last executing test programs: 16.722223773s ago: executing program 3 (id=417): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=@ipv6_newrule={0x1c, 0x20, 0x1, 0x70bd28, 0x35dfdbff, {0xa, 0x80, 0x0, 0x0, 0xb5, 0x0, 0x0, 0x3, 0x17}}, 0x1c}, 0x1, 0x0, 0x0, 0x30040c50}, 0x20048810) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000005c0)=ANY=[@ANYBLOB="5c0000001000390400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000003c0012800b000100697036746e6c00002c000280140003002001000000000000000000000000000914000200fc"], 0x5c}}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = syz_open_dev$video(&(0x7f0000000440), 0x8, 0x0) ioctl$VIDIOC_S_SELECTION(r2, 0xc040565f, &(0x7f0000000280)={0xa, 0x100, 0x3, {0x8000, 0x3, 0x4, 0x2}}) ioctl$VIDIOC_S_FMT(r2, 0xc0d05605, &(0x7f0000000180)={0xa, @raw_data="689ab49e5319d6eac36b7a0ef2a7f5a28a6c14397fdfebc6ef52ce5e477de5455a891a7e0d384a920e86ccb0effa31bb7a8f7c3c02c13ba0f1681c675cd21739434966af02470d4a4df66a8c3a99dd468c705ef1b68c0adf24e90667fc1bf785b8223cffae6d3baa54023eb6f32d9e87288fd991897d139a356d3a906f81640c28f933d3e30cfc8d29eeec23ee2b9fe47657b6e24f2037b0e9bad717f79fdbbec0f724596e90d10414553d7b01c1039903af30e186cf64a761318ba3340c60f25d7c57bfda491ebc"}) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000500)=@nat={'nat\x00', 0x670, 0x5, 0x418, 0x2b0, 0x160, 0xffffffff, 0x160, 0x160, 0x380, 0x380, 0xffffffff, 0x380, 0x380, 0x5, 0x0, {[{{@uncond, 0x0, 0x118, 0x160, 0x48, {}, [@common=@set={{0x40}, {{0xffffffffffffffff, [0x1, 0x3, 0x9c15747fe4031eb, 0x0, 0x4, 0x1], 0x5, 0x3}}}, @common=@unspec=@rateest={{0x68}, {'wg0\x00', 'ip6tnl0\x00', 0x12, 0x2, 0x9, 0x2004, 0x5, 0x3, {0xc35}, {0x1ff}}}]}, @unspec=@DNAT1={0x0, 'DNAT\x00', 0x1, {0x10, @ipv6=@remote, @ipv6=@private1, @icmp_id=0x68, @gre_key=0xfff}}}, {{@ip={@empty, @private=0xa010101, 0xffffffff, 0xff, 'wlan1\x00', 'wlan1\x00', {}, {}, 0x6, 0x2, 0x4}, 0x0, 0x70, 0xa8}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x12, @empty, @loopback, @gre_key=0x1, @port=0x4e20}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x2, @local, @empty, @icmp_id=0x68, @icmp_id=0x67}}}}, {{@uncond, 0x0, 0x98, 0xd0, 0x0, {}, [@common=@icmp={{0x28}, {0xc, "1542", 0x1}}]}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @local, @icmp_id=0x64, @icmp_id=0x64}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x4af) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r5, 0x4004ae99, &(0x7f0000000040)=0x3) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x13, r5, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) close(r6) r7 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r7, 0x29, 0x20, &(0x7f0000000080)={@remote, 0x800, 0x0, 0x3, 0x1, 0x8}, 0x20) setsockopt$inet6_int(r6, 0x29, 0x1000000000021, &(0x7f0000000040)=0x2005, 0x4) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r9, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r10 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) ioctl$TIOCPKT(r10, 0x5420, &(0x7f0000000040)=0x3ff) sendfile(r8, r10, 0x0, 0x10ffff) sendmsg$inet6(r7, &(0x7f0000000140)={&(0x7f0000000100)={0xa, 0x4e60, 0x80000, @local, 0xfffffffb}, 0x1c, 0x0, 0x0, &(0x7f00000001c0)=[@hoplimit={{0x14, 0x29, 0x34, 0xfee5}}], 0x18}, 0x3404c8c4) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) 13.770393254s ago: executing program 3 (id=422): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x24000044) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, 0x0, 0x0) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669632e74696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657930820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, 0xffffffffffffffff) 13.60703932s ago: executing program 3 (id=424): recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) timer_gettime(r1, &(0x7f0000000100)) r2 = fsopen(&(0x7f0000000800)='hfs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, 0x0, &(0x7f00000008c0)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\bb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xd7\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80=\x8a\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\x1f\x03\x00\x00\x00\x00\x00\x00\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9ak\x00\x00\x00\x00\x00\x00\x00\n\xa72\xa3\xef^\xe7\x8f', 0x0) r3 = fsopen(&(0x7f0000001340)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x80) syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x8}}]}}}]}}]}}, 0x0) r5 = memfd_secret(0x0) ioctl$UBLK_U_CMD_START_DEV(r5, 0xc0207506, 0x0) tgkill(0x0, 0x0, 0x2) mount$fuse(0x0, 0x0, &(0x7f0000000140), 0x0, &(0x7f0000000300)=ANY=[]) landlock_create_ruleset(0x0, 0x0, 0x1) statx(0xffffffffffffff9c, 0x0, 0x2000, 0x800, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x2e, &(0x7f0000000080), 0x4) r6 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) ioctl$HIDIOCSREPORT(r6, 0x400c4808, &(0x7f0000000400)={0x2, 0x100}) r7 = openat$cgroup_procs(r4, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) sendfile(r7, r7, 0x0, 0x200) 13.483715154s ago: executing program 2 (id=425): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x35ebc0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl(0xffffffffffffffff, 0x8, &(0x7f0000000200)=' \x00\x00\x00\x00\x00\x00@') ioctl(r0, 0x4048aece, &(0x7f0000000080)) ioctl$KVM_RUN(r0, 0xae80, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./sys/bus/acpi/devices/PNP0C0F:00/status\x00', &(0x7f0000000180)='debugfs\x00', 0x84d895, 0x0) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0xff}, 0x0) setrlimit(0xd, &(0x7f0000000100)={0x8000000000000000, 0xcb7}) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/acpi/devices/PNP0C0F:00/status\x00', 0x0, 0x0) read(r5, &(0x7f00000002c0)=""/10, 0x5b) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/swaps\x00', 0x80040, 0x0) read(r6, &(0x7f0000000240)=""/93, 0x24) 12.088488288s ago: executing program 2 (id=426): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket(0x400000000010, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = dup(r2) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1ff, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f0000000080)="c4417d290ddada01ca48b8a9884315c2c245040f23c00f21f835000002000f23f8c4a2e0f3db0f07d2c74424001e09000000442402e4000000654c0fc72ef3410fc777d365420fc7700066b8502466ef", 0x6e}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x72, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 11.879306456s ago: executing program 3 (id=428): bpf$MAP_CREATE(0x0, 0x0, 0x48) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000012, 0x3000005, 0x401d031, 0xffffffffffffffff, 0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000)=0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x30, 0x40400d1}}], 0x1, 0x10) r1 = fsmount(0xffffffffffffffff, 0x0, 0x0) fchdir(r1) open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x61) futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, &(0x7f0000048000), 0x0) 11.564035942s ago: executing program 2 (id=430): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) listns(&(0x7f0000000200)={0x20, 0x0, 0x3, 0x14020000, 0x0, 0x1}, &(0x7f0000000180)=[0x0, 0x0, 0x0], 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0xe00, 0x0) ioctl$RTC_WKALM_SET(r4, 0x4028700f, &(0x7f0000000080)={0x1, 0x1, {0x39, 0x38, 0x9, 0xd, 0x6, 0x4eac, 0x5, 0xce}}) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x2800) ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, &(0x7f00000083c0)={{0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r5, 0x40505412, &(0x7f00000000c0)={0x3, 0x9dc5, 0x0, 0x0, 0xef7826c8d995ba17}) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0), 0x840, 0x0) r6 = openat$loop_ctrl(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r6, 0x4c81, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x3, 0x3, &(0x7f0000000480)=@framed, &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) rseq(0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000140)=ANY=[@ANYRES32=0x1, @ANYRES32=r7, @ANYBLOB='.'], 0x20) 10.030742165s ago: executing program 2 (id=432): sendmsg$NL80211_CMD_DEL_PMKSA(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x400c4) r0 = socket$l2tp(0x2, 0x2, 0x73) getsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xf, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x6) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0x1}], 0x1) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) set_mempolicy(0x8006, 0x0, 0x5) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_GUEST_MEMFD(r3, 0xc040aed4, &(0x7f00000001c0)={0x1000200001ee0000, 0x3}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r4, 0x78d4a000) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10) syz_emit_ethernet(0x3a, &(0x7f00000002c0)={@link_local, @empty, @val={@val={0x88a8, 0x0, 0x1, 0x4}, {0x8100, 0x5, 0x1}}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @local, @multicast1}, {0x0, 0x0, 0x10, 0x0, @wg=@response={0x2, 0x4, 0x3, "dfb65230d5edc9ad722342f5326b79663aa7379c6ae756a685a6b06e728ddf14", "c8049ac105204a72358c9d00", {"ee0b3e9b577d0b94198fe03ffa76fd52", "7caec12cf489c2efecbb4c9fbe12a219"}}}}}}}, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fcntl$notify(r5, 0x402, 0x80000020) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, 0x0, &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x26, '\x00', 0x0, 0x25, r5}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x5, 0x50, 0x0, &(0x7f0000000000)="ff", 0x0, 0x36, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x50) socket$nl_route(0x10, 0x3, 0x0) close(r0) r7 = ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) ioctl$NS_GET_PARENT(r7, 0xb702, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x50) pipe(0x0) clock_settime(0x6, 0x0) 8.364633799s ago: executing program 1 (id=435): socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) madvise(&(0x7f00002e5000/0x400000)=nil, 0x400000, 0xf) madvise(&(0x7f0000000000/0x800000)=nil, 0x800002, 0xe) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) keyctl$KEYCTL_PKEY_VERIFY(0x1c, 0x0, &(0x7f0000000080)={'enc=', 'oaep', ' hash=', {'blake2s-224-generic\x00'}}, 0x0, 0x0) ioctl$USBDEVFS_CONTROL(0xffffffffffffffff, 0xc0185500, &(0x7f0000000240)={0x80, 0x6, 0x103, 0x0, 0xe0, 0x0, 0x0}) r3 = syz_open_dev$usbfs(&(0x7f0000000480), 0x76, 0x160341) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, &(0x7f0000000000)=@usbdevfs_connect) socket(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f00000016c0)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0200000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000000000006a0af2fe000000008500000009000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe40400000056bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a05cbee30ff0000001989425f5d0b79f6584d0416d7c4bb9f547b328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c3157f00000000000000a06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c3630000000002232017810e743bdaf879946547dbf8b497af002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2c4af38ffb7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e6dafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0eb3280e097585ab91d20baca005472b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92fe8bad99ca332af00f191b66b6a6f732a91f0e2e9190e4b448da7de018c58e950767f9b320be61e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c52573d9308a13d115b43f8b1894c8fa8a14dc4810f61ae96bf704526a8919bc700002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb50409fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381ccc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4d8521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f78fbd8d31330d89069f9648a2ff93060fd2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3bca426a9b7d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4728288e78980c1184d8223edbccbf9258b7374e79a1f8bf3fb73cfd1e76982f3d899f71e4a9f0ba8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c03"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000040), 0x10}, 0x94) 7.60320554s ago: executing program 0 (id=436): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r0, &(0x7f0000000040), 0x8) listen(r0, 0x3) accept4(r0, 0x0, 0x0, 0x80800) r1 = semget$private(0x0, 0x20000000102, 0x0) semop(r1, &(0x7f0000000240)=[{0x3, 0x0, 0x1800}, {0x1, 0x8, 0x1800}, {0x1, 0xe65b}], 0x3) semctl$SETALL(r1, 0x0, 0x11, &(0x7f0000000680)=[0x7, 0x7f, 0x1, 0x9d]) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000180), 0x400, 0x0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x420, &(0x7f00000000c0)={[{@mpol={'mpol', 0x3d, {'interleave', '=static', @void}}}]}) openat$sequencer2(0xffffff9c, &(0x7f0000000000), 0x20940, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={0x0}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) r2 = socket$inet6(0xa, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0xffd8) 6.413202578s ago: executing program 3 (id=437): syz_clone3(&(0x7f0000000040)={0x2a0a00300, 0x0, 0x0, 0x0, {0x3}, 0x0, 0x0, 0x0, 0x0}, 0x3f) openat$comedi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/comedi4\x00', 0x121002, 0x0) io_setup(0x3f, &(0x7f0000000140)=0x0) r1 = timerfd_create(0x0, 0x0) io_submit(r0, 0x1, &(0x7f0000000500)=[&(0x7f0000000340)={0x0, 0x0, 0x0, 0x5, 0x4, r1, 0x0}]) ioctl$TFD_IOC_SET_TICKS(r1, 0x40085400, &(0x7f0000000000)=0x3) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000000c0), 0x240000, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x5}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000040)="2703022b590200330000002f1eafbcf706e1050000008864000f1102ee16002182973d2bd4b83c4a8291a14b8a34f90186cee844000000080000000019b0fb0bba", 0x41}, {&(0x7f0000000440)="63f805d76494961172959832930469edc7b7d050139bf7ada32bc9e37eed1153ecb716cdb8981cd819af0b33254465cc904b7b31789d65c0e0d3333ce2ef36205dd154e363bcadf8f2ea93f45503c6d9fd8dfe5a638cfeb9f79c930a4d18260e5a08ffd35ed8371cff78119319b2b62c7cd9378c73ae90c801681f55ef26cb0000000000000000", 0x87}, {&(0x7f0000000280)="fe112162c63e6da8bc8432294ef18af53cc330a62a2c7035246635093ba4d30fcf19a90804f04a10939db8f4e13069cda6d167bf1b68c94d8d694d6ad1a4d51a715975560ad48770706eb1b88d021e1119f2eb75275cfe77f862368649be0f7aff5e7826729816e3d3e7986d9434f891c71ca6e4210c6757083cfd8e732048c504f28b6d309fc129ed8eb5a82e224eb648f90134d1d315977c6ea360a7fece4baa3dd7dcc970759f29df0e86469e954e2b050e87b203ca27a2a519b7555c3b73f2681d49442d9647ff5ea64110cc5020fdeafe53a7d8be70f3260816bc376bcdc5352771fa55d9733e27730ec7103520e8359c78edd21ee6c68feb3685a55722f5da09ffe8ba9f05081a8d214156376f99906245f2f390ad717979d98f0574f8c5b52dcc2fa494f461be6c2560ddbaafb80c5b4583cbe56d24f14ab78fd718947077ea736251c7b8eee267267534c84daa6f095e94bfb85986a03ddea362cc7e6682884e710727c1163cd4f336c13b844605b7a815fe39e43bd0d2e414410a82958455b8a6bd9194c631d66295675fed64c04107a595c421111a3af6e9fadab5c9", 0x1a1}, {&(0x7f0000000180)="6fe4dd9eeba3271dc700b581440284", 0xfe69}], 0x4}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r3) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000008c0)={'wlan0\x00'}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1002}) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000300)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x1}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_ife={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x20, 0x1, {{0x0, 0x0, 0x2}}}]}}}]}]}}]}, 0x8c}}, 0x0) write$tun(r4, &(0x7f0000000400)=ANY=[], 0xdf41) 6.411682247s ago: executing program 1 (id=438): prlimit64(0x0, 0xe, &(0x7f0000000080)={0x7, 0xf4}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() ioctl$UBLK_U_IO_NEED_GET_DATA(0xffffffffffffffff, 0xc0107522, &(0x7f0000001b40)={0x2, 0xc09, 0x6, &(0x7f0000000b40)=@buf_4k="7f077aee80e894cdac708d0bef26fe36ff86fce14dcb4209d5659ad68e4c2ed3315f64931c658c27f74f4ac05029fec3eb2ff779ab71d8b5c4e06b6f86b4f07df4a7b294e1b6497a53b72fa9dde5196214f8c3d70a9b804ee2ddebf3292efb82ed8a8c3d642337c164481926b5c47b7be766df965cd51b84a2326cbe8261faced6478e7d3f7283935b09947907e5d4c27daaca162cb3111bca89a5e0b7324bac3bb833e11b57c094587bd968120bfbd093c9edaeb1f4ba3ba762d4c18bf23a5d370c3f5981274cdf773c7fdbe4a006a95253a9c35c7aa7e94cb389a777f82e1b237170b3261582a28c55c72192c74d73fbcad69873b6aab2e7ba2bfd03caecae80906d104e0cc1a10c1b0e6b0f102a72fa0074af5b062122bb94eea8c716d21832f2a8924ee62e282ba0d065121b86ec13b74b5d8a420babc5a45b658484f705421716d3c636f3df2c78fb2cc6cb4ba502dee064c188052decdb0ad2fcd4ee11d772f5cf008dd8495db2f933db259429f725d33558f574783947742fb00099d79e59e003292c335f08743d2d03bca1348e0c652e970c4055a5c78b5035f469be0cf5581823c50064d3b8fcba0d6a925ec7a7387d0d5347514ada4344723ca9907a0a9b318c1e632a2132b1bee7ca57291b6f0c888655606a78d6f27d0f6a37db4c22c875cbb6351eb55dda5555c49e2679e773e3af743d3142205da337513c5f6103ff9491db42549a9d6df47df816baecba779951483f69787697205e7a28b1c9d09f95b5441aa525e6832cce0cc9e279846ad3b5b42c7e7df0c21d20efb66f8ee5ee5d7b8864a15d5ff88ad287fc69702ec917a0077ac6844124d9e173d5caad7ccc614c5655b19e7ae6faf9fa0bed97d453429b4396aeaff88887800af8c6895cb9f09be41d6cc78407c558afc4840695d28c7402e2f84073e4c3e2f33995db40a046e5e187940dd57069364e567eb6cfcc63b3a314e342beab26e909ec7fe853e59da04414ac9a6301f908edb890f65aa0f707a7a2055d8ef0331fe2992d70aaed4bfa09e9bc730c50fa62e42db4851739f529dcd2ffa85b3d9287a071dadfadc88e3b700996ad1c8870ae3222cf284eb2b1894b17e9b66f5ef9e7b8554ec72b14f8c19d28b7a5f7527bc165237b057393fc0f5d2d6658ae8dfa24fc27ed54ea3791e93856b9d3441254e56d62b239647d6113253b4c5c885cfb54bf367dfade3f182361a987e293ad33ea0ce6d0ca212b28676e7811468c23ad10cb133ddf3f66a229ca6bc24f7f5d9aa206f60c7dd5ba4333a790e21022e98c494fb5079b1d6898c268e10f703ba0ab8f2d983c74bca562cfea0e736f18a76c3e24602ef0ac9ecdf08cec71953bf1874c7d32e4a4bc893d9215bc4ef30e92b2f9a2c456e9d75dca243b07aa7a9bbbf3f0c0172839d6d985583b5f8e83ff5d85eecca239aade305cba2a40a5b7a5164afc19fe3882172ad5e182c25371f061faad58c29ddac3803ecfec76391c682d46c43ee271bed3b39a4d2107a08e987561e5f841709dcee95eb3447be2c33203e2bec322a0d4c7cee705276a98d931e849a621cdc4b639f90e3c557ad5e9c97cdaf36b7922387177906163cb21fd79b40cad13bdb0a06ab6e16c81149df8c9b8f1b9d9ae8dc14a131c565648e9b3119d7e8a597684f16b3236cb9848ed4109adbc1446b92535653409a03d2f66509415821e65f746b8411df2b8249cacee5512a1674912f80244ee3910873b9c691ec371914443bc415dad2522af8284d2fbd4ea61be26cbecbc63d2cc0633471e5f5f9de72a56f269da1cbe66dfcf6d63f36893d3454b59087741e4ffce0d826363cbff54e899e78c67b5cb1af52f5cb773ea69e765e8b9f77abb87e572f2d4c70c9b4d295d6c531bab1faea436dd7badde92d84513adc788d6c3123b8544243d01c48b82309d014d9d5509570ebe17b461a2977bc8f1f61268eb825a543f314448c3649349ba404e4c69392e8a1a711950f57571d18ec2233466c53e99e86c4c85c4ddede0c70277f9dbfd54ac0f1c2ec56582eced0cb0e96ecc455c06e4a4759e04027b4ac4b304757e586b4ac411fafec8ff8e0435c167e46985613136e3391103226d7a86f13868e618037c498a1bc7b966788850c191fba1e0ccb29292a7bb871d3a16c5c2e85554253bae15a483be0aeeca8066caae0e3ceba875533e850b60a6b834743b05a7443271ec40a3be55eb177c86cd3ea415a548e1d743226b4925e30cacbbd2905544dfc3ed1c6c6f82008c0e4086a529f53177e903c5607a0a6381a4e84c58a5b9337e3d7b2afcc9534bc0a581681f197873378c19622f08155b4fef3d65cbba92a7ba6fd18d5b99728f87a275ba781401e7b75a352aa8098eb1db6db2422c900d93190aba7cab9f506882a010819bca45e0e125bf45e84d170e0ba4b9b1c3e9e37d099bd6dcce6ef279f86ef46dfc257c05e0bb366cc28bae0a76124bb5d52c1dc6d50775cf2eacf203bdfc1b07483c4b843d6e4c65fc9bb84543c0ef0d422cc4316c78149fd39c54779b64f33cfb271d5ef5636a15663998402853c2c61f0bcc00f5104521419497adc8f0ca2c777ff4e055baad88a9c282c77d5cc0430e9c513bc7f7635b161e3f3486a23277a78ef32811e5f7343bcbce20e8b66433ef7f45b39756b9712954e39e37c6f04154cfe79d334c4afe8e6095529fa93e69f487ce448d2dbb7619a2f37f43b4d8f65c46751a8d2d61a5546835bfb8e50ec8d62433b08bed38b1d8869b66f7ee1b79ca035420ce9f4fdebaad63dbebb23e11cf38204f38f0e3d7fa4af0ae89d396b0c32bd465d85ddb07211731560d412835bb498eb5336ad5a8851280237b47a10ed80a92e3056fefe21bb470d0f19ec31e7f411749d9ea7d6894c2013b3131cc9ff6b0f9098d735db91572a156f3e628a74070a675c93f287b0f640198ce2d88842e047551612647285b5398ba1a4277bc64e0660ce4d10337a4707be84005ad82d5093d32077a89f603d1a55c6e9d67f560fce31963c0fa9bb7f9d6bceb681c2fe2fdbc315c0ca9f8f635b48a566b3b2b46fc13190f1f8ceebde44baccf26777c0d0a2d16266571dee163c8d78bef70aa87b28b55dd7a49cd14d769c1cdf96bb4f1cb55ab998fb3982ce2e91d0be03a731f8336d25d49ca4ba80df824806d1b5e2b48ab57dc525213e010a53f9ec738616a56d38fd4a9ea37a193a6b8f982fca049bd30450f69947eb114c45b912e89cd9fe69daceebfec9b816b1df37001205fe8c522f86e992f66b6abd00ddfeae29088d92d03a564502c2708eb99c5e85425ccbc76863000acea06be6e78ab1ae35eb04bca4b58d6f575d54e5656b6354abff8b065a37a313700d35cb5bfa82f12efaf993baaab1c195d92574941c062d9621d7d5bd97ccdd560d5503afe0fad2f3b3baefdb141a22eeb8c8ee27c7b2098b2ab3bdc68d3bca836b03fabc809906a85185f45f40e89c187fc20974e79be6718397bda9d3ad4ae8599e2f75177322c5a34377fed025200dcec0f8121e4fb218f420621691fa84858ac3d6098cebed60fe6fa8c398597c86cb6d390e9f476be95a8df7060bd354e3fa0d6535e9d084bd2c57d6dbc33471b6d044d7bbc49ada854d0f4066b4b3d9ea648e54709a6af13ef9808155be852702ab0a6595ae0759aa6bb5d3f0560816c7144585ff8dbed1d0f6e5b71a9f005a831fd87e2eabf4c29bc68432fcfba47b8112a461e48f47a54c9010ff93e8ef899cbc3d597e6f075ce09a0a8a3c91e09d52fcf33ae3c27e90919d3c3f22519a449e5c5d7e9092c98315d3fb0005ed888ca8a3e2548fcbff2ddfc921147c13ad7f44ca62b27ebceb7123f8f56914d6e9880c459a27d06ece0b3c7151c943d5d3570667e6f9fe2ba94610e57f068dbfaab4af711a19ad88c1f27688b56203089ac96053df8ea30bf453be41a1311b29ef675aacf7eaa1bd86421454733344eda060363160998215809bc3d9d1b28074ce7e04750ee6a879c8421c7d707c663b5168947b44109c776c20e3f374460f1ad3b65503a56e6f82219d705fc8eed13af4bb80d05ea11597bd78e67cd9fa1811385845a46c2e27419491ac8a205ef1d8fa7e33a7c48398e4915da3d8f240868d8be5f507693e277d1d30557e2ceac482e6e35fd38bbcd73247c0ed6d549492325c58f4fa3334f94230ff6e2a90afb5835cefe9fd8957bfe320ab1d5adf7b5c2f271d8c8a95cebcf1be0a6c1d8cb003d6a88f6121ba2e33e68c543d14570f6110b339645b7b96eaf90e9d09dbd55a2aa7e2897d785f31e15f925d1d2a368bff3ed32e24644e8c1f4c02acb544460081f3c5f7e72ca67cd23da3f7d5bc022d06f23898b9d460e5b0f538463f1751d082a594cc3cd57d1104e83be1464cef870e60bfd6e358414dad8864dd2f439c47de58876a71c23ca40da6ee0af7fe56defab49fe8b59e45849af61c6a953e43a5cd4c92ef288a7c17e2c21c19deabca8713b5b2d4d2b1fc351e03e5d047245a47ff1ba48e810f7d0eec3ec6c79c1b522d40cc99adf7a5597b3a861428c7d3147f33a29cef68dd7861e0ee14dcc5f25d8d9b6a0eedf29e5f6dd707986d4b3e5a63643bb8c3c9b9d4142db45e9e9476a7b941e463fb8c546cadf0b2772de179437950fb654185b1da0c29b47c246104dbdb47a3348b3d6fdcdf0de08d62164e3eb29f9cbe17f89726cd48fabd3695aaad5ad77b8bc23d714486db9048e07927755602ea493ef0a0de5f015a4b593bbe2def902d6a443d56ff1aa9c6daa27a0baee29fa92a203ac2e6f459a1ec232ec074a771cdcfe20779acee6183f9026f7b319bcc9b14d61a1627c7aa1b81e04476f0d41a8bcaa76427712481bb1428974f1830c2651e475016d298bc7a24c9c3cb7a6952d2c20982267ddc810dcc3717650a336835882a7e46567f02e80efa9591cd2c906c0ad283d4fb9fa3758fb166e6514f6685d83285b711f85278553c363d7ed0f0e021adcb32e7fb814af4a41cc1516c4c38d7c3df080143d04873648b460de5abad445a4bc8f6c34e6ab3ea4ef1a4916e94931e88b6b79cc22e8baabcf5c99ad1c6ba3a928e55d3cef6f52954225ab121800aecf3f7af886d67e485f4c026d666b613bd9a6c47c9481fe745250118488772b6d7cc9c98e07a3c23f7ccb097ae2162c75e94794ef6306c4e916764c106ab47c5a71ebde68f1c058bcebe7198489df533deba7afbe8cce261b0f796477379bf58077cd148760ccdac5a6576d62691824c01afa16470111157441d501358b1ea4d43cbceda7b737f08c4356e43f4e7f81e3db8b3dae1652f529438d9379a79235b236cffecee61cf9f5e5d317d6505196abaf471fc200c3848ac6090757dfc956ea2ad4831d42a580280bf6eee9238e5d6cf6928834bc9f4613b379fc53188389cad37b42ad7b1633779ec9c7f400b6d7285bce8149ea45a9bc6d917592dd68a8a83f4769283981d95999ffbdbaca5958b87415095904ae495d5ff384987d1cc07a96f7468617dc434484a00ec5ffbbc0de437996b96c0f79e3a460b63273adf8acfe5bb4697e0ed92d43c14cfa8723709f3185334c22f54f604e633d79b22e734248f88ca0d33083b9d7f1575e7a0e403955e7bebe24ce7601666146975dfcbb276c48695be11fd4476149207951681cc54bd78ad3bff7c71783f670a00900cde2853e08b850ce70f971b39ad521633cabf5ade147ea975f826ad75624fda1350bad1d70aa8aa21020c77daf9d850ceaef0d91b14c2d1f69f19f5b99"}) sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xe, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r3, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1, 