last executing test programs: 2m30.88272724s ago: executing program 0 (id=204): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x1, 0x5, 0x9fd, 0x84, 0x105}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) r3 = socket$inet6(0xa, 0x1, 0x84) setsockopt$inet6_int(r3, 0x29, 0x1a, 0x0, 0x0) sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) getsockopt$bt_hci(r3, 0x84, 0x6d, &(0x7f0000002280)=""/4090, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="0000000000000000b7080000000000047b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) r5 = add_key$user(&(0x7f0000002100), &(0x7f0000002180)={'syz', 0x1}, &(0x7f00000021c0), 0x0, 0xfffffffffffffffe) r6 = add_key$keyring(&(0x7f0000000180), &(0x7f00000001c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) r7 = add_key$user(&(0x7f0000002300), 0x0, &(0x7f0000000540), 0x0, r6) keyctl$dh_compute(0x17, &(0x7f0000000400)={r5, r7, r5}, &(0x7f0000000440)=""/206, 0xce, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x13, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1a"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)={0x54, 0x2, 0x6, 0x5, 0x0, 0x0, {0x7}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x5}]}]}, 0x54}}, 0x0) sendmsg$IPSET_CMD_ADD(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty=0xfffffffe}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000050) 2m29.93899905s ago: executing program 0 (id=208): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002180)={0x8, 0x4, &(0x7f00000020c0)=ANY=[@ANYBLOB="419d40000800000800000000000000ff18410000f8ffffff0000000000000000"], &(0x7f0000000100)='GPL\x00'}, 0x94) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x0, 0x0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000002080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000002040)='net/snmp6\x00') read$FUSE(r4, &(0x7f0000000000)={0x2020}, 0xfffffc7a) gettid() timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r5) socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r5, 0x6, 0x1e, &(0x7f0000000000)=0x400000001, 0x4) setsockopt$inet6_tcp_int(r5, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x1, 0x4) connect$inet6(r5, &(0x7f0000000080)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c) sendmmsg(r5, &(0x7f00000025c0)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f00000001c0)='N', 0x1}], 0x1}}], 0x1, 0xc015) 2m27.400241877s ago: executing program 0 (id=211): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000680)="6f47aa478b6e40d7a0d54238d5b7f49bbc47602404bf6280f3ab2533c0d8c2747e82b1fd11c2190e73aecaee84d536660efe4c30082b35a08ed2a36921d7786f497326dc21dc6bdc1dd75a0000000000"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r3, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 2m25.863864752s ago: executing program 0 (id=216): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000001180)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000380)="c4f6567b42428c351d0eb7e00adfac40f6f3c6ddfeee4f9b47f2ae534b00a80cf8bfe9952dadad722784be00d5e05f8aa568711892567737d85ade9858ea72a66a3a417d6fbdfe0c98a369e4e8de7139ea726aa8fd9e2b80cf70a64914c3cc12d10db3f785dcc90135afb89c4f917aba8da3dafa45a3ce5c98ad8d4e6528e2210d206b85f15e5eb55355d2acc609a1cc4df8ff5011ac509e40cc0ebded6b2781a05df6b38f458fe8a98d5ec9117cf4d25825b441b2e49dd32aca0852c7d7387a5452972ebde3fa90be5547e19b635d3b468d8cb58dd8d5e5aa5a917104c39f", 0xdf}, {&(0x7f0000000640)="18f2539a86f4267acf60e40dadcc211bb186706861b663e404ae5430d948a3deeb5982fbb1551c83edaad587e700949a9d32f5e7ab7cf7f52b86771efac9c04f3e30497f94e49127658062a15683e89b0aceb57d125d3b4ea3d1ad05f4e14c85034917bea1f128a1f6f3f33e7fd479c0c7124b558f472800bd87b2b9bb1221098d2ed2f09ae6829354166d", 0x8b}, {&(0x7f0000000940)="5d661b3f30a1248619c1c7ac10ba2a7b5ccc52", 0x13}], 0x3}}], 0x1, 0x4000000) sendmmsg$inet(r0, &(0x7f0000000c00)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000700)="44900000000056ee66c372f3105e", 0xe}, {&(0x7f00000000c0)}], 0x2}}], 0x1, 0x4000900) syz_usb_connect(0x1, 0x24, &(0x7f0000003c80)={{0x12, 0x1, 0x0, 0x94, 0xb6, 0xd9, 0x8, 0x17cc, 0x4711, 0x374c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x4, 0x20, 0x4, "", [{{0x9, 0x4, 0x92, 0x7, 0x0, 0x72, 0x7a, 0x3, 0xef}}]}}]}}, &(0x7f0000004e40)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]}) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 2m21.763225368s ago: executing program 0 (id=225): r0 = socket$igmp(0x2, 0x3, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'netdevsim0\x00', 0x0}) socket$inet_icmp(0x2, 0x2, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket$rds(0x15, 0x5, 0x0) bind$rds(r5, &(0x7f0000001000)={0x2, 0x4e21, @loopback}, 0x10) sendmsg$rds(r5, &(0x7f0000000180)={&(0x7f0000000080)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000000540)=[@mask_fadd={0x58, 0x118, 0x8, {{0xfffffffc, 0x1}, 0x0, 0x0, 0x5c, 0x8, 0x0, 0x200010000000}}], 0x58}, 0x0) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000040)={0x84, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e23, 0x3, 'dh\x00', 0x1, 0x7, 0x49}, 0x2c) r6 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') ioctl$vim2m_VIDIOC_G_FMT(r6, 0xc0d05604, &(0x7f0000000440)={0x2, @sliced={0x2, [0x2, 0xb, 0x8, 0x8, 0x2, 0x4, 0x6, 0x1, 0x7, 0x7, 0xb84, 0x7, 0x200, 0x2, 0x6, 0x8fee, 0x8, 0x6, 0x1, 0x8000, 0x1, 0x78e5, 0x3, 0x8, 0xae4, 0x300, 0x4, 0x9, 0x7fff, 0x401, 0xd874, 0x100, 0x9, 0x9, 0x4, 0x67, 0x1, 0xfff8, 0x58f, 0x3a4, 0xfff, 0x4, 0x7, 0x7, 0xbdcf, 0x9, 0x0, 0x93], 0xfffffa6a}}) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x19, &(0x7f00000001c0)=0x8, 0x4) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000240)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, 0x0}}], 0x1, 0x20008000) shutdown(0xffffffffffffffff, 0x1) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000004f37ea30f5e6dc290c54acf7c91d450702777fb6650f7da88f07755b5738e49186f1490de575054f77aaa828ba3b4dbd67549a9fa1b608b089"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r1}, 0x94) 2m20.709345742s ago: executing program 0 (id=227): socket$kcm(0x11, 0x200000000000002, 0x300) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000004"], 0x48) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000400), 0x1, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001a40)=0x14) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x3, 0x100008b}, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000100), 0x1, 0x410503) accept4$llc(0xffffffffffffffff, 0x0, &(0x7f0000000140), 0x800) sched_setscheduler(0x0, 0x5, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) msgget$private(0x0, 0x4d2) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) getsockopt$inet6_int(r0, 0x29, 0x10, &(0x7f0000000000), &(0x7f00000000c0)=0xffffff4b) ioctl$IOMMU_VFIO_IOAS$SET(0xffffffffffffffff, 0x3b88, &(0x7f0000000200)={0xc}) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000019c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_COPY(r1, 0x3b83, &(0x7f0000001a00)={0x28, 0x4, 0x0, r3, 0x6, 0x1, 0x8}) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000040002, 0x0) ptrace(0x8, 0x0) getpid() mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000280)='pvfs2\x00', 0x804010, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, &(0x7f0000001980)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) getdents64(r1, &(0x7f0000000400)=""/4096, 0x1000) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0) r5 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r4, r5, 0x0, 0x20000023896) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) 2m5.203764369s ago: executing program 32 (id=227): socket$kcm(0x11, 0x200000000000002, 0x300) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000004"], 0x48) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000400), 0x1, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001a40)=0x14) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x3, 0x100008b}, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000100), 0x1, 0x410503) accept4$llc(0xffffffffffffffff, 0x0, &(0x7f0000000140), 0x800) sched_setscheduler(0x0, 0x5, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) msgget$private(0x0, 0x4d2) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) getsockopt$inet6_int(r0, 0x29, 0x10, &(0x7f0000000000), &(0x7f00000000c0)=0xffffff4b) ioctl$IOMMU_VFIO_IOAS$SET(0xffffffffffffffff, 0x3b88, &(0x7f0000000200)={0xc}) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f00000019c0)={0xc, 0x0}) ioctl$IOMMU_IOAS_COPY(r1, 0x3b83, &(0x7f0000001a00)={0x28, 0x4, 0x0, r3, 0x6, 0x1, 0x8}) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000040002, 0x0) ptrace(0x8, 0x0) getpid() mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000280)='pvfs2\x00', 0x804010, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, &(0x7f0000001980)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) getdents64(r1, &(0x7f0000000400)=""/4096, 0x1000) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0) r5 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r4, r5, 0x0, 0x20000023896) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) 1m40.741161042s ago: executing program 4 (id=335): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000000c00)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000002c0)="91f8a9849519def2f8eb48d9173c3d6f357d0272b7319130feaab952ac4703cad04be68907e50e997fc26e4c91ea4feb931647fc5393de25000000000000000000f38a6a4cb6b275ee91bd0196db0af38f2665cbbb4e66534143d02eac997657cf0a3df3cc8df5281ca813b255039632532f021a46b78fb7892513e4d3307f2dc6eca9986be03dfdd7dea5a59b3af0f59c39d0edaaf273933db78b8653e664f28ca6a3f8803662958348e8bef4a1370e5fc0c803eeb3e1154bab13b3", 0xbc}, {&(0x7f0000001000)="44900000000056ee66c372f3105eb186dd8062fad2d5b5bfb0ba06f274a8d026bd209da8ffa6a26e3b3f8075704a9d0ef9aff7f1e7db24609f02d34e76992c9df9fe6888c6c9a4825c6223be6ac54536025af1dea54e527c68b0ff250261953f2da79a78104c2d9e7b16ed86b124945aa9ab7581ebd385fb61d442035db81e18c2d2462d0bb25fff9d3b1ce90b597992b2a4d541611ce77f58dce7c9500118229e7cdf4ca7f6adca92c73d97ce54164c1942b2568635bec8e020b41fb2f8000000000000000000000000000000001c8a9f7956583e26f6f0edc415851d0b8305fe66c2b7c114e3712d87744938848f24a13cb604000000", 0xf7}, {&(0x7f0000000140)="641a6a2b863c080000003a3f97a834ebb75a925ab48c8442", 0x18}, {&(0x7f00000001c0)="985e44efeaab001cabcf3d8673c3a254a9a2d3197970cb347b70a243bf77139a94bc3ae91684aaf7b7dff691deb8f8aef2d915fb3a0794a9a9b431a819bca6122c350637808dde804a048f", 0x4b}], 0x4}}, {{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000001e00)="03deba91c25995772ba981874cf3617e5a5f26d296be0bcb1ab619b901e1588b23e68431025b444671a918fd8ca862eb4494e52e10561f1dcac08771bcb099d2ac19ac81be56580fbf8a31fc043df05d4f9a1ca963f95a0dad514caf83c851eec544ac66993e0aa8aac7013f19af84202254eadfd12b56f2ebc32396500466e9f16d358dd5354ef69bb8caedf66a220372311a092a4f03a336f27222302c6364b738a58c3b8e99d1a40552dfad46ba272544c0b39ebbca7d1da95fc74f6010956a8bb3165ee8db3867d1f92176de044693fa090b97bcadedd59b7e509e0d60017b6a3b025aac6650826d7f3406d4206b4d714c620225b5797e60513988e244874ac2a0ac80d18c707edf4999d1beaf841f2b8dd9a3", 0x115}], 0x1}}], 0x2, 0x4000900) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 1m39.428235551s ago: executing program 4 (id=337): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000001540)=""/74, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001680)={0x2, 0x0, [{0x0, 0x5d, &(0x7f00000025c0)=""/93}, {0xdddd1000, 0xea, &(0x7f0000000400)=""/234}]}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000000340)=""/182, &(0x7f0000000140)=""/92}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000001500)={@my=0x1}) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001"], 0x64}}, 0x40110) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000200)={0x28, 0x0, 0xffffffff, @my=0x1}, 0x10) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=""/57, 0x0, &(0x7f0000000500)=""/4092}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) 1m38.399319604s ago: executing program 4 (id=341): syz_emit_ethernet(0x46, &(0x7f0000000340)=ANY=[@ANYBLOB="ffffffffffff0000000004000800460fa2e2f5549ea6969a90780000000000000000940400040000000000000000000000000000000000004e2300004e210000000300000003"], 0x0) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xcc, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xc, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb3d68000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000580)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0, 0xdddd0000}) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, 0x0, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000002700)) ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f0000000180)=0x1) 1m37.32409427s ago: executing program 4 (id=342): r0 = socket$kcm(0x10, 0x2, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) unshare(0x60040000) socket(0xa, 0x1, 0x0) socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x2, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000001880)}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) 1m27.203717961s ago: executing program 4 (id=361): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-blowfish-asm\x00'}, 0x58) sendmsg$alg(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x4000) recvmmsg(0xffffffffffffffff, &(0x7f0000000dc0)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000001c0)=""/20, 0x14}], 0x1}, 0xe}], 0x1, 0x2021, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$can_raw(0x1d, 0x3, 0x1) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r3, 0x0, 0x1, &(0x7f0000000bc0)=0x2, 0xfffffffffffffcbb) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000000180)={0xffffffffffffffff, &(0x7f0000000000)='cgroup\x00', 0x101, 0x0, 0xf, 0x0, 0x0}) getsockopt$WPAN_SECURITY(r3, 0x0, 0x1, 0x0, &(0x7f0000000140)) getsockopt(r2, 0x1, 0x1, 0x0, &(0x7f00000002c0)) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@newtfilter={0x24, 0x11, 0x1, 0x691522eb, 0xf0ffffff, {0x0, 0x0, 0x74, r4, {0x10, 0x7}, {}, {0x5}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x80}, 0x0) 1m21.037375102s ago: executing program 4 (id=368): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000), 0x20000328) 1m5.97378221s ago: executing program 33 (id=368): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000), 0x20000328) 7.481170862s ago: executing program 2 (id=621): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) syz_open_dev$usbfs(&(0x7f00000000c0), 0x205, 0x2) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x40040) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x6, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x6}, 0x94) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x20, 0x0, 0x7fff8000}]}) openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r4 = socket$unix(0x1, 0x2, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) r5 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r5, 0xffffffffffffffff, 0x31, 0x0, @void}, 0x10) setsockopt$sock_int(r4, 0x1, 0x10, &(0x7f0000000000)=0x2, 0x4) connect$unix(r4, 0x0, 0x0) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000000)=0x15) close_range(r3, 0xffffffffffffffff, 0x0) 7.453183087s ago: executing program 3 (id=622): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000021c0), r0) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r0, &(0x7f00000022c0)={0x0, 0x0, &(0x7f0000002280)={&(0x7f0000002200)={0x14, r1, 0x1, 0x70bd2d, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 7.315818101s ago: executing program 3 (id=625): r0 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, 0x0, 0x0) semget$private(0x0, 0x207, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = dup(r1) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0xfffffffe, @loopback, 0x5}], 0x1c) sendmsg$inet6(r1, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="91", 0x1}], 0x1}, 0x48043) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x25, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="30000000100001000000000000000071ff9aee24", @ANYRES32=0x0, @ANYBLOB="0000000000000000080004000006000008001b"], 0x30}, 0x1, 0x0, 0x0, 0x4004000}, 0x40080) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0x2a}}, 0x7, 0x1, 0xf06, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSETATTR(r5, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0xffffff9a) splice(r4, 0x0, r1, 0x0, 0x317e, 0x4) getsockopt$inet_sctp_SCTP_STATUS(r2, 0x84, 0xe, &(0x7f00000003c0)={0x0, 0x0, 0x7fff, 0x2, 0x80, 0x1, 0x5e5, 0xd80000, {0x0, @in6={{0xa, 0x4e22, 0x1ff, @private2={0xfc, 0x2, '\x00', 0x1}, 0x80}}, 0x6, 0xec, 0x33c, 0x2, 0x2}}, &(0x7f0000000480)=0xb0) 7.151021357s ago: executing program 6 (id=627): setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000080)={0x0, 0x8001}, 0x8) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB='b'], 0x9) getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x7f, &(0x7f0000000080)=""/4057, &(0x7f0000000000)=0xfd9) 7.082069295s ago: executing program 1 (id=628): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r3 = memfd_secret(0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xa, 0x11, r3, 0x0) ftruncate(r3, 0x51a9495) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x0, 0x0, 0x0}, 0x94) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) r5 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) read$FUSE(r4, &(0x7f0000002580)={0x2020}, 0x6d) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) 7.081860247s ago: executing program 6 (id=629): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f0000000480)='usbip-vudc.', 0xb) 5.938163455s ago: executing program 6 (id=630): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000480)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000a00), 0x0, 0x0, 0x0}) dup3(r1, r0, 0x80000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000440)=[@request_death={0x400c6313}], 0xffffffffffffff9a, 0x1000000, 0x0}) 5.932074613s ago: executing program 3 (id=631): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x4c, 0x0, &(0x7f00000009c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @release={0x40046306, 0x3}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000940)={0x44, 0x0, &(0x7f00000005c0)=[@reply={0x40406301, {0x7, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x6f, 0x0, &(0x7f0000000840)="b828968b2eedcbc1feca7a588518e89ca3b6eec3cc581ad1ab5c58eec8ae9772c689a2d279582afaf202f26f5678b33849886651760eee6768a9706c65440bb759a21b7e0f2d4242b933b98639ebb5526e72baca54bfc5ce8d3c60212e0e7927185c3c177419f4e33da44413698990"}) 5.464590317s ago: executing program 3 (id=633): bind$inet(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000000)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x800, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r2, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r2, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x100, 0x0, 0x0, 0x0, 0x54}, 0x9c) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f000099c000/0x2000)=nil, 0x2000, 0x1000000, 0x1010, r3, 0x5efaa000) syz_init_net_socket$llc(0x1a, 0x1, 0x0) r4 = socket(0x10, 0x3, 0x0) write(r4, &(0x7f0000000000)="2400000011005f0414f9f40700090400810000000d0000000000000008000f0001000000", 0x24) 5.434155967s ago: executing program 6 (id=634): openat(0xffffffffffffff9c, 0x0, 0x88000, 0x1) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f00000005c0)='fd', 0x0, r0) write$tun(r0, &(0x7f0000000380)=ANY=[], 0xfdef) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r1, 0x0, 0x2) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r4, r4) setpgid(0x0, r4) fchdir(r3) readlink(&(0x7f0000000000)='./cgroup\x00', &(0x7f0000000240)=""/184, 0xb8) openat$dir(0xffffffffffffff9c, 0x0, 0x20000, 0x8) 5.179925972s ago: executing program 2 (id=635): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x1, 