last executing test programs: 15.088163678s ago: executing program 2 (id=884): madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(0xffffffffffffffff, 0x54a2) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) ioctl$KVM_GET_PIT2(r0, 0x8070ae9f, &(0x7f0000000200)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(0xffffffffffffffff, 0x0, 0x0) fchdir(r4) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000480)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x4000000}, 0x50) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000340)={0x1b, 0x0, 0x0, 0x40000, 0x0, r5, 0xfff}, 0x50) write(r0, &(0x7f0000000080)='4', 0x1) 14.164394333s ago: executing program 0 (id=886): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1002}) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000900)={'syzkaller0\x00', 0x41}) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r1) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB='8\x00\x00', @ANYRES16=r2, @ANYBLOB="01000000000000000000010000000000000001410000001c0017fffffffd000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) write(r0, &(0x7f0000000380)="fff766fffdff00000000000188ca0d525c8e6318100000000000010001000032aacb9d0200000000000000223db2b54700"/58, 0x3a) 13.20168555s ago: executing program 2 (id=891): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x7, 0x6, 0x9, 0x0, 0xffffffffffffffff, 0x100}, 0x50) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f0000000040), 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r2, &(0x7f0000000300)='md0\x00', 0x3) r3 = socket$inet_sctp(0x2, 0x1, 0x84) listen(r3, 0xda90) accept4(r3, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(0xffffffffffffffff, &(0x7f0000000600)='raid1\x00', 0x5) r4 = fsopen(&(0x7f0000000300)='nfs4\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000c00)='sec\x00', &(0x7f0000000d00)='krb5\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000c00)='sec\x00', &(0x7f0000000d00)='krb5\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/block/md0/md/raid_disks\x00', 0x400, 0x0) write(r5, &(0x7f0000000800)='1\x00', 0x1) r6 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r6, &(0x7f0000000a00)='1:0\x00', 0x3) r7 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/block/md0/md/dev-ram0/slot\x00', 0x2, 0x0) write$khugepaged_scan(r7, &(0x7f0000000080), 0x8) r8 = openat(0xffffffffffffff9c, &(0x7f0000000d00)='./sys/block/md0/md/array_state\x00', 0x2, 0x0) write(r8, &(0x7f0000000e00)='active\x00', 0x6) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x7, 0x17, &(0x7f00000007c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x6, 0x0, 0xb, 0x9, 0x0, 0x1, 0x20000000}, {0x66, 0x0, 0x0, 0x256c6c64}}, [@printk={@ld, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x1, 0x5, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {}, {0x15}}], {{0x7, 0x1, 0x3, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000000)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 13.072448502s ago: executing program 1 (id=893): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x8000) bpf$MAP_CREATE(0x0, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, 0x0, 0x884) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) r4 = openat2(0xffffffffffffffff, &(0x7f00000003c0)='./file0/../file0\x00', &(0x7f0000000380)={0x100, 0x0, 0x8}, 0x18) read$FUSE(r4, &(0x7f0000000c00)={0x2020}, 0x2020) r5 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r6 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r6, 0x40146f2c, &(0x7f00000000c0)={0x1, 0x0, 0x0, 0x13, 0x4}) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0x1, 0x1f4}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x40040001, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 12.231804556s ago: executing program 0 (id=894): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x129240, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r1, 0x3ba0, &(0x7f0000000540)={0x48, 0x2, r2, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r4, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_HWPT_ALLOC$TEST(r1, 0x3b89, &(0x7f00000001c0)={0x28, 0x0, r3, r4, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000180)}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r1, 0x3ba0, &(0x7f0000000640)={0x48, 0xa, r5}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r1, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r4, 0x0, 0x0, 0x0, 0x0, 0x1}) 12.206255524s ago: executing program 4 (id=895): pipe(&(0x7f00000001c0)) fsopen(0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000040)={0x0, 0xc1, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x42, 0x3, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc81d, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) 12.126618626s ago: executing program 3 (id=896): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) fcntl$lock(r0, 0x25, &(0x7f0000019100)={0x0, 0x4, 0x3, 0x69}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="020700"], 0x10}}, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00') pread64(r3, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200) r4 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000480), 0xffffffffffffffff) write$nci(r4, &(0x7f00000004c0)=ANY=[], 0x102) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) mremap(&(0x7f0000a94000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000259000/0x4000)=nil) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast2, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0xfffffffffffffffc, 0xff}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe8) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x1c) request_key(&(0x7f0000000000)='cifs.idmap\x00', &(0x7f0000019080)={'syz', 0x3}, &(0x7f00000190c0)='):-+\x00', 0xfffffffffffffffb) ioctl$PPPIOCGL2TPSTATS(r3, 0x80487436, &(0x7f0000019180)) socket(0x2, 0xa, 0x0) 11.499784245s ago: executing program 1 (id=897): socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$VT_ACTIVATE(r0, 0x4b63, 0x3) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x181) r2 = bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0x1c, &(0x7f0000000040)=ANY=[@ANYBLOB="18080000e0000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bca900000000000035090100000000009500000000000000b7020000000000007b9af8ff00000000b509020001000000dbaaf8fff1000000bf8200000000000007080000f8ffffffbfa400000000000007090000f0ffffffc70200000800000018220000", @ANYRES32, @ANYBLOB="000000000000000900000000080000004608f1ff76000000bf9800000000000056080000000000008500000007000000b7000000000000009500000000000000"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdir(&(0x7f0000000100)='./file1\x00', 0x13b) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x189482) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r3) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="090d2000000000f0ff000700000008000300", @ANYRES32=r5, @ANYBLOB="0800051d000000001400060076657468115f746f5f7465616d0000000400cc0008000500090000001400040073"], 0x58}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000010024bd7000fc0ddf2500000000", @ANYRES32=0x0, @ANYBLOB="1b0b04000300000008001b"], 0x28}, 0x1, 0x0, 0x0, 0x68010}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="050000000000000000007dcaafe9993f830b23d47dd2c857fcb605479f2df4000796fbb02c1e9961e8a0fbbacfe15c89bec62219f86eaf58784016e964ed230c3e39192634a74f78b6effaeba1ef597d8dab0f04d98dfd102ac2b18ffa08e76b76de1872c2cb775905f41ed8634416ad9f04d01ff4263c54d46623859b3a8f872653550cab18776e60e4b9bc9bbb05bd3a5f514d442f7644461bfabe882161a6e303f1886170c235ae015627c2f466046ae6b576761e0ffc253b18cefdcf4553134047013bdb0f6d3932ced1d1af545b0b8e29ca4fe8e16c7b0918d416bb95563807065cd598bfe5c8fee5220e40d842343bb1007dfc610091416699a8aaee6e62b152ec8078316cd139fa06", @ANYRES32=r9, @ANYBLOB="0800050003000000"], 0x24}}, 0x0) 11.104143931s ago: executing program 4 (id=898): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000080), 0x80000001, 0x162842) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) socket$inet6(0xa, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000000300)=""/102400, 0x19000) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000001ac0)={r0, 0x2000, {0x0, 0x0, 0x0, 0x3, 0x14a1fd, 0x0, 0x0, 0x1e, 0x1c, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1ca43f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d2", "24431a1e77a68e00000010e200", [0x0, 0x400]}}) 10.831247852s ago: executing program 0 (id=899): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, 0x0) ioctl$vim2m_VIDIOC_QBUF(r1, 0xc058560f, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x7f7) write(0xffffffffffffffff, &(0x7f0000000180)='10000', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) r3 = socket$inet(0x2, 0x5, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, 0x0, 0x0) write(r2, &(0x7f0000000200)='1', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r4, &(0x7f0000000280)='0', 0x1) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_NEWRULE={0x74, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x48, 0x4, 0x0, 0x1, [{0x44, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_MATCH_NAME={0xd, 0x1, 'devgroup\x00'}, @NFTA_MATCH_REV={0x8}, @NFTA_MATCH_INFO={0x17, 0x3, "0400"/19}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xfc}}, 0x0) 10.829352135s ago: executing program 2 (id=900): socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0xbe1165819e56e499, 0x0, &(0x7f0000000040)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/mdstat\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) lsm_set_self_attr(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="6800000000000000ffffffffffffffff37004000000000001700000000000000719253c233c813bb57cc2450c9c8b97d24ecc020f50021773d4de76111fd211beaa24970d4b748a098664d3feeb16a67fe80832b81ad2b83c55a9ab86d8894cfbb37a719586f59116986c66925cb8ca0b3b58743b735f26a6358cb2863bda1a1a71d4a9b72f833f57048cd"], 0x37, 0x0) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) 10.645681742s ago: executing program 3 (id=901): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, 0x0, &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001040)=@newsa={0x140, 0x10, 0x713, 0x70bd26, 0x0, {{@in=@remote, @in=@dev={0xac, 0x14, 0x14, 0x13}, 0x4e22, 0x1, 0x0, 0x3, 0x2, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, {@in6=@initdev={0xfe, 0x88, '\x00', 0xfe, 0x0}, 0x0, 0x33}, @in6=@local, {0x0, 0x0, 0xb, 0xa, 0x6, 0x0, 0x0, 0x3}, {0x0, 0x7, 0x2, 0xffffff7ffffffff8}, {0xc, 0x0, 0x2}, 0x70bd29, 0x0, 0x2, 0x4}, [@algo_auth={0x48, 0x1, {{'blake2s-224-arm\x00'}}}, @tfcpad={0x8, 0x16, 0x4}]}, 0x140}, 0x1, 0x0, 0x0, 0xc0}, 0x4840) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000480)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x4000000}, 0x50) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000340)={0x1b, 0x0, 0x0, 0x40000, 0x0, r3, 0xfff}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x15, 0x1c, &(0x7f0000000100)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {0x7, 0x0, 0xb, 0x6}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x2}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x6, 0x1, 0xa, 0x9, 0x8}, {0x7, 0x0, 0x0, 0x8}, {0x7, 0x1, 0xb, 0x4, 0x8, 0x20}, {}, {0x7, 0x0, 0xc}, {0x18, 0x6, 0x2, 0x0, r3}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 10.052315892s ago: executing program 0 (id=902): r0 = syz_open_dev$media(&(0x7f0000000000), 0xa3f, 0x101000) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc0287c02, &(0x7f0000000800)={0x80000000, 0x0, &(0x7f0000000b00)=[{}, {{}, {0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_ENTITIES(r0, 0xc1007c01, &(0x7f0000000240)={r1}) ioctl$MEDIA_IOC_G_TOPOLOGY(0xffffffffffffffff, 0xc0487c04, &(0x7f0000000940)={0x0, 0x5, 0x0, &(0x7f00000004c0)=[{}, {}, {0x80000000}, {}, {}], 0x2, 0x0, &(0x7f0000000340)=[{}, {}], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc0287c02, &(0x7f0000000a80)={0x80000000, &(0x7f00000009c0)=[{}, {0x80000000}], &(0x7f0000000a00)}) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc0287c02, &(0x7f0000000700)={r2, &(0x7f00000006c0)=[{0x80000000, 0x0}], &(0x7f0000000b00)}) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0xc0347c03, &(0x7f0000000bc0)={{r1, 0x0, 0x0, [0xffffffff, 0x2]}, {r3, r4, 0x1, [0x3, 0x7]}, 0x4, [0xb4e, 0x7]}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a00)={0x0, 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40080) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000fe4000/0x11000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) rename(0x0, &(0x7f00000000c0)='./file0/../file0/file0\x00') add_key$fscrypt_provisioning(&(0x7f0000000340), 0x0, 0x0, 0x0, 0xfffffffffffffffe) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000280)="2c235aa9c5", 0x5) r6 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r7 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) syz_usb_ep_write$ath9k_ep1(r7, 0x82, 0xc38, &(0x7f0000000dc0)=ANY=[]) 9.809398754s ago: executing program 2 (id=903): modify_ldt$write2(0x11, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r3 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r4 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) r5 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, 0x0) sendmsg$NL80211_CMD_DEL_KEY(r6, &(0x7f0000003100)={0x0, 0x0, &(0x7f00000030c0)={&(0x7f00000000c0)={0x28, r5, 0x1, 0x70bd23, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY={0xc, 0x50, 0x0, 0x1, [@NL80211_KEY_TYPE={0x8, 0x7, 0x2}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x200060f5}, 0x0) mmap$KVM_VCPU(&(0x7f0000ffb000/0x4000)=nil, r3, 0x3000002, 0x10, r4, 0x0) recvmmsg(r2, &(0x7f0000005700)=[{{0x0, 0x0, &(0x7f0000003380)=[{&(0x7f0000001f80)=""/132, 0x84}], 0x1}, 0x4}], 0x1, 0x0, 0x0) syz_emit_ethernet(0x86, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x64, 0x0, @wg=@response={0x2, 0x3, 0x1, "56805c734ee222c29de4125f81f6e030a5441a99f362cd24e0a1ac2291500733", "467f517bd818d5a4a8d26ae61b4cbf13", {"31ffc21d2e9bfb1eb3c03976ed837b6f", "876605ac29dcb96a8901e0711afb3db3"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000840)={0x6, 0x64, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x5, 0x0, 0x0, 0x60ff78ce1cb3c070, 0x0, '\x00', 0x0, 0x25, r0}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x0) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) acct(&(0x7f0000000040)='./file0\x00') r8 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000007300)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000006200)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x4c, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bind$inet6(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r8, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x282a40, 0x0) syz_emit_ethernet(0x86, &(0x7f0000000540)={@random, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x5, 0x78, 0x0, 0xe000, 0x3, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0x64, 0x0, @wg=@response={0x2, 0x2, 0x1, "c280440876218f4076c9f025d316ae0235103803e8122f7ac1bc5b24d97134ef", "ee27b1bccc82ad60db6500", {"430f140c019f1953ffa9e47fadca163a", "3b70439ab82b682a6576c87b9f8bb9ff"}}}}}}}, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000006340)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1f}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x2, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x8}}}}}, 0x0) 9.103234471s ago: executing program 3 (id=904): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x85, &(0x7f0000000240)={0x0, @in={{0x2, 0x0, @empty}}, 0x7, 0x23}, 0x90) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000840)={0x0, @in6={{0xa, 0x4e23, 0xe84, @empty, 0x129}}, 0x2, 0x2, 0x0, 0x2, 0x5, 0x8, 0x4}, 0x9c) pread64(0xffffffffffffffff, 0x0, 0x0, 0x200) openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x1c) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x8814) mount(0x0, 0x0, 0x0, 0x8, 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x1, &(0x7f0000002140)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r4, &(0x7f0000006e80)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r4, &(0x7f0000004300)={0x50, 0x0, r5, {0x7, 0x29, 0x4, 0x840120, 0x7, 0x909b, 0x40057, 0x1, 0x0, 0x0, 0x2, 0x8}}, 0x50) r6 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x280a00, 0x0) file_getattr(r6, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x18, 0x100) read$FUSE(r4, &(0x7f0000004540)={0x2020}, 0x2020) 9.042829586s ago: executing program 4 (id=905): socket$inet_sctp(0x2, 0x5, 0x84) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x129240, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r1, 0x3ba0, &(0x7f0000000540)={0x48, 0x2, r2, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r4, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_HWPT_ALLOC$TEST(r1, 0x3b89, &(0x7f00000001c0)={0x28, 0x0, r3, r4, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000180)}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000600)={0xc}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r1, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r4, 0x0, 0x0, 0x0, 0x0, 0x1}) 6.958846493s ago: executing program 1 (id=906): socket$netlink(0x10, 0x3, 0x0) r0 = socket$kcm(0xa, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x181) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$TIPC_DEST_DROPPABLE(r2, 0x10f, 0x81, &(0x7f0000000080), 0x4a) sendmmsg$inet(r2, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) r4 = socket$kcm(0xa, 0x5, 0x0) socket$kcm(0x2, 0xa, 0x2) ioctl$sock_SIOCETHTOOL(r3, 0x89f1, &(0x7f00000002c0)={'ip6gre0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x10, 0x485b, 0x9, 0x8, 0x6, 0x0, 0xffffffff, 0xfaa, 0x9}}) mkdirat(0xffffffffffffff9c, 0x0, 0x67) ioctl$sock_kcm_SIOCKCMCLONE(r4, 0x8916, &(0x7f0000000000)={r4}) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='new trusted:syz 020'], 0x2d, 0xfffffffffffffff9) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) r5 = socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r4, 0x8916, &(0x7f0000000000)={r5}) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x8936, &(0x7f0000000000)={r5}) 6.898463621s ago: executing program 0 (id=907): r0 = socket$inet(0x2, 0x2, 0x3) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x3f, &(0x7f0000000080)=0x1, 0x4) bind$inet(r0, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x402, 0x0) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) socket$netlink(0x10, 0x3, 0x8000000004) socket(0xa, 0x3, 0x3a) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x40, &(0x7f0000000240)={0x3, 0x0, 0x202, 0x5, 0x10000, 0x8000, 0x4, 0x1}, 0x0, 0x0, 0x0, 0x0) ioctl$TCSETSF(r1, 0x5404, &(0x7f0000000080)={0x8, 0x2, 0x0, 0x200, 0xa, "2b35740e4f4e6c04704020dd9636bce158a556"}) recvmmsg(r0, 0x0, 0xffffffffffffff79, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) openat$vimc1(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 6.832893149s ago: executing program 2 (id=908): pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r2, 0x5, 0x0, 0x0, r1) fsmount(r2, 0x0, 0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={0x0, 0x0}, 0x28) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r3, r3) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000480), r1) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000004c0)={0x1c, r4, 0x2, 0x70bd28, 0x25dfdbfb, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x24004081) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000300)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000040)={0x0, 0xc1, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x42, 0x3, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc81d, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) 6.731730166s ago: executing program 3 (id=909): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000380)={0xa, 0x4e21, 0x1, @loopback, 0x400014}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f0000000300)=@gcm_128={{0x303}, "fc895d8eb00066c2", "c5998c867c22b401046a89606ffcf92e", "2c5be7ad", "a0ca05c0707e52f4"}, 