last executing test programs: 16.730433684s ago: executing program 2 (id=3198): socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) recvmmsg$unix(r0, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2003, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0xfffffffffffffdff, 0x0}, 0x40000020) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/key-users\x00', 0x0, 0x0) write$binfmt_script(r1, &(0x7f0000000280)={'#! ', './file0', [{0x20, '\\{-.//'}, {0x20, 'vcan0\x00'}, {}], 0xa, "7fb1bc2c87594dd2601d406aa726f81e9234893ca865eb239b266dbae6023ee45bd33b3c3fffbfdff2313896223ec1c0c0"}, 0x4b) syz_emit_ethernet(0x4a, &(0x7f00000003c0)=ANY=[], 0x0) prlimit64(0x0, 0xe, &(0x7f0000000400)={0x8, 0x8b}, 0x0) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000480)=0x2) sched_setscheduler(r2, 0x2, &(0x7f00000004c0)=0x4) mmap(&(0x7f0000a81000/0x1000)=nil, 0x1000, 0xb635773f06ebbeef, 0x10, 0xffffffffffffffff, 0xffffb000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000540)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000005c0), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f0000000600), 0x10106, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, &(0x7f0000000640)=0x39cb, 0x4) shutdown(0xffffffffffffffff, 0x1) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000680), 0x121602, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000700)=@tipc=@id={0x1e, 0x3, 0x2, {0x1, 0x8}}, 0x80, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYRES8, @ANYRES32=r3, @ANYRESOCT=r5, @ANYRES64], 0x220}, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f00000007c0)=0x11) ioctl$TIOCVHANGUP(r6, 0x5437, 0x2) sendto$inet6(r5, 0x0, 0x0, 0x20004041, 0x0, 0x0) connect$inet6(r5, &(0x7f0000000840)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0x5}, 0x1c) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@bridge_getvlan={0x18, 0x72, 0x7e3bfe4fa73db39f, 0x2, 0x25dfdbfd}, 0x18}}, 0x4000) socket$inet6_icmp(0xa, 0x2, 0x3a) 15.595280369s ago: executing program 0 (id=3200): syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000fe07124081173809499b010203010902240001000000000904"], 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF_FLAGS(0xffffffffffffffff, 0x84, 0x7a, &(0x7f0000000000)={0x2, 0xffffffffffffffff}, &(0x7f0000000080)=0xc) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) r2 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x3, 0xc, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000800)={0x3, 0xc, &(0x7f00000008c0)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x94) r3 = syz_open_dev$vbi(&(0x7f00000000c0), 0x1, 0x2) ioctl$VIDIOC_G_FMT(r3, 0xc0d05604, &(0x7f0000000b40)={0x6, @pix_mp={0x9, 0xd5c, 0x20385655, 0x2, 0x7, [{0xe4ba, 0x2}, {0x6, 0x1}, {0x9, 0xc}, {0x2, 0x1ff}, {0x2, 0x8001}, {0x0, 0x2}, {0x6, 0x7}, {0x100, 0x3}], 0x8, 0xb6, 0x6, 0x0, 0x5}}) syz_usb_connect$uac1(0x5, 0x81, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010002000000106307012040000102030109026f0003010300050904000000010100000a240100000a0002010209040100000102000009040101010102000009050109080002fc0a072501000e060009040200000102000009040203010102000008240201f9033c7f072401070402100905820940"], 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x1, 0xc, &(0x7f0000000a00)=ANY=[], &(0x7f0000000a40)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000ac0)=r4, 0x4) sendmsg$inet(r0, &(0x7f0000000b00)={0x0, 0x0, 0x0}, 0x20000004) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000140)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f00000002c0)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000340), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000003c0)=0x6) socket$inet6_udp(0xa, 0x2, 0x0) mmap(&(0x7f0000fa2000/0x3000)=nil, 0x3000, 0x3, 0x13, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_VRING_KICK(0xffffffffffffffff, 0x4008af20, &(0x7f0000000380)) keyctl$get_persistent(0x16, 0x0, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a20000000000a05000000000000000000010000000900010073797a300000000048000000030a01020000000000000000010000000900030073797a320000000014000480080002400000000008000140000000000900010073797a3000000000080007006e6174002c000000060a010400000000000000000100000008000b40000000000900faff72797a300000000004000480140000001100010000000000000000000000000a7fa51b03ac598dac3d2800f2cf90d5e038398c42d22920289e1626512ffe5811b57392d3a2973810062f3488ae28c16518bd9a8f8e0f754a78eda67f0092420e52e19a7eb9ee4cc2c997b575a57419d516ddbfe78bebc8913ad46d2825e55ae4fceac5a98e2c1a3aad1d1f35b1294c3d8b624d5f4376e0af18b04b00"/324], 0xbc}, 0x1, 0x0, 0x0, 0xc0}, 0x10) 15.332035854s ago: executing program 4 (id=3201): mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./proc\x00', 0x1ed) getsockopt$CAN_RAW_JOIN_FILTERS(0xffffffffffffffff, 0x65, 0x6, &(0x7f0000002a80), &(0x7f0000002ac0)=0x4) getrusage(0xffffffffffffffff, &(0x7f0000000300)) mount(0x0, &(0x7f0000000900)='./proc\x00', &(0x7f0000000a00)='proc\x00', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xc02, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000180)={0x107}) ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000000200)) close(r1) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'sit0\x00'}) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[], 0x38}, 0x1, 0x11}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$tipc(0x1e, 0x2, 0x0) ioctl$XFS_IOC_START_COMMIT(r4, 0x80585882, &(0x7f00000001c0)) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, 0x0, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) r6 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, 0x0) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYRES32], 0x1c}}, 0x1010) r7 = socket$can_bcm(0x1d, 0x2, 0x2) r8 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$FS_IOC_FSSETXATTR(r8, 0x50009404, &(0x7f00000004c0)={0x0, 0x0, 0x3a}) connect$can_bcm(r7, &(0x7f0000000140), 0x10) r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r9, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT={0x5}, 0x2) 15.130249839s ago: executing program 2 (id=3203): symlinkat(&(0x7f0000001080)='.\x00', 0xffffffffffffff9c, &(0x7f00000010c0)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000001100)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000001140)='./bus\x00', 0x0) mount$overlay(0xeaff, &(0x7f0000001180)='./bus\x00', &(0x7f00000011c0), 0xa14000, &(0x7f00000003c0)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@xino_on}]}) 14.051583035s ago: executing program 3 (id=3204): r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000140)={{0x12, 0x1, 0x310, 0x63, 0x86, 0x35, 0x10, 0xcf3, 0x1010, 0x3687, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x7f, 0x4, 0x50, 0x0, "", [{{0x9, 0x4, 0x7c, 0xb, 0x0, 0xa4, 0xca, 0xd4}}]}}]}}, &(0x7f0000000180)={0x0, 0x0, 0x8, &(0x7f00000001c0)=ANY=[]}) syz_emit_vhci(&(0x7f0000000200)=ANY=[@ANYBLOB="040e08780c08"], 0xb) syz_usb_disconnect(r0) prlimit64(0x0, 0xe, &(0x7f00000002c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setaffinity(r1, 0x2, &(0x7f0000000340)=0x8000000000009) sched_setscheduler(r1, 0x2, &(0x7f0000000380)=0x6) r2 = openat$vimc0(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r2, 0x4020565b, &(0x7f0000000400)={0x8000000, 0x200, 0x2}) bpf$PROG_LOAD(0x5, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ptrace$getsig(0x4202, r1, 0x5, &(0x7f0000000500)) connect$unix(r3, &(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000600), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000640)=0x2) recvmmsg(r3, &(0x7f0000000680), 0x10106, 0x2, 0x0) mknodat(0xffffffffffffffff, 0x0, 0x8, 0x2) ioctl$COMEDI_DEVCONFIG(0xffffffffffffffff, 0x40946400, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000006c0)={0x1, &(0x7f0000000700)=[{0x6, 0x7, 0x2, 0x7fff7ffc}]}) close_range(r5, r5, 0x200000000000000) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000740)='ns/net\x00') r6 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000780)=@bpf_lsm={0x1e, 0x3, &(0x7f0000000840)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000008c0)={r6, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r7 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r7, &(0x7f0000000940), 0x0) socket(0x400000000010, 0x3, 0x0) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) listen(r8, 0x28) 13.958876537s ago: executing program 2 (id=3205): ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000100)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) setns(0xc9, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) socket$inet_smc(0x2b, 0x1, 0x0) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000400), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000440)={0x409, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042"}) unshare(0x22020600) unshare(0x20a0000) ioctl$SW_SYNC_IOC_INC(r1, 0x40045701, &(0x7f0000000480)=0x8000) syz_usb_connect$uac3(0x3, 0x80, &(0x7f00000004c0)=ANY=[@ANYBLOB="1201100100000008732b0a0040000102030109024e00030109200c080b0001010130080904000000010130000a2401010a000010000009040100000102300009040101010102300009050109b0020905f80a25"], 0x0) landlock_create_ruleset(&(0x7f0000000540)={0x14000, 0x8, 0x3, 0x600, 0x6, 0x2}, 0x30, 0x1) r2 = syz_open_dev$loop(&(0x7f0000000580), 0x3, 0x101002) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$BLKCLOSEZONE(r2, 0x40101287, &(0x7f00000005c0)={0x7ff, 0x7}) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = dup(r3) unlinkat(0xffffffffffffff9c, &(0x7f0000000600)='./cgroup/../file0/file0\x00', 0x200) rmdir(&(0x7f0000000640)='./cgroup/../file0\x00') write$UHID_INPUT(r4, &(0x7f0000000780)={0x9, {"a2e3ad214fc752f91b29090955f70e0dd038e7ff7fc6e5539b324c078b089b33393b6d1a0890e0878f0e1ac6e7049b0747959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b313b0d076d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78659a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fde039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deffcb05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b4bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0630060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e70000000001000000e71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab60dd64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c283550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080c0300f8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab22427292510200000002210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7d5e4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c743da2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e5c641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36050000000000060000000000000022e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600000000000000000000000000000000fe0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009fda00", 0xffffffffffffff6c}}, 0x1006) socket$pppoe(0x18, 0x1, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) r6 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r6, &(0x7f00000017c0)=@pppol2tpin6={0x18, 0x1, {0x0, r5, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x4000000, @mcast1, 0x20000000}}}, 0x32) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x34, 0x0, &(0x7f00000001c0)=[@increfs={0x40046304, 0x3}, @free_buffer, @request_freeze={0x400c6313, 0x2, 0x1}, @clear_death={0x400c630f, 0x1, 0x3}], 0x100, 0x0, &(0x7f0000000200)}) sendmmsg(r6, &(0x7f0000001800)=[{{0x0, 0x31, 0x0}}], 0x34000, 0x0) close(0x3) openat$tun(0xffffffffffffff9c, &(0x7f0000001840), 0x0, 0x0) 13.765482149s ago: executing program 4 (id=3207): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x109181, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e22, 0x8, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xd}}, 0x5}, 0x1c) socket$inet6(0xa, 0x1, 0x100) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x7) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000100)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0xc4206000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs={0x1, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000200), 0x651, 0x0) recvmmsg(r3, &(0x7f0000000240), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x6) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x46032, 0xffffffffffffffff, 0x0) r5 = userfaultfd(0x80801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f00000002c0)) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, 0x0) ioctl$UFFDIO_CONTINUE(r5, 0xc020aa08, &(0x7f0000000340)={{&(0x7f0000c00000/0x400000)=nil, 0x400000}}) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000380), 0x400, 0x0) connect$inet6(r1, &(0x7f00000003c0)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x3}, 0x1c) r6 = fcntl$dupfd(r1, 0x406, r1) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000400)=0x10, 0x4) sendmsg$NFT_BATCH(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000500)=ANY=[], 0x56c}, 0x1, 0x0, 0x0, 0x4855}, 0x8811) shutdown(r6, 0x1) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, 0x0, 0x0) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000000540)={0x0, 0x9, 0x1000, 0x3, 0x315}, &(0x7f0000000600)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfe48, 0x8000, 0x3, 0x204, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3ad5, 0x40, 0x2, 0x268}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6373, 0x1, 0x3, 0x34d}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8ce8, 0x8000, 0x1, 0x9b, 0x0, r6}}], 0x4, 0x0, &(0x7f0000000880)) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) 12.451576015s ago: executing program 1 (id=3208): r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc00455d0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/sys/net/ipv4/fib_multipath_hash_fields\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='-55', 0x3) write$tun(r1, &(0x7f0000000100)={@val={0x0, 0x8884}, @val={0x0, 0x1, 0x9, 0x4, 0x800, 0x9}, @eth={@broadcast, @local, @val={@void, {0x8100, 0x6, 0x1}}, {@mpls_uc={0x8847, {[{0x101}, {0x8, 0x0, 0x1}, {0x7}, {0x5}, {0x4, 0x0, 0x1}, {0x9, 0x0, 0x1}, {0x3, 0x0, 0x1}], @llc={@snap={0x1, 0x0, "c6", "830e40", 0x8906, "60d7f417707f6d8966a9009afb736f57ac90dc16339ad941c1"}}}}}}}, 0x5d) syz_open_dev$loop(&(0x7f0000000040), 0x100000001, 0x24481) 12.374191613s ago: executing program 4 (id=3209): socket$nl_route(0x10, 0x3, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000180)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000280)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000300), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x0, 0x0) recvmmsg(r2, &(0x7f0000000380), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000440)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x3, 0x1c, &(0x7f0000000580)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x80000000}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x19}}, [@snprintf={{0x5, 0x0, 0x7, 0x9, 0x0, 0x2, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfe00}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x90}, {0x3, 0x0, 0x6, 0xa, 0x9, 0xfe04, 0xf1}, {0x7, 0x1, 0xb, 0x7, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x9, 0x2, 0x0, r0}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000680)='GPL\x00', 0x7, 0x0, 0x0, 0x41000, 0xc, '\x00', 0x0, @fallback=0x26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe5}, 0x94) 12.299049406s ago: executing program 1 (id=3210): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000007c0)={'xfrm0\x00'}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$sg(0x0, 0x2, 0x200000) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x4000000000001a2, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$VHOST_SET_VRING_NUM(0xffffffffffffffff, 0x4008af10, &(0x7f0000000500)={0x1, 0x80000001}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, 0x0) exit(0x7ffd) r3 = syz_open_procfs(0x0, &(0x7f0000000380)='fd/3\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r3, 0x0, 0x0) openat$dsp1(0xffffff9c, &(0x7f0000000040), 0x80040, 0x0) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) sched_setaffinity(r0, 0x8, &(0x7f00000001c0)) mbind(&(0x7f0000ff5000/0xb000)=nil, 0xb000, 0x3, &(0x7f0000000180)=0x9, 0x4, 0x1) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f00000000c0)=ANY=[@ANYRESDEC=r1], 0x0, 0x38}, 0x28) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8890}, 0x40) ioprio_set$uid(0x3, 0x0, 0x2004) add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000280)={'syz', 0x3}, &(0x7f00000002c0)="1d", 0x0, 0xfffffffffffffffe) 11.246758004s ago: executing program 0 (id=3211): ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b14, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000080"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r0) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0f0000000400000004000000120000"], 0x50) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2000}, 0x94) r4 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet6(r4, &(0x7f0000000500)=[{{&(0x7f0000000040)={0xa, 0x4e20, 0x1, @mcast2}, 0x1c, 0x0}}], 0x1, 0x0) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000006c0)=ANY=[@ANYRES32=r2, @ANYRES32=r3, @ANYBLOB="05"], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r2}, &(0x7f0000000140), &(0x7f0000000180)=r0}, 0x20) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b142b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c04594282423424d00", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x2003}, 0x94) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000200)='syzkaller\x00', 0x9}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x9c00, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 11.203485246s ago: executing program 4 (id=3212): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="30000000410007012bbd700000000000047c00000400c2800c000180060006008848"], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000003c0)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000400)={0xa, 0x4e21, 0x0, @empty, 0x4}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000440), 0x28) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000480)=@ccm_128={{0x304}, "1f5fe89b3e65d0fd", "313a19ff4c7d278bf34b54168b154d15", "1e5a7ddb", "2fd978cbd6bf3b5d"}, 0x28) setsockopt$inet6_tcp_int(r1, 0x11a, 0x4, 0x0, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={0x0}}, 0x4000100) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000580)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000005c0)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000680), 0x48103, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000006c0), 0x2, 0x141102) writev(r2, &(0x7f0000000700)=[{&(0x7f0000000740)="94", 0xf000}, {0x0}], 0x2) r3 = socket$kcm(0x29, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x20004040) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r4, 0x7a7, &(0x7f0000000800)=0x80000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r4, 0x7a0, &(0x7f0000000840)={@host}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r4, 0x7a8, &(0x7f0000000880)={{@host}, @host, 0x0, 0x6, 0x244c, 0xffffffffffffffff, 0x101, 0x0, 0xfffffffc}) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x1, 0x5, &(0x7f0000001a40)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef42d430f6296b72a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed40000000022278d00031e5388ee5c867ddd58211d6ece3ccb0cd2b6d3cffd962867a3a2f624f992daa94a6a556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff020000000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409e011f1264d43f153b3d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7000026a4e739c60f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf3f704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eedd9068ca1457870eb30d219e23ccc8e06dddeb61799257ab5000013c86ba99523d61a00000000c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb8629aeec90e6d1857da822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae200f279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522e8dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87995b51cb6febd5f34a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724be3733c26f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be10ba7dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2db484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b00ffffff7f000000000801f71d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cf0d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67856ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e2b8e7370baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b09000000d31df213c802d74797056fd3bca8b2d6cb134437cba0193ba4360bdcc98aad2560aa48291c4eb9d4e08ad7a9c5f04be1ab597124d84dfc7bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b8dd4221fff0f0000705d7257ff7f76c78ba0b44ec0bdfa0d32d7042059b13a079639f14f9032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e0caac037209d2f14fcddd00000000000000000000000000000000e609893bdce015e8ccfb36399844db61f6171b0b0e845e48728450c6ba4f7098f8e000676b59ab9f851f3ab77847ce05c89411277ec69c409b7ec50a3337a78675f38a568612c235ab5f2cd6d035d5f5f6a693c381adbbf7b37e37292783b2c7efe7d3a067906552f76d419e0300000000000000000000008f3a20b49fe7636806867283e35cff8d00e7b251bab3cf6377a24f8e8d4bda7503674bc94bf7f4d2fa6f25944bf0a186436d9f6831995976328a1fdc78492c65c1434855dc35c3cf7cf9610c5387794443c99b304799114132362849c3fa85d6379729ff9094933db0cfbe8887c50b87e1469fdf454cef4cbc5f7bf384000000000000a4e8c1a25f47c440144a9776be6cb40aafdb9d3cc8f6a6050974e1c4000000000000008b753f4e1bef9556efcc087a99dbf231167013a4b2eaf6338a0b100c98a331dffc09bbaa2efa16c90e92fa90b8361a825905c69cd1ae3427f6c5e301393bd2b5ff678f110f4f9818b3a3f5f0c3cefacf70d0fbc529c3935d55c1cb8c"], &(0x7f0000000000)='GPL\x00'}, 0x94) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001940)={0x0, 0x0, 0x0}, 0x20000811) ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x89e0, &(0x7f0000001980)={0xffffffffffffffff, r5}) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000019c0)={'\x00', 0x401, 0x9, 0xa, 0xf, 0x5}) mount(0x0, 0x0, 0x0, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_usb_connect(0x0, 0x2e, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002000000404406478000010102030109021c0001010080fa0904030000010100000a240100010a0002"], 0x0) 11.109334517s ago: executing program 1 (id=3213): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) connect$802154_dgram(r0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x1ff) ioctl$F2FS_IOC_START_ATOMIC_WRITE(r0, 0xf501, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x800001000089}, 0x0) r1 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r1, &(0x7f0000000100)={&(0x7f0000000180)=@in6={0x2, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@mark={{0x10, 0x1, 0x4f, 0x3}}], 0x10}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getrlimit(0x2, &(0x7f0000000340)) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000380)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000003c0), 0x0, 0x0) read$msr(r3, &(0x7f0000000400)=""/102392, 0x18ff8) keyctl$instantiate(0xc, 0x0, &(0x7f0000019400)=ANY=[], 0x2a, 0x0) add_key$user(0x0, &(0x7f0000019440), &(0x7f0000019480), 0x0, 0xfffffffffffffffd) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000194c0), 0x200002, 0x0) rmdir(&(0x7f0000019500)='./cgroup/../file0\x00') openat$cgroup_type(r4, &(0x7f0000019540), 0x2, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000019580), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f00000195c0)={'batadv0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000019600)={'batadv_slave_1\x00'}) sendmsg$BATADV_CMD_GET_ORIGINATORS(r6, &(0x7f0000019640)={0x0, 0x0, &(0x7f0000019680)={&(0x7f00000196c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="090325bd7000fcdbdf25080000000800", @ANYRES32=r8, @ANYBLOB="08000600"], 0x24}, 0x1, 0x0, 0x0, 0x4090}, 0x24000890) mount(&(0x7f0000000140)=@filename='mtd0\x00', &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='jffs2\x00', 0x800000, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xac5) 10.174914436s ago: executing program 1 (id=3214): r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) r2 = socket(0x1, 0x5, 0x0) close(r2) syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') r3 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000180)={0xe000200c}) setns(r1, 0x24020000) umount2(&(0x7f0000000040)='.