0x5, 0x9fd, 0x84, 0x105}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) r3 = socket$inet6(0xa, 0x1, 0x84) setsockopt$inet6_int(r3, 0x29, 0x1a, 0x0, 0x0) getsockopt$bt_hci(r3, 0x84, 0x6d, &(0x7f0000002280)=""/4090, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = add_key$user(&(0x7f0000002100), &(0x7f0000002180)={'syz', 0x1}, &(0x7f00000021c0), 0x0, 0xfffffffffffffffe) r6 = add_key$keyring(&(0x7f0000000180), &(0x7f00000001c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) r7 = add_key$user(&(0x7f0000002300), 0x0, &(0x7f0000000540), 0x0, r6) keyctl$dh_compute(0x17, &(0x7f0000000400)={r5, r7, r5}, &(0x7f0000000440)=""/206, 0xce, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x13, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1a"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)={0x54, 0x2, 0x6, 0x5, 0x0, 0x0, {0x7}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x5}]}]}, 0x54}}, 0x0) sendmsg$IPSET_CMD_ADD(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty=0xfffffffe}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000050) 4.889280357s ago: executing program 1 (id=636): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000021c0), r0) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r0, &(0x7f00000022c0)={0x0, 0x0, &(0x7f0000002280)={&(0x7f0000002200)={0x14, r1, 0x1, 0x70bd2d, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 4.179795996s ago: executing program 2 (id=637): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x78, 0x2c, 0xd3b, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xc, 0x2}, {}, {0x7, 0xf}}, [@filter_kind_options=@f_basic={{0xa}, {0x48, 0x2, [@TCA_BASIC_EMATCHES={0x44, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x38, 0x2, 0x0, 0x1, [@TCF_EM_META={0x18, 0x1, 0x0, 0x0, {{0x7, 0x4, 0x5}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x0, 0x84}, {0x5, 0x7, 0x1}}}]}}, @TCF_EM_U32={0x1c, 0x2, 0x0, 0x0, {{0x6}, {0xeaae, 0xffff0001, 0x80, 0x6}}}]}]}]}}]}, 0x78}, 0x1, 0x0, 0x0, 0x410c4}, 0x4880) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000280)=@xdp={0x2c, 0x7, r3, 0x3e}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000600)="70ebd4219aa416e7b2c1f0731d8822ea08bb4866516564dcb9dbd01f6212d44b0d8dc7fe53d3aaece040429d831cce805769f9b4ddd62208462383c6d118bd9ec396", 0x42}], 0x1}, 0x0) 3.901169939s ago: executing program 1 (id=639): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) socket$unix(0x1, 0x1, 0x0) r0 = add_key$user(&(0x7f0000002100), 0x0, &(0x7f00000021c0), 0x0, 0xfffffffffffffffe) r1 = add_key$user(0x0, &(0x7f0000002340)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f0000000400)={r0, r1, r0}, &(0x7f0000000280)=""/190, 0xbe, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000070601080000000000000000000000000500010006"], 0x1c}}, 0x0) recvmmsg(r3, &(0x7f0000003840)=[{{0x0, 0x0, &(0x7f0000002780)=[{&(0x7f00000002c0)=""/127, 0x7f}, {&(0x7f0000000340)=""/240, 0xf0}, {&(0x7f0000000440)=""/96, 0x60}, {&(0x7f00000016c0)=""/4096, 0x1000}], 0x4}, 0x1}], 0x1, 0x20, 0x0) 3.813418545s ago: executing program 2 (id=640): socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() openat$ttyprintk(0xffffffffffffff9c, 0x0, 0x22802, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6d71b000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) kexec_load(0x0, 0x0, 0x0, 0x0) socket$alg(0x26, 0x5, 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) read$FUSE(r3, &(0x7f00000021c0)={0x2020}, 0x2020) mkdirat(0xffffffffffffff9c, 0x0, 0x22) set_mempolicy(0x3, &(0x7f0000000000)=0x80000000007, 0x7) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000006c0)="5c00000012006bcd9e3fe3dc6e48aa310b6b87033c00a6001f03000000000000040014000d000a000d0000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x40) 3.629893754s ago: executing program 5 (id=641): openat(0xffffffffffffff9c, 0x0, 0x88000, 0x1) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f00000005c0)='fd', 0x0, r0) write$tun(r0, &(0x7f0000000380)=ANY=[], 0xfdef) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r1, 0x0, 0x2) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r4, r4) setpgid(0x0, r4) fchdir(r3) readlink(0x0, &(0x7f0000000240)=""/184, 0xb8) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20000, 0x8) 3.384281128s ago: executing program 1 (id=642): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='0x000', 0x5) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x1, 0x0) write(r2, &(0x7f0000000280)='ACME\n', 0x5) close(r2) write(0xffffffffffffffff, &(0x7f0000000300)='ACMESynth\n\x00', 0xa) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/midi2.usb0\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r3, &(0x7f0000000680)='nonexistent_udc\n\x00', 0x10) close(r3) 2.530326348s ago: executing program 1 (id=643): r0 = socket$igmp(0x2, 0x3, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'netdevsim0\x00', 0x0}) socket$inet_icmp(0x2, 0x2, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet_sctp(0x2, 0x1, 0x84) r5 = socket$rds(0x15, 0x5, 0x0) bind$rds(r5, &(0x7f0000001000)={0x2, 0x4e21, @loopback}, 0x10) sendmsg$rds(r5, &(0x7f0000000180)={&(0x7f0000000080)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000000540)=[@mask_fadd={0x58, 0x118, 0x8, {{0xfffffffc, 0x1}, 0x0, 0x0, 0x5c, 0x8, 0x0, 0x200010000000}}], 0x58}, 0x0) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000040)={0x84, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e23, 0x3, 'dh\x00', 0x1, 0x7, 0x49}, 0x2c) r6 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') ioctl$vim2m_VIDIOC_G_FMT(r6, 0xc0d05604, &(0x7f0000000440)={0x2, @sliced={0x2, [0x2, 0xb, 0x8, 0x8, 0x2, 0x4, 0x6, 0x1, 0x7, 0x7, 0xb84, 0x7, 0x200, 0x2, 0x6, 0x8fee, 0x8, 0x6, 0x1, 0x8000, 0x1, 0x78e5, 0x3, 0x8, 0xae4, 0x300, 0x4, 0x9, 0x7fff, 0x401, 0xd874, 0x100, 0x9, 0x9, 0x4, 0x67, 0x1, 0xfff8, 0x58f, 0x3a4, 0xfff, 0x4, 0x7, 0x7, 0xbdcf, 0x9, 0x0, 0x93], 0xfffffa6a}}) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x19, &(0x7f00000001c0)=0x8, 0x4) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000240)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, 0x0}}], 0x1, 0x20008000) shutdown(0xffffffffffffffff, 0x1) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000004f37ea30f5e6dc290c54acf7c91d450702777fb6650f7da88f07755b5738e49186f1490de575054f77aaa828ba3b4dbd67549a9fa1b608b089"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r1}, 0x94) 2.174101158s ago: executing program 6 (id=644): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16, @ANYBLOB="3f9d00000000000000001700000008000300", @ANYRES32=r1, @ANYBLOB="60003080050002000000000014000400403a050c5bae9c544ef2b6d713459a7a1c000180050002000000000008000400050000000800010002"], 0x7c}}, 0x0) 2.029615455s ago: executing program 2 (id=645): socket$nl_generic(0x10, 0x3, 0x10) ioctl$vim2m_VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() openat$ttyprintk(0xffffffffffffff9c, 0x0, 0x22802, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6d71b000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) kexec_load(0x0, 0x0, 0x0, 0x0) socket$alg(0x26, 0x5, 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) read$FUSE(r3, &(0x7f00000021c0)={0x2020}, 0x2020) mkdirat(0xffffffffffffff9c, 0x0, 0x22) set_mempolicy(0x3, &(0x7f0000000000)=0x80000000007, 0x7) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000006c0)="5c00000012006bcd9e3fe3dc6e48aa310b6b87033c00a6001f03000000000000040014000d000a000d0000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x40) 1.96315585s ago: executing program 6 (id=646): request_key(&(0x7f0000000c40)='encrypted\x00', &(0x7f0000000c80)={'syz', 0x0}, 0x0, 0x0) r0 = add_key(&(0x7f00000000c0)='cifs.idmap\x00', 0x0, 0x0, 0x0, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x100000000001, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) r5 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x8800, 0x0) ioctl$SIOCX25SDTEFACILITIES(0xffffffffffffffff, 0x89eb, 0x0) ioctl$PTP_CLOCK_GETCAPS(r5, 0x40043d14, &(0x7f0000000040)) io_setup(0x3, &(0x7f0000000600)) sendmsg$NL802154_CMD_SET_LBT_MODE(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000cc0), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_mgmt(0x0, 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_ADD(r1, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008000}, 0x4040000) keyctl$negate(0xd, 0x0, 0x8000000000000000, r0) 1.764839616s ago: executing program 5 (id=647): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='0x000', 0x5) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x1, 0x0) write(r2, &(0x7f0000000280)='ACM', 0x3) close(r2) write(0xffffffffffffffff, &(0x7f0000000300)='ACMESynth\n\x00', 0xa) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/midi2.usb0\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r3, &(0x7f0000000680)='nonexistent_udc\n\x00', 0x10) close(r3) 1.587210213s ago: executing program 3 (id=648): pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f00000005c0)='fd', 0x0, r0) write$tun(r0, &(0x7f0000000380)=ANY=[], 0xfdef) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r1, 0x0, 0x2) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r4, r4) setpgid(0x0, r4) fchdir(r3) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20000, 0x8) 786.082327ms ago: executing program 5 (id=649): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000021c0), r0) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r0, &(0x7f00000022c0)={0x0, 0x0, &(0x7f0000002280)={&(0x7f0000002200)={0x14, r1, 0x1, 0x70bd2d, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 605.698402ms ago: executing program 5 (id=650): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x78, 0x2c, 0xd3b, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xc, 0x2}, {}, {0x7, 0xf}}, [@filter_kind_options=@f_basic={{0xa}, {0x48, 0x2, [@TCA_BASIC_EMATCHES={0x44, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x38, 0x2, 0x0, 0x1, [@TCF_EM_META={0x18, 0x1, 0x0, 0x0, {{0x7, 0x4, 0x5}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x0, 0x84}, {0x5, 0x7, 0x1}}}]}}, @TCF_EM_U32={0x1c, 0x2, 0x0, 0x0, {{0x6}, {0xeaae, 0xffff0001, 0x80, 0x6}}}]}]}]}}]}, 0x78}, 0x1, 0x0, 0x0, 0x410c4}, 0x4880) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000280)=@xdp={0x2c, 0x7, r3, 0x3e}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000600)="70ebd4219aa416e7b2c1f0731d8822ea08bb4866516564dcb9dbd01f6212d44b0d8dc7fe53d3aaece040429d831cce805769f9b4ddd62208462383c6d118bd9ec396", 0x42}], 0x1}, 0x0) 400.613701ms ago: executing program 5 (id=651): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_genetlink_get_family_id$nfc(0x0, 0xffffffffffffffff) write$nci(r0, &(0x7f00000028c0)=@NCI_OP_RF_INTF_ACTIVATED_NTF={0x1, 0x1, 0x3, 0x5, 0x1, @f={0x3, 0x2, 0x1, 0x2, 0xd9, 0x4, 0xff, {0xe6}, 0x9, 0x7, 0x9d, 0x3, 0xcb, "8ff8ece57ec6e5e4ed7337658a274082614ff5f8bc75bfdedae28c9d733c6aab771afe99fa15e68aee4865266c40ab9a2416f2986a79cd9eb94db78c2aa220d0b2d6c0d8f21ee94825506c98747df3fd3a18c53a33f811b3f02911dc76df8e622e690a4dfd50d11b7c41eb101fed85bd31158493f3ebd85c0a89634bc36237cb93923c5391161312d2f112f18b604b47b852dd3bcc800e42ded66edfdc939e6ebfcdf51ac13ca98067be3eb072b749375c55cba80e76bd3cb3091719e8bdc096fdbd55d83f14045df02691"}}, 0xdc) 329.619644ms ago: executing program 3 (id=652): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) mkdir(&(0x7f0000000000)='mysys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='mysys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='mysys/bus/usb/devices/usb1/bNumInterfaces\x00', 0x0, 0x0) read(r0, &(0x7f0000000500)=""/16, 0x10) 241.103491ms ago: executing program 2 (id=653): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r3 = memfd_secret(0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xa, 0x11, r3, 0x0) ftruncate(r3, 0x51a9495) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x0, 0x0, 0x0}, 0x94) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) r5 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) read$FUSE(r4, &(0x7f0000002580)={0x2020}, 0x6d) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) 76.02057ms ago: executing program 5 (id=654): openat(0xffffffffffffff9c, 0x0, 0x88000, 0x1) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f00000005c0)='fd', 0x0, r0) write$tun(r0, &(0x7f0000000380)=ANY=[], 0xfdef) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r1, 0x0, 0x2) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r4, r4) setpgid(0x0, r4) fchdir(r3) readlink(&(0x7f0000000000)='./cgroup\x00', 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20000, 0x8) 0s ago: executing program 1 (id=655): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/functions/uac1.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000000200)='./config/usb_gadget/g1/functions/uac1.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1/uac1.usb0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='dummy_udc.0\n\x00', 0xc) kernel console output (not intermixed with test programs): : avc: denied { mount } for pid=5611 comm="syz-executor" name="/" dev="gadgetfs" ino=8276 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 63.811466][ T30] audit: type=1400 audit(1784937323.386:161): avc: denied { mount } for pid=5611 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 63.849547][ T3361] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 63.866267][ T5609] veth0_macvtap: entered promiscuous mode [ 63.872852][ T3361] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 63.916489][ T5609] veth1_macvtap: entered promiscuous mode [ 63.935992][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 63.957977][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 64.045736][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 64.094052][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.103348][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.131038][ T5607] veth0_macvtap: entered promiscuous mode [ 64.140250][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.150772][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.212303][ T5615] Bluetooth: hci1: command tx timeout [ 64.246859][ T5803] 9pnet_fd: Insufficient options for proto=fd [ 64.255128][ T5803] IPVS: set_ctl: invalid protocol: 92 172.20.20.39:20002 [ 64.346219][ T5615] Bluetooth: hci4: command tx timeout [ 64.352007][ T5615] Bluetooth: hci3: command tx timeout [ 64.358846][ T5615] Bluetooth: hci2: command tx timeout [ 64.364409][ T5623] Bluetooth: hci0: command tx timeout [ 64.440476][ T5795] IPVS: starting estimator thread 0... [ 64.491268][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 64.528660][ T5607] veth1_macvtap: entered promiscuous mode [ 64.542294][ T5804] IPVS: using max 40 ests per chain, 96000 per kthread [ 64.563316][ T53] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.572833][ T53] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.598854][ T53] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.625386][ T53] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.646826][ T1096] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.655099][ T1096] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.665419][ T5607] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 64.699817][ T5607] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 64.711601][ T82] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.719899][ T82] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.725517][ T1096] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.737907][ T1096] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.751079][ T1096] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.760488][ T1096] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.660141][ T5809] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 65.767299][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 66.006442][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 66.018193][ T5809] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 66.069356][ T5809] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 66.110195][ T5809] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 66.127147][ T5809] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 66.164445][ T5809] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 66.176496][ T5809] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 66.188061][ T5809] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 66.299642][ T5809] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 66.327356][ T5809] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 66.343016][ T5809] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 66.369029][ T5809] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 66.391347][ T5809] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 66.412150][ T5809] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 66.429985][ T5809] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 66.616258][ T5824] netlink: 68 bytes leftover after parsing attributes in process `syz.2.9'. [ 66.712965][ T5612] Bluetooth: hci1: command 0x0c1a tx timeout [ 66.791825][ T53] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.848112][ T53] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.172267][ T5612] Bluetooth: hci0: command 0x0c1a tx timeout [ 68.237477][ T5612] Bluetooth: hci2: command 0x0c1a tx timeout [ 68.392387][ T5612] Bluetooth: hci3: command 0x0c1a tx timeout [ 68.398734][ T5615] Bluetooth: hci4: command 0x0c1a tx timeout [ 68.465007][ T5831] Set syz1 is full, maxelem 65536 reached [ 68.500939][ T30] kauditd_printk_skb: 44 callbacks suppressed [ 68.500952][ T30] audit: type=1400 audit(1784937328.156:206): avc: denied { open } for pid=5832 comm="syz.2.12" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 68.569256][ T30] audit: type=1400 audit(1784937328.306:207): avc: denied { read } for pid=5832 comm="syz.2.12" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 68.622924][ T30] audit: type=1400 audit(1784937328.366:208): avc: denied { open } for pid=5832 comm="syz.2.12" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 68.656999][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.677285][ T82] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.690099][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.697624][ T82] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.794055][ T5615] Bluetooth: hci1: command 0x0c1a tx timeout [ 68.855833][ T30] audit: type=1400 audit(1784937328.656:209): avc: denied { create } for pid=5838 comm="syz.3.14" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 68.949954][ T82] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.016628][ T82] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.106939][ T5843] 9pnet_fd: Insufficient options for proto=fd [ 69.116506][ T5843] IPVS: set_ctl: invalid protocol: 92 172.20.20.39:20002 [ 69.212316][ T30] audit: type=1400 audit(1784937328.906:210): avc: denied { ioctl } for pid=5838 comm="syz.3.14" path="socket:[8140]" dev="sockfs" ino=8140 ioctlcmd=0x8954 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 69.618162][ T30] audit: type=1400 audit(1784937328.926:211): avc: denied { setopt } for pid=5838 comm="syz.3.14" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 69.670558][ T30] audit: type=1400 audit(1784937329.466:212): avc: denied { mount } for pid=5841 comm="syz.0.1" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 70.822486][ T5615] Bluetooth: hci0: command 0x0c1a tx timeout [ 70.828575][ T5615] Bluetooth: hci2: command 0x0c1a tx timeout [ 70.834622][ T5612] Bluetooth: hci4: command 0x0c1a tx timeout [ 70.840678][ T5623] Bluetooth: hci3: command 0x0c1a tx timeout [ 71.062361][ T30] audit: type=1400 audit(1784937329.746:213): avc: denied { unmount } for pid=5609 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 