last executing test programs: 6.192596498s ago: executing program 3 (id=71): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2840, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, &(0x7f0000000600)="0f20c10f01c43e0f01cbb803008ed0660f3880b60f002667f30f12fa643e2f36d2c8baf80c66b8b0ad278866efbafc0cec6766c7442400050000006766c7442402000000806766c744240600000000670f011424", 0x54}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 5.996521264s ago: executing program 3 (id=78): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_AUTHENTICATE(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000740)={0x4c, r1, 0x1, 0x70bd28, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@key_params=[@NL80211_ATTR_MAC={0xa}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x985}], @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8, 0x35, 0x2}, @key_params=[@NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x1}]]}, 0x4c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 5.996412044s ago: executing program 3 (id=79): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000100)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000300)={0x84, &(0x7f0000000b80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0x40025b0c, &(0x7f0000000040)) 3.244361659s ago: executing program 1 (id=121): unshare(0x2c020400) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000002840)={0x1, &(0x7f0000000100)=[{0x80000006}]}, 0x8) getsockopt$sock_buf(r0, 0x1, 0x1a, 0x0, &(0x7f0000000200)=0x15) 3.244236619s ago: executing program 1 (id=122): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000020000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40000000010800034000000014480000000c0a010100000000000000040a0000060900020073797a31000000000900010073797a31000000001c0003801800008008000340000000020c0004400000000000000c7f14000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001040)=ANY=[@ANYBLOB="4c0000000d0a010800000000000000000a0000010900020073797a31000000000900010073797a3100000000200003801c"], 0x4c}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) 3.244158699s ago: executing program 1 (id=123): syz_usb_connect$cdc_ecm(0x3, 0x56, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000020100102505a1a4400000000001090244000101000000090400001602020000052406000005240000000d240f0106000000000000000009058103200000000009058202080000000009050302", @ANYRES8], 0x0) 2.981004828s ago: executing program 3 (id=124): ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000000)={0x7, 'hsr0\x00', {0x3}, 0x1}) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x8, 0x94, 0x7fff0000}]}) close_range(r0, 0xffffffffffffffff, 0x2) syz_io_uring_setup(0x797e, &(0x7f0000000040)={0x0, 0x8007b88, 0x2, 0x3, 0x3c6}, 0x0, 0x0, 0x0) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000000)={0x28, 0x0, 0x0, @hyper}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x1f, &(0x7f0000000000)=[0xffffffffffffffff], 0x1) 2.969938467s ago: executing program 3 (id=125): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x3, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000950000000000cc1b9006bf43eb560410f47f39b90000"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='fdinfo/3\x00') read$FUSE(r1, &(0x7f0000001640)={0x2020}, 0x2020) r2 = syz_open_dev$evdev(&(0x7f00000001c0), 0x1bbc, 0x801) openat$sysfs(0xffffff9c, &(0x7f0000000080)='/sys/kernel/fscaps', 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) syz_clone3(&(0x7f00000003c0)={0x385200080, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, {r3}}, 0x58) write$evdev(r2, &(0x7f00000000c0)=[{{}, 0x0, 0x1, 0x3}], 0x5b) ioctl$EVIOCSCLOCKID(r2, 0x400445a0, &(0x7f0000000180)=0x7) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r4, 0x4008af60, &(0x7f0000000040)={@my=0x1}) r5 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r5, 0x4008af60, &(0x7f0000000040)={@my=0x1}) socket$unix(0x1, 0x2, 0x0) r6 = socket$unix(0x1, 0x2, 0x0) r7 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000000000086666048800000000000109022400010000100809040090010300000009210000000122050009058103"], 0x0) syz_usb_control_io$hid(r7, 0x0, 0x0) syz_usb_control_io(r7, &(0x7f00000005c0)={0x18, &(0x7f0000000080)=ANY=[@ANYBLOB="00242300000048220f041b"], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$EVIOCGNAME(r2, 0x80404506, &(0x7f0000000200)=""/142) bind$unix(r6, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r8, &(0x7f00000bd000), 0x53, 0x20040000) 1.985184468s ago: executing program 1 (id=140): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) lseek(r0, 0xfffffd0b, 0x4) 1.975879728s ago: executing program 1 (id=141): timer_create(0x2, 0x0, &(0x7f0000bbdffc)) clock_nanosleep(0x2, 0x0, &(0x7f0000000040)={0x0, 0x989680}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000200)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) unshare(0x62040200) 1.133752425s ago: executing program 1 (id=146): ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc01c5868, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000000240)={0xb800001a}) syz_usb_connect(0x2, 0x2d, &(0x7f0000000140)={{0x12, 0x1, 0x310, 0x3c, 0x3e, 0xae, 0x20, 0xeb1, 0x7007, 0x200, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0xfa, 0x1, 0x10, 0x66, "", [{{0x9, 0x4, 0x99, 0x6, 0x1, 0xff, 0x0, 0xff, 0x4, [@hid_hid={0x0, 0x21, 0x1, 0x1, 0x1, {0x22, 0xd43}}, @cdc_ecm={{0x0, 0x24, 0x6, 0x0, 0x0, "f4eb"}, {0x45, 0x24, 0x0, 0x1000}, {0x0, 0x24, 0xf, 0x1, 0x2fd6, 0x8, 0xd0, 0x2}, [@call_mgmt, @mbim_extended={0x0, 0x24, 0x1c, 0xc, 0x6, 0x1}, @mdlm={0x0, 0x24, 0x12, 0x857}, @dmm={0x1c, 0x24, 0x14, 0xa71d}, @network_terminal={0x0, 0x24, 0xa, 0xed, 0x7, 0x1, 0x1}, @network_terminal={0x0, 0x24, 0xa, 0x7, 0x2, 0xc4, 0x5}]}], [{{0x9, 0x5, 0xa, 0x1f, 0x200, 0x1, 0x1, 0xfc}}]}}]}}]}}, &(0x7f0000000040)={0x0, 0x0, 0xffffff43, 0x0, 0x1, [{0x0, 0x0}]}) 1.060390587s ago: executing program 4 (id=147): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0xd0f, 0x4703d2d, 0xfffffffd, {0x60, 0x0, 0x0, r2, {0x0, 0xfff2}, {0xfff1, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}, 0x1, 0x0, 0x0, 0x24000040}, 0x44080) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x3f}, 0x4004814) 1.004185798s ago: executing program 4 (id=148): r0 = socket$tipc(0x1e, 0x2, 0x0) getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f0000000040), &(0x7f0000000080)=0x8) 1.003950088s ago: executing program 3 (id=149): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000201b4510fc0428155d6d01020301090212000100000000090401"], 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'macsec0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x1, 