\x00', 0x2) 8.903945444s ago: executing program 0 (id=3215): mkdir(&(0x7f0000000000)='./mysys\x00', 0x1ff) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000003c0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xb, 0xa2b9, 0x6, 0x7, 0xe1, 0x200, 0xfc000004, 0x7, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x6, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x0, 0x8a, 0x79, 0x2, 0x10080, 0xfffffffe, 0x83f4, 0x129, 0x1, 0x16, 0x8, 0x2, 0x401, 0x1, 0x405, 0x0, 0x880, 0x9, 0xf9a6, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x2, 0x2000007, 0x489, 0x7ff, 0x4, 0x4007b, 0xffffffff, 0x1, 0x2], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0x2, 0x8, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0xac12, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x7, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffff7fff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x3ff], [0x2, 0x4, 0x9, 0xc, 0x0, 0x2e6bf783, 0x80000001, 0x5, 0x40000005, 0x48e, 0x81, 0x200026, 0x7f, 0x403, 0x102, 0x1, 0x41, 0x6, 0xee4e, 0x2000104, 0x1, 0x9, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x100006, 0x2, 0x400, 0x8, 0x5, 0xd2, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x9, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x4, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfe, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x3, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x2, 0x140f1, 0x5396, 0x4, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x80000000, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x2, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x1, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000840), 0x0, 0x0) socket$igmp6(0xa, 0x3, 0x2) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/raw6\x00') preadv(r1, &(0x7f0000000240)=[{&(0x7f0000000280)=""/196, 0xc4}, {&(0x7f0000000c80)=""/219, 0xdb}, {&(0x7f0000000d80)=""/201, 0xc9}], 0x3, 0x8, 0x5) capset(0x0, &(0x7f0000000880)={0x5, 0x5, 0x80, 0x1, 0x1, 0x1}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000008c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$NILFS_IOCTL_DELETE_CHECKPOINT(r3, 0x40086e81, &(0x7f0000000900)=0x5) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000940)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000980)={[0x2000000035, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x800000000002, 0x5, 0xef, 0xd, 0x7fffffffffffe, 0xcd3, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xa], 0x25000, 0x304}) bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x3, 0x5, &(0x7f0000000b00)=ANY=[@ANYBLOB="bf"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$kvm(0xffffffffffffff9c, &(0x7f0000000b40), 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r6 = dup(r5) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000b80)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000bc0)=[@text32={0x20, &(0x7f0000000c00)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000c40)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) mount(0x0, &(0x7f0000000100)='./mysys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./mysys/bus/pci/devices/0000:00:01.0/enable\x00', 0x1, 0x0) r9 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) ioctl$IOCTL_GET_NCIDEV_IDX(r8, 0x0, &(0x7f0000000040)=0x0) bind$nfc_llcp(r9, &(0x7f0000000080)={0x27, r10, 0x1, 0x4, 0x8, 0x4, "f96af53f6f40b915f9fe8b1f5a03d9ceb85da663b9d7ef0a117a760d4beba173921a709ace27e72389408ce413219eeb0fb21942732264e90d721a44fb0de5", 0xd}, 0x60) write(r8, &(0x7f0000000140)="257f61ceeb5d130d3509ed32f1b0d4e5e1fd1f96dd006e646220c1149bbfe04df93f2f3339f9b69854cbbf311a020441e1b4e2dd7f918459a85a8df6cb35505144e0f7dce1fb46", 0x47) 8.735162577s ago: executing program 2 (id=3216): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00p\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00', @ANYRES32=r1, @ANYBLOB="140001800800010000000200050006"], 0x2c}}, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) r2 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) shutdown(r2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x16) 8.692455109s ago: executing program 3 (id=3217): mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./proc\x00', 0x1ed) getsockopt$CAN_RAW_JOIN_FILTERS(0xffffffffffffffff, 0x65, 0x6, &(0x7f0000002a80), &(0x7f0000002ac0)=0x4) getrusage(0xffffffffffffffff, &(0x7f0000000300)) mount(0x0, &(0x7f0000000900)='./proc\x00', &(0x7f0000000a00)='proc\x00', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xc02, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000180)={0x107}) ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000000200)) close(r1) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'sit0\x00'}) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[], 0x38}, 0x1, 0x11}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$tipc(0x1e, 0x2, 0x0) ioctl$XFS_IOC_START_COMMIT(r4, 0x80585882, &(0x7f00000001c0)) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, 0x0, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) r6 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, 0x0) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYRES32], 0x1c}}, 0x1010) r7 = socket$can_bcm(0x1d, 0x2, 0x2) r8 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$FS_IOC_FSSETXATTR(r8, 0x50009404, &(0x7f00000004c0)={0x0, 0x0, 0x3a}) connect$can_bcm(r7, &(0x7f0000000140), 0x10) r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r9, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_emit_vhci(&(0x7f0000000000)=@HCI_VENDOR_PKT={0x5}, 0x2) 7.981792557s ago: executing program 4 (id=3218): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="30000000410007012bbd700000000000047c00000400c2800c000180060006008848"], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000003c0)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000400)={0xa, 0x4e21, 0x0, @empty, 0x4}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000440), 0x28) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000480)=@ccm_128={{0x304}, "1f5fe89b3e65d0fd", "313a19ff4c7d278bf34b54168b154d15", "1e5a7ddb", "2fd978cbd6bf3b5d"}, 0x28) setsockopt$inet6_tcp_int(r1, 0x11a, 0x4, 0x0, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)={0x28, 0x0, 0x8, 0x801, 0x0, 0x0, {0xa, 0x0, 0x3}, [@CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x88}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x3a}, @CTA_TIMEOUT_DATA={0x4, 0x4, 0x0, 0x1, @tcp}]}, 0x28}}, 0x4000100) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000580)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000005c0)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000680), 0x48103, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000006c0), 0x2, 0x141102) writev(r2, &(0x7f0000000700)=[{&(0x7f0000000740)="94", 0xf000}, {0x0}], 0x2) r3 = socket$kcm(0x29, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x20004040) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r4, 0x7a7, &(0x7f0000000800)=0x80000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r4, 0x7a0, &(0x7f0000000840)={@host}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r4, 0x7a8, &(0x7f0000000880)={{@host}, @host, 0x0, 0x6, 0x244c, 0xffffffffffffffff, 0x101, 0x0, 0xfffffffc}) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x1, 0x5, &(0x7f0000001a40)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef42d430f6296b72a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed40000000022278d00031e5388ee5c867ddd58211d6ece3ccb0cd2b6d3cffd962867a3a2f624f992daa94a6a556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff020000000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409e011f1264d43f153b3d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7000026a4e739c60f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf3f704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eedd9068ca1457870eb30d219e23ccc8e06dddeb61799257ab5000013c86ba99523d61a00000000c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb8629aeec90e6d1857da822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae200f279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522e8dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87995b51cb6febd5f34a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724be3733c26f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be10ba7dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2db484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b00ffffff7f000000000801f71d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cf0d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67856ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e2b8e7370baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b09000000d31df213c802d74797056fd3bca8b2d6cb134437cba0193ba4360bdcc98aad2560aa48291c4eb9d4e08ad7a9c5f04be1ab597124d84dfc7bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b8dd4221fff0f0000705d7257ff7f76c78ba0b44ec0bdfa0d32d7042059b13a079639f14f9032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e0caac037209d2f14fcddd00000000000000000000000000000000e609893bdce015e8ccfb36399844db61f6171b0b0e845e48728450c6ba4f7098f8e000676b59ab9f851f3ab77847ce05c89411277ec69c409b7ec50a3337a78675f38a568612c235ab5f2cd6d035d5f5f6a693c381adbbf7b37e37292783b2c7efe7d3a067906552f76d419e0300000000000000000000008f3a20b49fe7636806867283e35cff8d00e7b251bab3cf6377a24f8e8d4bda7503674bc94bf7f4d2fa6f25944bf0a186436d9f6831995976328a1fdc78492c65c1434855dc35c3cf7cf9610c5387794443c99b304799114132362849c3fa85d6379729ff9094933db0cfbe8887c50b87e1469fdf454cef4cbc5f7bf384000000000000a4e8c1a25f47c440144a9776be6cb40aafdb9d3cc8f6a6050974e1c4000000000000008b753f4e1bef9556efcc087a99dbf231167013a4b2eaf6338a0b100c98a331dffc09bbaa2efa16c90e92fa90b8361a825905c69cd1ae3427f6c5e301393bd2b5ff678f110f4f9818b3a3f5f0c3cefacf70d0fbc529c3935d55c1cb8c"], &(0x7f0000000000)='GPL\x00'}, 0x94) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001940)={0x0, 0x0, 0x0}, 0x20000811) ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x89e0, &(0x7f0000001980)={0xffffffffffffffff, r5}) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000019c0)={'\x00', 0x401, 0x9, 0xa, 0xf, 0x5}) mount(0x0, 0x0, 0x0, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0xe0c81) syz_usb_connect(0x0, 0x2e, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002000000404406478000010102030109021c0001010080fa0904030000010100000a240100010a0002"], 0x0) 6.150702993s ago: executing program 3 (id=3219): openat$adsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./mnt/trace_marker\x00', 0x1, 0x1a) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./mnt/trace_pipe\x00', 0x0, 0x0) syz_open_dev$usbfs(0x0, 0x76, 0x101301) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_int(r2, 0x29, 0x8, &(0x7f00000001c0)=0x405, 0x4) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r3 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(r0, &(0x7f0000000040)='./mnt/trace_marker\x00', 0x40) mount(0x0, &(0x7f0000000240)='./sys_sec\x00', &(0x7f0000000280)='securityfs\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000400)=0x7) r5 = syz_open_dev$sndmidi(&(0x7f0000000440), 0x2, 0x143102) writev(r5, &(0x7f0000000500)=[{&(0x7f0000000540)="94", 0xf000}, {0x0}], 0x2) pipe2$9p(0x0, 0x4000) shutdown(0xffffffffffffffff, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x0) read(r6, &(0x7f00000005c0)=""/28, 0xfffffffffffffdee) write$tun(r6, 0x0, 0xffe) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000000640)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000680)={0xffffffffffffffff}, 0x111, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r7, &(0x7f00000006c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x9, @empty, 0x9}, {0xa, 0x5, 0x13, @dev={0xfe, 0x80, '\x00', 0x1d}, 0x848a}, r8, 0x1}}, 0x48) write$RDMA_USER_CM_CMD_MIGRATE_ID(r7, &(0x7f0000000740)={0x12, 0x6, 0xfa00, {0x0, r8, r7}}, 0x18) mount$afs(&(0x7f0000000780)=ANY=[@ANYRESHEX=r3], &(0x7f00000007c0)='./mnt/trace_pipe\x00', 0x0, 0x100000, &(0x7f00000002c0)=ANY=[@ANYBLOB="666c6f63364652aab3ab854b9b7f6175746f63656c6c2c66716f006b3d64796e2c666c6f436b3d090000006c2c6613b9f057be333719c43a9d6c6f756b3d737472696319e307c8d5b393dc0e8b742c666c6fe36b3d776f743d072eb3fc88de2c6473", @ANYRES8=r4]) read(r1, &(0x7f00000008c0)=""/16384, 0x4000) 6.072932876s ago: executing program 0 (id=3220): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001440)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000080)='bpf\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x1, 0x0) fchdir(r2) sendmmsg$unix(r0, &(0x7f0000001480)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff000}}, {{&(0x7f0000001500)=@file={0x1, './file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e, 0x0}}], 0x2, 0x0) 5.013707379s ago: executing program 3 (id=3221): clock_gettime(0x7, &(0x7f00000009c0)) io_getevents(0x0, 0x2e5, 0x4, &(0x7f0000000100)=[{}, {}, {}, {}], &(0x7f0000000180)={0x0, 0x3938700}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) getsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0xd, 0x0, &(0x7f00000005c0)) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e23, 0x2002, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x1}], 0x1c) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f0000000440)={@broadcast, @empty, 0x1}, 0xc) unshare(0x22020600) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) listen(r3, 0x0) ppoll(&(0x7f0000000480)=[{r3}], 0x1, &(0x7f0000000500)={0x0, 0x3938700}, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1e000000000000004200040001"], 0x50) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000580)={r4, 0x0, &(0x7f0000000600)=""/53}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000640)={r4, 0x0, &(0x7f0000000680)=""/53}, 0x20) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f00000006c0)='lp', 0x2) bind$inet6(r5, &(0x7f0000000700)={0xa, 0x2, 0x5, @loopback, 0x7}, 0x1c) sendto$inet6(r5, &(0x7f0000000780)="1c", 0x1, 0x200080c0, &(0x7f0000000000)={0xa, 0x2, 0x9000, @loopback, 0xffffff1e}, 0x1c) 4.910952077s ago: executing program 0 (id=3222): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x5) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000000000086d044fc1ffffed00000109022400010000000009040000010300030009210000000122050009058103"], 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000100)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000140), 0x0, 0x0) read$msr(r3, &(0x7f0000000440)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000019440)=0x7) socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket(0x8000000010, 0x2, 0x0) write(r4, &(0x7f0000019480)="fc0000001c000704ab5b2509b86803000aab087a0400000001481193210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5b", 0x7e) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x14, r6, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x0) 4.805786808s ago: executing program 4 (id=3223): socket$nl_route(0x10, 0x3, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000180)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000280)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000300), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000340)=0x2) recvmmsg(r2, &(0x7f0000000380), 0x10106, 0x2, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000003c0), 0x180, 0x0) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000440)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x3, 0x1c, &(0x7f0000000580)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x80000000}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x19}}, [@snprintf={{0x5, 0x0, 0x7, 0x9, 0x0, 0x2, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfe00}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x90}, {0x3, 0x0, 0x6, 0xa, 0x9, 0xfe04, 0xf1}, {0x7, 0x1, 0xb, 0x7, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x9, 0x2, 0x0, r0}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000680)='GPL\x00', 0x7, 0x0, 0x0, 0x41000, 0xc, '\x00', 0x0, @fallback=0x26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe5}, 0x94) r5 = socket$tipc(0x1e, 0x5, 0x0) connect$tipc(r5, &(0x7f0000000400)=@name={0x1e, 0x2, 0x3, {{0x0, 0x4}, 0x3}}, 0x10) sendmsg$tipc(r5, &(0x7f0000000240)={&(0x7f0000000100)=@nameseq={0x1e, 0x1, 0x1, {0x1, 0x1, 0x1}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4040010}, 0x20028805) close(r5) 2.922604346s ago: executing program 1 (id=3224): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x5607, 0x1) sendmmsg$unix(r1, &(0x7f00000000c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}}, {{&(0x7f0000000140)=@abs={0x0, 0x0, 0x4e24}, 0x6e, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYRES32=r0], 0x18, 0x20008880}}], 0x2, 0x4c054) r2 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000240)={'bridge_slave_1\x00'}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000740)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r4, 0x8932, &(0x7f0000000780)={'sit0\x00', @random="e5539104ecf5"}) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000220000012bbd7000fddbdf25021434080300000802000000a987c57c638978b5f50980a57eedf69aa781ece992eee3454b95f5afddc4c77b6e20018485590b70f227c0cc8a4d634aa4d0399cf0fb42bc8ac735767a540a306e1b88cba2f086f356d1414b160cb698f60484daa6967fd079e3dfd58b4d59ab943d0c9393f1f5fceb167cf021dd44b4c30dedc600244e8269f41854a30ee7d949ead9f345f9739dabc5044b3a98321c"], 0x1c}, 0x1, 0x0, 0x0, 0x400c080}, 0x200088c2) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r5, 0x6, 0xd, 0x0, 0x0) bind$inet6(r5, &(0x7f0000000380)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = syz_open_dev$dvb_frontend(&(0x7f0000000640), 0x9, 0x0) ioctl$FE_DISEQC_RESET_OVERLOAD(r7, 0x6f3e, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0x2a, &(0x7f00000003c0)=0x9, 0x4) getsockname$packet(0xffffffffffffffff, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000006c0)=0x14) sendto$inet6(r5, &(0x7f0000000400)="a6", 0x1, 0x2404c081, &(0x7f0000000440)={0xa, 0x2, 0xd, @loopback, 0x9}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000480)='bbr', 0x3) r8 = socket$nl_audit(0x10, 0x3, 0x9) sendmmsg$inet(r8, &(0x7f00000004c0)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000580)="06", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f00000005c0)=[{0x0}, {0x0, 0x4000}], 0x2}}], 0x2, 0x14) shutdown(r5, 0x1) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000600)={@empty, 0x0, 0x1, 0x0, 0x8, 0x4, 0x46fd}, 0x20) r9 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r9, 0x8933, &(0x7f0000000300)={'vxcan1\x00', 0x0}) setsockopt$sock_linger(r8, 0x1, 0xd, &(0x7f0000000700)={0x1, 0x4}, 0x8) bind$can_raw(r9, &(0x7f0000000000)={0x1d, r10}, 0x10) setsockopt$CAN_RAW_FILTER(r9, 0x65, 0x1, &(0x7f00000000c0), 0xf00) bind$can_raw(r9, &(0x7f0000000080), 0x10) 2.863893659s ago: executing program 3 (id=3225): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) getpgid(0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000540)=0x2, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @remote}, 0x10) sendmmsg$inet(r0, &(0x7f0000006740)=[{{0x0, 0x0, &(0x7f0000002740)=[{0x0}, {&(0x7f0000000100), 0xc02}, {0x0}, {&(0x7f0000000080)="09ebb34c6e6b9bcb890e8fc488c52697590da70578e206547182de9cd141c0012e4926791de3eea4aa103ad545198bf93c390bbdb6f1faf1c0924adb7ebc658f62f9f47ed5f8d851dea2d62af8d6aa9af055c1975558eef4", 