last executing test programs: 1m16.445300211s ago: executing program 4 (id=289): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x109002, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r1) sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000a80)={0x58, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x4}, @TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "00172233f60ad0b992422bc1ccddeeff13596dbe"}}]}]}, 0x58}}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x68c01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000001480)={'syzkaller0\x00', 0x7101}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2c8800, 0x0) close(r5) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) ioctl$SIOCSIFHWADDR(r5, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) read$dsp(r0, &(0x7f00000000c0)=""/108, 0x6c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000ebff000000000000edff007912300000000000950000000000bf50", @ANYRES16], &(0x7f0000000280)='syzkaller\x00', 0xffffffff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r6 = socket(0x2, 0x80805, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r6, 0x84, 0x19, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r7) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000007c0)=ANY=[@ANYRES32=r10, @ANYRES32=r9, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r10}, &(0x7f0000000000), &(0x7f00000002c0)=r7}, 0x20) sendmsg$inet(r8, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x22fe0}], 0x1}, 0x0) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) 1m13.74013264s ago: executing program 4 (id=297): syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x300, 0x0, 0x1}, 0x0) 1m13.391538149s ago: executing program 4 (id=299): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./sys_sec\x00', 0x174) r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000200)=[{&(0x7f00000000c0)="480000001400190d09004beafc0d8c560a84696080060000000000000000bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5100000000", 0x43}], 0x1) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpid() syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) mkdirat(0xffffffffffffffff, &(0x7f0000000000)='./myproc\x00', 0x1dd) mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x0) write(r4, &(0x7f0000000280)='select 0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000280)='./file1\x00', 0x0, 0x200c01, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000001}, 0x4000080) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x20, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x11d15}}, 0x20}, 0x1, 0x0, 0x0, 0x28001}, 0x8000) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={0x0}}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x7e832, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f000000aa00)=ANY=[@ANYBLOB="d850000044000701fefffffffcdbdf25037c000004004580c0500180bc506480b850cd80b450d680b05018800400f28004008d809f506a80cb84262700fc44f829e9ac5d2b0168d2ed51fbf02783ae7705c94d9468d49caa3fe7907450398014006d800500a4000000000008004d00ac14140c5950028037000180d01032234b706888b980d85f5def3c191ca34a6233501153013bfba3d086610cf508856addde7e5c76f43c436ca7ad24952a0b0085125080106436907b2a903f7e0157da1114736ba94b5dbf4f9c4f80f729a22252376abc3c07a20ec89bb97eb05c339e1274645639afd083cb636ee66d5c151197e89a6e61c57a8c6166ab600ed3768498f99189e39e1b69fc318fdf49ec5bb01f58252c64b18d56a5d340c13a8bc9079abfef0061800400d98004006b00ea11c6ebcf7daba729395ae46378a6c5ea317653ba1c9c415186a816e5b96d1bb170d08a0c3662a881ae356dd004bdcec0f7523da7ba2cca516faf18cc0f269d75b20e5b9a1ba0fe28c74d055c36a00d4055fe19f4d587c63364210d3ba1c9065fb993f13e48a2b2ae7f807b33ef09377821210240935f332253a7abc5a81e51fdf5a47c34d6b6735a1cfc8a2c08d27a668b14211d555addb43097e24d6122e4fd6eb36336a962c07465bbf558eda52d3381f3a8731316953ac9ec5a1621ddb5f93beacfaeb9a06ed666cd011e61d39471491d66ccdbacf99d42fcd8313f8e7625cc2700cf10c58006000d005b000000c41b098a50dda9bb69dd1b8fbc7e1d6a6d00426bb56a116f397aee87932d5a5dcaf58f5d35653926a46cfd0c7cae541dc5e9a0e092c7fe0373937164401ea504e79bea646aef3e0f16f82ba596e064bf2b2cc8528df217def0e6b8974ff2d7952dca23f00149d9b4189a26e057806a67f166922f06db4ce6e19cdaf26b1fa56a7b52b69794ca5624b7dee8f48eba85ae25559334a6af7439a0d58e3b238cb98d501cc026e13fc0269f68b83e006359e5a79f7916096d99fbe600a35a8b55205f631a0a2fe3f13938fdbe4cb259df8a7a69d00594b28249d1764d7b202230c0ca148f6efdfe3108fe38dfd34e5711df4bd741729e138c73faba648361fb53a772d70f8662818764f66302f3314ba96f7c175ec76242b5fb66ff2dd7e81a9bfddf8c58101b30c85fa65239218400300bb7cae9fe6dd4e5827af6c51f506a657aba798068b80283b55149491b49ea8db6c27ea283f0284410098268320e90a7a6508fa9d86f7cc74dfc42688d7e8281692b4f4a66654188f1ef99d1074291c751f57327c93bb1b411bab7e65aa8b26272e211367e80e903796ef0c705856941c9e14940f5925c6dfd7995d6769b7c788ad28125a487594560cd614132be9eb9f74b23f0412cc589ee152ed50adad3ad7722a0f67a3e523798e5fda6dd9eaf4e8407af3f8679efce7ed3fd7f1ff687ad45e2e769ea4cb12ec8eb4c9902b84cc5c4428181a4321379486852a809b0947c464fe5eb261c9d4b74bf0c85e0a92b87933e2bd0ff3538a882fc8460016c5964b963ac67040ab872c438d792c797a9cd57f0f6caea157c7866362dd4f41088f5d02e2bca6a07838a85f1cbef335e0e069641135b4c3e5a055f9fc501859c7c90ea1105faba48a9f6b5d58f6fc3ea487811c760b5848d0aae86fd6c482625087b6831873b26cdae442675fad68b5e904e4ba013fc9ae86f271290671b6c9b65ce00f40e11938384744bed5f4e6ec68e530eb89da516a6d032f979688821893f0920e8b2b51f47081270d0b209c875fa7817f375568e0e08a85b50c3e69a6c5935fda95c43732c2963071ea98cba4382403b95ffa88fcb8b7155685304d8021ba5ab6ce1fb98aea0ac742e69f6039506b4dbaa6af01a0a0dd683717d59373a88b602fc0f3165b1b7817af9490081239d1a2ecdf21b65023bc071fc18aae01ea888182f326969fda2f073219bb135ef632f67a83eb12deb8ee880e8f4bf217e077d83ae9fdbbd8ef4556c5ecd9de9a0387970766a1515ea10099d080eb0f3c31b542fdbb05e2359728c287cc38c98908a8335e2b2f0f32950639670be162075ec4711ca4396ecc32d803195f8992afd430c1e8f9de7810f4bd2708d55eccdf048f87e5e02040a572ec122934a6fcab35091fe94107bf1d1fc19cc28b60cb27ad86c5a2929f4d6781182164c18c86b04ae221746e952d5cf9a26dc9df51f2837bb0d13bdbba32fe810ec3fb6a985c277bc13f1ce5d23285e388ec1a30473d1d6437ed77ca1e42e6c41a6bb81185bf7e7880cbeb13c95ab547f3655787869f608d1e2fc1536dd67163104acbd961a632ce46dcb9ab1d79c7d77ea58c6caa462ca6caa7f4d9365cdcb3703a78d6ed4684c069bbcaf7f9e10f6377652f0bfce0a4204f1dc1dde6e1fcd5dd441749bd6479d90734426a59a749fd1d9c35651b79c21865bb261ad1cf776b4d6556160f1742e7c838824258fd547c98c1ff6967e36a68e2d1e238a582f2a0600a8fffd19d7166959bfdf1387911406b4bf8fdb7095d32eb9c286cf36499f15238ec7fe416b42c9240d6d25c4dd46a024127d688464d1d2ae1726587dd65a43e5133bec63e5b78bcac5b062d149ff1b0a65a73fcb0e0281ddfba3847d6b3170a85e74accce9cc4e5b724dd22ff236"], 0x50d8}}, 0xc000) r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xe8001, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2}) ioctl$TUNSETTXFILTER(r7, 0x400454d1, &(0x7f0000000000)=ANY=[@ANYBLOB="0100e1f9"]) syz_open_dev$dmmidi(&(0x7f0000000300), 0x2, 0x189083) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={0xffffffffffffffff, 0xe0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x6, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xe9, &(0x7f00000002c0)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000300), &(0x7f0000000340), 0x8, 0xd1, 0x8, 0x8, &(0x7f0000000380)}}, 0x10) 47.759228753s ago: executing program 32 (id=315): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0) fcntl$getflags(r0, 0x408) sendmsg$DEVLINK_CMD_RATE_SET(0xffffffffffffffff, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000280)='./file1\x00', 0x0, 0x200c01, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000001}, 0x4000080) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x20, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x11d15}}, 0x20}, 0x1, 0x0, 0x0, 0x28001}, 0x8000) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={0x0}}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x7e832, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f000000aa00)=ANY=[@ANYBLOB="d850000044000701fefffffffcdbdf25037c000004004580c0500180bc506480b850cd80b450d680b05018800400f28004008d809f506a80cb84262700fc44f829e9ac5d2b0168d2ed51fbf02783ae7705c94d9468d49caa3fe7907450398014006d800500a4000000000008004d00ac14140c5950028037000180d01032234b706888b980d85f5def3c191ca34a6233501153013bfba3d086610cf508856addde7e5c76f43c436ca7ad24952a0b0085125080106436907b2a903f7e0157da1114736ba94b5dbf4f9c4f80f729a22252376abc3c07a20ec89bb97eb05c339e1274645639afd083cb636ee66d5c151197e89a6e61c57a8c6166ab600ed3768498f99189e39e1b69fc318fdf49ec5bb01f58252c64b18d56a5d340c13a8bc9079abfef0061800400d98004006b00ea11c6ebcf7daba729395ae46378a6c5ea317653ba1c9c415186a816e5b96d1bb170d08a0c3662a881ae356dd004bdcec0f7523da7ba2cca516faf18cc0f269d75b20e5b9a1ba0fe28c74d055c36a00d4055fe19f4d587c63364210d3ba1c9065fb993f13e48a2b2ae7f807b33ef09377821210240935f332253a7abc5a81e51fdf5a47c34d6b6735a1cfc8a2c08d27a668b14211d555addb43097e24d6122e4fd6eb36336a962c07465bbf558eda52d3381f3a8731316953ac9ec5a1621ddb5f93beacfaeb9a06ed666cd011e61d39471491d66ccdbacf99d42fcd8313f8e7625cc2700cf10c58006000d005b000000c41b098a50dda9bb69dd1b8fbc7e1d6a6d00426bb56a116f397aee87932d5a5dcaf58f5d35653926a46cfd0c7cae541dc5e9a0e092c7fe0373937164401ea504e79bea646aef3e0f16f82ba596e064bf2b2cc8528df217def0e6b8974ff2d7952dca23f00149d9b4189a26e057806a67f166922f06db4ce6e19cdaf26b1fa56a7b52b69794ca5624b7dee8f48eba85ae25559334a6af7439a0d58e3b238cb98d501cc026e13fc0269f68b83e006359e5a79f7916096d99fbe600a35a8b55205f631a0a2fe3f13938fdbe4cb259df8a7a69d00594b28249d1764d7b202230c0ca148f6efdfe3108fe38dfd34e5711df4bd741729e138c73faba648361fb53a772d70f8662818764f66302f3314ba96f7c175ec76242b5fb66ff2dd7e81a9bfddf8c58101b30c85fa65239218400300bb7cae9fe6dd4e5827af6c51f506a657aba798068b80283b55149491b49ea8db6c27ea283f0284410098268320e90a7a6508fa9d86f7cc74dfc42688d7e8281692b4f4a66654188f1ef99d1074291c751f57327c93bb1b411bab7e65aa8b26272e211367e80e903796ef0c705856941c9e14940f5925c6dfd7995d6769b7c788ad28125a487594560cd614132be9eb9f74b23f0412cc589ee152ed50adad3ad7722a0f67a3e523798e5fda6dd9eaf4e8407af3f8679efce7ed3fd7f1ff687ad45e2e769ea4cb12ec8eb4c9902b84cc5c4428181a4321379486852a809b0947c464fe5eb261c9d4b74bf0c85e0a92b87933e2bd0ff3538a882fc8460016c5964b963ac67040ab872c438d792c797a9cd57f0f6caea157c7866362dd4f41088f5d02e2bca6a07838a85f1cbef335e0e069641135b4c3e5a055f9fc501859c7c90ea1105faba48a9f6b5d58f6fc3ea487811c760b5848d0aae86fd6c482625087b6831873b26cdae442675fad68b5e904e4ba013fc9ae86f271290671b6c9b65ce00f40e11938384744bed5f4e6ec68e530eb89da516a6d032f979688821893f0920e8b2b51f47081270d0b209c875fa7817f375568e0e08a85b50c3e69a6c5935fda95c43732c2963071ea98cba4382403b95ffa88fcb8b7155685304d8021ba5ab6ce1fb98aea0ac742e69f6039506b4dbaa6af01a0a0dd683717d59373a88b602fc0f3165b1b7817af9490081239d1a2ecdf21b65023bc071fc18aae01ea888182f326969fda2f073219bb135ef632f67a83eb12deb8ee880e8f4bf217e077d83ae9fdbbd8ef4556c5ecd9de9a0387970766a1515ea10099d080eb0f3c31b542fdbb05e2359728c287cc38c98908a8335e2b2f0f32950639670be162075ec4711ca4396ecc32d803195f8992afd430c1e8f9de7810f4bd2708d55eccdf048f87e5e02040a572ec122934a6fcab35091fe94107bf1d1fc19cc28b60cb27ad86c5a2929f4d6781182164c18c86b04ae221746e952d5cf9a26dc9df51f2837bb0d13bdbba32fe810ec3fb6a985c277bc13f1ce5d23285e388ec1a30473d1d6437ed77ca1e42e6c41a6bb81185bf7e7880cbeb13c95ab547f3655787869f608d1e2fc1536dd67163104acbd961a632ce46dcb9ab1d79c7d77ea58c6caa462ca6caa7f4d9365cdcb3703a78d6ed4684c069bbcaf7f9e10f6377652f0bfce0a4204f1dc1dde6e1fcd5dd441749bd6479d90734426a59a749fd1d9c35651b79c21865bb261ad1cf776b4d6556160f1742e7c838824258fd547c98c1ff6967e36a68e2d1e238a582f2a0600a8fffd19d7166959bfdf1387911406b4bf8fdb7095d32eb9c286cf36499f15238ec7fe416b42c9240d6d25c4dd46a024127d688464d1d2ae1726587dd65a43e5133bec63e5b78bcac5b062d149ff1b0a65a73fcb0e0281ddfba3847d6b3170a85e74accce9cc4e5b724dd22ff236"], 0x50d8}}, 0xc000) r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xe8001, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2}) ioctl$TUNSETTXFILTER(r7, 0x400454d1, &(0x7f0000000000)=ANY=[@ANYBLOB="0100e1f9"]) syz_open_dev$dmmidi(&(0x7f0000000300), 0x2, 0x189083) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={0xffffffffffffffff, 0xe0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x6, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xe9, &(0x7f00000002c0)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000300), &(0x7f0000000340), 0x8, 0xd1, 0x8, 0x8, &(0x7f0000000380)}}, 0x10) 12.509200446s ago: executing program 2 (id=423): r0 = gettid() tkill(r0, 0x7) 12.359865833s ago: executing program 1 (id=425): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4f8, 0x0, 0xd0, 0x1a0, 0x270, 0x428, 0x0, 0xd0, 0x1a0, 0x358, 0x428, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff]}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x558) r1 = socket$inet6(0xa, 0x3, 0x3c) writev(r1, &(0x7f0000001880)=[{&(0x7f0000000580)="06a5a714e3887cd4f7f97506f176b8", 0xf}, {&(0x7f0000000880)="ee993abf99d826c3107b1259f25b162e724318d5d0c450141df0608f0f4f51cef8c8e8a49edb5af15fc39f35bbd0157324e55b9cd5f17e0a310913b385f189d13027c20b60d962cf7548082713069833a794bcffcd5f6daba24f91232f678cd091bcae6ec94991775faffbaf2645fd5a38a66a85eaac7006c9feee4f0f1ae0eb6374378f0acf90b6cc9e04c4c5bc5875bcdf80f18879ffd4a823bed96903405e4ac629733e48576a6e28e775fa1bd30190342fc3ea2fa690f84c78cd494d7ea7d50dbff1f362f3ed52cd7ae86e10efc957f23a0dd5cbc7ce0edbf2eb0c7dd53cf1f1cf10dd42790050f0e38d51a822e303802eeeaf8fa3875b7943f61f4530262b8775b7d31a2c3aa2ac6fe44e614e9d4c2abd00ea17142e7216632baca316fe7731dee60a8847b5d1207edf990bf254c5695ca9f2e35933864ded45bc6b109b5d2db3a19af0066d07798b044c2c228d3ce5c5f2b40499580a6a5dbd15f90bcf4ef8126cd4b818c84d27ca3bed4ee9d149afca7bc927b9df102e98a49add9a9c52ec950d679e4f40726736d974a2c4e9118c36238fe7aa057dee0f4433d587d4f3fb2cc39c8f9578eb80a4c5f3150d7a0f7aefa4eb8aecc70560880b0a7c6a835251427613c57dabddda6c8d407b1f2785f2a18918d5d5184c2156889d8c9be6c8e6e979a4987375d9566c1bf23d9b262fc4532c79afc3f1ae57bc3f8c838564ca2ea50ae26a6b9fa977f47bd2dbfebfc15dc602028520e37166c31adad67d17227963b970128477b107e5c4aaccc3d2feceaadecc3b1186765b52c72e9f70afa268a6213bd78d283f643f7b3769ad9a518336a79c45e9500887c469efea14102777a55ecbdac7aad31cc44f192b287e1366cee23125cd35b9adb7da8b3e1ce29931536957231818a2af645375b050bf82ad896afee5a98149861abbcbfe74f411d39897fcf2b61f4d8616224bcc082f68b0faf923093b38c87ca4d42d80e69f37bde9b8ed7c014c77010fae5007d7a229bcd72d2283cb47aacc2a7ca72066839bbd81ab58a98ba1b751e61c44f60157c549d872f3a36c1b99982fd51f329be6ed59379275d01a311a95cdb65b5f851699f9f2903a88fa63eb22453ec95082d3cd804fba64f67272b0ec4e322bcaa0d40a5d86398438e09352a3f2f2428009b5c4cede8720463c61765ae9a46f51827430d05755b1de5ee8a1835b5ec06890d921c63b0ac1c97f8bfc786c13cb3d88603ae5779076e0083ac0374870f32f299faff14cd86b78da9f56388d50e57d92e24bf6db454cb1579e6590f520be854baded354f235b0452b0fad58a67e8ed8cb0dad6c64c9b964ac18aab442b1c579b56287a1cceb23bd2885f93b8912217522f4e0139b2e0a65c117a0fa6aa8beba3298fbeca3ecc72c43eafe0a59e1e6c0a7810d2e0119203ae0990c69519f1cccaf553f20d7401881b579c3d5d23eb2cadab61dcfe231c62982091a2a1d733c5e2d768dc700655b834d83e58af85b9e87808c66e0a67903a0fbe940774ecbec6b069bbf4d72ad1f7adbae9bfbfe52fdea6397918fb5736e338ebb9329a7528f5b54ca3d5db39bf1c7e086096ff2d3abf275137e8c83e8fe1acf1f1bf9247e94855abd99d9ee8a2fa57b942a5fcf23db702286d5acf19147cfe51faa9ffbbf0562d344af117161ddad99603a50c2c896c1f9c3123dcec6844555b38bf3e7a52fcfeb3278035912763401edd4efb5d5744d5afbdf65d4df37f718c36166d43d03ff9ec61a16b91d6f8beffc1de631b5adcaa26d71829c92476f30ec4ca9c719c93611c4ba869dc044923fb8fa7e8e1e5fafc33a64deb307e3dc1e4d440118ba3d1cce4694a95eb9f1dae0f22a151f2de0a680c943f09928a", 0x535}], 0x2) 12.332969876s ago: executing program 2 (id=426): syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040), 0x208e24b) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x4, &(0x7f0000000340)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x5}]}, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000540)={r0, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180), ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000280)=[0x0, 0x0, 0x0], 0x0, 0x46, &(0x7f00000002c0)=[{}], 0x8, 0x10, &(0x7f0000000300), &(0x7f00000003c0), 0x8, 0xdd, 0x8, 0x0, 0x0}}, 0x10) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) sendmsg$nl_route_sched(r1, 0x0, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000004c00)=@newtfilter={0x44, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {0xf, 0x9}, {0x1}, {0x300, 0x1}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FD={0x8, 0x6, r2}]}}]}, 0x44}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) ftruncate(r0, 0x5) getpgid(0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) r3 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f00000000c0)={0xb, 0x1, 0x4, 0x0, 0x7}) ioctl$vim2m_VIDIOC_STREAMOFF(r3, 0x40045612, &(0x7f0000000000)=0x1) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x29) write(r5, &(0x7f0000000000)='7', 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) ppoll(&(0x7f0000000100)=[{r3, 0x1004}], 0x1, 0x0, 0x0, 0x0) ioctl$vim2m_VIDIOC_S_CTRL(r4, 0xc008561c, &(0x7f0000000040)={0xf0f046}) 12.083903076s ago: executing program 1 (id=428): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58) listen(r0, 0x5) close_range(r0, 0xffffffffffffffff, 0x0) 11.881171682s ago: executing program 1 (id=431): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000c80)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f8fff5f8a7abe4dbefc62fd85769e1ffffff1200000000000000004ee7e37884c201e615e3ef4c0000"], 0x50) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r4, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x0, @dev}, 0x2}}, 0x2e) 10.949448239s ago: executing program 2 (id=434): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7) socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r4, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x0, @dev}, 0x2}}, 0x2e) 10.447032344s ago: executing program 0 (id=436): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10004893}, 0x80) 10.214385565s ago: executing program 0 (id=437): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4f8, 0x0, 0xd0, 0x1a0, 0x270, 0x428, 0x0, 0xd0, 0x1a0, 0x358, 0x428, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff]}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x558) r1 = socket$inet6(0xa, 0x3, 0x3c) writev(r1, &(0x7f0000001880)=[{&(0x7f0000000580)="06a5a714e3887cd4f7f97506f176b8", 