0x10, 0x25dfdbff, {0x0, 0x0, 0x0, r3}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macsec={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACSEC_INC_SCI={0x5, 0xf}]}}}]}, 0x3c}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 1.003817898s ago: executing program 4 (id=150): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@newtfilter={0x90, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r8, {0x0, 0x3}, {}, {0xfff3, 0x1f}}, [@filter_kind_options=@f_matchall={{0xd}, {0x5c, 0x2, [@TCA_MATCHALL_ACT={0x58, 0x2, [@m_ife={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0xd, 0xd0ea, 0x20000001, 0x3, 0x4}, 0x1}}, @TCA_IFE_SMAC={0xa, 0x4, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3b}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x3}}}}]}]}}]}, 0x90}, 0x1, 0x0, 0x0, 0x50}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r9, {0xc, 0xc}, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) 969.4669ms ago: executing program 4 (id=151): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) open(0x0, 0x14927e, 0x68) socket$inet6(0xa, 0x800000000000002, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) r0 = fsopen(&(0x7f0000000040)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x82) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) fchdir(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) unlinkat(r1, &(0x7f0000000140)='./file0\x00', 0x200) r2 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x0) r4 = openat$cgroup_subtree(r3, &(0x7f0000000040), 0x2, 0x0) write$cgroup_subtree(r4, &(0x7f0000000200)=ANY=[@ANYBLOB='-pids'], 0x6) 958.18671ms ago: executing program 4 (id=152): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="3800000010000507000000000004000000000000", @ANYRES32, @ANYBLOB="00000016010000001800120008000100736974000c000200"], 0x38}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="680000000b06010200000000000000000000000005000100070000000900020073797a310000000040000780"], 0x68}, 0x1, 0x0, 0x0, 0x800}, 0x80) 937.736ms ago: executing program 4 (id=153): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000001040)={0x24, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\b'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000400)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) 396.455617ms ago: executing program 0 (id=156): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r0 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x17}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000140)=0x8, 0x4) connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @broadcast}, 0x10) sendmmsg$inet(r0, &(0x7f0000004d00)=[{{0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x300, 0xf00) 396.347317ms ago: executing program 0 (id=157): r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140), 0x8800, 0x0) preadv(r0, &(0x7f0000000280)=[{&(0x7f0000001a80)=""/102400, 0x19000}, {0x0}], 0x2, 0x0, 0x0) 396.225407ms ago: executing program 0 (id=158): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x9, 0x4, 0xb47e, 0xb, 0x3, 0xd, 0xf, 0x1ff}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$packet(0x11, 0x3, 0x300) r5 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) write$FUSE_INIT(r5, 0x0, 0x0) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x4207, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r4, &(0x7f00000002c0)="05031400d3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @multicast}, 0x14) 359.910659ms ago: executing program 0 (id=159): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000740)=ANY=[@ANYBLOB="3c0100001a000100feffffff00010000ac1e0101000000000000000000000000ac1414bb000000000000000000000000000107174e2300030a0000203a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000033590001000004d46c000000fc02000000000000000000000000000007000000000000009201000000000010a39b000000000000ffff0000000000001c250800000000000500000000000000fcffffffffffffff0400000000000000ffffffffffffffff00000000000000001f000000000000000500000000000000fefffffffc030000000000007e000000043500000a00010020000000480003006465666c617465000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800220002"], 0x13c}, 0x1, 0x0, 0x0, 0x4010}, 0x48850) 336.637019ms ago: executing program 0 (id=160): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)={0x30, 0x3e, 0x1, 0x80000, 0x0, {0x1}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@nested={0x8, 0x10, 0x0, 0x1, [@typed={0x4, 0xe3, 0x0, 0x0, @binary}]}]}, @typed={0xc, 0x2, 0x0, 0x0, @u64}]}, 0x30}, 0x1, 0x0, 0x0, 0x4811}, 0x4000094) 284.449531ms ago: executing program 0 (id=161): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000459bb2405804035000000000000109021b000111000000090400000195699b000905", @ANYRES32], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000180)={0x0, 0x0, 0x3, 'Yf\''}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000001e40)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000001dc0)={0x20, 0x1, 0x34, "712bab"}, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000001300)={0x84, &(0x7f0000000e40)={0x0, 0x0, 0x3, "0b3b81"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 86.935787ms ago: executing program 2 (id=163): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x60400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r2, 0xc040aed5, 0x0) 433.31µs ago: executing program 2 (id=164): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000000)={0x44, r0, 0x801, 0x400, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_KEY={0x28, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "4abee33908f8eef16f162471f4"}, @NL80211_KEY_IDX={0x5, 0x2, 0x2}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac05}]}]}, 0x44}}, 0x0) 332.17µs ago: executing program 2 (id=165): socket$inet(0x2, 0x4000000000000001, 0x0) unshare(0x68040200) socket$netlink(0x10, 0x3, 0x14) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000280)={'security\x00', 0x0, [0xa, 0x80, 0x6, 0x400, 0x40]}, &(0x7f0000000300)=0x54) 246.42µs ago: executing program 2 (id=166): r0 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x5c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_EXPR={0x20, 0x11, 0x0, 0x1, @connlimit={{0xe}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_COUNT={0x8, 0x1, 0x1, 0x0, 0xfffff274}]}}}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 144.84µs ago: executing program 2 (id=167): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, 0x0) 0s ago: executing program 2 (id=168): syz_emit_ethernet(0x56, 0x0, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af25, &(0x7f00000001c0)={@host}) r1 = socket(0x10, 0x803, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) r5 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) ioctl$int_in(r5, 0x5421, &(0x7f0000000440)=0x6) connect$bt_rfcomm(r5, &(0x7f00000001c0)={0x1f, @any, 0x6}, 0xa) close(r5) r6 = socket$inet6(0xa, 0x80003, 0x6) connect$inet6(r6, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f0000000340)={{{@in=@broadcast, @in6=@dev={0xfe, 0x80, '\x00', 0xfd}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x4, 0x0, 0xa78a}, 0xfffffffe, 0x0, 0x1}, {{@in=@empty, 0x0, 0x33}, 0x0, @in=@rand_addr=0x64010101, 0x0, 0x3, 0x2, 0x7}}, 0xe4) sendmmsg(r6, &(0x7f0000000480), 0x2e9, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_cmd={0x2c, 0x4, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [0x0, 0x3]}}) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0500000005000000", @ANYRES32=0x1, @ANYRES32], 0x50) kernel console output (not intermixed with test programs): [ 14.018075][ T28] audit: type=1400 audit(1781450687.078:62): avc: denied { rlimitinh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.021816][ T28] audit: type=1400 audit(1781450687.078:63): avc: denied { siginh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.196' (ED25519) to the list of known hosts. [ 21.186073][ T28] audit: type=1400 audit(1781450694.258:64): avc: denied { mounton } for pid=279 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.187177][ T279] cgroup: Unknown subsys name 'net' [ 21.208932][ T28] audit: type=1400 audit(1781450694.258:65): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.236309][ T28] audit: type=1400 audit(1781450694.288:66): avc: denied { unmount } for pid=279 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.236464][ T279] cgroup: Unknown subsys name 'devices' [ 21.375649][ T279] cgroup: Unknown subsys name 'hugetlb' [ 21.381267][ T279] cgroup: Unknown subsys name 'rlimit' [ 21.483932][ T28] audit: type=1400 audit(1781450694.558:67): avc: denied { setattr } for pid=279 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.507194][ T28] audit: type=1400 audit(1781450694.558:68): avc: denied { mounton } for pid=279 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 21.530751][ T281] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 21.532690][ T28] audit: type=1400 audit(1781450694.558:69): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.564537][ T28] audit: type=1400 audit(1781450694.618:70): avc: denied { relabelto } for pid=281 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.567270][ T279] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.590352][ T28] audit: type=1400 audit(1781450694.618:71): avc: denied { write } for pid=281 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.625026][ T28] audit: type=1400 audit(1781450694.638:72): avc: denied { read } for pid=279 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.650864][ T28] audit: type=1400 audit(1781450694.638:73): avc: denied { open } for pid=279 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.341778][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.349094][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.356546][ T287] device bridge_slave_0 entered promiscuous mode [ 22.364651][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.371988][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.379420][ T287] device bridge_slave_1 entered promiscuous mode [ 22.406662][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.413844][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.421126][ T288] device bridge_slave_0 entered promiscuous mode [ 22.428136][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.435235][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.442666][ T288] device bridge_slave_1 entered promiscuous mode [ 22.533753][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.540810][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.548270][ T293] device bridge_slave_0 entered promiscuous mode [ 22.555403][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.562444][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.569943][ T293] device bridge_slave_1 entered promiscuous mode [ 22.626156][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.633205][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.640922][ T289] device bridge_slave_0 entered promiscuous mode [ 22.649303][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.656511][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.664086][ T289] device bridge_slave_1 entered promiscuous mode [ 22.721712][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.728846][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.736261][ T295] device bridge_slave_0 entered promiscuous mode [ 22.758470][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.765624][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.773075][ T295] device bridge_slave_1 entered promiscuous mode [ 22.823257][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.830328][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.838077][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.845105][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.859883][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.866959][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.874251][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.881362][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.895195][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.902579][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.909841][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.917183][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.985269][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.992414][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.999716][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.007181][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.018649][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.026498][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.034185][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.041430][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.048960][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.056746][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.064098][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.071442][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.078678][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.097611][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.113469