0x58}, {&(0x7f0000001580)="5cf0b67aa16bf1dcc2f1ae5aa14e42cb6db77c270b99b1c640ab27453b4a089d9ad367f0f0dd7ab38ddbaeb047ef74d0a1f9aa080b894ea2f067824e2331f63e32eca6dd1196239a33e3ff58a8c40a9c120cca1666ab88492ec25f2ee144dc6b0d2e21651eea22bd79d45e406676df1e1ae9f937ff483c77a3c16a52c736c022b2829500081c0d6159780f114f713eb8364ba6d5b6c9f64f43326bc2219741e92de26f4342bcc6d691ff5f36c990af86750adc5b945e27ee8d6b65cd12841c9b110bad0f2c9a2d2e73410f0cb58d43c433459b820ed4314723626946aa6697e045c1edce001ffe549ae2a44b4377da7d4f3d2857e45c3f25ea44797577256b587f7420a30745a6e373c058200d42edc02b42d028e4cab8d6fe09d677ccd453784f3deb8724be00842dc857e2efe2a752a32b3dcd252d6ccb6ede45cfab2830c0b5947a4b9c9f68705d9e669d8f1e6d60a32812825252a46beadd87ecc1344c9924cffb26c2effcf25244b1f7b717b0e4b3f30b8c136b2385aeb52364d199e97c455117c390d3d3f0524bb4159b15a1803be4d289ee4524a36d70a47f56b1dcb865c40452f9851860601d929a4237c3ff9522ce238fb12761a11b0eeffa5156d5f8f8e8782dd61e291cd691dfebf673c04622ab3d0f41386eaa02f05a9d4f0b83c796ba1a3115ce0132030cd11f4cc797a20e5388ca45936c27282f7c28ae8312654c9f34b28f1c59894449dcc1c993929cff02280f7688100ac4ccba6e534cd44e6cefa6cf2c64fa66f8e3d59b0b851fbbdbbe81d57c44a5eee6a7d96ca176ad33240a703cff52de4fd70ea2d4330f4efc17c55aa688ed5daa1646e50ffc07c95059a2b3ee442f665c9838293b0400b951a1f706bf73b63d9d7a8aed42c0b54bb81be4fc698e1eb0605d656a5446698b76ef5a224cde75c457d49ad7479153d36ce1c2e32011e058866cc94d44604eefc42fdb6bfd82cf4722bf4c73df1ea2d02eb787ec0eb26ea13532a77465da7070bff12fe8c1694ec2eb87285915ab182543db23b45a1ca291e7b9133fccdc0742ce6e6b71e3286412339dc52d696136f47912519545911c246c875ff80dd734f81c41a73493da7da9c4ee125c60dd65a49d490e2fc33ca5fc511ad18148b1177f19eaeffe7a0174875dd03e8e3b32ebcae0a8aabea0d4d1de879332ea50471fc6eb5b7cefcc7b243c22c84d85c73f8c8fc31cbbcd9f4c6b601e02375428fdbd320c2182877da71a2d70330f05fd8e7c50f73c291bc4bff8e306f55c79cfea125876f6e9092ad5598d8fa62d119385061f1ff13bf7c2b44fd363be7229f6b4f2f6fb7f641535c47cca350e598b8290fa73bfc0559e5bfa74228bd4b7048b8f0356c43a439b5731381d575997780e4f57b5c2d6b5bfbb955aa10e9f9cc46eb62b530a156511fa7e0c001f24396af1a9946d07d3c065f7fb88c430c63807652c60cb174735e1466df3bd407a765a4a63ad2cf004bad50ab2049a7f56cdfd53d39eabc749871e70fbab4ffe42756ed05335df15d40420134902a68b69a15dda03c98ed9333174043441f807b70f5a98d35984128a902e7ee8d5ae806ca40e4f5ad2288ec645ca43275c7625eabda5a774d10c9efcc852b4e2a181255308ab1082ad382bb5bdff980865e7caadcec81b4697457d816625097cb4a9659d480145a3d40237e54be17faf12fae9a9a48226fd7e43509e325359642bd8626e37958f83494b15b6c615121238129c15c1fac440dabc71a836ac2976e1987abdc3ecbe78dacda51cf9019e3159b276a877e355c18a9835cdf98522dad7467dcbd97dca4098599ce33ebee7c742ab847d39172608fd8f829e344393b50f29f0e7efdc35bad46c1e20ed7c3f5874f021a8afe3a96cf9e186eafee13b138d92091282414ad896034d8146e849785b364450970abe11f743a12ac977062059ad7f67b01d32cdcc75c6babe2309fc929a9d92c805ecb4ff70719df50807e824ae90f66b0557bff4ebf78dfa43532869ff5164e144defc4d8ee1d6745ed369e7ed7afc981f0f3a0c82a1f97032a12eb8d672b2231040d132971ff2b2ea2eeb0f30fc21fdcd80e32f8a64d325b0fa74919c0b727335230cd340883ed28bd50af63e07f98f91e5d69851b25ab260828303713fa7ce5671c598fabee013bbb6ed04bc70e8d16d9748b885179ae22e4a9ea40d55d6565b0dc5b35719f28199b95ce9ce7f3c81c5a62a5ec1c9c63a8c74cbd26682875ffd2b8c709643d4dfa81199f9828fbe6c1e99d5c003f7ebfbf860fb238f1e427c74eadf459ed60ee73de4d13c8cfc7c58fc371fdd0e8bd70b10e4f9de9928f5c1fa81dffabc7a818fc8d50d9611f06b901bd88a5fc6b9f8bc6503b23822f105653b598c9f0abffbae0d8c56cff568f2c2bc47a88b26c2124a78921462efa4895730f369bf1f0d3227ef1b76dd394317c1726a13f9c15d65bcf6128b61351abac6a54151efcd872d25d9929cf5b7ef141e84b8d145fff6453d6a943af1c0ebd6c2aad77c1cadd21880bcdc362c690e88a914f946c8cfe00ac1936ac8e7ee66156bf76a158b09244aee3c937677067b8d6ce6de5711c80ee00893acf16e86e44037450581e6d06aff72630356644d2345741e76065a15b23cd57ed96a4b702b07a1c2df236ef5d1f0711ed23742a05bf7c047b48338e28115cdce04277cc10936937f0434ae60adbf1a9fc6f422ce8017d1f7b5554c19dc67fdce214afdb8b9a04e3987d16ce5b0b8d9f779914441357347af13f08fec8b05e4f786e88d1346fffd81cd3feb2c518c8a5199ebc2e15754a789febfde86dacb5530ebad117acc0b1cad2669836b5e536dc3df3739f22b85bf1d64353ce65b81707902fc9b471bd159fc80065f26d56aa310d47c276bbd83f5d2e5e4ffbe0e424b21eb940d9e1b3198eae52cdde8c193f4f07e7af9e40f64e2ebdb9aa0f0dc49fae9b024128379eec28ff2b2989907e16bdd9ea22f767f73d21c1c9ed2992b1c5ff5e606c7a3f5f29ce6e30e0118f5c6f88c6bdd27bc58fc74390a97a98590b31fbcbd76449777b253ce0c68da51d402ae862beef5fbfd8afb3aaa62f57826e74c8f6b985aa456e015fd8325eb8fedbc0f0e681bcd8d7626bee70e48d563d1acb03af39d206384b1e8328e588e66fb7243c8c9c2748a8f9efb34a0ab4e76035d9c6e4a7784ead7194f2868f97c580769942b3e81bf02e55c27f43885303d641ab9717618592bf790c119a9033ffce20a8ffcd0d1f1043add8da1a40b2d223920e33625366ccbf515b4e83ba5030df036316798c8cd50b5dca303fddfed3b4d7e89077be0af139ed509243dca68271d02238c85a6dc019897727b6137b18fdf444cff1790631b4c411daa9939b4a4b1abd93b2b1370d62c9e07962cacdde123b75a625553cc8dd2c4f4df4f96a1cdd07fefb232347dbf24e39831251d30e931dc965b789975d93c35d001bb90335f77984b4fe6cfe67eeacbfe8b03dd3b9eccc33ae979b38bf89417e89e0b7c3da65443cb8371353e7b5a44f99db5c73a0f7bc84147ef45847dc0231e00684f0bfb361efc62636c460501a910047db41258c00538b6763b3a79a23395afc6a46be1f53d123202bb598f9e3f40d50939f0cb01c70215e55de53703375e5be090387eaec3717d22e718c31f9d9eb2a81a2bddd846671d14aa42995cd18aca6c804b4b8eba42693eb4d2db995ef26e5a7ab1c4a98d7c268821edf7d2f193f381c15e87fa8355207c3efb209e4214038e99f7c3e7fdcdc4d038b18b08c488edc20a949f7417a7d8dd4e37dbf1b4afcf79ef867d17ca68a0d744b8f6aee7738be4beb737ca9dba34fda810f44c0f51ec9f8e295e7cd78e3256ae73db7186b1e29a04f63065c44fa6c7a16fe4f50851f336b402ce5a73ff88f9b5cdb52ead12060590180f112a4f6c36e5418207bc5dc8635ec831e383ae67fbbe119de517a6932a69440015d014a1d143c8b09f611aa4f79b083c8ea67806cf221ede408771cf2d979feb3e448fcbd859e875d6ff6cff062e073bdb4b32bcf5", 0xb35}], 0x5}}, {{0x0, 0x0, 0x0}}], 0x3fffffffffffe97, 0x2404c845) 2.66320865s ago: executing program 3 (id=3226): sendmsg$key(0xffffffffffffffff, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=ANY=[@ANYBLOB="020d0007020000000000000000000000d23b8ffca8c5bcbebb9d546eead39553bc2ee8af176b980be108d9efe5fd4ce47538e7cc9b5ede6fed16f8afc4800d16abb021ec7b8a93a955375c0e9f5777942bfcb17c676f3b8e2f23fdcbbe62278dc0cb657251bc"], 0x10}}, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x20846, 0x12) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x101700) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000540)=ANY=[@ANYRES64=0x0], &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp=0x25, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x40}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x0, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) creat(&(0x7f0000000000)='./file0\x00', 0x1) r2 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) sendmsg$802154_raw(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)="e9", 0x2f}, 0x1, 0x0, 0x0, 0x810}, 0x24004014) r3 = syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff00000007058102000200070582020002000705830200020007058402000200070586"], 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], 0x0, 0x200000, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) truncate(&(0x7f0000000180)='./file0\x00', 0x8fff5) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r4, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f0000000640), 0x0, 0x0, 0x0, 0x1}}, 0x40) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r0, 0x0) r5 = add_key$user(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x0}, &(0x7f00000001c0)="f2", 0x1, 0xfffffffffffffffe) r6 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$dh_compute(0x17, &(0x7f0000000200)={0x0, r5, r6}, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r7, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffffff, &(0x7f00000004c0)='./file0\x00', 0x17f) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/mapper/control\x00', 0x2, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r8, 0x40106614, &(0x7f0000000300)) r9 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r9}, &(0x7f0000000000)=0x0) timer_settime(r10, 0x1, &(0x7f0000000040), 0x0) timer_settime(r10, 0x0, &(0x7f0000000280)={{0x77359400}, {0x77359400}}, &(0x7f00000002c0)) ioctl(r8, 0xc138fd03, 0x0) 2.652839142s ago: executing program 1 (id=3227): r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000140)={{0x12, 0x1, 0x310, 0x63, 0x86, 0x35, 0x10, 0xcf3, 0x1010, 0x3687, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x7f, 0x4, 0x50, 0x0, "", [{{0x9, 0x4, 0x7c, 0xb, 0x0, 0xa4, 0xca, 0xd4}}]}}]}}, &(0x7f0000000180)={0x0, 0x0, 0x8, &(0x7f00000001c0)=ANY=[]}) syz_emit_vhci(&(0x7f0000000200)=ANY=[@ANYBLOB="040e08780c08"], 0xb) syz_usb_disconnect(r0) prlimit64(0x0, 0xe, &(0x7f00000002c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setaffinity(r1, 0x2, &(0x7f0000000340)=0x8000000000009) sched_setscheduler(r1, 0x2, &(0x7f0000000380)=0x6) r2 = openat$vimc0(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r2, 0x4020565b, &(0x7f0000000400)={0x8000000, 0x200, 0x2}) bpf$PROG_LOAD(0x5, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ptrace$getsig(0x4202, r1, 0x5, &(0x7f0000000500)) connect$unix(r3, &(0x7f0000000580)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000600), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000640)=0x2) recvmmsg(r3, &(0x7f0000000680), 0x10106, 0x2, 0x0) mknodat(0xffffffffffffffff, 0x0, 0x8, 0x2) ioctl$COMEDI_DEVCONFIG(0xffffffffffffffff, 0x40946400, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000006c0)={0x1, &(0x7f0000000700)=[{0x6, 0x7, 0x2, 0x7fff7ffc}]}) close_range(r5, r5, 0x200000000000000) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000740)='ns/net\x00') r6 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000780)=@bpf_lsm={0x1e, 0x3, &(0x7f0000000840)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000008c0)={r6, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r7 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r7, &(0x7f0000000940), 0x0) socket(0x400000000010, 0x3, 0x0) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) listen(r8, 0x28) 2.421803929s ago: executing program 0 (id=3228): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000004c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000000700)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="d197227d9aecefce2cfe584268726a084ce2e0ecb77744f0a8c5d3f029e5bce591c46ec6bb5368784a35bd03a9a4951db86d85616516d5cfaa84203692de151653254a7df490d09315ef1a3fe9978ed2345262757a33e4a3799aa7b9bf592018971c1829cfe962f7b3", @ANYRESDEC=0x0, @ANYBLOB=',\x00']) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f0000000440)={{0x1, 0x1, 0x18, r0, {0x4}}, './file0\x00'}) recvmmsg$unix(r1, &(0x7f0000001f00)=[{{0x0, 0x0, &(0x7f0000001940)=[{&(0x7f0000000800)=""/4096, 0x1000}, {&(0x7f0000001800)=""/232, 0xe8}, {&(0x7f0000000000)=""/17, 0x11}], 0x3}}, {{&(0x7f00000001c0)=@abs, 0x6e, &(0x7f0000001d40)=[{&(0x7f0000001a00)=""/228, 0xe4}, {&(0x7f0000001b00)=""/27, 0x1b}, {&(0x7f0000001b40)=""/214, 0xd6}, {&(0x7f0000001c40)=""/53, 0x35}, {&(0x7f0000001c80)=""/128, 0x80}, {&(0x7f0000001d00)=""/58, 0x3a}], 0x6, &(0x7f0000000580)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x118}}], 0x2, 0x23, &(0x7f0000000140)={0x0, 0x989680}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0x22a03, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000500)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f000063e000/0x18000)=nil, &(0x7f0000000540)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000001fc0)=[@textreal={0x8, &(0x7f0000002000)="f00fc7484d36f08266060266b9800000c00f326635000400000f308bc1de780066b9aa0200000f3266b9ab0900000f32f2f031b3e759dc2c", 0x38}], 0x1, 0x9f6a364b3fac2a63, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x1) r7 = eventfd(0x5f0) ioctl$KVM_IOEVENTFD(r6, 0x40a0ae49, &(0x7f0000000180)={0x7ff, 0x0, 0x0, r7}) rename(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='./file0\x00') mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) r8 = syz_usb_connect(0x1, 0x2d, &(0x7f0000000240)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904010001faf40d00090582239f"], 0x0) r9 = syz_open_dev$char_usb(0xc, 0xb4, 0xfffffffffffff001) syz_usb_disconnect(r8) poll(&(0x7f0000000400)=[{r9, 0x82d0}], 0x1, 0x5) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setxattr$trusted_overlay_upper(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x0, 0x1015, 0x0) lgetxattr(&(0x7f0000000340)='./file0\x00', &(0x7f00000003c0)=@known='trusted.overlay.upper\x00', 0x0, 0x4000) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 1.57510096s ago: executing program 2 (id=3229): socket$rxrpc(0x21, 0x2, 0xa) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$vim2m(&(0x7f0000000240), 0x6, 0x2) ioctl$vim2m_VIDIOC_PREPARE_BUF(r1, 0xc0405602, 0x0) openat$comedi(0xffffffffffffff9c, &(0x7f0000000280)='/dev/comedi4\x00', 0x101000, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x20004450) r2 = open(0x0, 0x80140, 0x0) prlimit64(0x0, 0xe, &(0x7f00000002c0)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x5) r3 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) r4 = syz_ublk_setup_io_uring(0x5a42, &(0x7f0000000380)={0x0, 0xdaa8, 0x10, 0x1}, &(0x7f0000000400)=0x0, &(0x7f0000000440)=0x0, &(0x7f0000000480)=0x0) r8 = syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f00000004c0)={0x2e, 0xc, 0x0, r3, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000540)=@new_dev={0x3, 0x104}}}, &(0x7f0000000580)=0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000005c0), 0x80200, 0x0) r11 = syz_open_dev$sndmidi(&(0x7f0000000600), 0x2, 0x141102) writev(r11, &(0x7f0000000640)=[{&(0x7f0000000680)="94", 0xf000}, {0x0}], 0x2) listns(0x0, &(0x7f00000006c0), 0x0, 0x0) r12 = syz_open_dev$ublk_chdev(&(0x7f0000000700), r8, 0x2) syz_ublk_setup_queues(r12, r10, &(0x7f0000000740)={0x0, 0x5a7a, 0x0, 0x2, 0x2ce}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x72bc, 0x40, 0x0, 0x1f5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x18a7, 0x1, 0x2, 0x31e}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x468b, 0x40000, 0x1, 0x39f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9af2, 0x400, 0x1, 0x20a, 0x0, r2}}], 0x4, &(0x7f0000000a40)={0x2e, 0x10, 0x0, r12, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xff}, 0x0, r9, '\x00', {0x4, 0xe50, 0x0, 0x0}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000ac0)={&(0x7f0000000b00)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, &(0x7f0000000b40)=""/17, 0x1a, 0x11, 0x1, 0x5}, 0x28) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x8001a0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x200002, 0x0) socket$nl_route(0x10, 0x3, 0x0) setsockopt$sock_int(r0, 0x1, 0x55, &(0x7f0000000b80)=0x7, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./mnt\x00', 0x1a7) mount(&(0x7f0000000100)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000180)='ext4\x00', 0x8410, 0x0) open$dir(&(0x7f00000001c0)='./mnt\x00', 0x0, 0x2) 0s ago: executing program 2 (id=3230): r0 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000140)={0x200002, 0x200003, 0x801, 0x4, 0x7}) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fsopen(&(0x7f0000000340)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r3, 0x5, &(0x7f0000000380)='fd', 0x0, r2) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x2) fchdir(r4) symlink(&(0x7f00000003c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f00000004c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') readlinkat(0xffffffffffffff9c, &(0x7f00000005c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffffff, 0xb4) readlink(&(0x7f00000006c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f00000007c0)=""/79, 0x4f) r5 = syz_open_dev$sg(&(0x7f0000000180), 0x0, 0x800) r6 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f0000002c40)={0x800fff, 0x200, 0x6, 0x8001}, 0x10) write(r6, &(0x7f0000002c80)="240000001a005f0214f9f407000904001f000000000000050000000008000400011f0000", 0x24) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r4, 0xc0502100, &(0x7f00000001c0)={0x0, 0x0}) lstat(&(0x7f0000000980)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r6, 0x4058587a, &(0x7f0000000d00)={{r6, &(0x7f0000000b00)='O/\xa3]*-^$[\'%\x00', 0x4000, &(0x7f0000000b40)={@align=0x100000000, {0x5, 0x401, 0x5, 0x5}}, 0x29da, &(0x7f0000000b80)={@_ha_fsid}, &(0x7f0000000bc0)=0x3}, {[0x6, 0x8, 0xe, 0x1]}, 0x8, 0xe3, &(0x7f0000000c00)=""/227}) r9 = openat(0xffffffffffffff9c, &(0x7f0000000d80)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r9, 0xc138fd03, &(0x7f0000000dc0)="0400000000000000000000003801") read$FUSE(r1, &(0x7f0000004d00)={0x2020, 0x0, 0x0, 0x0}, 0x2020) mount$fuse(0x0, &(0x7f0000000840)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000940), 0x80000, &(0x7f0000002b40)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r8}, 0x2c, {[{@allow_other}, {@blksize={'blksize', 0x3d, 0x400}}, {@blksize={'blksize', 0x3d, 0x1000}}, {@allow_other}, {@default_permissions}], [{@uid_gt={'uid>', r10}}]}}) capset(&(0x7f0000000240)={0x20071026, r7}, &(0x7f0000000280)={0x6, 0x7e2, 0xff, 0x8, 0x1800, 0x40}) ioctl$SG_GET_VERSION_NUM(r5, 0x2284, 0x0) io_uring_register$IORING_REGISTER_IOWQ_AFF(0xffffffffffffffff, 0x11, &(0x7f00000002c0)="3d6e9d88083bd0f4c3ba18259dcf2af7b31e51eaa6a6013b99b02d9b05fc0a1dcf1d5db82ca50bb59344f79cc65d978f14a2", 0x32) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000e00)={0xffffffffffffffff}) getsockopt$sock_buf(r11, 0x1, 0x3d, 0x0, &(0x7f0000000e40)) fallocate(r0, 0x6000000, 0x0, 0x1000f4) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={0xffffffffffffffff, &(0x7f0000000000)="c85890af51a86bd570", &(0x7f0000000080)=@udp, 0x2}, 0x20) kernel console output (not intermixed with test programs): T16198] veth0_macvtap: entered promiscuous mode [ 1003.384934][T16198] macvtap0: left promiscuous mode [ 1003.385767][T16198] veth1_macvtap: entered promiscuous mode [ 1003.385926][T16198] macsec0: left promiscuous mode [ 1003.458322][T16198] geneve0: left promiscuous mode [ 1003.465214][T16198] geneve1: left promiscuous mode [ 1003.484403][T16198] netdevsim netdevsim0 netdevsim0: left promiscuous mode [ 1003.485092][T16198] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1003.487983][T16198] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1003.492357][T16198] netdevsim netdevsim0 netdevsim2: left promiscuous mode [ 1003.494659][T16198] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1003.495320][T16198] netdevsim netdevsim0 netdevsim3: left promiscuous mode [ 1003.495575][T16198] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1003.505121][T16198] mac80211_hwsim hwsim4 wlan0: left promiscuous mode [ 1003.507299][T16198] mac80211_hwsim hwsim5 wlan1: left promiscuous mode [ 1003.538569][T16198] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1003.543723][T16198] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1003.566222][T16198] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1003.614573][T16198] macsec1: left promiscuous mode [ 1004.370039][T16191] syzkaller0: entered promiscuous mode [ 1004.370065][T16191] syzkaller0: entered allmulticast mode [ 1004.393749][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 1004.393833][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1004.396591][ T50] bridge0: port 2(bridge_slave_1) entered blocking state [ 1004.396639][ T50] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1004.400716][T16214] overlayfs: failed to clone upperpath [ 1006.230285][T16238] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2761'. [ 1006.230314][T16238] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 1007.360752][ T5857] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1007.360928][ T5857] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1007.362774][ T5857] bond6: (slave veth0_virt_wifi): link status definitely up, 10000 Mbps full duplex [ 1007.362976][ T5857] bond6: (slave veth0_virt_wifi): making interface the new active one [ 1007.365250][ T5857] bond6: active interface up! [ 1007.366561][ T50] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1007.384512][T10574] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1007.384587][T10574] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1007.386818][ T10] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1007.422938][ T5857] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1007.497852][ T30] audit: type=1400 audit(1792297655.592:1817): avc: denied { mounton } for pid=16249 comm="syz.2.2765" path="/592/file0" dev="tmpfs" ino=3315 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 1007.499393][T16250] fuse: fd is not a fuse device [ 1007.641224][ T10] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1007.652160][T16256] cgroup: No subsys list or none specified [ 1008.730510][ T10] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1009.182422][T16280] jffs2: notice: (16280) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1011.411622][T16292] fuse: fd is not a fuse device [ 1011.771199][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1012.763104][T16325] tipc: Cannot configure node identity twice [ 1013.549168][T16330] jffs2: notice: (16330) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1014.754399][T16343] tipc: Cannot configure node identity twice [ 1015.927783][T16351] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=57 sclass=netlink_route_socket pid=16351 comm=syz.4.2790 [ 1016.320636][ T10] libceph: connect (1)[c::]:6789 error -99 [ 1016.320783][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 1016.951137][ T10] libceph: connect (1)[c::]:6789 error -99 [ 1016.951295][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 1016.956800][T16354] ceph: No mds server is up or the cluster is laggy [ 1019.966979][T16389] jffs2: notice: (16389) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1020.652508][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1021.319732][T16399] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1021.331708][T16399] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1021.342866][T16399] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1021.350240][T16399] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1021.358424][T16399] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1021.408204][ T30] audit: type=1400 audit(1792297669.502:1818): avc: denied { mounton } for pid=16398 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 1021.620158][T16408] nvme_fabrics: unknown parameter or missing value 'dis' in ctrl creation request [ 1021.992482][T16398] rxe_eth0 speed is unknown, defaulting to 1000 [ 1023.451129][ T5604] Bluetooth: hci5: command tx timeout [ 1023.541071][ T24] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 1023.597852][T16398] bridge0: port 1(bridge_slave_0) entered blocking state [ 1023.597942][T16398] bridge0: port 1(bridge_slave_0) entered disabled state [ 1023.598045][T16398] bridge_slave_0: entered allmulticast mode [ 1023.599866][T16398] bridge_slave_0: entered promiscuous mode [ 1023.634204][T16398] bridge0: port 2(bridge_slave_1) entered blocking state [ 1023.634454][T16398] bridge0: port 2(bridge_slave_1) entered disabled state [ 1023.634945][T16449] netlink: zone id is out of range [ 1023.634954][T16449] netlink: zone id is out of range [ 1023.634961][T16449] netlink: zone id is out of range [ 1023.634974][T16449] netlink: zone id is out of range [ 1023.634982][T16449] netlink: zone id is out of range [ 1023.634989][T16449] netlink: zone id is out of range [ 1023.634996][T16449] netlink: zone id is out of range [ 1023.635002][T16449] netlink: zone id is out of range [ 1023.635009][T16449] netlink: zone id is out of range [ 1023.635016][T16449] netlink: zone id is out of range [ 1023.635353][T16398] bridge_slave_1: entered allmulticast mode [ 1023.638471][T16398] bridge_slave_1: entered promiscuous mode [ 1023.722375][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 1023.723003][ T24] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1023.723894][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1023.723921][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1023.723942][ T24] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1023.723977][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1023.727308][ T24] usb 4-1: config 0 descriptor?? [ 1023.949271][T16455] jffs2: notice: (16455) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1024.636132][T16398] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1024.638925][T16398] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1024.686411][T16398] team0: Port device team_slave_0 added [ 1024.688981][T16398] team0: Port device team_slave_1 added [ 1024.734184][T16398] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1024.734201][T16398] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1024.734222][T16398] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1024.738568][T16398] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1024.738581][T16398] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1024.738600][T16398] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1025.531113][ T5604] Bluetooth: hci5: command tx timeout [ 1026.409518][T16398] hsr_slave_0: entered promiscuous mode [ 1026.410106][T16398] hsr_slave_1: entered promiscuous mode [ 1026.410498][T16398] debugfs: 'hsr0' already exists in 'hsr' [ 1026.410513][T16398] Cannot create hsr debugfs directory [ 1026.477005][ T24] usbhid 4-1:0.0: can't add hid device: -71 [ 1026.477081][ T24] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1026.502634][ T24] usb 4-1: USB disconnect, device number 76 [ 1026.669702][T16473] overlay: Unknown parameter 'audit' [ 1027.413859][T16473] smbdirect: ib_dev[s`z1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 1027.413883][T16473] smbdirect: ib_dev[s`z1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 1027.413907][T16473] smbdirect: ib_dev[s`z1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 1027.507112][T16473] infiniband s`z1: RDMA CMA: cma_listen_on_dev, error -98 [ 1027.611112][ T5604] Bluetooth: hci5: command tx timeout [ 1027.980004][ T5604] Bluetooth: hci0: unexpected event for opcode 0x2028 [ 1028.341370][T16494] jffs2: notice: (16494) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1029.144054][T16398] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1029.162540][T16398] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1029.163165][T16398] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1029.167055][T16398] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1029.172510][T16398] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1029.203895][T16398] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1029.206669][T16398] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1029.208147][T16398] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1029.440109][T16398] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1029.456968][T16398] 8021q: adding VLAN 0 to HW filter on device team0 [ 1029.469208][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 1029.469291][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1029.474930][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 1029.475004][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1029.702446][ T5604] Bluetooth: hci5: command tx timeout [ 1031.861476][T16532] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2828'. [ 1031.861524][T16532] net_ratelimit: 336 callbacks suppressed [ 1031.861535][T16532] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 1032.066229][T16537] jffs2: notice: (16537) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1032.708472][T16398] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1032.798137][T16398] veth0_vlan: entered promiscuous mode [ 1032.809209][T16398] veth1_vlan: entered promiscuous mode [ 1032.869372][T16398] veth0_macvtap: entered promiscuous mode [ 1032.879442][T16398] veth1_macvtap: entered promiscuous mode [ 1032.896628][T16398] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1033.068868][T16398] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1033.113627][ T59] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1033.141227][ T59] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1033.141264][ T59] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1033.141292][ T59] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1033.366659][T16551] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=16551 comm=syz.1.2832 [ 1033.398854][ T8983] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1033.398873][ T8983] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1033.415954][T16553] cgroup: No subsys list or none specified [ 1034.609878][ T50] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1034.609898][ T50] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1034.631589][ T30] audit: type=1400 audit(1792297682.722:1819): avc: denied { mounton } for pid=16398 comm="syz-executor" path="/root/syzkaller.C4Tv29/syz-tmp" dev="sda1" ino=2048 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 1034.631638][ T30] audit: type=1400 audit(1792297682.722:1820): avc: denied { mounton } for pid=16398 comm="syz-executor" path="/root/syzkaller.C4Tv29/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 1034.885111][ T30] audit: type=1400 audit(1792297682.982:1821): avc: denied { mounton } for pid=16398 comm="syz-executor" path="/root/syzkaller.C4Tv29/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=40714 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 1035.372188][ T30] audit: type=1400 audit(1792297683.462:1822): avc: denied { mounton } for pid=16398 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2784 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 1035.380859][ T30] audit: type=1400 audit(1792297683.472:1823): avc: denied { mounton } for pid=16398 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 1036.005089][T16584] cgroup: Unknown subsys name 'smackfsroot' [ 1036.008939][T16575] ALSA: mixer_oss: invalid OSS volume '' [ 1036.158190][T16584] overlayfs: conflicting options: nfs_export=on,metacopy=on [ 1036.227552][T16588] tipc: Started in network mode [ 1036.227622][T16588] tipc: Node identity 2, cluster identity 7 [ 1036.227646][T16588] tipc: Node number set to 2 [ 1037.459554][T16598] input: syz1 as /devices/virtual/input/input22 [ 1037.931517][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1042.038259][T16653] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2853'. [ 1042.038302][T16653] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 1042.901132][T15262] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 1043.052724][T15262] usb 4-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 1043.054152][T15262] usb 4-1: config 1 has an invalid interface number: 3 but max is 0 [ 1043.054206][T15262] usb 4-1: config 1 has no interface number 0 [ 1043.060072][T15262] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1043.060319][T15262] usb 4-1: Product: syz [ 1043.060413][T15262] usb 4-1: Manufacturer: syz [ 1043.060608][T15262] usb 4-1: SerialNumber: syz [ 1043.166956][T15262] usb 4-1: 3:0 : does not exist [ 1043.166977][T15262] usb 4-1: 3:0 : does not exist [ 1043.532912][ T29] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 1043.681384][ T29] usb 3-1: Using ep0 maxpacket: 8 [ 1043.687773][ T29] usb 3-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 1043.725276][ T29] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1043.725307][ T29] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1043.725363][ T29] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1043.782297][ T29] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1043.782388][ T29] usb 3-1: Product: syz [ 1043.782472][ T29] usb 3-1: Manufacturer: syz [ 1043.782513][ T29] usb 3-1: SerialNumber: syz [ 1043.834359][ T29] usb 3-1: config 0 descriptor?? [ 1043.836951][T16660] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1044.132963][T16670] jffs2: notice: (16670) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1044.557555][ T29] rc_core: IR keymap rc-streamzap not found [ 1044.557574][ T29] Registered IR keymap rc-empty [ 1044.558646][ T29] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 1044.644110][ T29] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input23 [ 1044.672609][ T5336] usb 4-1: USB disconnect, device number 77 [ 1046.896586][ T5803] usb 3-1: USB disconnect, device number 16 [ 1047.187537][ T5604] Bluetooth: hci4: unexpected event for opcode 0x080c [ 1048.836318][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 [ 1049.611818][ T5803] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 1049.761181][ T5803] usb 3-1: Using ep0 maxpacket: 8 [ 1049.762612][ T5803] usb 3-1: New USB device found, idVendor=04a5, idProduct=3035, bcdDevice=1e.c2 [ 1049.763560][ T5803] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1049.763599][ T5803] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1049.864898][ T5803] usb 3-1: config 0 descriptor?? [ 1049.879399][ T5803] gspca_main: benq-2.14.0 probing 04a5:3035 [ 1050.116352][T13683] usb 3-1: USB disconnect, device number 17 [ 1050.785286][T16727] FAULT_INJECTION: forcing a failure. [ 1050.785286][T16727] name failslab, interval 1, probability 0, space 0, times 0 [ 1050.785321][T16727] CPU: 0 UID: 0 PID: 16727 Comm: syz.3.2875 Tainted: G L syzkaller #0 PREEMPT(full) [ 1050.785350][T16727] Tainted: [L]=SOFTLOCKUP [ 1050.785358][T16727] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1050.785371][T16727] Call Trace: [ 1050.785378][T16727] [ 1050.785387][T16727] dump_stack_lvl+0x100/0x190 [ 1050.785423][T16727] should_fail_ex.cold+0x5/0xa [ 1050.785454][T16727] should_failslab+0xc2/0x120 [ 1050.785486][T16727] __kmalloc_cache_noprof+0x91/0x6d0 [ 1050.785510][T16727] ? userio_char_open+0xdb/0x200 [ 1050.785544][T16727] ? __pfx_userio_char_open+0x10/0x10 [ 1050.785578][T16727] userio_char_open+0xdb/0x200 [ 1050.785608][T16727] ? __pfx_userio_char_open+0x10/0x10 [ 1050.785638][T16727] misc_open+0x26d/0x450 [ 1050.785665][T16727] ? __pfx_misc_open+0x10/0x10 [ 1050.785691][T16727] chrdev_open+0x234/0x6a0 [ 1050.785721][T16727] ? __pfx_chrdev_open+0x10/0x10 [ 1050.785751][T16727] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 1050.785780][T16727] do_dentry_open+0x6ab/0x14d0 [ 1050.785805][T16727] ? __pfx_chrdev_open+0x10/0x10 [ 1050.785839][T16727] vfs_open+0x82/0x3f0 [ 1050.785873][T16727] path_openat+0x1a23/0x2450 [ 1050.785906][T16727] ? __pfx_path_openat+0x10/0x10 [ 1050.785941][T16727] do_file_open+0x20e/0x430 [ 1050.785970][T16727] ? __pfx_do_file_open+0x10/0x10 [ 1050.786018][T16727] ? _raw_spin_unlock+0x28/0x50 [ 1050.786044][T16727] ? alloc_fd+0x471/0x7a0 [ 1050.786081][T16727] do_sys_openat2+0x10f/0x1e0 [ 1050.786101][T16727] ? __pfx_do_sys_openat2+0x10/0x10 [ 1050.786121][T16727] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1050.786159][T16727] __x64_sys_openat+0x12d/0x210 [ 1050.786186][T16727] ? __pfx___x64_sys_openat+0x10/0x10 [ 1050.786218][T16727] do_syscall_64+0x123/0x790 [ 1050.786252][T16727] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1050.786275][T16727] RIP: 0033:0x7f339899e559 [ 1050.786293][T16727] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1050.786313][T16727] RSP: 002b:00007f3399924028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1050.786333][T16727] RAX: ffffffffffffffda RBX: 00007f3398c25fa0 RCX: 00007f339899e559 [ 1050.786347][T16727] RDX: 0000000000101402 RSI: 00002000000005c0 RDI: ffffffffffffff9c [ 1050.786359][T16727] RBP: 00007f3398a35ab8 R08: 0000000000000000 R09: 0000000000000000 [ 1050.786371][T16727] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1050.786383][T16727] R13: 00007f3398c26038 R14: 00007f3398c25fa0 R15: 00007ffe80daed68 [ 1050.786412][T16727] [ 1050.937284][T16727] netlink: 'syz.3.2875': attribute type 83 has an invalid length. [ 1052.392530][T16752] cgroup: No subsys list or none specified [ 1054.167516][ T24] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 1054.321202][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 1054.326545][ T24] usb 4-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=36.87 [ 1054.329811][ T24] usb 4-1: config 127 has an invalid interface number: 124 but max is 0 [ 1054.329877][ T24] usb 4-1: config 127 has no interface number 0 [ 1054.330031][ T24] usb 4-1: config 127 interface 124 has no altsetting 0 [ 1054.486197][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1054.486597][ T24] usb 4-1: Product: syz [ 1054.486707][ T24] usb 4-1: Manufacturer: syz [ 1054.486760][ T24] usb 4-1: SerialNumber: syz [ 1054.794938][ T5604] Bluetooth: hci0: unexpected event for opcode 0x080c [ 1055.544169][T16783] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2889'. [ 1055.544214][T16783] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 1056.176771][ T5336] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 1056.414273][ T5336] usb 3-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 1056.446916][ T5336] usb 3-1: config 1 has an invalid interface number: 3 but max is 0 [ 1056.446940][ T5336] usb 3-1: config 1 has no interface number 0 [ 1056.563847][ T5336] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1056.563875][ T5336] usb 3-1: Product: syz [ 1056.563890][ T5336] usb 3-1: Manufacturer: syz [ 1056.563903][ T5336] usb 3-1: SerialNumber: syz [ 1056.826101][ T5336] usb 3-1: 3:0 : does not exist [ 1056.826125][ T5336] usb 3-1: 3:0 : does not exist [ 1057.035688][T16787] jffs2: notice: (16787) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1057.683457][ T5604] Bluetooth: hci0: ISO packet too small [ 1057.752783][ T5336] usb 3-1: USB disconnect, device number 18 [ 1058.130204][ T24] usb 4-1: USB disconnect, device number 78 [ 1058.165892][T16800] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=57 sclass=netlink_route_socket pid=16800 comm=syz.0.2887 [ 1058.631702][T16807] ALSA: mixer_oss: invalid OSS volume '' [ 1059.020170][ T30] audit: type=1400 audit(1792297707.113:1824): avc: denied { mount } for pid=16818 comm="syz.4.2899" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 1060.217930][T16837] jffs2: notice: (16837) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1061.833654][T16853] can0: slcan on ttyS3. [ 1061.902960][T16852] can0 (unregistered): slcan off ttyS3. [ 1061.915615][ T5604] Bluetooth: hci3: ISO packet too small [ 1062.960511][T16399] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1062.990196][T16399] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1062.999373][T16399] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1063.018110][T16399] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1063.018600][T16399] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1063.125763][T16867] can0: slcan on ttyS3. [ 1063.303908][T16869] can0 (unregistered): slcan off ttyS3. [ 1063.439182][T16878] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=57 sclass=netlink_route_socket pid=16878 comm=syz.4.2909 [ 1063.775083][T16864] rxe_eth0 speed is unknown, defaulting to 1000 [ 1064.605324][T16897] jffs2: notice: (16897) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1064.839738][T16897] jffs2: fork failed for JFFS2 garbage collect thread: -EINTR [ 1065.155060][ T5604] Bluetooth: hci1: command tx timeout [ 1065.254708][T16904] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2918'. [ 1065.254750][T16904] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 1065.611939][T16548] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 1065.782419][T16548] usb 3-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 1065.786122][T16548] usb 3-1: config 1 has an invalid interface number: 3 but max is 0 [ 1065.786151][T16548] usb 3-1: config 1 has no interface number 0 [ 1065.827328][T16548] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1065.827363][T16548] usb 3-1: Product: syz [ 1065.827404][T16548] usb 3-1: Manufacturer: syz [ 1065.827441][T16548] usb 3-1: SerialNumber: syz [ 1066.005354][T16548] usb 3-1: 3:0 : does not exist [ 1066.005375][T16548] usb 3-1: 3:0 : does not exist [ 1067.211660][ T5604] Bluetooth: hci1: command tx timeout [ 1068.067501][T16548] usb 3-1: USB disconnect, device number 19 [ 1068.329464][T13683] infiniband s`z1: ib_query_port failed (-19) [ 1068.355783][ T12] smbdirect: ib_dev[s`z1] removed [ 1068.435062][ T5604] Bluetooth: hci0: ISO packet too small [ 1068.657899][T16864] bridge0: port 1(bridge_slave_0) entered blocking state [ 1068.659521][T16864] bridge0: port 1(bridge_slave_0) entered disabled state [ 1068.659810][T16864] bridge_slave_0: entered allmulticast mode [ 1068.664716][T16864] bridge_slave_0: entered promiscuous mode [ 1068.666829][T16864] bridge0: port 2(bridge_slave_1) entered blocking state [ 1068.668233][T16864] bridge0: port 2(bridge_slave_1) entered disabled state [ 1068.668487][T16864] bridge_slave_1: entered allmulticast mode [ 1068.674582][T16864] bridge_slave_1: entered promiscuous mode [ 1068.754933][T16864] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1068.764551][T16864] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1068.828444][T16864] team0: Port device team_slave_0 added [ 1068.832682][T16864] team0: Port device team_slave_1 added [ 1068.898768][T16864] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1068.898785][T16864] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1068.898806][T16864] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1068.956868][T16864] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1068.956884][T16864] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1068.956904][T16864] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1069.864322][ T5604] Bluetooth: hci1: command tx timeout [ 1069.980912][T16864] hsr_slave_0: entered promiscuous mode [ 1070.067809][T16864] hsr_slave_1: entered promiscuous mode [ 1070.068406][T16864] debugfs: 'hsr0' already exists in 'hsr' [ 1070.068424][T16864] Cannot create hsr debugfs directory [ 1071.365123][T16972] trusted_key: encrypted_key: insufficient parameters specified [ 1071.851236][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1071.931383][ T5604] Bluetooth: hci1: command tx timeout [ 1072.051547][T16864] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1072.641218][T16548] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 1072.735146][T16864] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1072.792878][T16548] usb 4-1: New USB device found, idVendor=056a, idProduct=033b, bcdDevice= 0.00 [ 1072.794921][T16548] usb 4-1: config 0 has no interfaces? [ 1072.794941][T16548] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1072.797514][T16548] usb 4-1: config 0 descriptor?? [ 1072.954376][T16864] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1073.017988][T13683] usb 4-1: USB disconnect, device number 79 [ 1073.053987][T16983] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=57 sclass=netlink_route_socket pid=16983 comm=syz.2.2937 [ 1073.152588][T16864] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1073.282437][ T5604] Bluetooth: hci0: ISO packet too small [ 1073.359214][ T30] audit: type=1800 audit(1792297721.453:1825): pid=16990 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.1.2939" name="nullb0" dev="tmpfs" ino=1548 res=0 errno=0 [ 1073.421669][T16864] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1073.426137][T16864] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1073.426962][T16864] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1073.453853][T16864] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1073.454524][T16864] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1073.460743][T16864] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1073.468461][T16864] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1073.488845][T16864] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1074.431017][T17010] tipc: Cannot configure node identity twice [ 1074.673320][T16864] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1074.696974][T16864] 8021q: adding VLAN 0 to HW filter on device team0 [ 1074.717560][ T3930] bridge0: port 1(bridge_slave_0) entered blocking state [ 1074.717646][ T3930] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1074.752662][ T3930] bridge0: port 2(bridge_slave_1) entered blocking state [ 1074.752743][ T3930] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1075.521156][ T5803] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 1075.792835][ T5803] usb 4-1: New USB device found, idVendor=04d8, idProduct=0083, bcdDevice=da.47 [ 1075.795205][ T5803] usb 4-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 1075.795242][ T5803] usb 4-1: config 2 has 0 interfaces, different from the descriptor's value: 1 [ 1075.800283][ T5803] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1075.800333][ T5803] usb 4-1: Product: syz [ 1075.800379][ T5803] usb 4-1: Manufacturer: syz [ 1075.800422][ T5803] usb 4-1: SerialNumber: syz [ 1075.812364][ T24] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 1076.001220][ T24] usb 3-1: device descriptor read/64, error -71 [ 1076.033181][T17025] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2945'. [ 1076.054485][ T5803] usb 4-1: USB disconnect, device number 80 [ 1076.241759][ T24] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 1076.361838][T16864] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1076.391049][ T24] usb 3-1: device descriptor read/64, error -71 [ 1076.496172][T16864] veth0_vlan: entered promiscuous mode [ 1076.507153][ T24] usb usb3-port1: attempt power cycle [ 1076.525125][T16864] veth1_vlan: entered promiscuous mode [ 1076.612724][T16864] veth0_macvtap: entered promiscuous mode [ 1076.626387][T16864] veth1_macvtap: entered promiscuous mode [ 1076.669843][T16864] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1076.694283][T16864] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1076.762072][ T5857] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1076.762114][ T5857] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1076.762145][ T5857] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1076.762176][ T5857] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1076.851052][ T24] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 1076.884319][ T24] usb 3-1: device descriptor read/8, error -71 [ 1077.009750][ T311] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1077.009770][ T311] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1077.095600][ T8983] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1077.095618][ T8983] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1077.246954][ T24] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 1077.261517][ T24] usb 3-1: device descriptor read/8, error -71 [ 1077.371365][ T24] usb usb3-port1: unable to enumerate USB device [ 1077.918934][T17069] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=57 sclass=netlink_route_socket pid=17069 comm=syz.0.2953 [ 1078.076432][T16399] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1078.079900][T16399] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1078.098512][T16399] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1078.108272][T16399] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1078.108773][T16399] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1079.147199][T17096] overlayfs: conflicting options: metacopy=on,redirect_dir=follow [ 1079.761938][T17073] rxe_eth0 speed is unknown, defaulting to 1000 [ 1080.171376][T16399] Bluetooth: hci2: command tx timeout [ 1080.579530][T17129] trusted_key: encrypted_key: master key parameter 'Z pxYlO\qT&abGg\V\]daXYQ?K!ky' is invalid [ 1081.005474][ T8983] bridge_slave_1: left allmulticast mode [ 1081.007285][ T8983] bridge0: port 2(bridge_slave_1) entered disabled state [ 1081.029370][ T8983] bridge_slave_0: left allmulticast mode [ 1081.032043][ T8983] bridge0: port 1(bridge_slave_0) entered disabled state [ 1081.718400][T17139] jffs2: notice: (17139) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1081.910327][T17139] jffs2: fork failed for JFFS2 garbage collect thread: -EINTR [ 1082.322259][T16399] Bluetooth: hci2: command tx timeout [ 1082.634138][ T30] audit: type=1400 audit(1792297730.733:1826): avc: denied { write } for pid=17126 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1082.714510][T17152] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2968'. [ 1082.775824][ T30] audit: type=1400 audit(1792297730.873:1827): avc: denied { write } for pid=17153 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1082.930848][ T8983] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1082.942625][ T8983] bond0 (unregistering): Released all slaves [ 1082.947852][ T8983] bond1 (unregistering): Released