0x28) recvfrom$inet6(r1, &(0x7f00000000c0)=""/3, 0x3, 0x300, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x10000008ebc, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) 3.928219474s ago: executing program 1 (id=910): socket$inet6_sctp(0xa, 0x1, 0x84) r0 = openat(0xffffffffffffff9c, 0x0, 0x800, 0x0) read$FUSE(r0, &(0x7f0000001100)={0x2020}, 0x2020) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) r3 = socket$netlink(0x10, 0x3, 0x8000000004) connect$inet6(r2, &(0x7f0000000800)={0xa, 0x4e20, 0xc0, @local, 0xc58e}, 0x1c) writev(r3, &(0x7f0000001200), 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) ioctl$KVM_GET_FPU(r1, 0x81a0ae8c, &(0x7f0000000440)) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r4, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r5, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='debugfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@xino_on}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r7 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) getdents64(r7, &(0x7f0000004000)=""/4099, 0x1003) 3.6043237s ago: executing program 4 (id=911): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$wireguard(0x0, 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000007c0)=ANY=[@ANYBLOB="40010000", @ANYRES16=r3, @ANYBLOB="01000000000004000000010000002400030000000000000000000000000000000000000000000000000000000000000000001400020077673100000000000000000000000000f4000880"], 0x140}, 0x1, 0x0, 0x0, 0x8000}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config\x00', 0x1c0) mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.usb0/control/extensions/xu1\x00', 0x1c0) openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.usb0/control/extensions/xu1/bmControls\x00', 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x4c, r3, 0x321, 0x70bd2d, 0x25dfdbfc, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg1\x00'}, @WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @a}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40090}, 0x4000) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000300)={'wg0\x00', 0x0}) setsockopt$inet_mreqsrc(r1, 0x0, 0x26, &(0x7f0000000380)={@multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}, @remote}, 0xc) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x1f, 0x10, 0x0, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x11, '\x00', r4, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000580)=ANY=[@ANYBLOB="300000004100010029bd7000040000000100000004004880100001800c00108005000380f300000008000200", @ANYRES32=r6, @ANYBLOB="7a8626162d0aee4ba3de2eba145da6a101007b98416ff0674e458c6b1ed6fb70ba64d1954c8699d568b9"], 0x30}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f0000001400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000013c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="2e00000099f8941fe980963dca9813da7ec92536434d9d841148d6d96d8263a846696bb39d4ab904562c48f432182855febbfc04ea724b6651b1b0a61b49c6372b49a3badf530e0e33c5a2", @ANYRES16=r3, @ANYBLOB="04002abd7000fbdbdf2501000000"], 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x11) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000480)={0x0, 0x5, 0x10}, 0xc) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x1}, 0x1c, &(0x7f0000000180)=[{&(0x7f00000000c0)='v', 0x1}], 0x1}, 0x4048043) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) r7 = syz_open_dev$usbfs(&(0x7f0000000000), 0x200, 0xa0402) ioctl$USBDEVFS_CONTROL(r7, 0xc0185500, &(0x7f0000000040)={0x23, 0x1, 0x14, 0xec, 0x0, 0x7, 0x0}) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e21, @empty}}, 0x5, 0x3, 0xf06, 0x4, 0x94, 0xfffffffd, 0x5}, 0x9c) r8 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r8, &(0x7f0000000f80)="900000001c001f4d154a817193278bff0a80a57802000000e503740014000100ac1414bb0542d6401051a2d708f37ac8da1a297e00a2c5fed0759cb068d0bf46d323456536016466fcb78dcaaf6c3efed495a46215be0000760700c0b21a1c69d33e02cdba86c9d2896c013bca2d0000000b0015009e49a6560641263da4de1df32c1739d7fbee9aa241731ae9e0b390", 0x90, 0x0, 0x0, 0x0) sendmmsg$inet6(r0, &(0x7f0000000340)=[{{0x0, 0x0, &(0x7f0000000900)}}], 0x1, 0x0) 1.946482027s ago: executing program 1 (id=912): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, 0x0) ioctl$vim2m_VIDIOC_QBUF(r1, 0xc058560f, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x7f7) write(0xffffffffffffffff, &(0x7f0000000180)='10000', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) r3 = socket$inet(0x2, 0x5, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, 0x0, 0x0) write(r2, &(0x7f0000000200)='1', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r4, &(0x7f0000000280)='0', 0x1) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_NEWRULE={0x74, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x48, 0x4, 0x0, 0x1, [{0x44, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_MATCH_NAME={0xd, 0x1, 'devgroup\x00'}, @NFTA_MATCH_REV={0x8}, @NFTA_MATCH_INFO={0x17, 0x3, "0400"/19}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xfc}}, 0x0) 1.868130941s ago: executing program 2 (id=913): socket$pppoe(0x18, 0x1, 0x0) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, 0x0, 0x800) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x4, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) prlimit64(r1, 0x6, &(0x7f0000000080)={0x3, 0x209}, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a140000000e0a01020000000000000000010000000000000000000100000a7fc2e4bb7a3f"], 0x3c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r3 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x0) userfaultfd(0x80001) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x0) r4 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) setsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, 0xc) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f0000000040)={0x0, 0xd19e, 0x30}, &(0x7f0000000140)=0xc) connect$llc(r4, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10) sendmmsg(r4, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendto$inet6(0xffffffffffffffff, &(0x7f00000001c0)="89d56a6fc2ff6a07", 0x8, 0x10, 0x0, 0x0) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)={0x14, 0x2f, 0x9, 0x70bd27, 0x0, {0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x42804}, 0x10) 1.852495673s ago: executing program 4 (id=914): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="18020000000000000000000000000000850000002e000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000ffffff90850000007300000095"], &(0x7f0000000080)='GPL\x00'}, 0x94) socket$kcm(0x21, 0x2, 0x2) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1, 0x4, 0x2, 0x7}, 0x50) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_XOR={0x4}]}}}]}]}], {0x14}}, 0xc0}}, 0x0) getpeername$netlink(r1, &(0x7f0000000340), &(0x7f0000000540)=0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000", @ANYRES32], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x8, 0x1014}, 0x48) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be5216344841", 0xe}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r5, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r6, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 1.784552503s ago: executing program 3 (id=915): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, 0x0, &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001040)=@newsa={0x140, 0x10, 0x713, 0x70bd26, 0x0, {{@in=@remote, @in=@dev={0xac, 0x14, 0x14, 0x13}, 0x4e22, 0x1, 0x0, 0x3, 0x2, 0x0, 0x0, 0x3a, 0x0, 0xffffffffffffffff}, {@in6=@initdev={0xfe, 0x88, '\x00', 0xfe, 0x0}, 0x0, 0x33}, @in6=@local, {0x0, 0x0, 0xb, 0xa, 0x6, 0x0, 0x0, 0x3}, {0x0, 0x7, 0x2, 0xffffff7ffffffff8}, {0xc, 0x0, 0x2}, 0x70bd29, 0x0, 0x2, 0x4}, [@algo_auth={0x48, 0x1, {{'blake2s-224-arm\x00'}}}, @tfcpad={0x8, 0x16, 0x4}]}, 0x140}, 0x1, 0x0, 0x0, 0xc0}, 0x4840) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000480)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x4000000}, 0x50) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000340)={0x1b, 0x0, 0x0, 0x40000, 0x0, r3, 0xfff}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x15, 0x1c, &(0x7f0000000100)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {0x7, 0x0, 0xb, 0x6}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x2}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x6, 0x1, 0xa, 0x9, 0x8}, {0x7, 0x0, 0x0, 0x8}, {0x7, 0x1, 0xb, 0x4, 0x8, 0x20}, {}, {0x7, 0x0, 0xc}, {0x18, 0x6, 0x2, 0x0, r3}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 450.845354ms ago: executing program 0 (id=916): syz_open_dev$tty1(0xc, 0x4, 0x1) request_key(0x0, 0x0, &(0x7f0000000340)='\x8e\x00\x9e\xbb\x1e\x1av\xe8M\x00d\xaaI\x00\x00\x00\x00\x00\x00\t<\xe5u\xedA\xa7\aT\xdd\xd1{\xff\xcb\xdb\xb11\xc2s\xcb\xbf\x04\x00\x00\x00<\xfe\xf9\f\xe6E\b\x00\xd7\x85q\xc4\xab\xbd&\x92\x89(\xf3\"\xceJ\x19\x185\xa6- \xe6uK\xe1D\x8f\x9f\x92\xca\x93#\xf5E\xc2\x91Yl\x17\a\x02\t\x17\x7f\xc4\xde\x04\x9b\x89#\xf6&[\xd81\xb3\xdc\x00\x04\x15\x03\x17R\xd24\xeb\xb5\xc2\xff\x1bnF\x8e\xe4\'\x18\xba9.\xd4\xd9\xc6\x98\x8f\xc6D!p\xbeV\xb7x\r@\x1b5\x8br\x11\xdex\x19\x89\xdc\x1el\xcd\x13\xb6\xc2\xdb\x1fr2\x7f?\xfe\x0f\x04\x11\xc3\x8f:uXQ\x0f\v\xfc\xff\x7fL\xfb\xa8]\xd4\xd7\x13?\xe3<#\x1f\x9a\x03C\x8f\xe7\rV1\x99\xaf@Re\x18J\xb6\xee\xeeAnR\n\x8a\xe4\x1a:&\xc7\x15B\x8aG\xa4\a`\xee\xaf\x80T\xddo\xc4D^z\xbf\x1c\x87F?!k\'\xc3\xf9\xa3\xd9\x85\xb1N%\x17\f\xd0#\x05^\xf7\x11\x13\xadKb\x8ck\x10\xd3 >\t\xe0\x16\x80\x82\xb3\xcc\xc7\x05*\x9b\x0eQ\x92\xd7\xbaO\x06\xb2\xdc\xe7/\x1f\x90]IB94(evFMJ\x85\xc4S\xa8\x8b\xbe\xd3\x90\xe9\t\x00\x13\x1e\x9a\x94\x00\x00\x00\x00\x00U\xfbLA\xa6K\xd5\x0eD\xf2Y\xc3,\t4hD\xc4o\xc3\x87$\x9d6\xc8\x93\xa3\x8e:\xfe#\xa0`\xb1k\xacz\xe0\xb3\x95\x17\xdf\xc7\xc2\xedKc\xa3\xbd\xc2\x9f\x86C(/\xe3\xb2\xc6$s^\xd1vU\x9cB)ao\xf1\'', 0xffffffffffffffff) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800006, 0x7000001, 0x6e073, 0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$UBLK_U_CMD_END_USER_RECOVERY(0xffffffffffffffff, 0xc0207511, &(0x7f0000000580)={0x0, 0xffff, 0x0, 0x0, 0xffffffffffffffff}) sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, 0x0) mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000000) syz_emit_ethernet(0x66, &(0x7f0000000ac0)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000086dd6000000200303a00fe8000000000000000000000000000bbfe80000000"], 0x0) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x385a, 0x0, 0x2, 0x115a}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000140)=0x0) ioctl$PPPIOCGMRU(0xffffffffffffffff, 0x80047453, 0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000480)=0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$I2C(&(0x7f00000007c0), 0x0, 0x40) r8 = dup(r7) syz_ublk_setup_queues(r8, r6, &(0x7f0000000180)={0x0, 0xf000, 0x1f00, 0x1, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7fffde, 0x200, 0x2, 0x15e, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x3881, 0x10005009, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90f, 0x4e52ba9def4ca6b0, 0x3, 0x0, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0x1e9}}], 0x1, &(0x7f0000000340)={0x2e, 0x13, 0x0, r8, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x8004, 0x0, 0x0}}, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000340)={{0x2, 0x3, 0xf3b, 0x2, 0x13fffffc}}) 432.070258ms ago: executing program 3 (id=917): r0 = semget$private(0x0, 0x6, 0x0) semtimedop(r0, &(0x7f00000003c0)=[{0x0, 0x1}, {0x4, 0x4, 0x1800}], 0x2, 0x0) semop(r0, 0x0, 0x0) semop(r0, &(0x7f0000001240)=[{}, {0x0, 0x0, 0x2000}], 0x2) semctl$GETZCNT(r0, 0x2, 0xf, 0x0) 414.035494ms ago: executing program 4 (id=918): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1002}) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000900)={'syzkaller0\x00', 0x41}) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r1) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01000000000000000000010000000000000001410000001c0017fffffffd000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) write(r0, &(0x7f0000000380)="fff766fffdff00000000000188ca0d525c8e6318100000000000010001000032aacb", 0x22) 0s ago: executing program 1 (id=919): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x7, 0x6, 0x9, 0x0, 0xffffffffffffffff, 0x100}, 0x50) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f0000000040), 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r2, &(0x7f0000000300)='md0\x00', 0x3) r3 = socket$inet_sctp(0x2, 0x1, 0x84) listen(r3, 0xda90) accept4(r3, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./ram0\x00', 0x2, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/level\x00', 0x2, 0x0) write(r4, &(0x7f0000000600), 0x0) r5 = fsopen(&(0x7f0000000300)='nfs4\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000c00)='sec\x00', 0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000c00)='sec\x00', &(0x7f0000000d00)='krb5\x00', 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/block/md0/md/raid_disks\x00', 0x400, 0x0) write(r6, 0x0, 0x0) r7 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r7, &(0x7f0000000a00)='1:0\x00', 0x3) r8 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/block/md0/md/dev-ram0/slot\x00', 0x2, 0x0) write$khugepaged_scan(r8, &(0x7f0000000080), 0x8) r9 = openat(0xffffffffffffff9c, &(0x7f0000000d00)='./sys/block/md0/md/array_state\x00', 0x2, 0x0) write(r9, &(0x7f0000000e00)='active\x00', 0x6) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x7, 0x17, &(0x7f00000007c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x6, 0x0, 0xb, 0x9, 0x0, 0x1, 0x20000000}, {0x66, 0x0, 0x0, 0x256c6c64}}, [@printk={@ld, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x1, 0x5, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {}, {0x15}}], {{0x7, 0x1, 0x3, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000000)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) kernel console output (not intermixed with test programs): 5696] usb 4-1: config 0 descriptor?? [ 146.041263][ T5783] usb 4-1: USB disconnect, device number 3 [ 146.992927][ T5328] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 147.186902][ T5696] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 147.552320][ T5328] usb 1-1: Using ep0 maxpacket: 32 [ 147.722718][ T5328] usb 1-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 147.734580][ T5328] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 147.747855][ T5696] usb 3-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 147.757512][ T5696] usb 3-1: config 0 has no interfaces? [ 147.765639][ T5696] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 147.778025][ T5328] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 147.788336][ T5696] usb 3-1: config 0 descriptor?? [ 147.801133][ T5328] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 147.837565][ T5328] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 147.859464][ T5328] usb 1-1: Product: syz [ 147.868109][ T5328] usb 1-1: Manufacturer: syz [ 147.874267][ T5328] usb 1-1: SerialNumber: syz [ 148.167698][ T30] audit: type=1400 audit(1786923813.584:427): avc: denied { read write } for pid=6563 comm="syz.0.196" name="ppp" dev="devtmpfs" ino=708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 148.392758][ T30] audit: type=1400 audit(1786923813.594:428): avc: denied { open } for pid=6563 comm="syz.0.196" path="/dev/ppp" dev="devtmpfs" ino=708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 148.667642][ T30] audit: type=1400 audit(1786923813.594:429): avc: denied { ioctl } for pid=6563 comm="syz.0.196" path="/dev/ppp" dev="devtmpfs" ino=708 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 149.254042][ T5717] usb 3-1: USB disconnect, device number 3 [ 150.939856][ T5328] usb 1-1: 1:1 : incorrect wMaxPacketSize for BADD profile [ 150.954106][ T30] audit: type=1400 audit(1786923816.414:430): avc: denied { append } for pid=6592 comm="syz.2.207" name="comedi3" dev="devtmpfs" ino=1276 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 151.273876][ T5328] usb 1-1: incorrect wMaxPacketSize 0x10 for BADD profile [ 152.534365][ T5328] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 152.578212][ T5328] usb 1-1: USB disconnect, device number 5 [ 152.678271][ T5596] udevd[5596]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 152.846626][ T6615] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 152.855285][ T6615] CPU: 0 UID: 0 PID: 6615 Comm: syz.0.212 Tainted: G L syzkaller #0 PREEMPT(full) [ 152.855315][ T6615] Tainted: [L]=SOFTLOCKUP [ 152.855322][ T6615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 152.855333][ T6615] Call Trace: [ 152.855341][ T6615] [ 152.855348][ T6615] dump_stack_lvl+0x100/0x190 [ 152.855377][ T6615] sysfs_warn_dup.cold+0x1c/0x28 [ 152.855405][ T6615] sysfs_create_dir_ns+0x24b/0x2b0 [ 152.855427][ T6615] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 152.855447][ T6615] ? find_held_lock+0x2b/0x80 [ 152.855467][ T6615] ? kobject_add_internal+0x25f/0x930 [ 152.855495][ T6615] ? kobject_add_internal+0x25f/0x930 [ 152.855525][ T6615] ? class_dir_child_ns_type+0xd/0x60 [ 152.855554][ T6615] kobject_add_internal+0x2c8/0x930 [ 152.855586][ T6615] kobject_add+0x16a/0x1e0 [ 152.855615][ T6615] ? __pfx_kobject_add+0x10/0x10 [ 152.855645][ T6615] ? get_device_parent+0x1b3/0x4c0 [ 152.855671][ T6615] ? kobject_put+0xb9/0x640 [ 152.855705][ T6615] device_add+0x294/0x1970 [ 152.855736][ T6615] ? lockdep_init_map_type+0x5c/0x250 [ 152.855762][ T6615] ? __pfx_device_add+0x10/0x10 [ 152.855791][ T6615] ? lockdep_init_map_type+0x5c/0x250 [ 152.855823][ T6615] ? __init_waitqueue_head+0xca/0x150 [ 152.855858][ T6615] tty_register_device_attr+0x388/0x7f0 [ 152.855884][ T6615] ? lockdep_init_map_type+0x5c/0x250 [ 152.855909][ T6615] ? __pfx_tty_register_device_attr+0x10/0x10 [ 152.855939][ T6615] ? tty_port_init+0x156/0x1c0 [ 152.855967][ T6615] gsm_activate_mux+0x155/0x2a0 [ 152.855995][ T6615] gsmld_ioctl+0xbbc/0x15c0 [ 152.856031][ T6615] ? __pfx_gsmld_ioctl+0x10/0x10 [ 152.856062][ T6615] ? __ldsem_down_read_nested+0xf3/0x890 [ 152.856095][ T6615] ? __pfx___ldsem_down_read_nested+0x10/0x10 [ 152.856131][ T6615] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 152.856156][ T6615] ? __pfx_pty_unix98_ioctl+0x10/0x10 [ 152.856178][ T6615] ? __pfx_gsmld_ioctl+0x10/0x10 [ 152.856204][ T6615] tty_ioctl+0x11b4/0x1640 [ 152.856228][ T6615] ? __pfx_tty_ioctl+0x10/0x10 [ 152.856252][ T6615] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 152.856291][ T6615] ? __fget_files+0x215/0x3d0 [ 152.856309][ T6615] ? hook_file_ioctl_common+0x140/0x440 [ 152.856338][ T6615] ? selinux_file_ioctl+0x13b/0x290 [ 152.856366][ T6615] ? selinux_file_ioctl+0xb6/0x290 [ 152.856396][ T6615] ? __pfx_tty_ioctl+0x10/0x10 [ 152.856421][ T6615] __x64_sys_ioctl+0x18e/0x210 [ 152.856452][ T6615] do_syscall_64+0x115/0x870 [ 152.856473][ T6615] ? clear_bhb_loop+0x70/0xc0 [ 152.856497][ T6615] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 152.856516][ T6615] RIP: 0033:0x7f8072d9e0d9 [ 152.856533][ T6615] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 152.856549][ T6615] RSP: 002b:00007f8070fd5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 152.856570][ T6615] RAX: ffffffffffffffda RBX: 00007f8073026180 RCX: 00007f8072d9e0d9 [ 152.856582][ T6615] RDX: 0000200000000040 RSI: 00000000404c4701 RDI: 0000000000000006 [ 152.856594][ T6615] RBP: 00007f8072e35024 R08: 0000000000000000 R09: 0000000000000000 [ 152.856606][ T6615] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 152.856618][ T6615] R13: 00007f8073026218 R14: 00007f8073026180 R15: 00007ffe0883a418 [ 152.856645][ T6615] [ 152.856753][ T6615] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 153.445513][ T6617] input: syz1 as /devices/virtual/input/input7 [ 153.452612][ T6617] input: failed to attach handler leds to device input7, error: -6 [ 154.393664][ T6624] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 155.249822][ T5717] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 155.461926][ T5717] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 