][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.121819][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.129305][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.136915][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.145548][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.152580][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.160037][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.167895][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.175350][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.183509][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.190600][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.205910][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.214190][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.221196][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.228598][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.236815][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.243854][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.253173][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.267714][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.275993][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.283002][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.290568][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.315549][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.323966][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.331894][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.340180][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.348387][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.356663][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.370493][ T287] device veth0_vlan entered promiscuous mode [ 23.383740][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.392101][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.400546][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.408482][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.416867][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.425010][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.432924][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.441429][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.449876][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.457384][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.467402][ T288] device veth0_vlan entered promiscuous mode [ 23.476415][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.484379][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.492302][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.500498][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.508667][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.516344][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.524304][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.531850][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.544233][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.551815][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.559549][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.567925][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.577262][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.584312][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.591764][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.600112][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.608354][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.615390][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.632890][ T293] device veth0_vlan entered promiscuous mode [ 23.641466][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 23.649414][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.657959][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.666323][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.673535][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.681366][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.689858][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.698091][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.705818][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.713176][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.721702][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.730214][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.738323][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.746461][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.754870][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.763083][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.770710][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.781454][ T287] device veth1_macvtap entered promiscuous mode [ 23.793798][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.801581][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.809693][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.817862][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.826328][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.837543][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.846790][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.855344][ T293] device veth1_macvtap entered promiscuous mode [ 23.876612][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.885031][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.893228][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.901872][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.911188][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.919773][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.928272][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.938622][ T288] device veth1_macvtap entered promiscuous mode [ 23.947315][ T289] device veth0_vlan entered promiscuous mode [ 23.953854][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.961548][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.983945][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.984200][ T287] request_module fs-gadgetfs succeeded, but still no fs? [ 23.991681][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.006991][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.015538][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.024050][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.031956][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.040343][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.048649][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.056900][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.065232][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.073608][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.081905][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.109122][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.148343][ T316] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 24.176408][ T289] device veth1_macvtap entered promiscuous mode [ 24.183324][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.209583][ T295] device veth0_vlan entered promiscuous mode [ 24.233275][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.241264][ T319] kvm: emulating exchange as write [ 24.243222][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.247378][ T323] random: crng reseeded on system resumption [ 24.268969][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.289595][ T295] device veth1_macvtap entered promiscuous mode [ 24.297169][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.307231][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.315721][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.324706][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.333039][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.366331][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.376365][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.386424][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.395044][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.417136][ T334] loop2: detected capacity change from 0 to 7 [ 24.425692][ T334] loop2: [ 24.513320][ T323] syz.1.6 (323) used greatest stack depth: 21320 bytes left [ 24.553046][ T352] binder: 351:352 ioctl 4018620d 0 returned -22 [ 24.725897][ T380] netlink: 8 bytes leftover after parsing attributes in process `syz.1.28'. [ 24.736428][ T380] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.768938][ T384] 9pnet_virtio: no channels available for device syz [ 24.993631][ T310] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 25.134007][ T19] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 25.153650][ T6] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 25.185322][ T310] usb 4-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 25.197803][ T310] usb 4-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 25.207731][ T310] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.216176][ T310] usb 4-1: Product: syz [ 25.220620][ T310] usb 4-1: Manufacturer: syz [ 25.225817][ T310] usb 4-1: SerialNumber: syz [ 25.231405][ T310] usb 4-1: config 0 descriptor?? [ 25.240949][ T378] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 25.323618][ T19] usb 2-1: Using ep0 maxpacket: 8 [ 25.331545][ T19] usb 2-1: New USB device found, idVendor=0fe9, idProduct=db01, bcdDevice=e9.9b [ 25.341127][ T19] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.349758][ T19] usb 2-1: Product: syz [ 25.354494][ T19] usb 2-1: Manufacturer: syz [ 25.359474][ T19] usb 2-1: SerialNumber: syz [ 25.359569][ T6] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 25.379859][ T19] usb 2-1: config 0 descriptor?? [ 25.407647][ T6] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 25.418187][ T6] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 25.448655][ T6] usb 3-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 25.456383][ T39] usb 4-1: USB disconnect, device number 2 [ 25.468727][ T6] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.486756][ T6] usb 3-1: Product: syz [ 25.492591][ T6] usb 3-1: Manufacturer: syz [ 25.498271][ T6] usb 3-1: SerialNumber: syz [ 25.507624][ T6] usb 3-1: config 0 descriptor?? [ 25.952292][ T410] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 25.961503][ T410] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 26.003729][ T39] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 26.183667][ T39] usb 1-1: Using ep0 maxpacket: 8 [ 26.189961][ T39] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 26.201342][ T39] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 26.210736][ T39] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.218950][ T28] kauditd_printk_skb: 61 callbacks suppressed [ 26.218961][ T28] audit: type=1400 audit(1781450699.288:135): avc: denied { create } for pid=418 comm="syz.4.44" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 26.245823][ T39] usb 1-1: config 0 descriptor?? [ 26.251479][ T28] audit: type=1400 audit(1781450699.288:136): avc: denied { ioctl } for pid=418 comm="syz.4.44" path="socket:[16351]" dev="sockfs" ino=16351 ioctlcmd=0x8955 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 26.277934][ T28] audit: type=1400 audit(1781450699.288:137): avc: denied { ioctl } for pid=418 comm="syz.4.44" path="socket:[16348]" dev="sockfs" ino=16348 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 26.304468][ T28] audit: type=1400 audit(1781450699.328:138): avc: denied { name_bind } for pid=422 comm="syz.4.46" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 26.332387][ T28] audit: type=1400 audit(1781450699.398:139): avc: denied { create } for pid=428 comm="syz.4.49" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 26.354243][ T28] audit: type=1400 audit(1781450699.398:140): avc: denied { bind } for pid=428 comm="syz.4.49" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 26.374503][ T28] audit: type=1400 audit(1781450699.398:141): avc: denied { write } for pid=428 comm="syz.4.49" path="socket:[16791]" dev="sockfs" ino=16791 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 26.545771][ T436] kvm [435]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc1) = 0x10000003c [ 26.556999][ T436] kvm [435]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x70b3 [ 26.567907][ T436] kvm [435]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x1d9) = 0x6261 [ 26.646970][ T28] audit: type=1400 audit(1781450699.718:142): avc: denied { create } for pid=438 comm="syz.4.53" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 26.668253][ T28] audit: type=1400 audit(1781450699.718:143): avc: denied { read } for pid=438 comm="syz.4.53" dev="nsfs" ino=4026532498 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 26.689825][ T28] audit: type=1400 audit(1781450699.718:144): avc: denied { open } for pid=438 comm="syz.4.53" path="net:[4026532498]" dev="nsfs" ino=4026532498 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 26.872514][ T445] SELinux: ebitmap start bit (6528) is beyond the end of the bitmap (1472) [ 26.882607][ T445] SELinux: failed to load policy [ 27.157933][ T452] 9pnet_virtio: no channels available for device syz [ 27.632819][ T461] usb