71.492260][ T5623] Bluetooth: hci1: command 0x0c1a tx timeout [ 71.617730][ T30] audit: type=1400 audit(1784937330.676:214): avc: denied { bind } for pid=5847 comm="syz.4.5" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 71.812943][ T30] audit: type=1400 audit(1784937330.676:215): avc: denied { write } for pid=5847 comm="syz.4.5" name="001" dev="devtmpfs" ino=740 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 72.040960][ T5864] netlink: 'syz.2.18': attribute type 10 has an invalid length. [ 72.908266][ T5623] Bluetooth: hci3: command 0x0c1a tx timeout [ 72.915088][ T5612] Bluetooth: hci4: command 0x0c1a tx timeout [ 72.921104][ T5615] Bluetooth: hci2: command 0x0c1a tx timeout [ 72.922260][ T5614] Bluetooth: hci0: command 0x0c1a tx timeout [ 73.121374][ T5874] netlink: 4 bytes leftover after parsing attributes in process `syz.3.24'. [ 73.154399][ T5874] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 73.208190][ T5874] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 73.222019][ T5874] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 73.229658][ T5874] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 74.441231][ T30] kauditd_printk_skb: 17 callbacks suppressed [ 74.441249][ T30] audit: type=1400 audit(1784937334.246:233): avc: denied { name_connect } for pid=5872 comm="syz.2.22" dest=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 74.482631][ T5879] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 74.488615][ T5879] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 74.494579][ T5879] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 74.500499][ T5879] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 74.506447][ T5879] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 74.644652][ T30] audit: type=1400 audit(1784937334.446:234): avc: denied { setopt } for pid=5883 comm="syz.0.26" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 74.881021][ T30] audit: type=1400 audit(1784937334.686:235): avc: denied { unmount } for pid=5884 comm="syz.3.25" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 75.141371][ T30] audit: type=1400 audit(1784937334.946:236): avc: denied { ioctl } for pid=5893 comm="syz.3.28" path="/dev/raw-gadget" dev="devtmpfs" ino=821 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 75.227016][ T30] audit: type=1400 audit(1784937335.036:237): avc: denied { create } for pid=5895 comm="syz.1.29" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 75.253125][ T5896] netlink: 4 bytes leftover after parsing attributes in process `syz.1.29'. [ 75.263282][ T30] audit: type=1400 audit(1784937335.066:238): avc: denied { getopt } for pid=5895 comm="syz.1.29" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 75.284069][ T5896] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 75.292708][ T5896] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 75.304730][ T5896] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 75.317510][ T5896] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 75.383249][ T5702] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 75.553013][ T5702] usb 4-1: Using ep0 maxpacket: 32 [ 75.569095][ T5702] usb 4-1: config 0 has an invalid interface number: 146 but max is 0 [ 75.586209][ T5702] usb 4-1: config 0 has an invalid descriptor of length 1, skipping remainder of the config [ 75.597484][ T5702] usb 4-1: config 0 has no interface number 0 [ 75.605339][ T5702] usb 4-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0x1C, changing to 0xC [ 75.617542][ T5898] warning: `syz.1.30' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 75.688027][ T5702] usb 4-1: config 0 interface 146 altsetting 0 endpoint 0xC has invalid wMaxPacketSize 0 [ 75.702416][ T5702] usb 4-1: config 0 interface 146 altsetting 0 bulk endpoint 0xC has invalid maxpacket 0 [ 75.713317][ T5702] usb 4-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 75.726618][ T5702] usb 4-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 75.738988][ T5702] usb 4-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 75.832549][ T5702] usb 4-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 75.845536][ T5702] usb 4-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid maxpacket 24876, setting to 1024 [ 75.857213][ T5702] usb 4-1: config 0 interface 146 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 75.874853][ T5702] usb 4-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 75.885165][ T30] audit: type=1400 audit(1784937335.696:239): avc: denied { read write } for pid=5902 comm="syz.0.32" name="nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 75.910559][ T5702] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 75.919446][ T5702] usb 4-1: Product: syz [ 75.923770][ T5702] usb 4-1: Manufacturer: syz [ 75.929155][ T5702] usb 4-1: SerialNumber: syz [ 75.940742][ T30] audit: type=1400 audit(1784937335.726:240): avc: denied { open } for pid=5902 comm="syz.0.32" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 75.976373][ T5702] usb 4-1: config 0 descriptor?? [ 75.982908][ T5894] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 75.990143][ T5894] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 76.005579][ T5702] usb 4-1: will this work? Command EP is not usually 12 [ 76.017023][ T5702] usb 4-1: will this work? Response EP is not usually 3 [ 76.025551][ T5702] usb 4-1: will this work? Image data EP is not usually 2 [ 76.037590][ T24] cfg80211: failed to load regulatory.db [ 76.048389][ T5702] scsi host1: microtekX6 [ 76.060605][ T3370] usb 4-1: error -90 submitting URB [ 76.093022][ T2780] usb 4-1: error -90 submitting URB [ 76.134183][ T2780] usb 4-1: error -90 submitting URB [ 76.182307][ T2780] usb 4-1: error -90 submitting URB [ 76.461563][ T5702] IPVS: starting estimator thread 0... [ 76.552516][ T5623] Bluetooth: hci1: command 0x0c1a tx timeout [ 76.552986][ T5614] Bluetooth: hci3: command 0x0c1a tx timeout [ 76.564646][ T5612] Bluetooth: hci4: command 0x0c1a tx timeout [ 76.570691][ T5612] Bluetooth: hci2: command 0x0c1a tx timeout [ 76.576869][ T5612] Bluetooth: hci0: command 0x0c1a tx timeout [ 76.608417][ T30] audit: type=1400 audit(1784937336.416:241): avc: denied { allowed } for pid=5893 comm="syz.3.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 76.673466][ T5911] IPVS: using max 43 ests per chain, 103200 per kthread [ 76.763453][ T30] audit: type=1400 audit(1784937336.446:242): avc: denied { create } for pid=5893 comm="syz.3.28" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 77.278217][ T5924] binder: 5922:5924 ioctl c0306201 200000000640 returned -22 [ 77.305397][ T5924] binder: 5922:5924 ioctl c0306201 2000000001c0 returned -11 [ 78.216450][ T10] usb 4-1: USB disconnect, device number 2 [ 78.530257][ T5946] capability: warning: `syz.3.43' uses deprecated v2 capabilities in a way that may be insecure [ 79.267935][ T5960] netlink: 'syz.3.48': attribute type 10 has an invalid length. [ 79.986503][ T30] kauditd_printk_skb: 28 callbacks suppressed [ 79.986527][ T30] audit: type=1400 audit(1784937339.796:271): avc: denied { create } for pid=5971 comm="syz.3.51" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 80.094662][ T30] audit: type=1400 audit(1784937339.886:272): avc: denied { listen } for pid=5971 comm="syz.3.51" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 80.114856][ T30] audit: type=1400 audit(1784937339.916:273): avc: denied { name_connect } for pid=5969 comm="syz.2.50" dest=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 80.137130][ T30] audit: type=1400 audit(1784937339.926:274): avc: denied { create } for pid=5971 comm="syz.3.51" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 80.164276][ T30] audit: type=1400 audit(1784937339.976:275): avc: denied { ioctl } for pid=5971 comm="syz.3.51" path="socket:[9485]" dev="sockfs" ino=9485 ioctlcmd=0x8903 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 80.235039][ T30] audit: type=1400 audit(1784937340.046:276): avc: denied { name_bind } for pid=5971 comm="syz.3.51" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 80.299576][ T30] audit: type=1400 audit(1784937340.046:277): avc: denied { node_bind } for pid=5971 comm="syz.3.51" saddr=224.0.0.1 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 80.433741][ T30] audit: type=1400 audit(1784937340.096:278): avc: denied { create } for pid=5971 comm="syz.3.51" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 81.650701][ T30] audit: type=1400 audit(1784937341.336:279): avc: denied { bind } for pid=5990 comm="syz.3.55" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 83.506546][ T6009] netlink: 'syz.1.60': attribute type 1 has an invalid length. [ 83.930554][ T6011] netlink: 'syz.1.61': attribute type 10 has an invalid length. [ 86.758575][ T30] audit: type=1400 audit(1784937346.556:280): avc: denied { read } for pid=6040 comm="syz.1.69" name="uinput" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 88.713942][ T30] audit: type=1400 audit(1784937348.516:281): avc: denied { sqpoll } for pid=6048 comm="syz.0.72" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 89.414419][ T6065] netlink: 'syz.4.73': attribute type 10 has an invalid length. [ 89.511585][ T6039] Set syz1 is full, maxelem 65536 reached [ 92.180202][ T6100] netlink: 'syz.1.82': attribute type 10 has an invalid length. [ 92.607930][ T6097] netlink: 4 bytes leftover after parsing attributes in process `syz.4.83'. [ 92.635155][ C1] Illegal XDP return value 16128 on prog (id 22) dev bond_slave_1, expect packet loss! [ 94.401624][ T6113] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 94.407734][ T6113] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 94.413756][ T6113] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 94.419797][ T6113] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 94.425829][ T6113] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 94.831206][ T30] audit: type=1400 audit(1784937354.636:282): avc: denied { name_bind } for pid=6115 comm="syz.0.87" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 95.256132][ T30] audit: type=1400 audit(1784937355.066:283): avc: denied { mount } for pid=6123 comm="syz.4.88" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 95.718587][ T6136] netlink: 'syz.2.90': attribute type 10 has an invalid length. [ 95.912724][ T5615] Bluetooth: hci1: command 0x0c1a tx timeout [ 96.094963][ T30] audit: type=1400 audit(1784937355.896:284): avc: denied { unmount } for pid=5607 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 96.276261][ T6141] gadgetfs: bound to dummy_udc driver [ 96.451213][ T30] audit: type=1400 audit(1784937356.256:285): avc: denied { unmount } for pid=5607 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 96.487657][ T5615] Bluetooth: hci3: command 0x0c1a tx timeout [ 96.597285][ T5623] Bluetooth: hci4: command 0x0c1a tx timeout [ 96.603411][ T5623] Bluetooth: hci2: command 0x0c1a tx timeout [ 96.610153][ T5612] Bluetooth: hci0: command 0x0c1a tx timeout [ 97.625763][ T30] audit: type=1400 audit(1784937356.476:286): avc: denied { create } for pid=6142 comm="syz.1.93" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 98.324205][ T30] audit: type=1400 audit(1784937356.486:287): avc: denied { setopt } for pid=6142 comm="syz.1.93" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 100.231929][ T6162] netlink: 68 bytes leftover after parsing attributes in process `syz.0.98'. [ 101.133065][ T6167] 9pnet_fd: Insufficient options for proto=fd [ 101.140102][ T6167] IPVS: set_ctl: invalid protocol: 92 172.20.20.39:20002 [ 101.286558][ T6160] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 101.293750][ T6160] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 101.300942][ T6160] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 101.307246][ T6160] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 101.313290][ T6160] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 102.000878][ T30] audit: type=1400 audit(1784937361.806:288): avc: denied { read } for pid=6179 comm="syz.3.102" name="sg0" dev="devtmpfs" ino=798 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 102.058088][ T30] audit: type=1400 audit(1784937361.816:289): avc: denied { open } for pid=6179 comm="syz.3.102" path="/dev/sg0" dev="devtmpfs" ino=798 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 102.082273][ T5717] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 102.227195][ T6185] syzkaller0: entered promiscuous mode [ 102.239799][ T6185] syzkaller0: entered allmulticast mode [ 102.247620][ T187] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 102.255232][ T5717] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 102.270647][ T6185] tipc: Started in network mode [ 102.274684][ T5717] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 102.278351][ T6185] tipc: Node identity 2a6565aef28a, cluster identity 4711 [ 102.291898][ T6185] tipc: Enabled bearer , priority 0 [ 102.300717][ T5717] usb 1-1: Product: syz [ 102.316197][ T5717] usb 1-1: Manufacturer: syz [ 102.321784][ T5717] usb 1-1: SerialNumber: syz [ 102.322013][ T6184] tipc: Resetting bearer [ 102.343561][ T6188] CUSE: unknown device info "" [ 102.357918][ T6184] tipc: Disabling bearer [ 102.358949][ T6188] CUSE: unknown device info "Ö" [ 102.370199][ T6188] CUSE: unknown device info "" [ 102.375927][ T6188] CUSE: unknown device info "" [ 102.386854][ T6188] CUSE: unknown device info "" [ 102.391734][ T6188] CUSE: unknown device info "" [ 102.396474][ T6189] tmpfs: Unknown parameter 'usrquota/ÌÄzL6)Øô¨¾ýµ—ν¥ùO6 [ 102.396474][ T6189] 1¹P‡Ë¬4wˆ§è!‡úæ' [ 102.397396][ T6188] CUSE: unknown device info "ðÿÿÿ" [ 102.412901][ T6188] CUSE: unknown device info "" [ 102.417736][ T6188] CUSE: unknown device info "" [ 102.424156][ T6188] CUSE: unknown device info "" [ 102.425671][ T187] usb 5-1: config 150 has an invalid interface number: 204 but max is 2 [ 102.429143][ T6188] CUSE: unknown device info "" [ 102.437965][ T187] usb 5-1: config 150 has 2 interfaces, different from the descriptor's value: 3 [ 102.452050][ T187] usb 5-1: config 150 has no interface number 0 [ 102.458548][ T187] usb 5-1: config 150 interface 204 has no altsetting 0 [ 102.463112][ T6188] CUSE: unknown device info "r" [ 102.469327][ T187] usb 5-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=c7.eb [ 102.470559][ T6188] CUSE: unknown device info "ýÿÿÿÿÿÿÿ#Û" [ 102.479913][ T187] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 102.485409][ T6188] CUSE: unknown device info "ÿÿÿÿ" [ 102.498257][ T6188] CUSE: unknown device info "" [ 102.506053][ T187] usb 5-1: Product: syz [ 102.508284][ T6188] CUSE: unknown device info "€" [ 102.518790][ T187] usb 5-1: Manufacturer: syz [ 102.518892][ T6188] CUSE: DEVNAME unspecified [ 102.524334][ T187] usb 5-1: SerialNumber: syz [ 102.539687][ T30] audit: type=1400 audit(1784937362.346:290): avc: denied { write } for pid=6190 comm="syz.2.106" name="configs" dev="configfs" ino=8881 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 102.580274][ T10] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 102.584177][ T30] audit: type=1400 audit(1784937362.346:291): avc: denied { firmware_load } for pid=10 comm="kworker/0:1" path="/lib/firmware/ath9k_htc/htc_9271-1.4.0.fw" dev="sda1" ino=313 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:lib_t tclass=system permissive=1 [ 102.637224][ T30] audit: type=1400 audit(1784937362.346:292): avc: denied { write } for pid=6190 comm="syz.2.106" name="functions" dev="configfs" ino=8880 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 102.660357][ T30] audit: type=1400 audit(1784937362.376:293): avc: denied { write } for pid=6190 comm="syz.2.106" name="header" dev="configfs" ino=9923 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 102.740268][ T30] audit: type=1400 audit(1784937362.376:294): avc: denied { write } for pid=6190 comm="syz.2.106" name="header" dev="configfs" ino=9936 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 102.775114][ T187] xr_serial 5-1:150.204: skipping garbage [ 102.791147][ T187] xr_serial 5-1:150.204: xr_serial converter detected [ 102.880117][ T6171] netlink: 'syz.0.99': attribute type 2 has an invalid length. [ 102.888590][ T30] audit: type=1400 audit(1784937362.376:295): avc: denied { write } for pid=6190 comm="syz.2.106" name="ss" dev="configfs" ino=9933 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 103.740934][ T5625] Bluetooth: hci1: command 0x0c1a tx timeout [ 103.760614][ T5615] Bluetooth: hci0: command 0x0c1a tx timeout [ 103.766653][ T5615] Bluetooth: hci2: command 0x0c1a tx timeout [ 103.773160][ T5612] Bluetooth: hci3: command 0x0c1a tx timeout [ 103.779163][ T5623] Bluetooth: hci4: command 0x0c1a tx timeout [ 103.862701][ T10] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 103.870861][ T10] ath9k_htc: Failed to initialize the device [ 103.877988][ T30] audit: type=1400 audit(1784937362.376:296): avc: denied { create } for pid=6190 comm="syz.2.106" name="h" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=lnk_file permissive=1 [ 104.755208][ T6205] gadgetfs: bound to dummy_udc driver [ 104.779260][ T30] audit: type=1400 audit(1784937362.386:297): avc: denied { write } for pid=6190 comm="syz.2.106" name="ss" dev="configfs" ino=9933 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 104.817712][ T6171] Zero length message leads to an empty skb [ 104.901550][ T6207] binder: 6206:6207 ioctl c0306201 0 returned -14 [ 104.923564][ T10] usb 1-1: ath9k_htc: USB layer deinitialized [ 104.975103][ T6182] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 105.001640][ T6182] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 105.023933][ T187] usb 5-1: xr_serial converter now attached to ttyUSB0 [ 105.100074][ T5617] usb 1-1: USB disconnect, device number 2 [ 105.231074][ T5794] usb 5-1: USB disconnect, device number 2 [ 105.258492][ T5794] xr_serial ttyUSB0: xr_serial converter now disconnected from ttyUSB0 [ 105.277889][ T5794] xr_serial 5-1:150.204: device disconnected [ 107.081740][ T6226] Set syz1 is full, maxelem 65536 reached [ 107.242262][ T6229] CUSE: unknown device info "" [ 107.374892][ T6233] tmpfs: Unknown parameter 'usrquota/ÌÄzL6)Øô¨¾ýµ—ν¥ùO6 [ 107.374892][ T6233] 1¹P‡Ë¬4wˆ§è!