all slaves [ 1082.974914][ T8983] bond2 (unregistering): Released all slaves [ 1083.005416][ T8983] bond3 (unregistering): Released all slaves [ 1083.123558][ T8983] bond4 (unregistering): Released all slaves [ 1083.150925][ T8983] bond5 (unregistering): Released all slaves [ 1083.171883][ T8983] bond6 (unregistering): Released all slaves [ 1083.658404][ T8983] bond7 (unregistering): (slave wireguard0): Releasing backup interface [ 1083.659439][ T8983] bond7 (unregistering): Released all slaves [ 1083.684175][ T8983] bond8 (unregistering): Released all slaves [ 1083.708641][ T8983] bond9 (unregistering): (slave veth0_virt_wifi): Releasing active interface [ 1083.722121][ T8983] bond9 (unregistering): Released all slaves [ 1084.008018][ T5265] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1084.331157][T16399] Bluetooth: hci2: command tx timeout [ 1084.694273][T17163] ALSA: mixer_oss: invalid OSS volume '' [ 1085.029178][ T8983] tipc: Left network mode [ 1085.181098][ T5803] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 1085.331169][ T5803] usb 4-1: Using ep0 maxpacket: 16 [ 1085.331890][ T5803] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1085.332750][ T5803] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1085.332775][ T5803] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1085.332796][ T5803] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1085.332830][ T5803] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1085.403227][ T5803] usb 4-1: config 0 descriptor?? [ 1085.785824][T17196] jffs2: notice: (17196) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1086.277339][T17196] jffs2: fork failed for JFFS2 garbage collect thread: -EINTR [ 1086.524839][T16399] Bluetooth: hci2: command tx timeout [ 1089.732940][ T30] audit: type=1400 audit(1792297737.833:1828): avc: denied { write } for pid=17186 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1089.769782][ T5803] usbhid 4-1:0.0: can't add hid device: -71 [ 1089.769834][ T5803] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1089.787140][ T5803] usb 4-1: USB disconnect, device number 81 [ 1090.018215][T17073] bridge0: port 1(bridge_slave_0) entered blocking state [ 1090.019899][T17073] bridge0: port 1(bridge_slave_0) entered disabled state [ 1090.020000][T17073] bridge_slave_0: entered allmulticast mode [ 1090.041504][T17073] bridge_slave_0: entered promiscuous mode [ 1090.115632][ T30] audit: type=1400 audit(1792297738.163:1829): avc: denied { write } for pid=17224 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1090.117565][T17073] bridge0: port 2(bridge_slave_1) entered blocking state [ 1090.117636][T17073] bridge0: port 2(bridge_slave_1) entered disabled state [ 1090.117746][T17073] bridge_slave_1: entered allmulticast mode [ 1090.133729][T17073] bridge_slave_1: entered promiscuous mode [ 1090.485210][T17073] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1090.500051][T17073] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1090.500884][ T5265] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1090.510542][T17232] nvme_fabrics: unknown parameter or missing value 'nq' in ctrl creation request [ 1090.588595][T17073] team0: Port device team_slave_0 added [ 1090.656259][T17073] team0: Port device team_slave_1 added [ 1090.755266][T17073] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1090.755281][T17073] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1090.755300][T17073] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1090.762899][T17073] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1090.762911][T17073] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1090.762930][T17073] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1091.157601][T17073] hsr_slave_0: entered promiscuous mode [ 1091.158364][T17073] hsr_slave_1: entered promiscuous mode [ 1091.158867][T17073] debugfs: 'hsr0' already exists in 'hsr' [ 1091.158882][T17073] Cannot create hsr debugfs directory [ 1091.318226][ T30] audit: type=1400 audit(1792297739.413:1830): avc: denied { write } for pid=17236 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1091.383799][ T5336] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 1091.521544][ T5803] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 1091.541981][ T5336] usb 4-1: device descriptor read/64, error -71 [ 1091.693091][ T30] audit: type=1400 audit(1792297739.783:1831): avc: denied { write } for pid=17264 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1091.821237][ T5336] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 1091.951122][ T5336] usb 4-1: device descriptor read/64, error -71 [ 1092.068873][ T5336] usb usb4-port1: attempt power cycle [ 1092.121642][ T5803] usb 1-1: Using ep0 maxpacket: 8 [ 1092.123513][ T5803] usb 1-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 1092.124395][ T5803] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1092.124420][ T5803] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1092.124449][ T5803] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1092.127109][ T5803] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1092.127129][ T5803] usb 1-1: Product: syz [ 1092.127143][ T5803] usb 1-1: Manufacturer: syz [ 1092.127156][ T5803] usb 1-1: SerialNumber: syz [ 1092.133866][ T5803] usb 1-1: config 0 descriptor?? [ 1092.134381][T17251] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 1092.188929][T17271] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2988'. [ 1092.297998][ T5803] rc_core: IR keymap rc-streamzap not found [ 1092.298015][ T5803] Registered IR keymap rc-empty [ 1092.298862][ T5803] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 1092.304971][ T5803] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input24 [ 1092.635541][ T5336] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 1092.651586][ T5336] usb 4-1: device descriptor read/8, error -71 [ 1092.682363][ T5265] 8021q: adding VLAN 0 to HW filter on device eth3 [ 1092.868132][T17280] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2989'. [ 1092.901504][ T5336] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 1092.921661][ T5336] usb 4-1: device descriptor read/8, error -71 [ 1093.031252][ T5336] usb usb4-port1: unable to enumerate USB device [ 1094.002805][ T30] audit: type=1400 audit(1792297742.103:1832): avc: denied { write } for pid=17287 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1094.064402][ T5803] usb 1-1: USB disconnect, device number 6 [ 1094.080609][ T8983] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1094.103035][ T8983] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1094.186946][ T30] audit: type=1400 audit(1792297742.283:1833): avc: denied { write } for pid=17300 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1095.114666][T17308] nvme_fabrics: unknown parameter or missing value 'transport' in ctrl creation request [ 1095.440357][T16399] Bluetooth: hci0: unexpected event for opcode 0x0c2d [ 1096.159788][ T8983] team0 (unregistering): Port device team_slave_1 removed [ 1096.185768][ T8983] team0 (unregistering): Port device team_slave_0 removed [ 1096.460915][T17311] tipc: Started in network mode [ 1096.460936][T17311] tipc: Node identity 2, cluster identity 7 [ 1096.460946][T17311] tipc: Node number set to 2 [ 1096.546336][T17325] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1096.562177][T17325] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1096.581388][T17325] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1096.582264][T17325] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1096.761254][ T5336] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 1096.911268][ T5336] usb 3-1: device descriptor read/64, error -71 [ 1097.151259][ T5336] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 1097.182133][ T30] audit: type=1400 audit(1792297745.283:1834): avc: denied { write } for pid=17328 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1097.281869][ T5336] usb 3-1: device descriptor read/64, error -71 [ 1097.285656][T17344] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 1097.285676][T17344] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 1097.285688][T17344] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 1097.391702][ T5336] usb usb3-port1: attempt power cycle [ 1097.397082][ T30] audit: type=1400 audit(1792297745.493:1835): avc: denied { write } for pid=17351 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1097.568226][ T8983] IPVS: stop unused estimator thread 0... [ 1097.582890][T17354] Bluetooth: MGMT ver 1.23 [ 1097.741740][ T5336] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 1097.771623][ T5336] usb 3-1: device descriptor read/8, error -71 [ 1097.819013][T17073] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1097.839882][T17073] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1097.843229][T17073] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1097.889170][T17073] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1097.893062][T17073] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1097.914651][T17073] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1097.918233][T17073] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1097.928762][ T30] audit: type=1400 audit(1792297746.013:1836): avc: denied { write } for pid=17355 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1097.974867][T17073] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1098.021081][ T5336] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 1098.051549][ T5336] usb 3-1: device descriptor read/8, error -71 [ 1098.078184][ T30] audit: type=1400 audit(1792297746.173:1837): avc: denied { write } for pid=17374 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1098.173164][ T5336] usb usb3-port1: unable to enumerate USB device [ 1098.257052][T17073] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1098.316998][T17073] 8021q: adding VLAN 0 to HW filter on device team0 [ 1098.334889][ T8983] bridge0: port 1(bridge_slave_0) entered blocking state [ 1098.334972][ T8983] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1098.360793][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 1098.360882][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1098.540757][ T30] audit: type=1400 audit(1792297746.633:1838): avc: denied { read } for pid=17387 comm="syz.1.3007" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 1098.753323][ T30] audit: type=1400 audit(1792297746.853:1839): avc: denied { write } for pid=17379 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1098.829795][T16399] Bluetooth: hci3: unexpected event for opcode 0x080c [ 1099.022872][ T30] audit: type=1400 audit(1792297747.123:1840): avc: denied { write } for pid=17402 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1100.405785][T17415] binder: 17408:17415 ioctl c0502100 200000000340 returned -22 [ 1100.406419][T17415] binder: 17408:17415 ioctl 40406f06 200000000080 returned -22 [ 1102.007925][T17073] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1102.700158][ T30] audit: type=1400 audit(1792297750.793:1841): avc: denied { write } for pid=17422 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1103.063429][T17073] veth0_vlan: entered promiscuous mode [ 1103.097743][T17073] veth1_vlan: entered promiscuous mode [ 1103.114002][ T30] audit: type=1400 audit(1792297751.213:1842): avc: denied { write } for pid=17462 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1103.245339][T17073] veth0_macvtap: entered promiscuous mode [ 1103.262011][T17073] veth1_macvtap: entered promiscuous mode [ 1103.330360][T17073] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1103.343140][T17073] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1103.462699][ T29] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 1103.511653][T15262] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 1103.552337][T17474] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3019'. [ 1104.151092][ T29] usb 3-1: Using ep0 maxpacket: 8 [ 1104.151193][T15262] usb 1-1: Using ep0 maxpacket: 32 [ 1104.151746][ T29] usb 3-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 1104.263341][ T29] usb 3-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 1104.263386][ T29] usb 3-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 1104.263437][ T29] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1104.263462][ T29] usb 3-1: config 168 interface 0 altsetting 188 has 1 endpoint descriptor, different from the interface descriptor's value: 100 [ 1104.263487][ T29] usb 3-1: config 168 interface 0 has no altsetting 0 [ 1104.285863][T15262] usb 1-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 1104.285993][ T29] usb 3-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 1104.286019][ T29] usb 3-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 1104.286048][ T29] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1104.286121][ T29] usb 3-1: config 168 interface 0 altsetting 188 has 1 endpoint descriptor, different from the interface descriptor's value: 100 [ 1104.286145][ T29] usb 3-1: config 168 interface 0 has no altsetting 0 [ 1104.297462][ T29] usb 3-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 1104.297490][ T29] usb 3-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 1104.297519][ T29] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1104.297543][ T29] usb 3-1: config 168 interface 0 altsetting 188 has 1 endpoint descriptor, different from the interface descriptor's value: 100 [ 1104.297565][ T29] usb 3-1: config 168 interface 0 has no altsetting 0 [ 1104.335284][ T29] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1104.335304][ T29] usb 3-1: Product: syz [ 1104.335317][ T29] usb 3-1: Manufacturer: syz [ 1104.335330][ T29] usb 3-1: SerialNumber: syz [ 1104.339931][T15262] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1104.339951][T15262] usb 1-1: Product: syz [ 1104.339964][T15262] usb 1-1: Manufacturer: syz [ 1104.339976][T15262] usb 1-1: SerialNumber: syz [ 1104.348185][T15262] usb 1-1: config 0 descriptor?? [ 1104.394426][T15262] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 1104.667969][ T29] adutux 3-1:168.0: interrupt endpoints not found [ 1104.690348][ T30] audit: type=1400 audit(1792297752.773:1843): avc: denied { map } for pid=17488 comm="syz.3.3021" path="/dev/video7" dev="devtmpfs" ino=950 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 1104.690398][ T30] audit: type=1400 audit(1792297752.773:1844): avc: denied { execute } for pid=17488 comm="syz.3.3021" path="/dev/video7" dev="devtmpfs" ino=950 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 1104.739513][ T29] usb 3-1: USB disconnect, device number 28 [ 1104.802247][ T8983] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1104.803271][ T8983] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1104.803309][ T8983] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1104.803337][ T8983] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1104.846020][T15262] gspca_ov534_9: reg_w failed -71 [ 1104.877481][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1104.877501][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1104.995887][ T30] audit: type=1400 audit(1792297753.093:1845): avc: denied { write } for pid=17472 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1105.066184][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1105.071968][ T30] audit: type=1400 audit(1792297753.173:1846): avc: denied { write } for pid=17498 comm="syz.3.3022" name="loop5" dev="devtmpfs" ino=650 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1105.072971][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1105.312056][T15262] gspca_ov534_9: Unknown sensor 0000 [ 1105.312124][T15262] ov534_9 1-1:0.0: probe with driver ov534_9 failed with error -22 [ 1105.315588][ T30] audit: type=1400 audit(1792297753.413:1847): avc: denied { write } for pid=17501 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1105.320800][T15262] usb 1-1: USB disconnect, device number 7 [ 1105.523713][T17508] FAULT_INJECTION: forcing a failure. [ 1105.523713][T17508] name failslab, interval 1, probability 0, space 0, times 0 [ 1105.523746][T17508] CPU: 0 UID: 0 PID: 17508 Comm: syz.0.3026 Tainted: G L syzkaller #0 PREEMPT(full) [ 1105.523782][T17508] Tainted: [L]=SOFTLOCKUP [ 1105.523790][T17508] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1105.523801][T17508] Call Trace: [ 1105.523808][T17508] [ 1105.523817][T17508] dump_stack_lvl+0x100/0x190 [ 1105.523852][T17508] should_fail_ex.cold+0x5/0xa [ 1105.523880][T17508] should_failslab+0xc2/0x120 [ 1105.523910][T17508] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 1105.523935][T17508] ? __d_alloc+0x35/0xa50 [ 1105.523957][T17508] __d_alloc+0x35/0xa50 [ 1105.523978][T17508] d_alloc+0x4a/0x1e0 [ 1105.523998][T17508] lookup_one_qstr_excl+0x171/0x250 [ 1105.524023][T17508] start_dirop+0x59/0xb0 [ 1105.524050][T17508] simple_start_creating+0xf9/0x110 [ 1105.524078][T17508] ? __pfx_simple_start_creating+0x10/0x10 [ 1105.524107][T17508] ? mntput+0x70/0xa0 [ 1105.524134][T17508] ? simple_pin_fs+0xa3/0x190 [ 1105.524162][T17508] debugfs_start_creating.part.0+0x7b/0x150 [ 1105.524189][T17508] debugfs_create_symlink+0x84/0x220 [ 1105.524216][T17508] drm_debugfs_clients_add+0x199/0x210 [ 1105.524240][T17508] drm_file_alloc+0x5c6/0xb40 [ 1105.524267][T17508] drm_open_helper+0x1fc/0x540 [ 1105.524293][T17508] drm_open+0x1a0/0x3e0 [ 1105.524315][T17508] ? __pfx_drm_open+0x10/0x10 [ 1105.524337][T17508] drm_stub_open+0x20f/0x380 [ 1105.524360][T17508] ? __pfx_drm_stub_open+0x10/0x10 [ 1105.524382][T17508] chrdev_open+0x234/0x6a0 [ 1105.524411][T17508] ? __pfx_chrdev_open+0x10/0x10 [ 1105.524440][T17508] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 1105.524470][T17508] do_dentry_open+0x6ab/0x14d0 [ 1105.524495][T17508] ? __pfx_chrdev_open+0x10/0x10 [ 1105.524529][T17508] vfs_open+0x82/0x3f0 [ 1105.524563][T17508] path_openat+0x1a23/0x2450 [ 1105.524596][T17508] ? __pfx_path_openat+0x10/0x10 [ 1105.524632][T17508] do_file_open+0x20e/0x430 [ 1105.524663][T17508] ? __pfx_do_file_open+0x10/0x10 [ 1105.524714][T17508] ? _raw_spin_unlock+0x28/0x50 [ 1105.524740][T17508] ? alloc_fd+0x471/0x7a0 [ 1105.524782][T17508] do_sys_openat2+0x10f/0x1e0 [ 1105.524803][T17508] ? __pfx_do_sys_openat2+0x10/0x10 [ 1105.524821][T17508] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 1105.524860][T17508] __x64_sys_openat+0x12d/0x210 [ 1105.524881][T17508] ? __pfx___x64_sys_openat+0x10/0x10 [ 1105.524912][T17508] do_syscall_64+0x123/0x790 [ 1105.524945][T17508] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1105.524966][T17508] RIP: 0033:0x7f8756b5ed8e [ 1105.524983][T17508] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1105.525002][T17508] RSP: 002b:00007f8757b43b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1105.525021][T17508] RAX: ffffffffffffffda RBX: 00007f8757b446c0 RCX: 00007f8756b5ed8e [ 1105.525034][T17508] RDX: 0000000000040000 RSI: 00007f8757b43c00 RDI: ffffffffffffff9c [ 1105.525047][T17508] RBP: 00007f8757b43c00 R08: 0000000000000000 R09: 0000000000000000 [ 1105.525059][T17508] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 1105.525071][T17508] R13: 00007f8756e26038 R14: 00007f8756e25fa0 R15: 00007ffef90c62a8 [ 1105.525099][T17508] [ 1105.630792][T17505] 9pnet: p9_errstr2errno: server reported unknown error 0000000 [ 1105.964144][T17519] ip_tables: iptables: counters copy to user failed while replacing table [ 1105.990447][T17518] IPv6: NLM_F_CREATE should be specified when creating new route [ 1106.063125][T16399] Bluetooth: hci2: ISO packet too small [ 1106.892939][ T30] audit: type=1400 audit(1792297754.993:1848): avc: denied { write } for pid=17516 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1107.000542][ T5604] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1107.003873][ T5604] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1107.012754][ T5604] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1107.221593][ T5604] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1107.232266][ T5604] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1107.657071][ T30] audit: type=1400 audit(1792297755.753:1849): avc: denied { read } for pid=17535 comm="syz.3.3029" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 1107.699815][ T30] audit: type=1400 audit(1792297755.763:1850): avc: denied { open } for pid=17535 comm="syz.3.3029" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 1107.815248][ T30] audit: type=1400 audit(1792297755.913:1851): avc: denied { write } for pid=17549 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1108.739294][T17550] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1108.742120][T17541] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 1108.743215][T17550] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 1108.929289][T17540] rxe_eth0 speed is unknown, defaulting to 1000 [ 1109.002380][T17550] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1109.003607][T17550] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 1109.070609][T17550] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 1109.126215][T17550] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1109.126271][T17550] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 1109.159871][T17550] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 1109.289115][T17550] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1109.289857][T17550] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 1109.291183][ T5604] Bluetooth: hci4: command tx timeout [ 1109.331880][ T30] audit: type=1400 audit(1792297757.433:1852): avc: denied { write } for pid=17560 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1109.337061][T17550] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 1109.375989][T17550] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1109.376045][T17550] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 1109.412280][T17550] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 1109.587565][ T30] audit: type=1400 audit(1792297757.683:1853): avc: denied { write } for pid=17575 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1109.694039][ T5803] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 1110.050806][T17582] jffs2: notice: (17582) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1110.551397][T17582] jffs2: fork failed for JFFS2 garbage collect thread: -EINTR [ 1110.674339][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 [ 1110.685742][ T5803] usb 1-1: New USB device found, idVendor=0471, idProduct=081e, bcdDevice= 1.00 [ 1110.686579][ T5803] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1110.686599][ T5803] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 1110.686628][ T5803] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1110.766364][ T5803] spcp8x5 1-1:1.0: SPCP8x5 converter detected [ 1110.803270][ T5803] usb 1-1: SPCP8x5 converter now attached to ttyUSB0 [ 1111.032033][T17594] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3031'. [ 1111.052140][ T5604] Bluetooth: hci5: command 0x0c1a tx timeout [ 1111.131281][ T5604] Bluetooth: hci1: command 0x0c1a tx timeout [ 1111.287871][ T59] IPVS: starting estimator thread 0... [ 1111.301948][ T5604] Bluetooth: hci2: command 0x0c1a tx timeout [ 1111.413727][ T5803] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 1111.418558][T17597] IPVS: using max 42 ests per chain, 100800 per kthread [ 1111.452979][ T5604] Bluetooth: hci4: command 0x040f tx timeout [ 1111.561800][ T5803] usb 5-1: Using ep0 maxpacket: 16 [ 1111.562990][ T5803] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1111.584602][ T5803] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 1111.603222][ T5803] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1111.603256][ T5803] usb 5-1: Product: syz [ 1111.603297][ T5803] usb 5-1: Manufacturer: syz [ 1111.603335][ T5803] usb 5-1: SerialNumber: syz [ 1111.695039][ T5803] usb 5-1: config 0 descriptor?? [ 1111.782775][ T5803] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1111.782816][ T5803] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 1111.901442][ T30] audit: type=1400 audit(1792297759.993:1854): avc: denied { write } for pid=17581 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1112.204912][ T5803] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 1112.490040][T17606] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1112.490267][T17606] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1112.526780][T16547] usb 1-1: USB disconnect, device number 8 [ 1112.547338][ T5803] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 1112.547376][ T5803] em28xx 5-1:0.0: board has no eeprom [ 1112.578821][T16547] SPCP8x5 ttyUSB0: SPCP8x5 converter now disconnected from ttyUSB0 [ 1112.579137][T16547] spcp8x5 1-1:1.0: device disconnected [ 1112.631065][ T30] audit: type=1400 audit(1792297760.723:1855): avc: denied { write } for pid=17608 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1112.634223][ T149] netdevsim netdevsim1 netdevsim1 (unregistering): left allmulticast mode [ 1112.726655][ T5803] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 1112.726684][ T5803] em28xx 5-1:0.0: dvb set to bulk mode. [ 1112.729226][ T10] em28xx 5-1:0.0: Binding DVB extension [ 1113.131062][ T5604] Bluetooth: hci5: command 0x0c1a tx timeout [ 1113.151747][T15262] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 1113.211631][ T5604] Bluetooth: hci1: command 0x0c1a tx timeout [ 1113.311179][T15262] usb 1-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1113.353597][T15262] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1113.371147][ T5604] Bluetooth: hci2: command 0x0c1a tx timeout [ 1113.490540][T15262] usb 1-1: config 0 descriptor?? [ 1113.531056][ T5604] Bluetooth: hci4: command 0x040f tx timeout [ 1113.711557][T15262] udl 1-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 1114.920883][T15679] usb 5-1: USB disconnect, device number 11 [ 1115.035825][T15679] em28xx 5-1:0.0: Disconnecting em28xx [ 1115.131659][ T10] em28xx 5-1:0.0: Registering input extension [ 1115.136285][T15679] em28xx 5-1:0.0: Closing input extension [ 1115.212320][ T5604] Bluetooth: hci5: command 0x0c1a tx timeout [ 1115.254988][T15262] [drm] Initialized udl 0.0.1 for 1-1:0.0 on minor 1 [ 1115.255014][T15262] [drm] Initialized udl on minor 1 [ 1115.292651][ T5604] Bluetooth: hci1: command 0x0c1a tx timeout [ 1115.296165][ C1] raw-gadget.0 gadget.0: ignoring, device is not running [ 1115.323721][T15262] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffe0 [ 1115.348654][T15262] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 1115.368055][T15262] usb 1-1: USB disconnect, device number 9 [ 1115.384607][T15679] em28xx: Freeing device [ 1115.451615][ T5604] Bluetooth: hci2: command 0x0c1a tx timeout [ 1115.612531][ T5604] Bluetooth: hci4: command 0x040f tx timeout [ 1115.726486][T17615] FAULT_INJECTION: forcing a failure. [ 1115.726486][T17615] name failslab, interval 1, probability 0, space 0, times 0 [ 1115.726510][T17615] CPU: 0 UID: 0 PID: 17615 Comm: syz.3.3033 Tainted: G L syzkaller #0 PREEMPT(full) [ 1115.726526][T17615] Tainted: [L]=SOFTLOCKUP [ 1115.726531][T17615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1115.726538][T17615] Call Trace: [ 1115.726543][T17615] [ 1115.726548][T17615] dump_stack_lvl+0x100/0x190 [ 1115.726585][T17615] should_fail_ex.cold+0x5/0xa [ 1115.726603][T17615] should_failslab+0xc2/0x120 [ 1115.726622][T17615] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 1115.726639][T17615] ? __d_alloc+0x35/0xa50 [ 1115.726654][T17615] __d_alloc+0x35/0xa50 [ 1115.726665][T17615] ? __lock_acquire+0x5c0/0x1f40 [ 1115.726686][T17615] d_alloc_parallel+0x105/0x14c0 [ 1115.726705][T17615] ? lock_acquire+0x1d1/0x380 [ 1115.726719][T17615] ? lookup_slow+0x42/0x70 [ 1115.726731][T17615] ? __pfx_d_alloc_parallel+0x10/0x10 [ 1115.726747][T17615] ? __pfx___might_resched+0x10/0x10 [ 1115.726760][T17615] ? find_held_lock+0x2b/0x80 [ 1115.726777][T17615] ? __d_lookup+0x25c/0x4a0 [ 1115.726793][T17615] ? down_read+0x13b/0x4c0 [ 1115.726805][T17615] ? __pfx_down_read+0x10/0x10 [ 1115.726817][T17615] __lookup_slow+0x98/0x320 [ 1115.726831][T17615] lookup_slow+0x50/0x70 [ 1115.726843][T17615] lookup_noperm_positive_unlocked+0xd5/0x110 [ 1115.726861][T17615] debugfs_lookup+0xc7/0x150 [ 1115.726877][T17615] kvm_dev_ioctl+0xfdc/0x1b50 [ 1115.726896][T17615] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 1115.726913][T17615] ? selinux_file_ioctl+0x13b/0x290 [ 1115.726929][T17615] ? selinux_file_ioctl+0xb6/0x290 [ 1115.726946][T17615] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 1115.726961][T17615] __x64_sys_ioctl+0x18e/0x210 [ 1115.726976][T17615] do_syscall_64+0x123/0x790 [ 1115.726994][T17615] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1115.727008][T17615] RIP: 0033:0x7f339899e559 [ 1115.727018][T17615] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1115.727029][T17615] RSP: 002b:00007f3399924028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1115.727041][T17615] RAX: ffffffffffffffda RBX: 00007f3398c25fa0 RCX: 00007f339899e559 [ 1115.727048][T17615] RDX: 0000000000000000 RSI: 000000000000ae01 RDI: 0000000000000006 [ 1115.727055][T17615] RBP: 00007f3398a35ab8 R08: 0000000000000000 R09: 0000000000000000 [ 1115.727061][T17615] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1115.727068][T17615] R13: 00007f3398c26038 R14: 00007f3398c25fa0 R15: 00007ffe80daed68 [ 1115.727083][T17615] [ 1115.951062][ T10] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 1116.060803][T17540] bridge0: port 1(bridge_slave_0) entered blocking state [ 1116.060881][T17540] bridge0: port 1(bridge_slave_0) entered disabled state [ 1116.063451][T17540] bridge_slave_0: entered allmulticast mode [ 1116.073628][T17540] bridge_slave_0: entered promiscuous mode [ 1116.107686][T17540] bridge0: port 2(bridge_slave_1) entered blocking state [ 1116.107772][T17540] bridge0: port 2(bridge_slave_1) entered disabled state [ 1116.107874][T17540] bridge_slave_1: entered allmulticast mode [ 1116.114990][T17540] bridge_slave_1: entered promiscuous mode [ 1116.148055][T17634] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1116.159055][ T30] audit: type=1400 audit(1792297764.253:1856): avc: denied { write } for pid=17619 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1116.162037][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 1116.162569][ T10] usb 5-1: New USB device found, idVendor=0eef, idProduct=72d0, bcdDevice= 0.00 [ 1116.205719][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1116.205752][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1116.205773][ T10] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 7 [ 1116.205809][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1116.210911][ T10] usb 5-1: config 0 descriptor?? [ 1116.269058][ T10] usbhid 5-1:0.0: fixing wrong optional hid class descriptors count [ 1116.269072][ T10] usbhid 5-1:0.0: can't add hid device: -22 [ 1116.269111][ T10] usbhid 5-1:0.0: probe with driver usbhid failed with error -22 [ 1116.350435][ T149] bridge_slave_1: left allmulticast mode [ 1116.350651][ T149] bridge0: port 2(bridge_slave_1) entered disabled state [ 1116.379345][ T149] bridge_slave_0: left allmulticast mode [ 1116.379507][ T149] bridge0: port 1(bridge_slave_0) entered disabled state [ 1116.861383][ T30] audit: type=1400 audit(1792297764.933:1857): avc: denied { write } for pid=17646 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1117.678510][ T5604] Bluetooth: hci5: unexpected event for opcode 0x080c [ 1117.691427][ T5604] Bluetooth: hci4: command 0x040f tx timeout [ 1118.576790][ T149] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1118.637390][ T149] bond0 (unregistering): (slave c@0): Releasing backup interface [ 1118.660849][ T149] bond0 (unregistering): Released all slaves [ 1118.677656][ T149] bond1 (unregistering): Released all slaves [ 1118.703899][ T149] bond2 (unregistering): Released all slaves [ 1118.747841][ T149] bond3 (unregistering): (slave veth0_virt_wifi): Releasing active interface [ 1118.766130][T17660] netlink: 'syz.3.3042': attribute type 2 has an invalid length. [ 1118.767091][ T30] audit: type=1400 audit(1792297766.863:1858): avc: denied { connect } for pid=17658 comm="syz.3.3042" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1118.767872][ T30] audit: type=1400 audit(1792297766.863:1859): avc: denied { setopt } for pid=17658 comm="syz.3.3042" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1118.838900][ T149] bond3 (unregistering): Released all slaves [ 1118.913989][T17669] 9pnet_fd: p9_fd_create_unix (17669): problem connecting socket: ./cgroup: -111 [ 1118.936451][T17669] overlay: Unknown parameter 'smackfsdef' [ 1119.137156][T17540] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1119.182261][ T149] tipc: Left network mode [ 1119.194886][T17540] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1119.199092][ T30] audit: type=1400 audit(1792297767.293:1860): avc: denied { write } for pid=17656 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1119.237681][ T5803] usb 5-1: USB disconnect, device number 12 [ 1119.338907][ T30] audit: type=1400 audit(1792297767.433:1861): avc: denied { write } for pid=17676 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1119.502998][T17540] team0: Port device team_slave_0 added [ 1119.523351][T17540] team0: Port device team_slave_1 added [ 1119.677905][T17540] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1119.677923][T17540] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1119.677946][T17540] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1119.683768][T17540] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1119.683782][T17540] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1119.683801][T17540] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1119.771077][ T5604] Bluetooth: hci4: command 0x040f tx timeout [ 1120.068358][T17540] hsr_slave_0: entered promiscuous mode [ 1120.075399][T17540] hsr_slave_1: entered promiscuous mode [ 1120.075850][T17540] debugfs: 'hsr0' already exists in 'hsr' [ 1120.075864][T17540] Cannot create hsr debugfs directory [ 1121.931137][T16399] Bluetooth: hci4: command 0x040f tx timeout [ 1122.035882][T17684] MTD: Attempt to mount non-MTD device "/dev/loop2" [ 1122.113780][T17684] cramfs: wrong magic [ 1122.910158][ T30] audit: type=1400 audit(1792297771.003:1862): avc: denied { write } for pid=17696 comm="syz.0.3047" path="socket:[46523]" dev="sockfs" ino=46523 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 1123.217178][ T30] audit: type=1400 audit(1792297771.313:1863): avc: denied { write } for pid=17686 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1123.520415][ T30] audit: type=1400 audit(1792297771.613:1864): avc: denied { write } for pid=17704 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1123.736992][ T5265] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1123.973652][ T30] audit: type=1400 audit(1792297772.073:1865): avc: denied { listen } for pid=17708 comm="syz.4.3049" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 1124.750186][ T30] audit: type=1400 audit(1792297772.843:1866): avc: denied { setopt } for pid=17713 comm="syz.0.3050" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 1125.017394][ T30] audit: type=1400 audit(1792297773.113:1867): avc: denied { name_bind } for pid=17720 comm="syz.4.3051" src=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=udp_socket permissive=1 [ 1125.216506][T15679] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 1125.861760][T15679] usb 4-1: Using ep0 maxpacket: 32 [ 1125.863167][T15679] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 1125.865556][T15679] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 1125.865585][T15679] usb 4-1: config 0 has no interface number 0 [ 1125.865762][T15679] usb 4-1: config 0 interface 184 has no altsetting 0 [ 1125.871654][T15679] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1125.871674][T15679] usb 4-1: Product: syz [ 1125.871687][T15679] usb 4-1: Manufacturer: syz [ 1125.871699][T15679] usb 4-1: SerialNumber: syz [ 1125.874458][T15679] usb 4-1: config 0 descriptor?? [ 1126.022847][ T149] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1126.445866][T17726] ALSA: mixer_oss: invalid OSS volume '' [ 1126.870321][T17739] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3055'. [ 1126.870366][T17739] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 1127.251409][T15682] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 1127.404155][T15682] usb 3-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 1127.426562][T15682] usb 3-1: config 1 has an invalid interface number: 3 but max is 0 [ 1127.426637][T15682] usb 3-1: config 1 has no interface number 0 [ 1127.463010][T15682] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1127.463140][T15682] usb 3-1: Product: syz [ 1127.463177][T15682] usb 3-1: Manufacturer: syz [ 1127.463285][T15682] usb 3-1: SerialNumber: syz [ 1127.803411][T15682] usb 3-1: 3:0 : does not exist [ 1127.803486][T15682] usb 3-1: 3:0 : does not exist [ 1129.414256][ T149] team0 (unregistering): Port device team_slave_1 removed [ 1129.476425][ T149] team0 (unregistering): Port device team_slave_0 removed [ 1129.495508][T15679] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -71 [ 1129.495683][T15679] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -71 [ 1129.557787][T15679] usb 4-1: USB disconnect, device number 86 [ 1129.608462][ T29] usb 3-1: USB disconnect, device number 29 [ 1131.007674][ T30] audit: type=1400 audit(1792297779.103:1868): avc: denied { append } for pid=17747 comm="syz.4.3058" name="nbd4" dev="devtmpfs" ino=681 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 1131.228578][T17754] jffs2: notice: (17754) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1131.334510][T17418] syz.3.3010 (17418) used greatest stack depth: 18008 bytes left [ 1131.531100][T15679] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 1131.682919][T15679] usb 3-1: Using ep0 maxpacket: 16 [ 1131.685619][T15679] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1131.699310][T15679] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1131.699336][T15679] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1131.699354][T15679] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1131.699386][T15679] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1131.704555][T15679] usb 3-1: config 0 descriptor?? [ 1131.780065][ T149] IPVS: stop unused estimator thread 0... [ 1131.797945][T17775] cgroup: Need name or subsystem set [ 1131.825576][T17540] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1131.873834][T17540] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1131.874697][T17540] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1133.013384][T17783] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3064'. [ 1133.469866][T17540] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1133.639454][ T343] IPVS: starting estimator thread 0... [ 1133.641531][T17540] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1133.710604][T17540] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1133.718454][T17540] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1133.721093][T17786] IPVS: using max 46 ests per chain, 110400 per kthread [ 1133.747238][ T30] audit: type=1400 audit(1792297781.843:1869): avc: denied { write } for pid=17752 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1133.815072][T17540] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1133.985544][T17793] MTD: Attempt to mount non-MTD device "/dev/loop3" [ 1133.986067][T17793] cramfs: wrong magic [ 1135.587172][ T30] audit: type=1400 audit(1792297783.683:1870): avc: denied { write } for pid=17794 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1135.979848][T15679] usbhid 3-1:0.0: can't add hid device: -71 [ 1135.979935][T15679] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1136.018144][T15679] usb 3-1: USB disconnect, device number 30 [ 1136.072422][T17540] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1136.101725][T17540] 8021q: adding VLAN 0 to HW filter on device team0 [ 1136.109199][T17652] bridge0: port 1(bridge_slave_0) entered blocking state [ 1136.109264][T17652] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1136.123043][T17652] bridge0: port 2(bridge_slave_1) entered blocking state [ 1136.123259][T17652] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1136.683645][ T5803] usb 3-1: new full-speed USB device number 31 using dummy_hcd [ 1137.307515][ T30] audit: type=1400 audit(1792297785.403:1871): avc: denied { ioctl } for pid=17817 comm="syz.3.3069" path="socket:[46790]" dev="sockfs" ino=46790 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1138.374432][ T5803] usb 3-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 1138.377677][ T5803] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 1138.377709][ T5803] usb 3-1: can't read configurations, error -71 [ 1138.551238][T17482] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 1138.771868][T17482] usb 4-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 1138.772748][T17482] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 12336, setting to 1024 [ 1138.772775][T17482] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 1024 [ 1138.774434][T17482] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1138.774455][T17482] usb 4-1: Product: syz [ 1138.774468][T17482] usb 4-1: Manufacturer: syz [ 1138.774481][T17482] usb 4-1: SerialNumber: syz [ 1138.777316][T17822] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1139.519136][T17540] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1139.641275][T17848] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3074'. [ 1139.641316][T17848] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 1140.021484][T16548] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 1140.073036][T17482] usb 4-1: failed to send ARPC request 1: -110 [ 1140.073143][T17482] usb 4-1: failed to execute ARPC: -110 [ 1140.073159][T17482] usb 4-1: failed to set connected state for cport 0: -110 [ 1140.073176][T17482] greybus greybus1: 0/0:0: failed to set connected state: -110 [ 1140.170774][T17482] usb 4-1: failed to send ARPC request 3: -32 [ 1140.170844][T17482] usb 4-1: failed to execute ARPC: -32 [ 1140.170854][T17482] usb 4-1: failed to clear cport 0: -32 [ 1140.170864][T17482] greybus greybus1: 0/0:0: failed to clear host cport: -32 [ 1140.213861][T16548] usb 1-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 1140.232964][T16548] usb 1-1: config 1 has an invalid interface number: 3 but max is 0 [ 1140.233024][T16548] usb 1-1: config 1 has no interface number 0 [ 1140.268134][T16548] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1140.268221][T16548] usb 1-1: Product: syz [ 1140.268258][T16548] usb 1-1: Manufacturer: syz [ 1140.268568][T16548] usb 1-1: SerialNumber: syz [ 1140.365270][T17540] veth0_vlan: entered promiscuous mode [ 1140.468410][T16548] usb 1-1: 3:0 : does not exist [ 1140.468654][T16548] usb 1-1: 3:0 : does not exist [ 1140.724275][T17855] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3077'. [ 1140.724467][T17855] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 1140.896545][T17482] es2_ap_driver 4-1:1.0: probe with driver es2_ap_driver failed with error -110 [ 1140.971754][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1141.151208][ T5803] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 1141.301881][ T5803] usb 5-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 1141.305827][ T5803] usb 5-1: config 1 has an invalid interface number: 3 but max is 0 [ 1141.305860][ T5803] usb 5-1: config 1 has no interface number 0 [ 1141.360695][ T5803] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1141.360727][ T5803] usb 5-1: Product: syz [ 1141.360844][ T5803] usb 5-1: Manufacturer: syz [ 1141.372630][ T5803] usb 5-1: SerialNumber: syz [ 1141.415978][T17540] veth1_vlan: entered promiscuous mode [ 1141.898433][ T5803] usb 5-1: 3:0 : does not exist [ 1141.899066][ T5803] usb 5-1: 3:0 : does not exist [ 1142.085825][ T10] usb 4-1: USB disconnect, device number 87 [ 1142.089275][T17540] veth0_macvtap: entered promiscuous mode [ 1142.116895][T17540] veth1_macvtap: entered promiscuous mode [ 1142.131075][T13683] usb 1-1: USB disconnect, device number 10 [ 1142.190158][T17540] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1142.208898][T17540] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1142.236634][ T5803] usb 5-1: USB disconnect, device number 13 [ 1142.242730][ T3307] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1142.242929][ T3307] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1142.242956][ T3307] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1142.242980][ T3307] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1142.365123][T17811] udevd[17811]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.3/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1142.447559][T17811] udevd[17811]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.3/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 1142.699171][ T343] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1142.699216][ T343] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1143.330490][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1143.330519][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1147.250405][T17895] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3089'. [ 1147.250447][T17895] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 1147.601115][T17482] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 1147.761654][T17482] usb 4-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 1147.764353][T17482] usb 4-1: config 1 has an invalid interface number: 3 but max is 0 [ 1147.764381][T17482] usb 4-1: config 1 has no interface number 0 [ 1147.807160][T17482] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1147.807192][T17482] usb 4-1: Product: syz [ 1147.807232][T17482] usb 4-1: Manufacturer: syz [ 