0x80000001}}}, 0x88) setsockopt$inet6_group_source_req(r3, 0x29, 0x2d, &(0x7f00000005c0)={0x1, {{0xa, 0x0, 0x0, @mcast1, 0x5}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) pipe2$9p(0x0, 0x4000) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r4 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) setsockopt$packet_int(r4, 0x107, 0xf, 0x0, 0x0) ioctl$SIOCX25SCALLUSERDATA(r4, 0x89e5, &(0x7f0000000100)={0x4b, "a07ee3b9d7a60ce389335589ce69e007eb8817b43e8abfdc4766ca5204e665574dc44fbe9ff2b08c666b3add44f41176540612fa2b5b429d6ef47ef20071d837ce56ace4d2dfec83d162cd7a3a183510a931081d09a573251380a1f169a322affd56382c8788cc01c8b32adc014685e52106b18627c32ec044712acdb8e586a7"}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) write(0xffffffffffffffff, &(0x7f0000000200)='wwnn=0x111111', 0xd) 6.100674107s ago: executing program 4 (id=440): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket(0x400000000010, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = dup(r2) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1ff, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f0000000080)="c4417d290ddada01ca48b8a9884315c2c245040f23c00f21f835000002000f23f8c4a2e0f3db0f07d2c74424001e09000000442402e4000000654c0fc72ef3410fc777d365420fc7700066b8502466ef", 0x6e}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x72, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 5.276071688s ago: executing program 1 (id=441): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000300), 0x0) 5.001587169s ago: executing program 4 (id=442): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r0, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r0, 0x2) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r1, 0xffffffffffffffff, 0x0) 4.999114788s ago: executing program 3 (id=443): bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYRESOCT], 0x48) r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7fff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0xb, 0x1, 0x4, 0x0, 0x7}) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000500)={'ip6gre0\x00', &(0x7f0000000480)={'ip6gre0\x00', 0x0, 0x29, 0x7f, 0xb, 0x4, 0x2, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @empty, 0x40, 0x7, 0x3, 0x8}}) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000000)=0x1) ppoll(&(0x7f0000000640)=[{r0, 0x2103}], 0x1, 0x0, 0x0, 0x0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000300)={'vxcan1\x00', 0x0}) bind$can_j1939(r4, &(0x7f0000000180)={0x1d, r5, 0x0, {0x1, 0xff, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r4, 0x1, 0x5, &(0x7f0000000040)=0x1, 0x4) sendmmsg(r4, &(0x7f0000000440)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000005c0)='\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x9}], 0x1}}], 0x1, 0x44845) connect$can_j1939(r4, &(0x7f00000000c0)={0x1d, 0x0, 0x0, {0x1, 0xff}, 0xfd}, 0x7b) sendmsg$nl_route_sched(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=@newtfilter={0x24, 0x11, 0x1, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x74, r5, {0x7, 0xfffa}, {0x7, 0xffff}, {0x3, 0x8}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x4008050) recvfrom(r2, 0x0, 0x0, 0x10000, 0x0, 0x0) sendmsg$NL80211_CMD_START_NAN(r2, &(0x7f0000001480)={&(0x7f0000001340)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001440)={&(0x7f00000009c0)=ANY=[@ANYRESOCT=r4, @ANYRESHEX, @ANYBLOB="15d630910104986a85a9f3d0692271b0195b25f82bf2b4b3b64f91abebfb5ad89785caa5ac0120bda8afc4f831783aa82969db546bb1971459da86d2174f3cae1e7f6a639b7e82ff4359c76616eda17f304f8b7d2852330ee599e4c4aad05051bc9f5e98ee9953a9a3ab83e4a316d6f726b08d281129c5dd36e711ca2840a7e99c22ec30fcefdc3de74aa52a4a54ce5793e98cf0c500b3339a8448327c21ef3be3b265332483385a362f9528e5683bb2e5b4c7fedc7fc03fec672d55f4ed65efdde1b2e84e32f335478862022f64c2719a236b1f54736ae63ef734748848797a5cd6d05ce4850b62a77dc26aeb", @ANYBLOB="8783b047cece7c70aa3f69f9977d3b965464b1bfd30c061fbb4b83d5d3e6f990b2a460d304b642864409f698cccff6cd47582174939bc744ba0e2c44ceac9bc5ae97dd866cb66fffa525975aca4a123116b2ca48987b353e0f9bd1d211d22b9607fcf07e082fbca26971f4cc92c38b76eb7589422f68a2f3461d9fe1a7677e6306c66ec6c16b"], 0x14}, 0x1, 0x0, 0x0, 0x20048001}, 0x40010) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) ioctl$XFS_IOC_PATH_TO_HANDLE(r3, 0xc0385869, &(0x7f0000000700)={0xffffffffffffffff, &(0x7f0000000540)='debugfs\x00', 0x8105cf1fe3b0665, &(0x7f0000000200)={@align=0x1, {0x893, 0xb, 0xf, 0x9}}, 0x45, &(0x7f0000000680), &(0x7f0000000140)=0x3}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f0000000740)=r6, 0x1) mount(0x0, &(0x7f00000001c0)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/split_huge_pages\x00', 0x1, 0x0) write(r7, &(0x7f0000000600)='1', 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x7, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="1806000000000000002428c7a3e1d5f46000583c7adcd3e0290000000000000007000000a62c94696262a8b253e8ffc2e3496ad00276c5a0904b289413e2606467f8a52349202e8116607d99824261dc"], &(0x7f00000005c0)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'veth1_to_team\x00'}) 4.822609886s ago: executing program 0 (id=444): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x378b5ec3}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @queue={{0xa}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_QUEUE_FLAGS={0x6, 0x3, 0x1, 0x0, 0x1}, @NFTA_QUEUE_NUM={0x6, 0x1, 0x1, 0x0, 0x17}]}}}]}]}], {0x14}}, 0xd0}}, 0x0) 4.695616619s ago: executing program 4 (id=445): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)) r1 = fsopen(&(0x7f0000000800)='hfs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, 0x0, 0x0, 0x0) r2 = fsopen(&(0x7f0000001340)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x80) r4 = syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) tgkill(0x0, 0x0, 0x2) landlock_create_ruleset(0x0, 0x0, 0x1) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x2e, &(0x7f0000000080), 0x4) syz_usb_control_io$hid(r4, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[], 0x0}, 0x0) r5 = openat$cgroup_procs(r3, 0x0, 0x2, 0x0) sendfile(r5, r5, 0x0, 0x200) 4.489367493s ago: executing program 0 (id=446): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x24000044) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)='3', 0x4e) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, 0x0, 0x0) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669632e74696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657930820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, 0xffffffffffffffff) 4.376182501s ago: executing program 4 (id=447): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x2, 0x12, 0x6, 0x1, 0x2, 0x0, 0x70bd2a, 0x25dfdbfb}, 0x10}}, 0x0) 4.153028998s ago: executing program 1 (id=448): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x101401, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'batadv_slave_1\x00', 0x200}) socket$netlink(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) rseq(&(0x7f0000001080)={0x0, 0x0, 0x0, 0x5}, 0xfffffffffffffef9, 0x0, 0x0) syz_io_uring_setup(0x5026, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='map_files\x00') getdents64(r2, &(0x7f0000000000)=""/121, 0x79) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) ioctl$SG_GET_REQUEST_TABLE(0xffffffffffffffff, 0x2286, &(0x7f0000000140)) setsockopt$MRT6_ASSERT(r1, 0x29, 0xcf, &(0x7f00000003c0)=0x101, 0x4) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = shmget$private(0x0, 0x400000, 0x8, &(0x7f000000e000/0x400000)=nil) shmctl$SHM_LOCK(r4, 0xb) timer_create(0x3, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) process_vm_readv(0x0, &(0x7f0000000980), 0x0, &(0x7f0000000500)=[{&(0x7f00000008c0)=""/206, 0xce}, {&(0x7f0000000400)=""/9, 0x9}, {0x0}, {&(0x7f00000010c0)=""/4096, 0x1000}, {&(0x7f0000000580)=""/99, 0x63}], 0x5, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) r5 = syz_open_dev$vim2m(&(0x7f0000000080), 0xffe, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f0000000040)={0x8, 0x1, 0x1}) clock_gettime(0x0, 0x0) ioctl$vim2m_VIDIOC_QBUF(r5, 0xc058560f, &(0x7f00000000c0)=@mmap={0x1, 0x1, 0x4, 0x8030, 0xffffffff, {}, {0x0, 0xc, 0xf1, 0xa, 0x0, 0x1, "bf231e4b"}}) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r6, 0x400448cb, 0x0) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, 0x0, 0x10, &(0x7f0000000340)={0x5}) 4.151635346s ago: executing program 4 (id=449): socket$nl_netfilter(0x10, 0x3, 0xc) fsetxattr$trusted_overlay_opaque(0xffffffffffffffff, &(0x7f00000000c0), &(0x7f0000000180), 0x2, 0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) r2 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r2, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r2, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c0002800500010000000000080007"], 0x64}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="5c00000002010104000000000000000002001000240002801400018008000100e000000108000200e00000010c000280050001"], 0x5c}, 0x1, 0x0, 0x0, 0x4800}, 0x4000) 4.123483375s ago: executing program 0 (id=450): r0 = syz_open_dev$usbfs(&(0x7f0000000480), 0x76, 0x160341) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, 0x0) 2.456192555s ago: executing program 0 (id=451): sendmsg$NL80211_CMD_DEL_PMKSA(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x400c4) r0 = socket$l2tp(0x2, 0x2, 0x73) getsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xf, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x6) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) set_mempolicy(0x8006, 0x0, 0x5) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_GUEST_MEMFD(r3, 0xc040aed4, &(0x7f00000001c0)={0x1000200001ee0000, 0x3}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r4, 0x78d4a000) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10) syz_emit_ethernet(0x3a, &(0x7f00000002c0)={@link_local, @empty, @val={@val={0x88a8, 0x0, 0x1, 0x4}, {0x8100, 0x5, 0x1}}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x73, 0x0, @local, @multicast1}, {0x0, 0x0, 0x10, 0x0, @wg=@response={0x2, 0x4, 0x3, "dfb65230d5edc9ad722342f5326b79663aa7379c6ae756a685a6b06e728ddf14", "c8049ac105204a72358c9d00", {"ee0b3e9b577d0b94198fe03ffa76fd52", "7caec12cf489c2efecbb4c9fbe12a219"}}}}}}}, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fcntl$notify(r5, 0x402, 0x80000020) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, 0x0, &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x26, '\x00', 0x0, 0x25, r5}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x5, 0x50, 0x0, &(0x7f0000000000)="ff", 0x0, 0x36, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x50) socket$nl_route(0x10, 0x3, 0x0) close(r0) r7 = ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) ioctl$NS_GET_PARENT(r7, 0xb702, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) pipe(0x0) lsetxattr$security_capability(&(0x7f0000000080)='./cgroup/cgroup.procs\x00', &(0x7f00000000c0), 0x0, 0xfffffffffffffcb1, 0x0) 2.445534669s ago: executing program 1 (id=452): r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$packet(0x11, 0x3, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x67) socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) socketpair$unix(0x1, 0x5, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000840)={r5, @in6={{0xa, 0x4e22, 0x80, @empty, 0x5d4e}}, 0x2, 0x2, 0x614, 0x4, 0xd, 0x7, 0x4}, 0x9c) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'geneve0\x00', 0x0}) sendto$packet(r1, &(0x7f0000000180)="0b031407e0ff640f0200475400f6a13bb1000e00080081004803", 0x10000, 0x0, &(0x7f0000000140)={0x11, 0x0, r6}, 0x14) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0xe0, 0xf, 0x7fff7ffc}]}) r8 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x600) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r8, 0xc0a85320, &(0x7f0000000440)={{0x80}, 'port1\x00', 0xe3, 0x1b1c07, 0x0, 0xd}) close_range(r7, 0xffffffffffffffff, 0x3f00000000000000) 2.219209492s ago: executing program 2 (id=453): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket(0x400000000010, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = dup(r2) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1ff, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f0000000080)="c4417d290ddada01ca48b8a9884315c2c245040f23c00f21f835000002000f23f8c4a2e0f3db0f07d2c74424001e09000000442402e4000000654c0fc72ef3410fc777d365420fc7700066b8502466ef", 0x6e}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x72, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 676.744308ms ago: executing program 2 (id=454): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r0, &(0x7f0000000040), 0x8) listen(r0, 0x3) accept4(r0, 0x0, 0x0, 0x80800) r1 = semget$private(0x0, 0x20000000102, 0x0) semop(r1, &(0x7f0000000240)=[{0x3, 0x0, 0x1800}, {0x1, 0x8, 0x1800}, {0x1, 0xe65b}], 0x3) semctl$SETALL(r1, 0x0, 0x11, &(0x7f0000000680)=[0x7, 0x7f, 0x1, 0x9d]) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000180), 0x400, 0x0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x420, &(0x7f00000000c0)={[{@mpol={'mpol', 0x3d, {'interleave', '=static', @void}}}]}) openat$sequencer2(0xffffff9c, &(0x7f0000000000), 0x20940, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd2c, 0x0, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x7fffffffffffffff, 0x0, 0x0, 0x4, 0xffffffffffffffff, 0x7}, {0x0, 0xa00, 0x407ffffffffffe, 0x800000000000002}, 0xffffffff, 0x0, 0x1, 0x0, 0x6}}, 0xb8}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) r2 = socket$inet6(0xa, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0xffd8) 674.472366ms ago: executing program 1 (id=455): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x4) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000016000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x4e, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x0, 0xd000}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa0f7f"], 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 63.683848ms ago: executing program 0 (id=456): mkdir(&(0x7f00000001c0)='./my_configfs\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x10000000005) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_emit_ethernet(0x66, &(0x7f00000003c0)={@local, @random="42238e910adb", @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "fca33f", 0x30, 0x67, 0x0, @dev, @local, {[@fragment={0x21}, @dstopts={0x0, 0x3, '\x00', [@generic={0x0, 0x17, "3e090e541b64f22a8982d3f5aaacd21a0ca186608b74f1"}]}]}}}}}, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000200)=0x40003) r4 = socket$packet(0x11, 0x3, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f0000000000)=[{0x48, 0x2, 0x48, 0x5}, {0x6, 0x27, 0x2, 0x207}]}, 0x10) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="c323567fea2eb55ab91640ea77eb5f6ae9f6564983ae5689da72d2e7a28657524e863f1102f9bbf99e3f973e4abe7a95eeb4e1e213c0bf915331001e04c028f2dbc32428bb43d87ac6364d93d936435e000aa9cc8dff68141f7e752a1a10d9ec3f0a87583236e7d32f3fa56ba46a6081ee30f26f6c71aca4c7c43bf653cb768932e992", @ANYRES16=r5, @ANYBLOB="99061762e348c5774f5a7938c05120d53914d04aa1519eb03dece010d02e65f8ec0ebc6e66684ca7986bbccf1c260bdcd5c1a550eef5330ae0", @ANYRES8=r3, @ANYRESOCT=r5, @ANYRES64=0x0], 0x1c}}, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0) sendto$packet(r4, &(0x7f0000000140)="09000000e7001400000000803500008100000088a80000000000504e7c6a59e468", 0x21, 0x4044804, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r7, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="1000000014000300ce5d6201ffdbdf25"], 0x10}}, 0x40000) 0s ago: executing program 4 (id=457): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)) r1 = fsopen(&(0x7f0000000800)='hfs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, 0x0, 0x0, 0x0) r2 = fsopen(&(0x7f0000001340)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x80) r4 = syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) tgkill(0x0, 0x0, 0x2) landlock_create_ruleset(0x0, 0x0, 0x1) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x2e, &(0x7f0000000080), 0x4) syz_usb_control_io$hid(r4, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[], 0x0}, 0x0) r5 = openat$cgroup_procs(r3, 0x0, 0x2, 0x0) sendfile(r5, r5, 0x0, 0x200) kernel console output (not intermixed with test programs): lave bond_slave_1): Enslaving as an active interface with an up link [ 64.234899][ T5611] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.234963][ T5611] bridge0: port 1(bridge_slave_0) entered disabled state [ 64.235040][ T5611] bridge_slave_0: entered allmulticast mode [ 64.237071][ T5611] bridge_slave_0: entered promiscuous mode [ 64.239055][ T5611] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.239145][ T5611] bridge0: port 2(bridge_slave_1) entered disabled state [ 64.239426][ T5611] bridge_slave_1: entered allmulticast mode [ 64.240640][ T5611] bridge_slave_1: entered promiscuous mode [ 64.273755][ T5612] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.273824][ T5612] bridge0: port 1(bridge_slave_0) entered disabled state [ 64.274450][ T5612] bridge_slave_0: entered allmulticast mode [ 64.278136][ T5612] bridge_slave_0: entered promiscuous mode [ 64.282033][ T5612] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.282098][ T5612] bridge0: port 2(bridge_slave_1) entered disabled state [ 64.282177][ T5612] bridge_slave_1: entered allmulticast mode [ 64.285104][ T5612] bridge_slave_1: entered promiscuous mode [ 64.334008][ T5601] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 64.334020][ T5601] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 64.334038][ T5601] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 64.335039][ T5603] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 64.335048][ T5603] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 64.335076][ T5603] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 64.366530][ T5601] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 64.366541][ T5601] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 64.366559][ T5601] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 64.373585][ T5603] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 64.373595][ T5603] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 64.373613][ T5603] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 64.382534][ T5612] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 64.385533][ T5602] team0: Port device team_slave_0 added [ 64.388819][ T5611] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 64.394879][ T5612] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 64.396739][ T5602] team0: Port device team_slave_1 added [ 64.407703][ T5611] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 64.509392][ T5601] hsr_slave_0: entered promiscuous mode [ 64.510117][ T5601] hsr_slave_1: entered promiscuous mode [ 64.516971][ T5603] hsr_slave_0: entered promiscuous mode [ 64.517631][ T5603] hsr_slave_1: entered promiscuous mode [ 64.518090][ T5603] debugfs: 'hsr0' already exists in 'hsr' [ 64.518136][ T5603] Cannot create hsr debugfs directory [ 64.528930][ T5602] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 64.528941][ T5602] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 64.528958][ T5602] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 64.610046][ T5610] Bluetooth: hci1: command tx timeout [ 64.662004][ T5612] team0: Port device team_slave_0 added [ 64.662859][ T5602] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 64.662870][ T5602] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 64.662889][ T5602] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 64.664233][ T5611] team0: Port device team_slave_0 added [ 64.673971][ T5612] team0: Port device team_slave_1 added [ 64.678739][ T5610] Bluetooth: hci3: command tx timeout [ 64.686045][ T4922] Bluetooth: hci4: command tx timeout [ 64.686104][ T4922] Bluetooth: hci0: command tx timeout [ 64.686261][ T5610] Bluetooth: hci2: command tx timeout [ 64.696788][ T5611] team0: Port device team_slave_1 added [ 64.774238][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 64.774252][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 64.774272][ T5612] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 64.775055][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 64.775065][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 64.775084][ T5611] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 64.801576][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 64.801589][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 64.801606][ T5612] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 64.802293][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 64.802302][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 64.802318][ T5611] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 64.819158][ T5602] hsr_slave_0: entered promiscuous mode [ 64.819940][ T5602] hsr_slave_1: entered promiscuous mode [ 64.820400][ T5602] debugfs: 'hsr0' already exists in 'hsr' [ 64.820414][ T5602] Cannot create hsr debugfs directory [ 64.942591][ T5611] hsr_slave_0: entered promiscuous mode [ 64.943264][ T5611] hsr_slave_1: entered promiscuous mode [ 64.943722][ T5611] debugfs: 'hsr0' already exists in 'hsr' [ 64.943736][ T5611] Cannot create hsr debugfs directory [ 64.969566][ T5612] hsr_slave_0: entered promiscuous mode [ 64.970250][ T5612] hsr_slave_1: entered promiscuous mode [ 64.970706][ T5612] debugfs: 'hsr0' already exists in 'hsr' [ 64.970720][ T5612] Cannot create hsr debugfs directory [ 65.201019][ T5601] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 65.204577][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 65.205073][ T5601] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 65.218478][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 65.242065][ T5601] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 65.244542][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 65.245251][ T5601] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 65.257977][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 65.320125][ T5603] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 65.325091][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 65.339864][ T5603] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 65.343601][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 65.344859][ T5603] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 65.368900][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 65.369553][ T5603] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 65.372107][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 65.448892][ T5602] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 65.453202][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 65.455303][ T5602] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 65.479478][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 65.481436][ T5602] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 65.483668][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 65.496592][ T5602] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 65.502167][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 65.534260][ T5601] 8021q: adding VLAN 0 to HW filter on device bond0 [ 65.586446][ T5601] 8021q: adding VLAN 0 to HW filter on device team0 [ 65.612856][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.612936][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 65.616171][ T5612] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 65.626890][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 65.627418][ T5612] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 65.632592][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 65.633107][ T5612] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 65.640941][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 65.641494][ T5612] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 65.647829][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 65.694661][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.694862][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 65.809098][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 [ 65.809131][ T1307] ieee802154 phy1 wpan1: encryption failed: -22 [ 65.809590][ T5603] 8021q: adding VLAN 0 to HW filter on device bond0 [ 65.812027][ T5611] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 65.813973][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 65.825330][ T5602] 8021q: adding VLAN 0 to HW filter on device bond0 [ 65.828309][ T5611] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 65.833432][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 65.847120][ T5611] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 65.853619][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 65.855089][ T5611] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 65.860412][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 65.891709][ T5612] 8021q: adding VLAN 0 to HW filter on device bond0 [ 65.894120][ T5603] 8021q: adding VLAN 0 to HW filter on device team0 [ 65.908180][ T5602] 8021q: adding VLAN 0 to HW filter on device team0 [ 65.928343][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.928425][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 65.931028][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.931107][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 65.968788][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.968933][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 65.971010][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.971090][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 65.978257][ T31] kauditd_printk_skb: 14 callbacks suppressed [ 65.978269][ T31] audit: type=1400 audit(1790329474.383:153): avc: denied { sys_module } for pid=5601 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 65.978435][ T5612] 8021q: adding VLAN 0 to HW filter on device team0 [ 66.040134][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.040206][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 66.044161][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.044231][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 66.240233][ T5611] 8021q: adding VLAN 0 to HW filter on device bond0 [ 66.266884][ T5611] 8021q: adding VLAN 0 to HW filter on device team0 [ 66.291245][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.291293][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 66.313306][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.313391][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 66.628799][ T5601] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 66.675908][ T5610] Bluetooth: hci1: command tx timeout [ 66.734732][ T5601] veth0_vlan: entered promiscuous mode [ 66.756170][ T5609] Bluetooth: hci0: command tx timeout [ 66.756197][ T5609] Bluetooth: hci4: command tx timeout [ 66.756216][ T5609] Bluetooth: hci3: command tx timeout [ 66.756328][ T5610] Bluetooth: hci2: command tx timeout [ 66.774775][ T5601] veth1_vlan: entered promiscuous mode [ 66.846311][ T5601] veth0_macvtap: entered promiscuous mode [ 66.863682][ T5601] veth1_macvtap: entered promiscuous mode [ 66.901515][ T5601] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 66.925309][ T5601] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 67.000303][ T43] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.000636][ T43] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.000828][ T43] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.018172][ T43] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.101472][ T1537] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.101490][ T1537] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.153564][ T5612] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.179532][ T1537] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.179552][ T1537] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.211698][ T31] audit: type=1400 audit(1790329475.613:154): avc: denied { mounton } for pid=5601 comm="syz-executor" path="/root/syzkaller.qEKHs7/syz-tmp" dev="sda1" ino=2042 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 67.211738][ T31] audit: type=1400 audit(1790329475.613:155): avc: denied { mount } for pid=5601 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 67.244433][ T5603] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.278855][ T31] audit: type=1400 audit(1790329475.683:156): avc: denied { mounton } for pid=5601 comm="syz-executor" path="/root/syzkaller.qEKHs7/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 67.284190][ T5612] veth0_vlan: entered promiscuous mode [ 67.285503][ T31] audit: type=1400 audit(1790329475.683:157): avc: denied { mount } for pid=5601 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 67.303177][ T5612] veth1_vlan: entered promiscuous mode [ 67.352912][ T31] audit: type=1400 audit(1790329475.753:158): avc: denied { mounton } for pid=5601 comm="syz-executor" path="/root/syzkaller.qEKHs7/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 67.352939][ T31] audit: type=1400 audit(1790329475.753:159): avc: denied { mounton } for pid=5601 comm="syz-executor" path="/root/syzkaller.qEKHs7/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=8223 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 67.380798][ T31] audit: type=1400 audit(1790329475.783:160): avc: denied { unmount } for pid=5601 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 67.398624][ T5612] veth0_macvtap: entered promiscuous mode [ 67.398715][ T31] audit: type=1400 audit(1790329475.803:161): avc: denied { mounton } for pid=5601 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2780 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 67.409695][ T31] audit: type=1400 audit(1790329475.813:162): avc: denied { mount } for pid=5601 comm="syz-executor" name="/" dev="gadgetfs" ino=8232 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 67.411057][ T5612] veth1_macvtap: entered promiscuous mode [ 67.463196][ T5602] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.517523][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 67.524345][ T5601] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 67.541092][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 67.661651][ T5602] veth0_vlan: entered promiscuous mode [ 67.671325][ T5611] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.707123][ T5602] veth1_vlan: entered promiscuous mode [ 67.726178][ T59] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.726754][ T59] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.726986][ T59] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.312008][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.312029][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.341681][ T5602] veth0_macvtap: entered promiscuous mode [ 68.365678][ T1117] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.365694][ T1117] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.371554][ T5602] veth1_macvtap: entered promiscuous mode [ 68.383972][ T5611] veth0_vlan: entered promiscuous mode [ 68.422482][ T5611] veth1_vlan: entered promiscuous mode [ 68.427765][ T5603] veth0_vlan: entered promiscuous mode [ 68.451463][ T5602] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 68.459463][ T5603] veth1_vlan: entered promiscuous mode [ 68.474715][ T5602] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 68.516124][ T5611] veth0_macvtap: entered promiscuous mode [ 68.544019][ T5611] veth1_macvtap: entered promiscuous mode [ 68.610354][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.610663][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.610940][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.611253][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.611476][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.614484][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 68.624963][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 68.642185][ T5603] veth0_macvtap: entered promiscuous mode [ 68.690010][ T5603] veth1_macvtap: entered promiscuous mode [ 68.690976][ T5802] xt_connbytes: Forcing CT accounting to be enabled [ 68.691033][ T5802] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 68.720888][ T1117] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.720904][ T1117] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.748813][ T1117] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.749263][ T1117] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.756141][ T5610] Bluetooth: hci1: command tx timeout [ 68.792181][ T5603] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 68.813998][ T5603] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 68.835826][ T4922] Bluetooth: hci3: command tx timeout [ 68.835851][ T4922] Bluetooth: hci4: command tx timeout [ 68.835869][ T4922] Bluetooth: hci0: command tx timeout [ 68.835983][ T5610] Bluetooth: hci2: command tx timeout [ 68.857368][ T1117] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.861693][ T59] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.861725][ T59] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.861752][ T59] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.861778][ T59] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.861804][ T59] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.885517][ T1117] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.885532][ T1117] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.932127][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.932142][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.060253][ T100] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.060270][ T100] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.169455][ T1117] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.169475][ T1117] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.096370][ T5808] Illegal XDP return value 4294967294 on prog (id 2) dev N/A, expect packet loss! [ 70.288825][ T50] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.288844][ T50] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.848743][ T5610] Bluetooth: hci1: command tx timeout [ 70.915710][ T5609] Bluetooth: hci0: command tx timeout [ 70.915738][ T5609] Bluetooth: hci4: command tx timeout [ 70.915756][ T5609] Bluetooth: hci3: command tx timeout [ 70.915802][ T5610] Bluetooth: hci2: command tx timeout [ 71.139575][ T31] kauditd_printk_skb: 40 callbacks suppressed [ 71.139592][ T31] audit: type=1400 audit(1790329479.543:203): avc: denied { setopt } for pid=5825 comm="syz.2.11" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 71.141914][ T31] audit: type=1400 audit(1790329479.543:204): avc: denied { bind } for pid=5825 comm="syz.2.11" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 71.142500][ T31] audit: type=1400 audit(1790329479.543:205): avc: denied { name_bind } for pid=5825 comm="syz.2.11" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 71.144352][ T31] audit: type=1400 audit(1790329479.543:206): avc: denied { node_bind } for pid=5825 comm="syz.2.11" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 71.145197][ T31] audit: type=1400 audit(1790329479.543:207): avc: denied { write } for pid=5825 comm="syz.2.11" lport=20001 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 71.702402][ T31] audit: type=1400 audit(1790329480.103:208): avc: denied { create } for pid=5826 comm="syz.1.13" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 71.760387][ T5829] IPv4: Oversized IP packet from 127.202.26.0 [ 72.001110][ T5837] xt_connbytes: Forcing CT accounting to be enabled [ 72.001131][ T5837] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 72.280086][ T5844] Bluetooth: ISO socket layer initialized [ 72.309688][ T5844] process 'syz.3.19' launched './file1' with NULL argv: empty string added [ 72.371666][ T31] audit: type=1400 audit(1790329480.683:209): avc: denied { bind } for pid=5835 comm="syz.3.19" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 72.371800][ T31] audit: type=1400 audit(1790329480.683:210): avc: denied { write } for pid=5835 comm="syz.3.19" path="socket:[7809]" dev="sockfs" ino=7809 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 72.371915][ T31] audit: type=1400 audit(1790329480.713:211): avc: denied { execute } for pid=5835 comm="syz.3.19" name="file1" dev="tmpfs" ino=46 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 72.372044][ T31] audit: type=1400 audit(1790329480.713:212): avc: denied { execute_no_trans } for pid=5835 comm="syz.3.19" path="/5/file1" dev="tmpfs" ino=46 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 74.018724][ T5852] Zero length message leads to an empty skb [ 75.490291][ T5873] xt_connbytes: Forcing CT accounting to be enabled [ 75.490315][ T5873] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 75.552582][ T5871] IPv4: Oversized IP packet from 127.202.26.0 [ 76.694239][ T10] cfg80211: failed to load regulatory.db [ 76.764345][ T5885] FAULT_INJECTION: forcing a failure. [ 76.764345][ T5885] name failslab, interval 1, probability 0, space 0, times 1 [ 76.764375][ T5885] CPU: 0 UID: 0 PID: 5885 Comm: syz.3.35 Not tainted syzkaller #0 PREEMPT(full) [ 76.764397][ T5885] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 76.764408][ T5885] Call Trace: [ 76.764414][ T5885] [ 76.764422][ T5885] dump_stack_lvl+0x100/0x190 [ 76.764458][ T5885] should_fail_ex.cold+0x5/0xa [ 76.764486][ T5885] should_failslab+0xc2/0x120 [ 76.764512][ T5885] __kmalloc_noprof+0xfc/0x840 [ 76.764533][ T5885] ? rcu_is_watching+0x13/0xc0 [ 76.764558][ T5885] ? tomoyo_encode2+0xfb/0x3c0 [ 76.764588][ T5885] tomoyo_encode2+0xfb/0x3c0 [ 76.764616][ T5885] tomoyo_encode+0x29/0x50 [ 76.764640][ T5885] tomoyo_realpath_from_path+0x18c/0x690 [ 76.764670][ T5885] tomoyo_path_number_perm+0x23c/0x580 [ 76.764691][ T5885] ? tomoyo_path_number_perm+0x22e/0x580 [ 76.764714][ T5885] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 76.764746][ T5885] ? __lock_acquire+0x5c0/0x1f40 [ 76.764781][ T5885] ? __fget_files+0x34/0x3d0 [ 76.764806][ T5885] ? find_held_lock+0x2b/0x80 [ 76.764834][ T5885] ? hook_file_ioctl_common+0x140/0x440 [ 76.764867][ T5885] ? __fget_files+0x21f/0x3d0 [ 76.764896][ T5885] security_file_ioctl+0xd3/0x230 [ 76.764919][ T5885] __x64_sys_ioctl+0xb7/0x210 [ 76.764942][ T5885] do_syscall_64+0x123/0x790 [ 76.764963][ T5885] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.764983][ T5885] RIP: 0033:0x7fe9c499e159 [ 76.764999][ T5885] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 76.765016][ T5885] RSP: 002b:00007fe9c588b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 76.765035][ T5885] RAX: ffffffffffffffda RBX: 00007fe9c4c25fa0 RCX: 00007fe9c499e159 [ 76.765048][ T5885] RDX: 0000000000000000 RSI: 00000000d000943d RDI: 0000000000000003 [ 76.765059][ T5885] RBP: 00007fe9c4a3506b R08: 0000000000000000 R09: 0000000000000000 [ 76.765071][ T5885] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 76.765082][ T5885] R13: 00007fe9c4c26038 R14: 00007fe9c4c25fa0 R15: 00007fff79b424b8 [ 76.765107][ T5885] [ 76.899057][ T31] kauditd_printk_skb: 9 callbacks suppressed [ 76.899072][ T31] audit: type=1400 audit(1790329485.293:222): avc: denied { name_bind } for pid=5884 comm="syz.3.35" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 76.899108][ T31] audit: type=1400 audit(1790329485.303:223): avc: denied { node_bind } for pid=5884 comm="syz.3.35" saddr=172.20.20.170 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 76.945760][ T5885] ERROR: Out of memory at tomoyo_realpath_from_path. [ 78.134783][ T31] audit: type=1400 audit(1790329486.533:224): avc: denied { create } for pid=5897 comm="syz.3.39" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 78.172177][ T5898] netlink: 12 bytes leftover after parsing attributes in process `syz.3.39'. [ 78.331561][ T5898] netlink: 8 bytes leftover after parsing attributes in process `syz.3.39'. [ 80.215694][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 80.443736][ T5918] FAULT_INJECTION: forcing a failure. [ 80.443736][ T5918] name failslab, interval 1, probability 0, space 0, times 0 [ 80.443769][ T5918] CPU: 1 UID: 0 PID: 5918 Comm: syz.0.44 Not tainted syzkaller #0 PREEMPT(full) [ 80.443791][ T5918] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 80.443802][ T5918] Call Trace: [ 80.443808][ T5918] [ 80.443816][ T5918] dump_stack_lvl+0x100/0x190 [ 80.443848][ T5918] should_fail_ex.cold+0x5/0xa [ 80.443876][ T5918] should_failslab+0xc2/0x120 [ 80.443902][ T5918] kmem_cache_alloc_noprof+0x92/0x6a0 [ 80.443924][ T5918] ? __pfx_map_id_range_down+0x10/0x10 [ 80.443946][ T5918] ? rcu_is_watching+0x13/0xc0 [ 80.443970][ T5918] ? security_inode_alloc+0x3b/0x2c0 [ 80.443996][ T5918] security_inode_alloc+0x3b/0x2c0 [ 80.444017][ T5918] inode_init_always_gfp+0xc6f/0xfb0 [ 80.444044][ T5918] alloc_inode+0x8e/0x250 [ 80.444063][ T5918] sock_alloc+0x44/0x280 [ 80.444088][ T5918] ? security_socket_create+0x7f/0x250 [ 80.444108][ T5918] __sock_create+0xc2/0x860 [ 80.444131][ T5918] __sys_socket+0x14d/0x260 [ 80.444152][ T5918] ? __pfx___sys_socket+0x10/0x10 [ 80.444179][ T5918] __x64_sys_socket+0x72/0xb0 [ 80.444199][ T5918] ? lockdep_hardirqs_on+0x7d/0x110 [ 80.444228][ T5918] do_syscall_64+0x123/0x790 [ 80.444248][ T5918] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.444267][ T5918] RIP: 0033:0x7f3c1479e159 [ 80.444284][ T5918] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 80.444302][ T5918] RSP: 002b:00007f3c15710028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 80.444321][ T5918] RAX: ffffffffffffffda RBX: 00007f3c14a25fa0 RCX: 00007f3c1479e159 [ 80.444333][ T5918] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 000000000000000a [ 80.444344][ T5918] RBP: 00007f3c1483506b R08: 0000000000000000 R09: 0000000000000000 [ 80.444355][ T5918] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 80.444366][ T5918] R13: 00007f3c14a26038 R14: 00007f3c14a25fa0 R15: 00007fffac5fa648 [ 80.444391][ T5918] [ 80.444413][ T5918] socket: no more sockets [ 80.472730][ T5918] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 80.740366][ T5920] IPv4: Oversized IP packet from 127.202.26.0 [ 82.123748][ T31] audit: type=1400 