‡úæ' [ 107.404618][ T6229] CUSE: unknown device info "Ö" [ 108.583143][ T6238] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 108.583827][ T6229] CUSE: unknown device info "" [ 108.589224][ T6238] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 108.599941][ T6238] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 108.605895][ T6238] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 108.611813][ T6238] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 108.739031][ T6241] binder: 6240:6241 ioctl c0306201 200000000040 returned -14 [ 108.802386][ T6229] CUSE: unknown device info "" [ 108.816221][ T6241] binder: 6240:6241 ioctl c0306201 2000000001c0 returned -11 [ 108.862674][ T6229] CUSE: unknown device info "" [ 108.886062][ T6229] CUSE: unknown device info "" [ 108.902333][ T6229] CUSE: unknown device info "ðÿÿÿ" [ 109.152399][ T10] usb 2-1: new low-speed USB device number 2 using dummy_hcd [ 109.886153][ T6229] CUSE: unknown device info "" [ 109.902309][ T6229] CUSE: unknown device info "" [ 109.912960][ T6229] CUSE: unknown device info "" [ 109.921667][ T6229] CUSE: unknown device info "" [ 109.932599][ T6229] CUSE: unknown device info "r" [ 110.181915][ T6229] CUSE: unknown device info "ýÿÿÿÿÿÿÿ#Û" [ 110.212300][ T6229] CUSE: unknown device info "ÿÿÿÿ" [ 110.292039][ T6229] CUSE: unknown device info "" [ 110.299509][ T6229] CUSE: unknown device info "€" [ 110.303525][ T10] usb 2-1: config 0 has an invalid interface number: 146 but max is 0 [ 110.315114][ T10] usb 2-1: config 0 has no interface number 0 [ 110.322472][ T10] usb 2-1: config 0 interface 146 has no altsetting 0 [ 110.323774][ T6229] CUSE: DEVNAME unspecified [ 110.339585][ T30] kauditd_printk_skb: 13 callbacks suppressed [ 110.339598][ T30] audit: type=1400 audit(1784937370.146:311): avc: denied { connect } for pid=6251 comm="syz.0.125" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 110.341535][ T10] usb 2-1: string descriptor 0 read error: -22 [ 110.387989][ T10] usb 2-1: New USB device found, idVendor=17cc, idProduct=4711, bcdDevice=37.4c [ 110.418453][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 110.447991][ T6255] netlink: 'syz.4.124': attribute type 10 has an invalid length. [ 110.481031][ T10] usb 2-1: config 0 descriptor?? [ 110.517581][ T30] audit: type=1400 audit(1784937370.326:312): avc: denied { bind } for pid=6257 comm="syz.0.126" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 110.523619][ T10] snd-usb-caiaq 2-1:0.146: can't set alt interface. [ 110.633252][ T5615] Bluetooth: hci3: command 0x0c1a tx timeout [ 110.643969][ T5625] Bluetooth: hci4: command 0x0c1a tx timeout [ 110.649993][ T5625] Bluetooth: hci2: command 0x0c1a tx timeout [ 110.656045][ T5625] Bluetooth: hci0: command 0x0c1a tx timeout [ 110.662031][ T5625] Bluetooth: hci1: command 0x0c1a tx timeout [ 110.668994][ T10] usb 2-1: unable to init card! (ret=-5) [ 110.676031][ T10] snd-usb-caiaq 2-1:0.146: probe with driver snd-usb-caiaq failed with error -5 [ 110.688087][ T30] audit: type=1400 audit(1784937370.326:313): avc: denied { name_bind } for pid=6257 comm="syz.0.126" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 111.580111][ T6262] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 111.586233][ T6262] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 111.592255][ T6262] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 111.598247][ T6262] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 111.604246][ T6262] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 111.771998][ T10] usb 2-1: USB disconnect, device number 2 [ 112.043460][ T30] audit: type=1400 audit(1784937370.326:314): avc: denied { node_bind } for pid=6257 comm="syz.0.126" saddr=172.20.20.170 src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 112.587705][ T30] audit: type=1400 audit(1784937372.176:315): avc: denied { create } for pid=6266 comm="syz.0.129" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 113.672472][ T5623] Bluetooth: hci3: command 0x0c1a tx timeout [ 113.678526][ T5615] Bluetooth: hci4: command 0x0c1a tx timeout [ 113.678557][ T5625] Bluetooth: hci2: command 0x0c1a tx timeout [ 113.685126][ T5615] Bluetooth: hci0: command 0x0c1a tx timeout [ 113.691407][ T5612] Bluetooth: hci1: command 0x0c1a tx timeout [ 115.323054][ T6281] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 115.329894][ T6281] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 115.335978][ T6281] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 115.341932][ T6281] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 115.348013][ T6281] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 116.308742][ T30] audit: type=1400 audit(1784937376.116:316): avc: denied { write } for pid=6283 comm="syz.0.134" name="sg0" dev="devtmpfs" ino=798 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 116.798536][ T6309] fuse: Invalid rootmode [ 116.813978][ T6309] netlink: 'syz.2.140': attribute type 10 has an invalid length. [ 116.821856][ T6309] netlink: 40 bytes leftover after parsing attributes in process `syz.2.140'. [ 116.846891][ T30] audit: type=1400 audit(1784937376.596:317): avc: denied { kexec_image_load } for pid=6303 comm="syz.2.140" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 117.551685][ T5623] Bluetooth: hci3: command 0x0c1a tx timeout [ 117.558016][ T5623] Bluetooth: hci4: command 0x0c1a tx timeout [ 117.564264][ T5614] Bluetooth: hci2: command 0x0c1a tx timeout [ 117.570281][ T5615] Bluetooth: hci0: command 0x0c1a tx timeout [ 117.576312][ T5625] Bluetooth: hci1: command 0x0c1a tx timeout [ 118.176168][ T6313] fuse: Invalid rootmode [ 118.182140][ T6313] netlink: 'syz.4.141': attribute type 10 has an invalid length. [ 118.195930][ T6313] netlink: 40 bytes leftover after parsing attributes in process `syz.4.141'. [ 119.057998][ T6320] CUSE: unknown device info "" [ 119.083761][ T6320] CUSE: unknown device info "Ö" [ 119.126716][ T6320] CUSE: unknown device info "" [ 119.168214][ T6321] tmpfs: Unknown parameter 'usrquota/ÌÄzL6)Øô¨¾ýµ—ν¥ùO6 [ 119.168214][ T6321] 1¹P‡Ë¬4wˆ§è!‡úæ' [ 119.244685][ T6320] CUSE: unknown device info "" [ 119.263828][ T6320] CUSE: unknown device info "" [ 119.291172][ T6320] CUSE: unknown device info "" [ 119.291186][ T6320] CUSE: unknown device info "ðÿÿÿ" [ 119.291194][ T6320] CUSE: unknown device info "" [ 119.291202][ T6320] CUSE: unknown device info "" [ 119.291210][ T6320] CUSE: unknown device info "" [ 119.291217][ T6320] CUSE: unknown device info "" [ 119.291225][ T6320] CUSE: unknown device info "r" [ 119.291233][ T6320] CUSE: unknown device info "ýÿÿÿÿÿÿÿ#Û" [ 119.291241][ T6320] CUSE: unknown device info "ÿÿÿÿ" [ 119.291249][ T6320] CUSE: unknown device info "" [ 119.291257][ T6320] CUSE: unknown device info "€" [ 119.291266][ T6320] CUSE: DEVNAME unspecified [ 119.896772][ T6336] netlink: 'syz.4.146': attribute type 10 has an invalid length. [ 120.226596][ T30] audit: type=1400 audit(1784937380.036:318): avc: denied { ioctl } for pid=6343 comm="syz.3.151" path="socket:[10527]" dev="sockfs" ino=10527 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 120.399689][ T6356] fuse: Invalid rootmode [ 120.414352][ T6356] netlink: 'syz.0.152': attribute type 10 has an invalid length. [ 120.422108][ T6356] netlink: 40 bytes leftover after parsing attributes in process `syz.0.152'. [ 122.140946][ T6361] CUSE: unknown device info "" [ 122.145952][ T6361] CUSE: unknown device info "Ö" [ 122.150814][ T6361] CUSE: unknown device info "" [ 122.156132][ T6361] CUSE: unknown device info "" [ 122.160995][ T6361] CUSE: unknown device info "" [ 122.166159][ T6361] CUSE: unknown device info "" [ 122.171078][ T6361] CUSE: unknown device info "ðÿÿÿ" [ 122.176387][ T6361] CUSE: unknown device info "" [ 122.181541][ T6361] CUSE: unknown device info "" [ 122.188474][ T6361] CUSE: unknown device info "" [ 122.193656][ T6361] CUSE: unknown device info "" [ 122.201292][ T6362] tmpfs: Unknown parameter 'usrquota/ÌÄzL6)Øô¨¾ýµ—ν¥ùO6 [ 122.201292][ T6362] 1¹P‡Ë¬4wˆ§è!‡úæ' [ 122.218007][ T6361] CUSE: unknown device info "r" [ 122.241498][ T6361] CUSE: unknown device info "ýÿÿÿÿÿÿÿ#Û" [ 122.247345][ T6361] CUSE: unknown device info "ÿÿÿÿ" [ 122.252625][ T6361] CUSE: unknown device info "" [ 122.257484][ T6361] CUSE: unknown device info "€" [ 122.262381][ T6361] CUSE: DEVNAME unspecified [ 123.375753][ T6373] netlink: 'syz.2.158': attribute type 4 has an invalid length. [ 123.425155][ T30] audit: type=1400 audit(1784937383.226:319): avc: denied { write } for pid=6374 comm="syz.3.159" name="functions" dev="configfs" ino=8880 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 123.472347][ T30] audit: type=1400 audit(1784937383.266:320): avc: denied { write } for pid=6374 comm="syz.3.159" name="core" dev="configfs" ino=3025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 123.882719][ T30] audit: type=1400 audit(1784937383.426:321): avc: denied { write } for pid=6374 comm="syz.3.159" name="rd_mcp_0" dev="configfs" ino=10576 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 123.907593][ T30] audit: type=1400 audit(1784937383.446:322): avc: denied { write } for pid=6374 comm="syz.3.159" name="target" dev="configfs" ino=3024 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 123.931765][ T5343] IPVS: starting estimator thread 0... [ 123.947953][ T30] audit: type=1400 audit(1784937383.456:323): avc: denied { write } for pid=6374 comm="syz.3.159" name="usb_gadget" dev="configfs" ino=10592 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 123.989655][ T30] audit: type=1400 audit(1784937383.736:324): avc: denied { write } for pid=6374 comm="syz.3.159" name="naa.1234567890123456" dev="configfs" ino=10594 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 124.032629][ T6381] IPVS: using max 44 ests per chain, 105600 per kthread [ 124.232706][ T6389] Config c/1 of g1 needs at least one function. [ 124.268797][ T6389] udc usbip-vudc.0: failed to start g1: -22 [ 124.275734][ T6389] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -22 [ 124.289700][ T6389] UDC core: g1: couldn't find an available UDC or it's busy [ 124.914431][ T6401] CUSE: unknown device info "" [ 124.922216][ T6401] CUSE: unknown device info "Ö" [ 124.929223][ T6401] CUSE: unknown device info "" [ 124.934779][ T6401] CUSE: unknown device info "" [ 124.939705][ T6401] CUSE: unknown device info "" [ 124.947730][ T6401] CUSE: unknown device info "" [ 124.961201][ T6401] CUSE: unknown device info "ðÿÿÿ" [ 124.970086][ T6401] CUSE: unknown device info "" [ 124.975222][ T6401] CUSE: unknown device info "" [ 124.980392][ T6401] CUSE: unknown device info "" [ 124.986050][ T6401] CUSE: unknown device info "" [ 124.986532][ T6408] tmpfs: Unknown parameter 'usrquota/ÌÄzL6)Øô¨¾ýµ—ν¥ùO6 [ 124.986532][ T6408] 1¹P‡Ë¬4wˆ§è!‡úæ' [ 124.991027][ T6401] CUSE: unknown device info "r" [ 125.008736][ T6401] CUSE: unknown device info "ýÿÿÿÿÿÿÿ#Û" [ 125.016200][ T6401] CUSE: unknown device info "ÿÿÿÿ" [ 125.023392][ T6401] CUSE: unknown device info "" [ 125.029366][ T6401] CUSE: unknown device info "€" [ 125.036853][ T6401] CUSE: DEVNAME unspecified [ 125.210056][ T6413] Config c/1 of g1 needs at least one function. [ 125.225815][ T6413] udc usbip-vudc.0: failed to start g1: -22 [ 125.244187][ T6413] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -22 [ 125.277607][ T6413] UDC core: g1: couldn't find an available UDC or it's busy [ 127.282977][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 127.289358][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 129.768595][ T6424] Set syz1 is full, maxelem 65536 reached [ 130.099442][ T30] audit: type=1400 audit(1784937389.906:325): avc: denied { unmount } for pid=5608 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 130.525813][ T6448] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 130.772405][ T10] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 130.922243][ T10] usb 5-1: device descriptor read/64, error -71 [ 130.955809][ T6460] CUSE: unknown device info "" [ 130.965671][ T6460] CUSE: unknown device info "Ö" [ 130.978984][ T6460] CUSE: unknown device info "" [ 130.989363][ T6460] CUSE: unknown device info "" [ 131.002801][ T6460] CUSE: unknown device info "" [ 131.012894][ T6460] CUSE: unknown device info "" [ 131.034158][ T6461] tmpfs: Unknown parameter 'usrquota/ÌÄzL6)Øô¨¾ýµ—ν¥ùO6 [ 131.034158][ T6461] 1¹P‡Ë¬4wˆ§è!‡úæ' [ 131.051345][ T6460] CUSE: unknown device info "ðÿÿÿ" [ 131.059393][ T6460] CUSE: unknown device info "" [ 131.074991][ T6460] CUSE: unknown device info "" [ 131.090082][ T6460] CUSE: unknown device info "" [ 131.099178][ T6460] CUSE: unknown device info "" [ 131.125325][ T6460] CUSE: unknown device info "r" [ 131.138388][ T6460] CUSE: unknown device info "ýÿÿÿÿÿÿÿ#Û" [ 131.144157][ T6460] CUSE: unknown device info "ÿÿÿÿ" [ 131.149370][ T6460] CUSE: unknown device info "" [ 131.154259][ T6460] CUSE: unknown device info "€" [ 131.159102][ T6460] CUSE: DEVNAME unspecified [ 131.182545][ T10] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 131.345151][ T10] usb 5-1: device descriptor read/64, error -71 [ 131.552725][ T10] usb usb5-port1: attempt power cycle [ 131.992280][ T10] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 132.050380][ T10] usb 5-1: device descriptor read/8, error -71 [ 132.336206][ T6472] UDC core: g1: couldn't find an available UDC or it's busy [ 132.347610][ T6444] Set syz1 is full, maxelem 65536 reached [ 132.382459][ T10] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 132.432748][ T10] usb 5-1: device descriptor read/8, error -71 [ 132.571517][ T10] usb usb5-port1: unable to enumerate USB device [ 133.238880][ T30] audit: type=1400 audit(1784937393.046:326): avc: denied { setopt } for pid=6481 comm="syz.4.190" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 133.262756][ T30] audit: type=1400 audit(1784937393.046:327): avc: denied { listen } for pid=6481 comm="syz.4.190" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 133.265827][ T6483] syz.4.190 uses obsolete (PF_INET,SOCK_PACKET) [ 133.854685][ T6491] netlink: 'syz.3.193': attribute type 10 has an invalid length. [ 134.275413][ T6505] netlink: 'syz.2.195': attribute type 10 has an invalid length. [ 135.781876][ T6525] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 136.352563][ T5343] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 136.702434][ T5343] usb 3-1: device descriptor read/64, error -71 [ 137.402535][ T5343] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 137.542410][ T5343] usb 3-1: device descriptor read/64, error -71 [ 137.638631][ T30] audit: type=1400 audit(1784937397.446:328): avc: denied { create } for pid=6538 comm="syz.3.206" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 137.770303][ T5343] usb usb3-port1: attempt power cycle [ 138.758739][ T30] audit: type=1400 audit(1784937397.486:329): avc: denied { ioctl } for pid=6538 comm="syz.3.206" path="socket:[10813]" dev="sockfs" ino=10813 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 139.768082][ T30] audit: type=1400 audit(1784937399.206:330): avc: denied { write } for pid=6544 comm="syz.0.208" name="snmp6" dev="proc" ino=4026533431 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 140.339222][ T6557] binder_alloc: 6551: binder_alloc_buf, no vma [ 140.344407][ T30] audit: type=1400 audit(1784937399.906:331): avc: denied { create } for pid=6549 comm="syz.2.210" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 140.737787][ T30] audit: type=1400 audit(1784937399.996:332): avc: denied { ioctl } for pid=6549 comm="syz.2.210" path="socket:[11701]" dev="sockfs" ino=11701 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 141.762558][ T30] audit: type=1400 audit(1784937400.236:333): avc: denied { read write } for pid=6549 comm="syz.2.210" dev="sockfs" ino=11701 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 142.382316][ T9] usb 1-1: new low-speed USB device number 3 using dummy_hcd [ 142.763641][ T30] audit: type=1400 audit(1784937401.596:334): avc: denied { read append } for pid=6568 comm="syz.2.215" name="mtd0" dev="devtmpfs" ino=704 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 143.430799][ T30] audit: type=1400 audit(1784937401.596:335): avc: denied { open } for pid=6568 comm="syz.2.215" path="/dev/mtd0" dev="devtmpfs" ino=704 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 143.484406][ T6581] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 143.491130][ T6581] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 143.497100][ T6581] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 143.503055][ T6581] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 143.508971][ T6581] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 143.715692][ T30] audit: type=1400 audit(1784937401.596:336): avc: denied { ioctl } for pid=6568 comm="syz.2.215" path="/dev/mtd0" dev="devtmpfs" ino=704 ioctlcmd=0x4d04 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 143.834156][ T9] usb 1-1: config 0 has an invalid interface number: 146 but max is 0 [ 143.840778][ T30] audit: type=1400 audit(1784937401.656:337): avc: denied { lock } for pid=6568 comm="syz.2.215" path="/dev/mtd0" dev="devtmpfs" ino=704 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 143.856926][ T9] usb 1-1: config 0 has no interface number 0 [ 143.892255][ T9] usb 1-1: config 0 interface 146 has no altsetting 0 [ 143.904120][ T9] usb 1-1: string descriptor 0 read error: -22 [ 143.910499][ T9] usb 1-1: New USB device found, idVendor=17cc, idProduct=4711, bcdDevice=37.4c [ 143.923677][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 144.930226][ T9] usb 1-1: config 0 descriptor?? [ 145.625069][ T5614] Bluetooth: hci3: command 0x0c1a tx timeout [ 145.631276][ T5615] Bluetooth: hci4: command 0x0c1a tx timeout [ 145.638167][ T5615] Bluetooth: hci2: command 0x0c1a tx timeout [ 145.644199][ T5615] Bluetooth: hci0: command 0x0c1a tx timeout [ 145.650189][ T5615] Bluetooth: hci1: command 0x0c1a tx timeout [ 145.711897][ T9] usb 1-1: can't set config #0, error -71 [ 145.761134][ T9] usb 1-1: USB disconnect, device number 3 [ 145.778532][ T6596] binder: BINDER_SET_CONTEXT_MGR already set [ 145.828226][ T6596] binder: 6595:6596 ioctl 4018620d 200000004a80 returned -16 [ 147.485150][ T6620] Device name not specified. [ 147.485150][ T6620] [ 147.616302][ T30] audit: type=1400 audit(1784937407.426:338): avc: denied { setopt } for pid=6617 comm="syz.2.229" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 148.506558][ T6626] Config c/1 of g1 needs at least one function. [ 148.582557][ T6626] udc usbip-vudc.0: failed to start g1: -22 [ 148.812522][ T6626] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -22 [ 148.874657][ T6626] UDC core: g1: couldn't find an available UDC or it's busy [ 149.066991][ T30] audit: type=1400 audit(1784937408.866:339): avc: denied { write } for pid=6636 comm="syz.2.233" name="fs" dev="configfs" ino=9943 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 150.044527][ T30] audit: type=1400 audit(1784937408.896:340): avc: denied { write } for pid=6636 comm="syz.2.233" name="fs" dev="configfs" ino=9943 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 150.100483][ T30] audit: type=1400 audit(1784937409.906:341): avc: denied { write } for pid=6636 comm="syz.2.233" name="c.1" dev="configfs" ino=9919 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 150.353836][ T30] audit: type=1400 audit(1784937409.906:342): avc: denied { write } for pid=6636 comm="syz.2.233" name="c.1" dev="configfs" ino=9919 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 150.384188][ T6641] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 150.390206][ T6641] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 150.396237][ T6641] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 150.402285][ T6641] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 150.408249][ T6641] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 150.670356][ T6649] netlink: 4 bytes leftover after parsing attributes in process `syz.3.237'. [ 150.670431][ T6649] bridge_slave_1: left allmulticast mode [ 150.670450][ T6649] bridge_slave_1: left promiscuous mode [ 150.671534][ T6649] bridge0: port 2(bridge_slave_1) entered disabled state [ 150.730713][ T30] audit: type=1400 audit(1784937410.476:343): avc: denied { create } for pid=6644 comm="syz.3.237" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 150.739480][ T6649] bridge_slave_0: left allmulticast mode [ 150.739505][ T6649] bridge_slave_0: left promiscuous mode [ 150.739644][ T6649] bridge0: port 1(bridge_slave_0) entered disabled state [ 151.392269][ T9] usb 2-1: new low-speed USB device number 3 using dummy_hcd [ 151.474113][ T30] audit: type=1400 audit(1784937411.276:344): avc: denied { write } for pid=6656 comm="syz.4.240" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 151.655840][ T30] audit: type=1400 audit(1784937411.456:345): avc: denied { mount } for pid=6658 comm="syz.3.239" name="/" dev="autofs" ino=11054 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 152.075694][ T9] usb 2-1: config 0 has an invalid interface number: 146 but max is 0 [ 152.089509][ T9] usb 2-1: config 0 has no interface number 0 [ 152.107249][ T9] usb 2-1: config 0 interface 146 has no altsetting 