1147.807271][T17482] usb 4-1: SerialNumber: syz [ 1147.955303][T15682] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 1148.111526][T15682] usb 1-1: Using ep0 maxpacket: 16 [ 1148.128977][T15682] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1148.185517][T15682] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1148.185614][T15682] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1148.185644][T15682] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1148.186338][T15682] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1148.254392][T17482] usb 4-1: 3:0 : does not exist [ 1148.255352][T17482] usb 4-1: 3:0 : does not exist [ 1148.350759][T15682] usb 1-1: config 0 descriptor?? [ 1149.685609][T17482] usb 4-1: USB disconnect, device number 88 [ 1151.058259][T17903] udevd[17903]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.3/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1151.156197][T15682] usbhid 1-1:0.0: can't add hid device: -71 [ 1151.156281][T15682] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 1151.164955][T15682] usb 1-1: USB disconnect, device number 11 [ 1151.245877][T17920] xt_hashlimit: size too large, truncated to 1048576 [ 1153.541314][ T30] audit: type=1400 audit(1792297801.613:1872): avc: denied { map } for pid=17951 comm="syz.2.3101" path="socket:[49153]" dev="sockfs" ino=49153 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1153.541451][ T30] audit: type=1400 audit(1792297801.613:1873): avc: denied { read } for pid=17951 comm="syz.2.3101" path="socket:[49153]" dev="sockfs" ino=49153 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1154.644088][ T30] audit: type=1400 audit(1792297802.743:1874): avc: denied { accept } for pid=17966 comm="syz.2.3105" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 1154.918848][ T30] audit: type=1400 audit(1792297802.983:1875): avc: denied { lock } for pid=17966 comm="syz.2.3105" path="socket:[49176]" dev="sockfs" ino=49176 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 1155.016294][ T30] audit: type=1400 audit(1792297803.083:1876): avc: denied { ioctl } for pid=17966 comm="syz.2.3105" path="socket:[49180]" dev="sockfs" ino=49180 ioctlcmd=0x586d scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1155.669066][T17978] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3107'. [ 1157.293921][T17969] hub 5-0:1.0: USB hub found [ 1157.298746][T17969] hub 5-0:1.0: 1 port detected [ 1157.513033][T17997] loop4: detected capacity change from 0 to 2640 [ 1157.526899][T17976] Buffer I/O error on dev loop4, logical block 0, async page read [ 1157.527351][T17976] Buffer I/O error on dev loop4, logical block 0, async page read [ 1157.530924][T17976] Buffer I/O error on dev loop4, logical block 0, async page read [ 1157.571159][T15682] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 1157.602378][T17997] Buffer I/O error on dev loop4, logical block 0, lost async page write [ 1157.603970][T17997] Buffer I/O error on dev loop4, logical block 1, lost async page write [ 1157.604012][T17997] Buffer I/O error on dev loop4, logical block 2, lost async page write [ 1157.604031][T17997] Buffer I/O error on dev loop4, logical block 3, lost async page write [ 1157.604059][T17997] Buffer I/O error on dev loop4, logical block 4, lost async page write [ 1157.604078][T17997] Buffer I/O error on dev loop4, logical block 5, lost async page write [ 1157.604097][T17997] Buffer I/O error on dev loop4, logical block 6, lost async page write [ 1157.771306][T15682] usb 5-1: Using ep0 maxpacket: 8 [ 1157.771947][T15682] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1157.774333][T15682] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1157.796276][T15682] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1157.796290][T15682] pvrusb2: ********** [ 1157.796295][T15682] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1157.796305][T15682] pvrusb2: Important functionality might not be entirely working. [ 1157.796311][T15682] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1157.796319][T15682] pvrusb2: ********** [ 1157.988025][ T2354] pvrusb2: Invalid write control endpoint [ 1158.021174][T17482] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 1158.027595][T18011] oom_control is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 1158.138342][ T2354] pvrusb2: Invalid write control endpoint [ 1158.138356][ T2354] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1158.138364][ T2354] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1158.138370][ T2354] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1158.138378][ T2354] pvrusb2: Device being rendered inoperable [ 1158.138405][ T2354] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1158.138440][ T2354] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 1158.139120][ T2354] pvrusb2: Attached sub-driver cx25840 [ 1158.139129][ T2354] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1158.139137][ T2354] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1158.175393][T17482] usb 2-1: New USB device found, idVendor=17ef, idProduct=61ae, bcdDevice= 0.00 [ 1158.179172][T17482] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 252, changing to 11 [ 1158.179205][T17482] usb 2-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1158.179230][T17482] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1158.179259][T17482] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1158.187526][T17482] usb 2-1: config 0 descriptor?? [ 1158.355635][T16548] usb 5-1: USB disconnect, device number 14 [ 1158.693833][T17482] lenovo 0003:17EF:61AE.0009: ignoring exceeding usage max [ 1158.773785][T17482] input: HID 17ef:61ae as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:17EF:61AE.0009/input/input26 [ 1158.832219][T17482] lenovo 0003:17EF:61AE.0009: input,hidraw0: USB HID v0.10 Joystick [HID 17ef:61ae] on usb-dummy_hcd.1-1/input0 [ 1158.866195][T17482] usb 2-1: USB disconnect, device number 18 [ 1158.934582][T18030] fido_id[18030]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 1159.511925][T18041] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3124'. [ 1159.511966][T18041] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 1159.543090][T16548] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 1159.781305][T16548] usb 3-1: Using ep0 maxpacket: 16 [ 1159.937399][T16548] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1159.938485][T16548] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1159.938512][T16548] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1159.938532][T16548] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1159.938567][T16548] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1159.974967][T16548] usb 3-1: config 0 descriptor?? [ 1160.370855][T18048] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3126'. [ 1160.384473][T18048] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 1161.604463][T13683] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 1161.785187][ T5604] Bluetooth: hci3: Opcode 0x1003 failed: -110 [ 1161.861105][T16547] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 1162.281267][T13683] usb 2-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 1162.471821][T13683] usb 2-1: config 1 has an invalid interface number: 3 but max is 0 [ 1162.471855][T13683] usb 2-1: config 1 has no interface number 0 [ 1163.247847][T16547] usb 1-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 1164.513672][T16547] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 1164.514415][T16547] usb 1-1: can't read configurations, error -71 [ 1164.540988][T13683] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1164.548103][T13683] usb 2-1: can't set config #1, error -71 [ 1164.565325][T13683] usb 2-1: USB disconnect, device number 19 [ 1164.650027][T18057] tipc: Started in network mode [ 1164.650046][T18057] tipc: Node identity 2, cluster identity 7 [ 1164.650056][T18057] tipc: Node number set to 2 [ 1164.673804][T16548] usbhid 3-1:0.0: can't add hid device: -71 [ 1164.673894][T16548] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1164.677378][T16548] usb 3-1: USB disconnect, device number 33 [ 1164.878466][T18067] jffs2: notice: (18067) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1164.917306][ T30] audit: type=1400 audit(1792297813.013:1877): avc: denied { write } for pid=18064 comm="syz.0.3130" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 1164.918458][ T30] audit: type=1400 audit(1792297813.013:1878): avc: denied { add_name } for pid=18064 comm="syz.0.3130" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 1164.919804][ T30] audit: type=1400 audit(1792297813.013:1879): avc: denied { create } for pid=18064 comm="syz.0.3130" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 1164.931056][ T30] audit: type=1400 audit(1792297813.023:1880): avc: denied { write open } for pid=18064 comm="syz.0.3130" path="/41/file0/file0" dev="jffs2" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 1164.952628][ T30] audit: type=1400 audit(1792297813.043:1881): avc: denied { write } for pid=18064 comm="syz.0.3130" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 1164.977563][ T30] audit: type=1400 audit(1792297813.073:1882): avc: denied { mounton } for pid=18064 comm="syz.0.3130" path="/41/file0/proc" dev="jffs2" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 1165.405226][ T30] audit: type=1400 audit(1792297813.503:1883): avc: denied { write } for pid=16864 comm="syz-executor" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 1165.422163][ T30] audit: type=1400 audit(1792297813.513:1884): avc: denied { remove_name } for pid=16864 comm="syz-executor" name="proc" dev="jffs2" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 1165.431804][ T30] audit: type=1400 audit(1792297813.533:1885): avc: denied { rmdir } for pid=16864 comm="syz-executor" name="proc" dev="jffs2" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 1165.458319][ T30] audit: type=1400 audit(1792297813.553:1886): avc: denied { write } for pid=16864 comm="syz-executor" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 1165.685301][T16399] Bluetooth: hci1: unexpected event for opcode 0x0c47 [ 1166.127051][T18080] FAULT_INJECTION: forcing a failure. [ 1166.127051][T18080] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1166.127089][T18080] CPU: 0 UID: 0 PID: 18080 Comm: syz.1.3135 Tainted: G L syzkaller #0 PREEMPT(full) [ 1166.127118][T18080] Tainted: [L]=SOFTLOCKUP [ 1166.127126][T18080] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1166.127139][T18080] Call Trace: [ 1166.127146][T18080] [ 1166.127154][T18080] dump_stack_lvl+0x100/0x190 [ 1166.127188][T18080] should_fail_ex.cold+0x5/0xa [ 1166.127216][T18080] _copy_from_user+0x2e/0xd0 [ 1166.127249][T18080] copy_msghdr_from_user+0x9f/0x4c0 [ 1166.127276][T18080] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1166.127305][T18080] ? rcu_is_watching+0x13/0xc0 [ 1166.127334][T18080] ? ___sys_recvmsg+0x177/0x1a0 [ 1166.127357][T18080] ? kfree+0x1e5/0x6d0 [ 1166.127381][T18080] ___sys_recvmsg+0xdd/0x1a0 [ 1166.127407][T18080] ? __pfx____sys_recvmsg+0x10/0x10 [ 1166.127431][T18080] ? lock_acquire+0x1d1/0x380 [ 1166.127468][T18080] ? __pfx___might_resched+0x10/0x10 [ 1166.127493][T18080] do_recvmmsg+0x2f3/0x740 [ 1166.127529][T18080] ? __pfx_do_recvmmsg+0x10/0x10 [ 1166.127560][T18080] ? do_futex+0x190/0x440 [ 1166.127597][T18080] ? __x64_sys_futex+0x34f/0x4d0 [ 1166.127629][T18080] __x64_sys_recvmmsg+0x22a/0x280 [ 1166.127651][T18080] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1166.127679][T18080] do_syscall_64+0x123/0x790 [ 1166.127710][T18080] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1166.127729][T18080] RIP: 0033:0x7fe7adb9e559 [ 1166.127747][T18080] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1166.127766][T18080] RSP: 002b:00007fe7ae9a5028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1166.127787][T18080] RAX: ffffffffffffffda RBX: 00007fe7ade25fa0 RCX: 00007fe7adb9e559 [ 1166.127800][T18080] RDX: 04000000000002ba RSI: 0000200000004040 RDI: 0000000000000005 [ 1166.127812][T18080] RBP: 00007fe7adc35ab8 R08: 0000000000000000 R09: 0000000000000000 [ 1166.127823][T18080] R10: 0000000040000002 R11: 0000000000000246 R12: 0000000000000000 [ 1166.127835][T18080] R13: 00007fe7ade26038 R14: 00007fe7ade25fa0 R15: 00007ffdeb6f5818 [ 1166.127862][T18080] [ 1167.291556][T16547] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 1167.441284][T16547] usb 1-1: Using ep0 maxpacket: 32 [ 1167.442276][T16547] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1167.443202][T16547] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 1167.443241][T16547] usb 1-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 32 [ 1167.443264][T16547] usb 1-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 16 [ 1167.444981][T16547] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1167.445002][T16547] usb 1-1: Product: ᐁ [ 1167.445016][T16547] usb 1-1: Manufacturer: ࡠ [ 1167.445030][T16547] usb 1-1: SerialNumber: syz [ 1167.556589][T16547] cdc_ncm 1-1:1.0: CDC Union missing and no IAD found [ 1167.556645][T16547] cdc_ncm 1-1:1.0: bind() failure [ 1167.608686][T16547] cdc_ncm 1-1:1.1: CDC Union missing and no IAD found [ 1167.608726][T16547] cdc_ncm 1-1:1.1: bind() failure [ 1168.359954][T18110] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3142'. [ 1168.359996][T18110] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 1169.902922][T16547] usb 1-1: USB disconnect, device number 14 [ 1170.808633][T15682] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 1171.697207][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 [ 1172.733409][T18138] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3148'. [ 1172.733480][T18138] netlink: 'syz.0.3148': attribute type 2 has an invalid length. [ 1172.873408][T18139] sctp: [Deprecated]: syz.0.3148 (pid 18139) Use of int in max_burst socket option deprecated. [ 1172.873408][T18139] Use struct sctp_assoc_value instead [ 1173.897465][T18150] Bluetooth: ISO socket layer initialized [ 1174.176158][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 1174.176186][ T30] audit: type=1400 audit(1792297822.223:1888): avc: denied { setattr } for pid=18148 comm="syz.2.3150" name="HCI" dev="sockfs" ino=48751 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1176.129873][T18168] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3157'. [ 1176.129914][T18168] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 1176.557220][T15262] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 1177.751382][T13683] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 1177.782989][T15262] usb 2-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 1177.783836][T15262] usb 2-1: config 1 has an invalid interface number: 3 but max is 0 [ 1177.783860][T15262] usb 2-1: config 1 has no interface number 0 [ 1177.789435][T15262] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1177.789457][T15262] usb 2-1: Product: syz [ 1177.789472][T15262] usb 2-1: Manufacturer: syz [ 1177.789486][T15262] usb 2-1: SerialNumber: syz [ 1177.854520][T15262] usb 2-1: 3:0 : does not exist [ 1177.854535][T15262] usb 2-1: 3:0 : does not exist [ 1177.911610][T13683] usb 1-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice=cc.2f [ 1177.912481][T13683] usb 1-1: config 1 has an invalid interface number: 36 but max is 0 [ 1177.912494][T13683] usb 1-1: config 1 has no interface number 0 [ 1177.912509][T13683] usb 1-1: config 1 interface 36 has no altsetting 0 [ 1177.953110][T13683] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1177.953134][T13683] usb 1-1: Product: syz [ 1177.953148][T13683] usb 1-1: Manufacturer: syz [ 1177.953162][T13683] usb 1-1: SerialNumber: syz [ 1178.105418][T15262] usb 2-1: USB disconnect, device number 20 [ 1178.205683][T13683] redrat3 1-1:1.36: Couldn't find all endpoints [ 1178.209253][T13683] usb 1-1: USB disconnect, device number 15 [ 1178.531078][T16548] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 1178.684411][T16548] usb 5-1: Using ep0 maxpacket: 16 [ 1178.684957][T16548] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1178.685840][T16548] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1178.685864][T16548] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1178.685878][T16548] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1178.685900][T16548] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1178.717248][T16548] usb 5-1: config 0 descriptor?? [ 1178.804032][ T30] audit: type=1400 audit(1792297826.903:1889): avc: denied { map } for pid=18185 comm="syz.1.3158" path="socket:[48821]" dev="sockfs" ino=48821 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1178.804310][ T30] audit: type=1400 audit(1792297826.903:1890): avc: denied { read } for pid=18185 comm="syz.1.3158" path="socket:[48821]" dev="sockfs" ino=48821 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1178.864233][T18186] FAULT_INJECTION: forcing a failure. [ 1178.864233][T18186] name failslab, interval 1, probability 0, space 0, times 0 [ 1178.864281][T18186] CPU: 1 UID: 0 PID: 18186 Comm: syz.1.3158 Tainted: G L syzkaller #0 PREEMPT(full) [ 1178.864307][T18186] Tainted: [L]=SOFTLOCKUP [ 1178.864314][T18186] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1178.864326][T18186] Call Trace: [ 1178.864332][T18186] [ 1178.864340][T18186] dump_stack_lvl+0x100/0x190 [ 1178.864368][T18186] should_fail_ex.cold+0x5/0xa [ 1178.864395][T18186] should_failslab+0xc2/0x120 [ 1178.864423][T18186] kmem_cache_alloc_noprof+0x92/0x6a0 [ 1178.864450][T18186] ? inet_bind2_bucket_create+0x36/0x5f0 [ 1178.864469][T18186] inet_bind2_bucket_create+0x36/0x5f0 [ 1178.864482][T18186] __inet_hash_connect+0x1527/0x2000 [ 1178.864499][T18186] ? __pfx___inet6_check_established+0x10/0x10 [ 1178.864518][T18186] ? __pfx___inet_hash_connect+0x10/0x10 [ 1178.864536][T18186] ? inet6_ehashfn+0x25/0x3e0 [ 1178.864565][T18186] ? inet6_hash_connect+0xe7/0x180 [ 1178.864597][T18186] tcp_v6_connect+0x166f/0x2660 [ 1178.864636][T18186] ? __pfx_tcp_v6_connect+0x10/0x10 [ 1178.864660][T18186] __inet_stream_connect+0x208/0xf90 [ 1178.864689][T18186] ? __pfx___inet_stream_connect+0x10/0x10 [ 1178.864717][T18186] ? kasan_save_track+0x14/0x30 [ 1178.864743][T18186] ? __kasan_kmalloc+0xaa/0xb0 [ 1178.864765][T18186] ? __kmalloc_cache_noprof+0x2f8/0x6d0 [ 1178.864778][T18186] ? tcp_sendmsg_fastopen+0x24d/0x750 [ 1178.864798][T18186] tcp_sendmsg_fastopen+0x3ed/0x750 [ 1178.864819][T18186] tcp_sendmsg_locked+0x27da/0x4420 [ 1178.864852][T18186] ? __lock_acquire+0x5c0/0x1f40 [ 1178.864879][T18186] ? reacquire_held_locks+0xdd/0x1f0 [ 1178.864901][T18186] ? release_sock+0x21/0x280 [ 1178.864916][T18186] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 1178.864933][T18186] ? lock_acquire+0x1d1/0x380 [ 1178.864945][T18186] ? do_raw_spin_lock+0x128/0x260 [ 1178.864961][T18186] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1178.864988][T18186] ? __local_bh_enable_ip+0xa5/0x120 [ 1178.865013][T18186] tcp_sendmsg+0x2e/0x50 [ 1178.865027][T18186] ? __pfx_tcp_sendmsg+0x10/0x10 [ 1178.865054][T18186] inet6_sendmsg+0xb9/0x140 [ 1178.865073][T18186] __sys_sendto+0x36d/0x4e0 [ 1178.865084][T18186] ? __pfx___sys_sendto+0x10/0x10 [ 1178.865106][T18186] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1178.865138][T18186] ? __pfx___x64_sys_futex+0x10/0x10 [ 1178.865165][T18186] ? ksys_write+0x1ac/0x250 [ 1178.865188][T18186] ? __pfx_ksys_write+0x10/0x10 [ 1178.865212][T18186] __x64_sys_sendto+0xe0/0x1c0 [ 1178.865223][T18186] ? do_syscall_64+0xae/0x790 [ 1178.865240][T18186] ? lockdep_hardirqs_on+0x7d/0x110 [ 1178.865257][T18186] do_syscall_64+0x123/0x790 [ 1178.865282][T18186] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1178.865302][T18186] RIP: 0033:0x7fe7adb9e559 [ 1178.865318][T18186] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1178.865335][T18186] RSP: 002b:00007fe7ae9a5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1178.865353][T18186] RAX: ffffffffffffffda RBX: 00007fe7ade25fa0 RCX: 00007fe7adb9e559 [ 1178.865361][T18186] RDX: 0000000000000091 RSI: 0000000000000000 RDI: 0000000000000005 [ 1178.865367][T18186] RBP: 00007fe7adc35ab8 R08: 0000200000000500 R09: 000000000000001c [ 1178.865374][T18186] R10: 0000000024000045 R11: 0000000000000246 R12: 0000000000000000 [ 1178.865381][T18186] R13: 00007fe7ade26038 R14: 00007fe7ade25fa0 R15: 00007ffdeb6f5818 [ 1178.865399][T18186] [ 1179.299994][T18189] xt_hashlimit: size too large, truncated to 1048576 [ 1181.599028][T16548] usbhid 5-1:0.0: can't add hid device: -71 [ 1181.599112][T16548] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1181.621317][T16548] usb 5-1: USB disconnect, device number 15 [ 1181.664934][T16399] Bluetooth: hci1: ISO packet too small [ 1181.710734][T18211] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3164'. [ 1181.710785][T18211] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 1182.014173][T15262] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 1182.605062][T15262] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1182.658415][T15262] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1182.658449][T15262] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1182.658472][T15262] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 1182.658509][T15262] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1182.903978][T15262] usb 4-1: config 0 descriptor?? [ 1183.254018][T18207] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1183.255895][T18207] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1184.677238][ T30] audit: type=1400 audit(1792297832.773:1891): avc: denied { override_creds } for pid=18206 comm="syz.3.3162" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 1184.693206][T15262] plantronics 0003:047F:FFFF.000A: report_id 0 is invalid [ 1184.693226][T15262] plantronics 0003:047F:FFFF.000A: item 0 0 1 8 parsing failed [ 1184.693665][T15262] plantronics 0003:047F:FFFF.000A: parse failed [ 1184.693736][T15262] plantronics 0003:047F:FFFF.000A: probe with driver plantronics failed with error -22 [ 1184.794254][ T30] audit: type=1400 audit(1792297832.883:1892): avc: denied { setattr } for pid=18206 comm="iou-wrk-18207" name="[io_uring]" dev="anon_inodefs" ino=49020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 1185.372847][T15262] usb 4-1: USB disconnect, device number 89 [ 1186.154501][T18244] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3174'. [ 1186.154542][T18244] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 1186.171048][T15262] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 1186.491046][T15262] usb 1-1: Using ep0 maxpacket: 8 [ 1186.491857][T15262] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1186.516514][ T5718] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 1186.578233][T15262] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 1186.578300][T15262] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1186.578323][T15262] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1186.578345][T15262] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1186.578367][T15262] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1186.578404][T15262] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1186.721357][ T5718] usb 3-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 1186.725494][ T5718] usb 3-1: config 1 has an invalid interface number: 3 but max is 0 [ 1186.725534][ T5718] usb 3-1: config 1 has no interface number 0 [ 1186.786428][ T5718] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1186.786464][ T5718] usb 3-1: Product: syz [ 1186.786539][ T5718] usb 3-1: Manufacturer: syz [ 1186.786577][ T5718] usb 3-1: SerialNumber: syz [ 1186.904636][T18249] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3176'. [ 1186.984909][ T5718] usb 3-1: 3:0 : does not exist [ 1186.985359][ T5718] usb 3-1: 3:0 : does not exist [ 1187.121379][T15262] usb 1-1: GET_CAPABILITIES returned 0 [ 1187.121422][T15262] usbtmc 1-1:16.0: can't read capabilities [ 1187.549070][ T30] audit: type=1400 audit(1792297835.643:1893): avc: denied { recv } for pid=0 comm="swapper/1" saddr=10.128.0.169 src=30006 daddr=10.128.0.142 dest=41196 netif=eth0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=peer permissive=1 [ 1188.412215][ T5718] usb 3-1: USB disconnect, device number 35 [ 1188.925047][T18265] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3179'. [ 1189.135120][T18277] xt_hashlimit: size too large, truncated to 1048576 [ 1189.269565][T18286] can0: slcan on ttyS3. [ 1189.395407][T18290] random: crng reseeded on system resumption [ 1189.408344][ T30] audit: type=1400 audit(1792297837.493:1894): avc: denied { write } for pid=18278 comm="syz.1.3184" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 1189.601121][T18286] can0 (unregistered): slcan off ttyS3. [ 1189.893850][T16547] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 1190.042672][T16547] usb 2-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1190.043232][T16547] usb 2-1: config 0 has no interfaces? [ 1190.046648][T16547] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1190.046672][T16547] usb 2-1: Product: syz [ 1190.046687][T16547] usb 2-1: Manufacturer: syz [ 1190.046701][T16547] usb 2-1: SerialNumber: syz [ 1190.082603][T16547] usb 2-1: config 0 descriptor?? [ 1190.248754][T18301] evm: overlay not supported [ 1192.258370][ T30] audit: type=1400 audit(1792297840.273:1895): avc: denied { egress } for pid=0 comm="swapper/0" saddr=fe80::1b daddr=ff02::2 netif=teql0 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:netif_t tclass=netif permissive=1 [ 1192.258419][ T30] audit: type=1400 audit(1792297840.273:1896): avc: denied { sendto } for pid=0 comm="swapper/0" saddr=fe80::1b daddr=ff02::2 netif=teql0 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:node_t tclass=node permissive=1 [ 1192.363118][T16548] usb 2-1: USB disconnect, device number 21 [ 1192.482754][T16547] usb 1-1: USB disconnect, device number 16 [ 1192.524639][ T30] audit: type=1326 audit(1792297840.623:1897): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18323 comm="syz.1.3195" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe7adb9e559 code=0x0 [ 1192.707322][ T30] audit: type=1400 audit(1792297840.803:1898): avc: denied { getopt } for pid=18328 comm="syz.0.3197" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1192.784646][T18330] netlink: 200 bytes leftover after parsing attributes in process `syz.0.3197'. [ 1193.573506][T18336] ublk_ctrl_add_dev: invalid recovery flags 10 [ 1193.575551][ T30] audit: type=1400 audit(1792297841.673:1899): avc: denied { cmd } for pid=18323 comm="syz.1.3195" path="/dev/ublk-control" dev="devtmpfs" ino=695 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=io_uring permissive=1 [ 1193.765498][T18340] can0: slcan on ttyS3. [ 1194.042048][T18340] can0 (unregistered): slcan off ttyS3. [ 1194.361036][T16548] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 1194.399581][T16399] Bluetooth: hci2: ISO packet too small [ 1194.410392][T18350] tipc: Enabling of bearer rejected, failed to enable media [ 1194.410920][T18350] netlink: 72 bytes leftover after parsing attributes in process `syz.3.3194'. [ 1194.431501][T18350] netlink: 72 bytes leftover after parsing attributes in process `syz.3.3194'. [ 1194.519031][T16548] usb 1-1: New USB device found, idVendor=1781, idProduct=0938, bcdDevice=9b.49 [ 1194.519947][T16548] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1194.524580][T16548] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1194.524600][T16548] usb 1-1: Product: syz [ 1194.524614][T16548] usb 1-1: Manufacturer: syz [ 1194.524626][T16548] usb 1-1: SerialNumber: syz [ 1194.560821][T16548] usb 1-1: config 0 descriptor?? [ 1195.259381][T18358] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3202'. [ 1195.506833][ T149] IPVS: starting estimator thread 0... [ 1195.673635][T18344] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1195.680580][T18344] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1195.703043][T18362] IPVS: using max 75 ests per chain, 180000 per kthread [ 1196.281248][T15682] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 1196.394157][ T5718] libceph: connect (1)[c::]:6789 error -101 [ 1196.398975][ T5718] libceph: mon0 (1)[c::]:6789 connect error [ 1196.400327][T18373] ceph: No mds server is up or the cluster is laggy [ 1196.621131][T15682] usb 3-1: Using ep0 maxpacket: 8 [ 1196.622035][T15682] usb 3-1: New USB device found, idVendor=2b73, idProduct=000a, bcdDevice= 0.40 [ 1196.640572][T15682] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1196.640587][T15682] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1196.661264][ T5718] libceph: connect (1)[c::]:6789 error -101 [ 1196.665527][ T5718] libceph: mon0 (1)[c::]:6789 connect error [ 1196.949639][T15682] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1196.949668][T15682] usb 3-1: Product: syz [ 1196.949683][T15682] usb 3-1: Manufacturer: syz [ 1196.949697][T15682] usb 3-1: SerialNumber: syz [ 1198.249759][T16548] usb 1-1: USB disconnect, device number 17 [ 1198.381566][T17482] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 1198.449368][T18398] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3212'. [ 1198.449409][T18398] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 1198.843200][T18401] jffs2: notice: (18401) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 1 orphan) and 2 of xref (0 dead, 2 orphan) found. [ 1199.345181][T17482] usb 4-1: Using ep0 maxpacket: 16 [ 1199.653988][T16547] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 1199.802766][T16547] usb 5-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 1199.804967][T16547] usb 5-1: config 1 has an invalid interface number: 3 but max is 0 [ 1199.804999][T16547] usb 5-1: config 1 has no interface number 0 [ 1199.809705][T16547] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1199.809737][T16547] usb 5-1: Product: syz [ 1199.809829][T16547] usb 5-1: Manufacturer: syz [ 1199.809865][T16547] usb 5-1: SerialNumber: syz [ 1199.938087][T16547] usb 5-1: 3:0 : does not exist [ 1199.938608][T16547] usb 5-1: 3:0 : does not exist [ 1200.103101][T17482] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1200.103168][T17482] usb 4-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=36.87 [ 1200.135692][T17482] usb 4-1: config 127 has an invalid interface number: 124 but max is 0 [ 1200.135720][T17482] usb 4-1: config 127 has no interface number 0 [ 1200.135745][T17482] usb 4-1: config 127 interface 124 has no altsetting 0 [ 1200.204182][T17482] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1200.204209][T17482] usb 4-1: Product: syz [ 1200.204244][T17482] usb 4-1: Manufacturer: syz [ 1200.204259][T17482] usb 4-1: SerialNumber: syz [ 1200.985757][T17482] usb 4-1: can't set config #127, error -71 [ 1201.299182][T17482] usb 4-1: USB disconnect, device number 90 [ 1201.552923][T15262] usb 5-1: USB disconnect, device number 16 [ 1201.577162][T15682] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 1201.598932][T15682] usb 3-1: USB disconnect, device number 36 [ 1201.684246][T18417] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3218'. [ 1201.684286][T18417] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 1201.899314][T18411] udevd[18411]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 1202.510503][ T30] audit: type=1400 audit(1792297850.603:1900): avc: denied { bind } for pid=18405 comm="syz.0.3215" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 1202.633458][T15262] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 1202.855287][T15262] usb 5-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 1202.872605][T15262] usb 5-1: config 1 has an invalid interface number: 3 but max is 0 [ 1202.872637][T15262] usb 5-1: config 1 has no interface number 0 [ 1202.900838][T15262] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1202.900872][T15262] usb 5-1: Product: syz [ 1202.900911][T15262] usb 5-1: Manufacturer: syz [ 1202.909374][T15262] usb 5-1: SerialNumber: syz [ 1203.401516][T15262] usb 5-1: 3:0 : does not exist [ 1203.401539][T15262] usb 5-1: 3:0 : does not exist [ 1204.140205][T17482] usb 5-1: USB disconnect, device number 17 [ 1205.002608][T16547] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 1205.163136][T16547] usb 1-1: Using ep0 maxpacket: 8 [ 1205.164284][T16547] usb 1-1: New USB device found, idVendor=046d, idProduct=c14f, bcdDevice=ff.ff [ 1205.185845][T16547] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1205.185881][T16547] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1205.212642][T16547] usb 1-1: New USB device strings: Mfr=237, Product=0, SerialNumber=0 [ 1205.212675][T16547] usb 1-1: Manufacturer: syz [ 1205.261317][T16547] usb 1-1: config 0 descriptor?? [ 1206.666739][ T5718] usb 1-1: USB disconnect, device number 18 [ 1207.029563][ T30] audit: type=1400 audit(1792297855.123:1901): avc: denied { write } for pid=18445 comm="syz.3.3226" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 1207.029702][T18446] ieee802154 phy0 wpan0: encryption failed: -22 [ 1207.045915][T16399] Bluetooth: hci4: unexpected event for opcode 0x080c [ 1207.328902][T17482] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 1207.502530][T17482] usb 4-1: New USB device found, idVendor=045e, idProduct=0775, bcdDevice= 1.00 [ 1207.840846][T17482] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 8192, setting to 64 [ 1207.853626][T17482] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 1207.853650][T17482] usb 4-1: Product: syz [ 1207.853664][T17482] usb 4-1: Manufacturer: syz [ 1209.447835][T17482] input: Samsung SUR40 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/input/input27 [ 1209.543479][T16548] usb 4-1: USB disconnect, device number 91 [ 1209.637264][T18460] ================================================================== [ 1209.637278][T18460] BUG: KASAN: slab-use-after-free in vb2_core_queue_release+0x150/0x190 [ 1209.637311][T18460] Read of size 4 at addr ff ** replaying previous printk message ** [ 1209.637311][T18460] Read of size 4 at addr ffff88807e02aaa8 by task v4l_id/18460 [ 1209.637324][T18460] [ 1209.637335][T18460] CPU: 0 UID: 0 PID: 18460 Comm: v4l_id Tainted: G L syzkaller #0 PREEMPT(full) [ 1209.637359][T18460] Tainted: [L]=SOFTLOCKUP [ 1209.637365][T18460] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1209.637376][T18460] Call Trace: [ 1209.637382][T18460] [ 1209.637389][T18460] dump_stack_lvl+0x100/0x190 [ 1209.637415][T18460] print_report+0x13d/0x4b0 [ 1209.637439][T18460] ? __virt_addr_valid+0x239/0x430 [ 1209.637458][T18460] ? vb2_core_queue_release+0x150/0x190 [ 1209.637482][T18460] kasan_report+0xdf/0x1c0 [ 1209.637507][T18460] ? vb2_core_queue_release+0x150/0x190 [ 1209.637534][T18460] vb2_core_queue_release+0x150/0x190 [ 1209.637560][T18460] _vb2_fop_release+0xe8/0x280 [ 1209.637584][T18460] v4l2_release+0x280/0x390 [ 1209.637604][T18460] ? __pfx_v4l2_release+0x10/0x10 [ 1209.637623][T18460] __fput+0x400/0xb60 [ 1209.637651][T18460] fput_close_sync+0x118/0x250 [ 1209.637668][T18460] ? __pfx_fput_close_sync+0x10/0x10 [ 1209.637687][T18460] __x64_sys_close+0x8b/0x120 [ 1209.637704][T18460] do_syscall_64+0x123/0x790 [ 1209.637731][T18460] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1209.637749][T18460] RIP: 0033:0x7f39f24a7407 [ 1209.637763][T18460] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1209.637780][T18460] RSP: 002b:00007fff7812d7d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 [ 1209.637797][T18460] RAX: ffffffffffffffda RBX: 00007f39f2c7c880 RCX: 00007f39f24a7407 [ 1209.637809][T18460] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 1209.637820][T18460] RBP: 00007f39f2c7c6e8 R08: 0000000000000000 R09: 0000000000000000 [ 1209.637830][T18460] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 1209.637841][T18460] R13: 00007fff7812da00 R14: 00007f39f2de3000 R15: 0000559a957d14d8 [ 1209.637860][T18460] [ 1209.637866][T18460] [ 1209.637870][T18460] Allocated by task 17482: [ 1209.637878][T18460] kasan_save_stack+0x30/0x50 [ 1209.637900][T18460] kasan_save_track+0x14/0x30 [ 1209.637920][T18460] __kasan_kmalloc+0xaa/0xb0 [ 1209.637939][T18460] __kmalloc_cache_noprof+0x2f8/0x6d0 [ 1209.637956][T18460] sur40_probe+0x1a8/0x1580 [ 1209.637971][T18460] usb_probe_interface+0x386/0x9b0 [ 1209.637991][T18460] really_probe+0x241/0xa60 [ 1209.638004][T18460] __driver_probe_device+0x210/0x460 [ 1209.638017][T18460] driver_probe_device+0x4a/0x140 [ 1209.638029][T18460] __device_attach_driver+0x1df/0x320 [ 1209.638043][T18460] bus_for_each_drv+0x159/0x1e0 [ 1209.638063][T18460] __device_attach+0x1e4/0x4d0 [ 1209.638076][T18460] device_initial_probe+0xaf/0xd0 [ 1209.638094][T18460] bus_probe_device+0x64/0x160 [ 1209.638115][T18460] device_add+0x121d/0x1970 [ 1209.638132][T18460] usb_set_configuration+0xd97/0x1dc0 [ 1209.638148][T18460] usb_generic_driver_probe+0xa1/0xe0 [ 1209.638171][T18460] usb_probe_device+0xef/0x400 [ 1209.638188][T18460] really_probe+0x241/0xa60 [ 1209.638201][T18460] __driver_probe_device+0x210/0x460 [ 1209.638215][T18460] driver_probe_device+0x4a/0x140 [ 1209.638228][T18460] __device_attach_driver+0x1df/0x320 [ 1209.638249][T18460] bus_for_each_drv+0x159/0x1e0 [ 1209.638269][T18460] __device_attach+0x1e4/0x4d0 [ 1209.638282][T18460] device_initial_probe+0xaf/0xd0 [ 1209.638297][T18460] bus_probe_device+0x64/0x160 [ 1209.638318][T18460] device_add+0x121d/0x1970 [ 1209.638333][T18460] usb_new_device.part.0+0xcc2/0x1686 [ 1209.638356][T18460] hub_event.cold+0x1e3/0xe90 [ 1209.638378][T18460] process_one_work+0xac7/0x1b10 [ 1209.638393][T18460] worker_thread+0x5ef/0xe50 [ 1209.638406][T18460] kthread+0x373/0x450 [ 1209.638428][T18460] ret_from_fork+0x730/0xd60 [ 1209.638445][T18460] ret_from_fork_asm+0x1a/0x30 [ 1209.638463][T18460] [ 1209.638467][T18460] Freed by task 16548: [ 1209.638474][T18460] kasan_save_stack+0x30/0x50 [ 1209.638495][T18460] kasan_save_track+0x14/0x30 [ 1209.638516][T18460] kasan_save_free_info+0x3b/0x70 [ 1209.638532][T18460] __kasan_slab_free+0x5f/0x80 [ 1209.638553][T18460] kfree+0x22b/0x6d0 [ 1209.638568][T18460] sur40_disconnect+0xb8/0x170 [ 1209.638582][T18460] usb_unbind_interface+0x1dd/0x9e0 [ 1209.638602][T18460] device_remove+0x12a/0x180 [ 1209.638624][T18460] device_release_driver_internal+0x44e/0x620 [ 1209.638641][T18460] bus_remove_device+0x2bc/0x560 [ 1209.638662][T18460] device_del+0x376/0x9b0 [ 1209.638685][T18460] usb_disable_device+0x367/0x810 [ 1209.638701][T18460] usb_disconnect+0x2e2/0x9a0 [ 1209.638718][T18460] hub_event+0x1bb1/0x4420 [ 1209.638735][T18460] process_one_work+0xac7/0x1b10 [ 1209.638748][T18460] worker_thread+0x5ef/0xe50 [ 1209.638761][T18460] kthread+0x373/0x450 [ 1209.638783][T18460] ret_from_fork+0x730/0xd60 [ 1209.638800][T18460] ret_from_fork_asm+0x1a/0x30 [ 1209.638816][T18460] [ 1209.638820][T18460] The buggy address belongs to the object at ffff88807e02a000 [ 1209.638820][T18460] which belongs to the cache kmalloc-4k of size 4096 [ 1209.638833][T18460] The buggy address is located 2728 bytes inside of [ 1209.638833][T18460] freed 4096-byte region [ffff88807e02a000, ffff88807e02b000) [ 1209.638849][T18460] [ 1209.638854][T18460] The buggy address belongs to the physical page: [ 1209.638861][T18460] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7e028 [ 1209.638876][T18460] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1209.638889][T18460] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 1209.638904][T18460] page_type: f5(slab) [ 1209.638919][T18460] raw: 00fff00000000040 ffff88801d033140 dead000000000100 dead000000000122 [ 1209.638934][T18460] raw: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000 [ 1209.638949][T18460] head: 00fff00000000040 ffff88801d033140 dead000000000100 dead000000000122 [ 1209.638964][T18460] head: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000 [ 1209.638979][T18460] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 1209.638994][T18460] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 1209.639003][T18460] page dumped because: kasan: bad access detected [ 1209.639011][T18460] page_owner tracks the page as allocated [ 1209.639016][T18460] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 17482, tgid 17482 (kworker/1:6), ts 1207879981410 [ 1209.639042][T18460] post_alloc_hook+0xfd/0x120 [ 1209.639059][T18460] get_page_from_freelist+0x110d/0x35d0 [ 1209.639077][T18460] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 1209.639096][T18460] new_slab+0xa9/0x6e0 [ 1209.639111][T18460] refill_objects+0xe3/0x410 [ 1209.639128][T18460] __pcs_replace_empty_main+0x35e/0x650 [ 1209.639145][T18460] __kmalloc_cache_noprof+0x4f4/0x6d0 [ 1209.639161][T18460] kobject_uevent_env+0x263/0x18b0 [ 1209.639181][T18460] device_add+0x1173/0x1970 [ 1209.639198][T18460] usb_set_configuration+0xd97/0x1dc0 [ 1209.639216][T18460] usb_generic_driver_probe+0xa1/0xe0 [ 1209.639247][T18460] usb_probe_device+0xef/0x400 [ 1209.639264][T18460] really_probe+0x241/0xa60 [ 1209.639277][T18460] __driver_probe_device+0x210/0x460 [ 1209.639291][T18460] driver_probe_device+0x4a/0x140 [ 1209.639305][T18460] __device_attach_driver+0x1df/0x320 [ 1209.639319][T18460] page last free pid 18412 tgid 18407 ts 1207354554903 stack trace: [ 1209.639330][T18460] __free_frozen_pages+0x79f/0x10f0 [ 1209.639345][T18460] qlist_free_all+0x47/0xf0 [ 1209.639362][T18460] kasan_quarantine_reduce+0x1a0/0x1f0 [ 1209.639381][T18460] __kasan_slab_alloc+0x69/0x90 [ 1209.639402][T18460] kmem_cache_alloc_node_noprof+0x282/0x6e0 [ 1209.639423][T18460] zswap_store+0xc6d/0x2e70 [ 1209.639439][T18460] swap_writeout+0xde0/0x1b20 [ 1209.639455][T18460] shrink_folio_list+0x4ffb/0x5e40 [ 1209.639478][T18460] reclaim_folio_list+0xe9/0x5e0 [ 1209.639500][T18460] reclaim_pages+0x428/0x5e0 [ 1209.639523][T18460] madvise_cold_or_pageout_pte_range+0x15b5/0x27b0 [ 1209.639549][T18460] walk_pgd_range+0xbef/0x1e00 [ 1209.639568][T18460] __walk_page_range+0x171/0x850 [ 1209.639589][T18460] walk_page_range_vma_unsafe+0x209/0x8f0 [ 1209.639609][T18460] walk_page_range_vma+0x63/0x90 [ 1209.639628][T18460] madvise_pageout+0x29e/0x5b0 [ 1209.639649][T18460] [ 1209.639653][T18460] Memory state around the buggy address: [ 1209.639661][T18460] ffff88807e02a980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1209.639673][T18460] ffff88807e02aa00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1209.639684][T18460] >ffff88807e02aa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1209.639694][T18460] ^ [ 1209.639702][T18460] ffff88807e02ab00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1209.639713][T18460] ffff88807e02ab80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1209.639722][T18460] ================================================================== [ 1209.651603][ T30] audit: type=1400 audit(1792297857.753:1902): avc: denied { read } for pid=4952 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 1209.652118][ T30] audit: type=1400 audit(1792297857.753:1903): avc: denied { search } for pid=4952 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1209.652600][ T30] audit: type=1400 audit(1792297857.753:1904): avc: denied { write search } for pid=4952 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1209.654740][ T30] audit: type=1400 audit(1792297857.753:1905): avc: denied { add_name } for pid=4952 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1209.660698][ T30] audit: type=1400 audit(1792297857.753:1906): avc: denied { create } for pid=4952 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 1209.660733][ T30] audit: type=1400 audit(1792297857.753:1907): avc: denied { append open } for pid=4952 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 1209.660764][ T30] audit: type=1400 audit(1792297857.753:1908): avc: denied { getattr } for pid=4952 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 1209.662020][T18460] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1210.667626][T18460] CPU: 0 UID: 0 PID: 18460 Comm: v4l_id Tainted: G L syzkaller #0 PREEMPT(full) [ 1210.678210][T18460] Tainted: [L]=SOFTLOCKUP [ 1210.682525][T18460] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 1210.692567][T18460] Call Trace: [ 1210.695832][T18460] [ 1210.698749][T18460] dump_stack_lvl+0x100/0x190 [ 1210.703420][T18460] vpanic+0x553/0x970 [ 1210.707390][T18460] ? __pfx_vpanic+0x10/0x10 [ 1210.711876][T18460] ? vb2_core_queue_release+0x150/0x190 [ 1210.717418][T18460] panic+0xd1/0xe0 [ 1210.721122][T18460] ? __pfx_panic+0x10/0x10 [ 1210.725517][T18460] ? vb2_core_queue_release+0x150/0x190 [ 1210.731047][T18460] ? preempt_schedule_common+0x3c/0xb0 [ 1210.736494][T18460] check_panic_on_warn.cold+0x19/0x34 [ 1210.741844][T18460] end_report.part.0+0x3a/0x90 [ 1210.746607][T18460] kasan_report.cold+0xe/0x18 [ 1210.751269][T18460] ? vb2_core_queue_release+0x150/0x190 [ 1210.756801][T18460] vb2_core_queue_release+0x150/0x190 [ 1210.762162][T18460] _vb2_fop_release+0xe8/0x280 [ 1210.766916][T18460] v4l2_release+0x280/0x390 [ 1210.771403][T18460] ? __pfx_v4l2_release+0x10/0x10 [ 1210.776408][T18460] __fput+0x400/0xb60 [ 1210.780377][T18460] fput_close_sync+0x118/0x250 [ 1210.785119][T18460] ? __pfx_fput_close_sync+0x10/0x10 [ 1210.790393][T18460] __x64_sys_close+0x8b/0x120 [ 1210.795052][T18460] do_syscall_64+0x123/0x790 [ 1210.799630][T18460] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1210.805506][T18460] RIP: 0033:0x7f39f24a7407 [ 1210.809900][T18460] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1210.829484][T18460] RSP: 002b:00007fff7812d7d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 [ 1210.837875][T18460] RAX: ffffffffffffffda RBX: 00007f39f2c7c880 RCX: 00007f39f24a7407 [ 1210.845822][T18460] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 1210.853772][T18460] RBP: 00007f39f2c7c6e8 R08: 0000000000000000 R09: 0000000000000000 [ 1210.861718][T18460] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 1210.869667][T18460] R13: 00007fff7812da00 R14: 00007f39f2de3000 R15: 0000559a957d14d8 [ 1210.877622][T18460] [ 1210.880716][T18460] Kernel Offset: disabled [ 1210.885022][T18460] Rebooting in 86400 seconds..