audit(1790329490.523:225): avc: denied { accept } for pid=5930 comm="syz.3.49" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 82.232430][ T5933] gadgetfs: bound to dummy_udc driver [ 82.251488][ T31] audit: type=1400 audit(1790329490.653:226): avc: denied { name_bind } for pid=5930 comm="syz.3.49" src=3618 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 82.498880][ T5723] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 82.499383][ C1] gadgetfs: connected [ 82.500298][ T5723] gadgetfs: disconnected [ 82.645888][ C1] gadgetfs: connected [ 82.652767][ T5723] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 1.00 [ 82.653090][ T5723] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 82.653124][ T5723] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 82.717699][ C1] gadgetfs: configuration #1 [ 82.890599][ T5938] FAULT_INJECTION: forcing a failure. [ 82.890599][ T5938] name failslab, interval 1, probability 0, space 0, times 0 [ 82.890634][ T5938] CPU: 1 UID: 0 PID: 5938 Comm: syz.2.47 Not tainted syzkaller #0 PREEMPT(full) [ 82.890657][ T5938] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 82.890669][ T5938] Call Trace: [ 82.890676][ T5938] [ 82.890684][ T5938] dump_stack_lvl+0x100/0x190 [ 82.890718][ T5938] should_fail_ex.cold+0x5/0xa [ 82.890747][ T5938] should_failslab+0xc2/0x120 [ 82.890774][ T5938] __kmalloc_noprof+0xfc/0x840 [ 82.890795][ T5938] ? rcu_is_watching+0x13/0xc0 [ 82.890822][ T5938] ? tomoyo_realpath_from_path+0xb6/0x690 [ 82.890854][ T5938] tomoyo_realpath_from_path+0xb6/0x690 [ 82.890888][ T5938] tomoyo_path_number_perm+0x23c/0x580 [ 82.890910][ T5938] ? tomoyo_path_number_perm+0x22e/0x580 [ 82.890934][ T5938] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 82.890958][ T5938] ? __pfx_futex_wait+0x10/0x10 [ 82.890983][ T5938] ? __lock_acquire+0x5c0/0x1f40 [ 82.891016][ T5938] ? __fget_files+0x34/0x3d0 [ 82.891042][ T5938] ? find_held_lock+0x2b/0x80 [ 82.891068][ T5938] ? hook_file_ioctl_common+0x140/0x440 [ 82.891102][ T5938] ? __fget_files+0x21f/0x3d0 [ 82.891131][ T5938] security_file_ioctl+0xd3/0x230 [ 82.891156][ T5938] __x64_sys_ioctl+0xb7/0x210 [ 82.891179][ T5938] do_syscall_64+0x123/0x790 [ 82.891201][ T5938] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.891221][ T5938] RIP: 0033:0x7f58fdd9e159 [ 82.891241][ T5938] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 82.891259][ T5938] RSP: 002b:00007f58fecb2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 82.891279][ T5938] RAX: ffffffffffffffda RBX: 00007f58fe025fa0 RCX: 00007f58fdd9e159 [ 82.891292][ T5938] RDX: 0000000000000000 RSI: 00000000d000943d RDI: 0000000000000003 [ 82.891304][ T5938] RBP: 00007f58fde3506b R08: 0000000000000000 R09: 0000000000000000 [ 82.891316][ T5938] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 82.891328][ T5938] R13: 00007f58fe026038 R14: 00007f58fe025fa0 R15: 00007ffc23388718 [ 82.891354][ T5938] [ 82.892494][ T5938] ERROR: Out of memory at tomoyo_realpath_from_path. [ 83.173542][ T5930] gadgetfs: suspended from state 3 [ 83.183450][ T5723] usb 1-1: USB disconnect, device number 2 [ 83.194492][ T5930] gadgetfs: disconnected [ 83.336405][ T31] audit: type=1400 audit(1790329491.743:227): avc: denied { unmount } for pid=5601 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 85.231869][ T5950] netlink: 12 bytes leftover after parsing attributes in process `syz.1.55'. [ 85.306798][ T5952] netlink: 8 bytes leftover after parsing attributes in process `syz.1.55'. [ 85.563005][ T5959] FAULT_INJECTION: forcing a failure. [ 85.563005][ T5959] name failslab, interval 1, probability 0, space 0, times 0 [ 85.563036][ T5959] CPU: 1 UID: 0 PID: 5959 Comm: syz.3.57 Not tainted syzkaller #0 PREEMPT(full) [ 85.563057][ T5959] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 85.563068][ T5959] Call Trace: [ 85.563075][ T5959] [ 85.563083][ T5959] dump_stack_lvl+0x100/0x190 [ 85.563115][ T5959] should_fail_ex.cold+0x5/0xa [ 85.563141][ T5959] should_failslab+0xc2/0x120 [ 85.563167][ T5959] kmem_cache_alloc_noprof+0x92/0x6a0 [ 85.563189][ T5959] ? __pfx_map_id_range_down+0x10/0x10 [ 85.563209][ T5959] ? rcu_is_watching+0x13/0xc0 [ 85.563233][ T5959] ? security_inode_alloc+0x3b/0x2c0 [ 85.563258][ T5959] security_inode_alloc+0x3b/0x2c0 [ 85.563280][ T5959] inode_init_always_gfp+0xc6f/0xfb0 [ 85.563309][ T5959] alloc_inode+0x8e/0x250 [ 85.563328][ T5959] sock_alloc+0x44/0x280 [ 85.563353][ T5959] ? security_socket_create+0x7f/0x250 [ 85.563374][ T5959] __sock_create+0xc2/0x860 [ 85.563396][ T5959] __sys_socket+0x14d/0x260 [ 85.563417][ T5959] ? __pfx___sys_socket+0x10/0x10 [ 85.563444][ T5959] __x64_sys_socket+0x72/0xb0 [ 85.563463][ T5959] ? lockdep_hardirqs_on+0x7d/0x110 [ 85.563493][ T5959] do_syscall_64+0x123/0x790 [ 85.563513][ T5959] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.563532][ T5959] RIP: 0033:0x7fe9c499e159 [ 85.563547][ T5959] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 85.563572][ T5959] RSP: 002b:00007fe9c588b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 85.563594][ T5959] RAX: ffffffffffffffda RBX: 00007fe9c4c25fa0 RCX: 00007fe9c499e159 [ 85.563607][ T5959] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 000000000000000a [ 85.563620][ T5959] RBP: 00007fe9c4a3506b R08: 0000000000000000 R09: 0000000000000000 [ 85.563632][ T5959] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 85.563644][ T5959] R13: 00007fe9c4c26038 R14: 00007fe9c4c25fa0 R15: 00007fff79b424b8 [ 85.563668][ T5959] [ 85.563705][ T5959] socket: no more sockets [ 85.564543][ T5959] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 87.373096][ T31] audit: type=1400 audit(1790329495.773:228): avc: denied { create } for pid=5972 comm="syz.1.61" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 87.974427][ T31] audit: type=1400 audit(1790329496.373:229): avc: denied { watch } for pid=5977 comm="syz.3.64" path="/18/file5" dev="tmpfs" ino=120 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 87.974519][ T31] audit: type=1400 audit(1790329496.373:230): avc: denied { watch_sb watch_reads } for pid=5977 comm="syz.3.64" path="/18/file5" dev="tmpfs" ino=120 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 90.436739][ T31] audit: type=1400 audit(1790329498.843:231): avc: denied { create } for pid=5995 comm="syz.2.54" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 90.444370][ T31] audit: type=1400 audit(1790329498.843:232): avc: denied { mount } for pid=5995 comm="syz.2.54" name="/" dev="securityfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 90.577174][ T6002] FAULT_INJECTION: forcing a failure. [ 90.577174][ T6002] name failslab, interval 1, probability 0, space 0, times 0 [ 90.577196][ T6002] CPU: 1 UID: 0 PID: 6002 Comm: syz.1.70 Not tainted syzkaller #0 PREEMPT(full) [ 90.577209][ T6002] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 90.577215][ T6002] Call Trace: [ 90.577220][ T6002] [ 90.577224][ T6002] dump_stack_lvl+0x100/0x190 [ 90.577245][ T6002] should_fail_ex.cold+0x5/0xa [ 90.577262][ T6002] should_failslab+0xc2/0x120 [ 90.577278][ T6002] kmem_cache_alloc_noprof+0x92/0x6a0 [ 90.577292][ T6002] ? __pfx_map_id_range_down+0x10/0x10 [ 90.577305][ T6002] ? rcu_is_watching+0x13/0xc0 [ 90.577320][ T6002] ? security_inode_alloc+0x3b/0x2c0 [ 90.577334][ T6002] security_inode_alloc+0x3b/0x2c0 [ 90.577347][ T6002] inode_init_always_gfp+0xc6f/0xfb0 [ 90.577364][ T6002] alloc_inode+0x8e/0x250 [ 90.577376][ T6002] sock_alloc+0x44/0x280 [ 90.577392][ T6002] ? security_socket_create+0x7f/0x250 [ 90.577405][ T6002] __sock_create+0xc2/0x860 [ 90.577418][ T6002] __sys_socket+0x14d/0x260 [ 90.577430][ T6002] ? __pfx___sys_socket+0x10/0x10 [ 90.577445][ T6002] __x64_sys_socket+0x72/0xb0 [ 90.577457][ T6002] ? lockdep_hardirqs_on+0x7d/0x110 [ 90.577477][ T6002] do_syscall_64+0x123/0x790 [ 90.577490][ T6002] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.577503][ T6002] RIP: 0033:0x7fc85939e159 [ 90.577513][ T6002] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 90.577525][ T6002] RSP: 002b:00007fc85a30a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 90.577537][ T6002] RAX: ffffffffffffffda RBX: 00007fc859625fa0 RCX: 00007fc85939e159 [ 90.577544][ T6002] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 000000000000000a [ 90.577552][ T6002] RBP: 00007fc85943506b R08: 0000000000000000 R09: 0000000000000000 [ 90.577559][ T6002] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 90.577566][ T6002] R13: 00007fc859626038 R14: 00007fc859625fa0 R15: 00007ffe070c2928 [ 90.577580][ T6002] [ 90.577595][ T6002] socket: no more sockets [ 90.587298][ T6002] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 90.661095][ T31] audit: type=1400 audit(1790329499.063:233): avc: denied { create } for pid=5995 comm="syz.2.54" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 90.680253][ T31] audit: type=1400 audit(1790329499.083:234): avc: denied { listen } for pid=5995 comm="syz.2.54" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 90.943415][ T6008] netlink: 12 bytes leftover after parsing attributes in process `syz.1.71'. [ 91.053328][ T31] audit: type=1400 audit(1790329499.453:235): avc: denied { unmount } for pid=5602 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 91.086495][ T6008] netlink: 8 bytes leftover after parsing attributes in process `syz.1.71'. [ 91.277291][ T31] audit: type=1400 audit(1790329499.673:236): avc: denied { ioctl } for pid=6012 comm="syz.4.62" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=10487 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 92.579341][ T31] audit: type=1400 audit(1790329500.983:237): avc: denied { write } for pid=6003 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 93.499865][ T31] audit: type=1400 audit(1790329501.513:238): avc: denied { write } for pid=6032 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 93.705686][ T31] audit: type=1400 audit(1790329502.083:239): avc: denied { write } for pid=6034 comm="syz.4.76" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 95.349441][ T31] audit: type=1400 audit(1790329503.753:240): avc: denied { write } for pid=6037 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 96.261018][ T6074] netlink: 12 bytes leftover after parsing attributes in process `syz.3.84'. [ 96.364725][ T6080] netlink: 8 bytes leftover after parsing attributes in process `syz.3.84'. [ 97.177002][ T31] audit: type=1400 audit(1790329505.583:241): avc: denied { mount } for pid=6085 comm="syz.2.75" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 97.225259][ T31] audit: type=1400 audit(1790329505.623:242): avc: denied { write } for pid=6083 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 97.584070][ T31] audit: type=1400 audit(1790329505.983:243): avc: denied { unmount } for pid=5602 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 98.309274][ T6098] FAULT_INJECTION: forcing a failure. [ 98.309274][ T6098] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 98.309306][ T6098] CPU: 1 UID: 0 PID: 6098 Comm: syz.2.90 Not tainted syzkaller #0 PREEMPT(full) [ 98.309327][ T6098] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 98.309339][ T6098] Call Trace: [ 98.309346][ T6098] [ 98.309353][ T6098] dump_stack_lvl+0x100/0x190 [ 98.309385][ T6098] should_fail_ex.cold+0x5/0xa [ 98.309416][ T6098] _copy_from_user+0x2e/0xd0 [ 98.309441][ T6098] __sys_bpf+0x2f5/0x4a30 [ 98.309468][ T6098] ? __pfx___sys_bpf+0x10/0x10 [ 98.309487][ T6098] ? __pfx_futex_hash+0x10/0x10 [ 98.309511][ T6098] ? get_pid_task+0xfc/0x250 [ 98.309537][ T6098] ? get_pid_task+0xfc/0x250 [ 98.309570][ T6098] ? find_held_lock+0x2b/0x80 [ 98.309604][ T6098] ? rcu_read_lock_any_held+0x6a/0x90 [ 98.309632][ T6098] ? find_held_lock+0x2b/0x80 [ 98.309658][ T6098] ? ksys_write+0x190/0x250 [ 98.309677][ T6098] ? ksys_write+0x190/0x250 [ 98.309712][ T6098] ? __x64_sys_futex+0x34f/0x4d0 [ 98.309737][ T6098] ? __x64_sys_futex+0x358/0x4d0 [ 98.309765][ T6098] ? xfd_validate_state+0x129/0x190 [ 98.309790][ T6098] ? __x64_sys_bpf+0xce/0x140 [ 98.309809][ T6098] __x64_sys_bpf+0xce/0x140 [ 98.309829][ T6098] ? do_syscall_64+0xae/0x790 [ 98.309851][ T6098] do_syscall_64+0x123/0x790 [ 98.309877][ T6098] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.309897][ T6098] RIP: 0033:0x7f58fdd9e159 [ 98.309914][ T6098] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 98.309932][ T6098] RSP: 002b:00007f58fecb2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 98.309952][ T6098] RAX: ffffffffffffffda RBX: 00007f58fe025fa0 RCX: 00007f58fdd9e159 [ 98.309966][ T6098] RDX: 0000000000000048 RSI: 0000000000000000 RDI: 0000000000000000 [ 98.309979][ T6098] RBP: 00007f58fde3506b R08: 0000000000000000 R09: 0000000000000000 [ 98.309992][ T6098] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 98.310005][ T6098] R13: 00007f58fe026038 R14: 00007f58fe025fa0 R15: 00007ffc23388718 [ 98.310031][ T6098] [ 100.954556][ T31] audit: type=1400 audit(1790329509.213:244): avc: denied { create } for pid=6117 comm="syz.2.96" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 100.954615][ T31] audit: type=1400 audit(1790329509.243:245): avc: denied { setopt } for pid=6117 comm="syz.2.96" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 101.105996][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 101.411323][ T31] audit: type=1400 audit(1790329509.803:246): avc: denied { mmap_zero } for pid=6107 comm="syz.4.88" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 101.451398][ T31] audit: type=1400 audit(1790329509.843:247): avc: denied { map } for pid=6107 comm="syz.4.88" path="socket:[9927]" dev="sockfs" ino=9927 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 103.737309][ T31] audit: type=1400 audit(1790329512.143:248): avc: denied { mount } for pid=6148 comm="syz.2.98" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 104.767381][ T6156] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2142054965 (4284109930 ns) > initial count (2850433972 ns). Using initial count to start timer. [ 104.789327][ T6152] netlink: 12 bytes leftover after parsing attributes in process `syz.3.105'. [ 104.812437][ T31] audit: type=1400 audit(1790329513.213:249): avc: denied { unmount } for pid=5602 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 104.864320][ T6159] netlink: 8 bytes leftover after parsing attributes in process `syz.3.105'. [ 107.215684][ T6187] FAULT_INJECTION: forcing a failure. [ 107.215684][ T6187] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 107.215717][ T6187] CPU: 1 UID: 0 PID: 6187 Comm: syz.4.113 Not tainted syzkaller #0 PREEMPT(full) [ 107.215738][ T6187] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 107.215755][ T6187] Call Trace: [ 107.215762][ T6187] [ 107.215769][ T6187] dump_stack_lvl+0x100/0x190 [ 107.215803][ T6187] should_fail_ex.cold+0x5/0xa [ 107.215833][ T6187] _copy_from_user+0x2e/0xd0 [ 107.215858][ T6187] __sys_bpf+0x2f5/0x4a30 [ 107.215885][ T6187] ? __pfx___sys_bpf+0x10/0x10 [ 107.215904][ T6187] ? find_held_lock+0x2b/0x80 [ 107.215934][ T6187] ? futex_wake+0x4ea/0x5e0 [ 107.215970][ T6187] ? rcu_read_lock_any_held+0x6a/0x90 [ 107.215997][ T6187] ? find_held_lock+0x2b/0x80 [ 107.216022][ T6187] ? ksys_write+0x190/0x250 [ 107.216042][ T6187] ? ksys_write+0x190/0x250 [ 107.216077][ T6187] ? __x64_sys_futex+0x34f/0x4d0 [ 107.216102][ T6187] ? __x64_sys_futex+0x358/0x4d0 [ 107.216131][ T6187] ? xfd_validate_state+0x129/0x190 [ 107.216156][ T6187] ? __x64_sys_bpf+0xce/0x140 [ 107.216175][ T6187] __x64_sys_bpf+0xce/0x140 [ 107.216195][ T6187] ? do_syscall_64+0xae/0x790 [ 107.216215][ T6187] do_syscall_64+0x123/0x790 [ 107.216235][ T6187] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.216255][ T6187] RIP: 0033:0x7ff356d9e159 [ 107.216271][ T6187] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 107.216288][ T6187] RSP: 002b:00007ff357ceb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 107.216307][ T6187] RAX: ffffffffffffffda RBX: 00007ff357025fa0 RCX: 00007ff356d9e159 [ 107.216320][ T6187] RDX: 0000000000000048 RSI: 0000000000000000 RDI: 0000000000000000 [ 107.216331][ T6187] RBP: 00007ff356e3506b R08: 0000000000000000 R09: 0000000000000000 [ 107.216342][ T6187] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 107.216354][ T6187] R13: 00007ff357026038 R14: 00007ff357025fa0 R15: 00007ffdde891598 [ 107.216379][ T6187] [ 107.333012][ T31] audit: type=1400 audit(1790329515.733:250): avc: denied { write } for pid=6164 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 109.110586][ T31] audit: type=1400 audit(1790329517.503:251): avc: denied { write } for pid=6192 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 109.503743][ T31] audit: type=1400 audit(1790329517.903:252): avc: denied { write } for pid=6201 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 109.619619][ T31] audit: type=1400 audit(1790329518.023:253): avc: denied { write } for pid=6212 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 110.461461][ T31] audit: type=1400 audit(1790329518.863:254): avc: denied { unmount } for pid=5612 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 110.579785][ T6222] gadgetfs: bound to dummy_udc driver [ 111.170294][ T5695] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 111.170480][ C0] gadgetfs: connected [ 111.172500][ T5695] gadgetfs: disconnected [ 111.552122][ T6228] NILFS (nullb0): couldn't find nilfs on the device [ 112.875636][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 113.682618][ T6250] blktrace: Concurrent blktraces are not allowed on loop0 [ 114.315599][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 114.974349][ T6258] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 115.270456][ T31] audit: type=1400 audit(1790329523.373:255): avc: denied { read append } for pid=6256 comm="syz.3.127" name="rtc0" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 115.270503][ T31] audit: type=1400 audit(1790329523.373:256): avc: denied { open } for pid=6256 comm="syz.3.127" path="/dev/rtc0" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 115.270539][ T31] audit: type=1400 audit(1790329523.373:257): avc: denied { ioctl } for pid=6256 comm="syz.3.127" path="/dev/rtc0" dev="devtmpfs" ino=920 ioctlcmd=0x700f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 115.270577][ T31] audit: type=1400 audit(1790329523.383:258): avc: denied { read } for pid=6256 comm="syz.3.127" name="loop-control" dev="devtmpfs" ino=644 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 115.270614][ T31] audit: type=1400 audit(1790329523.383:259): avc: denied { open } for pid=6256 comm="syz.3.127" path="/dev/loop-control" dev="devtmpfs" ino=644 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 115.534377][ T6264] gadgetfs: bound to dummy_udc driver [ 115.860676][ T10] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 115.861434][ C0] gadgetfs: connected [ 115.864233][ T10] gadgetfs: disconnected [ 116.007144][ C0] gadgetfs: connected [ 116.023761][ T10] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 1.00 [ 116.036160][ T10] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 116.036943][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 116.292872][ T6260] gadgetfs: suspended from state 3 [ 116.293369][ T6260] gadgetfs: disconnected [ 116.364127][ T10] usb 1-1: can't set config #1, error -71 [ 116.387659][ T10] usb 1-1: USB disconnect, device number 4 [ 117.625804][ T31] audit: type=1400 audit(1790329525.713:260): avc: denied { read write } for pid=6274 comm="syz.1.133" name="nullb0" dev="devtmpfs" ino=694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 117.625851][ T31] audit: type=1400 audit(1790329525.723:261): avc: denied { open } for pid=6274 comm="syz.1.133" path="/dev/nullb0" dev="devtmpfs" ino=694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 117.625887][ T31] audit: type=1400 audit(1790329525.923:262): avc: denied { map } for pid=6274 comm="syz.1.133" path="/dev/loop9" dev="devtmpfs" ino=654 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 118.149989][ T6280] netlink: 12 bytes leftover after parsing attributes in process `syz.4.122'. [ 118.234424][ T6280] netlink: 8 bytes leftover after parsing attributes in process `syz.4.122'. [ 121.949618][ T6309] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 122.978518][ T31] audit: type=1400 audit(1790329531.373:263): avc: denied { create } for pid=6315 comm="syz.0.142" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 123.018957][ T31] audit: type=1400 audit(1790329531.423:264): avc: denied { ioctl } for pid=6315 comm="syz.0.142" path="socket:[11549]" dev="sockfs" ino=11549 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 123.058692][ T31] audit: type=1400 audit(1790329531.463:265): avc: denied { bind } for pid=6315 comm="syz.0.142" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 123.103470][ T31] audit: type=1400 audit(1790329531.503:266): avc: denied { getopt } for pid=6315 comm="syz.0.142" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 123.126348][ T31] audit: type=1400 audit(1790329531.503:267): avc: denied { write } for pid=6315 comm="syz.0.142" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 123.126391][ T31] audit: type=1400 audit(1790329531.533:268): avc: denied { nlmsg_write } for pid=6315 comm="syz.0.142" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 123.134006][ T31] audit: type=1400 audit(1790329531.533:269): avc: denied { read } for pid=6315 comm="syz.0.142" path="socket:[11551]" dev="sockfs" ino=11551 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 123.134883][ T31] audit: type=1400 audit(1790329531.533:270): avc: denied { setopt } for pid=6315 comm="syz.0.142" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 123.211994][ T31] audit: type=1400 audit(1790329531.533:271): avc: denied { read write } for pid=6315 comm="syz.0.142" name="raw-gadget" dev="devtmpfs" ino=814 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 123.212037][ T31] audit: type=1400 audit(1790329531.613:272): avc: denied { open } for pid=6315 comm="syz.0.142" path="/dev/raw-gadget" dev="devtmpfs" ino=814 