [ 57.297921][ T6103] should_fail_ex.cold+0x5/0xa [ 57.297937][ T6103] should_failslab+0xc2/0x120 [ 57.297955][ T6103] __kmalloc_noprof+0xfc/0x840 [ 57.297969][ T6103] ? __might_fault+0xc5/0x140 [ 57.297979][ T6103] ? ethnl_default_notify+0x178/0x9f0 [ 57.297997][ T6103] ethnl_default_notify+0x178/0x9f0 [ 57.298015][ T6103] ? __pfx_ethnl_default_notify+0x10/0x10 [ 57.298038][ T6103] ? __pfx_ethnl_default_notify+0x10/0x10 [ 57.298052][ T6103] ethnl_notify+0x17c/0x360 [ 57.298067][ T6103] ethtool_set_link_ksettings+0x2df/0x4a0 [ 57.298079][ T6103] ? __pfx_ethtool_set_link_ksettings+0x10/0x10 [ 57.298091][ T6103] ? do_syscall_64+0x123/0x790 [ 57.298103][ T6103] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 57.298120][ T6103] ? bpf_lsm_capable+0x9/0x10 [ 57.298130][ T6103] ? security_capable+0x80/0x260 [ 57.298144][ T6103] dev_ethtool+0x43d0/0x6c40 [ 57.298154][ T6103] ? bpf_ksym_find+0x128/0x1c0 [ 57.298165][ T6103] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 57.298178][ T6103] ? is_bpf_text_address+0x94/0x1a0 [ 57.298197][ T6103] ? __pfx_dev_ethtool+0x10/0x10 [ 57.298211][ T6103] ? tomoyo_path_number_perm+0x46d/0x580 [ 57.298225][ T6103] ? stack_trace_save+0x8e/0xc0 [ 57.298236][ T6103] ? __pfx_stack_trace_save+0x10/0x10 [ 57.298248][ T6103] ? stack_depot_save_flags+0x27/0x9f0 [ 57.298264][ T6103] ? __lock_acquire+0x5c0/0x1f40 [ 57.298279][ T6103] ? __lock_acquire+0x5c0/0x1f40 [ 57.298291][ T6103] ? __kasan_slab_free+0x5f/0x80 [ 57.298306][ T6103] ? kfree+0x22b/0x6d0 [ 57.298315][ T6103] ? tomoyo_path_number_perm+0x46d/0x580 [ 57.298327][ T6103] ? security_file_ioctl+0xd3/0x230 [ 57.298343][ T6103] ? __x64_sys_ioctl+0xb7/0x210 [ 57.298355][ T6103] ? do_syscall_64+0x123/0x790 [ 57.298366][ T6103] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 57.298380][ T6103] ? lock_acquire+0x1d1/0x380 [ 57.298392][ T6103] ? avc_has_extended_perms+0x201/0x1080 [ 57.298410][ T6103] ? find_held_lock+0x2b/0x80 [ 57.298425][ T6103] ? avc_has_extended_perms+0x33a/0x1080 [ 57.298442][ T6103] ? avc_has_extended_perms+0x33a/0x1080 [ 57.298465][ T6103] ? __lock_acquire+0x5c0/0x1f40 [ 57.298485][ T6103] ? __pfx_avc_has_extended_perms+0x10/0x10 [ 57.298513][ T6103] ? lock_acquire+0x1d1/0x380 [ 57.298528][ T6103] ? dev_load+0x2a/0x240 [ 57.298547][ T6103] ? find_held_lock+0x2b/0x80 [ 57.298594][ T6103] ? dev_load+0x8e/0x240 [ 57.298611][ T6103] ? dev_load+0x8e/0x240 [ 57.298633][ T6103] dev_ioctl+0x63b/0x10e0 [ 57.298654][ T6103] sock_do_ioctl+0x1a0/0x280 [ 57.298671][ T6103] ? __pfx_sock_do_ioctl+0x10/0x10 [ 57.298686][ T6103] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 57.298707][ T6103] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 57.298722][ T6103] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 57.298742][ T6103] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 57.298764][ T6103] sock_ioctl+0x599/0x6b0 [ 57.298779][ T6103] ? __pfx_sock_ioctl+0x10/0x10 [ 57.298799][ T6103] ? selinux_file_ioctl+0x13b/0x290 [ 57.298817][ T6103] ? selinux_file_ioctl+0xb6/0x290 [ 57.298846][ T6103] ? __pfx_sock_ioctl+0x10/0x10 [ 57.298870][ T6103] __x64_sys_ioctl+0x18e/0x210 [ 57.298891][ T6103] do_syscall_64+0x123/0x790 [ 57.298913][ T6103] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 57.298932][ T6103] RIP: 0033:0x7fec0219e159 [ 57.298947][ T6103] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 57.298964][ T6103] RSP: 002b:00007fec03090028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 57.298978][ T6103] RAX: ffffffffffffffda RBX: 00007fec02425fa0 RCX: 00007fec0219e159 [ 57.298987][ T6103] RDX: 0000200000000040 RSI: 0000000000008946 RDI: 0000000000000005 [ 57.298995][ T6103] RBP: 00007fec0223506b R08: 0000000000000000 R09: 0000000000000000 [ 57.299006][ T6103] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 57.299015][ T6103] R13: 00007fec02426038 R14: 00007fec02425fa0 R15: 00007fff2a3dce88 [ 57.299039][ T6103] [ 57.685972][ T6114] netlink: 'syz.0.79': attribute type 2 has an invalid length. [ 57.783777][ T43] audit: type=1400 audit(1791167970.534:297): avc: denied { write } for pid=6117 comm="syz.3.80" path="socket:[9033]" dev="sockfs" ino=9033 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 57.785116][ T43] audit: type=1400 audit(1791167970.544:298): avc: denied { bind } for pid=6117 comm="syz.3.80" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 57.921650][ T43] audit: type=1400 audit(1791167970.674:299): avc: denied { read } for pid=6123 comm="syz.2.83" name="sg0" dev="devtmpfs" ino=720 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 57.921978][ T43] audit: type=1400 audit(1791167970.674:300): avc: denied { open } for pid=6123 comm="syz.2.83" path="/dev/sg0" dev="devtmpfs" ino=720 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 57.924084][ T43] audit: type=1400 audit(1791167970.674:301): avc: denied { map } for pid=6123 comm="syz.2.83" path="/dev/sg0" dev="devtmpfs" ino=720 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 57.924292][ T43] audit: type=1400 audit(1791167970.674:302): avc: denied { execute } for pid=6123 comm="syz.2.83" path="/dev/sg0" dev="devtmpfs" ino=720 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 57.927020][ T43] audit: type=1400 audit(1791167970.684:303): avc: denied { ioctl } for pid=6123 comm="syz.2.83" path="/dev/sg0" dev="devtmpfs" ino=720 ioctlcmd=0x2287 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 58.104624][ T25] usb 8-1: new low-speed USB device number 2 using dummy_hcd [ 58.177187][ T6138] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 58.254655][ T25] usb 8-1: device descriptor read/64, error -71 [ 58.504579][ T25] usb 8-1: new low-speed USB device number 3 using dummy_hcd [ 58.528635][ T6144] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.603904][ T6144] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 58.607245][ T6144] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 58.634605][ T25] usb 8-1: device descriptor read/64, error -71 [ 58.745718][ T25] usb usb8-port1: attempt power cycle [ 58.794640][ T5779] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 58.794682][ T5779] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 58.794712][ T5779] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 58.794740][ T5779] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 58.944695][ T5742] Bluetooth: hci0: command 0x040f tx timeout [ 59.004910][ T5742] Bluetooth: hci1: command 0x040f tx timeout [ 59.004944][ T5742] Bluetooth: hci2: command 0x040f tx timeout [ 59.018619][ T5090] Bluetooth: hci3: command 0x040f tx timeout [ 59.095229][ T25] usb 8-1: new low-speed USB device number 4 using dummy_hcd [ 59.115865][ T25] usb 8-1: device descriptor read/8, error -71 [ 59.374624][ T25] usb 