155.549376][ T5717] usb 3-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 155.570719][ T5717] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 155.609120][ T5717] cdc_acm 3-1:1.0: probe with driver cdc_acm failed with error -22 [ 157.893549][ T30] audit: type=1400 audit(1786923823.334:431): avc: denied { create } for pid=6657 comm="syz.4.226" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 157.951884][ T30] audit: type=1400 audit(1786923823.414:432): avc: denied { listen } for pid=6657 comm="syz.4.226" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 157.988537][ T6658] binder: BC_ACQUIRE_RESULT not supported [ 157.994801][ T6658] binder: 6657:6658 ioctl c0306201 200000004a40 returned -22 [ 158.003619][ T30] audit: type=1400 audit(1786923823.464:433): avc: denied { accept } for pid=6657 comm="syz.4.226" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 158.056348][ T30] audit: type=1400 audit(1786923823.514:434): avc: denied { write } for pid=6657 comm="syz.4.226" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 158.079196][ T5688] usb 3-1: USB disconnect, device number 4 [ 158.096514][ T6661] batman_adv: batadv0: Adding interface: dummy0 [ 158.103971][ T6661] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 158.134032][ T6661] batman_adv: batadv0: Interface activated: dummy0 [ 158.161241][ T6661] batadv0: mtu less than device minimum [ 158.168625][ T6661] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 158.179461][ T6661] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 158.190299][ T6661] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 158.201081][ T6661] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 158.211861][ T6661] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 158.222629][ T6661] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 158.233394][ T6661] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 158.244166][ T6661] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 158.255077][ T6661] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 158.430361][ T6666] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 158.614394][ T6669] netlink: 'syz.0.230': attribute type 4 has an invalid length. [ 158.622183][ T6669] netlink: 17 bytes leftover after parsing attributes in process `syz.0.230'. [ 158.747947][ T30] audit: type=1400 audit(1786923824.204:435): avc: denied { write } for pid=6668 comm="syz.0.230" name="uncompressed" dev="configfs" ino=8475 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 159.676233][ T30] audit: type=1400 audit(1786923824.244:436): avc: denied { write } for pid=6668 comm="syz.0.230" name="u" dev="configfs" ino=12304 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 159.719850][ T6667] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 159.783713][ T30] audit: type=1400 audit(1786923824.254:437): avc: denied { write } for pid=6668 comm="syz.0.230" name="fs" dev="configfs" ino=8481 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 159.872938][ T6682] overlayfs: missing 'lowerdir' [ 163.045064][ T30] audit: type=1400 audit(1786923824.254:438): avc: denied { write } for pid=6668 comm="syz.0.230" name="fs" dev="configfs" ino=8481 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 163.820071][ T5783] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 163.939537][ T6701] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 163.948177][ T6701] CPU: 0 UID: 0 PID: 6701 Comm: syz.2.237 Tainted: G L syzkaller #0 PREEMPT(full) [ 163.948207][ T6701] Tainted: [L]=SOFTLOCKUP [ 163.948213][ T6701] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 163.948224][ T6701] Call Trace: [ 163.948232][ T6701] [ 163.948240][ T6701] dump_stack_lvl+0x100/0x190 [ 163.948270][ T6701] sysfs_warn_dup.cold+0x1c/0x28 [ 163.948300][ T6701] sysfs_create_dir_ns+0x24b/0x2b0 [ 163.948321][ T6701] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 163.948346][ T6701] ? find_held_lock+0x2b/0x80 [ 163.948363][ T6701] ? kobject_add_internal+0x25f/0x930 [ 163.948391][ T6701] ? kobject_add_internal+0x25f/0x930 [ 163.948422][ T6701] ? class_dir_child_ns_type+0xd/0x60 [ 163.948453][ T6701] kobject_add_internal+0x2c8/0x930 [ 163.948487][ T6701] kobject_add+0x16a/0x1e0 [ 163.948514][ T6701] ? __pfx_kobject_add+0x10/0x10 [ 163.948546][ T6701] ? get_device_parent+0x1b3/0x4c0 [ 163.948572][ T6701] ? kobject_put+0xb9/0x640 [ 163.948606][ T6701] device_add+0x294/0x1970 [ 163.948634][ T6701] ? lockdep_init_map_type+0x5c/0x250 [ 163.948658][ T6701] ? __pfx_device_add+0x10/0x10 [ 163.948684][ T6701] ? lockdep_init_map_type+0x5c/0x250 [ 163.948709][ T6701] ? __init_waitqueue_head+0xca/0x150 [ 163.948743][ T6701] tty_register_device_attr+0x388/0x7f0 [ 163.948768][ T6701] ? lockdep_init_map_type+0x5c/0x250 [ 163.948793][ T6701] ? __pfx_tty_register_device_attr+0x10/0x10 [ 163.948824][ T6701] ? tty_port_init+0x156/0x1c0 [ 163.948851][ T6701] gsm_activate_mux+0x155/0x2a0 [ 163.948876][ T6701] gsmld_ioctl+0xbbc/0x15c0 [ 163.948911][ T6701] ? __pfx_gsmld_ioctl+0x10/0x10 [ 163.948942][ T6701] ? __ldsem_down_read_nested+0xf3/0x890 [ 163.948975][ T6701] ? __pfx___ldsem_down_read_nested+0x10/0x10 [ 163.949011][ T6701] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 163.949035][ T6701] ? __pfx_pty_unix98_ioctl+0x10/0x10 [ 163.949057][ T6701] ? __pfx_gsmld_ioctl+0x10/0x10 [ 163.949082][ T6701] tty_ioctl+0x11b4/0x1640 [ 163.949106][ T6701] ? __pfx_tty_ioctl+0x10/0x10 [ 163.949130][ T6701] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 163.949168][ T6701] ? __fget_files+0x215/0x3d0 [ 163.949186][ T6701] ? hook_file_ioctl_common+0x140/0x440 [ 163.949215][ T6701] ? selinux_file_ioctl+0x13b/0x290 [ 163.949242][ T6701] ? selinux_file_ioctl+0xb6/0x290 [ 163.949272][ T6701] ? __pfx_tty_ioctl+0x10/0x10 [ 163.949296][ T6701] __x64_sys_ioctl+0x18e/0x210 [ 163.949328][ T6701] do_syscall_64+0x115/0x870 [ 163.949354][ T6701] ? clear_bhb_loop+0x70/0xc0 [ 163.949379][ T6701] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 163.949398][ T6701] RIP: 0033:0x7f096e99e0d9 [ 163.949416][ T6701] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 163.949433][ T6701] RSP: 002b:00007f096f7cd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 163.949451][ T6701] RAX: ffffffffffffffda RBX: 00007f096ec26180 RCX: 00007f096e99e0d9 [ 163.949463][ T6701] RDX: 0000200000000040 RSI: 00000000404c4701 RDI: 0000000000000006 [ 163.949475][ T6701] RBP: 00007f096ea35024 R08: 0000000000000000 R09: 0000000000000000 [ 163.949486][ T6701] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 163.949499][ T6701] R13: 00007f096ec26218 R14: 00007f096ec26180 R15: 00007ffda70bc1c8 [ 163.949528][ T6701] [ 163.949639][ T6701] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 164.409642][ T5783] usb 4-1: not running at top speed; connect to a high speed hub [ 165.338617][ T5783] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.00 [ 165.361895][ T5783] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 165.387720][ T5783] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 166.031868][ T5783] usb 4-1: can't set config #1, error -71 [ 166.093599][ T5783] usb 4-1: USB disconnect, device number 4 [ 166.339425][ T30] audit: type=1400 audit(1786923831.764:439): avc: denied { create } for pid=6707 comm="syz.3.239" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 166.505564][ T30] audit: type=1400 audit(1786923831.784:440): avc: denied { read } for pid=6707 comm="syz.3.239" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 166.756184][ T6717] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty65' [ 166.765148][ T6717] CPU: 0 UID: 0 PID: 6717 Comm: syz.0.240 Tainted: G L syzkaller #0 PREEMPT(full) [ 166.765180][ T6717] Tainted: [L]=SOFTLOCKUP [ 166.765187][ T6717] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 166.765198][ T6717] Call Trace: [ 166.765206][ T6717] [ 166.765213][ T6717] dump_stack_lvl+0x100/0x190 [ 166.765242][ T6717] sysfs_warn_dup.cold+0x1c/0x28 [ 166.765270][ T6717] sysfs_create_dir_ns+0x24b/0x2b0 [ 166.765291][ T6717] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 166.765310][ T6717] ? find_held_lock+0x2b/0x80 [ 166.765328][ T6717] ? kobject_add_internal+0x25f/0x930 [ 166.765356][ T6717] ? kobject_add_internal+0x25f/0x930 [ 166.765385][ T6717] ? class_dir_child_ns_type+0xd/0x60 [ 166.765416][ T6717] kobject_add_internal+0x2c8/0x930 [ 166.765448][ T6717] kobject_add+0x16a/0x1e0 [ 166.765477][ T6717] ? __pfx_kobject_add+0x10/0x10 [ 166.765507][ T6717] ? get_device_parent+0x1b3/0x4c0 [ 166.765533][ T6717] ? kobject_put+0xb9/0x640 [ 166.765564][ T6717] device_add+0x294/0x1970 [ 166.765593][ T6717] ? lockdep_init_map_type+0x5c/0x250 [ 166.765617][ T6717] ? __pfx_device_add+0x10/0x10 [ 166.765643][ T6717] ? lockdep_init_map_type+0x5c/0x250 [ 166.765668][ T6717] ? __init_waitqueue_head+0xca/0x150 [ 166.765700][ T6717] tty_register_device_attr+0x388/0x7f0 [ 166.765731][ T6717] ? lockdep_init_map_type+0x5c/0x250 [ 166.765756][ T6717] ? __pfx_tty_register_device_attr+0x10/0x10 [ 166.765787][ T6717] ? tty_port_init+0x156/0x1c0 [ 166.765815][ T6717] gsm_activate_mux+0x155/0x2a0 [ 166.765841][ T6717] gsmld_ioctl+0xbbc/0x15c0 [ 166.765876][ T6717] ? __pfx_gsmld_ioctl+0x10/0x10 [ 166.765908][ T6717] ? __ldsem_down_read_nested+0xf3/0x890 [ 166.765940][ T6717] ? __pfx___ldsem_down_read_nested+0x10/0x10 [ 166.765976][ T6717] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 166.765999][ T6717] ? __pfx_pty_unix98_ioctl+0x10/0x10 [ 166.766021][ T6717] ? __pfx_gsmld_ioctl+0x10/0x10 [ 166.766044][ T6717] tty_ioctl+0x11b4/0x1640 [ 166.766071][ T6717] ? __pfx_tty_ioctl+0x10/0x10 [ 166.766095][ T6717] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 166.766133][ T6717] ? __fget_files+0x215/0x3d0 [ 166.766152][ T6717] ? hook_file_ioctl_common+0x140/0x440 [ 166.766182][ T6717] ? selinux_file_ioctl+0x13b/0x290 [ 166.766210][ T6717] ? selinux_file_ioctl+0xb6/0x290 [ 166.766239][ T6717] ? __pfx_tty_ioctl+0x10/0x10 [ 166.766262][ T6717] __x64_sys_ioctl+0x18e/0x210 [ 166.766292][ T6717] do_syscall_64+0x115/0x870 [ 166.766313][ T6717] ? clear_bhb_loop+0x70/0xc0 [ 166.766336][ T6717] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 166.766356][ T6717] RIP: 0033:0x7f8072d9e0d9 [ 166.766372][ T6717] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 166.766389][ T6717] RSP: 002b:00007f8070fd5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 166.766407][ T6717] RAX: ffffffffffffffda RBX: 00007f8073026180 RCX: 00007f8072d9e0d9 [ 166.766418][ T6717] RDX: 0000200000000040 RSI: 00000000404c4701 RDI: 0000000000000006 [ 166.766428][ T6717] RBP: 00007f8072e35024 R08: 0000000000000000 R09: 0000000000000000 [ 166.766438][ T6717] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 166.766449][ T6717] R13: 00007f8073026218 R14: 00007f8073026180 R15: 00007ffe0883a418 [ 166.766473][ T6717] [ 166.767876][ T6717] kobject: kobject_add_internal failed for gsmtty65 with -EEXIST, don't try to register things with the same name in the same directory. [ 167.183736][ T6704] fuse: Bad value for 'fd' [ 167.189930][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 167.280014][ T5688] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 167.292506][ C0] raw-gadget.0 gadget.1: ignoring, device is not running [ 167.460589][ T5688] usb 2-1: device descriptor read/64, error -32 [ 168.292751][ T5688] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 168.490673][ T5688] usb 2-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 169.167439][ T6727] 9pnet_virtio: no channels available for device syz [ 169.753603][ T6729] netlink: 'syz.3.244': attribute type 23 has an invalid length. [ 169.881403][ T5688] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 169.889267][ T5688] usb 2-1: can't read configurations, error -71 [ 169.897493][ T5688] usb usb2-port1: attempt power cycle [ 172.377274][ T6751] tipc: Enabling of bearer rejected, failed to enable media [ 173.049033][ T5330] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 173.430380][ T5330] usb 4-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 173.466534][ T5330] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 173.477673][ T5330] usb 4-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 173.493023][ T30] audit: type=1400 audit(1786923838.954:441): avc: denied { append } for pid=6759 comm="syz.1.253" name="sg0" dev="devtmpfs" ino=785 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 173.517591][ T5330] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 173.587108][ T6760] netlink: 'syz.1.253': attribute type 11 has an invalid length. [ 173.981597][ T6778] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 175.836748][ T6799] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 176.019728][ T6802] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 176.619808][ T5688] usb 4-1: USB disconnect, device number 5 [ 176.632853][ T6812] net_ratelimit: 10 callbacks suppressed [ 176.632867][ T6812] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:2a [ 177.580243][ T6820] netlink: 28 bytes leftover after parsing attributes in process `syz.1.268'. [ 179.240477][ T6831] oom_control is deprecated and will be removed. Please report your usecase to linux-mm-@kvack.org if you depend on this functionality. [ 179.291279][ T6831] socket: no more sockets [ 180.207984][ T6831] socket: no more sockets [ 180.761223][ T6854] fuse: Bad value for 'fd' [ 181.994316][ T30] audit: type=1400 audit(1786923847.424:442): avc: denied { create } for pid=6874 comm="syz.4.279" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 182.131106][ T30] audit: type=1400 audit(1786923847.424:443): avc: denied { setopt } for pid=6874 comm="syz.4.279" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 182.492917][ T30] audit: type=1400 audit(1786923847.954:444): avc: denied { connect } for pid=6883 comm="syz.4.283" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 182.557070][ T30] audit: type=1400 audit(1786923848.014:445): avc: denied { write } for pid=6883 comm="syz.4.283" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 182.596423][ T30] audit: type=1400 audit(1786923848.044:446): avc: denied { read } for pid=6883 comm="syz.4.283" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 182.706133][ T6892] netlink: 'syz.3.285': attribute type 4 has an invalid length. [ 182.834393][ T6892] netlink: 17 bytes leftover after parsing attributes in process `syz.3.285'. [ 182.950609][ T6900] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 183.082013][ T6900] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 183.092154][ T6900] overlayfs: failed to look up (tracing) for ino (-66) [ 184.713757][ T5330] usb 5-1: new full-speed USB device number 4 using dummy_hcd [ 185.087633][ T5330] usb 5-1: not running at top speed; connect to a high speed hub [ 185.144039][ T5330] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.00 [ 185.255345][ T5330] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 185.397215][ T5330] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 185.677545][ T5330] garmin_gps 5-1:1.0: Garmin GPS usb/tty converter detected [ 185.759270][ T6926] 9pnet_virtio: no channels available for device syz [ 185.773041][ T5330] usb 5-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 185.798906][ T6917] vhci_hcd vhci_hcd.0: failed to lookup sock [ 185.806315][ T5783] usb 5-1: USB disconnect, device number 4 [ 185.825403][ T5603] Bluetooth: hci2: command 0x0406 tx timeout [ 185.832545][ T5603] Bluetooth: hci4: command 0x0406 tx timeout [ 185.839102][ T5610] Bluetooth: hci3: command 0x0406 tx timeout [ 185.839421][ T5611] Bluetooth: hci1: command 0x0406 tx timeout [ 185.851356][ T4911] Bluetooth: hci0: command 0x0406 tx timeout [ 185.861014][ T5783] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 185.957156][ T5783] garmin_gps 5-1:1.0: device disconnected [ 185.995086][ T6926] netlink: 'syz.2.293': attribute type 23 has an invalid length. [ 188.182118][ T6945] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 188.268991][ T6947] 9pnet_virtio: no channels available for device syz [ 188.320142][ T6946] md: could not open device unknown-block(1,0). [ 188.506491][ T6956] netlink: 'syz.4.298': attribute type 23 has an invalid length. [ 188.707767][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 188.715123][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 189.413314][ T6955] fuse: Bad value for 'fd' [ 190.224072][ T6971] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 190.245387][ T5328] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 190.454053][ T5328] usb 5-1: not running at top speed; connect to a high speed hub [ 190.479178][ T5328] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.00 [ 190.604607][ T5328] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 190.651087][ T5328] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 190.689633][ T5328] garmin_gps 5-1:1.0: Garmin GPS usb/tty converter detected [ 190.735782][ T5328] usb 5-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 190.911694][ T5696] usb 5-1: USB disconnect, device number 5 [ 190.941935][ T5696] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 190.983961][ T6978] 9pnet_virtio: no channels available for device syz [ 190.994347][ T5696] garmin_gps 5-1:1.0: device disconnected [ 191.101950][ T5328] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 191.195505][ T6985] netlink: 'syz.1.309': attribute type 23 has an invalid length. [ 191.296993][ T5328] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 191.395699][ T5328] usb 4-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 191.448009][ T5328] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 191.631479][ T5328] cdc_acm 4-1:1.0: probe with driver cdc_acm failed with error -22 [ 192.394679][ T30] audit: type=1400 audit(1786923857.854:447): avc: denied { kexec_image_load } for pid=6990 comm="syz.1.313" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 192.427557][ T30] audit: type=1400 audit(1786923857.884:448): avc: denied { write } for pid=6990 comm="syz.1.313" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 192.731640][ T7000] input: syz1 as /devices/virtual/input/input10 [ 192.738019][ T7000] input: failed to attach handler leds to device input10, error: -6 [ 194.184506][ T5717] usb 4-1: USB disconnect, device number 6 [ 194.419079][ T7023] input: syz1 as /devices/virtual/input/input11 [ 194.425530][ T7023] input: failed to attach handler leds to device input11, error: -6 [ 195.628761][ T7027] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 195.714721][ T7035] Zero length message leads to an empty skb [ 195.888092][ T7036] md: could not open device unknown-block(1,0). [ 196.862081][ T30] audit: type=1400 audit(1786923862.284:449): avc: denied { node_bind } for pid=7048 comm="syz.4.328" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 196.885373][ T30] audit: type=1400 audit(1786923862.294:450): avc: denied { write } for pid=7037 comm="syz.1.326" name="h" dev="configfs" ino=7949 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 196.938058][ T30] audit: type=1400 audit(1786923862.294:451): avc: denied { write } for pid=7037 comm="syz.1.326" name="h" dev="configfs" ino=7949 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 197.234687][ T7063] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 197.243318][ T7063] CPU: 0 UID: 0 PID: 7063 Comm: syz.3.331 Tainted: G L syzkaller #0 PREEMPT(full) [ 197.243347][ T7063] Tainted: [L]=SOFTLOCKUP [ 197.243354][ T7063] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 197.243365][ T7063] Call Trace: [ 197.243372][ T7063] [ 197.243379][ T7063] dump_stack_lvl+0x100/0x190 [ 197.243409][ T7063] sysfs_warn_dup.cold+0x1c/0x28 [ 197.243438][ T7063] sysfs_create_dir_ns+0x24b/0x2b0 [ 197.243460][ T7063] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 197.243480][ T7063] ? find_held_lock+0x2b/0x80 [ 197.243498][ T7063] ? kobject_add_internal+0x25f/0x930 [ 197.243526][ T7063] ? kobject_add_internal+0x25f/0x930 [ 197.243556][ T7063] ? class_dir_child_ns_type+0xd/0x60 [ 197.243593][ T7063] kobject_add_internal+0x2c8/0x930 [ 197.243627][ T7063] kobject_add+0x16a/0x1e0 [ 197.243654][ T7063] ? __pfx_kobject_add+0x10/0x10 [ 197.243684][ T7063] ? get_device_parent+0x1b3/0x4c0 [ 197.243712][ T7063] ? kobject_put+0xb9/0x640 [ 197.243745][ T7063] device_add+0x294/0x1970 [ 197.243774][ T7063] ? lockdep_init_map_type+0x5c/0x250 [ 197.243799][ T7063] ? __pfx_device_add+0x10/0x10 [ 197.243828][ T7063] ? lockdep_init_map_type+0x5c/0x250 [ 197.243854][ T7063] ? __init_waitqueue_head+0xca/0x150 [ 197.243887][ T7063] tty_register_device_attr+0x388/0x7f0 [ 197.243913][ T7063] ? lockdep_init_map_type+0x5c/0x250 [ 197.243938][ T7063] ? __pfx_tty_register_device_attr+0x10/0x10 [ 197.243968][ T7063] ? tty_port_init+0x156/0x1c0 [ 197.243996][ T7063] gsm_activate_mux+0x155/0x2a0 [ 197.244022][ T7063] gsmld_ioctl+0xbbc/0x15c0 [ 197.244056][ T7063] ? __pfx_gsmld_ioctl+0x10/0x10 [ 197.244086][ T7063] ? __ldsem_down_read_nested+0xf3/0x890 [ 197.244118][ T7063] ? __pfx___ldsem_down_read_nested+0x10/0x10 [ 197.244152][ T7063] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 197.244177][ T7063] ? __pfx_pty_unix98_ioctl+0x10/0x10 [ 197.244199][ T7063] ? __pfx_gsmld_ioctl+0x10/0x10 [ 197.244225][ T7063] tty_ioctl+0x11b4/0x1640 [ 197.244250][ T7063] ? __pfx_tty_ioctl+0x10/0x10 [ 197.244274][ T7063] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 197.244314][ T7063] ? hook_file_ioctl_common+0x140/0x440 [ 197.244343][ T7063] ? selinux_file_ioctl+0x13b/0x290 [ 197.244370][ T7063] ? selinux_file_ioctl+0xb6/0x290 [ 197.244400][ T7063] ? __pfx_tty_ioctl+0x10/0x10 [ 197.244424][ T7063] __x64_sys_ioctl+0x18e/0x210 [ 197.244455][ T7063] do_syscall_64+0x115/0x870 [ 197.244476][ T7063] ? clear_bhb_loop+0x70/0xc0 [ 197.244500][ T7063] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 197.244520][ T7063] RIP: 0033:0x7f7cb039e0d9 [ 197.244536][ T7063] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 197.244552][ T7063] RSP: 002b:00007f7cb1258028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 197.244571][ T7063] RAX: ffffffffffffffda RBX: 00007f7cb0626180 RCX: 00007f7cb039e0d9 [ 197.244589][ T7063] RDX: 0000200000000040 RSI: 00000000404c4701 RDI: 0000000000000006 [ 197.244600][ T7063] RBP: 00007f7cb0435024 R08: 0000000000000000 R09: 0000000000000000 [ 197.244614][ T7063] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 197.244625][ T7063] R13: 00007f7cb0626218 R14: 00007f7cb0626180 R15: 00007fffc4bc2438 [ 197.244650][ T7063] [ 197.244805][ T7063] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 198.936884][ T7071] 9pnet_virtio: no channels available for device syz [ 199.159482][ T7071] netlink: 'syz.2.334': attribute type 4 has an invalid length. [ 202.731504][ T7111] syz.1.346 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=1000 [ 202.811716][ T7111] CPU: 0 UID: 0 PID: 7111 Comm: syz.1.346 Tainted: G L syzkaller #0 PREEMPT(full) [ 202.811752][ T7111] Tainted: [L]=SOFTLOCKUP [ 202.811759][ T7111] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 202.811771][ T7111] Call Trace: [ 202.811778][ T7111] [ 202.811786][ T7111] dump_stack_lvl+0x100/0x190 [ 202.811817][ T7111] dump_header+0xfb/0x606 [ 202.811839][ T7111] oom_kill_process.cold+0xd/0x330 [ 202.811864][ T7111] out_of_memory+0x340/0x14f0 [ 202.811900][ T7111] ? __pfx_out_of_memory+0x10/0x10 [ 202.811937][ T7111] mem_cgroup_out_of_memory+0xc6/0x130 [ 202.811959][ T7111] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 202.811978][ T7111] ? find_held_lock+0x2b/0x80 [ 202.812001][ T7111] ? do_raw_spin_unlock+0x145/0x1e0 [ 202.812030][ T7111] ? _raw_spin_unlock+0x28/0x50 [ 202.812051][ T7111] try_charge_memcg+0x6e5/0xdf0 [ 202.812082][ T7111] ? __pfx_try_charge_memcg+0x10/0x10 [ 202.812109][ T7111] ? find_held_lock+0x2b/0x80 [ 202.812127][ T7111] ? rcu_read_unlock+0x17/0x60 [ 202.812156][ T7111] ? rcu_read_unlock+0x17/0x60 [ 202.812193][ T7111] __memcg_slab_post_alloc_hook+0x469/0x1160 [ 202.812232][ T7111] ? kasan_unpoison+0x27/0x60 [ 202.812256][ T7111] __kmalloc_cache_noprof+0x592/0x6c0 [ 202.812278][ T7111] ? nf_tables_newtable+0xd0a/0x1a90 [ 202.812309][ T7111] nf_tables_newtable+0xd0a/0x1a90 [ 202.812340][ T7111] ? __pfx_nf_tables_newtable+0x10/0x10 [ 202.812372][ T7111] ? __nla_parse+0x40/0x60 [ 202.812396][ T7111] nfnetlink_rcv_batch+0x1410/0x2880 [ 202.812439][ T7111] ? __pfx_nfnetlink_rcv_batch+0x10/0x10 [ 202.812468][ T7111] ? find_held_lock+0x2b/0x80 [ 202.812503][ T7111] ? avc_has_perm_noaudit+0x145/0x3b0 [ 202.812560][ T7111] ? __nla_parse+0x40/0x60 [ 202.812584][ T7111] nfnetlink_rcv+0x3bd/0x440 [ 202.812610][ T7111] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 202.812645][ T7111] netlink_unicast+0x585/0x850 [ 202.812672][ T7111] ? __pfx_netlink_unicast+0x10/0x10 [ 202.812704][ T7111] netlink_sendmsg+0x8b0/0xda0 [ 202.812733][ T7111] ? __pfx_netlink_sendmsg+0x10/0x10 [ 202.812761][ T7111] ? selinux_socket_sendmsg+0x198/0x2f0 [ 202.812794][ T7111] ____sys_sendmsg+0xa4d/0xbe0 [ 202.812812][ T7111] ? __pfx_netlink_sendmsg+0x10/0x10 [ 202.812836][ T7111] ? __pfx_____sys_sendmsg+0x10/0x10 [ 202.812852][ T7111] ? futex_hash+0x311/0x400 [ 202.812884][ T7111] ? plist_del+0x308/0x510 [ 202.812916][ T7111] ___sys_sendmsg+0x190/0x1e0 [ 202.812939][ T7111] ? __pfx____sys_sendmsg+0x10/0x10 [ 202.812956][ T7111] ? __lock_acquire+0x49f/0x1a40 [ 202.812981][ T7111] ? futex_wake+0x220/0x5e0 [ 202.813029][ T7111] __sys_sendmsg+0x160/0x210 [ 202.813055][ T7111] ? __pfx___sys_sendmsg+0x10/0x10 [ 202.813095][ T7111] do_syscall_64+0x115/0x870 [ 202.813117][ T7111] ? clear_bhb_loop+0x70/0xc0 [ 202.813140][ T7111] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 202.813160][ T7111] RIP: 0033:0x7f6547b9e0d9 [ 202.813176][ T7111] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 202.813194][ T7111] RSP: 002b:00007f6545df6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 202.813213][ T7111] RAX: ffffffffffffffda RBX: 00007f6547e26090 RCX: 00007f6547b9e0d9 [ 202.813225][ T7111] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 202.813235][ T7111] RBP: 00007f6547c35024 R08: 0000000000000000 R09: 0000000000000000 [ 202.813245][ T7111] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 202.813256][ T7111] R13: 00007f6547e26128 R14: 00007f6547e26090 R15: 00007ffca01576d8 [ 202.813282][ T7111] [ 202.813354][ T7111] memory: usage 8kB, limit 8kB, failcnt 23 [ 203.196010][ T7111] memory+swap: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 203.203584][ T7111] kmem: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 203.210600][ T7111] Memory cgroup stats for /syz1/test: [ 203.210909][ T7111] cache 0 [ 203.219403][ T7111] rss 0 [ 203.222763][ T7111] rss_huge 0 [ 203.226024][ T7111] shmem 0 [ 203.229111][ T7111] mapped_file 0 [ 203.790999][ T7120] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 203.812810][ T7111] dirty 0 [ 203.900353][ T7111] writeback 0 [ 203.903816][ T7111] workingset_refault_anon 0 [ 203.910086][ T7111] workingset_refault_file 0 [ 203.918497][ T7111] swap 0 [ 203.921752][ T7111] swapcached 0 [ 203.925213][ T7111] pgpgin 0 [ 203.928241][ T7111] pgpgout 0 [ 203.974319][ T7111] pgfault 9 [ 203.981610][ T7111] pgmajfault 0 [ 203.991699][ T7111] inactive_anon 0 [ 204.040091][ T7111] active_anon 0 [ 204.157145][ T7111] inactive_file 0 [ 204.162866][ T7129] 9pnet_virtio: no channels available for device syz [ 204.269059][ T7111] active_file 0 [ 204.288067][ T7111] unevictable 0 [ 204.450318][ T7111] hierarchical_memory_limit 8192 [ 204.463887][ T7129] netlink: 'syz.3.350': attribute type 4 has an invalid length. [ 204.617266][ T7111] hierarchical_memsw_limit 9223372036854771712 [ 204.770066][ T7111] total_cache 0 [ 204.778395][ T7111] total_rss 0 [ 204.786221][ T7111] total_rss_huge 0 [ 204.794764][ T7111] total_shmem 0 [ 204.810026][ T7111] total_mapped_file 0 [ 204.820032][ T7111] total_dirty 0 [ 204.835125][ T7111] total_writeback 0 [ 204.844848][ T7111] total_workingset_refault_anon 0 [ 204.862990][ T7111] total_workingset_refault_file 0 [ 204.930009][ T7111] total_swap 0 [ 204.938449][ T7111] total_swapcached 0 [ 204.947126][ T7111] total_pgpgin 0 [ 204.954520][ T7111] total_pgpgout 0 [ 204.976807][ T7111] total_pgfault 9 [ 204.990303][ T7111] total_pgmajfault 0 [ 204.995159][ T30] audit: type=1400 audit(1786923870.424:452): avc: denied { write } for pid=7136 comm="syz.4.353" name="h" dev="configfs" ino=7949 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 205.016385][ T7111] total_inactive_anon 0 [ 205.022673][ T7111] total_active_anon 0 [ 205.026683][ T7111] total_inactive_file 0 [ 205.072508][ T30] audit: type=1400 audit(1786923870.434:453): avc: denied { write } for pid=7136 comm="syz.4.353" name="h" dev="configfs" ino=7949 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 205.100735][ T7111] total_active_file 0 [ 205.106000][ T7111] total_unevictable 0 [ 205.113671][ T7111] anon_cost 0 [ 205.116982][ T7111] file_cost 0 [ 205.120286][ T7111] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz1/test,task_memcg=/syz1/test,task=syz.1.346,pid=7108,uid=0 [ 205.146147][ T7111] Memory cgroup out of memory: Killed process 7111 (syz.1.346) total-vm:104432kB, anon-rss:1436kB, file-rss:23300kB, shmem-rss:0kB, UID:0 pgtables:140kB oom_score_adj:1000 [ 208.260774][ T5704] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:2a [ 209.195735][ T7171] overlayfs: missing 'lowerdir' [ 209.932411][ T30] audit: type=1400 audit(1786923874.654:454): avc: denied { create } for pid=7168 comm="syz.3.362" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 210.220023][ T30] audit: type=1400 audit(1786923874.654:455): avc: denied { setopt } for pid=7168 comm="syz.3.362" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 210.534903][ T7187] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 210.755948][ T7197] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 210.894868][ T7197] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 210.904984][ T7197] overlayfs: failed to look up (tracing) for ino (-66) [ 211.080404][ T7198] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 212.881357][ T5696] usb 5-1: new full-speed USB device number 6 using dummy_hcd [ 212.934447][ T5328] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 213.070011][ T7194] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(3) [ 213.076642][ T7194] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 213.084755][ T5696] usb 5-1: device descriptor read/64, error -71 [ 213.098202][ T7194] vhci_hcd vhci_hcd.0: Device attached [ 213.110017][ T5328] usb 3-1: Using ep0 maxpacket: 32 [ 213.122786][ T5328] usb 3-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 213.154639][ T5328] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 213.283302][ T7214] vhci_hcd: connection closed [ 213.283314][ T5328] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 213.298385][ T48] vhci_hcd vhci_hcd.0: stop threads [ 213.304682][ T48] vhci_hcd vhci_hcd.0: release socket [ 213.311195][ T48] vhci_hcd vhci_hcd.0: disconnect device [ 213.316920][ T5328] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 213.400335][ T7219] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 213.537723][ T7219] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 213.548883][ T7219] overlayfs: failed to look up (tracing) for ino (-66) [ 214.290469][ T5696] usb 5-1: new full-speed USB device number 7 using dummy_hcd [ 214.298041][ T5328] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 214.316774][ T5328] usb 3-1: Product: syz [ 214.330813][ T7221] 9pnet_virtio: no channels available for device syz [ 214.630569][ T5328] usb 3-1: Manufacturer: syz [ 214.636964][ T5328] usb 3-1: SerialNumber: syz [ 214.690583][ T5696] usb 5-1: device descriptor read/64, error -71 [ 214.701169][ T7221] netlink: 'syz.1.378': attribute type 4 has an invalid length. [ 214.729922][ T7224] 9pnet_virtio: no channels available for device syz [ 214.811302][ T5696] usb usb5-port1: attempt power cycle [ 214.861636][ T7225] netlink: 'syz.3.379': attribute type 23 has an invalid length. [ 215.459968][ T5696] usb 5-1: new full-speed USB device number 8 using dummy_hcd [ 216.423292][ T7246] netlink: 28 bytes leftover after parsing attributes in process `syz.3.385'. [ 216.526856][ T7249] overlayfs: missing 'lowerdir' [ 216.595908][ T5696] usb 5-1: device not accepting address 8, error -71 [ 216.757694][ T5328] usb 3-1: 1:1 : incorrect wMaxPacketSize for BADD profile [ 217.939559][ T5328] usb 3-1: incorrect wMaxPacketSize 0x10 for BADD profile [ 218.190565][ T30] audit: type=1800 audit(1786923883.604:456): pid=7256 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.387" name="bmControls" dev="configfs" ino=14558 res=0 errno=0 [ 218.216848][ T7256] openvswitch: netlink: IP tunnel dst address not specified [ 218.316350][ T30] audit: type=1400 audit(1786923883.774:457): avc: denied { append } for pid=7255 comm="syz.0.387" name="001" dev="devtmpfs" ino=723 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 218.346302][ T7256] netlink: 96 bytes leftover after parsing attributes in process `syz.0.387'. [ 218.375802][ T5328] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 219.017623][ T5328] usb 3-1: USB disconnect, device number 5 [ 219.888670][ T5596] udevd[5596]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 219.925790][ T7276] 9pnet_virtio: no channels available for device syz [ 220.061282][ T7279] netlink: 'syz.4.395': attribute type 23 has an invalid length. [ 220.135436][ T7284] can0: slcan on ptm0. [ 220.189731][ T7290] 9pnet_virtio: no channels available for device syz [ 220.223560][ T7283] can0 (unregistered): slcan off ptm0. [ 220.300681][ T5328] usb 3-1: new full-speed USB device number 6 using dummy_hcd [ 220.438073][ T30] audit: type=1400 audit(1786923885.894:458): avc: denied { write } for pid=7291 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 220.462059][ T5328] usb 3-1: device descriptor read/64, error -71 [ 220.504495][ T30] audit: type=1400 audit(1786923885.964:459): avc: denied { write } for pid=7309 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 220.954690][ T5328] usb 3-1: new full-speed USB device number 7 using dummy_hcd [ 221.840684][ T7326] 9pnet_virtio: no channels available for device syz [ 221.900235][ T5328] usb 3-1: device descriptor read/64, error -71 [ 221.945997][ T30] audit: type=1400 audit(1786923887.404:460): avc: denied { write } for pid=7311 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 222.008561][ T30] audit: type=1400 audit(1786923887.464:461): avc: denied { write } for pid=7336 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 222.030608][ T5688] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 222.039687][ T5328] usb usb3-port1: attempt power cycle [ 222.093258][ T30] audit: type=1400 audit(1786923887.554:462): avc: denied { write } for pid=7333 comm="syz.1.407" name="h" dev="configfs" ino=7949 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 222.117156][ T30] audit: type=1400 audit(1786923887.554:463): avc: denied { write } for pid=7333 comm="syz.1.407" name="h" dev="configfs" ino=7949 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 222.202634][ T5688] usb 5-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 222.214112][ T5688] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 222.225348][ T5688] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 222.227693][ T7341] netlink: 'syz.1.409': attribute type 4 has an invalid length. [ 222.241388][ T7341] netlink: 17 bytes leftover after parsing attributes in process `syz.1.409'. [ 222.272515][ T5688] as10x_usb: device has been detected [ 222.279006][ T5688] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 222.317768][ T5688] usb 5-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 222.363158][ T7344] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 222.380034][ T5328] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 222.400334][ T5328] usb 3-1: device descriptor read/8, error -71 [ 222.426061][ T30] audit: type=1400 audit(1786923887.884:464): avc: denied { firmware_load } for pid=5688 comm="kworker/0:4" path="/lib/firmware/as102_data1_st.hex" dev="sda1" ino=297 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 222.454790][ T5688] as10x_usb: error during firmware upload part1 [ 222.462398][ T5688] Registered device Abilis Systems DVB-Titan [ 222.584270][ T30] audit: type=1400 audit(1786923888.044:465): avc: denied { write } for pid=7349 comm="syz.1.413" name="demux0" dev="devtmpfs" ino=926 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 222.670005][ T5328] usb 3-1: new full-speed USB device number 9 using dummy_hcd [ 222.695165][ T5328] usb 3-1: device descriptor read/8, error -71 [ 222.758885][ T7352] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 222.811611][ T5328] usb usb3-port1: unable to enumerate USB device [ 223.191308][ T7359] md: could not open device unknown-block(1,0). [ 224.201200][ T5688] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 224.361379][ C1] IPv4: Oversized IP packet from 127.0.0.1 [ 224.401807][ T5688] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 224.415485][ T5688] usb 3-1: config 1 interface 1 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 224.439365][ T5688] usb 3-1: config 1 interface 1 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 224.788338][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 224.788361][ T30] audit: type=1400 audit(1786923890.204:468): avc: denied { read } for pid=7319 comm="syz.4.404" name="frontend0" dev="devtmpfs" ino=3597 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 225.323103][ T5783] usb 5-1: USB disconnect, device number 10 [ 225.797524][ T5688] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 225.879438][ T5783] Unregistered device Abilis Systems DVB-Titan [ 225.896422][ T5783] as10x_usb: device has been disconnected [ 225.899244][ T5688] cdc_acm 3-1:1.0: probe with driver cdc_acm failed with error -12 [ 225.953784][ T7385] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 226.030410][ T7389] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 226.071110][ T7390] md: could not open device unknown-block(1,0). [ 226.150021][ T7392] md: could not open device unknown-block(1,0). [ 226.189983][ T5783] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 226.340822][ T5783] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 226.350836][ T5783] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 226.361842][ T5783] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 226.371434][ T5783] usb 5-1: config 0 descriptor?? [ 226.583336][ T5783] usbhid 5-1:0.0: can't add hid device: -71 [ 226.596132][ T5783] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 226.618507][ T5783] usb 5-1: USB disconnect, device number 11 [ 226.961978][ T5330] usb 1-1: new full-speed USB device number 6 using dummy_hcd [ 227.099962][ T5783] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 227.107641][ T5330] usb 1-1: device descriptor read/64, error -71 [ 227.150053][ T5704] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 227.260774][ T5783] usb 5-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 227.271206][ T5783] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 227.282607][ T5783] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 227.296974][ T5783] usb 5-1: config 0 descriptor?? [ 227.321874][ T5704] usb 2-1: not running at top speed; connect to a high speed hub [ 227.330553][ T5704] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.00 [ 227.342271][ T5704] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 227.354854][ T5330] usb 1-1: new full-speed USB device number 7 using dummy_hcd [ 227.365346][ T5704] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 227.387107][ T5704] garmin_gps 2-1:1.0: Garmin GPS usb/tty converter detected [ 227.418894][ T5704] usb 2-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 