0xf}, {&(0x7f0000000880)="ee993abf99d826c3107b1259f25b162e724318d5d0c450141df0608f0f4f51cef8c8e8a49edb5af15fc39f35bbd0157324e55b9cd5f17e0a310913b385f189d13027c20b60d962cf7548082713069833a794bcffcd5f6daba24f91232f678cd091bcae6ec94991775faffbaf2645fd5a38a66a85eaac7006c9feee4f0f1ae0eb6374378f0acf90b6cc9e04c4c5bc5875bcdf80f18879ffd4a823bed96903405e4ac629733e48576a6e28e775fa1bd30190342fc3ea2fa690f84c78cd494d7ea7d50dbff1f362f3ed52cd7ae86e10efc957f23a0dd5cbc7ce0edbf2eb0c7dd53cf1f1cf10dd42790050f0e38d51a822e303802eeeaf8fa3875b7943f61f4530262b8775b7d31a2c3aa2ac6fe44e614e9d4c2abd00ea17142e7216632baca316fe7731dee60a8847b5d1207edf990bf254c5695ca9f2e35933864ded45bc6b109b5d2db3a19af0066d07798b044c2c228d3ce5c5f2b40499580a6a5dbd15f90bcf4ef8126cd4b818c84d27ca3bed4ee9d149afca7bc927b9df102e98a49add9a9c52ec950d679e4f40726736d974a2c4e9118c36238fe7aa057dee0f4433d587d4f3fb2cc39c8f9578eb80a4c5f3150d7a0f7aefa4eb8aecc70560880b0a7c6a835251427613c57dabddda6c8d407b1f2785f2a18918d5d5184c2156889d8c9be6c8e6e979a4987375d9566c1bf23d9b262fc4532c79afc3f1ae57bc3f8c838564ca2ea50ae26a6b9fa977f47bd2dbfebfc15dc602028520e37166c31adad67d17227963b970128477b107e5c4aaccc3d2feceaadecc3b1186765b52c72e9f70afa268a6213bd78d283f643f7b3769ad9a518336a79c45e9500887c469efea14102777a55ecbdac7aad31cc44f192b287e1366cee23125cd35b9adb7da8b3e1ce29931536957231818a2af645375b050bf82ad896afee5a98149861abbcbfe74f411d39897fcf2b61f4d8616224bcc082f68b0faf923093b38c87ca4d42d80e69f37bde9b8ed7c014c77010fae5007d7a229bcd72d2283cb47aacc2a7ca72066839bbd81ab58a98ba1b751e61c44f60157c549d872f3a36c1b99982fd51f329be6ed59379275d01a311a95cdb65b5f851699f9f2903a88fa63eb22453ec95082d3cd804fba64f67272b0ec4e322bcaa0d40a5d86398438e09352a3f2f2428009b5c4cede8720463c61765ae9a46f51827430d05755b1de5ee8a1835b5ec06890d921c63b0ac1c97f8bfc786c13cb3d88603ae5779076e0083ac0374870f32f299faff14cd86b78da9f56388d50e57d92e24bf6db454cb1579e6590f520be854baded354f235b0452b0fad58a67e8ed8cb0dad6c64c9b964ac18aab442b1c579b56287a1cceb23bd2885f93b8912217522f4e0139b2e0a65c117a0fa6aa8beba3298fbeca3ecc72c43eafe0a59e1e6c0a7810d2e0119203ae0990c69519f1cccaf553f20d7401881b579c3d5d23eb2cadab61dcfe231c62982091a2a1d733c5e2d768dc700655b834d83e58af85b9e87808c66e0a67903a0fbe940774ecbec6b069bbf4d72ad1f7adbae9bfbfe52fdea6397918fb5736e338ebb9329a7528f5b54ca3d5db39bf1c7e086096ff2d3abf275137e8c83e8fe1acf1f1bf9247e94855abd99d9ee8a2fa57b942a5fcf23db702286d5acf19147cfe51faa9ffbbf0562d344af117161ddad99603a50c2c896c1f9c3123dcec6844555b38bf3e7a52fcfeb3278035912763401edd4efb5d5744d5afbdf65d4df37f718c36166d43d03ff9ec61a16b91d6f8beffc1de631b5adcaa26d71829c92476f30ec4ca9c719c93611c4ba869dc044923fb8fa7e8e1e5fafc33a64deb307e3dc1e4d440118ba3d1cce4694a95eb9f1dae0f22a151f2de0a680c943f09928a", 0x535}], 0x2) 10.079421836s ago: executing program 0 (id=438): mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./mnt\x00', &(0x7f0000000280)='configfs\x00', 0x0, 0x0) mount(0x0, 0x0, &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x401, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, &(0x7f00000083c0)={{0x1}}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./mnt/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt/usb_gadget/g1/configs/c.1\x00', 0x1ff) 9.246413975s ago: executing program 0 (id=439): pselect6(0x40, &(0x7f00000001c0)={0x8, 0x0, 0x5, 0xfffffffffffffffd, 0x0, 0x0, 0x7}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x20000000009, 0x5, 0x0, 0x1, 0x9}, 0x0, 0x0) 9.238155833s ago: executing program 1 (id=440): openat$sndtimer(0xffffffffffffff9c, 0x0, 0x0) r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfb, 0x4}, 0xc) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58) listen(r1, 0x5) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x240000d4, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0xffffffff}, 0x1c) socket$inet6_tcp(0xa, 0x1, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) 8.612961196s ago: executing program 2 (id=442): ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x180940, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x801a01, 0x0) ioctl$EVIOCGPROP(r0, 0x40047438, &(0x7f0000000180)=""/246) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$inet6(0xa, 0x3, 0x3) syz_usb_connect$hid(0x1, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000240)=@o_path={&(0x7f0000000180)='./file1\x00'}, 0x18) setrlimit(0x8, &(0x7f0000000080)={0x7, 0xd86000}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) unshare(0x400) r5 = socket$inet(0xa, 0x801, 0x84) connect$inet(r5, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r2, 0x8) r6 = accept4(r5, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r6, 0x84, 0x7d, &(0x7f0000000140)={0x0, 0x4}, 0x8) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f00000000c0)=[{0x20, 0x0, 0x8, 0xfffff038}, {0x20, 0xf, 0x0, 0xffffefff}, {0x6}]}, 0x10) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) sendmmsg(r3, &(0x7f0000000180), 0x4000190, 0xc03e) 8.567736861s ago: executing program 1 (id=443): socket$kcm(0x10, 0x2, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f0000000500), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000006, 0x204031, 0xffffffffffffffff, 0xec776000) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x44000) mount(&(0x7f0000000180)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='.\x00', &(0x7f0000000240)='gfs2\x00', 0x100801f, 0x0) 5.195897214s ago: executing program 1 (id=444): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x8001, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = dup(r2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) sendmsg$inet6(r2, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e21, @empty}}, 0x5, 0x3, 0xf06, 0x1, 0x94, 0xfffffffd, 0x5}, 0x9c) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x2, 0x9}}, 0xfd33) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e60, 0xfffffff2, @empty}}, 0xffffec47, 0x9, 0xffff1896, 0x100, 0x25, 0x7fff}, 0x9c) socket(0x2, 0x80805, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x8) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) 5.033148394s ago: executing program 2 (id=445): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x4, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000400)={{0x14}, [@NFT_MSG_NEWRULE={0x3c, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x10, 0x4, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, @ct={{0x7}, @void}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x64}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) r3 = socket$kcm(0xa, 0x922000000003, 0x11) setsockopt$sock_attach_bpf(r3, 0x29, 0x24, &(0x7f00000000c0), 0x4) sendmsg$kcm(r3, &(0x7f0000000000)={&(0x7f00000002c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000340)="f4001100032b2c25fe8007000000007a2c08000000090000ff020000000000000000fffffff50000", 0x5dc}], 0x1}, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0}) r4 = dup3(r1, r0, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000780)={0x10, 0x0, &(0x7f0000000380)=[@clear_death={0x400c630f, 0x1}], 0xc9, 0x0, &(0x7f0000000680)="f1a4f4b10f5bcb4501add85d3acacb5c46b400aa41b5f774e27319eb6906699b2cc9b5f30b6e8fac027b4bd92396d12ea915e94c8e03f5a887d24c96b3d8438019df2c0bb0a0c3fc8592d2575b1b99ba537f79897c06319a060982300a33fe7ddf83decd0f22b03e5d05a9f05e1ac281e23791859e186a5d421ef892806b9e20ade4cea7cb3e74d4bdba30c5755263024687fca6b7ef1c15694d4f0d9f6e481e367960520a07deddf0199b612b62f514f066eaa6632d5f7e9aeb981c5855fbe059b1224c8a255bae3e"}) sendmsg$NL80211_CMD_SET_INTERFACE(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r8, @ANYBLOB='\b\x00\x00'], 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000005c0)={0x98, r7, 0x5, 0x70bd29, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x62, 0xe, {{{}, {}, @broadcast, @broadcast, @random="ce99a8ba8228"}, 0x0, @default, 0x1, @void, @val, @void, @void, @val={0x6, 0x2, 0xfff}, @val={0x5, 0x3, {0xb, 0x1f}}, @val={0x25, 0x3, {0x1, 0x34, 0x3}}, @void, @val={0x3c, 0x4, {0x0, 0x8f, 0x84, 0x2}}, @val={0x2d, 0x1a, {0x1, 0x1, 0x7, 0x0, {0xa600000000000000, 0x2, 0x0, 0x48, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x9}}, @val={0x72, 0x6}, @void, @void}}], @NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x7f}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_P2P_CTWINDOW={0x5, 0xa2, 0x4}]}, 0x98}}, 0x20000014) 4.924736497s ago: executing program 3 (id=446): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) 3.597755949s ago: executing program 3 (id=447): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) prlimit64(0x0, 0xe, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x6) r3 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) r4 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r4, 0x403c6f2b, &(0x7f0000001e40)={0x6, {"4772ffacff04856ec9e8776f8ee906be", "2dfad343e15ead11f40c897700", "0000b3f88813da82b4cf00"}, 0x3eaf, 0x4}) ioctl$DVB_DEMUX_DMX_SET_FILTER(r3, 0x403c6f2b, &(0x7f0000000000)={0x6, {"771c2e01f8ffffffffffee00", "000900000000000200"}, 0x7, 0x4}) 3.215156921s ago: executing program 0 (id=448): mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./mnt\x00', &(0x7f0000000280)='configfs\x00', 0x0, 0x0) mount(0x0, 0x0, &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x401, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, &(0x7f00000083c0)={{0x1}}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r4, 0x54a2) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./mnt/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt/usb_gadget/g1/configs/c.1\x00', 0x1ff) 3.211605222s ago: executing program 5 (id=341): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0) write(r1, &(0x7f0000000280)='external', 0x8) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0) write(r2, &(0x7f0000000300)='raid5', 0x5) r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r3, &(0x7f0000000380)='2', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0) write(r4, &(0x7f0000000400)='65536', 0x5) r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/consistency_policy\x00', 0x1, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r6, &(0x7f00000005c0)='1:1', 0x3) r7 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-ram1/size\x00', 0x1, 0x0) write(r7, &(0x7f0000000840)='10', 0x2) r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/dev-ram1/ppl_size\x00', 0x1, 0x0) write(r8, &(0x7f0000000940)='128', 0x3) r9 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0) write(r9, &(0x7f00000009c0)='1', 0x1) write(0xffffffffffffffff, &(0x7f0000000a40)='active', 0x6) write(r5, &(0x7f0000000500)='ppl', 0x3) 1.618574204s ago: executing program 0 (id=449): setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000180)=0x81, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000340)='oom_score_adj\x00') pread64(r0, 0x0, 0x0, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_open_procfs(0x0, &(0x7f0000000840)='comm\x00') readv(r3, &(0x7f0000000100)=[{&(0x7f0000000000)=""/154, 0x9a}], 0x1) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={0x2c, r1, 0x1, 0x4, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xcb}]}, 0x2c}, 0x1, 0x300, 0x0, 0x1}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000080)={0x50, r6, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_FRAME={0x2a, 0x33, @action={{{}, {}, @broadcast, @device_a, @from_mac=@broadcast, {0x0, 0xff}}, @ext_ch_sw={0x4, 0x4, {{0x0, 0x0, 0x2}, @val={0x76, 0x6, {0x61, 0x3, 0xd, 0x5}}}}}}, @NL80211_ATTR_CSA_C_OFFSETS_TX={0x6, 0xcd, [0x0]}]}, 0x50}, 0x1, 0x0, 0x0, 0xc0}, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x220008d0}, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r8, &(0x7f0000000000)='3', 0x4e) mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000040)='.\x00', &(0x7f0000000000)='minix\x00', 0x0, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, 0x0, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x200000c0}, 0x0) 1.532060728s ago: executing program 3 (id=450): r0 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff) write$binfmt_script(r1, &(0x7f0000000700)={'#! ', './file1'}, 0xb) close(r1) execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r3, 0xaf01, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)={0x74, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private}, {0x8, 0x2, @multicast2}}}]}, @CTA_TIMEOUT={0x8}, @CTA_MARK={0x8}, @CTA_MARK_MASK={0x8}]}, 0x74}}, 0x0) ioctl$VHOST_SET_VRING_BUSYLOOP_TIMEOUT(r3, 0x4008af23, &(0x7f0000000140)={0x1, 0x5}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r5, 0x0, 0xa5ff47ae22c73441) close_range(r2, 0xffffffffffffffff, 0x0) 1.248216528s ago: executing program 2 (id=451): openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0) shmctl$SHM_LOCK(0x0, 0xb) syz_emit_ethernet(0x4a, &(0x7f00000004c0)=ANY=[], 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, r0, 0xffffc000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000001340)=@file={0x0, './file0\x00'}, 0x6e) r3 = socket$rxrpc(0x21, 0x2, 0x0) sendmsg(r2, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r3, 0x110, 0x4, &(0x7f0000000000)=0x1, 0x4) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, &(0x7f0000000040)=0x39cb, 0x4) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x121602, 0x0) socket$kcm(0x1e, 0x5, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000280)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0x7}, 0x1c) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e23, @remote}, 0x10) fstatfs(r4, &(0x7f00000002c0)=""/4096) set_mempolicy(0xa002, &(0x7f00000001c0)=0x401, 0x200) 817.205108ms ago: executing program 3 (id=452): connect$can_bcm(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000340)=0x0) fcntl$lock(0xffffffffffffffff, 0x5938f56e92bf77b0, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x1}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x8002) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000400)={0x53, 0xfffffffffffffffc, 0x6, 0xe9, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000180)='\x00\x00\x00\x00\x00\x00', 0x0, 0x9, 0x0, 0x80, 0x0}) 384.49078ms ago: executing program 3 (id=453): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x2f0, 0xffffffff, 0xa8, 0xa8, 0x0, 0xffffffff, 0xffffffff, 0x258, 0x258, 0x258, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast1, @empty, 0xffffff00, 0xff, 'veth0_virt_wifi\x00', 'vlan0\x00', {0xff}, {}, 0x1, 0x2, 0x20}, 0x0, 0x70, 0xa8, 0x1ba, {0x46010000, 0x2c000000000000}}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x0, 0x3}, {0xffffffffffffffff}, {0xffffffffffffffff}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'team_slave_0\x00', 'team0\x00', {0xff}, {}, 0x62, 0x3, 0xc}, 0x287, 0xb8, 0x118, 0x0, {}, [@common=@unspec=@nfacct={{0x48}, {'syz0\x00', 0x3}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x0, 0x3, 0x2, 0x0, 0x4], 0x1, 0x3}, {0x0, [0x6, 0x5, 0x6, 0x0, 0x5], 0x1, 0x2}}}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x7}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x350) 0s ago: executing program 3 (id=454): r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x28, r0, 0x1, 0x70bd2b, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000001}, 0x20000882) kernel console output (not intermixed with test programs): t=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 106.427928][ T31] audit: type=1400 audit(1789734981.637:246): avc: denied { mount } for pid=6035 comm="syz.2.55" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 106.429414][ T31] audit: type=1400 audit(1789734981.637:247): avc: denied { mount } for pid=6035 comm="syz.2.55" name="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 106.485408][ T6037] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 106.485830][ T6037] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 106.551314][ T6037] Zero length message leads to an empty skb [ 106.739249][ T5701] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 107.374843][ T6049] Cannot find add_set index 2 as target [ 107.930345][ T5701] usb 3-1: device descriptor read/64, error -71 [ 107.960539][ T6051] FAULT_INJECTION: forcing a failure. [ 107.960539][ T6051] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 107.960585][ T6051] CPU: 1 UID: 0 PID: 6051 Comm: syz.3.58 Not tainted syzkaller #0 PREEMPT(full) [ 107.960608][ T6051] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 107.960621][ T6051] Call Trace: [ 107.960629][ T6051] [ 107.960637][ T6051] dump_stack_lvl+0x100/0x190 [ 107.960676][ T6051] should_fail_ex.cold+0x5/0xa [ 107.960707][ T6051] _copy_from_iter+0x1f4/0x1690 [ 107.960740][ T6051] ? __pfx__copy_from_iter+0x10/0x10 [ 107.960764][ T6051] ? trace_kmalloc+0xeb/0x110 [ 107.960791][ T6051] ? __kasan_kmalloc+0xaa/0xb0 [ 107.960819][ T6051] ? __kmalloc_noprof+0x350/0x840 [ 107.960844][ T6051] ? kernfs_fop_write_iter+0x26a/0x5f0 [ 107.960875][ T6051] kernfs_fop_write_iter+0x186/0x5f0 [ 107.960904][ T6051] vfs_write+0x6af/0x1050 [ 107.960928][ T6051] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 107.960956][ T6051] ? __pfx_vfs_write+0x10/0x10 [ 107.960977][ T6051] ? find_held_lock+0x2b/0x80 [ 107.961029][ T6051] ksys_write+0x12a/0x250 [ 107.961052][ T6051] ? __pfx_ksys_write+0x10/0x10 [ 107.961082][ T6051] do_syscall_64+0x123/0x790 [ 107.961117][ T6051] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.961140][ T6051] RIP: 0033:0x7f7f0d39e159 [ 107.961158][ T6051] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 107.961177][ T6051] RSP: 002b:00007f7f0e2cb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 107.961198][ T6051] RAX: ffffffffffffffda RBX: 00007f7f0d626090 RCX: 00007f7f0d39e159 [ 107.961212][ T6051] RDX: 0000000000000001 RSI: 0000200000000240 RDI: 0000000000000004 [ 107.961225][ T6051] RBP: 00007f7f0e2cb090 R08: 0000000000000000 R09: 0000000000000000 [ 107.961239][ T6051] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 107.961252][ T6051] R13: 00007f7f0d626128 R14: 00007f7f0d626090 R15: 00007fff3224c7f8 [ 107.961283][ T6051] [ 108.206942][ T31] audit: type=1400 audit(1789734983.417:248): avc: denied { read } for pid=6053 comm="syz.4.48" name="card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 108.208852][ T31] audit: type=1400 audit(1789734983.417:249): avc: denied { open } for pid=6053 comm="syz.4.48" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 108.215531][ T5701] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 108.238572][ C1] Unknown status report in ack skb [ 108.317031][ T6047] VFS: Can't find a Minix filesystem V1 | V2 | V3 on device nullb0. [ 108.355504][ T5701] usb 3-1: device descriptor read/64, error -71 [ 108.472929][ T6057] Set syz1 is full, maxelem 2076 reached [ 108.493389][ T5701] usb usb3-port1: attempt power cycle [ 108.697933][ T6060] rnbd_client L202: map_device: Unknown parameter or missing value 'path=' [ 108.869652][ T31] audit: type=1326 audit(1789734984.077:250): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6064 comm="syz.3.63" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7f0d39e159 code=0x0 [ 108.875814][ T5701] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 108.913273][ T5701] usb 3-1: device descriptor read/8, error -71 [ 109.985905][ T5701] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 110.006872][ C1] raw-gadget.0 gadget.2: ignoring, device is not running [ 110.007154][ T5701] usb 3-1: device descriptor read/8, error -32 [ 110.043923][ T31] audit: type=1400 audit(1789734985.247:251): avc: denied { read } for pid=6074 comm="syz.3.65" name="binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 110.044328][ T31] audit: type=1400 audit(1789734985.247:252): avc: denied { open } for pid=6074 comm="syz.3.65" path="/dev/binderfs/binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 110.129337][ T5701] usb usb3-port1: unable to enumerate USB device [ 110.996773][ T31] kauditd_printk_skb: 5 callbacks suppressed [ 110.996791][ T31] audit: type=1400 audit(1789734986.207:258): avc: denied { setopt } for pid=6074 comm="syz.3.65" lport=17 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 111.000072][ T31] audit: type=1400 audit(1789734986.207:259): avc: denied { write } for pid=6074 comm="syz.3.65" lport=17 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 111.063710][ T31] audit: type=1400 audit(1789734986.267:260): avc: denied { map } for pid=6074 comm="syz.3.65" path="/dev/binderfs/binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 111.100043][ T31] audit: type=1400 audit(1789734986.307:261): avc: denied { call } for pid=6074 comm="syz.3.65" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 111.152945][ T6083] netlink: 4 bytes leftover after parsing attributes in process `syz.4.67'. [ 111.255231][ T6084] netlink: 4 bytes leftover after parsing attributes in process `syz.4.67'. [ 111.320526][ T13] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 111.320575][ T13] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 111.320610][ T13] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 111.320645][ T13] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 111.572929][ T31] audit: type=1400 audit(1789734986.777:262): avc: denied { read } for pid=6085 comm="syz.3.70" name="mice" dev="devtmpfs" ino=910 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 111.572987][ T31] audit: type=1400 audit(1789734986.777:263): avc: denied { open } for pid=6085 comm="syz.3.70" path="/dev/input/mice" dev="devtmpfs" ino=910 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 111.683107][ T6087] rnbd_client L607: Mapping device /dev/ram0 on session s+, (access_mode: rw, nr_poll_queues: 0) [ 111.745487][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 111.871656][ T6087] rtrs_client L2101: : Failed to resolve address, err: -ENODEV [ 111.904240][ T6087] rtrs_client L2644: : init_conns() failed: err=-ENODEV path=@ip:127.0.0.1 [:0] [ 112.334100][ T31] audit: type=1400 audit(1789734987.467:264): avc: denied { shutdown } for pid=6085 comm="syz.3.70" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 112.833053][ T6091] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 113.033962][ T31] audit: type=1400 audit(1789734988.237:265): avc: denied { write } for pid=6094 comm="syz.0.66" name="001" dev="devtmpfs" ino=735 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 113.220806][ T31] audit: type=1400 audit(1789734988.427:266): avc: denied { map } for pid=6094 comm="syz.0.66" path="/dev/bus/usb/006/001" dev="devtmpfs" ino=735 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 114.102405][ T6110] rnbd_client L127: Can't parse path ip:127: -22 [ 115.061973][ T6120] netlink: zone id is out of range [ 115.062780][ T6120] netlink: zone id is out of range [ 115.062807][ T6120] netlink: zone id is out of range [ 115.062830][ T6120] netlink: zone id is out of range [ 115.062853][ T6120] netlink: zone id is out of range [ 115.062876][ T6120] netlink: zone id is out of range [ 115.063238][ T6120] netlink: zone id is out of range [ 115.063262][ T6120] netlink: zone id is out of range [ 115.063284][ T6120] netlink: zone id is out of range [ 115.063307][ T6120] netlink: zone id is out of range [ 115.295181][ C0] Unknown status report in ack skb [ 115.418114][ T6118] VFS: Can't find a Minix filesystem V1 | V2 | V3 on device nullb0. [ 116.002913][ T6126] can0: slcan on ttyS3. [ 116.436798][ T6104] syz.0.66 (6104): drop_caches: 2 [ 116.899686][ T6123] can0 (unregistered): slcan off ttyS3. [ 118.429762][ T6137] VFS: Can't find a Minix filesystem V1 | V2 | V3 on device nullb0. [ 118.891701][ T31] audit: type=1326 audit(1789734994.097:267): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6146 comm="syz.3.75" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7f0d39e159 code=0x0 [ 120.162843][ T31] audit: type=1400 audit(1789734995.367:268): avc: denied { create } for pid=6160 comm="syz.3.87" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 120.163377][ T31] audit: type=1400 audit(1789734995.367:269): avc: denied { connect } for pid=6160 comm="syz.3.87" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 120.170726][ T31] audit: type=1400 audit(1789734995.377:270): avc: denied { write } for pid=6160 comm="syz.3.87" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 120.501933][ T6166] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 121.911004][ T6170] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 122.825275][ C0] Unknown status report in ack skb [ 122.848605][ T6176] VFS: Can't find a Minix filesystem V1 | V2 | V3 on device nullb0. [ 123.048605][ T6182] FAULT_INJECTION: forcing a failure. [ 123.048605][ T6182] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 123.048641][ T6182] CPU: 0 UID: 0 PID: 6182 Comm: syz.4.92 Not tainted syzkaller #0 PREEMPT(full) [ 123.048664][ T6182] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 123.048676][ T6182] Call Trace: [ 123.048683][ T6182] [ 123.048692][ T6182] dump_stack_lvl+0x100/0x190 [ 123.048755][ T6182] should_fail_ex.cold+0x5/0xa [ 123.048794][ T6182] _copy_to_user+0x32/0xd0 [ 123.048821][ T6182] simple_read_from_buffer+0xcb/0x170 [ 123.048852][ T6182] proc_fail_nth_read+0x1af/0x230 [ 123.048882][ T6182] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 123.048912][ T6182] ? rw_verify_area+0xce/0x6d0 [ 123.048945][ T6182] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 123.048973][ T6182] vfs_read+0x1e4/0xb40 [ 123.048996][ T6182] ? lock_acquire+0x1d1/0x380 [ 123.049020][ T6182] ? __fget_files+0x34/0x3d0 [ 123.049047][ T6182] ? __pfx_vfs_read+0x10/0x10 [ 123.049067][ T6182] ? find_held_lock+0x2b/0x80 [ 123.049099][ T6182] ? __fget_files+0x215/0x3d0 [ 123.049132][ T6182] ? __fget_files+0x21f/0x3d0 [ 123.049168][ T6182] ksys_read+0x12a/0x250 [ 123.049190][ T6182] ? __pfx_ksys_read+0x10/0x10 [ 123.049223][ T6182] do_syscall_64+0x123/0x790 [ 123.049259][ T6182] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.049295][ T6182] RIP: 0033:0x7f5b6f75e98e [ 123.049318][ T6182] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 123.049339][ T6182] RSP: 002b:00007f5b70629fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 123.049364][ T6182] RAX: ffffffffffffffda RBX: 00007f5b7062a6c0 RCX: 00007f5b6f75e98e [ 123.049379][ T6182] RDX: 000000000000000f RSI: 00007f5b7062a0a0 RDI: 0000000000000003 [ 123.049393][ T6182] RBP: 00007f5b7062a090 R08: 0000000000000000 R09: 0000000000000000 [ 123.049406][ T6182] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 123.049417][ T6182] R13: 00007f5b6fa26038 R14: 00007f5b6fa25fa0 R15: 00007fff66eb2ae8 [ 123.049448][ T6182] [ 123.142418][ T31] audit: type=1400 audit(1789734998.347:271): avc: denied { read write } for pid=6184 comm="syz.0.94" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 123.144698][ T31] audit: type=1400 audit(1789734998.347:272): avc: denied { open } for pid=6184 comm="syz.0.94" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 123.176613][ T31] audit: type=1400 audit(1789734998.387:273): avc: denied { mount } for pid=6160 comm="syz.3.87" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 123.179496][ T31] audit: type=1400 audit(1789734998.387:274): avc: denied { search } for pid=6160 comm="syz.3.87" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 123.179867][ T31] audit: type=1400 audit(1789734998.387:275): avc: denied { read } for pid=6160 comm="syz.3.87" name="trace" dev="tracefs" ino=3222 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 123.180255][ T31] audit: type=1400 audit(1789734998.387:276): avc: denied { open } for pid=6160 comm="syz.3.87" path="/20/trace/trace" dev="tracefs" ino=3222 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 123.610200][ T6191] can0: slcan on ttyS3. [ 123.827650][ C1] wlan1: beacon TX faster than countdown (channel/color switch) completion [ 123.924337][ T31] audit: type=1400 audit(1789734999.127:277): avc: denied { listen } for pid=6184 comm="syz.0.94" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 123.926031][ T31] audit: type=1400 audit(1789734999.137:278): avc: denied { create } for pid=6184 comm="syz.0.94" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 124.044622][ T31] audit: type=1400 audit(1789734999.247:279): avc: denied { connect } for pid=6184 comm="syz.0.94" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 124.121691][ T31] audit: type=1400 audit(1789734999.327:280): avc: denied { getopt } for pid=6184 comm="syz.0.94" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 124.167833][ T31] audit: type=1400 audit(1789734999.377:281): avc: denied { create } for pid=6184 comm="syz.0.94" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 124.180491][ T31] audit: type=1400 audit(1789734999.387:282): avc: denied { bind } for pid=6184 comm="syz.0.94" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 124.434586][ T31] audit: type=1400 audit(1789734999.637:283): avc: denied { unmount } for pid=5603 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 124.975578][ T6187] can0 (unregistered): slcan off ttyS3. [ 125.438682][ T31] audit: type=1326 audit(1789735000.617:284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6198 comm="syz.1.98" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f99a6b9e159 code=0x0 [ 125.486916][ T6204] FAULT_INJECTION: forcing a failure. [ 125.486916][ T6204] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 125.486950][ T6204] CPU: 0 UID: 0 PID: 6204 Comm: syz.2.96 Not tainted syzkaller #0 PREEMPT(full) [ 125.486979][ T6204] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 125.486993][ T6204] Call Trace: [ 125.487000][ T6204] [ 125.487008][ T6204] dump_stack_lvl+0x100/0x190 [ 125.487047][ T6204] should_fail_ex.cold+0x5/0xa [ 125.487081][ T6204] _copy_to_user+0x32/0xd0 [ 125.487109][ T6204] simple_read_from_buffer+0xcb/0x170 [ 125.487137][ T6204] proc_fail_nth_read+0x1af/0x230 [ 125.487167][ T6204] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 125.487198][ T6204] ? rw_verify_area+0xce/0x6d0 [ 125.487241][ T6204] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 125.487269][ T6204] vfs_read+0x1e4/0xb40 [ 125.487290][ T6204] ? lock_acquire+0x1d1/0x380 [ 125.487312][ T6204] ? __fget_files+0x34/0x3d0 [ 125.487338][ T6204] ? __pfx_vfs_read+0x10/0x10 [ 125.487356][ T6204] ? find_held_lock+0x2b/0x80 [ 125.487384][ T6204] ? __fget_files+0x215/0x3d0 [ 125.487414][ T6204] ? __fget_files+0x21f/0x3d0 [ 125.487447][ T6204] ksys_read+0x12a/0x250 [ 125.487468][ T6204] ? __pfx_ksys_read+0x10/0x10 [ 125.487498][ T6204] do_syscall_64+0x123/0x790 [ 125.487533][ T6204] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.487556][ T6204] RIP: 0033:0x7f174bd5e98e [ 125.487574][ T6204] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 125.487594][ T6204] RSP: 002b:00007f174ccc0fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 125.487617][ T6204] RAX: ffffffffffffffda RBX: 00007f174ccc16c0 RCX: 00007f174bd5e98e [ 125.487632][ T6204] RDX: 000000000000000f RSI: 00007f174ccc10a0 RDI: 0000000000000005 [ 125.487645][ T6204] RBP: 00007f174ccc1090 R08: 0000000000000000 R09: 0000000000000000 [ 125.487657][ T6204] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 125.487670][ T6204] R13: 00007f174c026128 R14: 00007f174c026090 R15: 00007ffd88f7ada8 [ 125.487699][ T6204] [ 125.718793][ T6206] netlink: 'syz.3.97': attribute type 32 has an invalid length. [ 125.847214][ T31] audit: type=1400 audit(1789735001.047:285): avc: denied { listen } for pid=6202 comm="syz.4.99" lport=3 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 125.952793][ T31] audit: type=1400 audit(1789735001.157:286): avc: denied { create } for pid=6198 comm="syz.1.98" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 126.949811][ T6218] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 127.566746][ T1309] ieee802154 phy0 wpan0: encryption failed: -22 [ 127.566801][ T1309] ieee802154 phy1 wpan1: encryption failed: -22 [ 128.899318][ T6226] can0: slcan on ttyS3. [ 130.017540][ T6223] can0 (unregistered): slcan off ttyS3. [ 130.080363][ T6224] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 130.908319][ T6237] can0: slcan on ttyS3. [ 131.229009][ T6235] can0 (unregistered): slcan off ttyS3. [ 131.886118][ T6229] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 132.269029][ T31] kauditd_printk_skb: 2 callbacks suppressed [ 132.269071][ T31] audit: type=1400 audit(1789735007.447:289): avc: denied { mounton } for pid=6221 comm="syz.3.103" path="/syzcgroup/unified/syz3" dev="cgroup2" ino=38 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 132.516508][ T31] audit: type=1400 audit(1789735007.717:290): avc: denied { relabelfrom } for pid=6221 comm="syz.3.103" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 132.601314][ T31] audit: type=1400 audit(1789735007.777:291): avc: denied { relabelto } for pid=6221 comm="syz.3.103" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 132.705320][ T6224] Can't find a SQUASHFS superblock on nullb0 [ 133.431773][ T6252] can0: slcan on ttyS3. [ 134.077242][ T6249] can0 (unregistered): slcan off ttyS3. [ 134.610360][ T31] audit: type=1400 audit(1789735009.817:292): avc: denied { setopt } for pid=6257 comm="syz.3.111" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 134.611557][ T31] audit: type=1400 audit(1789735009.817:293): avc: denied { bind } for pid=6257 comm="syz.3.111" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 134.611891][ T31] audit: type=1400 audit(1789735009.817:294): avc: denied { name_bind } for pid=6257 comm="syz.3.111" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 134.612099][ T31] audit: type=1400 audit(1789735009.817:295): avc: denied { node_bind } for pid=6257 comm="syz.3.111" saddr=::1 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 134.690741][ T31] audit: type=1400 audit(1789735009.897:296): avc: denied { write } for pid=6257 comm="syz.3.111" laddr=::1 lport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 134.692548][ T31] audit: type=1400 audit(1789735009.897:297): avc: denied { name_connect } for pid=6257 comm="syz.3.111" dest=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 135.080409][ T31] audit: type=1400 audit(1789735010.287:298): avc: denied { ioctl } for pid=6273 comm="syz.4.114" path="socket:[9871]" dev="sockfs" ino=9871 ioctlcmd=0x7437 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 135.287174][ T6282] Cannot find add_set index 2 as target [ 135.854220][ T6289] FAULT_INJECTION: forcing a failure. [ 135.854220][ T6289] name failslab, interval 1, probability 0, space 0, times 0 [ 135.854259][ T6289] CPU: 0 UID: 0 PID: 6289 Comm: syz.2.118 Not tainted syzkaller #0 PREEMPT(full) [ 135.854290][ T6289] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 135.854305][ T6289] Call Trace: [ 135.854314][ T6289] [ 135.854324][ T6289] dump_stack_lvl+0x100/0x190 [ 135.854367][ T6289] should_fail_ex.cold+0x5/0xa [ 135.854402][ T6289] should_failslab+0xc2/0x120 [ 135.854435][ T6289] __kmalloc_flags_noprof+0x122/0x8e0 [ 135.854478][ T6289] ? alloc_slab_obj_exts+0x6a/0x170 [ 135.854522][ T6289] alloc_slab_obj_exts+0x6a/0x170 [ 135.854562][ T6289] __memcg_slab_post_alloc_hook+0x3fc/0x10c0 [ 135.854622][ T6289] ? kasan_save_track+0x14/0x30 [ 135.854656][ T6289] kmem_cache_alloc_noprof+0x4fa/0x6a0 [ 135.854685][ T6289] ? alloc_buffer_head+0x21/0x140 [ 135.854729][ T6289] alloc_buffer_head+0x21/0x140 [ 135.854766][ T6289] folio_alloc_buffers+0x197/0x8e0 [ 135.854802][ T6289] bdev_getblk+0x2fb/0x6a0 [ 135.854842][ T6289] __bread_gfp+0x86/0x380 [ 135.854872][ T6289] minix_fill_super+0x156/0x1b80 [ 135.854909][ T6289] ? setup_bdev_super+0x4b6/0x770 [ 135.854931][ T6289] ? set_blocksize+0x1cf/0x460 [ 135.854954][ T6289] ? setup_bdev_super+0x4b6/0x770 [ 135.854982][ T6289] ? sb_set_blocksize+0x1f6/0x290 [ 135.855007][ T6289] ? setup_bdev_super+0x4e8/0x770 [ 135.855037][ T6289] get_tree_bdev_flags+0x38c/0x620 [ 135.855061][ T6289] ? __pfx_minix_fill_super+0x10/0x10 [ 135.855093][ T6289] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 135.855115][ T6289] ? cap_capable+0x107/0x430 [ 135.855153][ T6289] ? bpf_lsm_capable+0x9/0x10 [ 135.855185][ T6289] ? security_capable+0x80/0x260 [ 135.855221][ T6289] vfs_get_tree+0x92/0x320 [ 135.855254][ T6289] path_mount+0x7d0/0x24c0 [ 135.855294][ T6289] ? __pfx_path_mount+0x10/0x10 [ 135.855326][ T6289] ? lockdep_hardirqs_on+0x7d/0x110 [ 135.855363][ T6289] ? putname+0xb1/0x110 [ 135.855391][ T6289] ? kmem_cache_free+0x127/0x6c0 [ 135.855431][ T6289] ? __x64_sys_mount+0x293/0x310 [ 135.855462][ T6289] __x64_sys_mount+0x293/0x310 [ 135.855493][ T6289] ? __pfx___x64_sys_mount+0x10/0x10 [ 135.855540][ T6289] do_syscall_64+0x123/0x790 [ 135.855579][ T6289] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.855605][ T6289] RIP: 0033:0x7f174bd9e159 [ 135.855657][ T6289] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 135.855682][ T6289] RSP: 002b:00007f174cce2028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 135.855707][ T6289] RAX: ffffffffffffffda RBX: 00007f174c025fa0 RCX: 00007f174bd9e159 [ 135.855724][ T6289] RDX: 0000200000000000 RSI: 0000200000000040 RDI: 00002000000000c0 [ 135.855757][ T6289] RBP: 00007f174be3506b R08: 0000000000000000 R09: 0000000000000000 [ 135.855772][ T6289] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 135.855787][ T6289] R13: 00007f174c026038 R14: 00007f174c025fa0 R15: 00007ffd88f7ada8 [ 135.855823][ T6289] [ 136.009341][ T6289] VFS: Can't find a Minix filesystem V1 | V2 | V3 on device nullb0. [ 136.161502][ T6294] VFS: Can't find a Minix filesystem V1 | V2 | V3 on device nullb0. [ 136.419269][ T6305] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 137.397662][ T31] kauditd_printk_skb: 2 callbacks suppressed [ 137.397680][ T31] audit: type=1326 audit(1789735012.607:301): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6311 comm="syz.2.122" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f174bd9e159 code=0x0 [ 137.433393][ T31] audit: type=1400 audit(1789735012.637:302): avc: denied { write } for pid=6307 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 137.846426][ T6321] rnbd_client L127: Can't parse path ip:127.0.: -22 [ 141.211414][ T6345] can0: slcan on ttyS3. [ 141.755197][ T31] audit: type=1400 audit(1789735016.957:303): avc: denied { setopt } for pid=6347 comm="syz.0.128" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 141.800696][ T6338] can0 (unregistered): slcan off ttyS3. [ 141.801637][ T31] audit: type=1400 audit(1789735017.007:304): avc: denied { read write } for pid=6347 comm="syz.0.128" name="uinput" dev="devtmpfs" ino=914 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 141.801680][ T31] audit: type=1400 audit(1789735017.007:305): avc: denied { open } for pid=6347 comm="syz.0.128" path="/dev/uinput" dev="devtmpfs" ino=914 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 141.885537][ T31] audit: type=1400 audit(1789735017.077:306): avc: denied { write } for pid=6347 