8-1: new low-speed USB device number 5 using dummy_hcd [ 59.405274][ T25] usb 8-1: device descriptor read/8, error -71 [ 59.501774][ C0] vcan0: j1939_tp_rxtimer: 0xffff888025d97c00: rx timeout, send abort [ 59.503263][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff888025d97c00: 0x2f000: (3) A timeout occurred and this is the connection abort to close the session. [ 59.514969][ T25] usb usb8-port1: unable to enumerate USB device [ 59.591092][ T6166] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 60.134615][ T6168] hub 6-0:1.0: USB hub found [ 60.135072][ T6168] hub 6-0:1.0: 1 port detected [ 60.535776][ T6187] Driver unsupported XDP return value 0 on prog (id 3) dev N/A, expect packet loss! [ 60.894180][ T6203] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 60.924788][ T6215] batman_adv: batadv0: Adding interface: syzkaller0 [ 60.924800][ T6215] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 60.924815][ T6215] batman_adv: batadv0: Interface activated: syzkaller0 [ 60.927815][ T6214] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 60.938937][ T6214] batman_adv: batadv0: Removing interface: syzkaller0 [ 61.005632][ T5090] Bluetooth: hci0: command 0x040f tx timeout [ 61.084686][ T5090] Bluetooth: hci3: command 0x040f tx timeout [ 61.084721][ T5090] Bluetooth: hci2: command 0x040f tx timeout [ 61.084742][ T5090] Bluetooth: hci1: command 0x040f tx timeout [ 61.180142][ T1356] kernel write not supported for file /100/attr/keycreate (pid: 1356 comm: kworker/1:2) [ 61.534625][ T1356] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 61.685274][ T1356] usb 7-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 61.686610][ T1356] usb 7-1: config 1 has an invalid interface number: 3 but max is 0 [ 61.686632][ T1356] usb 7-1: config 1 has no interface number 0 [ 61.688766][ T1356] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 61.688779][ T1356] usb 7-1: Product: syz [ 61.688786][ T1356] usb 7-1: Manufacturer: syz [ 61.688793][ T1356] usb 7-1: SerialNumber: syz [ 61.693843][ T1356] usb 7-1: skipping empty audio interface (v1) [ 61.719600][ T1356] snd-usb-audio 7-1:1.3: probe with driver snd-usb-audio failed with error -22 [ 61.735900][ T5993] udevd[5993]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb7/7-1/7-1:1.3/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 61.824574][ T35] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 61.975334][ T35] usb 5-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice= 1.00 [ 61.976202][ T35] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 61.976226][ T35] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 61.977703][ T35] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 61.977715][ T35] usb 5-1: Product: syz [ 61.977724][ T35] usb 5-1: Manufacturer: syz [ 61.977732][ T35] usb 5-1: SerialNumber: syz [ 61.982587][ T35] usb 5-1: NFC: intf ffff88805537e000 id ffffffff8fe92f80 [ 61.992640][ T35] nfcmrvl 5-1:1.0: NFC: registered with nci successfully [ 62.044623][ T1356] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 62.189073][ T63] usb 5-1: USB disconnect, device number 8 [ 62.190488][ T63] usb 5-1: NFC: intf ffff88805537e000 [ 62.196483][ T1356] usb 8-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice= 1.00 [ 62.197509][ T1356] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 62.197523][ T1356] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 62.201437][ T1356] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 62.201456][ T1356] usb 8-1: Product: syz [ 62.201467][ T1356] usb 8-1: Manufacturer: syz [ 62.201479][ T1356] usb 8-1: SerialNumber: syz [ 62.215648][ T1356] usb 8-1: NFC: intf ffff88802b847000 id ffffffff8fe92f80 [ 62.236568][ T1356] nfcmrvl 8-1:1.0: NFC: registered with nci successfully [ 62.243074][ T6271] FAULT_INJECTION: forcing a failure. [ 62.243074][ T6271] name failslab, interval 1, probability 0, space 0, times 0 [ 62.243094][ T6271] CPU: 3 UID: 0 PID: 6271 Comm: syz.1.141 Not tainted syzkaller #0 PREEMPT(full) [ 62.243108][ T6271] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 62.243115][ T6271] Call Trace: [ 62.243120][ T6271] [ 62.243125][ T6271] dump_stack_lvl+0x100/0x190 [ 62.243146][ T6271] should_fail_ex.cold+0x5/0xa [ 62.243162][ T6271] should_failslab+0xc2/0x120 [ 62.243179][ T6271] __kmalloc_noprof+0xfc/0x840 [ 62.243193][ T6271] ? cache_create_net+0xa2/0x1f0 [ 62.243215][ T6271] cache_create_net+0xa2/0x1f0 [ 62.243231][ T6271] unix_gid_cache_create+0x60/0x130 [ 62.243246][ T6271] ? __pfx_sunrpc_init_net+0x10/0x10 [ 62.243257][ T6271] sunrpc_init_net+0x71/0x1b0 [ 62.243270][ T6271] ops_init+0x1e2/0x5f0 [ 62.243291][ T6271] setup_net+0x118/0x3a0 [ 62.243310][ T6271] ? __pfx_setup_net+0x10/0x10 [ 62.243345][ T6271] copy_net_ns+0x345/0x7a0 [ 62.243358][ T6271] create_new_namespaces+0x3ea/0xac0 [ 62.243376][ T6271] unshare_nsproxy_namespaces+0xf2/0x220 [ 62.243391][ T6271] ksys_unshare+0x4a2/0xa70 [ 62.243405][ T6271] ? __pfx_ksys_unshare+0x10/0x10 [ 62.243424][ T6271] __x64_sys_unshare+0x31/0x40 [ 62.243437][ T6271] do_syscall_64+0x123/0x790 [ 62.243451][ T6271] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 62.243463][ T6271] RIP: 0033:0x7f40fe79e159 [ 62.243473][ T6271] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 62.243483][ T6271] RSP: 002b:00007f40ff663028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 62.243495][ T6271] RAX: ffffffffffffffda RBX: 00007f40fea25fa0 RCX: 00007f40fe79e159 [ 62.243503][ T6271] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 [ 62.243509][ T6271] RBP: 00007f40fe83506b R08: 0000000000000000 R09: 0000000000000000 [ 62.243516][ T6271] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 62.243522][ T6271] R13: 00007f40fea26038 R14: 00007f40fea25fa0 R15: 00007ffc33777498 [ 62.243537][ T6271] [ 62.248319][ T1356] kernel write not supported for file /75/attr/keycreate (pid: 1356 comm: kworker/1:2) [ 62.342556][ T6279] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(3) [ 62.342573][ T6279] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 62.344269][ T6279] vhci_hcd vhci_hcd.0: Device attached [ 62.350433][ T43] kauditd_printk_skb: 31 callbacks suppressed [ 62.350449][ T43] audit: type=1400 audit(1791167975.104:335): avc: denied { create } for pid=6277 comm="syz.1.145" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 62.352483][ T6280] vhci_hcd: connection closed [ 62.354838][ T5779] vhci_hcd vhci_hcd.1: stop threads [ 62.355049][ T5779] vhci_hcd vhci_hcd.1: release socket [ 62.355067][ T5779] vhci_hcd vhci_hcd.1: disconnect device [ 62.414096][ T63] usb 8-1: USB disconnect, device number 6 [ 62.422428][ T63] usb 8-1: NFC: intf ffff88802b847000 [ 62.887328][ T43] audit: type=1400 audit(1791167975.644:336): avc: denied { setopt } for pid=6285 comm="syz.1.147" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 62.887751][ T43] audit: type=1400 audit(1791167975.644:337): avc: denied { connect } for pid=6285 comm="syz.1.147" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 63.164619][ T5742] Bluetooth: hci1: command 0x040f tx timeout [ 63.300505][ T6306] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 63.355450][ T35] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 63.484654][ T35] usb 8-1: device descriptor read/64, error -71 [ 63.694577][ T1356] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 63.734615][ T35] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 63.845393][ T1356] usb 5-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice= 1.00 [ 63.846393][ T1356] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 63.846407][ T1356] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 63.848152][ T1356] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 63.848164][ T1356] usb 5-1: Product: syz [ 63.848172][ T1356] usb 5-1: Manufacturer: syz [ 63.848179][ T1356] usb 5-1: SerialNumber: syz [ 63.854658][ T1356] usb 5-1: NFC: intf ffff88802e53e000 id ffffffff8fe92f80 [ 63.866716][ T1356] nfcmrvl 5-1:1.0: NFC: registered with nci successfully [ 63.874764][ T35] usb 8-1: device descriptor read/64, error -71 [ 63.986400][ T35] usb usb8-port1: attempt power cycle [ 64.263866][ T5435] usb 7-1: USB disconnect, device number 4 [ 64.324598][ T35] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 64.344984][ T35] usb 8-1: device descriptor read/8, error -71 [ 64.602864][ T6334] mtrr: base(0x20000000) is not aligned on a size(0x7000) boundary [ 64.605055][ T35] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 64.625467][ T35] usb 8-1: device descriptor read/8, error -71 [ 64.632101][ T43] audit: type=1400 audit(1791167977.384:338): avc: denied { write } for pid=6335 comm="syz.2.167" name="sg0" dev="devtmpfs" ino=720 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 64.660915][ T43] audit: type=1400 audit(1791167977.414:339): avc: denied { write } for pid=6337 comm="syz.2.168" name="ppp" dev="devtmpfs" ino=729 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 64.745057][ T35] usb usb8-port1: unable to enumerate USB device [ 65.991767][ T6292] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 65.993623][ T3380] usb 5-1: USB disconnect, device number 9 [ 65.995192][ T3380] usb 5-1: NFC: intf ffff88802e53e000 [ 66.236865][ T43] audit: type=1400 audit(1791167978.994:340): avc: denied { ioctl } for pid=6356 comm="syz.3.175" path="socket:[12451]" dev="sockfs" ino=12451 ioctlcmd=0x890b scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 66.352650][ T6363] mtrr: base(0x20000000) is not aligned on a size(0x0000) boundary [ 66.535054][ T6369] 9p: Bad value for 'rfdno' [ 66.624617][ T35] usb 8-1: new high-speed USB device number 11 using dummy_hcd [ 66.642600][ T43] audit: type=1400 audit(1791167979.394:341): avc: denied { read } for pid=6375 comm="syz.2.184" name="nvram" dev="devtmpfs" ino=631 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 66.642630][ T43] audit: type=1400 audit(1791167979.394:342): avc: denied { open } for pid=6375 comm="syz.2.184" path="/dev/nvram" dev="devtmpfs" ino=631 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 66.690785][ T43] audit: type=1400 audit(1791167979.444:343): avc: denied { bind } for pid=6373 comm="syz.0.183" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 66.752524][ T43] audit: type=1400 audit(1791167979.504:344): avc: denied { connect } for pid=6382 comm="syz.2.187" lport=60 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 66.753715][ T6383] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 66.775346][ T35] usb 8-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 66.776697][ T35] usb 8-1: config 1 has an invalid interface number: 3 but max is 0 [ 66.776711][ T35] usb 8-1: config 1 has no interface number 0 [ 66.779900][ T35] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 66.779914][ T35] usb 8-1: Product: syz [ 66.779921][ T35] usb 8-1: Manufacturer: syz [ 66.779928][ T35] usb 8-1: SerialNumber: syz [ 66.786068][ T35] usb 8-1: skipping empty audio interface (v1) [ 66.805674][ T35] snd-usb-audio 8-1:1.3: probe with driver snd-usb-audio failed with error -22 [ 66.818220][ T5993] udevd[5993]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb8/8-1/8-1:1.3/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 66.939725][ T6389] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 67.174124][ T6393] mtrr: base(0x20000000) is not aligned on a size(0x0000) boundary [ 67.461847][ T6407] FAULT_INJECTION: forcing a failure. [ 67.461847][ T6407] name failslab, interval 1, probability 0, space 0, times 0 [ 67.461881][ T6407] CPU: 3 UID: 0 PID: 6407 Comm: syz.1.198 Not tainted syzkaller #0 PREEMPT(full) [ 67.461902][ T6407] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 67.461913][ T6407] Call Trace: [ 67.461918][ T6407] [ 67.461925][ T6407] dump_stack_lvl+0x100/0x190 [ 67.461955][ T6407] should_fail_ex.cold+0x5/0xa [ 67.461980][ T6407] should_failslab+0xc2/0x120 [ 67.462007][ T6407] kmem_cache_alloc_bulk_noprof+0x77/0x890 [ 67.462036][ T6407] ? __pfx___cant_migrate+0x10/0x10 [ 67.462065][ T6407] xdp_test_run_batch.constprop.0+0x1561/0x1ca0 [ 67.462103][ T6407] ? __pfx_xdp_test_run_batch.constprop.0+0x10/0x10 [ 67.462124][ T6407] ? lock_acquire+0x1d1/0x380 [ 67.462145][ T6407] ? find_held_lock+0x2b/0x80 [ 67.462182][ T6407] ? ktime_get+0x23e/0x320 [ 67.462205][ T6407] ? ktime_get+0x1a4/0x320 [ 67.462230][ T6407] bpf_test_run_xdp_live+0x367/0x760 [ 67.462253][ T6407] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 67.462276][ T6407] ? lock_acquire+0x1d1/0x380 [ 67.462300][ T6407] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 67.462324][ T6407] ? find_held_lock+0x2b/0x80 [ 67.462352][ T6407] ? bpf_dispatcher_change_prog+0x6c3/0xa50 [ 67.462384][ T6407] ? __pfx_wait_rcu_exp_gp+0x10/0x10 [ 67.462407][ T6407] ? 0xffffffffa0405200 [ 67.462422][ T6407] ? 