227.499961][ T5330] usb 1-1: device descriptor read/64, error -71 [ 227.517609][ T5704] usb 3-1: USB disconnect, device number 10 [ 227.620222][ T5330] usb usb1-port1: attempt power cycle [ 227.682935][ T5695] usb 2-1: USB disconnect, device number 7 [ 228.266365][ T5783] aiptek 5-1:0.0: Aiptek using 400 ms programming speed [ 228.825677][ T5783] input: Aiptek as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input12 [ 228.849978][ T5330] usb 1-1: new full-speed USB device number 8 using dummy_hcd [ 228.931608][ T5330] usb 1-1: device descriptor read/8, error -71 [ 228.954687][ T5695] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 228.972731][ T5695] garmin_gps 2-1:1.0: device disconnected [ 229.179962][ T5330] usb 1-1: new full-speed USB device number 9 using dummy_hcd [ 229.905575][ T5783] usb 5-1: USB disconnect, device number 12 [ 229.905622][ C1] aiptek 5-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 229.956126][ T5330] usb 1-1: device descriptor read/8, error -71 [ 230.072938][ T5330] usb usb1-port1: unable to enumerate USB device [ 230.894642][ T7430] trusted_key: encrypted_key: insufficient parameters specified [ 232.759924][ T7441] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 233.587995][ T7440] openvswitch: netlink: IP tunnel dst address not specified [ 234.286647][ T7453] input: syz1 as /devices/virtual/input/input13 [ 234.293052][ T7453] input: failed to attach handler leds to device input13, error: -6 [ 234.310357][ T5330] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 234.850425][ T7440] netlink: 96 bytes leftover after parsing attributes in process `syz.1.437'. [ 235.000594][ T5330] usb 3-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 235.012327][ T5330] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 235.024779][ T5330] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 235.570308][ T5330] as10x_usb: device has been detected [ 235.804717][ T5330] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 236.068164][ T5330] usb 3-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 236.107143][ T5330] as10x_usb: error during firmware upload part1 [ 236.151843][ T5330] Registered device Abilis Systems DVB-Titan [ 236.460241][ T5330] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 237.070021][ T5330] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 237.090436][ T5688] usb 3-1: USB disconnect, device number 11 [ 237.118735][ T5330] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 237.141391][ T5688] Unregistered device Abilis Systems DVB-Titan [ 237.149672][ T5330] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 237.178926][ T5688] as10x_usb: device has been disconnected [ 237.193880][ T5330] usb 2-1: config 0 descriptor?? [ 237.297641][ T30] audit: type=1400 audit(1786923902.754:469): avc: denied { create } for pid=7475 comm="syz.3.448" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 238.024278][ T24] usb 5-1: new full-speed USB device number 13 using dummy_hcd [ 238.486843][ T5330] usbhid 2-1:0.0: can't add hid device: -71 [ 238.835879][ T5330] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 239.379286][ T7491] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 239.900099][ C0] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:2a [ 240.344412][ T5330] usb 2-1: USB disconnect, device number 8 [ 242.082672][ T7514] netlink: 'syz.4.455': attribute type 11 has an invalid length. [ 245.899591][ T7544] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 246.038433][ T7544] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 246.048623][ T7544] overlayfs: failed to look up (tracing) for ino (-66) [ 247.019972][ T5330] usb 3-1: new full-speed USB device number 12 using dummy_hcd [ 247.435716][ T7551] trusted_key: encrypted_key: insufficient parameters specified [ 247.444040][ T5330] usb 3-1: device descriptor read/64, error -71 [ 248.883774][ T5330] usb 3-1: new full-speed USB device number 13 using dummy_hcd [ 249.059982][ T5330] usb 3-1: device descriptor read/64, error -71 [ 249.142477][ T7567] overlayfs: missing 'lowerdir' [ 249.838419][ T5330] usb usb3-port1: attempt power cycle [ 250.148425][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 250.154875][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 251.855866][ T7578] 9pnet_virtio: no channels available for device syz [ 252.452277][ T30] audit: type=1400 audit(1786923917.794:470): avc: denied { name_connect } for pid=7576 comm="syz.2.474" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 252.523459][ T30] audit: type=1400 audit(1786923917.974:471): avc: denied { ioctl } for pid=7588 comm="syz.1.477" path="socket:[15647]" dev="sockfs" ino=15647 ioctlcmd=0x8922 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 252.604945][ T7593] netlink: 28 bytes leftover after parsing attributes in process `syz.1.478'. [ 252.866509][ T7598] netlink: 'syz.1.479': attribute type 11 has an invalid length. [ 253.311410][ T5783] usb 3-1: new full-speed USB device number 15 using dummy_hcd [ 253.702311][ T5696] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:2a [ 253.973531][ T5696] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:2a [ 254.071165][ T5783] usb 3-1: not running at top speed; connect to a high speed hub [ 254.079645][ T5783] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.00 [ 254.093113][ T5783] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 254.107457][ T5783] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 254.130522][ T30] audit: type=1400 audit(1786923919.594:472): avc: denied { read write } for pid=7609 comm="syz.4.483" name="rdma_cm" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 254.160771][ T5783] garmin_gps 3-1:1.0: Garmin GPS usb/tty converter detected [ 254.171880][ T30] audit: type=1400 audit(1786923919.594:473): avc: denied { open } for pid=7609 comm="syz.4.483" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 254.198959][ T5783] usb 3-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 254.539316][ T5783] usb 3-1: USB disconnect, device number 15 [ 254.848519][ T5783] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 254.959274][ T5783] garmin_gps 3-1:1.0: device disconnected [ 255.779731][ T5783] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:2a [ 256.308236][ T7625] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 256.435587][ T7625] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 256.446106][ T7625] overlayfs: failed to look up (tracing) for ino (-66) [ 257.270250][ T5783] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:2a [ 257.728932][ T7627] tipc: Enabling of bearer rejected, failed to enable media [ 258.715545][ T7635] 9pnet_virtio: no channels available for device syz [ 259.509455][ T30] audit: type=1800 audit(1786923924.964:474): pid=7654 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.498" name="bmControls" dev="configfs" ino=16480 res=0 errno=0 [ 259.534925][ T7654] openvswitch: netlink: IP tunnel dst address not specified [ 260.065132][ T7654] netlink: 96 bytes leftover after parsing attributes in process `syz.1.498'. [ 260.486983][ T7664] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 261.638919][ T7669] 9pnet_virtio: no channels available for device syz [ 262.110712][ T7669] netlink: 'syz.3.502': attribute type 4 has an invalid length. [ 262.140223][ T7671] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 263.038516][ T7671] md: could not open device unknown-block(1,0). [ 263.618256][ T7689] input: syz1 as /devices/virtual/input/input14 [ 263.624765][ T7689] input: failed to attach handler leds to device input14, error: -6 [ 264.302167][ T30] audit: type=1800 audit(1786923929.764:475): pid=7697 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.4.511" name="bmControls" dev="configfs" ino=16635 res=0 errno=0 [ 264.327848][ T7697] openvswitch: netlink: IP tunnel dst address not specified [ 264.957014][ T7706] 9pnet_virtio: no channels available for device syz [ 267.355534][ T7731] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 267.737631][ T30] audit: type=1400 audit(1786923933.194:476): avc: denied { shutdown } for pid=7732 comm="syz.1.519" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 267.836765][ T7735] tipc: Enabling of bearer rejected, failed to enable media [ 268.314301][ T7749] input: syz1 as /devices/virtual/input/input15 [ 268.321110][ T7749] input: failed to attach handler leds to device input15, error: -6 [ 268.747096][ T7744] syzkaller0: entered promiscuous mode [ 268.752872][ T7744] syzkaller0: entered allmulticast mode [ 269.094654][ T7763] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 272.350012][ T7790] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 272.536975][ T7795] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 273.820132][ C0] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:2a [ 273.822122][ T7813] input: syz1 as /devices/virtual/input/input16 [ 273.840931][ T7813] input: failed to attach handler leds to device input16, error: -6 [ 274.080493][ T5704] usb 1-1: new full-speed USB device number 10 using dummy_hcd [ 274.598918][ T5704] usb 1-1: not running at top speed; connect to a high speed hub [ 274.931975][ T5704] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.00 [ 274.941165][ T5704] usb 1-1: no configurations [ 274.947507][ T5704] usb 1-1: can't read configurations, error -22 [ 275.014501][ T7817] 9pnet_virtio: no channels available for device syz [ 275.100362][ T5704] usb 1-1: new full-speed USB device number 11 using dummy_hcd [ 275.271094][ T5704] usb 1-1: not running at top speed; connect to a high speed hub [ 275.279691][ T5704] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.00 [ 275.289566][ T5704] usb 1-1: no configurations [ 275.294374][ T5330] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 275.301983][ T5704] usb 1-1: can't read configurations, error -22 [ 275.308978][ T5704] usb usb1-port1: attempt power cycle [ 275.446532][ T7827] syzkaller0: entered promiscuous mode [ 275.451527][ T5330] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 275.454293][ T7827] syzkaller0: entered allmulticast mode [ 275.462264][ T5330] usb 5-1: config 1 interface 1 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 275.479147][ T5330] usb 5-1: config 1 interface 1 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 275.490113][ T5330] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 275.504643][ T5330] cdc_acm 5-1:1.0: probe with driver cdc_acm failed with error -12 [ 275.650163][ T5704] usb 1-1: new full-speed USB device number 12 using dummy_hcd [ 275.674812][ T5704] usb 1-1: not running at top speed; connect to a high speed hub [ 275.688189][ T5704] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.00 [ 275.718045][ T5704] usb 1-1: no configurations [ 275.738105][ T5704] usb 1-1: can't read configurations, error -22 [ 275.920247][ T5704] usb 1-1: new full-speed USB device number 13 using dummy_hcd [ 276.022921][ T5704] usb 1-1: not running at top speed; connect to a high speed hub [ 276.107110][ T5704] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.00 [ 276.152712][ T5704] usb 1-1: no configurations [ 276.169382][ T5704] usb 1-1: can't read configurations, error -22 [ 276.201624][ T5704] usb usb1-port1: unable to enumerate USB device [ 278.061136][ T5704] usb 5-1: USB disconnect, device number 14 [ 278.593099][ T30] audit: type=1400 audit(1786923944.054:477): avc: denied { write } for pid=7848 comm="syz.0.550" name="h" dev="configfs" ino=7949 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 278.635605][ T7854] syz.4.552 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 278.703840][ T7854] CPU: 1 UID: 0 PID: 7854 Comm: syz.4.552 Tainted: G L syzkaller #0 PREEMPT(full) [ 278.703871][ T7854] Tainted: [L]=SOFTLOCKUP [ 278.703879][ T7854] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 278.703889][ T7854] Call Trace: [ 278.703894][ T7854] [ 278.703901][ T7854] dump_stack_lvl+0x100/0x190 [ 278.703929][ T7854] dump_header+0xfb/0x606 [ 278.703944][ T7854] oom_kill_process.cold+0xd/0x330 [ 278.703958][ T7854] out_of_memory+0x340/0x14f0 [ 278.703979][ T7854] ? __pfx_out_of_memory+0x10/0x10 [ 278.704000][ T7854] mem_cgroup_out_of_memory+0xc6/0x130 [ 278.704013][ T7854] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 278.704025][ T7854] ? find_held_lock+0x2b/0x80 [ 278.704039][ T7854] ? do_raw_spin_unlock+0x145/0x1e0 [ 278.704056][ T7854] ? _raw_spin_unlock+0x28/0x50 [ 278.704069][ T7854] try_charge_memcg+0x6e5/0xdf0 [ 278.704087][ T7854] ? __pfx_try_charge_memcg+0x10/0x10 [ 278.704103][ T7854] ? find_held_lock+0x2b/0x80 [ 278.704113][ T7854] ? rcu_read_unlock+0x17/0x60 [ 278.704129][ T7854] ? rcu_read_unlock+0x17/0x60 [ 278.704149][ T7854] __memcg_slab_post_alloc_hook+0x469/0x1160 [ 278.704171][ T7854] ? kasan_save_track+0x14/0x30 [ 278.704194][ T7854] kmem_cache_alloc_lru_noprof+0x583/0x6a0 [ 278.704211][ T7854] ? __d_alloc+0x35/0xa50 [ 278.704228][ T7854] __d_alloc+0x35/0xa50 [ 278.704244][ T7854] d_alloc_pseudo+0x1c/0xc0 [ 278.704262][ T7854] alloc_file_pseudo+0x118/0x290 [ 278.704279][ T7854] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 278.704294][ T7854] ? alloc_fd+0x471/0x7a0 [ 278.704309][ T7854] sock_alloc_file+0x50/0x210 [ 278.704326][ T7854] __sys_socket+0x1c0/0x260 [ 278.704339][ T7854] ? __pfx___sys_socket+0x10/0x10 [ 278.704354][ T7854] __x64_sys_socket+0x72/0xb0 [ 278.704365][ T7854] ? lockdep_hardirqs_on+0x78/0x100 [ 278.704378][ T7854] do_syscall_64+0x115/0x870 [ 278.704391][ T7854] ? clear_bhb_loop+0x70/0xc0 [ 278.704404][ T7854] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 278.704416][ T7854] RIP: 0033:0x7f4c50f9e0d9 [ 278.704426][ T7854] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 278.704436][ T7854] RSP: 002b:00007f4c51e22028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 278.704448][ T7854] RAX: ffffffffffffffda RBX: 00007f4c51225fa0 RCX: 00007f4c50f9e0d9 [ 278.704454][ T7854] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 000000000000000a [ 278.704461][ T7854] RBP: 00007f4c51035024 R08: 0000000000000000 R09: 0000000000000000 [ 278.704467][ T7854] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 278.704473][ T7854] R13: 00007f4c51226038 R14: 00007f4c51225fa0 R15: 00007fffb3dba828 [ 278.704488][ T7854] [ 278.771354][ T7854] memory: usage 8kB, limit 8kB, failcnt 23 [ 278.800470][ T7859] syzkaller0: entered promiscuous mode [ 279.009130][ T7854] memory+swap: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 279.016987][ T30] audit: type=1400 audit(1786923944.054:478): avc: denied { write } for pid=7848 comm="syz.0.550" name="h" dev="configfs" ino=7949 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 279.125806][ T7854] kmem: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 279.198420][ T7862] netlink: 12 bytes leftover after parsing attributes in process `syz.3.554'. [ 279.242480][ T7854] Memory cgroup stats for /syz4/test: [ 279.248485][ T7854] cache 0 [ 279.361529][ T7854] rss 0 [ 279.381299][ T7854] rss_huge 0 [ 279.390838][ T7854] shmem 0 [ 279.393815][ T7854] mapped_file 0 [ 279.397444][ T7854] dirty 0 [ 279.400487][ T7854] writeback 0 [ 279.412293][ T7854] workingset_refault_anon 0 [ 279.433965][ T7854] workingset_refault_file 0 [ 280.765155][ T7854] swap 0 [ 280.824825][ T7854] swapcached 0 [ 280.840185][ T7854] pgpgin 0 [ 280.847619][ T7859] syzkaller0: entered allmulticast mode [ 280.864419][ T7854] pgpgout 0 [ 280.890698][ T7854] pgfault 0 [ 280.923285][ T7854] pgmajfault 0 [ 280.974687][ T7854] inactive_anon 0 [ 281.032319][ T7854] active_anon 0 [ 281.080105][ T7854] inactive_file 0 [ 281.114420][ T7854] active_file 0 [ 281.142669][ T7862] bond1: entered promiscuous mode [ 281.150557][ T7862] 8021q: adding VLAN 0 to HW filter on device bond1 [ 281.165415][ T7854] unevictable 0 [ 281.308135][ T7854] hierarchical_memory_limit 8192 [ 281.318238][ T7854] hierarchical_memsw_limit 9223372036854771712 [ 281.328050][ T7854] total_cache 0 [ 281.339004][ T7854] total_rss 0 [ 281.346067][ T7854] total_rss_huge 0 [ 281.498055][ T7875] input: syz1 as /devices/virtual/input/input17 [ 281.504541][ T7875] input: failed to attach handler leds to device input17, error: -6 [ 281.558281][ T7854] total_shmem 0 [ 281.783866][ T7864] bridge1: entered promiscuous mode [ 281.790782][ T7854] total_mapped_file 0 [ 281.799282][ T7854] total_dirty 0 [ 281.809420][ T7854] total_writeback 0 [ 281.812903][ T7864] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 281.813883][ T7854] total_workingset_refault_anon 0 [ 281.827387][ T7854] total_workingset_refault_file 0 [ 281.832839][ T7854] total_swap 0 [ 281.837740][ T7854] total_swapcached 0 [ 281.842673][ T7854] total_pgpgin 0 [ 281.846285][ T7854] total_pgpgout 0 [ 281.850186][ T7854] total_pgfault 0 [ 281.858072][ T7854] total_pgmajfault 0 [ 281.862275][ T7854] total_inactive_anon 0 [ 281.867997][ T7854] total_active_anon 0 [ 281.873345][ T7854] total_inactive_file 0 [ 281.908509][ T7854] total_active_file 0 [ 281.917002][ T7854] total_unevictable 0 [ 281.925695][ T7854] anon_cost 0 [ 281.933521][ T7854] file_cost 0 [ 281.945979][ T7854] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz4/test,task_memcg=/syz4/test,task=syz.4.552,pid=7853,uid=0 [ 281.974563][ T7854] Memory cgroup out of memory: Killed process 7854 (syz.4.552) total-vm:104432kB, anon-rss:1424kB, file-rss:23288kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 282.540884][ T5704] usb 1-1: new full-speed USB device number 14 using dummy_hcd [ 282.808965][ T5704] usb 1-1: not running at top speed; connect to a high speed hub [ 282.870386][ T5704] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.00 [ 282.966347][ T5704] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 283.008451][ T5704] usb 1-1: config 0 has no interfaces? [ 283.032044][ T5704] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 283.857169][ T5704] usb 1-1: config 0 descriptor?? [ 284.264338][ T5330] usb 1-1: USB disconnect, device number 14 [ 284.881290][ T30] audit: type=1400 audit(1786923950.334:479): avc: denied { write } for pid=7893 comm="syz.3.563" name="001" dev="devtmpfs" ino=741 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 285.043104][ T7902] netlink: 8 bytes leftover after parsing attributes in process `syz.3.566'. [ 285.098986][ T30] audit: type=1800 audit(1786923950.554:480): pid=7905 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.567" name="bmControls" dev="configfs" ino=17187 res=0 errno=0 [ 285.126085][ T7905] openvswitch: netlink: IP tunnel dst address not specified [ 285.243463][ T7905] netlink: 96 bytes leftover after parsing attributes in process `syz.0.567'. [ 285.481852][ T7915] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 285.974672][ T7917] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 285.983885][ T7917] overlayfs: overlapping lowerdir path [ 286.828766][ T30] audit: type=1400 audit(1786923952.274:481): avc: denied { ioctl } for pid=7919 comm="syz.0.571" path="socket:[17202]" dev="sockfs" ino=17202 ioctlcmd=0x5868 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 286.872418][ T7913] netlink: 'syz.1.570': attribute type 11 has an invalid length. [ 287.513472][ T5696] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 287.689194][ T5688] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:2a [ 287.802008][ T7921] syzkaller1: entered promiscuous mode [ 287.808697][ T7921] syzkaller1: entered allmulticast mode [ 287.870870][ T5696] usb 1-1: New USB device found, idVendor=2040, idProduct=4200, bcdDevice= 1.00 [ 287.929943][ T5696] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 287.957641][ T5696] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 288.037072][ T7938] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 288.172224][ T7938] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 288.182689][ T7938] overlayfs: failed to look up (tracing) for ino (-66) [ 288.935151][ T9] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:2a [ 289.013930][ T5696] em28xx 1-1:1.0: New device @ 480 Mbps (2040:4200, interface 0, class 0) [ 289.250399][ T5696] em28xx 1-1:1.0: Video interface 0 found: [ 289.317935][ T7943] netlink: 48 bytes leftover after parsing attributes in process `syz.4.575'. [ 289.530901][ T7937] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 289.711452][ T7947] 9pnet_virtio: no channels available for device syz [ 289.755200][ T5696] em28xx 1-1:1.0: unknown em28xx chip ID (0) [ 289.818251][ T7953] netlink: 12 bytes leftover after parsing attributes in process `syz.4.580'. [ 289.837734][ T5696] em28xx 1-1:1.0: reading from i2c device at 0xa0 failed (error=-5) [ 289.854974][ T5696] em28xx 1-1:1.0: board has no eeprom [ 289.857718][ T7953] bond1: entered promiscuous mode [ 289.867376][ T7953] 8021q: adding VLAN 0 to HW filter on device bond1 [ 289.891727][ T7956] bridge1: entered promiscuous mode [ 289.905287][ T7956] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 289.917441][ T29] usb 2-1: new full-speed USB device number 9 using dummy_hcd [ 289.930155][ T5696] em28xx 1-1:1.0: Identified as Hauppauge WinTV USB 2 (card=4) [ 289.946857][ T5696] em28xx 1-1:1.0: analog set to bulk mode. [ 289.953903][ T5328] em28xx 1-1:1.0: Registering V4L2 extension [ 290.075085][ T29] usb 2-1: not running at top speed; connect to a high speed hub [ 290.102762][ T29] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.00 [ 290.163243][ T29] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 290.211270][ T29] usb 2-1: config 0 has no interfaces? [ 290.247943][ T29] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 290.308662][ T29] usb 2-1: config 0 descriptor?? [ 290.601504][ T29] usb 2-1: USB disconnect, device number 9 [ 290.833364][ T5328] em28xx 1-1:1.0: reading from i2c device at 0x80 failed (error=-5) [ 290.842358][ T5696] usb 1-1: USB disconnect, device number 15 [ 290.850847][ T5696] em28xx 1-1:1.0: Disconnecting em28xx [ 291.053992][ T5328] em28xx 1-1:1.0: Config register raw data: 0xffffffed [ 291.071941][ T5328] em28xx 1-1:1.0: AC97 chip type couldn't be determined [ 291.142158][ T7975] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 291.150537][ T7975] overlayfs: overlapping lowerdir path [ 292.048731][ T5328] em28xx 1-1:1.0: No AC97 audio processor [ 292.055570][ T5328] em28xx 1-1:1.0: em28xx_v4l2_init: em28xx_write_reg - msp34xx(1) failed! error [-19] [ 292.076699][ T5328] em28xx 1-1:1.0: Registering input extension [ 292.356282][ T7979] 9pnet_virtio: no channels available for device syz [ 292.420805][ T5328] rc_core: IR keymap rc-hauppauge not found [ 292.431810][ T30] audit: type=1800 audit(1786923957.894:482): pid=7981 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.585" name="bmControls" dev="configfs" ino=17339 res=0 errno=0 [ 292.456328][ T5328] Registered IR keymap rc-empty [ 292.462108][ T7981] openvswitch: netlink: IP tunnel dst address not specified [ 292.478852][ T5328] rc rc0: Hauppauge WinTV USB 2 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/rc/rc0 [ 292.514465][ T5328] input: Hauppauge WinTV USB 2 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/rc/rc0/input18 [ 292.561722][ T5328] em28xx 1-1:1.0: Input extension successfully initialized [ 292.592259][ T5696] em28xx 1-1:1.0: Closing input extension [ 294.667665][ T8001] input: syz1 as /devices/virtual/input/input19 [ 294.674141][ T8001] input: failed to attach handler leds to device input19, error: -6 [ 295.355699][ T8005] syzkaller1: entered promiscuous mode [ 295.389454][ T8005] syzkaller1: entered allmulticast mode [ 295.447414][ T5696] em28xx 1-1:1.0: Freeing device [ 295.697601][ T8021] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 295.705987][ T8021] overlayfs: overlapping lowerdir path [ 296.181639][ T5696] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 296.922248][ T5696] usb 1-1: New USB device found, idVendor=2040, idProduct=4200, bcdDevice= 1.00 [ 296.965799][ T5696] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 297.003971][ T5696] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 297.021087][ T8026] 9pnet_virtio: no channels available for device syz [ 297.040702][ T5696] em28xx 1-1:1.0: New device @ 480 Mbps (2040:4200, interface 0, class 0) [ 297.066203][ T5696] em28xx 1-1:1.0: Video interface 0 found: [ 297.115781][ T8026] netlink: 'syz.3.598': attribute type 4 has an invalid length. [ 297.191244][ T8027] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 297.221330][ T8027] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 297.231421][ T8027] overlayfs: failed to look up (tracing) for ino (-66) [ 297.285822][ T30] audit: type=1400 audit(1786923962.744:483): avc: denied { read append } for pid=8028 comm="syz.3.599" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 297.286522][ T8029] random: crng reseeded on system resumption [ 297.345016][ T30] audit: type=1400 audit(1786923962.744:484): avc: denied { ioctl open } for pid=8028 comm="syz.3.599" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 297.374322][ T5696] em28xx 1-1:1.0: unknown em28xx chip ID (0) [ 297.467292][ T5696] em28xx 1-1:1.0: reading from i2c device at 0xa0 failed (error=-5) [ 297.492145][ T5696] em28xx 1-1:1.0: board has no eeprom [ 297.560793][ T5696] em28xx 1-1:1.0: Identified as Hauppauge WinTV USB 2 (card=4) [ 297.568886][ T5696] em28xx 1-1:1.0: analog set to bulk mode. [ 297.576230][ T5328] em28xx 1-1:1.0: Registering V4L2 extension [ 297.630556][ T5696] usb 1-1: USB disconnect, device number 16 [ 297.659665][ T5328] em28xx 1-1:1.0: reading from i2c device at 0x80 failed (error=-19) [ 297.669471][ T5696] em28xx 1-1:1.0: Disconnecting em28xx [ 297.794009][ T5328] em28xx 1-1:1.0: Config register raw data: 0xffffffed [ 297.815283][ T5328] em28xx 1-1:1.0: AC97 chip type couldn't be determined [ 297.831265][ T5328] em28xx 1-1:1.0: No AC97 audio processor [ 297.846692][ T5328] em28xx 1-1:1.0: em28xx_v4l2_init: em28xx_write_reg - msp34xx(1) failed! error [-19] [ 297.856379][ T5328] em28xx 1-1:1.0: Registering input extension [ 297.939894][ T5328] rc_core: IR keymap rc-hauppauge not found [ 297.953003][ T5328] Registered IR keymap rc-empty [ 297.965900][ T5328] rc rc0: Hauppauge WinTV USB 2 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/rc/rc0 [ 297.997516][ T5328] input: Hauppauge WinTV USB 2 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/rc/rc0/input20 [ 298.036167][ T5328] em28xx 1-1:1.0: Input extension successfully initialized [ 298.054979][ T5696] em28xx 1-1:1.0: Closing input extension [ 298.066312][ T8045] 9pnet_virtio: no channels available for device syz [ 298.111510][ T5696] em28xx 1-1:1.0: Freeing device [ 298.267863][ T8047] netlink: 'syz.0.603': attribute type 23 has an invalid length. [ 298.304450][ T8050] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 299.682977][ T8063] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 300.122785][ T8072] netlink: 8 bytes leftover after parsing attributes in process `syz.4.609'. [ 301.142888][ T30] audit: type=1400 audit(1786923966.604:485): avc: denied { write } for pid=8075 comm="syz.1.610" name="h" dev="configfs" ino=7949 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 301.164961][ T30] audit: type=1400 audit(1786923966.604:486): avc: denied { write } for pid=8075 comm="syz.1.610" name="h" dev="configfs" ino=7949 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 301.297908][ T30] audit: type=1800 audit(1786923966.754:487): pid=8084 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.613" name="bmControls" dev="configfs" ino=17910 res=0 errno=0 [ 301.332984][ T8084] openvswitch: netlink: IP tunnel dst address not specified [ 301.742207][ T8092] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 301.881249][ T8092] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 301.891366][ T8092] overlayfs: failed to look up (tracing) for ino (-66) [ 303.746769][ T8098] netlink: 12 bytes leftover after parsing attributes in process `syz.4.618'. [ 303.948824][ T8105] 9pnet_virtio: no channels available for device syz [ 304.445498][ T8108] netlink: 'syz.2.619': attribute type 23 has an invalid length. [ 306.717524][ T30] audit: type=1400 audit(1786923972.134:488): avc: denied { read } for pid=8123 comm="syz.1.625" name="rtc0" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 306.753723][ T8128] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 306.885709][ T30] audit: type=1400 audit(1786923972.134:489): avc: denied { open } for pid=8123 comm="syz.1.625" path="/dev/rtc0" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 306.982351][ T8135] 9pnet_virtio: no channels available for device syz [ 307.064296][ T8136] input: syz1 as /devices/virtual/input/input21 [ 307.070732][ T8136] input: failed to attach handler leds to device input21, error: -6 [ 307.430833][ T8131] md: could not open device unknown-block(1,0). [ 307.478380][ T8140] tipc: Started in network mode [ 307.483502][ T8140] tipc: Node identity 72b7718c616, cluster identity 4711 [ 307.491221][ T8140] tipc: Enabled bearer , priority 10 [ 307.502411][ T8139] tipc: Resetting bearer [ 307.529806][ T8139] tipc: Disabling bearer [ 307.717477][ T30] audit: type=1400 audit(1786923973.174:490): avc: denied { bind } for pid=8147 comm="syz.2.632" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 307.774119][ T30] audit: type=1400 audit(1786923973.204:491): avc: denied { write } for pid=8147 comm="syz.2.632" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 307.868721][ T8154] 9pnet_virtio: no channels available for device syz [ 307.926434][ T8156] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 308.057183][ T8160] netlink: 'syz.2.634': attribute type 23 has an invalid length. [ 308.098224][ T8158] md: could not open device unknown-block(1,0). [ 308.850481][ T30] audit: type=1400 audit(1786923973.694:492): avc: denied { accept } for pid=8151 comm="syz.1.633" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 311.036008][ T8177] binder: 8172:8177 ioctl 80089419 0 returned -22 [ 311.119524][ T8179] netlink: 48 bytes leftover after parsing attributes in process `syz.3.639'. [ 311.652596][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 311.823204][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 312.565276][ T8190] netlink: 12 bytes leftover after parsing attributes in process `syz.3.644'. [ 313.069564][ T8190] bond2: entered promiscuous mode [ 313.076904][ T8190] 8021q: adding VLAN 0 to HW filter on device bond2 [ 313.259379][ T8193] bridge2: entered promiscuous mode [ 313.281483][ T8193] bond2: (slave bridge2): Enslaving as an active interface with an up link [ 314.264694][ T8188] tipc: Started in network mode [ 314.321223][ T8188] tipc: Node identity c2c1341b5d17, cluster identity 4711 [ 314.367556][ T8188] tipc: Enabled bearer , priority 10 [ 314.637329][ T8211] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 314.664110][ T8185] tipc: Resetting bearer [ 314.686794][ T8185] tipc: Disabling bearer [ 314.807281][ T8217] 9pnet_virtio: no channels available for device syz [ 314.839921][ T29] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 315.028576][ T29] usb 3-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 315.092897][ T8223] netlink: 'syz.4.650': attribute type 23 has an invalid length. [ 315.118151][ T29] usb 3-1: config 0 has no interfaces? [ 315.168176][ T29] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 315.365808][ T29] usb 3-1: config 0 descriptor?? [ 315.805653][ T5330] usb 3-1: USB disconnect, device number 16 [ 316.286445][ T8242] input: syz1 as /devices/virtual/input/input22 [ 316.292890][ T8242] input: failed to attach handler leds to device input22, error: -6 [ 316.770945][ T5696] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 317.189890][ T5696] usb 2-1: Using ep0 maxpacket: 8 [ 317.195533][ T5696] usb 2-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 317.208113][ T5696] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 317.221838][ T5696] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 317.245411][ T5696] usb 2-1: Product: syz [ 317.256979][ T5696] usb 2-1: Manufacturer: syz [ 317.273801][ T5696] usb 2-1: SerialNumber: syz [ 317.293621][ T5696] usb 2-1: config 0 descriptor?? [ 317.308840][ T5696] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 317.689023][ T8254] 9pnet_virtio: no channels available for device syz [ 318.432034][ T8260] netlink: 'syz.2.661': attribute type 23 has an invalid length. [ 319.092059][ T5696] gspca_zc3xx: reg_w_i err -71 [ 319.785210][ T8269] input: syz1 as /devices/virtual/input/input23 [ 319.791662][ T8269] input: failed to attach handler leds to device input23, error: -6 [ 320.129882][ T5696] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 320.355774][ T5696] gspca_zc3xx 2-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 320.656731][ T8273] 9pnet_virtio: no channels available for device syz [ 321.584356][ T8281] input: syz1 as /devices/virtual/input/input24 [ 321.591571][ T8281] input: failed to attach handler leds to device input24, error: -6 [ 321.799083][ T5696] usb 2-1: USB disconnect, device number 10 [ 322.126182][ T8290] netlink: 'syz.2.665': attribute type 23 has an invalid length. [ 322.137509][ T8289] netlink: 12 bytes leftover after parsing attributes in process `syz.0.668'. [ 322.682448][ T8289] bond1: entered promiscuous mode [ 322.689403][ T8289] 8021q: adding VLAN 0 to HW filter on device bond1 [ 323.934506][ T8291] bridge1: entered promiscuous mode [ 324.072177][ T8291] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 324.245468][ T9] usb 2-1: new full-speed USB device number 11 using dummy_hcd [ 324.837498][ T9] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.00 [ 325.030607][ T9] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 325.059550][ T9] usb 2-1: can't read configurations, error -71 [ 325.884693][ T8313] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 325.934591][ T8314] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 326.583229][ T30] audit: type=1400 audit(1786923992.024:493): avc: denied { write } for pid=8321 comm="syz.1.675" name="h" dev="configfs" ino=7949 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 326.759557][ T30] audit: type=1400 audit(1786923992.024:494): avc: denied { write } for pid=8321 comm="syz.1.675" name="h" dev="configfs" ino=7949 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 327.508164][ T8337] netlink: 8 bytes leftover after parsing attributes in process `syz.1.680'. [ 328.062231][ T8341] netlink: 20 bytes leftover after parsing attributes in process `syz.2.682'. [ 328.199391][ T8348] netlink: 'syz.0.683': attribute type 11 has an invalid length. [ 329.251985][ T5330] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 329.376337][ T8366] netlink: 48 bytes leftover after parsing attributes in process `syz.2.688'. [ 329.404252][ T30] audit: type=1400 audit(1786923994.864:495): avc: denied { write } for pid=8363 comm="syz.4.690" name="h" dev="configfs" ino=7949 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 329.447726][ T5330] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 329.467510][ T5330] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 329.478685][ T30] audit: type=1400 audit(1786923994.894:496): avc: denied { write } for pid=8363 comm="syz.4.690" name="h" dev="configfs" ino=7949 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 329.502286][ T5330] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 329.514208][ T5330] usb 4-1: config 0 descriptor?? [ 329.613396][ T8372] 9pnet_virtio: no channels available for device syz [ 329.830068][ T5330] usbhid 4-1:0.0: can't add hid device: -71 [ 329.836665][ T5330] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 329.964071][ T8378] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 330.308285][ T5330] usb 4-1: USB disconnect, device number 7 [ 330.641731][ T8385] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 330.650312][ T8385] CPU: 0 UID: 0 PID: 8385 Comm: syz.1.696 Tainted: G L syzkaller #0 PREEMPT(full) [ 330.650344][ T8385] Tainted: [L]=SOFTLOCKUP [ 330.650351][ T8385] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 330.650363][ T8385] Call Trace: [ 330.650369][ T8385] [ 330.650377][ T8385] dump_stack_lvl+0x100/0x190 [ 330.650408][ T8385] sysfs_warn_dup.cold+0x1c/0x28 [ 330.650436][ T8385] sysfs_create_dir_ns+0x24b/0x2b0 [ 330.650459][ T8385] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 330.650479][ T8385] ? find_held_lock+0x2b/0x80 [ 330.650497][ T8385] ? kobject_add_internal+0x25f/0x930 [ 330.650524][ T8385] ? kobject_add_internal+0x25f/0x930 [ 330.650554][ T8385] ? class_dir_child_ns_type+0xd/0x60 [ 330.650585][ T8385] kobject_add_internal+0x2c8/0x930 [ 330.650617][ T8385] kobject_add+0x16a/0x1e0 [ 330.650645][ T8385] ? __pfx_kobject_add+0x10/0x10 [ 330.650675][ T8385] ? preempt_schedule_thunk+0x16/0x40 [ 330.650696][ T8385] ? kobject_put+0xb9/0x640 [ 330.650731][ T8385] device_add+0x294/0x1970 [ 330.650760][ T8385] ? lockdep_init_map_type+0x5c/0x250 [ 330.650785][ T8385] ? __pfx_device_add+0x10/0x10 [ 330.650810][ T8385] ? lockdep_init_map_type+0x5c/0x250 [ 330.650836][ T8385] ? __init_waitqueue_head+0xca/0x150 [ 330.650868][ T8385] tty_register_device_attr+0x388/0x7f0 [ 330.650893][ T8385] ? lockdep_init_map_type+0x5c/0x250 [ 330.650923][ T8385] ? __pfx_tty_register_device_attr+0x10/0x10 [ 330.650953][ T8385] ? tty_port_init+0x156/0x1c0 [ 330.650979][ T8385] gsm_activate_mux+0x155/0x2a0 [ 330.651005][ T8385] gsmld_ioctl+0xbbc/0x15c0 [ 330.651039][ T8385] ? __pfx_gsmld_ioctl+0x10/0x10 [ 330.651070][ T8385] ? __ldsem_down_read_nested+0xf3/0x890 [ 330.651103][ T8385] ? __pfx___ldsem_down_read_nested+0x10/0x10 [ 330.651139][ T8385] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 330.651165][ T8385] ? __pfx_pty_unix98_ioctl+0x10/0x10 [ 330.651187][ T8385] ? __pfx_gsmld_ioctl+0x10/0x10 [ 330.651214][ T8385] tty_ioctl+0x11b4/0x1640 [ 330.651238][ T8385] ? __pfx_tty_ioctl+0x10/0x10 [ 330.651262][ T8385] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 330.651301][ T8385] ? __fget_files+0x215/0x3d0 [ 330.651320][ T8385] ? hook_file_ioctl_common+0x140/0x440 [ 330.651348][ T8385] ? selinux_file_ioctl+0x13b/0x290 [ 330.651376][ T8385] ? selinux_file_ioctl+0xb6/0x290 [ 330.651406][ T8385] ? __pfx_tty_ioctl+0x10/0x10 [ 330.651430][ T8385] __x64_sys_ioctl+0x18e/0x210 [ 330.651461][ T8385] do_syscall_64+0x115/0x870 [ 330.651482][ T8385] ? clear_bhb_loop+0x70/0xc0 [ 330.651506][ T8385] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 330.651526][ T8385] RIP: 0033:0x7f6547b9e0d9 [ 330.651541][ T8385] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 330.651559][ T8385] RSP: 002b:00007f6545dd5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 330.651578][ T8385] RAX: ffffffffffffffda RBX: 00007f6547e26180 RCX: 00007f6547b9e0d9 [ 330.651590][ T8385] RDX: 0000200000000040 RSI: 00000000404c4701 RDI: 0000000000000006 [ 330.651602][ T8385] RBP: 00007f6547c35024 R08: 0000000000000000 R09: 0000000000000000 [ 330.651612][ T8385] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 330.651624][ T8385] R13: 00007f6547e26218 R14: 00007f6547e26180 R15: 00007ffca01576d8 [ 330.651649][ T8385] [ 330.651753][ T8385] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 331.180632][ T5330] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 331.427834][ T8389] random: crng reseeded on system resumption [ 332.729994][ T10] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 332.979223][ T10] usb 3-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 333.088206][ T10] usb 3-1: config 0 has no interfaces? [ 333.169114][ T8404] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 333.507494][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 333.533552][ T10] usb 3-1: config 0 descriptor?? [ 333.558213][ T30] audit: type=1800 audit(1786923999.014:497): pid=8403 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.3.702" name="bmControls" dev="configfs" ino=19152 