comm="syz.0.128" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 142.886837][ T6356] Cannot find add_set index 2 as target [ 142.911489][ T6362] ======================================================= [ 142.911489][ T6362] WARNING: The mand mount option has been deprecated and [ 142.911489][ T6362] and is ignored by this kernel. Remove the mand [ 142.911489][ T6362] option from the mount to silence this warning. [ 142.911489][ T6362] ======================================================= [ 143.002798][ T31] audit: type=1400 audit(1789735018.207:307): avc: denied { create } for pid=6360 comm="syz.1.130" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 143.178012][ T6368] Cannot find add_set index 2 as target [ 143.573892][ T31] audit: type=1400 audit(1789735018.777:308): avc: denied { ioctl } for pid=6360 comm="syz.1.130" path="socket:[10071]" dev="sockfs" ino=10071 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 143.725773][ T31] audit: type=1400 audit(1789735018.927:309): avc: denied { write } for pid=6318 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 143.943722][ T31] audit: type=1400 audit(1789735019.147:310): avc: denied { getopt } for pid=6377 comm="syz.0.134" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 143.954477][ T6378] netlink: 8 bytes leftover after parsing attributes in process `syz.0.134'. [ 143.981920][ T31] audit: type=1400 audit(1789735019.187:311): avc: denied { ioctl } for pid=6377 comm="syz.0.134" path="socket:[10702]" dev="sockfs" ino=10702 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 144.590306][ T6384] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 145.466973][ T31] audit: type=1400 audit(1789735020.667:312): avc: denied { write } for pid=6382 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 145.710980][ T31] audit: type=1400 audit(1789735020.917:313): avc: denied { ioctl } for pid=6388 comm="syz.3.136" path="socket:[10714]" dev="sockfs" ino=10714 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 145.732998][ T6389] syz.3.136 uses obsolete (PF_INET,SOCK_PACKET) [ 145.737101][ T31] audit: type=1400 audit(1789735020.927:314): avc: denied { ioctl } for pid=6388 comm="syz.3.136" path="socket:[10716]" dev="sockfs" ino=10716 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 147.065640][ T31] audit: type=1400 audit(1789735022.267:315): avc: denied { audit_read } for pid=6399 comm="syz.2.138" capability=37 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 147.085108][ T31] audit: type=1400 audit(1789735022.287:316): avc: denied { write } for pid=6399 comm="syz.2.138" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 147.345463][ T192] usb 3-1: new full-speed USB device number 6 using dummy_hcd [ 147.418903][ T6406] rnbd_client L127: Can't parse path ip:127.0.0.: -22 [ 147.501825][ T192] usb 3-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 147.551708][ T192] usb 3-1: config 0 has an invalid interface number: 12 but max is 0 [ 147.551745][ T192] usb 3-1: config 0 has no interface number 0 [ 147.551793][ T192] usb 3-1: config 0 interface 12 altsetting 2 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 147.551825][ T192] usb 3-1: config 0 interface 12 altsetting 2 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 147.551855][ T192] usb 3-1: config 0 interface 12 has no altsetting 0 [ 147.574729][ T192] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 147.574760][ T192] usb 3-1: Product: syz [ 147.574778][ T192] usb 3-1: Manufacturer: syz [ 147.574794][ T192] usb 3-1: SerialNumber: syz [ 147.824819][ T192] usb 3-1: config 0 descriptor?? [ 147.844547][ T6400] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 147.844693][ T6400] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 148.236112][ T6417] fuse: Bad value for 'fd' [ 148.285491][ T31] kauditd_printk_skb: 3 callbacks suppressed [ 148.285514][ T31] audit: type=1400 audit(1789735023.437:320): avc: denied { read write } for pid=6408 comm="syz.3.144" name="fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 148.285568][ T31] audit: type=1400 audit(1789735023.437:321): avc: denied { open } for pid=6408 comm="syz.3.144" path="/dev/fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 148.285611][ T31] audit: type=1400 audit(1789735023.477:322): avc: denied { prog_load } for pid=6408 comm="syz.3.144" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 149.248798][ T192] f81534 3-1:0.12: unsupported endpoint max packet size [ 149.275040][ T192] usb 3-1: USB disconnect, device number 6 [ 150.371211][ T6424] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 150.469118][ T31] audit: type=1400 audit(1789735025.677:323): avc: denied { map_create } for pid=6427 comm="syz.1.145" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 151.808434][ T6433] netlink: 4 bytes leftover after parsing attributes in process `syz.3.147'. [ 151.810997][ T6433] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 152.293912][ T6431] Cannot find add_set index 2 as target [ 152.305454][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 152.317730][ T31] audit: type=1400 audit(1789735026.997:324): avc: denied { map_read map_write } for pid=6426 comm="syz.3.147" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 152.373088][ T6433] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 152.392002][ T6241] IPVS: starting estimator thread 0... [ 152.495494][ T6435] IPVS: using max 33 ests per chain, 79200 per kthread [ 152.576127][ T31] audit: type=1326 audit(1789735027.787:325): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6436 comm="syz.2.148" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f174bd9e159 code=0x0 [ 152.820414][ T6441] Cannot find add_set index 2 as target [ 153.478669][ T6444] loop5: detected capacity change from 0 to 7 [ 153.511961][ T6444] Dev loop5: unable to read RDB block 7 [ 153.512007][ T6444] loop5: AHDI p1 p2 [ 153.512029][ T6444] loop5: partition table partially beyond EOD, truncated [ 153.513290][ T6444] loop5: p1 start 1818582900 is beyond EOD, truncated [ 153.561192][ T31] audit: type=1400 audit(1789735028.767:326): avc: denied { map } for pid=6445 comm="syz.4.152" path="/dev/nullb0" dev="devtmpfs" ino=694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 155.174170][ T6456] rnbd_client L127: Can't parse path ip:127.0.0.: -22 [ 156.614792][ T31] audit: type=1400 audit(1789735031.517:327): avc: denied { ioctl } for pid=6461 comm="syz.0.155" path="user:[4026531837]" dev="nsfs" ino=4026531837 ioctlcmd=0xf50a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 156.851966][ T6473] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 157.077375][ T6471] bond0: ARP target 9.0.0.0 is already present [ 157.078743][ T6471] bond0: option arp_ip_target: invalid value (9) [ 157.110884][ T6471] bond0 (unregistering): Released all slaves [ 157.135718][ T31] audit: type=1400 audit(1789735288.340:328): avc: denied { prog_run } for pid=6479 comm="syz.3.159" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 157.400855][ T6484] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 157.868719][ T5799] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 158.312016][ T5799] usb 4-1: unable to get BOS descriptor or descriptor too short [ 158.344380][ T5799] usb 4-1: not running at top speed; connect to a high speed hub [ 158.344549][ T5799] usb 4-1: New USB device found, idVendor=6666, idProduct=8802, bcdDevice= 0.40 [ 158.397500][ T31] audit: type=1400 audit(1789735289.610:329): avc: denied { read write } for pid=6485 comm="syz.2.161" name="rdma_cm" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 158.397923][ T31] audit: type=1400 audit(1789735289.610:330): avc: denied { open } for pid=6485 comm="syz.2.161" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 158.420619][ T5799] usb 4-1: config 1 interface 0 altsetting 14 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 158.420660][ T5799] usb 4-1: config 1 interface 0 has no altsetting 0 [ 158.505789][ T5799] usb 4-1: string descriptor 0 read error: -22 [ 158.505920][ T5799] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 158.511302][ T6480] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 158.974590][ T5799] smartjoyplus 0003:6666:8802.0001: unknown main item tag 0x2 [ 158.974631][ T5799] smartjoyplus 0003:6666:8802.0001: unknown main item tag 0x0 [ 158.974655][ T5799] smartjoyplus 0003:6666:8802.0001: unknown main item tag 0x0 [ 158.974744][ T5799] smartjoyplus 0003:6666:8802.0001: unknown main item tag 0x0 [ 158.974771][ T5799] smartjoyplus 0003:6666:8802.0001: unknown main item tag 0x0 [ 158.974793][ T5799] smartjoyplus 0003:6666:8802.0001: unknown main item tag 0x0 [ 158.974826][ T5799] smartjoyplus 0003:6666:8802.0001: unknown main item tag 0x0 [ 158.974854][ T5799] smartjoyplus 0003:6666:8802.0001: unknown main item tag 0x0 [ 158.974880][ T5799] smartjoyplus 0003:6666:8802.0001: unknown main item tag 0x0 [ 158.974906][ T5799] smartjoyplus 0003:6666:8802.0001: unknown main item tag 0x0 [ 159.038490][ T5799] smartjoyplus 0003:6666:8802.0001: hidraw0: USB HID v0.0a Keyboard [HID 6666:8802] on usb-dummy_hcd.3-1/input0 [ 159.244278][ T6480] Driver unsupported XDP return value 0 on prog (id 15) dev N/A, expect packet loss! [ 159.533015][ T5709] usb 4-1: USB disconnect, device number 2 [ 160.005751][ T6507] net_ratelimit: 144 callbacks suppressed [ 160.005794][ T6507] netlink: zone id is out of range [ 160.005819][ T6507] netlink: zone id is out of range [ 160.005843][ T6507] netlink: zone id is out of range [ 160.005867][ T6507] netlink: zone id is out of range [ 160.005891][ T6507] netlink: zone id is out of range [ 160.005918][ T6507] netlink: zone id is out of range [ 160.005960][ T6507] netlink: zone id is out of range [ 160.005984][ T6507] netlink: zone id is out of range [ 160.006007][ T6507] netlink: zone id is out of range [ 160.006030][ T6507] netlink: zone id is out of range [ 160.724015][ T31] audit: type=1400 audit(1789735291.930:331): avc: denied { setopt } for pid=6497 comm="syz.4.165" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 161.271475][ T6522] FAULT_INJECTION: forcing a failure. [ 161.271475][ T6522] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 161.271498][ T6522] CPU: 1 UID: 0 PID: 6522 Comm: syz.0.169 Not tainted syzkaller #0 PREEMPT(full) [ 161.271511][ T6522] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 161.271519][ T6522] Call Trace: [ 161.271523][ T6522] [ 161.271528][ T6522] dump_stack_lvl+0x100/0x190 [ 161.271550][ T6522] should_fail_ex.cold+0x5/0xa [ 161.271568][ T6522] _copy_from_user+0x2e/0xd0 [ 161.271582][ T6522] do_ip6t_set_ctl+0x9b8/0xd00 [ 161.271596][ T6522] ? nf_sockopt_find.isra.0+0x222/0x290 [ 161.271611][ T6522] ? nf_sockopt_find.isra.0+0x222/0x290 [ 161.271628][ T6522] ? __pfx_do_ip6t_set_ctl+0x10/0x10 [ 161.271641][ T6522] ? __mutex_unlock_slowpath+0x35d/0x930 [ 161.271659][ T6522] ? get_pid_task+0x106/0x250 [ 161.271675][ T6522] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 161.271698][ T6522] ? nf_sockopt_find.isra.0+0x222/0x290 [ 161.271714][ T6522] nf_setsockopt+0x8d/0xf0 [ 161.271730][ T6522] ipv6_setsockopt+0x135/0x170 [ 161.271746][ T6522] tcp_setsockopt+0xa7/0x100 [ 161.271760][ T6522] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 161.271778][ T6522] do_sock_setsockopt+0xf3/0x1d0 [ 161.271796][ T6522] __sys_setsockopt+0x195/0x220 [ 161.271812][ T6522] __x64_sys_setsockopt+0xbd/0x160 [ 161.271825][ T6522] ? do_syscall_64+0xae/0x790 [ 161.271841][ T6522] ? lockdep_hardirqs_on+0x7d/0x110 [ 161.271857][ T6522] do_syscall_64+0x123/0x790 [ 161.271873][ T6522] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.271886][ T6522] RIP: 0033:0x7efe9319e159 [ 161.271896][ T6522] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 161.271906][ T6522] RSP: 002b:00007efe94040028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 161.271925][ T6522] RAX: ffffffffffffffda RBX: 00007efe93425fa0 RCX: 00007efe9319e159 [ 161.271935][ T6522] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000003 [ 161.271944][ T6522] RBP: 00007efe94040090 R08: 00000000000004d8 R09: 0000000000000000 [ 161.271950][ T6522] R10: 00002000000005c0 R11: 0000000000000246 R12: 0000000000000001 [ 161.271957][ T6522] R13: 00007efe93426038 R14: 00007efe93425fa0 R15: 00007ffc5f1d7d28 [ 161.271973][ T6522] [ 161.345308][ T31] audit: type=1400 audit(1789735548.550:332): avc: denied { setopt } for pid=6524 comm="syz.2.172" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 161.889047][ T6526] Cannot find add_set index 2 as target [ 163.083117][ T6535] VFS: Can't find a Minix filesystem V1 | V2 | V3 on device nullb0. [ 163.514759][ T31] audit: type=1400 audit(1789735550.720:333): avc: denied { execute } for pid=6544 comm="syz.4.178" path="/dev/dsp" dev="devtmpfs" ino=1287 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sound_device_t tclass=chr_file permissive=1 [ 168.697129][ T5709] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 168.877746][ T5709] usb 4-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 168.919133][ T5709] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 168.919206][ T5709] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 168.919568][ T5709] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 169.090252][ T5709] usb 4-1: config 0 descriptor?? [ 170.156994][ T5709] cp2112 0003:10C4:EA90.0002: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.3-1/input0 [ 170.395792][ T31] audit: type=1400 audit(1789735813.607:334): avc: denied { map } for pid=6581 comm="syz.3.173" path="socket:[11657]" dev="sockfs" ino=11657 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 171.232679][ T31] audit: type=1400 audit(1789735814.437:335): avc: denied { read } for pid=6604 comm="syz.0.191" name="btrfs-control" dev="devtmpfs" ino=1313 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 171.242130][ T31] audit: type=1400 audit(1789735814.447:336): avc: denied { open } for pid=6604 comm="syz.0.191" path="/dev/btrfs-control" dev="devtmpfs" ino=1313 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 171.334315][ T31] audit: type=1400 audit(1789735814.537:337): avc: denied { ioctl } for pid=6604 comm="syz.0.191" path="/dev/btrfs-control" dev="devtmpfs" ino=1313 ioctlcmd=0x8903 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 171.581159][ T6609] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 172.045387][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 172.590896][ T31] audit: type=1400 audit(1789735815.797:338): avc: denied { create } for pid=6613 comm="syz.1.193" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 172.619982][ T5709] cp2112 0003:10C4:EA90.0002: error requesting version [ 172.645910][ T5709] cp2112 0003:10C4:EA90.0002: probe with driver cp2112 failed with error -71 [ 172.670430][ T5709] usb 4-1: USB disconnect, device number 3 [ 176.889534][ T31] audit: type=1400 audit(1789735819.977:339): avc: denied { create } for pid=6655 comm="syz.4.196" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 176.889594][ T31] audit: type=1400 audit(1789735820.027:340): avc: denied { bind } for pid=6655 comm="syz.4.196" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 176.889636][ T31] audit: type=1400 audit(1789735820.087:341): avc: denied { read write } for pid=6655 comm="syz.4.196" name="raw-gadget" dev="devtmpfs" ino=814 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 176.890812][ T31] audit: type=1400 audit(1789735820.087:342): avc: denied { open } for pid=6655 comm="syz.4.196" path="/dev/raw-gadget" dev="devtmpfs" ino=814 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 176.891256][ T31] audit: type=1400 audit(1789735820.087:343): avc: denied { ioctl } for pid=6655 comm="syz.4.196" path="/dev/raw-gadget" dev="devtmpfs" ino=814 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 177.175451][ T9] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 177.304341][ T31] audit: type=1400 audit(1789735820.507:344): avc: denied { create } for pid=6658 comm="syz.0.205" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 177.359495][ T6664] FAULT_INJECTION: forcing a failure. [ 177.359495][ T6664] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 177.359531][ T6664] CPU: 1 UID: 0 PID: 6664 Comm: syz.2.206 Not tainted syzkaller #0 PREEMPT(full) [ 177.359556][ T6664] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 177.359570][ T6664] Call Trace: [ 177.359576][ T6664] [ 177.359583][ T6664] dump_stack_lvl+0x100/0x190 [ 177.359620][ T6664] should_fail_ex.cold+0x5/0xa [ 177.359650][ T6664] _copy_from_user+0x2e/0xd0 [ 177.359675][ T6664] kstrtouint_from_user+0xd6/0x1d0 [ 177.359704][ T6664] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 177.359734][ T6664] ? lock_acquire+0x1d1/0x380 [ 177.359763][ T6664] proc_fail_nth_write+0x83/0x220 [ 177.359790][ T6664] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 177.359823][ T6664] vfs_write+0x2aa/0x1050 [ 177.359845][ T6664] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 177.359870][ T6664] ? lock_acquire+0x1d1/0x380 [ 177.359892][ T6664] ? __fget_files+0x34/0x3d0 [ 177.359919][ T6664] ? __pfx_vfs_write+0x10/0x10 [ 177.359938][ T6664] ? find_held_lock+0x2b/0x80 [ 177.359964][ T6664] ? __fget_files+0x215/0x3d0 [ 177.359991][ T6664] ? __fget_files+0x21f/0x3d0 [ 177.360019][ T6664] ksys_write+0x12a/0x250 [ 177.360038][ T6664] ? __pfx_ksys_write+0x10/0x10 [ 177.360067][ T6664] do_syscall_64+0x123/0x790 [ 177.360096][ T6664] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 177.360116][ T6664] RIP: 0033:0x7f174bd5e98e [ 177.360145][ T6664] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 177.360164][ T6664] RSP: 002b:00007f174cce1fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 177.360181][ T6664] RAX: ffffffffffffffda RBX: 00007f174cce26c0 RCX: 00007f174bd5e98e [ 177.360194][ T6664] RDX: 0000000000000001 RSI: 00007f174cce20a0 RDI: 0000000000000003 [ 177.360206][ T6664] RBP: 00007f174cce2090 R08: 0000000000000000 R09: 0000000000000000 [ 177.360217][ T6664] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 177.360228][ T6664] R13: 00007f174c026038 R14: 00007f174c025fa0 R15: 00007ffd88f7ada8 [ 177.360256][ T6664] [ 177.405476][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 177.413602][ T9] usb 5-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice= 0.00 [ 177.437773][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 177.444332][ T9] usb 5-1: config 0 descriptor?? [ 177.451687][ T9] usb 5-1: probing VID:PID(0424:012C) [ 177.453163][ T9] usb 5-1: Could not find two sets of bulk-in/out endpoint pairs [ 177.545494][ T31] audit: type=1400 audit(1789735820.747:345): avc: denied { connect } for pid=6658 comm="syz.0.205" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 177.558827][ T31] audit: type=1400 audit(1789735820.767:346): avc: denied { ioctl } for pid=6658 comm="syz.0.205" path="socket:[12437]" dev="sockfs" ino=12437 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 177.671514][ T6666] net_ratelimit: 144 callbacks suppressed [ 177.671539][ T6666] Set syz1 is full, maxelem 2076 