0xffffffffa0405200 [ 67.462440][ T6407] ? bpf_dispatcher_change_prog+0x2de/0xa50 [ 67.462465][ T6407] bpf_prog_test_run_xdp+0xd86/0x1670 [ 67.462501][ T6407] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 67.462532][ T6407] ? fput+0x7c/0x100 [ 67.462557][ T6407] ? __bpf_prog_get+0x97/0x290 [ 67.462581][ T6407] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 67.462603][ T6407] __sys_bpf+0x2265/0x4a30 [ 67.462631][ T6407] ? __pfx___sys_bpf+0x10/0x10 [ 67.462651][ T6407] ? find_held_lock+0x2b/0x80 [ 67.462675][ T6407] ? futex_wake+0x4ea/0x5e0 [ 67.462713][ T6407] ? putname+0xb1/0x110 [ 67.462741][ T6407] ? kmem_cache_free+0x127/0x6c0 [ 67.462777][ T6407] ? __x64_sys_futex+0x34f/0x4d0 [ 67.462805][ T6407] ? __x64_sys_futex+0x358/0x4d0 [ 67.462830][ T6407] ? __x64_sys_openat+0x12d/0x210 [ 67.462856][ T6407] ? __pfx___x64_sys_futex+0x10/0x10 [ 67.462889][ T6407] ? __x64_sys_bpf+0xce/0x140 [ 67.462909][ T6407] __x64_sys_bpf+0xce/0x140 [ 67.462933][ T6407] ? do_syscall_64+0xae/0x790 [ 67.462958][ T6407] do_syscall_64+0x123/0x790 [ 67.462982][ T6407] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 67.463001][ T6407] RIP: 0033:0x7f40fe79e159 [ 67.463014][ T6407] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 67.463031][ T6407] RSP: 002b:00007f40ff663028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 67.463048][ T6407] RAX: ffffffffffffffda RBX: 00007f40fea25fa0 RCX: 00007f40fe79e159 [ 67.463059][ T6407] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 67.463069][ T6407] RBP: 00007f40fe83506b R08: 0000000000000000 R09: 0000000000000000 [ 67.463080][ T6407] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 67.463098][ T6407] R13: 00007f40fea26038 R14: 00007f40fea25fa0 R15: 00007ffc33777498 [ 67.463126][ T6407] [ 67.616747][ T43] kauditd_printk_skb: 6 callbacks suppressed [ 67.616759][ T43] audit: type=1326 audit(1791167980.374:351): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6423 comm="syz.0.206" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f006879e159 code=0x7ffc0000 [ 67.616897][ T43] audit: type=1326 audit(1791167980.374:352): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6423 comm="syz.0.206" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f006879e159 code=0x7ffc0000 [ 67.617272][ T43] audit: type=1326 audit(1791167980.374:353): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6423 comm="syz.0.206" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f006879e159 code=0x7ffc0000 [ 67.617365][ T43] audit: type=1326 audit(1791167980.374:354): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6423 comm="syz.0.206" exe="/syz-executor" sig=0 arch=c000003e syscall=68 compat=0 ip=0x7f006879e159 code=0x7ffc0000 [ 67.617418][ T43] audit: type=1326 audit(1791167980.374:355): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6423 comm="syz.0.206" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f006879e159 code=0x7ffc0000 [ 67.617656][ T43] audit: type=1326 audit(1791167980.374:356): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6423 comm="syz.0.206" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f006879e159 code=0x7ffc0000 [ 67.617694][ T43] audit: type=1326 audit(1791167980.374:357): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6423 comm="syz.0.206" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f006879e159 code=0x7ffc0000 [ 67.617931][ T43] audit: type=1326 audit(1791167980.374:358): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6423 comm="syz.0.206" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f006879e159 code=0x7ffc0000 [ 67.618008][ T43] audit: type=1326 audit(1791167980.374:359): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6423 comm="syz.0.206" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f006879e159 code=0x7ffc0000 [ 67.618088][ T43] audit: type=1326 audit(1791167980.374:360): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6423 comm="syz.0.206" exe="/syz-executor" sig=0 arch=c000003e syscall=305 compat=0 ip=0x7f006879e159 code=0x7ffc0000 [ 67.934213][ T6454] ip_tables: iptables: counters copy to user failed while replacing table [ 67.971336][ T6456] netlink: 16 bytes leftover after parsing attributes in process `syz.0.221'. [ 68.248689][ T6469] Set syz1 is full, maxelem 14 reached [ 68.497247][ T6475] netlink: 'syz.1.230': attribute type 2 has an invalid length. [ 69.023684][ T6468] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 69.023850][ T6468] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 69.023977][ T6468] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 69.024112][ T6468] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 69.068969][ T6490] FAULT_INJECTION: forcing a failure. [ 69.068969][ T6490] name failslab, interval 1, probability 0, space 0, times 0 [ 69.068990][ T6490] CPU: 2 UID: 0 PID: 6490 Comm: syz.2.233 Not tainted syzkaller #0 PREEMPT(full) [ 69.069005][ T6490] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 69.069012][ T6490] Call Trace: [ 69.069016][ T6490] [ 69.069021][ T6490] dump_stack_lvl+0x100/0x190 [ 69.069042][ T6490] should_fail_ex.cold+0x5/0xa [ 69.069076][ T6490] should_failslab+0xc2/0x120 [ 69.069097][ T6490] __kmalloc_noprof+0xfc/0x840 [ 69.069112][ T6490] ? cache_create_net+0xa2/0x1f0 [ 69.069129][ T6490] cache_create_net+0xa2/0x1f0 [ 69.069143][ T6490] unix_gid_cache_create+0x60/0x130 [ 69.069158][ T6490] ? __pfx_sunrpc_init_net+0x10/0x10 [ 69.069169][ T6490] sunrpc_init_net+0x71/0x1b0 [ 69.069181][ T6490] ops_init+0x1e2/0x5f0 [ 69.069200][ T6490] setup_net+0x118/0x3a0 [ 69.069217][ T6490] ? __pfx_setup_net+0x10/0x10 [ 69.069240][ T6490] copy_net_ns+0x345/0x7a0 [ 69.069253][ T6490] create_new_namespaces+0x3ea/0xac0 [ 69.069272][ T6490] unshare_nsproxy_namespaces+0xf2/0x220 [ 69.069295][ T6490] ksys_unshare+0x4a2/0xa70 [ 69.069316][ T6490] ? __pfx_ksys_unshare+0x10/0x10 [ 69.069349][ T6490] __x64_sys_unshare+0x31/0x40 [ 69.069372][ T6490] do_syscall_64+0x123/0x790 [ 69.069397][ T6490] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 69.069418][ T6490] RIP: 0033:0x7fec0219e159 [ 69.069434][ T6490] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 69.069452][ T6490] RSP: 002b:00007fec03090028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 69.069473][ T6490] RAX: ffffffffffffffda RBX: 00007fec02425fa0 RCX: 00007fec0219e159 [ 69.069485][ T6490] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 [ 69.069496][ T6490] RBP: 00007fec0223506b R08: 0000000000000000 R09: 0000000000000000 [ 69.069507][ T6490] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 69.069520][ T6490] R13: 00007fec02426038 R14: 00007fec02425fa0 R15: 00007fff2a3dce88 [ 69.069540][ T6490] [ 69.252543][ T6505] tipc: Started in network mode [ 69.252564][ T6505] tipc: Node identity fe2a90642ca6, cluster identity 4711 [ 69.252800][ T6505] tipc: Enabled bearer , priority 0 [ 69.253371][ T6505] syzkaller0: entered promiscuous mode [ 69.253382][ T6505] syzkaller0: entered allmulticast mode [ 69.258354][ T6505] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 69.281451][ T6505] sch_tbf: burst 8 is lower than device syzkaller0 mtu (1514) ! [ 69.283219][ T6505] tipc: Resetting bearer [ 69.291807][ T6504] tipc: Resetting bearer [ 69.300718][ T6509] 9p: Bad value for 'rfdno' [ 69.303324][ T6504] tipc: Disabling bearer [ 69.395022][ T852] usb 8-1: USB disconnect, device number 11 [ 69.403098][ T6519] netlink: 16 bytes leftover