usb8: usbfs: interface 0 claimed by hub while 'syz.4.62' resets device [ 27.861684][ T39] usb 2-1: USB disconnect, device number 2 [ 27.889429][ T310] usb 3-1: USB disconnect, device number 2 [ 28.110690][ T512] tipc: Started in network mode [ 28.115692][ T512] tipc: Node identity ac1414aa, cluster identity 4711 [ 28.122870][ T512] tipc: Enabled bearer , priority 10 [ 28.203633][ T24] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 28.313658][ T308] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 28.383716][ T24] usb 5-1: Using ep0 maxpacket: 8 [ 28.389339][ T522] process 'syz.2.87' launched './file0' with NULL argv: empty string added [ 28.398897][ T24] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 28.407174][ T24] usb 5-1: config 0 has no interface number 0 [ 28.413267][ T24] usb 5-1: config 0 interface 55 altsetting 0 has an invalid endpoint with address 0x80, skipping [ 28.424306][ T24] usb 5-1: config 0 interface 55 altsetting 0 has an invalid endpoint with address 0xAB, skipping [ 28.435308][ T24] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 28.448577][ T24] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 28.457656][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.468710][ T24] usb 5-1: config 0 descriptor?? [ 28.493618][ T308] usb 4-1: Using ep0 maxpacket: 8 [ 28.499767][ T308] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 28.511546][ T308] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 28.522439][ T308] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 28.533457][ T308] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 28.547469][ T308] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 28.557291][ T308] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.676326][ T529] tipc: Cannot configure node identity twice [ 28.677562][ T6] usb 5-1: USB disconnect, device number 2 [ 28.735890][ T535] Zero length message leads to an empty skb [ 28.737962][ T501] usb 1-1: USB disconnect, device number 2 [ 28.760884][ T537] netlink: 'syz.0.94': attribute type 12 has an invalid length. [ 28.807488][ T547] device syzkaller0 entered promiscuous mode [ 28.832858][ T549] bridge: RTM_NEWNEIGH with unconfigured vlan 255 on bridge0 [ 28.973677][ T301] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 29.153633][ T301] usb 3-1: Using ep0 maxpacket: 8 [ 29.153649][ T501] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 29.159973][ T301] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 29.176368][ T301] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 29.186637][ T301] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 29.198024][ T301] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 29.216389][ T301] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 29.219823][ T566] SELinux: failed to load policy [ 29.225626][ T301] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.243752][ T24] tipc: Node number set to 2886997162 [ 29.354903][ T501] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 29.365347][ T501] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 29.378346][ T501] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 29.387477][ T501] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.433511][ T576] netlink: 4 bytes leftover after parsing attributes in process `syz.4.112'. [ 29.443123][ T576] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.453818][ T576] device bridge_slave_1 left promiscuous mode [ 29.459995][ T576] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.190179][ T589] 9pnet_virtio: no channels available for device syz [ 30.622547][ T592] syz.4.118 (592) used greatest stack depth: 21096 bytes left [ 31.052455][ T301] usb 4-1: USB disconnect, device number 3 [ 31.053654][ T501] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 31.243635][ T501] usb 2-1: Using ep0 maxpacket: 16 [ 31.259709][ T501] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 31.270820][ T501] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 8 [ 31.280807][ T501] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 255 [ 31.291021][ T501] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 22 [ 31.305734][ T501] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 31.314898][ T501] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.325601][ T603] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 31.332996][ T603] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 31.340445][ T617] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.340977][ T501] cdc_acm 2-1:1.0: Control and data interfaces are not separated! [ 31.366316][ T28] kauditd_printk_skb: 124 callbacks suppressed [ 31.366328][ T28] audit: type=1400 audit(1781450704.438:269): avc: denied { write } for pid=618 comm="syz.4.130" lport=5 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 31.392747][ T28] audit: type=1400 audit(1781450704.438:270): avc: denied { create } for pid=620 comm="syz.4.131" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 31.413081][ T28] audit: type=1400 audit(1781450704.438:271): avc: denied { write } for pid=620 comm="syz.4.131" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 31.513646][ T301] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 31.554061][ T501] cdc_acm 2-1:1.0: ttyACM0: USB ACM device [ 31.562571][ T501] usb 2-1: USB disconnect, device number 3 [ 31.693651][ T301] usb 4-1: Using ep0 maxpacket: 8 [ 31.700821][ T301] usb 4-1: config 0 interface 0 altsetting 144 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 31.705825][ T308] usb 3-1: USB disconnect, device number 3 [ 31.712345][ T301] usb 4-1: config 0 interface 0 altsetting 144 endpoint 0x81 has invalid wMaxPacketSize 0 [ 31.729407][ T19] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 31.737599][ T301] usb 4-1: config 0 interface 0 has no altsetting 0 [ 31.744289][ T28] audit: type=1400 audit(1781450704.808:272): avc: denied { ioctl } for pid=628 comm="syz.2.135" path="socket:[18572]" dev="sockfs" ino=18572 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 31.770737][ T301] usb 4-1: New USB device found, idVendor=6666, idProduct=8804, bcdDevice= 0.00 [ 31.780338][ T301] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.790239][ T301] usb 4-1: config 0 descriptor?? [ 31.798908][ T501] usb 1-1: USB disconnect, device number 3 [ 31.811479][ T28] audit: type=1400 audit(1781450704.888:273): avc: denied { connect } for pid=632 comm="syz.0.137" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 31.831880][ T28] audit: type=1400 audit(1781450704.888:274): avc: denied { write } for pid=632 