res=0 errno=0 [ 333.587543][ T8403] openvswitch: netlink: IP tunnel dst address not specified [ 333.690479][ T8403] netlink: 96 bytes leftover after parsing attributes in process `syz.3.702'. [ 334.301807][ T30] audit: type=1400 audit(1786923999.754:498): avc: denied { read write } for pid=8412 comm="syz.0.704" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 334.357356][ T8413] jffs2: notice: (8413) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 334.377797][ T30] audit: type=1400 audit(1786923999.754:499): avc: denied { open } for pid=8412 comm="syz.0.704" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 334.474486][ T30] audit: type=1400 audit(1786923999.874:500): avc: denied { write } for pid=8412 comm="syz.0.704" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 334.542318][ T29] usb 3-1: USB disconnect, device number 17 [ 334.589907][ T30] audit: type=1400 audit(1786923999.874:501): avc: denied { add_name } for pid=8412 comm="syz.0.704" name="test2" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 334.715634][ T30] audit: type=1400 audit(1786923999.874:502): avc: denied { create } for pid=8412 comm="syz.0.704" name="test2" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 334.736094][ T30] audit: type=1400 audit(1786923999.874:503): avc: denied { read write open } for pid=8412 comm="syz.0.704" path="/138/mnt/test2" dev="jffs2" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 334.889775][ T8424] input: syz1 as /devices/virtual/input/input25 [ 334.896210][ T8424] input: failed to attach handler leds to device input25, error: -6 [ 335.271963][ T30] audit: type=1400 audit(1786924000.724:504): avc: denied { read } for pid=4947 comm="acpid" name="event4" dev="devtmpfs" ino=3826 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 335.341833][ T30] audit: type=1400 audit(1786924000.724:505): avc: denied { open } for pid=4947 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=3826 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 335.401721][ T30] audit: type=1400 audit(1786924000.734:506): avc: denied { ioctl } for pid=4947 comm="acpid" path="/dev/input/event4" dev="devtmpfs" ino=3826 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 335.850019][ T9] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 336.044177][ T9] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 336.080500][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 336.110851][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 336.155874][ T9] usb 4-1: config 0 descriptor?? [ 336.244503][ T8443] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 336.278543][ T8443] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 336.288585][ T8443] overlayfs: failed to look up (tracing) for ino (-66) [ 336.326366][ T8437] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 336.403206][ T9] usbhid 4-1:0.0: can't add hid device: -71 [ 336.420805][ T9] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 336.451651][ T9] usb 4-1: USB disconnect, device number 9 [ 336.838747][ T8454] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 336.965639][ T8454] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 336.975668][ T8454] overlayfs: failed to look up (tracing) for ino (-66) [ 337.849935][ T9] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 338.011722][ T9] usb 4-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 338.023675][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 338.450623][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 338.713938][ T9] usb 4-1: config 0 descriptor?? [ 338.956218][ T9] usb 4-1: can't set config #0, error -71 [ 340.091116][ T8468] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 340.106670][ T8468] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 340.207683][ T9] usb 4-1: USB disconnect, device number 10 [ 340.263747][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 340.263764][ T30] audit: type=1800 audit(1786924005.724:510): pid=8474 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.722" name="bmControls" dev="configfs" ino=19252 res=0 errno=0 [ 340.296600][ T8474] openvswitch: netlink: IP tunnel dst address not specified [ 340.310273][ T8474] netlink: 96 bytes leftover after parsing attributes in process `syz.1.722'. [ 340.519387][ T30] audit: type=1400 audit(1786924005.974:511): avc: denied { bind } for pid=8481 comm="syz.2.725" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 340.809667][ T30] audit: type=1400 audit(1786924005.974:512): avc: denied { write } for pid=8481 comm="syz.2.725" path="socket:[19710]" dev="sockfs" ino=19710 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 340.848152][ T5607] Bluetooth: hci2: unexpected event 0x03 length: 1 < 11 [ 341.029261][ T8486] 8021q: adding VLAN 0 to HW filter on device bond2 [ 341.175487][ T8490] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 341.459918][ T10] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 342.300082][ C0] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:2a [ 343.049584][ T8518] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 343.397486][ T10] usb 3-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 343.407237][ T10] usb 3-1: config 0 has no interfaces? [ 343.412887][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 343.426740][ T10] usb 3-1: config 0 descriptor?? [ 345.388419][ T29] usb 3-1: USB disconnect, device number 18 [ 345.448227][ T8538] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 345.470456][ T8538] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 345.480700][ T8538] overlayfs: failed to look up (tracing) for ino (-66) [ 346.758177][ T8555] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 347.203677][ T8557] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 347.212391][ T8557] CPU: 1 UID: 0 PID: 8557 Comm: syz.3.741 Tainted: G L syzkaller #0 PREEMPT(full) [ 347.212422][ T8557] Tainted: [L]=SOFTLOCKUP [ 347.212429][ T8557] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 347.212442][ T8557] Call Trace: [ 347.212449][ T8557] [ 347.212457][ T8557] dump_stack_lvl+0x100/0x190 [ 347.212486][ T8557] sysfs_warn_dup.cold+0x1c/0x28 [ 347.212515][ T8557] sysfs_create_dir_ns+0x24b/0x2b0 [ 347.212537][ T8557] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 347.212558][ T8557] ? find_held_lock+0x2b/0x80 [ 347.212577][ T8557] ? kobject_add_internal+0x25f/0x930 [ 347.212605][ T8557] ? kobject_add_internal+0x25f/0x930 [ 347.212635][ T8557] ? class_dir_child_ns_type+0xd/0x60 [ 347.212666][ T8557] kobject_add_internal+0x2c8/0x930 [ 347.212697][ T8557] kobject_add+0x16a/0x1e0 [ 347.212724][ T8557] ? __pfx_kobject_add+0x10/0x10 [ 347.212755][ T8557] ? get_device_parent+0x1b3/0x4c0 [ 347.212782][ T8557] ? kobject_put+0xb9/0x640 [ 347.212815][ T8557] device_add+0x294/0x1970 [ 347.212845][ T8557] ? lockdep_init_map_type+0x5c/0x250 [ 347.212870][ T8557] ? __pfx_device_add+0x10/0x10 [ 347.212896][ T8557] ? lockdep_init_map_type+0x5c/0x250 [ 347.212921][ T8557] ? __init_waitqueue_head+0xca/0x150 [ 347.212955][ T8557] tty_register_device_attr+0x388/0x7f0 [ 347.212980][ T8557] ? lockdep_init_map_type+0x5c/0x250 [ 347.213003][ T8557] ? __pfx_tty_register_device_attr+0x10/0x10 [ 347.213033][ T8557] ? tty_port_init+0x156/0x1c0 [ 347.213061][ T8557] gsm_activate_mux+0x155/0x2a0 [ 347.213086][ T8557] gsmld_ioctl+0xbbc/0x15c0 [ 347.213121][ T8557] ? __pfx_gsmld_ioctl+0x10/0x10 [ 347.213152][ T8557] ? __ldsem_down_read_nested+0xf3/0x890 [ 347.213178][ T8557] ? finish_task_switch.isra.0+0x3b6/0x10c0 [ 347.213211][ T8557] ? __pfx___ldsem_down_read_nested+0x10/0x10 [ 347.213246][ T8557] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 347.213271][ T8557] ? __pfx_pty_unix98_ioctl+0x10/0x10 [ 347.213292][ T8557] ? __pfx_gsmld_ioctl+0x10/0x10 [ 347.213318][ T8557] tty_ioctl+0x11b4/0x1640 [ 347.213341][ T8557] ? __pfx___schedule+0x10/0x10 [ 347.213364][ T8557] ? __pfx_tty_ioctl+0x10/0x10 [ 347.213393][ T8557] ? preempt_schedule_irq+0x7b/0x90 [ 347.213416][ T8557] ? irqentry_exit+0x24d/0xa00 [ 347.213437][ T8557] ? lockdep_hardirqs_on+0x78/0x100 [ 347.213458][ T8557] ? irqentry_exit+0x24d/0xa00 [ 347.213489][ T8557] ? __pfx_tty_ioctl+0x10/0x10 [ 347.213517][ T8557] ? __pfx_tty_ioctl+0x10/0x10 [ 347.213544][ T8557] __x64_sys_ioctl+0x18e/0x210 [ 347.213581][ T8557] do_syscall_64+0x115/0x870 [ 347.213603][ T8557] ? clear_bhb_loop+0x70/0xc0 [ 347.213627][ T8557] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 347.213646][ T8557] RIP: 0033:0x7f7cb039e0d9 [ 347.213663][ T8557] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 347.213681][ T8557] RSP: 002b:00007f7cb1258028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 347.213700][ T8557] RAX: ffffffffffffffda RBX: 00007f7cb0626180 RCX: 00007f7cb039e0d9 [ 347.213712][ T8557] RDX: 0000200000000040 RSI: 00000000404c4701 RDI: 0000000000000006 [ 347.213724][ T8557] RBP: 00007f7cb0435024 R08: 0000000000000000 R09: 0000000000000000 [ 347.213735][ T8557] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 347.213746][ T8557] R13: 00007f7cb0626218 R14: 00007f7cb0626180 R15: 00007fffc4bc2438 [ 347.213771][ T8557] [ 347.213845][ T8557] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 347.906075][ T8559] random: crng reseeded on system resumption [ 348.116513][ T8561] jffs2: notice: (8561) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 348.155831][ T30] audit: type=1400 audit(1786924013.604:513): avc: denied { write } for pid=8560 comm="syz.4.747" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 348.656904][ C1] IPv4: Oversized IP packet from 127.0.0.1 [ 350.762212][ T8584] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 350.781922][ T8584] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 350.791875][ T8584] overlayfs: failed to look up (tracing) for ino (-66) [ 352.514401][ T8598] 9pnet_virtio: no channels available for device syz [ 353.259083][ T8604] netlink: 'syz.3.758': attribute type 23 has an invalid length. [ 353.564554][ T8607] jffs2: notice: (8607) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 353.633938][ T30] audit: type=1400 audit(1786924019.054:514): avc: denied { write } for pid=8606 comm="syz.4.760" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 355.470326][ C1] IPv4: Oversized IP packet from 127.0.0.1 [ 357.100068][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 357.794265][ T30] audit: type=1400 audit(1786924023.254:515): avc: denied { write } for pid=8648 comm="syz.3.773" name="netstat" dev="proc" ino=4026533263 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 361.964817][ C1] IPv4: Oversized IP packet from 127.0.0.1 [ 362.290026][ T8697] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 362.424621][ T8697] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 362.434945][ T8697] overlayfs: failed to look up (tracing) for ino (-66) [ 362.609915][ T9] usb 3-1: new full-speed USB device number 19 using dummy_hcd [ 364.009493][ T10] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 364.170621][ T10] usb 4-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 364.180674][ T10] usb 4-1: config 0 has no interfaces? [ 364.186772][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 364.204275][ T10] usb 4-1: config 0 descriptor?? [ 364.215004][ T9] usb 3-1: device not accepting address 19, error -71 [ 366.090038][ T29] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 366.254440][ T5330] usb 4-1: USB disconnect, device number 11 [ 366.292078][ T29] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 366.409309][ T29] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 366.489242][ T29] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 366.733386][ T29] usb 2-1: config 0 descriptor?? [ 366.851347][ T8733] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 366.977821][ T29] usbhid 2-1:0.0: can't add hid device: -71 [ 366.984783][ T29] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 367.198396][ T29] usb 2-1: USB disconnect, device number 13 [ 367.223757][ T8736] random: crng reseeded on system resumption [ 367.666197][ T29] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 367.758670][ T8743] input: syz1 as /devices/virtual/input/input28 [ 367.765136][ T8743] input: failed to attach handler leds to device input28, error: -6 [ 368.081827][ T10] usb 4-1: new full-speed USB device number 12 using dummy_hcd [ 368.108577][ T29] usb 2-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 368.140770][ T29] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 368.152832][ T29] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 368.171011][ T29] usb 2-1: config 0 descriptor?? [ 368.312980][ T10] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.00 [ 368.384831][ T10] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 368.403376][ T10] usb 4-1: can't read configurations, error -71 [ 368.506176][ T8751] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 369.528653][ T29] aiptek 2-1:0.0: Aiptek using 400 ms programming speed [ 369.537950][ T29] input: Aiptek as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input29 [ 369.755202][ T29] usb 2-1: USB disconnect, device number 14 [ 369.755272][ C1] aiptek 2-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 369.942549][ T8762] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 371.170624][ T8767] md: could not open device unknown-block(1,0). [ 371.220101][ T8773] loop9: detected capacity change from 0 to 2640 [ 371.228325][ T8773] Buffer I/O error on dev loop9, logical block 0, async page read [ 371.236610][ T8773] Buffer I/O error on dev loop9, logical block 0, async page read [ 371.244468][ T8773] Buffer I/O error on dev loop9, logical block 0, async page read [ 371.252290][ T8773] Buffer I/O error on dev loop9, logical block 0, async page read [ 371.260097][ T8773] Buffer I/O error on dev loop9, logical block 0, async page read [ 371.267943][ T8773] Buffer I/O error on dev loop9, logical block 0, async page read [ 371.275793][ T8773] Buffer I/O error on dev loop9, logical block 0, async page read [ 371.284538][ T8773] Buffer I/O error on dev loop9, logical block 0, async page read [ 371.292361][ T8773] ldm_validate_partition_table(): Disk read failed. [ 371.298934][ T8773] Buffer I/O error on dev loop9, logical block 0, async page read [ 371.306761][ T8773] Buffer I/O error on dev loop9, logical block 0, async page read [ 371.314578][ T8773] Dev loop9: unable to read RDB block 0 [ 371.320232][ T8773] loop9: unable to read partition table [ 371.325937][ T8773] loop_reread_partitions: partition scan of loop9 (3Ÿ ¾‚³˜) failed (rc=-5) [ 371.842296][ T8781] input: syz1 as /devices/virtual/input/input30 [ 371.849025][ T8781] input: failed to attach handler leds to device input30, error: -6 [ 373.053851][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 373.081607][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 373.258087][ T8792] netlink: 4 bytes leftover after parsing attributes in process `syz.3.812'. [ 374.576410][ T8809] netlink: 4 bytes leftover after parsing attributes in process `syz.2.815'. [ 374.666468][ T8810] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 375.234034][ T8818] netlink: 'syz.1.816': attribute type 11 has an invalid length. [ 376.765092][ T8828] 9pnet_virtio: no channels available for device syz [ 376.801651][ T8829] openvswitch: netlink: IP tunnel dst address not specified [ 376.925452][ T8816] md: could not open device unknown-block(1,0). [ 376.995364][ T5328] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:2a [ 378.183703][ T8845] jffs2: notice: (8845) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 378.233010][ T10] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:2a [ 379.132542][ T8859] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 379.755909][ T8869] md: could not open device unknown-block(1,0). [ 382.316383][ T8879] md: could not open device unknown-block(1,0). [ 382.831069][ T8896] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 382.850539][ T8896] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 382.860587][ T8896] overlayfs: failed to look up (tracing) for ino (-66) [ 383.014989][ T30] audit: type=1400 audit(1786924048.354:516): avc: denied { mount } for pid=8897 comm="syz.1.836" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 383.666946][ T29] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 384.536867][ T29] usb 1-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 384.555332][ T29] usb 1-1: config 0 has no interfaces? [ 384.579932][ T29] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 385.016772][ T29] usb 1-1: config 0 descriptor?? [ 385.060165][ T8916] input: syz1 as /devices/virtual/input/input31 [ 385.066456][ T8916] input: failed to attach handler leds to device input31, error: -6 [ 385.463152][ T30] audit: type=1400 audit(1786924050.924:517): avc: denied { unmount } for pid=5608 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 385.545817][ T10] usb 1-1: USB disconnect, device number 17 [ 386.859272][ T8939] loop9: detected capacity change from 0 to 2640 [ 386.866048][ T8939] buffer_io_error: 11 callbacks suppressed [ 386.866058][ T8939] Buffer I/O error on dev loop9, logical block 0, async page read [ 386.879706][ T8939] Buffer I/O error on dev loop9, logical block 0, async page read [ 386.887531][ T8939] Buffer I/O error on dev loop9, logical block 0, async page read [ 386.895404][ T8939] Buffer I/O error on dev loop9, logical block 0, async page read [ 386.903604][ T8939] Buffer I/O error on dev loop9, logical block 0, async page read [ 386.911467][ T8939] Buffer I/O error on dev loop9, logical block 0, async page read [ 386.919279][ T8939] Buffer I/O error on dev loop9, logical block 0, async page read [ 386.927129][ T8939] Buffer I/O error on dev loop9, logical block 0, async page read [ 386.934951][ T8939] ldm_validate_partition_table(): Disk read failed. [ 386.941584][ T8939] Buffer I/O error on dev loop9, logical block 0, async page read [ 386.949384][ T8939] Buffer I/O error on dev loop9, logical block 0, async page read [ 386.957222][ T8939] Dev loop9: unable to read RDB block 0 [ 386.962932][ T8939] loop9: unable to read partition table [ 386.968644][ T8939] loop_reread_partitions: partition scan of loop9 (3Ÿ ¾‚³˜) failed (rc=-5) [ 388.500408][ T8958] md: could not open device unknown-block(1,0). [ 392.388345][ T8990] netlink: 'syz.3.860': attribute type 11 has an invalid length. [ 392.466529][ T8996] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 392.466529][ T8996] The task syz.4.862 (8996) triggered the difference, watch for misbehavior. [ 393.361271][ T9003] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 393.497579][ T9003] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 393.507987][ T9003] overlayfs: failed to look up (tracing) for ino (-66) [ 395.560779][ T30] audit: type=1400 audit(1786924060.964:518): avc: denied { create } for pid=9012 comm="syz.0.867" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 395.944493][ T30] audit: type=1800 audit(1786924061.364:519): pid=9019 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.2.869" name="bmControls" dev="configfs" ino=21223 res=0 errno=0 [ 396.096246][ T9019] openvswitch: netlink: IP tunnel dst address not specified [ 396.643921][ T30] audit: type=1400 audit(1786924062.044:520): avc: denied { listen } for pid=9012 comm="syz.0.867" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 396.685618][ T30] audit: type=1400 audit(1786924062.054:521): avc: denied { accept } for pid=9012 comm="syz.0.867" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 396.793065][ T9023] netlink: 96 bytes leftover after parsing attributes in process `syz.2.869'. [ 399.038073][ T9029] loop9: detected capacity change from 0 to 2640 [ 399.047166][ T9029] buffer_io_error: 11 callbacks suppressed [ 399.047176][ T9029] Buffer I/O error on dev loop9, logical block 0, async page read [ 399.060878][ T9029] Buffer I/O error on dev loop9, logical block 0, async