after parsing attributes in process `syz.2.248'. [ 69.510954][ T6534] FAULT_INJECTION: forcing a failure. [ 69.510954][ T6534] name failslab, interval 1, probability 0, space 0, times 0 [ 69.510984][ T6534] CPU: 1 UID: 0 PID: 6534 Comm: syz.0.255 Not tainted syzkaller #0 PREEMPT(full) [ 69.511008][ T6534] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 69.511020][ T6534] Call Trace: [ 69.511028][ T6534] [ 69.511036][ T6534] dump_stack_lvl+0x100/0x190 [ 69.511068][ T6534] should_fail_ex.cold+0x5/0xa [ 69.511099][ T6534] should_failslab+0xc2/0x120 [ 69.511126][ T6534] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 69.511152][ T6534] ? __alloc_skb+0x140/0x710 [ 69.511184][ T6534] __alloc_skb+0x140/0x710 [ 69.511215][ T6534] ? __alloc_skb+0x5b7/0x710 [ 69.511243][ T6534] ? __pfx___alloc_skb+0x10/0x10 [ 69.511270][ T6534] ? netlink_has_listeners+0x21b/0x430 [ 69.511296][ T6534] ? netlink_has_listeners+0x21b/0x430 [ 69.511328][ T6534] alloc_uevent_skb+0x7d/0x210 [ 69.511360][ T6534] kobject_uevent_env+0xd2d/0x18b0 [ 69.511393][ T6534] ? nfs_netns_sysfs_setup+0x55/0x200 [ 69.511420][ T6534] nfs_netns_sysfs_setup+0x173/0x200 [ 69.511442][ T6534] nfs_net_init+0x10a/0x340 [ 69.511463][ T6534] ? __pfx_nfs_net_init+0x10/0x10 [ 69.511480][ T6534] ops_init+0x1e2/0x5f0 [ 69.511512][ T6534] setup_net+0x118/0x3a0 [ 69.511565][ T6534] ? __pfx_setup_net+0x10/0x10 [ 69.511605][ T6534] copy_net_ns+0x345/0x7a0 [ 69.511630][ T6534] create_new_namespaces+0x3ea/0xac0 [ 69.511662][ T6534] unshare_nsproxy_namespaces+0xf2/0x220 [ 69.511689][ T6534] ksys_unshare+0x4a2/0xa70 [ 69.511713][ T6534] ? __pfx_ksys_unshare+0x10/0x10 [ 69.511748][ T6534] __x64_sys_unshare+0x31/0x40 [ 69.511772][ T6534] do_syscall_64+0x123/0x790 [ 69.511796][ T6534] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 69.511815][ T6534] RIP: 0033:0x7f006879e159 [ 69.511832][ T6534] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 69.511849][ T6534] RSP: 002b:00007f00695aa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 69.511869][ T6534] RAX: ffffffffffffffda RBX: 00007f0068a25fa0 RCX: 00007f006879e159 [ 69.511882][ T6534] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 [ 69.511890][ T6534] RBP: 00007f006883506b R08: 0000000000000000 R09: 0000000000000000 [ 69.511899][ T6534] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 69.511911][ T6534] R13: 00007f0068a26038 R14: 00007f0068a25fa0 R15: 00007ffc234432a8 [ 69.511938][ T6534] [ 69.828207][ T6551] FAULT_INJECTION: forcing a failure. [ 69.828207][ T6551] name failslab, interval 1, probability 0, space 0, times 0 [ 69.828239][ T6551] CPU: 3 UID: 0 PID: 6551 Comm: syz.2.261 Not tainted syzkaller #0 PREEMPT(full) [ 69.828262][ T6551] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 69.828274][ T6551] Call Trace: [ 69.828281][ T6551] [ 69.828288][ T6551] dump_stack_lvl+0x100/0x190 [ 69.828321][ T6551] should_fail_ex.cold+0x5/0xa [ 69.828350][ T6551] should_failslab+0xc2/0x120 [ 69.828379][ T6551] kmem_cache_alloc_noprof+0x92/0x6a0 [ 69.828404][ T6551] ? mas_preallocate+0xc22/0xee0 [ 69.828432][ T6551] mas_preallocate+0xc22/0xee0 [ 69.828461][ T6551] ? __pfx_mas_preallocate+0x10/0x10 [ 69.828483][ T6551] ? rcu_is_watching+0x13/0xc0 [ 69.828518][ T6551] ? vm_area_alloc+0x1f/0x160 [ 69.828549][ T6551] ? lockdep_init_map_type+0x5c/0x250 [ 69.828583][ T6551] __mmap_region+0x139f/0x32e0 [ 69.828610][ T6551] ? __pfx___mmap_region+0x10/0x10 [ 69.828635][ T6551] ? stack_depot_save_flags+0x49a/0x9f0 [ 69.828672][ T6551] ? stack_depot_save_flags+0x49a/0x9f0 [ 69.828702][ T6551] ? kasan_save_stack+0x3f/0x50 [ 69.828726][ T6551] ? kasan_save_stack+0x30/0x50 [ 69.828756][ T6551] ? __kasan_slab_alloc+0x89/0x90 [ 69.828784][ T6551] ? kmem_cache_alloc_noprof+0x269/0x6a0 [ 69.828809][ T6551] ? avc_alloc_node+0x24/0x670 [ 69.828838][ T6551] ? avc_compute_av+0x101/0x820 [ 69.828865][ T6551] ? avc_perm_nonode+0xb1/0x180 [ 69.828893][ T6551] ? avc_has_perm_noaudit+0x37a/0x470 [ 69.828921][ T6551] ? avc_has_perm+0xbd/0x1e0 [ 69.829013][ T6551] mmap_region+0x5a8/0x6d0 [ 69.829037][ T6551] ? __pfx_mmap_region+0x10/0x10 [ 69.829076][ T6551] ? shmem_mapping+0xd/0x50 [ 69.829099][ T6551] ? __pfx_memfd_check_seals_mmap+0x10/0x10 [ 69.829131][ T6551] ? bpf_lsm_mmap_addr+0x9/0x30 [ 69.829158][ T6551] ? security_mmap_addr+0x71/0x1e0 [ 69.829186][ T6551] ? __get_unmapped_area+0x255/0x3e0 [ 69.829216][ T6551] do_mmap+0x12c7/0x1c30 [ 69.829247][ T6551] ? lock_acquire+0x1d1/0x380 [ 69.829269][ T6551] ? __pfx_do_mmap+0x10/0x10 [ 69.829295][ T6551] ? __pfx___might_resched+0x10/0x10 [ 69.829315][ T6551] ? bpf_lsm_current_getlsmprop_subj+0x9/0x10 [ 69.829335][ T6551] ? security_current_getlsmprop_subj+0x6e/0x130 [ 69.829361][ T6551] ? __pfx_down_write_killable+0x10/0x10 [ 69.829392][ T6551] vm_mmap_pgoff+0x28d/0x470 [ 69.829420][ T6551] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 69.829442][ T6551] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 69.829484][ T6551] ksys_mmap_pgoff+0x285/0x610 [ 69.829513][ T6551] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 69.829536][ T6551] ? xfd_validate_state+0x129/0x190 [ 69.829561][ T6551] __x64_sys_mmap+0x125/0x190 [ 69.829591][ T6551] do_syscall_64+0x123/0x790 [ 69.829616][ T6551] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 69.829637][ T6551] RIP: 0033:0x7fec0219e159 [ 69.829653][ T6551] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 69.829671][ T6551] RSP: 002b:00007fec03090028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 69.829692][ T6551] RAX: ffffffffffffffda RBX: 00007fec02425fa0 RCX: 00007fec0219e159 [ 69.829706][ T6551] RDX: 0000000000000002 RSI: 0000000000ff5000 RDI: 0000200000000000 [ 69.829718][ T6551] RBP: 00007fec0223506b R08: ffffffffffffffff R09: 0000000000000000 [ 69.829729][ T6551] R10: 000000000004c831 R11: 0000000000000246 R12: 0000000000000000 [ 69.829740][ T6551] R13: 00007fec02426038 R14: 00007fec02425fa0 R15: 00007fff2a3dce88 [ 69.829767][ T6551] [ 69.844371][ T852] usb 8-1: new high-speed USB device number 12 using dummy_hcd [ 69.952559][ T6563] netlink: 16 bytes leftover after parsing attributes in process `syz.0.267'. [ 69.996853][ T852] usb 8-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 69.997836][ T852] usb 8-1: config 1 has an invalid interface number: 3 but max is 0 [ 69.997853][ T852] usb 8-1: config 1 has no interface number 0 [ 69.999688][ T852] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 69.999705][ T852] usb 8-1: Product: syz [ 69.999715][ T852] usb 8-1: Manufacturer: syz [ 69.999725][ T852] usb 8-1: SerialNumber: syz [ 70.010041][ T852] usb 8-1: skipping empty audio interface (v1) [ 70.040396][ T852] snd-usb-audio 8-1:1.3: probe with driver snd-usb-audio failed with error -22 [ 