0 [ 152.125422][ T9] usb 2-1: string descriptor 0 read error: -22 [ 152.131940][ T9] usb 2-1: New USB device found, idVendor=17cc, idProduct=4711, bcdDevice=37.4c [ 152.153643][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 152.191721][ T9] usb 2-1: config 0 descriptor?? [ 152.225226][ T9] snd-usb-caiaq 2-1:0.146: can't set alt interface. [ 152.242105][ T9] usb 2-1: unable to init card! (ret=-5) [ 152.251704][ T9] snd-usb-caiaq 2-1:0.146: probe with driver snd-usb-caiaq failed with error -5 [ 152.364682][ T6672] random: crng reseeded on system resumption [ 152.375857][ T30] audit: type=1400 audit(1784937412.176:346): avc: denied { write } for pid=6671 comm="syz.3.245" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 152.402209][ T5623] Bluetooth: hci0: command 0x0c1a tx timeout [ 152.402231][ T5614] Bluetooth: hci1: command 0x0c1a tx timeout [ 152.431268][ T9] usb 2-1: USB disconnect, device number 3 [ 152.472269][ T5614] Bluetooth: hci3: command 0x0c1a tx timeout [ 152.472315][ T5623] Bluetooth: hci4: command 0x0c1a tx timeout [ 152.478412][ T5615] Bluetooth: hci2: command 0x0c1a tx timeout [ 152.484427][ T10] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 153.222902][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 153.230209][ T10] usb 5-1: config 0 has an invalid interface number: 146 but max is 0 [ 153.238700][ T10] usb 5-1: config 0 has an invalid descriptor of length 1, skipping remainder of the config [ 153.251252][ T10] usb 5-1: config 0 has no interface number 0 [ 153.257910][ T10] usb 5-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0x1C, changing to 0xC [ 153.269855][ T10] usb 5-1: config 0 interface 146 altsetting 0 endpoint 0xC has invalid wMaxPacketSize 0 [ 153.285225][ T10] usb 5-1: config 0 interface 146 altsetting 0 bulk endpoint 0xC has invalid maxpacket 0 [ 153.297375][ T10] usb 5-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 153.310327][ T10] usb 5-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 153.402539][ T10] usb 5-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 153.413078][ T10] usb 5-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 153.454918][ T10] usb 5-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid maxpacket 24876, setting to 1024 [ 153.466592][ T10] usb 5-1: config 0 interface 146 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 153.478988][ T10] usb 5-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 153.490009][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 153.586009][ T10] usb 5-1: Product: syz [ 153.694709][ T10] usb 5-1: Manufacturer: syz [ 153.756825][ T10] usb 5-1: SerialNumber: syz [ 153.990985][ T10] usb 5-1: config 0 descriptor?? [ 154.007437][ T30] audit: type=1400 audit(1784937413.816:347): avc: denied { mounton } for pid=6686 comm="syz.3.249" path="/57/file0" dev="tmpfs" ino=318 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 154.020993][ T6665] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 154.037494][ T6665] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 154.047805][ T10] usb 5-1: will this work? Command EP is not usually 12 [ 154.069112][ T10] usb 5-1: will this work? Response EP is not usually 3 [ 154.098241][ T10] usb 5-1: will this work? Image data EP is not usually 2 [ 154.104352][ T6689] CUSE: unknown device info "" [ 154.112297][ T6689] CUSE: unknown device info "Ö" [ 154.117276][ T6689] CUSE: unknown device info "" [ 154.123638][ T6689] CUSE: unknown device info "" [ 154.129197][ T6689] CUSE: unknown device info "" [ 154.130022][ T10] scsi host1: microtekX6 [ 154.155902][ T6689] CUSE: unknown device info "" [ 154.218208][ T6689] CUSE: unknown device info "ðÿÿÿ" [ 154.231323][ T914] usb 5-1: error -90 submitting URB [ 154.258886][ T914] usb 5-1: error -90 submitting URB [ 154.259891][ T6689] CUSE: unknown device info "" [ 154.259904][ T6689] CUSE: unknown device info "" [ 154.259913][ T6689] CUSE: unknown device info "" [ 154.259921][ T6689] CUSE: unknown device info "" [ 154.259929][ T6689] CUSE: unknown device info "r" [ 154.259936][ T6689] CUSE: unknown device info "ýÿÿÿÿÿÿÿ#Û" [ 154.259945][ T6689] CUSE: unknown device info "ÿÿÿÿ" [ 154.259953][ T6689] CUSE: unknown device info "" [ 154.259960][ T6689] CUSE: unknown device info "€" [ 154.259970][ T6689] CUSE: DEVNAME unspecified [ 154.343731][ T1757] usb 5-1: error -90 submitting URB [ 154.356491][ T6689] tmpfs: Unknown parameter 'usrquota/ÌÄzL6)Øô¨¾ýµ—ν¥ùO6 [ 154.356491][ T6689] 1¹P‡Ë¬4wˆ§è!‡úæ' [ 154.380770][ T6696] UDC core: g1: couldn't find an available UDC or it's busy [ 154.382364][ T1757] usb 5-1: error -90 submitting URB [ 156.223529][ T6706] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 156.223664][ T6706] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 156.223781][ T6706] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 156.223909][ T6706] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 156.224022][ T6706] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 156.555145][ T29] usb 5-1: USB disconnect, device number 7 [ 157.863884][ T6717] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 157.870768][ T6717] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 157.876800][ T6717] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 157.882810][ T6717] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 157.888794][ T6717] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 160.392316][ T5625] Bluetooth: hci3: command 0x0c1a tx timeout [ 160.398359][ T5614] Bluetooth: hci4: command 0x0c1a tx timeout [ 160.404594][ T5623] Bluetooth: hci2: command 0x0c1a tx timeout [ 160.410596][ T5623] Bluetooth: hci0: command 0x0c1a tx timeout [ 160.416635][ T5614] Bluetooth: hci1: command 0x0c1a tx timeout [ 160.488620][ T6737] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 160.495838][ T6737] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 160.501827][ T6737] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 160.507864][ T6737] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 160.513890][ T6737] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 160.545377][ T6741] CUSE: unknown device info "" [ 160.557566][ T6741] CUSE: unknown device info "Ö" [ 160.568242][ T6741] CUSE: unknown device info "" [ 160.580988][ T6741] CUSE: unknown device info "" [ 160.594596][ T6741] CUSE: unknown device info "" [ 160.604690][ T6741] CUSE: unknown device info "" [ 160.620728][ T6744] tmpfs: Unknown parameter 'usrquota/ÌÄzL6)Øô¨¾ýµ—ν¥ùO6 [ 160.620728][ T6744] 1¹P‡Ë¬4wˆ§è!‡úæ' [ 160.636606][ T30] audit: type=1400 audit(1784937420.396:348): avc: denied { write } for pid=6742 comm="syz.4.264" name="strings" dev="configfs" ino=9920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 160.665529][ T6741] CUSE: unknown device info "ðÿÿÿ" [ 160.686968][ T6741] CUSE: unknown device info "" [ 160.695096][ T6741] CUSE: unknown device info "" [ 160.703219][ T30] audit: type=1400 audit(1784937420.396:349): avc: denied { write } for pid=6742 comm="syz.4.264" name="functions" dev="configfs" ino=8880 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 160.730288][ T6741] CUSE: unknown device info "" [ 160.744156][ T6741] CUSE: unknown device info "" [ 160.751262][ T6741] CUSE: unknown device info "r" [ 160.756395][ T6741] CUSE: unknown device info "ýÿÿÿÿÿÿÿ#Û" [ 160.762567][ T30] audit: type=1400 audit(1784937420.406:350): avc: denied { write } for pid=6742 comm="syz.4.264" name="c.1" dev="configfs" ino=9919 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 160.786455][ T6741] CUSE: unknown device info "ÿÿÿÿ" [ 160.797027][ T6741] CUSE: unknown device info "" [ 160.802129][ T6741] CUSE: unknown device info "€" [ 160.808360][ T6741] CUSE: DEVNAME unspecified [ 160.813185][ T30] audit: type=1400 audit(1784937420.406:351): avc: denied { write } for pid=6742 comm="syz.4.264" name="c.1" dev="configfs" ino=9919 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 160.915022][ T5343] usb 3-1: new low-speed USB device number 5 using dummy_hcd [ 161.046519][ T6747] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 161.510850][ T5343] usb 3-1: config 0 has an invalid interface number: 146 but max is 0 [ 162.256870][ T6754] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 162.263845][ T6754] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 162.269891][ T6754] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 162.270804][ T5343] usb 3-1: config 0 has no interface number 0 [ 162.275966][ T6754] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 162.288444][ T6754] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 162.406661][ T5343] usb 3-1: config 0 interface 146 has no altsetting 0 [ 162.472035][ T5343] usb 3-1: string descriptor 0 read error: -71 [ 162.516911][ T5343] usb 3-1: New USB device found, idVendor=17cc, idProduct=4711, bcdDevice=37.4c [ 162.594059][ T5343] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 162.648693][ T5343] usb 3-1: config 0 descriptor?? [ 162.676907][ T5343] usb 3-1: can't set config #0, error -71 [ 162.706054][ T5343] usb 3-1: USB disconnect, device number 5 [ 162.812293][ T30] audit: type=1400 audit(1784937422.616:352): avc: denied { ioctl } for pid=6773 comm="syz-executor" path="socket:[11158]" dev="sockfs" ino=11158 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 162.857591][ T5614] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 162.867719][ T5614] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 162.878497][ T5614] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 162.886227][ T5614] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 162.896517][ T5614] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 162.914269][ T6763] configfs-gadget.g1 gadget.32: uvc: uvc_function_unbind() [ 162.979947][ T6778] fuse: Invalid rootmode [ 162.992976][ T6778] netlink: 'syz.3.272': attribute type 10 has an invalid length. [ 163.000727][ T6778] netlink: 40 bytes leftover after parsing attributes in process `syz.3.272'. [ 163.751573][ T6769] UDC core: g1: couldn't find an available UDC or it's busy [ 163.892211][ T30] audit: type=1400 audit(1784937423.696:353): avc: denied { read write } for pid=5607 comm="syz-executor" name="loop4" dev="devtmpfs" ino=651 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 163.916373][ T30] audit: type=1400 audit(1784937423.706:354): avc: denied { open } for pid=5607 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=651 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 163.966175][ T30] audit: type=1400 audit(1784937423.716:355): avc: denied { ioctl } for pid=5607 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=651 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 164.449509][ T5614] Bluetooth: hci1: command 0x0c1a tx timeout [ 164.456472][ T5614] Bluetooth: hci4: command 0x0c1a tx timeout [ 164.462888][ T5614] Bluetooth: hci2: command 0x0c1a tx timeout [ 164.468917][ T5614] Bluetooth: hci0: command 0x0c1a tx timeout [ 164.914499][ T6792] CUSE: unknown device info "" [ 164.919437][ T6792] CUSE: unknown device info "Ö" [ 164.924405][ T6792] CUSE: unknown device info "" [ 164.929255][ T6792] CUSE: unknown device info "" [ 164.934690][ T6792] CUSE: unknown device info "" [ 164.939546][ T6792] CUSE: unknown device info "" [ 165.040609][ T5615] Bluetooth: hci5: command tx timeout [ 165.112417][ T6792] CUSE: unknown device info "ðÿÿÿ" [ 165.304229][ T6795] tmpfs: Unknown parameter 'usrquota/ÌÄzL6)Øô¨¾ýµ—ν¥ùO6 [ 165.304229][ T6795] 1¹P‡Ë¬4wˆ§è!‡úæ' [ 165.346163][ T6792] CUSE: unknown device info "" [ 165.351057][ T6792] CUSE: unknown device info "" [ 165.386598][ T6792] CUSE: unknown device info "" [ 165.391579][ T6792] CUSE: unknown device info "" [ 165.396534][ T6792] CUSE: unknown device info "r" [ 165.419516][ T6792] CUSE: unknown device info "ýÿÿÿÿÿÿÿ#Û" [ 165.447472][ T6792] CUSE: unknown device info "ÿÿÿÿ" [ 165.469697][ T6792] CUSE: unknown device info "" [ 165.492355][ T6792] CUSE: unknown device info "€" [ 165.517098][ T6792] CUSE: DEVNAME unspecified [ 165.540487][ T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 165.577393][ T6790] syzkaller0: entered promiscuous mode [ 165.592220][ T6790] syzkaller0: entered allmulticast mode [ 165.717413][ T6809] netlink: 'syz.1.277': attribute type 10 has an invalid length. [ 165.728755][ T6809] bond0: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 165.958441][ T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 166.499030][ T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 166.560723][ T10] usb 3-1: new low-speed USB device number 6 using dummy_hcd [ 166.648654][ T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 166.764341][ T10] usb 3-1: config 0 has an invalid interface number: 146 but max is 0 [ 166.787714][ T30] audit: type=1400 audit(1784937426.596:356): avc: denied { append } for pid=6824 comm="syz.4.284" name="sg0" dev="devtmpfs" ino=798 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 166.845398][ T30] audit: type=1400 audit(1784937426.656:357): avc: denied { connect } for pid=6824 comm="syz.4.284" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 166.851451][ T10] usb 3-1: config 0 has no interface number 0 [ 166.878378][ T30] audit: type=1400 audit(1784937426.656:358): avc: denied { write } for pid=6824 comm="syz.4.284" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 166.897558][ T10] usb 3-1: config 0 interface 146 has no altsetting 0 [ 166.899927][ T10] usb 3-1: string descriptor 0 read error: -22 [ 167.611057][ T5615] Bluetooth: hci5: command tx timeout [ 167.890744][ T10] usb 3-1: New USB device found, idVendor=17cc, idProduct=4711, bcdDevice=37.4c [ 168.859918][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 168.870260][ T10] usb 3-1: config 0 descriptor?? [ 168.871598][ T6831] netlink: 'syz.1.285': attribute type 10 has an invalid length. [ 168.915047][ T10] usb 3-1: can't set config #0, error -71 [ 168.928460][ T10] usb 3-1: USB disconnect, device number 6 [ 169.272646][ T6847] 9pnet_fd: Insufficient options for proto=fd [ 169.280356][ T6847] IPVS: set_ctl: invalid protocol: 92 172.20.20.39:20002 [ 169.293101][ T187] IPVS: starting estimator thread 0... [ 169.402279][ T6848] IPVS: using max 42 ests per chain, 100800 per kthread [ 169.548688][ T6851] CUSE: unknown device info "" [ 169.581174][ T6851] CUSE: unknown device info "Ö" [ 169.586228][ T6851] CUSE: unknown device info "" [ 169.591073][ T6851] CUSE: unknown device info "" [ 169.602324][ T6851] CUSE: unknown device info "" [ 169.606990][ T30] audit: type=1400 audit(1784937429.416:359): avc: denied { search } for pid=5272 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 169.607712][ T6851] CUSE: unknown device info "" [ 169.633695][ T6851] CUSE: unknown device info "ðÿÿÿ" [ 169.638815][ T6851] CUSE: unknown device info "" [ 169.644398][ T30] audit: type=1400 audit(1784937429.436:360): avc: denied { search } for pid=5272 comm="dhcpcd" name="udev" dev="tmpfs" ino=9 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 169.654662][ T6852] tmpfs: Unknown parameter 'usrquota/ÌÄzL6)Øô¨¾ýµ—ν¥ùO6 [ 169.654662][ T6852] 1¹P‡Ë¬4wˆ§è!‡úæ' [ 169.676909][ T30] audit: type=1400 audit(1784937429.436:361): avc: denied { search } for pid=5272 comm="dhcpcd" name="data" dev="tmpfs" ino=14 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 169.701176][ T6851] CUSE: unknown device info "" [ 169.706705][ T6851] CUSE: unknown device info "" [ 169.719541][ T6851] CUSE: unknown device info "" [ 169.721134][ T30] audit: type=1400 audit(1784937429.436:362): avc: denied { read } for pid=5272 comm="dhcpcd" name="n30" dev="tmpfs" ino=2827 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 169.731181][ T6851] CUSE: unknown device info "r" [ 169.786431][ T6851] CUSE: unknown device info "ýÿÿÿÿÿÿÿ#Û" [ 169.796249][ T30] audit: type=1400 audit(1784937429.446:363): avc: denied { open } for pid=5272 comm="dhcpcd" path="/run/udev/data/n30" dev="tmpfs" ino=2827 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 169.805228][ T6851] CUSE: unknown device info "ÿÿÿÿ" [ 169.824836][ T30] audit: type=1400 audit(1784937429.446:364): avc: denied { getattr } for pid=5272 comm="dhcpcd" path="/run/udev/data/n30" dev="tmpfs" ino=2827 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 169.863366][ T6851] CUSE: unknown device info "" [ 169.887085][ T6851] CUSE: unknown device info "€" [ 169.902243][ T6851] CUSE: DEVNAME unspecified [ 169.960281][ T5615] Bluetooth: hci5: command tx timeout [ 170.086243][ T30] audit: type=1400 audit(1784937429.896:365): avc: denied { read } for pid=6870 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=1777 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 170.210277][ T13] bridge_slave_1: left allmulticast mode [ 170.231593][ T13] bridge_slave_1: left promiscuous mode [ 170.247099][ T6878] binder: 6877:6878 ioctl c0306201 200000000040 returned -22 [ 170.251738][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 171.251705][ T13] bridge_slave_0: left allmulticast mode [ 171.285212][ T13] bridge_slave_0: left promiscuous mode [ 171.304225][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 171.992224][ T5615] Bluetooth: hci5: command tx timeout [ 172.083200][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 172.083248][ T30] audit: type=1400 audit(1784937431.746:369): avc: denied { write } for pid=6868 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 172.561212][ T30] audit: type=1400 audit(1784937431.756:370): avc: denied { add_name } for pid=6868 comm="dhcpcd-run-hook" name="resolv.conf.eth1.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 172.706560][ T30] audit: type=1400 audit(1784937431.756:371): avc: denied { create } for pid=6868 comm="dhcpcd-run-hook" name="resolv.conf.eth1.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 172.881928][ T30] audit: type=1400 audit(1784937431.756:372): avc: denied { write } for pid=6868 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf.eth1.link" dev="tmpfs" ino=2866 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 172.955029][ T30] audit: type=1400 audit(1784937431.756:373): avc: denied { append } for pid=6868 comm="dhcpcd-run-hook" name="resolv.conf.eth1.link" dev="tmpfs" ino=2866 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 172.991741][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 173.009950][ T30] audit: type=1400 audit(1784937432.626:374): avc: denied { write } for pid=6907 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 173.037550][ T30] audit: type=1400 audit(1784937432.626:375): avc: denied { remove_name } for pid=6907 comm="rm" name="resolv.conf.eth1.link" dev="tmpfs" ino=2866 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 173.061866][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 173.084616][ T13] bond0 (unregistering): Released all slaves [ 173.093354][ T30] audit: type=1400 audit(1784937432.626:376): avc: denied { unlink } for pid=6907 comm="rm" name="resolv.conf.eth1.link" dev="tmpfs" ino=2866 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 173.131301][ T5272] 8021q: adding VLAN 0 to HW filter on device eth1 [ 173.394100][ T6897] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 173.400138][ T6897] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 173.406192][ T6897] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 173.412216][ T6897] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 173.418200][ T6897] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 173.424190][ T6897] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 173.523171][ T6897] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 173.791349][ T6921] CUSE: unknown device info "" [ 173.827131][ T6921] CUSE: unknown device info "Ö" [ 173.845567][ T6773] bridge0: port 1(bridge_slave_0) entered blocking state [ 173.876557][ T6921] CUSE: unknown device info "" [ 173.904854][ T6773] bridge0: port 1(bridge_slave_0) entered disabled state [ 173.932706][ T6922] tmpfs: Unknown parameter 'usrquota/ÌÄzL6)Øô¨¾ýµ—ν¥ùO6 [ 173.932706][ T6922] 1¹P‡Ë¬4wˆ§è!