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 124.100086][ T5695] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 124.248303][ T5695] usb 1-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 124.251023][ T5695] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 124.266307][ T5695] usb 1-1: config 0 descriptor?? [ 124.491562][ T5695] udl 1-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 124.735593][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 125.345591][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 125.734791][ T5695] [drm] Initialized udl 0.0.1 for 1-1:0.0 on minor 1 [ 125.734816][ T5695] [drm] Initialized udl on minor 1 [ 126.295678][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 126.566670][ T5695] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 126.601253][ T5695] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 126.631553][ T5695] usb 1-1: USB disconnect, device number 5 [ 127.241046][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 [ 127.241095][ T1307] ieee802154 phy1 wpan1: encryption failed: -22 [ 129.885352][ T6354] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 137.643054][ T5695] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 137.817875][ T5695] usb 4-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 137.819194][ T5695] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 137.827131][ T5695] usb 4-1: config 0 descriptor?? [ 138.036461][ T5695] udl 4-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 138.640015][ T6406] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 138.983012][ T31] kauditd_printk_skb: 2 callbacks suppressed [ 138.983028][ T31] audit: type=1400 audit(1790329547.053:275): avc: denied { ioctl } for pid=6403 comm="syz.0.166" path="/dev/loop-control" dev="devtmpfs" ino=644 ioctlcmd=0x4c80 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 139.108853][ T5695] [drm] Initialized udl 0.0.1 for 4-1:0.0 on minor 1 [ 139.108877][ T5695] [drm] Initialized udl on minor 1 [ 139.272810][ T6381] netlink: 12 bytes leftover after parsing attributes in process `syz.3.159'. [ 139.288693][ T5695] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 139.289030][ T5695] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 139.292046][ T5788] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 139.317564][ T5695] usb 4-1: USB disconnect, device number 2 [ 139.324965][ T5788] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 139.325262][ T5788] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 141.288937][ T6423] loop9: detected capacity change from 0 to 2640 [ 141.293574][ T6423] Buffer I/O error on dev loop9, logical block 0, async page read [ 141.293944][ T6423] Buffer I/O error on dev loop9, logical block 0, async page read [ 141.294095][ T6423] Buffer I/O error on dev loop9, logical block 0, async page read [ 141.294225][ T6423] Buffer I/O error on dev loop9, logical block 0, async page read [ 141.294339][ T6423] Buffer I/O error on dev loop9, logical block 0, async page read [ 141.294537][ T6423] Buffer I/O error on dev loop9, logical block 0, async page read [ 141.294768][ T6423] Buffer I/O error on dev loop9, logical block 0, async page read [ 141.294824][ T6423] Buffer I/O error on dev loop9, logical block 0, async page read [ 141.294845][ T6423] ldm_validate_partition_table(): Disk read failed. [ 141.294866][ T6423] Buffer I/O error on dev loop9, logical block 0, async page read [ 141.294994][ T6423] Buffer I/O error on dev loop9, logical block 0, async page read [ 141.295191][ T6423] Dev loop9: unable to read RDB block 0 [ 141.296014][ T6423] loop9: unable to read partition table [ 141.296913][ T6423] loop_reread_partitions: partition scan of loop9 (3Ÿ ¾‚³˜) failed (rc=-5) [ 144.529611][ T6443] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 144.955863][ T30] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 145.051036][ T31] audit: type=1400 audit(1790329553.453:276): avc: denied { create } for pid=6446 comm="syz.2.172" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 145.083220][ T31] audit: type=1400 audit(1790329553.483:277): avc: denied { read write } for pid=6446 comm="syz.2.172" name="rdma_cm" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 145.083271][ T31] audit: type=1400 audit(1790329553.483:278): avc: denied { open } for pid=6446 comm="syz.2.172" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 145.136072][ T30] usb 2-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 145.137620][ T30] usb 2-1: config 1 has an invalid interface number: 7 but max is 0 [ 145.137642][ T30] usb 2-1: config 1 has no interface number 0 [ 145.137676][ T30] usb 2-1: config 1 interface 7 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 64 [ 145.137699][ T30] usb 2-1: config 1 interface 7 altsetting 0 has a duplicate endpoint with address 0x7, skipping [ 145.137719][ T30] usb 2-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 145.139467][ T30] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 145.139488][ T30] usb 2-1: Product: syz [ 145.139502][ T30] usb 2-1: Manufacturer: syz [ 145.139517][ T30] usb 2-1: SerialNumber: syz [ 145.142493][ T6440] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 145.142615][ T6440] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 145.144687][ T30] usb 2-1: Expected 3 endpoints, found: 2 [ 145.193686][ T31] audit: type=1400 audit(1790329553.593:279): avc: denied { unmount } for pid=5602 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 146.062338][ T31] audit: type=1400 audit(1790329554.463:280): avc: denied { read write } for pid=6456 comm="syz.4.177" name="fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 146.062670][ T31] audit: type=1400 audit(1790329554.463:281): avc: denied { open } for pid=6456 comm="syz.4.177" path="/dev/fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 146.179509][ T31] audit: type=1400 audit(1790329554.583:282): avc: denied { unmount } for pid=5603 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 147.353377][ T5695] usb 2-1: USB disconnect, device number 2 [ 148.215799][ T5788] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 148.371991][ T5788] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 148.386016][ T5788] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 148.487645][ T5788] usb 5-1: config 0 descriptor?? [ 148.755320][ T5788] udl 5-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 148.999004][ T5788] [drm] Initialized udl 0.0.1 for 5-1:0.0 on minor 1 [ 148.999029][ T5788] [drm] Initialized udl on minor 1 [ 149.165208][ T6467] netlink: 12 bytes leftover after parsing attributes in process `syz.4.183'. [ 149.177047][ T5788] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 149.182611][ T5788] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 149.210408][ T5788] usb 5-1: USB disconnect, device number 2 [ 149.993372][ T6486] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 150.754630][ T6487] syz.2.190 (6487) used greatest stack depth: 17448 bytes left [ 150.842816][ T31] audit: type=1400 audit(1790329559.243:283): avc: denied { write } for pid=6489 comm="syz.0.189" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 150.843269][ T31] audit: type=1400 audit(1790329559.243:284): avc: denied { read } for pid=6489 comm="syz.0.189" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 151.051727][ T6493] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2142054965 (4284109930 ns) > initial count (2850433972 ns). Using initial count to start timer. [ 152.045634][ T31] audit: type=1400 audit(1790329560.043:285): avc: denied { validate_trans } for pid=6498 comm="syz.4.193" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 152.045670][ T31] audit: type=1400 audit(1790329560.063:286): avc: denied { append } for pid=6498 comm="syz.4.193" name="uprobe_events" dev="tracefs" ino=27 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 153.673107][ T31] audit: type=1400 audit(1790329561.623:287): avc: denied { name_bind } for pid=6508 comm="syz.0.198" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 153.673162][ T31] audit: type=1400 audit(1790329561.623:288): avc: denied { shutdown } for pid=6508 comm="syz.0.198" laddr=::1 lport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 154.009562][ T6513] NILFS (nullb0): couldn't find nilfs on the device [ 155.719448][ T6526] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 156.283824][ T6534] FAULT_INJECTION: forcing a failure. [ 156.283824][ T6534] name failslab, interval 1, probability 0, space 0, times 0 [ 156.283853][ T6534] CPU: 1 UID: 0 PID: 6534 Comm: syz.4.202 Not tainted syzkaller #0 PREEMPT(full) [ 156.283875][ T6534] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 156.283886][ T6534] Call Trace: [ 156.283893][ T6534] [ 156.283901][ T6534] dump_stack_lvl+0x100/0x190 [ 156.283934][ T6534] should_fail_ex.cold+0x5/0xa [ 156.283963][ T6534] should_failslab+0xc2/0x120 [ 156.283991][ T6534] kmem_cache_alloc_noprof+0x92/0x6a0 [ 156.284014][ T6534] ? get_close_on_exec+0x137/0x320 [ 156.284053][ T6534] ? mm_alloc+0x1b/0x60 [ 156.284077][ T6534] mm_alloc+0x1b/0x60 [ 156.284096][ T6534] alloc_bprm+0x2c0/0x9e0 [ 156.284120][ T6534] do_execveat_common.isra.0+0x19c/0x580 [ 156.284143][ T6534] ? do_getname+0x191/0x390 [ 156.284173][ T6534] __x64_sys_execveat+0xdf/0x130 [ 156.284198][ T6534] do_syscall_64+0x123/0x790 [ 156.284219][ T6534] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 156.284238][ T6534] RIP: 0033:0x7ff356d9e159 [ 156.284254][ T6534] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 156.284273][ T6534] RSP: 002b:00007ff357ceb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000142 [ 156.284292][ T6534] RAX: ffffffffffffffda RBX: 00007ff357025fa0 RCX: 00007ff356d9e159 [ 156.284305][ T6534] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000007 [ 156.284316][ T6534] RBP: 00007ff356e3506b R08: 0000000000001000 R09: 0000000000000000 [ 156.284327][ T6534] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 156.284338][ T6534] R13: 00007ff357026038 R14: 00007ff357025fa0 R15: 00007ffdde891598 [ 156.284365][ T6534] [ 156.662354][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 157.319423][ T30] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 157.466439][ T30] usb 3-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 157.467568][ T30] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 157.469834][ T30] usb 3-1: config 0 descriptor?? [ 157.675422][ T30] udl 3-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 157.918951][ T30] [drm] Initialized udl 0.0.1 for 3-1:0.0 on minor 1 [ 157.918977][ T30] [drm] Initialized udl on minor 1 [ 158.092049][ T30] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 158.092388][ T30] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 158.116853][ T30] usb 3-1: USB disconnect, device number 2 [ 158.125522][ T5723] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 158.283237][ T31] audit: type=1400 audit(1790329566.673:289): avc: denied { connect } for pid=6556 comm="syz.4.209" laddr=::1 lport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 158.283459][ T31] audit: type=1400 audit(1790329566.673:290): avc: denied { name_connect } for pid=6556 comm="syz.4.209" dest=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 158.881381][ T31] audit: type=1400 audit(1790329567.283:291): avc: denied { read } for pid=6565 comm="syz.1.213" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 158.882952][ T31] audit: type=1400 audit(1790329567.283:292): avc: denied { open } for pid=6565 comm="syz.1.213" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 159.827726][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 160.439392][ T6572] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 161.495200][ T6578] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 161.726102][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 162.841952][ T31] audit: type=1400 audit(1790329571.243:293): avc: denied { map_create } for pid=6590 comm="syz.3.222" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 163.018989][ T31] audit: type=1400 audit(1790329571.423:294): avc: denied { mount } for pid=6593 comm="syz.4.223" name="/" dev="configfs" ino=1064 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 163.023055][ T31] audit: type=1400 audit(1790329571.423:295): avc: denied { search } for pid=6593 comm="syz.4.223" name="/" dev="configfs" ino=1064 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 163.023101][ T31] audit: type=1400 audit(1790329571.423:296): avc: denied { search } for pid=6593 comm="syz.4.223" name="nvmet" dev="configfs" ino=3552 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 163.023137][ T31] audit: type=1400 audit(1790329571.423:297): avc: denied { search } for pid=6593 comm="syz.4.223" name="subsystems" dev="configfs" ino=3553 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 163.023172][ T31] audit: type=1400 audit(1790329571.423:298): avc: denied { write search } for pid=6593 comm="syz.4.223" name="subsystems" dev="configfs" ino=3553 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 163.208791][ T6594] nvmet_tcp: address family 255 not supported [ 163.636969][ T6604] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 164.229344][ T31] kauditd_printk_skb: 29 callbacks suppressed [ 164.229361][ T31] audit: type=1400 audit(1790329572.633:328): avc: denied { prog_load } for pid=6610 comm="syz.2.218" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 164.926302][ T6617] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 165.244034][ T31] audit: type=1400 audit(1790329573.353:329): avc: denied { prog_run } for pid=6615 comm="syz.0.229" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 166.413177][ T31] audit: type=1400 audit(1790329574.813:330): avc: denied { mounton } for pid=6632 comm="syz.4.235" path="/45/proc" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=dir permissive=1 [ 166.493585][ T6635] netlink: 36 bytes leftover after parsing attributes in process `syz.1.231'. [ 166.981629][ T31] audit: type=1400 audit(1790329574.893:331): avc: denied { bind } for pid=6627 comm="syz.1.231" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 166.981668][ T31] audit: type=1400 audit(1790329574.893:332): avc: denied { setopt } for pid=6627 comm="syz.1.231" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 167.465753][ T6640] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 167.740744][ T31] audit: type=1400 audit(1790329576.143:333): avc: denied { map_read map_write } for pid=6642 comm="syz.4.238" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 168.404094][ T6651] hub 8-0:1.0: USB hub found [ 168.460719][ T6652] netlink: 36 bytes leftover after parsing attributes in process `syz.4.240'. [ 168.766043][ T6651] hub 8-0:1.0: 1 port detected [ 168.836365][ T31] audit: type=1400 audit(1790329576.773:334): avc: denied { write } for pid=6645 comm="syz.3.239" name="001" dev="devtmpfs" ino=720 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 169.754571][ T6656] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 170.159268][ T31] audit: type=1400 audit(1790329578.563:335): avc: denied { mounton } for pid=6658 comm="syz.1.241" path="/52/file0" dev="tmpfs" ino=303 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 172.051182][ T6684] hub 8-0:1.0: USB hub found [ 172.052076][ T6684] hub 8-0:1.0: 1 port detected [ 173.376171][ T31] audit: type=1400 audit(1790329581.773:336): avc: denied { read write } for pid=6694 comm="syz.1.251" name="raw-gadget" dev="devtmpfs" ino=814 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 173.382735][ T31] audit: type=1400 audit(1790329581.783:337): avc: denied { open } for pid=6694 comm="syz.1.251" path="/dev/raw-gadget" dev="devtmpfs" ino=814 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 173.391415][ T31] audit: type=1400 audit(1790329581.793:338): avc: denied { ioctl } for pid=6694 comm="syz.1.251" path="/dev/raw-gadget" dev="devtmpfs" ino=814 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 173.770787][ T6708] FAULT_INJECTION: forcing a failure. [ 173.770787][ T6708] name failslab, interval 1, probability 0, space 0, times 0 [ 173.770815][ T6708] CPU: 0 UID: 0 PID: 6708 Comm: syz.0.255 Not tainted syzkaller #0 PREEMPT(full) [ 173.770836][ T6708] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 173.770846][ T6708] Call Trace: [ 173.770852][ T6708] [ 173.770859][ T6708] dump_stack_lvl+0x100/0x190 [ 173.770889][ T6708] should_fail_ex.cold+0x5/0xa [ 173.770922][ T6708] should_failslab+0xc2/0x120 [ 173.770946][ T6708] kmem_cache_alloc_noprof+0x92/0x6a0 [ 173.770967][ T6708] ? mas_preallocate+0xc22/0xee0 [ 173.770990][ T6708] mas_preallocate+0xc22/0xee0 [ 173.771012][ T6708] ? __pfx_mas_preallocate+0x10/0x10 [ 173.771028][ T6708] ? mt_find+0x136/0x9b0 [ 173.771053][ T6708] ? lock_acquire+0x1d1/0x380 [ 173.771071][ T6708] ? avc_has_perm_noaudit+0x56/0x470 [ 173.771100][ T6708] vma_link+0x14a/0x8c0 [ 173.771132][ T6708] ? __pfx_vma_link+0x10/0x10 [ 173.771163][ T6708] ? __pfx_selinux_vm_enough_memory+0x10/0x10 [ 173.771187][ T6708] ? rcu_is_watching+0x13/0xc0 [ 173.771209][ T6708] ? percpu_counter_add_batch+0xb9/0x230 [ 173.771242][ T6708] insert_vm_struct+0x1f7/0x890 [ 173.771265][ T6708] create_init_stack_vma+0x830/0xcf0 [ 173.771290][ T6708] ? __pfx_create_init_stack_vma+0x10/0x10 [ 173.771312][ T6708] ? lock_acquire+0x1d1/0x380 [ 173.771331][ T6708] ? do_raw_spin_lock+0x128/0x260 [ 173.771354][ T6708] ? alloc_bprm+0x54e/0x9e0 [ 173.771373][ T6708] ? alloc_bprm+0x54e/0x9e0 [ 173.771397][ T6708] alloc_bprm+0x57b/0x9e0 [ 173.771419][ T6708] do_execveat_common.isra.0+0x19c/0x580 [ 173.771441][ T6708] ? do_getname+0x191/0x390 [ 173.771469][ T6708] __x64_sys_execveat+0xdf/0x130 [ 173.771493][ T6708] do_syscall_64+0x123/0x790 [ 173.771513][ T6708] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 173.771532][ T6708] RIP: 0033:0x7f3c1479e159 [ 173.771547][ T6708] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 173.771564][ T6708] RSP: 002b:00007f3c15710028 EFLAGS: 00000246 ORIG_RAX: 0000000000000142 [ 173.771582][ T6708] RAX: ffffffffffffffda RBX: 00007f3c14a25fa0 RCX: 00007f3c1479e159 [ 173.771594][ T6708] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000007 [ 173.771605][ T6708] RBP: 00007f3c1483506b R08: 0000000000001000 R09: 0000000000000000 [ 173.771615][ T6708] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 173.771625][ T6708] R13: 00007f3c14a26038 R14: 00007f3c14a25fa0 R15: 00007fffac5fa648 [ 173.771651][ T6708] [ 173.967408][ T10] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 174.181806][ T10] usb 2-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 174.195289][ T10] usb 2-1: config 1 has an invalid interface number: 7 but max is 0 [ 174.195341][ T10] usb 2-1: config 1 has no interface number 0 [ 174.197578][ T10] usb 2-1: config 1 interface 7 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 64 [ 174.197632][ T10] usb 2-1: config 1 interface 7 altsetting 0 has a duplicate endpoint with address 0x7, skipping [ 174.197749][ T10] usb 2-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 174.247620][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 174.247678][ T10] usb 2-1: Product: syz [ 174.247797][ T10] usb 2-1: Manufacturer: syz [ 174.247893][ T10] usb 2-1: SerialNumber: syz [ 174.306186][ T6701] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 174.306292][ T6701] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 174.315324][ T10] usb 2-1: Expected 3 endpoints, found: 2 [ 175.837181][ T31] audit: type=1400 audit(1790329584.243:339): avc: denied { mounton } for pid=6694 comm="syz.1.251" path="/syzcgroup/unified/syz1" dev="cgroup2" ino=68 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 175.933187][ T6734] hub 8-0:1.0: USB hub found [ 175.933821][ T6734] hub 8-0:1.0: 1 port detected [ 176.454166][ T31] audit: type=1400 audit(1790329584.853:340): avc: denied { write } for pid=6742 comm="syz.3.264" name="subsystems" dev="configfs" ino=14488 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 176.454377][ T31] audit: type=1400 audit(1790329584.853:341): avc: denied { write } for pid=6742 comm="syz.3.264" name="subsystems" dev="configfs" ino=14488 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 176.454827][ T6743] nvmet_tcp: enabling port 1 (127.0.0.1:442) [ 176.993204][ T882] usb 2-1: USB disconnect, device number 3 [ 177.059986][ T6753] netlink: 36 bytes leftover after parsing attributes in process `syz.4.267'. [ 177.830907][ C1] IPv4: Oversized IP packet from 172.20.20.24 [ 178.699985][ T6761] hub 8-0:1.0: USB hub found [ 178.700781][ T6761] hub 8-0:1.0: 1 port detected [ 178.888797][ T6765] tmpfs: Bad value for 'huge' [ 179.806544][ T6775] NILFS (nullb0): couldn't find nilfs on the device [ 180.495062][ T6788] gadgetfs: bound to dummy_udc driver [ 180.885678][ T5716] usb 1-1: new full-speed USB device number 6 using dummy_hcd [ 180.887767][ C0] gadgetfs: connected [ 180.888192][ T5716] gadgetfs: disconnected [ 181.765440][ T5723] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 181.965599][ T5723] usb 2-1: Using ep0 maxpacket: 32 [ 181.966097][ T5723] usb 2-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 181.966948][ T5723] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 181.966968][ T5723] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 181.967003][ T5723] usb 2-1: too many endpoints for config 1 interface 1 altsetting 239: 255, using maximum allowed: 30 [ 181.967034][ T5723] usb 2-1: config 1 interface 1 altsetting 239 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 181.967067][ T5723] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 181.967087][ T5723] usb 2-1: config 1 interface 1 has no altsetting 0 [ 181.968787][ T5723] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 181.968808][ T5723] usb 2-1: Product: syz [ 181.968821][ T5723] usb 2-1: Manufacturer: syz [ 181.968835][ T5723] usb 2-1: SerialNumber: syz [ 183.157007][ T6817] netlink: 36 bytes leftover after parsing attributes in process `syz.0.287'. [ 