70.063688][ T5993] udevd[5993]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb8/8-1/8-1:1.3/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 70.214355][ T3380] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 70.284358][ T5742] Bluetooth: hci0: command 0x040f tx timeout [ 70.365726][ T3380] usb 7-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice= 1.00 [ 70.366721][ T3380] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 70.366741][ T3380] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 70.368556][ T3380] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 70.368577][ T3380] usb 7-1: Product: syz [ 70.368589][ T3380] usb 7-1: Manufacturer: syz [ 70.368608][ T3380] usb 7-1: SerialNumber: syz [ 70.376665][ T3380] usb 7-1: NFC: intf ffff88805532d000 id ffffffff8fe92f80 [ 70.385539][ T3380] nfcmrvl 7-1:1.0: NFC: registered with nci successfully [ 70.580461][ T35] usb 7-1: USB disconnect, device number 5 [ 70.589219][ T35] usb 7-1: NFC: intf ffff88805532d000 [ 71.094950][ T5742] Bluetooth: hci3: command 0x040f tx timeout [ 71.094994][ T5742] Bluetooth: hci2: command 0x040f tx timeout [ 71.095006][ T5090] Bluetooth: hci1: command 0x040f tx timeout [ 71.248361][ T1441] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.248410][ T1441] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.261060][ T1043] cfg80211: failed to load regulatory.db [ 71.494227][ T3380] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 71.645301][ T3380] usb 5-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice= 1.00 [ 71.646188][ T3380] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 71.646202][ T3380] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 71.647749][ T3380] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 71.647761][ T3380] usb 5-1: Product: syz [ 71.647800][ T3380] usb 5-1: Manufacturer: syz [ 71.647809][ T3380] usb 5-1: SerialNumber: syz [ 71.652275][ T3380] usb 5-1: NFC: intf ffff88803de6f000 id ffffffff8fe92f80 [ 71.659713][ T3380] nfcmrvl 5-1:1.0: NFC: registered with nci successfully [ 71.859420][ T852] usb 5-1: USB disconnect, device number 10 [ 71.861155][ T852] usb 5-1: NFC: intf ffff88803de6f000 [ 72.394156][ T852] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 72.525872][ T852] usb 7-1: device descriptor read/64, error -71 [ 72.575678][ T1043] usb 8-1: USB disconnect, device number 12 [ 72.701361][ T6661] bonding: bond0 is being created... [ 72.703705][ T6661] bonding: bond0 already exists [ 72.765730][ T852] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 72.894021][ T852] usb 7-1: device descriptor read/64, error -71 [ 72.948762][ T6673] netlink: 16 bytes leftover after parsing attributes in process `syz.1.310'. [ 73.017201][ T852] usb usb7-port1: attempt power cycle [ 73.373986][ T852] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 73.394651][ T852] usb 7-1: device descriptor read/8, error -71 [ 73.643935][ T852] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 73.664576][ T852] usb 7-1: device descriptor read/8, error -71 [ 73.775058][ T852] usb usb7-port1: unable to enumerate USB device [ 74.086062][ T43] kauditd_printk_skb: 30 callbacks suppressed [ 74.086077][ T43] audit: type=1400 audit(1791170546.843:391): avc: denied { create } for pid=6688 comm="syz.3.317" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 74.089097][ T6689] netlink: 'syz.3.317': attribute type 2 has an invalid length. [ 75.302438][ T6705] FAULT_INJECTION: forcing a failure. [ 75.302438][ T6705] name failslab, interval 1, probability 0, space 0, times 0 [ 75.302470][ T6705] CPU: 3 UID: 0 PID: 6705 Comm: syz.2.322 Not tainted syzkaller #0 PREEMPT(full) [ 75.302494][ T6705] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 75.302507][ T6705] Call Trace: [ 75.302515][ T6705] [ 75.302523][ T6705] dump_stack_lvl+0x100/0x190 [ 75.302568][ T6705] should_fail_ex.cold+0x5/0xa [ 75.302597][ T6705] should_failslab+0xc2/0x120 [ 75.302639][ T6705] kmem_cache_alloc_noprof+0x92/0x6a0 [ 75.302665][ T6705] ? __proc_create+0xc1/0x8f0 [ 75.302687][ T6705] ? __proc_create+0x247/0x8f0 [ 75.302713][ T6705] __proc_create+0x247/0x8f0 [ 75.302738][ T6705] ? __pfx___proc_create+0x10/0x10 [ 75.302765][ T6705] ? _raw_write_unlock+0x28/0x50 [ 75.302797][ T6705] proc_create_reg+0x75/0x170 [ 75.302820][ T6705] proc_create_data+0x86/0x110 [ 75.302841][ T6705] ? __pfx_proc_create_data+0x10/0x10 [ 75.302862][ T6705] ? cache_register_net+0x137/0x5e0 [ 75.302893][ T6705] ? cache_register_net+0x137/0x5e0 [ 75.302922][ T6705] cache_register_net+0x1e0/0x5e0 [ 75.302951][ T6705] nfsd_export_init+0xb6/0x250 [ 75.302970][ T6705] ? __pfx_nfsd_net_init+0x10/0x10 [ 75.303013][ T6705] nfsd_net_init+0x69/0x480 [ 75.303040][ T6705] ? __pfx_nfsd_net_init+0x10/0x10 [ 75.303070][ T6705] ops_init+0x1e2/0x5f0 [ 75.303104][ T6705] setup_net+0x118/0x3a0 [ 75.303135][ T6705] ? __pfx_setup_net+0x10/0x10 [ 75.303170][ T6705] copy_net_ns+0x345/0x7a0 [ 75.303193][ T6705] create_new_namespaces+0x3ea/0xac0 [ 75.303224][ T6705] unshare_nsproxy_namespaces+0xf2/0x220 [ 75.303249][ T6705] ksys_unshare+0x4a2/0xa70 [ 75.303270][ T6705] ? __pfx_ksys_unshare+0x10/0x10 [ 75.303300][ T6705] __x64_sys_unshare+0x31/0x40 [ 75.303322][ T6705] do_syscall_64+0x123/0x790 [ 75.303347][ T6705] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.303368][ T6705] RIP: 0033:0x7fec0219e159 [ 75.303386][ T6705] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 75.303404][ T6705] RSP: 002b:00007fec03090028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 75.303424][ T6705] RAX: ffffffffffffffda RBX: 00007fec02425fa0 RCX: 00007fec0219e159 [ 75.303437][ T6705] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 [ 75.303450][ T6705] RBP: 00007fec0223506b R08: 0000000000000000 R09: 0000000000000000 [ 75.303464][ T6705] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 75.303477][ T6705] R13: 00007fec02426038 R14: 00007fec02425fa0 R15: 00007fff2a3dce88 [ 75.303524][ T6705] [ 75.514859][ T43] audit: type=1400 audit(1791170548.273:392): avc: denied { ioctl } for pid=6708 comm="syz.2.324" path="socket:[13823]" dev="sockfs" ino=13823 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 75.515676][ T43] audit: type=1400 audit(1791170548.273:393): avc: denied { write } for pid=6708 comm="syz.2.324" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 75.580387][ T43] audit: type=1400 audit(1791170548.333:394): avc: denied { create } for pid=6712 comm="syz.2.326" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 75.739178][ T6665] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 75.797469][ T43] audit: type=1400 audit(1791170548.553:395): avc: denied { append } for pid=6720 comm="syz.2.330" name="pfkey" dev="proc" ino=4026533256 