‡úæ' [ 173.969601][ T6773] bridge_slave_0: entered allmulticast mode [ 174.009436][ T6921] CUSE: unknown device info "" [ 174.019302][ T6773] bridge_slave_0: entered promiscuous mode [ 174.038716][ T6921] CUSE: unknown device info "" [ 174.060816][ T6773] bridge0: port 2(bridge_slave_1) entered blocking state [ 174.077078][ T6921] CUSE: unknown device info "" [ 174.117371][ T6773] bridge0: port 2(bridge_slave_1) entered disabled state [ 174.125016][ T6773] bridge_slave_1: entered allmulticast mode [ 174.131797][ T6921] CUSE: unknown device info "ðÿÿÿ" [ 174.132272][ T6773] bridge_slave_1: entered promiscuous mode [ 174.167072][ T6773] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 174.175215][ T6921] CUSE: unknown device info "" [ 174.184377][ T6773] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 174.220330][ T6921] CUSE: unknown device info "" [ 174.246644][ T6921] CUSE: unknown device info "" [ 174.268946][ T6921] CUSE: unknown device info "" [ 174.285598][ T6921] CUSE: unknown device info "r" [ 174.293946][ T6937] binder: 6936:6937 ioctl c0306201 200000000040 returned -22 [ 174.316248][ T6921] CUSE: unknown device info "ýÿÿÿÿÿÿÿ#Û" [ 174.324090][ T6921] CUSE: unknown device info "ÿÿÿÿ" [ 174.380996][ T6921] CUSE: unknown device info "" [ 174.401443][ T6921] CUSE: unknown device info "€" [ 174.440352][ T6921] CUSE: DEVNAME unspecified [ 175.432379][ T5614] Bluetooth: hci5: command 0x0c1a tx timeout [ 175.438844][ T5615] Bluetooth: hci4: command 0x0c1a tx timeout [ 175.445180][ T5623] Bluetooth: hci2: command 0x0c1a tx timeout [ 175.451199][ T5625] Bluetooth: hci0: command 0x0c1a tx timeout [ 175.451292][ T5612] Bluetooth: hci1: command 0x0c1a tx timeout [ 175.506554][ T6773] team0: Port device team_slave_0 added [ 175.514534][ T6773] team0: Port device team_slave_1 added [ 175.541080][ T6773] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 175.791628][ T6773] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 176.107577][ T6773] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 176.449542][ T6955] fuse: Invalid rootmode [ 176.468869][ T6955] netlink: 'syz.3.311': attribute type 10 has an invalid length. [ 176.476816][ T6955] netlink: 40 bytes leftover after parsing attributes in process `syz.3.311'. [ 177.227137][ T6773] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 177.241405][ T6773] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 178.217437][ T5612] Bluetooth: hci5: command 0x0c1a tx timeout [ 178.249548][ T6773] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 178.542391][ T30] audit: type=1400 audit(1784937438.346:377): avc: denied { write } for pid=6924 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 179.989276][ T30] audit: type=1400 audit(1784937439.796:378): avc: denied { write } for pid=6962 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 180.205695][ T24] IPVS: starting estimator thread 0... [ 180.304920][ T5612] Bluetooth: hci5: command 0x0c1a tx timeout [ 180.482410][ T6975] IPVS: using max 41 ests per chain, 98400 per kthread [ 180.717261][ T6983] binder: 6981:6983 ioctl c0306201 200000000040 returned -22 [ 181.689718][ T6991] 9pnet_fd: Insufficient options for proto=fd [ 181.696862][ T6991] IPVS: set_ctl: invalid protocol: 92 172.20.20.39:20002 [ 181.716349][ T5272] 8021q: adding VLAN 0 to HW filter on device eth2 [ 181.779942][ T6773] hsr_slave_0: entered promiscuous mode [ 181.801231][ T6773] hsr_slave_1: entered promiscuous mode [ 181.996441][ T6773] debugfs: 'hsr0' already exists in 'hsr' [ 182.004850][ T6773] Cannot create hsr debugfs directory [ 183.856537][ T13] hsr_slave_0: left promiscuous mode [ 183.863396][ T13] hsr_slave_1: left promiscuous mode [ 183.869237][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 183.876857][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 183.913427][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 183.926605][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 184.036731][ T13] veth1_macvtap: left promiscuous mode [ 184.043021][ T13] veth0_macvtap: left promiscuous mode [ 184.048597][ T13] veth1_vlan: left promiscuous mode [ 184.055836][ T13] veth0_vlan: left promiscuous mode [ 184.323383][ T7018] 9pnet_fd: Insufficient options for proto=fd [ 184.330491][ T7018] IPVS: set_ctl: invalid protocol: 92 172.20.20.39:20002 [ 184.496502][ T13] team0 (unregistering): Port device team_slave_1 removed [ 184.518796][ T13] team0 (unregistering): Port device team_slave_0 removed [ 184.597110][ T7006] syzkaller0: entered promiscuous mode [ 184.603255][ T7006] syzkaller0: entered allmulticast mode [ 184.763139][ T7020] UDC core: g1: couldn't find an available UDC or it's busy [ 184.919240][ T30] audit: type=1400 audit(1784937444.726:379): avc: denied { transfer } for pid=7023 comm="syz.1.329" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 186.680813][ T7039] tipc: Enabling of bearer rejected, failed to enable media [ 186.696490][ T7032] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 186.703348][ T7032] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 186.709363][ T7032] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 186.715529][ T7032] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 186.721565][ T7032] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 186.996821][ T6773] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 188.092440][ T6773] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 188.109958][ T6773] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 188.636965][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 188.655006][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 188.792426][ T5614] Bluetooth: hci5: command 0x0c1a tx timeout [ 188.798726][ T5614] Bluetooth: hci4: command 0x0c1a tx timeout [ 188.804872][ T5614] Bluetooth: hci2: command 0x0c1a tx timeout [ 188.811258][ T5614] Bluetooth: hci0: command 0x0c1a tx timeout [ 188.817265][ T5614] Bluetooth: hci1: command 0x0c1a tx timeout [ 188.882014][ T6773] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 188.890734][ T6773] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 188.916093][ T6773] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 188.931084][ T6773] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 188.940052][ T7060] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 188.952115][ T6773] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 188.952489][ T7060] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 188.967089][ T7060] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 188.973162][ T7060] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 188.974796][ T30] audit: type=1400 audit(1784937448.786:380): avc: denied { write } for pid=7028 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 188.979854][ T7060] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 189.018937][ T7071] syzkaller1: entered promiscuous mode [ 189.024559][ T7071] syzkaller1: entered allmulticast mode [ 189.221811][ T30] audit: type=1400 audit(1784937449.026:381): avc: denied { write } for pid=7076 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 189.767662][ T29] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 189.878501][ T13] IPVS: stop unused estimator thread 0... [ 189.998832][ T29] usb 2-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 190.109664][ T29] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 190.251367][ T5272] 8021q: adding VLAN 0 to HW filter on device eth3 [ 190.261484][ T29] usb 2-1: config 0 descriptor?? [ 190.394658][ T6773] 8021q: adding VLAN 0 to HW filter on device bond0 [ 190.579925][ T6773] 8021q: adding VLAN 0 to HW filter on device team0 [ 190.595544][ T76] bridge0: port 1(bridge_slave_0) entered blocking state [ 190.603080][ T76] bridge0: port 1(bridge_slave_0) entered forwarding state [ 190.632504][ T76] bridge0: port 2(bridge_slave_1) entered blocking state [ 190.639653][ T76] bridge0: port 2(bridge_slave_1) entered forwarding state [ 191.061979][ T5614] Bluetooth: hci5: command 0x0c1a tx timeout [ 191.068078][ T5612] Bluetooth: hci4: command 0x0c1a tx timeout [ 191.074100][ T5612] Bluetooth: hci2: command 0x0c1a tx timeout [ 191.080090][ T5612] Bluetooth: hci0: command 0x0c1a tx timeout [ 191.086146][ T5614] Bluetooth: hci1: command 0x0c1a tx timeout [ 191.287822][ T29] udl 2-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 191.324828][ T29] [drm:udl_init] *ERROR* Selecting channel failed [ 191.402705][ T29] [drm] Initialized udl 0.0.1 for 2-1:0.0 on minor 2 [ 191.422762][ T29] [drm] Initialized udl on minor 2 [ 191.441826][ T29] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 191.492764][ T29] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 191.542421][ T24] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 191.550820][ T29] usb 2-1: USB disconnect, device number 4 [ 191.588401][ T24] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 191.809147][ T30] audit: type=1400 audit(1784937451.616:382): avc: denied { write } for pid=7102 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 192.317397][ T30] audit: type=1400 audit(1784937452.116:383): avc: denied { write } for pid=7132 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 192.590260][ T5272] 8021q: adding VLAN 0 to HW filter on device eth4 [ 192.802221][ T9] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 193.004732][ T9] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 193.037808][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 193.115085][ T7151] netlink: 'syz.1.349': attribute type 10 has an invalid length. [ 193.122874][ T7151] netlink: 40 bytes leftover after parsing attributes in process `syz.1.349'. [ 193.861789][ T6773] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 193.998099][ T9] usb 4-1: Product: syz [ 194.002485][ T9] usb 4-1: Manufacturer: syz [ 194.007099][ T9] usb 4-1: SerialNumber: syz [ 194.031764][ T10] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 194.974806][ T7136] netlink: 'syz.3.348': attribute type 2 has an invalid length. [ 195.109883][ T7169] netlink: 'syz.3.348': attribute type 2 has an invalid length. [ 195.113505][ T10] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 195.142024][ T10] ath9k_htc: Failed to initialize the device [ 195.189009][ T7169] netlink: 67 bytes leftover after parsing attributes in process `syz.3.348'. [ 195.202234][ T10] usb 4-1: ath9k_htc: USB layer deinitialized [ 195.488152][ T7176] netlink: 'syz.1.352': attribute type 10 has an invalid length. [ 195.769389][ T9] usb 4-1: USB disconnect, device number 3 [ 195.875898][ T6773] veth0_vlan: entered promiscuous mode [ 195.887980][ T6773] veth1_vlan: entered promiscuous mode [ 195.917764][ T6773] veth0_macvtap: entered promiscuous mode [ 195.927554][ T6773] veth1_macvtap: entered promiscuous mode [ 195.946435][ T6773] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 195.973670][ T6773] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 196.181673][ T3361] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 196.195737][ T3361] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 196.207733][ T3361] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 196.216900][ T3361] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 198.037009][ T7186] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 198.043119][ T7186] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 198.049132][ T7186] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 198.055177][ T7186] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 198.061183][ T7186] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 198.211002][ T3361] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 198.222828][ T3361] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 200.162519][ T5614] Bluetooth: hci4: command 0x0c1a tx timeout [ 200.168650][ T5615] Bluetooth: hci2: command 0x0c1a tx timeout [ 200.174735][ T5623] Bluetooth: hci0: command 0x0c1a tx timeout [ 200.180736][ T5625] Bluetooth: hci1: command 0x0c1a tx timeout [ 200.186999][ T5612] Bluetooth: hci5: command 0x0c1a tx timeout [ 200.223264][ T7198] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 200.229316][ T7198] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 200.235390][ T7198] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 200.241397][ T7198] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 200.247405][ T7198] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 200.596852][ T6178] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 201.585025][ T6178] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 201.604694][ T7214] netlink: 4 bytes leftover after parsing attributes in process `syz.4.361'. [ 201.623506][ T30] audit: type=1400 audit(1784937461.436:384): avc: denied { unmount } for pid=6773 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 202.553777][ T5615] Bluetooth: hci5: command 0x0c1a tx timeout [ 202.559819][ T5615] Bluetooth: hci4: command 0x0c1a tx timeout [ 202.566262][ T5612] Bluetooth: hci2: command 0x0c1a tx timeout [ 202.573042][ T5615] Bluetooth: hci0: command 0x0c1a tx timeout [ 202.579957][ T5612] Bluetooth: hci1: command 0x0c1a tx timeout [ 202.586472][ T7214] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 202.632592][ T7214] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 203.601022][ T7214] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 204.294392][ T7214] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 208.377706][ T7256] netlink: 'syz.2.370': attribute type 10 has an invalid length. [ 208.385498][ T7256] netlink: 40 bytes leftover after parsing attributes in process `syz.2.370'. [ 209.128075][ T7260] ======================================================= [ 209.128075][ T7260] WARNING: The mand mount option has been deprecated and [ 209.128075][ T7260] and is ignored by this kernel. Remove the mand [ 209.128075][ T7260] option from the mount to silence this warning. [ 209.128075][ T7260] ======================================================= [ 211.456250][ T30] audit: type=1400 audit(1784937471.256:385): avc: denied { write } for pid=7227 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 212.660056][ T30] audit: type=1400 audit(1784937472.466:386): avc: denied { write } for pid=7301 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 213.692285][ T30] audit: type=1400 audit(1784937473.496:387): avc: denied { bind } for pid=7309 comm="syz.3.385" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 214.939921][ T7326] netlink: 4 bytes leftover after parsing attributes in process `syz.1.389'. [ 214.948795][ T7326] bridge_slave_1: left allmulticast mode [ 214.954571][ T7326] bridge_slave_1: left promiscuous mode [ 214.961569][ T7326] bridge0: port 2(bridge_slave_1) entered disabled state [ 215.294967][ T7326] bridge_slave_0: left allmulticast mode [ 215.300633][ T7326] bridge_slave_0: left promiscuous mode [ 215.306379][ T7326] bridge0: port 1(bridge_slave_0) entered disabled state [ 216.443787][ T30] audit: type=1400 audit(1784937476.246:388): avc: denied { write } for pid=7320 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 217.072454][ T30] audit: type=1400 audit(1784937476.336:389): avc: denied { write } for pid=7345 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 217.389213][ T7328] Set syz1 is full, maxelem 65536 reached [ 217.649737][ T7350] syzkaller0: entered promiscuous mode [ 217.668730][ T7350] syzkaller0: entered allmulticast mode [ 217.685956][ T7350] tipc: Started in network mode [ 217.691815][ T7350] tipc: Node identity 9ab0fc4e436, cluster identity 4711 [ 217.699034][ T7350] tipc: Enabled bearer , priority 0 [ 217.712105][ T7350] tipc: Resetting bearer [ 217.728190][ T7349] tipc: Resetting bearer [ 218.011280][ T7359] netlink: 'syz.3.395': attribute type 10 has an invalid length. [ 218.019098][ T7359] netlink: 40 bytes leftover after parsing attributes in process `syz.3.395'. [ 218.672771][ T7349] tipc: Disabling bearer [ 219.685905][ T7362] syzkaller0: entered promiscuous mode [ 219.691459][ T7362] syzkaller0: entered allmulticast mode [ 220.871277][ T5343] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 221.123843][ T30] audit: type=1400 audit(1784937480.896:390): avc: denied { write } for pid=7363 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 221.201731][ T5343] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 221.228792][ T5343] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 221.264942][ T5343] usb 4-1: Product: syz [ 221.279431][ T5343] usb 4-1: Manufacturer: syz [ 221.301809][ T5343] usb 4-1: SerialNumber: syz [ 221.320646][ T30] audit: type=1400 audit(1784937481.126:391): avc: denied { write } for pid=7394 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 221.430531][ T29] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 221.647791][ T7385] netlink: 'syz.3.401': attribute type 2 has an invalid length. [ 221.749891][ T5612] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 221.759774][ T5612] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 221.768262][ T5612] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 221.776128][ T5612] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 221.784411][ T5612] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 221.864035][ T7406] netlink: 'syz.3.401': attribute type 2 has an invalid length. [ 221.881071][ T7406] netlink: 67 bytes leftover after parsing attributes in process `syz.3.401'. [ 222.952344][ T29] usb 4-1: Service connection timeout for: 256 [ 222.964280][ T29] ath9k_htc 4-1:1.0: ath9k_htc: Unable to initialize HTC services [ 222.990381][ T29] ath9k_htc: Failed to initialize the device [ 223.247580][ T29] usb 4-1: ath9k_htc: USB layer deinitialized [ 223.835586][ T5612] Bluetooth: hci3: command tx timeout [ 224.423670][ T9] usb 4-1: USB disconnect, device number 4 [ 224.583776][ T7422] tipc: Started in network mode [ 224.610811][ T7422] tipc: Node identity 92ce98f14139, cluster identity 4711 [ 224.643066][ T7422] tipc: Enabled bearer , priority 0 [ 224.703803][ T7432] netlink: 4 bytes leftover after parsing attributes in process `syz.5.409'. [ 224.737047][ T3361] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 224.775749][ T7433] syzkaller0: entered promiscuous mode [ 224.786007][ T7433] syzkaller0: entered allmulticast mode [ 224.808511][ T7432] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 224.825920][ T7432] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 224.837246][ T7439] binder: 7438:7439 ioctl c0306201 0 returned -14 [ 224.855147][ T7432] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 224.860112][ T7439] binder_alloc: 7438: binder_alloc_buf, no vma [ 224.873237][ T7432] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 224.960937][ T7433] tipc: Resetting bearer [ 224.969834][ T30] audit: type=1400 audit(1784937484.776:392): avc: denied { write } for pid=7418 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 225.042893][ T3361] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 225.086929][ T7421] tipc: Resetting bearer [ 225.109551][ T30] audit: type=1400 audit(1784937484.916:393): avc: denied { write } for pid=7450 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 225.109992][ T7421] tipc: Disabling bearer [ 225.249707][ T3361] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 225.920500][ T5614] Bluetooth: hci3: command tx timeout [ 227.956166][ T3361] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 228.062247][ T5612] Bluetooth: hci3: command tx timeout [ 228.752739][ T7476] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 228.758789][ T7476] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 228.764829][ T7476] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 228.770811][ T7476] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 228.776843][ T7476] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 228.782787][ T7476] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 228.852501][ T7476] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 229.223216][ T9] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 229.634965][ T9] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 229.695422][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 230.008274][ T9] usb 6-1: Product: syz [ 230.039732][ T9] usb 6-1: Manufacturer: syz [ 230.059882][ T9] usb 6-1: SerialNumber: syz [ 230.131153][ T5717] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 230.274131][ T7500] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 230.280311][ T7500] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 230.286482][ T7500] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 230.292601][ T7500] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 230.298695][ T7500] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 230.371932][ T7486] netlink: 'syz.5.417': attribute type 2 has an invalid length. [ 230.446045][ T7510] tipc: Enabling of bearer rejected, failed to enable media [ 230.539357][ T7519] netlink: 'syz.5.417': attribute type 2 has an invalid length. [ 230.605680][ T7519] netlink: 67 bytes leftover after parsing attributes in process `syz.5.417'. [ 230.690792][ T7402] bridge0: port 1(bridge_slave_0) entered blocking state [ 230.734249][ T7402] bridge0: port 1(bridge_slave_0) entered disabled state [ 230.780492][ T7402] bridge_slave_0: entered allmulticast mode [ 230.855041][ T7402] bridge_slave_0: entered promiscuous mode [ 230.933386][ T7402] bridge0: port 2(bridge_slave_1) entered blocking state [ 231.003177][ T7402] bridge0: port 2(bridge_slave_1) entered disabled state [ 231.020152][ T5343] usb 6-1: USB disconnect, device number 2 [ 231.130992][ T7402] bridge_slave_1: entered allmulticast mode [ 231.310311][ T7402] bridge_slave_1: entered promiscuous mode [ 231.375662][ T3361] bridge_slave_1: left allmulticast mode [ 231.388597][ T3361] bridge_slave_1: left promiscuous mode [ 231.394967][ T3361] bridge0: port 2(bridge_slave_1) entered disabled state [ 231.415073][ T3361] bridge_slave_0: left allmulticast mode [ 231.424964][ T3361] bridge_slave_0: left promiscuous mode [ 231.439592][ T3361] bridge0: port 1(bridge_slave_0) entered disabled state [ 231.620417][ T30] audit: type=1400 audit(1784937491.426:394): avc: denied { write } for pid=7528 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 231.920093][ T5717] usb 6-1: Service connection timeout for: 256 [ 232.015440][ T5717] ath9k_htc 6-1:1.0: ath9k_htc: Unable to initialize HTC services [ 232.601126][ T5612] Bluetooth: hci5: command 0x0c1a tx timeout [ 232.607194][ T5615] Bluetooth: hci4: command 0x0c1a tx timeout [ 232.613216][ T5615] Bluetooth: hci2: command 0x0c1a tx timeout [ 232.619197][ T5615] Bluetooth: hci1: command 0x0c1a tx timeout [ 232.625205][ T5614] Bluetooth: hci3: command 0x0c1a tx timeout [ 233.025527][ T5717] ath9k_htc: Failed to initialize the device [ 233.190896][ T5343] usb 6-1: ath9k_htc: USB layer deinitialized [ 234.088335][ T7558] netlink: 68 bytes leftover after parsing attributes in process `syz.1.430'. [ 234.180915][ T30] audit: type=1400 audit(1784937493.986:395): avc: denied { write } for pid=7547 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 234.637317][ T5625] Bluetooth: hci3: command 0x0c1a tx timeout [ 235.825990][ T3361] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 235.851532][ T3361] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 235.874628][ T3361] bond0 (unregistering): Released all slaves [ 235.951348][ T7402] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 236.009047][ T7402] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 236.250661][ T5272] 8021q: adding VLAN 0 to HW filter on device eth5 [ 237.210733][ T5625] Bluetooth: hci3: command 0x0c1a tx timeout [ 237.239546][ T7402] team0: Port device team_slave_0 added [ 237.263307][ T7402] team0: Port device team_slave_1 added [ 239.210203][ T7402] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 239.224967][ T7402] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 239.879650][ T7402] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 239.892843][ T7402] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 239.899886][ T7402] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 240.010064][ T7402] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 240.051558][ T7595] netlink: 68 bytes leftover after parsing attributes in process `syz.1.443'. [ 240.102706][ T7588] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 240.108819][ T7588] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 240.114922][ T7588] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 240.120966][ T7588] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 240.127733][ T7588] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 240.290729][ T7402] hsr_slave_0: entered promiscuous mode [ 240.381686][ T7402] hsr_slave_1: entered promiscuous mode [ 240.402861][ T7402] debugfs: 'hsr0' already exists in 'hsr' [ 240.475306][ T7402] Cannot create hsr debugfs directory [ 242.281002][ T5625] Bluetooth: hci3: command 0x0c1a tx timeout [ 242.287058][ T5625] Bluetooth: hci5: command 0x0c1a tx timeout [ 242.293082][ T5625] Bluetooth: hci4: command 0x0c1a tx timeout [ 242.299062][ T5625] Bluetooth: hci2: command 0x0c1a tx timeout [ 242.305486][ T5625] Bluetooth: hci1: command 0x0c1a tx timeout [ 244.017311][ T7610] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 244.023407][ T7610] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 244.029420][ T7610] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 244.035487][ T7610] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 244.042427][ T7610] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 244.522294][ T3361] hsr_slave_0: left promiscuous mode [ 244.539282][ T3361] hsr_slave_1: left promiscuous mode [ 244.587843][ T3361] veth1_macvtap: left promiscuous mode [ 244.626692][ T3361] veth0_macvtap: left promiscuous mode [ 244.650470][ T3361] veth1_vlan: left promiscuous mode [ 244.840708][ T3361] veth0_vlan: left promiscuous mode [ 246.431610][ T5625] Bluetooth: hci1: command 0x0c1a tx timeout [ 246.437723][ T5615] Bluetooth: hci3: command 0x0c1a tx timeout [ 246.444084][ T5625] Bluetooth: hci5: command 0x0c1a tx timeout [ 246.445969][ T5612] Bluetooth: hci2: command 0x0c1a tx timeout [ 246.462330][ T5614] Bluetooth: hci4: command 0x0c1a tx timeout [ 249.334326][ T3361] team0 (unregistering): Port device team_slave_1 removed [ 249.440570][ T3361] team0 (unregistering): Port device team_slave_0 removed [ 250.425160][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 250.431512][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 250.650628][ T30] audit: type=1400 audit(1784937510.436:396): avc: denied { write } for pid=7633 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 251.067642][ T30] audit: type=1400 audit(1784937510.876:397): avc: denied { write } for pid=7662 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 251.233154][ T5272] 8021q: adding VLAN 0 to HW filter on device eth6 [ 251.240504][ T6178] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 251.266625][ T6178] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 251.283591][ T7402] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 251.331105][ T7402] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 251.340251][ T7402] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 251.363729][ T7402] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 251.380882][ T7667] syzkaller0: entered promiscuous mode [ 251.392248][ T7667] syzkaller0: entered allmulticast mode [ 251.403703][ T6178] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 251.419427][ T30] audit: type=1400 audit(1784937511.216:398): avc: denied { watch watch_reads } for pid=7678 comm="syz.1.465" path="/104" dev="tmpfs" ino=562 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 251.457371][ T6178] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 251.478013][ T7669] tipc: Enabled bearer , priority 0 [ 251.511240][ T7669] tipc: Resetting bearer [ 251.525585][ T7402] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 251.539462][ T7402] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 251.547348][ T7402] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 251.560769][ T7402] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 251.584679][ T7666] tipc: Resetting bearer [ 251.627433][ T7666] tipc: Disabling bearer [ 251.680317][ T3361] IPVS: stop unused estimator thread 0... [ 251.841030][ T7402] 8021q: adding VLAN 0 to HW filter on device bond0 [ 251.881213][ T7402] 8021q: adding VLAN 0 to HW filter on device team0 [ 251.916789][ T53] bridge0: port 1(bridge_slave_0) entered blocking state [ 251.923942][ T53] bridge0: port 1(bridge_slave_0) entered forwarding state [ 251.997977][ T53] bridge0: port 2(bridge_slave_1) entered blocking state [ 252.005132][ T53] bridge0: port 2(bridge_slave_1) entered forwarding state [ 252.168426][ T30] audit: type=1400 audit(1784937511.976:399): avc: denied { unmount } for pid=5611 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 252.340593][ T30] audit: type=1400 audit(1784937512.146:400): avc: denied { write } for pid=7689 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 252.588708][ T30] audit: type=1400 audit(1784937512.396:401): avc: denied { write } for pid=7727 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 252.806180][ T5272] 8021q: adding VLAN 0 to HW filter on device eth7 [ 253.241156][ T7402] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 253.635311][ T30] audit: type=1400 audit(1784937513.436:402): avc: denied { write } for pid=7752 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 253.809058][ T30] audit: type=1400 audit(1784937513.616:403): avc: denied { write } for pid=7776 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 253.836347][ T5612] Bluetooth: hci5: command 0x0c1a tx timeout [ 253.863583][ T7402] veth0_vlan: entered promiscuous mode [ 253.896498][ T7402] veth1_vlan: entered promiscuous mode [ 253.945012][ T7779] tipc: Enabled bearer , priority 0 [ 253.976394][ T7779] tipc: Resetting bearer [ 253.984638][ T5272] 8021q: adding VLAN 0 to HW filter on device eth8 [ 253.993037][ T5623] Bluetooth: hci1: command 0x0c1a tx timeout [ 254.021132][ T7778] tipc: Disabling bearer [ 254.085181][ T7782] netlink: 68 bytes leftover after parsing attributes in process `syz.5.483'. [ 254.094760][ T7402] veth0_macvtap: entered promiscuous mode [ 254.126059][ T7402] veth1_macvtap: entered promiscuous mode [ 254.200366][ T7402] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 254.249783][ T7402] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 254.288399][ T12] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 254.328290][ T12] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 254.353769][ T12] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 254.884530][ T12] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 255.122860][ T53] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 255.202038][ T53] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 255.321292][ T53] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 255.336177][ T53] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 255.475023][ T30] audit: type=1400 audit(1784937515.216:404): avc: denied { setopt } for pid=7802 comm="syz.1.491" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 256.161253][ T5614] Bluetooth: hci5: command 0x0c1a tx timeout [ 256.168014][ T5614] Bluetooth: hci1: command 0x0c1a tx timeout [ 256.202692][ T30] audit: type=1400 audit(1784937515.286:405): avc: denied { bind } for pid=7802 comm="syz.1.491" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 256.710212][ T7820] netlink: 4 bytes leftover after parsing attributes in process `syz.6.403'. [ 256.719298][ T7820] bridge_slave_1: left allmulticast mode [ 256.725566][ T7820] bridge_slave_1: left promiscuous mode [ 256.731283][ T7820] bridge0: port 2(bridge_slave_1) entered disabled state [ 256.755958][ T7820] bridge_slave_0: left allmulticast mode [ 256.761623][ T7820] bridge_slave_0: left promiscuous mode [ 256.767454][ T7820] bridge0: port 1(bridge_slave_0) entered disabled state [ 257.034222][ T7828] syzkaller0: entered promiscuous mode [ 257.040303][ T7828] syzkaller0: entered allmulticast mode [ 259.270940][ T7853] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 260.382459][ T29] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 260.525117][ T30] audit: type=1400 audit(1784937520.336:406): avc: denied { ioctl } for pid=7864 comm="syz.5.507" path="socket:[16489]" dev="sockfs" ino=16489 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 260.563664][ T29] usb 2-1: Using ep0 maxpacket: 16 [ 260.573657][ T29] usb 2-1: config index 0 descriptor too short (expected 8192, got 56) [ 260.592637][ T29] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 260.603771][ T30] audit: type=1400 audit(1784937520.356:407): avc: denied { bind } for pid=7864 comm="syz.5.507" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 260.628315][ T29] usb 2-1: config 0 has no interfaces? [ 260.643345][ T29] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 260.667329][ T29] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 260.677045][ T30] audit: type=1400 audit(1784937520.356:408): avc: denied { read } for pid=7864 comm="syz.5.507" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 260.702174][ T29] usb 2-1: Manufacturer: syz [ 260.718386][ T29] usb 2-1: config 0 descriptor?? [ 260.852867][ T7866] bridge0: port 2(bridge_slave_1) entered disabled state [ 260.860422][ T7866] bridge0: port 1(bridge_slave_0) entered disabled state [ 261.054926][ T6178] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 261.064338][ T6178] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 261.075808][ T6178] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 261.085685][ T6178] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 261.723441][ T7887] binder: 7886:7887 ioctl c0306201 200000000040 returned -22 [ 261.985641][ T29] usb 2-1: USB disconnect, device number 5 [ 262.184930][ T5343] usb 7-1: new full-speed USB device number 2 using dummy_hcd [ 262.485604][ T5625] Bluetooth: hci3: command 0x0c1a tx timeout [ 262.663219][ T5343] usb 7-1: config 150 has an invalid interface number: 204 but max is 2 [ 262.671722][ T5343] usb 7-1: config 150 has 2 interfaces, different from the descriptor's value: 3 [ 262.681287][ T5343] usb 7-1: config 150 has no interface number 0 [ 262.687607][ T5343] usb 7-1: config 150 interface 204 has no altsetting 0 [ 262.696847][ T5343] usb 7-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=c7.eb [ 262.706034][ T5343] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 262.721598][ T5343] usb 7-1: Product: syz [ 262.725826][ T5343] usb 7-1: Manufacturer: syz [ 262.730808][ T5343] usb 7-1: SerialNumber: syz [ 263.514307][ T30] audit: type=1400 audit(1784937523.326:409): avc: denied { setopt } for pid=7918 comm="syz.5.524" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 263.682787][ T5343] xr_serial 7-1:150.204: skipping garbage [ 263.688568][ T5343] xr_serial 7-1:150.204: xr_serial converter detected [ 263.701014][ T1096] Bluetooth: hci0: Frame reassembly failed (-84) [ 263.784389][ T7924] binder: 7923:7924 ioctl c0306201 0 returned -14 [ 263.792408][ T7924] binder: 7923:7924 ioctl c0306201 200000000040 returned -22 [ 263.924199][ T5623] Bluetooth: hci4: command 0x0c1a tx timeout [ 264.154250][ T7897] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 264.172186][ T7897] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 264.207907][ T5343] usb 7-1: xr_serial converter now attached to ttyUSB0 [ 264.460618][ T5717] usb 7-1: USB disconnect, device number 2 [ 264.507475][ T5717] xr_serial ttyUSB0: xr_serial converter now disconnected from ttyUSB0 [ 264.564741][ T5614] Bluetooth: hci3: command 0x0c1a tx timeout [ 264.693932][ T7942] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 264.982420][ T29] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 265.040731][ T5717] xr_serial 7-1:150.204: device disconnected [ 265.212173][ T29] usb 2-1: Using ep0 maxpacket: 16 [ 265.265079][ T29] usb 2-1: config index 0 descriptor too short (expected 8192, got 56) [ 265.331134][ T29] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 265.448959][ T29] usb 2-1: config 0 has no interfaces? [ 265.519029][ T29] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 265.652896][ T29] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 265.733634][ T29] usb 2-1: Manufacturer: syz [ 265.747024][ T29] usb 2-1: config 0 descriptor?? [ 265.753840][ T5612] Bluetooth: hci0: command 0x1003 tx timeout [ 265.753859][ T5625] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 266.016894][ T5625] Bluetooth: hci4: command 0x0c1a tx timeout [ 267.490059][ T29] usb 2-1: USB disconnect, device number 6 [ 267.647984][ T7969] netlink: 36 bytes leftover after parsing attributes in process `syz.2.537'. [ 267.725830][ T30] audit: type=1400 audit(1784937527.536:410): avc: denied { write } for pid=7946 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 267.783006][ T7979] binder: 7976:7979 ioctl c0306201 0 returned -14 [ 267.787499][ T7979] binder: 7976:7979 ioctl c0306201 200000000040 returned -22 [ 267.910328][ T30] audit: type=1400 audit(1784937527.716:411): avc: denied { write } for pid=7981 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 268.959053][ T30] audit: type=1400 audit(1784937528.766:412): avc: denied { write } for pid=7994 comm="syz.6.546" name="strings" dev="configfs" ino=8882 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 269.009615][ T7997] UDC core: g1: couldn't find an available UDC or it's busy [ 269.062398][ T30] audit: type=1400 audit(1784937528.836:413): avc: denied { setopt } for pid=8000 comm="syz.5.548" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 270.219597][ T30] audit: type=1400 audit(1784937530.026:414): avc: denied { write } for pid=8005 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 270.358572][ T8036] binder: 8035:8036 ioctl c0306201 0 returned -14 [ 270.377118][ T8036] binder: 8035:8036 ioctl c0306201 200000000040 returned -22 [ 270.392195][ T30] audit: type=1400 audit(1784937530.196:415): avc: denied { write } for pid=8034 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 270.941888][ T8060] syzkaller1: entered promiscuous mode [ 270.952939][ T8060] syzkaller1: entered allmulticast mode [ 271.365134][ T5625] Bluetooth: hci1: command 0x0c1a tx timeout [ 271.392940][ T8058] netlink: 'syz.5.559': attribute type 10 has an invalid length. [ 271.502920][ T30] audit: type=1400 audit(1784937531.316:416): avc: denied { write } for pid=8042 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 271.776241][ T30] audit: type=1400 audit(1784937531.576:417): avc: denied { write } for pid=8079 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 272.075592][ T8091] netlink: 68 bytes leftover after parsing attributes in process `syz.5.570'. [ 272.154627][ T5795] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 272.166084][ T8094] netlink: 36 bytes leftover after parsing attributes in process `syz.5.571'. [ 272.329357][ T8102] tipc: Started in network mode [ 272.334369][ T8102] tipc: Node identity 763373173737, cluster identity 4711 [ 272.341585][ T8102] tipc: Enabled bearer , priority 0 [ 272.349810][ T5795] usb 2-1: config 150 has an invalid interface number: 204 but max is 2 [ 272.363530][ T5795] usb 2-1: config 150 has 2 interfaces, different from the descriptor's value: 3 [ 272.373862][ T8102] tipc: Resetting bearer [ 272.381327][ T5795] usb 2-1: config 150 has no interface number 0 [ 272.387959][ T5795] usb 2-1: config 150 interface 204 has no altsetting 0 [ 272.401957][ T8100] tipc: Disabling bearer [ 272.417898][ T5795] usb 2-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=c7.eb [ 272.509684][ T5795] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 272.524582][ T8106] syzkaller0: entered promiscuous mode [ 272.533403][ T5795] usb 2-1: Product: syz [ 272.548915][ T8106] syzkaller0: entered allmulticast mode [ 272.557621][ T5795] usb 2-1: Manufacturer: syz [ 272.567901][ T30] audit: type=1400 audit(1784937532.376:418): avc: denied { write } for pid=8089 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 272.591213][ T5795] usb 2-1: SerialNumber: syz [ 272.601462][ T8110] tipc: Enabled bearer , priority 0 [ 272.624201][ T8106] tipc: Resetting bearer [ 272.639501][ T8105] tipc: Resetting bearer [ 272.689834][ T8105] tipc: Disabling bearer [ 272.722478][ T8109] syzkaller0: entered promiscuous mode [ 272.731986][ T30] audit: type=1400 audit(1784937532.536:419): avc: denied { write } for pid=8112 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 272.738324][ T8109] syzkaller0: entered allmulticast mode [ 272.815270][ T5795] xr_serial 2-1:150.204: skipping garbage [ 272.843746][ T5795] xr_serial 2-1:150.204: xr_serial converter detected [ 272.863225][ T8121] netlink: 12 bytes leftover after parsing attributes in process `syz.3.576'. [ 272.878475][ T8121] netlink: 20 bytes leftover after parsing attributes in process `syz.3.576'. [ 272.977633][ T8117] syzkaller1: entered promiscuous mode [ 272.983283][ T8117] syzkaller1: entered allmulticast mode [ 273.217282][ T8132] netlink: 'syz.3.578': attribute type 10 has an invalid length. [ 273.482320][ T5623] Bluetooth: hci1: command 0x0c1a tx timeout [ 273.592197][ T8138] netlink: 36 bytes leftover after parsing attributes in process `syz.6.583'. [ 273.675457][ T8071] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 273.694627][ T8071] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 273.718334][ T5795] usb 2-1: xr_serial converter now attached to ttyUSB0 [ 273.763161][ T8148] UDC core: g1: couldn't find an available UDC or it's busy [ 274.016554][ T8155] netlink: 20 bytes leftover after parsing attributes in process `syz.6.588'. [ 274.056419][ T5717] usb 2-1: USB disconnect, device number 7 [ 274.077004][ T30] audit: type=1400 audit(1784937533.876:420): avc: denied { read } for pid=8154 comm="syz.6.588" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 274.100907][ T5717] xr_serial ttyUSB0: xr_serial converter now disconnected from ttyUSB0 [ 274.568471][ T5717] xr_serial 2-1:150.204: device disconnected [ 274.852478][ T5702] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 275.142387][ T5702] usb 7-1: Using ep0 maxpacket: 8 [ 275.227568][ T5702] usb 7-1: config 0 has an invalid interface number: 143 but max is 0 [ 275.288520][ T5702] usb 7-1: config 0 has no interface number 0 [ 275.309387][ T5702] usb 7-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 275.319467][ T5702] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 275.330699][ T5702] usb 7-1: config 0 descriptor?? [ 275.526013][ T5702] viperboard 7-1:0.143: version 0.00 found at bus 007 address 003 [ 275.835096][ T8184] netlink: 'syz.2.597': attribute type 10 has an invalid length. [ 276.418450][ T5702] viperboard-i2c viperboard-i2c.2.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 276.432929][ T5702] viperboard-i2c viperboard-i2c.2.auto: probe with driver viperboard-i2c failed with error -5 [ 276.667694][ T8192] syzkaller0: entered promiscuous mode [ 276.680884][ T8198] UDC core: g1: couldn't find an available UDC or it's busy [ 276.693171][ T8192] syzkaller0: entered allmulticast mode [ 276.701367][ T8195] syzkaller0: entered promiscuous mode [ 276.709847][ T8195] syzkaller0: entered allmulticast mode [ 277.389150][ T9] usb 7-1: USB disconnect, device number 3 [ 277.999109][ T8221] syzkaller0: entered promiscuous mode [ 278.012520][ T8221] syzkaller0: entered allmulticast mode [ 278.220396][ T8227] syzkaller0: entered promiscuous mode [ 278.226540][ T8227] syzkaller0: entered allmulticast mode [ 278.298006][ T8231] netlink: 'syz.5.611': attribute type 10 has an invalid length. [ 278.305795][ T8231] netlink: 40 bytes leftover after parsing attributes in process `syz.5.611'. [ 278.412510][ T8227] tipc: Enabled bearer , priority 0 [ 278.716671][ T8227] tipc: Resetting bearer [ 279.121960][ T8225] tipc: Resetting bearer [ 279.219755][ T8225] tipc: Disabling bearer [ 279.248444][ T30] audit: type=1400 audit(1784937539.056:421): avc: denied { relabelfrom } for pid=8237 comm="syz.6.617" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 279.814053][ T8239] tipc: Started in network mode [ 279.890643][ T8239] tipc: Node identity , cluster identity 4711 [ 279.983189][ T30] audit: type=1400 audit(1784937539.076:422): avc: denied { relabelto } for pid=8237 comm="syz.6.617" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 280.003763][ T8239] tipc: Failed to obtain node identity [ 280.009787][ T8239] tipc: Enabling of bearer rejected, failed to enable media [ 280.077761][ T8247] netlink: 20 bytes leftover after parsing attributes in process `syz.1.620'. [ 280.735059][ T8273] UDC core: g1: couldn't find an available UDC or it's busy [ 281.384487][ T8269] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 281.390547][ T8269] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 281.396597][ T8269] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 281.402703][ T8269] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 281.408728][ T8269] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 282.038152][ T8280] binder: 8279:8280 ioctl c0306201 200000000040 returned -22 [ 282.792168][ T5623] Bluetooth: hci1: command 0x0c1a tx timeout [ 283.522256][ T5625] Bluetooth: hci5: command 0x0c1a tx timeout [ 283.528309][ T5625] Bluetooth: hci4: command 0x0c1a tx timeout [ 283.534421][ T5612] Bluetooth: hci2: command 0x0c1a tx timeout [ 283.540475][ T5623] Bluetooth: hci3: command 0x0c1a tx timeout [ 283.678457][ T8289] netlink: 4 bytes leftover after parsing attributes in process `syz.3.633'. [ 283.778740][ T8307] netlink: 20 bytes leftover after parsing attributes in process `syz.1.639'. [ 284.082178][ T8315] netlink: 'syz.2.640': attribute type 10 has an invalid length. [ 284.089953][ T8315] netlink: 40 bytes leftover after parsing attributes in process `syz.2.640'. [ 284.901070][ T8317] UDC core: g1: couldn't find an available UDC or it's busy [ 285.884492][ T8330] netlink: 'syz.2.645': attribute type 10 has an invalid length. [ 285.892300][ T8330] netlink: 40 bytes leftover after parsing attributes in process `syz.2.645'. [ 286.648373][ T8332] UDC core: g1: couldn't find an available UDC or it's busy [ 287.396407][ T30] audit: type=1400 audit(1784937547.206:423): avc: denied { read } for pid=8327 comm="syz.6.646" name="ptp0" dev="devtmpfs" ino=1266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 287.452207][ T30] audit: type=1400 audit(1784937547.206:424): avc: denied { open } for pid=8327 comm="syz.6.646" path="/dev/ptp0" dev="devtmpfs" ino=1266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 287.517841][ T30] audit: type=1400 audit(1784937547.306:425): avc: denied { ioctl } for pid=8327 comm="syz.6.646" path="/dev/ptp0" dev="devtmpfs" ino=1266 ioctlcmd=0x3d14 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 287.614366][ T30] audit: type=1400 audit(1784937547.426:426): avc: denied { write } for pid=8355 comm="syz.1.655" name="functions" dev="configfs" ino=8880 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 287.618224][ T8356] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 288.385170][ T5343] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 288.393267][ T8356] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 288.620125][ T30] audit: type=1400 audit(1784937547.426:427): avc: denied { write } for pid=8355 comm="syz.1.655" name="c.1" dev="configfs" ino=9919 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 288.654208][ T8356] ================================================================== [ 288.662284][ T8356] BUG: KASAN: slab-out-of-bounds in dummy_free_request+0x8a/0x90 [ 288.670005][ T8356] Read of size 8 at addr ffff888076759af0 by task syz.1.655/8356 [ 288.677706][ T8356] [ 288.680019][ T8356] CPU: 1 UID: 0 PID: 8356 Comm: syz.1.655 Not tainted syzkaller #0 PREEMPT(full) [ 288.680040][ T8356] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 288.680051][ T8356] Call Trace: [ 288.680058][ T8356] [ 288.680064][ T8356] dump_stack_lvl+0x100/0x190 [ 288.680093][ T8356] print_report+0x13d/0x4b0 [ 288.680120][ T8356] ? __virt_addr_valid+0x239/0x430 [ 288.680145][ T8356] ? dummy_free_request+0x8a/0x90 [ 288.680169][ T8356] kasan_report+0xdf/0x1c0 [ 288.680194][ T8356] ? dummy_free_request+0x8a/0x90 [ 288.680222][ T8356] dummy_free_request+0x8a/0x90 [ 288.680246][ T8356] uvc_function_bind+0x181a/0x1939 [ 288.680270][ T8356] ? __pfx_uvc_function_bind+0x10/0x10 [ 288.680291][ T8356] usb_add_function+0x219/0x890 [ 288.680317][ T8356] configfs_composite_bind+0xd83/0x1960 [ 288.680344][ T8356] gadget_bind_driver+0x28c/0xbf0 [ 288.680372][ T8356] ? __pfx_dummy_udc_set_speed+0x10/0x10 [ 288.680396][ T8356] ? __pfx_gadget_bind_driver+0x10/0x10 [ 288.680425][ T8356] really_probe+0x241/0xa60 [ 288.680447][ T8356] __driver_probe_device+0x20e/0x450 [ 288.680470][ T8356] driver_probe_device+0x4a/0x140 [ 288.680492][ T8356] __driver_attach+0x21f/0x5b0 [ 288.680513][ T8356] ? __pfx___driver_attach+0x10/0x10 [ 288.680534][ T8356] bus_for_each_dev+0x13e/0x1d0 [ 288.680562][ T8356] ? __pfx_bus_for_each_dev+0x10/0x10 [ 288.680588][ T8356] ? bus_add_driver+0x2b5/0x5b0 [ 288.680609][ T8356] bus_add_driver+0x305/0x5b0 [ 288.680629][ T8356] driver_register+0x1e2/0x360 [ 288.680652][ T8356] usb_gadget_register_driver_owner+0x132/0x210 [ 288.680682][ T8356] gadget_dev_desc_UDC_store+0x1b0/0x2e0 [ 288.680704][ T8356] configfs_write_iter+0x302/0x4e0 [ 288.680727][ T8356] vfs_write+0x6ac/0x1050 [ 288.680754][ T8356] ? __pfx_configfs_write_iter+0x10/0x10 [ 288.680775][ T8356] ? __pfx_vfs_write+0x10/0x10 [ 288.680809][ T8356] ksys_write+0x12a/0x250 [ 288.680836][ T8356] ? __pfx_ksys_write+0x10/0x10 [ 288.680866][ T8356] do_syscall_64+0x115/0x870 [ 288.680885][ T8356] ? clear_bhb_loop+0x40/0x90 [ 288.680905][ T8356] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 288.680923][ T8356] RIP: 0033:0x7f0c1179de99 [ 288.680938][ T8356] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 288.680955][ T8356] RSP: 002b:00007f0c12652028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 288.680973][ T8356] RAX: ffffffffffffffda RBX: 00007f0c11a25fa0 RCX: 00007f0c1179de99 [ 288.680985][ T8356] RDX: 000000000000000c RSI: 0000200000000400 RDI: 0000000000000003 [ 288.680996][ T8356] RBP: 00007f0c11833eaf R08: 0000000000000000 R09: 0000000000000000 [ 288.681007][ T8356] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 288.681017][ T8356] R13: 00007f0c11a26038 R14: 00007f0c11a25fa0 R15: 00007ffe1bc6ada8 [ 288.681035][ T8356] [ 288.681041][ T8356] [ 288.958562][ T8356] Allocated by task 8164: [ 288.962863][ T8356] kasan_save_stack+0x30/0x50 [ 288.967524][ T8356] kasan_save_track+0x14/0x30 [ 288.972176][ T8356] __kasan_kmalloc+0xaa/0xb0 [ 288.976744][ T8356] __kmalloc_noprof+0x322/0x820 [ 288.981571][ T8356] lsm_blob_alloc+0x68/0x90 [ 288.986049][ T8356] security_task_alloc+0x2a/0x260 [ 288.991052][ T8356] copy_process+0x2b94/0x8030 [ 288.995714][ T8356] kernel_clone+0x176/0x9d0 [ 289.000196][ T8356] __do_sys_clone3+0x214/0x290 [ 289.004950][ T8356] do_syscall_64+0x115/0x870 [ 289.009518][ T8356] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 289.015386][ T8356] [ 289.017683][ T8356] Freed by task 23: [ 289.021460][ T8356] kasan_save_stack+0x30/0x50 [ 289.026116][ T8356] kasan_save_track+0x14/0x30 [ 289.030770][ T8356] kasan_save_free_info+0x3b/0x70 [ 289.035776][ T8356] __kasan_slab_free+0x5f/0x80 [ 289.040517][ T8356] kfree+0x22b/0x6c0 [ 289.044398][ T8356] security_task_free+0x9d/0x1a0 [ 289.049311][ T8356] __put_task_struct+0x12d/0x590 [ 289.054224][ T8356] rcu_core+0x5a2/0x10d0 [ 289.058447][ T8356] handle_softirqs+0x1ea/0x9b0 [ 289.063188][ T8356] run_ksoftirqd+0x38/0x60 [ 289.067582][ T8356] smpboot_thread_fn+0x3d3/0xaa0 [ 289.072508][ T8356] kthread+0x370/0x450 [ 289.076550][ T8356] ret_from_fork+0x72b/0xd50 [ 289.081120][ T8356] ret_from_fork_asm+0x1a/0x30 [ 289.085875][ T8356] [ 289.088182][ T8356] The buggy address belongs to the object at ffff888076759a00 [ 289.088182][ T8356] which belongs to the cache kmalloc-128 of size 128 [ 289.102209][ T8356] The buggy address is located 112 bytes to the right of [ 289.102209][ T8356] allocated 128-byte region [ffff888076759a00, ffff888076759a80) [ 289.116849][ T8356] [ 289.119148][ T8356] The buggy address belongs to the physical page: [ 289.125530][ T8356] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888076759b00 pfn:0x76759 [ 289.135564][ T8356] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff) [ 289.143603][ T8356] page_type: f5(slab) [ 289.147560][ T8356] raw: 00fff00000000200 ffff88813fe22a00 ffffea0000cf2a50 ffffea0000a96110 [ 289.156121][ T8356] raw: ffff888076759b00 000000080010000f 00000000f5000000 0000000000000000 [ 289.164673][ T8356] page dumped because: kasan: bad access detected [ 289.171056][ T8356] page_owner tracks the page as allocated [ 289.176743][ T8356] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5953, tgid 5953 (syz.4.45), ts 79200160681, free_ts 79199552620 [ 289.197119][ T8356] post_alloc_hook+0xfd/0x120 [ 289.201780][ T8356] get_page_from_freelist+0xf48/0x3530 [ 289.207216][ T8356] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 289.213089][ T8356] new_slab+0xa2/0x650 [ 289.217134][ T8356] refill_objects+0xe3/0x410 [ 289.221699][ T8356] __pcs_replace_empty_main+0x376/0x680 [ 289.227226][ T8356] __kmalloc_flags_noprof+0x684/0x890 [ 289.232581][ T8356] alloc_slab_obj_exts+0xb2/0x250 [ 289.237581][ T8356] __memcg_slab_post_alloc_hook+0x3d4/0x1160 [ 289.243542][ T8356] kmem_cache_alloc_noprof+0x587/0x6a0 [ 289.248979][ T8356] __anon_vma_prepare+0x344/0x5e0 [ 289.253984][ T8356] __vmf_anon_prepare+0x11f/0x250 [ 289.258987][ T8356] do_anonymous_page+0x51b/0x2080 [ 289.263993][ T8356] __handle_mm_fault+0x1d2c/0x2a00 [ 289.269087][ T8356] handle_mm_fault+0x37b/0xa30 [ 289.273832][ T8356] do_user_addr_fault+0x5a3/0x12f0 [ 289.278926][ T8356] page last free pid 5962 tgid 5962 stack trace: [ 289.285222][ T8356] __free_frozen_pages+0x79f/0x1090 [ 289.290400][ T8356] qlist_free_all+0x47/0xf0 [ 289.294877][ T8356] kasan_quarantine_reduce+0x1a0/0x1f0 [ 289.300312][ T8356] __kasan_slab_alloc+0x69/0x90 [ 289.305140][ T8356] kmem_cache_alloc_lru_noprof+0x267/0x6a0 [ 289.310921][ T8356] __d_alloc+0x35/0xa50 [ 289.315054][ T8356] d_alloc_parallel+0x105/0x14b0 [ 289.319977][ T8356] __lookup_slow+0x98/0x320 [ 289.324460][ T8356] lookup_slow+0x50/0x70 [ 289.328681][ T8356] link_path_walk+0x1712/0x1cc0 [ 289.333514][ T8356] path_openat+0x1c9/0x4280 [ 289.337990][ T8356] do_file_open+0x20e/0x430 [ 289.342470][ T8356] do_sys_openat2+0x10f/0x1e0 [ 289.347124][ T8356] __x64_sys_openat+0x12d/0x210 [ 289.351952][ T8356] do_syscall_64+0x115/0x870 [ 289.356517][ T8356] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 289.362388][ T8356] [ 289.364688][ T8356] Memory state around the buggy address: [ 289.370289][ T8356] ffff888076759980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 289.378325][ T8356] ffff888076759a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 289.386359][ T8356] >ffff888076759a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 289.394391][ T8356] ^ [ 289.402079][ T8356] ffff888076759b00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 289.410115][ T8356] ffff888076759b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 289.418148][ T8356] ================================================================== [ 289.486401][ T8356] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 289.493621][ T8356] CPU: 1 UID: 0 PID: 8356 Comm: syz.1.655 Not tainted syzkaller #0 PREEMPT(full) [ 289.502805][ T8356] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 289.512847][ T8356] Call Trace: [ 289.516115][ T8356] [ 289.519034][ T8356] dump_stack_lvl+0x100/0x190 [ 289.523711][ T8356] vpanic+0x552/0x970 [ 289.527681][ T8356] ? __pfx_vpanic+0x10/0x10 [ 289.532176][ T8356] ? mark_held_locks+0x40/0x70 [ 289.536936][ T8356] ? dummy_free_request+0x8a/0x90 [ 289.541955][ T8356] panic+0xd1/0xe0 [ 289.545663][ T8356] ? __pfx_panic+0x10/0x10 [ 289.550069][ T8356] ? dummy_free_request+0x8a/0x90 [ 289.555091][ T8356] ? preempt_schedule_common+0x42/0xc0 [ 289.560541][ T8356] check_panic_on_warn.cold+0x19/0x34 [ 289.565903][ T8356] end_report.part.0+0x3a/0x90 [ 289.570664][ T8356] kasan_report.cold+0xe/0x18 [ 289.575339][ T8356] ? dummy_free_request+0x8a/0x90 [ 289.580361][ T8356] dummy_free_request+0x8a/0x90 [ 289.585206][ T8356] uvc_function_bind+0x181a/0x1939 [ 289.590316][ T8356] ? __pfx_uvc_function_bind+0x10/0x10 [ 289.595767][ T8356] usb_add_function+0x219/0x890 [ 289.600614][ T8356] configfs_composite_bind+0xd83/0x1960 [ 289.606158][ T8356] gadget_bind_driver+0x28c/0xbf0 [ 289.611181][ T8356] ? __pfx_dummy_udc_set_speed+0x10/0x10 [ 289.616809][ T8356] ? __pfx_gadget_bind_driver+0x10/0x10 [ 289.622356][ T8356] really_probe+0x241/0xa60 [ 289.626851][ T8356] __driver_probe_device+0x20e/0x450 [ 289.632131][ T8356] driver_probe_device+0x4a/0x140 [ 289.637147][ T8356] __driver_attach+0x21f/0x5b0 [ 289.641900][ T8356] ? __pfx___driver_attach+0x10/0x10 [ 289.647180][ T8356] bus_for_each_dev+0x13e/0x1d0 [ 289.652032][ T8356] ? __pfx_bus_for_each_dev+0x10/0x10 [ 289.657409][ T8356] ? bus_add_driver+0x2b5/0x5b0 [ 289.662253][ T8356] bus_add_driver+0x305/0x5b0 [ 289.666920][ T8356] driver_register+0x1e2/0x360 [ 289.671680][ T8356] usb_gadget_register_driver_owner+0x132/0x210 [ 289.677921][ T8356] gadget_dev_desc_UDC_store+0x1b0/0x2e0 [ 289.683553][ T8356] configfs_write_iter+0x302/0x4e0 [ 289.688659][ T8356] vfs_write+0x6ac/0x1050 [ 289.692990][ T8356] ? __pfx_configfs_write_iter+0x10/0x10 [ 289.698625][ T8356] ? __pfx_vfs_write+0x10/0x10 [ 289.703396][ T8356] ksys_write+0x12a/0x250 [ 289.707730][ T8356] ? __pfx_ksys_write+0x10/0x10 [ 289.712584][ T8356] do_syscall_64+0x115/0x870 [ 289.717167][ T8356] ? clear_bhb_loop+0x40/0x90 [ 289.721838][ T8356] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 289.727720][ T8356] RIP: 0033:0x7f0c1179de99 [ 289.732123][ T8356] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 289.751725][ T8356] RSP: 002b:00007f0c12652028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 289.760134][ T8356] RAX: ffffffffffffffda RBX: 00007f0c11a25fa0 RCX: 00007f0c1179de99 [ 289.768079][ T8356] RDX: 000000000000000c RSI: 0000200000000400 RDI: 0000000000000003 [ 289.776021][ T8356] RBP: 00007f0c11833eaf R08: 0000000000000000 R09: 0000000000000000 [ 289.783968][ T8356] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 289.791914][ T8356] R13: 00007f0c11a26038 R14: 00007f0c11a25fa0 R15: 00007ffe1bc6ada8 [ 289.799869][ T8356] [ 289.803078][ T8356] Kernel Offset: disabled [ 289.807375][ T8356] Rebooting in 86400 seconds..