183.614025][ T6796] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 183.648082][ T6796] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 183.664378][ T6796] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(12) [ 183.664399][ T6796] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 183.664992][ T6796] vhci_hcd vhci_hcd.0: Device attached [ 184.054798][ T5716] usb 36-1: SetAddress Request (2) to port 0 [ 184.055053][ T5716] usb 36-1: new SuperSpeed USB device number 2 using vhci_hcd [ 184.626673][ T6796] vhci_hcd vhci_hcd.0: port 0 already used [ 184.629145][ T6820] vhci_hcd: connection reset by peer [ 184.631010][ T12] vhci_hcd vhci_hcd.1: stop threads [ 184.631202][ T12] vhci_hcd vhci_hcd.1: release socket [ 184.631698][ T12] vhci_hcd vhci_hcd.1: disconnect device [ 185.649823][ T5604] Bluetooth: hci0: command 0x0406 tx timeout [ 185.650261][ T5604] Bluetooth: hci3: command 0x0406 tx timeout [ 185.650345][ T5604] Bluetooth: hci1: command 0x0406 tx timeout [ 185.650430][ T5604] Bluetooth: hci4: command 0x0406 tx timeout [ 185.651063][ T5604] Bluetooth: hci2: command 0x0406 tx timeout [ 185.939585][ T5723] usb 2-1: selecting invalid altsetting 0 [ 185.940683][ T5723] usb 2-1: 1:1: cannot get freq (v2/v3): err -71 [ 185.941154][ T5723] usb 2-1: 1:1: cannot set freq 44100 (v2/v3): err -71 [ 186.155632][ T5723] usb 2-1: USB disconnect, device number 4 [ 186.385970][ T6844] tmpfs: Unknown parameter 'n' [ 186.411804][ T6846] udevd[6846]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 187.270897][ T6856] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 187.324148][ T31] audit: type=1400 audit(1790329595.723:342): avc: denied { audit_write } for pid=6857 comm="syz.4.301" capability=29 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 188.698041][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 [ 188.698105][ T1307] ieee802154 phy1 wpan1: encryption failed: -22 [ 189.314960][ T6884] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 189.641360][ T5716] usb 36-1: device descriptor read/8, error -110 [ 189.916585][ T6894] gadgetfs: bound to dummy_udc driver [ 190.097631][ T5716] usb usb36-port1: attempt power cycle [ 190.215750][ T10] usb 1-1: new full-speed USB device number 7 using dummy_hcd [ 190.218027][ C0] gadgetfs: connected [ 190.219312][ T10] gadgetfs: disconnected [ 190.371404][ C0] gadgetfs: connected [ 190.396001][ T10] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 1.00 [ 190.402168][ T10] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 190.402261][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 190.611205][ C0] gadgetfs: configuration #1 [ 190.815823][ T6891] gadgetfs: suspended from state 3 [ 190.815946][ T6891] gadgetfs: disconnected [ 190.880464][ T5716] usb usb36-port1: unable to enumerate USB device [ 190.888757][ T10] usb 1-1: can't set config #1, error -71 [ 190.979732][ T10] usb 1-1: USB disconnect, device number 7 [ 191.165354][ T6903] netlink: 4 bytes leftover after parsing attributes in process `syz.4.310'. [ 191.401385][ T31] audit: type=1400 audit(1790329599.803:343): avc: denied { write } for pid=6879 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 191.460329][ T6911] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 192.853385][ T31] audit: type=1400 audit(1790329601.253:344): avc: denied { write } for pid=6916 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 193.417764][ T31] audit: type=1400 audit(1790329601.823:345): avc: denied { create } for pid=6928 comm="syz.1.316" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 193.530865][ T31] audit: type=1400 audit(1790329601.933:346): avc: denied { write } for pid=6928 comm="syz.1.316" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 193.632648][ T6929] netlink: 12 bytes leftover after parsing attributes in process `syz.1.316'. [ 193.788806][ T6936] netlink: 28 bytes leftover after parsing attributes in process `syz.1.316'. [ 193.942276][ T6937] FAULT_INJECTION: forcing a failure. [ 193.942276][ T6937] name failslab, interval 1, probability 0, space 0, times 0 [ 193.942308][ T6937] CPU: 0 UID: 0 PID: 6937 Comm: syz.2.307 Not tainted syzkaller #0 PREEMPT(full) [ 193.942329][ T6937] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 193.942339][ T6937] Call Trace: [ 193.942346][ T6937] [ 193.942354][ T6937] dump_stack_lvl+0x100/0x190 [ 193.942387][ T6937] should_fail_ex.cold+0x5/0xa [ 193.942413][ T6937] should_failslab+0xc2/0x120 [ 193.942437][ T6937] kmem_cache_alloc_noprof+0x92/0x6a0 [ 193.942464][ T6937] ? mas_preallocate+0xc22/0xee0 [ 193.942491][ T6937] mas_preallocate+0xc22/0xee0 [ 193.942515][ T6937] ? __pfx_mas_preallocate+0x10/0x10 [ 193.942533][ T6937] ? mt_find+0x136/0x9b0 [ 193.942561][ T6937] ? lock_acquire+0x1d1/0x380 [ 193.942580][ T6937] ? avc_has_perm_noaudit+0x56/0x470 [ 193.942619][ T6937] vma_link+0x14a/0x8c0 [ 193.942652][ T6937] ? __pfx_vma_link+0x10/0x10 [ 193.942687][ T6937] ? __pfx_selinux_vm_enough_memory+0x10/0x10 [ 193.942712][ T6937] ? rcu_is_watching+0x13/0xc0 [ 193.942735][ T6937] ? percpu_counter_add_batch+0xb9/0x230 [ 193.942765][ T6937] insert_vm_struct+0x1f7/0x890 [ 193.942788][ T6937] create_init_stack_vma+0x830/0xcf0 [ 193.942813][ T6937] ? __pfx_create_init_stack_vma+0x10/0x10 [ 193.942838][ T6937] ? lock_acquire+0x1d1/0x380 [ 193.942859][ T6937] ? do_raw_spin_lock+0x128/0x260 [ 193.942884][ T6937] ? alloc_bprm+0x54e/0x9e0 [ 193.942904][ T6937] ? alloc_bprm+0x54e/0x9e0 [ 193.942931][ T6937] alloc_bprm+0x57b/0x9e0 [ 193.942956][ T6937] do_execveat_common.isra.0+0x19c/0x580 [ 193.942980][ T6937] ? do_getname+0x191/0x390 [ 193.943012][ T6937] __x64_sys_execveat+0xdf/0x130 [ 193.943037][ T6937] do_syscall_64+0x123/0x790 [ 193.943058][ T6937] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 193.943079][ T6937] RIP: 0033:0x7f58fdd9e159 [ 193.943095][ T6937] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 193.943112][ T6937] RSP: 002b:00007f58fecb2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000142 [ 193.943131][ T6937] RAX: ffffffffffffffda RBX: 00007f58fe025fa0 RCX: 00007f58fdd9e159 [ 193.943144][ T6937] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000007 [ 193.943156][ T6937] RBP: 00007f58fde3506b R08: 0000000000001000 R09: 0000000000000000 [ 193.943167][ T6937] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 193.943178][ T6937] R13: 00007f58fe026038 R14: 00007f58fe025fa0 R15: 00007ffc23388718 [ 193.943205][ T6937] [ 194.420930][ T6947] FAULT_INJECTION: forcing a failure. [ 194.420930][ T6947] name failslab, interval 1, probability 0, space 0, times 0 [ 194.420965][ T6947] CPU: 0 UID: 0 PID: 6947 Comm: syz.3.318 Not tainted syzkaller #0 PREEMPT(full) [ 194.420989][ T6947] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 194.421001][ T6947] Call Trace: [ 194.421008][ T6947] [ 194.421016][ T6947] dump_stack_lvl+0x100/0x190 [ 194.421053][ T6947] should_fail_ex.cold+0x5/0xa [ 194.421082][ T6947] should_failslab+0xc2/0x120 [ 194.421110][ T6947] __kmalloc_noprof+0xfc/0x840 [ 194.421133][ T6947] ? x509_get_sig_params+0x39e/0x6c0 [ 194.421162][ T6947] x509_get_sig_params+0x39e/0x6c0 [ 194.421189][ T6947] x509_cert_parse+0x4e9/0x910 [ 194.421215][ T6947] x509_key_preparse+0x65/0x9c0 [ 194.421245][ T6947] asymmetric_key_preparse+0xce/0x1d0 [ 194.421276][ T6947] ? __pfx_asymmetric_key_preparse+0x10/0x10 [ 194.421309][ T6947] __key_create_or_update+0x463/0xe30 [ 194.421340][ T6947] ? __pfx___key_create_or_update+0x10/0x10 [ 194.421369][ T6947] ? lookup_user_key+0x3f3/0x1300 [ 194.421406][ T6947] ? __pfx_lookup_user_key_possessed+0x10/0x10 [ 194.421436][ T6947] key_create_or_update+0x42/0x60 [ 194.421465][ T6947] __do_sys_add_key+0x2e8/0x460 [ 194.421497][ T6947] ? __pfx___do_sys_add_key+0x10/0x10 [ 194.421538][ T6947] do_syscall_64+0x123/0x790 [ 194.421559][ T6947] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 194.421579][ T6947] RIP: 0033:0x7fe9c499e159 [ 194.421596][ T6947] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 194.421613][ T6947] RSP: 002b:00007fe9c588b028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 194.421634][ T6947] RAX: ffffffffffffffda RBX: 00007fe9c4c25fa0 RCX: 00007fe9c499e159 [ 194.421647][ T6947] RDX: 0000200000000200 RSI: 0000000000000000 RDI: 0000200000000000 [ 194.421658][ T6947] RBP: 00007fe9c4a3506b R08: ffffffffffffffff R09: 0000000000000000 [ 194.421676][ T6947] R10: 0000000000000559 R11: 0000000000000246 R12: 0000000000000000 [ 194.421688][ T6947] R13: 00007fe9c4c26038 R14: 00007fe9c4c25fa0 R15: 00007fff79b424b8 [ 194.421715][ T6947] [ 194.954751][ T31] audit: type=1400 audit(1790329603.353:347): avc: denied { write } for pid=6930 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 194.993646][ T31] audit: type=1400 audit(1790329603.393:348): avc: denied { allowed } for pid=6953 comm="syz.2.321" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 195.129756][ T6964] loop9: detected capacity change from 0 to 2640 [ 195.132305][ T6964] buffer_io_error: 11 callbacks suppressed [ 195.132335][ T6964] Buffer I/O error on dev loop9, logical block 0, async page read [ 195.132530][ T6964] Buffer I/O error on dev loop9, logical block 0, async page read [ 195.132643][ T6964] Buffer I/O error on dev loop9, logical block 0, async page read [ 195.132757][ T6964] Buffer I/O error on dev loop9, logical block 0, async page read [ 195.132886][ T6964] Buffer I/O error on dev loop9, logical block 0, async page read [ 195.133115][ T6964] Buffer I/O error on dev loop9, logical block 0, async page read [ 195.133322][ T6964] Buffer I/O error on dev loop9, logical block 0, async page read [ 195.133497][ T6964] Buffer I/O error on dev loop9, logical block 0, async page read [ 195.133540][ T6964] ldm_validate_partition_table(): Disk read failed. [ 195.133651][ T6964] Buffer I/O error on dev loop9, logical block 0, async page read [ 195.133763][ T6964] Buffer I/O error on dev loop9, logical block 0, async page read [ 195.134040][ T6964] Dev loop9: unable to read RDB block 0 [ 195.138798][ T6964] loop9: unable to read partition table [ 195.139896][ T6964] loop_reread_partitions: partition scan of loop9 (3Ÿ ¾‚³˜) failed (rc=-5) [ 196.278852][ T31] audit: type=1400 audit(1790329604.683:349): avc: denied { write } for pid=6962 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 196.349798][ T6968] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 196.692545][ T6976] gadgetfs: bound to dummy_udc driver [ 196.965716][ T882] usb 1-1: new full-speed USB device number 8 using dummy_hcd [ 196.966157][ C1] gadgetfs: connected [ 196.966553][ T882] gadgetfs: disconnected [ 197.116067][ C1] gadgetfs: connected [ 197.118431][ T882] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 1.00 [ 197.123640][ T882] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 197.124154][ T882] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 197.297695][ C1] gadgetfs: configuration #1 [ 197.586940][ T6972] gadgetfs: suspended from state 3 [ 197.587140][ T6972] gadgetfs: disconnected [ 197.625937][ T882] usb 1-1: can't set config #1, error -71 [ 197.707487][ T882] usb 1-1: USB disconnect, device number 8 [ 197.728341][ T6983] syzkaller0: entered promiscuous mode [ 197.728431][ T6983] syzkaller0: entered allmulticast mode [ 198.931538][ T6994] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 199.244497][ T31] audit: type=1400 audit(1790329607.313:350): avc: denied { read append } for pid=6992 comm="syz.4.331" name="rtc0" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 199.244541][ T31] audit: type=1400 audit(1790329607.313:351): avc: denied { open } for pid=6992 comm="syz.4.331" path="/dev/rtc0" dev="devtmpfs" ino=920 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 199.244577][ T31] audit: type=1400 audit(1790329607.333:352): avc: denied { ioctl } for pid=6992 comm="syz.4.331" path="/dev/rtc0" dev="devtmpfs" ino=920 ioctlcmd=0x700f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 199.385837][ T882] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 199.537340][ T882] usb 3-1: Using ep0 maxpacket: 32 [ 199.544449][ T882] usb 3-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 199.547463][ T882] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 199.547482][ T882] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 199.547514][ T882] usb 3-1: too many endpoints for config 1 interface 1 altsetting 239: 255, using maximum allowed: 30 [ 199.547542][ T882] usb 3-1: config 1 interface 1 altsetting 239 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 199.547571][ T882] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 199.547589][ T882] usb 3-1: config 1 interface 1 has no altsetting 0 [ 199.557191][ T882] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 199.557210][ T882] usb 3-1: Product: syz [ 199.557223][ T882] usb 3-1: Manufacturer: syz [ 199.557241][ T882] usb 3-1: SerialNumber: syz [ 200.909894][ T31] audit: type=1400 audit(1790329609.313:353): avc: denied { node_bind } for pid=7000 comm="syz.3.324" saddr=224.0.0.1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 200.984298][ T6991] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 200.984714][ T6991] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 201.082280][ T6991] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(12) [ 201.082298][ T6991] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 201.082346][ T6991] vhci_hcd vhci_hcd.0: Device attached [ 201.114029][ T6991] vhci_hcd vhci_hcd.0: port 0 already used [ 201.145519][ T7004] vhci_hcd: connection closed [ 201.145833][ T13] vhci_hcd vhci_hcd.2: stop threads [ 201.145852][ T13] vhci_hcd vhci_hcd.2: release socket [ 201.145867][ T13] vhci_hcd vhci_hcd.2: disconnect device [ 201.207936][ T882] usb 3-1: selecting invalid altsetting 0 [ 201.212692][ T882] usb 3-1: 1:1: cannot get freq (v2/v3): err -71 [ 201.216080][ T882] usb 3-1: 1:1: cannot set freq 44100 (v2/v3): err -71 [ 201.276266][ T7011] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 201.418188][ T7013] hub 8-0:1.0: USB hub found [ 201.418962][ T7013] hub 8-0:1.0: 1 port detected [ 201.848710][ T882] usb 3-1: USB disconnect, device number 3 [ 202.123584][ T6843] udevd[6843]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 202.941429][ T7026] FAULT_INJECTION: forcing a failure. [ 202.941429][ T7026] name failslab, interval 1, probability 0, space 0, times 0 [ 202.941461][ T7026] CPU: 0 UID: 0 PID: 7026 Comm: syz.4.332 Not tainted syzkaller #0 PREEMPT(full) [ 202.941484][ T7026] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 202.941495][ T7026] Call Trace: [ 202.941502][ T7026] [ 202.941510][ T7026] dump_stack_lvl+0x100/0x190 [ 202.941545][ T7026] should_fail_ex.cold+0x5/0xa [ 202.941574][ T7026] should_failslab+0xc2/0x120 [ 202.941602][ T7026] __kmalloc_noprof+0xfc/0x840 [ 202.941624][ T7026] ? asymmetric_key_generate_id+0x7e/0x180 [ 202.941660][ T7026] asymmetric_key_generate_id+0x7e/0x180 [ 202.941695][ T7026] x509_cert_parse+0x5c1/0x910 [ 202.941721][ T7026] x509_key_preparse+0x65/0x9c0 [ 202.941748][ T7026] asymmetric_key_preparse+0xce/0x1d0 [ 202.941777][ T7026] ? __pfx_asymmetric_key_preparse+0x10/0x10 [ 202.941808][ T7026] __key_create_or_update+0x463/0xe30 [ 202.941838][ T7026] ? __pfx___key_create_or_update+0x10/0x10 [ 202.941866][ T7026] ? lookup_user_key+0x3f3/0x1300 [ 202.941901][ T7026] ? __pfx_lookup_user_key_possessed+0x10/0x10 [ 202.941931][ T7026] key_create_or_update+0x42/0x60 [ 202.941960][ T7026] __do_sys_add_key+0x2e8/0x460 [ 202.941992][ T7026] ? __pfx___do_sys_add_key+0x10/0x10 [ 202.942038][ T7026] do_syscall_64+0x123/0x790 [ 202.942061][ T7026] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 202.942082][ T7026] RIP: 0033:0x7ff356d9e159 [ 202.942099][ T7026] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 202.942118][ T7026] RSP: 002b:00007ff357ceb028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 202.942139][ T7026] RAX: ffffffffffffffda RBX: 00007ff357025fa0 RCX: 00007ff356d9e159 [ 202.942152][ T7026] RDX: 0000200000000200 RSI: 0000000000000000 RDI: 0000200000000000 [ 202.942163][ T7026] RBP: 00007ff356e3506b R08: ffffffffffffffff R09: 0000000000000000 [ 202.942175][ T7026] R10: 0000000000000559 R11: 0000000000000246 R12: 0000000000000000 [ 202.942189][ T7026] R13: 00007ff357026038 R14: 00007ff357025fa0 R15: 00007ffdde891598 [ 202.942216][ T7026] [ 205.785498][ T7054] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 207.166322][ T5716] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 207.822633][ T5716] usb 1-1: Using ep0 maxpacket: 32 [ 207.825928][ T5716] usb 1-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 207.826775][ T5716] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 207.826793][ T5716] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 207.826827][ T5716] usb 1-1: too many endpoints for config 1 interface 1 altsetting 239: 255, using maximum allowed: 30 [ 207.826857][ T5716] usb 1-1: config 1 interface 1 altsetting 239 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 207.826889][ T5716] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 207.826909][ T5716] usb 1-1: config 1 interface 1 has no altsetting 0 [ 207.931348][ T5716] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 207.931372][ T5716] usb 1-1: Product: syz [ 207.931386][ T5716] usb 1-1: Manufacturer: syz [ 207.931399][ T5716] usb 1-1: SerialNumber: syz [ 208.539949][ T7060] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 208.563774][ T7060] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 208.734904][ T7060] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(12) [ 208.734937][ T7060] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 208.758006][ T7060] vhci_hcd vhci_hcd.0: Device attached [ 208.826614][ T7075] vhci_hcd vhci_hcd.0: port 0 already used [ 208.896369][ T7073] vhci_hcd: connection closed [ 208.910023][ T13] vhci_hcd vhci_hcd.0: stop threads [ 208.910518][ T13] vhci_hcd vhci_hcd.0: release socket [ 208.911268][ T13] vhci_hcd vhci_hcd.0: disconnect device [ 209.736282][ T7079] FAULT_INJECTION: forcing a failure. [ 209.736282][ T7079] name failslab, interval 1, probability 0, space 0, times 0 [ 209.736311][ T7079] CPU: 1 UID: 0 PID: 7079 Comm: syz.4.353 Not tainted syzkaller #0 PREEMPT(full) [ 209.736331][ T7079] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 209.736343][ T7079] Call Trace: [ 209.736349][ T7079] [ 209.736356][ T7079] dump_stack_lvl+0x100/0x190 [ 209.736388][ T7079] should_fail_ex.cold+0x5/0xa [ 209.736415][ T7079] should_failslab+0xc2/0x120 [ 209.736440][ T7079] __kmalloc_noprof+0xfc/0x840 [ 209.736459][ T7079] ? x509_get_sig_params+0x39e/0x6c0 [ 209.736486][ T7079] x509_get_sig_params+0x39e/0x6c0 [ 209.736511][ T7079] x509_cert_parse+0x4e9/0x910 [ 209.736535][ T7079] x509_key_preparse+0x65/0x9c0 [ 209.736562][ T7079] asymmetric_key_preparse+0xce/0x1d0 [ 209.736591][ T7079] ? __pfx_asymmetric_key_preparse+0x10/0x10 [ 209.736624][ T7079] __key_create_or_update+0x463/0xe30 [ 209.736652][ T7079] ? __pfx___key_create_or_update+0x10/0x10 [ 209.736677][ T7079] ? lookup_user_key+0x3f3/0x1300 [ 209.736712][ T7079] ? __pfx_lookup_user_key_possessed+0x10/0x10 [ 209.736741][ T7079] key_create_or_update+0x42/0x60 [ 209.736770][ T7079] __do_sys_add_key+0x2e8/0x460 [ 209.736799][ T7079] ? __pfx___do_sys_add_key+0x10/0x10 [ 209.736838][ T7079] do_syscall_64+0x123/0x790 [ 209.736859][ T7079] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 209.736879][ T7079] RIP: 0033:0x7ff356d9e159 [ 209.736895][ T7079] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 209.736912][ T7079] RSP: 002b:00007ff357ceb028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 209.736931][ T7079] RAX: ffffffffffffffda RBX: 00007ff357025fa0 RCX: 00007ff356d9e159 [ 209.736951][ T7079] RDX: 0000200000000200 RSI: 0000000000000000 RDI: 0000200000000000 [ 209.736962][ T7079] RBP: 00007ff356e3506b R08: ffffffffffffffff R09: 0000000000000000 [ 209.736975][ T7079] R10: 0000000000000559 R11: 0000000000000246 R12: 0000000000000000 [ 209.736987][ T7079] R13: 00007ff357026038 R14: 00007ff357025fa0 R15: 00007ffdde891598 [ 209.737015][ T7079] [ 209.737718][ T5716] usb 1-1: selecting invalid altsetting 0 [ 209.842228][ T5716] usb 1-1: 1:1: cannot get freq (v2/v3): err -71 [ 209.855621][ T5716] usb 1-1: 1:1: cannot set freq 44100 (v2/v3): err -71 [ 210.002406][ T7082] gadgetfs: bound to dummy_udc driver [ 210.087379][ T5716] usb 1-1: USB disconnect, device number 9 [ 210.207460][ T6843] udevd[6843]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 210.238799][ T7084] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 210.242441][ T7084] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 210.260940][ T7084] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 210.714677][ T7097] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 211.092891][ T7104] hub 8-0:1.0: USB hub found [ 211.093567][ T7104] hub 8-0:1.0: 1 port detected [ 212.971367][ T7114] hub 8-0:1.0: USB hub found [ 212.971504][ T7114] hub 8-0:1.0: 1 port detected [ 213.013880][ T31] audit: type=1400 audit(1790329621.413:354): avc: denied { connect } for pid=7117 comm="syz.1.354" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 213.074325][ T31] audit: type=1400 audit(1790329621.473:355): avc: denied { shutdown } for pid=7117 comm="syz.1.354" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 213.127451][ T7119] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 214.422216][ T7133] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 215.273102][ T5610] Bluetooth: hci4: command 0x0406 tx timeout [ 215.449950][ T7142] NILFS (nullb0): couldn't find nilfs on the device [ 216.279679][ T7149] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 218.221056][ T7160] gadgetfs: bound to dummy_udc driver [ 218.515983][ T10] usb 1-1: new full-speed USB device number 10 using dummy_hcd [ 218.516413][ C0] gadgetfs: connected [ 218.516950][ T10] gadgetfs: disconnected [ 218.610544][ T7154] gadgetfs: suspended from state 2 [ 218.866592][ T10] usb 1-1: device not accepting address 10, error -71 [ 220.704640][ T7181] gadgetfs: bound to dummy_udc driver [ 220.985832][ T882] usb 1-1: new full-speed USB device number 12 using dummy_hcd [ 220.986116][ C1] gadgetfs: connected [ 220.986585][ T882] gadgetfs: disconnected [ 221.137544][ C1] gadgetfs: connected [ 221.155075][ T882] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 1.00 [ 221.327402][ T882] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 221.327545][ T882] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 221.428976][ T7179] gadgetfs: suspended from state 3 [ 221.429088][ T7179] gadgetfs: disconnected [ 221.546231][ T882] usb 1-1: can't set config #1, error -71 [ 221.563967][ T882] usb 1-1: USB disconnect, device number 12 [ 222.229543][ T7187] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 222.806781][ T31] audit: type=1400 audit(1790329631.213:356): avc: denied { ioctl } for pid=7183 comm="syz.2.386" path="socket:[16913]" dev="sockfs" ino=16913 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 224.157042][ T7206] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 225.999091][ C1] IPv4: Oversized IP packet from 172.20.20.24 [ 228.953547][ T7239] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 230.551321][ T7246] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 232.249614][ T7252] gadgetfs: bound to dummy_udc driver [ 232.525770][ T10] usb 1-1: new full-speed USB device number 13 using dummy_hcd [ 232.526162][ C0] gadgetfs: connected [ 232.526574][ T10] gadgetfs: disconnected [ 232.698082][ C0] gadgetfs: connected [ 232.712283][ T10] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 1.00 [ 232.737901][ T10] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 232.738009][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 232.854645][ C0] gadgetfs: configuration #1 [ 233.000754][ T7250] gadgetfs: suspended from state 3 [ 233.000830][ T7250] gadgetfs: disconnected [ 233.046674][ T10] usb 1-1: can't set config #1, error -71 [ 233.101747][ T10] usb 1-1: USB disconnect, device number 13 [ 233.463150][ T7257] IPv4: Oversized IP packet from 127.202.26.0 [ 233.526120][ T7258] netlink: 28 bytes leftover after parsing attributes in process `syz.3.400'. [ 233.526146][ T7258] netlink: 28 bytes leftover after parsing attributes in process `syz.3.400'. [ 233.526159][ T7258] netlink: 8 bytes leftover after parsing attributes in process `syz.3.400'. [ 233.687086][ T7262] netlink: 8 bytes leftover after parsing attributes in process `syz.0.406'. [ 234.436151][ T31] audit: type=1400 audit(1790329642.843:357): avc: denied { read } for pid=7268 comm="syz.2.408" name="video8" dev="devtmpfs" ino=950 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 234.436197][ T31] audit: type=1400 audit(1790329642.843:358): avc: denied { open } for pid=7268 comm="syz.2.408" path="/dev/video8" dev="devtmpfs" ino=950 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 234.438901][ T31] audit: type=1400 audit(1790329642.843:359): avc: denied { ioctl } for pid=7268 comm="syz.2.408" path="/dev/video8" dev="devtmpfs" ino=950 ioctlcmd=0x565f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 236.798227][ T7267] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 237.116452][ T7277] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 237.745596][ T882] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 237.895677][ T882] usb 3-1: Using ep0 maxpacket: 8 [ 237.896165][ T882] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 237.897565][ T882] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 237.897592][ T882] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 1015 [ 237.901529][ T882] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 237.901543][ T882] usb 3-1: Product: syz [ 237.901551][ T882] usb 3-1: Manufacturer: syz [ 237.901560][ T882] usb 3-1: SerialNumber: syz [ 237.920700][ T7290] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 237.920789][ T7290] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 238.279232][ T31] audit: type=1400 audit(1790329646.683:360): avc: denied { create } for pid=7289 comm="syz.2.415" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 238.427639][ T5610] Bluetooth: hci2: unexpected event for opcode 0x2003 [ 238.528330][ T31] audit: type=1400 audit(1790329646.933:361): avc: denied { setopt } for pid=7289 comm="syz.2.415" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 238.695265][ T31] audit: type=1400 audit(1790329647.093:362): avc: denied { write } for pid=7289 comm="syz.2.415" name="video36" dev="devtmpfs" ino=1043 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 238.755592][ T882] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -71 [ 238.784040][ T882] usb 3-1: USB disconnect, device number 4 [ 239.439462][ T7305] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 239.981337][ T7308] netlink: 28 bytes leftover after parsing attributes in process `syz.4.420'. [ 239.982367][ T7308] netlink: 8 bytes leftover after parsing attributes in process `syz.4.420'. [ 241.055122][ T7317] gadgetfs: bound to dummy_udc driver [ 241.317352][ T10] usb 1-1: new full-speed USB device number 14 using dummy_hcd [ 241.317847][ C0] gadgetfs: connected [ 241.318459][ T10] gadgetfs: disconnected [ 241.405758][ T1751] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 241.479157][ C0] gadgetfs: connected [ 241.492524][ T10] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 1.00 [ 241.493132][ T10] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 241.493297][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 241.542546][ C0] gadgetfs: configuration #1 [ 241.880199][ T7315] gadgetfs: suspended from state 3 [ 241.880376][ T7315] gadgetfs: disconnected [ 242.284364][ T10] usb 1-1: can't set config #1, error -71 [ 242.318874][ T10] usb 1-1: USB disconnect, device number 14 [ 242.561759][ T31] audit: type=1400 audit(1790329650.963:363): avc: denied { create } for pid=7324 comm="syz.3.428" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 243.541493][ T7334] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 244.610344][ T7338] gadgetfs: bound to dummy_udc driver [ 244.977904][ T5613] usb 1-1: new full-speed USB device number 15 using dummy_hcd [ 244.979870][ C1] gadgetfs: connected [ 244.980322][ T5613] gadgetfs: disconnected [ 245.171059][ C1] gadgetfs: connected [ 245.196021][ T5613] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 1.00 [ 245.199608][ T5613] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 245.199697][ T5613] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 245.383701][ C1] gadgetfs: configuration #1 [ 245.480668][ T7336] gadgetfs: suspended from state 3 [ 245.480807][ T7336] gadgetfs: disconnected [ 245.533492][ T5613] usb 1-1: can't set config #1, error -71 [ 245.580165][ T5613] usb 1-1: USB disconnect, device number 15 [ 247.099422][ T7353] hub 8-0:1.0: USB hub found [ 247.100569][ T7353] hub 8-0:1.0: 1 port detected [ 247.982476][ T7349] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 248.033133][ T31] audit: type=1400 audit(1790329656.433:364): avc: denied { ioctl } for pid=7354 comm="syz.3.437" path="socket:[18507]" dev="sockfs" ino=18507 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 248.091353][ T7355] netlink: 28 bytes leftover after parsing attributes in process `syz.3.437'. [ 248.091378][ T7355] netlink: 28 bytes leftover after parsing attributes in process `syz.3.437'. [ 248.091391][ T7355] netlink: 8 bytes leftover after parsing attributes in process `syz.3.437'. [ 248.094618][ T31] audit: type=1400 audit(1790329656.493:365): avc: denied { listen } for pid=7356 comm="syz.0.436" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 248.095075][ T31] audit: type=1400 audit(1790329656.493:366): avc: denied { accept } for pid=7356 comm="syz.0.436" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 248.244106][ T31] audit: type=1400 audit(1790329656.643:367): avc: denied { remount } for pid=7356 comm="syz.0.436" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 249.583838][ T31] audit: type=1400 audit(1790329657.983:368): avc: denied { write } for pid=7371 comm="syz.3.443" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 249.605216][ T7372] netlink: 4 bytes leftover after parsing attributes in process `syz.3.443'. [ 249.609686][ T31] audit: type=1400 audit(1790329658.003:369): avc: denied { connect } for pid=7371 comm="syz.3.443" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 249.654280][ T31] audit: type=1400 audit(1790329658.053:370): avc: denied { read } for pid=7371 comm="syz.3.443" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 249.706093][ T31] audit: type=1400 audit(1790329658.113:371): avc: denied { write } for pid=7371 comm="syz.3.443" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 249.759483][ T31] audit: type=1400 audit(1790329658.163:372): avc: denied { mount } for pid=7371 comm="syz.3.443" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 250.119627][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 [ 250.119675][ T1307] ieee802154 phy1 wpan1: encryption failed: -22 [ 250.135163][ T31] audit: type=1400 audit(1790329658.533:373): avc: denied { create } for pid=7382 comm="syz.4.447" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 252.407502][ C1] IPv4: Oversized IP packet from 172.20.20.24 [ 255.768201][ T7422] syz.0.456 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 255.768225][ T7422] CPU: 1 UID: 0 PID: 7422 Comm: syz.0.456 Not tainted syzkaller #0 PREEMPT(full) [ 255.768238][ T7422] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 255.768244][ T7422] Call Trace: [ 255.768248][ T7422] [ 255.768253][ T7422] dump_stack_lvl+0x100/0x190 [ 255.768273][ T7422] dump_header+0xfb/0x606 [ 255.768287][ T7422] oom_kill_process.cold+0xd/0x380 [ 255.768301][ T7422] out_of_memory+0x340/0x14f0 [ 255.768321][ T7422] ? __pfx_out_of_memory+0x10/0x10 [ 255.768340][ T7422] mem_cgroup_out_of_memory+0xc6/0x130 [ 255.768353][ T7422] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 255.768365][ T7422] ? find_held_lock+0x2b/0x80 [ 255.768385][ T7422] ? do_raw_spin_unlock+0x145/0x1e0 [ 255.768400][ T7422] ? _raw_spin_unlock+0x28/0x50 [ 255.768417][ T7422] try_charge_memcg+0x783/0xf60 [ 255.768437][ T7422] ? __pfx_try_charge_memcg+0x10/0x10 [ 255.768455][ T7422] ? find_held_lock+0x2b/0x80 [ 255.768476][ T7422] ? rcu_read_unlock+0x17/0x60 [ 255.768491][ T7422] ? rcu_read_unlock+0x17/0x60 [ 255.768505][ T7422] ? find_held_lock+0x2b/0x80 [ 255.768521][ T7422] ? rcu_read_unlock+0x17/0x60 [ 255.768534][ T7422] charge_memcg+0x1ae/0x210 [ 255.768552][ T7422] __mem_cgroup_charge+0x2b/0x1c0 [ 255.768564][ T7422] shmem_alloc_and_add_folio+0x451/0xd40 [ 255.768585][ T7422] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 255.768603][ T7422] ? shmem_allowable_huge_orders+0x2bd/0x400 [ 255.768624][ T7422] shmem_get_folio_gfp+0x75b/0x1980 [ 255.768645][ T7422] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 255.768663][ T7422] ? vm_normal_page+0x1d1/0x380 [ 255.768676][ T7422] ? __pfx_vm_normal_page+0x10/0x10 [ 255.768692][ T7422] shmem_write_begin+0x1a4/0x420 [ 255.768711][ T7422] ? __pfx_shmem_write_begin+0x10/0x10 [ 255.768729][ T7422] ? balance_dirty_pages_ratelimited_flags+0x91/0x1170 [ 255.768751][ T7422] generic_perform_write+0x292/0xa40 [ 255.768765][ T7422] ? __pfx_shmem_file_write_iter+0x10/0x10 [ 255.768781][ T7422] ? __pfx_generic_perform_write+0x10/0x10 [ 255.768797][ T7422] ? file_update_time_flags+0x38c/0x520 [ 255.768823][ T7422] ? __pfx_shmem_file_write_iter+0x10/0x10 [ 255.768835][ T7422] shmem_file_write_iter+0x10e/0x140 [ 255.768848][ T7422] __kernel_write_iter+0x2ac/0x930 [ 255.768862][ T7422] ? __pfx___kernel_write_iter+0x10/0x10 [ 255.768874][ T7422] ? __up_read+0x333/0x980 [ 255.768889][ T7422] ? dump_user_range+0x65e/0xad0 [ 255.768905][ T7422] dump_user_range+0x3f9/0xad0 [ 255.768920][ T7422] ? __pfx_dump_user_range+0x10/0x10 [ 255.768938][ T7422] ? __pfx_writenote+0x10/0x10 [ 255.768950][ T7422] ? elf_core_dump+0x1f25/0x3d20 [ 255.768965][ T7422] elf_core_dump+0x2d68/0x3d20 [ 255.768986][ T7422] ? __pfx_elf_core_dump+0x10/0x10 [ 255.768999][ T7422] ? kasan_save_stack+0x3f/0x50 [ 255.769011][ T7422] ? kasan_save_stack+0x30/0x50 [ 255.769024][ T7422] ? kasan_save_track+0x14/0x30 [ 255.769036][ T7422] ? __kasan_kmalloc+0xaa/0xb0 [ 255.769048][ T7422] ? vfs_coredump+0x21f6/0x54a0 [ 255.769059][ T7422] ? get_signal+0x1f2a/0x21e0 [ 255.769070][ T7422] ? arch_do_signal_or_restart+0x91/0x7e0 [ 255.769091][ T7422] ? 0xffffffffff600000 [ 255.769118][ T7422] ? lock_acquire+0x1d1/0x380 [ 255.769129][ T7422] ? get_signal+0x1f2a/0x21e0 [ 255.769150][ T7422] ? vfs_coredump+0x281a/0x54a0 [ 255.769161][ T7422] vfs_coredump+0x281a/0x54a0 [ 255.769178][ T7422] ? __pfx_vfs_coredump+0x10/0x10 [ 255.769190][ T7422] ? __lock_acquire+0x5c0/0x1f40 [ 255.769205][ T7422] ? __lock_acquire+0x5c0/0x1f40 [ 255.769219][ T7422] ? lock_acquire+0x1d1/0x380 [ 255.769230][ T7422] ? unwind_next_frame+0xbd/0x2090 [ 255.769248][ T7422] ? lock_acquire+0x1d1/0x380 [ 255.769264][ T7422] ? bpf_ksym_find+0x128/0x1c0 [ 255.769281][ T7422] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 255.769297][ T7422] ? arch_stack_walk+0xa6/0xf0 [ 255.769316][ T7422] ? __sigqueue_free+0xbe/0x2a0 [ 255.769331][ T7422] ? stack_trace_save+0x8e/0xc0 [ 255.769341][ T7422] ? __pfx_stack_trace_save+0x10/0x10 [ 255.769352][ T7422] ? stack_depot_save_flags+0x27/0x9f0 [ 255.769367][ T7422] ? __lock_acquire+0x5c0/0x1f40 [ 255.769404][ T7422] ? proc_coredump_connector+0x2d3/0x4f0 [ 255.769416][ T7422] ? __pfx_proc_coredump_connector+0x10/0x10 [ 255.769430][ T7422] ? rcu_is_watching+0x13/0xc0 [ 255.769448][ T7422] get_signal+0x1f2a/0x21e0 [ 255.769466][ T7422] ? __pfx_get_signal+0x10/0x10 [ 255.769483][ T7422] arch_do_signal_or_restart+0x91/0x7e0 [ 255.769501][ T7422] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 255.769526][ T7422] irqentry_exit+0x402/0xa10 [ 255.769539][ T7422] asm_exc_page_fault+0x26/0x30 [ 255.769550][ T7422] RIP: 0033:0x7f3c1479e161 [ 255.769559][ T7422] Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f [ 255.769570][ T7422] RSP: 002b:fffffffffffffe70 EFLAGS: 00010217 [ 255.769579][ T7422] RAX: 0000000000000000 RBX: 00007f3c14a26090 RCX: 00007f3c1479e159 [ 255.769587][ T7422] RDX: 0000000000000000 RSI: fffffffffffffe70 RDI: 0000000000008000 [ 255.769593][ T7422] RBP: 00007f3c1483506b R08: 0000000000000000 R09: 0000000000000000 [ 255.769600][ T7422] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 255.769606][ T7422] R13: 00007f3c14a26128 R14: 00007f3c14a26090 R15: 00007fffac5fa648 [ 255.769622][ T7422] [ 255.769626][ T7422] memory: usage 307200kB, limit 307200kB, failcnt 6706 [ 255.769633][ T7422] memory+swap: usage 323100kB, limit 9007199254740988kB, failcnt 0 [ 255.769640][ T7422] kmem: usage 2244kB, limit 9007199254740988kB, failcnt 0 [ 255.769647][ T7422] Memory cgroup stats for /syz0: [ 255.769774][ T7422] cache 311939072 [ 255.769779][ T7422] rss 335872 [ 255.769783][ T7422] rss_huge 0 [ 255.769787][ T7422] shmem 311922688 [ 255.769791][ T7422] mapped_file 131080192 [ 255.769795][ T7422] dirty 0 [ 255.769798][ T7422] writeback 0 [ 255.769802][ T7422] workingset_refault_anon 0 [ 255.769811][ T7422] workingset_refault_file 151 [ 255.769815][ T7422] swap 16281600 [ 255.769819][ T7422] swapcached 16281600 [ 255.769823][ T7422] pgpgin 520747 [ 255.769827][ T7422] pgpgout 444508 [ 255.769831][ T7422] pgfault 165291 [ 255.769834][ T7422] pgmajfault 7 [ 255.769838][ T7422] inactive_anon 249909248 [ 255.769842][ T7422] active_anon 62349312 [ 255.769846][ T7422] inactive_file 0 [ 255.769851][ T7422] active_file 8192 [ 255.769855][ T7422] unevictable 0 [ 255.769858][ T7422] hierarchical_memory_limit 314572800 [ 255.769863][ T7422] hierarchical_memsw_limit 9223372036854771712 [ 255.769868][ T7422] total_cache 311939072 [ 255.769872][ T7422] total_rss 335872 [ 255.769876][ T7422] total_rss_huge 0 [ 255.769880][ T7422] total_shmem 311922688 [ 255.769884][ T7422] total_mapped_file 131080192 [ 255.769888][ T7422] total_dirty 0 [ 255.769892][ T7422] total_writeback 0 [ 255.769896][ T7422] total_workingset_refault_anon 0 [ 255.769900][ T7422] total_workingset_refault_file 151 [ 255.769905][ T7422] total_swap 16281600 [ 255.769908][ T7422] total_swapcached 16281600 [ 255.769913][ T7422] total_pgpgin 520747 [ 255.769917][ T7422] total_pgpgout 444508 [ 255.769921][ T7422] total_pgfault 165291 [ 255.769925][ T7422] total_pgmajfault 7 [ 255.769929][ T7422] total_inactive_anon 249909248 [ 255.769933][ T7422] total_active_anon 62349312 [ 255.769937][ T7422] total_inactive_file 0 [ 255.769942][ T7422] total_active_file 8192 [ 255.769946][ T7422] total_unevictable 0 [ 255.769950][ T7422] anon_cost 0 [ 255.769953][ T7422] file_cost 0 [ 255.769957][ T7422] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz.0.369,pid=7130,uid=0 [ 255.770078][ T7422] Memory cgroup out of memory: Killed process 7130 (syz.0.369) total-vm:202608kB, anon-rss:1252kB, file-rss:20548kB, shmem-rss:116528kB, UID:0 pgtables:344kB oom_score_adj:1000 [ 360.715499][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 361.425199][ C0] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P6966/1:b..l [ 361.433100][ C0] rcu: (detected by 0, t=10573 jiffies, g=23589, q=688 ncpus=2) [ 361.440811][ C0] task:syz.2.321 state:R running task stack:18840 pid:6966 tgid:6966 ppid:5602 task_flags:0x40064c flags:0x00480001 [ 361.454287][ C0] Call Trace: [ 361.457564][ C0] [ 361.460490][ C0] __schedule+0x1259/0x6920 [ 361.464995][ C0] ? unwind_next_frame+0x3be/0x2090 [ 361.470216][ C0] ? __pfx___schedule+0x10/0x10 [ 361.475062][ C0] ? arch_stack_walk+0x88/0xf0 [ 361.479828][ C0] ? rcu_is_watching+0x13/0xc0 [ 361.484595][ C0] preempt_schedule_irq+0x4e/0x90 [ 361.489621][ C0] irqentry_exit+0x205/0xa10 [ 361.494208][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 361.500182][ C0] RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x70 [ 361.506243][ C0] Code: c6 56 61 00 48 89 df 5b e9 0d 39 67 00 be 03 00 00 00 5b e9 e2 00 1f 03 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 65 48 8b 05 6c bd 80 12 48 8b 34 24 65 48 8b 15 50 bd [ 361.525844][ C0] RSP: 0018:ffffc900073df118 EFLAGS: 00000246 [ 361.531904][ C0] RAX: 1ffffffff1cca3ee RBX: 0000000000000008 RCX: 0000000000000000 [ 361.540299][ C0] RDX: dffffc0000000000 RSI: ffffffff828bd410 RDI: 0000000000000008 [ 361.548259][ C0] RBP: 0000000000041057 R08: 0000000000000005 R09: 0000000000000000 [ 361.556218][ C0] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 [ 361.564176][ C0] R13: 00000000028a028f R14: 0000000000000001 R15: 0000000003a802d3 [ 361.572146][ C0] ? lookup_page_ext+0x10/0x100 [ 361.577002][ C0] ? iput+0x35/0x40 [ 361.580806][ C0] __nr_to_section+0x13/0x100 [ 361.585478][ C0] lookup_page_ext+0x46/0x100 [ 361.590154][ C0] __update_page_owner_free_handle.isra.0+0xe6/0x4b0 [ 361.596828][ C0] ? page_ext_put+0x3e/0xd0 [ 361.601333][ C0] __reset_page_owner+0x93/0x190 [ 361.606270][ C0] free_unref_folios+0xa4a/0x1790 [ 361.611291][ C0] ? folios_put_refs+0x51d/0xaa0 [ 361.616230][ C0] ? folios_put_refs+0x51d/0xaa0 [ 361.621167][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 361.626976][ C0] folios_put_refs+0x585/0xaa0 [ 361.631747][ C0] ? __pfx_folios_put_refs+0x10/0x10 [ 361.637035][ C0] ? folio_batch_remove_exceptionals+0x115/0x1a0 [ 361.643370][ C0] shmem_undo_range+0x5e5/0x1570 [ 361.648308][ C0] ? __pfx_shmem_undo_range+0x10/0x10 [ 361.653674][ C0] ? lock_acquire+0x1d1/0x380 [ 361.658322][ C0] ? is_bpf_text_address+0x25/0x1a0 [ 361.663515][ C0] shmem_evict_inode+0x3b1/0xca0 [ 361.668430][ C0] ? __pfx_shmem_evict_inode+0x10/0x10 [ 361.673866][ C0] ? __pfx_inode_wait_for_writeback+0x10/0x10 [ 361.679912][ C0] ? lock_acquire+0x1d1/0x380 [ 361.684560][ C0] ? find_held_lock+0x2b/0x80 [ 361.689210][ C0] ? evict+0x37e/0xad0 [ 361.693246][ C0] ? evict+0x37e/0xad0 [ 361.697285][ C0] ? __pfx_shmem_evict_inode+0x10/0x10 [ 361.702719][ C0] evict+0x3c2/0xad0 [ 361.706583][ C0] ? fsnotify_grab_connector+0x4b/0x290 [ 361.712108][ C0] ? __pfx_evict+0x10/0x10 [ 361.716491][ C0] ? lock_acquire+0x1d1/0x380 [ 361.721150][ C0] ? iput.part.0+0x981/0x1050 [ 361.725799][ C0] iput.part.0+0x989/0x1050 [ 361.730276][ C0] iput+0x35/0x40 [ 361.733877][ C0] dentry_unlink_inode+0x284/0x470 [ 361.738964][ C0] dentry_kill+0x25d/0xc20 [ 361.743362][ C0] dput.part.0+0xd7/0x240 [ 361.747659][ C0] dput+0x1f/0x30 [ 361.751261][ C0] __fput+0x519/0xb50 [ 361.755226][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 361.760398][ C0] task_work_run+0x150/0x240 [ 361.764973][ C0] ? __pfx_task_work_run+0x10/0x10 [ 361.770065][ C0] do_exit+0x951/0x2ae0 [ 361.774195][ C0] ? __pfx_do_exit+0x10/0x10 [ 361.778756][ C0] ? __pfx_proc_coredump_connector+0x10/0x10 [ 361.784711][ C0] do_group_exit+0xd5/0x2a0 [ 361.789188][ C0] get_signal+0x1ec7/0x21e0 [ 361.793668][ C0] ? __pfx_get_signal+0x10/0x10 [ 361.798491][ C0] arch_do_signal_or_restart+0x91/0x7e0 [ 361.804012][ C0] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 361.810147][ C0] irqentry_exit+0x402/0xa10 [ 361.814708][ C0] asm_exc_page_fault+0x26/0x30 [ 361.819537][ C0] RIP: 0033:0x7f58fdd9e161 [ 361.823935][ C0] RSP: 002b:ffffffffffffff50 EFLAGS: 00010217 [ 361.829969][ C0] RAX: 0000000000000000 RBX: 00007f58fe026090 RCX: 00007f58fdd9e159 [ 361.837909][ C0] RDX: 0000000000000000 RSI: ffffffffffffff50 RDI: 0000000020b84011 [ 361.845849][ C0] RBP: 00007f58fde3506b R08: 0000000000000000 R09: 0000000000000000 [ 361.853788][ C0] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 361.861729][ C0] R13: 00007f58fe026128 R14: 00007f58fe026090 R15: 00007ffc23388718 [ 361.869675][ C0] [ 361.872682][ C0] rcu: rcu_preempt kthread starved for 10391 jiffies! g23589 f0x0 RCU_GP_WAIT_FQS(5) ->state=R ->cpu=1 [ 361.883675][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 361.893613][ C0] rcu: RCU grace-period kthread stack dump: [ 361.899469][ C0] task:rcu_preempt state:R running task stack:27496 pid:17 tgid:17 ppid:2 task_flags:0x208040 flags:0x00080000 [ 361.912907][ C0] Call Trace: [ 361.916158][ C0] [ 361.919065][ C0] __schedule+0x1259/0x6920 [ 361.923544][ C0] ? __lock_acquire+0x5c0/0x1f40 [ 361.928474][ C0] ? __pfx___schedule+0x10/0x10 [ 361.933324][ C0] ? find_held_lock+0x2b/0x80 [ 361.938005][ C0] ? schedule+0x225/0x2c0 [ 361.942337][ C0] schedule+0xdd/0x2c0 [ 361.946405][ C0] schedule_timeout+0x127/0x280 [ 361.951251][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 361.956619][ C0] ? __pfx_process_timeout+0x10/0x10 [ 361.961900][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 361.967723][ C0] ? prepare_to_swait_event+0xdf/0x4a0 [ 361.973179][ C0] rcu_gp_fqs_loop+0x1a9/0x8f0 [ 361.977939][ C0] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 361.983221][ C0] ? __pfx_rcu_gp_init+0x10/0x10 [ 361.988152][ C0] ? __pfx_rcu_gp_cleanup+0x10/0x10 [ 361.993341][ C0] ? rcu_is_watching+0x13/0xc0 [ 361.998101][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 362.003909][ C0] rcu_gp_kthread+0x17a/0x220 [ 362.008581][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 362.013769][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 362.019576][ C0] ? __kthread_parkme+0x18f/0x230 [ 362.024596][ C0] ? kthread+0x13a/0x450 [ 362.028836][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 362.034045][ C0] kthread+0x373/0x450 [ 362.038111][ C0] ? __pfx_kthread+0x10/0x10 [ 362.042701][ C0] ret_from_fork+0x730/0xd60 [ 362.047289][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 362.052394][ C0] ? __switch_to+0x800/0x10f0 [ 362.057072][ C0] ? __pfx_kthread+0x10/0x10 [ 362.061663][ C0] ret_from_fork_asm+0x1a/0x30 [ 362.066434][ C0] [ 362.069444][ C0] rcu: Stack dump where RCU GP kthread last ran: [ 362.075750][ C0] Sending NMI from CPU 0 to CPUs 1: [ 362.080945][ C1] NMI backtrace for cpu 1 [ 362.080956][ C1] CPU: 1 UID: 0 PID: 7422 Comm: syz.0.456 Not tainted syzkaller #0 PREEMPT(full) [ 362.080973][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 362.080981][ C1] RIP: 0010:shrink_lruvec+0x1ce/0x2670 [ 362.081002][ C1] Code: 68 fd ff ff 48 83 c0 10 48 89 c2 48 89 85 c8 fc ff ff 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 67 24 00 00 <48> 8b 85 68 fd ff ff 48 8b 58 10 48 85 db 0f 84 fb 01 00 00 e8 f9 [ 362.081015][ C1] RSP: 0018:ffffc90004906290 EFLAGS: 00000246 [ 362.081028][ C1] RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: 0000000000000000 [ 362.081037][ C1] RDX: 1ffff92000920d27 RSI: ffffffff82566b71 RDI: ffffc90004906400 [ 362.081046][ C1] RBP: ffffc900049065e0 R08: 0000000000000001 R09: ffffed1003d588a9 [ 362.081055][ C1] R10: ffffc90004906600 R11: 0000000000000001 R12: ffff88801eac3d88 [ 362.081064][ C1] R13: ffffc90004906928 R14: ffffc90004906928 R15: dffffc0000000000 [ 362.081074][ C1] FS: 00007f3c156ef6c0(0000) GS:ffff888123c52000(0000) knlGS:0000000000000000 [ 362.081089][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 362.081098][ C1] CR2: 0000200000010000 CR3: 00000000474fc000 CR4: 00000000003526f0 [ 362.081108][ C1] Call Trace: [ 362.081112][ C1] [ 362.081116][ C1] ? xa_load+0x149/0x2c0 [ 362.081134][ C1] ? xa_load+0x153/0x2c0 [ 362.081148][ C1] ? __pfx_xa_load+0x10/0x10 [ 362.081163][ C1] ? __pfx_shrink_lruvec+0x10/0x10 [ 362.081181][ C1] ? do_shrink_slab+0xb6c/0x1200 [ 362.081194][ C1] ? find_held_lock+0x2b/0x80 [ 362.081212][ C1] ? do_shrink_slab+0xcde/0x1200 [ 362.081226][ C1] ? lock_acquire+0x1d1/0x380 [ 362.081242][ C1] ? __lock_acquire+0x5c0/0x1f40 [ 362.081257][ C1] ? shrink_slab+0x677/0x12e0 [ 362.081277][ C1] ? __pfx___might_resched+0x10/0x10 [ 362.081291][ C1] ? page_counter_calculate_protection+0x344/0x730 [ 362.081308][ C1] ? shrink_node+0x7a0/0x4320 [ 362.081326][ C1] shrink_node+0x7a0/0x4320 [ 362.081350][ C1] ? __pfx_shrink_node+0x10/0x10 [ 362.081371][ C1] ? queue_work_on+0x11b/0x1e0 [ 362.081384][ C1] ? lockdep_hardirqs_on+0x7d/0x110 [ 362.081404][ C1] ? queue_work_on+0x141/0x1e0 [ 362.081419][ C1] ? do_try_to_free_pages+0x33e/0x16d0 [ 362.081438][ C1] do_try_to_free_pages+0x33e/0x16d0 [ 362.081462][ C1] ? __pfx_do_try_to_free_pages+0x10/0x10 [ 362.081484][ C1] try_to_free_mem_cgroup_pages+0x2bf/0x840 [ 362.081510][ C1] ? psi_group_change+0x457/0xa20 [ 362.081524][ C1] ? __pfx_try_to_free_mem_cgroup_pages+0x10/0x10 [ 362.081548][ C1] ? psi_memstall_enter+0x226/0x3b0 [ 362.081568][ C1] ? lockdep_hardirqs_on+0x7d/0x110 [ 362.081588][ C1] ? psi_memstall_enter+0x226/0x3b0 [ 362.081608][ C1] try_charge_memcg+0x50b/0xf60 [ 362.081631][ C1] ? __pfx_try_charge_memcg+0x10/0x10 [ 362.081650][ C1] ? find_held_lock+0x2b/0x80 [ 362.081667][ C1] ? rcu_read_unlock+0x17/0x60 [ 362.081679][ C1] ? rcu_read_unlock+0x17/0x60 [ 362.081690][ C1] ? find_held_lock+0x2b/0x80 [ 362.081708][ C1] ? rcu_read_unlock+0x17/0x60 [ 362.081722][ C1] charge_memcg+0x1ae/0x210 [ 362.081741][ C1] __mem_cgroup_charge+0x2b/0x1c0 [ 362.081755][ C1] shmem_alloc_and_add_folio+0x451/0xd40 [ 362.081776][ C1] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 362.081796][ C1] ? shmem_allowable_huge_orders+0x2bd/0x400 [ 362.081818][ C1] shmem_get_folio_gfp+0x75b/0x1980 [ 362.081840][ C1] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 362.081860][ C1] ? vm_normal_page+0x1d1/0x380 [ 362.081875][ C1] ? __pfx_vm_normal_page+0x10/0x10 [ 362.081892][ C1] shmem_write_begin+0x1a4/0x420 [ 362.081912][ C1] ? __pfx_shmem_write_begin+0x10/0x10 [ 362.081932][ C1] ? balance_dirty_pages_ratelimited_flags+0x91/0x1170 [ 362.081956][ C1] generic_perform_write+0x292/0xa40 [ 362.081973][ C1] ? __pfx_shmem_file_write_iter+0x10/0x10 [ 362.081991][ C1] ? __pfx_generic_perform_write+0x10/0x10 [ 362.082009][ C1] ? file_update_time_flags+0x38c/0x520 [ 362.082031][ C1] ? __pfx_shmem_file_write_iter+0x10/0x10 [ 362.082045][ C1] shmem_file_write_iter+0x10e/0x140 [ 362.082061][ C1] __kernel_write_iter+0x2ac/0x930 [ 362.082077][ C1] ? __pfx___kernel_write_iter+0x10/0x10 [ 362.082091][ C1] ? __up_read+0x333/0x980 [ 362.082108][ C1] ? dump_user_range+0x65e/0xad0 [ 362.082126][ C1] dump_user_range+0x3f9/0xad0 [ 362.082142][ C1] ? __pfx_dump_user_range+0x10/0x10 [ 362.082161][ C1] ? __pfx_writenote+0x10/0x10 [ 362.082176][ C1] ? elf_core_dump+0x1f25/0x3d20 [ 362.082194][ C1] elf_core_dump+0x2d68/0x3d20 [ 362.082214][ C1] ? __pfx_elf_core_dump+0x10/0x10 [ 362.082228][ C1] ? kasan_save_stack+0x3f/0x50 [ 362.082243][ C1] ? kasan_save_stack+0x30/0x50 [ 362.082258][ C1] ? kasan_save_track+0x14/0x30 [ 362.082272][ C1] ? __kasan_kmalloc+0xaa/0xb0 [ 362.082286][ C1] ? vfs_coredump+0x21f6/0x54a0 [ 362.082299][ C1] ? get_signal+0x1f2a/0x21e0 [ 362.082313][ C1] ? arch_do_signal_or_restart+0x91/0x7e0 [ 362.082334][ C1] ? 0xffffffffff600000 [ 362.082357][ C1] ? lock_acquire+0x1d1/0x380 [ 362.082370][ C1] ? get_signal+0x1f2a/0x21e0 [ 362.082388][ C1] ? vfs_coredump+0x281a/0x54a0 [ 362.082401][ C1] vfs_coredump+0x281a/0x54a0 [ 362.082418][ C1] ? __pfx_vfs_coredump+0x10/0x10 [ 362.082431][ C1] ? __lock_acquire+0x5c0/0x1f40 [ 362.082448][ C1] ? __lock_acquire+0x5c0/0x1f40 [ 362.082462][ C1] ? lock_acquire+0x1d1/0x380 [ 362.082476][ C1] ? unwind_next_frame+0xbd/0x2090 [ 362.082501][ C1] ? lock_acquire+0x1d1/0x380 [ 362.082517][ C1] ? bpf_ksym_find+0x128/0x1c0 [ 362.082537][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 362.082554][ C1] ? arch_stack_walk+0xa6/0xf0 [ 362.082574][ C1] ? __sigqueue_free+0xbe/0x2a0 [ 362.082592][ C1] ? stack_trace_save+0x8e/0xc0 [ 362.082604][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 362.082617][ C1] ? stack_depot_save_flags+0x27/0x9f0 [ 362.082636][ C1] ? __lock_acquire+0x5c0/0x1f40 [ 362.082667][ C1] ? proc_coredump_connector+0x2d3/0x4f0 [ 362.082681][ C1] ? __pfx_proc_coredump_connector+0x10/0x10 [ 362.082697][ C1] ? rcu_is_watching+0x13/0xc0 [ 362.082716][ C1] get_signal+0x1f2a/0x21e0 [ 362.082734][ C1] ? __pfx_get_signal+0x10/0x10 [ 362.082752][ C1] arch_do_signal_or_restart+0x91/0x7e0 [ 362.082771][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 362.082797][ C1] irqentry_exit+0x402/0xa10 [ 362.082810][ C1] asm_exc_page_fault+0x26/0x30 [ 362.082823][ C1] RIP: 0033:0x7f3c1479e161 [ 362.082835][ C1] Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f [ 362.082847][ C1] RSP: 002b:fffffffffffffe70 EFLAGS: 00010217 [ 362.082858][ C1] RAX: 0000000000000000 RBX: 00007f3c14a26090 RCX: 00007f3c1479e159 [ 362.082866][ C1] RDX: 0000000000000000 RSI: fffffffffffffe70 RDI: 0000000000008000 [ 362.082875][ C1] RBP: 00007f3c1483506b R08: 0000000000000000 R09: 0000000000000000 [ 362.082883][ C1] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 362.082892][ C1] R13: 00007f3c14a26128 R14: 00007f3c14a26090 R15: 00007fffac5fa648 [ 362.082906][ C1] [ 364.640335][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 [ 364.640382][ T1307] ieee802154 phy1 wpan1: encryption failed: -22 [ 364.801687][ T7422] syz.0.456 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 364.801710][ T7422] CPU: 1 UID: 0 PID: 7422 Comm: syz.0.456 Not tainted syzkaller #0 PREEMPT(full) [ 364.801723][ T7422] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 364.801729][ T7422] Call Trace: [ 364.801734][ T7422] [ 364.801739][ T7422] dump_stack_lvl+0x100/0x190 [ 364.801758][ T7422] dump_header+0xfb/0x606 [ 364.801772][ T7422] oom_kill_process.cold+0xd/0x380 [ 364.801786][ T7422] out_of_memory+0x340/0x14f0 [ 364.801805][ T7422] ? __pfx_out_of_memory+0x10/0x10 [ 364.801824][ T7422] mem_cgroup_out_of_memory+0xc6/0x130 [ 364.801838][ T7422] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 364.801850][ T7422] ? find_held_lock+0x2b/0x80 [ 364.801869][ T7422] ? do_raw_spin_unlock+0x145/0x1e0 [ 364.801888][ T7422] ? _raw_spin_unlock+0x28/0x50 [ 364.801905][ T7422] try_charge_memcg+0x783/0xf60 [ 364.801926][ T7422] ? __pfx_try_charge_memcg+0x10/0x10 [ 364.801942][ T7422] ? find_held_lock+0x2b/0x80 [ 364.801957][ T7422] ? rcu_read_unlock+0x17/0x60 [ 364.801967][ T7422] ? rcu_read_unlock+0x17/0x60 [ 364.801977][ T7422] ? find_held_lock+0x2b/0x80 [ 364.801993][ T7422] ? rcu_read_unlock+0x17/0x60 [ 364.802006][ T7422] charge_memcg+0x1ae/0x210 [ 364.802023][ T7422] __mem_cgroup_charge+0x2b/0x1c0 [ 364.802036][ T7422] shmem_alloc_and_add_folio+0x451/0xd40 [ 364.802057][ T7422] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 364.802075][ T7422] ? shmem_allowable_huge_orders+0x2bd/0x400 [ 364.802096][ T7422] shmem_get_folio_gfp+0x75b/0x1980 [ 364.802117][ T7422] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 364.802135][ T7422] ? vm_normal_page+0x1d1/0x380 [ 364.802147][ T7422] ? __pfx_vm_normal_page+0x10/0x10 [ 364.802163][ T7422] shmem_write_begin+0x1a4/0x420 [ 364.802182][ T7422] ? __pfx_shmem_write_begin+0x10/0x10 [ 364.802200][ T7422] ? balance_dirty_pages_ratelimited_flags+0x91/0x1170 [ 364.802221][ T7422] generic_perform_write+0x292/0xa40 [ 364.802236][ T7422] ? __pfx_shmem_file_write_iter+0x10/0x10 [ 364.802252][ T7422] ? __pfx_generic_perform_write+0x10/0x10 [ 364.802268][ T7422] ? file_update_time_flags+0x38c/0x520 [ 364.802287][ T7422] ? __pfx_shmem_file_write_iter+0x10/0x10 [ 364.802299][ T7422] shmem_file_write_iter+0x10e/0x140 [ 364.802312][ T7422] __kernel_write_iter+0x2ac/0x930 [ 364.802326][ T7422] ? __pfx___kernel_write_iter+0x10/0x10 [ 364.802338][ T7422] ? __up_read+0x333/0x980 [ 364.802353][ T7422] ? dump_user_range+0x65e/0xad0 [ 364.802368][ T7422] dump_user_range+0x3f9/0xad0 [ 364.802383][ T7422] ? __pfx_dump_user_range+0x10/0x10 [ 364.802401][ T7422] ? __pfx_writenote+0x10/0x10 [ 364.802413][ T7422] ? elf_core_dump+0x1f25/0x3d20 [ 364.802428][ T7422] elf_core_dump+0x2d68/0x3d20 [ 364.802450][ T7422] ? __pfx_elf_core_dump+0x10/0x10 [ 364.802462][ T7422] ? kasan_save_stack+0x3f/0x50 [ 364.802474][ T7422] ? kasan_save_stack+0x30/0x50 [ 364.802486][ T7422] ? kasan_save_track+0x14/0x30 [ 364.802498][ T7422] ? __kasan_kmalloc+0xaa/0xb0 [ 364.802510][ T7422] ? vfs_coredump+0x21f6/0x54a0 [ 364.802521][ T7422] ? get_signal+0x1f2a/0x21e0 [ 364.802532][ T7422] ? arch_do_signal_or_restart+0x91/0x7e0 [ 364.802553][ T7422] ? 0xffffffffff600000 [ 364.802580][ T7422] ? lock_acquire+0x1d1/0x380 [ 364.802591][ T7422] ? get_signal+0x1f2a/0x21e0 [ 364.802608][ T7422] ? vfs_coredump+0x281a/0x54a0 [ 364.802619][ T7422] vfs_coredump+0x281a/0x54a0 [ 364.802636][ T7422] ? __pfx_vfs_coredump+0x10/0x10 [ 364.802648][ T7422] ? __lock_acquire+0x5c0/0x1f40 [ 364.802664][ T7422] ? __lock_acquire+0x5c0/0x1f40 [ 364.802677][ T7422] ? lock_acquire+0x1d1/0x380 [ 364.802688][ T7422] ? unwind_next_frame+0xbd/0x2090 [ 364.802707][ T7422] ? lock_acquire+0x1d1/0x380 [ 364.802723][ T7422] ? bpf_ksym_find+0x128/0x1c0 [ 364.802740][ T7422] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 364.802756][ T7422] ? arch_stack_walk+0xa6/0xf0 [ 364.802775][ T7422] ? __sigqueue_free+0xbe/0x2a0 [ 364.802790][ T7422] ? stack_trace_save+0x8e/0xc0 [ 364.802800][ T7422] ? __pfx_stack_trace_save+0x10/0x10 [ 364.802811][ T7422] ? stack_depot_save_flags+0x27/0x9f0 [ 364.802827][ T7422] ? __lock_acquire+0x5c0/0x1f40 [ 364.802864][ T7422] ? proc_coredump_connector+0x2d3/0x4f0 [ 364.802876][ T7422] ? __pfx_proc_coredump_connector+0x10/0x10 [ 364.802894][ T7422] ? rcu_is_watching+0x13/0xc0 [ 364.802912][ T7422] get_signal+0x1f2a/0x21e0 [ 364.802930][ T7422] ? __pfx_get_signal+0x10/0x10 [ 364.802946][ T7422] arch_do_signal_or_restart+0x91/0x7e0 [ 364.802964][ T7422] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 364.802990][ T7422] irqentry_exit+0x402/0xa10 [ 364.803002][ T7422] asm_exc_page_fault+0x26/0x30 [ 364.803013][ T7422] RIP: 0033:0x7f3c1479e161 [ 364.803023][ T7422] Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f [ 364.803033][ T7422] RSP: 002b:fffffffffffffe70 EFLAGS: 00010217 [ 364.803044][ T7422] RAX: 0000000000000000 RBX: 00007f3c14a26090 RCX: 00007f3c1479e159 [ 364.803050][ T7422] RDX: 0000000000000000 RSI: fffffffffffffe70 RDI: 0000000000008000 [ 364.803057][ T7422] RBP: 00007f3c1483506b R08: 0000000000000000 R09: 0000000000000000 [ 364.803064][ T7422] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 364.803070][ T7422] R13: 00007f3c14a26128 R14: 00007f3c14a26090 R15: 00007fffac5fa648 [ 364.803085][ T7422] [ 364.803090][ T7422] memory: usage 307200kB, limit 307200kB, failcnt 280332 [ 364.803097][ T7422] memory+swap: usage 323192kB, limit 9007199254740988kB, failcnt 0 [ 364.803104][ T7422] kmem: usage 2248kB, limit 9007199254740988kB, failcnt 0 [ 364.803110][ T7422] Memory cgroup stats for /syz0: [ 364.803172][ T7422] cache 311934976 [ 364.803177][ T7422] rss 335872 [ 364.803181][ T7422] rss_huge 0 [ 364.803185][ T7422] shmem 311918592 [ 364.803188][ T7422] mapped_file 129183744 [ 364.803193][ T7422] dirty 0 [ 364.803196][ T7422] writeback 0 [ 364.803200][ T7422] workingset_refault_anon 0 [ 364.803204][ T7422] workingset_refault_file 157 [ 364.803208][ T7422] swap 16375808 [ 364.803212][ T7422] swapcached 16543744 [ 364.803216][ T7422] pgpgin 520816 [ 364.803220][ T7422] pgpgout 444578 [ 364.803224][ T7422] pgfault 165297 [ 364.803227][ T7422] pgmajfault 10 [ 364.803231][ T7422] inactive_anon 153923584 [ 364.803235][ T7422] active_anon 158330880 [ 364.803239][ T7422] inactive_file 4096 [ 364.803243][ T7422] active_file 8192 [ 364.803247][ T7422] unevictable 0 [ 364.803251][ T7422] hierarchical_memory_limit 314572800 [ 364.803256][ T7422] hierarchical_memsw_limit 9223372036854771712 [ 364.803260][ T7422] total_cache 311934976 [ 364.803264][ T7422] total_rss 335872 [ 364.803268][ T7422] total_rss_huge 0 [ 364.803272][ T7422] total_shmem 311918592 [ 364.803276][ T7422] total_mapped_file 129183744 [ 364.803280][ T7422] total_dirty 0 [ 364.803285][ T7422] total_writeback 0 [ 364.803289][ T7422] total_workingset_refault_anon 0 [ 364.803293][ T7422] total_workingset_refault_file 157 [ 364.803298][ T7422] total_swap 16375808 [ 364.803302][ T7422] total_swapcached 16543744 [ 364.803306][ T7422] total_pgpgin 520816 [ 364.803310][ T7422] total_pgpgout 444578 [ 364.803314][ T7422] total_pgfault 165297 [ 364.803318][ T7422] total_pgmajfault 10 [ 364.803322][ T7422] total_inactive_anon 153923584 [ 364.803326][ T7422] total_active_anon 158330880 [ 364.803330][ T7422] total_inactive_file 4096 [ 364.803335][ T7422] total_active_file 8192 [ 364.803339][ T7422] total_unevictable 0 [ 364.803343][ T7422] anon_cost 0 [ 364.803346][ T7422] file_cost 0 [ 364.803350][ T7422] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz0,task_memcg=/syz0,task=syz.0.456,pid=7422,uid=0 [ 364.803442][ T7422] Memory cgroup out of memory: Killed process 7422 (syz.0.456) total-vm:104432kB, anon-rss:1440kB, file-rss:54852kB, shmem-rss:11480kB, UID:0 pgtables:236kB oom_score_adj:1000 [ 364.941336][ T33] oom_reaper: reaped process 7130 (syz.0.369), now anon-rss:0kB, file-rss:20480kB, shmem-rss:114672kB [ 365.206473][ T31] kauditd_printk_skb: 2 callbacks suppressed [ 365.206487][ T31] audit: type=1400 audit(1790329773.603:376): avc: denied { unmount } for pid=5601 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 SYZFAIL: failed to send rpc fd=3 want=29704 sent=0 n=-1 (errno 32: Broken pipe) [ 367.920421][ T1117] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.260573][ T1117] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.315347][ T1117] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.379825][ T1117] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.560700][ T1117] bridge_slave_1: left allmulticast mode [ 368.560733][ T1117] bridge_slave_1: left promiscuous mode [ 368.561616][ T1117] bridge0: port 2(bridge_slave_1) entered disabled state [ 368.568452][ T1117] bridge_slave_0: left allmulticast mode [ 368.568469][ T1117] bridge_slave_0: left promiscuous mode [ 368.568642][ T1117] bridge0: port 1(bridge_slave_0) entered disabled state [ 368.834384][ T1117] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 368.846200][ T1117] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 368.849446][ T1117] bond0 (unregistering): Released all slaves [ 368.934640][ T31] audit: type=1400 audit(1790329777.333:377): avc: denied { write } for pid=7435 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 369.082025][ T31] audit: type=1400 audit(1790329777.483:378): avc: denied { write } for pid=7446 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 369.210805][ T5267] 8021q: adding VLAN 0 to HW filter on device eth1 [ 369.264563][ T1117] hsr_slave_0: left promiscuous mode [ 369.271390][ T1117] hsr_slave_1: left promiscuous mode [ 369.272260][ T1117] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 369.272285][ T1117] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 369.275207][ T1117] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 369.275223][ T1117] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 369.312226][ T1117] veth1_macvtap: left promiscuous mode [ 369.312276][ T1117] veth0_macvtap: left promiscuous mode [ 369.312370][ T1117] veth1_vlan: left promiscuous mode [ 369.312438][ T1117] veth0_vlan: left promiscuous mode [ 369.698270][ T31] audit: type=1400 audit(1790329778.103:379): avc: denied { write } for pid=7449 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 369.733719][ T1117] team0 (unregistering): Port device team_slave_1 removed [ 369.767350][ T1117] team0 (unregistering): Port device team_slave_0 removed [ 369.817833][ T31] audit: type=1400 audit(1790329778.223:380): avc: denied { write } for pid=7460 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 369.980172][ T5267] 8021q: adding VLAN 0 to HW filter on device eth2 [ 370.183253][ T31] audit: type=1400 audit(1790329778.583:381): avc: denied { write } for pid=7463 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 370.260819][ T1117] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 370.280301][ T31] audit: type=1400 audit(1790329778.683:382): avc: denied { write } for pid=7474 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 370.333088][ T1117] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 370.340168][ T5267] 8021q: adding VLAN 0 to HW filter on device eth3 [ 370.374387][ T1117] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 370.422721][ T1117] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 370.568988][ T1117] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 370.611549][ T31] audit: type=1400 audit(1790329779.013:383): avc: denied { write } for pid=7477 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 370.666592][ T1117] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 370.683270][ T31] audit: type=1400 audit(1790329779.083:384): avc: denied { write } for pid=7489 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 370.736495][ T1117] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 370.740373][ T5267] 8021q: adding VLAN 0 to HW filter on device eth4 [ 370.806755][ T1117] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 370.962002][ T1117] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 371.010120][ T1117] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 371.028049][ T31] audit: type=1400 audit(1790329779.433:385): avc: denied { write } for pid=7493 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 371.089292][ T1117] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 371.090234][ T31] audit: type=1400 audit(1790329779.493:386): avc: denied { write } for pid=7504 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 371.153449][ T1117] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 371.175152][ T5267] 8021q: adding VLAN 0 to HW filter on device eth5 [ 371.305023][ T1117] bridge_slave_1: left allmulticast mode [ 371.305046][ T1117] bridge_slave_1: left promiscuous mode [ 371.305201][ T1117] bridge0: port 2(bridge_slave_1) entered disabled state [ 371.330888][ T1117] bridge_slave_0: left allmulticast mode [ 371.330911][ T1117] bridge_slave_0: left promiscuous mode [ 371.331059][ T1117] bridge0: port 1(bridge_slave_0) entered disabled state [ 371.364689][ T1117] bridge_slave_1: left allmulticast mode [ 371.364712][ T1117] bridge_slave_1: left promiscuous mode [ 371.364864][ T1117] bridge0: port 2(bridge_slave_1) entered disabled state [ 371.392407][ T1117] bridge_slave_0: left allmulticast mode [ 371.392428][ T1117] bridge_slave_0: left promiscuous mode [ 371.392563][ T1117] bridge0: port 1(bridge_slave_0) entered disabled state