comm="syz.0.137" path="socket:[18160]" dev="sockfs" ino=18160 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 31.861381][ T28] audit: type=1400 audit(1781450704.938:275): avc: denied { read } for pid=632 comm="syz.0.137" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 31.994731][ T19] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 32.005815][ T19] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 32.016071][ T19] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 32.029058][ T19] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 32.038151][ T19] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.047300][ T19] usb 5-1: config 0 descriptor?? [ 32.153672][ T308] usb 3-1: new low-speed USB device number 4 using dummy_hcd [ 32.217308][ T301] smartjoyplus 0003:6666:8804.0001: unknown main item tag 0x2 [ 32.224916][ T301] smartjoyplus 0003:6666:8804.0001: item fetching failed at offset 4/5 [ 32.233740][ T301] smartjoyplus 0003:6666:8804.0001: parse failed [ 32.240192][ T301] smartjoyplus: probe of 0003:6666:8804.0001 failed with error -22 [ 32.334692][ T308] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 32.345504][ T308] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 32.354449][ T308] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 32.365657][ T308] usb 3-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 32.374994][ T308] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.383869][ T631] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 32.391770][ T308] hub 3-1:1.0: bad descriptor, ignoring hub [ 32.397901][ T308] hub: probe of 3-1:1.0 failed with error -5 [ 32.404188][ T308] cdc_wdm 3-1:1.0: skipping garbage [ 32.409406][ T308] cdc_wdm 3-1:1.0: skipping garbage [ 32.416883][ T308] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 32.431193][ T501] usb 4-1: USB disconnect, device number 4 [ 32.464516][ T19] usbhid 5-1:0.0: can't add hid device: -71 [ 32.470683][ T19] usbhid: probe of 5-1:0.0 failed with error -71 [ 32.479611][ T19] usb 5-1: USB disconnect, device number 3 [ 32.723834][ T301] usb 3-1: USB disconnect, device number 4 [ 32.760442][ T28] audit: type=1400 audit(1781450705.828:276): avc: denied { read } for pid=649 comm="syz.0.144" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 33.016869][ T28] audit: type=1400 audit(1781450706.088:277): avc: denied { getopt } for pid=658 comm="syz.4.148" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 33.117298][ T28] audit: type=1326 audit(1781450706.188:278): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=670 comm="syz.2.154" exe="/root/ci2-android-6-1/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7feb1879ce59 code=0x0 [ 33.213713][ T301] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 33.293759][ T19] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 33.363638][ T6] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 33.395209][ T301] usb 2-1: unable to get BOS descriptor or descriptor too short [ 33.403354][ T301] usb 2-1: not running at top speed; connect to a high speed hub [ 33.411906][ T301] usb 2-1: config 250 has an invalid interface number: 153 but max is 0 [ 33.420406][ T301] usb 2-1: config 250 has an invalid descriptor of length 0, skipping remainder of the config [ 33.430670][ T301] usb 2-1: config 250 has no interface number 0 [ 33.437003][ T301] usb 2-1: config 250 interface 153 altsetting 6 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 33.451104][ T301] usb 2-1: config 250 interface 153 has no altsetting 0 [ 33.460536][ T301] usb 2-1: string descriptor 0 read error: -22 [ 33.466818][ T301] usb 2-1: New USB device found, idVendor=0eb1, idProduct=7007, bcdDevice= 2.00 [ 33.475885][ T19] usb 4-1: Using ep0 maxpacket: 16 [ 33.481040][ T301] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.489948][ T19] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 33.498322][ T19] usb 4-1: config 0 has no interface number 0 [ 33.506888][ T19] usb 4-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 33.516077][ T19] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.524132][ T19] usb 4-1: Product: syz [ 33.528286][ T19] usb 4-1: Manufacturer: syz [ 33.532863][ T19] usb 4-1: SerialNumber: syz [ 33.538072][ T19] usb 4-1: config 0 descriptor?? [ 33.555966][ T6] usb 5-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 33.565365][ T6] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.573375][ T6] usb 5-1: Product: syz [ 33.577606][ T6] usb 5-1: Manufacturer: syz [ 33.582212][ T6] usb 5-1: SerialNumber: syz [ 33.587735][ T6] usb 5-1: config 0 descriptor?? [ 33.652709][ T681] device syzkaller0 entered promiscuous mode [ 33.693117][ T683] netlink: 76 bytes leftover after parsing attributes in process `syz.0.159'. [ 33.707506][ T501] usb 2-1: USB disconnect, device number 4 [ 33.993708][ T308] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 34.063652][ C0] ================================================================== [ 34.072122][ C0] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x6c/0xb0 [ 34.079881][ C0] Read of size 8 at addr ffff88812e7fd990 by task swapper/0/0 [ 34.087345][ C0] [ 34.089748][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 [ 34.096761][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 34.106894][ C0] Call Trace: [ 34.110172][ C0] [ 34.113009][ C0] __dump_stack+0x21/0x24 [ 34.117416][ C0] dump_stack_lvl+0x110/0x170 [ 34.122085][ C0] ? __cfi_dump_stack_lvl+0x8/0x8 [ 34.127721][ C0] ? debug_smp_processor_id+0x17/0x20 [ 34.133096][ C0] ? rcu_cblist_dequeue+0x6c/0xb0 [ 34.138106][ C0] print_address_description+0x71/0x200 [ 34.143642][ C0] print_report+0x4a/0x60 [ 34.148066][ C0] kasan_report+0x122/0x150 [ 34.152783][ C0] ? rcu_cblist_dequeue+0x6c/0xb0 [ 34.158437][ C0] __asan_report_load8_noabort+0x14/0x20 [ 34.164728][ C0] rcu_cblist_dequeue+0x6c/0xb0 [ 34.169704][ C0] rcu_do_batch+0x4bc/0xc30 [ 34.174191][ C0] ? rcu_core+0xf00/0xf00 [ 34.178624][ C0] ? _raw_spin_unlock_irqrestore+0x5a/0x80 [ 34.184428][ C0] ? note_gp_changes+0x140/0x220 [ 34.189380][ C0] ? _raw_spin_unlock+0x4c/0x70 [ 34.194414][ C0] rcu_core+0x486/0xf00 [ 34.198607][ C0] ? rcu_cpu_kthread_park+0x90/0x90 [ 34.203787][ C0] ? kvm_sched_clock_read+0x18/0x40 [ 34.209014][ C0] ? run_rebalance_domains+0xf7/0x1c0 [ 34.214390][ C0] rcu_core_si+0x9/0x10 [ 34.218543][ C0] handle_softirqs+0x1d7/0x600 [ 34.223324][ C0] __irq_exit_rcu+0x52/0xf0 [ 34.227835][ C0] irq_exit_rcu+0x9/0x10 [ 34.232079][ C0] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 34.237917][ C0] [ 34.240843][ C0] [ 