reached [ 177.738721][ T9] vub300 5-1:0.0: probe with driver vub300 failed with error -22 [ 177.794696][ T6669] VFS: Can't find a Minix filesystem V1 | V2 | V3 on device nullb0. [ 177.918394][ T31] audit: type=1400 audit(1789735821.127:347): avc: denied { create } for pid=6655 comm="syz.4.196" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 177.969666][ T9] usb 5-1: USB disconnect, device number 2 [ 178.048193][ T31] audit: type=1400 audit(1789735821.257:348): avc: denied { setopt } for pid=6672 comm="syz.2.208" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 178.078962][ T6673] tipc: Started in network mode [ 178.079000][ T6673] tipc: Node identity 7f000001, cluster identity 4711 [ 178.081502][ T6673] tipc: New replicast peer: 127.0.0.2 [ 178.082217][ T6673] tipc: Enabled bearer , priority 10 [ 179.635665][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 179.901059][ T9] tipc: Node number set to 2130706433 [ 181.266460][ T148] IPVS: starting estimator thread 0... [ 181.355705][ T6689] IPVS: using max 45 ests per chain, 108000 per kthread [ 181.562133][ T6696] VFS: Can't find a Minix filesystem V1 | V2 | V3 on device nullb0. [ 182.368711][ T6700] Cannot find add_set index 2 as target [ 183.337682][ T6709] Cannot find add_set index 2 as target [ 184.755596][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 185.119721][ T31] kauditd_printk_skb: 4 callbacks suppressed [ 185.119741][ T31] audit: type=1326 audit(1789736084.333:353): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6715 comm="syz.4.214" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5b6f79e159 code=0x0 [ 185.576631][ T31] audit: type=1400 audit(1789736084.793:354): avc: denied { create } for pid=6719 comm="syz.2.216" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 185.629616][ T31] audit: type=1400 audit(1789736084.843:355): avc: denied { append } for pid=6719 comm="syz.2.216" name="frontend0" dev="devtmpfs" ino=925 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 185.925475][ T5799] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 186.078783][ T5799] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 186.080492][ T5799] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 186.088074][ T5799] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 186.088112][ T5799] usb 3-1: Product: syz [ 186.088130][ T5799] usb 3-1: Manufacturer: syz [ 186.088147][ T5799] usb 3-1: SerialNumber: syz [ 188.349746][ T5799] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 7 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 188.357937][ T5799] usb 3-1: USB disconnect, device number 7 [ 188.369610][ T5799] usblp0: removed [ 189.763100][ T1309] ieee802154 phy0 wpan0: encryption failed: -22 [ 189.763178][ T1309] ieee802154 phy1 wpan1: encryption failed: -22 [ 189.899109][ T31] audit: type=1400 audit(1789736089.113:356): avc: denied { bind } for pid=6742 comm="syz.2.228" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 190.079007][ T6741] capability: warning: `syz.0.227' uses deprecated v2 capabilities in a way that may be insecure [ 190.831642][ T6749] Cannot find add_set index 2 as target [ 191.098997][ T6759] FAULT_INJECTION: forcing a failure. [ 191.098997][ T6759] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 191.099038][ T6759] CPU: 1 UID: 0 PID: 6759 Comm: syz.4.232 Not tainted syzkaller #0 PREEMPT(full) [ 191.099064][ T6759] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 191.099077][ T6759] Call Trace: [ 191.099085][ T6759] [ 191.099093][ T6759] dump_stack_lvl+0x100/0x190 [ 191.099150][ T6759] should_fail_ex.cold+0x5/0xa [ 191.099182][ T6759] _copy_from_user+0x2e/0xd0 [ 191.099208][ T6759] input_event_from_user+0x123/0x310 [ 191.099240][ T6759] ? __pfx_input_event_from_user+0x10/0x10 [ 191.099270][ T6759] ? __pfx___might_resched+0x10/0x10 [ 191.099290][ T6759] ? input_inject_event+0x198/0x380 [ 191.099323][ T6759] evdev_write+0x342/0x610 [ 191.099366][ T6759] ? __pfx_evdev_write+0x10/0x10 [ 191.099404][ T6759] ? bpf_lsm_file_permission+0x9/0x10 [ 191.099433][ T6759] ? security_file_permission+0x76/0x210 [ 191.099463][ T6759] ? rw_verify_area+0xce/0x6d0 [ 191.099499][ T6759] vfs_write+0x2aa/0x1050 [ 191.099522][ T6759] ? __pfx_evdev_write+0x10/0x10 [ 191.099554][ T6759] ? lock_acquire+0x1d1/0x380 [ 191.099577][ T6759] ? __fget_files+0x34/0x3d0 [ 191.099605][ T6759] ? __pfx_vfs_write+0x10/0x10 [ 191.099626][ T6759] ? find_held_lock+0x2b/0x80 [ 191.099657][ T6759] ? __fget_files+0x215/0x3d0 [ 191.099682][ T6759] ? __fget_files+0x215/0x3d0 [ 191.099714][ T6759] ? __fget_files+0x21f/0x3d0 [ 191.099751][ T6759] ksys_write+0x1f8/0x250 [ 191.099774][ T6759] ? __pfx_ksys_write+0x10/0x10 [ 191.099806][ T6759] do_syscall_64+0x123/0x790 [ 191.099842][ T6759] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 191.099865][ T6759] RIP: 0033:0x7f5b6f79e159 [ 191.099883][ T6759] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 191.099903][ T6759] RSP: 002b:00007f5b7062a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 191.099925][ T6759] RAX: ffffffffffffffda RBX: 00007f5b6fa25fa0 RCX: 00007f5b6f79e159 [ 191.099939][ T6759] RDX: 000000000000fe72 RSI: 0000200000000000 RDI: 0000000000000003 [ 191.099953][ T6759] RBP: 00007f5b7062a090 R08: 0000000000000000 R09: 0000000000000000 [ 191.099967][ T6759] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 191.099987][ T6759] R13: 00007f5b6fa26038 R14: 00007f5b6fa25fa0 R15: 00007fff66eb2ae8 [ 191.100018][ T6759] [ 191.834431][ T4919] Bluetooth: hci2: command 0x0406 tx timeout [ 191.834481][ T4919] Bluetooth: hci1: command 0x0406 tx timeout [ 191.834511][ T4919] Bluetooth: hci3: command 0x0406 tx timeout [ 191.834580][ T5610] Bluetooth: hci4: command 0x0406 tx timeout [ 193.739433][ T31] audit: type=1400 audit(1789736092.953:357): avc: denied { connect } for pid=6770 comm="syz.1.236" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 193.798229][ T31] audit: type=1400 audit(1789736093.013:358): avc: denied { read append } for pid=6770 comm="syz.1.236" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 193.814537][ T31] audit: type=1400 audit(1789736093.013:359): avc: denied { open } for pid=6770 comm="syz.1.236" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 194.388487][ T6773] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 194.414575][ T6773] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 194.553721][ T6773] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 194.553798][ T6773] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 194.616519][ T6773] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 194.616633][ T6773] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 194.676317][ T6773] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 194.676446][ T6773] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 195.119772][ T6771] xt_l2tp: wrong L2TP version: 6 [ 196.497738][ T52] Bluetooth: hci1: command 0x0406 tx timeout [ 196.606012][ T52] Bluetooth: hci3: command 0x0406 tx timeout [ 196.606070][ T52] Bluetooth: hci2: command 0x0406 tx timeout [ 196.685855][ T52] Bluetooth: hci4: command 0x0406 tx timeout [ 196.802687][ T6794] rnbd_client L607: Mapping device /dev/ram0 on session s+, (access_mode: rw, nr_poll_queues: 0) [ 196.820640][ T6794] rtrs_client L2101: : Failed to resolve address, err: -ENODEV [ 196.821009][ T6794] rtrs_client L2644: : init_conns() failed: err=-ENODEV path=@ip:127.0.0.1 [:0] [ 197.590811][ T31] audit: type=1400 audit(1789736096.803:360): avc: denied { ioctl } for pid=6796 comm="syz.1.242" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=12754 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 197.718385][ T6798] FAULT_INJECTION: forcing a failure. [ 197.718385][ T6798] name failslab, interval 1, probability 0, space 0, times 0 [ 197.718455][ T6798] CPU: 0 UID: 0 PID: 6798 Comm: syz.1.242 Not tainted syzkaller #0 PREEMPT(full) [ 197.718502][ T6798] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 197.718516][ T6798] Call Trace: [ 197.718524][ T6798] [ 197.718533][ T6798] dump_stack_lvl+0x100/0x190 [ 197.718574][ T6798] should_fail_ex.cold+0x5/0xa [ 197.718608][ T6798] should_failslab+0xc2/0x120 [ 197.718637][ T6798] __kmalloc_noprof+0xfc/0x840 [ 197.718661][ T6798] ? __pfx_dynamic_dname+0x10/0x10 [ 197.718691][ T6798] ? tomoyo_encode2+0xfb/0x3c0 [ 197.718725][ T6798] tomoyo_encode2+0xfb/0x3c0 [ 197.718757][ T6798] tomoyo_encode+0x29/0x50 [ 197.718783][ T6798] tomoyo_realpath_from_path+0x18c/0x690 [ 197.718818][ T6798] tomoyo_path_number_perm+0x23c/0x580 [ 197.718846][ T6798] ? tomoyo_path_number_perm+0x22e/0x580 [ 197.718872][ T6798] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 197.718896][ T6798] ? find_held_lock+0x2b/0x80 [ 197.718936][ T6798] ? __lock_acquire+0x5c0/0x1f40 [ 197.718976][ T6798] ? __fget_files+0x34/0x3d0 [ 197.719004][ T6798] ? find_held_lock+0x2b/0x80 [ 197.719034][ T6798] ? hook_file_ioctl_common+0x140/0x440 [ 197.719072][ T6798] ? __fget_files+0x21f/0x3d0 [ 197.719104][ T6798] security_file_ioctl+0xd3/0x230 [ 197.719132][ T6798] __x64_sys_ioctl+0xb7/0x210 [ 197.719158][ T6798] do_syscall_64+0x123/0x790 [ 197.719199][ T6798] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 197.719223][ T6798] RIP: 0033:0x7f99a6b9e159 [ 197.719243][ T6798] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 197.719263][ T6798] RSP: 002b:00007f99a7a45028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 197.719287][ T6798] RAX: ffffffffffffffda RBX: 00007f99a6e25fa0 RCX: 00007f99a6b9e159 [ 197.719301][ T6798] RDX: 0000200000000080 RSI: 00000000c020aa07 RDI: 0000000000000003 [ 197.719316][ T6798] RBP: 00007f99a7a45090 R08: 0000000000000000 R09: 0000000000000000 [ 197.719329][ T6798] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 197.719342][ T6798] R13: 00007f99a6e26038 R14: 00007f99a6e25fa0 R15: 00007ffe07cea588 [ 197.719373][ T6798] [ 197.719459][ T6798] ERROR: Out of memory at tomoyo_realpath_from_path. [ 198.535481][ T52] Bluetooth: hci1: command 0x0406 tx timeout [ 198.686207][ T52] Bluetooth: hci3: command 0x0406 tx timeout [ 198.696350][ T52] Bluetooth: hci2: command 0x0406 tx timeout [ 198.777159][ T52] Bluetooth: hci4: command 0x0406 tx timeout [ 199.803567][ T6808] Cannot find add_set index 2 as target [ 200.946512][ T6817] netlink: zone id is out of range [ 200.946529][ T6817] netlink: zone id is out of range [ 200.946538][ T6817] netlink: zone id is out of range [ 200.946546][ T6817] netlink: zone id is out of range [ 200.946554][ T6817] netlink: zone id is out of range [ 200.946562][ T6817] netlink: zone id is out of range [ 200.946583][ T6817] netlink: zone id is out of range [ 200.946591][ T6817] netlink: zone id is out of range [ 200.946599][ T6817] netlink: zone id is out of range [ 200.946606][ T6817] netlink: zone id is out of range [ 200.951304][ T30] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 201.097673][ T30] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 201.098674][ T30] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 201.098723][ T30] usb 5-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 201.103027][ T30] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 201.103059][ T30] usb 5-1: Product: syz [ 201.103077][ T30] usb 5-1: Manufacturer: syz [ 201.103094][ T30] usb 5-1: SerialNumber: syz [ 201.191385][ T30] cdc_ncm 5-1:1.0: skipping garbage [ 201.191420][ T30] cdc_ncm 5-1:1.0: CDC Union missing and no IAD found [ 201.191466][ T30] cdc_ncm 5-1:1.0: bind() failure [ 201.216479][ T30] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 201.216524][ T30] cdc_ncm 5-1:1.1: bind() failure [ 201.432337][ T30] usb 5-1: USB disconnect, device number 3 [ 202.673842][ T6824] FAULT_INJECTION: forcing a failure. [ 202.673842][ T6824] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 202.673876][ T6824] CPU: 1 UID: 0 PID: 6824 Comm: syz.0.249 Not tainted syzkaller #0 PREEMPT(full) [ 202.673911][ T6824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 202.673925][ T6824] Call Trace: [ 202.673932][ T6824] [ 202.673941][ T6824] dump_stack_lvl+0x100/0x190 [ 202.673978][ T6824] should_fail_ex.cold+0x5/0xa [ 202.674011][ T6824] strncpy_from_user+0x3b/0x2d0 [ 202.674042][ T6824] do_getname+0x78/0x390 [ 202.674078][ T6824] __x64_sys_rename+0x57/0xb0 [ 202.674111][ T6824] do_syscall_64+0x123/0x790 [ 202.674146][ T6824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 202.674170][ T6824] RIP: 0033:0x7efe9319e159 [ 202.674189][ T6824] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 202.674210][ T6824] RSP: 002b:00007efe94040028 EFLAGS: 00000246 ORIG_RAX: 0000000000000052 [ 202.674232][ T6824] RAX: ffffffffffffffda RBX: 00007efe93425fa0 RCX: 00007efe9319e159 [ 202.674247][ T6824] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000200000000040 [ 202.674262][ T6824] RBP: 00007efe94040090 R08: 0000000000000000 R09: 0000000000000000 [ 202.674276][ T6824] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 202.674289][ T6824] R13: 00007efe93426038 R14: 00007efe93425fa0 R15: 00007ffc5f1d7d28 [ 202.674320][ T6824] [ 204.325178][ T31] audit: type=1400 audit(1789736103.533:361): avc: denied { write } for pid=6836 comm="syz.0.254" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 204.417276][ T6838] rnbd_client L607: Mapping device /dev/ram0 on session s+, (access_mode: rw, nr_poll_queues: 0) [ 204.441846][ T6838] rtrs_client L2101: : Failed to resolve address, err: -ENODEV [ 204.442244][ T6838] rtrs_client L2644: : init_conns() failed: err=-ENODEV path=@ip:127.0.0.1 [:0] [ 205.570828][ T31] audit: type=1400 audit(1789736104.783:362): avc: denied { write } for pid=6842 comm="syz.0.255" name="tracing_on" dev="tracefs" ino=3277 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 205.607745][ T31] audit: type=1400 audit(1789736104.823:363): avc: denied { ioctl } for pid=6842 comm="syz.0.255" path="/58/dir0/tracing_on" dev="tracefs" ino=3277 ioctlcmd=0xaebf scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 206.052938][ T13] IPVS: starting estimator thread 0... [ 206.730486][ T6849] IPVS: using max 45 ests per chain, 108000 per kthread [ 206.768823][ T6846] Cannot find add_set index 2 as target [ 207.795583][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 210.016931][ T31] audit: type=1400 audit(1789736109.233:364): avc: denied { read write } for pid=6862 comm="syz.1.261" name="sg0" dev="devtmpfs" ino=915 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 210.017423][ T31] audit: type=1400 audit(1789736109.233:365): avc: denied { open } for pid=6862 comm="syz.1.261" path="/dev/sg0" dev="devtmpfs" ino=915 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 210.413368][ T6869] can0: slcan on ttyS3. [ 211.000611][ T6864] can0 (unregistered): slcan off ttyS3. [ 211.544412][ T6874] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 211.827141][ T6874] Can't find a SQUASHFS superblock on nullb0 [ 211.925450][ T973] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 211.990030][ T6888] FAULT_INJECTION: forcing a failure. [ 211.990030][ T6888] name failslab, interval 1, probability 0, space 0, times 0 [ 211.990074][ T6888] CPU: 1 UID: 0 PID: 6888 Comm: syz.4.259 Not tainted syzkaller #0 PREEMPT(full) [ 211.990102][ T6888] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 211.990117][ T6888] Call Trace: [ 211.990127][ T6888] [ 211.990137][ T6888] dump_stack_lvl+0x100/0x190 [ 211.990176][ T6888] should_fail_ex.cold+0x5/0xa [ 211.990209][ T6888] should_failslab+0xc2/0x120 [ 211.990239][ T6888] __kmalloc_noprof+0xfc/0x840 [ 211.990264][ T6888] ? trace_kmalloc+0xeb/0x110 [ 211.990289][ T6888] ? lsm_blob_alloc+0x68/0x90 [ 211.990325][ T6888] lsm_blob_alloc+0x68/0x90 [ 211.990358][ T6888] security_sk_alloc+0x2d/0x290 [ 211.990383][ T6888] sk_prot_alloc+0x12a/0x2a0 [ 211.990421][ T6888] sk_alloc+0x36/0xe80 [ 211.990452][ T6888] bpf_prog_test_run_skb+0x4d2/0x3530 [ 211.990495][ T6888] ? lock_acquire+0x1d1/0x380 [ 211.990518][ T6888] ? __fget_files+0x34/0x3d0 [ 211.990547][ T6888] ? find_held_lock+0x2b/0x80 [ 211.990580][ T6888] ? __fget_files+0x191/0x3d0 [ 211.990614][ T6888] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 211.990658][ T6888] ? fput+0x7c/0x100 [ 211.990695][ T6888] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 211.990723][ T6888] __sys_bpf+0x2265/0x4a30 [ 211.990756][ T6888] ? __pfx___sys_bpf+0x10/0x10 [ 211.990777][ T6888] ? find_held_lock+0x2b/0x80 [ 211.990808][ T6888] ? futex_wake+0x4ea/0x5e0 [ 211.990868][ T6888] ? rcu_read_lock_any_held+0x6a/0x90 [ 211.990901][ T6888] ? find_held_lock+0x2b/0x80 [ 211.990933][ T6888] ? ksys_write+0x190/0x250 [ 211.990956][ T6888] ? ksys_write+0x190/0x250 [ 211.990997][ T6888] ? __x64_sys_futex+0x34f/0x4d0 [ 211.991027][ T6888] ? __x64_sys_futex+0x358/0x4d0 [ 211.991063][ T6888] ? xfd_validate_state+0x129/0x190 [ 211.991093][ T6888] ? __x64_sys_bpf+0xce/0x140 [ 211.991116][ T6888] __x64_sys_bpf+0xce/0x140 [ 211.991139][ T6888] ? do_syscall_64+0xae/0x790 [ 211.991174][ T6888] do_syscall_64+0x123/0x790 [ 211.991213][ T6888] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 211.991240][ T6888] RIP: 0033:0x7f5b6f79e159 [ 211.991262][ T6888] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 211.991285][ T6888] RSP: 002b:00007f5b7062a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 211.991308][ T6888] RAX: ffffffffffffffda RBX: 00007f5b6fa25fa0 RCX: 00007f5b6f79e159 [ 211.991325][ T6888] RDX: 0000000000000050 RSI: 00002000000002c0 RDI: 000000000000000a [ 211.991340][ T6888] RBP: 00007f5b6f83506b R08: 0000000000000000 R09: 0000000000000000 [ 211.991354][ T6888] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 211.991368][ T6888] R13: 00007f5b6fa26038 R14: 00007f5b6fa25fa0 R15: 00007fff66eb2ae8 [ 211.991401][ T6888] [ 212.472600][ T973] usb 4-1: not running at top speed; connect to a high speed hub [ 212.472754][ T973] usb 4-1: New USB device found, idVendor=1b80, idProduct=e309, bcdDevice=1f.40 [ 212.596662][ T973] usb 4-1: config 1 has an invalid interface number: 167 but max is 0 [ 212.596751][ T973] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 212.596783][ T973] usb 4-1: config 1 has no interface number 0 [ 212.596949][ T973] usb 4-1: config 1 interface 167 altsetting 167 endpoint 0x8A has an invalid bInterval 0, changing to 4 [ 212.597010][ T973] usb 4-1: config 1 interface 167 altsetting 167 endpoint 0x8A has invalid wMaxPacketSize 0 [ 212.597042][ T973] usb 4-1: config 1 interface 167 altsetting 167 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 212.597084][ T973] usb 4-1: config 1 interface 167 has no altsetting 0 [ 212.811741][ T973] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 212.811825][ T973] usb 4-1: Product: syz [ 212.811871][ T973] usb 4-1: Manufacturer: syz [ 212.811922][ T973] usb 4-1: SerialNumber: syz [ 213.022121][ T31] audit: type=1400 audit(1789736112.233:366): avc: denied { listen } for pid=6896 comm="syz.1.265" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 213.113705][ T6888] gadgetfs: bound to dummy_udc driver [ 213.121339][ T31] audit: type=1400 