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 76.721829][ T6741] 9p: Bad value for 'rfdno' [ 76.768485][ T43] audit: type=1400 audit(1791170549.513:396): avc: denied { create } for pid=6749 comm="syz.0.339" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 76.770918][ T43] audit: type=1400 audit(1791170549.523:397): avc: denied { write } for pid=6749 comm="syz.0.339" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 76.771003][ T43] audit: type=1400 audit(1791170549.523:398): avc: denied { nlmsg_write } for pid=6749 comm="syz.0.339" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 76.771908][ T43] audit: type=1400 audit(1791170549.523:399): avc: denied { read } for pid=5738 comm="syz-executor" name="loop3" dev="devtmpfs" ino=659 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 76.772044][ T43] audit: type=1400 audit(1791170549.523:400): avc: denied { open } for pid=5738 comm="syz-executor" path="/dev/loop3" dev="devtmpfs" ino=659 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 76.848780][ T6756] netlink: 'syz.0.342': attribute type 2 has an invalid length. [ 76.883879][ T6760] netlink: 4 bytes leftover after parsing attributes in process `syz.3.343'. [ 77.066880][ T6771] 9p: Bad value for 'rfdno' [ 77.153948][ T6784] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 77.227315][ T6791] netlink: 12 bytes leftover after parsing attributes in process `syz.2.352'. [ 77.642699][ T6823] can0: slcan on ttyS3. [ 77.724339][ T6823] can0 (unregistered): slcan off ttyS3. [ 77.753442][ T1043] usb 7-1: new low-speed USB device number 10 using dummy_hcd [ 77.905454][ T1043] usb 7-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 77.906429][ T1043] usb 7-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 77.906467][ T1043] usb 7-1: config 168 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 77.907378][ T1043] usb 7-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 77.907412][ T1043] usb 7-1: config 168 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 77.908312][ T1043] usb 7-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 77.909734][ T1043] usb 7-1: config 168 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 77.912341][ T1043] usb 7-1: string descriptor 0 read error: -22 [ 77.912439][ T1043] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 77.919162][ T1043] adutux 7-1:168.0: interrupt endpoints not found [ 77.983698][ T6840] 9p: Bad value for 'rfdno' [ 78.293467][ T25] usb 7-1: USB disconnect, device number 10 [ 79.107518][ T6895] netlink: 5 bytes leftover after parsing attributes in process `syz.0.394'. [ 79.110101][ T6895] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 79.159778][ T43] kauditd_printk_skb: 5 callbacks suppressed [ 79.159789][ T43] audit: type=1400 audit(1791170551.913:406): avc: denied { mount } for pid=6897 comm="syz.0.395" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 79.177861][ T43] audit: type=1400 audit(1791170551.933:407): avc: denied { unmount } for pid=5729 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 79.214495][ T6900] netlink: 28 bytes leftover after parsing attributes in process `syz.0.396'. [ 79.325183][ T6867] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 79.326347][ T6867] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 79.326454][ T6867] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 79.326544][ T6867] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 79.506344][ T43] audit: type=1400 audit(1791170552.263:408): avc: denied { create } for pid=6916 comm="syz.1.404" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 79.510022][ T43] audit: type=1400 audit(1791170552.263:409): avc: denied { ioctl } for pid=6916 comm="syz.1.404" path="socket:[14492]" dev="sockfs" ino=14492 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 79.514438][ T43] audit: type=1400 audit(1791170552.273:410): avc: denied { write } for pid=6916 comm="syz.1.404" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 79.515757][ T43] audit: type=1400 audit(1791170552.273:411): avc: denied { read } for pid=6916 comm="syz.1.404" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 79.621293][ T43] audit: type=1400 audit(1791170552.373:412): avc: denied { setopt } for pid=6931 comm="syz.3.411" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 79.888424][ T6946] netlink: 16 bytes leftover after parsing attributes in process `syz.0.417'. [ 79.959185][ T6950] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 80.426041][ T6930] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 80.426231][ T6930] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 80.427898][ T6930] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 80.428032][ T6930] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 80.732774][ T6984] netlink: 'syz.0.432': attribute type 2 has an invalid length. $ƚgJupc]X" ^NOa*/H l2<6x1X=Sln&*i'{8c@pUN)='(@BR8G^OF)rmф)beܚ?\ӽ =ǯ.96Rt~V]Rؤ02 [ 80.935576][ T7007] netlink: 20 bytes leftover after parsing attributes in process `syz.3.441'. [ 81.071031][ T43] audit: type=1400 audit(1791170553.823:413): avc: denied { mount } for pid=7018 comm="syz.3.446" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 81.091029][ T43] audit: type=1400 audit(1791170553.843:414): avc: denied { unmount } for pid=5738 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 81.563969][ T6989] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 81.564119][ T6989] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 81.564457][ T6989] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 81.564541][ T6989] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 81.598896][ T7028] batman_adv: batadv0: Adding interface: syzkaller0 [ 81.598912][ T7028] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.598939][ T7028] batman_adv: batadv0: Interface activated: syzkaller0 [ 81.653114][ T7034] netlink: 20 bytes leftover after parsing attributes in process `syz.1.452'. [ 81.742092][ T7038] A link change request failed with some changes committed already. Interface xfrm0 may have been left with an inconsistent configuration, please check. [ 81.829807][ T7026] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 81.848569][ T7026] batman_adv: batadv0: Removing interface: syzkaller0 [ 81.876789][ T7045] netlink: 'syz.1.457': attribute type 2 has an invalid length. [ 81.969530][ T7057] netlink: 12 bytes leftover after parsing attributes in process `syz.0.461'. [ 82.008729][ T43] audit: type=1400 audit(1791170554.764:415): avc: denied { write } for pid=7063 comm="syz.2.464" name="functions" dev="configfs" ino=8186 scontext=root:sysadm_r:sysadm ** replaying previous printk message ** [ 82.008729][ T43] audit: type=1400 audit(1791170554.764:415): avc: denied { write } for pid=7063 comm="syz.2.464" name="functions" dev="configfs" ino=8186 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 82.020597][ T7064] [ 82.030055][ T7064] ====================================================== [ 82.032399][ T7064] WARNING: possible circular locking dependency detected [ 82.034703][ T7064] syzkaller #0 Not tainted [ 82.036314][ T7064] ------------------------------------------------------ [ 82.038585][ T7064] syz.2.464/7064 is trying to acquire lock: [ 82.040518][ T7064] ffffffff8ffb3ce8 (&subsys->su_mutex){+.