34.243764][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 34.249732][ C0] RIP: 0010:default_idle+0xf/0x20 [ 34.254758][ C0] Code: cc 00 00 cc cc 00 00 cc cc 00 00 90 90 90 90 90 90 90 90 90 90 90 b8 0c 67 40 a5 55 48 89 e5 66 90 0f 00 2d 63 7b 65 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90 [ 34.274367][ C0] RSP: 0018:ffffffff87007d58 EFLAGS: 00000257 [ 34.274914][ T308] usb 1-1: config 17 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 34.280460][ C0] RAX: ffff8881f6e00000 RBX: ffffffff8701c680 RCX: 517f4884b7346600 [ 34.291081][ T308] usb 1-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 34.298984][ C0] RDX: 0000000000000001 RSI: ffffffff85ca61c0 RDI: ffffffff85ca6180 [ 34.299003][ C0] RBP: ffffffff87007d58 R08: ffff8881f6e348b3 R09: 1ffff1103edc6916 [ 34.299012][ C0] R10: 0000000000000000 R11: ffffffff8500b370 R12: dffffc0000000000 [ 34.299022][ C0] R13: 0000000000000000 R14: ffffffff8701c680 R15: dffffc0000000000 [ 34.299037][ C0] ? __cfi_default_idle+0x10/0x10 [ 34.309804][ T308] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.316038][ C0] arch_cpu_idle+0x1c/0x20 [ 34.316066][ C0] default_idle_call+0x71/0x1d0 [ 34.316087][ C0] do_idle+0x354/0x640 [ 34.325412][ T687] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 34.332080][ C0] ? ct_irq_exit+0x9/0x10 [ 34.340905][ T308] aiptek 1-1:17.0: interface has no int in endpoints, but must have minimum 1 [ 34.345048][ C0] ? irqentry_exit+0x30/0x40 [ 34.345075][ C0] ? idle_inject_timer_fn+0x60/0x60 [ 34.345096][ C0] cpu_startup_entry+0x43/0x60 [ 34.402440][ C0] rest_init+0x10a/0x130 [ 34.406676][ C0] ? __cfi_x86_late_time_init+0x8/0x8 [ 34.412464][ C0] arch_call_rest_init+0xe/0x10 [ 34.417304][ C0] start_kernel+0x483/0x4f1 [ 34.421799][ C0] x86_64_start_reservations+0x2a/0x2c [ 34.427257][ C0] x86_64_start_kernel+0x7c/0x81 [ 34.432209][ C0] secondary_startup_64_no_verify+0xce/0xdb [ 34.438095][ C0] [ 34.441104][ C0] [ 34.443470][ C0] Allocated by task 700: [ 34.447718][ C0] kasan_set_track+0x4b/0x70 [ 34.452302][ C0] kasan_save_alloc_info+0x1f/0x30 [ 34.457399][ C0] __kasan_kmalloc+0x95/0xb0 [ 34.461971][ C0] __kmalloc+0xb4/0x1e0 [ 34.466193][ C0] l2tp_session_create+0x38/0xbd0 [ 34.471336][ C0] pppol2tp_connect+0xbf5/0x1640 [ 34.477663][ C0] __sys_connect+0x3da/0x460 [ 34.482248][ C0] __x64_sys_connect+0x7a/0x90 [ 34.486992][ C0] x64_sys_call+0x88d/0x9a0 [ 34.491572][ C0] do_syscall_64+0x4c/0xa0 [ 34.496873][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 34.502877][ C0] [ 34.505189][ C0] Freed by task 309: [ 34.509147][ C0] kasan_set_track+0x4b/0x70 [ 34.513724][ C0] kasan_save_free_info+0x2b/0x40 [ 34.518795][ C0] ____kasan_slab_free+0x132/0x180 [ 34.523905][ C0] __kasan_slab_free+0x11/0x20 [ 34.528688][ C0] slab_free_freelist_hook+0xc2/0x190 [ 34.534039][ C0] __kmem_cache_free+0xb7/0x1b0 [ 34.538884][ C0] kfree+0x6f/0xf0 [ 34.542647][ C0] l2tp_session_put+0xaf/0x1a0 [ 34.547470][ C0] l2tp_session_delete+0x3df/0x4d0 [ 34.552581][ C0] l2tp_tunnel_del_work+0x199/0x410 [ 34.557863][ C0] process_one_work+0x717/0xc30 [ 34.562708][ C0] worker_thread+0xa4d/0x11d0 [ 34.567372][ C0] kthread+0x281/0x320 [ 34.571509][ C0] ret_from_fork+0x1f/0x30 [ 34.576723][ C0] [ 34.579572][ C0] Last potentially related work creation: [ 34.585410][ C0] kasan_save_stack+0x3a/0x60 [ 34.590078][ C0] __kasan_record_aux_stack+0xb6/0xc0 [ 34.595517][ C0] kasan_record_aux_stack_noalloc+0xb/0x10 [ 34.601407][ C0] call_rcu+0xcf/0xf50 [ 34.605603][ C0] pppol2tp_release+0x1e3/0x2b0 [ 34.611118][ C0] sock_close+0xc9/0x220 [ 34.615634][ C0] __fput+0x1fd/0x8f0 [ 34.620132][ C0] ____fput+0x15/0x20 [ 34.624181][ C0] task_work_run+0x1e1/0x250 [ 34.628773][ C0] exit_to_user_mode_loop+0x9b/0xb0 [ 34.633984][ C0] exit_to_user_mode_prepare+0x87/0xd0 [ 34.639558][ C0] syscall_exit_to_user_mode+0x1a/0x30 [ 34.645027][ C0] do_syscall_64+0x58/0xa0 [ 34.649432][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 34.655315][ C0] [ 34.657716][ C0] The buggy address belongs to the object at ffff88812e7fd800 [ 34.657716][ C0] which belongs to the cache kmalloc-512 of size 512 [ 34.671864][ C0] The buggy address is located 400 bytes inside of [ 34.671864][ C0] 512-byte region [ffff88812e7fd800, ffff88812e7fda00) [ 34.685387][ C0] [ 34.687714][ C0] The buggy address belongs to the physical page: [ 34.694112][ C0] page:ffffea0004b9ff00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12e7fc [ 34.704344][ C0] head:ffffea0004b9ff00 order:2 compound_mapcount:0 compound_pincount:0 [ 34.712665][ C0] flags: 0x4000000000010200(slab|head|zone=1) [ 34.718760][ C0] raw: 4000000000010200 ffffea0004b9fc00 dead000000000002 ffff888100042f00 [ 34.727603][ C0] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 34.736251][ C0] page dumped because: kasan: bad access detected [ 34.742651][ C0] page_owner tracks the page as allocated [ 34.748353][ C0] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 287, tgid 287 (syz-executor), ts 22278894947, free_ts 0 [ 34.768668][ C0] post_alloc_hook+0x1f5/0x210 [ 34.773428][ C0] prep_new_page+0x1c/0x110 [ 34.777935][ C0] get_page_from_freelist+0x2ca9/0x2d20 [ 34.783591][ C0] __alloc_pages+0x1fa/0x610 [ 34.788201][ C0] alloc_slab_page+0x6e/0xf0 [ 34.792777][ C0] new_slab+0x98/0x3e0 [ 34.797137][ C0] ___slab_alloc+0x70f/0xb70 [ 34.801726][ C0] __slab_alloc+0x5e/0xa0 [ 34.806058][ C0] __kmem_cache_alloc_node+0x204/0x2d0 [ 34.811511][ C0] __kmalloc_node_track_caller+0xa1/0x1e0 [ 34.817224][ C0] __alloc_skb+0x226/0x4a0 [ 34.821626][ C0] rtmsg_ifa+0xfa/0x1e0 [ 34.825766][ C0] __inet_insert_ifa+0x83f/0xa30 [ 34.830691][ C0] inet_rtm_newaddr+0x8be/0x1650 [ 34.835652][ C0] rtnetlink_rcv_msg+0xb28/0xde0 [ 34.840601][ C0] netlink_rcv_skb+0x200/0x450 [ 34.845365][ C0] page_owner free stack trace missing [ 34.850736][ C0] [ 34.853051][ C0] Memory state around the buggy address: [ 34.858669][ C0] ffff88812e7fd880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.867163][ C0] ffff88812e7fd900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.875220][ C0] >ffff88812e7fd980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.883265][ C0] ^ [ 34.887839][ C0] ffff88812e7fda00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.895881][ C0] ffff88812e7fda80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.904023][ C0] ================================================================== [ 34.912175][ C0] Disabling lock debugging due to kernel taint [ 36.042466][ T6] usb 4-1: USB disconnect, device number 5 [ 36.109208][ T19] usb 5-1: USB disconnect, device number 4 [ 36.734537][ T6] usb 1-1: USB disconnect, device number 4