audit(1789736112.333:367): avc: denied { accept } for pid=6896 comm="syz.1.265" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 213.152930][ T31] audit: type=1400 audit(1789736112.363:368): avc: denied { write } for pid=6875 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 213.199046][ T6884] netlink: 20 bytes leftover after parsing attributes in process `syz.3.263'. [ 213.223531][ T973] em28xx 4-1:1.167: New device syz syz @ 12 Mbps (1b80:e309, interface 167, class 167) [ 213.223569][ T973] em28xx 4-1:1.167: Device initialization failed. [ 213.223582][ T973] em28xx 4-1:1.167: Device must be connected to a high-speed USB 2.0 port. [ 213.256863][ T973] usb 4-1: USB disconnect, device number 4 [ 213.373432][ T6888] gadgetfs: suspended from state 2 [ 213.395532][ T9] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 213.431184][ T31] audit: type=1400 audit(1789736112.643:369): avc: denied { append } for pid=6904 comm="syz.0.266" name="uprobe_events" dev="tracefs" ino=1075 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 213.445555][ T5702] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 213.558273][ T31] audit: type=1400 audit(1789736112.773:370): avc: denied { unmount } for pid=5602 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 213.559059][ T31] audit: type=1400 audit(1789736112.773:371): avc: denied { write } for pid=6907 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 213.611740][ T5702] usb 2-1: Using ep0 maxpacket: 32 [ 213.709943][ T6902] tc_dump_action: action bad kind [ 213.742436][ T31] audit: type=1326 audit(1789736112.953:372): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6896 comm="syz.1.265" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f99a6b9e159 code=0x7ffc0000 [ 213.742597][ T31] audit: type=1326 audit(1789736112.953:373): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6896 comm="syz.1.265" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f99a6b9e159 code=0x7ffc0000 [ 213.826478][ T6902] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 213.826949][ T6902] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 214.550497][ T6927] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 214.838121][ T6934] Cannot find add_set index 2 as target [ 215.241923][ T6929] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 215.358159][ T6927] Can't find a SQUASHFS superblock on nullb0 [ 215.379496][ T31] kauditd_printk_skb: 17 callbacks suppressed [ 215.379517][ T31] audit: type=1400 audit(1789736114.593:391): avc: denied { ioctl } for pid=6938 comm="syz.0.273" path="socket:[12923]" dev="sockfs" ino=12923 ioctlcmd=0x6628 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 215.581913][ T5702] usb 2-1: unable to get BOS descriptor or descriptor too short [ 215.581963][ T5702] usb 2-1: New USB device found, idVendor=09e8, idProduct=0021, bcdDevice= 0.40 [ 215.588916][ T5702] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 215.588961][ T5702] usb 2-1: can't read configurations, error -71 [ 215.790397][ T31] audit: type=1400 audit(1789736115.003:392): avc: denied { write } for pid=6911 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 216.199986][ T6939] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 216.203767][ T31] audit: type=1400 audit(1789736115.413:393): avc: denied { write } for pid=6954 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 216.205923][ T6939] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 216.207043][ T6939] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 216.207229][ T6939] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 216.433806][ T6961] geneve1: entered promiscuous mode [ 216.670420][ T6973] Can't find a SQUASHFS superblock on nullb0 [ 216.911911][ T6980] VFS: Can't find a Minix filesystem V1 | V2 | V3 on device nullb0. [ 217.179747][ T31] audit: type=1400 audit(1789736116.393:394): avc: denied { setattr } for pid=6981 comm="syz.3.282" path="socket:[12994]" dev="sockfs" ino=12994 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 217.230205][ T31] audit: type=1400 audit(1789736116.443:395): avc: denied { open } for pid=6981 comm="syz.3.282" path="/dev/ttyqb" dev="devtmpfs" ino=386 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 217.259132][ T31] audit: type=1400 audit(1789736116.463:396): avc: denied { ioctl } for pid=6981 comm="syz.3.282" path="socket:[12994]" dev="sockfs" ino=12994 ioctlcmd=0x9411 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 217.364198][ T6987] FAULT_INJECTION: forcing a failure. [ 217.364198][ T6987] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 217.364225][ T6987] CPU: 1 UID: 0 PID: 6987 Comm: syz.4.283 Not tainted syzkaller #0 PREEMPT(full) [ 217.364240][ T6987] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 217.364248][ T6987] Call Trace: [ 217.364252][ T6987] [ 217.364257][ T6987] dump_stack_lvl+0x100/0x190 [ 217.364279][ T6987] should_fail_ex.cold+0x5/0xa [ 217.364298][ T6987] strncpy_from_user+0x3b/0x2d0 [ 217.364315][ T6987] do_getname+0x78/0x390 [ 217.364335][ T6987] __x64_sys_name_to_handle_at+0x1af/0x2d0 [ 217.364350][ T6987] ? __pfx___x64_sys_name_to_handle_at+0x10/0x10 [ 217.364368][ T6987] do_syscall_64+0x123/0x790 [ 217.364388][ T6987] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 217.364401][ T6987] RIP: 0033:0x7f5b6f79e159 [ 217.364411][ T6987] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 217.364423][ T6987] RSP: 002b:00007f5b7062a028 EFLAGS: 00000246 ORIG_RAX: 000000000000012f [ 217.364435][ T6987] RAX: ffffffffffffffda RBX: 00007f5b6fa25fa0 RCX: 00007f5b6f79e159 [ 217.364444][ T6987] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffffffffff9c [ 217.364451][ T6987] RBP: 00007f5b7062a090 R08: 0000000000000600 R09: 0000000000000000 [ 217.364458][ T6987] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 217.364465][ T6987] R13: 00007f5b6fa26038 R14: 00007f5b6fa25fa0 R15: 00007fff66eb2ae8 [ 217.364481][ T6987] [ 217.745549][ T52] Bluetooth: hci1: command 0x0406 tx timeout [ 218.047318][ T6996] can0: slcan on ttyS3. [ 218.205591][ T52] Bluetooth: hci2: command 0x0406 tx timeout [ 218.285514][ T5604] Bluetooth: hci3: command 0x0406 tx timeout [ 218.285596][ T52] Bluetooth: hci4: command 0x0406 tx timeout [ 218.334354][ T31] audit: type=1400 audit(1789736117.543:397): avc: denied { create } for pid=7001 comm="syz.0.288" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 218.360813][ T31] audit: type=1400 audit(1789736117.573:398): avc: denied { ioctl } for pid=7001 comm="syz.0.288" path="socket:[13024]" dev="sockfs" ino=13024 ioctlcmd=0x660f scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 218.578756][ T6990] can0 (unregistered): slcan off ttyS3. [ 218.682870][ T7012] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 218.930596][ T7024] VFS: Can't find a Minix filesystem V1 | V2 | V3 on device nullb0. [ 219.239191][ T5702] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 220.336654][ T5702] usb 4-1: Using ep0 maxpacket: 32 [ 220.391833][ T31] audit: type=1400 audit(1789736119.603:399): avc: denied { write } for pid=7010 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 220.504474][ T7025] tc_dump_action: action bad kind [ 220.583580][ T31] audit: type=1326 audit(1789736119.793:400): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7021 comm="syz.3.291" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f0d39e159 code=0x7ffc0000 [ 220.583640][ T31] audit: type=1326 audit(1789736119.793:401): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7021 comm="syz.3.291" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f0d39e159 code=0x7ffc0000 [ 220.626942][ T31] audit: type=1326 audit(1789736119.833:402): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7021 comm="syz.3.291" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=5 compat=0 ip=0x7f7f0d39e159 code=0x7ffc0000 [ 220.627002][ T31] audit: type=1326 audit(1789736119.833:403): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7021 comm="syz.3.291" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f0d39e159 code=0x7ffc0000 [ 220.627045][ T31] audit: type=1326 audit(1789736119.833:404): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7021 comm="syz.3.291" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f0d39e159 code=0x7ffc0000 [ 220.636769][ T31] audit: type=1326 audit(1789736119.833:405): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7021 comm="syz.3.291" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f7f0d39e159 code=0x7ffc0000 [ 220.636828][ T31] audit: type=1326 audit(1789736119.833:406): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7021 comm="syz.3.291" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f0d39e159 code=0x7ffc0000 [ 220.636898][ T31] audit: type=1326 audit(1789736119.833:407): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7021 comm="syz.3.291" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f0d39e159 code=0x7ffc0000 [ 220.645970][ T7025] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 220.646245][ T31] audit: type=1326 audit(1789736119.853:408): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=7021 comm="syz.3.291" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f7f0d35e98e code=0x7ffc0000 [ 220.652312][ T7025] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 224.038062][ T5702] usb 4-1: unable to get BOS descriptor or descriptor too short [ 224.038118][ T5702] usb 4-1: New USB device found, idVendor=09e8, idProduct=0021, bcdDevice= 0.40 [ 224.048772][ T5702] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 224.048816][ T5702] usb 4-1: can't read configurations, error -71 [ 224.586807][ T7071] can0: slcan on ttyS3. [ 224.663824][ T7069] net_ratelimit: 144 callbacks suppressed [ 224.663863][ T7069] Set syz1 is full, maxelem 2076 reached [ 225.211983][ T7080] VFS: Can't find a Minix filesystem V1 | V2 | V3 on device nullb0. [ 225.267677][ T7068] can0 (unregistered): slcan off ttyS3. [ 226.896289][ T7086] FAULT_INJECTION: forcing a failure. [ 226.896289][ T7086] name failslab, interval 1, probability 0, space 0, times 0 [ 226.896331][ T7086] CPU: 1 UID: 0 PID: 7086 Comm: syz.0.306 Not tainted syzkaller #0 PREEMPT(full) [ 226.896361][ T7086] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 226.896378][ T7086] Call Trace: [ 226.896387][ T7086] [ 226.896397][ T7086] dump_stack_lvl+0x100/0x190 [ 226.896437][ T7086] should_fail_ex.cold+0x5/0xa [ 226.896471][ T7086] should_failslab+0xc2/0x120 [ 226.896503][ T7086] __kmalloc_noprof+0xfc/0x840 [ 226.896526][ T7086] ? trace_kmalloc+0xeb/0x110 [ 226.896558][ T7086] ? lsm_blob_alloc+0x68/0x90 [ 226.896597][ T7086] lsm_blob_alloc+0x68/0x90 [ 226.896631][ T7086] security_sk_alloc+0x2d/0x290 [ 226.896656][ T7086] sk_prot_alloc+0x12a/0x2a0 [ 226.896694][ T7086] sk_alloc+0x36/0xe80 [ 226.896722][ T7086] bpf_prog_test_run_skb+0x4d2/0x3530 [ 226.896754][ T7086] ? lock_acquire+0x1d1/0x380 [ 226.896778][ T7086] ? __fget_files+0x34/0x3d0 [ 226.896812][ T7086] ? irqentry_exit+0x171/0xa10 [ 226.896852][ T7086] ? __pfx_lockdep_hardirqs_on+0x1/0x10 [ 226.896896][ T7086] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 226.896935][ T7086] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 226.896963][ T7086] __sys_bpf+0x2265/0x4a30 [ 226.896996][ T7086] ? __pfx___sys_bpf+0x10/0x10 [ 226.897019][ T7086] ? find_held_lock+0x2b/0x80 [ 226.897064][ T7086] ? futex_wake+0x4ea/0x5e0 [ 226.897123][ T7086] ? rcu_read_lock_any_held+0x6a/0x90 [ 226.897158][ T7086] ? find_held_lock+0x2b/0x80 [ 226.897189][ T7086] ? ksys_write+0x190/0x250 [ 226.897213][ T7086] ? ksys_write+0x190/0x250 [ 226.897255][ T7086] ? __x64_sys_futex+0x34f/0x4d0 [ 226.897292][ T7086] ? __x64_sys_futex+0x358/0x4d0 [ 226.897330][ T7086] ? xfd_validate_state+0x129/0x190 [ 226.897362][ T7086] ? __x64_sys_bpf+0xce/0x140 [ 226.897384][ T7086] __x64_sys_bpf+0xce/0x140 [ 226.897409][ T7086] ? do_syscall_64+0xae/0x790 [ 226.897445][ T7086] do_syscall_64+0x123/0x790 [ 226.897481][ T7086] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 226.897507][ T7086] RIP: 0033:0x7efe9319e159 [ 226.897528][ T7086] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 226.897552][ T7086] RSP: 002b:00007efe94040028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 226.897575][ T7086] RAX: ffffffffffffffda RBX: 00007efe93425fa0 RCX: 00007efe9319e159 [ 226.897591][ T7086] RDX: 0000000000000050 RSI: 00002000000002c0 RDI: 000000000000000a [ 226.897606][ T7086] RBP: 00007efe9323506b R08: 0000000000000000 R09: 0000000000000000 [ 226.897621][ T7086] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 226.897635][ T7086] R13: 00007efe93426038 R14: 00007efe93425fa0 R15: 00007ffc5f1d7d28 [ 226.897666][ T7086] [ 227.019366][ T7086] gadgetfs: bound to dummy_udc driver [ 227.042471][ T31] kauditd_printk_skb: 19 callbacks suppressed [ 227.042489][ T31] audit: type=1400 audit(1789736126.253:428): avc: denied { node_bind } for pid=7094 comm="syz.1.300" saddr=::1 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=sctp_socket permissive=1 [ 227.256188][ T973] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 227.256456][ C0] gadgetfs: connected [ 227.257138][ T973] gadgetfs: disconnected [ 228.528885][ T7104] Cannot find add_set index 2 as target [ 229.751481][ T6241] IPVS: starting estimator thread 0... [ 229.835690][ T7114] IPVS: using max 64 ests per chain, 153600 per kthread [ 229.998806][ T7101] Can't find a SQUASHFS superblock on nullb0 [ 230.901962][ T7123] FAULT_INJECTION: forcing a failure. [ 230.901962][ T7123] name failslab, interval 1, probability 0, space 0, times 0 [ 230.902001][ T7123] CPU: 1 UID: 0 PID: 7123 Comm: syz.4.311 Not tainted syzkaller #0 PREEMPT(full) [ 230.902029][ T7123] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 230.902044][ T7123] Call Trace: [ 230.902052][ T7123] [ 230.902061][ T7123] dump_stack_lvl+0x100/0x190 [ 230.902102][ T7123] should_fail_ex.cold+0x5/0xa [ 230.902136][ T7123] should_failslab+0xc2/0x120 [ 230.902168][ T7123] __kmalloc_noprof+0xfc/0x840 [ 230.902197][ T7123] ? trace_kmalloc+0xeb/0x110 [ 230.902228][ T7123] ? lsm_blob_alloc+0x68/0x90 [ 230.902269][ T7123] lsm_blob_alloc+0x68/0x90 [ 230.902302][ T7123] security_sk_alloc+0x2d/0x290 [ 230.902326][ T7123] sk_prot_alloc+0x12a/0x2a0 [ 230.902366][ T7123] sk_alloc+0x36/0xe80 [ 230.902396][ T7123] bpf_prog_test_run_skb+0x4d2/0x3530 [ 230.902428][ T7123] ? lock_acquire+0x1d1/0x380 [ 230.902453][ T7123] ? __fget_files+0x34/0x3d0 [ 230.902483][ T7123] ? find_held_lock+0x2b/0x80 [ 230.902515][ T7123] ? __fget_files+0x191/0x3d0 [ 230.902551][ T7123] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 230.902582][ T7123] ? fput+0x7c/0x100 [ 230.902614][ T7123] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 230.902641][ T7123] __sys_bpf+0x2265/0x4a30 [ 230.902674][ T7123] ? __pfx___sys_bpf+0x10/0x10 [ 230.902706][ T7123] ? find_held_lock+0x2b/0x80 [ 230.902740][ T7123] ? futex_wake+0x4ea/0x5e0 [ 230.902802][ T7123] ? rcu_read_lock_any_held+0x6a/0x90 [ 230.902846][ T7123] ? find_held_lock+0x2b/0x80 [ 230.902879][ T7123] ? ksys_write+0x190/0x250 [ 230.902902][ T7123] ? ksys_write+0x190/0x250 [ 230.902945][ T7123] ? __x64_sys_futex+0x34f/0x4d0 [ 230.902975][ T7123] ? __x64_sys_futex+0x358/0x4d0 [ 230.903010][ T7123] ? xfd_validate_state+0x129/0x190 [ 230.903041][ T7123] ? __x64_sys_bpf+0xce/0x140 [ 230.903063][ T7123] __x64_sys_bpf+0xce/0x140 [ 230.903088][ T7123] ? do_syscall_64+0xae/0x790 [ 230.903123][ T7123] do_syscall_64+0x123/0x790 [ 230.903159][ T7123] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 230.903184][ T7123] RIP: 0033:0x7f5b6f79e159 [ 230.903204][ T7123] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 230.903226][ T7123] RSP: 002b:00007f5b7062a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 230.903250][ T7123] RAX: ffffffffffffffda RBX: 00007f5b6fa25fa0 RCX: 00007f5b6f79e159 [ 230.903266][ T7123] RDX: 0000000000000050 RSI: 00002000000002c0 RDI: 000000000000000a [ 230.903282][ T7123] RBP: 00007f5b6f83506b R08: 0000000000000000 R09: 0000000000000000 [ 230.903298][ T7123] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 230.903311][ T7123] R13: 00007f5b6fa26038 R14: 00007f5b6fa25fa0 R15: 00007fff66eb2ae8 [ 230.903343][ T7123] [ 231.431504][ T7123] gadgetfs: bound to dummy_udc driver [ 232.996072][ T5732] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 233.259852][ T31] audit: type=1400 audit(1789736132.423:429): avc: denied { write } for pid=7142 comm="syz.0.319" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 233.591686][ T5732] usb 4-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 233.604665][ T5732] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 233.604704][ T5732] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 233.604742][ T5732] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 233.642820][ T5732] usb 4-1: config 0 descriptor?? [ 233.891116][ T31] audit: type=1400 audit(1789736133.103:430): avc: denied { create } for pid=7153 comm="syz.1.320" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 233.915653][ T31] audit: type=1400 audit(1789736133.113:431): avc: denied { write } for pid=7153 comm="syz.1.320" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 234.257366][ T5732] cp2112 0003:10C4:EA90.0003: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.3-1/input0 [ 234.405991][ T5799] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 234.565555][ T5799] usb 2-1: New USB device found, idVendor=0bda, idProduct=0129, bcdDevice= 1.00 [ 234.588549][ T5799] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 235.039247][ T5799] rtsx_usb 2-1:1.0: probe with driver rtsx_usb failed with error -71 [ 235.059149][ T5799] usb 2-1: USB disconnect, device number 4 [ 237.124921][ T31] audit: type=1400 audit(1789736136.333:432): avc: denied { mount } for pid=7165 comm="syz.0.323" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 237.209464][ T31] audit: type=1400 audit(1789736136.423:433): avc: denied { cmd } for pid=7167 comm="iou-wrk-7168" path="socket:[13291]" dev="sockfs" ino=13291 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 237.211845][ T7163] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 237.368578][ T5732] cp2112 0003:10C4:EA90.0003: error requesting version [ 237.386286][ T5732] cp2112 0003:10C4:EA90.0003: probe with driver cp2112 failed with error -71 [ 237.423547][ T5732] usb 4-1: USB disconnect, device number 7 [ 237.511070][ T7163] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 237.728760][ T7163] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 238.526760][ T7163] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 238.940026][ T31] audit: type=1400 audit(1789736138.153:434): avc: denied { write } for pid=7183 comm="syz.0.327" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 239.450176][ T31] audit: type=1400 audit(1789736138.663:435): avc: denied { read } for pid=7193 comm="syz.3.331" name="kcore" dev="proc" ino=4026532046 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_kcore_t tclass=file permissive=1 [ 239.454136][ T31] audit: type=1400 audit(1789736138.663:436): avc: denied { open } for pid=7193 comm="syz.3.331" path="/63/proc_mnt/kcore" dev="proc" ino=4026532046 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_kcore_t tclass=file permissive=1 [ 240.302199][ T31] audit: type=1400 audit(1789736139.513:437): avc: denied { mount } for pid=7196 comm="syz.0.332" name="/" dev="configfs" ino=33 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 240.372894][ T31] audit: type=1400 audit(1789736139.583:438): avc: denied { search } for pid=7196 comm="syz.0.332" name="/" dev="configfs" ino=33 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 240.397829][ T31] audit: type=1400 audit(1789736139.593:439): avc: denied { search } for pid=7196 comm="syz.0.332" name="/" dev="configfs" ino=33 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 240.397898][ T31] audit: type=1400 audit(1789736139.603:440): avc: denied { read } for pid=7196 comm="syz.0.332" name="/" dev="configfs" ino=33 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 240.397944][ T31] audit: type=1400 audit(1789736139.603:441): avc: denied { read open } for pid=7196 comm="syz.0.332" path="/" dev="configfs" ino=33 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 241.341659][ T7217] netlink: 32 bytes leftover after parsing attributes in process `syz.0.335'. [ 247.170183][ T5604] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 247.184049][ T5604] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 247.195669][ T5604] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 247.206330][ T5604] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 247.208549][ T5604] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 247.246684][ T2029] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 247.410436][ T2029] usb 2-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 247.562783][ T2029] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 247.736013][ T5799] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 247.916346][ T5799] usb 1-1: New USB device found, idVendor=2040, idProduct=7500, bcdDevice= 1.00 [ 247.917622][ T5799] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 248.035918][ T5799] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 248.035965][ T5799] usb 1-1: Product: syz [ 248.035976][ T5799] usb 1-1: Manufacturer: syz [ 248.035986][ T5799] usb 1-1: SerialNumber: syz [ 248.780799][ T5799] pvrusb2: Hardware description: WinTV HVR-1950 Model 750xx [ 250.382083][ T31] audit: type=1400 audit(1789736148.703:442): avc: denied { mount } for pid=7257 comm="syz.2.345" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 250.382166][ T31] audit: type=1400 audit(1789736149.593:443): avc: denied { unmount } for pid=5609 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 250.409194][ T5604] Bluetooth: hci5: command tx timeout [ 250.448423][ T1309] ieee802154 phy0 wpan0: encryption failed: -22 [ 250.448487][ T1309] ieee802154 phy1 wpan1: encryption failed: -22 [ 250.508695][ T5799] usb 1-1: USB disconnect, device number 5 [ 250.622939][ T2029] cxacru 2-1:1.0: send of cm 0x84 failed (-71) [ 250.623033][ T2029] ATM dev 0: cxacru_atm_start: CHIP_ADSL_LINE_START returned -71 [ 250.644102][ T2029] cxacru 2-1:1.0: send of cm 0x88 failed (-71) [ 250.644185][ T2029] ATM dev 0: poll status: error -71 [ 250.644226][ T2029] ATM dev 0: polling disabled, set adsl_state to 'start' or 'poll' to resume [ 250.644747][ C1] ATM dev 0: usbatm_complete: urb 0xffff88807c9c1f00 failed (-71)! [ 250.644827][ C1] ATM dev 0: usbatm_complete: urb 0xffff88807c9c1d00 failed (-71)! [ 250.644882][ C1] ATM dev 0: usbatm_complete: urb 0xffff88807c9c1500 failed (-71)! [ 250.644936][ C1] ATM dev 0: usbatm_complete: urb 0xffff88802c5aa800 failed (-71)! [ 250.707013][ T2355] usb 1-1: Direct firmware load for v4l-pvrusb2-73xxx-01.fw failed with error -2 [ 250.709492][ T31] audit: type=1400 audit(1789736149.923:444): avc: denied { firmware_load } for pid=2355 comm="pvrusb2-context" scontext=system_u:system_r:kernel_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 250.726266][ T2355] usb 1-1: Falling back to sysfs fallback for: v4l-pvrusb2-73xxx-01.fw [ 250.747980][ C1] ATM dev 0: usbatm_complete: urb 0xffff88807c9c1f00 failed (-71)! [ 250.787369][ T2029] usb 2-1: USB disconnect, device number 5 [ 252.448302][ T5604] Bluetooth: hci5: command tx timeout [ 254.141547][ T12] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 254.141588][ T12] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 254.528603][ T5604] Bluetooth: hci5: command tx timeout [ 254.548579][ T12] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 254.548621][ T12] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 255.319122][ T12] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 255.319163][ T12] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 255.565064][ T31] kauditd_printk_skb: 15 callbacks suppressed [ 255.565086][ T31] audit: type=1400 audit(1789736154.773:447): avc: denied { watch watch_reads } for pid=7298 comm="syz.0.356" path="/90/file1" dev="tmpfs" ino=526 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 255.607643][ T31] audit: type=1400 audit(1789736154.823:448): avc: denied { read write } for pid=7300 comm="syz.2.357" name="video3" dev="devtmpfs" ino=933 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 255.608337][ T31] audit: type=1400 audit(1789736154.823:449): avc: denied { open } for pid=7300 comm="syz.2.357" path="/dev/video3" dev="devtmpfs" ino=933 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 255.639693][ T31] audit: type=1400 audit(1789736154.833:450): avc: denied { ioctl } for pid=7300 comm="syz.2.357" path="/dev/video3" dev="devtmpfs" ino=933 ioctlcmd=0x5608 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 255.753125][ T7301] syz.2.357 invoked oom-killer: gfp_mask=0x400cc0(GFP_KERNEL_ACCOUNT), order=0, oom_score_adj=1000 [ 255.753163][ T7301] CPU: 0 UID: 0 PID: 7301 Comm: syz.2.357 Not tainted syzkaller #0 PREEMPT(full) [ 255.753181][ T7301] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 255.753194][ T7301] Call Trace: [ 255.753201][ T7301] [ 255.753206][ T7301] dump_stack_lvl+0x100/0x190 [ 255.753238][ T7301] dump_header+0xfb/0x606 [ 255.753257][ T7301] oom_kill_process.cold+0xd/0x380 [ 255.753276][ T7301] out_of_memory+0x340/0x14f0 [ 255.753298][ T7301] ? __pfx_out_of_memory+0x10/0x10 [ 255.753319][ T7301] mem_cgroup_out_of_memory+0xc6/0x130 [ 255.753334][ T7301] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 255.753347][ T7301] ? find_held_lock+0x2b/0x80 [ 255.753372][ T7301] ? do_raw_spin_unlock+0x145/0x1e0 [ 255.753389][ T7301] ? _raw_spin_unlock+0x28/0x50 [ 255.753406][ T7301] try_charge_memcg+0x783/0xf60 [ 255.753429][ T7301] ? __pfx_try_charge_memcg+0x10/0x10 [ 255.753447][ T7301] ? find_held_lock+0x2b/0x80 [ 255.753464][ T7301] ? rcu_read_unlock+0x17/0x60 [ 255.753482][ T7301] ? rcu_read_unlock+0x17/0x60 [ 255.753506][ T7301] obj_cgroup_charge_pages+0x2b/0x1f0 [ 255.753544][ T7301] __memcg_slab_post_alloc_hook+0x47f/0x10c0 [ 255.753567][ T7301] ? kasan_unpoison+0x27/0x60 [ 255.753582][ T7301] __kvmalloc_node_noprof+0x750/0x9b0 [ 255.753595][ T7301] ? __might_fault+0x51/0x140 [ 255.753614][ T7301] ? xt_alloc_table_info+0x44/0xa0 [ 255.753633][ T7301] xt_alloc_table_info+0x44/0xa0 [ 255.753648][ T7301] do_ip6t_set_ctl+0x611/0xd00 [ 255.753663][ T7301] ? nf_sockopt_find.isra.0+0x222/0x290 [ 255.753679][ T7301] ? nf_sockopt_find.isra.0+0x222/0x290 [ 255.753697][ T7301] ? __pfx_do_ip6t_set_ctl+0x10/0x10 [ 255.753711][ T7301] ? __mutex_unlock_slowpath+0x35d/0x930 [ 255.753732][ T7301] ? futex_wait+0x11e/0x370 [ 255.753745][ T7301] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 255.753780][ T7301] ? nf_sockopt_find.isra.0+0x222/0x290 [ 255.753799][ T7301] nf_setsockopt+0x8d/0xf0 [ 255.753818][ T7301] ipv6_setsockopt+0x135/0x170 [ 255.753838][ T7301] udpv6_setsockopt+0x64/0xb0 [ 255.753857][ T7301] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 255.753877][ T7301] do_sock_setsockopt+0xf3/0x1d0 [ 255.753896][ T7301] __sys_setsockopt+0x195/0x220 [ 255.753913][ T7301] __x64_sys_setsockopt+0xbd/0x160 [ 255.753927][ T7301] ? do_syscall_64+0xae/0x790 [ 255.753943][ T7301] ? lockdep_hardirqs_on+0x7d/0x110 [ 255.753960][ T7301] do_syscall_64+0x123/0x790 [ 255.753978][ T7301] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 255.753992][ T7301] RIP: 0033:0x7f174bd9e159 [ 255.754005][ T7301] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 255.754017][ T7301] RSP: 002b:00007f174cce2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 255.754034][ T7301] RAX: ffffffffffffffda RBX: 00007f174c025fa0 RCX: 00007f174bd9e159 [ 255.754042][ T7301] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 000000000000000a [ 255.754050][ T7301] RBP: 00007f174be3506b R08: 00000000000002f0 R09: 0000000000000000 [ 255.754059][ T7301] R10: 00002000000004c0 R11: 0000000000000246 R12: 0000000000000000 [ 255.754067][ T7301] R13: 00007f174c026038 R14: 00007f174c025fa0 R15: 00007ffd88f7ada8 [ 255.754088][ T7301] [ 255.765073][ T12] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 255.765117][ T12] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 255.779369][ T7301] memory: usage 8kB, limit 8kB, failcnt 21 [ 255.779395][ T7301] memory+swap: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 255.779410][ T7301] kmem: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 255.779424][ T7301] Memory cgroup stats for /syz2/test: [ 255.779903][ T7301] cache 0 [ 255.779914][ T7301] rss 0 [ 255.779921][ T7301] rss_huge 0 [ 255.779929][ T7301] shmem 0 [ 255.779937][ T7301] mapped_file 0 [ 255.779945][ T7301] dirty 0 [ 255.779952][ T7301] writeback 0 [ 255.779959][ T7301] workingset_refault_anon 0 [ 255.779968][ T7301] workingset_refault_file 0 [ 255.779978][ T7301] swap 0 [ 255.779986][ T7301] swapcached 0 [ 255.779994][ T7301] pgpgin 0 [ 255.780002][ T7301] pgpgout 0 [ 255.780010][ T7301] pgfault 0 [ 255.780017][ T7301] pgmajfault 0 [ 255.780026][ T7301] inactive_anon 0 [ 255.780034][ T7301] active_anon 0 [ 255.780042][ T7301] inactive_file 0 [ 255.780050][ T7301] active_file 0 [ 255.780057][ T7301] unevictable 0 [ 255.780065][ T7301] hierarchical_memory_limit 8192 [ 255.780075][ T7301] hierarchical_memsw_limit 9223372036854771712 [ 255.780085][ T7301] total_cache 0 [ 255.780092][ T7301] total_rss 0 [ 255.780100][ T7301] total_rss_huge 0 [ 255.780110][ T7301] total_shmem 0 [ 255.780117][ T7301] total_mapped_file 0 [ 255.780126][ T7301] total_dirty 0 [ 255.780133][ T7301] total_writeback 0 [ 255.780142][ T7301] total_workingset_refault_anon 0 [ 255.780151][ T7301] total_workingset_refault_file 0 [ 255.780160][ T7301] total_swap 0 [ 255.780168][ T7301] total_swapcached 0 [ 255.780176][ T7301] total_pgpgin 0 [ 255.780184][ T7301] total_pgpgout 0 [ 255.780192][ T7301] total_pgfault 0 [ 255.780200][ T7301] total_pgmajfault 0 [ 255.780208][ T7301] total_inactive_anon 0 [ 255.780217][ T7301] total_active_anon 0 [ 255.780225][ T7301] total_inactive_file 0 [ 255.780233][ T7301] total_active_file 0 [ 255.780241][ T7301] total_unevictable 0 [ 255.780250][ T7301] anon_cost 0 [ 255.780257][ T7301] file_cost 0 [ 255.780265][ T7301] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz2/test,task_memcg=/syz2/test,task=syz.2.357,pid=7300,uid=0 [ 255.823725][ T7301] Memory cgroup out of memory: Killed process 7300 (syz.2.357) total-vm:104300kB, anon-rss:1428kB, file-rss:23104kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 256.156526][ T7308] Cannot find add_set index 2 as target [ 256.438916][ T31] audit: type=1400 audit(1789736155.653:451): avc: denied { append } for pid=7306 comm="syz.3.354" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 256.517953][ T31] audit: type=1400 audit(1789736155.733:452): avc: denied { create } for pid=7312 comm="syz.0.360" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 256.519560][ T31] audit: type=1400 audit(1789736155.733:453): avc: denied { ioctl } for pid=7312 comm="syz.0.360" path="socket:[14302]" dev="sockfs" ino=14302 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 256.520969][ T31] audit: type=1400 audit(1789736155.733:454): avc: denied { bind } for pid=7312 comm="syz.0.360" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 256.521546][ T31] audit: type=1400 audit(1789736155.733:455): avc: denied { setopt } for pid=7312 comm="syz.0.360" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 256.523206][ T31] audit: type=1400 audit(1789736155.733:456): avc: denied { write } for pid=7312 comm="syz.0.360" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 256.610770][ T5604] Bluetooth: hci5: command tx timeout [ 257.282026][ T7324] Bluetooth: MGMT ver 1.23 [ 258.035514][ T5709] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 258.186503][ T5709] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 258.188049][ T5709] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 258.188085][ T5709] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 258.188111][ T5709] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 258.188155][ T5709] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 258.276988][ T5709] usb 4-1: config 0 descriptor?? [ 258.448602][ T7239] bridge0: port 1(bridge_slave_0) entered blocking state [ 258.449319][ T7239] bridge0: port 1(bridge_slave_0) entered disabled state [ 258.449515][ T7239] bridge_slave_0: entered allmulticast mode [ 258.453734][ T7239] bridge_slave_0: entered promiscuous mode [ 259.923888][ T7239] bridge0: port 2(bridge_slave_1) entered blocking state [ 259.923972][ T7239] bridge0: port 2(bridge_slave_1) entered disabled state [ 259.924083][ T7239] bridge_slave_1: entered allmulticast mode [ 259.933235][ T7239] bridge_slave_1: entered promiscuous mode [ 260.148584][ T5709] plantronics 0003:047F:FFFF.0004: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 260.197314][ T12] bridge_slave_1: left allmulticast mode [ 260.197369][ T12] bridge_slave_1: left promiscuous mode [ 260.199695][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 260.249189][ T12] bridge_slave_0: left allmulticast mode [ 260.249224][ T12] bridge_slave_0: left promiscuous mode [ 260.249480][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 260.510355][ T7356] gfs2: error -5 reading superblock [ 260.567173][ T31] kauditd_printk_skb: 5 callbacks suppressed [ 260.567204][ T31] audit: type=1400 audit(1789736159.783:462): avc: denied { write } for pid=7350 comm="syz.2.368" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 261.636693][ T5732] usb 4-1: reset high-speed USB device number 8 using dummy_hcd [ 261.650059][ T7365] Bluetooth: MGMT ver 1.23 [ 262.229796][ T31] audit: type=1400 audit(1789736161.433:463): avc: denied { write } for pid=7348 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 262.609384][ T7373] FAULT_INJECTION: forcing a failure. [ 262.609384][ T7373] name failslab, interval 1, probability 0, space 0, times 0 [ 262.609435][ T7373] CPU: 1 UID: 0 PID: 7373 Comm: syz.0.373 Not tainted syzkaller #0 PREEMPT(full) [ 262.609464][ T7373] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 262.609479][ T7373] Call Trace: [ 262.609488][ T7373] [ 262.609497][ T7373] dump_stack_lvl+0x100/0x190 [ 262.609539][ T7373] should_fail_ex.cold+0x5/0xa [ 262.609581][ T7373] should_failslab+0xc2/0x120 [ 262.609614][ T7373] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 262.609645][ T7373] ? lockdep_hardirqs_on+0x7d/0x110 [ 262.609678][ T7373] ? vfs_parse_fs_qstr+0x112/0x1c0 [ 262.609720][ T7373] kmemdup_nul+0x49/0xd0 [ 262.609759][ T7373] vfs_parse_fs_qstr+0x112/0x1c0 [ 262.609794][ T7373] ? __pfx_vfs_parse_fs_qstr+0x10/0x10 [ 262.609838][ T7373] ? __pfx_vfs_parse_comma_sep+0x10/0x10 [ 262.609874][ T7373] ? __pfx_vfs_parse_comma_sep+0x10/0x10 [ 262.609908][ T7373] vfs_parse_monolithic_sep+0x195/0x210 [ 262.609946][ T7373] ? __pfx_vfs_parse_monolithic_sep+0x10/0x10 [ 262.609980][ T7373] ? v9fs_init_fs_context+0x465/0x5c0 [ 262.610017][ T7373] ? alloc_fs_context+0x65a/0xf40 [ 262.610057][ T7373] path_mount+0x77f/0x24c0 [ 262.610094][ T7373] ? __pfx_path_mount+0x10/0x10 [ 262.610140][ T7373] ? lockdep_hardirqs_on+0x7d/0x110 [ 262.610178][ T7373] ? putname+0xb1/0x110 [ 262.610207][ T7373] ? kmem_cache_free+0x127/0x6c0 [ 262.610253][ T7373] ? __x64_sys_mount+0x293/0x310 [ 262.610286][ T7373] __x64_sys_mount+0x293/0x310 [ 262.610322][ T7373] ? __pfx___x64_sys_mount+0x10/0x10 [ 262.610367][ T7373] do_syscall_64+0x123/0x790 [ 262.610403][ T7373] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 262.610427][ T7373] RIP: 0033:0x7efe9319e159 [ 262.610465][ T7373] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 262.610487][ T7373] RSP: 002b:00007efe94040028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 262.610511][ T7373] RAX: ffffffffffffffda RBX: 00007efe93425fa0 RCX: 00007efe9319e159 [ 262.610527][ T7373] RDX: 00002000000000c0 RSI: 0000200000000040 RDI: 0000000000000000 [ 262.610541][ T7373] RBP: 00007efe9323506b R08: 0000200000000800 R09: 0000000000000000 [ 262.610557][ T7373] R10: 0000000000800006 R11: 0000000000000246 R12: 0000000000000000 [ 262.610579][ T7373] R13: 00007efe93426038 R14: 00007efe93425fa0 R15: 00007ffc5f1d7d28 [ 262.610613][ T7373] [ 262.610675][ T31] audit: type=1400 audit(1789736161.823:464): avc: denied { mounton } for pid=7372 comm="syz.0.373" path="/96/proc/337/task/338/fail-nth" dev="proc" ino=15525 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=file permissive=1 [ 262.831879][ T973] usb 4-1: USB disconnect, device number 8 [ 262.907344][ T31] audit: type=1400 audit(1789736162.123:465): avc: denied { write } for pid=7374 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 263.352501][ T31] audit: type=1400 audit(1789736162.453:466): avc: denied { mounton } for pid=7375 comm="syz.3.374" path="/75/file0" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=dir permissive=1 [ 263.390476][ T7384] netlink: 'syz.0.375': attribute type 4 has an invalid length. [ 264.100472][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 264.104642][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 264.126569][ T12] bond0 (unregistering): Released all slaves [ 264.141105][ T7239] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 264.163572][ T5264] 8021q: adding VLAN 0 to HW filter on device eth1 [ 264.239684][ T7239] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 264.345979][ T7239] team0: Port device team_slave_0 added [ 264.357579][ T7239] team0: Port device team_slave_1 added [ 265.463173][ T7239] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 265.463194][ T7239] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 265.463223][ T7239] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 266.046312][ T7239] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 266.046343][ T7239] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 266.046369][ T7239] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 267.460541][ T31] audit: type=1400 audit(1789736166.673:467): avc: denied { write } for pid=7398 