page read [ 399.068692][ T9029] Buffer I/O error on dev loop9, logical block 0, async page read [ 399.076609][ T9029] Buffer I/O error on dev loop9, logical block 0, async page read [ 399.085243][ T9029] Buffer I/O error on dev loop9, logical block 0, async page read [ 399.093537][ T9029] Buffer I/O error on dev loop9, logical block 0, async page read [ 399.101481][ T9029] Buffer I/O error on dev loop9, logical block 0, async page read [ 399.109346][ T9029] Buffer I/O error on dev loop9, logical block 0, async page read [ 399.117223][ T9029] ldm_validate_partition_table(): Disk read failed. [ 399.123871][ T9029] Buffer I/O error on dev loop9, logical block 0, async page read [ 399.131896][ T9029] Buffer I/O error on dev loop9, logical block 0, async page read [ 399.139765][ T9029] Dev loop9: unable to read RDB block 0 [ 399.145557][ T9029] loop9: unable to read partition table [ 399.151401][ T9029] loop_reread_partitions: partition scan of loop9 (3Ÿ ¾‚³˜) failed (rc=-5) [ 400.469890][ T5328] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 401.441428][ T10] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 401.523677][ T5328] usb 5-1: Using ep0 maxpacket: 8 [ 401.548847][ T5328] usb 5-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 402.530005][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 402.535928][ T5328] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 402.550010][ T10] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 402.839038][ T5328] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 402.857902][ T5328] usb 5-1: Product: syz [ 403.321905][ T10] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 403.332509][ T5328] usb 5-1: Manufacturer: syz [ 403.337494][ T5328] usb 5-1: SerialNumber: syz [ 403.342319][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 403.358542][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 403.368700][ T5328] usb 5-1: config 0 descriptor?? [ 403.375215][ T10] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 403.391302][ T10] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 403.643941][ T10] usb 1-1: string descriptor 0 read error: -71 [ 403.755721][ T10] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 403.807981][ T5328] usb 5-1: can't set config #0, error -71 [ 403.832555][ T5328] usb 5-1: USB disconnect, device number 15 [ 403.843825][ T10] usb 1-1: config 0 descriptor?? [ 403.843897][ T9081] netlink: 1752 bytes leftover after parsing attributes in process `syz.4.887'. [ 403.882658][ T10] usb 1-1: can't set config #0, error -71 [ 403.913748][ T10] usb 1-1: USB disconnect, device number 18 [ 403.917271][ T30] audit: type=1800 audit(1786924069.374:522): pid=9085 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.4.888" name="bmControls" dev="configfs" ino=21503 res=0 errno=0 [ 404.538124][ T9085] openvswitch: netlink: IP tunnel dst address not specified [ 404.603160][ T9085] netlink: 96 bytes leftover after parsing attributes in process `syz.4.888'. [ 405.779722][ T9095] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 405.825027][ T9106] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 405.869210][ T9106] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 405.976270][ T9103] md: could not open device unknown-block(1,0). [ 406.109562][ T9106] iommufd_mock iommufd_mock2: Adding to iommu group 2 [ 407.960635][ T9125] loop9: detected capacity change from 0 to 2640 [ 407.967258][ T9125] buffer_io_error: 6 callbacks suppressed [ 407.967267][ T9125] Buffer I/O error on dev loop9, logical block 0, async page read [ 407.980961][ T9125] Buffer I/O error on dev loop9, logical block 0, async page read [ 407.988777][ T9125] Buffer I/O error on dev loop9, logical block 0, async page read [ 407.997425][ T9125] Buffer I/O error on dev loop9, logical block 0, async page read [ 408.005269][ T9125] Buffer I/O error on dev loop9, logical block 0, async page read [ 408.013131][ T9125] Buffer I/O error on dev loop9, logical block 0, async page read [ 408.020972][ T9125] Buffer I/O error on dev loop9, logical block 0, async page read [ 408.028798][ T9125] Buffer I/O error on dev loop9, logical block 0, async page read [ 408.036633][ T9125] ldm_validate_partition_table(): Disk read failed. [ 408.043251][ T9125] Buffer I/O error on dev loop9, logical block 0, async page read [ 408.051126][ T9125] Buffer I/O error on dev loop9, logical block 0, async page read [ 408.058968][ T9125] Dev loop9: unable to read RDB block 0 [ 408.064702][ T9125] loop9: unable to read partition table [ 408.070464][ T9125] loop_reread_partitions: partition scan of loop9 (3Ÿ ¾‚³˜) failed (rc=-5) [ 408.249910][ T10] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 408.261638][ T4962] ldm_validate_partition_table(): Disk read failed. [ 408.268330][ T4962] Dev loop9: unable to read RDB block 0 [ 408.740256][ T4962] loop9: unable to read partition table [ 408.753169][ T9127] netlink: 'syz.1.897': attribute type 11 has an invalid length. [ 408.927227][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 408.998648][ T10] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 409.149998][ T10] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 409.330399][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 409.443279][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 409.553257][ T10] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 409.651476][ T10] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 409.705166][ T9] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:2a [ 409.766380][ T10] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 409.780651][ T9145] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 409.811124][ T10] usb 1-1: Manufacturer: syz [ 410.921253][ T10] usb 1-1: config 0 descriptor?? [ 410.926479][ T192] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:2a [ 411.000182][ T9147] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 411.011641][ T10] usb 1-1: can't set config #0, error -71 [ 411.098453][ T10] usb 1-1: USB disconnect, device number 19 [ 411.117493][ T9150] iommufd_mock iommufd_mock2: Adding to iommu group 2 [ 414.938912][ T9174] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 415.065840][ T9174] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 415.075946][ T9174] overlayfs: failed to look up (tracing) for ino (-66) [ 415.789417][ T9173] openvswitch: netlink: IP tunnel dst address not specified [ 415.992037][ T30] audit: type=1800 audit(1786924080.324:523): pid=9173 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.4.911" name="bmControls" dev="configfs" ino=22710 res=0 errno=0 [ 416.055448][ T9173] netlink: 96 bytes leftover after parsing attributes in process `syz.4.911'. [ 418.379893][ C1] ================================================================== [ 418.388007][ C1] BUG: KASAN: slab-use-after-free in llc_conn_ac_send_sabme_cmd_p_set_x+0x442/0x470 [ 418.397364][ C1] Read of size 1 at addr ffff888036063010 by task kworker/1:1H/4923 [ 418.405323][ C1] [ 418.407630][ C1] CPU: 1 UID: 0 PID: 4923 Comm: kworker/1:1H Tainted: G L syzkaller #0 PREEMPT(full) [ 418.407647][ C1] Tainted: [L]=SOFTLOCKUP [ 418.407651][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 418.407659][ C1] Workqueue: events_highpri snd_vmidi_output_work [ 418.407680][ C1] Call Trace: [ 418.407684][ C1] [ 418.407688][ C1] dump_stack_lvl+0x100/0x190 [ 418.407703][ C1] print_report+0x13d/0x4b0 [ 418.407719][ C1] ? __virt_addr_valid+0x239/0x430 [ 418.407735][ C1] ? llc_conn_ac_send_sabme_cmd_p_set_x+0x442/0x470 [ 418.407754][ C1] kasan_report+0xdf/0x1c0 [ 418.407770][ C1] ? llc_conn_ac_send_sabme_cmd_p_set_x+0x442/0x470 [ 418.407790][ C1] llc_conn_ac_send_sabme_cmd_p_set_x+0x442/0x470 [ 418.407809][ C1] ? __pfx_llc_conn_ac_send_sabme_cmd_p_set_x+0x10/0x10 [ 418.407829][ C1] llc_conn_state_process+0x3ec/0x1480 [ 418.407844][ C1] llc_conn_tmr_common_cb+0x2d4/0x880 [ 418.407860][ C1] ? __pfx_llc_conn_ack_tmr_cb+0x10/0x10 [ 418.407872][ C1] call_timer_fn+0x19a/0x610 [ 418.407886][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 418.407899][ C1] ? __pfx_llc_conn_ack_tmr_cb+0x10/0x10 [ 418.407911][ C1] ? mark_held_locks+0x40/0x70 [ 418.407926][ C1] ? __pfx_llc_conn_ack_tmr_cb+0x10/0x10 [ 418.407938][ C1] __run_timers+0x757/0xb00 [ 418.407957][ C1] ? __pfx___run_timers+0x10/0x10 [ 418.407972][ C1] ? ktime_get+0x9f/0x320 [ 418.407986][ C1] ? _raw_spin_lock_irq+0x45/0x50 [ 418.407998][ C1] run_timer_base+0x114/0x190 [ 418.408012][ C1] ? __pfx_run_timer_base+0x10/0x10 [ 418.408026][ C1] run_timer_softirq+0x1a/0x50 [ 418.408040][ C1] handle_softirqs+0x1ea/0x9b0 [ 418.408056][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 418.408071][ C1] ? _raw_spin_unlock+0x28/0x50 [ 418.408081][ C1] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 418.408093][ C1] __irq_exit_rcu+0x162/0x210 [ 418.408107][ C1] irq_exit_rcu+0x9/0x30 [ 418.408122][ C1] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 418.408135][ C1] [ 418.408138][ C1] [ 418.408142][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 418.408154][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 [ 418.408170][ C1] Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 96 90 26 f6 48 89 df e8 1e e0 26 f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 c5 ed 15 f6 65 8b 05 ee a6 c4 08 85 c0 74 16 5b [ 418.408187][ C1] RSP: 0018:ffffc9000ed1fb10 EFLAGS: 00000246 [ 418.408203][ C1] RAX: 0000000000000006 RBX: ffff888073e497a0 RCX: 0000000000000040 [ 418.408216][ C1] RDX: 0000000000000000 RSI: ffffffff8e3aced0 RDI: ffffffff8c600380 [ 418.408224][ C1] RBP: 0000000000000293 R08: 0000000000000001 R09: 0000000000000000 [ 418.408231][ C1] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88802af3cb28 [ 418.408237][ C1] R13: 0000000000000081 R14: ffff888073e49788 R15: 0000000000000001 [ 418.408248][ C1] snd_midi_event_encode_byte+0x5d1/0xd30 [ 418.408267][ C1] snd_vmidi_output_work+0x150/0x390 [ 418.408284][ C1] ? __pfx_snd_vmidi_output_work+0x10/0x10 [ 418.408302][ C1] ? rcu_is_watching+0x12/0xc0 [ 418.408320][ C1] process_one_work+0xa23/0x1940 [ 418.408336][ C1] ? __pfx_process_one_work+0x10/0x10 [ 418.408350][ C1] ? __pfx_snd_vmidi_output_work+0x10/0x10 [ 418.408367][ C1] worker_thread+0x5ef/0xe50 [ 418.408381][ C1] ? __pfx_worker_thread+0x10/0x10 [ 418.408394][ C1] ? kthread+0x13a/0x450 [ 418.408404][ C1] ? __pfx_worker_thread+0x10/0x10 [ 418.408416][ C1] kthread+0x370/0x450 [ 418.408426][ C1] ? __pfx_kthread+0x10/0x10 [ 418.408437][ C1] ret_from_fork+0x72b/0xd50 [ 418.408455][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 418.408472][ C1] ? __switch_to+0x800/0x10f0 [ 418.408484][ C1] ? __pfx_kthread+0x10/0x10 [ 418.408495][ C1] ret_from_fork_asm+0x1a/0x30 [ 418.408515][ C1] [ 418.408518][ C1] [ 418.778292][ C1] Allocated by task 9182: [ 418.782600][ C1] kasan_save_stack+0x30/0x50 [ 418.787260][ C1] kasan_save_track+0x14/0x30 [ 418.791914][ C1] __kasan_kmalloc+0xaa/0xb0 [ 418.796484][ C1] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 418.801830][ C1] llc_sap_open+0x120/0x3b0 [ 418.806319][ C1] llc_ui_autobind.isra.0+0x2ae/0x580 [ 418.811675][ C1] llc_ui_connect+0x582/0xdb0 [ 418.816333][ C1] __sys_connect_file+0x141/0x1a0 [ 418.821337][ C1] __sys_connect+0x141/0x170 [ 418.825905][ C1] __x64_sys_connect+0x72/0xb0 [ 418.830646][ C1] do_syscall_64+0x115/0x870 [ 418.835212][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 418.841088][ C1] [ 418.843388][ C1] Freed by task 9200: [ 418.847341][ C1] kasan_save_stack+0x30/0x50 [ 418.851996][ C1] kasan_save_track+0x14/0x30 [ 418.856652][ C1] kasan_save_free_info+0x3b/0x70 [ 418.861651][ C1] __kasan_slab_free+0x5f/0x80 [ 418.866405][ C1] __rcu_free_sheaf_prepare+0x5d/0x2f0 [ 418.871849][ C1] rcu_free_sheaf+0x1a/0xe0 [ 418.876328][ C1] rcu_core+0x5a2/0x10d0 [ 418.880552][ C1] handle_softirqs+0x1ea/0x9b0 [ 418.885297][ C1] __irq_exit_rcu+0x162/0x210 [ 418.889967][ C1] irq_exit_rcu+0x9/0x30 [ 418.894197][ C1] sysvec_call_function_single+0xa3/0xc0 [ 418.899808][ C1] asm_sysvec_call_function_single+0x1a/0x20 [ 418.905765][ C1] [ 418.908066][ C1] The buggy address belongs to the object at ffff888036063000 [ 418.908066][ C1] which belongs to the cache kmalloc-2k of size 2048 [ 418.922095][ C1] The buggy address is located 16 bytes inside of [ 418.922095][ C1] freed 2048-byte region [ffff888036063000, ffff888036063800) [ 418.935861][ C1] [ 418.938164][ C1] The buggy address belongs to the physical page: [ 418.944546][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888036062000 pfn:0x36060 [ 418.954584][ C1] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 418.963060][ C1] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 418.971537][ C1] page_type: f5(slab) [ 418.975494][ C1] raw: 00fff00000000240 ffff88801c023000 ffffea0000a77610 ffffea0001d32810 [ 418.984052][ C1] raw: ffff888036062000 0000000800080006 00000000f5000000 0000000000000000 [ 418.992625][ C1] head: 00fff00000000240 ffff88801c023000 ffffea0000a77610 ffffea0001d32810 [ 419.001271][ C1] head: ffff888036062000 0000000800080006 00000000f5000000 0000000000000000 [ 419.009917][ C1] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 419.018564][ C1] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 419.027207][ C1] page dumped because: kasan: bad access detected [ 419.033594][ C1] page_owner tracks the page as allocated [ 419.039282][ C1] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5592, tgid 5592 (syz-executor), ts 60270662410, free_ts 37398323496 [ 419.060617][ C1] post_alloc_hook+0xfd/0x120 [ 419.065274][ C1] get_page_from_freelist+0xf48/0x3530 [ 419.070709][ C1] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 419.076579][ C1] new_slab+0xa2/0x640 [ 419.080625][ C1] refill_objects+0xe3/0x410 [ 419.085193][ C1] __pcs_replace_empty_main+0x376/0x680 [ 419.090714][ C1] __kmalloc_cache_noprof+0x479/0x6c0 [ 419.096061][ C1] rtnl_newlink+0x126/0x2380 [ 419.100635][ C1] rtnetlink_rcv_msg+0x95e/0xe90 [ 419.105552][ C1] netlink_rcv_skb+0x159/0x420 [ 419.110305][ C1] netlink_unicast+0x585/0x850 [ 419.115043][ C1] netlink_sendmsg+0x8b0/0xda0 [ 419.119784][ C1] __sys_sendto+0x48b/0x4e0 [ 419.124272][ C1] __x64_sys_sendto+0xe0/0x1c0 [ 419.129014][ C1] do_syscall_64+0x115/0x870 [ 419.133583][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 419.139453][ C1] page last free pid 5257 tgid 5257 stack trace: [ 419.145750][ C1] __free_frozen_pages+0x79f/0x1090 [ 419.150930][ C1] qlist_free_all+0x47/0xf0 [ 419.155414][ C1] kasan_quarantine_reduce+0x1a0/0x1f0 [ 419.160852][ C1] __kasan_slab_alloc+0x69/0x90 [ 419.165681][ C1] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 419.171553][ C1] __alloc_skb+0x140/0x710 [ 419.175951][ C1] alloc_skb_with_frags+0xdd/0x760 [ 419.181042][ C1] sock_alloc_send_pskb+0x801/0x980 [ 419.186218][ C1] unix_dgram_sendmsg+0x3c7/0x1810 [ 419.191308][ C1] unix_seqpacket_sendmsg+0x12a/0x1d0 [ 419.196656][ C1] sock_write_iter+0x53a/0x5b0 [ 419.201394][ C1] do_iter_readv_writev+0x6f7/0x930 [ 419.206573][ C1] vfs_writev+0x360/0xdd0 [ 419.210883][ C1] do_writev+0x28a/0x340 [ 419.215120][ C1] do_syscall_64+0x115/0x870 [ 419.219689][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 419.225559][ C1] [ 419.227858][ C1] Memory state around the buggy address: [ 419.233460][ C1] ffff888036062f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 419.241496][ C1] ffff888036062f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 419.249530][ C1] >ffff888036063000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 419.257562][ C1] ^ [ 419.262125][ C1] ffff888036063080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 419.270161][ C1] ffff888036063100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 419.278193][ C1] ================================================================== [ 419.289281][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 419.296479][ C1] CPU: 1 UID: 0 PID: 4923 Comm: kworker/1:1H Tainted: G L syzkaller #0 PREEMPT(full) [ 419.307502][ C1] Tainted: [L]=SOFTLOCKUP [ 419.311820][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 419.321871][ C1] Workqueue: events_highpri snd_vmidi_output_work [ 419.328284][ C1] Call Trace: [ 419.331555][ C1] [ 419.334392][ C1] dump_stack_lvl+0x100/0x190 [ 419.339073][ C1] vpanic+0x552/0x970 [ 419.343050][ C1] ? __pfx_vpanic+0x10/0x10 [ 419.347552][ C1] ? mark_held_locks+0x40/0x70 [ 419.352316][ C1] ? irqentry_exit+0x24d/0xa00 [ 419.357079][ C1] ? llc_conn_ac_send_sabme_cmd_p_set_x+0x442/0x470 [ 419.363670][ C1] panic+0xd1/0xe0 [ 419.367386][ C1] ? __pfx_panic+0x10/0x10 [ 419.371795][ C1] ? check_panic_on_warn+0x1f/0x90 [ 419.376900][ C1] check_panic_on_warn.cold+0x19/0x34 [ 419.382270][ C1] end_report.part.0+0x3a/0x90 [ 419.387036][ C1] kasan_report.cold+0xe/0x18 [ 419.391715][ C1] ? llc_conn_ac_send_sabme_cmd_p_set_x+0x442/0x470 [ 419.398309][ C1] llc_conn_ac_send_sabme_cmd_p_set_x+0x442/0x470 [ 419.404727][ C1] ? __pfx_llc_conn_ac_send_sabme_cmd_p_set_x+0x10/0x10 [ 419.411671][ C1] llc_conn_state_process+0x3ec/0x1480 [ 419.417132][ C1] llc_conn_tmr_common_cb+0x2d4/0x880 [ 419.422511][ C1] ? __pfx_llc_conn_ack_tmr_cb+0x10/0x10 [ 419.428141][ C1] call_timer_fn+0x19a/0x610 [ 419.432732][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 419.437842][ C1] ? __pfx_llc_conn_ack_tmr_cb+0x10/0x10 [ 419.443468][ C1] ? mark_held_locks+0x40/0x70 [ 419.448233][ C1] ? __pfx_llc_conn_ack_tmr_cb+0x10/0x10 [ 419.453861][ C1] __run_timers+0x757/0xb00 [ 419.458375][ C1] ? __pfx___run_timers+0x10/0x10 [ 419.463408][ C1] ? ktime_get+0x9f/0x320 [ 419.467733][ C1] ? _raw_spin_lock_irq+0x45/0x50 [ 419.472754][ C1] run_timer_base+0x114/0x190 [ 419.477428][ C1] ? __pfx_run_timer_base+0x10/0x10 [ 419.482623][ C1] run_timer_softirq+0x1a/0x50 [ 419.487386][ C1] handle_softirqs+0x1ea/0x9b0 [ 419.492156][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 419.497445][ C1] ? _raw_spin_unlock+0x28/0x50 [ 419.502288][ C1] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 419.507915][ C1] __irq_exit_rcu+0x162/0x210 [ 419.512590][ C1] irq_exit_rcu+0x9/0x30 [ 419.516825][ C1] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 419.522450][ C1] [ 419.525371][ C1] [ 419.528288][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 419.534259][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 [ 419.540670][ C1] Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 96 90 26 f6 48 89 df e8 1e e0 26 f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 c5 ed 15 f6 65 8b 05 ee a6 c4 08 85 c0 74 16 5b [ 419.560261][ C1] RSP: 0018:ffffc9000ed1fb10 EFLAGS: 00000246 [ 419.566311][ C1] RAX: 0000000000000006 RBX: ffff888073e497a0 RCX: 0000000000000040 [ 419.574261][ C1] RDX: 0000000000000000 RSI: ffffffff8e3aced0 RDI: ffffffff8c600380 [ 419.582209][ C1] RBP: 0000000000000293 R08: 0000000000000001 R09: 0000000000000000 [ 419.590158][ C1] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88802af3cb28 [ 419.598108][ C1] R13: 0000000000000081 R14: ffff888073e49788 R15: 0000000000000001 [ 419.606081][ C1] snd_midi_event_encode_byte+0x5d1/0xd30 [ 419.611792][ C1] snd_vmidi_output_work+0x150/0x390 [ 419.617062][ C1] ? __pfx_snd_vmidi_output_work+0x10/0x10 [ 419.622853][ C1] ? rcu_is_watching+0x12/0xc0 [ 419.627603][ C1] process_one_work+0xa23/0x1940 [ 419.632527][ C1] ? __pfx_process_one_work+0x10/0x10 [ 419.637878][ C1] ? __pfx_snd_vmidi_output_work+0x10/0x10 [ 419.643669][ C1] worker_thread+0x5ef/0xe50 [ 419.648240][ C1] ? __pfx_worker_thread+0x10/0x10 [ 419.653333][ C1] ? kthread+0x13a/0x450 [ 419.657553][ C1] ? __pfx_worker_thread+0x10/0x10 [ 419.662641][ C1] kthread+0x370/0x450 [ 419.666687][ C1] ? __pfx_kthread+0x10/0x10 [ 419.671258][ C1] ret_from_fork+0x72b/0xd50 [ 419.675832][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 419.680926][ C1] ? __switch_to+0x800/0x10f0 [ 419.685587][ C1] ? __pfx_kthread+0x10/0x10 [ 419.690154][ C1] ret_from_fork_asm+0x1a/0x30 [ 419.694910][ C1] [ 419.698104][ C1] Kernel Offset: disabled [ 419.702400][ C1] Rebooting in 86400 seconds..