+.}-{4:4}, at: configfs_rmdir+0x5ae/0x950 [ 82.043554][ T7064] [ 82.043554][ T7064] but task is already holding lock: [ 82.045907][ T7064] ffff8880559c9440 (&sb->s_type->i_mutex_key#26){++++}-{4:4}, at: vfs_rmdir+0xed/0x8a0 [ 82.048941][ T7064] [ 82.048941][ T7064] which lock already depends on the new lock. [ 82.048941][ T7064] [ 82.052255][ T7064] [ 82.052255][ T7064] the existing dependency chain (in reverse order) is: [ 82.055032][ T7064] [ 82.055032][ T7064] -> #2 (&sb->s_type->i_mutex_key#26){++++}-{4:4}: [ 82.057732][ T7064] lock_acquire+0x1d1/0x380 [ 82.059384][ T7064] down_write+0x8b/0x1f0 [ 82.060910][ T7064] configfs_depend_item_unlocked+0xf3/0x6a0 [ 82.062991][ T7064] usbg_make_tpg+0x251/0x610 [ 82.064618][ T7064] target_fabric_make_tpg+0xab/0x8c0 [ 82.066484][ T7064] configfs_mkdir+0x525/0xd40 [ 82.068164][ T7064] vfs_mkdir+0x364/0x850 [ 82.069738][ T7064] filename_mkdirat+0x48b/0x5e0 [ 82.071501][ T7064] __x64_sys_mkdirat+0x89/0xc0 [ 82.073296][ T7064] do_syscall_64+0x123/0x790 [ 82.074940][ T7064] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.077014][ T7064] [ 82.077014][ T7064] -> #1 (tpg_instances_lock){+.+.}-{4:4}: [ 82.079570][ T7064] lock_acquire+0x1d1/0x380 [ 82.081218][ T7064] __mutex_lock+0x1a4/0x1bd0 [ 82.082926][ T7064] usbg_make_tpg+0x10b/0x610 [ 82.084609][ T7064] target_fabric_make_tpg+0xab/0x8c0 [ 82.086473][ T7064] configfs_mkdir+0x525/0xd40 [ 82.088106][ T7064] vfs_mkdir+0x364/0x850 [ 82.089655][ T7064] filename_mkdirat+0x48b/0x5e0 [ 82.091436][ T7064] __x64_sys_mkdirat+0x89/0xc0 [ 82.093280][ T7064] do_syscall_64+0x123/0x790 [ 82.095150][ T7064] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.097434][ T7064] [ 82.097434][ T7064] -> #0 (&subsys->su_mutex){+.+.}-{4:4}: [ 82.099958][ T7064] check_prev_add+0xeb/0xe60 [ 82.101706][ T7064] __lock_acquire+0x1528/0x1f40 [ 82.103617][ T7064] lock_acquire+0x1d1/0x380 [ 82.105228][ T7064] __mutex_lock+0x1a4/0x1bd0 [ 82.106889][ T7064] configfs_rmdir+0x5ae/0x950 [ 82.108643][ T7064] vfs_rmdir+0x328/0x8a0 [ 82.110169][ T7064] filename_rmdir+0x31a/0x5c0 [ 82.112055][ T7064] __x64_sys_unlinkat+0xf5/0x130 [ 82.114291][ T7064] do_syscall_64+0x123/0x790 [ 82.116395][ T7064] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.119030][ T7064] [ 82.119030][ T7064] other info that might help us debug this: [ 82.119030][ T7064] [ 82.123255][ T7064] Chain exists of: [ 82.123255][ T7064] &subsys->su_mutex --> tpg_instances_lock --> &sb->s_type->i_mutex_key#26 [ 82.123255][ T7064] [ 82.129143][ T7064] Possible unsafe locking scenario: [ 82.129143][ T7064] [ 82.132212][ T7064] CPU0 CPU1 [ 82.134464][ T7064] ---- ---- [ 82.136709][ T7064] lock(&sb->s_type->i_mutex_key#26); [ 82.138936][ T7064] lock(tpg_instances_lock); [ 82.141958][ T7064] lock(&sb->s_type->i_mutex_key#26); [ 82.145271][ T7064] lock(&subsys->su_mutex); [ 82.147242][ T7064] [ 82.147242][ T7064] *** DEADLOCK *** [ 82.147242][ T7064] [ 82.150635][ T7064] locks held by syz.2.464/7064: 3, last CPU#1: [ 82.153231][ T7064] #0: ffff88802493e460 (sb_writers#15){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x5c0 [ 82.156963][ T7064] #1: ffff8880559cac00 (&sb->s_type->i_mutex_key#7/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x5c0 [ 82.160916][ T7064] #2: ffff8880559c9440 (&sb->s_type->i_mutex_key#26){++++}-{4:4}, at: vfs_rmdir+0xed/0x8a0 [ 82.164613][ T7064] [ 82.164613][ T7064] stack backtrace: [ 82.166703][ T7064] CPU: 1 UID: 0 PID: 7064 Comm: syz.2.464 Not tainted syzkaller #0 PREEMPT(full) [ 82.169455][ T7064] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 82.172499][ T7064] Call Trace: [ 82.173525][ T7064] [ 82.174440][ T7064] dump_stack_lvl+0x100/0x190 [ 82.175988][ T7064] print_circular_bug.cold+0x178/0x1be [ 82.177820][ T7064] check_noncircular+0x146/0x160 [ 82.179430][ T7064] ? check_prev_add+0x354/0xe60 [ 82.181028][ T7064] check_prev_add+0xeb/0xe60 [ 82.182542][ T7064] ? __lock_acquire+0xe8b/0x1f40 [ 82.184117][ T7064] __lock_acquire+0x1528/0x1f40 [ 82.185615][ T7064] ? __lock_acquire+0x5c0/0x1f40 [ 82.187262][ T7064] lock_acquire+0x1d1/0x380 [ 82.188846][ T7064] ? configfs_rmdir+0x5ae/0x950 [ 82.190429][ T7064] ? __pfx___might_resched+0x10/0x10 [ 82.192216][ T7064] __mutex_lock+0x1a4/0x1bd0 [ 82.193724][ T7064] ? configfs_rmdir+0x5ae/0x950 [ 82.195347][ T7064] ? configfs_rmdir+0x5ae/0x950 [ 82.196946][ T7064] ? reacquire_held_locks+0xdd/0x1f0 [ 82.198650][ T7064] ? fast_dput+0x494/0x6f0 [ 82.200152][ T7064] ? __pfx___mutex_lock+0x10/0x10 [ 82.201916][ T7064] ? do_raw_spin_lock+0x128/0x260 [ 82.203608][ T7064] ? find_held_lock+0x2b/0x80 [ 82.205146][ T7064] ? fast_dput+0x2fe/0x6f0 [ 82.206602][ T7064] ? _raw_spin_unlock+0x28/0x50 [ 82.208271][ T7064] ? fast_dput+0x168/0x6f0 [ 82.209727][ T7064] ? configfs_rmdir+0x5ae/0x950 [ 82.211318][ T7064] configfs_rmdir+0x5ae/0x950 [ 82.213136][ T7064] ? __pfx_configfs_rmdir+0x10/0x10 [ 82.214787][ T7064] ? __pfx_down_write+0x10/0x10 [ 82.216323][ T7064] vfs_rmdir+0x328/0x8a0 [ 82.217661][ T7064] filename_rmdir+0x31a/0x5c0 [ 82.219164][ T7064] ? __pfx_filename_rmdir+0x10/0x10 [ 82.220805][ T7064] ? do_getname+0x191/0x390 [ 82.222295][ T7064] __x64_sys_unlinkat+0xf5/0x130 [ 82.223885][ T7064] do_syscall_64+0x123/0x790 [ 82.225340][ T7064] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.227194][ T7064] RIP: 0033:0x7fec0219e159 [ 82.228638][ T7064] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 82.234973][ T7064] RSP: 002b:00007fec03090028 EFLAGS: 00000246 ORIG_RAX: 0000000000000107 [ 82.238406][ T7064] RAX: ffffffffffffffda RBX: 00007fec02425fa0 RCX: 00007fec0219e159 [ 82.241302][ T7064] RDX: 0000000000000200 RSI: 00002000000002c0 RDI: ffffffffffffff9c [ 82.243849][ T7064] RBP: 00007fec0223506b R08: 0000000000000000 R09: 0000000000000000 [ 82.246311][ T7064] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 82.248804][ T7064] R13: 00007fec02426038 R14: 00007fec02425fa0 R15: 00007fff2a3dce88 [ 82.251288][ T7064] [ 82.842777][ T5090] Bluetooth: hci0: command 0x040f tx timeout [ 83.642844][ T5742] Bluetooth: hci2: command 0x040f tx timeout [ 83.642880][ T5742] Bluetooth: hci1: command 0x040f tx timeout [ 83.642929][ T5090] Bluetooth: hci3: command 0x040f tx timeout