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 267.475280][ T7239] hsr_slave_0: entered promiscuous mode [ 268.031877][ T7239] hsr_slave_1: entered promiscuous mode [ 268.033127][ T7239] debugfs: 'hsr0' already exists in 'hsr' [ 268.033172][ T7239] Cannot create hsr debugfs directory [ 268.224410][ T31] audit: type=1400 audit(1789736167.433:468): avc: denied { write } for pid=7427 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 268.379130][ T5264] 8021q: adding VLAN 0 to HW filter on device eth2 [ 268.424189][ T31] audit: type=1400 audit(1789736167.633:469): avc: denied { mounton } for pid=7432 comm="syz.0.384" path="/100/file0" dev="tmpfs" ino=578 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 269.665565][ T31] audit: type=1400 audit(1789736168.263:470): avc: denied { write } for pid=7435 comm="syz.1.385" name="usb_gadget" dev="configfs" ino=2836 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 269.665624][ T31] audit: type=1400 audit(1789736168.273:471): avc: denied { add_name } for pid=7435 comm="syz.1.385" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 269.665660][ T31] audit: type=1400 audit(1789736168.273:472): avc: denied { create } for pid=7435 comm="syz.1.385" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 269.665697][ T31] audit: type=1400 audit(1789736168.323:473): avc: denied { write } for pid=7435 comm="syz.1.385" name="configs" dev="configfs" ino=14859 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 269.665737][ T31] audit: type=1400 audit(1789736168.353:474): avc: denied { write } for pid=7435 comm="syz.1.385" name="c.1" dev="configfs" ino=14863 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 269.665782][ T31] audit: type=1400 audit(1789736168.353:475): avc: denied { create } for pid=7435 comm="syz.1.385" name="geth.usb0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=lnk_file permissive=1 [ 269.767856][ T31] audit: type=1400 audit(1789736168.953:476): avc: denied { unmount } for pid=7432 comm="syz.0.384" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 270.301619][ T12] hsr_slave_0: left promiscuous mode [ 270.325224][ T12] hsr_slave_1: left promiscuous mode [ 270.332698][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 270.332746][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 270.344071][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 270.344096][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 270.391970][ T12] veth1_macvtap: left promiscuous mode [ 270.392028][ T12] veth0_macvtap: left promiscuous mode [ 270.392134][ T12] veth1_vlan: left promiscuous mode [ 270.392941][ T12] veth0_vlan: left promiscuous mode [ 270.842671][ T7457] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[5599] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[7457] [ 272.888438][ T12] team0 (unregistering): Port device team_slave_1 removed [ 272.940801][ T12] team0 (unregistering): Port device team_slave_0 removed [ 273.724384][ T31] kauditd_printk_skb: 1 callbacks suppressed [ 273.724405][ T31] audit: type=1400 audit(1789736172.923:478): avc: denied { write } for pid=7481 comm="syz.3.400" name="idVendor" dev="configfs" ino=14924 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 273.724442][ T31] audit: type=1400 audit(1789736172.923:479): avc: denied { open } for pid=7481 comm="syz.3.400" path="/82/config/usb_gadget/g1/idVendor" dev="configfs" ino=14924 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 273.787431][ T31] audit: type=1400 audit(1789736173.003:480): avc: denied { write } for pid=7481 comm="syz.3.400" name="strings" dev="configfs" ino=14860 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 273.837591][ T31] audit: type=1400 audit(1789736173.053:481): avc: denied { write } for pid=7481 comm="syz.3.400" name="functions" dev="configfs" ino=14858 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 273.893297][ T7474] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 273.962204][ T7485] Config c/1 of g1 needs at least one function. [ 273.962455][ T7485] udc dummy_udc.0: failed to start g1: -22 [ 273.962471][ T7485] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 274.104771][ T7485] UDC core: g1: couldn't find an available UDC or it's busy [ 275.851717][ T31] audit: type=1400 audit(1789736175.063:482): avc: denied { write } for pid=7493 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 275.877927][ T12] IPVS: stop unused estimator thread 0... [ 275.903011][ T7495] fsa4480 0-0042: error -ENODEV: FSA4480 not found [ 275.945216][ T7495] i2c i2c-0: new_device: Instantiated device fsa4480 at 0x42 [ 276.009878][ T31] audit: type=1400 audit(1789736175.223:483): avc: denied { create } for pid=7517 comm="syz.0.407" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 276.120127][ T7239] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 276.158922][ T7239] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 276.162590][ T7239] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 276.192061][ T31] audit: type=1400 audit(1789736175.403:484): avc: denied { write } for pid=7518 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 276.270747][ T7239] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 276.277455][ T7239] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 276.312230][ T7239] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 276.313111][ T7239] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 276.334377][ T7239] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 276.336598][ T5264] 8021q: adding VLAN 0 to HW filter on device eth4 [ 276.349645][ T31] audit: type=1400 audit(1789736175.553:485): avc: denied { write } for pid=7523 comm="syz.1.409" name="control" dev="devtmpfs" ino=1266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 276.398017][ T7524] device-mapper: table: 248:0: zero-length target [ 276.398040][ T7524] device-mapper: ioctl: error adding target to table [ 276.843940][ T7538] ipt_REJECT: TCP_RESET invalid for non-tcp [ 276.969539][ T31] audit: type=1400 audit(1789736176.113:486): avc: denied { map } for pid=7531 comm="syz.0.410" path="socket:[15111]" dev="sockfs" ino=15111 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 277.242090][ T7239] 8021q: adding VLAN 0 to HW filter on device bond0 [ 277.276695][ T7544] loop0: detected capacity change from 0 to 262144 [ 277.314129][ T7544] loop1: detected capacity change from 0 to 262144 [ 277.339920][ T7239] 8021q: adding VLAN 0 to HW filter on device team0 [ 277.384329][ T7544] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 277.398406][ T6241] bridge0: port 1(bridge_slave_0) entered blocking state [ 277.398511][ T6241] bridge0: port 1(bridge_slave_0) entered forwarding state [ 277.419440][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 277.419575][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 278.738883][ T7559] overlayfs: failed to clone lowerpath [ 278.743794][ T31] audit: type=1400 audit(1789736177.933:487): avc: denied { create } for pid=7553 comm="syz.0.414" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 279.265219][ T7551] md/raid1:md0: active with 2 out of 2 mirrors [ 279.287224][ T7551] md0: detected capacity change from 0 to 262144 [ 279.763393][ T31] audit: type=1400 audit(1789736178.973:488): avc: denied { write } for pid=7542 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 280.121189][ T31] audit: type=1400 audit(1789736179.333:489): avc: denied { write } for pid=7585 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 280.981187][ T5264] 8021q: adding VLAN 0 to HW filter on device eth3 [ 282.589990][ T7618] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 282.720454][ T7239] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 284.376687][ T31] audit: type=1400 audit(1789736183.593:490): avc: denied { connect } for pid=7631 comm="syz.1.431" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 284.573059][ T7239] veth0_vlan: entered promiscuous mode [ 284.610737][ T7239] veth1_vlan: entered promiscuous mode [ 284.632452][ T7659] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 284.758179][ T7239] veth0_macvtap: entered promiscuous mode [ 284.783401][ T7239] veth1_macvtap: entered promiscuous mode [ 285.631030][ T7239] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 285.660177][ T7239] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 285.705568][ T148] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 285.705617][ T148] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 285.705651][ T148] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 285.705685][ T148] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 286.355230][ T6239] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 286.355253][ T6239] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 286.593891][ T31] audit: type=1400 audit(1789736185.793:491): avc: denied { name_connect } for pid=7669 comm="syz.2.442" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 286.665965][ T7675] gfs2: error -5 reading superblock [ 289.442031][ T6236] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 289.442047][ T6236] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 290.170916][ T31] audit: type=1400 audit(1789736189.373:492): avc: denied { mounton } for pid=7239 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 293.291211][ T7707] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 294.154055][ T7707] md/raid:md0: device loop1 operational as raid disk 1 [ 294.154084][ T7707] md/raid:md0: device loop0 operational as raid disk 0 [ 294.440735][ T7707] md/raid:md0: couldn't allocate thread. [ 294.620694][ T7731] xt_nfacct: accounting object `syz0' does not exist [ 294.922988][ T31] audit: type=1400 audit(1789736194.133:493): avc: denied { write } for pid=7708 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 295.072034][ T7707] ============================================================================= [ 295.072053][ T7707] BUG raid5-md0 (Not tainted): Objects remaining on __kmem_cache_shutdown() [ 295.072071][ T7707] ----------------------------------------------------------------------------- [ 295.072071][ T7707] [ 295.073024][ T7707] Object 0xffff888057928000 @offset=0 [ 295.073045][ T7707] Object 0xffff8880579284d8 @offset=1240 [ 295.073058][ T7707] Object 0xffff8880579289b0 @offset=2480 [ 295.073070][ T7707] Object 0xffff888057928e88 @offset=3720 [ 295.073083][ T7707] Slab 0xffffea00015e4a00 objects=13 used=4 fp=0xffff888057929360 flags=0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 295.073126][ T7707] Disabling lock debugging due to kernel taint [ 295.073271][ T7707] ------------[ cut here ]------------ [ 295.073275][ T7707] 1 [ 295.073279][ T7707] WARNING: mm/slub.c:1268 at __slab_err+0x15/0x20, CPU#1: syz.5.341/7707 [ 295.161633][ T7707] Modules linked in: [ 295.165539][ T7707] CPU: 1 UID: 0 PID: 7707 Comm: syz.5.341 Tainted: G B syzkaller #0 PREEMPT(full) [ 295.176577][ T7707] Tainted: [B]=BAD_PAGE [ 295.180737][ T7707] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 295.190886][ T7707] RIP: 0010:__slab_err+0x15/0x20 [ 295.195848][ T7707] Code: 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 e8 5b fd ff ff be 01 00 00 00 bf 05 00 00 00 e8 cc 00 a4 00 90 <0f> 0b 90 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 [ 295.215545][ T7707] RSP: 0018:ffffc9000590f848 EFLAGS: 00010087 [ 295.221623][ T7707] RAX: 0000000000018621 RBX: ffffc9000590f898 RCX: ffffc9001b88d000 [ 295.229618][ T7707] RDX: 0000000000080000 RSI: ffffffff81c8525d RDI: ffff8880345dcb00 [ 295.237602][ T7707] RBP: ffff88802bcf4e58 R08: 0000000000000007 R09: 0000000000000000 [ 295.245604][ T7707] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000003a20 [ 295.253594][ T7707] R13: ffff88805792bef8 R14: ffff88802bcf4e40 R15: ffffea00015e4a00 [ 295.261561][ T7707] FS: 00007f59187af6c0(0000) GS:ffff888123c58000(0000) knlGS:0000000000000000 [ 295.270490][ T7707] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 295.277065][ T7707] CR2: 000055832e4abef8 CR3: 000000002274c000 CR4: 00000000003526f0 [ 295.285022][ T7707] Call Trace: [ 295.288287][ T7707] [ 295.291210][ T7707] __kmem_cache_shutdown.cold+0x16e/0x177 [ 295.296934][ T7707] kmem_cache_destroy+0x7d/0x1a0 [ 295.301870][ T7707] free_conf+0x1cb/0x710 [ 295.306121][ T7707] setup_conf+0xd80/0x2a20 [ 295.310543][ T7707] ? __pfx_setup_conf+0x10/0x10 [ 295.315821][ T7707] ? _raw_spin_unlock+0x28/0x50 [ 295.320660][ T7707] ? get_pers+0x227/0x2e0 [ 295.324968][ T7707] ? __pfx_get_pers+0x10/0x10 [ 295.329623][ T7707] ? __pfx_kstrtoll+0x10/0x10 [ 295.334297][ T7707] raid5_takeover+0x2b3/0x590 [ 295.338970][ T7707] ? __pfx_raid5_takeover+0x10/0x10 [ 295.344182][ T7707] level_store+0x890/0x1f60 [ 295.348693][ T7707] ? __pfx_level_store+0x10/0x10 [ 295.353631][ T7707] ? lock_acquire+0x1d1/0x380 [ 295.358301][ T7707] ? do_raw_spin_lock+0x128/0x260 [ 295.363326][ T7707] ? find_held_lock+0x2b/0x80 [ 295.368008][ T7707] ? md_attr_store+0x195/0x330 [ 295.372760][ T7707] ? md_attr_store+0x195/0x330 [ 295.377510][ T7707] md_attr_store+0x1c5/0x330 [ 295.382098][ T7707] ? __pfx_md_attr_store+0x10/0x10 [ 295.387192][ T7707] sysfs_kf_write+0xf2/0x150 [ 295.391770][ T7707] kernfs_fop_write_iter+0x3e0/0x5f0 [ 295.397048][ T7707] ? __pfx_sysfs_kf_write+0x10/0x10 [ 295.402232][ T7707] vfs_write+0x6af/0x1050 [ 295.406552][ T7707] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 295.412360][ T7707] ? __pfx_vfs_write+0x10/0x10 [ 295.417115][ T7707] ? find_held_lock+0x2b/0x80 [ 295.421803][ T7707] ksys_write+0x12a/0x250 [ 295.426115][ T7707] ? __pfx_ksys_write+0x10/0x10 [ 295.430965][ T7707] do_syscall_64+0x123/0x790 [ 295.435551][ T7707] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 295.441435][ T7707] RIP: 0033:0x7f591799e159 [ 295.445842][ T7707] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 295.465439][ T7707] RSP: 002b:00007f59187af028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 295.473836][ T7707] RAX: ffffffffffffffda RBX: 00007f5917c25fa0 RCX: 00007f591799e159 [ 295.481822][ T7707] RDX: 0000000000000005 RSI: 0000200000000300 RDI: 0000000000000005 [ 295.489807][ T7707] RBP: 00007f5917a3506b R08: 0000000000000000 R09: 0000000000000000 [ 295.497787][ T7707] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 295.505767][ T7707] R13: 00007f5917c26038 R14: 00007f5917c25fa0 R15: 00007ffea9b91a78 [ 295.513732][ T7707] [ 295.516736][ T7707] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 295.523998][ T7707] CPU: 1 UID: 0 PID: 7707 Comm: syz.5.341 Tainted: G B syzkaller #0 PREEMPT(full) [ 295.534767][ T7707] Tainted: [B]=BAD_PAGE [ 295.538910][ T7707] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 295.549060][ T7707] Call Trace: [ 295.552346][ T7707] [ 295.555298][ T7707] dump_stack_lvl+0x100/0x190 [ 295.560022][ T7707] vpanic+0x553/0x970 [ 295.563990][ T7707] ? __pfx_vpanic+0x10/0x10 [ 295.568489][ T7707] ? lock_release+0x24d/0x310 [ 295.573165][ T7707] panic+0xd1/0xe0 [ 295.576893][ T7707] ? __pfx_panic+0x10/0x10 [ 295.581300][ T7707] check_panic_on_warn.cold+0x19/0x34 [ 295.586656][ T7707] ? __slab_err+0x15/0x20 [ 295.590980][ T7707] __warn.cold+0x191/0x318 [ 295.595388][ T7707] __report_bug+0x30f/0x440 [ 295.599895][ T7707] ? __slab_err+0x15/0x20 [ 295.604220][ T7707] ? __pfx___report_bug+0x10/0x10 [ 295.609245][ T7707] ? irq_work_queue+0xd1/0x100 [ 295.614271][ T7707] ? __wake_up_klogd+0xe5/0x140 [ 295.619110][ T7707] ? vprintk_emit+0x1c9/0x6b0 [ 295.623777][ T7707] ? __pfx_vprintk_emit+0x10/0x10 [ 295.628801][ T7707] ? __pfx_vprintk_emit+0x10/0x10 [ 295.633810][ T7707] ? __slab_err+0x15/0x20 [ 295.638121][ T7707] report_bug+0xb3/0x220 [ 295.642449][ T7707] ? __slab_err+0x15/0x20 [ 295.646810][ T7707] handle_bug+0x16a/0x2a0 [ 295.651129][ T7707] exc_invalid_op+0x17/0x50 [ 295.655623][ T7707] asm_exc_invalid_op+0x1a/0x20 [ 295.660462][ T7707] RIP: 0010:__slab_err+0x15/0x20 [ 295.665391][ T7707] Code: 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 e8 5b fd ff ff be 01 00 00 00 bf 05 00 00 00 e8 cc 00 a4 00 90 <0f> 0b 90 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 [ 295.684986][ T7707] RSP: 0018:ffffc9000590f848 EFLAGS: 00010087 [ 295.691041][ T7707] RAX: 0000000000018621 RBX: ffffc9000590f898 RCX: ffffc9001b88d000 [ 295.699028][ T7707] RDX: 0000000000080000 RSI: ffffffff81c8525d RDI: ffff8880345dcb00 [ 295.706996][ T7707] RBP: ffff88802bcf4e58 R08: 0000000000000007 R09: 0000000000000000 [ 295.714978][ T7707] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000003a20 [ 295.722947][ T7707] R13: ffff88805792bef8 R14: ffff88802bcf4e40 R15: ffffea00015e4a00 [ 295.730923][ T7707] ? add_taint+0x6d/0xb0 [ 295.735249][ T7707] ? __slab_err+0x14/0x20 [ 295.739556][ T7707] __kmem_cache_shutdown.cold+0x16e/0x177 [ 295.745277][ T7707] kmem_cache_destroy+0x7d/0x1a0 [ 295.750237][ T7707] free_conf+0x1cb/0x710 [ 295.754491][ T7707] setup_conf+0xd80/0x2a20 [ 295.758897][ T7707] ? __pfx_setup_conf+0x10/0x10 [ 295.763740][ T7707] ? _raw_spin_unlock+0x28/0x50 [ 295.768596][ T7707] ? get_pers+0x227/0x2e0 [ 295.772919][ T7707] ? __pfx_get_pers+0x10/0x10 [ 295.777571][ T7707] ? __pfx_kstrtoll+0x10/0x10 [ 295.782250][ T7707] raid5_takeover+0x2b3/0x590 [ 295.786912][ T7707] ? __pfx_raid5_takeover+0x10/0x10 [ 295.792095][ T7707] level_store+0x890/0x1f60 [ 295.796581][ T7707] ? __pfx_level_store+0x10/0x10 [ 295.801511][ T7707] ? lock_acquire+0x1d1/0x380 [ 295.806167][ T7707] ? do_raw_spin_lock+0x128/0x260 [ 295.811192][ T7707] ? find_held_lock+0x2b/0x80 [ 295.815855][ T7707] ? md_attr_store+0x195/0x330 [ 295.820601][ T7707] ? md_attr_store+0x195/0x330 [ 295.825352][ T7707] md_attr_store+0x1c5/0x330 [ 295.829936][ T7707] ? __pfx_md_attr_store+0x10/0x10 [ 295.835028][ T7707] sysfs_kf_write+0xf2/0x150 [ 295.839598][ T7707] kernfs_fop_write_iter+0x3e0/0x5f0 [ 295.844861][ T7707] ? __pfx_sysfs_kf_write+0x10/0x10 [ 295.850042][ T7707] vfs_write+0x6af/0x1050 [ 295.854364][ T7707] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 295.860158][ T7707] ? __pfx_vfs_write+0x10/0x10 [ 295.864921][ T7707] ? find_held_lock+0x2b/0x80 [ 295.869608][ T7707] ksys_write+0x12a/0x250 [ 295.873920][ T7707] ? __pfx_ksys_write+0x10/0x10 [ 295.878749][ T7707] do_syscall_64+0x123/0x790 [ 295.883333][ T7707] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 295.889206][ T7707] RIP: 0033:0x7f591799e159 [ 295.893601][ T7707] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 295.913274][ T7707] RSP: 002b:00007f59187af028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 295.921683][ T7707] RAX: ffffffffffffffda RBX: 00007f5917c25fa0 RCX: 00007f591799e159 [ 295.929638][ T7707] RDX: 0000000000000005 RSI: 0000200000000300 RDI: 0000000000000005 [ 295.937589][ T7707] RBP: 00007f5917a3506b R08: 0000000000000000 R09: 0000000000000000 [ 295.945555][ T7707] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 295.953516][ T7707] R13: 00007f5917c26038 R14: 00007f5917c25fa0 R15: 00007ffea9b91a78 [ 295.961502][ T7707] [ 295.964759][ T7707] Kernel Offset: disabled [ 295.969094][ T7707] Rebooting in 86400 seconds..